Roastwarden

Releases ·

Roastwarden 0.11.0

Safe to share, continued (phase 1). The dashboard signs in instead of keeping the owner key: each browser trades the key (or a token) once for a sign-in cookie it cannot read, and the owner sees and ends signed-in browsers. Reads need a sign-in unless an install opens them (the owner's does, behind Pocket ID), and the audit log is the owner's and admin tokens' only. The shipped MQTT broker no longer takes anonymous clients: the server and each roaster sign in, and a roaster may use only its own topics (the owner's ESP32 is on firmware 3.6.0, which does). The owner's homelab files moved to contrib/homelab/.

Security

  • A real login and protected reads (ROADMAP Next 59, Security "Logins"): the dashboard no longer keeps the owner key in the browser. It signs the browser in once with the key or a token and gets an HttpOnly, SameSite=Strict cookie for 30 days from its last use; a key an older dashboard saved is traded for a sign-in at its next load and removed. A new owner key signs every owner browser out, a revoked token its browsers; the owner sees the signed-in browsers under Settings → This browser and signs one or all out. A write carried by the cookie must come from the dashboard's own page (403 CROSS_SITE).
  • Reads need a credential on a server with a key, unless RUSTROAST_READS=open (a trusted LAN, or behind a proxy that signs people in; production sets it, so phones and second screens past Pocket ID read as before). Health, the app shell, the API's description and share pages stay open.
  • The shipped Mosquitto is locked (Next 60, Security "MQTT"): no anonymous clients, one MQTT listener (the WebSockets one is gone). The server signs in as rustroast with MQTT_PASSWORD (now required in .env); each roaster signs in as its device id (MQTT_DEVICES=<id>:<password>), and the ACL keeps it to roaster/<id>/# and reading the server's presence. A one-shot mqtt-users service writes the password file and ACL at every start. The owner's ESP32 runs firmware 3.6.0, which signs in.
  • The audit log is the owner's and admin tokens' only, whatever the read setting: its bodies hold every change made. roast audit needs an admin token.

Changed

  • The owner's leftovers are out (Next 62): About links the CHANGELOG of the repository the image was built from (RUSTROAST_REPO_URL, stamped by CI; no link without it) instead of the owner's Forgejo; .env.example no longer names the owner's broker; the old start-server.sh, STARTUP_INSTRUCTIONS.md and tasks/ are gone. The homelab deployment (compose file, deploy.sh, the hermes sync and how CI deploys to the owner's VM) moved to contrib/homelab/; Running it keeps what any install needs.
  • The Hermes eval's Kenya cupping paragraph is written for the eval, no supplier's text.

Fixed

  • The API shapes test read the purchases report for "this month", whose chart came and went with the date (on the 1st it held only that day's purchases); it reads from October now.