145 releases 145 tags

RSS feed

• v1.10.7 277a072d7a

  Compare

  Morphit v1.10.7 Stable

  agorise released this 2026-08-09 04:12:55 +00:00 | 33 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.7

  Theme: a smooth first install. This fixes a guided-install failure, clears a false "APT is corrupt" warning on Linux Mint, and makes the long filesystem-baseline step show that it's actually working.

  This is a maintenance release. There are no database migrations and no breaking changes.

  Fixed

  Guided install no longer fails when dynamic DNS is enabled. Several parts of the install place helper scripts in a shared directory, but that directory was only created by an optional step that runs late. If you enabled dynamic DNS, an earlier step tried to write its script before the directory existed and the install stopped with "destination directory does not exist." The shared directory is now created up front, so every part of the install finds it.

  No more false "Your APT configuration is corrupt" warning on Linux Mint. The offline install bundle's local package index was missing a compressed form that newer apt looks for first, which made apt log harmless errors — and Mint's Update Manager reported them as a corrupt configuration. The bundle now ships that compressed index, so apt is quiet and the warning is gone. (Nothing was ever actually broken; the install worked regardless.)

  Changed

  The filesystem-integrity baseline step now shows it's working. Building this baseline fingerprints your entire disk and, on a low-power mini-PC, can take considerably longer than the old "5–15 minutes" estimate — with no output in between, it looked frozen. The step now explains up front that it can take 15–40 minutes on slow hardware, runs in the background, and prints a steady heartbeat so you can see it's still going. (The tool reports no percentage, so it's an elapsed-time heartbeat rather than a true progress bar.)

  A clearer note in the node-operator guide about the download size for a fresh install.

  Notes

  • No database migrations. No breaking changes.
  • If a guided install previously stopped at the dynamic-DNS step, this release resolves it.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    3 downloads · 2026-08-09 04:50:57 +00:00 · 1 KiB
  • morphit-v1.10.7-offline.tar.gz
    2 downloads · 2026-08-09 04:51:10 +00:00 · 704 MiB
  • morphit-v1.10.7-offline.tar.gz.sha256
    2 downloads · 2026-08-09 04:51:10 +00:00 · 97 B
  • morphit-v1.10.7.tar.gz
    3 downloads · 2026-08-09 04:50:57 +00:00 · 12 MiB
  • morphit-v1.10.7.tar.gz.sha256
    3 downloads · 2026-08-09 04:50:57 +00:00 · 89 B
• v1.10.6 9a68e5be8f

  Compare

  Morphit v1.10.6 Stable

  agorise released this 2026-08-08 23:13:49 +00:00 | 34 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.6

  Theme: guided (ansible) installs can upgrade reliably. This fixes a bug where an ansible-installed node's online upgrade could fail whenever a release introduced a new dependency.

  This is a maintenance release. There are no database migrations and no breaking changes.

  Fixed

  Online upgrades on ansible-installed nodes no longer fail on new dependencies. The morphit-ops launcher created by the guided (ansible) install runs the tool in npm's offline mode for a fast start-up. That offline setting was being inherited by the upgrade's own dependency install step, forcing it to use only what was already in the local cache. On any upgrade that added or changed a dependency — for example a version jump that pulls a package the machine had never downloaded — the install step failed and the upgrade rolled back. Nodes installed manually were never affected because their launcher doesn't use offline mode. The upgrade now clears that inherited flag before installing dependencies, so it can reach the registry when it needs to. Genuinely offline (air-gapped) upgrades are unaffected: they ship their own bundled dependencies and never touch the registry.

  Changed

  Release automation now warns loudly if the offline install bundle is missing. The self-contained offline tarball is built on a best-effort basis, so a release could previously ship without it and no one would notice until an offline operator got stuck. Release runs now surface a prominent warning when the offline bundle wasn't produced, so it can be built and attached before the release is announced.

  Notes

  • No database migrations. No breaking changes.
  • If a previous online upgrade on an ansible node failed part-way with a dependency/cache error and rolled back, this release resolves it.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    7 downloads · 2026-08-08 23:50:06 +00:00 · 1 KiB
  • morphit-v1.10.6-offline.tar.gz
    2 downloads · 2026-08-08 23:50:21 +00:00 · 704 MiB
  • morphit-v1.10.6-offline.tar.gz.sha256
    2 downloads · 2026-08-08 23:50:22 +00:00 · 97 B
  • morphit-v1.10.6.tar.gz
    3 downloads · 2026-08-08 23:50:06 +00:00 · 12 MiB
  • morphit-v1.10.6.tar.gz.sha256
    4 downloads · 2026-08-08 23:50:06 +00:00 · 89 B
• v1.10.5 fdb1f94479

  Compare

  Morphit v1.10.5 Stable

  agorise released this 2026-08-08 05:51:01 +00:00 | 35 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.5

  Theme: guided (ansible) installs now advertise the correct relay account, so a new instance is accepted by its peers on the first probe instead of being rejected.

  This is a maintenance release. There are no database migrations and no breaking changes.

  Fixed

  Ansible-installed instances now report their own relay account. Every instance publishes a relay account in /v1/instance, and peers refuse to trust an instance whose published relay account doesn't match the account that signed its on-chain registration (an anti-impersonation check). The guided ansible installer set the operator tag and account name but never wrote the indexer's relay-account setting, so it silently fell back to the canonical default — meaning a fresh ansible instance advertised the wrong account and every other node rejected its health probe with a "relay account mismatch." The installer now writes the correct value (the same account the relay signs with), matching what the manual morphit-ops wizard already did. A guard was added so no install writer can omit it again.

  Notes

  • No database migrations. No breaking changes.
  • Only the guided (ansible) install path was affected; manual morphit-ops installs already set this correctly.
  • An existing ansible instance can fix this without upgrading by setting MORPHIT_INDEXER_RELAY_ACCOUNT to its own account and restarting the indexer.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-08-08 06:27:55 +00:00 · 1 KiB
  • morphit-v1.10.5-offline.tar.gz
    1 download · 2026-08-08 06:28:09 +00:00 · 704 MiB
  • morphit-v1.10.5-offline.tar.gz.sha256
    3 downloads · 2026-08-08 06:28:09 +00:00 · 97 B
  • morphit-v1.10.5.tar.gz
    6 downloads · 2026-08-08 06:27:55 +00:00 · 12 MiB
  • morphit-v1.10.5.tar.gz.sha256
    7 downloads · 2026-08-08 06:27:55 +00:00 · 89 B
• v1.10.4 f036b9f928

  Compare

  Morphit v1.10.4 Stable

  agorise released this 2026-08-08 03:41:05 +00:00 | 36 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.4

  Theme: instances can finally see each other. This release fixes a bug that stopped every instance from health-probing its peers, so the federation directory shows real, live status for other operators.

  This is a maintenance release. There are no database migrations and no breaking changes.

  Fixed

  Peer health probes now work. The indexer probes other instances over their public address and, as an anti-DNS-rebinding measure, pins the resolved IP for the connection. The code that pinned the IP used an older callback style that the current HTTP library rejects, so the connection failed immediately with an internal "invalid IP address" error — on every peer. The result: other operators' cards in the directory were stuck on "Unreachable" and never picked up their name, tagline, contact link, or Tor/I2P addresses, even when the instance was perfectly reachable. An instance's own card was unaffected because it fills in from local configuration, which is why this stayed hidden until a second instance joined. The IP-pinning now uses the shape the library expects, so probes connect and the directory reflects real peer status. A regression test covers the exact callback contract.

  Notes

  • No database migrations. No breaking changes.
  • After upgrading, previously "Unreachable" peers will flip to their real status (good / syncing / quiet) on the next probe.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-08 04:20:20 +00:00 · 1 KiB
  • morphit-v1.10.4-offline.tar.gz
    1 download · 2026-08-08 04:20:36 +00:00 · 704 MiB
  • morphit-v1.10.4-offline.tar.gz.sha256
    2 downloads · 2026-08-08 04:20:36 +00:00 · 97 B
  • morphit-v1.10.4.tar.gz
    2 downloads · 2026-08-08 04:20:19 +00:00 · 12 MiB
  • morphit-v1.10.4.tar.gz.sha256
    4 downloads · 2026-08-08 04:20:19 +00:00 · 89 B
• v1.10.3 ac9e87bfa7

  Compare

  Morphit v1.10.3 Stable

  agorise released this 2026-08-07 22:34:00 +00:00 | 37 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.3

  Theme: smoother upgrades, and a federation that welcomes regional and right-to-left instances. This release fixes a false upgrade error, lets instances brand themselves with the project name, and makes every text field work correctly in Persian, Arabic, and other RTL languages.

  This is a maintenance release. There are no database migrations and no breaking changes.

  Fixed

  Upgrades no longer fail with a false integrity error. Since v1.10.1 every release ships two download files — the small standard tarball and a larger self-contained "offline" bundle — each with its own checksum. The upgrader picked whichever tarball it found first and, separately, whichever checksum it found first, with no guarantee they were the same file. So an online upgrade could fetch the tarball from one place and its checksum from another, decide they didn't match, and stop with a "SHA-256 mismatch" even though nothing was wrong. The upgrader now always uses the small standard tarball for an online upgrade and matches its checksum and signature to that exact file; the offline bundle is used only for genuine offline installs where you supply the file yourself. The integrity check is exactly as strict as before — it was simply comparing the wrong pair.

  Instances can brand themselves with the project name. Registering an instance whose display name contained "Morphit" (for example "Morphit Latino") was being rejected as impersonation, which blocked the whole point of running a regional instance. The rule now allows the brand as part of a longer, distinct name while still blocking bare-handle impersonation ("morphit", "@morphit"), look-alike/homograph attacks, and the reserved infrastructure handles ("morphit-fees" and friends). The rightful owner of a reserved name is also exempt for that name, matching how user profiles already worked.

  Right-to-left languages now work everywhere text is entered or shown. The half-space (ZWNJ) that Persian and other scripts rely on was being rejected as a forbidden character across instance names, order titles and terms, feedback, and payment-method labels — so a Farsi name or description couldn't be saved at all. That character (and the related joiner) is now accepted everywhere, while the genuinely dangerous zero-width space and bidirectional-override controls stay blocked. On top of that, every field where a user types text and every place user text is displayed now renders right-to-left correctly. Editing an instance's title and description in Farsi through morphit-ops works too.

  Notes

  • No database migrations. No breaking changes.
  • If a v1.10.1 or v1.10.2 upgrade stopped on a "SHA-256 mismatch," this release resolves it.
  • An instance rejected earlier for a "Morphit …" name (or a right-to-left name) can register once the instances processing it are on v1.10.3.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-08-07 23:10:24 +00:00 · 1 KiB
  • morphit-v1.10.3-offline.tar.gz
    1 download · 2026-08-07 23:10:41 +00:00 · 704 MiB
  • morphit-v1.10.3-offline.tar.gz.sha256
    3 downloads · 2026-08-07 23:10:41 +00:00 · 97 B
  • morphit-v1.10.3.tar.gz
    2 downloads · 2026-08-07 23:10:24 +00:00 · 12 MiB
  • morphit-v1.10.3.tar.gz.sha256
    3 downloads · 2026-08-07 23:10:24 +00:00 · 89 B
• v1.10.2 60e5ea1970

  Compare

  Morphit v1.10.2 Stable

  agorise released this 2026-08-07 07:38:28 +00:00 | 39 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.2

  Theme: a reboot shouldn't take your node down. This release fixes a database-permission defect that could stop the indexer from coming back after a restart, and repairs the gitea.com release mirror.

  This is a small but important maintenance release for anyone running a Morphit instance installed the guided (ansible) way. There are no database migrations and no breaking changes.

  Fixed

  The indexer now always comes back after a restart or reboot. On instances set up with the guided installer, the database's host-permission file (pg_hba.conf) was left without a rule allowing the indexer and relay to log in over the local network connection they actually use. Everything ran fine until PostgreSQL next re-read that file — typically the first reboot — after which the indexer would fail to connect and restart in a loop, taking /v1/health (and anything that depends on the indexer) down with it. The installer now writes the correct, tightly-scoped permission rule (only the indexer's own database user, only over the loopback address, password-authenticated), so a restart or power cut no longer locks the indexer out. A regression guard was added so this can't silently come back.

  If you hit this before upgrading, the symptom in the logs was no pg_hba.conf entry for host "127.0.0.1". After upgrading to v1.10.2 the installer repairs the rule for you; on a node you've already patched by hand, the upgrade simply confirms the rule is present.

  The gitea.com release mirror now publishes. Forgejo reserves secret names beginning with GITEA_, so the token for the gitea.com mirror can't be stored under the name the release workflow originally expected. The workflow now reads the token from a name Forgejo allows (GITEACOM_TOKEN), so — with that secret set — each new release is mirrored to gitea.com alongside codeberg.org, keeping upgrades working even if the main forge is unreachable.

  Notes

  • No database migrations. No breaking changes.
  • Instances installed the manual (morphit-ops) way were not affected by the database-permission defect; it was specific to the guided/ansible database setup.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-07 08:14:04 +00:00 · 1 KiB
  • morphit-v1.10.2-offline.tar.gz
    3 downloads · 2026-08-07 08:14:19 +00:00 · 704 MiB
  • morphit-v1.10.2-offline.tar.gz.sha256
    4 downloads · 2026-08-07 08:14:19 +00:00 · 97 B
  • morphit-v1.10.2.tar.gz
    2 downloads · 2026-08-07 08:14:04 +00:00 · 12 MiB
  • morphit-v1.10.2.tar.gz.sha256
    3 downloads · 2026-08-07 08:14:04 +00:00 · 89 B
• v1.10.1 51b1d1ba77

  Compare

  Morphit v1.10.1 Stable

  agorise released this 2026-08-07 04:23:29 +00:00 | 40 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.1

  Theme: a node you can look after with less effort. This release is a cluster of practical improvements for the people who run Morphit instances — clearer status while a fresh node catches up, at-a-glance proof that your node is helping host the release, one command that hands your whole health picture to a monitor, and upgrades that keep working when the internet doesn't. Underneath, a brand-new node now writes its catch-up to the database in safer, bounded batches.

  This is a maintenance release. There are no database migrations and no breaking changes; an ordinary online instance behaves exactly as before.

  Added

  See whether your node is seeding the release. Every instance runs a small IPFS node that pins the signed release and rebroadcasts the ipns:// record so releases stay hosted and resolvable as long as any instance is alive. The node-health view now shows an IPFS/IPNS release seeding line — ok, degraded, down, or not-configured — so you can tell at a glance that your box is doing its share, without digging through logs.

  One command for monitoring. morphit-ops health --json now prints the whole node-health view as one machine-readable object — indexer, relay, system (CPU/memory/disk), background services, backups, the warrant canary, and the new IPFS/IPNS seeding state. Point Zabbix (or any monitor) at it — run it on a timer into a file, or through an agent — and alert on any section leaving its healthy state. Host-level operational detail like this stays out of the public health endpoint on purpose, so a passing stranger can't learn that your backups are failing or your disk is full.

  Upgrade with no internet, from a USB stick or a folder. Copy the signed -offline tarball (and its signature) onto the box and run morphit-ops upgrade --from-file=…, or simply drop it into the offline release folder — the main menu then shows ● update available (offline tarball ready) on its own, and a normal upgrade uses it automatically whenever the network can't be reached. An upgrade that begins online even finishes from that dropped tarball if the connection drops partway through. Unsigned tarballs are refused.

  Set up your warrant canary during install. The guided home install now offers to set up your warrant canary right then, instead of leaving it as a separate follow-up step.

  Clearer instance status. The public instances list now tells apart a node that is still catching up (Syncing) from one that has genuinely fallen behind (stale), and the status dropdown uses plain-language labels for each state.

  Changed

  Safer initial sync. When a fresh node replays the Blurt chain to build its local view, it now commits each window of blocks in one bounded database transaction rather than one transaction per block. If the machine crashes mid-catch-up, the partial window rolls back cleanly and the node resumes from exactly where it left off — with no half-written state and no risk of a long transaction stalling the database. The same data ends up stored; there is nothing to configure.

  Releases mirrored automatically. Each release is now also published to the codeberg.org and gitea.com mirrors (when their tokens are configured), so upgrades keep finding a release even if the main forge is unreachable.

  Fixed

  IPNS rebroadcast on ansible-managed nodes. An instance installed through the ansible role now also rebroadcasts its IPNS record on a timer. Previously only the hand-run IPFS setup did this, so an ansible-managed node could quietly stop keeping the ipns:// name alive. The rebroadcast needs no key — it simply re-announces the release's own on-chain-signed record — and now runs everywhere.

  Notes

  • No database migrations. No breaking changes.
  • The complete node-health picture (including backups, disk, and IPFS seeding) is available through morphit-ops health --json, locally or over SSH; it is deliberately not exposed on the public /v1/health endpoint.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-07 04:59:36 +00:00 · 1 KiB
  • morphit-v1.10.1-offline.tar.gz
    3 downloads · 2026-08-07 04:59:52 +00:00 · 704 MiB
  • morphit-v1.10.1-offline.tar.gz.sha256
    6 downloads · 2026-08-07 04:59:52 +00:00 · 97 B
  • morphit-v1.10.1.tar.gz
    2 downloads · 2026-08-07 04:59:36 +00:00 · 12 MiB
  • morphit-v1.10.1.tar.gz.sha256
    3 downloads · 2026-08-07 04:59:36 +00:00 · 89 B
• v1.10.0 0ecced72b7

  Compare

  Morphit v1.10.0 Stable

  agorise released this 2026-08-06 22:15:48 +00:00 | 41 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.10.0

  Theme: Morphit now installs completely offline. From a single self-contained download, with the network cable unplugged, the guided install runs start to finish — and the few steps that genuinely need the internet (your real HTTPS certificate, connecting to Blurt, and, if you opt in, listing your instance on-chain) complete themselves automatically the first time the box sees a connection.

  This finishes the offline appliance. An instance can be brought up in a place with no internet at all, on the local network, and it upgrades itself the moment a real link appears — retrying quietly until it succeeds, then stepping out of the way.

  Added

  Completely offline install. There are now two downloads on each release:

  • the usual slim source tarball, which fetches its dependencies while installing (needs internet), and
  • a self-contained -offline tarball, which bundles everything — the application libraries, the operating-system packages, the Docker images, the Node runtime, and Kubo. Installing from it touches the network for nothing: apt, Docker, and every other step install from the bundle. It is a large download by design.

  To install with no internet: download the -offline tarball on any machine, copy it to the target, extract it, and run the guided install. When the box is later connected, normal package updates are automatically restored (the offline install temporarily points apt at the bundled packages using a reversible setting that leaves your system's own package sources untouched; the finish-when-online helper removes it once you're online).

  Finish-when-online. After the install, a background helper (morphit-first-online) watches for a real internet connection — it actually checks that it can reach several Blurt nodes, not just that a cable is plugged in. The first time it succeeds it obtains your real Let's Encrypt certificate (until then the site is served over HTTPS on your local network with a self-signed certificate, so it still works), connects the indexer and relay to Blurt, and — if you opted in — publishes your on-chain instance listing. Each step is done once and remembered; anything that can't finish yet is retried on the next cycle; when everything is done the helper retires itself.

  Opt-in automatic on-chain listing. The guided install asks whether to list your instance on-chain automatically once online, or leave it for you to run morphit-ops register yourself later. The unattended path reuses the same relay key and passphrase your relay already runs with — no key is entered by hand.

  Fast initial sync. A brand-new instance replays the Blurt chain from the beginning to build its local view. That catch-up used to fetch one block-window at a time; it now fetches several windows at once, each aimed at a different one of your configured Blurt nodes — so no single node is leaned on, and a slow or failing node is stepped around automatically — while still writing every block in strict order, one per transaction. A fresh instance reaches the chain head dramatically faster, and exactly the same data ends up stored. Nothing to configure; a tuning knob (MORPHIT_INDEXER_BACKFILL_CONCURRENCY) exists for the curious but defaults to one window per node.

  Changed

  The HTTPS step never blocks the install. If Let's Encrypt can't be reached when you install (offline, or your domain isn't resolving yet), the certificate step is deferred to the finish-when-online helper instead of stopping the install. The site comes up immediately and upgrades to the real certificate automatically once it can.

  Fixed

  Guided-install robustness — from the first real federated deployment. Standing up the first independent Morphit instance surfaced a batch of first-install issues, all now fixed so a fresh install comes up cleanly end to end:

  • The real HTTPS certificate is made readable by the proxy on both first issue and on renewal, so the site keeps serving over the renewed certificate without hand-holding.
  • The reverse-proxy and firewall containers now start in the right order, with the file permissions and controlled Docker access they need, instead of racing each other on a cold boot.
  • The single shared database is set up once and used by both the indexer and the relay (an earlier layout created a second, empty database the relay then couldn't use).
  • A multi-word instance name — and your optional Tor and I2P addresses — are now captured and stored intact, so your instance's name and onion/I2P links show up correctly.

  Notes

  • No database migrations. No breaking changes. An ordinary online install behaves exactly as before — every offline mechanism is dormant unless a bundle is actually present.
  • Building the -offline tarball (for release maintainers): run bash scripts/build-offline-bundle.sh on an Ubuntu 24.04 machine with Docker; it assembles the bundle and writes morphit-v1.10.0-offline.tar.gz. The release CI attempts this automatically on a best-effort basis, so a build machine without Docker never blocks a release.
  • If a past install stopped waiting on a certificate or a Blurt connection, nothing needs undoing — re-run the guided install with this version; it finishes offline and the helper takes care of the rest when you're online.

  Downloads

  • Source code (ZIP)
    1 download
  • Source code (TAR.GZ)
    2 downloads

  ---

  • distribution-anchor.env
    7 downloads · 2026-08-06 22:50:53 +00:00 · 1 KiB
  • morphit-v1.10.0-offline.tar.gz
    2 downloads · 2026-08-06 22:51:08 +00:00 · 706 MiB
  • morphit-v1.10.0-offline.tar.gz.sha256
    5 downloads · 2026-08-06 22:51:09 +00:00 · 97 B
  • morphit-v1.10.0.tar.gz
    2 downloads · 2026-08-06 22:50:53 +00:00 · 12 MiB
  • morphit-v1.10.0.tar.gz.sha256
    5 downloads · 2026-08-06 22:50:53 +00:00 · 89 B
• v1.9.22 ae2299309c

  Compare

  Morphit v1.9.22 Stable

  agorise released this 2026-08-04 05:25:13 +00:00 | 59 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.22

  Theme: the guided install now creates every drop-in configuration directory it writes into, so hardening can't stop on a "directory does not exist" error.

  This is the companion hotfix to v1.9.21. That release fixed the SSH-hardening step for machines without an SSH server; this one fixes the same class of problem one step later. On some machines the password-policy step stopped with "/etc/security/pwquality.conf.d does not exist" — the password-quality package installs its main config file but doesn't create the drop-in directory, so writing into it failed.

  Fixed

  Every hardening drop-in now ensures its directory first. Instead of trusting each system package to have created its own .d drop-in directory (some do, some don't), the installer now creates the directory before writing into it — for the password policy, the audit rules, the AIDE integrity rules, and the SSH hardening. The result is the same hardened configuration; it simply no longer depends on a package having pre-made a directory.

  We also added an internal build check that fails if any future drop-in write forgets to ensure its directory, so this whole class of "directory does not exist" install stoppage can't come back.

  Notes

  • No database migrations. No breaking changes.
  • If your last install stopped at the password-policy step, nothing needs undoing — re-run the guided install with this version and it will pick up cleanly and finish.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • distribution-anchor.env
    4 downloads · 2026-08-04 05:56:28 +00:00 · 1 KiB
  • morphit-v1.9.22.tar.gz
    3 downloads · 2026-08-04 05:56:28 +00:00 · 12 MiB
  • morphit-v1.9.22.tar.gz.sha256
    4 downloads · 2026-08-04 05:56:28 +00:00 · 89 B
• v1.9.21 82937660e5

  Compare

  Morphit v1.9.21 Stable

  agorise released this 2026-08-04 03:27:15 +00:00 | 60 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.9.21

  Theme: home-desktop installs no longer stop at the SSH-hardening step when the machine has no SSH server.

  This is a small hotfix for the guided install. If you install Morphit on a home computer that doesn't run an SSH server (common for a desktop you sit at and administer locally), the previous version stopped during setup with an error like "Destination directory /etc/ssh/sshd_config.d does not exist." Rented servers (VPS) always have an SSH server, so they were unaffected — but a home node could get stuck here.

  Fixed

  SSH hardening now applies only when an SSH server is actually installed. The installer checks for an SSH server first:

  • If one is present (always the case on a VPS, and on any machine where you added SSH for remote access), it is hardened exactly as before — root login and password login are turned off.
  • If there is none (a typical home desktop you run locally), the installer prints a short note explaining there is nothing to harden and moves on, instead of stopping.

  We deliberately do not install an SSH server for you. Whether to run one — and expose it — is your decision, not something the marketplace installer should make on your behalf. If you add an SSH server later for remote access, just re-run the installer and it will harden it.

  Two small belt-and-braces fixes ride along so the same class of problem can't surface elsewhere: the scheduled security scans (AIDE, rkhunter) are guaranteed their scheduling directories, and the certificate-renewal hook is guaranteed its directory before it's written.

  Notes

  • No database migrations. No breaking changes.
  • If your last install stopped at the SSH step, you don't need to undo anything — just re-run the guided install with this version and it will pick up cleanly and finish.

  Downloads

  • Source code (ZIP)
    3 downloads
  • Source code (TAR.GZ)
    2 downloads

  ---

  • distribution-anchor.env
    5 downloads · 2026-08-04 03:59:45 +00:00 · 1 KiB
  • morphit-v1.9.21.tar.gz
    4 downloads · 2026-08-04 03:59:44 +00:00 · 12 MiB
  • morphit-v1.9.21.tar.gz.sha256
    4 downloads · 2026-08-04 03:59:45 +00:00 · 89 B