chore: pin decdn to v0.0.4

AGENTS.md

@@ -141,7 +141,7 @@ test-scripts` fails while the committed file differs from a fresh render, and `m
 lint-alloy` validates and runs it.
 
 **Pinned upstream releases.** One decdn/decdn release (`decdn_node_version`, today
-`0.0.3`) and one decdn/sponsord release (`sponsord_version` = `sponsord_onramp_version`,
+`0.0.4`) and one decdn/sponsord release (`sponsord_version` = `sponsord_onramp_version`,
 today `0.0.3`; decdn/sponsord tags its whole workspace `vX.Y.Z`, there are no per-crate
 tags) are pinned across every path: the role defaults, the onramp's installer pin
 (`sponsord_onramp_decdn_release` + `_decdn_sums_sha256`, copied into
@@ -195,7 +195,7 @@ the pinned `iroh-relay` (re-capture it when bumping `iroh_relay_version`).
   the publisher's step). **The public deCDN node**
   (baseline + `decdn-node`), installed by `decdn_node_install_method`:
   `release` (the default) — a pinned GitHub release tarball verified against the
-  release's GPG-signed `SHA256SUMS` (`decdn_node_version`, default `0.0.3`); `source` — a git ref (any tag/branch/SHA) cloned and `cargo build`-ed **on the
+  release's GPG-signed `SHA256SUMS` (`decdn_node_version`, default `0.0.4`); `source` — a git ref (any tag/branch/SHA) cloned and `cargo build`-ed **on the
   node** as the unprivileged `decdn-build` user, sha256-pinned rustup, a `<repo>@<commit>`
   stamp (`tasks/source.yml`, copied into both sponsord roles, which share the user,
   home and toolchain). **No build can poison a later one:** root owns the home, the

ansible/README.md

@@ -174,7 +174,7 @@ ignored on the first converge.
    - **`release`** (the default) downloads the `v<decdn_node_version>` tarballs from
      `decdn_node_release_base` and verifies them against the GPG-signed `SHA256SUMS`.
      `decdn_node_version` defaults to the decdn/decdn release this repo pins
-     (`0.0.3`); the sponsord roles pin decdn/sponsord `0.0.3` the same way.
+     (`0.0.4`); the sponsord roles pin decdn/sponsord `0.0.3` the same way.
    - **`source`** clones `decdn_node_source_repo` (default `decdn/decdn` on GitHub) at
      `decdn_node_source_ref` (any tag, branch or SHA) **on the node** and builds it there
      as an unprivileged `decdn-build` user, in a fresh environment per commit, with a
@@ -498,7 +498,7 @@ the RPC URL when it is not provisioned on the host instead). Highlights:
 | `baseline_extra_inbound` | `[]` | public inbound ports; `decdn_nodes` opens udp/4433. |
 | `baseline_preserve_ipv6_autoconf` | `true` | Keep IPv6 RA/autoconf under hardening; set `false` for static-IPv6 hosts. |
 | `baseline_rp_filter_loose` | `false` | `true` loosens reverse-path filtering (`rp_filter=2`) for multi-homed nodes. |
-| `decdn_node_install_method` | `release` | `release` (the pinned `decdn_node_version`, `0.0.3`), `source` (build `decdn_node_source_ref` on the node) or `manual` (copy a control-machine build). |
+| `decdn_node_install_method` | `release` | `release` (the pinned `decdn_node_version`, `0.0.4`), `source` (build `decdn_node_source_ref` on the node) or `manual` (copy a control-machine build). |
 | `decdn_node_source_repo` / `decdn_node_source_ref` | `decdn/decdn` on GitHub / `""` | `source` only: the repo (no credentials in the URL) and the tag, branch or SHA to build. |
 | `decdn_node_target` | from the host | The release target triple, derived from the host architecture (x86_64 or aarch64). |
 | `decdn_network` | `""` | `arbitrum-sepolia` sets `chain_id` and every contract address from the role's manifest mirror; inventory values still win. `""` = set them yourself. |

ansible/galaxy/node/CHANGELOG.md

@@ -224,7 +224,7 @@ Initial packaging of the deCDN node roles as a distributable collection
   job checks the mirrors against that tag, the onramp's `SHA256SUMS` digests and
   the Compose image digests against the pinned releases, and fails when either
   upstream repo has a newer `vX.Y.Z` tag.
-- `decdn_node`: `decdn_node_version` defaults to `0.0.3`, decdn/decdn v0.0.3. The
+- `decdn_node`: `decdn_node_version` defaults to `0.0.4`, decdn/decdn v0.0.4. The
   generated mirrors (`vars/main/networks.yml`, `schema-keys.txt`) are
   regenerated from that tag.
 

ansible/galaxy/publisher/CHANGELOG.md

@@ -228,7 +228,7 @@ role describe a change shared with that collection.
   `origin/main`. The weekly `upstream-drift` job checks the mirrors against that
   tag, the onramp's `SHA256SUMS` digests and the Compose image digests against the
   pinned releases, and fails when either upstream repo has a newer `vX.Y.Z` tag.
-- `sponsord_onramp`: the installers' decdn pin defaults to decdn/decdn `v0.0.3`
+- `sponsord_onramp`: the installers' decdn pin defaults to decdn/decdn `v0.0.4`
   and that release's `SHA256SUMS` digest, following the `decdn_node` role's
   `decdn_node_version`.
 - `sponsord`: the restart-inputs comparison is now the only thing that restarts the

ansible/inventory/group_vars/sponsord_onramp_hosts.yml

@@ -33,7 +33,7 @@
 # sponsord_onramp_rpc_url: https://sepolia-rollup.arbitrum.io/rpc
 # sponsord_onramp_turnstile_sitekey: "0x…"
 # The decdn release the installers install defaults to the role's pin (decdn/decdn
-# v0.0.3), with the SHA-256 of its SHA256SUMS. To serve another, set both:
-# sponsord_onramp_decdn_release: v0.0.3
+# v0.0.4), with the SHA-256 of its SHA256SUMS. To serve another, set both:
+# sponsord_onramp_decdn_release: v0.0.4
 # sponsord_onramp_decdn_sums_sha256: "…"
 # CapacityBond and SlashJudge come from sponsord_network (group_vars/sponsord_hosts.yml).

ansible/inventory/host_vars/decdn-node-1/main.yml

@@ -23,13 +23,13 @@
 # the GPG-signed SHA256SUMS manifest. The version defaults to the decdn/decdn release
 # the role pins; set it only to hold a node on another one.
 decdn_node_install_method: release
-# decdn_node_version: "0.0.3"
+# decdn_node_version: "0.0.4"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.0.3
+#     decdn_node_source_ref: v0.0.4
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual

ansible/inventory/host_vars/origin-1/main.yml

@@ -25,13 +25,13 @@
 # the GPG-signed SHA256SUMS manifest. The version defaults to the decdn/decdn release
 # the role pins; set it only to hold a node on another one.
 decdn_node_install_method: release
-# decdn_node_version: "0.0.3"
+# decdn_node_version: "0.0.4"
 #
 # Alternative: build on the node from a git ref (any tag, branch or SHA), as an
 # unprivileged build user with a pinned toolchain (decdn_node_version is not checked
 # in this mode):
 #     decdn_node_install_method: source
-#     decdn_node_source_ref: v0.0.3
+#     decdn_node_source_ref: v0.0.4
 # Alternative: copy binaries built on this control machine
 # (`cargo build --release -p decdn-node -p decdn-cli` in a decdn/decdn checkout):
 #     decdn_node_install_method: manual

ansible/molecule/validation-sponsord/converge.yml

@@ -948,7 +948,7 @@
           ansible.builtin.include_role:
             name: sponsord_onramp
           vars:
-            sponsord_onramp_decdn_sums_sha256: 59debaf73eee9a45ac5ec3cf34886ba60233bc848f5aee8d23b0c920afa4cd59
+            sponsord_onramp_decdn_sums_sha256: bc295285109e2189331e57d9cb51d214113cba332bd08a2777866a7a1cec2951
       rescue:
         - name: Record onramp-pin-pair rejection (only if its assert failed)
           ansible.builtin.set_fact:

ansible/roles/decdn_node/README.md

@@ -7,12 +7,12 @@ pulls a pinned GitHub Release tarball and verifies it against the GPG-signed
 and `manual` copies locally-built binaries from the Ansible control machine. This
 is the repo's deployment (`playbooks/site.yml`).
 
-**Pinned release.** `decdn_node_version` defaults to `0.0.3`, the decdn/decdn
+**Pinned release.** `decdn_node_version` defaults to `0.0.4`, the decdn/decdn
 release this repo pins; see [Bumping the decdn release](#bumping-the-decdn-release)
 to move it. CI tests the role against stub binaries, not this release.
 
 **Schema tracking.** This role renders `node.toml` against the config schema of
-`decdn/decdn` v0.0.3, the release `decdn_node_version` pins. Upstream marks every config
+`decdn/decdn` v0.0.4, the release `decdn_node_version` pins. Upstream marks every config
 section `#[serde(deny_unknown_fields)]` and defines **no** serde aliases, so a key
 this role emits that your binary does not know is a startup crash-loop, not a
 warning. The role runs `decdn config validate` against the installed binary after
@@ -51,7 +51,7 @@ Per the deCDN node-onboarding ADR (019), a node only serves paid traffic after
      `decdn_verify_release_signature: false` for an air-gapped mirror that strips
      the signature — that takes the tarballs on trust.
 
-     `decdn_node_version` (default `0.0.3`) names the `v<version>` release, which
+     `decdn_node_version` (default `0.0.4`) names the `v<version>` release, which
      must be reachable from the target host; override `decdn_node_release_base`
      for a mirror.
    - **`source`** — the role builds the two binaries **on the node** from
@@ -103,7 +103,7 @@ Per the deCDN node-onboarding ADR (019), a node only serves paid traffic after
        rolling the ref back to the previous commit reinstalls that.
      - `decdn_node_version` is not checked in this mode: the backstop only
        requires the binaries to run. To build exactly a release, set
-       `decdn_node_source_ref` to its tag (`v0.0.3`).
+       `decdn_node_source_ref` to its tag (`v0.0.4`).
      - The repo URL may not carry a secret: no password, no user on an http(s)
        URL, no query. The upstream repo is public; for a private fork, root does
        the fetch, so give root on the node an ssh deploy key and the git host's key

ansible/roles/decdn_node/defaults/main.yml

@@ -61,7 +61,7 @@ decdn_rustup_sha256:
 # also moves the generated mirrors, the onramp's decdn pin (role default and
 # compose/sponsord-onramp.env.example), the Compose image digest and the chart's
 # appVersion (README.md, "Bumping the decdn release").
-decdn_node_version: "0.0.3"       # asserted non-empty in "release" mode
+decdn_node_version: "0.0.4"       # asserted non-empty in "release" mode
 # Release target triple. Derived from the host's gathered architecture (x86_64 or
 # aarch64, see vars/main/arch.yml), so arm64 hosts (Graviton, Ampere, Hetzner CAX)
 # get the aarch64 tarball with no inventory change. Needs facts: a play with

ansible/roles/decdn_node/vars/main/networks.yml

@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 1c41dd6e095e843ff6e2bab8340e12767aa68e32
+# Source: decdn/decdn @ 2a75f663ebd5fcb87ada4c024918a0b94bc5524d
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #

ansible/roles/sponsord/vars/main/networks.yml

@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 1c41dd6e095e843ff6e2bab8340e12767aa68e32
+# Source: decdn/decdn @ 2a75f663ebd5fcb87ada4c024918a0b94bc5524d
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #

ansible/roles/sponsord_onramp/README.md

@@ -100,7 +100,7 @@ is unreachable.
 4. **Point DNS** for the domain (A/AAAA) at the host, so Caddy can get a
    certificate.
 5. **The `decdn` release the installers install** defaults to the one this repo
-   pins: the decdn/decdn `v0.0.3` tag and the SHA-256 of that release's
+   pins: the decdn/decdn `v0.0.4` tag and the SHA-256 of that release's
    `SHA256SUMS`. To serve another, set the tag together with its digest: the role
    refuses a pair where one half keeps its default.
 6. **Set inventory** (`group_vars/sponsord_onramp_hosts.yml`): the domain, the
@@ -132,7 +132,7 @@ See [`defaults/main.yml`](defaults/main.yml) for the full list with comments.
 | `sponsord_onramp_turnstile_sitekey` | `""` | **Required.** |
 | `sponsord_onramp_turnstile_secret` | `""` | **Sensitive.** Leave empty to provision `turnstile-secret` on the host. |
 | `sponsord_onramp_turnstile_secret_overwrite_host_file` | `false` | Confirm that the inventory secret may replace a file the role did not write. |
-| `sponsord_onramp_decdn_release`, `_decdn_sums_sha256` | `v0.0.3`, its digest | A decdn/decdn `vX.Y.Z` tag and 64 lowercase hex. The default follows the `decdn_node` role's pin; a host override of `decdn_node_version` does not move it. |
+| `sponsord_onramp_decdn_release`, `_decdn_sums_sha256` | `v0.0.4`, its digest | A decdn/decdn `vX.Y.Z` tag and 64 lowercase hex. The default follows the `decdn_node` role's pin; a host override of `decdn_node_version` does not move it. |
 | `sponsord_onramp_brand_name`, `_gate_template_src` | `""` | The gate page's name, or your own HTML page (a control-machine file). |
 | `sponsord_onramp_spending_cap_micro_usdc`, `_ttl_secs` | `""` | Requested per capability. `""` takes the daemon's maximum; more than it fails the deploy. |
 | `sponsord_onramp_fund_rate_per_min`, `_poll_rate_per_min` | `""` | Per-address rate limits (upstream 10 and 120; `0` turns one off). |

ansible/roles/sponsord_onramp/defaults/main.yml

@@ -138,10 +138,10 @@ sponsord_onramp_gate_template_src: ""
 # --- Release the installers install --------------------------------------------
 # The decdn/decdn release the installers download `decdn` from: a tag and the
 # SHA-256 of that release's SHA256SUMS file (`sha256sum SHA256SUMS` after
-# verifying its .asc). Default: decdn/decdn v0.0.3. Override the tag together with
+# verifying its .asc). Default: decdn/decdn v0.0.4. Override the tag together with
 # its digest: preflight refuses a pair where only one half moved.
-sponsord_onramp_decdn_release: v0.0.3     # decdn/decdn tag
-sponsord_onramp_decdn_sums_sha256: 59debaf73eee9a45ac5ec3cf34886ba60233bc848f5aee8d23b0c920afa4cd59
+sponsord_onramp_decdn_release: v0.0.4     # decdn/decdn tag
+sponsord_onramp_decdn_sums_sha256: bc295285109e2189331e57d9cb51d214113cba332bd08a2777866a7a1cec2951
 sponsord_onramp_releases_base: ""         # [https://github.com/decdn]
 
 # --- Limits ("" = the onramp's own default, shown in brackets) -----------------

ansible/roles/sponsord_onramp/vars/main/networks.yml

@@ -1,6 +1,6 @@
 ---
 # GENERATED by scripts/sync-network-profiles.py -- do not hand-edit.
-# Source: decdn/decdn @ 1c41dd6e095e843ff6e2bab8340e12767aa68e32
+# Source: decdn/decdn @ 2a75f663ebd5fcb87ada4c024918a0b94bc5524d
 #   crates/cli/src/known_chains.rs (KNOWN_CHAINS, KnownChain::addresses)
 #   + contracts/deployments/<chainId>.json
 #

charts/decdn-node/Chart.yaml

@@ -13,7 +13,7 @@ version: 0.1.2
 # image tag used when neither image.tag nor image.digest is set. Keep it equal to
 # the decdn_node role's decdn_node_version, and the tag of the one image in the
 # artifacthub.io/images annotation below (make test-scripts checks both).
-appVersion: "0.0.3"
+appVersion: "0.0.4"
 kubeVersion: ">=1.25.0-0"
 home: https://decdn.org
 icon: https://decdn.org/icon.svg
@@ -37,7 +37,7 @@ annotations:
   artifacthub.io/license: MIT
   artifacthub.io/images: |
     - name: decdn-node
-      image: ghcr.io/decdn/decdn-node:0.0.3
+      image: ghcr.io/decdn/decdn-node:0.0.4
   artifacthub.io/links: |
     - name: Chart source
       url: https://github.com/decdn/devops/tree/main/charts/decdn-node

charts/decdn-node/README.md

@@ -60,7 +60,7 @@ What it does **not** do:
 - **UDP reachability.** Either a load balancer that supports UDP Services, or
   `quic.hostPort.enabled` on nodes with a public IP.
 - **An image.** By default the chart runs `ghcr.io/decdn/decdn-node:<appVersion>`
-  (today `0.0.3`, the decdn/decdn release the chart is synced against). Pin
+  (today `0.0.4`, the decdn/decdn release the chart is synced against). Pin
   `image.digest` instead in production: take it from the release's
   `decdn-node-image-digest.txt` (`image-digest.txt` in v0.0.1), after checking its
   `.asc` against the keys in

charts/decdn-node/values.yaml

@@ -13,8 +13,8 @@ image:
   tag: ""
   # sha256:... — takes precedence over tag when set. Prefer it: a tag can be moved.
   # Take it from the release's signed decdn-node-image-digest.txt (v0.0.1:
-  # image-digest.txt), e.g. for v0.0.3
-  # sha256:dd76b5d755913be645435f0d71327cf1813ddb5ed7a780ee014573441e48d804
+  # image-digest.txt), e.g. for v0.0.4
+  # sha256:7c303b6105a1b419c0f7e3ef57d8ad3ba23d07cccba0d42332699fd409133f0a
   digest: ""
   pullPolicy: IfNotPresent
 

cloud-init/README.md

@@ -38,7 +38,7 @@ for the secrets of every group the host is in.
 > (`release` mode). The `manual` mode would install binaries that nothing verified,
 > and the Ansible path's `source` mode builds whatever its git ref points at (and
 > takes many minutes on first boot), so the lint refuses both. The release is the
-> one the roles pin at `DEVOPS_REF` (decdn/decdn `v0.0.3` today, decdn/sponsord
+> one the roles pin at `DEVOPS_REF` (decdn/decdn `v0.0.4` today, decdn/sponsord
 > `v0.0.3` for the sponsor); set `decdn_node_version` in the user-data to pin
 > another. `decdn_node_release_base` points the download at a mirror that serves
 > `v<version>/{decdn-node,decdn}-<version>-<target>.tar.gz`, `SHA256SUMS` and

cloud-init/user-data-publisher.yaml

@@ -140,7 +140,7 @@ write_files:
           # DEVOPS_REF (sponsord_onramp_decdn_release, with the SHA-256 of that release's
           # SHA256SUMS: take `sha256sum SHA256SUMS` once its SHA256SUMS.asc verifies).
           # Override both together, e.g.:
-          # sponsord_onramp_decdn_release: "v0.0.3"
+          # sponsord_onramp_decdn_release: "v0.0.4"
           # sponsord_onramp_decdn_sums_sha256: "<64 lowercase hex>"
 
   # What an interactive login prints while the bootstrap is unfinished. It is written

compose/.env.example

@@ -28,8 +28,8 @@ COMPOSE_PROFILES=node
 # releases the Ansible roles pin (README.md, the node's "Operate").
 
 # --- node -----------------------------------------------------------------------
-# decdn/decdn v0.0.3
-DECDN_IMAGE_DIGEST=sha256:dd76b5d755913be645435f0d71327cf1813ddb5ed7a780ee014573441e48d804
+# decdn/decdn v0.0.4
+DECDN_IMAGE_DIGEST=sha256:7c303b6105a1b419c0f7e3ef57d8ad3ba23d07cccba0d42332699fd409133f0a
 # DECDN_IMAGE_REPO=ghcr.io/decdn/decdn-node
 
 # uid/gid of the host's dedicated `decdn` system account, which owns /var/lib/decdn

compose/README.md

@@ -69,7 +69,7 @@ from: the wrapper always names the project (`decdn`) and refuses to run while th
 shell sets a `COMPOSE_*` variable or one `compose.yaml` reads, which Compose would
 otherwise take over `.env`, so its checks see what Compose runs. `init`
 starts it from `.env.example`, which carries the digests of the releases the Ansible
-roles pin (decdn/decdn v0.0.3, decdn/sponsord v0.0.3), each copied from that
+roles pin (decdn/decdn v0.0.4, decdn/sponsord v0.0.3), each copied from that
 release's signed digest file; [Operate](#operate) says how to take a newer one.
 
 ## The node

compose/sponsord-onramp.env.example

@@ -20,9 +20,9 @@ ONRAMP_GATE=turnstile
 ONRAMP_TURNSTILE_SITEKEY=
 # The decdn release the installers install: a decdn/decdn vX.Y.Z tag and the
 # SHA-256 of that release's SHA256SUMS file (`sha256sum SHA256SUMS` once its .asc
-# verifies). This is the pin the Ansible role defaults to: decdn/decdn v0.0.3.
-ONRAMP_DECDN_RELEASE=v0.0.3
-ONRAMP_DECDN_SUMS_SHA256=59debaf73eee9a45ac5ec3cf34886ba60233bc848f5aee8d23b0c920afa4cd59
+# verifies). This is the pin the Ansible role defaults to: decdn/decdn v0.0.4.
+ONRAMP_DECDN_RELEASE=v0.0.4
+ONRAMP_DECDN_SUMS_SHA256=bc295285109e2189331e57d9cb51d214113cba332bd08a2777866a7a1cec2951
 
 # --- Client address ---------------------------------------------------------------
 # The header the proxy puts the client address in; the onramp rate limits by it.