v1.17.0 - Secrets at rest, in-app credential rotation, Lightning payouts
This is a security release. Your secrets are now encrypted at rest, you can change your password and rotate your Braiins tokens from the dashboard, and Profit & Loss finally counts Lightning payouts. Existing installs upgrade themselves on first start, and Umbrel updates in place.
Security
Secrets are encrypted at rest (#331, GHSA-wvpp-w528-9p8x). Your Braiins tokens, bitcoind RPC password, Telegram token, and DDNS credential are now AES-256-GCM encrypted in the database instead of plaintext, and your dashboard password is stored as a one-way scrypt hash. A copied state.db or a backup no longer hands over your secrets. The key comes from BHA_SECRET_KEY (on Umbrel that's the device-derived APP_SEED, kept outside the app's data) or a generated key file next to the database. If the key is ever lost the daemon treats the secret as unset and asks you to re-enter it, rather than crash-looping. This protects the data-leaves-the-box cases; it does not, and by design cannot, protect against someone who already controls the running machine.
No more secrets in the audit trail (GHSA-x8x9-3m72-9w8w). The config-change history no longer records credential values, and any that were previously logged are scrubbed on upgrade. Credential fields are also write-only in the settings API now: the dashboard shows them blank and keeps the saved value if you leave them blank.
New
Change your password and rotate your Braiins tokens in-app (#332). Config → Pool & Payout → Security & credentials. The password change takes effect immediately (the old one stops working at once); a new Braiins token is checked against Braiins before it's saved, so a typo can't quietly break bidding. Every change asks for your current password first. This is the first way to rotate these secrets without a shell or SOPS, so it finally works on Umbrel. On env/SOPS installs the section is read-only and points you to where those secrets are defined.
Profit & Loss counts Lightning payouts (#323). The "collected" figure now reads from Ocean's own payout ledger (the earnpay endpoint), so both on-chain and Lightning payouts count, split by rail, and a payout you've already spent still shows up. You no longer need a Bitcoin node for the collected number. An optional on-chain source still adds the confirmation gems to the chart.
Upgrading
Nothing to do. Existing installs encrypt their stored secrets and hash the password in place on the first start of this version. Umbrel updates the app in place.
Full technical detail: docs/security-secrets-at-rest.md and docs/credential-rotation.md.