- Deployments are on internal networks with self-signed UME certificates:
installers write NETX_UME_VERIFY_TLS=false and
NETX_ALLOW_INSECURE_DEFAULTS=1 when absent (Linux also on update), so
binding 0.0.0.0 no longer stops NetX at the startup security check.
Admin password and JWT secret stay unique per install.
- Linux: after install, check app_user to report whether the generated
initial password applies or the admin already exists (reused external
DB); new 'netxctl admin-password'.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Installing under /root left systemd failing with 203/EXEC and empty logs.
The installer now checks that the service user can enter the program and
data dirs; blocked parents are granted traverse-only access (setfacl
u:netx:x, else chmod o+x) with --grant-access or after asking, otherwise
it stops with the exact command. Start failures show the supervisor log
or journalctl when api.log is empty. README: /root installs and UME with
self-signed certificates (NETX_ALLOW_INSECURE_DEFAULTS).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- packaging/linux: netx-<ver>-linux-x86_64.tar.gz with bundled Python 3.12,
PostgreSQL 16 and web/dist (glibc >= 2.17). install.sh (install/update/
reinstall), netxctl (start/stop/status/logs, set-port, set-bind,
set-pg-port, reconfigure-db, check-update/update/auto-update, backup,
uninstall), systemd units, nohup fallback without systemd. Privilege
drop, detaching and tar go through the bundled Python, so bare images
without su/runuser/setsid/tar work.
- Updates: same GitHub/Forgejo/manifest sources as Windows, sha256
verified, pre-update pg_dump, automatic rollback when the new version
does not come up.
- Non-loopback bind: generated bootstrap admin password and
NETX_UME_VERIFY_TLS=true, as security_bootstrap requires.
- Build in manylinux2014 + check_bundle.sh (GLIBC <= 2.17, no missing
libs); release-linux.yml builds on v* tags and smoke-tests offline on
CentOS 7, Rocky 9, Ubuntu 18.04/24.04, Debian 12, openSUSE Leap 15 and
openEuler 22.03 before attaching to the release.
- Windows: Setup DB page gets a bundled PG port field and
/BundledPgPort=; set_pg_port.ps1 + tray "Built-in database port";
reconfigure keeps the configured port; postgresql.conf is written
without a BOM (PS 5.1 Set-Content -Encoding utf8 broke postgres).
- Forgejo/GitHub publish scripts include the Linux package.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
