-
Notifications
You must be signed in to change notification settings - Fork 76
/
Copy pathCHANGELOG.txt
9397 lines (7632 loc) · 423 KB
/
CHANGELOG.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
###
### Stable BOA-5.6.0-pro - Full Edition
### Date: Tue Dec 31 06:12:44 AM AEDT 2024 in Sydney
### Happy New Year!
###
@=> New BOA-5.6.0 PRO Release – Happy New Year!
We're thrilled to introduce BOA-5.6.0 PRO, our latest release and the fourth
under our new branch structure and dual licensing model.
This PRO release brings the project fully in sync with the DEV branch,
which has been actively developed over the past two months, incorporating
over 750 commits since BOA-5.5.0.
We extend our heartfelt thanks to all of you who support our work
by purchasing a BOA Pro license: https://omega8.cc/boapro.
As always, this announcement covers only the most impactful new features,
critical fixes, and enhancements. For a comprehensive list of all updates,
please refer to the full commit history.
@=> New Features
* Active Sites Databases Backups are available in ~/static/files/dbackup/
* Add experimental support for Cloudflare R2 Object Storage
* Add mergecsf tool to join and de-duplicate legacy csf configuration
* Add perftest tool to test hardware performance within VM
* Add php-cli access for [grp:ltd-shell-more]
* Add smtpgapps tool to install and configure msmtp on Devuan
* Add support for all AWS S3 regions, including dual-stack endpoints
* Add support for php-rebuild or php-reinstall on barracuda upgrade
* Add support for separate /root/.deny.solr7.cnf and /root/.deny.jetty9.cnf
* Add verifyvhostsdns tool to check all vhosts for aliases with invalid DNS
* New Relic Integration for Drupal with Drush Compatibility (8, 12, 13)
* PHP 8.4 is fully supported and installed by default
* Remote System Backups use `global`, `data` and optional `custom` buckets
* Completely New Backups! There is too much to cover, so please refer to
our extensive new documentation pages for all details.
This new feature is exclusive to BOA PRO and will not be ported to LTS.
New PRO Backups for BOA SysAdmin:
https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_ROOT.md
New PRO Backups for Octopus Lshell User:
https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_USER.md
New PRO Backups Retention Policy Configuration:
https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_RETENTION.md
New PRO Backups Supported Regions and Bucket Creation Guidelines:
https://github.com/omega8cc/boa/tree/5.x-pro/docs/BACKUP_REGIONS.md
@=> Improvements
* Add _backup_waiting_notify to make admin aware of the backup status
* Add _csf_lfd_gateway_allow()
* Add _linode_vm_postinstall()
* Add _turn_off_apparmor unless /root/.keep_apparmor_on.cnf
* Add /etc/cron.hourly/systemtime
* Add auto-restore of backup_schedule
* Add boa info to all backup reports
* Add cleanup for /var/lib/redis/ on OOM incident
* Add d7security_client-7.x-1.3 to o_contrib_seven and Hostmaster
* Add early aa-teardown on init to make sure that AppArmor is turned off
* Add function to auto-repair incomplete backup sets
* Add local Aegir Third Party Libraries
* Add more checks to make sure that OpenSSL is fully up to date
* Add support for /root/.turn.off.auto.update.cnf
* Add support for cloudflare-dns-ssl-py.info and cloudflare-dns-ssl-sh.info
* Add wkhtmltox_0.12.6.1-3 for Daedalus
* Aegir Hostmaster: Log wget cron runs
* Aegir Provision: Install local Drush automatically on platform verify and unlock
* Always run dist-upgrade twice -- helps with slow access to Devuan servers
* Configure backups --concurrency dynamically
* Disable _if_start_screen with noscreen in the args
* Disable backup_schedule on systems with too low free RAM
* Do not install CSF until BOA installation is complete on Linode
* Do not install csf/lfd on Linode early
* Do not reinstall Duplicity unless /root/.force.duplicity.reinstall.cnf exists
* Drupal 7 now supports and expects Trusted Host Patterns
* Improve all wget/curl downloads with proper re-try logic
* Improve and simplify _switch_php()
* Improve sysctl.conf template
* Improve tools/le/hooks/cloudflare logic
* Install or upgrade csf/lfd monitoring early
* Install wkhtmltopdf from packages first to get all dependencies
* Integrate original _SKYNET_MODE docs/history
* More fixes in the vdrush wrapper to support Drush 13
* Move /data/disk/arch to global and /home to data backups
* Move certain log scanners from the slow minute.sh to fast second.sh loop
* Replace direct exec with _forward_to_shell in shell wrapper
* Report also on newrelic-daemon and monagent versions in boa info
* Run guest-water.sh right after CSF install or upgrade
* Run orphaned duplicity processes cleanup separately
* Sync _sql_busy_detection with max_connect_errors
* Sync barracuda.cnf templates and docs
* Sync sshd restart procedure across all scripts
* Update barracuda config with missing vars if any
* Update email template to remove confusing legacy details
* Update xboa email templates
* Use include/exclude instead of exclude/include logic
* Use just one graceful csf restart on upgrade
* Use newer, supported --copy-links option in Duplicity
* Use noscreen in non-interactive scripts launched by parent scripts or cron
* Waiting 8 minutes before attempting to run enforced post-install upgrade
@=> Changes
* Add docs/IPv6.md to explain why BOA disables IPv6 by default
* Disable confusing hosting_client_send_welcome with non-working login link
* Disable memory swap when running duplicity
* Disable no longer supported GSSAPIAuthentication in SSH config
* Disable performance_schema for Percona 5.7 but enable for 8.0+
* Disable ssl_stapling and fix http2 directive
* Do not auto-re-enable swap
* Enforce Composer 2.8.2 (because 2.8.3+ breaks previously working builds)
* Force sysctl.conf.mod-disable-ipv6
* Introducing the New BOA Branching Scheme -- see docs/BRANCHES.md
* Move /bin/websh to /opt/local/bin/websh
* Newest Python should be installed only with barracuda or backup tools
* Remove hosting_cron_use_backend.txt support
* Remove no longer supported legacy _SCOUT_KEY
* Remove no longer supported legacy HHVM
* Set SOLR WAIT to 8s to speed up reboot and services restarts
* The oldest NewRelic supported PHP version is 7.2
* Update and Sync nice/renice logic for scripts and services
* Update boa-mirrors-2024-12.txt
* Updates for lshell.conf template
* Use gzip to compress classic myslqdump backups
* Use zero tolerance mode for SSH/FTP failed login attempts
* Use zstd to compress mydumper sql backups
* We have now doubled the disk space in all our hosted plans
@=> Upgrades
* Composer 2.8.2
* cURL 8.11.1
* Drupal 7.103.1
* Drush 8.5.0.1
* Duplicity 3.0.3.2
* ionCube 14.0.0 (up to PHP 8.3)
* New Relic 11.4.0.17
* Nginx 1.27.3
* OpenSSL 3.4.0
* PHP 8.1.31
* PHP 8.2.27
* PHP 8.3.15
* PHP 8.4.2
* PHP APCu 5.1.24
* PHP MCRYPT 1.0.7
* Unbound 1.22.0
* Use phpredis 4.3.0 with PHP 5.6
* Use phpredis 6.1.0 for 7.4 and newer
@=> Important Fixes
* Aegir Hostmaster: Improve hosting_cron_queue reliability
* Aegir Hostmaster: Unset variables at the end of the loop
* Aegir Provision: Add backup mode ctrl file cleanup on clone and migrate
* Aegir Provision: Add more supported compression variants
* Aegir Provision: Do not confuse PDO and MySQLi conventions
* Aegir Provision: Fix Drush 13 support by invoking vendor/drush/drush/drush.php
* Aegir Provision: Follow symlinks to include all files in custom backup task only
* Aegir Provision: Improve function revoke()
* Aegir Provision: Prioritize '.tar.zst' as provision_backup_suffix
* Aegir Provision: Use supported localhost in can_grant_privileges()
* Allow _php_if_versions_cleanup_cnf if Master Aegir was not upgraded yet
* Barracuda downgrade protection should not rely on key/barracuda_key.txt
* Constant E_STRICT is deprecated in PHP 8.4
* Disable shell wrapper on system stop/start early
* Double check if /etc/init.d/nginx is really updated
* Excessive email notifications due to DHCP error checks #1829
* Final fixes in shell wrapper make it rock solid again
* Fix and sync all apt options
* Fix autoinit conflicting functions
* Fix for --enable-redis-lzf also in _php_extensions_update()
* Fix for counting symlinked files in resources usage monitoring
* Fix for duplicate http2 in all vhosts on upgrade
* Fix for platforms deployed using Manage with Git method
* Fix for SFTP chroot by using external mode in Subsystem sftp
* Fix the bug in the shell wrapper when composer is both a command and argument
* Fix the logic for Devuan base-files update for Daedalus
* Fix the logic in _ifnames_grub_check_sync()
* Improve the http2/ssl_stapling logic
* Legacy MCRYPT can’t be used with PHP 8.4
* Make sure that both web and app root dirs are group writable
* Make sure we add keys in a new line in xboa
* More capabilities to satisfy complex composer tasks
* Octopus downgrade protection should not rely on tools/key/octopus_key.txt
* Patch hosting_cron.module automatically to make web cron 100% reliable
* Remove duplicate ssl directives in all vhosts templates
* Sync include/openssl extended check for latest version
* Sync max allowed PHP-FPM versions running (11)
* Sync maxBooleanClauses for new Solr cores to 4096
* Sync PHP 8.3 precedence -- it's still default version
* Use dash by default and limit the use of _forward_to_shell
###
### Stable BOA-5.5.0-pro - Full Edition
### Date: Sat 26 Oct 2024 09:49:51 AM PDT in Santa Clara
###
@=> New BOA-5.5.0 PRO Release – Thank You for Your Support!
We're thrilled to introduce BOA-5.5.0 PRO, our latest release and the third
under our new branch structure and dual licensing model.
This PRO release brings the project fully in sync with the DEV branch,
which has been actively developed over the past several months, incorporating
nearly 400 commits since BOA-5.4.0.
BOA-5.5.0 PRO also comes equipped with 26 Aegir-ready platforms, supporting
either Drupal core alone or various popular Drupal distributions—seven of
which are new! These platforms include options like Commerce, DXPR Marketing,
EzContent, farmOS, LocalGov, OpenCulturas, OpenFed, OpenLucius, Opigno LMS,
Sector, Social, Thunder, Ubercart, and Varbase.
We extend our heartfelt thanks to all of you who support our work
by purchasing a BOA Pro license: https://omega8.cc/boapro.
As always, this announcement covers only the most impactful new features,
critical fixes, and enhancements. For a comprehensive list of all updates,
please refer to the full commit history.
@=> New Features
* Added codebasecheck tool for codebase compatibility check with Percona 8.0
* Added Drush 13 support by invoking vendor/drush/drush/drush.php directly
* Added dedicated memorytuner (for testing for now)
* Added mysqltuner5 and mysqltuner8
* Added bash version scan_nginx.sh -- the Nginx DoS Guard
* Added support for more granular load limits like 1.2 2.5 3.
* Added support for non-standard /hdd mount point
* Added support for /mnt/ paths in Drush
* Added sqlclean and vhostcheck tools for root
* SQL Adminer access moved to Octopus Aegir HTTPS vhost URL at /sqladmin
* Added incident_email_report() feature to all monitor/check/ scripts
* Allow SSH based access authorization to SQL Adminer at new /sqladmin/ URL
* Added incident detection and email reporting for LE certs renewal failures
* Added screen auto-start in boa, barracuda and octopus
* Added support for Percona 8.4 LTS (for testing only, you should use 8.0)
* Added support for Percona 8.3 (for testing only, you should use 8.0)
* Added support for Percona 8.0 (production ready)
@=> Improvements
* Added _redis_cold_restart to mysql restart in the monitor/check/ scripts
* Rewrite the code used to install many new Drupal distros in Octopus
* Added Troubleshooting Docs in docs/FIXME.md (more entries soon)
* Faster _sql_busy_detection() in the monitor/check/ scripts
* Added _mysql_downgrade_protection() to avoid downgrade from Percona 8.0
* Many improvements in the Nginx DoS Guard in the monitor/check/ scripts
* Do not use fast firewall block unless /root/.instant.csf.block.cnf
* Pause some new monitors sub-tasks during BOA upgrades and backups
* Use underscore as prefix for all functions and camelCase vars
* Block only relevant ports using the monitor/check/ scripts
* Added docs on _NGINX_DOS_ variables
* Added doc on PHP versions management — fixes #1807
* Added separate docs/PHP-FPM.md and docs/DRUSH-CLI.md
* Added docs on Importance of Keeping SKYNET Enabled in BOA
* Added _CPU_TASK_RATIO to the CPU logic in auto-healing scripts
* Display currently used GRUB config in boa info
* Make the not_supported_virt() BOLD ENOUGH in boa info
* Added WARNING if /root/.allow.any.virt.cnf exists in boa info
* Display _DSK Usage for relevant partitions only in boa info
* Improved _XSY System Uptime/Load/Kernel/Disk/Memory Report in boa info
* Added Lshell version to boa info
* Always attach basic boa info report to barracuda upgrade log/email
* Improve check_php_rebuild() and add separate check_php_ssl_version()
* Explained _INCIDENT_EMAIL_REPORT variable
* Explained _SQL_MAX_TTL variable
* Explained _SQL_LOW_MAX_TTL variable
* Split big minute.sh into smaller auto-healing scripts
* Added procedure to fix empty or missing .dhp files
* Improved /root/.dont.use.fancy.bash.login.cnf logic
* Improved the octopus upgrade email tpl
* Added Key Services Uptime Report to boa info
* Pretty large defunct code cleanup
@=> Changes
* Install python3-full packages
* Duplicity: Remove Python 2 support and require OpenSSL 3
* Remove restrictions for opcache_compile_file (Grav CMS support)
* Removed legacy manage_ip_auth_access() for SQL Adminer access
* PHP 8.3 is the new default version
* Prefer system default Python3 for Lshell and src build for Duplicity
* Always run ifnames_grub_check_sync in DEMO mode unless ctrl file exists
* Remove chrony if preinstalled
* PHP 8.1 is the max version supported on Stretch and Jessie
* New Relic removed support for legacy PHP 7.0 and 7.1
* Run _update_boa_tools only when new serial or pid key is detected
* Redis extension 8.x-1.8.2 (with not needed db schema update reverted)
* Disabled backboa install in auto mode
* Allow all 7.x PHP versions on legacy (Debian) systems
* Amazon EC2 No Longer Supported (system crashes, doesn't support Devuan)
* Use legacy PHP 7.x by default on legacy Debian systems
@=> Upgrades
* Lshell 0.10
* Composer 2.8.1
* Unbound 1.21.1
* OpenSSL 3.3.2
* PHP 8.3.13
* PHP 8.2.25
* PHP 8.1.30
* OpenSSH 9.9p1
* Python 3.12.5 (for Duplicity)
* cURL 8.10.1
* Nginx 1.27.2
* ionCube 13.3.1 (also for PHP 8.3)
* MyQuick 0.16.7-3
* CSF 14.21
* Duplicity 3.0.2
@=> Important Fixes
* Fix PATH in the websh wrapper (fixes git and OpenSSL issues)
* Fix for _PHP_FPM_TIMEOUT logic
* Remove apt-listchanges on Debian (for legacy systems with broken debconf)
* Improve _if_fix_python() procedure logic
* Fix the logic for _update_boa_tools on init
* Do not remove usage.sh — fixes #1824
* Add cleanup for exclude.tag (could result with no files on clone)
* Do not restart sshd every minute
* Do not reload nginx every few minutes by default
* cURL version upgrade should happen only with barracuda upgrade
* Fix for too broad cleanup in /var/xdrago/log/
* Ignore all dynamic requests related to css/js while they are generated
* Do not log redirects (Nginx)
* Inconsistent checks for SSL version in check_php_rebuild — fixes #1815
* Use _CURL_VRN=7.50.1 for Wheezy compatibility
* Use separate log for mysql notices — fixes #1805
* Add built-in /run/unbound setup — fixes #1804
* Percona 5.7 still depends on legacy packages naming — fixes #1808
* Compatibility with legacy Python 3.5
@=> Drupal platforms available for installation -- docs/PLATFORMS.md
* Commerce Kickstart 2.77 (7.101.1)
* Commerce Base 2.40 (10.1.8)
* Commerce Kickstart 3.0.0 (10.3.6)
* DXPR Marketing 10.3.0 (10.3.6)
* EzContent 2.2.15 (10.3.6)
* farmOS 3.3.1 (10.3.6)
* LocalGov 3.0.11 (10.3.6)
* OpenCulturas 2.2.1 (10.3.6)
* OpenFed 12.2.4 (10.2.10)
* OpenLucius 2.0.0 (9.5.11)
* Opigno LMS 3.1.0 (9.5.11)
* Sector 10.0.0-rc5 (10.2.10)
* Social 12.4.5 (10.2.10)
* Thunder 7.3.7 (10.3.6)
* Ubercart 2.15 (6.60.1)
* Ubercart 3.13 (7.101.1)
* Varbase 9.1.6 (10.3.6)
* Varbase 10.0.2 (10.3.6)
* Pressflow 6.60.1 (core only)
* Drupal 7.101.1 (core only)
* Drupal 9.5.11 (core only)
* Drupal 10.0.11 (core only)
* Drupal 10.1.8 (core only)
* Drupal 10.2.10 (core only)
* Drupal 10.3.6 (core only)
* Drupal 10.4.x-dev (core only)
###
### Stable BOA-5.4.0-pro - Full Edition
### Date: Wed 14 Aug 2024 06:24:03 AM AEST in Sydney
###
@=> New BOA PRO Release & Comparison with LTS and DEV Branches
We are excited to announce the release of BOA-5.4.0 PRO and BOA-5.4.0 LTS,
marking the second release under our new branch structure and dual licensing
model, which began with BOA-5.2.0.
These new PRO and LTS versions bring the project fully up to date with the
DEV branch, which has been actively developed over the past several months.
As always, this announcement highlights only the most significant new features,
critical fixes, and improvements. For a detailed list of all changes,
please refer to the commit history.
@=> New Features
* Simplify and speed up BOA install/upgrades -- please check all details in
the updated and greatly improved documentation:
docs/INSTALL.md
docs/UPGRADE.md
docs/SELFUPGRADE.md
docs/MAJORUPGRADE.md
* AppArmor BOA integration for more strict system protection (needs docs)
* Barracuda install without Octopus is now possible -- docs/INSTALL.md
* Enable instant php-cli version switch for Aegir backend -- docs/DRUSH.md
* Improve Ruby Gems and Node/NPM security and speed x3 -- docs/GEM.md
* Let's Encrypt for Aegir Hostmaster installed automatically -- docs/SSL.md
* Let's Encrypt Live Mode is enabled by default -- docs/SSL.md
* Add three manual backup modes in Aegir (incomplete feature at the moment)
* New Relic support with Octopus/Platform/Site Config -- docs/NEWRELIC.md
* Restore _AEGIR_UPGRADE_ONLY {aegir} as supported barracuda upgrade mode
* Restore {aegir|platforms|both} as supported octopus upgrade modes
* Security Considerations for Multi-Ægir Systems -- docs/SECURITY.md
* Use /root/.deny.clamav.cnf to auto-disable clamav if installed
* Use /root/.deny.java.cnf to auto-disable Solr and Jetty if not used
* Drush 12 in Aegir Tasks: Dynamically Utilize Site-Local Drush for
the updatedb Operations on Drupal 10+ (needs docs).
For now here is a brief explanation on how it works:
# Both Migrate and Clone tasks in Aegir by default run the updatedb
with Aegir own Drush 8 in the final deploy internal procedure.
# This may cause unexpected issues in Drupal 10 and newer versions, so
we have added a switch which allows you to tell Aegir to skip running
`updatedb` on Drupal 10+ -- either globally with empty control file
~/static/control/DisAutoUpDb.info or per site with empty control file
~/static/control/sitename_DisAutoUpDb.info where `sitename` is the site
main domain name used in its Drush alias. You could then unlock the
Site-Local Drush and run it manually with `vdrush` in the platform
app root (not web root) to better control what happens on `updatedb`
using command: `vdrush @site-alias updatedb`
# Automatic mode does it even better for Drupal 10+ Here's how it works,
given no control file listed above exists:
1. Platform Verify task locks Site-Local Drush and patches Drupal core.
2. If the site is migrated to different platform or cloned to different
platform, Aegir will check if **both old and new** platforms have
the Site-Local Drush in their codebases.
3. If Site-Local Drush is detected in both platforms Aegir will unlock
Drush in both platforms, will also revert the Drupal core patch it
normally needs to use its own Drush 8.
4. Now Aegir will run the Site-Local Drush for `updatedb` command and
will report all details in the task log in the admin interface.
5. Once the `updatedb` is complete, Aegir will automatically apply
the Drupal core patch again and will lock Site-Local Drush, so you
could run any other tasks in the control panel as usual. Magic!
@=> Drupal platforms available for installation -- docs/PLATFORMS.md
* Drupal 10.4.x-dev
* Drupal 10.3.1
* Drupal 10.2.7
* Drupal 10.1.8
* Drupal 10.0.11
* Social 12.4.2 (10.2.6)
* Thunder 7.3.0 (10.3.1)
* Varbase 10.0.0 (10.3.1)
* Varbase 9.1.3 (10.2.6)
* Drupal 9.5.11
* OpenLucius 2.0.0 (9.5.11)
* Opigno LMS 3.1.0 (9.5.11)
* Commerce 1.72
* Commerce 2.77
* Drupal 7.101.1
* Ubercart 3.13
* Pressflow 6.60.1
* Ubercart 2.15
@=> Improvements
* Add better protection from duplicate sql tasks
* Improve Aegir tasks messages to identify new improvements in the backend
* Update Drush 10+ aliases on the fly within Aegir deploy procedure
* Add BOA Roadmap & Progress Update in ROADMAP.md
* Add bring_all_ram_cpu_online
* Add CSF self-update debugging log in /var/backups/csf/water/
* Add Dual License and BOA Branches Explained in DUALLICENSE.md
* Add INI (platform level) docs in docs/ini/platform/INI.md
* Add INI (site level) docs in docs/ini/site/INI.md
* Add killer script for hanging apt-get update
* Add support for /root/.force.queue.runner.cnf
* Add switch_to_bash_in_octopus
* Detect and remove stale pid faster
* Display also system-manufacturer in the welcome messages and reports
* Do not lower proc nice on init and major OS upgrades
* Do not restart slow starting services during major OS upgrade
* Execute post-install octopus auto-upgrade on boa and octopus install
* Explain how upgrades affect BOA special shell wrapper
* Improve and simplify is_logged_in early check in global.inc
* Improve rsyslog to use separate log files for cron, mail, lfd, iptables
* Limit noise printed in the console
* Protect csf.allow from removing custom entries
* Rewrite and improve all BOA project docs to use Markdown
* Rewrite and improve the main README.md
* Simplify upgrade docs
* Turn Off AppArmor while running octopus
* Update tests for Amazon EC2 environment detection
* Use `drush11 aliases` or `drush11 sa` for Drupal 8+ core and PHP 8.2+
* Use new `fancynow` welcome screen only for interactive root sessions
* Nginx: Sync js/css aggregation support
* Nginx: Sync static files regex
@=> Changes and Upgrades
* Add compatibility with Redis 8.x-1.7.1
* Add igbinary support to PHP 5.6
* Add recommended security and privacy HTTP headers in Nginx config
* Add required now $settings['state_cache'] = TRUE; in global.inc
* Adjust patches and PHP versions
* AdvAgg is no longer added to D8+ o_contrib
* Barracuda upgrade after boa install is now automated
* Build OpenSSH from sources by default
* cURL 8.9.1
* Disable man-db/auto-update to speed up also autoinit and boa install
* Duplicity 3.0.0
* Force mysql root password update on barracuda upgrade
* Git 2.45.2
* Image Optimize toolkit binaries are now included by default
* Install Python 3.12.4 for Duplicity
* ionCube 13.0.4
* Launch daily.sh automatically after barracuda upgrade
* Lshell 0.9.18.10
* MySecureShell master-29-06-2024
* New Relic 11.0.0.13
* New Relic no longer supports PHP 5.6
* Nginx 1.27.0
* Nginx: http2 is now a separate directive
* OpenSSL 3.0.14 LTS
* Re-enable cleanup for GHOST distros revisions
* Remove /etc/apt/preferences
* Remove cloud-utils if detected
* Remove legacy i386/x32 support
* Remove no longer supported MariaDB code
* Remove not used mysql_hourly.sh
* Removing old boa-init no longer needed after introducing fast autoinit
* Removing systemd cleanup from boa, now handled by the fast autoinit
* Replace mail with s-nail
* Replace pdnsd with unbound
* Restrict also find/scp to prevent lshell escape
* Upgrade to openjdk 11.0.24
* Use /etc/ssh for OpenSSH built from sources (no new server keys, finally)
* Use maximum compatible PhpRedis versions for legacy PHP
* Use PermitRootLogin prohibit-password
* We no longer allow to install BOA on Debian to avoid confusion
* We no longer override server sshd keys to avoid confusion
* Nginx: Remove the legacy X-XSS-Protection header
* Nginx: block bytedance and PetalBot aggressive crawlers
@=> Important Fixes
* Add python3.5 compatibility for Stretch
* Add second cron entry for critically important /var/xdrago/clear.sh
* Add support for legacy python3.4
* Always copy hostmaster LE cert to /etc/ssl/private/ if just updated
* Avoid any AppArmor code on legacy Debian systems
* Bash 5.2 compatibility
* Detect broken GIT early and reinstall from sources
* Do not install PHP 8.2 8.3 with _OPENSSL_EOL_VRN and _OPENSSL_LEGACY_VRN
* Do not use --with-http_v3_module for Nginx on legacy systems
* Do not use --with-imap for PHP on Jessie
* Do not use --with-imap for PHP on major upgrade on any OS
* Do not use --with-sodium for PHP on Jessie
* Fix confusing ICU logic
* Fix for ignored nofile limits
* Fix for iptables paths backward compatibility
* Fix for non-blocking ntpdate
* Fix New Relic APT config
* Fix Percona apt config logic
* Fix platforms symlinking in the limited shell account
* Fix Pure-FTPD install and config
* Force crontab update on major OS upgrade
* Improve resolvconf auto-config
* Let's Encrypt actually supports wildcard names already
* Make sure that _PHP_SINGLE_INSTALL exists before disabling other versions
* Modernize Percona keys logic
* Nginx: Sync http2 in legacy tpl
* Remove blocking cnf file if php-max is used
* Show PHP patch results on _DEBUG_MODE=YES
* Sync for python3.11
* Sync PHP extensions existence check directly, not just via ctrl files
* Sync PhpRedis build options with versions compatibility
* Sync with python3.9
* Update wkhtmltopdf versions logic
* Use cURL 7.71.1 on Jessie
* Use cURL 8.2.1 on Stretch
* Use OpenSSH 8.3p1 on Jessie
* Use OpenSSH 9.3p1 on Stretch
* Use OpenSSL 1.0.2u on Jessie
* Use OpenSSL 1.1.1w on Stretch
* Fix for composer.json and composer.lock protection
###
### Stable BOA-5.3.0-pro - Full Edition
### Date: Mon 12 Aug 2024 05:33:46 AM AEST in Sydney
###
@=> New BOA LTS Release & Comparison with PRO and DEV Branches
We are excited to announce the release of the latest BOA LTS version,
marking the first LTS release since the introduction of our new branch
structure and dual licensing model, which began with the BOA-5.2.0 release.
This LTS version brings the project up to date with BOA-5.3.0-pro, which
has been available for several months. Both BOA-5.3.0-pro and BOA-5.3.0-lts
are officially released today.
Looking ahead, BOA-5.4.0-pro will be released within the next 48 hours,
incorporating all recent developments from the DEV branch.
Please note that the project README and documentation displayed on GitHub
by default apply primarily to the BOA DEV branch, and shortly to BOA PRO.
These do not cover BOA LTS. If you are working with the LTS version, ensure
you switch to the appropriate branch to access legacy documentation
relevant to BOA LTS.
As always, we highlight only the most critical fixes and improvements in
this announcement. For a comprehensive list of changes, please refer to
the commit history.
@=> New Features
* PHP 8.3 Support
* Update sFTP password and password expiration date with temporary pid file
~/static/control/run-sftp-password-update.pid
Now the main Octopus limited shell user can easily self-update password
based access if still has working SSH keys but lost working password.
New password will be written to ~/static/control/new-USER-password.txt
* Add boa cleanup {detect|purge} {user|batch} to automate Octopus instances
cleanup. Requires existence of /data/disk/USER/log/CANCELLED file and
no vhosts existing in /data/disk/USER/config/server_master/nginx/vhost.d/
It will archive only config files and delete everything else, but will not
delete any databases nor db users (yet).
@=> Improvements
* Add ltd-shell account client access to moved sites files in static/files
* Always install legacy OpenSSL first and force new on upgrade
* Disable man-db/auto-update to speed up barracuda upgrades
* MySQL: Disable performance_schema by default
* MySQL: Do not run mysql_cleanup.sh on servers with >100 dbs
* Nginx DoS-Guard: Add ignore_admin to protect site admin activity
* Nginx DoS-Guard: Catch typical hack probe requests early
* Nginx DoS-Guard: Detect and block ‘unknown’ IPs requests
* Nginx DoS-Guard: Track and block 500/403/404 flood
* Prepare for but do not enable http3/quic yet
* Use cold solr7 restart only on barracuda upgrade
@=> Changes and Upgrades
* Build PHP --with-bz2
* Build Redis with --enable-redis-lzf --enable-redis-igbinary
* Composer 2.7.7
* cURL 8.7.1
* Drupal 7.101.1
* Enable ClassicTrack for Aegir tasks by default
* ionCube 13.0.2
* Nginx 1.26.0
* OpenSSH 9.8p1
* OpenSSL LTS with 3.0.13 (new default version)
* PHP 8.1.29
* PHP 8.2.22
* PHP 8.3.10
* PHP APCu 5.1.23
* PHP igbinary 3.2.15
* PHP imagick 3.7.0
* Ruby 3.3.4
* Use _USE_FPM=1024 as minimum
* Use phpredis 6.0.2 for 7.2 and newer
@=> Important Fixes
* Add clamd/freshclam to auto-healing
* Add cleanup for ctrl files blocking PHP upgrade
* Always check if all /var/xdrago/* scripts are present or force update
* Always install openjdk-11-jre-headless
* Fix for vdrush @site updb in Drush 12
* Fix protection from duplicate sql backups
* Legacy PHP versions require legacy OpenSSL version
* More protection from race conditions in auto-healing
* Remove old auto-healing pids if detected
* Restore ULIMIT in nginx init.d
* Sync autoupboa cron to not collide with sql backups
* The adduser no longer automates —home
* Use only php-fpm reload instead of start on upgrade
* Use PHP 7.4 in run_drush8_cmd if available
###
### Stable BOA-5.2.0 - Full Edition
### Date: Wed 03 Apr 2024 02:11:56 PM CEST in Warsaw
###
@=> Notes on new available BOA branches and licenses
BOA is available in three main branches, but only LTS for installation:
* LTS which remains completely free to use without any kind of license
as it was from the beginning (previously named HEAD or STABLE).
This branch should be considered as BOA LTS with slow updates, focused
on both security and bug fixes, but very limited new features additions.
* DEV which requires paid license for both install and upgrade and includes
the latest features, security and bug fixes and installed services versions.
This branch shouldn't be used in production without extensive testing.
* PRO which requires paid license and is available only as an upgrade
from either LTS or DEV (or previous HEAD/STABLE) is the branch with regular
monthly or bi-monthly releases, closely following tested DEV branch.
Once you install BOA LTS and want to upgrade to PRO with license obtained
from https://omega8.cc/licenses you will need to use up-pro command.
Once you install BOA LTS or PRO and want to upgrade to DEV with license
from https://omega8.cc/licenses you will need to use up-dev command.
Old commands using in-head, in-stable, up-head and up-stable no longer work
to avoid confusion and have been replaced with in-lts and up-lts in all
installation and upgrade scripts.
Please make sure to read updated docs/INSTALL.txt and docs/UPGRADE.txt
@=> New Features
* Add autodaedalus tool for easy automated major system upgrades
* Add Linux Containers (LXC) guest as supported (tested only by others)
* Add mysql_cleanup running hourly to keep known caches overhead at minimum
* Add OpenVZ Containers guest as supported (tested only by others)
* Add support for ~/static/control/disable_user_register_protection.info
* Add support for du command in limited shell with /root/.allow.du.cnf
* Debian Bookworm and Devuan Daedalus support (needs further testing)
* Full Drupal 10.2 support for install and upgrades from Drupal 9 and 10
@=> Improvements
* Add control/enable-drush-sa.info for native drush sa command
* Add hyperv qemu and kvm aws as supported
* Add ltd-shell alias vdrush:vendor/bin/drush
* Do not enforce newrelic_background_job(FALSE)
* Document BOA planned features in the ROADMAP.txt
* Document Drush usage in docs/DRUSH.txt
* Make it clear that only Devuan Chimaera should be used in production
* New Relic: Separate Web and Drush stats
* Purge firewall deny rules before reboot for faster system restart
* README rewrite and improvements
@=> Changes and Upgrades
* Aegir D10 Platforms: 3x Drupal core 10.0.11
* Aegir D10 Platforms: 3x Drupal core 10.1.8
* Aegir D10 Platforms: 3x Drupal core 10.2.4
* Aegir D10 Platforms: Social 12.2.2 with core 10.2.4
* Aegir D10 Platforms: Thunder 7.2.0 with core 10.2.4
* Aegir D10 Platforms: Varbase 9.1.1 with core 10.2.4
* Disable support for several built-in legacy D7 distros
* Do not enable /root/.fast.cron.cnf by default
* Drush 8.4.12.9
* Nginx 1.24.0
* Nginx: update ssl_ciphers remove 4 weak but leave 2 to support Safari 6-8
* OpenSSH 9.7p1
* OpenSSL LTS with 3.0.13 (prepare, optional)
* PHP 8.1.27
* PHP 8.2.17
* Redis 7.0.15
* Remove legacy Ubuntu support
@=> Important Fixes
* Always revert to iptables-legacy from nf_tables
* Fix for broken cURL self-healing
* Fix for cURL/libcurl version conflict
* Force Nginx cold restart if status is locked
* Improve auto-healing for duplicate move_sql and mysql_backup
* Improve downgrade_protection
* Revert "Sync /etc/security/limits.conf"
* Update Drush yml sites aliases also for Aegir system user
###
### Stable BOA-5.1.0 - Full Edition
### Date: Sat 04 Nov 2023 03:26:41 PM CET in Warsaw
###
### Documenting details in progress...
###
@=> New Features
* Automatically detect and add known web-root dir names on Add New Platform
* Lock Drush in any platform with Aegir task: Verify + Lock Drush
* Manage pid files in platforms web-root for Drush Lock/Unlock status
* Unlock Drush in any platform with new Aegir task: Unlock Local Drush
@=> Improvements
* Document ~/static/control/FastTrack.info in docs/FASTTRACK.txt
* Improve BOA forks compatibility with standalone Aegir paths
* Improve tasks labels in the Aegir control panel
* Use Aegir backend built-in chmod for Unlock Drush w/o external scripts
@=> Changes and Upgrades
* Aegir D10 Platforms: 3x Drupal core 10.1.6
* Aegir D10 Platforms: Social 12.0.0-rc3 with core 10.0.11
* Aegir D10 Platforms: Thunder 7.1.2 with core 10.1.6
* Aegir D10 Platforms: Varbase 9.0.16 with core 10.1.6
* Enable hosting_site_backup_manager Aegir extension by default again
* Fix permissions and ownership on every Platform Verify for Drupal 8/9/10
* OpenSSL 3.1.4
* PHP 8.1.25
* PHP 8.2.12
@=> Important Fixes
* Added missing web-root paths in built-in platforms for Drupal 9/10
* Fix the ability to rename existing platforms in the Aegir control panel
* Multiple fixes for built-in permissions and ownership Aegir scripts
###
### Stable BOA-5.0.0 - Full Edition
### Date: Thu 26 Oct 2023 09:55:22 PM CEST in Warsaw
###
### Documenting details in progress...
###
@=> New Features
* Add support for verbose Drush like 'drush -vvv @site status'
* Aegir in BOA is now fully compatible with PHP 8.1 and 8.2
* Do not purge cache tables listed in /root/.my.cache.exceptions.cnf
* Drupal 10 is fully supported (needs docs)
* Drupal 10 platforms available: Thunder, Varbase, Drupal 10.1 and 10.0
* Make system reboot much faster, also with 'boa reboot' command
* OpenSSL 3.x optional/test support with /root/.install.modern.openssl.cnf
@=> Improvements
* Always install latest Composer on barracuda upgrade
* Enable ~/static/control/FastTrack.info by default (needs docs)
* Minimize services downtime on upgrade using soft reload only if possible
* Site Local Drush is no longer removed on platform Verify (only locked)
* Use 'barracuda php-idle disable' to speed up major upgrades
@=> Changes and Upgrades
* Aegir D10 Platforms: 3x Drupal core 10.0.11
* Aegir D10 Platforms: 3x Drupal core 10.1.5
* Aegir D10 Platforms: Thunder 7.1.2 with core 10.1.5
* Aegir D10 Platforms: Varbase 9.0.16 with core 10.1.5
* Aegir D7 Platforms: Commerce 1.72 with core 7.98.1
* Aegir D7 Platforms: Commerce 2.77 with core 7.98.1
* Aegir D7 Platforms: Guardr 2.57 with core 7.98.1
* Aegir D7 Platforms: OpenOutreach 1.69 with core 7.98.1
* Aegir D7 Platforms: Opigno LMS 1.59 with core 7.98.1
* Aegir D7 Platforms: Panopoly 1.92 with core 7.98.1
* Aegir D7 Platforms: Ubercart 3.13 with core 7.98.1
* Aegir D9 Platforms: 3x Drupal 9.5.11
* Aegir D9 Platforms: OpenLucius 2.0.0 with core 9.5.11
* Aegir D9 Platforms: Opigno LMS 3.1.0 with core 9.5.11
* Aegir D9 Platforms: Social 11.9.14 with core 9.5.11
* BOA requires at least PHP 7.4 or newer as default version
* Change redis_perm_ttl from 6h to 24h
* Do not inlcude advagg/cdn in o_contrib_eight
* Drupal 10: add minimum patch for core
* Drupal 10: disable not working yet welcome email on install
* Drupal 10: fix compatibility and add missing code in Drush 8
* Drupal 10: lock vendor/drush
* Drupal 10: lock vendor/symfony/console/Input
* Drupal 10: replace psr/log in core with Drush 8 version
* Drush Launcher is not supported anymore so removed
* Enable /root/.fast.cron.cnf by default (needs docs)
* Remove confusing -bin suffix from Drush 10+ (needs docs)
* Set _PURGE_BACKUPS default to 14 or 7 on hosted BOA
* Set Composer Install Support in Aegir Backend as disabled by default
* The redis_use_modern is no longer optional in the INI files
* Update vendor code in the Aegir backend / Provision
* Use _STRONG_PASSWORDS=YES by default
* Use _USE_MYSQLTUNER=NO by default
@=> Important Fixes
* Do not enable redis on D7/D6 automatically, it works anyway
* Fast DNS Cache Server (pdnsd) install is no longer optional since 2014 (!)
* Fix for hosting_cron_queue() with ADV_CRON_MAX_PLL logic
* Make sure that expired password will not hang backend task
* Nginx: Add missing no-cache checks from @cache to @drupal
* Nginx: Move exceptions to the /index.php location
* Nginx: The css/js aggregation logic has changed in Drupal 10.1
###
### Cutting Edge BOA-5.0.0-dev - Initial Edition
### Date: Sat 06 May 2023 08:42:31 AM EEST in Kyiv
### Слава Україні!
###
### Documenting details in progress...
###
@=> New Features
* Add 'barracuda php-idle disable/enable' (needs docs)
* Automatic BOA System Major Upgrade Tool -- see docs/UPGRADE.txt
* Debian Bullseye and Buster support
* Devuan Chimaera and Beowulf support (systemd-free Debian alternative)
* Make Composer running with PHP defined in ~/static/control/cli.info
* Make PHP-CLI for Composer and Drush configurable on the fly (needs docs)
* New multi-step BOA install procedure -- see docs/INSTALL.txt
* PHP 8.2 support
@=> Major Improvements
* Barracuda first upgrade after boa install no longer requires reboot
* Use all available CPU cores for much faster PHP, Nginx, OpenSSL etc builds
@=> Important Changes
* BOA requires the classic network interface naming convention (needs docs)
* Disable all nightly codebase cleanup procedures
* Nginx: Add PATCH to allowed $request_method list
* Nginx: Remove deprecated upload_progress support
* Remove AdvAgg and CDN from D9+ o_contrib
* Rewrite the _PHP_MULTI_INSTALL cleanup to make it optional (needs docs)
* Stop running any Drush operations on Drupal 8+ in daily.sh
* Switch to Redis Server 7.x by default
* The php-all should no longer include 7.3 and older versions (needs docs)
* Ubuntu support is deprecated
* Use php-max to install ALL nine (9) PHP versions (needs docs)
@=> Important Fixes
* Discover the system IPv4 once and store in a file
* Fix several issues with ~/static/control/MyQuick.info logic
* Maintain csf.allow/ignore backup on serial update in /var/backups/csf/
* Nginx: Fix protected access to /update.php
* Nginx: Protect composer.json if exists in the Drupal web-root
###
### NEW BOA-4.2.0-stable - Full Edition
### Date: Sat 06 May 2023 07:42:19 AM EEST in Ivano-Frankivsk
### Слава Україні!
###
### Documenting details in progress...
###
@=> New Features
* Add 'barracuda php-idle disable/enable' (needs docs)
* Automatic BOA System Major Upgrade Tool -- see docs/UPGRADE.txt
* Debian Bullseye and Buster support
* Devuan Chimaera and Beowulf support (systemd-free Debian alternative)
* Make Composer running with PHP defined in ~/static/control/cli.info
* Make PHP-CLI for Composer and Drush configurable on the fly (needs docs)
* New multi-step BOA install procedure -- see docs/INSTALL.txt
* PHP 8.2 support
@=> Major Improvements
* Barracuda first upgrade after boa install no longer requires reboot
* Use all available CPU cores for much faster PHP, Nginx, OpenSSL etc builds
@=> Important Changes
* BOA requires the classic network interface naming convention (needs docs)
* Disable all nightly codebase cleanup procedures
* Remove AdvAgg and CDN from D9+ o_contrib
* Rewrite the _PHP_MULTI_INSTALL cleanup to make it optional (needs docs)
* Stop running any Drush operations on Drupal 8+ in daily.sh
* Switch to Redis Server 7.x by default
* The php-all should no longer include 7.3 and older versions (needs docs)
* Ubuntu support is deprecated
* Use php-max to install ALL nine (9) PHP versions (needs docs)
@=> Important Fixes
* Discover the system IPv4 once and store in a file
* Maintain csf.allow/ignore backup on serial update in /var/backups/csf/
###
### Stable BOA-4.1.4-rel - Full Edition
### Date: Fri Dec 10 22:30:49 CET 2021 in Warsaw
###
### Documenting details in progress...
###
@=> New Features
*