v2.0.1

Merge pull request #65 from balena-io/cert-provider-update
cert-provider: Update to support ACMEv2 on staging provider
2025-06-24 18:25:16 +00:00 · 2020-01-17 12:30:31 +02:00 · 2020-01-17 10:28:43 +00:00 · 2020-01-17 10:24:43 +00:00 · 2019-09-02 13:39:55 +03:00 · 2019-09-02 11:38:03 +01:00
26 changed files with 1691 additions and 86 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,6 +1,7 @@
 .DS_Store
 .project
 .vagrant/
-config/
-src/
-package-lock.json
+
+/config
+/docker-compose.yml
+/package-lock.json
--- a/.versionbot/CHANGELOG.yml
+++ b/.versionbot/CHANGELOG.yml
@ -0,0 +1,963 @@
+- commits:
+    - subject: 'cert-provider: Update to support ACMEv2 on staging provider'
+      hash: d67e29223ff314b40fd745ce78301e550c2c9148
+      body: >
+        Acquiring a staging certificiate from LetsEncrypt was failing, so
+        acme.sh was
+
+        updated to version 2.8.5, which includes support for using ACMEv2 on the
+
+        LetsEncrypt servers.
+
+
+        Changes to the state flow to make access retries infinite as it became
+        apparent
+
+        that in some scenarios the certificate acquisition could fail to occur
+        due to
+
+        containers taking longer to become accessible.
+      footer:
+        Change-type: patch
+        change-type: patch
+        Signed-off-by: Rich Bayliss <rich@balena.io>
+        signed-off-by: Rich Bayliss <rich@balena.io>
+      author: Rich Bayliss
+  version: 2.0.1
+  date: 2020-01-17T10:27:22.097Z
+- commits:
+    - subject: 'feature: Use S3 bucket for Registry service backend'
+      hash: 2a7d0687a22f6b4b3bedc88e18bee165ef03c932
+      body: |
+        Update open-balena-s3 to 2.8.3
+
+        This makes new installations of openBalena use the S3 container as a
+        storage backend for the Registry service by default. Existing installs
+        should not be affected.
+      footer:
+        Change-type: major
+        change-type: major
+        Signed-off-by: Rich Bayliss <rich@balena.io>
+        signed-off-by: Rich Bayliss <rich@balena.io>
+      author: Rich Bayliss
+  version: 2.0.0
+  date: 2019-09-02T09:32:56.813Z
+- commits:
+    - subject: 'services: Update Registry service version'
+      hash: 853ffb33e8e29b085db57df1773f8875dca5bbe3
+      body: |
+        Update open-balena-registry to 2.11.1
+
+        This allows the registry to use an S3 bucket for storing images.
+      footer:
+        Change-type: minor
+        change-type: minor
+        Signed-off-by: Rich Bayliss <rich@balena.io>
+        signed-off-by: Rich Bayliss <rich@balena.io>
+      author: Rich Bayliss
+    - subject: >-
+        feature: Support deployment via balena push to local-mode balenaOS
+        devices
+      hash: a029160caf20096a14eb4955e1d5ddc7ecfdebf5
+      body: >
+        - remove some `.gitignore` entries as this is also honoured by `balena
+        push`
+
+        - added a step to `scripts/quickstart` to produce a single, flat
+        `docker-compose.yml` after running
+
+        - set the compose file versions to `2.0` to ensure only supported terms
+        are used in the `docker-compose.yml` file output
+
+        - quoted empty env values as these need to be passed in as blank, and
+        not ommitted
+
+        - include the MDNS publisher service IF the domain being used is a
+        .local one
+
+        - corrected spelling of macOS in script messages
+
+        - move sidecar container source into ./src as per convention
+      footer:
+        Change-type: patch
+        change-type: patch
+        Signed-off-by: Rich Bayliss <rich@balena.io>
+        signed-off-by: Rich Bayliss <rich@balena.io>
+      author: Rich Bayliss
+  version: 1.3.0
+  date: 2019-07-30T11:12:51.064Z
+- commits:
+    - subject: 'tidy: Remove unused DEVICE_CONFIG_OPENVPN_CONFIG variable'
+      hash: 199d8eb4a454cc99a9cd8329fa6beae49b9040e1
+      body: ''
+      footer:
+        Change-type: patch
+        change-type: patch
+        Signed-off-by: Rich Bayliss <rich@balena.io>
+        signed-off-by: Rich Bayliss <rich@balena.io>
+      author: Rich Bayliss
+    - subject: 'services: Update Registry service version'
+      hash: 6fdc554e4396f950398fcf61640386ef70e57467
+      body: >
+        Update open-balena-registry to 2.7.0
+
+
+        This allows registry to be configured to use its internal Redis instance
+        for caching. It is still disabled by default though.
+      footer:
+        Change-type: minor
+        change-type: minor
+      author: Akis Kesoglou
+    - subject: 'services: Update API service version'
+      hash: f8b8a1589a6f46589721b0eb3cb2a156730ca56c
+      body: |
+        Update open-balena-api from 0.11.8 to 0.19.5
+
+        This brings in the latest bugfixes and changes.
+      footer:
+        Change-type: patch
+        change-type: patch
+        Signed-off-by: Rich Bayliss <rich@balena.io>
+        signed-off-by: Rich Bayliss <rich@balena.io>
+      author: Rich Bayliss
+      nested:
+        - commits:
+            - subject: Update typed-error to 3.1.0
+              hash: 7ba397da9f1765258c533d454aa49dbacb9c0b79
+              body: |
+                Update typed-error from 2.0.0 to 3.1.0
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+              nested:
+                - commits:
+                    - subject: 'dev: Enforce prettier coding standards'
+                      hash: 47c07a641fa39ddb833b41aff7a918accad08289
+                      body: ''
+                      footer:
+                        Change-type: minor
+                        change-type: minor
+                        Signed-off-by: Will Boyce <will@balena.io>
+                        signed-off-by: Will Boyce <will@balena.io>
+                      author: Will Boyce
+                    - subject: 'npm: Update dependencies and remove `package-lock.json`'
+                      hash: 067bceb5c8dfd46f7e4ff0f58dead46fd9626167
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                        Signed-off-by: Will Boyce <will@balena.io>
+                        signed-off-by: Will Boyce <will@balena.io>
+                      author: Will Boyce
+                    - subject: >-
+                        codeowners: Add top contributors @wrboyce, @Page-, and
+                        @dfunckt
+                      hash: 6acc8757a594f74f264c8d68ea4501c61bda9951
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                        Signed-off-by: Will Boyce <will@balena.io>
+                        signed-off-by: Will Boyce <will@balena.io>
+                      author: Will Boyce
+                    - subject: 'versionbot: Add CHANGELOG.yml (for nested changelogs)'
+                      hash: 2b684a0bb0c95a5dbd3b130ba0f184d3464d298f
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                        Signed-off-by: Will Boyce <will@balena.io>
+                        signed-off-by: Will Boyce <will@balena.io>
+                      author: Will Boyce
+                  version: typed-error-3.1.0
+                  date: 2019-04-01T10:20:01.427Z
+                - commits:
+                    - author: CameronDiver
+                      body: ''
+                      footers:
+                        change-type: patch
+                        signed-off-by: Cameron Diver <cameron@balena.io>
+                      hash: aaa9391dc463c1037f85e845d30f6f9434bb4dc1
+                      subject: Update README with new import style
+                  date: '2018-11-01T12:08:25Z'
+                  version: typed-error-3.0.2
+                - commits:
+                    - author: Pagan Gazzard
+                      body: ''
+                      footers:
+                        change-type: patch
+                      hash: 627cdd281d7b086df8fe5ed1ccb0e0e0df3df062
+                      subject: Update to typescript 3
+                    - author: Pagan Gazzard
+                      body: ''
+                      footers:
+                        change-type: patch
+                      hash: 00d182bb2bc29bd82adb4e8ea4527f6bda6c5278
+                      subject: Update dev dependencies
+                    - author: Pagan Gazzard
+                      body: ''
+                      hash: 94adac5d747f16b9228b39e56007ee0126c6f99c
+                      subject: Add node-10 to the circle test suite
+                  date: '2018-10-29T14:05:23Z'
+                  version: typed-error-3.0.1
+                - commits:
+                    - author: Will Boyce
+                      body: >-
+                        * Switch to `export ...` syntax (from `export = ...`)
+
+                        * Fix invalid export of class inheriting non-exported
+                        class
+                      footers:
+                        change-type: major
+                      hash: a6307b8c04d3456ad7d8a6ac19035b5e718c4311
+                      subject: Distribute generated typescript declaration
+                    - author: Will Boyce
+                      body: ''
+                      footers:
+                        change-type: patch
+                      hash: 37c4b700baadba8cdd6bc0c40df74b30b1a6301c
+                      subject: use circle for build/publish and add package-lock
+                    - author: Will Boyce
+                      body: ''
+                      footers:
+                        change-type: patch
+                      hash: 83e809281f5172ca1ff71bdf0ee663cd504f1428
+                      subject: add lint scripts/requirements
+                    - author: Will Boyce
+                      body: ''
+                      footers:
+                        change-type: minor
+                      hash: da9431d08e501a0d4d0db3a7fb2c0bd06d76d064
+                      subject: Remove `BaseError` class and  directly subclass `Error`
+                    - author: Will Boyce
+                      body: ''
+                      footers:
+                        change-type: patch
+                      hash: e46a36b54498b68f513c6cb947e217c11525e160
+                      subject: 'Update dependencies, clean up package/tsconfig'
+                  date: '2018-04-17T08:19:27Z'
+                  version: typed-error-3.0.0
+                - commits:
+                    - author: Akis Kesoglou
+                      body: ''
+                      footers:
+                        change-type: patch
+                      hash: d35c44f1e57f6386c6f769f8cafc28e0886719cc
+                      subject: Add LICENSE
+                  date: '2017-12-15T17:19:00Z'
+                  version: typed-error-2.0.1
+          version: open-balena-api-0.19.5
+          date: 2019-05-20T12:59:21.646Z
+        - commits:
+            - subject: Some linting fixes for resin-lint 3
+              hash: 808fc3e1ec9b21d8df1166bc3265d92d6bfa1c59
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+          version: open-balena-api-0.19.4
+          date: 2019-05-20T12:11:09.118Z
+        - commits:
+            - subject: Silence expected API key related rejections
+              hash: d9e10e7128be9c562bcabbd58243830c6b2d1e01
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Akis Kesoglou
+          version: open-balena-api-0.19.3
+          date: 2019-05-17T11:47:13.587Z
+        - commits:
+            - subject: Update dependencies
+              hash: a01960d25643dd5da4f090638db8e87b297c00c5
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+          version: open-balena-api-0.19.2
+          date: 2019-05-17T10:44:43.341Z
+        - commits:
+            - subject: Make use of a prepared query for device state query
+              hash: ffa3f0bbba27d2c7246a45ab4ed4ff342a5c772c
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+            - subject: Update pinejs to 10.14.0
+              hash: ff02a77bebe6d4fbdd0a7fa9e2f2ef736fc560bc
+              body: |
+                Update pinejs from 10.11.0 to 10.14.0
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+              nested:
+                - commits:
+                    - subject: >-
+                        Update pinejs-client-core and make use of prepared
+                        queries
+                      hash: f61469c74fcba879bffb1e5e677805480e16e614
+                      body: |
+                        Update abstract-sql-compiler from 6.4.0 to 6.4.2
+                        Update odata-parser from 1.0.1 to 1.0.3
+                        Update odata-to-abstract-sql from 3.1.1 to 3.1.2
+                        Update pinejs-client-core from 5.3.6 to 5.5.1
+                        Update sbvr-parser from 0.2.1 to 0.2.2
+                        Update sbvr-types from 2.0.2 to 2.0.3
+                      footer:
+                        Change-type: minor
+                        change-type: minor
+                      author: Pagan Gazzard
+                      nested:
+                        - commits:
+                            - subject: >-
+                                Add .versionbot/CHANGELOG.yml for downstream
+                                changelogs
+                              hash: d871880a00c86b8eeec37489cf1d62a3688aabcc
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: odata-parser-1.0.3
+                          date: 2019-05-08T14:25:13.528Z
+                        - commits:
+                            - author: Pagan Gazzard
+                              body: ''
+                              footers:
+                                change-type: patch
+                              hash: 70ac83b0059a99d1d42e986f0a42fb7120c35ee8
+                              subject: Update dependencies
+                          date: '2019-04-15T06:51:46Z'
+                          version: odata-parser-1.0.2
+                        - commits:
+                            - subject: Update and fix lodash typings
+                              hash: 2bf073bbff3a94d66c31e07d98c3e298f5132b2c
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                            - subject: Update husky/mocha dev dependencies
+                              hash: 29f7d52185186bdb1171fdf27a923eb38887d009
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: abstract-sql-compiler-6.4.2
+                          date: 2019-05-09T21:32:48.414Z
+                        - commits:
+                            - subject: Fix typescript compilation
+                              hash: a3733e5c348687d74dd290538c6a7f3f3a4a4bb0
+                              body: |
+                                Update odata-parser from 1.0.1 to 1.0.3
+                                Update odata-to-abstract-sql from 3.0.0 to 3.0.1
+                                Update sbvr-parser from 0.2.1 to 0.2.2
+                                Update sbvr-types from 2.0.0 to 2.0.3
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                              nested:
+                                - commits:
+                                    - subject: >-
+                                        Add .versionbot/CHANGELOG.yml for
+                                        downstream changelogs
+                                      hash: 45c5843b204def5a727b8ba8dfafb2a2347f50f3
+                                      body: ''
+                                      footer:
+                                        Change-type: patch
+                                        change-type: patch
+                                      author: Pagan Gazzard
+                                  version: sbvr-parser-0.2.2
+                                  date: 2019-05-08T14:23:57.847Z
+                            - subject: Add node 12 tests
+                              hash: 094c059eb3c5fd6f3502c53e40ed4b90197ed5c2
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                            - subject: Add repo.yml for upstream changelogs
+                              hash: 3f4bffe3a107a4b6fd30c15bf1e70c79e68e226e
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                            - subject: >-
+                                Add .versionbot/CHANGELOG.yml for downstream
+                                changelogs
+                              hash: 5e4ab1569e5e7f7648d4c14df8d3bf9f834a4828
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: abstract-sql-compiler-6.4.1
+                          date: 2019-05-08T16:45:44.728Z
+                        - commits:
+                            - subject: >-
+                                Fix downstream declaration creation errors due
+                                to `Dictionary`
+                              hash: a8a39edff8cc7e1d05fb9b67037718970e94296c
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: pinejs-client-js-5.5.1
+                          date: 2019-05-15T13:32:13.920Z
+                        - commits:
+                            - subject: >-
+                                Add a prepare method that prepares a query into
+                                a function
+                              hash: eb7eccca7d90c453710575ebdf3adb9ef56835a7
+                              body: ''
+                              footer:
+                                Change-type: minor
+                                change-type: minor
+                              author: Pagan Gazzard
+                          version: pinejs-client-js-5.5.0
+                          date: 2019-05-15T11:51:46.450Z
+                        - commits:
+                            - subject: Add CODEOWNERS
+                              hash: e01174008f812e0c24ec1036aa1f9ff0bc716e85
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                                Signed-off-by: Gergely Imreh <gergely@balena.io>
+                                signed-off-by: Gergely Imreh <gergely@balena.io>
+                              author: Gergely Imreh
+                          version: pinejs-client-js-5.4.1
+                          date: 2019-05-10T10:14:00.677Z
+                        - commits:
+                            - subject: >-
+                                Add support for parameter aliases in resource
+                                ids
+                              hash: a4e6a640a3ced56bcd3ef7bf22770338e089a90d
+                              body: ''
+                              footer:
+                                Change-type: minor
+                                change-type: minor
+                              author: Pagan Gazzard
+                          version: pinejs-client-js-5.4.0
+                          date: 2019-05-10T09:57:46.863Z
+                        - commits:
+                            - subject: Deduplicate transformation of GET results
+                              hash: dd856e24072f652684adf63af97408ee0ba7389c
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: pinejs-client-js-5.3.10
+                          date: 2019-05-10T09:44:09.422Z
+                        - commits:
+                            - subject: >-
+                                Simplify how we expose types, which means
+                                `subscribe` is now exposed
+                              hash: f81e0cc59e75e0f9ffc71d9f122b9cfab9c05165
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: pinejs-client-js-5.3.9
+                          date: 2019-05-10T08:57:16.276Z
+                        - commits:
+                            - subject: Add automatic formatting via prettier
+                              hash: a345d32f295acfa8ed4e5b815c24e1e7fdb335f2
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: pinejs-client-js-5.3.8
+                          date: 2019-05-09T17:38:43.260Z
+                        - commits:
+                            - subject: 'Remove node 4 build, add node 12'
+                              hash: 8d549277d80746feadbdd8a6bba37eb076270440
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                            - subject: >-
+                                Add .versionbot/CHANGELOG.yml for downstream
+                                changelogs
+                              hash: 067bedf65e86a902b7334ed6e5f117d6ac41afde
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: pinejs-client-js-5.3.7
+                          date: 2019-05-08T15:41:50.201Z
+                        - commits:
+                            - subject: Add node 12 tests
+                              hash: a6cc208654a36228a35fb8d8886e62bccc3c9fa4
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                            - subject: Add repo.yml for upstream changelogs
+                              hash: e50ca4f49d80b3e89d37f7d8bf6607b0f797c7ae
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                            - subject: >-
+                                Add .versionbot/CHANGELOG.yml for downstream
+                                changelogs
+                              hash: 9d68e94757f2f9498dedf3d6f085ce77ea70652a
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: odata-to-abstract-sql-3.1.2
+                          date: 2019-05-08T15:52:48.099Z
+                        - commits:
+                            - subject: >-
+                                Add .versionbot/CHANGELOG.yml for downstream
+                                changelogs
+                              hash: cc2e3e23030521788c127b5750abf3c65645a710
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: sbvr-types-2.0.3
+                          date: 2019-05-08T14:29:46.824Z
+                        - commits:
+                            - subject: >-
+                                Add .versionbot/CHANGELOG.yml for downstream
+                                changelogs
+                              hash: 45c5843b204def5a727b8ba8dfafb2a2347f50f3
+                              body: ''
+                              footer:
+                                Change-type: patch
+                                change-type: patch
+                              author: Pagan Gazzard
+                          version: sbvr-parser-0.2.2
+                          date: 2019-05-08T14:23:57.847Z
+                  version: pinejs-10.14.0
+                  date: 2019-05-15T14:12:22.538Z
+                - commits:
+                    - subject: >-
+                        Fix possible null error when using a parameter alias
+                        with no value
+                      hash: ee0cb996e27a2234eb62608152230074a614cc4e
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                      author: Pagan Gazzard
+                  version: pinejs-10.13.3
+                  date: 2019-05-14T11:01:52.288Z
+                - commits:
+                    - subject: Add repo.yml for nested changelogs
+                      hash: 02a34373d90f29b5ec06f9ae9823d87207fbb577
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                      author: Pagan Gazzard
+                  version: pinejs-10.13.2
+                  date: 2019-05-08T15:09:50.814Z
+                - commits:
+                    - subject: Add node 12 to the circle tests
+                      hash: 7ae335dce37abf005daaa2e43239ed26ae2519de
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                      author: Pagan Gazzard
+                  version: pinejs-10.13.1
+                  date: 2019-05-06T21:37:25.704Z
+                - commits:
+                    - subject: Expose odata-compiler as a bin script
+                      hash: cf86826e0d6653c456057d4de8d849d00ffc023f
+                      body: >
+                        This means that it will now match the module
+                        dependencies of the
+
+                        installed pinejs
+                      footer:
+                        Change-type: minor
+                        change-type: minor
+                      author: Pagan Gazzard
+                  version: pinejs-10.13.0
+                  date: 2019-05-06T17:33:54.911Z
+                - commits:
+                    - subject: Expose sbvr-compiler as a bin script
+                      hash: e6718ffe901b4d711f47493ff907ee1fe2f947e0
+                      body: >
+                        This means that it will now match the module
+                        dependencies of the
+
+                        installed pinejs
+                      footer:
+                        Change-type: minor
+                        change-type: minor
+                      author: Pagan Gazzard
+                    - subject: >-
+                        Move odata-metadata-generator into odata-metadata
+                        directory
+                      hash: d414696ff13c9d9f2183f44eda434d0da8d26f01
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                      author: Pagan Gazzard
+                  version: pinejs-10.12.0
+                  date: 2019-05-01T13:08:20.878Z
+                - commits:
+                    - subject: >-
+                        Update @types/lodash, avoiding `_.isObject` where
+                        necessary
+                      hash: 77a281beef4e9b82c6070dba3027ddd606e4c08b
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                      author: Pagan Gazzard
+                  version: pinejs-10.11.3
+                  date: 2019-05-01T11:07:54.197Z
+                - commits:
+                    - subject: >-
+                        Only validate the model if the query affected at least 1
+                        row
+                      hash: 8bfd0a1f1cd45a837957f210979ec910e0e46261
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                      author: Pagan Gazzard
+                  version: pinejs-10.11.2
+                  date: 2019-04-22T13:42:40.543Z
+                - commits:
+                    - subject: >-
+                        Switch odata-metadata-generator to using an abstract sql
+                        model
+                      hash: 9cf5c16b50f7371552cb8876dd5ca724cccdf911
+                      body: ''
+                      footer:
+                        Change-type: patch
+                        change-type: patch
+                      author: Pagan Gazzard
+                  version: pinejs-10.11.1
+                  date: 2019-04-11T16:03:38.840Z
+          version: open-balena-api-0.19.1
+          date: 2019-05-15T19:19:14.258Z
+        - commits:
+            - subject: Update target to es2018
+              hash: b3bab02244ae85e4805db95eec92a3ae61fb0d92
+              body: ''
+              footer:
+                Change-type: minor
+                change-type: minor
+              author: Pagan Gazzard
+          version: open-balena-api-0.19.0
+          date: 2019-05-15T15:25:47.366Z
+        - commits:
+            - subject: 'bug: Resolve NPM dependency issues preventing startup'
+              hash: 13842dee794bd12465ba97572a7a3ee0a19b7fc6
+              body: |
+                Add `ts-node` as a dependency, as it had been marked as devOnly
+                in a previous PR.
+              footer:
+                Change-type: patch
+                change-type: patch
+                Signed-off-by: Rich Bayliss <rich@balena.io>
+                signed-off-by: Rich Bayliss <rich@balena.io>
+              author: Rich Bayliss
+          version: open-balena-api-0.18.6
+          date: 2019-05-10T11:05:12.524Z
+        - commits:
+            - subject: Add typed-error upstream to repo.yml
+              hash: d50d88a873988aa2c9cf1f50ed721fbf92565869
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+            - subject: Add open-balena-base upstream to repo.yml
+              hash: 2d039de7c4c8f8728a5a5af931fa83f55ef2a303
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+          version: open-balena-api-0.18.5
+          date: 2019-05-08T16:12:46.186Z
+        - commits:
+            - subject: Disable the service start limit
+              hash: d69d9b2355616685dfb570be6aa6c14ccc97a7c2
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+            - subject: Update open-balena-base to v7.0.2
+              hash: d363fa289386f39de9af1bc3a3eb0690b35d9ea0
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+          version: open-balena-api-0.18.4
+          date: 2019-05-06T11:23:47.208Z
+        - commits:
+            - subject: 'tests: Add test framework'
+              hash: 52c6eebcc45f637d15b48b7ea7942e6011b891eb
+              body: |
+                Add a test framework to allow testing of the openBalena API
+
+                Added CircleCI pipeline to run tests.
+              footer:
+                Change-type: patch
+                change-type: patch
+                Signed-off-by: Rich Bayliss <rich@balena.io>
+                signed-off-by: Rich Bayliss <rich@balena.io>
+              author: Rich Bayliss
+          version: open-balena-api-0.18.3
+          date: 2019-05-01T09:06:36.206Z
+        - commits:
+            - subject: Fix import ordering issue
+              hash: d4f207d8b7d9c55ef0f173fd3e58d20d46a964bc
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+              author: Pagan Gazzard
+          version: open-balena-api-0.18.2
+          date: 2019-04-29T12:32:17.257Z
+        - commits:
+            - subject: 'versionbot: add machine readable changelog'
+              hash: 95c57fb121cda374e36e45aaf82ee36877e8b82f
+              body: ''
+              footer:
+                Change-type: patch
+                change-type: patch
+                Signed-off-by: Gergely Imreh <gergely@balena.io>
+                signed-off-by: Gergely Imreh <gergely@balena.io>
+              author: Gergely Imreh
+          version: open-balena-api-0.18.1
+          date: 2019-04-29T11:23:22.500Z
+        - commits:
+            - author: Gergely Imreh
+              body: |-
+                That OS version and upwards have docker with capability to pull
+                from registry v2.
+              footers:
+                change-type: minor
+                signed-off-by: Gergely Imreh <gergely@balena.io>
+              hash: 9fa9f17256d3c975f1fa590d5d132433d1b20646
+              subject: >-
+                device-config: allow devices going back to v1.2.1 to use
+                registry v2
+          date: '2019-04-29T09:32:40Z'
+          version: open-balena-api-0.18.0
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: patch
+              hash: 41b3e535f633862c8191c0ee94b2a089179316ef
+              subject: Handle requesting registry scopes with explicit indices above 20
+          date: '2019-04-26T19:16:24Z'
+          version: open-balena-api-0.17.4
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: patch
+              hash: 501a5cb839d7bd6e24a4e702c9b2d55f6a7ccdae
+              subject: Use more accurate `BadRequestError`s for invalid env var names
+            - author: Pagan Gazzard
+              body: ''
+              hash: ec8543f76672e23a36353f2d38444f74867a3e64
+              subject: Remove unnecessary `nameProp` argument from `addEnvHooks`
+            - author: Pagan Gazzard
+              body: ''
+              hash: 8ca26a0368feaf72a40d528fc462dbb953426797
+              subject: Avoid unnecessary object creation on env var validation
+          date: '2019-04-26T09:24:50Z'
+          version: open-balena-api-0.17.3
+        - commits:
+            - author: Will Boyce
+              body: >-
+                Allowing the server to dictate when keys are renegotiated allows
+                us to
+
+                control load spikes more effectively.
+              footers:
+                change-type: patch
+                signed-off-by: Will Boyce <will@balena.io>
+              hash: de52f7e24057f12b0b9381d462ca1d0d0ea5a8d6
+              subject: 'os-config: disable client-initiated vpn tls key renegotiation'
+          date: '2019-04-24T12:32:57Z'
+          version: open-balena-api-0.17.2
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: patch
+              hash: f4676ba5237d374c9148db9855e7e0ce29bddb38
+              subject: Remove unused `DEVICE_CONFIG_OPENVPN_CONFIG` fron env backend
+          date: '2019-04-19T14:06:00Z'
+          version: open-balena-api-0.17.1
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: minor
+              hash: ef31eaefa2c75a3e6f61268bdc60af4b1e39f970
+              subject: Rename `env_var_name` to `name` to match cloud
+          date: '2019-04-18T15:54:23Z'
+          version: open-balena-api-0.17.0
+        - commits:
+            - author: Rich Bayliss
+              body: |-
+                Add missing changes to make the `my_application` resource return
+                results, instead of throwing an exception.
+              footers:
+                change-type: patch
+                signed-off-by: Rich Bayliss <rich@balena.io>
+              hash: 065454c21c7308b9e51395186a8023fc3b11b6a7
+              subject: >-
+                fix: Changes required to make `my_application` resource
+                available
+          date: '2019-04-18T13:38:33Z'
+          version: open-balena-api-0.16.1
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: minor
+              hash: 12bab4ff126f8156afa8aa1ad62f8776746d7c6e
+              subject: Handle `my_applications` within pinejs
+          date: '2019-04-17T14:18:41Z'
+          version: open-balena-api-0.16.0
+        - commits:
+            - author: Will Boyce
+              body: ''
+              footers:
+                change-type: patch
+                signed-off-by: Will Boyce <will@balena.io>
+              hash: 285091d355eb71099925d8e0eb5748aa50213de5
+              subject: 'device-proxy: use `.balena` tld in favour of `.resin`'
+          date: '2019-04-17T12:13:03Z'
+          version: open-balena-api-0.15.2
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: patch
+              hash: 76063693f447bdd155abe12004d52e51831fe7a9
+              subject: Update method-override to 3.x
+          date: '2019-04-17T09:52:51Z'
+          version: open-balena-api-0.15.1
+        - commits:
+            - author: Pagan Gazzard
+              body: |-
+                Also splits index.js to make sure the bulk of it is typed
+                Update pinejs from 10.8.0 to 10.11.0
+              footers:
+                change-type: minor
+              hash: 384f53606795d4b565d8a851b86316ce4fcfbcb9
+              subject: >-
+                Rename `configPath` to `config` and make sure config.json is
+                valid
+          date: '2019-04-15T18:37:57Z'
+          version: open-balena-api-0.15.0
+        - commits:
+            - author: Pablo Carranza Velez
+              body: >-
+                Added to the supervisor in
+                https://github.com/balena-io/balena-supervisor/pull/934
+
+                We add this variable to the whitelist and add the information so
+                that the UI can show it and allow changing it.
+              footers:
+                change-type: minor
+                signed-off-by: Pablo Carranza Velez <pablocarranza@gmail.com>
+              hash: ed41b29c8211d37897f656ed5b55594f3317aebe
+              subject: >-
+                Whitelist the new RESIN_SUPERVISOR_INSTANT_UPDATE_TRIGGER
+                configuration variable
+          date: '2019-04-11T18:27:19Z'
+          version: open-balena-api-0.14.0
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: patch
+              hash: f827088cd504c62753390d2f3929d9b9de708914
+              subject: Fix `ResolvableReturnType` typing
+          date: '2019-04-02T15:20:27Z'
+          version: open-balena-api-0.13.3
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: patch
+              hash: c0e11d4fd0080a74ca67568062ec8133fa9deb68
+              subject: Add CODEOWNERS file
+          date: '2019-04-01T13:32:08Z'
+          version: open-balena-api-0.13.2
+        - commits:
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: patch
+              hash: da963b34c86e0f3a5bb7caefcf5cfad82a1de49e
+              subject: Add an index for the vpn's service instance lookup
+          date: '2019-04-01T13:18:22Z'
+          version: open-balena-api-0.13.1
+        - commits:
+            - author: Pagan Gazzard
+              body: Update pinejs from 10.6.1 to 10.8.0
+              footers:
+                change-type: patch
+              hash: 4f7200e14388b379e4b068a64acbf2d4f4d62a9c
+              subject: Use a readTransaction for device state
+            - author: Pagan Gazzard
+              body: ''
+              footers:
+                change-type: minor
+              hash: 1f5005153dcf8aeb20622b6f23cc0131b9afd74a
+              subject: >-
+                Remove runInTransaction wrapper to avoid unnecessary function
+                creation
+            - author: Pagan Gazzard
+              body: ''
+              hash: 4ce469103710955e23754b09a94f8d1793cf82bc
+              subject: Avoid need to repeateadly check for `readTransaction` existence
+          date: '2019-03-28T11:00:59Z'
+          version: open-balena-api-0.13.0
+        - commits:
+            - author: Stevche Radevski
+              body: |-
+                This will allow us to store the pre
+                and post-image build logs as shown in
+                the terminal.
+              footers:
+                change-type: minor
+                signed-off-by: Stevche Radevski <stevche@balena.io>
+              hash: e781deead7e08e4fc35e33769ab8262fdc941f2b
+              subject: Add build log to release resource
+          date: '2019-03-19T14:19:56Z'
+          version: open-balena-api-0.12.0
+  version: 1.2.0
+  date: 2019-05-21T14:52:12.117Z
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -4,6 +4,392 @@ All notable changes to this project will be documented in this file
 automatically by Versionist. DO NOT EDIT THIS FILE MANUALLY!
 This project adheres to [Semantic Versioning](http://semver.org/).

+# v2.0.1
+## (2020-01-17)
+
+* cert-provider: Update to support ACMEv2 on staging provider [Rich Bayliss]
+
+# v2.0.0
+## (2019-09-02)
+
+* feature: Use S3 bucket for Registry service backend [Rich Bayliss]
+
+# v1.3.0
+## (2019-07-30)
+
+* services: Update Registry service version [Rich Bayliss]
+* feature: Support deployment via balena push to local-mode balenaOS devices [Rich Bayliss]
+
+# v1.2.0
+## (2019-05-21)
+
+* tidy: Remove unused DEVICE_CONFIG_OPENVPN_CONFIG variable [Rich Bayliss]
+* services: Update Registry service version [Akis Kesoglou]
+* services: Update API service version [Rich Bayliss]
+
+<details>
+<summary> View details </summary>
+
+## open-balena-api-0.19.5
+### (2019-05-20)
+
+* Update typed-error to 3.1.0 [Pagan Gazzard]
+
+<details>
+<summary> View details </summary>
+
+### typed-error-3.1.0
+#### (2019-04-01)
+
+* dev: Enforce prettier coding standards [Will Boyce]
+* npm: Update dependencies and remove `package-lock.json` [Will Boyce]
+* codeowners: Add top contributors @wrboyce, @Page-, and @dfunckt [Will Boyce]
+* versionbot: Add CHANGELOG.yml (for nested changelogs) [Will Boyce]
+
+### typed-error-3.0.2
+#### (2018-11-01)
+
+* Update README with new import style [CameronDiver]
+
+### typed-error-3.0.1
+#### (2018-10-29)
+
+* Update to typescript 3 [Pagan Gazzard]
+* Update dev dependencies [Pagan Gazzard]
+* Add node-10 to the circle test suite [Pagan Gazzard]
+
+### typed-error-3.0.0
+#### (2018-04-17)
+
+* Distribute generated typescript declaration [Will Boyce]
+* use circle for build/publish and add package-lock [Will Boyce]
+* add lint scripts/requirements [Will Boyce]
+* Remove `BaseError` class and  directly subclass `Error` [Will Boyce]
+* Update dependencies, clean up package/tsconfig [Will Boyce]
+
+### typed-error-2.0.1
+#### (2017-12-15)
+
+* Add LICENSE [Akis Kesoglou]
+</details>
+
+
+## open-balena-api-0.19.4
+### (2019-05-20)
+
+* Some linting fixes for resin-lint 3 [Pagan Gazzard]
+
+## open-balena-api-0.19.3
+### (2019-05-17)
+
+* Silence expected API key related rejections [Akis Kesoglou]
+
+## open-balena-api-0.19.2
+### (2019-05-17)
+
+* Update dependencies [Pagan Gazzard]
+
+## open-balena-api-0.19.1
+### (2019-05-15)
+
+* Make use of a prepared query for device state query [Pagan Gazzard]
+* Update pinejs to 10.14.0 [Pagan Gazzard]
+
+<details>
+<summary> View details </summary>
+
+### pinejs-10.14.0
+#### (2019-05-15)
+
+* Update pinejs-client-core and make use of prepared queries [Pagan Gazzard]
+
+<details>
+<summary> View details </summary>
+
+#### odata-parser-1.0.3
+##### (2019-05-08)
+
+* Add .versionbot/CHANGELOG.yml for downstream changelogs [Pagan Gazzard]
+
+#### odata-parser-1.0.2
+##### (2019-04-15)
+
+* Update dependencies [Pagan Gazzard]
+
+#### abstract-sql-compiler-6.4.2
+##### (2019-05-09)
+
+* Update and fix lodash typings [Pagan Gazzard]
+* Update husky/mocha dev dependencies [Pagan Gazzard]
+
+#### abstract-sql-compiler-6.4.1
+##### (2019-05-08)
+
+* Fix typescript compilation [Pagan Gazzard]
+
+<details>
+<summary> View details </summary>
+
+##### sbvr-parser-0.2.2
+###### (2019-05-08)
+
+* Add .versionbot/CHANGELOG.yml for downstream changelogs [Pagan Gazzard]
+</details>
+
+* Add node 12 tests [Pagan Gazzard]
+* Add repo.yml for upstream changelogs [Pagan Gazzard]
+* Add .versionbot/CHANGELOG.yml for downstream changelogs [Pagan Gazzard]
+
+#### pinejs-client-js-5.5.1
+##### (2019-05-15)
+
+* Fix downstream declaration creation errors due to `Dictionary` [Pagan Gazzard]
+
+#### pinejs-client-js-5.5.0
+##### (2019-05-15)
+
+* Add a prepare method that prepares a query into a function [Pagan Gazzard]
+
+#### pinejs-client-js-5.4.1
+##### (2019-05-10)
+
+* Add CODEOWNERS [Gergely Imreh]
+
+#### pinejs-client-js-5.4.0
+##### (2019-05-10)
+
+* Add support for parameter aliases in resource ids [Pagan Gazzard]
+
+#### pinejs-client-js-5.3.10
+##### (2019-05-10)
+
+* Deduplicate transformation of GET results [Pagan Gazzard]
+
+#### pinejs-client-js-5.3.9
+##### (2019-05-10)
+
+* Simplify how we expose types, which means `subscribe` is now exposed [Pagan Gazzard]
+
+#### pinejs-client-js-5.3.8
+##### (2019-05-09)
+
+* Add automatic formatting via prettier [Pagan Gazzard]
+
+#### pinejs-client-js-5.3.7
+##### (2019-05-08)
+
+* Remove node 4 build, add node 12 [Pagan Gazzard]
+* Add .versionbot/CHANGELOG.yml for downstream changelogs [Pagan Gazzard]
+
+#### odata-to-abstract-sql-3.1.2
+##### (2019-05-08)
+
+* Add node 12 tests [Pagan Gazzard]
+* Add repo.yml for upstream changelogs [Pagan Gazzard]
+* Add .versionbot/CHANGELOG.yml for downstream changelogs [Pagan Gazzard]
+
+#### sbvr-types-2.0.3
+##### (2019-05-08)
+
+* Add .versionbot/CHANGELOG.yml for downstream changelogs [Pagan Gazzard]
+
+#### sbvr-parser-0.2.2
+##### (2019-05-08)
+
+* Add .versionbot/CHANGELOG.yml for downstream changelogs [Pagan Gazzard]
+</details>
+
+
+### pinejs-10.13.3
+#### (2019-05-14)
+
+* Fix possible null error when using a parameter alias with no value [Pagan Gazzard]
+
+### pinejs-10.13.2
+#### (2019-05-08)
+
+* Add repo.yml for nested changelogs [Pagan Gazzard]
+
+### pinejs-10.13.1
+#### (2019-05-06)
+
+* Add node 12 to the circle tests [Pagan Gazzard]
+
+### pinejs-10.13.0
+#### (2019-05-06)
+
+* Expose odata-compiler as a bin script [Pagan Gazzard]
+
+### pinejs-10.12.0
+#### (2019-05-01)
+
+* Expose sbvr-compiler as a bin script [Pagan Gazzard]
+* Move odata-metadata-generator into odata-metadata directory [Pagan Gazzard]
+
+### pinejs-10.11.3
+#### (2019-05-01)
+
+* Update @types/lodash, avoiding `_.isObject` where necessary [Pagan Gazzard]
+
+### pinejs-10.11.2
+#### (2019-04-22)
+
+* Only validate the model if the query affected at least 1 row [Pagan Gazzard]
+
+### pinejs-10.11.1
+#### (2019-04-11)
+
+* Switch odata-metadata-generator to using an abstract sql model [Pagan Gazzard]
+</details>
+
+
+## open-balena-api-0.19.0
+### (2019-05-15)
+
+* Update target to es2018 [Pagan Gazzard]
+
+## open-balena-api-0.18.6
+### (2019-05-10)
+
+* bug: Resolve NPM dependency issues preventing startup [Rich Bayliss]
+
+## open-balena-api-0.18.5
+### (2019-05-08)
+
+* Add typed-error upstream to repo.yml [Pagan Gazzard]
+* Add open-balena-base upstream to repo.yml [Pagan Gazzard]
+
+## open-balena-api-0.18.4
+### (2019-05-06)
+
+* Disable the service start limit [Pagan Gazzard]
+* Update open-balena-base to v7.0.2 [Pagan Gazzard]
+
+## open-balena-api-0.18.3
+### (2019-05-01)
+
+* tests: Add test framework [Rich Bayliss]
+
+## open-balena-api-0.18.2
+### (2019-04-29)
+
+* Fix import ordering issue [Pagan Gazzard]
+
+## open-balena-api-0.18.1
+### (2019-04-29)
+
+* versionbot: add machine readable changelog [Gergely Imreh]
+
+## open-balena-api-0.18.0
+### (2019-04-29)
+
+* device-config: allow devices going back to v1.2.1 to use registry v2 [Gergely Imreh]
+
+## open-balena-api-0.17.4
+### (2019-04-26)
+
+* Handle requesting registry scopes with explicit indices above 20 [Pagan Gazzard]
+
+## open-balena-api-0.17.3
+### (2019-04-26)
+
+* Use more accurate `BadRequestError`s for invalid env var names [Pagan Gazzard]
+* Remove unnecessary `nameProp` argument from `addEnvHooks` [Pagan Gazzard]
+* Avoid unnecessary object creation on env var validation [Pagan Gazzard]
+
+## open-balena-api-0.17.2
+### (2019-04-24)
+
+* os-config: disable client-initiated vpn tls key renegotiation [Will Boyce]
+
+## open-balena-api-0.17.1
+### (2019-04-19)
+
+* Remove unused `DEVICE_CONFIG_OPENVPN_CONFIG` fron env backend [Pagan Gazzard]
+
+## open-balena-api-0.17.0
+### (2019-04-18)
+
+* Rename `env_var_name` to `name` to match cloud [Pagan Gazzard]
+
+## open-balena-api-0.16.1
+### (2019-04-18)
+
+* fix: Changes required to make `my_application` resource available [Rich Bayliss]
+
+## open-balena-api-0.16.0
+### (2019-04-17)
+
+* Handle `my_applications` within pinejs [Pagan Gazzard]
+
+## open-balena-api-0.15.2
+### (2019-04-17)
+
+* device-proxy: use `.balena` tld in favour of `.resin` [Will Boyce]
+
+## open-balena-api-0.15.1
+### (2019-04-17)
+
+* Update method-override to 3.x [Pagan Gazzard]
+
+## open-balena-api-0.15.0
+### (2019-04-15)
+
+* Rename `configPath` to `config` and make sure config.json is valid [Pagan Gazzard]
+
+## open-balena-api-0.14.0
+### (2019-04-11)
+
+* Whitelist the new RESIN_SUPERVISOR_INSTANT_UPDATE_TRIGGER configuration variable [Pablo Carranza Velez]
+
+## open-balena-api-0.13.3
+### (2019-04-02)
+
+* Fix `ResolvableReturnType` typing [Pagan Gazzard]
+
+## open-balena-api-0.13.2
+### (2019-04-01)
+
+* Add CODEOWNERS file [Pagan Gazzard]
+
+## open-balena-api-0.13.1
+### (2019-04-01)
+
+* Add an index for the vpn's service instance lookup [Pagan Gazzard]
+
+## open-balena-api-0.13.0
+### (2019-03-28)
+
+* Use a readTransaction for device state [Pagan Gazzard]
+* Remove runInTransaction wrapper to avoid unnecessary function creation [Pagan Gazzard]
+* Avoid need to repeateadly check for `readTransaction` existence [Pagan Gazzard]
+
+## open-balena-api-0.12.0
+### (2019-03-19)
+
+* Add build log to release resource [Stevche Radevski]
+</details>
+
+# v1.1.1
+## (2019-05-07)
+
+* docker: Update docker-compose version to latest [Heds Simons]
+
+# v1.1.0
+## (2019-05-07)
+
+* s3: Update to latest version with credentials [Heds Simons]
+
+# v1.0.2
+## (2019-04-17)
+
+* scripts: Handle missing coreutils on Mac [Roman Mazur]
+
+# v1.0.1
+## (2019-03-20)
+
+* vpn: Remove BALENA_ROOT_CA from the VPN trust chain [Rich Bayliss]
+
 # v1.0.0
 ## (2019-03-15)

--- a/2
+++ b/2
@ -1 +1 @@
-1.0.0
+2.0.1
--- a/8
+++ b/8
@ -20,15 +20,21 @@ Vagrant.configure('2') do |config|
  config.ssh.forward_agent = true

  config.vm.provision :docker
-  config.vm.provision :docker_compose

  $provision = <<-SCRIPT
+    DOCKER_COMPOSE_VERSION=1.24.0
+
    touch /home/vagrant/.bashrc
    grep -Fxq 'source /home/vagrant/openbalena/.openbalenarc' /home/vagrant/.bashrc || echo 'source /home/vagrant/openbalena/.openbalenarc' >> /home/vagrant/.bashrc

    curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.34.0/install.sh | bash
    source "/home/vagrant/.nvm/nvm.sh" # This loads nvm
    nvm install 10.15.0 && nvm use 10.15.0
+
+    # Install a newer version of docker-compose
+    (cd /usr/local/bin; \
+    sudo curl -o docker-compose --silent --location https://github.com/docker/compose/releases/download/$DOCKER_COMPOSE_VERSION/docker-compose-Linux-x86_64; \
+    sudo chmod a+x docker-compose)
  SCRIPT

  config.vm.provision :shell, privileged: false, inline: $provision
--- a/compose/common.yml
+++ b/compose/common.yml
@ -1,4 +1,4 @@
-version: '2.1'
+version: "2.0"

 services:
  component:
--- a/compose/mdns.yml
+++ b/compose/mdns.yml
@ -0,0 +1,31 @@
+version: "2.0"
+
+services:
+  balena-mdns-publisher:
+    image: balena/balena-mdns-publisher:${OPENBALENA_MDNS_PUBLISHER_VERSION_TAG}
+    network_mode: "host"
+    cap_add:
+        - SYS_RESOURCE
+        - SYS_ADMIN
+    security_opt:
+        - apparmor:unconfined
+    tmpfs:
+        - /run
+        - /sys/fs/cgroup
+    # balenaOS - Required for host DBus comms. Not required for standalone Linux
+    labels:
+        io.balena.features.dbus: '1'
+        io.balena.features.supervisor-api: '1'
+    environment:
+        CONFD_BACKEND: ENV
+        # The name of the TLD to use. This *must* match certificates used for the rest of
+        # the resin backend (eg. that for BALENA_ROOT_CA if present).
+        MDNS_TLD: ${OPENBALENA_HOST_NAME}
+        # List of subdomains to advertise. This must include all required hosts.
+        MDNS_SUBDOMAINS: '["api", "db", "registry", "s3", "vpn"]'
+        # The expectation is the DBus socket to use is always at the following location.
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/host/run/dbus/system_bus_socket"
+        # Selects the interface used for incoming connections from the wider subnet.
+        # For NUCs, this is `eno1`. If running natively, pick the appropriate interface.
+        # Alternatively, keep the default commented out to autoselect.
+        #INTERFACE: "eno1"
--- a/compose/services.yml
+++ b/compose/services.yml
@ -1,4 +1,4 @@
-version: "2.1"
+version: "2.0"

 volumes:
  certs: {}
@ -13,7 +13,7 @@ services:
    extends:
      file: ./common.yml
      service: component
-    image: balena/open-balena-api:${OPENBALENA_API_VERSION_TAG:-master}
+    image: balena/open-balena-api:${OPENBALENA_API_VERSION_TAG}
    depends_on:
      - db
      - s3
@ -27,7 +27,6 @@ services:
      DB_PORT: 5432
      DB_USER: docker
      DELTA_HOST: delta.${OPENBALENA_HOST_NAME}
-      DEVICE_CONFIG_OPENVPN_CONFIG: ${OPENBALENA_VPN_CONFIG}
      DEVICE_CONFIG_OPENVPN_CA: ${OPENBALENA_VPN_CA_CHAIN}
      DEVICE_CONFIG_SSH_AUTHORIZED_KEYS: ${OPENBALENA_SSH_AUTHORIZED_KEYS}
      HOST: api.${OPENBALENA_HOST_NAME}
@ -45,7 +44,7 @@ services:
      REDIS_PORT: 6379
      REGISTRY2_HOST: registry.${OPENBALENA_HOST_NAME}
      REGISTRY_HOST: registry.${OPENBALENA_HOST_NAME}
-      SENTRY_DSN:
+      SENTRY_DSN: ""
      TOKEN_AUTH_BUILDER_TOKEN: ${OPENBALENA_TOKEN_AUTH_BUILDER_TOKEN}
      TOKEN_AUTH_CERT_ISSUER: api.${OPENBALENA_HOST_NAME}
      TOKEN_AUTH_CERT_KEY: ${OPENBALENA_TOKEN_AUTH_KEY}
@ -62,9 +61,8 @@ services:
    extends:
      file: ./common.yml
      service: component
-    image: balena/open-balena-registry:${OPENBALENA_REGISTRY_VERSION_TAG:-master}
+    image: balena/open-balena-registry:${OPENBALENA_REGISTRY_VERSION_TAG}
    depends_on:
-      - api
      - s3
      - redis
    volumes:
@ -75,10 +73,16 @@ services:
      BALENA_ROOT_CA: ${OPENBALENA_ROOT_CA}
      BALENA_TOKEN_AUTH_ISSUER: api.${OPENBALENA_HOST_NAME}
      BALENA_TOKEN_AUTH_REALM: https://api.${OPENBALENA_HOST_NAME}/auth/v1/token
-      COMMON_REGION:
-      REGISTRY2_S3_BUCKET:
-      REGISTRY2_S3_KEY:
-      REGISTRY2_S3_SECRET:
+      COMMON_REGION: ${OPENBALENA_S3_REGION}
+      REGISTRY2_CACHE_ENABLED: "false"
+      REGISTRY2_CACHE_ADDR: 127.0.0.1:6379
+      REGISTRY2_CACHE_DB: 0
+      REGISTRY2_CACHE_MAXMEMORY_MB: 1024 # megabytes
+      REGISTRY2_CACHE_MAXMEMORY_POLICY: allkeys-lru
+      REGISTRY2_S3_REGION_ENDPOINT: ${OPENBALENA_S3_ENDPOINT}
+      REGISTRY2_S3_BUCKET: ${OPENBALENA_REGISTRY2_S3_BUCKET}
+      REGISTRY2_S3_KEY: ${OPENBALENA_S3_ACCESS_KEY}
+      REGISTRY2_S3_SECRET: ${OPENBALENA_S3_SECRET_KEY}
      REGISTRY2_SECRETKEY: ${OPENBALENA_REGISTRY_SECRET_KEY}
      REGISTRY2_STORAGEPATH: /data

@ -86,7 +90,7 @@ services:
    extends:
      file: ./common.yml
      service: component
-    image: balena/open-balena-vpn:${OPENBALENA_VPN_VERSION_TAG:-master}
+    image: balena/open-balena-vpn:${OPENBALENA_VPN_VERSION_TAG}
    depends_on:
      - api
    cap_add:
@ -98,7 +102,7 @@ services:
      BALENA_VPN_PORT: 443
      PRODUCTION_MODE: "${OPENBALENA_PRODUCTION_MODE}"
      RESIN_VPN_GATEWAY: 10.2.0.1
-      SENTRY_DSN:
+      SENTRY_DSN: ""
      VPN_HAPROXY_USEPROXYPROTOCOL: "true"
      VPN_OPENVPN_CA_CRT: ${OPENBALENA_VPN_CA}
      VPN_OPENVPN_SERVER_CRT: ${OPENBALENA_VPN_SERVER_CRT}
@ -110,17 +114,21 @@ services:
    extends:
      file: ./common.yml
      service: system
-    image: balena/open-balena-db:${OPENBALENA_DB_VERSION_TAG:-master}
+    image: balena/open-balena-db:${OPENBALENA_DB_VERSION_TAG}
    volumes:
      - db:/var/lib/postgresql/data

  s3:
    extends:
      file: ./common.yml
-      service: system
-    image: balena/open-balena-s3:${OPENBALENA_S3_VERSION_TAG:-master}
+      service: component
+    image: balena/open-balena-s3:${OPENBALENA_S3_VERSION_TAG}
    volumes:
      - s3:/export
+    environment:
+      S3_MINIO_ACCESS_KEY: ${OPENBALENA_S3_ACCESS_KEY}
+      S3_MINIO_SECRET_KEY: ${OPENBALENA_S3_SECRET_KEY}
+      BUCKETS: ${OPENBALENA_S3_BUCKETS}

  redis:
    extends:
@ -134,7 +142,7 @@ services:
    extends:
      file: ./common.yml
      service: system
-    build: ../haproxy
+    build: ../src/haproxy
    depends_on:
      - api
      - cert-provider
@ -169,7 +177,7 @@ services:
      - certs:/certs:ro

  cert-provider:
-    build: ../cert-provider
+    build: ../src/cert-provider
    volumes:
      - certs:/certs
      - cert-provider:/usr/src/app/certs
--- a/compose/template.yml
+++ b/compose/template.yml
@ -7,4 +7,4 @@
 # `compose/services.yml` as the "base" config.
 #
 # You may view the effective config with `scripts/compose config`.
-version: '2.1'
+version: "2.0"
--- a/compose/versions
+++ b/compose/versions
@ -1,5 +1,6 @@
-export OPENBALENA_API_VERSION_TAG=v0.11.8
+export OPENBALENA_API_VERSION_TAG=v0.19.5
 export OPENBALENA_DB_VERSION_TAG=v2.0.3
-export OPENBALENA_REGISTRY_VERSION_TAG=v2.5.0
-export OPENBALENA_S3_VERSION_TAG=v2.5.0
+export OPENBALENA_MDNS_PUBLISHER_VERSION_TAG=v1.6.2
+export OPENBALENA_REGISTRY_VERSION_TAG=v2.11.1
+export OPENBALENA_S3_VERSION_TAG=v2.8.5
 export OPENBALENA_VPN_VERSION_TAG=v8.10.0
--- a/repo.yml
+++ b/repo.yml
@ -1,2 +1,15 @@
-type: 'generic'
+type: "generic"
 reviewers: 1
+upstream:
+  - repo: open-balena-api
+    url: https://github.com/balena-io/open-balena-api
+  - repo: open-balena-vpn
+    url: https://github.com/balena-io/open-balena-vpn
+  - repo: open-balena-registry
+    url: https://github.com/balena-io/open-balena-registry
+  - repo: open-balena-db
+    url: https://github.com/balena-io/open-balena-db
+  - repo: open-balena-s3
+    url: https://github.com/balena-io/open-balena-s3
+  - repo: balena-mdns-publisher
+    url: https://github.com/balena-io/balena-mdns-publisher
--- a/scripts/_realpath
+++ b/scripts/_realpath
@ -1,5 +1,11 @@
 #!/bin/bash -e

+echo_error() {
+    local RED=`tput setaf 1`
+    local RESET=`tput sgr0`
+    echo "${RED}ERROR: ${1}${RESET}"
+}
+
 REALPATH=
 REALPATHS=(
    'realpath'
@ -14,8 +20,13 @@ fi
 done

 if [ -z "${REALPATH}" ]; then
-    local RED=`tput setaf 1`
-    echo "${RED}ERROR: Unable to find suitable command for realpath."
+    echo_error 'Unable to find suitable command for realpath.'
+    if [ $(uname) == 'Darwin' ]; then
+        echo 'GNU coreutils are required to build openBalena on macOS. To install with brew, run'
+        echo ''
+        echo '    brew install coreutils'
+        echo ''
+    fi
    exit 1
 fi

--- a/scripts/compose
+++ b/scripts/compose
@ -24,9 +24,17 @@ if [ ! -f "$ENV_FILE" ]; then
  exit 1
 fi

+source "${ENV_FILE}"
+
+# only include the MDNS publisher IF the domain is valid...
+if [ ${OPENBALENA_HOST_NAME: -6} == ".local" ]; then
+  INCLUDE_MDNS="-f ${BASE_DIR}/compose/mdns.yml"
+fi
+
 # shellcheck source=/dev/null
-source "${VERSIONS_FILE}"; source "${ENV_FILE}"; docker-compose \
+source "${VERSIONS_FILE}"; docker-compose \
  --project-name 'openbalena' \
  -f "${BASE_DIR}/compose/services.yml" \
+  ${INCLUDE_MDNS} \
  -f "${CONFIG_DIR}/docker-compose.yml" \
  "$@"
--- a/scripts/gen-vpn-certs
+++ b/scripts/gen-vpn-certs
@ -32,14 +32,9 @@ if [ ! -f $VPN_CA ] || [ ! -f $VPN_CRT ] || [ ! -f $VPN_KEY ] || [ ! -f $VPN_DH

  rm -f $VPN_CA $VPN_CRT $VPN_DH $VPN_KEY

-  # generate VPN sub-CA
+  # generate VPN CA
  "$easyrsa_bin" --pki-dir="${VPN_PKI}" init-pki &>/dev/null
-  "$easyrsa_bin" --pki-dir="${VPN_PKI}" --days="${CA_EXPIRY_DAYS}" --req-cn="vpn-ca.${CN}" build-ca nopass subca 2>/dev/null
-
-  # import sub-CA CSR into root PKI, sign, and copy back to vpn PKI
-  "$easyrsa_bin" --pki-dir="${ROOT_PKI}" import-req "${VPN_PKI}/reqs/ca.req" "vpn-ca" 2>/dev/null
-  "$easyrsa_bin" --pki-dir="${ROOT_PKI}" sign-req ca "vpn-ca" 2>/dev/null
-  cp "${ROOT_PKI}/issued/vpn-ca.crt" "${VPN_PKI}/ca.crt"
+  "$easyrsa_bin" --pki-dir="${VPN_PKI}" --days="${CA_EXPIRY_DAYS}" --req-cn="vpn-ca.${CN}" build-ca nopass 2>/dev/null

  # generate and sign vpn server certificate
  "$easyrsa_bin" --pki-dir="${VPN_PKI}" --days="${CRT_EXPIRY_DAYS}" build-server-full "vpn.${CN}" nopass 2>/dev/null
@ -48,8 +43,6 @@ if [ ! -f $VPN_CA ] || [ ! -f $VPN_CRT ] || [ ! -f $VPN_KEY ] || [ ! -f $VPN_DH
  "$easyrsa_bin" --pki-dir="${VPN_PKI}" --keysize=2048 gen-dh 2>/dev/null

  # update indexes and generate CRLs
-  "$easyrsa_bin" --pki-dir="${ROOT_PKI}" update-db 2>/dev/null
  "$easyrsa_bin" --pki-dir="${VPN_PKI}" update-db 2>/dev/null
-  "$easyrsa_bin" --pki-dir="${ROOT_PKI}" gen-crl 2>/dev/null
  "$easyrsa_bin" --pki-dir="${VPN_PKI}" gen-crl 2>/dev/null
 fi
--- a/scripts/logger.sh
+++ b/scripts/logger.sh
@ -0,0 +1,62 @@
+#!/bin/sh
+
+BLACK=`tput setaf 0`
+RED=`tput setaf 1`
+GREEN=`tput setaf 2`
+YELLOW=`tput setaf 3`
+BLUE=`tput setaf 4`
+MAGENTA=`tput setaf 5`
+CYAN=`tput setaf 6`
+WHITE=`tput setaf 7`
+
+BOLD=`tput bold`
+RESET=`tput sgr0`
+
+log_raw () {
+    local COLOR="${WHITE}"
+    local LEVEL="${1}"
+    local MESSAGE="${2}"
+    case "${LEVEL}" in
+        info)
+            COLOR="${BLUE}"
+            ;;
+        warn)
+            COLOR="${YELLOW}"
+            ;;
+        fatal)
+            COLOR="${RED}"
+            ;;
+        *)
+            LEVEL="debug"
+            ;;
+    esac
+    LEVEL="${LEVEL}     "
+    echo "[$(date +%T)] ${COLOR}$(echo "${LEVEL:0:5}" | tr '[:lower:]' '[:upper:]')${RESET} ${MESSAGE}";
+}
+
+log () {
+    log_raw "debug" "${1}"
+}
+
+info () {
+    log_raw "info" "${1}";
+}
+
+warn () {
+    log_raw "warn" "${1}";
+}
+
+die () {
+    log_raw "fatal" "${1}";
+    exit 1;
+}
+
+die_unless_forced () {
+    if [ ! -z "$1" ]; then
+        log_raw "warn" "$2";
+        return;
+    fi
+    
+    log_raw "fatal" "$2";
+    die "Use -f to forcibly upgrade.";
+}
--- a/scripts/make-env
+++ b/scripts/make-env
@ -12,7 +12,7 @@ usage() {
  echo "  JWT_CRT    Path to Token Auth certificate"
  echo "  JWT_KEY    Path to Token Auth private key"
  echo "  JWT_KID    Path to KeyID for the Token Auth certificate"
-  echo "  VPN_CA     Path to the VPN sub-CA certificate"
+  echo "  VPN_CA     Path to the VPN CA certificate"
  echo "  VPN_CRT    Path to the VPN server certificate"
  echo "  VPN_KEY    Path to the VPN server private key"
  echo "  VPN_DH     Path to the VPN server Diffie Hellman parameters"
@ -40,40 +40,15 @@ b64file() {
  b64encode "$(cat "$@")"
 }

-VPN_CONFIG=$(cat <<STR
-client
-remote vpn.$DOMAIN 443
-resolv-retry infinite
-
-remote-cert-tls server
-ca /etc/openvpn/ca.crt
-auth-user-pass /var/volatile/vpn-auth
-auth-retry none
-script-security 2
-up /etc/openvpn-misc/upscript.sh
-up-restart
-down /etc/openvpn-misc/downscript.sh
-
-comp-lzo
-dev resin-vpn
-dev-type tun
-proto tcp
-nobind
-
-persist-key
-persist-tun
-verb 3
-user openvpn
-group openvpn
-
-STR
-)
+# buckets to create in the S3 service...
+REGISTRY2_S3_BUCKET="registry-data"

 cat <<STR
 export OPENBALENA_PRODUCTION_MODE=false
 export OPENBALENA_COOKIE_SESSION_SECRET=$(randstr 32)
 export OPENBALENA_HOST_NAME=$DOMAIN
 export OPENBALENA_JWT_SECRET=$(randstr 32)
+export OPENBALENA_REGISTRY2_S3_BUCKET=${REGISTRY2_S3_BUCKET}
 export OPENBALENA_RESINOS_REGISTRY_CODE=$(randstr 32)
 export OPENBALENA_ROOT_CA=$(b64file "${ROOT_CA}")
 export OPENBALENA_ROOT_CRT=$(b64file "${ROOT_CRT}")
@ -83,14 +58,18 @@ export OPENBALENA_TOKEN_AUTH_PUB=$(b64file "$JWT_CRT")
 export OPENBALENA_TOKEN_AUTH_KEY=$(b64file "$JWT_KEY")
 export OPENBALENA_TOKEN_AUTH_KID=$(b64file "$JWT_KID")
 export OPENBALENA_VPN_CA=$(b64file "$VPN_CA")
-export OPENBALENA_VPN_CA_CHAIN=$(b64file "$ROOT_CA" "$VPN_CA")
-export OPENBALENA_VPN_CONFIG=$(b64encode "$VPN_CONFIG")
+export OPENBALENA_VPN_CA_CHAIN=$(b64file "$VPN_CA")
 export OPENBALENA_VPN_SERVER_CRT=$(b64file "$VPN_CRT")
 export OPENBALENA_VPN_SERVER_KEY=$(b64file "$VPN_KEY")
 export OPENBALENA_VPN_SERVER_DH=$(b64file "$VPN_DH")
 export OPENBALENA_VPN_SERVICE_API_KEY=$(randstr 32)
 export OPENBALENA_API_VPN_SERVICE_API_KEY=$(randstr 32)
 export OPENBALENA_REGISTRY_SECRET_KEY=$(randstr 32)
+export OPENBALENA_S3_ACCESS_KEY=$(randstr 32)
+export OPENBALENA_S3_BUCKETS="${REGISTRY2_S3_BUCKET}"
+export OPENBALENA_S3_ENDPOINT="https://s3.${DOMAIN}"
+export OPENBALENA_S3_REGION=us-east-1
+export OPENBALENA_S3_SECRET_KEY=$(randstr 32)
 export OPENBALENA_SSH_AUTHORIZED_KEYS=
 export OPENBALENA_SUPERUSER_EMAIL=$SUPERUSER_EMAIL
 export OPENBALENA_SUPERUSER_PASSWORD=$(printf "%q" "${SUPERUSER_PASSWORD}")
--- a/scripts/migrate-registry-storage
+++ b/scripts/migrate-registry-storage
@ -0,0 +1,29 @@
+#!/bin/sh
+
+migrate_data_to_s3 () {
+  BUCKET="${1:-registry-data}"
+
+  if [ -z "${BUCKET}" ]; then return 1; fi
+
+  if [ -n "${DOCKER_HOST}" ]; then
+      log "Using docker host: ${DOCKER_HOST}"
+      export DOCKER_HOST="${DOCKER_HOST}"
+  fi
+
+  REGISTRY_CONTAINER="$(docker ps | grep registry_ | awk '{print $1}')"
+  S3_CONTAINER="$(docker ps | grep s3_ | awk '{print $1}')"
+
+  if [ -z "${REGISTRY_CONTAINER}" ] || [ -z "${S3_CONTAINER}" ]; then return 2; fi
+
+  REGISTRY_VOLUME="$(docker inspect "${REGISTRY_CONTAINER}" | jq -r '.[].Mounts | map(select(.Destination=="/data")) | .[0].Source')"
+  S3_VOLUME=$(docker inspect "${S3_CONTAINER}" | jq -r '.[].Mounts | map(select(.Destination=="/export")) | .[0].Source')
+
+  if [ -z "${REGISTRY_VOLUME}" ] || [ -z "${S3_VOLUME}" ]; then return 3; fi
+
+  # run the S3 container image, and copy the data partition into S3...
+  docker run -it --rm \
+      -v "${REGISTRY_VOLUME}:/data" \
+      -v "${S3_VOLUME}:/s3" \
+      --name "migrate-registry" alpine \
+      sh -c "mkdir -p /s3/${BUCKET}/data && cp -r /data/docker /s3/${BUCKET}/data/"
+}
--- a/scripts/quickstart
+++ b/scripts/quickstart
@ -16,6 +16,12 @@ RESET=`tput sgr0`
 OPENSSL_VERSION=$(openssl version -v)
 if [[ "${OPENSSL_VERSION}" =~ ^LibreSSL.*$ ]]; then
  echo -e "${RED}ERROR: You may not have a compatible OpenSSL version (${OPENSSL_VERSION}). Please install OpenSSL version 1.0.2q or above.${RESET}"
+  if [ $(uname) == 'Darwin' ]; then
+        echo 'OpenSSL is required to build openBalena on macOS. To install with brew, run'
+        echo ''
+        echo '    brew install openssl'
+        echo ''
+    fi
  exit 1
 fi

@ -125,7 +131,25 @@ fi
 echo_bold "==> Success!"
 echo '  - Start the instance with: ./scripts/compose up -d'
 echo '  - Stop the instance with: ./scripts/compose stop'
+echo '  - To create a single, flat, docker-compose.yml file, run:'
+echo ''
+echo '      ./scripts/compose config > docker-compose.yml'
+echo ''

 if [ -z "${ACME_CERT_ENABLED}" ]; then
  echo "  - Use the following certificate with Balena CLI: ${CERTS_DIR}/root/ca.crt"
+
+  case $(uname) in
+    Darwin)
+      echo ''
+      printf '    On macOS:\n\n'
+      printf '      sudo security add-trusted-cert -d -r trustRoot -k "/Library/Keychains/System.keychain" "%s/root/ca.crt"\n' "${CERTS_DIR}"
+      echo ''
+      ;;
+    *)
+      ;;
+  esac
+
+  echo -e "    ${YELLOW}IMPORTANT:${RESET} You will need to restart your Docker daemon after trusting this certificate to allow your workstation to push images to the registry."
+  echo ''
 fi
--- a/scripts/upgrade-1.x-to-2.0
+++ b/scripts/upgrade-1.x-to-2.0
@ -0,0 +1,78 @@
+#!/bin/sh
+
+source "${BASH_SOURCE%/*}/logger.sh"
+source "${BASH_SOURCE%/*}/migrate-registry-storage"
+
+# This script takes a v1.x.x install and updates the compose stack to use S3 as your
+# registry storage.
+
+source "${BASH_SOURCE%/*}/_realpath"
+
+DIR="$(dirname $(realpath "$0"))"
+BASE_DIR="$(dirname "${DIR}")"
+CONFIG_DIR="${BASE_DIR}/config"
+CONFIG_FILE="${CONFIG_DIR}/activate"
+
+# Step 1. Make sure a config exists...
+[ -f "${CONFIG_FILE}" ] || die "Unable to find existing config!";
+
+info "Preparing to upgrade..."
+source "${CONFIG_FILE}"
+
+while getopts "f" opt; do
+  case "${opt}" in
+    f) 
+        warn "Forcing upgrade! I hope you know what you're doing..."
+        FORCE_UPGRADE=1
+        ;;
+    *)
+      echo "Invalid argument: ${OPTARG}"
+      exit 1
+      ;;
+  esac
+done
+shift $((OPTIND-1))
+
+# Step 2. Check if the S3 configuration already exists...
+upgrade_required () {
+    [ -z "${OPENBALENA_REGISTRY2_S3_BUCKET}" ] || return 1;
+    [ -z "${OPENBALENA_S3_ACCESS_KEY}" ] || return 1;
+    [ -z "${OPENBALENA_S3_ENDPOINT}" ] || return 1;
+    [ -z "${OPENBALENA_S3_REGION}" ] || return 1;
+    [ -z "${OPENBALENA_S3_SECRET_KEY}" ] || return 1;
+}
+upgrade_required || die_unless_forced "${FORCE_UPGRADE}" "Configuration may already be using S3 for Registry storage!"
+
+# Step 3. Create missing S3 configuration...
+randstr() {
+  LC_CTYPE=C tr -dc A-Za-z0-9 < /dev/urandom | fold -w "${1:-32}" | head -n 1
+}
+
+upsert_config () {
+    var="${1}"
+    value="${2}"
+
+    if [ -z "${!var}" ]; then
+        echo "export ${1}=${2}" >> "${CONFIG_FILE}"
+    else
+        sed -i '' "s~export ${1}=.*~export ${1}=${2}~" "${CONFIG_FILE}"
+    fi
+}
+
+upsert_config "OPENBALENA_REGISTRY2_S3_BUCKET" "registry-data" || warn "Failed to update config value OPENBALENA_REGISTRY2_S3_BUCKET"
+upsert_config "OPENBALENA_S3_ACCESS_KEY" "$(randstr 32)" || warn "Failed to update config value OPENBALENA_S3_ACCESS_KEY"
+upsert_config "OPENBALENA_S3_ENDPOINT" "https://s3.${OPENBALENA_HOST_NAME}" || warn "Failed to update config value OPENBALENA_S3_ENDPOINT"
+upsert_config "OPENBALENA_S3_REGION" "us-east-1" || warn "Failed to update config value OPENBALENA_S3_REGION"
+upsert_config "OPENBALENA_S3_SECRET_KEY" "$(randstr 32)" || warn "Failed to update config value OPENBALENA_S3_SECRET_KEY"
+
+# Step 4. Migrate Registry data to S3...
+info "Copying data from the Registry volume to the S3 volume..."
+migrate_data_to_s3 "registry-data"
+case $? in
+    1)  die "Invalid bucket name";;
+    2)  die "Unable to find the running Registry or S3 containers";;
+    3)  die "Unable to determine the data volumes for the Registry or S3 containers";;
+    *)  info "Registry data copied"
+        ;;
+esac
+info "Upgrade complete"
--- a/src/cert-provider/Dockerfile
+++ b/src/cert-provider/Dockerfile
@ -6,9 +6,11 @@ VOLUME [ "/usr/src/app/certs" ]

 RUN apk add --update bash curl git openssl ncurses socat

+# from https://github.com/Neilpang/acme.sh/releases/tag/2.8.5
 RUN git clone https://github.com/Neilpang/acme.sh.git && \
    cd acme.sh && \
-    git checkout 08357e3cb0d80c84bdaf3e42ce0e439665387f57 . && \
+    git fetch && git fetch --tags && \
+    git checkout 2.8.5 . && \
    ./acme.sh --install  \
    --cert-home /usr/src/app/certs

--- a/src/cert-provider/cert-provider.sh
+++ b/src/cert-provider/cert-provider.sh
@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash

 # the acme.sh client script, installed via Git in the Dockerfile...
 ACME_BIN="$(realpath ~/.acme.sh/acme.sh)"
@ -45,14 +45,20 @@ retryWithDelay() {
    DELAY=${3:-5}

    local ATTEMPT=0
-    while [ $RETRIES -gt $ATTEMPT ]; do
-        let "ATTEMPT++"
+    while [ "$RETRIES" -gt "$ATTEMPT" ]; do
+        (( ATTEMPT++ ))
+        logInfo "($ATTEMPT/$RETRIES) Connecting..."
        if $1; then
+            logInfo "($ATTEMPT/$RETRIES) Success!"
            return $?
        fi

-        echo "($ATTEMPT/$RETRIES) Retrying in ${DELAY} seconds..."
-        sleep $DELAY
+        if [ "$RETRIES" -gt "$ATTEMPT" ]; then
+            logInfo "($ATTEMPT/$RETRIES) Failed. Retrying in ${DELAY} seconds..."
+            sleep "$DELAY"
+        else
+            logInfo "($ATTEMPT/$RETRIES) Failed!"
+        fi
    done

    return 1
@ -62,7 +68,7 @@ waitForOnline() {
    ADDRESS="${1,,}"

    logInfo "Waiting for ${ADDRESS} to be available via HTTP..."
-    retryWithDelay "curl --output /dev/null --silent --head --fail http://${ADDRESS}" 6 5
+    retryWithDelay "curl --output /dev/null --silent --head --fail --max-time 5 http://${ADDRESS}"
 }

 isUsingStagingCert() {
@ -167,7 +173,10 @@ acquireCertificate() {

 pre-flight || logErrorAndStop "Unable to continue due to misconfiguration. See errors above."

-waitForOnline "${ACME_DOMAINS[0]}" || logErrorAndStop "Unable to access ${ACME_DOMAINS[0]} on port 80. This is needed for certificate validation."
+while ! waitForOnline "${ACME_DOMAINS[0]}"; do
+    logInfo "Unable to access ${ACME_DOMAINS[0]} on port 80. This is needed for certificate validation. Retrying in 30 seconds..."
+    sleep 30
+done

 if ! lastAcquiredCertFor "production"; then
    acquireCertificate "staging" || logErrorAndStop "Unable to acquire a staging certificate."
--- a/src/cert-provider/entry.sh
+++ b/src/cert-provider/entry.sh
--- a/src/cert-provider/fake-le-bundle.pem
+++ b/src/cert-provider/fake-le-bundle.pem
--- a/src/haproxy/Dockerfile
+++ b/src/haproxy/Dockerfile
--- a/src/haproxy/haproxy.cfg
+++ b/src/haproxy/haproxy.cfg
@ -64,34 +64,35 @@ backend backend_api
  mode http
  option forwardfor
  balance roundrobin
-  server resin_api_1 api:80 check port 80
+  server balena_api_1 api:80 check port 80

 backend backend_registry
  mode http
  option forwardfor
  balance roundrobin
-  server resin_registry_1 registry:80 check port 80
+  server balena_registry_1 registry:80 check port 80

 backend backend_vpn
  mode http
  option forwardfor
  balance roundrobin
-  server resin_vpn_1 vpn:80 check port 80
+  server balena_vpn_1 vpn:80 check port 80

 backend backend_s3
  mode http
  option forwardfor
  balance roundrobin
+  server balena_s3_1 s3:80 check port 80

 backend cert-provider
  mode http
  option forwardfor
  balance roundrobin
-  server resin_cert-provider_1 cert-provider:80 no-check
+  server balena_cert-provider_1 cert-provider:80 no-check

 backend vpn-devices
  mode tcp
-  server resin_vpn_1 vpn:443 send-proxy-v2 check-send-proxy port 443
+  server balena_vpn_1 vpn:443 send-proxy-v2 check-send-proxy port 443

 frontend db
  mode tcp
@ -101,7 +102,7 @@ frontend db

 backend backend_db
  mode tcp
-  server resin_db_1 db:5432 check port 5432
+  server balena_db_1 db:5432 check port 5432

 frontend redis
  mode tcp
@ -111,7 +112,7 @@ frontend redis

 backend backend_redis
  mode tcp
-  server resin_redis_1 redis:6379 check port 6379
+  server balena_redis_1 redis:6379 check port 6379

 listen vpn-tunnel
  mode tcp
--- a/src/haproxy/start-haproxy.sh
+++ b/src/haproxy/start-haproxy.sh
Author	SHA1	Message	Date
Balena CI	17419557a5	v2.0.1	2020-01-17 12:30:31 +02:00
Rich Bayliss	c58ee37f17	Merge pull request #65 from balena-io/cert-provider-update cert-provider: Update to support ACMEv2 on staging provider	2020-01-17 10:28:43 +00:00
Rich Bayliss	d67e29223f	cert-provider: Update to support ACMEv2 on staging provider Acquiring a staging certificiate from LetsEncrypt was failing, so acme.sh was updated to version 2.8.5, which includes support for using ACMEv2 on the LetsEncrypt servers. Changes to the state flow to make access retries infinite as it became apparent that in some scenarios the certificate acquisition could fail to occur due to containers taking longer to become accessible. Change-type: patch Signed-off-by: Rich Bayliss <rich@balena.io>	2020-01-17 10:24:43 +00:00
Balena CI	08a990d32d	v2.0.0	2019-09-02 13:39:55 +03:00
Rich Bayliss	d70c2177ff	Merge pull request #60 from balena-io/use-s3 feature: Use S3 bucket for Registry service backend	2019-09-02 11:38:03 +01:00
Rich Bayliss	2a7d0687a2	feature: Use S3 bucket for Registry service backend Update open-balena-s3 to 2.8.3 This makes new installations of openBalena use the S3 container as a storage backend for the Registry service by default. Existing installs should not be affected. Change-type: major Signed-off-by: Rich Bayliss <rich@balena.io>	2019-09-02 10:30:15 +01:00
Resin CI	e6c865e383	v1.3.0	2019-07-30 14:21:49 +03:00
Rich Bayliss	617209dc9e	Merge pull request #59 from balena-io/use-bob feature: Support deployment via balena push to local-mode balenaOS devices	2019-07-30 12:20:02 +01:00
Rich Bayliss	853ffb33e8	services: Update Registry service version Update open-balena-registry to 2.11.1 This allows the registry to use an S3 bucket for storing images. Change-type: minor Signed-off-by: Rich Bayliss <rich@balena.io>	2019-07-30 12:10:06 +01:00
Rich Bayliss	a029160caf	feature: Support deployment via balena push to local-mode balenaOS devices - remove some `.gitignore` entries as this is also honoured by `balena push` - added a step to `scripts/quickstart` to produce a single, flat `docker-compose.yml` after running - set the compose file versions to `2.0` to ensure only supported terms are used in the `docker-compose.yml` file output - quoted empty env values as these need to be passed in as blank, and not ommitted - include the MDNS publisher service IF the domain being used is a .local one - corrected spelling of macOS in script messages - move sidecar container source into ./src as per convention Change-type: patch Signed-off-by: Rich Bayliss <rich@balena.io>	2019-07-30 12:10:01 +01:00
Resin CI	bb1328e27e	v1.2.0	2019-05-21 18:00:07 +03:00
Rich Bayliss	395613af57	Merge pull request #53 from balena-io/service-updates Update service versions	2019-05-21 15:58:07 +01:00
Rich Bayliss	199d8eb4a4	tidy: Remove unused DEVICE_CONFIG_OPENVPN_CONFIG variable Change-type: patch Signed-off-by: Rich Bayliss <rich@balena.io>	2019-05-21 15:47:57 +01:00
Akis Kesoglou	6fdc554e43	services: Update Registry service version Update open-balena-registry to 2.7.0 This allows registry to be configured to use its internal Redis instance for caching. It is still disabled by default though. Change-type: minor	2019-05-21 14:45:54 +01:00
Rich Bayliss	f8b8a1589a	services: Update API service version Update open-balena-api from 0.11.8 to 0.19.5 This brings in the latest bugfixes and changes. Change-type: patch Signed-off-by: Rich Bayliss <rich@balena.io>	2019-05-21 14:01:38 +01:00
Resin CI	3bf14a2140	v1.1.1	2019-05-10 18:22:12 +03:00
Heds Simons	fef145f993	Merge pull request #51 from balena-io/50-update-docker-compose docker: Update docker-compose version to latest	2019-05-10 16:20:42 +01:00
Heds Simons	e068f8058f	docker: Update docker-compose version to latest Connects-to: #50 Change-type: patch Signed-off-by: Heds Simons <heds@balena.io>	2019-05-07 17:15:19 +01:00
Resin CI	c1ee146f0d	v1.1.0	2019-05-07 14:38:17 +03:00
Heds Simons	9ad92596b9	Merge pull request #49 from balena-io/48-s3-credential-changes s3: Update to latest version with credentials	2019-05-07 12:36:26 +01:00
Heds Simons	56de2d20bb	s3: Update to latest version with credentials Credentials for S3 can now be specified using the following docker-compose based envvars: * S3_MINIO_ACCESS_KEY * S3_MINIO_SECRET_KEY Connects-to: #48 Change-type: minor Signed-off-by: Heds Simons <heds@balena.io>	2019-05-07 11:18:48 +01:00
Resin CI	290c90c262	v1.0.2	2019-04-18 15:30:38 +03:00
dfunckt	98b6100fed	Merge pull request #45 from roman-mazur/roman/fix-build scripts: Handle missing coreutils on Mac	2019-04-18 15:28:19 +03:00
Roman Mazur	e1bfb7f7b0	scripts: Handle missing coreutils on Mac For convenience, also add instructions what to install. Tha change also addresses invalid usage of 'local' outside of a function. Change-type: patch Signed-off-by: Roman Mazur <mazur.roman@gmail.com>	2019-04-16 18:05:16 +03:00
Resin CI	35ab5300e6	v1.0.1	2019-03-20 11:24:21 +02:00
Rich Bayliss	fd031ad3a4	Merge pull request #42 from balena-io/prevent-root-ca-signing-vpn-ca vpn: Remove BALENA_ROOT_CA from the VPN trust chain	2019-03-20 09:22:11 +00:00
Rich Bayliss	95d53993bc	vpn: Remove BALENA_ROOT_CA from the VPN trust chain The VPN CA shouldn't need to be signed by the same CA that the HAproxy service certificate is signed by. By removing this chain we are able to use a different CA for the HTTPS services without impacting on the VPN service. Change-type: patch Signed-off-by: Rich Bayliss <rich@balena.io>	2019-03-20 09:13:19 +00:00
 @ -1 +1 @@
 .0.0
 .0.1