---
title: "1.7.1 — Standard host integrity, and vhost naming without ceremony"
description: "Adds a standard AL2023 host-integrity profile — file-integrity monitoring, RPM verification, and exact trusted-change evidence — for nodes that opt in. Fixes two edge bugs: static assets under a declared app route 404ing, and renewed certificates silently not reaching nodes. Also removes the reserve…"
date: "2026-08-09"
tags: ["release"]
canonical: "https://django-mojo.sitesmojo.com/changelog/1-7-1/"
---

Adds a standard AL2023 host-integrity profile — file-integrity monitoring, RPM verification, and exact trusted-change evidence — for nodes that opt in. Fixes two edge bugs: static assets under a declared app route 404ing, and renewed certificates silently not reaching nodes. Also removes the reserved-hostname mechanism for naming vhosts — owning the domain is now the whole requirement. That removal drops an internal, platform-admin-only endpoint and field (`claim_reserved`/`claims_reserved`); no known caller exists outside internal ops.

### Added
- New packaged host-integrity profile `al2023-web-v1` for standard Amazon Linux 2023 web nodes: a fast (60s) tier watching `/etc`, SSH, cron, systemd, and local executables, and a slow (6h) tier verifying RPM-owned system files and Python packages against package metadata.
- Known package installs, certificate renewals, and deployments now file exact, expiring "trusted change" evidence instead of being silently ignored or flooding operators with alerts.

### Changed
- Home-directory exposure on integrity-monitored nodes now uses `ProtectHome=tmpfs` with explicit read-only binds, so monitoring sees the paths it needs without exposing the rest of the home directory.
- `claims_reserved` is no longer part of the vhost API response, and `POST /api/edge/vhost/claim_reserved` is removed (now 404s). This was a platform-admin-only operations action with no known external caller; naming a vhost now only requires owning its domain.

### Fixed
- Static assets served under a declared application route (e.g. `/api/account/static/...`) no longer 404 — they were losing to an internal caching rule.
- A certificate renewed in place (same record, new material) now reaches every node on the next ordinary sync; previously it silently kept serving the expired certificate until something else changed.

### Upgrade notes
- The new `al2023-web-v1` integrity profile is opt-in and test-suite verified, but has not yet been validated on a live node by the maintainer — hold off enabling it in production until that validation lands.
- Anything calling the removed `claim_reserved` endpoint or reading `claims_reserved` needs to stop.