Repository files, collaboration, releases and project activity.
ARCHFORGE HISTORY
Blame · FIX-ADMIN-LOGIN-1.0.6.md
Branch main · the Commit author is not necessarily a verified ArchForge account.
299229ecf6archadmin2026-10-12
1 # Debian 13 — Git-based login recovery (1.0.6)299229ecf6archadmin2026-10-12
2 299229ecf6archadmin2026-10-12
3 If `https://status.archforge.nl/admin/login` still returns **403 Invalid origin** after updating to 1.0.5, do **not** reinstall the status server or erase the SQLite database.299229ecf6archadmin2026-10-12
4 299229ecf6archadmin2026-10-12
5 1. Extract the 1.0.6 update ZIP over the existing ArchForge Git repository on your computer; commit and push the changes to its main branch. Never commit `/etc/archforge-status/status.env` or your SQLite database.299229ecf6archadmin2026-10-12
6 2. On VPS 2, as root:299229ecf6archadmin2026-10-12
7 299229ecf6archadmin2026-10-12
8 ```bash299229ecf6archadmin2026-10-12
9 cd ~/archforge-external-status299229ecf6archadmin2026-10-12
10 git pull --ff-only299229ecf6archadmin2026-10-12
11 bash ./repair-admin-login.sh299229ecf6archadmin2026-10-12
12 ```299229ecf6archadmin2026-10-12
13 299229ecf6archadmin2026-10-12
14 The script checks it is running from a 1.0.6 checkout, that Caddy's HTTPS host is configured, and that the installed app is available. It backs up the environment file privately, synchronizes only the public URL if needed, uses the existing deployment backup/rollback mechanism, then reads the newly running app version from `/healthz`. Finally, it sends dummy form submissions to the local app with a fresh CSRF cookie. Canonical HTTPS and privacy-protected same-origin POSTs must reach the normal invalid-credentials response; cross-site requests must receive 403. It does not send, read or reset your real credentials or authenticator secret.299229ecf6archadmin2026-10-12
15 299229ecf6archadmin2026-10-12
16 The application remains accessible at `https://status.archforge.nl/admin/login`. Refresh the login page in a new tab after running the tool.299229ecf6archadmin2026-10-12
17 299229ecf6archadmin2026-10-12
18 If the script fails, share **only its `[ERROR]` line**. If it completes but the browser still fails, share the exact new error text (403 Invalid origin, 403 Invalid or expired form token, 401 invalid credentials, or something else). Do not send an `.env`, cookies, passwords, backup contents or 2FA secrets.299229ecf6archadmin2026-10-12
19 299229ecf6archadmin2026-10-12
20 **Scope:** this project touches only VPS 2; ArchForge 11.3.6 on the primary VPS is unchanged.