Skip to content

Palisade v1.5.0

Choose a tag to compare

View all tags
@Shakes63 Shakes63 released this 11 Jul 20:11
· 59 commits to main since this release
v1.5.0
70f2c9e

A reliability, security, and onboarding release — plus a mod updater.

Mod updater

Installed mods now stay current on their own. For the two games whose mods don't auto-update on restart — Valheim (Thunderstore) and Minecraft (pinned CurseForge modpack):

  • A background check flags servers with out-of-date mods, shows a "Mod update" badge on the server card, and sends a Discord/ntfy notification (new opt-in group, on by default).
  • "Update all mods" applies every pending update in one click (Valheim mods tab).
  • A new update-mods scheduler action applies mod updates automatically on a cron — skipping the restart entirely when everything's already current, and honoring skip-if-players-online.

Reliability

  • Startup deadline — a server that never reaches its ready marker no longer hangs in Starting forever holding the one-server slot. After a per-game window it's marked failed, torn down, and reported, freeing the box.
  • Start preflight — a start is now rejected before it can do harm when the data volume is too full to install a game (clear "free up disk" message instead of a corrupted half-install), or when the game image isn't available (clear reason instead of a cryptic Docker error).
  • Chaos test harness — recovery behavior (auto-restart, crash-loop cap, the startup deadline, bounded teardown) is now a red-build-if-broken property, not an assumption.

Security hardening

  • Safe archive extraction — every untrusted archive (Thunderstore mod zips, uploads, backup imports) is now vetted for path-traversal (../, absolute paths) and symlink escape before anything is written, independent of the extractor's own behavior.
  • Container-hardening invariant harness — every game's container spec is asserted to keep no-new-privileges, a PID/RAM cap, no auto-restart policy, and — critically — to never mount the Docker socket. A future change that weakens hardening fails the build.

Easier to install

A blank install now just works — nothing to generate in a terminal:

  • SECRETS_KEY and JWT_SECRET are auto-generated and persisted on first start (stable across restarts). An explicit value still wins for bring-your-own setups.
  • HOST_DATA_DIR is auto-detected from the manager's own data mount, so changing the App-data path can't silently break your game servers.
  • The Unraid template marks all three optional; the README has a 3-step Quick start. Existing installs are unaffected.
Assets 2
Loading