From b3c1a8d937b2b229473336b7f7451dd8f4ee720d Mon Sep 17 00:00:00 2001
From: /rootzoll <christian@geektank.de>
Date: Fri, 15 Mar 2024 11:28:07 +0100
Subject: [PATCH 01/14] prevent redis hang on setup reboot (#4474)

to fix #4469 while removing sudos from bootstrap script
---
 home.admin/_background.scan.sh                |   4 +
 home.admin/_background.sh                     |   4 +-
 home.admin/_bootstrap.sh                      | 156 ++++++++++--------
 home.admin/_cache.sh                          |   1 +
 home.admin/config.scripts/blitz.error.sh      |   4 +
 .../config.scripts/blitz.preparerelease.sh    |   9 +
 home.admin/config.scripts/blitz.ssh.sh        |  54 +++++-
 7 files changed, 156 insertions(+), 76 deletions(-)

diff --git a/home.admin/_background.scan.sh b/home.admin/_background.scan.sh
index c1ad1eb25..c49996d2a 100755
--- a/home.admin/_background.scan.sh
+++ b/home.admin/_background.scan.sh
@@ -128,6 +128,9 @@ fi
 # flag that init was done (will be checked on each loop)
 /home/admin/_cache.sh set system_init_time "$(date +%s)"
 
+# add info about start to raspiblitz.log
+echo "INFO: _bootstrap.scan.sh loop started > sudo journalctl -f -u background.scan" >> /home/admin/raspiblitz.log
+
 while [ 1 ]
 do
 
@@ -140,6 +143,7 @@ do
   source <(/home/admin/_cache.sh get system_init_time)
   if [ "${system_init_time}" == "" ]; then
     echo "FAIL: CACHE IS MISSING INIT DATA ... exiting to let systemd restart"
+    echo "INFO: _bootstrap.scan.sh -> cache not running - exiting" >> /home/admin/raspiblitz.log
     exit 1
   fi
 
diff --git a/home.admin/_background.sh b/home.admin/_background.sh
index e0fb6acb3..c1b7970d7 100755
--- a/home.admin/_background.sh
+++ b/home.admin/_background.sh
@@ -13,6 +13,7 @@ configFile="/mnt/hdd/raspiblitz.conf"
 # LOGS see: sudo journalctl -f -u background
 
 echo "_background.sh STARTED"
+echo "INFO: _background.sh loop started - sudo journalctl -f -u background" >> /home/admin/raspiblitz.log
 
 # global vars
 blitzTUIHeartBeatLine=""
@@ -104,8 +105,7 @@ do
 
     # detect a missing DHCP config
     if [ "${localip:0:4}" = "169." ]; then
-      echo "Missing DHCP detected ... trying emergency reboot"
-      /home/admin/config.scripts/blitz.shutdown.sh reboot
+      echo "Missing DHCP detected ..."
     else
       echo "DHCP OK"
     fi
diff --git a/home.admin/_bootstrap.sh b/home.admin/_bootstrap.sh
index 19c0a44d5..a50de0558 100755
--- a/home.admin/_bootstrap.sh
+++ b/home.admin/_bootstrap.sh
@@ -3,6 +3,8 @@
 # This script runs on every start called by boostrap.service
 # see logs with --> tail -n 100 /home/admin/raspiblitz.log
 
+# NOTE: this boostrap script runs as root user (bootstrap.service) - so no sudo needed
+
 ################################
 # BASIC SETTINGS
 ################################
@@ -28,24 +30,35 @@ infoFile="/home/admin/raspiblitz.info"
 setupFile="/var/cache/raspiblitz/temp/raspiblitz.setup"
 
 # Backup last log file if available
-sudo cp ${logFile} /home/admin/raspiblitz.last.log 2>/dev/null
+cp ${logFile} /home/admin/raspiblitz.last.log 2>/dev/null
 
 # Init boostrap log file
 echo "Writing logs to: ${logFile}"
 echo "" > $logFile
-sudo chmod 640 ${logFile}
-sudo chown root:sudo ${logFile}
+chmod 640 ${logFile}
+chown root:sudo ${logFile}
 echo "***********************************************" >> $logFile
 echo "Running RaspiBlitz Bootstrap ${codeVersion}" >> $logFile
 date >> $logFile
 echo "***********************************************" >> $logFile
 
-# make sure SSH server is configured & running
-sudo /home/admin/config.scripts/blitz.ssh.sh checkrepair >> ${logFile}
+# list all running systemd services for future debug
+systemctl list-units --type=service --state=running >> $logFile
+
+# check if the file /etc/ssh/sshd_init_keys exists --> initial boot of fresh sd card image
+if [ -f "/etc/ssh/sshd_init_keys" ]; then
+  echo "# init SSH KEYS fresh for new user" >> $logFile
+  /home/admin/config.scripts/blitz.ssh.sh init >> $logFile
+else
+  echo "# make sure SSH server is configured & running" >> $logFile
+  /home/admin/config.scripts/blitz.ssh.sh checkrepair >> $logFile
+fi
+
+echo "## prepare raspiblitz temp" >> $logFile
 
 # make sure /var/cache/raspiblitz/temp exists
-sudo mkdir -p /var/cache/raspiblitz/temp
-sudo chmod 777 /var/cache/raspiblitz/temp
+mkdir -p /var/cache/raspiblitz/temp
+chmod 777 /var/cache/raspiblitz/temp
 
 ################################
 # INIT raspiblitz.info
@@ -96,7 +109,7 @@ echo "ln_cl_mainnet_sync_initial_done=${ln_cl_mainnet_sync_initial_done}" >> $in
 echo "ln_cl_testnet_sync_initial_done=${ln_cl_testnet_sync_initial_done}" >> $infoFile
 echo "ln_cl_signet_sync_initial_done=${ln_cl_signet_sync_initial_done}" >> $infoFile
 
-sudo chmod 664 ${infoFile}
+chmod 664 ${infoFile}
 
 # write content of raspiblitz.info to logs
 cat $infoFile >> $logFile
@@ -105,6 +118,18 @@ cat $infoFile >> $logFile
 # INIT RaspiBlitz Cache
 #########################
 
+# make sure that redis service is enabled (disabled on fresh sd card image)
+redisEnabled=$(systemctl is-enabled redis-server | grep -c "enabled")
+echo "## redisEnabled(${redisEnabled})" >> $logFile
+if [ ${redisEnabled} -eq 0 ]; then
+  echo "# make sure redis is running" >> $logFile
+  sleep 6
+  systemctl status redis-server >> $logFile
+  systemctl enable redis-server >> $logFile
+  systemctl start redis-server >> $logFile
+  systemctl status redis-server >> $logFile
+fi
+
 echo "## INIT RaspiBlitz Cache ... wait background.scan.service to finish first scan loop" >> $logFile
 systemscan_runtime=""
 while [ "${systemscan_runtime}" == "" ]
@@ -131,23 +156,18 @@ source ${configFile} 2>/dev/null
 # CHECK SD CARD STATE
 
 # when a file 'stop' is on the sd card bootfs partition root - stop for manual provision
-flagExists=$(sudo ls /boot/firmware/stop | grep -c 'stop')
+flagExists=$(ls /boot/firmware/stop | grep -c 'stop')
 if [ "${flagExists}" == "1" ]; then
   # remove flag
-  sudo rm /boot/firmware/stop
-  # set state info
-  /home/admin/_cache.sh set state "stop"
-  /home/admin/_cache.sh set message "stopped for manual provision"
+  rm /boot/firmware/stop
   # log info
   echo "INFO: 'bootstrap stopped - run release after manual provison'" >> ${logFile}
   exit 0
 fi
 
-
-
 # wifi config by file on sd card
-wifiFileExists=$(sudo ls /boot/firmware/wifi | grep -c 'wifi')
-wpaFileExists=$(sudo ls /boot/firmware/wpa_supplicant.conf | grep -c 'wpa_supplicant.conf')
+wifiFileExists=$(ls /boot/firmware/wifi | grep -c 'wifi')
+wpaFileExists=$(ls /boot/firmware/wpa_supplicant.conf | grep -c 'wpa_supplicant.conf')
 if [ "${wifiFileExists}" == "1" ] || [ "${wpaFileExists}" == "1" ]; then
 
   # set info
@@ -159,8 +179,8 @@ if [ "${wifiFileExists}" == "1" ] || [ "${wpaFileExists}" == "1" ]; then
   # get second line as string from wifi file (PASSWORD OF WIFI)
   if [ "${wifiFileExists}" == "1" ]; then
     echo "Getting data from file: /boot/firmware/wifi" >> ${logFile}
-    ssid=$(sudo sed -n '1p' /boot/firmware/wifi | tr -d '[:space:]')
-    password=$(sudo sed -n '2p' /boot/firmware/wifi | tr -d '[:space:]')
+    ssid=$(sed -n '1p' /boot/firmware/wifi | tr -d '[:space:]')
+    password=$(sed -n '2p' /boot/firmware/wifi | tr -d '[:space:]')
   fi
 
   # File: wpa_supplicant.conf (legacy way to set wifi)
@@ -182,22 +202,22 @@ if [ "${wifiFileExists}" == "1" ] || [ "${wpaFileExists}" == "1" ]; then
     /home/admin/_cache.sh set state "errorWIFI"
     /home/admin/_cache.sh set message "${err}"
     sleep 60
-    sudo shutdown now
+    shutdown now
     exit 1
   fi
 
   # remove file
   echo "Setting Wifi worked - removing file" >> ${logFile}
-  sudo rm /boot/firmware/wifi 2>/dev/null
-  sudo rm /boot/firmware/wpa_supplicant.conf 2>/dev/null
+  rm /boot/firmware/wifi 2>/dev/null
+  rm /boot/firmware/wpa_supplicant.conf 2>/dev/null
 else
   echo "No Wifi config by file on sd card." >> ${logFile}
 fi
 
 # when the provision did not ran thru without error (ask user for fresh sd card)
-provisionFlagExists=$(sudo ls /home/admin/provision.flag | grep -c 'provision.flag')
+provisionFlagExists=$(ls /home/admin/provision.flag | grep -c 'provision.flag')
 if [ "${provisionFlagExists}" == "1" ]; then
-  sudo systemctl stop ${network}d 2>/dev/null
+  systemctl stop ${network}d 2>/dev/null
   /home/admin/_cache.sh set state "inconsistentsystem"
   /home/admin/_cache.sh set message "provision did not ran thru"
   echo "FAIL: 'provision did not ran thru' - need fresh sd card!" >> ${logFile}
@@ -224,15 +244,15 @@ sleep 5
 # Emergency cleaning logs when over 1GB (to prevent SD card filling up)
 # see https://github.com/rootzoll/raspiblitz/issues/418#issuecomment-472180944
 echo "*** Checking Log Size ***"
-logsMegaByte=$(sudo du -c -m /var/log | grep "total" | awk '{print $1;}')
+logsMegaByte=$(du -c -m /var/log | grep "total" | awk '{print $1;}')
 if [ ${logsMegaByte} -gt 1000 ]; then
   echo "WARN # Logs /var/log in are bigger then 1GB" >> $logFile
   # dont delete directories - can make services crash
-  sudo rm /var/log/*
-  sudo service rsyslog restart
+  rm /var/log/*
+  service rsyslog restart
   /home/admin/_cache.sh set message "WARNING: /var/log/ >1GB"
   echo "WARN # Logs in /var/log in were bigger then 1GB and got emergency delete to prevent fillup." >> $logFile
-  sudo ls -la /var/log >> $logFile
+  ls -la /var/log >> $logFile
   echo "If you see this in the logs please report to the GitHub issues, so LOG config needs to be optimized." >> $logFile
   sleep 10
 else
@@ -241,19 +261,19 @@ fi
 echo ""
 
 # get the state of data drive
-source <(sudo /home/admin/config.scripts/blitz.datadrive.sh status)
+source <(/home/admin/config.scripts/blitz.datadrive.sh status)
 
 ################################
 # WAIT LOOP: HDD CONNECTED
 ################################
 
 echo "Waiting for HDD/SSD ..." >> $logFile
-sudo ls -la /etc/ssh >> $logFile 
+ls -la /etc/ssh >> $logFile 
 until [ ${isMounted} -eq 1 ] || [ ${#hddCandidate} -gt 0 ]
 do
 
   # recheck HDD/SSD
-  source <(sudo /home/admin/config.scripts/blitz.datadrive.sh status)
+  source <(/home/admin/config.scripts/blitz.datadrive.sh status)
   echo "isMounted: $isMounted" >> $logFile
   echo "hddCandidate: $hddCandidate" >> $logFile
 
@@ -288,13 +308,13 @@ systemInitReboot=0
 # the sd card - switch to hdmi
 ################################
 
-forceHDMIoutput=$(sudo ls /boot/firmware/hdmi* 2>/dev/null | grep -c hdmi)
+forceHDMIoutput=$(ls /boot/firmware/hdmi* 2>/dev/null | grep -c hdmi)
 if [ ${forceHDMIoutput} -eq 1 ]; then
   # delete that file (to prevent loop)
-  sudo rm /boot/hdmi*
+  rm /boot/hdmi*
   # switch to HDMI what will trigger reboot
   echo "HDMI switch found ... activating HDMI display output & reboot" >> $logFile
-  sudo /home/admin/config.scripts/blitz.display.sh set-display hdmi >> $logFile
+  /home/admin/config.scripts/blitz.display.sh set-display hdmi >> $logFile
   systemInitReboot=1
   /home/admin/_cache.sh set message "HDMI"
 else
@@ -306,11 +326,11 @@ fi
 # extend sd card to maximum capacity
 ################################
 
-source <(sudo /home/admin/config.scripts/blitz.bootdrive.sh status)
+source <(/home/admin/config.scripts/blitz.bootdrive.sh status)
 if [ "${needsExpansion}" == "1" ] && [ "${fsexpanded}" == "0" ]; then
   echo "FSEXPAND needed ... starting process" >> $logFile
-  sudo /home/admin/config.scripts/blitz.bootdrive.sh status >> $logFile
-  sudo /home/admin/config.scripts/blitz.bootdrive.sh fsexpand >> $logFile
+  /home/admin/config.scripts/blitz.bootdrive.sh status >> $logFile
+  /home/admin/config.scripts/blitz.bootdrive.sh fsexpand >> $logFile
   systemInitReboot=1
   /home/admin/_cache.sh set message "FSEXPAND"
 elif [ "${tooSmall}" == "1" ]; then
@@ -320,7 +340,7 @@ elif [ "${tooSmall}" == "1" ]; then
   /home/admin/_cache.sh set state "sdtoosmall"
   echo "System stopped. Please cut power." >> $logFile
   sleep 6000
-  sudo shutdown -r now
+  shutdown -r now
   slepp 100
   exit 1
 else
@@ -364,7 +384,7 @@ fi
 # the sd card - delete old ssh data
 ################################
 
-sshReset=$(sudo ls /boot/firmware/ssh.reset* 2>/dev/null | grep -c reset)
+sshReset=$(ls /boot/firmware/ssh.reset* 2>/dev/null | grep -c reset)
 if [ ${sshReset} -eq 1 ]; then
   # delete that file (to prevent loop)
   rm /boot/firmware/ssh.reset* >> $logFile
@@ -412,7 +432,7 @@ fi
 # UASP FIX
 ################################
 /home/admin/_cache.sh set message "checking HDD"
-source <(sudo /home/admin/config.scripts/blitz.datadrive.sh uasp-fix)
+source <(/home/admin/config.scripts/blitz.datadrive.sh uasp-fix)
 if [ "${neededReboot}" == "1" ]; then
   echo "UASP FIX applied ... reboot needed." >> $logFile
   systemInitReboot=1
@@ -425,11 +445,13 @@ fi
 # from actions above
 
 if [ "${systemInitReboot}" == "1" ]; then
+  echo "Stopping Redis server" >> $logFile
+  systemctl stop redis
   echo "Reboot" >> $logFile
-  sudo cp ${logFile} /home/admin/raspiblitz.systeminit.log
+  cp ${logFile} /home/admin/raspiblitz.systeminit.log
   /home/admin/_cache.sh set state "reboot"
   sleep 8
-  sudo shutdown -r now
+  shutdown -r now
   sleep 100
   exit 0
 fi
@@ -504,7 +526,7 @@ fi
 /home/admin/_cache.sh set message "please wait"
 
 # get fresh info about data drive to continue
-source <(sudo /home/admin/config.scripts/blitz.datadrive.sh status)
+source <(/home/admin/config.scripts/blitz.datadrive.sh status)
 
 echo "isMounted: $isMounted" >> $logFile
 
@@ -590,11 +612,11 @@ if [ ${isMounted} -eq 0 ]; then
   do
 
     # get fresh info about data drive (in case the hdd gets disconnected)
-    source <(sudo /home/admin/config.scripts/blitz.datadrive.sh status)
+    source <(/home/admin/config.scripts/blitz.datadrive.sh status)
     if [ "${hddCandidate}" == "" ]; then
       /home/admin/config.scripts/blitz.error.sh _bootstrap.sh "lost-hdd" "Lost HDD connection .. triggering reboot." "happened during WAIT LOOP: USER SETUP/UPDATE/MIGRATION" ${logFile}
       sleep 8
-      sudo shutdown -r now
+      shutdown -r now
       sleep 100
       exit 0
     fi
@@ -605,7 +627,7 @@ if [ ${isMounted} -eq 0 ]; then
     if [ "${localip}" == "" ]; then
       sed -i "s/^state=.*/state=errorNetwork/g" ${infoFile}
       sleep 8
-      sudo shutdown now
+      shutdown now
       sleep 100
       exit 0
     fi
@@ -630,7 +652,7 @@ if [ ${isMounted} -eq 0 ]; then
   echo "the provision process was started but did not finish yet" > /home/admin/provision.flag
 
   # get fresh data from setup file & data drive
-  source <(sudo /home/admin/config.scripts/blitz.datadrive.sh status)
+  source <(/home/admin/config.scripts/blitz.datadrive.sh status)
   source ${setupFile}
 
   # special setup tasks (triggered by api/webui thru setupfile)
@@ -641,7 +663,7 @@ if [ ${isMounted} -eq 0 ]; then
       
     # check if there is a flag set on sd card boot section to format as btrfs (experimental)
     filesystem="ext4"
-    flagBTRFS=$(sudo ls /boot/firmware/btrfs* 2>/dev/null | grep -c btrfs)
+    flagBTRFS=$(ls /boot/firmware/btrfs* 2>/dev/null | grep -c btrfs)
     if [ "${flagBTRFS}" != "0" ]; then
       echo "Found BTRFS flag ---> formatting with experimental BTRFS filesystem" >> ${logFile}
       filesystem="btrfs"
@@ -651,7 +673,7 @@ if [ ${isMounted} -eq 0 ]; then
     error=""
     /home/admin/_cache.sh set state "formathdd"
     echo "Running Format: filesystem(${filesystem}) hddCandidate(${hddCandidate})" >> ${logFile}
-    source <(sudo /home/admin/config.scripts/blitz.datadrive.sh format ${filesystem} ${hddCandidate})
+    source <(/home/admin/config.scripts/blitz.datadrive.sh format ${filesystem} ${hddCandidate})
     if [ "${error}" != "" ]; then
       echo "FAIL ON FORMATTING THE DRIVE:" >> ${logFile}
       echo "${error}" >> ${logFile}
@@ -671,7 +693,7 @@ if [ ${isMounted} -eq 0 ]; then
     if [ "${hddGotMigrationData}" != "" ]; then
         clear
         echo "Migrating Blockchain of ${hddGotMigrationData}'" >> ${logFile}
-        source <(sudo /home/admin/config.scripts/blitz.migration.sh migration-${hddGotMigrationData})
+        source <(/home/admin/config.scripts/blitz.migration.sh migration-${hddGotMigrationData})
         if [ "${error}" != "0" ]; then
           echo "MIGRATION OF BLOCKHAIN FAILED: ${err}" >> ${logFile}
           echo "Format data disk on laptop & recover funds with fresh sd card using seed words + static channel backup." >> ${logFile}
@@ -683,8 +705,8 @@ if [ ${isMounted} -eq 0 ]; then
 
     # delete everything but blockchain
     echo "Deleting everything on HDD/SSD while keeping blockchain ..." >> ${logFile}
-    sudo /home/admin/config.scripts/blitz.datadrive.sh tempmount 1>/dev/null 2>/dev/null
-    sudo /home/admin/config.scripts/blitz.datadrive.sh clean all -keepblockchain >> ${logFile}
+    /home/admin/config.scripts/blitz.datadrive.sh tempmount 1>/dev/null 2>/dev/null
+    /home/admin/config.scripts/blitz.datadrive.sh clean all -keepblockchain >> ${logFile}
     if [ "${error}" != "" ]; then
        echo "CLEANING HDD FAILED:" >> ${logFile}
       echo "${error}" >> ${logFile}
@@ -693,7 +715,7 @@ if [ ${isMounted} -eq 0 ]; then
       /home/admin/_cache.sh set message "Fail Cleaning HDD"
       exit 1
     fi
-    sudo /home/admin/config.scripts/blitz.datadrive.sh unmount >> ${logFile}
+    /home/admin/config.scripts/blitz.datadrive.sh unmount >> ${logFile}
     /home/admin/_cache.sh set setupPhase "setup"
 
     sleep 2
@@ -718,10 +740,10 @@ if [ ${isMounted} -eq 0 ]; then
     # will first be created and in cache drive
     # and some lines below copied to hdd when mounted
     TEMPCONFIGFILE="/var/cache/raspiblitz/temp/raspiblitz.conf"
-    sudo rm $TEMPCONFIGFILE 2>/dev/null
-    sudo touch $TEMPCONFIGFILE
-    sudo chown admin:admin $TEMPCONFIGFILE
-    sudo chmod 777 $TEMPCONFIGFILE
+    rm $TEMPCONFIGFILE 2>/dev/null
+    touch $TEMPCONFIGFILE
+    chown admin:admin $TEMPCONFIGFILE
+    chmod 777 $TEMPCONFIGFILE
     echo "# RASPIBLITZ CONFIG FILE" > $TEMPCONFIGFILE
     echo "raspiBlitzVersion='${codeVersion}'" >> $TEMPCONFIGFILE
     echo "lcdrotate='1'" >> $TEMPCONFIGFILE
@@ -735,7 +757,7 @@ if [ ${isMounted} -eq 0 ]; then
   # make sure HDD is mounted (could be freshly formatted by user on last loop)
   source <(/home/admin/config.scripts/blitz.datadrive.sh status)
   echo "Temp mounting (2) data drive (hddFormat='${hddFormat}')" >> ${logFile}
-  source <(sudo /home/admin/config.scripts/blitz.datadrive.sh tempmount)
+  source <(/home/admin/config.scripts/blitz.datadrive.sh tempmount)
   echo "Temp mounting (2) result: ${isMounted}" >> ${logFile}
 
   # check that HDD was temp mounted
@@ -747,16 +769,16 @@ if [ ${isMounted} -eq 0 ]; then
 
   # make sure all links between directories/drives are correct
   echo "Refreshing links between directories/drives .." >> ${logFile}
-  sudo /home/admin/config.scripts/blitz.datadrive.sh link
+  /home/admin/config.scripts/blitz.datadrive.sh link
 
   # copy over the raspiblitz.conf created from setup to HDD
   configExists=$(ls /mnt/hdd/raspiblitz.conf 2>/dev/null | grep -c "raspiblitz.conf")
   if [ "${configExists}" != "1" ]; then
-    sudo cp /var/cache/raspiblitz/temp/raspiblitz.conf ${configFile}
+    cp /var/cache/raspiblitz/temp/raspiblitz.conf ${configFile}
   fi
 
   # enable tor service
-  sudo /home/admin/config.scripts/tor.install.sh enable >> ${logFile}
+  /home/admin/config.scripts/tor.install.sh enable >> ${logFile}
 
   # kick-off provision process
   /home/admin/_cache.sh set state "provision"
@@ -824,7 +846,7 @@ if [ ${isMounted} -eq 0 ]; then
   fi
 
   echo "# setting PASSWORD A" >> ${logFile}
-  sudo /home/admin/config.scripts/blitz.passwords.sh set a "${passwordA}" >> ${logFile}
+  /home/admin/config.scripts/blitz.passwords.sh set a "${passwordA}" >> ${logFile}
 
   # Bitcoin Mainnet
   if [ "${mainnet}" == "on" ] || [ "${chain}" == "main" ]; then
@@ -857,7 +879,7 @@ if [ ${isMounted} -eq 0 ]; then
     /home/admin/_cache.sh set message "Provision Setup"
     /home/admin/_provision.setup.sh
     errorState=$?
-    sudo cat /home/admin/raspiblitz.provision-setup.log
+    cat /home/admin/raspiblitz.provision-setup.log
     if [ "$errorState" != "0" ]; then
       # only trigger an error message if the script hasnt itself triggered an error message already
       source <(/home/admin/_cache.sh get state)
@@ -983,7 +1005,7 @@ else
 
   # limit debug.log to 10MB on start - see #3872
   if [ $(grep -c "shrinkdebugfile=" < /mnt/hdd/bitcoin/bitcoin.conf) -eq 0 ];then
-    echo "shrinkdebugfile=1" | sudo tee -a /mnt/hdd/bitcoin/bitcoin.conf
+    echo "shrinkdebugfile=1" | tee -a /mnt/hdd/bitcoin/bitcoin.conf
   fi
   # /mnt/hdd/lnd/logs/bitcoin/mainnet/lnd.log
   rm /mnt/hdd/lnd/logs/${network}/${chain}net/lnd.log 2>/dev/null
@@ -1048,7 +1070,7 @@ fi
 # CLEAN HDD TEMP
 #####################################
 echo "CLEANING TEMP DRIVE/FOLDER" >> $logFile
-source <(sudo /home/admin/config.scripts/blitz.datadrive.sh clean temp)
+source <(/home/admin/config.scripts/blitz.datadrive.sh clean temp)
 if [ ${#error} -gt 0 ]; then
   echo "FAIL: ${error}" >> $logFile
 else
@@ -1082,7 +1104,7 @@ fi
 
 if [ -d "/mnt/hdd/app-data/subscriptions" ]; then
   echo "OK: subscription data directory exists"
-  sudo chown admin:admin /mnt/hdd/app-data/subscriptions
+  chown admin:admin /mnt/hdd/app-data/subscriptions
 else
   echo "CREATE: subscription data directory"
   mkdir /mnt/hdd/app-data/subscriptions
@@ -1090,7 +1112,7 @@ else
 fi
 
 # make sure that bitcoin service is active
-sudo systemctl enable ${network}d
+systemctl enable ${network}d
 
 # make sure setup/provision is marked as done
 /home/admin/_cache.sh set setupPhase "done"
diff --git a/home.admin/_cache.sh b/home.admin/_cache.sh
index 03e971b10..25e115291 100755
--- a/home.admin/_cache.sh
+++ b/home.admin/_cache.sh
@@ -112,6 +112,7 @@ elif [ "$1" = "keyvalue" ] && [ "$2" = "on" ]; then
 
   # edit config: dont save to disk
   sudo sed -i "/^save .*/d" /etc/redis/redis.conf
+  sudo sed -i 's/^stop-writes-on-bgsave-error yes/stop-writes-on-bgsave-error no/' /etc/redis/redis.conf
 
   # restart with new config
   if ! ischroot; then sudo systemctl restart redis-server; fi
diff --git a/home.admin/config.scripts/blitz.error.sh b/home.admin/config.scripts/blitz.error.sh
index 2d3ee1c65..c32fb7604 100755
--- a/home.admin/config.scripts/blitz.error.sh
+++ b/home.admin/config.scripts/blitz.error.sh
@@ -60,6 +60,10 @@ if [ "${logfile}" !=  "" ]; then
   echo "##################" >> ${logFile}
   echo "${errorReport}" >> ${logFile}
   echo "##################" >> ${logFile}
+else 
+  # if no logfile given - write to default log
+    echo "##################" >> /home/admin/raspiblitz.log
+  echo "${errorReport}" >> /home/admin/raspiblitz.log
 fi
 
 # on serial calls make sure that at least a second is between error reports
diff --git a/home.admin/config.scripts/blitz.preparerelease.sh b/home.admin/config.scripts/blitz.preparerelease.sh
index 109e00ee2..4f8be1644 100755
--- a/home.admin/config.scripts/blitz.preparerelease.sh
+++ b/home.admin/config.scripts/blitz.preparerelease.sh
@@ -25,6 +25,7 @@ echo
 echo "deleting SSH Pub keys ..."
 echo "they will get recreated on fresh bootup, by _bootstrap.sh service"
 sudo rm /etc/ssh/ssh_host_*
+sudo touch /etc/ssh/sshd_init_keys
 echo "OK"
 
 # https://github.com/rootzoll/raspiblitz/issues/1068#issuecomment-599267503
@@ -49,6 +50,14 @@ update_config=1
 country=US" | sudo tee /etc/wpa_supplicant/wpa_supplicant.conf  2>/dev/null
 echo "OK"
 
+# make sure that every install runs API with own secret
+# https://github.com/raspiblitz/raspiblitz/issues/4469
+echo
+echo "disable redis for initial start ..."
+sudo systemctl stop redis 2>/dev/null
+sudo systemctl disable redis 2>/dev/null
+echo "OK"
+
 echo
 echo "Will shutdown now."
 echo "Wait until Raspberry LEDs show no activity anymore."
diff --git a/home.admin/config.scripts/blitz.ssh.sh b/home.admin/config.scripts/blitz.ssh.sh
index 365a1d3ef..44b999472 100755
--- a/home.admin/config.scripts/blitz.ssh.sh
+++ b/home.admin/config.scripts/blitz.ssh.sh
@@ -5,7 +5,8 @@ if [ $# -eq 0 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ] || [ "$1" = "-help" ];
   echo "RaspiBlitz SSH tools"
   echo
   echo "## SSHD SERVICE #######"
-  echo "blitz.ssh.sh renew       --> renew the sshd host certs"
+  echo "blitz.ssh.sh renew       --> renew the sshd host certs & restarts sshd"
+  echo "blitz.ssh.sh init        --> just creates sshd host certs"
   echo "blitz.ssh.sh clear       --> make sure old sshd host certs are cleared"
   echo "blitz.ssh.sh checkrepair --> check sshd & repair just in case"
   echo "blitz.ssh.sh backup      --> copy ssh keys to backup (if exist)"
@@ -27,28 +28,67 @@ if [ "$EUID" -ne 0 ]; then
   exit 1
 fi
 
+###################
+# INIT
+###################
+if [ "$1" = "init" ]; then
+  echo "# *** $0 $1"
+
+  echo "# generate new keys"
+  ssh-keygen -A
+  if [ $? -gt 0 ]; then
+    echo "error='ssh-keygen failed'"
+    exit 1
+  fi
+
+  echo "# reconfigure"
+  dpkg-reconfigure openssh-server
+  if [ $? -gt 0 ]; then
+    echo "error='dpkg-reconfigure failed'"
+    exit 1
+  fi
+
+  echo "# remove flag"
+  rm /etc/ssh/sshd_init_keys
+
+  echo "# restart sshd"
+  systemctl restart sshd
+  if [ $? -gt 0 ]; then
+    echo "error='sshd restart failed'"
+    exit 1
+  fi
+
+  exit 0
+fi
+
 ###################
 # RENEW
 ###################
 if [ "$1" = "renew" ]; then
   echo "# *** $0 $1"
 
-  # stop sshd
+  echo "# stop sshd"
   systemctl stop sshd
 
-  # remove old keys
+  echo "# remove old keys"
   rm /etc/ssh/ssh_host_*
 
-  # generate new keys
+  echo "# generate new keys"
   ssh-keygen -A
+  echo "# reconfigure"
   dpkg-reconfigure openssh-server
 
-  # clear journalctl logs
+  echo "# clear journalctl logs"
   journalctl --rotate
   journalctl --vacuum-time=1s
 
-  # restart sshd
-  systemctl start sshd
+  if [ "$1" = "init" ]; then
+    echo "# init mode - not starting sshd"
+    rm /etc/ssh/sshd_init_keys
+  else
+    echo "# start sshd"
+    systemctl start sshd
+  fi
   exit 0
 fi
 

From e4773772140658e2d4be8dcdd02219c78ed55082 Mon Sep 17 00:00:00 2001
From: rootzoll <christian@geektank.de>
Date: Fri, 15 Mar 2024 11:59:43 +0100
Subject: [PATCH 02/14] adapt versioning with v

---
 ci/packer.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ci/packer.sh b/ci/packer.sh
index fcfe4e609..88dcab06d 100644
--- a/ci/packer.sh
+++ b/ci/packer.sh
@@ -126,15 +126,15 @@ echo "# Date: ${dateString}"
 if [ "${ARCH}" == "arm" ] && [ "${TYPE}" == "min" ]; then
   PACKERTARGET="arm64-rpi-lean-image"
   PACKERBUILDPATH="./raspiblitz/ci/arm64-rpi/packer-builder-arm/raspiblitz-arm64-rpi-lean.img"
-  PACKERFINALFILE="raspiblitz-min-${codeVersion}-${dateString}.img"
+  PACKERFINALFILE="raspiblitz-min-v${codeVersion}-${dateString}.img"
 elif [ "${ARCH}" == "arm" ] && [ "${TYPE}" == "fat" ]; then
   PACKERTARGET="arm64-rpi-fatpack-image" 
   PACKERBUILDPATH="./raspiblitz/ci/arm64-rpi/packer-builder-arm/TODO" #TODO
-  PACKERFINALFILE="raspiblitz-fat-${codeVersion}-${dateString}.img"
+  PACKERFINALFILE="raspiblitz-fat-v${codeVersion}-${dateString}.img"
 elif [ "${ARCH}" == "x86" ] && [ "${TYPE}" == "min" ]; then
   PACKERTARGET="amd64-lean-server-legacyboot-image"
   PACKERBUILDPATH="./raspiblitz/ci/amd64/builds/raspiblitz-amd64-debian-lean-qemu/raspiblitz-amd64-debian-lean.qcow2"
-  PACKERFINALFILE="raspiblitz-amd64-min-${codeVersion}-${dateString}.qcow2"
+  PACKERFINALFILE="raspiblitz-amd64-min-v${codeVersion}-${dateString}.qcow2"
 else
   echo "error='$ARCH-$TYPE not supported'"
   exit 1

From 14e1201d82bf0470fde9f0939c065d51adaebdb8 Mon Sep 17 00:00:00 2001
From: /rootzoll <christian@geektank.de>
Date: Fri, 15 Mar 2024 15:54:03 +0100
Subject: [PATCH 03/14] Correct branches for WebUI & API

---
 FAQ.dev.md                                 |  3 +++
 build_sdcard.sh                            |  8 ++++----
 home.admin/_version.info                   |  2 +-
 home.admin/config.scripts/blitz.web.api.sh | 12 +++++++-----
 home.admin/config.scripts/blitz.web.ui.sh  | 11 ++++++-----
 5 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/FAQ.dev.md b/FAQ.dev.md
index ef19ea798..cdce96fbe 100644
--- a/FAQ.dev.md
+++ b/FAQ.dev.md
@@ -2,6 +2,9 @@
 
 ### Steps to create RaspberryPi images with Packer?
 
+* Make sure you have:
+  * Correct version-string in: `_version.info`
+  * Correct version-branch as fallback in `build_sdcard.sh`
 * Start [`Debian LIVE`](https://cdimage.debian.org/debian-cd/current-live/amd64/iso-hybrid/debian-live-12.4.0-amd64-cinnamon.iso) from USB stick
   * On USB boot be sure to start the "LIVE_SYSTEM" image
   * Set KeyboardLang, "Screensaver" & "Power Management"
diff --git a/build_sdcard.sh b/build_sdcard.sh
index 041230193..0be62066e 100644
--- a/build_sdcard.sh
+++ b/build_sdcard.sh
@@ -10,8 +10,8 @@
 # setup fresh SD card with image above - login via SSH and run this script:
 ##########################################################################
 
-defaultRepo="raspiblitz" #user that hosts a `raspiblitz` repo
-defaultBranch="v1.10"
+defaultRepo="raspiblitz" # user that hosts a `raspiblitz` repo
+defaultBranch="v1.11" # latest version branch
 
 defaultAPIuser="fusion44"
 defaultAPIrepo="blitz_api"
@@ -56,8 +56,8 @@ if [ "$EUID" -ne 0 ]; then
 fi
 
 if [ "$1" = "-EXPORT" ] || [ "$1" = "EXPORT" ]; then
-  cd /home/admin/raspiblitz 2>/dev/null
-  activeBranch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
+  activeBranch=$(git -C /home/admin/raspiblitz branch --show-current 2>/dev/null)
+  echo "activeBranch='${activeBranch}'"
   if [ "${activeBranch}" == "" ]; then
     activeBranch="${defaultBranch}"
   fi
diff --git a/home.admin/_version.info b/home.admin/_version.info
index f44fd8119..7b75e92bf 100644
--- a/home.admin/_version.info
+++ b/home.admin/_version.info
@@ -1,3 +1,3 @@
 # RaspiBlitz Version - always [major].[main].[sub] (sub can be a string like '2rc1')
 codeVersion="1.11.0rc4"
-# keep last line with comment
\ No newline at end of file
+# keep last line with comment ---> IF YOU HAVE A NEW VERSION BRANCH > EDIT ALSO buil_sdcard.sh
\ No newline at end of file
diff --git a/home.admin/config.scripts/blitz.web.api.sh b/home.admin/config.scripts/blitz.web.api.sh
index 03478bd58..b5b9891ab 100644
--- a/home.admin/config.scripts/blitz.web.api.sh
+++ b/home.admin/config.scripts/blitz.web.api.sh
@@ -170,13 +170,15 @@ fi
 if [ "$1" = "1" ] || [ "$1" = "on" ]; then
 
   if [ "$2" == "DEFAULT" ]; then
-    echo "# getting default user/repo from build_sdcard.sh"
+    echo "# API: getting default user/repo from build_sdcard.sh"
+    # copy build_sdcard.sh out of raspiblitz diretcory to not create "changes" in git
     sudo cp /home/admin/raspiblitz/build_sdcard.sh /home/admin/build_sdcard.sh
     sudo chmod +x /home/admin/build_sdcard.sh 2>/dev/null
     source <(sudo /home/admin/build_sdcard.sh -EXPORT)
+    echo "# activeBranch detected by build_sdcard.sh: ${activeBranch}"
     GITHUB_USER="${defaultAPIuser}"
     GITHUB_REPO="${defaultAPIrepo}"
-    GITHUB_BRANCH="${githubBranch}"
+    GITHUB_BRANCH="blitz-${githubBranch}"
     GITHUB_COMMITORTAG=""
   else
     # get parameters
@@ -192,17 +194,17 @@ if [ "$1" = "1" ] || [ "$1" = "on" ]; then
     echo "# FAIL: No GITHUB_USER provided"
     exit 1
   fi
-  echo "GITHUB_REPO(${GITHUB_REPO})"
+  echo "# GITHUB_REPO(${GITHUB_REPO})"
   if [ "${GITHUB_REPO}" == "" ]; then
     echo "# FAIL: No GITHUB_REPO provided"
     exit 1
   fi
-  echo "GITHUB_BRANCH(${GITHUB_BRANCH})"
+  echo "# GITHUB_BRANCH(${GITHUB_BRANCH})"
   if [ "${GITHUB_BRANCH}" == "" ]; then
     echo "# FAIL: No GITHUB_BRANCH provided"
     exit 1
   fi
-  echo "GITHUB_COMMITORTAG(${GITHUB_COMMITORTAG})"
+  echo "# GITHUB_COMMITORTAG(${GITHUB_COMMITORTAG})"
   if [ "${GITHUB_COMMITORTAG}" == "" ]; then
     echo "# INFO: No GITHUB_COMMITORTAG provided .. will use latest code on branch"
   fi
diff --git a/home.admin/config.scripts/blitz.web.ui.sh b/home.admin/config.scripts/blitz.web.ui.sh
index 4710ebf48..9564d6595 100755
--- a/home.admin/config.scripts/blitz.web.ui.sh
+++ b/home.admin/config.scripts/blitz.web.ui.sh
@@ -57,13 +57,14 @@ fi
 if [ "$1" = "1" ] || [ "$1" = "on" ]; then
 
   if [ "$2" == "DEFAULT" ]; then
-    echo "# getting default user/repo from build_sdcard.sh"
+    echo "# WEBUI: getting default user/repo from build_sdcard.sh"
+    # copy build_sdcard.sh out of raspiblitz diretcory to not create "changes" in git
     sudo cp /home/admin/raspiblitz/build_sdcard.sh /home/admin/build_sdcard.sh
     sudo chmod +x /home/admin/build_sdcard.sh 2>/dev/null
     source <(sudo /home/admin/build_sdcard.sh -EXPORT)
     GITHUB_USER="${defaultWEBUIuser}"
     GITHUB_REPO="${defaultWEBUIrepo}"
-    GITHUB_BRANCH="${githubBranch}"
+    GITHUB_BRANCH="release/${githubBranch}"
     GITHUB_COMMITORTAG=""
   else
     # get parameters
@@ -79,17 +80,17 @@ if [ "$1" = "1" ] || [ "$1" = "on" ]; then
     echo "# FAIL: No GITHUB_USER provided"
     exit 1
   fi
-  echo "GITHUB_REPO(${GITHUB_REPO})"
+  echo "# GITHUB_REPO(${GITHUB_REPO})"
   if [ "${GITHUB_REPO}" == "" ]; then
     echo "# FAIL: No GITHUB_REPO provided"
     exit 1
   fi
-  echo "GITHUB_BRANCH(${GITHUB_BRANCH})"
+  echo "# GITHUB_BRANCH(${GITHUB_BRANCH})"
   if [ "${GITHUB_BRANCH}" == "" ]; then
     echo "# FAIL: No GITHUB_BRANCH provided"
     exit 1
   fi
-  echo "GITHUB_COMMITORTAG(${GITHUB_COMMITORTAG})"
+  echo "# GITHUB_COMMITORTAG(${GITHUB_COMMITORTAG})"
   if [ "${GITHUB_COMMITORTAG}" == "" ]; then
     echo "# INFO: No GITHUB_COMMITORTAG provided .. will use latest code on branch"
   fi

From ac377df504c4fd283b16ae1b91b9ce50724df271 Mon Sep 17 00:00:00 2001
From: rootzoll <christian@geektank.de>
Date: Fri, 15 Mar 2024 16:29:32 +0100
Subject: [PATCH 04/14] fix typo

---
 home.admin/_version.info | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/home.admin/_version.info b/home.admin/_version.info
index 7b75e92bf..a87d4c5f4 100644
--- a/home.admin/_version.info
+++ b/home.admin/_version.info
@@ -1,3 +1,3 @@
 # RaspiBlitz Version - always [major].[main].[sub] (sub can be a string like '2rc1')
 codeVersion="1.11.0rc4"
-# keep last line with comment ---> IF YOU HAVE A NEW VERSION BRANCH > EDIT ALSO buil_sdcard.sh
\ No newline at end of file
+# keep last line with comment ---> IF YOU HAVE A NEW VERSION BRANCH > EDIT ALSO build_sdcard.sh
\ No newline at end of file

From 2d701b77e2795ac7fff648861ad5a9e57a69e7de Mon Sep 17 00:00:00 2001
From: rootzoll <christian@geektank.de>
Date: Sat, 16 Mar 2024 00:57:24 +0100
Subject: [PATCH 05/14] v1.11.0rc4 downloads

---
 CHANGES.md |  6 +++---
 README.md  | 26 +++++++++++++++-----------
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 765c95133..f001432e0 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -7,17 +7,17 @@
 - Update: RaspberryOS base image 2023-12-05 (Debian 12 Bookworm)
 - Update: amd64 base image: debian-12.5.0-amd64-netinst.iso
 - Update: Bitcoin Core v26.0 [details](https://bitcoincore.org/en/releases/26.0/)
+- Update: LND v0.17.3-beta [details](https://github.com/lightningnetwork/lnd/releases/tag/v0.17.3-beta)
+- Update: Core Lightning v23.11.2 [details](https://github.com/ElementsProject/lightning/releases/tag/v23.11.2)
+- Update: C-lightningREST v0.10.7 [details](https://github.com/Ride-The-Lightning/c-lightning-REST/releases/tag/v0.10.7)
 - Update: Electrum Server in Rust (electrs) v0.10.2 [details](https://github.com/romanz/electrs/blob/master/RELEASE-NOTES.md#0102-dec-31-2023)
 - Update: Fulcrum Electrum server v1.9.8 (CLI install script) [details](https://github.com/cculianu/Fulcrum/releases/tag/v1.9.8)
 - Update: BTC-RPC-Explorer v3.4.0 [details](https://github.com/janoside/btc-rpc-explorer/blob/master/CHANGELOG.md#v340)
 - Update: JoinMarket v0.9.11 [details](https://github.com/JoinMarket-Org/joinmarket-clientserver/releases/tag/v0.9.11)
 - Update: Jam (JoinMarket Web UI) v0.2.0 [details](https://github.com/joinmarket-webui/jam/releases/tag/v0.2.0)
 - Update: JoininBox v0.8.3 [details](https://github.com/openoms/joininbox/releases/tag/v0.8.3)
-- Update: LND v0.17.3-beta [details](https://github.com/lightningnetwork/lnd/releases/tag/v0.17.3-beta)
 - Update: RTL v0.14.1 [details](https://github.com/Ride-The-Lightning/RTL/releases/tag/v0.14.1)
 - Update: Thunderhub v0.13.30 [details](https://github.com/apotdevin/thunderhub/releases/tag/v0.13.30)
-- Update: Core Lightning v23.11.2 [details](https://github.com/ElementsProject/lightning/releases/tag/v23.11.2)
-- Update: C-lightningREST v0.10.7 [details](https://github.com/Ride-The-Lightning/c-lightning-REST/releases/tag/v0.10.7)
 - Update: CLBOSS 0.13+ (latest master 0673c50) [details](https://github.com/ZmnSCPxj/clboss/releases/tag/v0.13)
 - Update: BTCPayServer v1.12.5 [details](https://github.com/btcpayserver/btcpayserver/releases/tag/v1.12.5)
 - Update: Channel Tools (chantools) v0.12.0 [details](https://github.com/lightninglabs/chantools/releases/tag/v0.12.0)
diff --git a/README.md b/README.md
index 34b3c5fec..be1511359 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 
 _Build your own Lightning & Bitcoin Fullnode on a RaspberryPi with an optional Display._
 
-`Version 1.11.0rc0 with bitcoin 26.0, lnd 0.17.3 & Core Lightning 23.11` ([api](https://github.com/fusion44/blitz_api)|[web](https://github.com/raspiblitz/raspiblitz-web))
+`Version 1.11.0rc4 with bitcoin 26.0, lnd 0.17.3 & Core Lightning 23.11.2` ([api](https://github.com/fusion44/blitz_api)|[web](https://github.com/raspiblitz/raspiblitz-web))
 
 ![RaspiBlitz](pictures/raspiblitz.jpg)
 
@@ -166,33 +166,37 @@ In this section you find the latest ready-to-use RaspiBlitz SDcard images. Basic
 
 This is the sd card image you should choose if your at the beginning of your RaspiBlitz journey or you are a casual node runner wanna download the next update/upgrade - with WebUI & fast installing bonus apps.
 
-<!--- _WARNING: THIS IS STILL A RELEASE CANDIDATE VERSION</br>
-JUST USE FOR TESTING, HIGHER RISK OF LOSING FUNDS!_ -->
+_WARNING: THIS IS STILL A RELEASE CANDIDATE VERSION</br>
+JUST USE FOR TESTING, HIGHER RISK OF LOSING FUNDS!_
 
-- **FATPACK SD CARD IMAGE ⮕ [raspiblitz-fat-v1.10.0-2023-09-22.img.gz](https://raspiblitz.fulmo.org/images/raspiblitz-fat-v1.10.0-2023-09-22.img.gz)**
-- SHA-256: 50b48e078d162dfafc2b80025cf493141b0d8ab5774519bff4c3239d5d246f8f
-GPG 64-bit (main): 1C73 060C 7C17 6461 & (sub): AA9D D1B5 CC56 47DA
+- **FATPACK SD CARD IMAGE ⮕ [raspiblitz-fat-v1.11.0rc4-2024-03-15.img.gz](https://raspiblitz.fulmo.org/images/raspiblitz-fat-v1.11.0rc4-2024-03-15.img.gz)**
+- SHA-256: 2081ad3d93e56672b6c75043a825a634a165ff1b4d7ca00d106ba74ab257a6af
+<!--
+- GPG 64-bit (main): 1C73 060C 7C17 6461 & (sub): AA9D D1B5 CC56 47DA
 - Signature-File: [raspiblitz-fat-v1.10.0-2023-09-22.img.gz.sig](https://raspiblitz.fulmo.org/images/raspiblitz-fat-v1.10.0-2023-09-22.img.gz.sig)
 - Torrent: [raspiblitz-fat-v1.10.0-2023-09-22.img.gz.torrent](https://github.com/rootzoll/raspiblitz/raw/dev/home.admin/assets/raspiblitz-fat-v1.10.0-2023-09-22.img.gz.torrent)
 - [How to verify the SD card image after download?](FAQ.md#how-to-verify-the-sd-card-image-after-download)
+-->
 
 ### MINIMAL SD Card Image (Experienced Users - SSH)
 
 This is the sd card image for RaspiBlitz users that are already more experienced and want to use just a limited set of features of the RaspiBlitz. This image has just the bare minimum of features pre-installed - LCD & HDMI output is off by default. Setup, Update or Recovery needs to be done thru SSH login - API & WebUI are later available but are not preinstalled/activated by default. The RaspiBlitz will download & compile just the tools that are in your ´raspiblitz.conf´ - this will take longer but as a trade-off this RaspiBlitz then just runs with a reduced set of dependencies and so a minimalized attack vector and better performance. Its for the serious & experienced node runners.
 
-<!-- _WARNING: THIS IS STILL A RELEASE CANDIDATE VERSION</br>
-JUST USE FOR TESTING, HIGHER RISK OF LOSING FUNDS!_ -->
+_WARNING: THIS IS STILL A RELEASE CANDIDATE VERSION</br>
+JUST USE FOR TESTING, HIGHER RISK OF LOSING FUNDS!_
 
-- **MINIMAL SD CARD IMAGE ⮕ [raspiblitz-min-v1.10.0-2023-09-22.img.gz](https://raspiblitz.fulmo.org/images/raspiblitz-min-v1.10.0-2023-09-22.img.gz)**
-- SHA-256: 77674947b6682cfcc507179038ad532d4b7e60eb5274edca1a62ee78882108ad
+- **MINIMAL SD CARD IMAGE ⮕ [raspiblitz-min-v1.11.0rc4-2024-03-15.img.gz](https://raspiblitz.fulmo.org/images/raspiblitz-min-v1.11.0rc4-2024-03-15.img.gz)**
+- SHA-256: 401c44c056bdaf94bf6b136ab5f5fdb2eab954914f486e31dd1dbbd677907a4c
+<!--
 - GPG 64-bit (main): 1C73 060C 7C17 6461 & (sub): AA9D D1B5 CC56 47DA
 - Signature-File: [raspiblitz-min-v1.10.0-2023-09-22.img.gz.sig](https://raspiblitz.fulmo.org/images/raspiblitz-min-v1.10.0-2023-09-22.img.gz.sig)
 - Torrent: [raspiblitz-min-v1.10.0-2023-09-22.img.gz.torrent](https://github.com/rootzoll/raspiblitz/raw/dev/home.admin/assets/raspiblitz-min-v1.10.0-2023-09-22.img.gz.torrent)
 - [How to verify the SD card image after download?](FAQ.md#how-to-verify-the-sd-card-image-after-download)
+-->
 
 Further Info:
 
-- [What's new in Version 1.10.0 of RaspiBlitz?](CHANGES.md#whats-new-in-version-1100-of-raspiblitz)
+- [What's new in Version 1.11.0 of RaspiBlitz?](CHANGES.md#whats-new-in-version-1110-of-raspiblitz)
 - [How to update my RaspiBlitz?](README.md#updating-raspiblitz-to-new-version)
 - [How to migrate to RaspiBlitz from Umbrel/myNode/Citadel](#make-a-raspiblitz-out-of-your-umbrel-citadel-or-mynode)
 

From 5581a40b2bf77e72f77357382034c471d4225922 Mon Sep 17 00:00:00 2001
From: openoms <43343391+openoms@users.noreply.github.com>
Date: Sun, 17 Mar 2024 08:49:01 +0100
Subject: [PATCH 06/14] base image update: raspios_arm64-2024-03-15 (#4479)

---
 CHANGES.md                           | 2 +-
 build_sdcard.sh                      | 4 ++--
 ci/arm64-rpi/build.arm64-rpi.pkr.hcl | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index f001432e0..750b6826c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -4,7 +4,7 @@
 - New: BTCPay Server PostgreSQL database backup and restore options [details](https://github.com/raspiblitz/raspiblitz/pull/4409)
 - New: Reset option for the self-signed TLS certificate [details](https://github.com/raspiblitz/raspiblitz/pull/4412)
 - New on WebUI: Electrum Connect Screen
-- Update: RaspberryOS base image 2023-12-05 (Debian 12 Bookworm)
+- Update: RaspberryOS arm64 base image 2024-03-15 (Debian 12 Bookworm) [details](https://downloads.raspberrypi.com/raspios_full_arm64/release_notes.txt)
 - Update: amd64 base image: debian-12.5.0-amd64-netinst.iso
 - Update: Bitcoin Core v26.0 [details](https://bitcoincore.org/en/releases/26.0/)
 - Update: LND v0.17.3-beta [details](https://github.com/lightningnetwork/lnd/releases/tag/v0.17.3-beta)
diff --git a/build_sdcard.sh b/build_sdcard.sh
index 0be62066e..5016305a2 100644
--- a/build_sdcard.sh
+++ b/build_sdcard.sh
@@ -2,8 +2,8 @@
 
 #########################################################################
 # Build your SD card image based on: 2023-12-05-raspios-bookworm-arm64.img.xz
-# https://downloads.raspberrypi.org/raspios_arm64/images/raspios_arm64-2023-12-06/
-# SHA256: 5c54f0572d61e443a32dfa80aa8d918049814bfc70ab977f2d545eef45f1658e
+# https://downloads.raspberrypi.org/raspios_arm64/images/raspios_arm64-2024-03-15/
+# SHA256: 7e53a46aab92051d523d7283c080532bebb52ce86758629bf1951be9b4b0560f
 # also change in: raspiblitz/ci/arm64-rpi/build.arm64-rpi.pkr.hcl
 # PGP fingerprint: 8738CD6B956F460C - to check signature:
 # curl -O https://www.raspberrypi.org/raspberrypi_downloads.gpg.key && gpg --import ./raspberrypi_downloads.gpg.key && gpg --verify *.sig
diff --git a/ci/arm64-rpi/build.arm64-rpi.pkr.hcl b/ci/arm64-rpi/build.arm64-rpi.pkr.hcl
index 96ab3a85d..5726087d3 100644
--- a/ci/arm64-rpi/build.arm64-rpi.pkr.hcl
+++ b/ci/arm64-rpi/build.arm64-rpi.pkr.hcl
@@ -1,8 +1,8 @@
 variable "pack" { default = "lean" }
 variable "github_user" { default = "raspiblitz" }
 variable "branch" { default = "dev" }
-variable "image_link" { default = "https://downloads.raspberrypi.org/raspios_arm64/images/raspios_arm64-2023-12-06/2023-12-05-raspios-bookworm-arm64.img.xz" }
-variable "image_checksum" { default = "5c54f0572d61e443a32dfa80aa8d918049814bfc70ab977f2d545eef45f1658e" }
+variable "image_link" { default = "https://downloads.raspberrypi.org/raspios_arm64/images/raspios_arm64-2024-03-15/2024-03-15-raspios-bookworm-arm64.img.xz" }
+variable "image_checksum" { default = "7e53a46aab92051d523d7283c080532bebb52ce86758629bf1951be9b4b0560f" }
 
 source "arm" "raspiblitz-arm64-rpi" {
   file_checksum_type    = "sha256"

From 7426a3a287f0be030d3113de37487ef9d05a03f2 Mon Sep 17 00:00:00 2001
From: openoms <43343391+openoms@users.noreply.github.com>
Date: Sun, 17 Mar 2024 08:49:50 +0100
Subject: [PATCH 07/14] fulcrum update to v1.10.0 (#4481)

---
 CHANGES.md                                 | 2 +-
 home.admin/config.scripts/bonus.fulcrum.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 750b6826c..a4e8ef2e4 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -11,7 +11,7 @@
 - Update: Core Lightning v23.11.2 [details](https://github.com/ElementsProject/lightning/releases/tag/v23.11.2)
 - Update: C-lightningREST v0.10.7 [details](https://github.com/Ride-The-Lightning/c-lightning-REST/releases/tag/v0.10.7)
 - Update: Electrum Server in Rust (electrs) v0.10.2 [details](https://github.com/romanz/electrs/blob/master/RELEASE-NOTES.md#0102-dec-31-2023)
-- Update: Fulcrum Electrum server v1.9.8 (CLI install script) [details](https://github.com/cculianu/Fulcrum/releases/tag/v1.9.8)
+- Update: Fulcrum Electrum server v1.10.0 (CLI install script) [details](https://github.com/cculianu/Fulcrum/releases/tag/v1.10.0)
 - Update: BTC-RPC-Explorer v3.4.0 [details](https://github.com/janoside/btc-rpc-explorer/blob/master/CHANGELOG.md#v340)
 - Update: JoinMarket v0.9.11 [details](https://github.com/JoinMarket-Org/joinmarket-clientserver/releases/tag/v0.9.11)
 - Update: Jam (JoinMarket Web UI) v0.2.0 [details](https://github.com/joinmarket-webui/jam/releases/tag/v0.2.0)
diff --git a/home.admin/config.scripts/bonus.fulcrum.sh b/home.admin/config.scripts/bonus.fulcrum.sh
index ea1d8b065..9939fcfbc 100644
--- a/home.admin/config.scripts/bonus.fulcrum.sh
+++ b/home.admin/config.scripts/bonus.fulcrum.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # https://github.com/cculianu/Fulcrum/releases
-fulcrumVersion="1.9.8"
+fulcrumVersion="1.10.0"
 
 portTCP="50021"
 portSSL="50022"

From 9e64abc9d9447341f06918db9c64f62041fdc7b0 Mon Sep 17 00:00:00 2001
From: Stephan Oeste <emzy@emzy.de>
Date: Sun, 17 Mar 2024 08:52:22 +0100
Subject: [PATCH 08/14] Fix electrs data dir user at update, update electrs to
 v0.10.4 (#4480)

* Fix electrs data dir user at update
* check and create, fix persmissions of storage dir when on
the data disk is not always available yet when the install option is running
* apply formatting
* fix storage dir before code install check
* electrs update v0.10.4
* update in changes
---------
Co-authored-by: openoms <oms@tuta.io>
---
 CHANGES.md                                 |   2 +-
 home.admin/config.scripts/bonus.electrs.sh | 112 +++++++++++----------
 2 files changed, 61 insertions(+), 53 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index a4e8ef2e4..9083e40b9 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -10,7 +10,7 @@
 - Update: LND v0.17.3-beta [details](https://github.com/lightningnetwork/lnd/releases/tag/v0.17.3-beta)
 - Update: Core Lightning v23.11.2 [details](https://github.com/ElementsProject/lightning/releases/tag/v23.11.2)
 - Update: C-lightningREST v0.10.7 [details](https://github.com/Ride-The-Lightning/c-lightning-REST/releases/tag/v0.10.7)
-- Update: Electrum Server in Rust (electrs) v0.10.2 [details](https://github.com/romanz/electrs/blob/master/RELEASE-NOTES.md#0102-dec-31-2023)
+- Update: Electrum Server in Rust (electrs) v0.10.4 [details](https://github.com/romanz/electrs/blob/master/RELEASE-NOTES.md#0104-mar-15-2024)
 - Update: Fulcrum Electrum server v1.10.0 (CLI install script) [details](https://github.com/cculianu/Fulcrum/releases/tag/v1.10.0)
 - Update: BTC-RPC-Explorer v3.4.0 [details](https://github.com/janoside/btc-rpc-explorer/blob/master/CHANGELOG.md#v340)
 - Update: JoinMarket v0.9.11 [details](https://github.com/JoinMarket-Org/joinmarket-clientserver/releases/tag/v0.9.11)
diff --git a/home.admin/config.scripts/bonus.electrs.sh b/home.admin/config.scripts/bonus.electrs.sh
index 9f77473f2..27fd799e4 100755
--- a/home.admin/config.scripts/bonus.electrs.sh
+++ b/home.admin/config.scripts/bonus.electrs.sh
@@ -1,17 +1,17 @@
 #!/bin/bash
 
 # https://github.com/romanz/electrs/releases
-ELECTRSVERSION="v0.10.2"
+ELECTRSVERSION="v0.10.4"
 
 # command info
 if [ $# -eq 0 ] || [ "$1" = "-h" ] || [ "$1" = "-help" ]; then
- echo "config script to switch the Electrum Rust Server on or off"
- echo "bonus.electrs.sh status -> dont call in loops"
- echo "bonus.electrs.sh status-sync"
- echo "bonus.electrs.sh [on|off|menu|update]"
- echo "bonus.electrs.sh [install|uninstall]"
- echo "installs the version $ELECTRSVERSION"
- exit 1
+  echo "config script to switch the Electrum Rust Server on or off"
+  echo "bonus.electrs.sh status -> dont call in loops"
+  echo "bonus.electrs.sh status-sync"
+  echo "bonus.electrs.sh [on|off|menu|update]"
+  echo "bonus.electrs.sh [install|uninstall]"
+  echo "installs the version $ELECTRSVERSION"
+  exit 1
 fi
 
 PGPsigner="romanz"
@@ -55,7 +55,10 @@ if [ "$1" = "status" ]; then
     localPortRunning=$(sudo netstat -an | grep -c '0.0.0.0:50001')
     echo "localTCPPortActive=${localPortRunning}"
 
-    publicPortRunning=$(nc -z -w6 ${publicip} 50001 2>/dev/null; echo $?)
+    publicPortRunning=$(
+      nc -z -w6 ${publicip} 50001 2>/dev/null
+      echo $?
+    )
     if [ "${publicPortRunning}" == "0" ]; then
       # OK looks good - but just means that something is answering on that port
       echo "publicTCPPortAnswering=1"
@@ -66,7 +69,10 @@ if [ "$1" = "status" ]; then
     echo "portSSL='50002'"
     localPortRunning=$(sudo netstat -an | grep -c '0.0.0.0:50002')
     echo "localHTTPPortActive=${localPortRunning}"
-    publicPortRunning=$(nc -z -w6 ${publicip} 50002 2>/dev/null; echo $?)
+    publicPortRunning=$(
+      nc -z -w6 ${publicip} 50002 2>/dev/null
+      echo $?
+    )
     if [ "${publicPortRunning}" == "0" ]; then
       # OK looks good - but just means that something is answering on that port
       echo "publicHTTPPortAnswering=1"
@@ -177,7 +183,7 @@ This can take multiple hours.
   fi
 
   if [ ${nginxTest} -eq 0 ]; then
-     dialog --title "Testing nginx.conf has failed" --msgbox "
+    dialog --title "Testing nginx.conf has failed" --msgbox "
 Nginx is in a failed state. Will attempt to fix.
 Try connecting via port 50002 or Tor again once finished.
 Check 'sudo nginx -t' for a detailed error message.
@@ -194,17 +200,17 @@ Check 'sudo nginx -t' for a detailed error message.
   fi
 
   # Options (available without TOR)
-  OPTIONS=( \
-        CONNECT "How to Connect" \
-        REINDEX "Delete&Rebuild Index" \
-        STATUS "ElectRS Status Info"
-	)
+  OPTIONS=(
+    CONNECT "How to Connect"
+    REINDEX "Delete&Rebuild Index"
+    STATUS "ElectRS Status Info"
+  )
 
   CHOICE=$(whiptail --clear --title "Electrum Rust Server" --menu "menu" 10 50 4 "${OPTIONS[@]}" 2>&1 >/dev/tty)
   clear
 
   case $CHOICE in
-    CONNECT)
+  CONNECT)
     echo "######## How to Connect to Electrum Rust Server #######"
     echo
     echo "Install the Electrum Wallet App on your laptop from:"
@@ -235,13 +241,13 @@ Check 'sudo nginx -t' for a detailed error message.
     read key
     sudo /home/admin/config.scripts/blitz.display.sh hide
     ;;
-    STATUS)
+  STATUS)
     sudo /home/admin/config.scripts/bonus.electrs.sh status
     echo
     echo "Press ENTER to get back to main menu."
     read key
     ;;
-    REINDEX)
+  REINDEX)
     echo "######## Delete/Rebuild Index ########"
     echo "# stopping service"
     sudo systemctl stop electrs
@@ -264,15 +270,15 @@ fi
 echo "# Making sure services are not running"
 sudo systemctl stop electrs 2>/dev/null
 
-# uninstall
+# install
 if [ "$1" = "install" ]; then
   echo "# INSTALL ELECTRS"
 
   if id "electrs" &>/dev/null; then
-      echo "# user electrs exists already (codebase is installed)"
+    echo "# user electrs exists already (codebase is installed)"
   else
     echo "# Installing codebase"
-    
+
     echo
     echo "# Creating the electrs user"
     echo
@@ -284,7 +290,7 @@ if [ "$1" = "install" ]; then
     echo
     # https://github.com/romanz/electrs/blob/master/doc/usage.md#build-dependencies
     sudo -u electrs curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sudo -u electrs sh -s -- --default-toolchain none -y
-    sudo apt install -y clang cmake build-essential  # for building 'rust-rocksdb'
+    sudo apt install -y clang cmake build-essential # for building 'rust-rocksdb'
 
     echo
     echo "# Downloading and building electrs $ELECTRSVERSION. This will take ~40 minutes"
@@ -296,18 +302,11 @@ if [ "$1" = "install" ]; then
 
     # verify
     sudo -u electrs /home/admin/config.scripts/blitz.git-verify.sh \
-     "${PGPsigner}" "${PGPpubkeyLink}" "${PGPpubkeyFingerprint}" || exit 1
+      "${PGPsigner}" "${PGPpubkeyLink}" "${PGPpubkeyFingerprint}" || exit 1
 
     # build
     sudo -u electrs /home/electrs/.cargo/bin/cargo build --locked --release || exit 1
-
-    echo
-    echo "# The electrs database will be built in /mnt/hdd/app-storage/electrs/db. Takes ~18 hours and ~50Gb diskspace"
-    echo
-    sudo mkdir /mnt/hdd/app-storage/electrs 2>/dev/null
-    sudo chown -R electrs:electrs /mnt/hdd/app-storage/electrs
   fi
-
   exit 0
 fi
 
@@ -315,6 +314,16 @@ fi
 if [ "$1" = "1" ] || [ "$1" = "on" ]; then
   echo "# ACTIVATING ELECTRS"
 
+  # check and create storage dir
+  if ! sudo ls /mnt/hdd/app-storage/electrs 2>/dev/null; then
+    sudo mkdir /mnt/hdd/app-storage/electrs
+    echo
+    echo "# The electrs database will be built in /mnt/hdd/app-storage/electrs/db. Takes ~18 hours and ~50Gb diskspace"
+    echo
+  fi
+  # always fix user id
+  sudo chown -R electrs:electrs /mnt/hdd/app-storage/electrs
+
   isInstalled=$(sudo ls /etc/systemd/system/electrs.service 2>/dev/null | grep -c 'electrs.service')
   if [ ${isInstalled} -eq 0 ]; then
 
@@ -365,12 +374,11 @@ server_banner = \"Welcome to electrs $ELECTRSVERSION - the Electrum Rust Server
     echo
     echo "# Checking for config.toml"
     echo
-    if [ ! -f "/home/electrs/.electrs/config.toml" ]
-        then
-            echo "Failed to create config.toml"
-            exit 1
-        else
-            echo "OK"
+    if [ ! -f "/home/electrs/.electrs/config.toml" ]; then
+      echo "Failed to create config.toml"
+      exit 1
+    else
+      echo "OK"
     fi
 
     echo
@@ -378,14 +386,14 @@ server_banner = \"Welcome to electrs $ELECTRSVERSION - the Electrum Rust Server
     echo
     isElectrs=$(sudo cat /etc/nginx/nginx.conf 2>/dev/null | grep -c 'upstream electrs')
     if [ ${isElectrs} -gt 0 ]; then
-            echo "electrs is already configured with Nginx. To edit manually run \`sudo nano /etc/nginx/nginx.conf\`"
+      echo "electrs is already configured with Nginx. To edit manually run \`sudo nano /etc/nginx/nginx.conf\`"
 
     elif [ ${isElectrs} -eq 0 ]; then
 
-            isStream=$(sudo cat /etc/nginx/nginx.conf 2>/dev/null | grep -c 'stream {')
-            if [ ${isStream} -eq 0 ]; then
+      isStream=$(sudo cat /etc/nginx/nginx.conf 2>/dev/null | grep -c 'stream {')
+      if [ ${isStream} -eq 0 ]; then
 
-            echo "
+        echo "
 stream {
         upstream electrs {
                 server 127.0.0.1:50001;
@@ -402,9 +410,9 @@ stream {
         }
 }" | sudo tee -a /etc/nginx/nginx.conf
 
-            elif [ ${isStream} -eq 1 ]; then
-                    sudo truncate -s-2 /etc/nginx/nginx.conf
-                    echo "
+      elif [ ${isStream} -eq 1 ]; then
+        sudo truncate -s-2 /etc/nginx/nginx.conf
+        echo "
         upstream electrs {
                 server 127.0.0.1:50001;
         }
@@ -420,10 +428,10 @@ stream {
         }
 }" | sudo tee -a /etc/nginx/nginx.conf
 
-            elif [ ${isStream} -gt 1 ]; then
-                    echo " Too many \`stream\` commands in nginx.conf. Please edit manually: \`sudo nano /etc/nginx/nginx.conf\` and retry"
-                    exit 1
-            fi
+      elif [ ${isStream} -gt 1 ]; then
+        echo " Too many \`stream\` commands in nginx.conf. Please edit manually: \`sudo nano /etc/nginx/nginx.conf\` and retry"
+        exit 1
+      fi
     fi
 
     echo
@@ -477,7 +485,7 @@ WantedBy=multi-user.target
   fi
 
   # whitelist downloading to localhost from bitcoind
-  if ! sudo grep -Eq "^whitelist=download@127.0.0.1" /mnt/hdd/bitcoin/bitcoin.conf;then
+  if ! sudo grep -Eq "^whitelist=download@127.0.0.1" /mnt/hdd/bitcoin/bitcoin.conf; then
     echo "whitelist=download@127.0.0.1" | sudo tee -a /mnt/hdd/bitcoin/bitcoin.conf
     bitcoindRestart=yes
   fi
@@ -569,7 +577,7 @@ if [ "$1" = "update" ]; then
   sudo -u electrs git fetch
 
   localVersion=$(/home/electrs/electrs/target/release/electrs --version)
-  updateVersion=$(curl --header "X-GitHub-Api-Version:2022-11-28" -s https://api.github.com/repos/romanz/electrs/releases/latest|grep tag_name|head -1|cut -d '"' -f4)
+  updateVersion=$(curl --header "X-GitHub-Api-Version:2022-11-28" -s https://api.github.com/repos/romanz/electrs/releases/latest | grep tag_name | head -1 | cut -d '"' -f4)
 
   if [ $localVersion = $updateVersion ]; then
     echo "# Up-to-date on version $localVersion"
@@ -580,11 +588,11 @@ if [ "$1" = "update" ]; then
     sudo -u electrs git reset --hard $updateVersion
 
     sudo -u electrs /home/admin/config.scripts/blitz.git-verify.sh \
-     "${PGPsigner}" "${PGPpubkeyLink}" "${PGPpubkeyFingerprint}" || exit 1
+      "${PGPsigner}" "${PGPpubkeyLink}" "${PGPpubkeyFingerprint}" || exit 1
 
     echo "# Installing build dependencies"
     sudo -u electrs curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sudo -u electrs sh -s -- --default-toolchain none -y
-    sudo apt install -y clang cmake build-essential  # for building 'rust-rocksdb'
+    sudo apt install -y clang cmake build-essential # for building 'rust-rocksdb'
     echo
 
     echo "# Build Electrs ..."

From 588820ff13ab63273a30b1475f66e5c6e24a554b Mon Sep 17 00:00:00 2001
From: openoms <43343391+openoms@users.noreply.github.com>
Date: Mon, 18 Mar 2024 15:02:34 +0100
Subject: [PATCH 09/14] cln update to v24.02.1 (#4482)

---
 CHANGES.md                              | 4 ++--
 home.admin/config.scripts/cl.install.sh | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 9083e40b9..815f0dae3 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,7 +8,7 @@
 - Update: amd64 base image: debian-12.5.0-amd64-netinst.iso
 - Update: Bitcoin Core v26.0 [details](https://bitcoincore.org/en/releases/26.0/)
 - Update: LND v0.17.3-beta [details](https://github.com/lightningnetwork/lnd/releases/tag/v0.17.3-beta)
-- Update: Core Lightning v23.11.2 [details](https://github.com/ElementsProject/lightning/releases/tag/v23.11.2)
+- Update: Core Lightning v24.02.1 [details](https://github.com/ElementsProject/lightning/releases/tag/v24.02.1)
 - Update: C-lightningREST v0.10.7 [details](https://github.com/Ride-The-Lightning/c-lightning-REST/releases/tag/v0.10.7)
 - Update: Electrum Server in Rust (electrs) v0.10.4 [details](https://github.com/romanz/electrs/blob/master/RELEASE-NOTES.md#0104-mar-15-2024)
 - Update: Fulcrum Electrum server v1.10.0 (CLI install script) [details](https://github.com/cculianu/Fulcrum/releases/tag/v1.10.0)
@@ -24,7 +24,7 @@
 - Update: LNbits 0.11.3 [details](https://github.com/lnbits/lnbits/releases/tag/0.11.3)
 - Update: Circuitbreaker v0.5.1 [details](https://github.com/lightningequipment/circuitbreaker/blob/master/README.md)
 - Experimental: LNDK (runs on top of LND to help forward onion messages (BOLT 12)) [details](https://github.com/lndk-org/lndk)
-- Fix: PyBlock 2.2.3 [details](https://github.com/curly60e/pyblock/blob/master/README.md) 
+- Fix: PyBlock 2.2.3 [details](https://github.com/curly60e/pyblock/blob/master/README.md)
 - Refactor: Wifi config with file on sd card
 - Deactivated for Repair: LNDg [details](https://github.com/raspiblitz/raspiblitz/issues/4418)
 - Deprecated: Homer Dashboard (remove from SSH menus, config script will stay with possible future removal)
diff --git a/home.admin/config.scripts/cl.install.sh b/home.admin/config.scripts/cl.install.sh
index bd6cca2bc..2084ef0b6 100644
--- a/home.admin/config.scripts/cl.install.sh
+++ b/home.admin/config.scripts/cl.install.sh
@@ -2,7 +2,7 @@
 # https://lightning.readthedocs.io/
 
 # https://github.com/ElementsProject/lightning/releases
-CLVERSION="v23.11.2"
+CLVERSION="v24.02.1"
 
 # install the latest master by using the last commit id
 # https://github.com/ElementsProject/lightning/commit/master

From f1342ebcfd12b2e81e93e328c1e6393dd73c72be Mon Sep 17 00:00:00 2001
From: /rootzoll <christian@geektank.de>
Date: Mon, 18 Mar 2024 15:59:02 +0100
Subject: [PATCH 10/14] Fix manual provisioning with stop file flag (#4485)

---
 FAQ.dev.md                                    |  4 +++
 home.admin/00infoLCD.sh                       |  1 -
 home.admin/00raspiblitz.sh                    |  1 -
 home.admin/_background.sh                     |  1 -
 home.admin/_bootstrap.sh                      | 35 +++++++++++--------
 home.admin/_cache.sh                          | 17 +++++++++
 .../setup.scripts/controlSetupDialog.sh       |  5 +--
 7 files changed, 45 insertions(+), 19 deletions(-)

diff --git a/FAQ.dev.md b/FAQ.dev.md
index cdce96fbe..d98d35e05 100644
--- a/FAQ.dev.md
+++ b/FAQ.dev.md
@@ -218,6 +218,10 @@ Now to sync your branch namend BRANCH on your forked repo with your RaspiBlitz,
 
 So your workflow can go like this: You write code on your local computer. Commit to your local repo, push it to your forked repo and use the sync-script above to get the code to your RaspiBlitz.
 
+### How can I manual provision an image with updated code?
+
+To boot an already build sd card image with your updated raspiblitz code base you can use the `stop` file flag. This will make the `_bootstrap.sh` script stop basically before making any setup or recovery changes to the system. You can SSH in an use the `github` command to update the raspiblitz code and then use `release` command. To set the `stop` file flag. Insert a fresh written sd card into your PC and on the root of `bootfs` drive with a file manager place a empty file simply called `stop` (with no file extension).
+
 ### How to add an app to the RaspiBlitz?
 
 To add your app you can fork the raspiblitz repo, follow the `/home.admin/config.scripts/bonus.template.sh` script [see code](https://github.com/raspiblitz/raspiblitz/blob/dev/home.admin/config.scripts/bonus.template.sh), copy/adapt it, test it on your RaspiBlitz and make a PR back to the main repo.
diff --git a/home.admin/00infoLCD.sh b/home.admin/00infoLCD.sh
index dca4e89f9..85ecb0fcf 100755
--- a/home.admin/00infoLCD.sh
+++ b/home.admin/00infoLCD.sh
@@ -86,7 +86,6 @@ while :
 
     # get config info if already available (with state value)
     source ${infoFile}
-    source <(/home/admin/_cache.sh get state message)
 
     configExists=$(ls "${configFile}" 2>/dev/null | grep -c '.conf')
     if [ ${configExists} -eq 1 ]; then
diff --git a/home.admin/00raspiblitz.sh b/home.admin/00raspiblitz.sh
index 9e26526ae..fa47a2bcc 100755
--- a/home.admin/00raspiblitz.sh
+++ b/home.admin/00raspiblitz.sh
@@ -13,7 +13,6 @@ source /mnt/hdd/raspiblitz.conf 2>/dev/null
 # INFOFILE - state data from bootstrap
 infoFile="/home/admin/raspiblitz.info"
 source ${infoFile}
-source <(/home/admin/_cache.sh get state message)
 
 # check that basic system phase/state information is available
 if [ "${setupPhase}" == "" ] || [ "${state}" == "" ]; then
diff --git a/home.admin/_background.sh b/home.admin/_background.sh
index c1b7970d7..9def40a1b 100755
--- a/home.admin/_background.sh
+++ b/home.admin/_background.sh
@@ -43,7 +43,6 @@ do
   # source info & config file fresh on every loop
   source ${infoFile} 2>/dev/null
   source ${configFile} 2>/dev/null
-  source <(/home/admin/_cache.sh get state setupPhase)
 
   ####################################################
   # SKIP BACKGROUND TASK LOOP ON CERTAIN SYSTEM STATES
diff --git a/home.admin/_bootstrap.sh b/home.admin/_bootstrap.sh
index a50de0558..f0673561c 100755
--- a/home.admin/_bootstrap.sh
+++ b/home.admin/_bootstrap.sh
@@ -90,15 +90,16 @@ ln_cl_signet_sync_initial_done=0
 source ${infoFile} 2>/dev/null
 
 # write fresh raspiblitz.info file
-echo "baseimage=${baseimage}" > $infoFile
+echo "state=starting" > $infoFile
+echo "message=starting" >> $infoFile
+echo "setupPhase=${setupPhase}" >> $infoFile
+echo "setupStep=${setupStep}" >> $infoFile
+echo "baseimage=${baseimage}" >> $infoFile
 echo "cpu=${cpu}" >> $infoFile
 echo "blitzapi=${blitzapi}" >> $infoFile
 echo "displayClass=${displayClass}" >> $infoFile
 echo "displayType=${displayType}" >> $infoFile
-echo "setupPhase=${setupPhase}" >> $infoFile
-echo "setupStep=${setupStep}" >> $infoFile
 echo "fsexpanded=${fsexpanded}" >> $infoFile
-echo "state=starting" >> $infoFile
 echo "btc_mainnet_sync_initial_done=${btc_mainnet_sync_initial_done}" >> $infoFile
 echo "btc_testnet_sync_initial_done=${btc_testnet_sync_initial_done}" >> $infoFile
 echo "btc_signet_sync_initial_done=${btc_signet_sync_initial_done}" >> $infoFile
@@ -114,6 +115,22 @@ chmod 664 ${infoFile}
 # write content of raspiblitz.info to logs
 cat $infoFile >> $logFile
 
+######################################
+# STOP file flag - for manual provision
+
+# when a file 'stop' is on the sd card bootfs partition root - stop for manual provision
+flagExists=$(ls /boot/firmware/stop | grep -c 'stop')
+if [ "${flagExists}" == "1" ]; then
+  # remove flag
+  rm /boot/firmware/stop
+  # set state info
+  /home/admin/_cache.sh set state "stop"
+  /home/admin/_cache.sh set message "stopped for manual provision"
+  # log info
+  echo "INFO: 'bootstrap stopped - run release after manual provison'" >> ${logFile}
+  exit 0
+fi
+
 #########################
 # INIT RaspiBlitz Cache
 #########################
@@ -155,16 +172,6 @@ source ${configFile} 2>/dev/null
 ######################################
 # CHECK SD CARD STATE
 
-# when a file 'stop' is on the sd card bootfs partition root - stop for manual provision
-flagExists=$(ls /boot/firmware/stop | grep -c 'stop')
-if [ "${flagExists}" == "1" ]; then
-  # remove flag
-  rm /boot/firmware/stop
-  # log info
-  echo "INFO: 'bootstrap stopped - run release after manual provison'" >> ${logFile}
-  exit 0
-fi
-
 # wifi config by file on sd card
 wifiFileExists=$(ls /boot/firmware/wifi | grep -c 'wifi')
 wpaFileExists=$(ls /boot/firmware/wpa_supplicant.conf | grep -c 'wpa_supplicant.conf')
diff --git a/home.admin/_cache.sh b/home.admin/_cache.sh
index 25e115291..7547afe72 100755
--- a/home.admin/_cache.sh
+++ b/home.admin/_cache.sh
@@ -148,6 +148,23 @@ elif [ "$1" = "set" ] || [ "$1" = "init" ]; then
     exit 1
   fi
 
+  # update certain values also in raspiblitz.info
+  if [ "${keystr}" = "state" ]; then
+    # change value in raspiblitz.info
+    sudo sed -i "s/^state=.*/state='${valuestr}'/g" ${infoFile}
+  fi
+  if [ "${keystr}" = "message" ]; then
+    # change value in raspiblitz.info
+    sudo sed -i "s/^message=.*/message='${valuestr}'/g" ${infoFile}
+  fi
+  if [ "${keystr}" = "setupPhase" ]; then
+    # change value in raspiblitz.info
+    sudo sed -i "s/^setupPhase=.*/setupPhase='${valuestr}'/g" ${infoFile}
+  fi
+  if [ "${keystr}" = "setupStep" ]; then
+    # change value in raspiblitz.info
+    sudo sed -i "s/^setupStep=.*/setupStep='${valuestr}'/g" ${infoFile}
+  fi 
 
   NX=""
   if [ "$1" = "init" ]; then
diff --git a/home.admin/setup.scripts/controlSetupDialog.sh b/home.admin/setup.scripts/controlSetupDialog.sh
index c42f4b879..bbd292e98 100755
--- a/home.admin/setup.scripts/controlSetupDialog.sh
+++ b/home.admin/setup.scripts/controlSetupDialog.sh
@@ -17,7 +17,7 @@ echo "# RASPIBLITZ SETUP STATE" > $SETUPFILE
 sudo chown admin:admin $SETUPFILE
 sudo chmod 777 $SETUPFILE
 
-source <(/home/admin/_cache.sh get setupPhase dnsworking)
+source <(/home/admin/_cache.sh get dnsworking)
 
 # remember original setupphase
 orgSetupPhase="${setupPhase}"
@@ -90,7 +90,8 @@ if [ "${setupPhase}" == "migration" ]; then
 
 fi
 
-source <(/home/admin/_cache.sh get setupPhase)
+# fresh import setup values
+source /home/admin/raspiblitz.info
 
 ############################################
 # DEFAULT: Basic Setup menu

From 24a3c06a35a0926dc7a74994b0edd82b80b21d9a Mon Sep 17 00:00:00 2001
From: /rootzoll <christian@geektank.de>
Date: Tue, 19 Mar 2024 00:05:00 +0100
Subject: [PATCH 11/14] Info about API/WebUI deactivation on fatpack provision 
 (#4486)

fixes #4468
---
 home.admin/_provision_.sh | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/home.admin/_provision_.sh b/home.admin/_provision_.sh
index 81ace2945..71b2d20cc 100755
--- a/home.admin/_provision_.sh
+++ b/home.admin/_provision_.sh
@@ -183,21 +183,25 @@ sed -i "s/^setupStep=.*/setupStep=100/g" /home/admin/raspiblitz.info
 ##########################
 # PROVISIONING SERVICES
 ##########################
-/home/admin/_cache.sh set message "Installing Services"
+
+echo "### CHECKING BLITZ-API/FRONT STATUS ###" >> ${logFile}
+blitzApiInstalled=$(systemctl status blitzapi | grep -c "loaded")
+echo "# blitzapi(${blitzapi}) blitzApiInstalled(${blitzApiInstalled})"
+if [ "${blitzapi}" != "on" ] && [ ${blitzApiInstalled} -gt 0 ]; then
+  /home/admin/_cache.sh set message "Deactivated API/WebUI (as in your config) - please use SSH for further setup"
+  sleep 10
+else
+  /home/admin/_cache.sh set message "Installing Services"
+fi
 
 # BLITZ WEB SERVICE
 echo "Provisioning BLITZ WEB SERVICE - run config script" >> ${logFile}
 /home/admin/config.scripts/blitz.web.sh https-on >> ${logFile} 2>&1
 
-echo "### CHECKING BLITZ-API/FRONT STATUS ###" >> ${logFile}
-blitzApiInstalled=$(systemctl status blitzapi | grep -c "loaded")
-echo "# blitzapi(${blitzapi}) blitzApiInstalled(${blitzApiInstalled})"
-
 # deinstall when not explizit 'on' when blitzapi is installed by fatpack
 # https://github.com/raspiblitz/raspiblitz/issues/4171#issuecomment-1728302628
 if [ "${blitzapi}" != "on" ] && [ ${blitzApiInstalled} -gt 0 ]; then
   echo "blitz_api directory exists & blitzapi is not 'on' - deactivating blitz-api" >> ${logFile}
-  /home/admin/_cache.sh set message "Deactivate API/WebUI"
   /home/admin/config.scripts/blitz.web.api.sh off >> ${logFile} 2>&1
   /home/admin/config.scripts/blitz.web.ui.sh off >> ${logFile} 2>&1
 fi

From 2c56f5248b6a85708fe4f1032d277112707d6cca Mon Sep 17 00:00:00 2001
From: rootzoll <christian@geektank.de>
Date: Tue, 19 Mar 2024 15:24:25 +0100
Subject: [PATCH 12/14] #4477 packer min-build without display

---
 ci/arm64-rpi/build.raspiblitz.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ci/arm64-rpi/build.raspiblitz.sh b/ci/arm64-rpi/build.raspiblitz.sh
index 2605f01f0..33008edfd 100644
--- a/ci/arm64-rpi/build.raspiblitz.sh
+++ b/ci/arm64-rpi/build.raspiblitz.sh
@@ -5,12 +5,14 @@ wget https://raw.githubusercontent.com/${github_user}/raspiblitz/${branch}/build
 
 if [ "${pack}" = "fatpack" ]; then
   fatpack="1"
+  display="lcd"
 else
   fatpack="0"
+  display="headless"
 fi
 
 # make /dev/shm world writable for qemu
 sudo chmod 777 /dev/shm
 
 echo 'Build RaspiBlitz ...'
-bash build_sdcard.sh -f ${fatpack} -u ${github_user} -b ${branch} -t false -w off -i false
+bash build_sdcard.sh -f ${fatpack} -u ${github_user} -b ${branch} -t false -w off -i false -d ${display}

From 5e461ff1ce84355fbaf68d4a977a93683f2bb972 Mon Sep 17 00:00:00 2001
From: /rootzoll <christian@geektank.de>
Date: Tue, 19 Mar 2024 18:01:55 +0100
Subject: [PATCH 13/14] #4122 lnproxy deactivate for repair (#4487)

---
 CHANGES.md                                 |  1 +
 home.admin/config.scripts/bonus.lnproxy.sh | 15 +++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/CHANGES.md b/CHANGES.md
index 815f0dae3..1932c9917 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -27,6 +27,7 @@
 - Fix: PyBlock 2.2.3 [details](https://github.com/curly60e/pyblock/blob/master/README.md)
 - Refactor: Wifi config with file on sd card
 - Deactivated for Repair: LNDg [details](https://github.com/raspiblitz/raspiblitz/issues/4418)
+- Deactivated for Repair: lnproxy [details](https://github.com/raspiblitz/raspiblitz/issues/4122)
 - Deprecated: Homer Dashboard (remove from SSH menus, config script will stay with possible future removal)
 - Deprecated: Bitcoinminds (remove from SSH menus, config script will stay with possible future removal)
 - Remove: ItchySats (unmaintained project / in consent with dev)
diff --git a/home.admin/config.scripts/bonus.lnproxy.sh b/home.admin/config.scripts/bonus.lnproxy.sh
index 01f50f003..74f80fc25 100644
--- a/home.admin/config.scripts/bonus.lnproxy.sh
+++ b/home.admin/config.scripts/bonus.lnproxy.sh
@@ -1,10 +1,14 @@
 #!/bin/bash
 
+# Deactivated - see https://github.com/raspiblitz/raspiblitz/issues/4122
+# Needs comitted maintainer or will be removed in future versions
+
 # https://github.com/lnproxy/lnproxy/commits/main
 LNPROXYVERSION="c1031bbe507623f8f196ff83aa5ea504cca05143"
 
 # command info
 if [ $# -eq 0 ] || [ "$1" = "-h" ] || [ "$1" = "-help" ]; then
+  echo "DEACTIVATED FOR REPAIR - see #4122"
   echo "config script to install or uninstall the lnproxy server"
   echo "bonus.lnproxy.sh [on|off|menu]"
   echo "installs the version $LNPROXYVERSION by default"
@@ -83,7 +87,18 @@ if [ "$1" = "1" ] || [ "$1" = "on" ]; then
 
   # build
   sudo -u lnproxy /usr/local/go/bin/go get lnproxy
+  if [ $? -ne 0 ]; then
+    echo "# FAIL -> go get lnproxy"
+    sudo userdel -rf lnproxy 2>/dev/null
+    exit 1
+  fi
+
   sudo -u lnproxy /usr/local/go/bin/go build
+  if [ $? -ne 0 ]; then
+    echo "# FAIL -> go build"
+    sudo userdel -rf lnproxy 2>/dev/null
+    exit 1
+  fi
 
   # manual start (in tmux)
   # sudo -u lnproxy /home/lnproxy/lnproxy/lnproxy -lnd-cert /home/lnproxy/.lnd/tls.cert /home/lnproxy/lnproxy.macaroon

From 1b01d920db9077c9fd3a0943ba88a51cfd47b7a2 Mon Sep 17 00:00:00 2001
From: rootzoll <christian@geektank.de>
Date: Tue, 19 Mar 2024 22:47:43 +0100
Subject: [PATCH 14/14] version v1.11.0rc5

---
 home.admin/_version.info | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/home.admin/_version.info b/home.admin/_version.info
index a87d4c5f4..968c2e000 100644
--- a/home.admin/_version.info
+++ b/home.admin/_version.info
@@ -1,3 +1,3 @@
 # RaspiBlitz Version - always [major].[main].[sub] (sub can be a string like '2rc1')
-codeVersion="1.11.0rc4"
+codeVersion="1.11.0rc5"
 # keep last line with comment ---> IF YOU HAVE A NEW VERSION BRANCH > EDIT ALSO build_sdcard.sh
\ No newline at end of file