From 113b23bb4c8f35fec1988f26f72277b1c3991500 Mon Sep 17 00:00:00 2001 From: GeiserX <9169332+GeiserX@users.noreply.github.com> Date: Sat, 7 Nov 2026 20:41:28 +0100 Subject: [PATCH 1/7] feat!: release CashPilot Desktop 1.0 as the first stable version Adds a What's new in 1.0 section to the README and docs/whats-new-1.0.md, and sets the hand-kept versions to 1.0.0. Touching wails.json also makes auto-tag run on this merge. BREAKING CHANGE: none in behaviour. 1.0.0 marks the first stable release; config, database, credentials and deployed services carry over unchanged. --- CHANGELOG.md | 4 + README.md | 12 +++ docs/whats-new-1.0.md | 178 +++++++++++++++++++++++++++++++++++++ frontend/package-lock.json | 4 +- frontend/package.json | 2 +- package.json | 2 +- wails.json | 2 +- 7 files changed, 199 insertions(+), 5 deletions(-) create mode 100644 docs/whats-new-1.0.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 855bbe6..8aa5254 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Changed + +- **1.0.0 is the first stable release.** Nothing breaks: config, database, saved credentials and deployed services carry over. An install from before v0.37.0 keeps its earners on Docker's default bridge until Turn on isolation is pressed, and a proxied copy from before v0.39.1 keeps its tunnel there until it is deployed again. `wails.json`, `package.json` and `frontend/package.json` now say 1.0.0; release builds still take the version from the tag. What 1.0 covers, upgrade notes and known limits: docs/whats-new-1.0.md. + ### Fixed - **The Fleet page could draw over another view, and lose a half-typed proxy.** Fleet reads the backend twice before it draws, so a user who opened another view meanwhile got the Fleet page back. Any proxy action redraws the page, which also reset the open proxy editor and dropped unsaved values, a typed password included. A redraw now gives up when Fleet is no longer shown or a newer redraw started, and keeps the open editor when the same proxy's editor is drawn again. diff --git a/README.md b/README.md index b189801..b4eb3eb 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,18 @@ CashPilot Desktop is a local-first desktop app for macOS (Apple Silicon), Window CashPilot Desktop dashboard

+## What's new in 1.0 + +1.0 is the first stable release, after about 130 releases since May 2026. Nothing breaks on upgrade. The highlights: + +- **Earners can't reach your LAN.** Container earners run on a fenced network that drops private ranges, tailnets, cloud metadata, this computer and its public IP. If the fence can't be written, the deploy is refused. +- **Earn on more IPs.** Run extra copies of a service through a SOCKS5, HTTP CONNECT or Tailscale exit-node proxy. If the proxy dies the copy stops. It never falls back to your IP. +- **Your node identities are safe.** Removing a service keeps its data, an unrecoverable volume is never deleted without a separate yes, and encrypted backups take one click. +- **41 graded services**, vendored from the web catalog, with a check before deploy that says what would stop a service earning here. +- **Signed and notarized on macOS**, with builds for Windows and Linux. Pairs with a CashPilot server, or acts as the hub for workers and Android phones. + +Full list, upgrade notes and known limits: [What's new in 1.0](docs/whats-new-1.0.md). + ## Features - **One-click install** -- No Docker knowledge required; the app handles container setup for you diff --git a/docs/whats-new-1.0.md b/docs/whats-new-1.0.md new file mode 100644 index 0000000..025cfe8 --- /dev/null +++ b/docs/whats-new-1.0.md @@ -0,0 +1,178 @@ +# What's new in 1.0 + +CashPilot Desktop 1.0 is the first stable release. It follows about 130 releases +since v0.1.0 in May 2026. Nothing breaks on upgrade: your config, database, +saved credentials and deployed services carry over as they are. The version +number says the app is ready for daily use, with the limits listed at the end +of this page. + +This page covers what Desktop does today, grouped by what you would want to +know first. Each part links to the page with the details. + +## Earners can't reach your network + +Earner images are closed source. Desktop assumes they might misbehave and +limits what they can reach. + +- **LAN fence.** On a new install, bridge-networked earners run on CashPilot's + own network, `cashpilot-isolated`. One nftables table drops traffic to + 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, tailnets at 100.64.0.0/10, cloud + metadata at 169.254.0.0/16, subnets directly connected to this computer, the + computer itself and its public IPv4. That last one stops NAT loopback from + reaching a port your router forwards. NAT and the drops live in the same table, so if the + table goes missing the earners lose the internet, not gain your LAN. The app + writes the table again at startup, before every deploy and every five + minutes, and refuses a deploy it can't fence before it touches the running + container. An upgraded install gets a **Turn on isolation** button under Needs + attention. See [LAN isolation](configuration.md#lan-isolation). +- **Least privilege for every container.** Every capability is dropped and only + the ones the catalog entry declares are added back, with `no-new-privileges`, + a process limit, host devices only from a fixed allow-list, and privileged + mode only where the entry asks for it. The fence, tunnel and Activity helper + images that Desktop runs itself are pinned by digest. +- **Data that can't be replaced is protected.** Removing a service keeps its + volumes. Deleting the data is a separate question that names each volume and + what it holds. A volume the catalog marks unrecoverable, such as a Storj identity + or a Mysterium keystore, is never deleted without a yes to that question. The + refusal comes before anything is removed, proxied copies included. +- **Encrypted backups of node identities.** A **Back these up** card lists the + services whose identity, keystore or wallet exists only on this disk. + **Download backup** reads those volumes with the container paused and + encrypts them with ChaCha20-Poly1305 to a passphrase or an X25519 public key. + CashPilot keeps nothing that could open the file, and has no upload. The + format is the web app's, so either app's tool opens either app's backups. + See [Backup](backup.md). +- **Credentials encrypted at rest** with AES-256-GCM, with the master key in the + OS keychain. +- **Mysterium on Windows** runs in userspace mode, which blocks its VPN + customers from your LAN, plus a Windows Firewall rule for 100.64.0.0/10 and + 169.254.0.0/16. The node does not start without the rule. +- **Signed macOS builds.** The macOS app is signed with a Developer ID + certificate, notarized and stapled. The release job fails if a signing secret + is missing, so it never ships unsigned. Releases are built with Go 1.26.10, + which distrusts the eight revoked eMudhra intermediates. +- **Activity, opt-in.** See which destinations each earner talks to: countries, + networks, ports, failed connections, and alerts for mail ports, LAN attempts + and odd hours. It never reads packet contents. Remote addresses are kept 24 + hours and deleted the moment you turn it off. See [Activity](activity.md). + +## Earn on more than one IP + +**Proxied copies** run an extra copy of a deployed service through a SOCKS5 +proxy, an HTTP CONNECT proxy or a Tailscale exit node, so one computer earns on +its own IP plus one per proxy. Add a proxy under Fleet, Proxies, test it to see +its exit IP and country, then run a copy through it. + +- Each copy is a tunnel container plus the earner in the tunnel's network + namespace. The tunnel's firewall goes in first, and the earner starts only + after an exit IP that isn't this computer's shows up within 45 seconds. +- It fails closed. If the proxy or the tunnel dies, the earner can't send a + packet anywhere, not from your own IP and not to your LAN. +- DNS goes through the proxy too, including plain HTTP CONNECT proxies. +- An optional traffic cap stops every copy behind a proxy at a percentage you + pick. A reset day, or Reset usage, starts only the copies the cap stopped, + and a copy that fails to start then is tried again. +- Proxy logins and auth keys are stored encrypted. + +There are limits. The app counts the cap only while it runs. Services that need host +networking, ports, volumes, devices or raw network capabilities can't run +through a proxy, and nor can services whose terms forbid proxies. With today's +catalog that rules out eight services. SOCKS5 and HTTP carry TCP only. See +[Proxied copies](proxies.md). + +## The catalog + +- **41 active services**, plus 11 retired entries the app hides and refuses to + deploy. They are vendored from the CashPilot web catalog byte for byte, with a weekly + check that fails when the two drift apart. +- **Letter grades** for every provider, computed from published criteria such + as payout record, account safety, container fit and privacy, with the top + cons and their sources. Missing evidence counts against a provider. + [How we grade](https://geiserx.github.io/CashPilot/ratings/). +- **A check before you deploy** that says what will stop a service earning on + this machine: a provider that forbids containers, no build for your CPU, or + another machine in the fleet already running a service the provider allows + once per connection. It never blocks. +- **A "not earning" flag** when a service's logs match a known failure or the + container keeps restarting. There is no green "earning" badge, because nothing + a container shows proves money moved. +- **Custom services** run an image the catalog doesn't list, under the same + restrictions. See [Custom services](custom-services.md). +- **Several instances** of a service on one machine, where the provider pays per + device and allows it. +- **Compose export**: save a `docker-compose.yml` with the same hardening and no + credentials, and keep earning without CashPilot. +- **Import** service logins from money4band, CashFactory or InternetIncome, after + a dry run. See [money4band](migrate/money4band.md). + +## Earnings and payouts + +- 17 earnings collectors read balances straight from the providers. A platform + with no reading shows a dash, never 0.00. +- Earnings per day over 7 or 30 days, in any of 44 display currencies. +- Each service shows how far its balance is from the provider's cash-out + minimum, how and how often it pays, and what it does with your connection. +- Mysterium's balance is read from each node's own API, not the 30-day cloud + figure. +- Per-container CPU, memory and network charts, kept for 35 days. + +## Fleet + +- **Pair with a CashPilot server** as a worker. The dashboard then shows what + your provider accounts earned across the whole fleet, and marks a platform as + shared when more than one machine runs it. The first pairing copies this + machine's earnings history to the server, so its past days count too. + Unlinking leaves your local history as it was. +- **Use Desktop as the hub instead.** Turn it on in Settings, and workers and + the Android companion report to this Desktop. Phones report every + 15 minutes, so a phone stays online between reports instead of flickering + offline. + +## Platforms + +| Platform | Build | Signed | +|---|---|---| +| macOS (Apple Silicon) | `.zip` | Yes, Developer ID, notarized | +| Windows (x64) | `.exe` | Not yet | +| Linux (x64) | `.tar.gz` | No | + +Earners run in Docker or Podman; the setup wizard helps if neither is +installed. Packages for winget, a Homebrew tap and the AUR are written and +tested against the release assets, but not submitted yet. See +[App stores](app-stores.md). + +## Upgrading from 0.x + +Nothing to do. A few things stay as they were until you act: + +- An install from before v0.37.0 keeps its earners on Docker's default bridge. + Press **Turn on isolation** under Needs attention to fence them. +- A proxied copy created before v0.39.1 keeps its tunnel on the default bridge + until you deploy that copy again. +- A Windows Mysterium node deployed before the userspace change keeps its old + launch until you deploy it again. +- Copying your history to a server needs CashPilot v1.16.0 or newer. + +## Known limits + +- The tray icon is macOS only. +- Podman is not fenced yet. With `auto`, Needs attention says so; with `on`, + container deploys are refused. +- Host-networked services such as Mysterium are not behind the fence. Mysterium + blocks its customers from private ranges itself. +- The fence is tested on colima. It is not tested on Docker Desktop itself, + rootless Docker or Windows. +- The proxy traffic cap is only counted while the app runs. +- No auto-update yet. Download new releases from the releases page. + +## Still in progress + +- Auto-updates. +- Windows code signing. +- Submitting the winget, Homebrew and AUR packages. +- A tray icon on Windows and Linux. +- A LAN fence that works on Podman. +- Remote deploy from a CashPilot server to this Desktop. + +The full list of changes is in the [changelog](../CHANGELOG.md) and on the +[releases page](https://github.com/GeiserX/CashPilot-Desktop/releases). diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 1964859..7601bd9 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -1,12 +1,12 @@ { "name": "cashpilot-desktop-frontend", - "version": "0.10.1", + "version": "1.0.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "cashpilot-desktop-frontend", - "version": "0.10.1", + "version": "1.0.0", "devDependencies": { "typescript": "^7.0.2", "vite": "^8.3.5" diff --git a/frontend/package.json b/frontend/package.json index 08c9d0c..750d42c 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -1,6 +1,6 @@ { "name": "cashpilot-desktop-frontend", - "version": "0.10.1", + "version": "1.0.0", "private": true, "type": "module", "scripts": { diff --git a/package.json b/package.json index 579a0b1..0158b68 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "cashpilot-desktop", - "version": "0.10.1", + "version": "1.0.0", "private": true, "license": "GPL-3.0-or-later", "scripts": { diff --git a/wails.json b/wails.json index 1d09758..487b396 100644 --- a/wails.json +++ b/wails.json @@ -12,7 +12,7 @@ }, "info": { "productName": "CashPilot Desktop", - "productVersion": "0.10.1", + "productVersion": "1.0.0", "copyright": "Copyright 2026 Sergio Fernandez", "comments": "Local-first passive income and DePIN service manager" } From 8b79dde8c7ae091b787e2dccc89c0108d7058df8 Mon Sep 17 00:00:00 2001 From: GeiserX <9169332+GeiserX@users.noreply.github.com> Date: Sat, 7 Nov 2026 20:43:03 +0100 Subject: [PATCH 2/7] docs: name the Android companion's 1.0 in the Desktop 1.0 notes --- README.md | 2 +- docs/whats-new-1.0.md | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b4eb3eb..fede387 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ CashPilot Desktop is a local-first desktop app for macOS (Apple Silicon), Window - **Earn on more IPs.** Run extra copies of a service through a SOCKS5, HTTP CONNECT or Tailscale exit-node proxy. If the proxy dies the copy stops. It never falls back to your IP. - **Your node identities are safe.** Removing a service keeps its data, an unrecoverable volume is never deleted without a separate yes, and encrypted backups take one click. - **41 graded services**, vendored from the web catalog, with a check before deploy that says what would stop a service earning here. -- **Signed and notarized on macOS**, with builds for Windows and Linux. Pairs with a CashPilot server, or acts as the hub for workers and Android phones. +- **Signed and notarized on macOS**, with builds for Windows and Linux. Pairs with a CashPilot server, or acts as the hub for workers and Android phones. The [Android companion](https://github.com/GeiserX/CashPilot-android/releases) reaches 1.0 at the same time. Full list, upgrade notes and known limits: [What's new in 1.0](docs/whats-new-1.0.md). diff --git a/docs/whats-new-1.0.md b/docs/whats-new-1.0.md index 025cfe8..bff1a11 100644 --- a/docs/whats-new-1.0.md +++ b/docs/whats-new-1.0.md @@ -127,6 +127,10 @@ catalog that rules out eight services. SOCKS5 and HTTP carry TCP only. See the Android companion report to this Desktop. Phones report every 15 minutes, so a phone stays online between reports instead of flickering offline. +- **The Android companion reaches 1.0 at the same time.** It reports the + earning apps on a phone to your CashPilot server or to this Desktop. Get it + from https://github.com/GeiserX/CashPilot-android/releases. An F-Droid + listing is submitted and waiting for review. ## Platforms From e9e8669962ecc2c76e183640da0c094763524e84 Mon Sep 17 00:00:00 2001 From: GeiserX <9169332+GeiserX@users.noreply.github.com> Date: Sat, 7 Nov 2026 20:44:04 +0100 Subject: [PATCH 3/7] docs: say which Desktop and web versions the Android 1.0 companion needs --- docs/whats-new-1.0.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/whats-new-1.0.md b/docs/whats-new-1.0.md index bff1a11..60fb2c4 100644 --- a/docs/whats-new-1.0.md +++ b/docs/whats-new-1.0.md @@ -125,10 +125,12 @@ catalog that rules out eight services. SOCKS5 and HTTP carry TCP only. See Unlinking leaves your local history as it was. - **Use Desktop as the hub instead.** Turn it on in Settings, and workers and the Android companion report to this Desktop. Phones report every - 15 minutes, so a phone stays online between reports instead of flickering - offline. + 15 minutes, so Desktop gives a phone 45 minutes before it shows offline, + against 3 minutes for a worker. - **The Android companion reaches 1.0 at the same time.** It reports the - earning apps on a phone to your CashPilot server or to this Desktop. Get it + earning apps on a phone to your CashPilot server or to this Desktop, and + sends nothing anywhere else. It needs CashPilot web 1.73.2 or newer, or + Desktop 0.39.6 or newer, so Desktop 1.0 works with it. Get it from https://github.com/GeiserX/CashPilot-android/releases. An F-Droid listing is submitted and waiting for review. From c9f2c64e711d087aabc0420d5b010697296e1d69 Mon Sep 17 00:00:00 2001 From: GeiserX <9169332+GeiserX@users.noreply.github.com> Date: Sat, 7 Nov 2026 20:44:49 +0100 Subject: [PATCH 4/7] docs: say Desktop 1.0 works alongside CashPilot web 2.0 --- README.md | 2 +- docs/whats-new-1.0.md | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index fede387..e79dfe0 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ CashPilot Desktop is a local-first desktop app for macOS (Apple Silicon), Window - **Earn on more IPs.** Run extra copies of a service through a SOCKS5, HTTP CONNECT or Tailscale exit-node proxy. If the proxy dies the copy stops. It never falls back to your IP. - **Your node identities are safe.** Removing a service keeps its data, an unrecoverable volume is never deleted without a separate yes, and encrypted backups take one click. - **41 graded services**, vendored from the web catalog, with a check before deploy that says what would stop a service earning here. -- **Signed and notarized on macOS**, with builds for Windows and Linux. Pairs with a CashPilot server, or acts as the hub for workers and Android phones. The [Android companion](https://github.com/GeiserX/CashPilot-android/releases) reaches 1.0 at the same time. +- **Signed and notarized on macOS**, with builds for Windows and Linux. Pairs with a CashPilot server, web 2.0 included, or acts as the hub for workers and Android phones. The [Android companion](https://github.com/GeiserX/CashPilot-android/releases) reaches 1.0 at the same time. Full list, upgrade notes and known limits: [What's new in 1.0](docs/whats-new-1.0.md). diff --git a/docs/whats-new-1.0.md b/docs/whats-new-1.0.md index 60fb2c4..157bf8b 100644 --- a/docs/whats-new-1.0.md +++ b/docs/whats-new-1.0.md @@ -122,7 +122,9 @@ catalog that rules out eight services. SOCKS5 and HTTP carry TCP only. See your provider accounts earned across the whole fleet, and marks a platform as shared when more than one machine runs it. The first pairing copies this machine's earnings history to the server, so its past days count too. - Unlinking leaves your local history as it was. + Unlinking leaves your local history as it was. Desktop 1.0 works alongside + CashPilot web 2.0, which keeps the worker heartbeat, enrollment and history + import routes as they were. - **Use Desktop as the hub instead.** Turn it on in Settings, and workers and the Android companion report to this Desktop. Phones report every 15 minutes, so Desktop gives a phone 45 minutes before it shows offline, From 0ab8908022d1079201855bba120cad0031c2ea21 Mon Sep 17 00:00:00 2001 From: GeiserX <9169332+GeiserX@users.noreply.github.com> Date: Sat, 7 Nov 2026 20:50:10 +0100 Subject: [PATCH 5/7] docs: link the web 2.0 notes from the Desktop 1.0 page --- docs/whats-new-1.0.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/whats-new-1.0.md b/docs/whats-new-1.0.md index 157bf8b..80b0fb4 100644 --- a/docs/whats-new-1.0.md +++ b/docs/whats-new-1.0.md @@ -123,8 +123,9 @@ catalog that rules out eight services. SOCKS5 and HTTP carry TCP only. See shared when more than one machine runs it. The first pairing copies this machine's earnings history to the server, so its past days count too. Unlinking leaves your local history as it was. Desktop 1.0 works alongside - CashPilot web 2.0, which keeps the worker heartbeat, enrollment and history - import routes as they were. + [CashPilot web 2.0](https://geiserx.github.io/CashPilot/whats-new-2.0/), + which keeps the worker heartbeat, enrollment and history import routes + compatible. - **Use Desktop as the hub instead.** Turn it on in Settings, and workers and the Android companion report to this Desktop. Phones report every 15 minutes, so Desktop gives a phone 45 minutes before it shows offline, From f7e24c26167598a11d2d640eb5bff7ffbc4d6c0e Mon Sep 17 00:00:00 2001 From: GeiserX <9169332+GeiserX@users.noreply.github.com> Date: Sat, 7 Nov 2026 21:58:08 +0100 Subject: [PATCH 6/7] docs: state the limits of the fence, the key fallback and the redeploys 1.0 upgraders need --- README.md | 2 +- docs/whats-new-1.0.md | 36 ++++++++++++++++++++++++++++-------- 2 files changed, 29 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index e79dfe0..30f6480 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ CashPilot Desktop is a local-first desktop app for macOS (Apple Silicon), Window 1.0 is the first stable release, after about 130 releases since May 2026. Nothing breaks on upgrade. The highlights: -- **Earners can't reach your LAN.** Container earners run on a fenced network that drops private ranges, tailnets, cloud metadata, this computer and its public IP. If the fence can't be written, the deploy is refused. +- **Earners can't reach your LAN.** On a new install, bridge-networked earners run on a fenced network that drops private ranges, tailnets, cloud metadata, this computer and its public IP. If the fence can't be written, the deploy is refused. Upgraded installs turn it on with one button. Podman and host-networked services such as Mysterium are not fenced ([limits](docs/configuration.md#lan-isolation)). - **Earn on more IPs.** Run extra copies of a service through a SOCKS5, HTTP CONNECT or Tailscale exit-node proxy. If the proxy dies the copy stops. It never falls back to your IP. - **Your node identities are safe.** Removing a service keeps its data, an unrecoverable volume is never deleted without a separate yes, and encrypted backups take one click. - **41 graded services**, vendored from the web catalog, with a check before deploy that says what would stop a service earning here. diff --git a/docs/whats-new-1.0.md b/docs/whats-new-1.0.md index 80b0fb4..f6d5b60 100644 --- a/docs/whats-new-1.0.md +++ b/docs/whats-new-1.0.md @@ -19,9 +19,15 @@ limits what they can reach. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, tailnets at 100.64.0.0/10, cloud metadata at 169.254.0.0/16, subnets directly connected to this computer, the computer itself and its public IPv4. That last one stops NAT loopback from - reaching a port your router forwards. NAT and the drops live in the same table, so if the - table goes missing the earners lose the internet, not gain your LAN. The app - writes the table again at startup, before every deploy and every five + reaching a port your router forwards. The app learns that address with a + lookup, so until the first lookup after a start succeeds the address is open, + and only one public IPv4 is covered. With a second WAN, block the others on + the router. NAT and the drops live in the same table, so if the table goes + missing the earners lose the internet over TCP instead of gaining your LAN. + Three things still get through while it is missing: traffic to this computer + itself, one-way UDP to a LAN device, and everything when the host has a + masquerade rule of its own that covers the bridge. The app writes the table + again at startup, before every deploy and every five minutes, and refuses a deploy it can't fence before it touches the running container. An upgraded install gets a **Turn on isolation** button under Needs attention. See [LAN isolation](configuration.md#lan-isolation). @@ -43,10 +49,16 @@ limits what they can reach. format is the web app's, so either app's tool opens either app's backups. See [Backup](backup.md). - **Credentials encrypted at rest** with AES-256-GCM, with the master key in the - OS keychain. + OS keychain. Where no keychain is available the key falls back to a + `.credential_key` file with `0600` permissions in the app's data folder, so a + backup of that folder holds the key too. A native, non-Docker service's + environment, which can include its credentials, sits unencrypted in + `native/state.json` with `0600` permissions. - **Mysterium on Windows** runs in userspace mode, which blocks its VPN customers from your LAN, plus a Windows Firewall rule for 100.64.0.0/10 and - 169.254.0.0/16. The node does not start without the rule. + 169.254.0.0/16. The node does not start without the rule. A node deployed + before this change keeps its old launch, which lets VPN customers reach your + LAN and tailnet, until you deploy it again. - **Signed macOS builds.** The macOS app is signed with a Developer ID certificate, notarized and stapled. The release job fails if a signing secret is missing, so it never ships unsigned. Releases are built with Go 1.26.10, @@ -65,10 +77,14 @@ its exit IP and country, then run a copy through it. - Each copy is a tunnel container plus the earner in the tunnel's network namespace. The tunnel's firewall goes in first, and the earner starts only - after an exit IP that isn't this computer's shows up within 45 seconds. + after the tunnel sees an exit IP within 45 seconds. When the app knows this + computer's public IP, that exit must also differ from it. - It fails closed. If the proxy or the tunnel dies, the earner can't send a packet anywhere, not from your own IP and not to your LAN. - DNS goes through the proxy too, including plain HTTP CONNECT proxies. +- A SOCKS5 or HTTP proxy gives the earner whatever the proxy itself can reach, + private networks on its side included. Pick a proxy that refuses private + destinations. Tailscale tunnels drop private and tailnet ranges. - An optional traffic cap stops every copy behind a proxy at a percentage you pick. A reset day, or Reset usage, starts only the copies the cap stopped, and a copy that fails to start then is tried again. @@ -152,14 +168,18 @@ tested against the release assets, but not submitted yet. See ## Upgrading from 0.x -Nothing to do. A few things stay as they were until you act: +Your settings, data and services carry over. A few older deployments stay as +they were until you act. The first three matter for security: - An install from before v0.37.0 keeps its earners on Docker's default bridge. Press **Turn on isolation** under Needs attention to fence them. - A proxied copy created before v0.39.1 keeps its tunnel on the default bridge until you deploy that copy again. - A Windows Mysterium node deployed before the userspace change keeps its old - launch until you deploy it again. + launch, which lets its VPN customers reach your LAN and tailnet. Deploy it + again. +- A ProxyBase service deployed before v0.10.1 runs the retired client and earns + nothing. Deploy it again with a fresh Access Token. - Copying your history to a server needs CashPilot v1.16.0 or newer. ## Known limits From 5624fbcdbd9b37b825e0e739fdc51e09e08b3f4a Mon Sep 17 00:00:00 2001 From: GeiserX <9169332+GeiserX@users.noreply.github.com> Date: Sun, 8 Nov 2026 00:41:37 +0100 Subject: [PATCH 7/7] docs: name the cases the LAN fence does not cover in the 1.0 notes --- README.md | 2 +- docs/whats-new-1.0.md | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 30f6480..f729cc5 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ CashPilot Desktop is a local-first desktop app for macOS (Apple Silicon), Window 1.0 is the first stable release, after about 130 releases since May 2026. Nothing breaks on upgrade. The highlights: -- **Earners can't reach your LAN.** On a new install, bridge-networked earners run on a fenced network that drops private ranges, tailnets, cloud metadata, this computer and its public IP. If the fence can't be written, the deploy is refused. Upgraded installs turn it on with one button. Podman and host-networked services such as Mysterium are not fenced ([limits](docs/configuration.md#lan-isolation)). +- **Earners can't reach your LAN.** On a new install, bridge-networked earners run on a fenced network that drops private ranges, tailnets, cloud metadata, this computer and its public IP. If the fence can't be written, the deploy is refused, and the app rewrites it every five minutes. Upgraded installs turn it on with one button. Not covered: Podman, host-networked services such as Mysterium, a second public IP, the minutes before the first public-IP lookup, and the gap after a firewall reload until the next rewrite ([limits](docs/configuration.md#lan-isolation)). - **Earn on more IPs.** Run extra copies of a service through a SOCKS5, HTTP CONNECT or Tailscale exit-node proxy. If the proxy dies the copy stops. It never falls back to your IP. - **Your node identities are safe.** Removing a service keeps its data, an unrecoverable volume is never deleted without a separate yes, and encrypted backups take one click. - **41 graded services**, vendored from the web catalog, with a check before deploy that says what would stop a service earning here. diff --git a/docs/whats-new-1.0.md b/docs/whats-new-1.0.md index f6d5b60..f694560 100644 --- a/docs/whats-new-1.0.md +++ b/docs/whats-new-1.0.md @@ -30,7 +30,9 @@ limits what they can reach. again at startup, before every deploy and every five minutes, and refuses a deploy it can't fence before it touches the running container. An upgraded install gets a **Turn on isolation** button under Needs - attention. See [LAN isolation](configuration.md#lan-isolation). + attention. On Podman the fence can't be written yet: with `auto`, earners + deploy unfenced on Podman's default network and Needs attention says so. + See [LAN isolation](configuration.md#lan-isolation). - **Least privilege for every container.** Every capability is dropped and only the ones the catalog entry declares are added back, with `no-new-privileges`, a process limit, host devices only from a fixed allow-list, and privileged @@ -116,8 +118,10 @@ catalog that rules out eight services. SOCKS5 and HTTP carry TCP only. See restrictions. See [Custom services](custom-services.md). - **Several instances** of a service on one machine, where the provider pays per device and allows it. -- **Compose export**: save a `docker-compose.yml` with the same hardening and no - credentials, and keep earning without CashPilot. +- **Compose export**: save a `docker-compose.yml` with the same container + hardening and no credentials, and keep earning without CashPilot. The file + does not carry the LAN fence, so exported earners can reach your LAN and this + computer unless your own firewall stops them. - **Import** service logins from money4band, CashFactory or InternetIncome, after a dry run. See [money4band](migrate/money4band.md).