-
Notifications
You must be signed in to change notification settings - Fork 75
/
CHANGELOG.txt
9195 lines (7454 loc) · 414 KB
/
CHANGELOG.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
###
### Stable BOA-5.5.0-pro - Full Edition
### Date: Sat 26 Oct 2024 09:49:51 AM PDT in Santa Clara
###
@=> New BOA-5.5.0 PRO Release – Thank You for Your Support!
We're thrilled to introduce BOA-5.5.0 PRO, our latest release and the third
under our new branch structure and dual licensing model.
This PRO release brings the project fully in sync with the DEV branch,
which has been actively developed over the past several months, incorporating
nearly 400 commits since BOA-5.4.0.
BOA-5.5.0 PRO also comes equipped with 26 Aegir-ready platforms, supporting
either Drupal core alone or various popular Drupal distributions—seven of
which are new! These platforms include options like Commerce, DXPR Marketing,
EzContent, farmOS, LocalGov, OpenCulturas, OpenFed, OpenLucius, Opigno LMS,
Sector, Social, Thunder, Ubercart, and Varbase.
We extend our heartfelt thanks to all of you who support our work
by purchasing a BOA Pro license: https://omega8.cc/boapro.
As always, this announcement covers only the most impactful new features,
critical fixes, and enhancements. For a comprehensive list of all updates,
please refer to the full commit history.
@=> New Features
* Added codebasecheck tool for codebase compatibility check with Percona 8.0
* Added Drush 13 support by invoking vendor/drush/drush/drush.php directly
* Added dedicated memorytuner (for testing for now)
* Added mysqltuner5 and mysqltuner8
* Added bash version scan_nginx.sh -- the Nginx DoS Guard
* Added support for more granular load limits like 1.2 2.5 3.
* Added support for non-standard /hdd mount point
* Added support for /mnt/ paths in Drush
* Added sqlclean and vhostcheck tools for root
* SQL Adminer access moved to Octopus Aegir HTTPS vhost URL at /sqladmin
* Added incident_email_report() feature to all monitor/check/ scripts
* Allow SSH based access authorization to SQL Adminer at new /sqladmin/ URL
* Added incident detection and email reporting for LE certs renewal failures
* Added screen auto-start in boa, barracuda and octopus
* Added support for Percona 8.4 LTS (for testing only, you should use 8.0)
* Added support for Percona 8.3 (for testing only, you should use 8.0)
* Added support for Percona 8.0 (production ready)
@=> Improvements
* Added _redis_cold_restart to mysql restart in the monitor/check/ scripts
* Rewrite the code used to install many new Drupal distros in Octopus
* Added Troubleshooting Docs in docs/FIXME.md (more entries soon)
* Faster _sql_busy_detection() in the monitor/check/ scripts
* Added _mysql_downgrade_protection() to avoid downgrade from Percona 8.0
* Many improvements in the Nginx DoS Guard in the monitor/check/ scripts
* Do not use fast firewall block unless /root/.instant.csf.block.cnf
* Pause some new monitors sub-tasks during BOA upgrades and backups
* Use underscore as prefix for all functions and camelCase vars
* Block only relevant ports using the monitor/check/ scripts
* Added docs on _NGINX_DOS_ variables
* Added doc on PHP versions management — fixes #1807
* Added separate docs/PHP-FPM.md and docs/DRUSH-CLI.md
* Added docs on Importance of Keeping SKYNET Enabled in BOA
* Added _CPU_TASK_RATIO to the CPU logic in auto-healing scripts
* Display currently used GRUB config in boa info
* Make the not_supported_virt() BOLD ENOUGH in boa info
* Added WARNING if /root/.allow.any.virt.cnf exists in boa info
* Display _DSK Usage for relevant partitions only in boa info
* Improved _XSY System Uptime/Load/Kernel/Disk/Memory Report in boa info
* Added Lshell version to boa info
* Always attach basic boa info report to barracuda upgrade log/email
* Improve check_php_rebuild() and add separate check_php_ssl_version()
* Explained _INCIDENT_EMAIL_REPORT variable
* Explained _SQL_MAX_TTL variable
* Explained _SQL_LOW_MAX_TTL variable
* Split big minute.sh into smaller auto-healing scripts
* Added procedure to fix empty or missing .dhp files
* Improved /root/.dont.use.fancy.bash.login.cnf logic
* Improved the octopus upgrade email tpl
* Added Key Services Uptime Report to boa info
* Pretty large defunct code cleanup
@=> Changes
* Install python3-full packages
* Duplicity: Remove Python 2 support and require OpenSSL 3
* Remove restrictions for opcache_compile_file (Grav CMS support)
* Removed legacy manage_ip_auth_access() for SQL Adminer access
* PHP 8.3 is the new default version
* Prefer system default Python3 for Lshell and src build for Duplicity
* Always run ifnames_grub_check_sync in DEMO mode unless ctrl file exists
* Remove chrony if preinstalled
* PHP 8.1 is the max version supported on Stretch and Jessie
* New Relic removed support for legacy PHP 7.0 and 7.1
* Run _update_boa_tools only when new serial or pid key is detected
* Redis extension 8.x-1.8.2 (with not needed db schema update reverted)
* Disabled backboa install in auto mode
* Allow all 7.x PHP versions on legacy (Debian) systems
* Amazon EC2 No Longer Supported (system crashes, doesn't support Devuan)
* Use legacy PHP 7.x by default on legacy Debian systems
@=> Upgrades
* Lshell 0.10
* Composer 2.8.1
* Unbound 1.21.1
* OpenSSL 3.3.2
* PHP 8.3.13
* PHP 8.2.25
* PHP 8.1.30
* OpenSSH 9.9p1
* Python 3.12.5 (for Duplicity)
* cURL 8.10.1
* Nginx 1.27.2
* ionCube 13.3.1 (also for PHP 8.3)
* MyQuick 0.16.7-3
* CSF 14.21
* Duplicity 3.0.2
@=> Important Fixes
* Fix PATH in the websh wrapper (fixes git and OpenSSL issues)
* Fix for _PHP_FPM_TIMEOUT logic
* Remove apt-listchanges on Debian (for legacy systems with broken debconf)
* Improve _if_fix_python() procedure logic
* Fix the logic for _update_boa_tools on init
* Do not remove usage.sh — fixes #1824
* Add cleanup for exclude.tag (could result with no files on clone)
* Do not restart sshd every minute
* Do not reload nginx every few minutes by default
* cURL version upgrade should happen only with barracuda upgrade
* Fix for too broad cleanup in /var/xdrago/log/
* Ignore all dynamic requests related to css/js while they are generated
* Do not log redirects (Nginx)
* Inconsistent checks for SSL version in check_php_rebuild — fixes #1815
* Use _CURL_VRN=7.50.1 for Wheezy compatibility
* Use separate log for mysql notices — fixes #1805
* Add built-in /run/unbound setup — fixes #1804
* Percona 5.7 still depends on legacy packages naming — fixes #1808
* Compatibility with legacy Python 3.5
@=> Drupal platforms available for installation -- docs/PLATFORMS.md
* Commerce Kickstart 2.77 (7.101.1)
* Commerce Base 2.40 (10.1.8)
* Commerce Kickstart 3.0.0 (10.3.6)
* DXPR Marketing 10.3.0 (10.3.6)
* EzContent 2.2.15 (10.3.6)
* farmOS 3.3.1 (10.3.6)
* LocalGov 3.0.11 (10.3.6)
* OpenCulturas 2.2.1 (10.3.6)
* OpenFed 12.2.4 (10.2.10)
* OpenLucius 2.0.0 (9.5.11)
* Opigno LMS 3.1.0 (9.5.11)
* Sector 10.0.0-rc5 (10.2.10)
* Social 12.4.5 (10.2.10)
* Thunder 7.3.7 (10.3.6)
* Ubercart 2.15 (6.60.1)
* Ubercart 3.13 (7.101.1)
* Varbase 9.1.6 (10.3.6)
* Varbase 10.0.2 (10.3.6)
* Pressflow 6.60.1 (core only)
* Drupal 7.101.1 (core only)
* Drupal 9.5.11 (core only)
* Drupal 10.0.11 (core only)
* Drupal 10.1.8 (core only)
* Drupal 10.2.10 (core only)
* Drupal 10.3.6 (core only)
* Drupal 10.4.x-dev (core only)
###
### Stable BOA-5.4.0-pro - Full Edition
### Date: Wed 14 Aug 2024 06:24:03 AM AEST in Sydney
###
@=> New BOA PRO Release & Comparison with LTS and DEV Branches
We are excited to announce the release of BOA-5.4.0 PRO and BOA-5.4.0 LTS,
marking the second release under our new branch structure and dual licensing
model, which began with BOA-5.2.0.
These new PRO and LTS versions bring the project fully up to date with the
DEV branch, which has been actively developed over the past several months.
As always, this announcement highlights only the most significant new features,
critical fixes, and improvements. For a detailed list of all changes,
please refer to the commit history.
@=> New Features
* Simplify and speed up BOA install/upgrades -- please check all details in
the updated and greatly improved documentation:
docs/INSTALL.md
docs/UPGRADE.md
docs/SELFUPGRADE.md
docs/MAJORUPGRADE.md
* AppArmor BOA integration for more strict system protection (needs docs)
* Barracuda install without Octopus is now possible -- docs/INSTALL.md
* Enable instant php-cli version switch for Aegir backend -- docs/DRUSH.md
* Improve Ruby Gems and Node/NPM security and speed x3 -- docs/GEM.md
* Let's Encrypt for Aegir Hostmaster installed automatically -- docs/SSL.md
* Let's Encrypt Live Mode is enabled by default -- docs/SSL.md
* Add three manual backup modes in Aegir (incomplete feature at the moment)
* New Relic support with Octopus/Platform/Site Config -- docs/NEWRELIC.md
* Restore _AEGIR_UPGRADE_ONLY {aegir} as supported barracuda upgrade mode
* Restore {aegir|platforms|both} as supported octopus upgrade modes
* Security Considerations for Multi-Ægir Systems -- docs/SECURITY.md
* Use /root/.deny.clamav.cnf to auto-disable clamav if installed
* Use /root/.deny.java.cnf to auto-disable Solr and Jetty if not used
* Drush 12 in Aegir Tasks: Dynamically Utilize Site-Local Drush for
the updatedb Operations on Drupal 10+ (needs docs).
For now here is a brief explanation on how it works:
# Both Migrate and Clone tasks in Aegir by default run the updatedb
with Aegir own Drush 8 in the final deploy internal procedure.
# This may cause unexpected issues in Drupal 10 and newer versions, so
we have added a switch which allows you to tell Aegir to skip running
`updatedb` on Drupal 10+ -- either globally with empty control file
~/static/control/DisAutoUpDb.info or per site with empty control file
~/static/control/sitename_DisAutoUpDb.info where `sitename` is the site
main domain name used in its Drush alias. You could then unlock the
Site-Local Drush and run it manually with `vdrush` in the platform
app root (not web root) to better control what happens on `updatedb`
using command: `vdrush @site-alias updatedb`
# Automatic mode does it even better for Drupal 10+ Here's how it works,
given no control file listed above exists:
1. Platform Verify task locks Site-Local Drush and patches Drupal core.
2. If the site is migrated to different platform or cloned to different
platform, Aegir will check if **both old and new** platforms have
the Site-Local Drush in their codebases.
3. If Site-Local Drush is detected in both platforms Aegir will unlock
Drush in both platforms, will also revert the Drupal core patch it
normally needs to use its own Drush 8.
4. Now Aegir will run the Site-Local Drush for `updatedb` command and
will report all details in the task log in the admin interface.
5. Once the `updatedb` is complete, Aegir will automatically apply
the Drupal core patch again and will lock Site-Local Drush, so you
could run any other tasks in the control panel as usual. Magic!
@=> Drupal platforms available for installation -- docs/PLATFORMS.md
* Drupal 10.4.x-dev
* Drupal 10.3.1
* Drupal 10.2.7
* Drupal 10.1.8
* Drupal 10.0.11
* Social 12.4.2 (10.2.6)
* Thunder 7.3.0 (10.3.1)
* Varbase 10.0.0 (10.3.1)
* Varbase 9.1.3 (10.2.6)
* Drupal 9.5.11
* OpenLucius 2.0.0 (9.5.11)
* Opigno LMS 3.1.0 (9.5.11)
* Commerce 1.72
* Commerce 2.77
* Drupal 7.101.1
* Ubercart 3.13
* Pressflow 6.60.1
* Ubercart 2.15
@=> Improvements
* Add better protection from duplicate sql tasks
* Improve Aegir tasks messages to identify new improvements in the backend
* Update Drush 10+ aliases on the fly within Aegir deploy procedure
* Add BOA Roadmap & Progress Update in ROADMAP.md
* Add bring_all_ram_cpu_online
* Add CSF self-update debugging log in /var/backups/csf/water/
* Add Dual License and BOA Branches Explained in DUALLICENSE.md
* Add INI (platform level) docs in docs/ini/platform/INI.md
* Add INI (site level) docs in docs/ini/site/INI.md
* Add killer script for hanging apt-get update
* Add support for /root/.force.queue.runner.cnf
* Add switch_to_bash_in_octopus
* Detect and remove stale pid faster
* Display also system-manufacturer in the welcome messages and reports
* Do not lower proc nice on init and major OS upgrades
* Do not restart slow starting services during major OS upgrade
* Execute post-install octopus auto-upgrade on boa and octopus install
* Explain how upgrades affect BOA special shell wrapper
* Improve and simplify is_logged_in early check in global.inc
* Improve rsyslog to use separate log files for cron, mail, lfd, iptables
* Limit noise printed in the console
* Protect csf.allow from removing custom entries
* Rewrite and improve all BOA project docs to use Markdown
* Rewrite and improve the main README.md
* Simplify upgrade docs
* Turn Off AppArmor while running octopus
* Update tests for Amazon EC2 environment detection
* Use `drush11 aliases` or `drush11 sa` for Drupal 8+ core and PHP 8.2+
* Use new `fancynow` welcome screen only for interactive root sessions
* Nginx: Sync js/css aggregation support
* Nginx: Sync static files regex
@=> Changes and Upgrades
* Add compatibility with Redis 8.x-1.7.1
* Add igbinary support to PHP 5.6
* Add recommended security and privacy HTTP headers in Nginx config
* Add required now $settings['state_cache'] = TRUE; in global.inc
* Adjust patches and PHP versions
* AdvAgg is no longer added to D8+ o_contrib
* Barracuda upgrade after boa install is now automated
* Build OpenSSH from sources by default
* cURL 8.9.1
* Disable man-db/auto-update to speed up also autoinit and boa install
* Duplicity 3.0.0
* Force mysql root password update on barracuda upgrade
* Git 2.45.2
* Image Optimize toolkit binaries are now included by default
* Install Python 3.12.4 for Duplicity
* ionCube 13.0.4
* Launch daily.sh automatically after barracuda upgrade
* Lshell 0.9.18.10
* MySecureShell master-29-06-2024
* New Relic 11.0.0.13
* New Relic no longer supports PHP 5.6
* Nginx 1.27.0
* Nginx: http2 is now a separate directive
* OpenSSL 3.0.14 LTS
* Re-enable cleanup for GHOST distros revisions
* Remove /etc/apt/preferences
* Remove cloud-utils if detected
* Remove legacy i386/x32 support
* Remove no longer supported MariaDB code
* Remove not used mysql_hourly.sh
* Removing old boa-init no longer needed after introducing fast autoinit
* Removing systemd cleanup from boa, now handled by the fast autoinit
* Replace mail with s-nail
* Replace pdnsd with unbound
* Restrict also find/scp to prevent lshell escape
* Upgrade to openjdk 11.0.24
* Use /etc/ssh for OpenSSH built from sources (no new server keys, finally)
* Use maximum compatible PhpRedis versions for legacy PHP
* Use PermitRootLogin prohibit-password
* We no longer allow to install BOA on Debian to avoid confusion
* We no longer override server sshd keys to avoid confusion
* Nginx: Remove the legacy X-XSS-Protection header
* Nginx: block bytedance and PetalBot aggressive crawlers
@=> Important Fixes
* Add python3.5 compatibility for Stretch
* Add second cron entry for critically important /var/xdrago/clear.sh
* Add support for legacy python3.4
* Always copy hostmaster LE cert to /etc/ssl/private/ if just updated
* Avoid any AppArmor code on legacy Debian systems
* Bash 5.2 compatibility
* Detect broken GIT early and reinstall from sources
* Do not install PHP 8.2 8.3 with _OPENSSL_EOL_VRN and _OPENSSL_LEGACY_VRN
* Do not use --with-http_v3_module for Nginx on legacy systems
* Do not use --with-imap for PHP on Jessie
* Do not use --with-imap for PHP on major upgrade on any OS
* Do not use --with-sodium for PHP on Jessie
* Fix confusing ICU logic
* Fix for ignored nofile limits
* Fix for iptables paths backward compatibility
* Fix for non-blocking ntpdate
* Fix New Relic APT config
* Fix Percona apt config logic
* Fix platforms symlinking in the limited shell account
* Fix Pure-FTPD install and config
* Force crontab update on major OS upgrade
* Improve resolvconf auto-config
* Let's Encrypt actually supports wildcard names already
* Make sure that _PHP_SINGLE_INSTALL exists before disabling other versions
* Modernize Percona keys logic
* Nginx: Sync http2 in legacy tpl
* Remove blocking cnf file if php-max is used
* Show PHP patch results on _DEBUG_MODE=YES
* Sync for python3.11
* Sync PHP extensions existence check directly, not just via ctrl files
* Sync PhpRedis build options with versions compatibility
* Sync with python3.9
* Update wkhtmltopdf versions logic
* Use cURL 7.71.1 on Jessie
* Use cURL 8.2.1 on Stretch
* Use OpenSSH 8.3p1 on Jessie
* Use OpenSSH 9.3p1 on Stretch
* Use OpenSSL 1.0.2u on Jessie
* Use OpenSSL 1.1.1w on Stretch
* Fix for composer.json and composer.lock protection
###
### Stable BOA-5.3.0-pro - Full Edition
### Date: Mon 12 Aug 2024 05:33:46 AM AEST in Sydney
###
@=> New BOA LTS Release & Comparison with PRO and DEV Branches
We are excited to announce the release of the latest BOA LTS version,
marking the first LTS release since the introduction of our new branch
structure and dual licensing model, which began with the BOA-5.2.0 release.
This LTS version brings the project up to date with BOA-5.3.0-pro, which
has been available for several months. Both BOA-5.3.0-pro and BOA-5.3.0-lts
are officially released today.
Looking ahead, BOA-5.4.0-pro will be released within the next 48 hours,
incorporating all recent developments from the DEV branch.
Please note that the project README and documentation displayed on GitHub
by default apply primarily to the BOA DEV branch, and shortly to BOA PRO.
These do not cover BOA LTS. If you are working with the LTS version, ensure
you switch to the appropriate branch to access legacy documentation
relevant to BOA LTS.
As always, we highlight only the most critical fixes and improvements in
this announcement. For a comprehensive list of changes, please refer to
the commit history.
@=> New Features
* PHP 8.3 Support
* Update sFTP password and password expiration date with temporary pid file
~/static/control/run-sftp-password-update.pid
Now the main Octopus limited shell user can easily self-update password
based access if still has working SSH keys but lost working password.
New password will be written to ~/static/control/new-USER-password.txt
* Add boa cleanup {detect|purge} {user|batch} to automate Octopus instances
cleanup. Requires existence of /data/disk/USER/log/CANCELLED file and
no vhosts existing in /data/disk/USER/config/server_master/nginx/vhost.d/
It will archive only config files and delete everything else, but will not
delete any databases nor db users (yet).
@=> Improvements
* Add ltd-shell account client access to moved sites files in static/files
* Always install legacy OpenSSL first and force new on upgrade
* Disable man-db/auto-update to speed up barracuda upgrades
* MySQL: Disable performance_schema by default
* MySQL: Do not run mysql_cleanup.sh on servers with >100 dbs
* Nginx DoS-Guard: Add ignore_admin to protect site admin activity
* Nginx DoS-Guard: Catch typical hack probe requests early
* Nginx DoS-Guard: Detect and block ‘unknown’ IPs requests
* Nginx DoS-Guard: Track and block 500/403/404 flood
* Prepare for but do not enable http3/quic yet
* Use cold solr7 restart only on barracuda upgrade
@=> Changes and Upgrades
* Build PHP --with-bz2
* Build Redis with --enable-redis-lzf --enable-redis-igbinary
* Composer 2.7.7
* cURL 8.7.1
* Drupal 7.101.1
* Enable ClassicTrack for Aegir tasks by default
* ionCube 13.0.2
* Nginx 1.26.0
* OpenSSH 9.8p1
* OpenSSL LTS with 3.0.13 (new default version)
* PHP 8.1.29
* PHP 8.2.22
* PHP 8.3.10
* PHP APCu 5.1.23
* PHP igbinary 3.2.15
* PHP imagick 3.7.0
* Ruby 3.3.4
* Use _USE_FPM=1024 as minimum
* Use phpredis 6.0.2 for 7.2 and newer
@=> Important Fixes
* Add clamd/freshclam to auto-healing
* Add cleanup for ctrl files blocking PHP upgrade
* Always check if all /var/xdrago/* scripts are present or force update
* Always install openjdk-11-jre-headless
* Fix for vdrush @site updb in Drush 12
* Fix protection from duplicate sql backups
* Legacy PHP versions require legacy OpenSSL version
* More protection from race conditions in auto-healing
* Remove old auto-healing pids if detected
* Restore ULIMIT in nginx init.d
* Sync autoupboa cron to not collide with sql backups
* The adduser no longer automates —home
* Use only php-fpm reload instead of start on upgrade
* Use PHP 7.4 in run_drush8_cmd if available
###
### Stable BOA-5.2.0 - Full Edition
### Date: Wed 03 Apr 2024 02:11:56 PM CEST in Warsaw
###
@=> Notes on new available BOA branches and licenses
BOA is available in three main branches, but only LTS for installation:
* LTS which remains completely free to use without any kind of license
as it was from the beginning (previously named HEAD or STABLE).
This branch should be considered as BOA LTS with slow updates, focused
on both security and bug fixes, but very limited new features additions.
* DEV which requires paid license for both install and upgrade and includes
the latest features, security and bug fixes and installed services versions.
This branch shouldn't be used in production without extensive testing.
* PRO which requires paid license and is available only as an upgrade
from either LTS or DEV (or previous HEAD/STABLE) is the branch with regular
monthly or bi-monthly releases, closely following tested DEV branch.
Once you install BOA LTS and want to upgrade to PRO with license obtained
from https://omega8.cc/licenses you will need to use up-pro command.
Once you install BOA LTS or PRO and want to upgrade to DEV with license
from https://omega8.cc/licenses you will need to use up-dev command.
Old commands using in-head, in-stable, up-head and up-stable no longer work
to avoid confusion and have been replaced with in-lts and up-lts in all
installation and upgrade scripts.
Please make sure to read updated docs/INSTALL.txt and docs/UPGRADE.txt
@=> New Features
* Add autodaedalus tool for easy automated major system upgrades
* Add Linux Containers (LXC) guest as supported (tested only by others)
* Add mysql_cleanup running hourly to keep known caches overhead at minimum
* Add OpenVZ Containers guest as supported (tested only by others)
* Add support for ~/static/control/disable_user_register_protection.info
* Add support for du command in limited shell with /root/.allow.du.cnf
* Debian Bookworm and Devuan Daedalus support (needs further testing)
* Full Drupal 10.2 support for install and upgrades from Drupal 9 and 10
@=> Improvements
* Add control/enable-drush-sa.info for native drush sa command
* Add hyperv qemu and kvm aws as supported
* Add ltd-shell alias vdrush:vendor/bin/drush
* Do not enforce newrelic_background_job(FALSE)
* Document BOA planned features in the ROADMAP.txt
* Document Drush usage in docs/DRUSH.txt
* Make it clear that only Devuan Chimaera should be used in production
* New Relic: Separate Web and Drush stats
* Purge firewall deny rules before reboot for faster system restart
* README rewrite and improvements
@=> Changes and Upgrades
* Aegir D10 Platforms: 3x Drupal core 10.0.11
* Aegir D10 Platforms: 3x Drupal core 10.1.8
* Aegir D10 Platforms: 3x Drupal core 10.2.4
* Aegir D10 Platforms: Social 12.2.2 with core 10.2.4
* Aegir D10 Platforms: Thunder 7.2.0 with core 10.2.4
* Aegir D10 Platforms: Varbase 9.1.1 with core 10.2.4
* Disable support for several built-in legacy D7 distros
* Do not enable /root/.fast.cron.cnf by default
* Drush 8.4.12.9
* Nginx 1.24.0
* Nginx: update ssl_ciphers remove 4 weak but leave 2 to support Safari 6-8
* OpenSSH 9.7p1
* OpenSSL LTS with 3.0.13 (prepare, optional)
* PHP 8.1.27
* PHP 8.2.17
* Redis 7.0.15
* Remove legacy Ubuntu support
@=> Important Fixes
* Always revert to iptables-legacy from nf_tables
* Fix for broken cURL self-healing
* Fix for cURL/libcurl version conflict
* Force Nginx cold restart if status is locked
* Improve auto-healing for duplicate move_sql and mysql_backup
* Improve downgrade_protection
* Revert "Sync /etc/security/limits.conf"
* Update Drush yml sites aliases also for Aegir system user
###
### Stable BOA-5.1.0 - Full Edition
### Date: Sat 04 Nov 2023 03:26:41 PM CET in Warsaw
###
### Documenting details in progress...
###
@=> New Features
* Automatically detect and add known web-root dir names on Add New Platform
* Lock Drush in any platform with Aegir task: Verify + Lock Drush
* Manage pid files in platforms web-root for Drush Lock/Unlock status
* Unlock Drush in any platform with new Aegir task: Unlock Local Drush
@=> Improvements
* Document ~/static/control/FastTrack.info in docs/FASTTRACK.txt
* Improve BOA forks compatibility with standalone Aegir paths
* Improve tasks labels in the Aegir control panel
* Use Aegir backend built-in chmod for Unlock Drush w/o external scripts
@=> Changes and Upgrades
* Aegir D10 Platforms: 3x Drupal core 10.1.6
* Aegir D10 Platforms: Social 12.0.0-rc3 with core 10.0.11
* Aegir D10 Platforms: Thunder 7.1.2 with core 10.1.6
* Aegir D10 Platforms: Varbase 9.0.16 with core 10.1.6
* Enable hosting_site_backup_manager Aegir extension by default again
* Fix permissions and ownership on every Platform Verify for Drupal 8/9/10
* OpenSSL 3.1.4
* PHP 8.1.25
* PHP 8.2.12
@=> Important Fixes
* Added missing web-root paths in built-in platforms for Drupal 9/10
* Fix the ability to rename existing platforms in the Aegir control panel
* Multiple fixes for built-in permissions and ownership Aegir scripts
###
### Stable BOA-5.0.0 - Full Edition
### Date: Thu 26 Oct 2023 09:55:22 PM CEST in Warsaw
###
### Documenting details in progress...
###
@=> New Features
* Add support for verbose Drush like 'drush -vvv @site status'
* Aegir in BOA is now fully compatible with PHP 8.1 and 8.2
* Do not purge cache tables listed in /root/.my.cache.exceptions.cnf
* Drupal 10 is fully supported (needs docs)
* Drupal 10 platforms available: Thunder, Varbase, Drupal 10.1 and 10.0
* Make system reboot much faster, also with 'boa reboot' command
* OpenSSL 3.x optional/test support with /root/.install.modern.openssl.cnf
@=> Improvements
* Always install latest Composer on barracuda upgrade
* Enable ~/static/control/FastTrack.info by default (needs docs)
* Minimize services downtime on upgrade using soft reload only if possible
* Site Local Drush is no longer removed on platform Verify (only locked)
* Use 'barracuda php-idle disable' to speed up major upgrades
@=> Changes and Upgrades
* Aegir D10 Platforms: 3x Drupal core 10.0.11
* Aegir D10 Platforms: 3x Drupal core 10.1.5
* Aegir D10 Platforms: Thunder 7.1.2 with core 10.1.5
* Aegir D10 Platforms: Varbase 9.0.16 with core 10.1.5
* Aegir D7 Platforms: Commerce 1.72 with core 7.98.1
* Aegir D7 Platforms: Commerce 2.77 with core 7.98.1
* Aegir D7 Platforms: Guardr 2.57 with core 7.98.1
* Aegir D7 Platforms: OpenOutreach 1.69 with core 7.98.1
* Aegir D7 Platforms: Opigno LMS 1.59 with core 7.98.1
* Aegir D7 Platforms: Panopoly 1.92 with core 7.98.1
* Aegir D7 Platforms: Ubercart 3.13 with core 7.98.1
* Aegir D9 Platforms: 3x Drupal 9.5.11
* Aegir D9 Platforms: OpenLucius 2.0.0 with core 9.5.11
* Aegir D9 Platforms: Opigno LMS 3.1.0 with core 9.5.11
* Aegir D9 Platforms: Social 11.9.14 with core 9.5.11
* BOA requires at least PHP 7.4 or newer as default version
* Change redis_perm_ttl from 6h to 24h
* Do not inlcude advagg/cdn in o_contrib_eight
* Drupal 10: add minimum patch for core
* Drupal 10: disable not working yet welcome email on install
* Drupal 10: fix compatibility and add missing code in Drush 8
* Drupal 10: lock vendor/drush
* Drupal 10: lock vendor/symfony/console/Input
* Drupal 10: replace psr/log in core with Drush 8 version
* Drush Launcher is not supported anymore so removed
* Enable /root/.fast.cron.cnf by default (needs docs)
* Remove confusing -bin suffix from Drush 10+ (needs docs)
* Set _PURGE_BACKUPS default to 14 or 7 on hosted BOA
* Set Composer Install Support in Aegir Backend as disabled by default
* The redis_use_modern is no longer optional in the INI files
* Update vendor code in the Aegir backend / Provision
* Use _STRONG_PASSWORDS=YES by default
* Use _USE_MYSQLTUNER=NO by default
@=> Important Fixes
* Do not enable redis on D7/D6 automatically, it works anyway
* Fast DNS Cache Server (pdnsd) install is no longer optional since 2014 (!)
* Fix for hosting_cron_queue() with ADV_CRON_MAX_PLL logic
* Make sure that expired password will not hang backend task
* Nginx: Add missing no-cache checks from @cache to @drupal
* Nginx: Move exceptions to the /index.php location
* Nginx: The css/js aggregation logic has changed in Drupal 10.1
###
### Cutting Edge BOA-5.0.0-dev - Initial Edition
### Date: Sat 06 May 2023 08:42:31 AM EEST in Kyiv
### Слава Україні!
###
### Documenting details in progress...
###
@=> New Features
* Add 'barracuda php-idle disable/enable' (needs docs)
* Automatic BOA System Major Upgrade Tool -- see docs/UPGRADE.txt
* Debian Bullseye and Buster support
* Devuan Chimaera and Beowulf support (systemd-free Debian alternative)
* Make Composer running with PHP defined in ~/static/control/cli.info
* Make PHP-CLI for Composer and Drush configurable on the fly (needs docs)
* New multi-step BOA install procedure -- see docs/INSTALL.txt
* PHP 8.2 support
@=> Major Improvements
* Barracuda first upgrade after boa install no longer requires reboot
* Use all available CPU cores for much faster PHP, Nginx, OpenSSL etc builds
@=> Important Changes
* BOA requires the classic network interface naming convention (needs docs)
* Disable all nightly codebase cleanup procedures
* Nginx: Add PATCH to allowed $request_method list
* Nginx: Remove deprecated upload_progress support
* Remove AdvAgg and CDN from D9+ o_contrib
* Rewrite the _PHP_MULTI_INSTALL cleanup to make it optional (needs docs)
* Stop running any Drush operations on Drupal 8+ in daily.sh
* Switch to Redis Server 7.x by default
* The php-all should no longer include 7.3 and older versions (needs docs)
* Ubuntu support is deprecated
* Use php-max to install ALL nine (9) PHP versions (needs docs)
@=> Important Fixes
* Discover the system IPv4 once and store in a file
* Fix several issues with ~/static/control/MyQuick.info logic
* Maintain csf.allow/ignore backup on serial update in /var/backups/csf/
* Nginx: Fix protected access to /update.php
* Nginx: Protect composer.json if exists in the Drupal web-root
###
### NEW BOA-4.2.0-stable - Full Edition
### Date: Sat 06 May 2023 07:42:19 AM EEST in Ivano-Frankivsk
### Слава Україні!
###
### Documenting details in progress...
###
@=> New Features
* Add 'barracuda php-idle disable/enable' (needs docs)
* Automatic BOA System Major Upgrade Tool -- see docs/UPGRADE.txt
* Debian Bullseye and Buster support
* Devuan Chimaera and Beowulf support (systemd-free Debian alternative)
* Make Composer running with PHP defined in ~/static/control/cli.info
* Make PHP-CLI for Composer and Drush configurable on the fly (needs docs)
* New multi-step BOA install procedure -- see docs/INSTALL.txt
* PHP 8.2 support
@=> Major Improvements
* Barracuda first upgrade after boa install no longer requires reboot
* Use all available CPU cores for much faster PHP, Nginx, OpenSSL etc builds
@=> Important Changes
* BOA requires the classic network interface naming convention (needs docs)
* Disable all nightly codebase cleanup procedures
* Remove AdvAgg and CDN from D9+ o_contrib
* Rewrite the _PHP_MULTI_INSTALL cleanup to make it optional (needs docs)
* Stop running any Drush operations on Drupal 8+ in daily.sh
* Switch to Redis Server 7.x by default
* The php-all should no longer include 7.3 and older versions (needs docs)
* Ubuntu support is deprecated
* Use php-max to install ALL nine (9) PHP versions (needs docs)
@=> Important Fixes
* Discover the system IPv4 once and store in a file
* Maintain csf.allow/ignore backup on serial update in /var/backups/csf/
###
### Stable BOA-4.1.4-rel - Full Edition
### Date: Fri Dec 10 22:30:49 CET 2021 in Warsaw
###
### Documenting details in progress...
###
@=> New Features
*
*
*
@=> Major Improvements
*
*
*
@=> Important Changes
*
*
*
@=> Important Fixes
*
*
*
### Stable BOA-4.1.3 Release - Full Edition
### Date: Thu Sep 24 18:51:49 CEST 2020
### Milestone URL: https://github.com/omega8cc/boa/milestones/4.1.3
# Release Notes:
This BOA release is a second transitional release before switching to rolling
release policy. Detailed changelog will follow.
This BOA update provides latest PHP versions, system updates, including
security fixes, many bug fixes, latest Aegir version ..but no Aegir platforms
are installed by default anymore, unless their keywords are listed in the file
~/static/control/platforms.info (please read further below for details)
TL;DR
* Yes, blazing fast site clone/migrate mode is available even for giant sites!
* Yes, BOA still supports Pressflow 6 (LTS version only!)
* No, we no longer install any supported distros as platforms by default.
@=> Super fast site cloning and migration mode (NEW!)
It is now possible to enable blazing fast migrations and cloning even sites
with complex and giant databases with this empty control file:
~/static/control/MyQuick.info
By the way, how fast is the super-fast? It's faster than you would expect!
We have seen it speeding up the clone and migrate tasks normally taking
1-2 hours to... even 3-6 minutes! Yes, that's how fast it's!
This file, if exists, will enable a super fast per table and parallel DB
dump and import, although without leaving a conventional complete database
dump file in the site archive normally created by Aegir when you run
not only the backup task, but also clone, migrate and delete tasks, hence
also restore task will not work anymore.
We need to emphasise this again: with this control file present all normally
super slow tasks will become blazing fast, but at the cost of not keeping
an archived complete database dump file in the archive of the site directory
where it would be otherwise included.
Of course the system still maintains nightly backups of all your sites
using the new split sql dump archives, but with this control file present
you won't be able to use restore task in Aegir, because the site archive
won't include the database dump -- you can still find that sql dump split
into per table files in the backups directory, though, in the subdirectory
with timestamp added, so you can still access it manually, if needed.
@=> Drupal platforms and Composer support
We no longer install any supported Drupal distros as platforms by default, but
you can customize Octopus platform list via control file, which will be used
on the next Octopus upgrade (you can request it individually if you are on
hosted Aegir service):
~/static/control/platforms.info
This file, if exists and contains a list of symbols used to define supported
platforms, allows to control/override the value of _PLATFORMS_LIST variable
normally defined in the /root/.${_USER}.octopus.cnf file, which can't be
modified by the Aegir instance owner with no system root access.
IMPORTANT: If used, it will replace/override the value defined on initial
instance install and all previous upgrades. It takes effect on every future
Octopus instance upgrade, which means that you will miss all newly added
distributions, if they will not be listed also in this control file.
Supported values which can be written in this file, listed in a single line
or one per line:
Drupal 9 based
THR ----------- Thunder
Drupal 8 based
LHG ----------- Lightning
OPG ----------- Opigno LMS
SOC ----------- Social
VBE ----------- Varbase
Drupal 7 based
D7P D7S D7D --- Drupal 7 prod/stage/dev
AGV ----------- aGov
CME ----------- Commerce v.2
CS7 ----------- Commons
DCE ----------- Commerce v.1
GDR ----------- Guardr
OA7 ----------- OpenAtrium
OAD ----------- OpenAid
OLS ----------- OpenLucius
OOH ----------- OpenOutreach
OPC ----------- OpenPublic
OPO ----------- Opigno LMS
PPY ----------- Panopoly
RST ----------- Restaurant
UC7 ----------- Ubercart
Drupal 6 based
D6P D6S D6D --- Pressflow (LTS) prod/stage/dev
DCS ----------- Commons
UCT ----------- Ubercart
You can also use special keyword 'ALL' instead of any other symbols to have
all available platforms installed, including newly added in all future BOA
system releases.
Examples:
ALL
LHG VBE D7P D7S D7D
Composer will now use PHP 7.3 by default, and you can find many useful hints at:
https://github.com/omega8cc/boa/blob/master/docs/COMPOSER.txt
IMPORTANT: You must switch your ~/static/control/cli.info to 7.2 or newer
PHP version (BOA hosted on Omega8.cc comes with 7.4, 7.3 and 7.2), because
D8 based distros require at least PHP 7.2 -- this also means that to run
the sites installed after switching cli.info to 7.2 or newer, you will also
need to either switch your ~/static/control/fpm.info to 7.2 or newer, or
more probably, to not break any existing sites not compatible with PHP 7.2+
you will need to list these D8 sites names in ~/static/control/multi-fpm.info
Please check for more information:
https://learn.omega8.cc/how-to-quickly-switch-php-to-newer-version-330
BOA supports Drupal 8 codebases both with classic directory structure like
in Drupal 7 and also Drupal 8 distros you can download from Drupal.org, but
if you use Composer based codebase with different structure, the platform path
is not the codebase root directory, but the subdirectory where you see the
Drupal own index.php and "core" subdirectory. It can be platform-name/web or
platform-name/docroot or something similar depending on the distro design.
### Stable BOA-4.1.2 Release - Full Edition
### Date: Tue Sep 22 05:30:08 CEST 2020
### Milestone URL: https://github.com/omega8cc/boa/milestones/4.1.2
# Release Notes:
This BOA release is a transitional release before switching to rolling
release policy. Detailed changelog will follow.
### Stable BOA-4.0.1 Release - Full Edition
### Date: Mon May 6 01:14:59 CEST 2019
### Milestone URL: https://github.com/omega8cc/boa/milestones/4.0.1
# Release Notes:
This BOA release provides three new PHP versions, system updates, including
security fixes, many bug fixes, latest Aegir version, plus all included
Drupal distributions updated to latest versions, and supplied with latest
Drupal 7 or Drupal 8 core, if possible. Yes, BOA still supports Pressflow 6.
Yes, Debian Stretch is supported. No newer Ubuntu releases are supported yet.
Yes, we have added Solr 7 support and every 5 minutes updates!
Four Drupal 8 based popular distributions have been included by default,
plus much improved Composer support and automatic permissions-fix-magic
on Platform and Site Verify tasks. No more manual fixes!
By the way, Composer will now use PHP 7.3 by default, and you can find
many useful hints at:
https://github.com/omega8cc/boa/blob/master/docs/COMPOSER.txt
Big improvements and changes are coming to (auto)managing Solr cores too!
Solr cores are are now created every 5 minutes if needed, instead of during
the nightly procedure only, and Solr 7 is used by default. Existing Solr 4
cores will continue to work as before, but the system will create new Solr 7
cores for all compatible sites, and will update the sites/foo.com/solr.php
accordingly. For existing Solr 4 cores there can be namespace conflicts,
so please make sure to check the updated sites/foo.com/solr.php file and
adjust your site configuration if needed.
Note: If you are using WinSCP and/or Putty on Windows, or Transmit/Coda
by Panic on a Mac, please check the Known Issues section at the bottom of this
BOA-4.0.1 release notes.