Torrentinel 0.9.6

Torrentinel 0.9.6 removes the last known way to take over a new installation.

There is no default admin/admin password any more. On first start Torrentinel creates the account admin with a random password, saves it in initial-admin-password in the application-data directory (readable only by Torrentinel's user), and prints it in the log line starting "First sign-in:" until it has been changed. Set INITIAL_ADMIN_PASSWORD to choose it instead. The file is deleted after the first password change. An existing installation that nobody has signed in to yet has its admin/admin password replaced the same way at startup, and any session that used it ends. The README shows how to read the password for each installation method.

Torrentinel now answers only requests addressed to an IP address, a single-word or local-only name (.local, .lan, .home, .home.arpa, .internal, .localdomain), the host of PUBLIC_URL, or a name in the new ALLOWED_HOSTS setting; other names receive HTTP 403 and a log warning. This stops DNS rebinding, where a web page reaches an installation on the visitor's network, for example to try passwords, under the attacker's own domain name.

The supplied Docker Compose file and Podman Quadlet now publish Torrentinel on the local machine only. Set TORRENTINEL_BIND_ADDRESS=0.0.0.0 in .env (Compose) or PublishPort=8999:8080/tcp (Quadlet) to open it to other devices.

Upgrade notes: if you open Torrentinel under a domain name that is not the host of PUBLIC_URL, for example through a reverse proxy, add it to ALLOWED_HOSTS before updating. IP addresses and names such as nas or nas.lan keep working. Docker Compose users who reach Torrentinel from other devices should set TORRENTINEL_BIND_ADDRESS. Accounts that have already changed their password are unaffected, and there is no database change. Back up the database and application data together before upgrading.

Validation: 255 automated tests, run in CI and inside both the linux/amd64 and linux/arm64 image builds, a typechecked production build, and the npm run check:ui layout check (48 page checks). Both published images passed a fresh-install browser smoke test that signs in with the generated password, confirms admin/admin is rejected and the password file is deleted after the change, and checks that a foreign host name is refused while addresses and local names are served.

Container images are provided for linux/amd64 and linux/arm64 under bah0/torrentinel:v0.9.6 and latest.