v2.4.1

Summary

Adds a relay secret exempt list (RELAY_SECRET_EXEMPT env var) that allows specific target names to connect without the relay secret. Also adds static (musl/Alpine-compatible) binaries to the release.

Changes

RELAY_SECRET_EXEMPT env var

• Comma-separated target names allowed to connect without the Bearer token
• When set, unauthenticated WebSocket connections are allowed to upgrade, but rejected on register unless the target name is in the exempt list
• When not set (empty), behavior is unchanged: all unauthenticated connections are rejected at the WebSocket upgrade level
• Enables gradual migration: legacy nodes can keep connecting while new nodes adopt the secret

Static binaries (Alpine/musl compatible)

• remotecmd-cli-linux-amd64-static (CGO_ENABLED=0)
• remotecmd-cli-linux-arm64-static (CGO_ENABLED=0)
• Needed for Alpine Linux containers (supergato, etc.) that use musl instead of glibc

Sidecar updates (remotecmd-sidecar repo)

• Both node and go sidecars now accept relaySecret in the pair request payload
• Pass --secret to set-relay when provided
• Falls back to RCMD_RELAY_SECRET env var

Deployment status

• dk1 relay: running with RELAY_SECRET + RELAY_SECRET_EXEMPT=supergato,74ac167fc6df,PRINTER-BOT-V1,coolify,dk31
• 6/7 targets alive: rbm21, dk2, vps1, pve2, rbm20, supergato (all with secret)
• rfs_dev_ecobox (74ac167fc6df): offline (daemon killed, no direct SSH) — in exempt list, will connect when daemon restarts
• dk31, PRINTER-BOT-V1, coolify: connected via exempt list (legacy nodes)

Test plan

• 8 unit tests for relay secret (reject/accept/wrong/no-secret/exempt-allow/exempt-reject/helpers/splitCSV)
• Full test suite passes (21s)
• CI green
• Deployed to dk1 with secret + exempt list
• 6/7 targets verified alive through enforced relay
• supergato re-paired via sidecar with relay secret

Generated with Devin