v0.1.0 — Initial Release

Ostra v0.1.0 is the first public release: self-hosted S3-compatible object storage built on Garage v2, with Caddy-managed TLS and a Go control-plane with a React dashboard.

Highlights

• S3-compatible, single-node object storage powered by Garage v2.
• Bucket management with usage statistics, creation, and safe deletion.
• Per-bucket custom domains with on-demand TLS and DNS ownership verification.
• Access-key management with per-bucket read, write, and owner permissions.
• Dashboard for storage overview, buckets, domains, access keys, and account settings.
• Built-in object browser: browse folders, drag-and-drop upload with progress, download files, copy public URLs, and delete files or folders.
• Configurable dashboard upload limit via MAX_UPLOAD_SIZE_MB (default: 5120 MB).
• Secure admin authentication: Argon2id passwords, short-lived JWTs, rotating httpOnly refresh cookies, session revocation, and login rate limiting.
• Bootstrap the first admin with ADMIN_EMAIL, ADMIN_PASSWORD, and optional ADMIN_NAME.
• Production-ready Docker Compose deployment, health checks, cold backup/restore scripts, and upgrade/rollback documentation.
• Supports bundled Caddy or an external proxy deployment, including guidance for Coolify and Cloudflare Tunnel.
• Multi-architecture container images for linux/amd64 and linux/arm64.

Security

• The control-plane refuses unsafe development settings (DNS_VERIFY=off or COOKIE_SECURE=false) outside .localhost and .test domains.
• Client IP forwarding is restricted through TRUSTED_PROXIES.

Fixed

• Dashboard page transitions skipped by the browser no longer log an uncaught InvalidStateError.

License

Ostra is licensed under the Apache License 2.0. Garage remains separately licensed under AGPL-3.0 and is used as an independent service through its API.

See the README for deployment instructions, and the CHANGELOG for the complete release history.