v1.31.1

Changed

• The dashboard now uses Waitress instead of Flask's development server.
• Dashboard containers stop cleanly through Waitress's supported SIGINT handler.
• Refreshed the Alpine 3.24 and Python 3.14 slim image pins and updated
  actions/setup-python to 7.1.0 (#121).
• Updated the digest-pinned Gitleaks, Hadolint, and QEMU CI images.

v1.31.0

Added

• Persistent incident log. The monitor now appends every alert-worthy
  event (node down/recovered, failed Healthchecks pings, disk-low, monitor
  restarts) to /state/events.log on the dashboard_state volume, so
  incident history survives container restarts and host reboots — docker logs doesn't. ./stack events prints it. Naive size cap: over 1 MB the
  newest half is kept.

Fixed

• Healthchecks pings no longer fail silently on a bad Tor exit. The
  dead-man ping rides Tor; an exit answering with an HTTP error page counted
  as delivered, so the 5-minute ping clock advanced and Healthchecks.io
  missed pings with nothing in the logs — showing up as random "down" flaps
  while the node was healthy. Non-200 responses now count as failures: the
  monitor retries every minute (on a fresh circuit) until one lands, and
  logs the failure to the incident log.

v1.30.0

Added

• The Upgrade button now sets itself up. Enabling dashboard.control is all
  it takes: ./stack up/apply start the host-side upgrade-agent detached
  (log: ~/upgrade-agent.log) and install a @reboot cron entry so it survives
  reboots — no sudo, no unit file. Disabling control and re-applying stops the
  agent and removes the cron entry. If the documented systemd unit is enabled,
  the stack defers to it. ./stack init asks one new question ("One-click
  upgrades from the dashboard?", default no), and ./stack doctor reports
  whether the agent is running.
• Sandboxed lifecycle tests for the agent manager. test_cli.sh stubs
  crontab/docker/pgrep/pkill/setsid/systemctl onto PATH and drives
  enable → re-apply (idempotence) → disable → systemd-deference without
  touching the host. The suite immediately caught a pipefail crash in the
  disable path when the agent's entry was the only crontab line.

Changed

• README: the feature list now covers one-command upgrades, the daily update
  check, and the Prometheus /metrics endpoint; the Testing section describes
  the full suite (including the e2e Tor-only egress audit and the gitleaks /
  hadolint CI jobs).

Fixed

• CHANGELOG version headings 1.23.0–1.29.1 had no reference links, so they
  rendered as literal brackets on GitHub.

v1.29.1

Fixed

• ./stack apply / ./stack upgrade no longer needlessly recreate bitcoind.
  configure.sh regenerated a fresh rpcauth salt on every run, which rotated the
  derived hash and changed the bitcoin container's env — so docker compose up -d
  recreated bitcoind (triggering its 5-minute flush grace) on every apply or
  upgrade, even for an unrelated change like a dashboard-only edit. The salt is
  now preserved across runs (like the RPC password already was), so an unchanged
  password re-renders byte-identical and only the containers that actually changed
  are recreated. A changed password still rotates the hash and correctly recreates
  bitcoind.
• The upgrade-agent systemd example now runs as the repo owner, not root. The
  1.29.0 unit in docs/operations.md omitted User=, so it defaulted to root and
  the upgrade's git fetch/checkout failed with "dubious ownership" on a
  user-owned checkout. Added User=YOU (must be in the docker group) and
  RestartSec.

v1.29.0

Added

• Opt-in dashboard Upgrade button. When dashboard.control is enabled and a
  newer release is available, the dashboard shows a one-click Upgrade now
  button. It preserves the non-root dashboard's security model: the dashboard
  has no host or Docker access and only writes a request marker to its state
  volume. A new host-side agent, ./stack upgrade-agent, watches for the marker
  and runs ./stack upgrade with the right privileges (run it under systemd —
  see docs/operations.md). Off by
  default; without the agent running, the button does nothing. This is the
  dashboard button the 1.28.0 notes deferred — now possible without giving
  the dashboard host/docker control. Covered by unit tests (endpoint gating,
  CSRF) and an end-to-end CI test (the agent consumes a button-written request
  and upgrades).

v1.28.0

Added

• One-command upgrade: ./stack upgrade. Fetches the latest release tag,
  backs up first, checks it out, and re-applies — pulling the new prebuilt
  images and recreating the changed containers. It only ever moves forward
  (never downgrades), prints a rollback line, and points a tarball (non-git)
  install at the release page. Pairs with the dashboard's existing "update
  available" badge: the badge tells you, ./stack upgrade does it. (CLI only by
  design — no dashboard button, which would require giving the non-root
  dashboard host/docker control.) Covered end-to-end by a new test_upgrade.sh
  that boots one release and upgrades to the next in CI.

v1.27.0

Changed

• The node now accepts inbound connections by default. inbound_onion flips
  from opt-in to on by default — the node publishes a Tor onion service and
  serves blocks back to the network, still with no IP exposure and no host
  port (it's all over Tor). This is the encouraged posture and makes the
  network healthier; the only cost is some extra upload bandwidth. To run
  outbound-only, set "inbound_onion": false in config.json (or answer n to
  the ./stack init prompt, now [Y/n]). Existing deployments keep whatever
  their config.json says; a bare ./stack up/./stack apply will enable it.

v1.26.2

Fixed

• Adding a watch-only wallet on a pruned node no longer silently fails. It
  used to accept the wallet, show "scanning…", then sit at — forever (a full
  rescan can't run on a pruned node). The dashboard now rejects it up front with
  a clear "a full node is required" message and doesn't add it to the list.
• ./stack backup is more robust and honest: it no longer aborts if it
  can't read the node onion key, warns (instead of silently skipping) when a
  container is down so an incomplete archive isn't mistaken for a complete one,
  and captures the watch-only roster (from 1.26.1).
• ./stack restore with no argument prints a clean usage line instead of a
  raw bash error; ./stack init checks for jq/openssl up front.
• configure.sh validation errors name the offending field instead of
  blaming all three at once.
• Loading page no longer shows an internal Docker IP and points you at
  ./stack doctor if it's stuck; add-form errors are now visually distinct from
  the "scanning" message.
• Documentation consistency pass: corrected the stale "images aren't published"
  note, matched the two doc indexes, and completed the config.json example.

Changed

• CI now measures code coverage (pytest-cov, floor 85%; currently ~93%) and
  cancels superseded runs; new tests pin the inbound-onion entrypoint branch and
  cover previously-dark error paths (wallet RPC, alert channels, version/update
  logic).

v1.26.1

Fixed

• ./stack backup now captures the watch-only roster. It previously saved
  config, credentials, and onion keys but not the dashboard_state volume — so a
  lost volume (or a restore onto a fresh box) dropped your curated wallet list
  (labels, keys, birthdays) and balance history. Backup and restore now include
  it (verified against a live stack). No action needed; just re-run ./stack backup.
• Accessibility: the watch-only add-form inputs (label / key / birthday) and
  the remove button now carry aria-labels, so screen readers announce them.

Changed

• CI robustness: workflows now cancel superseded in-progress runs
  (concurrency, keyed by ref) and carry timeout-minutes, so a redundant or
  hung run no longer wastes CI minutes.

v1.26.0

Changed

• Container hardening (2026-07 best-practices sweep). The dashboard now runs
  non-root (uid 1000, like bitcoin) — it's the only service with a host port,
  and it needs no root. All three services also get security_opt: no-new-privileges:true and cap_drop: [ALL]. Verified end-to-end: the full stack
  boots healthy under the new restrictions and the non-root dashboard writes its
  state volume on a fresh install.
  • Upgrade note: the existing dashboard_state volume was written as root, so
    chown it once before upgrading (the dashboard degrades gracefully without this
    — it just can't persist the wallet roster until done):
    docker run --rm -v bitcoin-starter-stack_dashboard_state:/state alpine chown -R 1000:1000 /state

Added

• Optional bitcoin.mem_limit_mb (default 0 = unlimited). Caps the bitcoin
  container's memory so a bitcoind blowup is a contained restart instead of a
  whole-host OOM — worth setting on a RAM-tight box. configure.sh validates it and
  warns if it isn't above dbcache_mb; see Configuration for
  sizing.

Fixed

• A slash-named git branch (feat/x) made STACK_VERSION contain /, which Docker
  rejects as an image tag — docker compose failed with "invalid reference format"
  on any feature branch. Sanitized (/→-).
• CI's GITHUB_TOKEN is now least-privilege (permissions: contents: read).