feat!: release 2.0, because upgrading from 1.x now needs a step

README.md

@@ -14,6 +14,13 @@ CashPilot is a self-hosted platform that runs passive income services on your ow
 
 ![The CashPilot dashboard: the balance first, a short list of what needs attention (an offline box, a stopped container, a balance it could not read, a payout to confirm), which service runs on which box, earnings per day, and the deployed services table](https://raw.githubusercontent.com/GeiserX/CashPilot/main/docs/images/screenshots/dashboard.png)
 
+## New in 2.0
+
+- **The worker is boxed in.** It reaches Docker only through a pinned socket proxy, and only the containers, volumes and networks it created, so a compromised worker cannot read the dashboard's data or its encryption key ([security defaults](https://geiserx.github.io/CashPilot/security-defaults/#docker-socket-proxy)).
+- **Earners are fenced off your LAN**, host, tailnet and cloud metadata on new installs; host-networked Mysterium is the exception ([network isolation](https://geiserx.github.io/CashPilot/isolation/)).
+- **One box, several IPs.** Proxied copies run an earner through SOCKS5, HTTP CONNECT or a Tailscale exit node, and stop instead of leaking when the proxy dies ([proxied copies](https://geiserx.github.io/CashPilot/proxies/)).
+- Coming from 1.x? Read [What's new in 2.0](https://geiserx.github.io/CashPilot/whats-new-2.0/#upgrading-from-1x) before you change the image tags.
+
 ## Features
 
 - Starts a Docker service with one click from the catalog; no compose file to write, no YAML to edit.

UPGRADING.md

@@ -19,6 +19,27 @@ commands, and [Backing up node identities](docs/backup.md) covers the rest.
 
 ---
 
+## 2.0: change the image tags
+
+**Affects everyone on 1.x.** The compose files pin a release series, so
+`docker compose pull` and the in-app **Update** button never move a 1.x install
+to 2.0.
+
+Beyond the fixes since 1.73, 2.0 changes nothing of its own, and it uses the
+same database. It is the major version for the releases below, several of which need
+a step from you: the socket proxy, owner isolation and its one-shot migration,
+and LAN isolation for upgraded installs.
+
+**What to do.** Back up `/data` and your node identities, then take the 2.0
+compose file for each host (or change every `drumsergio/cashpilot:1.x` and
+`drumsergio/cashpilot-worker:1.x` tag to `2.0`) and run
+`docker compose up -d --force-recreate`. Coming from before 1.73, also follow
+the sections below for your version.
+[What's new in 2.0](docs/whats-new-2.0.md#upgrading-from-1x) has a table by
+version and how to roll back.
+
+---
+
 ## Socket proxy on sockguard 2.4.6: take the new proxy line
 
 **Affects you if** your worker runs behind `cashpilot-socket-proxy`. sockguard

contrib/app-stores/casaos/CashPilot/docker-compose.yml

@@ -2,7 +2,7 @@ name: cashpilot
 
 services:
   cashpilot-ui:
-    image: drumsergio/cashpilot:1.73.0
+    image: drumsergio/cashpilot:2.0.0
     container_name: cashpilot-ui
     deploy:
       resources:
@@ -57,7 +57,7 @@ services:
   # labelled one, data checked, and keeps the original as <volume>-pre-isolation.
   # It holds the raw socket only while it runs.
   cashpilot-migrate:
-    image: drumsergio/cashpilot-worker:1.73.0
+    image: drumsergio/cashpilot-worker:2.0.0
     container_name: cashpilot-migrate
     user: "0:0"
     entrypoint: ["python", "-m", "app.owner_migrate"]
@@ -135,7 +135,7 @@ services:
             en_US: Host folders service containers may bind, comma-separated. Put the same list in the worker's CASHPILOT_PROXY_BIND_MOUNTS.
 
   cashpilot-worker:
-    image: drumsergio/cashpilot-worker:1.73.0
+    image: drumsergio/cashpilot-worker:2.0.0
     # The proxy's owner label, so the worker may read its own container.
     labels:
       cashpilot.deployed-by: worker
@@ -397,13 +397,15 @@ x-casaos:
   index: /
   port_map: "8080"
   scheme: http
-  version: "1.73.0"
+  version: "2.0.0"
   update_at: "2026-11-07"
   release_notes:
     en_US: |-
-      - First listing in the store, on CashPilot 1.73.0.
+      - First listing in the store, on CashPilot 2.0.0.
       - The worker reaches Docker through a socket proxy that refuses every call it does not make; only the proxy holds the Docker socket.
       - The proxy keeps the worker away from the dashboard's data and environment: it reaches only containers, volumes and networks labelled cashpilot.deployed-by=worker.
+      - New installs fence the earners off your LAN, the host, a tailnet and cloud metadata; host-networked Mysterium is not covered.
+      - Proxied copies run an extra copy of an earner through a SOCKS5, HTTP CONNECT or Tailscale exit-node proxy, so one box earns on several IPs.
       - The first visit asks for the setup token printed in the cashpilot-ui log, then creates the owner account.
   website: https://geiserx.github.io/CashPilot/
   repo: https://github.com/GeiserX/CashPilot

contrib/app-stores/runtipi/cashpilot/config.json

@@ -7,7 +7,7 @@
   "dynamic_config": true,
   "id": "cashpilot",
   "tipi_version": 4,
-  "version": "1.73.0",
+  "version": "2.0.0",
   "categories": ["finance", "automation"],
   "description": "CashPilot runs passive income services (bandwidth sharing, DePIN, storage and GPU compute) on your own server and shows what they earn in one web dashboard. A worker container starts the services that run in Docker; the dashboard reads the providers' balances into one earnings history.",
   "short_desc": "Run passive income services and see what they earn.",
@@ -17,6 +17,6 @@
   "form_fields": [],
   "supported_architectures": ["arm64", "amd64"],
   "created_at": 1793750400000,
-  "updated_at": 1794074579901,
+  "updated_at": 1794080522087,
   "min_tipi_version": "4.8.0"
 }

contrib/app-stores/runtipi/cashpilot/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   cashpilot:
-    image: drumsergio/cashpilot:1.73.0
+    image: drumsergio/cashpilot:2.0.0
     networks:
       - cashpilot_owned
     ports:
@@ -24,7 +24,7 @@ services:
   # labelled one, data checked, and keeps the original as <volume>-pre-isolation.
   # It holds the raw socket only while it runs.
   cashpilot-migrate:
-    image: drumsergio/cashpilot-worker:1.73.0
+    image: drumsergio/cashpilot-worker:2.0.0
     container_name: cashpilot-migrate
     user: "0:0"
     entrypoint: ["python", "-m", "app.owner_migrate"]
@@ -95,7 +95,7 @@ services:
         condition: service_completed_successfully
 
   cashpilot-worker:
-    image: drumsergio/cashpilot-worker:1.73.0
+    image: drumsergio/cashpilot-worker:2.0.0
     # The proxy's owner label, so the worker may read its own container.
     labels:
       cashpilot.deployed-by: worker

docs/index.md

@@ -20,6 +20,9 @@ hide:
 
 **CashPilot** runs passive income services on your own servers and shows what they earn in one dashboard. It is a UI that holds the catalog, the credentials and the earnings history, and on each server a worker that starts and watches the service containers through a Docker socket proxy. Start with [Getting started](getting-started.md), then pick services in the [Service guides](guides/index.md).
 
+!!! tip "New in 2.0"
+    The worker reaches Docker only through a socket proxy and only the containers, volumes and networks it created; earners are fenced off your LAN by default; and proxied copies let one box earn on several IPs. Upgrading from 1.x means changing the image tags: [What's new in 2.0](whats-new-2.0.md) lists what changed and how to upgrade.
+
 <div class="grid cards" markdown>
 
 -   :material-docker: **[Getting started](getting-started.md)**
@@ -141,6 +144,7 @@ graph LR
 - Every service container runs with all Linux capabilities dropped (a few services add back only the ones they declare), `no-new-privileges` set and a PID limit.
 - Stored credentials are encrypted at rest with a Fernet key at `/data/.fernet_key`. Back that file up: without it nothing can be decrypted. `CASHPILOT_ENCRYPTION_KEY` is adopted only when that file is absent, so on an instance that already has a key the variable changes nothing. It is not `CASHPILOT_SECRET_KEY`, which only signs login sessions.
 - With the shipped compose files, only the socket proxy holds the Docker socket, and the worker reaches Docker only through it ([Security defaults](security-defaults.md)). The [app-store listings](app-stores.md) do not include the proxy yet, so there the worker mounts the socket itself. The UI is published on loopback by default, and the worker's port 8081 is never published, because either could start containers on the host.
+- The proxy also limits the worker to the containers, volumes and networks it created, so a compromised worker cannot read the UI's `/data`, its encryption key or the keys in its environment ([owner isolation](security-defaults.md#docker-socket-proxy)).
 - [Security defaults](security-defaults.md) lists what ships enabled, [Protecting your home network](home-network-security.md) and [Network isolation](isolation.md) show how to keep the earners away from your LAN, router and host.
 - To report a security problem, follow the [security policy](https://github.com/GeiserX/CashPilot/blob/main/SECURITY.md) and do not open a public issue.