v0.1.0

[csysp]

v0.1.0 — 2026-03-17

First public release of XMRDP (Monero Mining Cluster Rapid Deployment).

New features

• xmrdp setup — interactive wizard that generates cluster.toml, downloads and
  SHA-256 verifies monerod, p2pool, and xmrig from official GitHub releases
• xmrdp start master / worker — starts services in dependency order with health checks
• xmrdp stop master / worker — graceful shutdown
• xmrdp status — shows running services, health, and P2Pool pool stats
• xmrdp sync — pushes cluster.toml to worker nodes over SSH/SCP
• xmrdp update / --check-only — rolling binary updates (xmrig → p2pool → monerod)
• xmrdp logs [service] — tail monerod / p2pool / xmrig / c2 log files
• xmrdp firewall <role> — prints platform-appropriate rules (ufw, iptables, pf, netsh)
• xmrdp config --validate / --show / --generate — config management; secrets redacted in --show
• -v / --verbose flag for DEBUG-level output on any command

Security

• HMAC constant-time token comparison (F-02)
• Per-IP auth failure rate limiting — 429 after 10 failures / 60 s (F-01)
• Worker identity binding — heartbeat from wrong IP returns 403 (F-11)
• Zip Slip / unsafe tar extraction prevented (F-06)
• subprocess injection blocked via arg allowlist on extra_args (F-05)
• Download size capped at 2 GB; streaming SHA-256 verification (F-07)
• xmrig wallet address written to config file, not process args (F-04)
• Config files created with mode 0600; data/config dirs 0700 on Unix (F-13 / NF-05)
• Optional TLS on C2 API with SHA-256 certificate fingerprint pinning (F-03)
• Structured audit logging (F-12)
• Worker name and host fields validated against allowlist regexes (NF-03 / NF-NEW-02)
• GITHUB_TOKEN env var honoured for GitHub API requests to avoid rate limits (F-14)

Infrastructure

• Worker registry persisted to workers.json (mode 0600); survives C2 restart
• master.bind_host option decouples C2 listen address from advertise address
• P2Pool stratum firewall rules restricted to known worker IPs
• xmrig donate-level defaults to 0
• CI: SHA-pinned GitHub Actions + bandit / pip-audit security scan
• 200 tests across core, C2, cluster, and sync modules

Platform support

Linux (x86_64, aarch64) · macOS (x86_64, Apple Silicon) · Windows (x86_64)

Install

pip install git+https://github.com/csysp/xmrdp.git@v0.1.0

See INSTALL.md for full installation and quick-start instructions.

---

This discussion was created from the release v0.1.0.