mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-25 19:03:14 +01:00
Claude
5e1cef37ce
server:install received the root username and password as positional arguments, visible in ps and /proc/<pid>/cmdline for the whole install, and LbInstallFlow/ProxyInstallFlow saved them in a plaintext bin/install/<id>.json for reinstalls. Any SSH host key was accepted. - The panel writes a 0600 bin/install/<id>.cred and runs `server:install <type> <id> <port> - - … --cred-file=<path>`; the command reads and deletes the file before connecting (InstallCredentials). Only <id>.cred files in bin/install/ are accepted. - <id>.json keeps the non-secret parameters only; reinstall_server now needs root_password in the request. cron:cleanup (MAIN) scrubs root_password from files written by earlier releases. - The node's SSH host key (SHA-1) must match the optional Expected SSH Host Key (hex or `ssh-keygen -l -E sha1` output), else the key stored by the first install (new servers.ssh_hostkey_sha1, migration 026), else it is trusted on first use and stored. - New install-form field and strings in all eight languages; cli-tools docs. Phase 0 stop-gap of the MAIN <-> LB API plan. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Es8UhyPS8MNjuYTagqfGWi