OwnTransit 0.1.2 — One-command VPS setup (signed development preview)

OwnTransit 0.1.2 — SIGNED DEVELOPMENT PREVIEW

VPS relay setup is now one command. Run this on a supported Linux VPS:

curl -fsSL https://github.com/sentrybottale/OwnTransit/releases/download/v0.1.2/install-preview-linux.sh | sudo sh -s -- relay

Enter the full public URL at the visible prompt, for example
wss://relay.example/connects. You can also append that URL after relay in
the installation command. It selects the website when several domains share
the server.

Setup detects Docker or Podman, installs a runtime through a supported package
manager when needed, loads the signed package's image, runs the relay as a
non-root container user and enables its reboot service. You do not create a
service account or type container commands. The host relay port stays on
127.0.0.1:9087.

Existing correct HTTPS routing is reused. Standard local Nginx, Apache and
Caddy adapters add only the selected site's /connects route, keep a private
backup, validate configuration and reload it. An identified older relay can be
replaced, with its existing pairing keys adopted. Failed public WebSocket
verification restores the previous relay and changed site; rollback errors are
reported. Unrelated listeners and unknown layouts are not silently replaced.

After the receiver prints its public ID, register it on the VPS with:

sudo owntransit-relay-preview register RECEIVER_ID

Full installation and pairing instructions.

Scope

This development preview supports Linux amd64/arm64 with systemd and an
existing HTTPS site. It covers recognized local Nginx/Apache/Caddy layouts and
can reuse a correct route supplied by any other proxy. It does not claim safe
automatic configuration of every bespoke proxy or a domain without HTTPS.
The same setup interface is independent of the hosting provider.

Endpoint TLS authorization, fixed loopback SSH target and terminal security
alarms are unchanged. No SSH account, SSH key, website content, database or
provider firewall setting is managed by this setup. The prior 0.1.0 and 0.1.1
release assets remain immutable.

Integrity and checks

Source: 4b2bceea6398e8568f18f9b3a87645f3ad4f63e4, reviewed in PR #17.
The signed tag and capsules select this source tree. Development signatures
use the existing distribution key and the separate
owntransit-development-v1 namespace. Initial curl-script delivery trusts
GitHub; archive verification happens before root extraction or execution.

Checks include both race/vet profiles, publication/security and CodeQL checks,
multi-site route isolation tests, disposable cutover/rollback and safe key
adoption tests, actual Nginx/Apache/Caddy configuration validation in a
disposable Linux environment, signed capsule installation/execution, and
Docker archive conversion with digest verification. No live VPS or Mac
configuration was changed during development.

This is not a stable or production-qualified release and does not claim an
independent external assessment, a new-machine lab or live-host reboot
qualification. Keep independent access while testing.