Skip to content

v0.5.0

Choose a tag to compare

View all tags
@h4ckx0r h4ckx0r released this 29 Oct 17:15
· 3 commits to main since this release
v0.5.0
ed0be40

First public release of the source code on GitHub.

Added

  • REDIS_PASSWORD_FILE for the API, worker and gateway, as an alternative to REDIS_PASSWORD. The example compose file now passes the Redis password as a secret (created by init.sh), so it no longer appears in any container's environment.
  • OIDC_ALLOW_UNVERIFIED_SIGNUP for providers that verify email addresses but do not send the email_verified claim (such as Entra ID). It only allows sign-up, never linking to an existing local account.
  • OCI labels (title, description, license, source and creation date) on the web, API and worker images.
  • SECURITY.md with the vulnerability reporting policy, and docs/SECURITY-NOTES.md with the authorization model and a deployment checklist.
  • CONTRIBUTING.md and an individual Contributor License Agreement (based on the Apache ICLA v2.2).

Changed

  • The project name is written as InfraWard in every text: web, API, worker, enrollment script and documentation. This includes the TOTP issuer; authenticators that are already set up keep their label. Lowercase identifiers (infraward, paths and keys) are unchanged.
  • The API docs (/docs and /openapi.json) are off by default in production; set DOCS_PUBLIC=true to enable them.
  • PUBLIC_URL must use HTTPS in production, except for loopback addresses.

Fixed

  • The web terminal no longer loses the output of commands that finish immediately.

Security

  • Patched vulnerable dependencies (including fastify, zod, fast-uri, body-parser, multer, undici and vite) and hardened the pnpm supply chain (minimum release age, no trust downgrades, no exotic sub-dependencies).
  • Login is also rate-limited per account, not only per IP (LOGIN_ACCOUNT_THROTTLE_*, with counters in Redis via THROTTLE_STORAGE). Only failures count, a successful login resets the counter, and networks the account has recently signed in from are not blocked, so a single IP cannot lock out another account.
  • Resetting or changing a password now also revokes the user's API tokens.
  • Automatic OIDC sign-up requires a verified email address, so nobody can create an account with someone else's email.
  • The enrollment script refuses a symlinked (or foreign-owned) ~/.ssh or authorized_keys in the inventory user's home and writes them as that user, so it can no longer be tricked into overwriting root's keys.
  • The OpenBao client never follows HTTP redirects, so AppRole credentials and tokens cannot be forwarded to another host.
  • Scan exclusion patterns are matched without regular expressions, which removes a ReDoS on patterns with many *.
  • The web terminal does not accept input until the API has recorded the session opening.
  • The enrollment token is no longer written to the nginx access log.
  • nginx sends X-Frame-Options, CSP frame-ancestors, HSTS, nosniff and Referrer-Policy on every location, and the production build no longer needs script-src 'unsafe-inline'.
  • Container images: updated base images (nginx 1.31 on Alpine 3.24), npm and corepack removed from the API image, Trivy 0.76.1, and every image is scanned for fixable critical vulnerabilities before it is pushed. The worker runs on Ubuntu 26.04 for the OpenSSH client fix (CVE-2026-60002).
  • Example compose file: Redis password, an internal network for PostgreSQL, Redis and OpenBao, cap_drop: ALL, no-new-privileges, read-only root filesystems and non-root users.
Assets 2
Loading