GeiserX/CashPilot v0.5.0

on GitHub

What's New

Security: Drop privileged mode from all services

• Set privileged: false across all 10 bandwidth service definitions
• None of these images require privileged mode (verified against Docker Hub docs)
• Mysterium correctly uses cap_add: [NET_ADMIN] + host networking (for VPN tunneling) without full privileged access
• Previously, privileged: true was blocking UI-based deployments since the worker policy layer rejects privileged containers

EarnFM: Rewrite to token-based auth

• Replaced Supabase email/password authentication with direct API key (EARNFM_TOKEN)
• The upstream earnfm/earnfm-client image uses a UUID token, not email/password
• Updated service YAML, collector code, UI hints, docs, and tests
• Collector is now simpler and more reliable (no Supabase token refresh dance)

Fixes

• Fixes #58 (EarnFM undeployable due to privileged: true)
• Fixes #59 (wrong env vars for EarnFM container)