icybear/bearnet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
74 Commits 1 Branch 0 Tags
8a4e164afd741333e47a0c32a6722b126749387a
Commit Graph
74 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
iceBear67 8a4e164afd bubble: must wait for docker network initialization 2026-07-27 22:33:45 +08:00
iceBear67 03dcc61b6a override dns 2026-07-16 13:15:30 +08:00
iceBear67 2b8c93b99f fix: tsdns cannot access host 2026-07-15 12:31:25 +08:00
iceBear67 cb5f4a7bdf fix access to bubble manager service 2026-07-15 12:27:48 +08:00
iceBear67 d0427a2e94 fix firewall issue 2026-07-15 12:19:19 +08:00
iceBear67 29c6cb21f5 support port-mapping feature from latest tsdns 2026-07-15 00:35:46 +08:00
iceBear67 8e2eeaf54d fix: conntrack does not load 2026-07-14 18:24:40 +08:00
iceBear67 b621d3658c fix: containers cannot access internet 2026-07-14 18:11:06 +08:00
iceBear67 c7afb86ebc harden build scripts and fix correctness issues from audit 
Security & correctness fixes following the audit in REPORT.md.

  - setup-hypervisor.sh: fix broken error handling — use curl -fsSL,
    check failures properly, return valid exit codes, and fetch
    /releases/latest (arch-aware) instead of the possibly-draft .[0]
  - entrypoint.sh: quote "$@" and build --net conditionally so empty
    NET_INTERFACE/NET_MAC don't yield "tap=,mac="
  - image-updater: replace tight 3s retry loop with capped exponential
    backoff + periodic pull instead of hammering the registry
  - sshd: set PermitRootLogin prohibit-password explicitly (key-only root)
  - vm.Dockerfile: copy only host private keys at mode 600 instead of
    the whole secret/* glob (drops .gitkeep/.pub from /etc/ssh)
  - Makefile: stop generating redundant _pub key files
  - build-image.sh: detect failure via alpine-make-vm-image's real exit
    status rather than grepping stdout for "ERROR"
  - remove orphaned etc/alloy/config.alloy (service not installed)
  - README: correct data.raw path
  - add REPORT.md audit notes (H1/H2 accepted as out-of-scope)
 2026-07-14 17:52:24 +08:00
iceBear67 43cd7c1d22 fix broken dns in containers 2026-07-13 18:43:15 +08:00
iceBear67 b1c74df46a enable auto-restarting 2026-07-13 18:27:11 +08:00
iceBear67 ba17c2a47b fix entrypoint script 2026-07-13 17:38:42 +08:00
iceBear67 f42f90445b fix entrypoint 2026-07-13 17:34:57 +08:00
iceBear67 ae5aba2109 fix entrypoint 2026-07-13 17:28:48 +08:00
iceBear67 b3ee94f8c0 fix makefile 2026-07-13 17:23:24 +08:00
iceBear67 2870d470c6 replace script with makefile 2026-07-13 17:22:24 +08:00
iceBear67 564888b297 remove test.sh 2026-07-13 17:16:48 +08:00
iceBear67 c041cb97cd introduce graceful shutdown 2026-07-13 17:07:50 +08:00
iceBear67 1b79e7677b block access to my LAN 2026-07-13 16:52:17 +08:00
iceBear67 d32acc00a5 fix: nftables intercepts normal forward traffic from containers 2026-07-09 00:33:05 +08:00
iceBear67 dcbc6e17cb fix: change image-updater to be oneshot unit 2026-07-09 00:13:58 +08:00
iceBear67 0bf03ef21f correct image-updater permission and add to runlevel 2026-07-09 00:10:15 +08:00
iceBear67 6891fd8991 add supervisor for bubble 2026-07-09 00:09:13 +08:00
iceBear67 be27cdba97 introduce image-updater 2026-07-09 00:04:25 +08:00
iceBear67 9b42945820 fix fstab && better retry logic for docker pull 2026-07-08 23:54:51 +08:00
iceBear67 8bb600d5ef fix bubble unit and revert alloy 2026-07-08 23:47:53 +08:00
iceBear67 7b9bd5567a fix: nftables intecepts all incoming traffics 2026-07-08 23:38:23 +08:00
iceBear67 d20a544a33 fix: failed to install alloy 2026-07-08 23:30:22 +08:00
iceBear67 6b58126315 add nftables to fix dependency of alloy 2026-07-08 23:15:59 +08:00
iceBear67 095ece8006 fix path spelling in .env.example 2026-07-08 22:32:44 +08:00
iceBear67 c6ce5f676e add alloy 2026-07-08 22:30:48 +08:00
iceBear67 06ad25f8e7 fix: tsdns startup creates multiple container 2026-07-06 14:31:07 +08:00
iceBear67 18a68ee6fd fix: multiple tsdns containers are created 2026-07-06 14:24:38 +08:00
iceBear67 0ada1a09ec disable cache for hypervisor by default 2026-07-06 13:56:24 +08:00
iceBear67 91a1e55ec7 implement auto restart with supervise-daemon 2026-07-06 13:54:21 +08:00
iceBear67 1e57cb3090 Revert "use ping for connectivity checkers" 
This reverts commit 29ee6c0bd5.
 2026-07-06 13:52:22 +08:00
iceBear67 29ee6c0bd5 use ping for connectivity checkers 2026-07-06 13:50:08 +08:00
iceBear67 14bd29fb94 revert start_pre hook 2026-07-05 21:17:51 +08:00
iceBear67 32bce5d34a fix dependency loop 2026-07-05 21:12:56 +08:00
iceBear67 f9676d1fe4 fix: use net-online instead of net to ensure internet connectivity 2026-07-05 21:04:09 +08:00
iceBear67 31bf5d70bd fix gitea token did not passed to authserver 2026-07-05 20:38:50 +08:00
iceBear67 b3ebdbf536 pass SIGTERM to cloud hypervisor 2026-07-05 19:10:38 +08:00
iceBear67 3e4a23f402 set TS_HOSTNAME for tsdns 2026-07-05 19:03:13 +08:00
iceBear67 ea638786d6 fix: tsdns init script 2026-07-05 19:01:00 +08:00
iceBear67 10d377fb26 enable pprof by default 2026-07-05 18:24:08 +08:00
iceBear67 860e144d3c set workspace image for bubble 2026-07-05 18:19:52 +08:00
iceBear67 46665f728e fix auth-server config 2026-07-05 15:37:09 +08:00
iceBear67 ce05ea534f fix fstab 2026-07-05 14:38:53 +08:00
iceBear67 a776332689 omit .env 2026-07-05 14:29:28 +08:00
iceBear67 fdc5c58af4 output logs to /dev/console 2026-07-05 14:28:29 +08:00