diff --git a/apps/bisq2-node/2.1.11.2/data.yml b/apps/bisq2-node/2.1.11.2/data.yml index c1328b906..8885413c9 100644 --- a/apps/bisq2-node/2.1.11.2/data.yml +++ b/apps/bisq2-node/2.1.11.2/data.yml @@ -1,51 +1,63 @@ additionalProperties: formFields: - - default: 8390 - edit: true - envKey: PANEL_APP_PORT_HTTP - labelEn: Local Management Port - labelZh: 本地管理端口 - label: - en: Local Management Port - zh: 本地管理端口 - zh-Hant: 本機管理連接埠 - ja: ローカル管理ポート - ko: 로컬 관리 포트 - ru: Локальный порт управления - ms: Port Pengurusan Tempatan - pt-br: Porta de Gerenciamento Local - required: true - rule: paramPort - type: number - - default: 86400 - edit: true - envKey: PAIRING_TTL_SECONDS - labelEn: Pairing Code Lifetime (Seconds) - labelZh: 配对码有效期（秒） - label: - en: Pairing Code Lifetime (Seconds) - zh: 配对码有效期（秒） - zh-Hant: 配對碼有效期（秒） - ja: ペアリングコード有効期間（秒） - ko: 페어링 코드 유효 시간(초) - ru: Срок действия кода сопряжения (сек.) - ms: Tempoh Kod Gandingan (Saat) - pt-br: Validade do Codigo de Pareamento (Segundos) - required: true - type: number - - default: ./data - edit: true - envKey: APP_DATA_DIR - labelEn: Data Directory - labelZh: 数据目录 - label: - en: Data Directory - zh: 数据目录 - zh-Hant: 資料目錄 - ja: データディレクトリ - ko: 데이터 디렉터리 - ru: Каталог данных - ms: Direktori Data - pt-br: Diretorio de Dados - required: true - type: text + - default: 8390 + edit: true + envKey: PANEL_APP_PORT_HTTP + labelEn: Local Management Port + labelZh: 本地管理端口 + label: + en: Local Management Port + zh: 本地管理端口 + zh-hant: 本機管理連接埠 + ja: ローカル管理ポート + ko: 로컬 관리 포트 + ru: Локальный порт управления + ms: Port Pengurusan Tempatan + pt-br: Porta de Gerenciamento Local + tr: Yerel Yönetim Portu + es-es: Puerto de gestión local + fa: درگاه مدیریت محلی + lo: ພອດຈັດການພາຍໃນ + required: true + rule: paramPort + type: number + - default: 86400 + edit: true + envKey: PAIRING_TTL_SECONDS + labelEn: Pairing Code Lifetime (Seconds) + labelZh: 配对码有效期（秒） + label: + en: Pairing Code Lifetime (Seconds) + zh: 配对码有效期（秒） + zh-hant: 配對碼有效期（秒） + ja: ペアリングコード有効期間（秒） + ko: 페어링 코드 유효 시간(초) + ru: Срок действия кода сопряжения (сек.) + ms: Tempoh Kod Gandingan (Saat) + pt-br: Validade do Codigo de Pareamento (Segundos) + tr: Eşleştirme Kodu Geçerlilik Süresi (Saniye) + es-es: Duración del código de emparejamiento (segundos) + fa: مدت اعتبار کد جفت‌سازی (ثانیه) + lo: ອາຍຸລະຫັດຈັບຄູ່ (ວິນາທີ) + required: true + type: number + - default: ./data + edit: true + envKey: APP_DATA_DIR + labelEn: Data Directory + labelZh: 数据目录 + label: + en: Data Directory + zh: 数据目录 + zh-hant: 資料目錄 + ja: データディレクトリ + ko: 데이터 디렉터리 + ru: Каталог данных + ms: Direktori Data + pt-br: Diretorio de Dados + tr: Veri Dizini + es-es: Directorio de datos + fa: شاخه داده‌ها + lo: ໄດເຣັກທໍຣີຂໍ້ມູນ + required: true + type: text diff --git a/apps/bisq2-node/2.1.11.2/docker-compose.yml b/apps/bisq2-node/2.1.11.2/docker-compose.yml index ce63a268f..4d1e6f77b 100644 --- a/apps/bisq2-node/2.1.11.2/docker-compose.yml +++ b/apps/bisq2-node/2.1.11.2/docker-compose.yml @@ -1,10 +1,9 @@ services: server: - image: "ghcr.io/bisq-network/bisq2-api:2.1.12.0@sha256:beba2f2db5aefca0f4b8d49285b105cb0b29d0eb0ed0f8136712aace0e167906" + image: "ghcr.io/bisq-network/bisq2-api:2.1.12.1@sha256:79fb71d64d23863c8f48d484a9d84754dae40e12cb395bca348f17dcec46b297" container_name: ${CONTAINER_NAME} restart: unless-stopped stop_grace_period: 1m - mem_limit: 2g networks: - 1panel-network ports: diff --git a/apps/bisq2-node/2.1.11.2/scripts/init.sh b/apps/bisq2-node/2.1.11.2/scripts/init.sh index 06cd93422..ef7e59993 100755 --- a/apps/bisq2-node/2.1.11.2/scripts/init.sh +++ b/apps/bisq2-node/2.1.11.2/scripts/init.sh @@ -27,6 +27,40 @@ configured_value() { printf '%s\n' "${value:-$default_value}" } +resolve_app_path() { + local key="$1" + local raw="$2" + local clean candidate resolved current part + local -a parts=() + case "$raw" in + ""|/*|.|..|../*|*/../*|*/..) echo "unsafe ${key} path" >&2; return 1 ;; + esac + if [[ "$raw" =~ [[:cntrl:]] ]]; then + echo "unsafe ${key} path" >&2 + return 1 + fi + clean="${raw#./}" + [[ -n "$clean" ]] || { echo "unsafe ${key} path" >&2; return 1; } + command -v realpath >/dev/null 2>&1 || { echo "realpath is required" >&2; return 1; } + candidate="$ROOT_DIR/$clean" + resolved="$(realpath -m -- "$candidate")" || { echo "unsafe ${key} path" >&2; return 1; } + case "$resolved" in + "$ROOT_DIR"/*) ;; + *) echo "unsafe ${key} path" >&2; return 1 ;; + esac + current="$ROOT_DIR" + IFS='/' read -r -a parts <<< "$clean" + for part in "${parts[@]}"; do + [[ -z "$part" || "$part" == "." ]] && continue + current="$current/$part" + if [[ -L "$current" ]]; then + echo "unsafe ${key} path" >&2 + return 1 + fi + done + printf '%s\n' "$resolved" +} + data_raw="$(configured_value APP_DATA_DIR ./data)" pairing_ttl="$(configured_value PAIRING_TTL_SECONDS 86400)" @@ -34,21 +68,19 @@ pairing_ttl="$(configured_value PAIRING_TTL_SECONDS 86400)" printf '%s\n' 'APP_DATA_DIR must be a non-empty relative path using only letters, digits, dots, underscores, hyphens, and slashes' >&2 exit 1 } -data_dir="$(realpath -m -- "$ROOT_DIR/${data_raw#./}")" -case "$data_dir" in - "$ROOT_DIR"/*) ;; - *) - printf '%s\n' 'APP_DATA_DIR must remain inside the application version directory' >&2 - exit 1 - ;; -esac +APP_DATA_DIR="$data_raw" +data_dir="$(resolve_app_path APP_DATA_DIR "$APP_DATA_DIR")" if [[ ! "$pairing_ttl" =~ ^[0-9]+$ ]] || ((10#$pairing_ttl < 300 || 10#$pairing_ttl > 86400)); then printf '%s\n' 'PAIRING_TTL_SECONDS must be an integer from 300 through 86400' >&2 exit 1 fi -install -d -m 0750 "$data_dir" +install -d -m 0750 -- "$data_dir" +[[ "$(resolve_app_path APP_DATA_DIR "$APP_DATA_DIR")" == "$data_dir" ]] || { + printf '%s\n' 'APP_DATA_DIR changed during initialization' >&2 + exit 1 +} data_dir="$(realpath -e -- "$data_dir")" case "$data_dir" in "$ROOT_DIR"/*) ;; diff --git a/apps/bisq2-node/2.1.11.2/scripts/uninstall.sh b/apps/bisq2-node/2.1.11.2/scripts/uninstall.sh deleted file mode 100755 index 6e877466e..000000000 --- a/apps/bisq2-node/2.1.11.2/scripts/uninstall.sh +++ /dev/null @@ -1,2 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail diff --git a/apps/bisq2-node/2.1.11.2/scripts/upgrade.sh b/apps/bisq2-node/2.1.11.2/scripts/upgrade.sh deleted file mode 100755 index a1b212511..000000000 --- a/apps/bisq2-node/2.1.11.2/scripts/upgrade.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -echo 'Back up the Bisq 2 data directory before upgrading.' diff --git a/apps/bisq2-node/README_en.md b/apps/bisq2-node/README_en.md new file mode 100644 index 000000000..b68f5a26d --- /dev/null +++ b/apps/bisq2-node/README_en.md @@ -0,0 +1,38 @@ +# Bisq 2 Node + +## Introduction + +Bisq 2 Node is a self-hosted trading node for Bisq Connect. It joins the Bisq peer-to-peer network over bundled Tor so your phone can use a node you control. It is not a Bitcoin full node and does not download the Bitcoin blockchain. + +## Features + +- Joins the Bisq 2 peer-to-peer network through bundled Tor +- Provides a self-controlled trading node for Bisq Connect +- Displays node status and a time-limited pairing QR code +- Persists node identity, databases, and Tor state +- Keeps the node API on shared loopback with no host publication + +## Usage + +The management page is forcibly bound to `127.0.0.1:` on the 1Panel host because it displays a pairing credential that can authorize node access and trade control. Reach it through an SSH tunnel, such as `ssh -L 8390:127.0.0.1:8390 user@server`, then open `http://127.0.0.1:8390/`. An existing authenticated HTTPS reverse proxy may target the loopback listener. Never rebind it to `0.0.0.0`, a public address, or an unauthenticated proxy. + +Pairing codes default to 86400 seconds and may be configured from 300 through 86400 seconds. Close the page after pairing. A code is single-use and held only in node memory; every node start overwrites the QR file in `APP_DATA_DIR`, invalidating an unused code from the previous process. Node identity and paired-client records persist. + +## Data and security + +`APP_DATA_DIR` must be a relative path inside the application version directory. It stores node identity, keys, databases, Tor state, and pairing material. The uninstall hook does not remove this data; back it up before upgrades, migrations, or removal. Restrict access to 1Panel, Docker, and the host because administrators can read the mounted data. + +The node API stays unpublished on shared loopback `127.0.0.1:8090`. The Web sidecar exposes only the static UI, pairing text, and fixed version proxy. Both containers use read-only root filesystems, `no-new-privileges`, and reduced capabilities. + +The pinned upstream images may contain dependency vulnerabilities. Re-scan the images after upstream publishes fixes and upgrade promptly. A vulnerability review does not replace updating vulnerable dependencies. + +## Network and trading risk + +The node communicates with the public Bisq network and external services over Tor. Tor improves network privacy but cannot eliminate traffic correlation, malicious peers, upstream data errors, software vulnerabilities, or a compromised host. Running your own node does not make offers, counterparties, payment methods, dispute outcomes, or market data trustworthy. Confirm transaction details, back up identity data, and follow local legal and tax requirements. + +## References + +- Source and license: +- Official Bisq website: +- Bisq Connect support: +- Official Umbrel deployment submission: diff --git a/apps/bisq2-node/data.yml b/apps/bisq2-node/data.yml index 381387466..c70dee924 100644 --- a/apps/bisq2-node/data.yml +++ b/apps/bisq2-node/data.yml @@ -1,24 +1,30 @@ name: Bisq 2 Node tags: - - Bitcoin +- Bitcoin title: 通过 Tor 运行自己的 Bisq 2 交易节点 description: 通过 Tor 运行自己的 Bisq 2 交易节点 additionalProperties: key: bisq2-node name: Bisq 2 Node tags: - - Bitcoin + - Bitcoin shortDescZh: 通过 Tor 运行自己的 Bisq 2 交易节点 shortDescEn: Run your own Bisq 2 trading node over Tor description: - en: Self-hosted Bisq 2 node for private peer-to-peer Bitcoin trading with Bisq Connect + en: Self-hosted Bisq 2 node for private peer-to-peer Bitcoin trading with Bisq + Connect zh: 配合 Bisq Connect 使用的自托管 Bisq 2 点对点比特币交易节点 - zh-Hant: 配合 Bisq Connect 使用的自託管 Bisq 2 點對點比特幣交易節點 + zh-hant: 配合 Bisq Connect 使用的自託管 Bisq 2 點對點比特幣交易節點 ja: Bisq Connect向けのセルフホスト型Bisq 2ピアツーピアBitcoin取引ノード ko: Bisq Connect용 자체 호스팅 Bisq 2 P2P 비트코인 거래 노드 ru: Собственный узел Bisq 2 для одноранговой торговли биткоином через Bisq Connect ms: Nod Bisq 2 hos sendiri untuk dagangan Bitcoin rakan-ke-rakan dengan Bisq Connect - pt-br: No Bisq 2 auto-hospedado para negociacao de Bitcoin ponto a ponto com Bisq Connect + pt-br: No Bisq 2 auto-hospedado para negociacao de Bitcoin ponto a ponto com Bisq + Connect + tr: Bisq Connect ile özel eşler arası Bitcoin ticareti için kendi barındırdığınız Bisq 2 düğümü + es-es: Nodo Bisq 2 autoalojado para el comercio de Bitcoin entre pares con Bisq Connect + fa: گره خودمیزبان Bisq 2 برای معامله همتا‌به‌همتای بیت‌کوین با Bisq Connect + lo: ໂນດ Bisq 2 ທີ່ໂຮສຕົນເອງ ສຳລັບການຊື້ຂາຍ Bitcoin ແບບເພື່ອນຫາເພື່ອນດ້ວຍ Bisq Connect type: tool crossVersionUpdate: true limit: 0 @@ -26,5 +32,5 @@ additionalProperties: github: https://github.com/bisq-network/bisq2 document: https://github.com/bisq-network/bisq2/tree/v2.1.11 architectures: - - amd64 - - arm64 + - amd64 + - arm64 diff --git a/apps/bisq2-node/logo.png b/apps/bisq2-node/logo.png index 412926d3f..9b93d0576 100644 Binary files a/apps/bisq2-node/logo.png and b/apps/bisq2-node/logo.png differ