145 releases 145 tags

RSS feed

• v1.12.1 9c1b230aa0

  Compare

  Morphit v1.12.1 Stable

  agorise released this 2026-08-15 07:01:52 +00:00 | 22 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.1

  Theme: make the hidden RPC layer robust and honest. A stable i2pd that installs itself correctly and self-heals, a node card that shows real latency for the Tor/I2P nodes and reads calmly when a transport isn't enabled, and automatic use of a Blurt node running on the same box.

  Added

  Automatically uses a Blurt node running on the same machine. If you run a Blurt RPC node (for example the hidden-rpc package) on the same server as your Morphit instance, the indexer now detects it on the standard loopback port at startup and reads the chain from it directly — instant, private, and the read never leaves the machine — with no configuration at all. It shows on the RPC endpoints card as a Local node at near-zero latency. Opt out with MORPHIT_INDEXER_LOCAL_RPC_AUTODETECT=false.

  The node card fills in Tor/I2P latency on its own. The RPC endpoints card now runs a quiet check right after it loads, so the hidden nodes show their real latency without you having to press refresh.

  Changed

  i2pd now installs from the maintained upstream build — not the crash-prone distro one. The version of i2pd in Ubuntu's default repositories crash-loops on startup on some systems (a corrupt-database abort a few seconds in). Both the standard install and the offline bundle now use the maintained purplei2p build instead, and an install will upgrade a node that's already stuck on the broken version. This is why some nodes' I2P addresses were unreachable; they now come up and stay up.

  Clearer wording on the RPC endpoints card: "The nodes that this Morphit site talks to for syncing blockchain data, trying them in order of privacy and fastest response."

  Fixed

  Hidden nodes read calmly when a transport isn't enabled — no scary red errors. If your instance doesn't have Tor or I2P running, the baked-in hidden nodes now show a muted "Requires Tor/I2P (not enabled on this instance)" instead of an alarming red "connection refused." A node that's genuinely down still shows a normal error; this only softens the "this instance simply hasn't turned that transport on" case, so the layer reads as intentional rather than broken.

  Tor and i2pd recover on their own if they crash. Both now install with a restart-on-failure policy (with a bounded retry budget so a persistent problem doesn't spin), so a transient daemon crash no longer silently takes the hidden layer down until someone notices.

  Notes

  • No database migration in this release.
  • The i2pd change means a node that was on the broken build gets upgraded on the next install/upgrade; existing healthy nodes are unaffected.
  • Everything hidden-service related remains fail-safe: an instance without Tor/i2pd falls back to clearnet, and the local/auto-detect behavior is opt-out.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    5 downloads · 2026-08-15 07:39:11 +00:00 · 1 KiB
  • morphit-v1.12.1-offline.tar.gz
    2 downloads · 2026-08-15 07:39:25 +00:00 · 698 MiB
  • morphit-v1.12.1-offline.tar.gz.sha256
    2 downloads · 2026-08-15 07:39:25 +00:00 · 97 B
  • morphit-v1.12.1.tar.gz
    3 downloads · 2026-08-15 07:39:10 +00:00 · 12 MiB
  • morphit-v1.12.1.tar.gz.sha256
    3 downloads · 2026-08-15 07:39:10 +00:00 · 89 B
• v1.12.0 cdea1d62c4

  Compare

  Morphit v1.12.0 Stable

  agorise released this 2026-08-15 01:59:26 +00:00 | 23 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.12.0

  Theme: the privacy RPC layer grows up. Your node can now read the chain from a node running on the same box (instant, and the read never leaves the machine), the network of censorship-resistant RPC nodes publishes itself on-chain so every instance adopts new ones automatically, and morphit-ops shows the health of every RPC node — not just a count. Plus a round of install fixes from a real from-scratch field test.

  Added

  Read the chain from a node on the same machine — instant, and it never leaves the box. If you run a Blurt RPC node (for example the hidden-rpc package) on the same server as your Morphit instance, point the indexer at it over loopback (MORPHIT_INDEXER_LOCAL_RPC_ENDPOINTS=http://127.0.0.1:8091) and it becomes your fastest, most private chain source: no network hop, no IP exposure, near-zero latency. Clearnet and hidden nodes stay as fallback. Only loopback addresses are accepted, so the setting can never be pointed at an outside host.

  An on-chain directory of privacy RPC nodes — self-adopted, no config edit. The project publishes the canonical list of public hidden-service (.onion / .b32.i2p) RPC nodes as a signed on-chain record; every trusting indexer reads it and merges those nodes into its pool automatically. A vetted node added to the directory reaches the whole network with no code change and no per-operator edit, and the directory now persists across restarts. The record is only honoured when its signer and on-chain key match the pinned project values, so a forged directory can't inject hostile nodes.

  The public hidden nodes now show on every instance. The Settings → RPC endpoints card shows the project's public hidden-service nodes — badged Tor / I2P — on every install, not just Ansible ones, so the censorship-resistant layer is visible everywhere. An instance without Tor/i2pd simply shows them unreachable; clearnet still carries all traffic.

  morphit-ops health now breaks out every RPC endpoint. Under the Blurt RPC: N/M reachable line it now lists each node with its transport (clearnet / Tor / I2P / local), a shortened address, latency, and reachability — so you can see at a glance which nodes are up, including the hidden ones, instead of just a count.

  Fixed

  The first backup actually runs on a fresh Ansible install. Two stacked bugs stopped it: the backup service's writable-path setting didn't match the install's data directory (failing with a mount-namespace error before the script even ran), and the backup authenticated to Postgres the wrong way for the Ansible layout. Both are fixed — a fresh node now writes its first dump a couple of minutes after setup, and morphit-ops shows a real backup.

  The warrant canary sets itself up on a root install. The canary setup only tried a per-user timer, which a root (sudo) install can't use, so it silently fell back to a manual step that was easy to miss. It now installs a proper system timer when run as root, so the canary publishes and refreshes itself automatically.

  The install wizard reads like a smooth success — no scary words. On a normal (and especially an offline) install, a few things looked alarming even though nothing was wrong: a couple of internal task names contained the word "Fail," the post-install checklist showed red ✗ marks for pieces that were merely still starting (RPC connectivity, the HTTPS certificate, the canary), and a firewall reminder said a setting was "wrong." All reframed — task names say "Verify…," pending items show a calm "still starting" rather than a failure, and the reminder is now an optional "if you ever notice…" note.

  /v1/health and morphit-ops health now agree about the relay. On a containerized deployment the public health endpoint could report the relay down while the local check saw it up. The indexer now probes the relay at the container's gateway address (where a containerized relay actually binds), so the two agree.

  Hidden RPC nodes are no longer undercounted while they warm up. The health probe used one short timeout for every node, which is fine for clearnet but too short for Tor and I2P (which take longer to connect, especially on a fresh node). Tor and I2P nodes now get a longer, transport-appropriate window, so healthy-but-slow hidden nodes are counted correctly.

  Notes

  • New database migration (adds a small table to persist the RPC directory). No breaking changes.
  • Everything hidden-service related is fail-safe: an instance without Tor/i2pd simply falls back to clearnet, and the local/loopback and hidden-node settings are opt-in and overridable.

  Downloads

  • Source code (ZIP)
    2 downloads
  • Source code (TAR.GZ)
    2 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-08-15 02:35:21 +00:00 · 1 KiB
  • morphit-v1.12.0-offline.tar.gz
    2 downloads · 2026-08-15 02:35:42 +00:00 · 736 MiB
  • morphit-v1.12.0-offline.tar.gz.sha256
    3 downloads · 2026-08-15 02:35:43 +00:00 · 97 B
  • morphit-v1.12.0.tar.gz
    4 downloads · 2026-08-15 02:35:21 +00:00 · 12 MiB
  • morphit-v1.12.0.tar.gz.sha256
    5 downloads · 2026-08-15 02:35:21 +00:00 · 89 B
• v1.11.4 1c807c2edd

  Compare

  Morphit v1.11.4 Stable

  agorise released this 2026-08-14 18:51:44 +00:00 | 24 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.11.4

  Theme: reading the chain without depending on the clear net. A Morphit node can now reach Blurt RPC over Tor and I2P, cross-checks what it reads across independent nodes, and — on Tor Browser — even verifies its own release without a visitor's IP ever touching the clear net. Plus a smoother first install and a round of polish.

  Added

  Censorship-resistant chain reads over Tor and I2P. Your indexer can now read the Blurt chain through hidden-service RPC nodes (.onion / .b32.i2p) in addition to the usual clearnet pool. Clearnet stays primary (it's faster), with the hidden nodes serving as a censorship-resistant fallback — if the clearnet RPC nodes are ever blocked, your node keeps reading the chain over Tor/I2P. On a standard install (which already runs Tor and i2pd), this turns on automatically: the installer seeds the hidden pool for you, so there's nothing to hand-edit. A node without Tor/i2pd is unaffected and stays clearnet-only.

  Your node cross-checks the chain data it's given. Reaching a node over Tor/I2P hides where you read, not whether what you read is true — so a node you don't control could lie about the chain. Every few minutes your indexer now asks several independent RPC nodes for the same finalised block and confirms they agree on it before trusting it. A disagreement (a node serving a forged or forked chain) is logged loudly; agreement is silent. This runs across both clearnet and hidden nodes, so it protects your reads regardless of transport, and never blocks indexing.

  Privacy-first release verification. Every Morphit page verifies, straight from the chain, that the instance is serving the exact official release. That one check is the single time your browser talks to a Blurt node directly. It now tries a hidden-service node first: on Tor Browser (or with an I2P proxy) that verification rides the hidden network and no clearnet node ever sees your IP. On an ordinary browser it falls back to a clearnet node exactly as before.

  Hidden nodes show on the Settings → RPC endpoints card. The card now badges each node by how your instance reaches it — Tor, I2P, or clearnet — so you can see at a glance that your pool spans censorship-resistant transports.

  Fixed

  The first backup now runs at install. The installer set up the daily backup timer but didn't take the first dump, so morphit-ops health showed a "no backup has ever run" warning until the next daily cycle. It now takes one backup immediately after setup, so you see a real backup on day one.

  Your warrant canary publishes soon after the box is online, not a week later. On an offline/air-gapped install the first canary publish is deferred until the box has internet — but the only thing that published it was the weekly timer, so it could sit missing for days. It now also refreshes a few minutes after the machine boots, so the deferred first canary appears the first time the box is online, as promised.

  The Matrix alert bot installs even before you have a token. Setting up alerts required pasting a bot access token during the install, and there was no guidance on how to get one — so choosing alerts without a token left the bot uninstalled. Now the wizard explains exactly how to obtain a bot token, and if you don't have one yet it offers to install the bot anyway, fully staged and ready. morphit-ops health then shows "token needed" (instead of "not installed"), and you add the token any time with morphit-ops → Matrix alerts — no reinstall.

  A clearer message when there's no HTTPS certificate. The health line for a missing certificate now explains why: a clearnet node must be reachable from the internet on ports 80/443 for the certificate challenge, so a home/CGNAT connection can't get one (use Tor-only mode there), while a Tor-only node needs no certificate at all.

  "About this instance" polish. The git commit is shown as the full hash in one clean line; the Matrix group-chat link now opens your own Matrix client directly (no third-party redirect, no encoded characters); and every card's columns line up.

  The compare page can fetch order books again. A too-large request meant both order books failed with a "must be less than or equal to 100" error; the request now stays within the limit.

  A quieter install. npm's "a new version of npm is available" banner no longer prints at the end of the setup wizard.

  Notes

  • No database migrations. No breaking changes.
  • Hidden-service chain reads are opt-out (empty the endpoint list to disable) and fail safe: if Tor/i2pd or a hidden node is unreachable, your node simply uses the clearnet pool.
  • Clearnet-only nodes behave exactly as before — the hidden-service routing is installed only when hidden endpoints are configured.

  Downloads

  • Source code (ZIP)
    2 downloads
  • Source code (TAR.GZ)
    2 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-08-14 19:27:46 +00:00 · 1 KiB
  • morphit-v1.11.4-offline.tar.gz
    3 downloads · 2026-08-14 19:28:03 +00:00 · 736 MiB
  • morphit-v1.11.4-offline.tar.gz.sha256
    3 downloads · 2026-08-14 19:28:04 +00:00 · 97 B
  • morphit-v1.11.4.tar.gz
    4 downloads · 2026-08-14 19:27:46 +00:00 · 12 MiB
  • morphit-v1.11.4.tar.gz.sha256
    4 downloads · 2026-08-14 19:27:46 +00:00 · 89 B
• v1.11.3 a2f986d8f1

  Compare

  Morphit v1.11.3 Stable

  agorise released this 2026-08-13 06:09:04 +00:00 | 25 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.11.3

  Theme: a calmer, clearer install. The setup wizard reads like a smooth, successful setup — even with the network unplugged — and it can now turn on alerts for you. Plus: you can switch a node between Tor-only and clearnet whenever you like.

  Added

  Set up alerts right from the install wizard. The guided install now asks — right after the Matrix-contact question — whether you'd like your node to message you on Matrix when something needs attention (low disk, a backup that didn't run, a service down, a TLS certificate nearing expiry). Paste a bot account's access token and the personal @you:server address to alert, and alerting comes on by default: the Matrix bot plus the disk, SMART, package, and service monitors (and certificate-expiry monitoring on a clearnet node) all start together. Don't have a bot token handy? Press Enter to skip and turn it on any time later with morphit-ops matrix. Alerts only ever go to a private @user:server, never a #room.

  A documented way to switch a node between Tor-only and clearnet. A node that started Tor-only can gain a clearnet domain later, and a clearnet node can drop back to Tor-only — either direction, as often as you like. Re-run the guided install and pick the other mode: your database, keys, and existing .onion address are all preserved, the clearnet web front and certificate are added or dropped automatically, and your on-chain registration re-publishes with the new address. See the new "Switching between Tor-only and clearnet" section in RUN-A-MORPHIT-NODE.md.

  Fixed

  The setup wizard no longer looks alarming. On a normal install — and especially an offline or air-gapped one — the wizard used to surface a lot of noise that read like failures even though the install succeeded. That's cleaned up across the board:

  • Benign system messages that read like errors ("Permission denied" while setting up temporary directories, an unsandboxed-apt notice, a harmless collection-download message) no longer appear.
  • The check that confirms your site serves fresh updates no longer prints a wall of "retrying" lines followed by a warning; it reports a single calm status line, and is skipped with a friendly note when the box is offline.
  • A successful container build is no longer labelled as a "warning."
  • The warrant-canary and privacy-address (Tor/I2P) steps explain themselves plainly instead of using alarming technical wording — and on an offline box, the canary clearly says it will publish itself automatically once the box is online, rather than looking like a failure.
  • The closing "no alerting" notice is now a short, calm, optional suggestion — and doesn't appear at all when you set up alerts during the install.
  • Assorted wording that leaned on the word "fail" has been softened where nothing had actually failed.

  /v1/health now agrees with morphit-ops health about the relay. On a containerized deployment the relay binds to the Docker bridge gateway (so the web container can reach it), not to loopback — and the indexer's public /v1/health was probing loopback only, so it reported the relay down even while the local health view (which also tries the bridge gateway) showed it up. The public health check now tries the same addresses, so the two agree.

  A crash-looping service no longer looks like it's just "starting." morphit-ops health read only a unit's top-level state, so a service that was failing and being auto-restarted (for example, a Matrix bot with a bad token or an unreachable homeserver) showed as a calm "starting" indefinitely. It now recognises the restart loop and reports it as failed, with a pointer to journalctl -u <unit> so you can see why.

  Notes

  • No database migrations. No breaking changes.
  • Switching a node's mode, and setting up alerts, are both non-destructive and fully reversible.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-13 06:44:47 +00:00 · 1 KiB
  • morphit-v1.11.3-offline.tar.gz
    1 download · 2026-08-13 06:45:03 +00:00 · 736 MiB
  • morphit-v1.11.3-offline.tar.gz.sha256
    0 downloads · 2026-08-13 06:45:04 +00:00 · 97 B
  • morphit-v1.11.3.tar.gz
    2 downloads · 2026-08-13 06:44:47 +00:00 · 12 MiB
  • morphit-v1.11.3.tar.gz.sha256
    2 downloads · 2026-08-13 06:44:47 +00:00 · 89 B
• v1.11.2 36ef473e2b

  Compare

  Morphit v1.11.2 Stable

  agorise released this 2026-08-12 20:24:04 +00:00 | 26 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.11.2

  Theme: more places to find the source, a licence tag that finally matches the licence, quieter upgrades, and an easy on-ramp for making your own instance your own.

  Added

  Nine more independent source mirrors. The signed source is now pushed to nine additional git hosts — gitgud.io, forge.chapril.org, git.disroot.org, git.kaki87.net, codefloe.com, git.gay, bolha.dev, opencommit.eu, and sij.ai — bringing the download page and the on-chain distribution record to eighteen mirrors in total. More independent copies means the code is that much harder to take offline: blocking any one host does nothing when seventeen others still serve the same GPG-signed bytes.

  A clear guide to rebranding your own instance. New guidance — in the run-a-node walkthrough and a new FAQ entry (in all ten languages) — walks through making a Morphit instance your own. Swapping the logo, colours, name, and wording needs no programming at all; deeper layout changes use SvelteKit. It recommends the free Visual Studio Code editor with the "Svelte for VS Code" extension and a live-reload preview, and links the official Svelte tutorial for anyone starting from scratch.

  Fixed

  Quieter, less alarming upgrades. morphit-ops upgrade no longer surfaces two benign, unactionable messages that made a successful upgrade look uncertain: a build-tool note about the page fallback, and a "could not auto-verify the served frontend" line that appeared on nodes (like Tor-only or home boxes) that simply can't reach their own public URL to check. The upgrade still reports real problems loudly.

  Notes

  • No database migrations. No breaking changes.
  • Licence metadata now reads AGPL-3.0-or-later — matching what the LICENSE file itself has always granted ("version 3 … or, at your option, any later version"). Nothing about your rights changes; the SPDX tag simply now agrees with the licence text. (This also lets the project list on source-hosting sites that require future-GPL compatibility.) Cosmetic rebrands remain fully allowed — the only rule is that a modified public instance must offer its changed source to its users.
  • Operators on older versions: this release records eighteen mirrors on-chain, more than the previous limit. An instance still running v1.11.1 or earlier will not accept this release's on-chain announcement until it upgrades — the canonical instance upgrades first, exactly as every release ceremony already does. Existing releases keep working on older instances until each one upgrades.
  • Housekeeping: removed a redundant CI workflow (the offline install bundle is already built and attached automatically with every release).

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    2 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-12 21:00:42 +00:00 · 1 KiB
  • morphit-v1.11.2-offline.tar.gz
    1 download · 2026-08-12 21:00:55 +00:00 · 731 MiB
  • morphit-v1.11.2-offline.tar.gz.sha256
    0 downloads · 2026-08-12 21:00:55 +00:00 · 97 B
  • morphit-v1.11.2.tar.gz
    2 downloads · 2026-08-12 21:00:42 +00:00 · 12 MiB
  • morphit-v1.11.2.tar.gz.sha256
    2 downloads · 2026-08-12 21:00:42 +00:00 · 89 B
• v1.11.1 7c1c3bb332

  Compare

  Morphit v1.11.1 Stable

  agorise released this 2026-08-12 01:35:29 +00:00 | 27 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.11.1

  Theme: quiet durability. A node self-heals operator registrations that a past bug wrongly rejected, the health disk figure watches the volume that actually fills, and an offline install stops looking like a failure. No new features, no breaking changes — just fewer sharp edges.

  Added

  Nodes now self-heal operator registrations that were wrongly rejected. If a past validator bug caused your indexer to reject a valid operator registration (for example, the regional-brand-name and Persian-name bugs fixed in earlier releases), that registration used to stay rejected forever — the only fix was to broadcast it again. On the next restart after upgrading, the indexer now automatically replays the registrations it had recorded as rejected and applies any that are valid under the current rules. It only ever re-applies registrations — never payments, orders, or feedback — so there's no risk of double-counting, and it does nothing at all when there's nothing to heal.

  The health "disk" figure now watches the volume that actually fills. On a machine where your data lives on a separate drive from the operating system, the disk number in morphit-ops health and /v1/health used to report the system drive — which could look comfortable while your data volume was nearly full. It now measures the filesystem holding your data (the database and chain index). On a normal single-drive box nothing changes; if your data is on its own mount, point MORPHIT_HEALTH_DISK_PATH at it (the guided installer does this for you). See docs/OPERATIONS.md.

  Fixed

  An offline or air-gapped install no longer looks like it failed. When you install with no internet on the box, the setup wizard can't reach Blurt to double-check your operator account name — which is completely expected. Instead of an alarming "Could not reach any Blurt RPC" warning, it now says plainly that there's no connection right now and that your node will verify the account by itself the first time it comes online. A genuine error still shows the specific problem.

  Notes

  • No database migrations. No breaking changes. Nothing about the on-chain format changed.
  • The registration self-heal is automatic and safe to run. It happens once, in the background, when the indexer starts; it's a no-op on a healthy node and never touches non-registration data.
  • Internal tidy-up. The IPFS/IPNS seeding health decision now lives in one shared place instead of two, so the operator health view and the public health endpoint can't drift apart. No visible change.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    2 downloads · 2026-08-12 02:14:04 +00:00 · 1 KiB
  • morphit-v1.11.1-offline.tar.gz
    3 downloads · 2026-08-12 02:14:20 +00:00 · 736 MiB
  • morphit-v1.11.1-offline.tar.gz.sha256
    0 downloads · 2026-08-12 02:14:20 +00:00 · 97 B
  • morphit-v1.11.1.tar.gz
    2 downloads · 2026-08-12 02:14:04 +00:00 · 12 MiB
  • morphit-v1.11.1.tar.gz.sha256
    2 downloads · 2026-08-12 02:14:04 +00:00 · 89 B
• v1.11.0 586271574d

  Compare

  Morphit v1.11.0 Stable

  agorise released this 2026-08-11 03:44:52 +00:00 | 28 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.11.0

  Theme: run a marketplace with no clearnet domain at all — reachable purely over Tor and I2P, listed in the federated directory, registered on-chain by its .onion. Maximum privacy, zero paperwork.

  Added

  Tor-only nodes: a full marketplace with no domain, no certificate, no port-forward. When the setup wizard asks how people will reach your marketplace, you can now choose Tor-only instead of a clearnet web address. The node then runs with no domain to buy, no HTTPS certificate to obtain, no router port to forward, and no dynamic DNS — it's reachable at an auto-generated Tor .onion (and, when i2pd is installed, its I2P address too). It registers itself on the federated directory by that onion and advertises it as its on-chain address automatically. This is the strongest posture Morphit offers: there is no domain to seize, no certificate authority in the trust path, and nothing inbound to firewall. The wizard is a few questions shorter, too. You can add a clearnet domain later without losing the onion — see docs/OPERATIONS.md.

  The federated directory now shows real, live status for hidden-service nodes. An indexer that runs Tor now probes .onion (and I2P) peers through its own Tor/I2P proxy, so their directory status reflects whether they're actually up — not just that they registered. If your own Tor happens to be off, a healthy hidden peer is simply listed rather than wrongly marked unreachable.

  Hidden-service nodes are labelled "No clearnet reliance" in the directory. A node with no clearnet domain shows that plainly on its directory card and always links to an address that actually works (its onion or I2P name), instead of displaying a bare, un-clickable hostname.

  An Onion-Location header for clearnet visitors. A node that also serves a clearnet site now advertises its .onion via the standard Onion-Location header, so Tor Browser and Brave offer visitors the onion automatically.

  A quieter "install this app" prompt. The web app now offers a native install banner on supported devices.

  Fixed

  The relay's health now reports correctly in a node's own status. A default configuration gap could make a perfectly healthy relay show as down in a node's health report. It now points at the right internal health URL by default.

  The post-install reachability self-check no longer runs when it can't. The clearnet reachability probe added in v1.10.10 is now correctly skipped on nodes where it doesn't apply (Tor-only, and offline installs), instead of reporting a confusing failure.

  Small polish to the setup review and the warrant-canary question. The final review step now reads in a more natural order, and the canary setup pre-fills your instance address so you don't retype it.

  Notes

  • No database migrations. No breaking changes. Existing clearnet nodes are unaffected.
  • On-chain compatible. Hidden-service registrations use an http://<onion> origin (Tor and I2P encrypt and authenticate at the network layer, so a clearnet TLS certificate is neither obtainable nor meaningful for a .onion). Older indexers that predate this release simply record the registration; upgraded indexers probe it for real status. Nothing about the on-chain format changed for clearnet nodes.
  • Tor-only nodes need Tor running (and i2pd too, if you want an I2P address). The guided installer sets both up for you.
  • If your ISP blocks inbound 80/443, a Tor-only node reaches the world with no port-forwarding at all.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    2 downloads

  ---

  • distribution-anchor.env
    6 downloads · 2026-08-11 04:23:08 +00:00 · 1 KiB
  • morphit-v1.11.0-offline.tar.gz
    1 download · 2026-08-11 04:23:27 +00:00 · 736 MiB
  • morphit-v1.11.0-offline.tar.gz.sha256
    3 downloads · 2026-08-11 04:23:27 +00:00 · 97 B
  • morphit-v1.11.0.tar.gz
    3 downloads · 2026-08-11 04:23:08 +00:00 · 12 MiB
  • morphit-v1.11.0.tar.gz.sha256
    6 downloads · 2026-08-11 04:23:08 +00:00 · 89 B
• v1.10.10 7a84bc325b

  Compare

  Morphit v1.10.10 Stable

  agorise released this 2026-08-10 04:45:29 +00:00 | 30 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.10

  Theme: a true offline install, a home node that tells you the truth about its own reachability, and Tor/I2P that actually serve the marketplace. Hardening from a full second-node bring-up.

  This is a maintenance release. There are no database migrations and no breaking changes.

  Fixed

  Tor (.onion) and I2P (.b32.i2p) now serve the whole marketplace, not a 404. The hidden services were pointed at the sign-up relay, which only answers a few paths, so visiting your .onion returned "not found" for the site and the public API. They now reach the web frontend — the same fan-out clearnet visitors get — so the full site, order book, and read-only API work over Tor and I2P. For a node whose owner can't open clearnet ports (see below), this is the path that reaches the world.

  A truly offline install no longer reaches the internet for git or Ansible. Two pieces were still fetched online during setup — git, and Ansible plus its Galaxy collections. They are now included in the offline bundle and installed from it, so a genuinely air-gapped install completes with the network cable unplugged.

  Backups no longer report a scary "unreadable" on a brand-new node. A freshly installed node hasn't run its first nightly backup yet, so the backup folder doesn't exist. The health check mislabeled that as a permissions error. It now correctly says "no backup yet" and tells you how to run one immediately.

  The warrant canary now lands where the site actually serves it. On a home install the canary was written into the source folder instead of the deployed one, so /canary.txt didn't load. It now goes to the served location, and the weekly auto-refresh follows it there too.

  The setup wizard's step counter ("Step 15 of 14") is fixed. A home install has 15 steps; the counter said 14.

  Added

  A post-install reachability self-check. After a home install, Morphit now checks — from an outside vantage point, using the Tor network it already runs — whether the public internet can actually reach your node on 80/443. Many home ISPs silently block inbound web ports; instead of discovering that hours later via a stale directory listing, you're told immediately and pointed at your .onion, which works regardless.

  Notes

  • No database migrations. No breaking changes.
  • The install sets the machine's timezone to UTC (standard for servers); your local wall-clock time will differ. This is intentional.
  • If your ISP blocks inbound 80/443, your .onion reaches the world with no port-forwarding.

  Downloads

  • Source code (ZIP)
    2 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-08-10 05:25:37 +00:00 · 1 KiB
  • morphit-v1.10.10-offline.tar.gz
    3 downloads · 2026-08-10 05:25:54 +00:00 · 735 MiB
  • morphit-v1.10.10-offline.tar.gz.sha256
    2 downloads · 2026-08-10 05:25:54 +00:00 · 98 B
  • morphit-v1.10.10.tar.gz
    3 downloads · 2026-08-10 05:25:37 +00:00 · 12 MiB
  • morphit-v1.10.10.tar.gz.sha256
    4 downloads · 2026-08-10 05:25:37 +00:00 · 90 B
• v1.10.9 c1f3ecf6a8

  Compare

  Morphit v1.10.9 Stable

  agorise released this 2026-08-09 20:21:01 +00:00 | 31 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.9

  Theme: a clean, trustworthy upgrade. The upgrade output no longer prints alarming-looking (but harmless) warnings that could make a new operator think something went wrong.

  This is a maintenance release. There are no database migrations and no breaking changes.

  Fixed

  No more "getcwd: cannot access parent directories" errors during an upgrade. The upgrade backs up the install directory by renaming it, but the running tool was still "inside" that directory — so every helper it started afterward complained that its working directory had vanished. The upgrade now steps out to a stable directory before the rename, so those errors are gone. (They were always harmless — the upgrade completed correctly — but they read like a broken install.)

  Quieter dependency install. The upgrade's dependency step printed several "npm warn deprecated" lines about third-party packages Morphit doesn't control and an operator can't act on. Those are now suppressed during an upgrade; genuine errors still show. (Developer builds keep the full output.)

  No stray "large chunk" build hint during an upgrade. The frontend build's chunk-size hint — useful when developing, noise when upgrading — is no longer shown during an operator upgrade.

  The "is the new frontend actually being served?" check no longer gives a false "could not verify." That check ran the instant the web container restarted, usually before it had finished coming back up, and reported it couldn't confirm. It now waits and retries briefly, so a successful upgrade reports a clean confirmation instead.

  Notes

  • No database migrations. No breaking changes.
  • These are all cosmetic-output fixes; v1.10.8 upgrades completed correctly despite the noise.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-09 20:57:40 +00:00 · 1 KiB
  • morphit-v1.10.9-offline.tar.gz
    2 downloads · 2026-08-09 20:57:55 +00:00 · 704 MiB
  • morphit-v1.10.9-offline.tar.gz.sha256
    2 downloads · 2026-08-09 20:57:55 +00:00 · 97 B
  • morphit-v1.10.9.tar.gz
    2 downloads · 2026-08-09 20:57:40 +00:00 · 12 MiB
  • morphit-v1.10.9.tar.gz.sha256
    4 downloads · 2026-08-09 20:57:40 +00:00 · 89 B
• v1.10.8 9cb6cfb77b

  Compare

  Morphit v1.10.8 Stable

  agorise released this 2026-08-09 08:26:10 +00:00 | 32 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.8

  Theme: a smooth, honest first install. The security-baseline step no longer stalls the wizard, guided installs on an online box stop showing a false "APT is corrupt" warning, health reporting is fixed and expanded, and the install ends with a single "is everything green?" command.

  This is a maintenance release. There are no database migrations and no breaking changes.

  Fixed

  The filesystem-integrity baseline no longer blocks — or can time out — the install. Building the AIDE baseline fingerprints the whole disk and, on a low-power machine, ran long enough to exceed the install's time budget and fail the whole run. It now builds in the background at idle priority after the install finishes, so the wizard completes quickly and the node starts syncing right away. The build is reboot-safe (an interrupted build never corrupts anything and simply resumes), removes its own one-shot service when finished, and — importantly — a background failure is not silent: it stays visible, logs a high-priority error, and is reported through the operator's alerting.

  No more false "Your APT configuration is corrupt" warning on an online guided install. The offline install bundle used to redirect the system's package manager to its bundled local repository even on a machine that had a working internet connection, which made the OS's Update Manager complain. It now only does that when the machine genuinely can't reach its normal package mirrors; an online install keeps its normal configuration.

  The node-health CPU figure is no longer always blank, and memory reads correctly. A hardening setting on the indexer hid the system files that the health endpoint reads for CPU and memory, so the CPU percentage was permanently blank and memory fell back to a coarse source. The setting has been relaxed just enough to read those system statistics, while still hiding other processes.

  Added

  A one-command health check that actually verifies the install. Node health (option 13 in morphit-ops) now confirms, in one place: the indexer is syncing in parallel across your Blurt RPC nodes, the relay is up, the Matrix alert bot is targeting the address you entered, automated backups are scheduled, the HTTPS/TLS certificate is valid (with days-to-expiry), and the integrity baseline built. The post-install summary now points here first.

  More Blurt account sign-up options are shown during setup.

  Notes

  • No database migrations. No breaking changes.
  • If a guided install previously failed while building the integrity baseline, this release resolves it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-09 09:02:50 +00:00 · 1 KiB
  • morphit-v1.10.8-offline.tar.gz
    1 download · 2026-08-09 09:03:04 +00:00 · 704 MiB
  • morphit-v1.10.8-offline.tar.gz.sha256
    3 downloads · 2026-08-09 09:03:04 +00:00 · 97 B
  • morphit-v1.10.8.tar.gz
    3 downloads · 2026-08-09 09:02:49 +00:00 · 12 MiB
  • morphit-v1.10.8.tar.gz.sha256
    4 downloads · 2026-08-09 09:02:50 +00:00 · 89 B