The assertNotPrivateUrl() function blocked standard loopback and link-local
addresses but could be bypassed using IPv4-mapped IPv6 representations:
- http://[::ffff:127.0.0.1]:8080/ → loopback bypass
- http://[::ffff:169.254.169.254]:8080/ → metadata endpoint bypass
- http://[::]:8080/ → all-interfaces bypass
Node.js normalises these to [::ffff:7f00:1], [::ffff:a9fe:a9fe], and [::]
respectively, none of which matched the existing regex patterns.
Add two patterns to close the gap:
- /^\[::ffff:/i catches all IPv4-mapped IPv6 addresses
- /^\[::\]$/ catches the IPv6 all-zeros address
Legitimate RFC1918 LAN URLs (192.168.x, 10.x, 172.16-31.x) remain allowed.
The App Installation Activity list on the Easy Setup complete page grew
unboundedly, pushing Active Downloads off-screen. Caps the list at ~8
visible items with overflow scrolling, auto-scrolling to keep the latest
activity visible.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The NVIDIA container toolkit setup requires gpg to dearmor the GPG key,
but minimal Debian/Ubuntu installs may not have it present. Adds gpg to
the dependency check alongside curl so it gets installed automatically.
Closes#522
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Backend returned { error: message } on 400 but frontend expected { message }.
catchInternal swallowed Axios errors and returned undefined, causing a
generic 'An internal error occurred' message instead of the real reason
(already installed, already in progress, not found).
- Fix 400 response shape to { success: false, message } in controller
- Replace catchInternal with direct error handling in installService,
affectService, and forceReinstallService API methods
- Extract error.response.data.message from Axios errors so callers
see the actual server message
The log2 normalization formula `50 * (1 + log2(ratio))` produces negative
values (clamped to 0) whenever the measured value is less than half the
reference. For example, a CPU scoring 1993 events/sec against a 5000
reference gives ratio=0.4, log2(0.4)=-1.32, score=-16 -> 0%.
Fix by dividing log2 by 3 to widen the usable range. This preserves the
50% score at the reference value while allowing below-average hardware
to receive proportional non-zero scores (e.g., 28% for the CPU above).
Also adds debug logging for CPU sysbench output parsing to aid future
diagnosis of parsing issues.
Fixes#415
Model downloads that fail (e.g., when Ollama is too old for a model)
were silently retrying 40 times with no UI feedback. Now errors are
broadcast via SSE and shown in the Active Model Downloads section.
Version mismatch errors use UnrecoverableError to fail immediately
instead of retrying. Stale failed jobs are cleared on retry so users
aren't permanently blocked.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
O Content Manager chamava api.deleteZimFile() para deletar arquivos
ZIM, mas esse método nunca foi implementado na classe API, causando
"TypeError: deleteZimFile is not a function".
O backend (DELETE /api/zim/:filename → ZimController.delete) já
existia e funcionava corretamente — só faltava o método no client
frontend que faz a ponte.
Closes#372
Link to the full step-by-step install walkthrough on projectnomad.us/install,
placed below the Quick Install command for users who need Ubuntu setup help.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When the install script runs a second time (e.g., after a failed first
attempt), it generates new random database passwords and writes them to
compose.yml. However, MySQL only initializes credentials on first startup
when its data directory is empty. If /opt/project-nomad/mysql/ persists
from the previous attempt, MySQL skips initialization and keeps the old
passwords, causing "Access denied" errors for nomad_admin.
Fix: remove the MySQL data directory before generating new credentials
so MySQL reinitializes with the correct passwords.
Closes#404
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
roguesupport.com changed to rogue.support (the actual domain).
Updates href and display text in two places.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The 2024-01 all_maxi ZIM was removed from Kiwix mirrors, causing
silent 404 failures for users selecting "Complete Wikipedia (Full)".
Updated to 2026-02 release (115 GB).
Closes#216
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
