vvvomit/interzone
Watch
1
0
Fork
You've already forked interzone
 0
Code Issues Pull requests Projects Releases 50 Packages Wiki Activity Actions
50 releases 50 tags
  • v0.5.34 100ba9e05c

    v0.5.34 Stable

    vvvomit released this 2026-10-30 01:16:05 +03:30 | 39 commits to main since this release

    Set up from other servers over IPFS

    When the in-country mirrors are unreachable too, interzone can now fetch everything from other interzone servers over IPFS.

    IPFS: from interzone's swarm

    • A third Network situation on the Server step. The playbook, Ansible roles, OS and Docker packages, PyPI and every container image come from interzone's private IPFS swarm. The server only needs to reach one peer that has the files.
    • Before the deploy, interzone installs the IPFS daemon (kubo) on the server and joins the swarm. It finds the newest publish and checks its signature before using anything, then serves the publish's images to Docker as a local registry. The playbook is held at the publish's commit, so the roles match the images.
    • Share what this server downloads is asked during setup, with no answer preselected. Sharing keeps IPFS running after the deploy, listening on TCP 4001, and lets the swarm's members see that the server holds Matrix software. Without sharing, IPFS stops after each run.
    • ctrl+t and interzone check test that the publish and the swarm's entry node can be reached.
    • Offline bundles made with IPFS chosen carry the IPFS daemon for x86 and ARM servers.

    The swarm's key ships with interzone. It keeps the public IPFS network out but isn't a secret. See the wiki's Blackout mode page, section 6.

    Downloads
  • v0.5.33 ec1f489385

    v0.5.33 Stable

    vvvomit released this 2026-10-29 22:34:53 +03:30 | 44 commits to main since this release

    Safer on disk and on the wire: fixes from a codebase audit

    Thank you, @TheNarratorsFrevor! Everything in this release comes from their audit of interzone (pull request #1): fifteen careful fixes, each with a clear account of what went wrong and why.

    Security

    • Ansible checks the server's SSH host key. Playbooks used to run with host key checking off, so someone in the middle could pose as the server and receive the sudo password and every secret. A new server is trusted the first time; a changed key stops the run.
    • Offline bundles can't write outside the folder they unpack into, even through links made by earlier entries. A bundle also leaves out leftover files holding the admin's password.
    • Passwords stay off command lines (registering a user no longer shows it in ps), and the SSH connection-sharing folder in /tmp is only used when it's yours alone.
    • Answers, presets and the inventory are always written owner-only, and atomically, so a crash or full disk keeps the old file.

    Data loss

    • interzone servers rm with no name deleted the first server's answers. It now prints the usage.
    • A config.json that isn't valid JSON is moved aside instead of being overwritten with new secrets, which would have locked Synapse out of Postgres on the next deploy.
    • Rollback keeps each server's replaced answers apart (they shared one file), and stops if it can't save them.
    • Moving to a new server copies all of /matrix, or says why not. A slow receiver could lose the end of the archive, and a full disk made the copy hang.
    • The base domain must be a hostname: a pasted https:// is dropped, and an imported domain can't write outside the playbook.

    Hangs and crashes

    • A very long line of Ansible output no longer freezes the run.
    • A server without /etc/os-release no longer crashes the mirror check.
    • Background checks no longer crash the app when you change settings while they run.
    • Leaving a screen mid-check no longer leaves it spinning for good, and a new user password shown once is no longer lost.

    Smaller fixes

    • Commands take their options after the arguments too (restore dump.sql --yes).
    • -layout and -theme are checked before -reset moves anything.
    • Passwords with {{ or {%, which Ansible would misread, are caught before the deploy, and passwords starting with - work with MAS.
    • pgup scrolls the deploy log, logs and Fine-tune lists.
    • make builds report a version self-update understands, and make test runs what CI runs.
    • The screenshot scripts find their fonts on any distribution.

    Update with interzone self-update or Manage › Update interzone.

    Downloads
  • v0.5.32 159135efed

    v0.5.32 Stable

    vvvomit released this 2026-10-29 18:26:47 +03:30 | 59 commits to main since this release

    More themes, and a little motion

    New

    • Six more themes: tokyonight, rose-pine, everforest, kanagawa, onedark and synthwave, each with a light and a dark version. ctrl+y cycles through all 13.
    • The Welcome logo's colours flow, and while a deploy runs, its progress bar is drawn in the theme's colours with a highlight sweeping across it.
    • INTERZONE_MOTION=off keeps the logo and bars still. Plain mode never animates, and nothing moves on screens where nothing is happening.

    The README's screenshots and the wiki's deploy screenshots were retaken.

    Update with interzone self-update or Manage › Update interzone.

    Downloads
  • v0.5.31 b84127d543

    v0.5.31 Stable

    vvvomit released this 2026-10-29 17:50:22 +03:30 | 64 commits to main since this release

    Components that couldn't be set up now can

    Fixed

    • Draupnir can be set up. It needed an access token interzone never asked for, so Review always refused it. Settings now asks for the bot's token; the wiki shows how to get one after the first deploy. The Public community preset no longer ticks Draupnir, since its account only exists once the server is up.
    • Meowlnir works, and bridges and bots know their admin. interzone now sets your first admin account as matrix_admin, which Meowlnir needs for its management room and which baibot, many mautrix bridges, Postmoogle and Steam take as their administrator.
    • Review stops MAS next to a Synapse password provider. REST auth, Shared Secret Auth, LDAP auth and Matrix Corporal don't work once MAS does the logins, and the playbook refused the combination part way through the deploy. Review now says so first.
    • The SMS bridge's truststore is optional, needed only when the gateway's certificate is self-signed.
    • WeChat is marked unmaintained (it doesn't work with current Synapse) and mx-puppet Steam deprecated (use the other Steam bridge).
    • Review's confirm box no longer has a double blank line when nothing failed.

    New in the wiki: a guide to every component, by category, in English and Persian: what it does, what to fill in, its DNS, and how to use it after the deploy.

    Update with interzone self-update or Manage › Update interzone.

    Downloads
  • v0.5.30 77f8335e6b

    v0.5.30 Stable

    vvvomit released this 2026-10-29 16:48:07 +03:30 | 72 commits to main since this release

    Rooms no longer leaves its screen behind

    Fixed

    • Going from Rooms to another screen leaves nothing behind. A room name with a tab, a line break or some emoji was drawn wider than interzone measured it, so the terminal scrolled and Rooms' header and keys stayed on screen on Users and elsewhere. Changing screens now redraws the whole window.
    • Room names, user names and log lines from the server are made safe to draw: tabs, line breaks and terminal escape codes become spaces, and joined emoji like 👨‍👩‍👧‍👦 are shown as their parts.
    • Long names are cut to the space on screen, so names in Chinese, Japanese or with emoji, which take two cells a character, no longer run past their column.

    Update with interzone self-update or Manage › Update interzone.

    Downloads
  • v0.5.29 57ea4625c8

    v0.5.29 Stable

    vvvomit released this 2026-10-29 16:15:06 +03:30 | 73 commits to main since this release

    The Dashboard works again, and sudo passwords with a quote do too

    Fixed

    • The Dashboard and interzone status work again. Since v0.5.26 Ansible refused to load the play behind them, on every server. Every play interzone writes is now checked by Ansible before a release.
    • A sudo password with a ' in it works. The quote was lost on its way to Ansible, so becoming root failed. The SSH host, user, port and key are quoted the same way now.
    • An SSH user, host or Git address starting with - can't be taken as an option by ssh or git. An answers file passed with --config could otherwise run a command on this machine.
    • No crash in very small windows on Backups, Alerts, Move server and Server. A wide layout picked with ctrl+l or -layout wide switches to compact when the window can't hold it, instead of drawing past the edges.
    • The menu fits short windows: it scrolls to where you are, with "more" above and below, instead of pushing the header off.
    • -plain drops the menu's and actions' icons, so a screen reader doesn't read them out.
    • Every command's -h says how to use it, and a path that doesn't exist says so plainly instead of a raw stat error.
    • Smaller things: the empty roll-back list says when deploys start being recorded, empty lists don't offer keys that do nothing, and typed confirmations no longer show a grey hint that looks like typed text.

    Update with interzone self-update or Manage › Update interzone.

    Downloads
  • v0.5.28 74ab0b8c3d

    v0.5.28 Stable

    vvvomit released this 2026-10-29 15:16:02 +03:30 | 81 commits to main since this release

    Easier to find your way: go to by name, every key listed, and Review asks before deploying

    New

    • Go to anything with ctrl+k. Type a few letters of a screen or a Manage action, e.g. vac or backup, and enter goes there. Actions that change the server wait for a second enter.
    • ? lists every key of the screen you're on and the ones that work anywhere, in every layout. The footer always keeps "? all keys" when the rest doesn't fit.
    • Every Manage action has a shortcut: A alerts, R rooms, D disk space, V vacuum, P Postgres upgrade, C compress, $ database shell, U update interzone, X uninstall.

    Changed

    • Review: enter asks before deploying. It shows whether it installs or updates, about how long that takes, what changes in vars.yml and which checks failed; y then deploys and anything else steps back. The page now scrolls as a whole with ↑↓.
    • Review's checks show up as each stage finishes, with the stage running and for how long. c stops them and keeps what was found.
    • Choices show which one is picked with ◉ and ○, not only by colour.
    • Confirmations look and work the same everywhere: an amber box, y or enter to go ahead, esc to cancel. Deleting a room can't be undone, so it now asks for the word delete to be typed.
    • One name per place: the menu's Updates is now "What's new", Tokens "Sign-up tokens", Rollback "Roll back", and Maintenance's Disk "Disk space", as the Manage actions call them.
    • Shorter messages: paths in your home folder are written ~/…, the start-fresh line fits on the screen, and the common errors say first what to do, e.g. "run a full install first: …" or "start Synapse under Maintenance › Services: …".

    Update with interzone self-update or Manage › Update interzone.

    Downloads
  • v0.5.27 cd5ddf6f81

    v0.5.27 Stable

    vvvomit released this 2026-10-29 06:19:06 +03:30 | 90 commits to main since this release

    Matrix room alerts can be chosen; Review no longer crashes

    Fixed

    • Alerts › Matrix room can be chosen. v0.5.26 announced alerts in a Matrix room, but the Alerts screen only offered plain text and JSON. Now "Matrix room" is the third message format, and choosing it asks for the homeserver, the room and the alerts account's access token.
    • Review no longer crashes when you scroll with ↑↓ while the window is too short to show the vars.yml preview, and then make the window taller.
    • z on Review shows the DNS records in a short window. It used to put them in the hidden preview, so it seemed to do nothing. Now the checks are cut short to make room, with a note that a taller window shows the rest.

    Update with interzone self-update or Manage › Update interzone.

    Downloads
  • v0.5.26 94d5ac8d8c

    v0.5.26 Stable

    vvvomit released this 2026-10-29 05:54:33 +03:30 | 92 commits to main since this release

    Alerts, rooms, a server tester, and locks that keep a running server safe

    New

    • Alerts. The server checks itself on a timer, even when your computer is off. It looks for failed services, the homeserver not answering, a certificate expiring within 14 days, a disk over 90% full and a mirror not answering. It sends one message when something breaks and one when it's fixed. Messages go to an ntfy topic, to a webhook (Hookshot, Slack, Discord, Mattermost), or into a Matrix room as formatted messages: a coloured headline and a list. Once a day it also sends the playbook's new changelog entries, marking with ★ the ones about your homeserver or components. Find it under Manage › Alerts.
    • Test any Matrix server. A new Test section in the menu takes one or more server names, user IDs or URLs and checks each from this computer, as other servers and apps would:
      • where federation goes (well-known, SRV records or port 8448), the signing keys, and which software and version answer;
      • the client well-known and its CORS header, the client API, the ways to log in and the support file;
      • what Element X needs: sliding sync, OAuth 2.0 logins and a call server.
    • Rooms (Synapse): every room on the server, biggest first. Block or unblock one, delete one for everyone here, or delete its history older than a number of days.
    • Add many users at once from a CSV file with lines of the form username[,password][,admin]. Missing passwords are generated, and all of them are saved next to the file as …-passwords.csv, readable only by you.
    • The Dashboard shows 30 days of history: load, memory and disk as small graphs, and roughly when the disk will be full at the current rate.
    • Review checks more before deploying:
      • the memory and disk your choice of components needs;
      • the ports a firewall must let in, and whether each one gets through from outside;
      • federation, the way a federation tester does;
      • the server as apps see it.
    • DNS records as zone-file lines, to paste into your DNS provider: z on Review, or interzone dns.
    • Updates: see the playbook's new changelog entries first, yours on top, and d does a dry run that shows what an update would change on the server before it does.
    • Federate with only some servers, or with all but some, on the Server step.
    • Maintenance › Disk: see what uses the disk, prune Docker, and set how long media cached from other servers is kept.
    • Plain mode for screen readers and logs: -plain or INTERZONE_PLAIN=1. It gives you no colours, ASCII boxes and bars, and no animation.
    • Start fresh: R on the Servers screen, or --reset, makes interzone forget every server and opens the wizard. Nothing is deleted: its config and data folders are moved aside as *.old-DATE.

    Changed

    • Choices a running server can't survive are locked. After installing or importing a server, its domain, its homeserver and (on Synapse) whether it uses MAS can't be changed in the setup, and deploys refuse to change them. Each lock says why, and what to do instead.
    • --reset used to show empty answers for the active server only. It now resets everything, as Start fresh does.

    Update with interzone self-update or Manage › Update interzone.

    Downloads
  • v0.5.25 c6930b12df

    v0.5.25 Stable

    vvvomit released this 2026-10-27 22:25:17 +03:30 | 112 commits to main since this release

    Blackout mode picks its mirrors; Maintenance from the playbook's docs

    New

    • Blackout mode picks working mirrors by itself. Choosing blackout on the Server step points every download at the in-country defaults. Before deploying, interzone checks them against the server and swaps in another known mirror where one falls short: PyPI before installing Ansible, the container registry against every image your services use, and the OS and Docker package mirrors against the server's distro and release. Each switch is logged and saved.
    • Maintenance (Manage's menu), one tab per task from the playbook's docs:
      • Services: start, stop or reinstall every service or one group. Reinstalling everything also removes components you've turned off, which a normal update leaves installed.
      • Vacuum the database with any of the five presets.
      • Upgrade Postgres to its newest major version, keeping the old data.
      • Compress Synapse's state.
      • Tags: run any playbook tags with extra vars.
      • Uninstall everything, after typing the domain.
    • Database shell: Manage opens psql on the server right in the terminal.

    Update with interzone self-update or Manage › Update interzone.

    Downloads