luadch-ng

docker compose up
 
[entrypoint] seeding /opt/luadch/cfg from /defaults/cfg/
[entrypoint] seeding /opt/luadch/scripts from /defaults/scripts/
[entrypoint] seeding /opt/luadch/certs from /defaults/certs/
init.lua: loaded 'adclib'
init.lua: loaded 'socket'
init.lua: loaded 'ssl'
             … 47 more modules
init.lua: init core modules
init.lua: initialized 'cfg'
init.lua: initialized 'secrets'
cert_bootstrap: generated self-signed P-256 cert at certs/servercert.pem
TLS keyprint (SHA256, base32): WEYYIOZB7233Q6BJ************************************
share with users as: adcs://<your-host>:<ssl_port>/?kp=SHA256/WEYYIOZB7233Q6BJ****
init.lua: initialized 'whitelist'
init.lua: initialized 'blocklist'

A first start. The hub seeds its own configuration, generates a P-256 certificate and prints the keyprint for your adcs:// URL. There is nothing to configure before it comes up encrypted.

Download

Extract and run, no build step and no runtime to install. These links always resolve to the current release. The container image is ghcr.io/luadch-ng/luadch-ng for amd64 and arm64.

Docker

git clone https://github.com/luadch-ng/luadch-ng.git
cd luadch-ng
cp .env.example .env
mkdir -p cfg scripts certs log secrets
docker compose up -d

The image runs unprivileged. On first start it seeds the empty mounts, generates a TLS certificate and logs the keyprint for your adcs:// URL.

Build from source

git clone https://github.com/luadch-ng/luadch-ng.git
cd luadch-ng
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j
cmake --install build
cd build/install/luadch && ./luadch

Fresh installs are TLS-only. Connect an ADC client to adcs://127.0.0.1:5001 and log in as dummy / test.

What it does

• 3.1.15TLS 1.3 only by default, with a P-256 certificate generated on first start
• 3.1.15Lua 5.4.8 runtime, lifted off the Lua 5.1 that upstream still uses
• 3.1.15AES-256-GCM encryption of the registered-user database at rest
• 3.1.15Sandboxed config and state loaders, so a tampered .tbl file cannot execute code
• 3.1.15Per-IP and per-user rate limits, TLS handshake deadline, failed-auth lockout
• 3.2 betaHTTP API with 75 REST routes, bearer tokens and read/admin scopes
• 3.2 betaPrometheus metrics endpoint, 7 gauges and 7 counters
• 3.2 betaAppend-only JSONL audit log of every staff action
• 3.2 betaScheduled backups, AES-256-GCM sealed, with an offline restore path
• 3.2 betaPre-handshake IP blocklist with Tor, Spamhaus and AbuseIPDB feeds
• 3.2 betaGeoIP country and ASN policy, with a built-in MaxMind updater
• 3.2 betaInbound webhooks, HMAC-SHA256 signed, posted into the hub chat
• 3.2 betaOpenWrt packages for three router architectures

The 3.2 line is not tagged yet. Those capabilities are on master and running, but the release you download today is v3.1.15.