Skip to content

V1.3.5.3

Latest
Latest

Choose a tag to compare

View all tags
@SpiritFramework SpiritFramework released this 05 Nov 17:36
· 5 commits to main since this release
V1.3.5.3
7847ce6

Spirit Panel V1.3.5.3

Security-focused release: origin hardening for Layer-7 floods when the panel sits behind Cloudflare.

Added

  • Nginx connection and request limits — separate budgets for web, API, and auth; higher allowance for /api/remote (FeatherWings); concurrent connection cap per IP. Zones in deploy/nginx/spirit-panel-http.conf.
  • Cloudflare origin helpers — cloudflare-realip.conf, sync-cloudflare-realip.sh, and ufw-cloudflare-origin.sh (80/443 from Cloudflare only). WAF / Managed Challenge guidance in SECURITY.md and PRODUCTION.md.
  • TLS session hardening in the reference nginx site (TLS 1.2/1.3, shared session cache, tickets off).
  • Nginx open-file headroom — raise-nginx-nofile.sh raises worker_rlimit_nofile / systemd LimitNOFILE so floods do not tip nginx into Too many open files (HTTP 500 on static assets).

Upgrade: spirit.sh update --ref V1.3.5.3 (or spirit.sh update on the release channel).

After updating, install rate-limit zones, restore Cloudflare visitor IPs, raise nginx FD limits, then (once Proxied DNS works) lock origin 80/443 to Cloudflare. See SECURITY.md → Layer-7 / TLS floods. Do not re-run a full install just to refresh nginx — copy/merge the site config and keep your server_name / cert paths.

Assets 2
Loading