dvb-projekt/dvb-WarpPool
dvb-projekt/dvb-WarpPool
1
0
Fork 0
Code Issues Pull requests Projects Releases 25 Packages 1 Wiki Activity Actions
25 releases 74 tags
  • v1.22.0 a68358a2b5

    v1.22.0
    All checks were successful
    Release / Docker Multi-Arch (push) Successful in 19m58s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m41s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m38s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m23s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m14s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m36s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m28s
    Details
    CI / Rust clippy (push) Successful in 1m35s
    Details
    CI / Rust fmt (push) Successful in 1m6s
    Details
    CI / Rust test (push) Successful in 5m7s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m5s
    Details
    CI / Security Audit (push) Successful in 1m13s
    Details
    docs / build (push) Successful in 32s
    Details
    Release / Cosign sign artifacts (push) Successful in 20s
    Details
    Release / Forgejo Release (push) Successful in 30s
    Details
    Stable

    dvb-projekt released this 2026-07-21 11:23:53 +00:00 | 40 commits to main since this release

    Certificates that renew themselves, and a donation card that asks properly.

    Added

    • Stratum TLS certificates are reloaded without a restart. The daemon read
      cert and key exactly once at startup, so after an ACME renewal it kept
      serving the old certificate until someone restarted it — and once that one
      expired, TLS broke for every miner on the TLS port. Cert and key are now
      watched and re-read when their mtime changes. Existing connections keep the
      certificate they negotiated, new handshakes get the fresh one, and nobody
      reconnects. [stratum] tls_reload_secs controls the check interval
      (default 300 s, 0 restores the previous read-once behaviour). A failed
      reload — a half-written file mid-renewal — leaves the previous certificate
      in service and retries on the next tick instead of taking the listener down.
      Only V1 TLS is affected; Stratum V2 uses Noise NX with its own authority key
      and has no X.509 material.

    Changed

    • Donation card copy, rewritten in all eight languages. It used to open
      with an imperative and ask before the reader had agreed to anything; it now
      leads with a question and then gives the reason — the pool charges 0% fee,
      so donations are what covers the server. Four locales had been calling the
      donation a tip in the service-staff sense (propina, pourboire,
      mancia, 打赏), inherited from the English wording; Chinese in particular
      disagreed with its own admin UI, which already said 捐赠. Each language
      was written on its own terms rather than translated, so register and
      percent typography now follow each locale's existing convention.

    Fixed

    • scripts/verify-reproducible.sh resolved release tags and assets against the
      suspended GitHub account, so third-party reproducibility checks could not run
      at all. Ported to the Forgejo API, with a WARPPOOL_FORGE override.
    • The doc comment on [stratum] sv2_listen suggested :3334 as an example —
      the port the TLS V1 listener uses. Corrected to :34254.

    dvb-WarpPool v1.22.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.22.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.21.0 4675ee4f65

    v1.21.0
    All checks were successful
    CI / Rust clippy (push) Successful in 1m42s
    Details
    CI / Rust fmt (push) Successful in 1m14s
    Details
    CI / Rust test (push) Successful in 5m29s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m13s
    Details
    CI / Security Audit (push) Successful in 1m19s
    Details
    docs / build (push) Successful in 36s
    Details
    Release / Docker Multi-Arch (push) Successful in 20m24s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m47s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m55s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 11m1s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m37s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m48s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m47s
    Details
    Release / Cosign sign artifacts (push) Successful in 26s
    Details
    Release / Forgejo Release (push) Successful in 36s
    Details
    Stable

    dvb-projekt released this 2026-07-20 15:16:33 +00:00 | 48 commits to main since this release

    An operator-authored announcement banner for the pool page.

    Added

    • Marquee announcement banner. Operators can now put a scrolling notice at
      the top of the pool page — a maintenance window, planned downtime, or anything
      else miners should see — from the new Admin → Banner page. The
      announcement runs for a chosen time (minutes, hours or days) and disappears on
      its own when that time is up; a Stop button ends it early.

      It is stored as text plus an RFC3339 expiry in pool_settings, so it needs no
      scheduler and survives a restart. Everyone is served the announcement through
      the public /api/overview (the field is omitted once expired), and the page
      hides it locally at the expiry moment instead of waiting for the next
      30-second poll, so it goes away on time.

      Announcements are rendered as plain text, never as HTML. The API rejects
      control characters, caps the text at 200 characters, and clamps the runtime to
      between one minute and 90 days.

      Scrolling pauses on hover and on keyboard focus so long notices can be read to
      the end, and visitors who ask for reduced motion get the text static instead
      of moving.

      New endpoints: GET / POST / DELETE /api/admin/banner.

    dvb-WarpPool v1.21.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.21.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.20.1 1d87cd3da9

    v1.20.1
    All checks were successful
    CI / Rust clippy (push) Successful in 1m34s
    Details
    CI / Rust fmt (push) Successful in 1m3s
    Details
    CI / Rust test (push) Successful in 5m14s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m1s
    Details
    CI / Security Audit (push) Successful in 1m11s
    Details
    docs / build (push) Successful in 27s
    Details
    Release / Docker Multi-Arch (push) Successful in 19m51s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m42s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 10m1s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m28s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 13m49s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m21s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m32s
    Details
    Release / Cosign sign artifacts (push) Successful in 21s
    Details
    Release / Forgejo Release (push) Successful in 28s
    Details
    Stable

    dvb-projekt released this 2026-07-17 07:29:17 +00:00 | 57 commits to main since this release

    A Stratum V2 fix for direct ASIC miners that open Standard mining channels.

    Fixed

    • Stratum V2 Standard-channel miners now get per-miner variable difficulty.
      Direct Sv2 miners that open a Standard mining channel (Bitaxe and similar)
      were pinned to a fixed difficulty derived once from their advertised hashrate
      and never adapted — so several identical units all sat at the same frozen
      difficulty at the same time, while the very same miners on Stratum V1 diverged
      normally. Only Extended channels (NerdQAxe and co.) were getting VarDiff.
      Standard channels now seed VarDiff with the same MinerClass tuning as Extended
      channels, so each miner adapts on its own share stream and reconnects restore
      the converged difficulty. Thanks to John11 for the detailed report that
      pinned it down (SV1 fine, Bitaxes affected, Qaxe++ not).

    dvb-WarpPool v1.20.1 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.20.1 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.20.0 a4009d007f

    v1.20.0
    All checks were successful
    CI / Rust clippy (push) Successful in 3m28s
    Details
    CI / Rust fmt (push) Successful in 1m6s
    Details
    CI / Rust test (push) Successful in 5m9s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m2s
    Details
    CI / Security Audit (push) Successful in 1m18s
    Details
    docs / build (push) Successful in 28s
    Details
    Release / Docker Multi-Arch (push) Successful in 19m46s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m52s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m44s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m42s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m33s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m27s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m39s
    Details
    Release / Cosign sign artifacts (push) Successful in 17s
    Details
    Release / Forgejo Release (push) Successful in 26s
    Details
    Stable

    dvb-projekt released this 2026-07-16 15:02:37 +00:00 | 60 commits to main since this release

    Recovery codes for two-factor auth, plus fixes surfaced by the first public
    mainnet run.

    Added

    • 2FA recovery codes. Enabling two-factor auth now issues 10 one-time
      recovery codes (shown once) so a lost authenticator no longer locks you out
      of the admin area. Enter a code in place of the TOTP at login; each works
      once. The admin 2FA page shows how many remain, warns when few are left, and
      can regenerate a fresh set (requires the current app code). Only Argon2
      hashes are stored — the plaintext is shown once and never persisted, and the
      codes are excluded from backups. Login accepts a recovery code only after the
      correct password, so it adds no brute-force surface.

    Fixed

    • Address ownership verification could get stuck. A failed signature check
      (wrong wallet or a malformed paste) used to consume the challenge, so every
      retry against the message still shown in the UI failed forever. A failed
      attempt now keeps the challenge; only a successful verify (or expiry)
      consumes it, and the one-shot guarantee holds under concurrency.
    • Admin visibility toggle mislabelled. The switch labelled "Miners tab"
      actually controls the Devices tab (the /miners route is the Devices
      nav entry); the label and its hint now match the navigation.
    • Owner area up front names the wallets that can sign a proof-of-ownership
      message (Electrum/Sparrow, incl. hardware wallets via those), so operators
      pick a working wallet before trying.

    Security

    • Recovery codes are drawn with rejection sampling (no modulo bias) and each
      login attempt that reaches the recovery path consumes at most one code
      atomically. 2FA enable is rejected on an already-active account so codes are
      never rotated silently — rotation goes through the confirmed regenerate flow.

    dvb-WarpPool v1.20.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.20.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.19.1 7b140b7bb1

    v1.19.1
    All checks were successful
    CI / Rust clippy (push) Successful in 1m30s
    Details
    CI / Rust fmt (push) Successful in 1m3s
    Details
    CI / Rust test (push) Successful in 4m51s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m1s
    Details
    CI / Security Audit (push) Successful in 1m12s
    Details
    docs / build (push) Successful in 26s
    Details
    Release / Docker Multi-Arch (push) Successful in 20m0s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 11m9s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 10m3s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m58s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m41s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m44s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 10m8s
    Details
    Release / Cosign sign artifacts (push) Successful in 16s
    Details
    Release / Forgejo Release (push) Successful in 25s
    Details
    Stable

    dvb-projekt released this 2026-07-16 11:00:18 +00:00 | 66 commits to main since this release

    Hardening patch after the first public-mainnet run (pool.warppool.org). The
    headline is a privacy fix: three read endpoints ignored the [privacy]
    toggles, so the switches hid the nav tabs while the data stayed one request
    away — most importantly /api/workers, which served every miner's full payout
    address to anyone. All three are now gated; the operator (authenticated) still
    sees everything.

    Security / Privacy

    • /api/workers, /api/hardware, /api/miners now honour the privacy
      toggles.       Previously hardware_tab_public / miners_tab_public /
      wallet_directory_public only hid the nav link. /api/hardware leaked the
      exact OS, kernel patch level and hardware to anyone; /api/miners the
      operator's LAN devices; /api/workers every full payout address + rig. Now
      anonymous callers get a 403 (hardware), an empty list (miners), or masked
      addresses (workers). Tests assert the gap is closed.
    • Web-push broadcasts only block-found events. The subscribe endpoint is
      unauthenticated by design (friends can subscribe without an account), so node
      health and update-available events — operator ops state — no longer go out
      over it. They still reach the operator via the configured server-side sinks.

    Fixed

    • Leaderboard / workers masking keeps the rig label (bc1qsx…dvng.bitaxe).
      Dropping it bought no privacy (a rig name carries no address) while making the
      board useless — you couldn't tell which of your machines earned a share.
    • Stratum V2 miners now show their hardware. The pool synthesised a
      user-agent from the SetupConnection fields and used it to classify the miner,
      but the Sv2 authorization callback had no field to carry it, so it was
      dropped — Sv2 miners appeared with no hardware while V1 miners had it.
    • Clearer first-run bootstrap error. A read-only /config mount made admin
      setup fail with a generic "could not persist secrets"; it now names the cause
      (not writable) and the path, and points at the packaging docs.
    • Docs: device-class count corrected (7 real classes, not 8 — the 8th is the
      Unknown fallback); Windows .msi marked paused (not built since the forge
      move); Cosign verification uses --bundle (the old --signature example
      couldn't work); UI strings say "release"/"issue" instead of "GitHub".

    Added

    • IPC/GBT badge in the header. Shows which template source is live — the
      RPC-ready badge can't, since RPC is required in both modes.
    • Wallet address search on the Workers page — jump straight to your own
      /users/<address> page to prove ownership and switch on privacy, even when
      the browsable directory is hidden. The tab is now always reachable.
    • Translator --v2-connect accepts a hostname, not just IP:port — it's
      resolved via DNS at startup.

    dvb-WarpPool v1.19.1 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.19.1 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.19.0 60e9fffb39

    v1.19.0
    All checks were successful
    CI / Rust clippy (push) Successful in 1m32s
    Details
    CI / Rust fmt (push) Successful in 1m4s
    Details
    CI / Rust test (push) Successful in 4m51s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m6s
    Details
    CI / Security Audit (push) Successful in 1m11s
    Details
    docs / build (push) Successful in 28s
    Details
    Release / Docker Multi-Arch (push) Successful in 20m30s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 12m5s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m42s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m51s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m36s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m24s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m35s
    Details
    Release / Cosign sign artifacts (push) Successful in 18s
    Details
    Release / Forgejo Release (push) Successful in 26s
    Details
    Stable

    dvb-projekt released this 2026-07-14 12:02:45 +00:00 | 68 commits to main since this release

    Donations for public 0% pools, plus a friendlier setup wizard. A per-worker
    pool takes 0% of every reward, so its only funding path is a voluntary tip —
    now built into the dashboard. Fully backward-compatible: the donation UI only
    appears in per-worker mode, and private solo pools are unchanged.

    Added

    • Voluntary donation addresses for public pools.
      • Admin → Donations — a new admin page (nav entry shown only when
        payout_mode = "per_worker") to set an optional on-chain Bitcoin address
        and/or a Lightning address (LN address / LNURL / BOLT12). The on-chain
        value is validated as a Bitcoin address on save; either may be left blank
        to hide that option.
      • "Support this pool" card — when at least one address is set, the public
        dashboard shows a donation card with copy buttons and QR codes (the
        on-chain QR is a bitcoin: URI wallets can open directly).
      • Addresses are stored as pool settings (no restart, no config.toml edit)
        and are pure operator metadata — they never touch coinbase construction, so
        the fail-closed per_worker invariant (no fee/donation skims the reward) is
        unaffected. New endpoints: POST /api/admin/donations (admin) and
        GET /api/donation-qr/{onchain,lightning} (public SVG). per_worker is now
        surfaced in /api/overview so the UI can gate public-pool-only features.
    • Setup wizard: pool-type choice. The Mining card now offers Private solo
      pool       vs Public 0% pool. Choosing the public option writes
      payout_mode = "per_worker", hides the (unused) pool-wide payout address, and
      forces the fee to 0 — no hand-editing of config.toml needed. Translated
      across all 8 wizard languages.

    Rust suite: 1149.

    dvb-WarpPool v1.19.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.19.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.18.0 27f3f7d334

    v1.18.0
    All checks were successful
    CI / Rust clippy (push) Successful in 1m29s
    Details
    CI / Rust fmt (push) Successful in 1m3s
    Details
    CI / Rust test (push) Successful in 4m37s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m2s
    Details
    CI / Security Audit (push) Successful in 1m11s
    Details
    docs / build (push) Successful in 26s
    Details
    Release / Docker Multi-Arch (push) Successful in 19m7s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m23s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m26s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m16s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m7s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m16s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m19s
    Details
    Release / Cosign sign artifacts (push) Successful in 17s
    Details
    Release / Forgejo Release (push) Successful in 27s
    Details
    Stable

    dvb-projekt released this 2026-07-13 16:49:28 +00:00 | 69 commits to main since this release

    Optional public-directory privacy for public pools — bring the default UI
    exposure in line with established solo pools. Fully backward-compatible: both
    new toggles default to the current open behaviour.

    Added

    • [privacy] config section.
      • wallet_directory_public (default true) — set false to hide the
        browsable Workers/wallet directory (/api/wallets and its nav link) from
        anonymous visitors, like solo.ckpool.org. Each per-address page
        /users/<address> stays reachable by direct link; the authenticated
        operator still sees the full directory (so keep admin auth enabled).
      • leaderboard_addresses_public (default true) — set false to mask
        the Bitcoin address in the public best-shares leaderboard server-side
        (bc1qsx…dvng, rig suffix dropped), like AtlasPool. The operator still sees
        full addresses.
      • Both are orthogonal to the existing per-miner opt-in privacy flag (the
        signature-gated Owner Area) and affect neither payouts nor block
        construction. Documented in the Configuration Reference and the public-pool
        setup guide. Rust suite: 1145.

    dvb-WarpPool v1.18.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.18.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.17.2 1604a5e5e3

    v1.17.2
    Some checks failed
    CI / Rust fmt (push) Has been cancelled
    Details
    CI / Rust test (push) Has been cancelled
    Details
    CI / UI (SvelteKit) (push) Has been cancelled
    Details
    CI / Security Audit (push) Has been cancelled
    Details
    CI / Rust clippy (push) Has been cancelled
    Details
    docs / build (push) Successful in 22s
    Details
    Release / Docker Multi-Arch (push) Successful in 18m46s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m23s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m34s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m31s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m21s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m30s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m16s
    Details
    Release / Cosign sign artifacts (push) Successful in 17s
    Details
    Release / Forgejo Release (push) Successful in 26s
    Details
    Stable

    dvb-projekt released this 2026-07-13 11:17:39 +00:00 | 71 commits to main since this release

    Patch: fix a /api/users 500 on whole-number best shares, and complete the
    end-user manuals with the public wallet page.

    Fixed

    • The public per-wallet page (/users/<address>) returned HTTP 500 when a
      rig's best share (or an empty hashrate window) decoded to a whole number.
      SQLite hands back SUM(CASE … ELSE 0 END) over an empty time window — and
      MAX/SUM of whole-number values — with INTEGER storage class, which sqlx
      refuses to decode into f64. The three address-scoped queries
      (best_ever_for_address, hashrate_windows_for_address,
      list_hashrate_5min_for_address) now CAST(… AS REAL). Regression test added
      (Rust suite: 1142).

    Documentation

    • End-user manuals now cover the public wallet page. Both the Umbrel and the
      general installation manual gain a new chapter 8, "Your public wallet page
      (/users)" — the shareable per-address dashboard, the ckpool-compatible JSON
      endpoint, and the signature-gated Owner Area (privacy toggle + notifications) —
      plus a per-worker payout note in the "Connecting your first miner" chapter.

    dvb-WarpPool v1.17.2 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.17.2 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.17.1 2d3da39d29

    v1.17.1
    All checks were successful
    CI / Rust clippy (push) Successful in 1m33s
    Details
    CI / Rust fmt (push) Successful in 1m6s
    Details
    CI / Rust test (push) Successful in 4m56s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m3s
    Details
    CI / Security Audit (push) Successful in 1m11s
    Details
    docs / build (push) Successful in 25s
    Details
    Release / Docker Multi-Arch (push) Successful in 20m23s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 11m6s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 10m0s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m42s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m29s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m54s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m28s
    Details
    Release / Cosign sign artifacts (push) Successful in 18s
    Details
    Release / Forgejo Release (push) Successful in 26s
    Details
    Stable

    dvb-projekt released this 2026-07-13 08:19:35 +00:00 | 72 commits to main since this release

    Patch: fix the static-UI SPA fallback so shareable client routes load on direct
    access.

    Fixed

    • Direct-loading a client route (/users/<address>, /wallets, /admin, …)
      returned 404 instead of the app.       The daemon's static UI serving relied on
      ServeDir::not_found_service, which does not fire when ServeDir is an axum
      fallback_service (tower-http 0.7) — so any non-index path that wasn't a real
      file 404'd, breaking the shareable per-wallet /users/<address> page (and
      bookmarks / firmware hitting it directly). Replaced with an explicit
      file-or-index fallback handler. Regression test added (Rust suite: 1141).

    dvb-WarpPool v1.17.1 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.17.1 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads
  • v1.17.0 26f318357d

    v1.17.0
    All checks were successful
    CI / Rust clippy (push) Successful in 1m39s
    Details
    CI / Rust fmt (push) Successful in 1m3s
    Details
    CI / Rust test (push) Successful in 4m34s
    Details
    CI / UI (SvelteKit) (push) Successful in 1m4s
    Details
    CI / Security Audit (push) Successful in 1m13s
    Details
    docs / build (push) Successful in 24s
    Details
    Release / Docker Multi-Arch (push) Successful in 18m58s
    Details
    Release / Binary aarch64-unknown-linux-gnu (push) Successful in 10m20s
    Details
    Release / Binary x86_64-unknown-linux-gnu (push) Successful in 9m17s
    Details
    Release / Linux .deb + .rpm (amd64) (push) Successful in 10m10s
    Details
    Release / Linux .deb + .rpm (arm64) (push) Successful in 11m1s
    Details
    Release / Linux AppImage (aarch64) (push) Successful in 10m7s
    Details
    Release / Linux AppImage (x86_64) (push) Successful in 9m8s
    Details
    Release / Cosign sign artifacts (push) Successful in 17s
    Details
    Release / Forgejo Release (push) Successful in 28s
    Details
    Stable

    dvb-projekt released this 2026-07-12 23:52:40 +00:00 | 73 commits to main since this release

    Per-worker payout mode — WarpPool can now run as a public, non-custodial,
    0%-fee solo pool     where every miner mines to their own address. Fully
    backward-compatible: single mode is the default and byte-for-byte unchanged.
    Rust suite grows to 1140 + 4 ignored (new real-Core regtest consensus E2E).

    Added

    • Per-worker coinbase ([mining] payout_mode = "per_worker"). Each miner
      supplies its own BTC address as the Stratum username; the coinbase is built
      per connection (V1) / per channel (Sv2) to pay that address the full block
      reward — one output, no pool fee. An invalid or wrong-network login address
      is rejected (no fallback to an operator address). The pool holds no funds.
      Config is fail-closed: per_worker with any fee/donation refuses to start.
    • Public per-wallet dashboard at /users/<address> — a ckpool-compatible
      JSON endpoint (firmware / ckstats parse it) plus a SvelteKit page: network
      panel, five hashrate windows, best-ever share, honest estimated-time-to-block,
      hashrate chart, and a per-rig table with detected mining software. Wallet rows
      on /wallets link straight to it.
    • Wallet ownership verification (BIP-137) — a miner proves control of an
      address by signing a pool-issued one-shot challenge (no funds moved). Once
      verified, an owner-only panel unlocks a privacy toggle (hide the wallet
      from the public list/pages) and per-wallet notifications (ntfy topic or
      webhook) for block-found and rig-offline events. All 22 owner-panel strings
      are translated in all 8 languages.
    • Public-pool deployment guide (docs/book/src/public-pool-setup.md) with a
      ready-to-paste hardening profile (per-IP caps, auto-ban, reject-ratio ban,
      IP-gate, TLS, reverse-proxy) and a deployment checklist.

    Security

    • Shared SSRF guard for all outbound, user-supplied targets (web-push and
      per-wallet notify). Private/loopback/link-local/CGNAT/0.0.0.0-8 hosts are
      refused, hostnames are re-checked against DNS-rebinding, and HTTP redirect
      following is disabled       so a 3xx cannot smuggle a request onto an internal
      host. Single source of truth, reused by both paths.
    • The per-wallet hashrate time-series (/api/users/<addr>/hashrate and
      /api/hashrate?worker=) now honour the privacy flag — a private wallet's
      series is hidden from anyone who is not its verified owner (or an
      authenticated operator).

    Changed

    • Coinbase construction refactored around a shared, address-independent
      JobTemplate; single mode delegates to it and is proven byte-identical to
      the previous builder. Merkle branches and the witness commitment stay shared;
      only the payout output varies per address.

    Tests

    • Real-Core regtest consensus E2E (--ignored, opt-in): builds per-worker
      blocks for multiple distinct addresses, submits them to a live bitcoind
      regtest, and asserts each block is accepted, pays the correct address with a
      single value output, carries a correct witness commitment (incl. a non-empty
      tx set), and that single mode still produces a valid block.

    dvb-WarpPool v1.17.0 — Downloads

    Docker

    git.warppool.org/dvb-projekt/dvb-warppool:v1.17.0 (multi-arch amd64+arm64, ohne v-Präfix)

    Native packages

    • Linux .deb: amd64 + arm64 → apt install ./dvb-warppool_*.deb
    • Linux .rpm: amd64 + arm64 → dnf install ./dvb-warppool-*.rpm
    • Linux AppImage: x86_64 + aarch64 portable
    • Linux tarballs: x86_64 + aarch64 for manual installs
    • macOS .dmg: added shortly after publish (built separately) — or build from source
    • Windows .msi: paused since the forge migration (no Windows runner yet)

    Signatures

    • SHA256SUMS + cosign bundle (SHA256SUMS.bundle, project key)
    • SBOM (SPDX) for all dependencies

    Verify (project public key cosign.pub in the repo root):

    cosign verify-blob \
  --key cosign.pub \
  --bundle SHA256SUMS.bundle \
  SHA256SUMS
sha256sum --check SHA256SUMS

    First-time setup: run dvb-warppool-setup for the first-run wizard.

    Downloads