v0.5.0

v0.5.0 is the resilience-and-hardening release. A TollGate now degrades gracefully instead of falling over: a failing Cashu mint no longer blocks purchases, the merchant drops into a degraded mode (and recovers) when no mint is reachable, and the reseller path got a dedicated upstream Wi-Fi manager plus two-router autopay reliability fixes. Around that core, the captive portal gains HTTPS, Lightning checkout, and a balance view; configuration becomes schema-driven with a JSON CLI for admin-UI integration; packaging adds .apk output for OpenWrt 25.x and an x86_64 target; and a security pass hardened password generation, proxy-header trust, and the captive-portal firewall posture.

Highlights

• Per-mint health tracking, try-all-mints fallback, and automatic recovery (#120, #167)
• Merchant degraded mode with dynamic upgrade/downgrade and portal UI (#138, #139, #140, #141)
• Upstream Wi-Fi manager: connectivity check, TollGate-aware probing, cross-radio DHCP nudge (#109, #122)
• Captive portal HTTPS with self-signed cert mode + Lightning checkout + balance view (#107, #123, #142)
• Schema-driven config with tollgate --json config schema/get/set/save for admin-UI integration (#147)
• .apk packaging for OpenWrt 25.x + x86_64 target + local SDK build helper (#97, #80, #105, #79, #183)
• Redundant Nostr/Blossom release distribution (#152, #155, #183)
• Security: crypto/rand passwords, X-Forwarded-For hardening, IPv6 portal bypass closed (#111, #104, #148, #160, #163)

Behavior changes on upgrade

• Config schema migrates v0.0.7 -> v0.0.8 in place (#178)
• Default profit share splits dev cut across 3 maintainers (0.07 each) (#165)
• IPv6 disabled on LAN at install (closes portal bypass) (#148, #160)
• NoDogSplash gateway port -> 2050, BOLT11 decode non-fatal (#158)
• Router hostname -> "TollGate", cert CN matches (#123)

Notable fixes

• Payment correctness: case-insensitive mint URLs, spent-token detection, valve re-auth (#104)
• Transport: TLS 1.2 forced, HTTP timeouts on constrained routers (#137)
• First-boot: reboot race eliminated, uci-defaults faster, postinst fixes (#84, #90)
• .ipk installs on stock OpenWrt (gzipped tar, not ar) (#100)
• Two-router autopay: ndsctl auth retry, valve timer race, payout safety (#161, #170)
• Expired session eviction + scan loop (#106)

Install

• Pre-built packages and firmware: https://releases.tollgate.me
• OpenWrt 25.x: apk add --allow-untrusted tollgate-wrt-<version>.apk
• OpenWrt 24.10 and earlier: opkg install tollgate-wrt_<version>_<arch>.ipk
• From source: scripts/build-sdk-package.sh cross-compiles and stages the packaging recipe into the OpenWrt SDK
• Nostr: releases are announced as NIP-94 events on project relays, with multiple Blossom mirror URLs per artifact

TollGate Review Club

We're launching the TollGate Review Club, inspired by the Bitcoin Review Club. The idea: TollGate enthusiasts who want to go deeper can help us test alpha releases and validate that they're ready to be marked stable. You'll get hands-on with new features before anyone else, learn how TollGate works under the hood, and directly shape what ships. Join the Signal group to get started: https://signal.group/#CjQKIBMfNzyL5IXRRG_R6JVl3rFEjDsN7x6ITt_CoFjjePC7EhCg8VnskJZJRNRSNKQ-GR4i

Contributors: @c03rad0r, @Amperstrand, @Origami74, @alexxie16

Full changelog: https://github.com/OpenTollGate/tollgate-module-basic-go/blob/main/CHANGELOG.md
Compare: v0.4.0...v0.5.0