Torrentinel 0.9.5

Torrentinel 0.9.5 is a security release. Upgrading is recommended for every installation, especially those with more than one account.

Personal tracker mirrors are now limited to the tracker's own domains (for example rutracker.net) and the global mirror. Previously any signed-in account could point a personal mirror at any address and make the server request pages on the local network, then read part of the response. A stored personal mirror that is no longer allowed is ignored and the global mirror is used instead; administrators can still set any global mirror, including one on the local network. This also stops an account from feeding made-up RuTracker search results into the release buffer that all accounts' rules share.

The integrated browser now starts Chrome with its sandbox. The supplied Compose file applies a seccomp profile (deploy/torrentinel-seccomp.json, Docker's default plus user namespaces) that makes this possible; Podman's default profile already allows it, so the Quadlet is unchanged. The log says "The integrated browser runs Chrome with its sandbox." when it works and warns when it falls back; BROWSER_SANDBOX=true refuses to run without it. Independently of the sandbox, the browser only opens pages on the tracker's own domains, cannot open further windows, and connects only through a proxy inside Torrentinel that resolves host names itself and refuses local and private network addresses for everything except the tracker, including frames, workers, service workers, WebSockets and WebRTC.

Cover art is downloaded only from public internet addresses, checked for every redirect and again when connecting, unless it comes from the release page's own host. Tracker sessions send cookies only to the site that set them, refuse redirects to local addresses and form re-submission to another host, and stop reading responses above 20 MB. Magnet and torrent links read from tracker pages are kept only when they are real magnet or http(s) links.

Sign-in is limited after repeated failures (HTTP 429 with Retry-After), as are current-password guesses on the password change form, and unknown or disabled accounts take as long to reject as a wrong password. Behind a reverse proxy, set the new TRUST_PROXY to the proxy's address so the limits apply per client. State-changing requests from other sites are rejected. Disabled accounts' subscriptions are no longer checked, Telegram bot tokens must have BotFather's format, and the server warns when PUBLIC_URL uses HTTPS without SESSION_COOKIE_SECURE=true. Fastify is updated to 5.12.5.

Upgrade notes: there is no database change, and 0.9.1 runs unchanged against the same data. Docker Compose needs deploy/torrentinel-seccomp.json from the same checkout, which the documented update provides. Personal mirrors outside the tracker's domains stop being used; ask an administrator to set such a mirror globally. Back up the database and application data together before upgrading.

Validation: 250 automated tests, run in CI and inside both the linux/amd64 and linux/arm64 image builds, a typechecked production build, and the npm run check:ui layout check (48 page checks). Both published images passed a fresh-install browser smoke test, which now also confirms that the integrated Chrome reports itself sandboxed, cannot reach a local address or leave the tracker, and that cross-site requests and disallowed personal mirrors are refused.

Container images are provided for linux/amd64 and linux/arm64 under bah0/torrentinel:v0.9.5 and latest.