KITPro Server v0.1.0-alpha.13

KITPro Server v0.1.0-alpha.13 release notes

Status: prepared release candidate. Do not treat this document as publication
or a release tag.

Alpha.13 expands the trusted catalog to 20 applications, adds bounded network
services and typed application configuration, strengthens package and runtime
recovery, and qualifies Ubuntu 26.04 LTS as a Supported platform.

Platform support

• Debian 13 amd64 is Supported.
• Ubuntu 26.04 LTS amd64 is Supported with the same qualified .deb.
• Fully updated Arch Linux x86_64 with linux-lts is Supported.
• Rocky Linux 10 amd64 and Podman remain Experimental.

Supported hosts use rootful Docker, systemd, and enforcing AppArmor. They must
configure an operator-selected, non-overlapping Docker default address pool.
KITPro checks current routes, Docker networks, and available child networks.
It does not edit /etc/docker/daemon.json or choose a universal CIDR.

The Experimental Rocky package, SELinux policy, rootful Podman 5 host,
Quadlet, crun, firewalld, trusted-storage registration, and reboot recovery
pass. Application installation is unavailable on Rocky in alpha.13 because
the Podman adapter does not implement the staged-generation lifecycle
contract. The normal API fails before it creates a runtime, network, or
committed generation.

Applications

The 15 existing applications remain in the catalog: FreshRSS, Uptime Kuma,
Mealie, Memos, Actual Budget, Vaultwarden, Home Assistant, Paperless-ngx, Open
WebUI, IT-Tools, Ollama, Jellyfin, Navidrome, Audiobookshelf, and SFTPGo.

Alpha.13 adds:

• Forgejo, with managed /data, HTTP only, and no Git-over-SSH exposure.
• Plex, with managed configuration, read-only media, CPU-only operation, and
  no automatic remote access.
• Nextcloud, as an Experimental SQLite small-instance profile.
• Pi-hole, as an Experimental DNS-only Network Service with TCP and UDP port
  53, a loopback administration endpoint, and lifecycle acknowledgement.
• Syncthing, as an Experimental manual-peer TCP-only profile with a loopback
  GUI, fixed TCP port 22000, and no discovery, relays, NAT traversal, QUIC, or
  UDP publication.

Syncthing uses an offline typed bootstrap, preserves its application-owned
identity, and restores the final owner and mode before normal startup. Live
qualification covered manual device pairing, explicit TCP addresses,
bidirectional file transfer with SHA-256 verification, managed configuration
restore, device identity, peer and folder state, and exclusion of external
/sync data.

Lifecycle, networking, and recovery

• Schema-v8 networking supports multiple bindings, TCP and UDP, trusted fixed
  ports, same-number TCP and UDP, and transport-aware conflict detection.
• Every application generation keeps a separate bridge network. KITPro does
  not merge networks or shorten retained-generation guarantees to save address
  space.
• Runtime removal retains the installation, managed data, external-storage
  bindings, and generated secrets.
• Reconciliation verifies runtime identity, image identity, mounts, bindings,
  and candidate cleanup before it advances the committed generation.
• Failed installations retain their installation identity and storage choices
  so the supported retry uses the same installation.
• The helper recovers orphaned failed candidates without adopting unknown
  runtime state.

Backup and restore

Application backup format version 1 protects declared managed files, detected
SQLite databases, and generated secrets for restore into the same existing
installation. Imported storage remains excluded and untouched. Alpha.13 adds
live qualification for the new applications and restores application-owned
configuration without changing external content.

Backups are root-owned local archives with restrictive permissions. They are
not encrypted by KITPro. Generated application secrets are root-bound
plaintext in helper state and restrictive backups.

Package transitions

The Debian alpha.12 to alpha.13 transition verifies the incoming package,
both databases, and a paired backup set before unpack and migration. Failed
preflight restores the services that were active before the check. The
transition migrates schema 13 to schema 14.

Arch uses a package-bound upgrade wrapper and pacman pre-transaction hook. The
wrapper validates the incoming package and AppArmor profile before pacman can
change package files.

Security

Alpha.13 keeps authentication, CSRF, Host, Origin, helper peer identity,
AppArmor or SELinux, typed protocol validation, exact runtime ownership,
symlink and hardlink defenses, secret redaction, and storage identity checks.
Credential reveal is limited to a manifest-authorized public credential ID and
returns Cache-Control: no-store.

Limits

A running container is not proof that an application is ready. KITPro does not
provide a reverse proxy, Certbot or ACME management, Cloudflare Tunnel
integration, automatic public access, host-to-host restore, bare-host
recovery, imported-storage backup, or destructive application-data deletion.

Verify all downloaded files with the alpha.13 checksum manifest. Publication,
tagging, and upload remain separate human-authorized actions.

KITPro Server v0.1.0-alpha.12

KITPro Server v0.1.0-alpha.12

KITPro Server v0.1.0-alpha.12 is an alpha prerelease for Debian and Arch Linux. It improves lifecycle recovery, reconciliation, backup and restore, and package-upgrade safety.

Important upgrade instructions for alpha.11 users

Alpha.11 users must use the transition wrapper for their package format. Do not run a raw package-manager upgrade from alpha.11.

Debian alpha.11 to alpha.12

Download kitpro-debian-upgrade and kitpro-server_0.1.0.alpha12_amd64.deb from this release, keep them in the same working directory, then run:

chmod +x kitpro-debian-upgrade
sudo ./kitpro-debian-upgrade ./kitpro-server_0.1.0.alpha12_amd64.deb

The wrapper validates the installed alpha.11 state, creates and verifies the complete database backup set, verifies the exact alpha.12 package by SHA-256 and package metadata, and invokes the upgrade only after preflight succeeds.

GitHub exposes the package with 0.1.0.alpha12 in the filename. The installed Debian package version remains 0.1.0~alpha12.

Direct apt install ./kitpro-server_0.1.0.alpha12_amd64.deb or dpkg -i is unsupported specifically for the alpha.11 to alpha.12 transition.

Arch Linux alpha.11 to alpha.12

Download kitpro-server-0.1.0_alpha12-1-upgrade.sh and kitpro-server-0.1.0_alpha12-1-x86_64.pkg.tar.zst from this release, keep them in the same working directory, then run:

chmod +x kitpro-server-0.1.0_alpha12-1-upgrade.sh
sudo ./kitpro-server-0.1.0_alpha12-1-upgrade.sh ./kitpro-server-0.1.0_alpha12-1-x86_64.pkg.tar.zst

The wrapper verifies the exact package, establishes a temporary fail-closed pre-transaction gate, and performs the supported transition.

Raw pacman -U is unsupported specifically for the alpha.11 to alpha.12 transition.

Alpha.12 installs permanent native package-upgrade protection for future upgrades.

Fresh installation

New alpha.12 installations can use the normal documented Debian or Arch installation path. The transition wrappers above are only for existing alpha.11 installations.

Reliability

• Lifecycle operations are durable across interruption and API response loss.
• Exact operation replay returns the recorded result, while conflicting reuse of an operation ID is rejected.
• Per-installation serialization and fencing prevent stale executors from committing privileged work.
• Single-component replacement stages and verifies a new runtime generation before making it active.
• Multi-component replacement stages the complete generation and records progress for each component.
• Multi-component start and stop honor dependency order.
• KITPro retains the previous runtime generation when recovery may need it.
• Cleanup failure is recorded as cleanup debt instead of changing a successful cutover into an ambiguous result.

Reconciliation and repair

• Reconciliation classifies missing, stopped, drifted, unavailable, migrated, removed, and cleanup-pending runtime state.
• Repair actions are explicit and bounded to trusted recorded state.
• Runtime unavailable is distinct from runtime missing, so KITPro does not treat a temporary runtime outage as proof that resources disappeared.
• KITPro can repair stale control projections from durable helper outcomes.
• Migrated runtimes are handled without blindly repeating destructive work.
• A deliberately removed runtime can become a stable reconciled state.
• Exact orphan candidates can be cleaned without requiring an active generation.

Backup and restore

• Restore uses a durable journal that records path identity, swap progress, generated secrets, prior runtime state, and cleanup debt.
• Startup recovery can complete a proven forward state or roll back to the prior tree after a crash.
• Mixed storage state fails closed when KITPro cannot prove a safe result.
• Restore cleanup failures remain recorded for later cleanup or repair.

Migration

Alpha.11 schema 7 to alpha.12 schema 13 migration is supported and validated. Downgrading after this migration is unsupported.

Packages and checksums

File	SHA-256
kitpro-server_0.1.0.alpha12_amd64.deb	29541da98fdba7fed0c4f7facec66d936c2da2487b8fedb562e289655fa8ac25
kitpro-debian-upgrade	8ddffc0070aec9576a7704a7b3f588ea7d0939dbed1c787a3c19ebcfd5489bb0
kitpro-server-0.1.0_alpha12-1-x86_64.pkg.tar.zst	2fe6b51c370c2e9399da9291c31ad2af6bb09934c1a872f502db0c8c615d12f6
kitpro-server-0.1.0_alpha12-1-upgrade.sh	0eab8578715fcaed71b27739036961e0e20fa48c5571a87e3351048513963f67
kitpro-server_0.1.0.alpha12_amd64.cdx.json	2f365f08afeb81c693ae7b4b0af59452b1220f08c432aa47a99a02a805bf6f27

Verify downloads against kitpro-alpha12-SHA256SUMS from this release.

Platform status

Debian and Arch Linux are the public supported baseline for this alpha. Rocky Linux and Podman-related work remain Experimental and are not promoted by this release.

Known limitations

• This remains alpha software.
• Runtime running state is not the same as application readiness.
• Same-port replacement can have a bounded cutover interruption.
• Failed restore or cleanup trees may require a later cleanup decision.
• Some cleanup debt requires an explicit repair action.
• Rocky Linux and Podman remain Experimental.
• Downgrading after schema migration is unsupported.
• KITPro does not provide arbitrary Compose management, generic container management, host-to-host restore, or rollback of irreversible application data migrations.

AI-assisted development

KITPro uses AI-assisted development tools within a human-directed engineering workflow. Project ownership, architecture, security decisions, review, validation, and release approval remain human responsibilities.

KITPro Server v0.1.0-alpha.2

KITPro Server v0.1.0-alpha.2

KITPro Server is a local-first Linux server manager for installing and managing
trusted self-hosted applications through a browser. Alpha.2 ships the polished
public interface shown on the KITPro Server product page.

Public Alpha: This is not production-ready software. Features may change.
Keep independent backups of /srv/kitpro and review the known limitations.

What is included

• A refined dashboard, catalog, application-management, access, update, error,
  responsive, and accessibility experience.
• Trusted, digest-pinned applications: FreshRSS, Uptime Kuma, Mealie, Memos,
  Actual Budget, Vaultwarden, Home Assistant, and Paperless-ngx.
• Paperless-ngx managed as one logical multi-container application.
• Persistent application storage, controlled Private / This server only /
  Local network access, reconciliation, and pre-update control-state backups.
• Apache License 2.0.

Supported platforms

• Debian 13 amd64
• Ubuntu 26.04 LTS amd64
• Arch Linux x86_64 using linux-lts, fully updated official repositories,
  rootful Docker, enforcing AppArmor, and full pacman -Syu upgrades only

Rocky Linux 10 amd64 remains experimental.

Rootful Docker and enforcing AppArmor are required. KITPro does not add users
to the Docker group. Application data is not automatically backed up, so keep
independent backups before relying on an application.

Start here

• KITPro Server product page
• Quickstart
• Supported platforms
• Known limitations
• Security policy
• Upgrade, removal, and recovery

Verify downloads with the attached kitpro-server_0.1.0-alpha.2_SHA256SUMS
file before installation.

KITPro Server v0.1.0-alpha.11

KITPro Server 0.1.0-alpha.11 release notes

Published 2026-09-15 as a GitHub prerelease from source commit 1eed6b0a2199e927a9647e50206e89f6cfc19995.

Alpha 11 turns trusted external storage into a practical media and data catalog.
Navidrome and Audiobookshelf consume administrator-approved read-only libraries;
SFTPGo is the first real imported read-write consumer. All three run as a
manifest-declared numeric non-root identity and start private by default.

Writable imported roots use a conservative single-writer policy. Another
writer, or a reader from another installation, cannot bind a root while its
writer is active. Read-only roots may be shared. KITPro never deletes imported
data with an installation.

The helper receives only CAP_CHOWN so it can assign the trusted non-root owner
to newly created KITPro-managed directories. It cannot choose an identity,
change imported-root ownership, inject supplementary groups, or gain broader
filesystem/device capabilities. AppArmor and package tests enforce that limit.

Immich is not included: its supported topology needs shared component secrets,
health-gated dependencies, bounded database shared memory, and database-aware
backup/rollback. Syncthing is not included because bridge networking does not
provide its supported LAN discovery topology, and host networking remains
prohibited. The archived original File Browser is replaced by maintained,
first-run-authenticated SFTPGo.

See the media and data app guide, catalog, trusted storage architecture, and known limitations.

Published artifacts

Artifact	SHA-256
kitpro-server_0.1.0-alpha.11_amd64.deb	0a832e5e9b8d55d0b21c8331b4a80b7caeba148627d387870ed50c2d6eda8399
kitpro-server-0.1.0_alpha11-1-x86_64.pkg.tar.zst	4fa242cadaff977b4bbefbafae65852a7272ebab1ba3dfbf067f7290bfec0722
kitpro-server_0.1.0-alpha.11_amd64.cdx.json	1414c192b9a56f80661b8ba5f58e7ee1fa4d4be1ae97d80d4854f88b4fcf5584

The release also publishes SHA256SUMS, build metadata, and a release manifest. Download artifacts only from the v0.1.0-alpha.11 release.

KITPro Server v0.1.0-alpha.1

KITPro Server 0.1.0-alpha.1

KITPro Server is a local-first application manager for people who want to
self-host useful services without handing a browser unrestricted Docker access.
This is a public alpha: expect rough edges and review the documented limits.

Highlights include authenticated setup and lifecycle controls, immutable
catalog images, installation-scoped persistent storage, controlled internal /
loopback / LAN exposure, multi-container Paperless-ngx support, native Debian,
Ubuntu, and Arch packages, AppArmor confinement, and validated update backups.

Supported platforms are Debian 13 amd64, Ubuntu 26.04 LTS amd64, and Arch
x86_64 with linux-lts, fully updated official repositories, rootful Docker,
and enforcing AppArmor. Rocky Linux 10 remains experimental.

The catalog contains FreshRSS, Uptime Kuma, Mealie, Memos, Actual Budget,
Vaultwarden, Home Assistant, and Paperless-ngx. No arbitrary Compose, user manifests,
HA/clustering, reverse proxy/TLS automation, or automatic disaster recovery is
included. Application data remains under /srv/kitpro/apps and is not silently
deleted by runtime removal or package removal.

Updates use native apt/dpkg or pacman. KITPro backs up its control/helper state
before package migrations; application-data backup is not automatic. Report
bugs with version, platform, logs scrubbed of secrets, and reproduction steps
through the repository issue process.