Changes:
- Added mirror repositories: upstream deb, rpm and arch repositories are copied as is, metadata and signatures included. Nothing is rebuilt or re-signed, clients keep using the upstream GPG key. Mirrors require a new persistent volume:
-v /var/lib/docker/volumes/repomanager-mirror:/home/mirror. Add it to yourdocker runcommand,docker-compose.ymlor Ansible configuration, otherwise mirrors are lost when the container is recreated. - Former mirror repositories are renamed curated repositories: the
mirrorrepository type becomescurated. Existing repositories and scheduled tasks are migrated automatically, but API clients relying on themirrorvalue must be updated. - Added Arch Linux mirror support.
- Added Arch Linux source repository templates (Arch Linux, Arch Linux ARM, Arch Linux CN, Chaotic-AUR, EndeavourOS).
- Added per repository / mirror snapshots retention setting, overriding the global retention (custom number of snapshots to keep or keep all snapshots). Can be set at creation or from the new repository Edit button #415
- Added HTTP basic authentication (username / password) support on source repositories, used when syncing curated repositories and mirrors (deb, rpm and arch). Can be set from the source repository edit form or in source repositories lists (basic-authentication section) #411
- Hosts: registering a host now requires an administrator API key, or the API key of a user with the new
Register hosts (API key)permission. Listing hosts and retrieving hosts data require an administrator API key, or the API key of a user with permissions on hosts. Make sure the API key used by linupdate to register new hosts meets this requirement. A host authenticated with its ID and token can only access its own data. - Hosts: tokens are now stored hashed and API keys are converted to a new hash format the first time they are used: going back to a previous version after the update requires restoring the backup.
- Security: fixed several vulnerabilities.
- Security: hardening: brute force protection on local accounts login (10 failed attempts per username and IP address within 15 minutes), hosts tokens stored hashed, cryptographically secure generation of passwords, API keys and hosts tokens, stricter session cookies, X-Frame-Options and X-Content-Type-Options headers, errors details only displayed in debug mode, stricter validation of the data coming from source repositories metadata.
- Reverse proxy: the
X-Frame-Options,X-Content-Type-OptionsandReferrer-Policyheaders are now sent by the container. They can be removed from your reverse proxy vhost to avoid sending them twice. TheStrict-Transport-Securityheader of the example has also been changed tomax-age=31536000; includeSubDomains(preloadremoved) (the reverse proxy example and the Ansible role have been updated). - Fixed #417
- Moved chart filters to a range based selection.
- Various UI fixes and improvements.