agorise/morphit
agorise/morphit
Watch
1
0
Fork
You've already forked morphit
 0
Code Issues Pull requests Projects Releases 209 Packages Wiki Activity Actions
209 releases 209 tags
  • v1.17.8 3609dd3ba0

    Morphit v1.17.8 Stable

    agorise released this 2026-09-14 04:56:15 +00:00 | 52 commits to main since this release

    Morphit v1.17.8

    Makes fast-sync actually work on a node with no clearnet — the case the whole
    feature exists for, and the one that had never been tested. No protocol or
    consensus change.

    Fixed

    • A Tor/I2P-only node can now fast-sync at all. Routing for hidden addresses
      was switched on by the indexer service and nowhere else, so the service read
      the chain happily over I2P while any of the tools running beside it aimed the
      same request straight at a hidden address with no proxy and got a bare
      "failed". A hidden-only node therefore could not even look up where the
      snapshot was, let alone fetch it — which is why one such instance would not
      mirror. Both the snapshot fetcher and the mirror now switch routing on
      themselves, and still refuse to fall back to the open internet.
    • Serving snapshots over the web works on more instances. The web front end
      passed the visitor's own hostname through to the local IPFS gateway. A gateway
      treats an unfamiliar hostname as a name it might have to look up, and on a node
      configured not to fetch, that request simply hangs — so the page eventually
      returned "not found". It now passes an address the gateway recognises. The
      affected instance's Tor and I2P paths were unaffected throughout, which is why
      this went unnoticed.
    • The gateway self-check stops reporting a healthy box as broken. It was
      asking with the same unusable hostname, so it declared the connection blocked
      on machines where it was fine, and its firewall repairs were aimed at a problem
      that did not exist.
    • Mirroring waits for the network to come up. A node restarts IPFS during an
      upgrade and the mirror ran immediately afterwards, when IPFS was answering but
      had no connections yet. It spent ten minutes trying to fetch from a network it
      had not joined, then gave up. It now waits for connections and, if there are
      none, says so and retries later instead of stalling.

    Added

    • Fast-sync is now genuinely tested on a simulated zero-clearnet node, over
      Tor and I2P separately — they are different code paths, so passing one proves
      nothing about the other. The tests use faithful stand-ins for both proxies and
      confirm the traffic really went through them, rather than trusting that the
      request succeeded.
    • That test also proves the privacy guarantee: offered a working open-internet
      source, a hidden-only node still refuses it rather than quietly using it to
      finish sooner.

    Notes

    • No protocol/consensus change. Everything here is operator-facing.
    • An instance that could not mirror before will do so on its next upgrade, or
      at its next scheduled attempt.
    • OPERATIONS.md §52 covers the snapshot pipeline and how to check it.
    Downloads
  • v1.17.7 f8a974c3b7

    Morphit v1.17.7 Stable

    agorise released this 2026-09-13 22:21:49 +00:00 | 53 commits to main since this release

    Morphit v1.17.7

    Finishes what v1.17.6 started: the snapshot publisher now works when run on a
    schedule, and operator alerts stop repeating themselves. No protocol or consensus
    change.

    Fixed

    • The snapshot publisher works on a timer. It talks to IPFS by switching to
      the IPFS account first — and on a hardened server, both of the standard tools
      for doing that are blocked: one is refused outright by the service's security
      settings, the other is not permitted to change accounts at all. The job is
      already running with full privileges and does not need to switch accounts: the
      IPFS command line only reads a small file and then talks to the running service
      over a local connection. It now tries talking directly first, falls back to
      each account-switching tool in turn, and uses whichever actually works —
      reporting which one it chose. Guessing which tool a given server permits is
      what made this fail repeatedly.
    • Alerts stop repeating. A unit that stayed broken produced a CRITICAL alert
      every five minutes, over and over, for the same unchanged fact. Alerts now fire
      when something changes: once when a unit fails, once when it recovers, and
      again if it fails afresh. A repeat failure is never swallowed, and if the
      bookkeeping cannot be written the behaviour falls back to alerting every scan
      — never to silence.

    Added

    • The alert monitor is now genuinely run during testing, driven through a
      whole failure → recovery → failure-again cycle, because "alerts once and then
      stays quiet" is a property you can only observe by running it repeatedly.
    • The publish test now reproduces a server where both account-switching tools
      are blocked      , which is the exact situation that broke the live publisher.

    Notes

    • No protocol/consensus change. Everything here is operator-facing.
    • If you disabled the publish timer to stop the alerts, re-enable it after
      upgrading: sudo systemctl enable --now morphit-snapshot-publish.timer.
    • OPERATIONS.md §52 covers the snapshot pipeline and how to check it.
    Downloads
  • v1.17.6 c956d47e82

    Morphit v1.17.6 Stable

    agorise released this 2026-09-13 19:42:30 +00:00 | 54 commits to main since this release

    Morphit v1.17.6

    Two things get fixed here: operator alerts that were unreadable, and a snapshot
    publish timer that could not complete a single run. Both had the same underlying
    cause — code that was only ever run by hand, never under the conditions it runs
    in for real. No protocol or consensus change.

    Fixed

    • Operator alerts arrive in ONE conversation, and you can read them. The alert
      bot remembered which private conversation to use only until it restarted — and
      it restarts on every upgrade. So each upgrade started a brand-new conversation,
      filling your inbox with duplicates, and because each new one needed its own
      encryption keys shared to a device the bot had never been introduced to, most
      alerts arrived as "Unable to decrypt message". The conversation is now
      remembered across restarts, and encryption is off by default for alerts: an
      alert you cannot read is worth nothing, and these are notices to your own
      account, not secrets. Set MORPHIT_MATRIX_ENCRYPT=1 to turn it back on.
    • Recovering from an encryption-key conflict no longer loses your place. That
      recovery deleted the bot's entire saved state — which also held its position in
      the alert stream and the conversation it uses — so "fixing" encryption started
      yet another conversation. It now clears only the encryption keys.
    • The snapshot publish job can complete a run. Under the service manager it
      failed at a different step each time, for five unrelated reasons, none of which
      appeared when the same script was run by hand: the file was not marked
      executable; a failure discarded the explanation instead of printing it; moving
      the finished snapshot out of a private temporary area failed because it crossed
      a storage boundary; the tool used to switch to the IPFS account is not permitted
      under the service's own security settings; and the check for "is IPFS up?" gave
      up instantly even though this very script restarts IPFS moments earlier.
    • Two other background jobs could never start either. The release monitor and
      the treasury re-pin were shipped without the executable flag, so the service
      manager refused to run them. Probably for some time, silently.
    • A failing publish now tells you why. Several steps sent a failed command's
      output to the bin and reported only "failed". They now print what the command
      actually said.

    Added

    • The publish and mirror jobs are now really run during testing, against
      stand-in IPFS and chain services, instead of only being read. Every failure
      listed above was reproduced and confirmed to be caught by these new tests. The
      mirror test also confirms it refuses a snapshot whose contents do not match the
      published fingerprint, and one published for a different chain.
    • A standing check across every background job: each must be executable, must
      not use a privilege tool its own security settings forbid, and must not discard
      the output of a command whose failure it is reporting.

    Notes

    • No protocol/consensus change. Everything here is operator-facing.
    • If your alert inbox has several "Morphit alerts" conversations, you can leave
      the old ones; after upgrading, the bot settles on one and stays there.
    • OPERATIONS.md §52 covers the snapshot pipeline, publishing, and how to check
      it.
    Downloads
  • v1.17.5 287855b7e2

    Morphit v1.17.5 Stable

    agorise released this 2026-09-13 03:59:01 +00:00 | 55 commits to main since this release

    Morphit v1.17.5

    The fast-sync snapshot pipeline now actually runs. Three separate faults meant it
    had never worked end to end — which is why no snapshot had ever been published
    since the feature shipped. All three were found by rehearsing the thing for real
    rather than by inspecting it. No protocol or consensus change.

    Fixed

    • Publishing a snapshot works. The publisher read the snapshot's own
      description sheet by handing it to a small helper program down the same channel
      the program itself arrives on — so the description was discarded and the helper
      received nothing. It failed on the very first attempt, every time, which is why
      no federation snapshot had ever been published. The description is now handed
      over separately.
    • Mirroring a snapshot works. The mirror job looked for the IPFS data store in
      the wrong place: it ran as the system administrator, whose data store is empty,
      rather than as the account that owns the real one. So it refused to fetch a file
      the very same machine was already serving. It now uses the right account, and
      its start-up check confirms the data store is genuinely reachable instead of
      merely confirming the software is installed — a check that could not tell the
      two situations apart.
    • The fast-sync rehearsal needs no database. --verify-only was meant to
      fetch and check a snapshot without touching anything, but one leftover database
      lookup ran before it finished, so it failed on any machine without a configured
      indexer. That lookup is only needed when actually restoring, and is now skipped.
    • A rehearsal no longer demands invented settings. It insisted on four
      configuration values it never used. It now fills in the ones it does not need
      and asks only for the chain identifier — which is deliberately never guessed,
      because it is the check that stops a node accepting a snapshot from a different
      chain.
    • Snapshot size reads correctly. A 583 kB snapshot was reported as "0 MB",
      which looked like the export had failed.

    Notes

    • No protocol/consensus change. Everything here is publisher- and
      operator-facing.
    • The first federation snapshot is now published and anchored on-chain, and has
      been fetched and verified from an unrelated machine over a public gateway. New
      instances can fast-sync.
    • OPERATIONS.md §52 covers the pipeline, how to publish, and how to check it.
    Downloads
  • v1.17.4 26af53594d

    Morphit v1.17.4 Stable

    agorise released this 2026-09-12 20:39:29 +00:00 | 56 commits to main since this release

    Morphit v1.17.4

    A polish release, written entirely from watching three real upgrades. Nothing
    here changes what Morphit does — it changes what the upgrade tells you while
    it does it. No protocol or consensus change.

    Fixed

    • Long steps no longer look frozen. Installing dependencies, redeploying the
      MCP server, seeding to IPFS and refreshing the snapshot mirror could each sit
      silent for a minute or more with nothing on screen. Every one of them now turns
      a spinner while it works, so you can always tell the difference between "busy"
      and "stuck". Their output is replayed in full when the step finishes.

    • The seeding self-check can finally see your addresses. It reported "no
      public origin found" and "no hidden address configured" on all three
      instances — including one that is reachable only over Tor and I2P, where the
      message was plainly absurd. Cause: it read one config file and your settings
      live in the other one. It now reads both, plus the web-firewall's own hostname
      as a last resort.

    • Hidden-only upgrades show their release notes. A node that fetches over
      Tor/I2P had no release page to read notes from, so it printed an empty heading
      and you upgraded blind. The notes ship inside the tarball, so they are now read
      from there — the same bytes the SHA-256 already covers.

    • The gateway check no longer raises a false alarm. It asked the gateway for
      an address the gateway does not serve, then read the resulting error as proof
      the connection was blocked — so it announced a problem on every instance,
      including ones demonstrably working. It now asks for something the gateway does
      serve, and treats any reply at all as proof the path is open.

    • Your own instance card now shows your own badge. A node scores its
      clearnet-elimination gate for peers, but never recorded it for itself — so the
      one instance that had actually earned the "Zero use of clearnet internet" medal
      was the only place it didn't appear. Every peer showed it correctly. The self
      card now reads the same gate everyone else sees.

    • Your own instance card no longer disagrees with your peers about your
      status.       A node labelled itself only "Good" or "Syncing", while peers applied
      an orderbook-activity rule and could show "Quiet" — the same instance described
      two ways with nothing to explain the gap. The self card now applies the same
      rule. It only relabels on a definite answer, so a lookup that tells it nothing
      can never mark a busy instance quiet.

    Added

    • A safe way to rehearse fast-sync. --verify-only runs the entire consumer
      path — find the signed snapshot on-chain, pick a mirror, download it over
      whichever transport suits the node, and prove every byte against the on-chain
      SHA-256 — then stops before touching any database and tells you what it found.
      It needs no indexer, no Postgres and no server, so you can rehearse the whole
      thing from a laptop and know it works before a brand-new instance depends on
      it.
    • The snapshot publisher's timer installs itself. The publish units were only
      laid down by the automated server setup, which never runs on a hand-built
      install — including the canonical one. They are now installed on every upgrade
      but stay inert until you opt in by creating /etc/morphit/snapshot-publish.env,
      so exactly one instance publishes and no upgrade can make a box start signing
      snapshots by surprise.

    Changed

    • Less alarming output when a check is inconclusive. The gateway check used to
      end with a warning that hidden-only peers could not upgrade from your box — a
      consequence it had not actually established, printed after the upgrade's own
      success message. It now reports only what it observed, says plainly that it can
      be wrong, and makes clear that nothing about it blocks your upgrade.

    Notes

    • No protocol/consensus change. Everything here is operator-facing output quality.
    • If v1.17.3 told you your box had no hidden address or warned that hidden peers
      could not upgrade from it, neither was true — both were reporting bugs, fixed
      here.
    Downloads
  • v1.17.3 a20f86f25c

    Morphit v1.17.3 Stable

    agorise released this 2026-09-12 05:10:51 +00:00 | 57 commits to main since this release

    Morphit v1.17.3

    Follow-up to v1.17.2, driven entirely by what two real upgrades revealed. The
    headline item is that nobody could set up a warrant canary — the setup script
    was being killed mid-prompt by a shell error, and the same defect sat in the
    weekly refresh that keeps an existing canary alive. No protocol or consensus
    change.

    Fixed

    • Warrant-canary setup no longer dies mid-prompt. Answering the questions
      would get as far as "Operator name" and then stop with "Canary setup didn't
      finish", with no explanation. The script was not finishing early — it was being
      terminated. It looks for your instance URL to offer as a default, and the
      search used a pipeline that reports "not found" as an error; combined with the
      script's own abort-on-any-error setting, the first configuration file that
      lacked that setting killed it outright. Since almost no existing instance has
      that setting recorded, this affected essentially everyone. The lookup now
      tolerates a miss, tries more places, and on a Tor-only box falls back to your
      .onion as the default.
    • The weekly canary refresh had the same defect. Identical construct in the
      refresh job that the timer runs. A node whose configuration lacked one
      particular setting — or that simply had no .onion among its chain endpoints —
      would have its refresh killed silently, letting a published canary go stale on
      its own schedule with no error any operator would ever see. That is the worse
      version of the bug, because nothing surfaces it until readers notice the date.
    • The seeding self-check can find your addresses again. Every instance was
      reporting "no hidden address configured" and skipping the frontend check, even
      with a live .onion and a working domain. Two causes: the check read one
      setting from one file, and it runs as an unprivileged user that cannot read
      Tor's address file at all. The upgrade now looks these up itself — where it has
      the permission to — and hands them down, with more fallbacks and a message
      naming exactly where it looked when it still finds nothing.
    • The snapshot mirror installs itself on hand-built servers. Its weekly timer
      was only installed by the automated server setup, which never runs on an
      instance that was installed by hand — including the canonical one. The upgrade
      now installs and enables the timer directly, so the feature is not silently
      inert on exactly the servers that matter most.
    • The stray "New major version of npm available!" banner is gone. It was
      printing after the upgrade's own success message, which read like part of the
      result. Suppressed at the last step that could emit it, so it holds however
      that step is run.

    Changed

    • The "Zero use of clearnet internet" badge now shows a medal (🏅) instead of a
      shield (🛡️)       in the instance directory. It marks an achievement a node has
      earned by proving all seven outbound paths are hidden, not a protective
      feature — the medal reads that way.

    Security

    • The address lookup deliberately does not read hidden addresses from the
      chain-endpoint configuration. That file lists other operators' .onion
      addresses, and reading it would have made this instance probe a stranger's node
      and report it as its own working seeder.

    Notes

    • No protocol/consensus change. Everything here is operator-facing: setup,
      upgrade, seeding and reporting accuracy.
    • If your canary setup failed on v1.17.2, re-run it after upgrading —
      sudo morphit-ops → "Harden this server", or
      sudo bash /opt/morphit/scripts/canary/setup.sh.
    • OPERATIONS.md §52 covers the snapshot mirror pipeline and how to check it.
    Downloads
  • v1.17.2 71d9696995

    Morphit v1.17.2 Stable

    agorise released this 2026-09-12 02:07:57 +00:00 | 58 commits to main since this release

    Morphit v1.17.2

    Hidden-seeding and fast-sync release. Two things were quietly broken in the same
    place: a Tor/I2P-only instance could not upgrade from the federation for weeks
    because of a single missing firewall rule, and a Tor/I2P-only instance could not
    fast-sync at all because the snapshot it needs was only ever reachable over
    clearnet. Both are fixed, along with the checks that reported success while the
    first one was broken. No protocol or consensus change.

    Added

    • Every instance now mirrors the federation indexer snapshot. Fast-sync is
      what gets a brand-new node from an empty database to a live orderbook in
      minutes instead of days, and it depends on one small (~600 kB) file that
      @morphit anchors on-chain. Until now nothing kept that file reachable from
      anywhere except the canonical box and a few public clearnet IPFS gateways —
      which made one box a single point of failure for every new instance, and made
      fast-sync impossible for a zero-clearnet node. Your instance now pins that file
      and re-serves it over your clearnet origin, your .onion and your .b32.i2p,
      refreshing weekly and after every upgrade. Mirroring is not a trust claim: a
      newcomer proves every byte against the signed on-chain SHA-256, so a bad mirror
      is caught by arithmetic rather than by reputation. Nothing to configure.
    • Fast-sync works over Tor and I2P. A new node now prefers federation peers
      on the transport it already speaks, ahead of any clearnet source. A hidden-only
      node omits clearnet sources entirely and falls back to a full replay rather than
      reaching for a public gateway — finishing faster is never worth deanonymising
      the box. Peers are discovered from the same chain history the node already reads
      to find the snapshot, so a brand-new box with no indexer yet still finds a
      private mirror, and no address is baked into the source tree to go stale.
    • The frontend-to-gateway firewall path now repairs itself. Every upgrade
      probes the connection from inside the frontend container and, if it is being
      dropped, fixes it in place — firewall rule, then a fallback rule, then a
      container restart, verifying after each and reporting which one worked. An
      instance admin is never asked to paste a firewall command.

    Fixed

    • Hidden-only instances can upgrade from the federation again. The frontend
      proxies /ipfs/ and /ipns/ to the IPFS gateway on the host, but the firewall
      had no rule for that port — so the container-to-host connection was dropped, nginx
      timed out, and every .onion / .b32.i2p release fetch returned a stock 404. Any
      instance running the web firewall was therefore unable to serve releases over
      Tor or I2P      , which is why hidden-only nodes fell back to stale copies from
      elsewhere and failed their integrity check. Hardening now opens that port to the
      web-firewall network only (never the public), when this box hosts IPFS — and the
      self-heal above delivers the same fix to instances the installer never manages.
    • The seeding self-check actually runs now. The check introduced for this
      release used a Bash-only construct in a script that runs under /bin/sh, which
      on Ubuntu aborts the moment it is called. In practice the entire per-transport
      verification — and the step after it — never executed on a single real box. It
      is now plain POSIX shell, and a probe that cannot connect reports that instead
      of killing the script, which matters because an unreachable gateway is exactly
      what it exists to detect.
    • No more false "your firewall is broken" warning. The same check asked the
      frontend for the release using the loopback address, which the web firewall
      rejects on every path even on a perfectly healthy box — so it would have told
      every operator at once that their firewall was dropping connections. It now asks
      using the instance's real hostname, and treats a refusal from its own probe as
      inconclusive rather than as a fault.
    • Reachability checks no longer time out on healthy nodes. The Tor and I2P
      checks downloaded the full ~33 MB release tarball, which routinely outruns any
      sane timeout over a hidden transport and reported working nodes as broken. They
      now fetch a small file over the identical path.
    • "Working seeder" is verified, not assumed. The previous self-check asked
      the local gateway whether it served the release and then announced the box was a
      working seeder over every transport. That passed happily while no peer could fetch
      anything. It now checks the path a peer actually uses — through the frontend, then
      end-to-end over each configured .onion and .b32.i2p — and reports each
      transport separately, with the exact fix when one fails.
    • No more false "unsigned tarball will be refused" warning. A release fetched
      over Tor/I2P carries no detached signature by design: it is verified against the
      SHA-256 anchored on-chain, read from the node's own indexer. The warning now
      describes what actually happens — the on-chain hash is used, and the upgrade is
      refused only if neither a signature nor a matching hash can be established.

    Changed

    • The health report no longer overstates IPFS seeding. Its "ok" verdict is based
      on local timer runs (the release is pinned, the IPNS record was rebroadcast), which
      does not prove a peer can fetch it. The wording now says exactly that, and points at
      the upgrade's seed step for the real per-transport reachability check.
    • Snapshot publishing is a single-signer job, and is off by default. Exactly one
      instance in the federation exports and anchors the snapshot; everyone else mirrors
      it. An ordinary instance will never begin anchoring snapshots under its own account
      just because it was installed with defaults.

    Security

    • The new firewall rule is scoped to the pinned web-firewall network and opens only
      the read-only release gateway, which serves pinned releases and nothing else. It is
      gated on the box actually hosting IPFS, so a node without IPFS opens no new port,
      and a Tor/I2P-only box gains no clearnet exposure.
    • A mirroring instance verifies the snapshot against the on-chain SHA-256 before it
      will serve it, and removes the pin if the hash does not match — so a box can never
      become a mirror for content the signer did not publish.
    • The self-heal only ever adds a rule permitting the pinned container network to reach
      the local read-only gateway, and verifies by observing the connection rather than
      trusting a command's exit code.

    Notes

    • No protocol/consensus change. All changes are operator-facing seeding, upgrade,
      fast-sync and reporting accuracy.
    • Mirroring rides on IPFS release hosting: a box without Kubo skips it silently.
      OPERATIONS.md §52 covers the whole pipeline, including how to opt out.
    Downloads
  • v1.17.1 02b32c1731

    Morphit v1.17.1 Stable

    agorise released this 2026-09-11 04:57:46 +00:00 | 59 commits to main since this release

    Morphit v1.17.1

    Smooth-install / self-heal release. A run of real operator pain — a fresh OS
    reinstall, a Tor-only upgrade, and a censored-region node — surfaced a handful of
    places where an install or upgrade needed a human to notice and fix something by
    hand. Every one of them now handles itself, or fails loud with the exact fix. No
    protocol or consensus change.

    Fixed

    • An upgrade no longer leaves a containerized frontend serving the OLD build.
      The BunkerWeb/containerized frontend bind-mounts the built site, and a rebuilt
      image is byte-identical, so docker compose up left the running container pinned
      to the pre-upgrade build — the upgrade reported success while /verify.json still
      showed the old version. The frontend is now force-recreated so it re-binds the
      fresh build, and the post-upgrade check self-heals (restart + re-verify) before
      it will warn.
    • operator_tag now shows on containerized instances. The tag was stamped into
      the served verify.json only on the bare-metal deploy path, so every
      container-served instance read operator_tag: null despite a correct config and
      on-chain registration. The stamp now runs before both deploy paths. (Cosmetic —
      fee attribution always used the runtime config and was never affected.)
    • A reinstalled IPFS origin host no longer goes publicly dark on IPFS. Stock
      firewall opened only 22/80/443, so a fresh install left the IPFS swarm port closed
      and public gateways couldn't fetch the seeded release. Hardening now opens 4001
      (tcp + udp)       automatically when the box hosts IPFS, and the post-harden self-test
      flags it if it's ever not open.
    • The warrant-canary upload survives a reinstall. A fresh OS re-keys only root,
      so the canary's morphit@ upload failed with "Permission denied". Install now
      propagates the operator's login keys to the morphit service user.
    • Canary autorenew no longer fails silently under nvm. The weekly timer runs with
      a minimal PATH and couldn't find a version-manager node; the generated service now
      pins node's directory into its PATH.

    Added

    • Turnkey canary setup. Remote (laptop-signed) setup now offers to generate a
      dedicated passphrase-less upload key, wires it behind an SSH alias, and points the
      refresh at it — so the weekly timer never prompts and the canary can't go falsely
      stale. Same-box setup is drivable with near-zero data entry.
    • Upgrade offers a canary when the footer link would 404. If the site footer's
      canary link has no canary behind it (bad for visitors and SEO), the upgrade offers a
      turnkey same-box setup — signing key, first canary, and weekly schedule, automatic —
      and is a single keystroke to decline. It stays silent for operators who already run
      a remote canary.
    • Every instance self-verifies it's a working release seeder. After seeding a
      release to IPFS, the instance now confirms its own gateway actually serves it (the
      path a peer uses) and says so plainly — or warns loudly if it doesn't — so the
      federation never silently loses a seeder.
    • Hidden-only nodes get a clear, verified offline path. When no federation peer
      yet serves a release over Tor/I2P, the fail-closed message now points to
      morphit-ops upgrade --from-file, which verifies the tarball against the SHA-256
      @morphit anchored on-chain (read from the node's own indexer — zero clearnet).

    Changed

    • morphit-ops edit already offered to re-publish your on-chain registration after a
      name/tag/origin/contact change; this is a reminder that the operator tag attributes
      fee earnings, so a config that drifts to a wrong/reserved tag is now easy to catch
      and correct.

    Security

    • Every change is hidden-only-safe: the 4001 rule is gated on the box actually hosting
      IPFS; the canary offer never fights a remote-signed canary; and the offline upgrade
      path verifies against the on-chain anchor with no clearnet dependency. No new network
      exposure on a Tor/I2P-only box.

    Notes

    • No protocol/consensus change. All changes are operator-facing install, upgrade,
      recovery, and seeding robustness.
    Downloads
  • v1.17.0 69ca9a2d76

    Morphit v1.17.0 Stable

    agorise released this 2026-09-10 23:37:58 +00:00 | 61 commits to main since this release

    Morphit v1.17.0

    Operator-safety release. Hardening can no longer strand an operator or take a site
    dark; fast-sync works on a stock box and recovers a stranded flagship from any
    synced peer; Matrix alerts set themselves up with zero hand-editing; and hidden-only
    instances are audited clean of any clearnet reliance.

    Fixed

    • Hardening can no longer lock you out of SSH. harden set PermitRootLogin no
      whenever any key was authorized — including a root-only key — locking out an
      operator whose only login was root. It now disables root login only when a
      non-root keyed user exists, and otherwise keeps key-only root
      (prohibit-password), so it can never strand the sole operator.
    • Hardening can no longer take the public site dark. Enabling UFW flushes
      nftables, wiping Docker's forwarding chains — external traffic reached the box
      but the DNAT-forward to the frontend container was dropped (the box looked
      healthy to itself while the world timed out). harden now re-asserts Docker's
      chains       after the firewall change, verifies the NAT rules returned, and
      hard-fails if they didn't.
    • Fast-sync works on a stock box. The snapshot bootstrap validated against a
      half-loaded environment and bailed (MORPHIT_INDEXER_CHAIN_ID: Required) because
      the fast-sync wrapper only inherited part of the operator env. It now sources
      the same env files the indexer unit does      , so a correctly-configured box can
      fast-sync.
    • matrix-bot no longer crash-loops on an E2EE key collision. Reusing an access
      token after a reinstall causes a "one time key … already exists" collision; the
      bot now self-clears the dead crypto store, prints a plain-language fix, and
      exits cleanly instead of hammering systemd.
    • timeapp language filter. Browsing in a locale no longer auto-locks the order
      language filter (which hid other-language orders and re-appeared on refresh);
      clearing the filter now re-queries immediately.

    Added

    • Fast-sync is the default, and can import a peer snapshot. The install offers
      it [Y/n]; the menu path now offers to stop the indexer (checking the real
      service state, no 90 s wait), offers to discard existing data (no --force
      archaeology), and auto-restarts after. New morphit-ops fast-sync --from-file <snapshot.tar.gz> imports a snapshot handed over from any synced peer — for when
      no fresh on-chain snapshot exists.
    • Harden self-heals a broken run (dead-man's-switch). After a run that changes
      SSH or the firewall, an automatic revert is armed via a transient systemd-run
      timer (independent of your SSH session). Confirm you can still reach the box and
      it cancels; otherwise it restores the exact pre-run SSH + firewall + Docker
      state       within ~2 minutes. Plus a post-harden self-test that fails loud on a
      lockout.
    • Matrix alerts set themselves up — no hand-editing. morphit-ops matrix setup
      (and the install wizard, and harden) collect the recipient + the bot's
      username/password, mint a fresh token via the Matrix login API, persist it,
      clear the stale crypto store, start the bot, and send a test. Entering a Matrix
      address during setup wires the whole thing.
    • Health report: a "Generating your health report…" spinner; CPU/Memory now
      show free; a "Reachable at" list of every address the node serves (clearnet +
      Tor .onion + I2P .b32.i2p); and the install wizard now has an explicit warrant
      canary step and offers to serve the frontend on a new vanity .loki/.i2p.

    Changed

    • npm's update-notifier is silenced globally (no more "new major version of npm"
      noise on install/upgrade). Italian "commissione" → "commissione (fee)" on the
      order fee-status line. The redundant CryptoCompare price source is dropped
      (it required new auth); a source that's up for one asset but doesn't list another
      now reads "no market" instead of an alarming "down".

    Security

    • Hidden-only instances stay clearnet-free. Audited across all of the above:
      the harden auto-revert restores the exact pre-run firewall rules (never opens
      clearnet ports a hidden-only box didn't have); the post-harden self-test skips
      clearnet checks on a Tor/I2P-only box; the health "Reachable at" list never prints
      a clearnet address the node doesn't serve; and fast-sync's env-sourcing fix
      actually improves hidden-only sync (the bootstrap now gets the Tor/I2P proxy
      config). The Matrix token mint uses the same outbound path as the bot itself; a
      fully air-gapped box uses the paste-a-token path.
    • Matrix token stays 0600. The bot access token is written only to
      matrix-bot.env (0600, owner-only) and preserved from there on re-render; only
      the non-secret recipient MXID lives in the group-readable operator config.

    Notes

    • No protocol/consensus change. All changes are operator-facing safety, recovery,
      and privacy hardening.
    Downloads
  • v1.16.13 74122cb0aa

    Morphit v1.16.13 Stable

    agorise released this 2026-09-09 02:02:15 +00:00 | 67 commits to main since this release

    Morphit v1.16.13

    Upgrade robustness on slow/throttled links, an honest update-check, and one more
    self-heal moved onto the release that ships it.

    Fixed

    • Upgrades survive a slow connection. The release download used a fixed 30 s
      total deadline and buffered the whole tarball in memory, so a healthy-but-slow
      link (a throttled or filtered connection) got its download aborted mid-transfer
      ("this operation was aborted"). It now streams to disk with an idle timeout:
      the transfer is only aborted if no bytes arrive for 90 s, so a slow-but-steady
      download completes. Only a genuine stall aborts.
    • A failed update-check no longer looks like "up to date." When the version
      check couldn't reach the release server (e.g. a slow link timed out), the menu
      silently dropped the "update available" marker — indistinguishable from being
      current. It now shows (couldn't check for updates — network) so an outdated
      node is never mistaken for a current one.

    Changed

    • The frontend rebuild now runs in the post-upgrade self-heal phase, from the
      freshly-installed binary (via the re-exec), alongside the WAF and IPFS heals.
      The frontend's nginx.conf is baked into its image, so a config change (e.g. the
      v1.16.12 /v1/broadcast body-size cap) previously only landed on the next
      upgrade; now it applies on the upgrade that ships it. A no-change rebuild is
      cheap (Docker layer cache), and a box without a compose-managed frontend no-ops.

    Notes

    • No protocol/consensus change. All three are operational robustness only.
    • A node upgrading from a pre-v1.16.11 release (no re-exec phase) picks up the
      self-heal behaviour on its next upgrade, once it is driven by a v1.16.11+
      orchestrator.
    Downloads