v1.33.0

Changed

• Require dashboard sign-in on every installation. New installs generate a
  password; existing installations must set a valid dashboard.password
  before applying or upgrading to this version.
• Replace the browser login popup with a sign-in page, expiring sessions, and
  sign-out. Password changes revoke all sessions, and managing RPC credentials
  requires a recent sign-in. Machine clients must send preemptive Basic
  credentials with username admin.
• Add an optional HTTPS reverse-proxy profile and Caddy example, with a
  loopback-only dashboard backend, canonical origin validation, and secure
  session cookies. VPN access remains recommended for VPS administration.
• Bound password verification work, strengthen browser security headers, and
  add a dependency vulnerability check to CI.

Fixed

• Refresh node status in place without replaying tower growth on routine updates.
• Keep the next block's flashing slot visible on full-height towers in both
  the overview and focused views.

v1.32.0

Added

• Node Manager supports Bitcoin Core, Monero, Tari, Litecoin, Dogecoin,
  Bitcoin Cash Node, and Zcash through Zakura, with a responsive tower overview
  and individual status panels.
• Install additional nodes from the dashboard, review their storage paths and
  estimated disk requirements, and opt into LAN interfaces. Port conflicts are
  checked before changes; affected nodes restart only when needed.
• View-only wallets for Bitcoin, Monero, Tari, Litecoin, and Bitcoin Cash, with
  pending and stale states and saved balance snapshots. Dogecoin and Zcash
  explicitly report that wallet balances are unavailable in their pruned modes.
• Ubuntu APT and macOS Homebrew installation, an explicit bitcoin-stack init,
  persistent configuration, and dashboard controls for launch at boot or login.
• Shared Telegram and Healthchecks settings, per-node block alerts, optional
  dashboard authentication, and separate node-interface credentials.
• Cached prices for every supported chain in nine fiat currencies, fetched
  through Tor, with unavailable and stale indicators.
• Experimental post-sync resource profiles: 1 CPU / 2 GiB for Bitcoin and
  Monero, and 1 CPU / 4 GiB for other nodes. Wallet and shared-service overhead
  is additional; full-chain resource qualification remains pending.
• Automatic activation of new container images after APT upgrades, with pinned
  image digests, approved configuration, and preservation of stopped services.
• Signed APT feed with primary fingerprint
  72FD656754BD7534E274360A37070C2730C0B4EA.

Changed

• Rebranded the project and repository as Node Manager. Existing package names,
  bitcoin-stack commands, configuration paths, and data volumes are preserved.
• Replaced the Python dashboard runtime with Go and retained functionality-focused
  Python and frontend regression tests.
• Fresh installations start pruned Bitcoin only, select a private LAN dashboard
  address, leave its password optional, and keep node interfaces and automatic
  launch disabled. Initial sync is uncapped by default.
• Updated Bitcoin Core to 32.1. Runtime internet traffic is isolated behind Tor;
  package and container downloads use the host connection.
• Updated Tari node and wallet to 6.2, dashboard gRPC/protobuf libraries, and
  the Monero image base.
• Release archives contain runtime code, required notices, and user guides;
  tests, parity references, benchmarks, screenshots, and maintainer tools remain
  in the repository.
• Removed the application self-updater. Release notices remain informational;
  users update through APT, Homebrew, or a GitHub download. Legacy upgrade
  commands only print instructions.
• Simplified the README around Ubuntu and macOS installation and refreshed its
  hero with a closer light-mode preview.

Fixed

• Launch-at-login settings remain synchronized after saving or reopening.
• Price fetching retries while Tor initializes and uses the correct Tari feed.
• Monero wallets use private writable ring-database storage and remain pending
  while the daemon syncs.
• Disk capacity, free space, and low-disk alerts use the correct allocation units
  on Docker Desktop bind mounts.
• Compose resources are scoped per installation, and unselected Tari wallet
  services and volumes are not created.
• Settings and node installation validate inputs, preserve private state, and
  roll back interrupted host changes.

v1.31.1

Changed

• The dashboard now uses Waitress instead of Flask's development server.
• Dashboard containers stop cleanly through Waitress's supported SIGINT handler.
• Refreshed the Alpine 3.24 and Python 3.14 slim image pins and updated
  actions/setup-python to 7.1.0 (#121).
• Updated the digest-pinned Gitleaks, Hadolint, and QEMU CI images.

v1.31.0

Added

• Persistent incident log. The monitor now appends every alert-worthy
  event (node down/recovered, failed Healthchecks pings, disk-low, monitor
  restarts) to /state/events.log on the dashboard_state volume, so
  incident history survives container restarts and host reboots — docker logs doesn't. ./stack events prints it. Naive size cap: over 1 MB the
  newest half is kept.

Fixed

• Healthchecks pings no longer fail silently on a bad Tor exit. The
  dead-man ping rides Tor; an exit answering with an HTTP error page counted
  as delivered, so the 5-minute ping clock advanced and Healthchecks.io
  missed pings with nothing in the logs — showing up as random "down" flaps
  while the node was healthy. Non-200 responses now count as failures: the
  monitor retries every minute (on a fresh circuit) until one lands, and
  logs the failure to the incident log.

v1.30.0

Added

• The Upgrade button now sets itself up. Enabling dashboard.control is all
  it takes: ./stack up/apply start the host-side upgrade-agent detached
  (log: ~/upgrade-agent.log) and install a @reboot cron entry so it survives
  reboots — no sudo, no unit file. Disabling control and re-applying stops the
  agent and removes the cron entry. If the documented systemd unit is enabled,
  the stack defers to it. ./stack init asks one new question ("One-click
  upgrades from the dashboard?", default no), and ./stack doctor reports
  whether the agent is running.
• Sandboxed lifecycle tests for the agent manager. test_cli.sh stubs
  crontab/docker/pgrep/pkill/setsid/systemctl onto PATH and drives
  enable → re-apply (idempotence) → disable → systemd-deference without
  touching the host. The suite immediately caught a pipefail crash in the
  disable path when the agent's entry was the only crontab line.

Changed

• README: the feature list now covers one-command upgrades, the daily update
  check, and the Prometheus /metrics endpoint; the Testing section describes
  the full suite (including the e2e Tor-only egress audit and the gitleaks /
  hadolint CI jobs).

Fixed

• CHANGELOG version headings 1.23.0–1.29.1 had no reference links, so they
  rendered as literal brackets on GitHub.

v1.29.1

Fixed

• ./stack apply / ./stack upgrade no longer needlessly recreate bitcoind.
  configure.sh regenerated a fresh rpcauth salt on every run, which rotated the
  derived hash and changed the bitcoin container's env — so docker compose up -d
  recreated bitcoind (triggering its 5-minute flush grace) on every apply or
  upgrade, even for an unrelated change like a dashboard-only edit. The salt is
  now preserved across runs (like the RPC password already was), so an unchanged
  password re-renders byte-identical and only the containers that actually changed
  are recreated. A changed password still rotates the hash and correctly recreates
  bitcoind.
• The upgrade-agent systemd example now runs as the repo owner, not root. The
  1.29.0 unit in docs/operations.md omitted User=, so it defaulted to root and
  the upgrade's git fetch/checkout failed with "dubious ownership" on a
  user-owned checkout. Added User=YOU (must be in the docker group) and
  RestartSec.

v1.29.0

Added

• Opt-in dashboard Upgrade button. When dashboard.control is enabled and a
  newer release is available, the dashboard shows a one-click Upgrade now
  button. It preserves the non-root dashboard's security model: the dashboard
  has no host or Docker access and only writes a request marker to its state
  volume. A new host-side agent, ./stack upgrade-agent, watches for the marker
  and runs ./stack upgrade with the right privileges (run it under systemd —
  see docs/operations.md). Off by
  default; without the agent running, the button does nothing. This is the
  dashboard button the 1.28.0 notes deferred — now possible without giving
  the dashboard host/docker control. Covered by unit tests (endpoint gating,
  CSRF) and an end-to-end CI test (the agent consumes a button-written request
  and upgrades).

v1.28.0

Added

• One-command upgrade: ./stack upgrade. Fetches the latest release tag,
  backs up first, checks it out, and re-applies — pulling the new prebuilt
  images and recreating the changed containers. It only ever moves forward
  (never downgrades), prints a rollback line, and points a tarball (non-git)
  install at the release page. Pairs with the dashboard's existing "update
  available" badge: the badge tells you, ./stack upgrade does it. (CLI only by
  design — no dashboard button, which would require giving the non-root
  dashboard host/docker control.) Covered end-to-end by a new test_upgrade.sh
  that boots one release and upgrades to the next in CI.

v1.27.0

Changed

• The node now accepts inbound connections by default. inbound_onion flips
  from opt-in to on by default — the node publishes a Tor onion service and
  serves blocks back to the network, still with no IP exposure and no host
  port (it's all over Tor). This is the encouraged posture and makes the
  network healthier; the only cost is some extra upload bandwidth. To run
  outbound-only, set "inbound_onion": false in config.json (or answer n to
  the ./stack init prompt, now [Y/n]). Existing deployments keep whatever
  their config.json says; a bare ./stack up/./stack apply will enable it.

v1.26.2

Fixed

• Adding a watch-only wallet on a pruned node no longer silently fails. It
  used to accept the wallet, show "scanning…", then sit at — forever (a full
  rescan can't run on a pruned node). The dashboard now rejects it up front with
  a clear "a full node is required" message and doesn't add it to the list.
• ./stack backup is more robust and honest: it no longer aborts if it
  can't read the node onion key, warns (instead of silently skipping) when a
  container is down so an incomplete archive isn't mistaken for a complete one,
  and captures the watch-only roster (from 1.26.1).
• ./stack restore with no argument prints a clean usage line instead of a
  raw bash error; ./stack init checks for jq/openssl up front.
• configure.sh validation errors name the offending field instead of
  blaming all three at once.
• Loading page no longer shows an internal Docker IP and points you at
  ./stack doctor if it's stuck; add-form errors are now visually distinct from
  the "scanning" message.
• Documentation consistency pass: corrected the stale "images aren't published"
  note, matched the two doc indexes, and completed the config.json example.

Changed

• CI now measures code coverage (pytest-cov, floor 85%; currently ~93%) and
  cancels superseded runs; new tests pin the inbound-onion entrypoint branch and
  cover previously-dark error paths (wallet RPC, alert channels, version/update
  logic).