diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt index 6c7396a..ec1b5c1 100644 --- a/.github/actions/spelling/expect.txt +++ b/.github/actions/spelling/expect.txt @@ -75,6 +75,7 @@ domainhere dracula dronebl droneblresponse +dropin duckduckbot eerror ellenjoe @@ -237,6 +238,7 @@ risc ruleset runlevels RUnlock +runtimedir sas sasl Scumm @@ -328,5 +330,4 @@ yoursite Zenos zizmor zombocom -Zonbocom zos diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md index e19e106..88c8591 100644 --- a/docs/docs/CHANGELOG.md +++ b/docs/docs/CHANGELOG.md @@ -10,7 +10,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] + + - Add `COOKIE_SECURE` option to set the cookie [Secure flag](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#block_access_to_your_cookies) - Sets cookie defaults to use [SameSite: None](https://web.dev/articles/samesite-cookies-explained) - Determine the `BIND_NETWORK`/`--bind-network` value from the bind address ([#677](https://github.com/TecharoHQ/anubis/issues/677)). @@ -21,6 +23,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Remove the "Success" interstitial after a proof of work challenge is concluded. - Add option for forcing a specific language ([#742](https://github.com/TecharoHQ/anubis/pull/742)) +### Potentially breaking changes + +The following potentially breaking change applies to native installs with systemd only: + +Each instance of systemd service template now has a unique `RuntimeDirectory`, as opposed to each instance of the service sharing a `RuntimeDirectory`. This change was made to avoid [the `RuntimeDirectory` getting nuked any time one of the Anubis instances restarts](https://github.com/TecharoHQ/anubis/issues/748). + +If you configured Anubis' unix sockets to listen on `/run/anubis/foo.sock` for instance `anubis@foo`, you will need to configure Anubis to listen on `/run/anubis/foo/sock` and additionally configure your HTTP load balancer as appropriate. + +If you need the legacy behaviour, install this [systemd unit dropin](https://www.flatcar.org/docs/latest/setup/systemd/drop-in-units/): + +```systemd +# /etc/systemd/system/anubis@.service.d/50-runtimedir.conf +[Service] +RuntimeDirectory=anubis +``` + ## v1.20.0: Thancred Waters The big ticket items are as follows: diff --git a/run/anubis@.service b/run/anubis@.service index 7b0fd94..2fe8fdd 100644 --- a/run/anubis@.service +++ b/run/anubis@.service @@ -12,7 +12,7 @@ CacheDirectory=anubis/%i CacheDirectoryMode=0755 StateDirectory=anubis/%i StateDirectoryMode=0755 -RuntimeDirectory=anubis +RuntimeDirectory=anubis/%i RuntimeDirectoryMode=0755 ReadWritePaths=/run