Keel Web 19.0-5, testing build 2026-10-12 step 12 (not signed, ISO missing)

Step 12 build of 2026-10-12, Web 19.0-5 on Core 19.0-10.

Debian trixie and archive.keellinux.org trixie-testing only; keel 0.23.13, keel-core 0.1.3, keel-overlay-vip 0.2.0 (installed, every unit off), inithooks 2.3.6+keel23, confconsole 2.2.3+keel15. No private key, certificate or machine-id in the image; root locked.

Lean core per decision 0052 (one image per application): the boot set (kernel, initrd tools, firmware, bootloaders, installer) is not in the container template; it moves to the per-appliance boot layer the ISO is made from.

NOT SIGNED, NOT FOR PRODUCTION: no archive key signature; the build keyring has no secret signing subkey.

ISO IS MISSING: this pre-release ships the container template (tar.zst) alone, per decision 0052 section 8. Not on the mirror. Testing channel.

Keel Web 19.0-4, testing build 2026-10-10 step 11 (signed)

Step 11 build of 2026-10-10 on Core 19.0-9: Debian trixie and archive.keellinux.org trixie-testing only; keel 0.20.0, keel-core 0.1.3, keel-overlay-vip 0.1.1 (installed, every unit off), inithooks 2.3.6+keel23, confconsole 2.2.3+keel15. No private key, certificate or machine-id in the image or its layer tarballs; root locked; signed by the Keel archive key.

Mirror: https://mirror.keellinux.org/images/debian-13-keel-web_19.0-4_amd64.tar.zst (same bytes). Release 2026-10-10 revision 1.

Testing channel. Not for production.

Keel Web 19.0-3, testing build 2026-10-03 step 10 (signed)

Final build of 2026-10-03 (step 10): Debian trixie and archive.keellinux.org trixie-testing only; keel-core 0.1.2, keel-web 0.2.0 (Keel default site), inithooks 2.3.6+keel21, confconsole 2.2.3+keel14, common with /etc/keel_version and no stale 127.0.1.1. No private key, certificate or machine-id in the image; root locked; signed by the Keel archive key.

Mirror: https://mirror.keellinux.org/images/debian-13-keel-web_19.0-3_amd64.tar.zst (same bytes). Release 2026-10-03 revision 3.

Testing channel. Not for production.

Keel Web 19.0-2, testing build 2026-10-02 (signed)

Web image of the attended release of 2026-10-02 (step 9): built on the core layer of the same release from Debian trixie and archive.keellinux.org trixie-testing only, no TurnKey source; no private key, certificate or machine-id in the image (keel-core#8); signed by the Keel archive key.

Mirror: https://mirror.keellinux.org/images/debian-13-keel-web_19.0-2_amd64.tar.zst (same bytes; .sha512 and .sha512.asc beside it). Layer web sha256 f8c022c41373a77919fc75971ee03d17662f72f9fa38fb93bd2e1c651f819dcd on core ee0f7aa7…, release 2026-10-02 revision 2.

Testing channel: the image follows trixie-testing. Not for production.

Keel Web 19.0-1, testing build 2026-10-02 (unsigned)

Test image of Keel Web, Phase 3 of the roadmap (Keel-Linux/tracker#46), built in isolation from this commit (keel-web master, ae46b34) on the Core layer of keel-core master (1902ac8), with every package built from its merged head: keel 0.15.1, inithooks 2.3.6+keel16, confconsole 2.2.3+keel11, keel-web 0.1.1, common 19.x (keel-overlay-coraza 0.1.2), anubis 1.27.0-0+keel3, libnginx-mod-http-coraza 0.21.0-0keel2, libcoraza 1.8.0, coreruleset 4.25.1. Testing only: not for production and not signed. Verify with the .sha512 file. Supersedes testing-19.0-1-step7-20261001-2.

The file name keeps the 19.0-1 testing series; the recipe inside the image now says 19.0-2.

Proxmox: copy to /var/lib/vz/template/cache and create a container from it. Plain LXC: extract into the rootfs.

Fixed since step7b (2026-10-01)

• HTTPS with Anubis: in the cloud modes the front is HTTPS only (port 80 answers 301), so Anubis's Secure cookies work and browsers pass the challenge (keel-web#3).
• The WAF no longer blocks Anubis's pass-challenge when the site is opened by IPv4 or IPv6 address (common#27).
• Coraza writes /var/log/coraza/audit.log, which names the CRS rule of each block (common#27).
• Anubis no longer answers 500 at random to clients without gzip (anubis#2); pass-challenge redirects only to the request's own origin (anubis#3).
• The usage screen lists the site first (keel-web#3).
• Everything listed for Keel Core: Keel branding and console art, C.UTF-8 login, password shown once, keel inspect, overlay confirm, monit summary (inithooks#32, #33, confconsole#16, #17, #18, common#26, #28, keel#64, keel-core#19, #20, #21).

Tested

First boot (manual password, no Keel Cloud key); simple: plain Nginx on port 80, Anubis off; cloud_simple through keel spec apply --system (17 changes, 0 failed): HTTPS on 443, 301 from 80, challenge passed by name, IPv4 and IPv6 in Chromium, XSS and SQLi get 403 with the rule ids in the audit log, a gzip page comes through whole, 300 challenge requests without gzip all get 200, Monit with nginx, waf-blocks and anubis all OK; a second apply changes nothing; back to simple. No SSH host keys, Anubis key, CrowdSec identity or secrets in the image, and the machine-id is empty.

Still open

• A site opened by a *.localhost name: CRS 934190 (SSRF) blocks pass-challenge with 403. A normal name and addresses work.
• On 80x24 and 100x30 terminals the console art scrolls off the top of the login message.

Keel Web 19.0-1, testing build 2026-10-01, second (unsigned)

Superseded by testing-19.0-1-step8-20261002. Use that build instead.

Test image of Keel Web, Phase 3 of the roadmap (Keel-Linux/tracker#46) and step 7 of handbook decision 0041, built in isolation from this commit (master after keel-web#1) on the Core layer of keel-core master, with keel 0.15.0 (Keel-Linux/keel#63), common 19.x after common#25 (keel-overlay-coraza 0.1.1), and the step 5 packages from their keel/trixie heads, libnginx-mod-http-coraza 0.21.0-0keel2 among them (libnginx-mod-http-coraza#3 and #4). Not for production and not signed. Verify with the .sha512 file. Supersedes testing-19.0-1-step7-20261001.

Proxmox: copy to /var/lib/vz/template/cache and create a container from it. Plain LXC: extract into the rootfs.

What it was tested for, in an LXC container on the build host:

• Simple installation: plain Nginx serves the default page (200), Coraza not loaded (a Core Rule Set payload gets 200), Anubis disabled and inactive; Monit watches sshd, Webmin, postfix and nginx; a second apply changes nothing.
• keel manifest validate passes and keel manifest show web --resolved prints the Web table of 0041.
• Cloud simple, through the spec and keel spec apply --system (17 changes, Coraza's and keel-web's state hooks included): CRS payload 403; a browser gets Anubis's challenge; Googlebot from 2001:4860:4801:10::1 gets the page (simulated: a test-only set_real_ip_from the test client with real_ip_header X-Forwarded-For), from any other address it is challenged; a static page asked for with gzip is whole (625 of 625 bytes) through Anubis and on the socket; Monit adds crowdsec, firewall-bouncer, anubis and waf-blocks; a second apply changes nothing.
• Back to simple through the spec: Debian's default site and plain Nginx again.
• No SSH host keys, Anubis key, CrowdSec identity, machine-id or hook record in the image.

Keel Web 19.0-1, testing build 2026-10-01 (unsigned)

Superseded by testing-19.0-1-step8-20261002. Use that build instead.

Test image of Keel Web, Phase 3 of the roadmap (Keel-Linux/tracker#46) and step 7 of handbook decision 0041, built in isolation from this commit (keel-web#1) on the Core layer of keel-core master, with keel 0.15.0 (Keel-Linux/keel#63), the common overlays of 19.x and the step 5 packages (libcoraza 1.8.0, libnginx-mod-http-coraza 0.21.0, coreruleset 4.25.1, anubis 1.27.0). Not for production and not signed: the attended, signed release on releases.keellinux.org comes later. Verify with the .sha512 file.

Proxmox: copy to /var/lib/vz/template/cache and create a container from it. Plain LXC: extract into the rootfs.

What it was tested for, in an LXC container on the build host:

• Simple installation: plain Nginx serves the default site (200), Coraza's module is not loaded (a Core Rule Set payload gets 200), Anubis is disabled and inactive; Monit watches sshd, Webmin, postfix and Nginx with its /keel-health probe; a second apply changes nothing.
• keel manifest show web --resolved prints the Web table of decision 0041.
• Moved to cloud simple through the spec with keel spec apply --system: a Core Rule Set payload gets 403; a browser user agent gets Anubis's challenge; Googlebot's user agent from 2001:4860:4801:10::1 gets the page, sent through a trusted proxy setting added for the test (set_real_ip_from the test client, real_ip_header X-Forwarded-For), while the same user agent from any other address is challenged; Monit adds CrowdSec, the bouncer, Anubis and the waf-blocks probe; a second apply changes nothing.
• Back to simple through the spec: Debian's default site and plain Nginx again.
• No SSH host keys, Anubis key, CrowdSec identity, machine-id or state hook record in the image.

Known: with Coraza on, a static file answered with gzip comes back empty (Keel-Linux/libnginx-mod-http-coraza#2); the default site avoids it on its internal hop.