186 releases 186 tags

RSS feed

• v1.13.0 8a30a529be

  Compare

  Morphit v1.13.0 Stable

  agorise released this 2026-08-28 21:16:37 +00:00 | 52 commits to main since this release

  Signed by agorise

  GPG key ID: 53524E1F1017EB9C

  Morphit v1.13.0

  Theme: a rock-solid first install on any network — including heavily censored ones — and a config mistake that took a node down is now impossible to ship.

  Fixed

  The indexer and relay no longer crash-loop when you set a fee recipient. The setup wizard writes your fee-recipient account into morphit.config.env, but the config loader's allowlist didn't recognise that key and aborted on every boot — so both services crash-looped from the first start, pinning the CPU and taking the whole node offline (the database never migrated, backups skipped, the canary couldn't publish, and the site returned 500/403). MORPHIT_INDEXER_FEE_RECIPIENT is now allowlisted where it always belonged, alongside the other fee-tuning keys. A new CI guard (config-env-allowlist-parity) cross-checks every key the installer writes into morphit.config.env against the allowlist and fails the build if they ever drift again, so this class of mistake can never reach an operator.

  Your contact URL now actually reaches the federated directory. The operator registration broadcasts your contact link (e.g. a Matrix DM) on-chain so users on other instances can reach you — but the value was read from the wrong file (indexer.env) instead of the file it's written to (morphit.config.env), so the registration went out with an empty contact even when you'd set one. It now reads from the correct file, and a new guard asserts every instance-branding field (name, origin, operator tag, contact) is read from the same place, so this can't regress. Re-running the registration (or your next upgrade) puts your contact on your directory card.

  A tor-only instance that's up no longer flaps to a false "Unreachable." The federated directory probes hidden-service peers over Tor/I2P, and a single slow or dropped circuit — routine for onion routing — would flip a perfectly healthy onion-only node straight to a red "Unreachable," the same badge a genuinely dead node wears. Hidden-service peers now get hysteresis: they must miss several probes in a row before being marked unreachable, mirroring the benefit-of-the-doubt already given when our own proxy is down. Clearnet peers are unchanged (a clearnet timeout is a reliable signal).

  Improved

  A first install now survives a stale, partial, or filtered package cache. On a fresh server image — or a slow, filtered, or censored connection — apt can hold an outdated index and try to fetch point-release .debs the mirror has already superseded, giving a wall of "404 Not Found" that stopped the install cold. Base-package installation now self-heals exactly the way an operator would by hand (rm -rf /var/lib/apt/lists/* && apt clean && apt update) and retries automatically, so a first-time operator never sees a scary failure or has to touch apt.

  I2P installs cleanly on networks that block Launchpad and keyservers. The i2pd install used to add a PPA, which fetches a signing key from a keyserver via deprecated tooling — both commonly blocked in censored countries, where it failed outright. When the offline bundle is present (which carries the maintained i2pd build), i2pd is now installed straight from that bundled package — no PPA, no keyserver, no Launchpad. On an online box with no bundle, the PPA step now retries a few times and, if it still can't be reached, falls back to the distribution's i2pd rather than halting the whole install.

  The offline bundle now proves its runtime-critical source survived packaging. The bundle's build-time completeness check verified the vendored apt/docker/kubo/node payloads; it now also asserts the indexer and relay entrypoints, the tsx launcher, and every workspace package's source are actually in the shipped tarball — so a future packaging change can never quietly ship a bundle that installs but then can't start.

  The "run a node" page speaks plainly about what you earn and links where you'd go next. It now states you earn 90% of the BLURT paid listing fees, links "your own instance" straight to the instance directory, and gives realistic hardware guidance (2+ CPU cores, 4+ GB RAM, 60+ GB drive space). A new paragraph explains how your included Tor and I2P addresses — plus encouraging a VPN — let users reach you from jurisdictions where clearnet access is blocked, with no SSL certificate needed.

  The instances directory page explains federation up front. The intro now describes how independent operators run instances and earn 90% of the listing fees on their sites, with links to the FAQ, the download, and the run-a-node page. The intro and the bookmark tip span the full content width, the live "LIVE" indicator sits on the same row as the status filter, and the "directory last updated" line now appears just below the instance cards.

  Assorted accuracy and polish. The homepage/SEO descriptions and the public comparison image were refreshed and brought in line with the current feature set, and the operator brag-list figures were audited against the live counts.

  Notes

  • No database migration in this release.
  • Everything from v1.12.21 and earlier is included.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    1 download

  ---

  • distribution-anchor.env
    9 downloads · 2026-08-28 21:50:48 +00:00 · 1 KiB
  • morphit-v1.13.0-offline.tar.gz
    1 download · 2026-08-28 21:51:03 +00:00 · 711 MiB
  • morphit-v1.13.0-offline.tar.gz.sha256
    2 downloads · 2026-08-28 21:51:03 +00:00 · 97 B
  • morphit-v1.13.0.tar.gz
    7 downloads · 2026-08-28 21:50:47 +00:00 · 32 MiB
  • morphit-v1.13.0.tar.gz.sha256
    5 downloads · 2026-08-28 21:50:47 +00:00 · 89 B