sduesterhaupt
cc2ca834d2
Add configurable ownership and permission defaults for shared DH parameter directories and files. Set shared DH parameter defaults to root:root, directory mode 0755, and file mode 0644 so non-root TLS services can traverse the directory and read DH parameter files. Enforce configured ownership and modes after synchronization and document the security boundary between public DH parameters and TLS private keys.
55 lines
3.7 KiB
Markdown
55 lines
3.7 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project will be documented in this file.
|
|
|
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
|
|
## Unreleased
|
|
|
|
### Added
|
|
|
|
- Added configurable ownership and permission defaults for the shared DH parameter directory and generated DH parameter files through `tls_private_owner`, `tls_private_dir_mode`, and `tls_private_file_mode`.
|
|
- Added configuration documentation for shared DH parameter access and for the distinction between DH parameters and TLS private keys.
|
|
- Added deterministic ownership and permission enforcement for the shared DH parameter directory and `dh_*.pem` files.
|
|
|
|
### Changed
|
|
|
|
- Changed the default shared DH parameter directory ownership and mode to `root:root` and `0755`.
|
|
- Changed the default shared DH parameter file ownership and mode to `root:root` and `0644`.
|
|
- Changed the shared DH parameter defaults to allow non-root TLS services to traverse the directory and read DH parameter files.
|
|
- Changed global DH parameter synchronization to apply the configured ownership and file mode after transfer.
|
|
|
|
## 1.0.0 - 2026-09-06
|
|
|
|
### Added
|
|
|
|
- Added configurable Diffie-Hellman parameter generation for one or more key sizes.
|
|
- Added global configuration options for temporary and persistent DH parameter directories.
|
|
- Added support for simple service definitions using the `service:owner` format.
|
|
- Added extended service definitions for per-service DH parameter deployment, destination ownership, and file permissions.
|
|
- Added support for both system-wide systemd services and per-user `systemctl --user` services.
|
|
- Added support for rootless container service units by executing user service actions with the configured service owner and `XDG_RUNTIME_DIR`.
|
|
- Added systemd state inspection through `LoadState`, `ActiveState`, `SubState`, and `Type`.
|
|
- Added automatic restart of active units after a successful optional service-specific DH parameter synchronization.
|
|
- Added automatic execution of inactive or failed `Type=oneshot` units after a successful DH parameter update.
|
|
- Added explicit validation and error reporting for missing users, missing units, unavailable user managers, incomplete service definitions, missing DH files, and failed file operations.
|
|
- Added secure, explicit ownership and permission handling for created target directories and deployed DH parameter files.
|
|
- Added cleanup and failure handling for temporary DH parameter files and the global synchronization step.
|
|
|
|
### Changed
|
|
|
|
- Changed service handling so that service-specific DH parameters are deployed before a service is restarted or a one-shot unit is started.
|
|
- Changed unit validation to distinguish missing services from inactive, failed, active, and transitional unit states.
|
|
- Changed reporting for per-user services to show the configured owner consistently for both status checks and service actions.
|
|
- Changed configuration parsing to preserve compatibility with `user.group` ownership syntax while converting it to `user:group` for `chown`.
|
|
|
|
### Fixed
|
|
|
|
- Fixed misleading success messages for services that do not exist on a host.
|
|
- Fixed the possibility of creating or synchronizing DH parameters to a configured target path when the corresponding systemd unit is missing.
|
|
- Fixed malformed error-handling blocks around destination-directory creation and DH parameter copy operations.
|
|
- Fixed validation of the configured `user.group` ownership field.
|
|
- Fixed user-service restart handling so that active `systemctl --user` services are restarted as their configured owner.
|
|
- Fixed handling of active `Type=oneshot` units with `SubState=exited` by using `ActiveState` for action decisions.
|