- .gitignore for IDE/OS files; Linux-VM-Bootstrapper.code-workspace untracked
(stays local only)
- docker user + docker group with stable ids (default 2000:2000, overridable
via --docker-uid/--docker-gid or DOCKER_UID/DOCKER_GID). Group is ensured
before Docker installs so the package adopts it; an existing group is
renumbered with a docker restart. Collisions with foreign uid/gid owners
are detected and left alone with a warning.
- /custom gets recursive POSIX ACLs (u/g docker, u/g 1000, root implicit)
plus default ACLs on directories so new stack data inherits the grants;
ownership of container-managed files is never changed. acl package added
to the base toolset.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Management UIs now served at ROOT paths on dedicated proxy TLS ports
(10443 Nginx UI, 10444 Dockhand, 10445 Webmin) via automatic.rules.conf -
no sub-path rewriting and no app-side configuration; Webmin webprefix from
the previous release is removed automatically. 443 keeps a minimal catch-all
and stays free for real vhosts.
- Bind priority implemented: VPN tunnel IP > private LAN IP > loopback, with
auto-upgrade of managed .env values on re-run. The firewall opens the mgmt
TLS ports on public interfaces ONLY when the host has neither a tunnel nor
a private LAN address (re-evaluated each boot).
- Dockhand adoption surfaced: same-path stacks mount documented in compose
headers, summary, and README (Stacks -> Import -> /custom/docker/stacks).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Firewall chains renamed VMBOOT-INPUT -> EDGE-PROXY-INPUT and
VMBOOT-DOCKER-USER -> EDGE-PROXY-DOCKER-INPUT (inbound-to-containers via
DOCKER-USER); legacy VMBOOT-* chains are removed automatically on re-run
- Maintenance payloads moved to /custom/scripts/cron/ as
Invoke-AutomaticPatchInstallation.sh and Invoke-AutomaticReboot.sh (own log
+ retention); cron file now preserves its randomized schedule while
refreshing commands on re-run
- Default site renamed to automatic.rules.conf; cert renamed to
/etc/ssl/selfsigned/selfsigned.{crt,key}; legacy files cleaned up
- New /webmin/ proxy route via host.docker.internal (host-gateway extra_host);
Webmin configured with native webprefix=/webmin for clean sub-path support
- proxy_redirect fixups on /nginxui/ and /dockhand/ so upstreams see root and
Location headers map back; sub-path strategy documented in README
- Child node Webmin messaging simplified
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gsadmin