Skip to content

v1.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 22:29
· 137 commits to master since this release
v1.2.0
9d494ff

Changes

  • Enrolled nodes and region probes follow the node channel URL the console gives out (channel-follow-v1, proto v1.2.0). When the operator changes the URL in the console's system settings, every heartbeat answer (for probes, every round of targets) carries the new URL. The node first checks it: one CheckChannel call that needs mutual TLS, with the CA pinned at enrollment and the node's own certificate, and the console must recognize the node. Only then does the node rewrite identity.json atomically and connect to the new URL, keeping the previous one as its fallback. There is no restart and no new enrollment, and https://, wss:// and ws:// URLs replace each other.
  • A URL that fails its check is not taken. The node stays on its URL and reports why (unreachable, websocket_refused, tls_untrusted, rejected, wrong_identity, invalid_address), then tries again after 1, 5, 15 and 60 minutes. Only the console's latest URL counts.
  • When no call succeeds on the URL in use for 3 minutes, the node checks its fallback and uses it until its URL works again, trying it every 5 minutes. The fallback is never written to identity.json, so after a restart the node connects to its URL first.
  • The URL only decides which host the node connects to and which name it verifies, never which certificates it trusts. Nodes refuse URLs with credentials, a path, a query, or a scheme other than https, wss and ws. A new console host joins the nftables allow list before the node connects to it.
  • New command edgeweir-node set-server --server URL [--server-name NAME] [--probe] for a node (or probe) that lost the console because its address went away first. It checks the new URL with the node's own identity and only then changes identity.json, keeping the identity, key and certificate. A failed check changes nothing. A running agent picks up the new URL within seconds.
  • Heartbeats report the URL in use, the fallback and the last failed check (ReportStatusRequest.channel), so the console can show which nodes still use an old URL.

With an older console nothing changes: it gives out no URL, and the node keeps the one it uses. set-server also works with an older console. Older agents read the changed identity.json as before, so a downgrade keeps the switched URL.

Upgrade: use the console's node upgrade, or the install command with --version 1.2.0.

Changelog

  • 05da4a8 build(proto): generate from proto/v1.2.0
  • 4c2ae5b docs(licensing): adaptive L7 DDoS mitigation and bot scoring are commercial
  • 42a71f0 feat(agent): follow the node channel URL the console gives out
  • d9e86a2 feat(cli): set-server checks a new console address and keeps the node's identity

Verify

cosign verify-blob \
  --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github\.com/marvinli001/edgeweir-node/\.github/workflows/release\.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt
sha256sum --ignore-missing -c checksums.txt
gh attestation verify <artifact> --repo marvinli001/edgeweir-node
Assets 26
Loading