v1.35.0

Orbis v1.35.0

The interface is new, DNS is never stale, and the whole node does far less work. On the reference
Raspberry Pi 4: forwarded lookups fell from 79 ms to about 20 ms, cached ones from 2.5 ms to under
1 ms, the Go heap from about 600 MB to about 130 MB, and no log rows are dropped.

Added

• The block page. A browser opening a blocked site gets a page saying what stopped it: the
  rule, the list, the device, and one line drawn from the device through each stage to the decision,
  with a link to review it in Orbis. It works on plain http for everyone, and on https for devices
  that trust the Orbis certificate. A device that refuses the certificate is detected after three
  tries and goes back to failing quietly for a day, so nobody is left looking at certificate
  warnings, and an ad inside someone else's page still fails silently. Only a name blocked in its
  own right gets the page. A name that merely leads to a blocked one, or sits in a blocked country,
  keeps the plain sinkhole: that name belongs to whoever runs it, and pointing it at this node would
  hand their page the node's origin. Settings, DNS, "Show a page when a site is blocked".
• The orbit chart. The Overview now answers "is my network safe?" in one sentence, beside a
  live map of the network: Orbis at the centre, devices on their orbits by what they are, each
  reaching the world through the gateway, and traffic running round the rim in one line per region
  as thick as the bytes on it. Blocked lookups stop at the shield and leave a mark you can open. Every
  warning now sits in one list, Needs you, beside what was just stopped. Simple mode's Home carries
  the chart too.
• Internet health. Continuous monitoring of the gateway and public resolvers, with latency,
  jitter, loss, 24 hours of history and an outage log. It tells you in one sentence whether a
  problem is your network or your provider.
• Change timeline. Every saved configuration is kept, the last 200 of them, with what changed and
  a line-by-line comparison, secrets hidden. Restore any version in one click. For anything touching
  the network it asks you to confirm within 60 seconds and rolls itself back if you cannot, so a
  change that cuts you off undoes itself, even if the node restarts or loses power in that minute.
  The rollback reloads the firewall too. Config edits are refused while a restore waits, and it
  tells you which changes only take effect after a restart, because the timer cannot test those.
  Neither a restore nor a rollback brings back an old admin password.
• Zone matrix. Firewall, Zone matrix: a grid of what happens between every pair of zones, with
  the rules that apply and the last hour of traffic in each cell. On a node in observe mode it says
  this is what would apply, not what is applied.
• Every decision can be traced. A blocked row in the DNS log, or a mark on the orbit chart's
  shield, opens the same route line the block page draws.

Changed

• A new look across both interfaces: a star-atlas plate, Prussian blue with brass hairlines,
  jade for safe and vermilion for blocked, violet kept for a traced decision, set in Geist.
  Destructive buttons stay outlined until you mean it. The fonts are built in; the interface still
  makes no outside requests.
• Restarts are quick. The built block index is kept on disk, so filtering is back within seconds
  rather than after two and a half minutes, and shutdown no longer waits out its 20 second timeout.
• Vermilion means a block or a threat, nothing else. Faults such as a lost gateway are amber, so
  anything red on screen can be opened and traced to what decided it. The Overview's sentence, its
  mark and the chart's lines all share one state, so a fault can never sit on the safe colour.
• The Overview says what each layer is doing: DNS filtering, firewall, in-stream ads and threat
  feeds, each on, off or not enforced. Node CPU, memory and temperature moved into Subsystems.
• The firewall opens ports 80 and 443 to your lan and vpn zones when the block page is on, in inline
  mode. Everything else from your non-WAN zones gets a reset, so a blocked name fails at once on every
  port and in every zone rather than timing out. Guest and IoT zones still cannot reach the interface.
• Traffic to Orbis itself skips the filter proxy, so the block page sees the real device.
• URLhaus now comes from AdGuard's compiled feed. abuse.ch withdrew its free downloads. Existing
  installs move over on their own. 1Hosts (mini) switches itself off: it has been empty since March 2025.
• Lists refresh together, overnight. A pass takes everything due soon, between 02:00 and 05:00
  local time, and a list that has not changed costs nothing. Lists used to drift onto separate
  clocks, which rebuilt the whole index about once an hour.
• Upstream DNS connections stay open. Each miss used to pay seven TLS handshakes.
• dns.min_ttl is gone. It is ignored if present. Raising a TTL is what served a 60 second record
  for an hour.

Fixed

• NXDOMAIN reached clients as an empty success, and so did SERVFAIL from an upstream. Every dead
  name on the network looked like a live one with no address.
• The first upstream reply won the race even when it was SERVFAIL or a stale NXDOMAIN. A real
  answer now wins outright, and "does not exist" needs a majority of resolvers.
• A list refresh stopped all logging. Each refresh rewrote the whole list in one transaction,
  which held the write lock for over 30 minutes on the largest list and dropped 125,000 log rows
  a day. Refreshes now write only what changed, in short transactions. This is also what tripped
  the interception load guard.
• The write-ahead log grew past 1 GB and is now cut back once it has been checkpointed.
• A geo repair held the database write lock for minutes after every boot. Logging stopped, devices
  and open ports failed to save with "database is locked", and a restart in that window waited out
  the 20 second shutdown timeout with DNS already down. It now runs only when a GeoIP database
  changes, reads and writes in small steps without holding the lock, and stops with the daemon.
• A list download cut short by a restart was reported as a failed list.
• Cloaked trackers went upstream on every lookup, because blocked CNAME answers were never
  cached. They now cost one query per TTL, and a rule change reaches what is already cached.
• Every cached and allowed lookup scanned all 1,200 list regexes, 2.5 ms a time on a Pi. A verdict
  is now remembered per name.
• Lists answering "not modified" were fetched again every hour.
• Answers larger than the client asked for were sent over UDP anyway, the EDNS flags of cached
  answers were being rewritten, and client cookies were forwarded to upstream resolvers.
• Losing a race counted as a failure, which took slower resolvers out of the pool.

Faster

• Live events reach only the page that wants them, so the shell no longer re-renders four times a
  second. Opening Orbis takes one round trip instead of three, /api/status no longer forks
  tailscale on every poll, and hidden or paused views stop fetching.
• Flows are written every 30 seconds rather than 5, and repeat updates of one flow coalesce, which
  cuts most of the node's writes. A redundant index on the blocklist table is gone.
• The block list index needs about a fifth of the memory and nothing for the garbage collector to
  scan.
• The globe keeps its markers instead of rebuilding them on every live tick, hover is once a frame,
  and the flat map stops drawing when hidden.

---

Install on a Debian/Ubuntu host, VM or LXC:

curl -fsSL https://raw.githubusercontent.com/Neoo-Blue/orbis/main/deploy/bootstrap.sh | sudo bash

Docker:

docker run -d --network host --cap-add NET_ADMIN --cap-add NET_RAW \
  -v orbis-config:/etc/orbis -v orbis-data:/var/lib/orbis \
  ghcr.io/neoo-blue/orbis:stable

Already running Orbis? It offers this release itself: Settings, About & diagnostics, Update now. Or sudo orbisd -update.