[3alpha]

Context

The HTTPS package uses end-of-life Node versions and outdated dependencies. RHSB-2026-012 also requires refreshing the trust stores affected by the eMudhra certificate compromise.

Runtime review found that certificate matching compared Promises, scheduled renewals did not reload nginx, proxy targets could insert nginx directives, and thrown reconfiguration errors left failed mappings persisted.

Approach

• Move Docker and CI to patched Node 26.12.1 on Alpine 3.24, upgrade Alpine packages, and require ca-certificates >=20261020-r0. Refresh both Node's bundled CA store and the system bundle.
• Update application dependencies, typings, GitHub Actions and the SDK pin; regenerate the lockfile and migrate to ESLint flat configuration. Keep TypeScript on 6.0.3, the latest supported by the current TypeScript ESLint parser (<6.1). Replace obsolete ejs-lint with EJS-native template compilation.
• Match certificates against the domain private key using Node's crypto API, retry signing only on a real mismatch, validate the retry, and replace the existing certificate only after validation.
• Reload nginx after scheduled renewal and retry a failed reload without requesting another certificate.
• Validate target host/IP/port syntax while retaining internal DNS names, private addresses and the existing trusted access model. Roll back failed mapping additions when reconfiguration returns false or throws.
• Fix IPv6 template rendering and update nginx HTTP/2 syntax. Add regression tests and include the refreshed local package upload metadata.

Review: @dappnode/core

Test instructions

1. Use the Node version in .nvmrc and Yarn Classic 1.22.22, then run:

   yarn install --frozen-lockfile
   yarn build
   yarn lint
   yarn lint:ejs
   yarn test
   yarn audit

2. Build the package for both supported architectures, or build locally with:

   docker build --pull --no-cache -t dnp-https:local .

3. On a test Dappnode, add and remove an internal host/port mapping and verify HTTP redirects and HTTPS forwarding. Check IPv6 and authenticated mappings where enabled.
4. Verify renewal with the local certificate service: a matching certificate should need one signing request, and nginx should serve the renewed certificate without another mapping change. Simulate signing/reconfiguration failure and confirm the failed mapping is removed and can be retried.

Validation completed: ARM64/AMD64 image builds; build, lint, template checks and all 9 regression tests; dependency audit with zero known vulnerabilities; inspection of both CA bundles for the affected roots; live container startup, nginx configuration, redirects and HTTPS forwarding; scheduled renewal serving the replacement certificate after exactly one signing request using local mock services.

Running deployments must be rebuilt and redeployed to receive the trust-store updates.

[github-actions]

Dappnode bot has built and pinned the built packages to an IPFS node, for commit: 676d4dc

This is a development version and should only be installed for testing purposes.

1. Package https.dnp.dappnode.eth

Install link

Hash: /ipfs/QmSypa7FhLKPqCmtV9tvHgNrtz7oxW1gngGyphegQFE1np

(by dappnodebot/build-action)