Keel-Linux/keel-web
1
0
Fork 0
Code Issues 3 Pull requests Projects Releases 7 Packages Wiki Activity Actions
7 releases 7 tags
  • testing-19.0-1-step8-20261002 ae46b34d8e

    Keel Web 19.0-1, testing build 2026-10-02 (unsigned) Pre-release

    marcos-mendez released this 2026-10-02 03:27:35 -03:00 | 14 commits to master since this release

    Test image of Keel Web, Phase 3 of the roadmap (Keel-Linux/tracker#46), built in isolation from this commit (keel-web master, ae46b34) on the Core layer of keel-core master (1902ac8), with every package built from its merged head: keel 0.15.1, inithooks 2.3.6+keel16, confconsole 2.2.3+keel11, keel-web 0.1.1, common 19.x (keel-overlay-coraza 0.1.2), anubis 1.27.0-0+keel3, libnginx-mod-http-coraza 0.21.0-0keel2, libcoraza 1.8.0, coreruleset 4.25.1. Testing only: not for production and not signed. Verify with the .sha512 file. Supersedes testing-19.0-1-step7-20261001-2.

    The file name keeps the 19.0-1 testing series; the recipe inside the image now says 19.0-2.

    Proxmox: copy to /var/lib/vz/template/cache and create a container from it. Plain LXC: extract into the rootfs.

    Fixed since step7b (2026-10-01)

    • HTTPS with Anubis: in the cloud modes the front is HTTPS only (port 80 answers 301), so Anubis's Secure cookies work and browsers pass the challenge (keel-web#3).
    • The WAF no longer blocks Anubis's pass-challenge when the site is opened by IPv4 or IPv6 address (common#27).
    • Coraza writes /var/log/coraza/audit.log, which names the CRS rule of each block (common#27).
    • Anubis no longer answers 500 at random to clients without gzip (anubis#2); pass-challenge redirects only to the request's own origin (anubis#3).
    • The usage screen lists the site first (keel-web#3).
    • Everything listed for Keel Core: Keel branding and console art, C.UTF-8 login, password shown once, keel inspect, overlay confirm, monit summary (inithooks#32, #33, confconsole#16, #17, #18, common#26, #28, keel#64, keel-core#19, #20, #21).

    Tested

    First boot (manual password, no Keel Cloud key); simple: plain Nginx on port 80, Anubis off; cloud_simple through keel spec apply --system (17 changes, 0 failed): HTTPS on 443, 301 from 80, challenge passed by name, IPv4 and IPv6 in Chromium, XSS and SQLi get 403 with the rule ids in the audit log, a gzip page comes through whole, 300 challenge requests without gzip all get 200, Monit with nginx, waf-blocks and anubis all OK; a second apply changes nothing; back to simple. No SSH host keys, Anubis key, CrowdSec identity or secrets in the image, and the machine-id is empty.

    Still open

    • A site opened by a *.localhost name: CRS 934190 (SSRF) blocks pass-challenge with 403. A normal name and addresses work.
    • On 80x24 and 100x30 terminals the console art scrolls off the top of the login message.
    Downloads