ngx-l402 v1.3.2 is out — a security release. Lightning paywalls for nginx, self-hosted and non-custodial. In Cashu P2PK mode a proof whose lock could lapse before redemption was accepted — an expired locktime with no refund tag is spendable by anyone under NUT-11. Any locktime is now refused. CASHU_P2PK_MODE only. Reported by Nuhiat-Arefin (https://github.com/Nuhiat-Arefin), thank you. Also in this release: - l402_tenant — name a tenant once at http level, reference it per location with l402_tenant_ref - a nested `l402 off` now turns the paywall off under a paid parent - a Blossom/Nostr `Authorization` header is no longer read as a failed L402 credential, so it gets the 402 challenge - tenant config errors name the file and line; cargo audit clean

gitworkshop - Decentralized Git

Decentralized GitHub alternative over Nostr for browsing repositories, managing issues, and collaborating on pull requests.

docker pull ghcr.io/ngx-l402/ngx-l402:1.3.2

GitHub

Release v1.3.2 · ngx-l402/ngx-l402

Upgrade notes Check these before upgrading; each can change how an existing deployment behaves. P2PK tokens carrying a locktime are now refused �...

Thanks @thesvn @npub1tluq...ayx2

ngx-l402 v1.3.0 is out ⚡ · An open-source nginx module that puts a Lightning paywall in front of any API · Two lines of config — any upstream, any language · Self-hosted and non-custodial: payments go straight to your node, your Lightning address, or your own wallet over NWC · No platform in the middle taking a cut Tighter defaults: · with Redis configured, a payment is accepted only once it's been recorded · every method goes through the same check, HEAD included · invoice rate limits key on the connection, so headers can't shift them · the Cashu wallet seed stays with the master process, away from the workers · metrics listen on localhost unless you open them up Easier to run (special thanks to @npub1g9n5...22z5): · nginx -t now just validates the config, so deploy scripts, CI checks and certbot's renewal hook see a clean pass · reloads keep the running state, so nginx -s reload is enough instead of a restart Also new: · headers-only 402s for agent routes · JSON logs, one line per L402 event · a price list at /.well-known/l402-services, so an agent with only your hostname can find what your routes cost Fixes in this one came from: - @npub1tluq...ayx2 - @thesvn - @npub1g9n5...22z5 - @Dhananjay Purohit Links: · repo, Nostr-native and pushed with ngit:

gitworkshop - Decentralized Git

Decentralized GitHub alternative over Nostr for browsing repositories, managing issues, and collaborating on pull requests.

· release notes:

GitHub

Release v1.3.0 · ngx-l402/ngx-l402

Upgrade notes Check these before upgrading; each can change how an existing deployment behaves. Cashu data directory — the directory holding the...

· site and live demo:

ngx-l402

ngx-l402 · Lightning paywall as an nginx module

Accept Lightning payments in front of any HTTP API. Two lines of nginx config, eight payment backends, non-custodial. L402.

#bitcoin #lightning #nostr #cashu #L402