Merge pull request #6708 from renovate/ghcr.io-bisq-network-bisq2-api-2.x

2026-09-27 08:01:06 +00:00 · 2026-09-11 17:35:08 +08:00
parent 9272907ddf bb86aaead0
commit 05bb04c366
8 changed files with 154 additions and 73 deletions
@@ -1,51 +1,63 @@
 additionalProperties:
  formFields:
-    - default: 8390
-      edit: true
-      envKey: PANEL_APP_PORT_HTTP
-      labelEn: Local Management Port
-      labelZh: 本地管理端口
-      label:
-        en: Local Management Port
-        zh: 本地管理端口
-        zh-Hant: 本機管理連接埠
-        ja: ローカル管理ポート
-        ko: 로컬 관리 포트
-        ru: Локальный порт управления
-        ms: Port Pengurusan Tempatan
-        pt-br: Porta de Gerenciamento Local
-      required: true
-      rule: paramPort
-      type: number
-    - default: 86400
-      edit: true
-      envKey: PAIRING_TTL_SECONDS
-      labelEn: Pairing Code Lifetime (Seconds)
-      labelZh: 配对码有效期（秒）
-      label:
-        en: Pairing Code Lifetime (Seconds)
-        zh: 配对码有效期（秒）
-        zh-Hant: 配對碼有效期（秒）
-        ja: ペアリングコード有効期間（秒）
-        ko: 페어링 코드 유효 시간(초)
-        ru: Срок действия кода сопряжения (сек.)
-        ms: Tempoh Kod Gandingan (Saat)
-        pt-br: Validade do Codigo de Pareamento (Segundos)
-      required: true
-      type: number
-    - default: ./data
-      edit: true
-      envKey: APP_DATA_DIR
-      labelEn: Data Directory
-      labelZh: 数据目录
-      label:
-        en: Data Directory
-        zh: 数据目录
-        zh-Hant: 資料目錄
-        ja: データディレクトリ
-        ko: 데이터 디렉터리
-        ru: Каталог данных
-        ms: Direktori Data
-        pt-br: Diretorio de Dados
-      required: true
-      type: text
+  - default: 8390
+    edit: true
+    envKey: PANEL_APP_PORT_HTTP
+    labelEn: Local Management Port
+    labelZh: 本地管理端口
+    label:
+      en: Local Management Port
+      zh: 本地管理端口
+      zh-hant: 本機管理連接埠
+      ja: ローカル管理ポート
+      ko: 로컬 관리 포트
+      ru: Локальный порт управления
+      ms: Port Pengurusan Tempatan
+      pt-br: Porta de Gerenciamento Local
+      tr: Yerel Yönetim Portu
+      es-es: Puerto de gestión local
+      fa: درگاه مدیریت محلی
+      lo: ພອດຈັດການພາຍໃນ
+    required: true
+    rule: paramPort
+    type: number
+  - default: 86400
+    edit: true
+    envKey: PAIRING_TTL_SECONDS
+    labelEn: Pairing Code Lifetime (Seconds)
+    labelZh: 配对码有效期（秒）
+    label:
+      en: Pairing Code Lifetime (Seconds)
+      zh: 配对码有效期（秒）
+      zh-hant: 配對碼有效期（秒）
+      ja: ペアリングコード有効期間（秒）
+      ko: 페어링 코드 유효 시간(초)
+      ru: Срок действия кода сопряжения (сек.)
+      ms: Tempoh Kod Gandingan (Saat)
+      pt-br: Validade do Codigo de Pareamento (Segundos)
+      tr: Eşleştirme Kodu Geçerlilik Süresi (Saniye)
+      es-es: Duración del código de emparejamiento (segundos)
+      fa: مدت اعتبار کد جفت‌سازی (ثانیه)
+      lo: ອາຍຸລະຫັດຈັບຄູ່ (ວິນາທີ)
+    required: true
+    type: number
+  - default: ./data
+    edit: true
+    envKey: APP_DATA_DIR
+    labelEn: Data Directory
+    labelZh: 数据目录
+    label:
+      en: Data Directory
+      zh: 数据目录
+      zh-hant: 資料目錄
+      ja: データディレクトリ
+      ko: 데이터 디렉터리
+      ru: Каталог данных
+      ms: Direktori Data
+      pt-br: Diretorio de Dados
+      tr: Veri Dizini
+      es-es: Directorio de datos
+      fa: شاخه داده‌ها
+      lo: ໄດເຣັກທໍຣີຂໍ້ມູນ
+    required: true
+    type: text
@@ -1,10 +1,9 @@
 services:
  server:
-    image: "ghcr.io/bisq-network/bisq2-api:2.1.12.0@sha256:beba2f2db5aefca0f4b8d49285b105cb0b29d0eb0ed0f8136712aace0e167906"
+    image: "ghcr.io/bisq-network/bisq2-api:2.1.12.1@sha256:79fb71d64d23863c8f48d484a9d84754dae40e12cb395bca348f17dcec46b297"
    container_name: ${CONTAINER_NAME}
    restart: unless-stopped
    stop_grace_period: 1m
-    mem_limit: 2g
    networks:
      - 1panel-network
    ports:
@@ -27,6 +27,40 @@ configured_value() {
  printf '%s\n' "${value:-$default_value}"
 }

+resolve_app_path() {
+  local key="$1"
+  local raw="$2"
+  local clean candidate resolved current part
+  local -a parts=()
+  case "$raw" in
+    ""|/*|.|..|../*|*/../*|*/..) echo "unsafe ${key} path" >&2; return 1 ;;
+  esac
+  if [[ "$raw" =~ [[:cntrl:]] ]]; then
+    echo "unsafe ${key} path" >&2
+    return 1
+  fi
+  clean="${raw#./}"
+  [[ -n "$clean" ]] || { echo "unsafe ${key} path" >&2; return 1; }
+  command -v realpath >/dev/null 2>&1 || { echo "realpath is required" >&2; return 1; }
+  candidate="$ROOT_DIR/$clean"
+  resolved="$(realpath -m -- "$candidate")" || { echo "unsafe ${key} path" >&2; return 1; }
+  case "$resolved" in
+    "$ROOT_DIR"/*) ;;
+    *) echo "unsafe ${key} path" >&2; return 1 ;;
+  esac
+  current="$ROOT_DIR"
+  IFS='/' read -r -a parts <<< "$clean"
+  for part in "${parts[@]}"; do
+    [[ -z "$part" || "$part" == "." ]] && continue
+    current="$current/$part"
+    if [[ -L "$current" ]]; then
+      echo "unsafe ${key} path" >&2
+      return 1
+    fi
+  done
+  printf '%s\n' "$resolved"
+}
+
 data_raw="$(configured_value APP_DATA_DIR ./data)"
 pairing_ttl="$(configured_value PAIRING_TTL_SECONDS 86400)"

@@ -34,21 +68,19 @@ pairing_ttl="$(configured_value PAIRING_TTL_SECONDS 86400)"
  printf '%s\n' 'APP_DATA_DIR must be a non-empty relative path using only letters, digits, dots, underscores, hyphens, and slashes' >&2
  exit 1
 }
-data_dir="$(realpath -m -- "$ROOT_DIR/${data_raw#./}")"
-case "$data_dir" in
-  "$ROOT_DIR"/*) ;;
-  *)
-    printf '%s\n' 'APP_DATA_DIR must remain inside the application version directory' >&2
-    exit 1
-    ;;
-esac
+APP_DATA_DIR="$data_raw"
+data_dir="$(resolve_app_path APP_DATA_DIR "$APP_DATA_DIR")"

 if [[ ! "$pairing_ttl" =~ ^[0-9]+$ ]] || ((10#$pairing_ttl < 300 || 10#$pairing_ttl > 86400)); then
  printf '%s\n' 'PAIRING_TTL_SECONDS must be an integer from 300 through 86400' >&2
  exit 1
 fi

-install -d -m 0750 "$data_dir"
+install -d -m 0750 -- "$data_dir"
+[[ "$(resolve_app_path APP_DATA_DIR "$APP_DATA_DIR")" == "$data_dir" ]] || {
+  printf '%s\n' 'APP_DATA_DIR changed during initialization' >&2
+  exit 1
+}
 data_dir="$(realpath -e -- "$data_dir")"
 case "$data_dir" in
  "$ROOT_DIR"/*) ;;
@@ -1,2 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
@@ -1,4 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-echo 'Back up the Bisq 2 data directory before upgrading.'
@@ -0,0 +1,38 @@
+# Bisq 2 Node
+
+## Introduction
+
+Bisq 2 Node is a self-hosted trading node for Bisq Connect. It joins the Bisq peer-to-peer network over bundled Tor so your phone can use a node you control. It is not a Bitcoin full node and does not download the Bitcoin blockchain.
+
+## Features
+
+- Joins the Bisq 2 peer-to-peer network through bundled Tor
+- Provides a self-controlled trading node for Bisq Connect
+- Displays node status and a time-limited pairing QR code
+- Persists node identity, databases, and Tor state
+- Keeps the node API on shared loopback with no host publication
+
+## Usage
+
+The management page is forcibly bound to `127.0.0.1:<local-management-port>` on the 1Panel host because it displays a pairing credential that can authorize node access and trade control. Reach it through an SSH tunnel, such as `ssh -L 8390:127.0.0.1:8390 user@server`, then open `http://127.0.0.1:8390/`. An existing authenticated HTTPS reverse proxy may target the loopback listener. Never rebind it to `0.0.0.0`, a public address, or an unauthenticated proxy.
+
+Pairing codes default to 86400 seconds and may be configured from 300 through 86400 seconds. Close the page after pairing. A code is single-use and held only in node memory; every node start overwrites the QR file in `APP_DATA_DIR`, invalidating an unused code from the previous process. Node identity and paired-client records persist.
+
+## Data and security
+
+`APP_DATA_DIR` must be a relative path inside the application version directory. It stores node identity, keys, databases, Tor state, and pairing material. The uninstall hook does not remove this data; back it up before upgrades, migrations, or removal. Restrict access to 1Panel, Docker, and the host because administrators can read the mounted data.
+
+The node API stays unpublished on shared loopback `127.0.0.1:8090`. The Web sidecar exposes only the static UI, pairing text, and fixed version proxy. Both containers use read-only root filesystems, `no-new-privileges`, and reduced capabilities.
+
+The pinned upstream images may contain dependency vulnerabilities. Re-scan the images after upstream publishes fixes and upgrade promptly. A vulnerability review does not replace updating vulnerable dependencies.
+
+## Network and trading risk
+
+The node communicates with the public Bisq network and external services over Tor. Tor improves network privacy but cannot eliminate traffic correlation, malicious peers, upstream data errors, software vulnerabilities, or a compromised host. Running your own node does not make offers, counterparties, payment methods, dispute outcomes, or market data trustworthy. Confirm transaction details, back up identity data, and follow local legal and tax requirements.
+
+## References
+
+- Source and license: <https://github.com/bisq-network/bisq2/tree/v2.1.11>
+- Official Bisq website: <https://bisq.network/>
+- Bisq Connect support: <https://github.com/bisq-network/bisq-mobile/issues>
+- Official Umbrel deployment submission: <https://github.com/getumbrel/umbrel-apps/pull/5850>
@@ -1,24 +1,30 @@
 name: Bisq 2 Node
 tags:
-  - Bitcoin
+- Bitcoin
 title: 通过 Tor 运行自己的 Bisq 2 交易节点
 description: 通过 Tor 运行自己的 Bisq 2 交易节点
 additionalProperties:
  key: bisq2-node
  name: Bisq 2 Node
  tags:
-    - Bitcoin
+  - Bitcoin
  shortDescZh: 通过 Tor 运行自己的 Bisq 2 交易节点
  shortDescEn: Run your own Bisq 2 trading node over Tor
  description:
-    en: Self-hosted Bisq 2 node for private peer-to-peer Bitcoin trading with Bisq Connect
+    en: Self-hosted Bisq 2 node for private peer-to-peer Bitcoin trading with Bisq
+      Connect
    zh: 配合 Bisq Connect 使用的自托管 Bisq 2 点对点比特币交易节点
-    zh-Hant: 配合 Bisq Connect 使用的自託管 Bisq 2 點對點比特幣交易節點
+    zh-hant: 配合 Bisq Connect 使用的自託管 Bisq 2 點對點比特幣交易節點
    ja: Bisq Connect向けのセルフホスト型Bisq 2ピアツーピアBitcoin取引ノード
    ko: Bisq Connect용 자체 호스팅 Bisq 2 P2P 비트코인 거래 노드
    ru: Собственный узел Bisq 2 для одноранговой торговли биткоином через Bisq Connect
    ms: Nod Bisq 2 hos sendiri untuk dagangan Bitcoin rakan-ke-rakan dengan Bisq Connect
-    pt-br: No Bisq 2 auto-hospedado para negociacao de Bitcoin ponto a ponto com Bisq Connect
+    pt-br: No Bisq 2 auto-hospedado para negociacao de Bitcoin ponto a ponto com Bisq
+      Connect
+    tr: Bisq Connect ile özel eşler arası Bitcoin ticareti için kendi barındırdığınız Bisq 2 düğümü
+    es-es: Nodo Bisq 2 autoalojado para el comercio de Bitcoin entre pares con Bisq Connect
+    fa: گره خودمیزبان Bisq 2 برای معامله همتا‌به‌همتای بیت‌کوین با Bisq Connect
+    lo: ໂນດ Bisq 2 ທີ່ໂຮສຕົນເອງ ສຳລັບການຊື້ຂາຍ Bitcoin ແບບເພື່ອນຫາເພື່ອນດ້ວຍ Bisq Connect
  type: tool
  crossVersionUpdate: true
  limit: 0
@@ -26,5 +32,5 @@ additionalProperties:
  github: https://github.com/bisq-network/bisq2
  document: https://github.com/bisq-network/bisq2/tree/v2.1.11
  architectures:
-    - amd64
-    - arm64
+  - amd64
+  - arm64