1.11.3 — Actionable Admin setup and self-healing nginx runtime paths

2026-08-11

django-mojo 1.11.3 adds a curated Admin Settings home, makes Setup and live QA feedback actionable, fixes evidence and datetime rendering, and automatically converges nginx runtime directories during deployment.

Added

• The built-in Admin now has a first-class Settings page for curated database-backed configuration, effective-value provenance, authentication presentation, and expected fleet topology.
• Deployments now converge and audit persistent nginx client-body and upstream spill directories before nginx validation and reload.

Changed

• Dashboard, Platform, and System Setup now lead operators to exact owners and actions, use summary-first evidence, and provide durable loading, recent-auth, progress, and completion feedback.
• The live Admin QA bridge can safely exercise a public HTTPS installation with isolated cookies and a pinned upstream while serving local portal assets.
• System Setup now prefills the public API origin from a trusted browser or QA context and presents existing S3 adoption as a guided choice that preserves objects and unrelated configuration.

Fixed

• Admin timestamps now render both epoch and ISO values correctly.
• Fleet health no longer reports zero runners when live edge runners are present.
• System Setup no longer treats inferred local listeners or optional static directories as installation failures.
• Setup evidence and choice values no longer collapse ordinary bucket names, domains, regions, and counts to [truncated].
• Setup email and S3 repairs now expose usable choices and state clearly when changes were applied and verified.
• Settings cards render optional values safely, and topology token editing no longer fails on malformed JavaScript.
• MojoSec validates the effective merged profile rather than rejecting valid inherited configuration.

Security

• Live Admin QA blocks DNS rebinding, private-address targets, unsafe redirects, credential forwarding, and browser-visible upstream cookies.
• Admin Settings refuses secret or duplicate override disclosure and non-public or reserved WebApp origins, and keeps mutation values out of request logs.

Upgrade notes

• The first deployment creates and verifies django-mojo-owned persistent nginx spill directories and installs the matching global nginx fragment before reload; no manual node repair is required.