BOA-5.88.833 — Candour Edition

BOA-5.88.833 PRO/LTS is the Candour Edition — 71 commits across three repositories (boa 58, provision 11, hosting 2), a combined feature and bugfix release. Everything in it ships in both PRO and LTS; no action is required beyond the ordinary upgrade.

Why "Candour"? Because in each of the places this release touches, the platform now proves what it used to assume — and says so plainly, loudly, where it cannot.

Backups you can take at face value. The panel's Backup task now offers three clearly-labelled modes — classic database dump only, site files only, or site files with the classic dump — and opens on the restorable one, so the natural single click produces an archive the Restore task can use. Partial backups are labelled for what they are — database-only or files-only — so from now on a partial snapshot announces itself before you rely on it. And archives that carry site files are always self-contained: the site's files and private directories are followed into the archive as real content, whatever symlinking arrangement the server uses, so the archive restores on any box.

And Restore now earns the name. Restoring an archive imports the database that archive contains — on systems with fast database imports it had been silently re-importing the site's current database and reporting success — a failure mode this release closes. An older archive with no database still restores its files and states plainly that the database was left unchanged. After a restore the site is re-homed into its per-account files store, and a leftover skeleton can never displace real content.

The first hour with BOA is now a straight line. A full self-hosted install started with nothing but one email address runs to completion and hands over the same two control-panel accounts a hosted system gets: the admin account derives its own distinct identity (root@<fqdn>), and a new [email protected] token on any install command supplies a real admin address instead — validated up front, position-independent, and preserved across an OS-conversion replay. The welcome email that closes the install tells the truth about that box: the SSH port it actually serves, sections for services the box does not run removed whole rather than shipped as dead instructions, and a mailed body byte-identical to the on-disk credentials copy. If it cannot be sent, the failure is loud and names the file holding the credentials.

Your server now remembers everything. XDR9000 is a new permanent, append-only archive every hosting box keeps about itself (the xdr9000 reader itself lands on every class of box): attack bans across web, SSH and FTP, self-heals and incidents, backup outcomes, a metric sample every five minutes and an hourly snapshot of box facts. It survives upgrades and log rotation by construction, costs almost nothing in CPU — a niced, throttled, bounded read holding a single lock — and is readable with one root command: xdr9000 report totals the attacks blocked, SYN-flood packets absorbed and repairs survived since recording began. It observes only: nothing is banned, killed or restarted by it (full detail: https://docs.boa.io/operating/monitoring/attack-health-archive). Recording is on by default; _XDR9000=NO stops it while keeping the archive — which is never pruned (past months compress, nothing is deleted), so budget for it on long-lived boxes.

Distributed scrapers lose their invisibility. Scraping campaigns spread across thousands of addresses at one request each used to burn PHP capacity through interactive-only Drupal paths without tripping any per-IP alarm. Those cold fetches — Flag toggle links without a Referer, HybridAuth login windows with neither Referer nor session — are now answered with a static 404 before PHP is ever reached, while real clicks, logins and OAuth returns pass untouched. A new IDS detector turns those verdicts into campaign-level visibility with evidence; its per-IP action stays report-only by default, deliberately, because the signal can be induced against innocent visitors. The batch-storm guard likewise now arms on the storm's own signature — many distinct batches looping at once — rather than box load, closing the blind spot where a pool-sized storm hid below every per-core threshold on large servers.

The platform proves what it used to assume. Every barracuda run now guarantees a working system logger, installing rsyslog wherever it is missing. The archive keyring on Devuan and Debian is verified installed — retried, and warned about by name if it cannot be established — and the permissive APT bypass BOA carries while a box cannot yet verify its archives now retires itself the day those repositories verify strictly. Fetched files can require a content sentinel, so a truncated or wrong payload is refused before it replaces a working file — including the shell wrapper that serves as /bin/sh on hosted systems — and every tool in the updater set now refreshes on its own version stamp on every pass, reaching every class of box — installer, SKYNET-active and SKYNET-off — without waiting for a tagged release.

Maintenance keeps to the night. A staged security kernel is activated only inside the 04:00–04:59 window, never on a day with a scheduled BOA upgrade, and every automatic activation is logged and announced by email before it happens. Nothing about who gets automatic reboots changed — only when they are allowed to fire.

For operators moving servers, the migration suite keeps its promises too: whole-server transfers now discover content living behind symlinks that point outside the copied trees — per-account backup stores on a second volume, typically — and materialise it as real files on the target, with the full map printed before any data moves. And the rebuilt orphan-database tool, sqlclean, treats Drush aliases as the source of truth for which databases are alive, so databases belonging to disabled, proxied or mid-migration sites are protected; it reports by default, deleting at all needs an operator-created protect file, and its unattended runbook mode additionally needs a freshly-reviewed manifest that still matches what the tool sees.

Also in this release: Drupal 10.6.15 and 11.4.5 platforms, the distribution set rebuilt on 11.4.5, OpenCulturas 3.0.5, Drupal 8+ sites joining the weekly banned-module sweep (detect-and-alert only — nothing ever bootstraps a D8+ site from outside Ægir's own backend path), quieter idle CI boxes, and a faster accepted-IP whitelist builder that takes the main driver out of the phantom load waves on login-busy small servers. The complete technical index is in the CHANGELOG.

Component Versions

Upgrade Instructions

Run inside a screen session as root:

screen
wget -qO- https://files.boa.io/BOA.sh.txt | bash
barracuda up-lts
octopus up-lts all force
boa reboot

Silent, logged variant (emailed on completion — useful for cron):

screen
wget -qO- https://files.boa.io/BOA.sh.txt | bash
barracuda up-lts log
octopus up-lts all force log

Full upgrade documentation: https://docs.boa.io/operating/os-lifecycle/manual-boa-upgrade

Links

• Documentation: https://docs.boa.io
• News & announcements: https://omega8.cc/news
• Full changelog: https://github.com/omega8cc/boa/blob/5.x-dev/CHANGELOG.txt
• Commit history: https://github.com/omega8cc/boa/commits/5.x-dev/