Keel-Linux/keel-web
1
0
Fork 0
Code Issues 3 Pull requests Projects Releases 7 Packages Wiki Activity Actions
7 releases 7 tags
  • testing-19.0-1-step7-20261001 060d14f104

    Keel Web 19.0-1, testing build 2026-10-01 (unsigned) Pre-release

    marcos-mendez released this 2026-10-01 16:57:10 -03:00 | 21 commits to master since this release

    Superseded by testing-19.0-1-step8-20261002. Use that build instead.

    Test image of Keel Web, Phase 3 of the roadmap (Keel-Linux/tracker#46) and step 7 of handbook decision 0041, built in isolation from this commit (keel-web#1) on the Core layer of keel-core master, with keel 0.15.0 (Keel-Linux/keel#63), the common overlays of 19.x and the step 5 packages (libcoraza 1.8.0, libnginx-mod-http-coraza 0.21.0, coreruleset 4.25.1, anubis 1.27.0). Not for production and not signed: the attended, signed release on releases.keellinux.org comes later. Verify with the .sha512 file.

    Proxmox: copy to /var/lib/vz/template/cache and create a container from it. Plain LXC: extract into the rootfs.

    What it was tested for, in an LXC container on the build host:

    • Simple installation: plain Nginx serves the default site (200), Coraza's module is not loaded (a Core Rule Set payload gets 200), Anubis is disabled and inactive; Monit watches sshd, Webmin, postfix and Nginx with its /keel-health probe; a second apply changes nothing.
    • keel manifest show web --resolved prints the Web table of decision 0041.
    • Moved to cloud simple through the spec with keel spec apply --system: a Core Rule Set payload gets 403; a browser user agent gets Anubis's challenge; Googlebot's user agent from 2001:4860:4801:10::1 gets the page, sent through a trusted proxy setting added for the test (set_real_ip_from the test client, real_ip_header X-Forwarded-For), while the same user agent from any other address is challenged; Monit adds CrowdSec, the bouncer, Anubis and the waf-blocks probe; a second apply changes nothing.
    • Back to simple through the spec: Debian's default site and plain Nginx again.
    • No SSH host keys, Anubis key, CrowdSec identity, machine-id or state hook record in the image.

    Known: with Coraza on, a static file answered with gzip comes back empty (Keel-Linux/libnginx-mod-http-coraza#2); the default site avoids it on its internal hop.

    Downloads