Skip to content

1.11.0

Latest
Latest

Choose a tag to compare

View all tags
@demyxco demyxco released this 29 May 14:32
· 9 commits to master since this release
1.11.0
6cc3e46
This commit was signed with the committer’s verified signature.
demyxco Cim
GPG key ID: 0F4FB04A7E640C5D
Verified
Learn about vigilant mode.

Highlights

  • Release-pinned image tags now make generated compose files, helper commands, installs, pulls, backups, restores, and upgrades resolve to the same Demyx release instead of drifting to latest.
  • Daily telemetry now uses a local TOFU identity with Ed25519 signatures and registration, replacing shared-secret HMAC usage in the send path.
  • Host upgrade handling now regenerates pinned compose config, force-recreates core services from the target release image, and avoids empty dangling-image cleanup runs.
  • Update checks now track WordPress CLI versions and preserve full OpenSSH portable versions such as 10.0p2.

Added

  • Added ca-certificates and openssl to the Demyx image for signed telemetry requests.
  • Added WordPress CLI version tracking to the update system.
  • Added TOFU telemetry identity bootstrap in daily cron: auto-creates /demyx/.telemetry, generates Ed25519 keypair when missing, and creates /demyx/.telemetry/identity.json for install_id and key_id.
  • Added TOFU telemetry registration flow to POST /wp-json/demyx/v1/telemetry/register when local identity is not yet registered.

Changed

  • Updated Demyx stack and app compose YAML generation to use direct demyx/<image>:${DEMYX_VERSION} tags instead of runtime Docker Hub tag resolution.
  • Updated Docker run, pull, backup, restore, utility, install, host, and version-check commands to use release-pinned Demyx image tags.
  • Updated code-server image references to use release-pinned variant tags such as ${DEMYX_VERSION}-wp, ${DEMYX_VERSION}-browse, and ${DEMYX_VERSION}-bedrock.
  • Updated Redis compose image from redis:alpine3.18 to redis:alpine3.22.
  • Added v1 moving tag to build and push steps in GitHub Actions workflow.
  • Updated GitHub Actions dependencies to actions/checkout@v6 and docker/login-action@v4.
  • Changed scheduled GitHub Actions build day from Friday to Thursday.
  • Pinned generated host helper and install-time helper commands to the release version.
  • Simplified HAProxy and MariaDB version extraction using regex patterns with grep.
  • Removed duplicate version checks and consolidated LSPHP/PHP version detection using environment variables.
  • Refactored awk commands in the update workflow for better efficiency and consistency.
  • Standardized changelog section headers to align with Keep a Changelog formatting.
  • Replaced shared-secret HMAC telemetry signing in cron with TOFU Ed25519 signed request flow against POST /wp-json/demyx/v1/telemetry.
  • Telemetry request headers now use install identity metadata (X-Demyx-Install-Id, X-Demyx-Key-Id, X-Demyx-Request-Id, X-Demyx-Signature-Alg) instead of HMAC-only auth headers.
  • Updated install --no-ping handling to pass telemetry-disabled state into the helper container.

Fixed

  • Fixed demyx host upgrade repeatedly re-running after helper updates by regenerating pinned compose config and force-recreating core services from the target release image.
  • Fixed demyx host upgrade dangling image cleanup to skip docker rmi when no dangling images exist.
  • Fixed single-image demyx pull commands for Demyx images to use release-pinned tags instead of falling back to latest.
  • Fixed version comparisons for OpenSSH portable versions such as 10.0p1 and 10.0p2.
  • Fixed SSH update cache parsing to preserve full OpenSSH portable versions such as 10.0p2.
  • Fixed regex escaping in the HAProxy version extraction pattern.

Removed

  • Removed Docker Compose version metadata from the generated VERSION file.
  • Removed DEMYX_TELEMETRY_SECRET usage from the daily telemetry send path in function/cron.sh.

Security

  • Replaced shared-secret telemetry authentication with per-install Ed25519 signed telemetry requests.
Assets 2
Loading