Skip to content

Bayanat v5.0.0

Latest
Latest

Choose a tag to compare

View all tags
@level09 level09 released this 17 Sep 13:56
· 1 commit to main since this release
v5.0.0
53a8e44
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Bayanat 5.0.0 changes how Bayanat is deployed as well as what it runs. Read the upgrade guide before moving an existing install: it is a migration with a maintenance window, not a routine pull.

Deployment

  • Signed releases. Every release ships bayanat-<tag>.tar.gz and a .minisig signature. The installer verifies both against a pinned key and refuses anything unsigned or tampered. Partners can verify by hand with minisign.
  • bayanat update updates an installer-managed instance from the command line: signature check, database snapshot, migrations with services stopped, health-checked switch, automatic rollback on failure. bayanat snapshots and bayanat restore recover a previous state. Available from this release onward; the hop from v4 is a documented one-time step.
  • bayanat harden moves an existing install onto the least-privilege layout: separate web and worker accounts, read-only release tree, peer-authenticated PostgreSQL, password-protected Redis. It backs up every file it touches and restores them if the result fails its health check.
  • Updates run from the command line only. The interface reports that a newer release exists and links its notes, but never applies it. bayanat status reports the running version, services, layout and update state.
  • Docker: production compose stack with automatic HTTPS, pinned images and non-root containers. PostgreSQL moves from 15 to 16, which requires a dump and restore of the database volume.

Security

  • Findings from an independent third-party security audit remediated and retested.
  • Login throttling per account and per source address; configurable idle session timeout.
  • The initial administrator is created by the installer, not by an unauthenticated setup page.

Application

  • Sessions stay alive during active typing and reading, with a warning before expiry.
  • Right-to-left interface support and translated titles for lookup tables and location levels.
  • Document and image redaction into a derived copy, leaving the original untouched.
  • Background search for long-running queries, saved searches in the search bar, and Arabic letter-variant normalization in term search.
  • Media over 5 GiB reach S3 via multipart upload; exports include every media file per item.
  • Independent event types for incidents; event location filters can include sub-locations.

Breaking changes

  • Services run as bayanat-web and bayanat-celery; the release tree is read-only to them and runtime files move to shared/.
  • PostgreSQL local access uses peer authentication with an ident map; Redis requires a password.
  • The uWSGI socket moves to /run/bayanat/bayanat.sock.
  • Raw OCR provider payloads are no longer stored.

The full list, including fixes, is in CHANGELOG.md.

Assets 4
Loading