Update Hashrate Autopilot to 1.17.0#5857
Open
rdouma wants to merge 1 commit into
Open
Conversation
Security release. DB-stored secrets are now AES-256-GCM encrypted at
rest and the dashboard password is scrypt-hashed (previously plaintext);
the config-change audit log no longer records credential values; you can
change the password and rotate Braiins tokens in-app; and Profit & Loss
now counts Lightning payouts via Ocean's earnpay ledger.
Adds BHA_SECRET_KEY=${APP_SEED} so the at-rest encryption key is the
device-derived per-app secret (outside app-data), matching the docs'
promise that an app-data backup does not carry the key.
Release notes: https://github.com/rdouma/hashrate-autopilot/releases/tag/v1.17.0
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type
App update
App
App ID: hashrate-autopilot
Upstream project: https://github.com/rdouma/hashrate-autopilot
Version: 1.17.0
Summary
Security release. Credentials the app stores in its SQLite database (Braiins API tokens, bitcoind RPC password, Telegram token, DDNS credential) are now AES-256-GCM encrypted at rest instead of plaintext, and the dashboard password is stored as a one-way scrypt hash. The config-change audit log no longer records credential values (and scrubs any previously logged on upgrade). Users can now change the dashboard password and rotate their Braiins tokens from the dashboard itself, and Profit & Loss counts Lightning payouts via Ocean's earnpay ledger. Existing installs upgrade their stored data in place on first start.
This bump also adds
BHA_SECRET_KEY: "${APP_SEED}"to the compose so the at-rest encryption key is the device-derived per-app secret, which lives outside the app's data directory. Without it the app falls back to a keyfile next to the database (still encrypted, but inside app-data); usingAPP_SEEDkeeps an app-data backup from ever carrying the key.Full release notes: https://github.com/rdouma/hashrate-autopilot/releases/tag/v1.17.0
Verification
Umbrel testing performed: installed 1.17.0 as an in-place update over the prior version on a real Umbrel device and verified the new in-app password change end to end. The image is pinned by digest.
Environment tested:
Architecture tested:
The runtime test above was on the maintainer's own Umbrel device (its native architecture). The published multi-arch image is built and CI-verified for both amd64 and arm64; the digest pinned here is the multi-arch index.
Known lint warnings or caveats: none.
Notes
BHA_SECRET_KEY: "${APP_SEED}"(rationale in Summary).