v0.4.0

nebula-mesh v0.4.0

Install — see README for the full snippets.

• Server: nebula-mgmt_0.4.0_<os>_<arch>.tar.gz or docker pull ghcr.io/forgekeep/nebula-mgmt:0.4.0
• Agent: nebula-agent_0.4.0_<os>_<arch>.tar.gz or docker pull ghcr.io/forgekeep/nebula-agent:0.4.0

Changelog

Bug fixes

• 432e4ac: fix(agent): refuse plaintext http:// server_url unless explicitly opted out (#235) (@ak2k)
• 3ca7c26: fix(agent): zeroize private keys after enrollment writes them to disk (#236) (@ak2k)
• 945ec58: fix(alerts): enforce the webhook SSRF guard at delivery time (#243) (@ak2k)
• ec8b364: fix(api): stop auditing pre-auth malformed agent polls (#242) (@ak2k)
• 853717c: fix(api,mobilebundle): apply stored firewall rules to generated configs (#245) (@ak2k)
• 849d56e: fix(api,web): audit network creation and firewall policy updates (#239) (@ak2k)
• d2b777b: fix(keystore,pki): bind CA-key envelopes to their ca_id with GCM AAD (#238) (@ak2k)
• 3d66eae: fix(ratelimit): key on rightmost X-Forwarded-For entry, not leftmost (#232) (@ak2k)
• 638bee2: fix(store): derive audit-log id from crypto/rand, not UnixNano (#240) (@ak2k)
• 64653a6: fix(store): pin Migrate to one connection so PRAGMA foreign_keys holds (#244) (@ak2k)
• 6ac19c8: fix(store,api,web): empty operator role defaults to user, not admin (#234) (@ak2k)
• 9eead1e: fix(web): equalize login timing for OIDC accounts (#233) (@ak2k)
• d92dd9a: fix(web): reject login with empty username instead of defaulting to admin (#223) (@juev)
• aca9080: fix(web): require non-admins to pick a network when creating a host (#241) (@ak2k)
• 10e6bc1: fix(web,store): make TOTP codes one-time within their validity window (#237) (@ak2k)

---

Full changelog: v0.3.8...v0.4.0