Skip to content

Nimbus Direct v1.7.2

Choose a tag to compare

View all tags
@eurosatofficial eurosatofficial released this 15 Aug 17:38
· 6 commits to main since this release
v1.7.2
8766ae7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Nimbus Direct v1.7.2

Nimbus Direct v1.7.2 introduces a secure push-notification architecture and further improves the reliability of the upcoming iOS companion app.

Highlights

Secure Nimbus Push Relay

Official iOS push notifications no longer require self-hosted Nimbus operators to possess the Nimbus Direct developer’s Apple APNs private key.

  • New central Nimbus Push Relay architecture
  • Apple .p8 credentials remain exclusively on the relay
  • Self-hosted instances generate their own Ed25519 installation identity
  • Signed requests include timestamps and single-use nonces
  • Replay protection, validation, and rate limiting
  • Notification contents and APNs device tokens are processed only for delivery
  • Structured APNs responses allow invalid device registrations to be disabled safely

Flexible push modes

Nimbus now supports three explicit configurations:

  • disabled — native push is disabled
  • relay — recommended for the official Nimbus Direct iOS app
  • direct — available for custom, independently signed app builds using operator-owned APNs credentials

Push notifications remain completely optional.

Face ID and device-passcode reliability

The development version of the iOS companion app includes several authentication improvements:

  • Fixed authentication errors after returning from the background
  • Prevented duplicate and overlapping Face ID requests
  • Improved rapid background/foreground handling
  • Device-passcode fallback after repeated biometric failures
  • Choosing “Enter Password” now continues directly to the passcode flow
  • Cancelled or interrupted authentication no longer displays a false failure
  • The app remains securely locked throughout the authentication process

Privacy and documentation

  • Updated privacy information for optional relay-based push delivery
  • Clearly documented the boundary between self-hosted Nimbus servers and the developer-operated relay
  • Added relay deployment and security documentation
  • Updated environment-variable and native-push setup instructions
  • Confirmed that normal account, infrastructure, support, console, and Proxmox data remain on the selected self-hosted Nimbus instance

Database and compatibility

  • Added the encrypted push-relay installation identity migration
  • Existing direct APNs deployments remain supported
  • Push-disabled installations continue to operate normally
  • Database changes are applied automatically during startup

Updating

Back up your Nimbus database and APP_SECRET, then rebuild the panel:

docker compose \
  -f compose.yaml \
  -f compose.internal.yaml \
  up -d --build --force-recreate panel

For official relay mode, configure:

PUSH_MODE=relay
PUSH_RELAY_URL=https://your-official-relay-address
PUSH_RELAY_TIMEOUT_SECONDS=10

Remove all APNS_* values from the self-hosted panel when using relay mode.

Direct APNs mode should only be used with a custom app build and Apple credentials owned by that app’s operator.

Notes

  • The Nimbus Direct iOS companion app remains in development and will be released very soon.
  • Normal self-hosted operators do not need to deploy the central relay themselves.
  • No additional Proxmox permissions are required for this update.
Assets 2
Loading