remote-systemd-toggle 1.3.0 Released

by

Version 1.3.0 of remote-systemd-toggle is now available. This release combines the security hardening and packaging improvements from 1.2.0 with a small CLI cleanup in 1.3.0.

There is one small breaking CLI change: use remote-systemd-toggle status instead of remote-systemd-toggle --status. The protocol, configuration files, secrets file format, certificates, and packages remain compatible.

🔐 Security hardening

The systemd service unit has been tightened with additional sandboxing and runtime restrictions. Core dumps are disabled for the daemon, reducing the chance of sensitive runtime data ending up on disk.

The server also checks and corrects ownership and permissions for protected paths where appropriate. This includes the configuration directory, configuration file, secrets directory, and secrets file. Symlinks are rejected for protected config and secret paths.

📦 Better package behavior

The Debian and RPM packages now include maintainer scripts for the server package.

During upgrades, systemd is reloaded and the daemon is restarted if the service is already enabled. When the server package is removed, the daemon is stopped. The client package is unchanged in this regard and does not install service scripts.

✅ Release artifact verification

Release artifacts now include a SHA256SUMS file. This allows downloaded .deb, .rpm, and Windows client binaries to be verified before installation.

📜 Improved certificate examples

The example certificate generation scripts now create certificates with explicit extensions, including CA constraints, key usage, and subject/authority key identifiers.

Existing certificates remain compatible. The changes only affect newly generated example certificates.

🖥️ Cleaner client CLI

The client CLI now uses explicit commands:

remote-systemd-toggle toggle
remote-systemd-toggle status

Calling remote-systemd-toggle without a command still defaults to toggle.

The old status flag has been removed:

remote-systemd-toggle --status

Use this instead:

remote-systemd-toggle status

This better matches what the client actually sends to the server: a command plus the password.

🚀 Upgrade notes

This release has one small breaking CLI change: --status was replaced by the status command.

Everything else remains compatible:

  • existing configuration files continue to work
  • existing secrets.yml files continue to work
  • existing certificates continue to work
  • the wire protocol remains unchanged
  • the server behavior remains compatible

In short: stronger packaging and security defaults, better release verification, improved certificate examples, and a cleaner CLI.