Release 1.1.9: durable fleet updates

README.md

@@ -126,6 +126,64 @@ Config files are stored in `/etc/cryptolabs-proxy/`:
 └── ssl/                # SSL certificates
 ```
 
+The image ships a bootstrap Nginx configuration. Service lifecycle commands
+regenerate the configuration above and require it to be mounted at
+`/etc/nginx/nginx.conf` in the running proxy container. This is how optional
+Vast Price Manager routing is enabled and removed; the CLI refuses to claim a
+route change when the container is still using the bundled configuration.
+The bootstrap configuration intentionally contains no Vast Price Manager route.
+Before an installer enables or disables VPM, it must first create the registry
+configuration, render `/etc/cryptolabs-proxy/nginx.conf`, bind-mount that file
+as `/etc/nginx/nginx.conf`, and verify the proxy is using it. The subsequent
+`cryptolabs-proxy register` or `unregister` command then validates and reloads
+that mounted configuration atomically with the registry update.
+
+### Existing custom proxy configuration
+
+Do not use the generic CLI alone to migrate a proxy that already runs a custom
+unmounted `nginx.conf`: it regenerates the full configuration. Use the reviewed
+`scripts/vpm-custom-config-migrate.py` helper first. Its read-only `plan` mode
+derives a migration ID from the source container and config hash. Its explicit
+`apply` stores root-only backups, mounts a byte-preserved custom baseline with
+only the canonical managed blocks added, and can perform a proxy-only
+`rollback`. Custom-config mode then permits only normal VPM
+`register`/`unregister`; it rejects changes to every other service. Its managed
+Fleet auth deny block remains installed in every HTTP server block after VPM is unregistered, so the
+always-running internal VPM session and reauthentication endpoints cannot fall
+through a preserved public <code>/auth/</code> route. Rollback restores the
+original stored baseline exactly.
+
+### Vast Price Manager Fleet sign-in
+
+### Vast Price Manager prerequisite
+
+Before a new Vast Price Manager route can be added, the local Vast.ai exporter
+must be running and report at least one connected account. Complete setup at
+`/vastai/`. Existing VPM installations remain available for maintenance if the
+exporter later loses connectivity; they are never automatically disabled.
+
+The proxy checks the exporter from inside its container using its internal
+management token, which must be provisioned by the exporter setup. It records
+only whether setup is ready and the count of connected accounts; API keys,
+account names, balances, and tokens are not returned.
+
+When Vast Price Manager runs in Fleet mode, it uses the existing Fleet
+`fleet_session` cookie and does not create a second VPM account or login. VPM
+introspects the current Fleet session on the Docker network at
+`http://cryptolabs-proxy:8081/auth/vast-price-manager/session`; the public
+Nginx configuration explicitly returns `404` for that endpoint and its
+reauthentication companion, including their trailing-slash variants.
+
+The internal session response is limited to the current enabled Fleet admin's
+username, role, and two purpose-separated HMAC values derived from the signed
+cookie: a subject and a CSRF token. It never returns the cookie, password,
+password hash, or signing key. The proxy rereads the user record for every
+session, reauthentication, and VPM proxy authorization check, so a disabled,
+deleted, demoted, or password-change-required account loses VPM access
+immediately. Sensitive VPM confirmation calls
+`POST /auth/vast-price-manager/reauth` internally with the Fleet password and
+the returned CSRF token; it uses the normal Fleet password throttle.
+
 User authentication data is stored in `/data/auth/`:
 
 ```

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cryptolabs-proxy"
-version = "1.1.7"
+version = "1.1.9"
 description = "Unified reverse proxy and fleet management landing page for CryptoLabs products"
 readme = "README.md"
 license = {text = "MIT"}