Skip to content

ExitLane v0.2.0-beta

Choose a tag to compare

View all tags
@kevindraai kevindraai released this 25 Jul 16:08
· 21 commits to main since this release
v0.2.0-beta.1
ebe2951
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ExitLane 0.2.0-beta.1

This is the first beta release of ExitLane.

Highlights

  • Browser-based installation and first-run setup wizard.
  • Provider-neutral VPN management with NordVPN as the first provider, including NordLynx connection, country selection, status, reconnect, and sign-out flows.
  • Independent WireGuard ingress and authenticated client-configuration management.
  • ExitLane-owned fail-closed VPN killswitch behavior with tunnel-loss recovery.
  • Local administrator authentication, password recovery, TOTP MFA, one-time recovery codes, session management, trusted-proxy support, and security hardening.
  • Root-only encrypted appliance backups, strictly validated restore, schema compatibility checks, protected alpha-to-beta upgrade snapshots, and automatic rollback after installer failure.
  • English and Dutch localization, Activity history, operational health information, and responsive light/dark UI.
  • Debian 12 and 13 installation support, with the primary appliance validation performed on a Debian 13 Proxmox LXC.
  • Automated backend, frontend, installer, dependency, CodeQL, secret-scanning, and passive ZAP checks.

Beta notice

This is a prerelease. Validate ExitLane carefully in a non-production environment before relying on it for network egress. Create and verify an encrypted appliance backup before upgrading, and retain the protected local recovery snapshot until post-upgrade validation is complete. Report product bugs through GitHub Issues; report security vulnerabilities privately according to SECURITY.md.

Upgrade or installation notes

Install from a trusted checkout on Debian 12 or 13:

sudo ./installer/install-debian.sh

The supported in-place upgrade path is from the accepted 0.2.0-alpha.1 baseline to 0.2.0-beta.1. Before upgrading, create and verify an encrypted backup with the root-only exitlane-cli backup commands. Do not run backup, restore, or multiple installers concurrently. A Proxmox LXC requires /dev/net/tun and permission to create WireGuard interfaces.

Known limitations

  • No signed automatic update channel.
  • Local recovery snapshots are host-bound, contain plaintext appliance state, and must remain root-only.
  • TLS termination is external; direct public-Internet exposure is unsupported.
  • Root or hypervisor compromise is outside the application security boundary.
  • TOTP is not phishing-resistant.
  • No independent penetration test, WebAuthn, high availability, public API, plugin system, or additional VPN provider is included in this beta.

Release commit: ebe29517eae6456e4a332241cd28bb79f65c9551

What's Changed

  • feat(activity): add structured application event log by @kevindraai in #4
  • refactor(frontend): split monolithic index.html into server-side partials by @kevindraai in #5
  • security: add hardening and security assurance baseline by @kevindraai in #6
  • build(deps): bump github/codeql-action/init from 3b0bd1d116c0bde30213346b22d4f634d96a2fb0 to 4187e74d05793876e9989daffde9c3e66b4acd07 by @dependabot[bot] in #7
  • build(deps): bump github/codeql-action/analyze from 3b0bd1d116c0bde30213346b22d4f634d96a2fb0 to 4187e74d05793876e9989daffde9c3e66b4acd07 by @dependabot[bot] in #8
  • build(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 by @dependabot[bot] in #11
  • build(deps): bump actions/setup-python from 5.6.0 to 7.0.0 by @dependabot[bot] in #10
  • build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #12
  • build(deps): bump python from 3.13-slim to 3.14-slim in /docker by @dependabot[bot] in #9
  • feat(vpn): add resilient country selection and provider recovery by @kevindraai in #18
  • build(deps): bump actions/checkout from 4.4.0 to 7.0.1 by @dependabot[bot] in #14
  • build(deps): bump gitleaks/gitleaks-action from dcedce43c6f43de0b836d1fe38946645c9c638dc to ff98106e4c7b2bc287b24eaf42907196329070c7 by @dependabot[bot] in #16
  • build(deps): bump actions/setup-node from 4.4.0 to 7.0.0 by @dependabot[bot] in #15
  • WireGuard-clientconfiguratie veilig beheren by @kevindraai in #19
  • feat(settings): add self-service credential and provider management by @kevindraai in #20
  • refactor(vpn): introduce provider abstraction by @kevindraai in #21
  • feat(auth): add MFA and safe reverse proxy configuration by @kevindraai in #22
  • refactor(settings): reorganize settings navigation by @kevindraai in #23
  • feat(vpn): add provider-independent killswitch by @kevindraai in #24
  • Reset navigation state after authentication by @kevindraai in #25
  • Add managed reverse-proxy settings by @kevindraai in #26
  • Fix reverse proxy environment defaults by @kevindraai in #27
  • Add provider-managed NordVPN installation by @kevindraai in #28
  • Fix NordVPN installation reconciliation by @kevindraai in #29
  • Improve NordVPN installation checklist by @kevindraai in #30
  • Fix NordVPN installation flow and gateway settings by @kevindraai in #31
  • Polish provider readiness, navigation, and killswitch UX by @kevindraai in #32
  • Add NordVPN provider logo and stabilize Safari sidebar rendering by @kevindraai in #33
  • Prepare ExitLane v0.2.0-beta.1 by @kevindraai in #34
  • chore(release): prepare v0.2.0-beta.1 by @kevindraai in #35

New Contributors

Full Changelog: v0.2.0-alpha.2...v0.2.0-beta.1

Contributors

kevindraai and dependabot
Assets 2
Loading