Skip to content

v2.0.0

Choose a tag to compare

View all tags
@Nonetss Nonetss released this 09 Oct 12:14
· 126 commits to main since this release
v2.0.0
5f98ad1

A standalone gateway in front of the app, a hardened backend, and a project website with full docs: https://nonetss.github.io/Komodo-CD/

⚠️ Breaking changes

  • The gateway is now its own image and service. Caddy used to run inside the frontend image; it now lives in ghcr.io/nonetss/komodo-cd-gateway, the only service that publishes a port. The new frontend image no longer listens on port 80, so you need the new compose.yml (see Upgrading).
  • API keys can no longer manage the configuration. The Komodo connection, ntfy and API key endpoints (/api/v0/deploy/credentials*, /api/v0/apikeys) now require a signed-in session and answer 403 to an x-api-key. CI keys keep full access to what they need: POST /api/v0/deploy, GET /api/v0/stacks and GET /api/v0/history.
  • BETTER_AUTH_SECRET must be at least 32 characters. A shorter secret makes the backend refuse to start. Generate one with openssl rand -base64 32 (the installer already did).
  • CORS only allows the app's own URL (APP_URL) instead of reflecting any origin with credentials. The dashboard and CI (curl) are not affected.

Highlights

  • Gateway with security headers: one origin for the dashboard and the API, nosniff, SAMEORIGIN framing, a strict referrer policy and a restrictive Permissions-Policy, with zstd/gzip compression and a /health endpoint.
  • Health-ordered startup: every service has a healthcheck; the frontend waits for the backend and the gateway for both. init: true everywhere, so docker stop no longer hangs for 10 s.
  • Graceful shutdown: in-flight requests get up to 5 s to finish, then the database is closed, always before Docker's kill.
  • Better errors for CI: a Komodo failure answers 502 with Komodo's message, a missing connection 503, and deleting unknown credentials 404. Every response carries an x-request-id that matches the backend's log line for that request.
  • Request bodies are capped at 1 MiB.
  • Project website with a screenshot tour and documentation in English and Spanish: getting started, connecting Komodo, deploying from CI, Docker Compose, configuration, REST API, architecture, upgrades and backups, and development.

Fixes

  • Installer: it checks for an existing .env before asking anything, reads ports like 08 as decimal, and warns when the public URL is plain http:// on a host other than localhost.

For contributors

  • The whole repo is configured from one root .env (bun run setup:dev generates it); BETTER_AUTH_URL falls back to APP_URL.
  • bun run dev starts a Docker dev stack behind the production gateway on http://localhost:4321; bun run dev:local keeps the native flow.
  • A bun test suite for the API on an in-memory SQLite with the real migrations, and CI that runs Biome, type checks, tests and a migration check on every PR and before publishing images. Images are only rebuilt when their inputs change.
  • OpenSpec specs for every capability in openspec/specs/.

Images

ghcr.io/nonetss/komodo-cd-backend:2.0.0
ghcr.io/nonetss/komodo-cd-frontend:2.0.0
ghcr.io/nonetss/komodo-cd-gateway:2.0.0

latest keeps tracking main. Pin the installer to this release with:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.0.0/scripts/bootstrap.sh | KCD_REF=v2.0.0 bash

Upgrading

No migrations. Back up the database first (see Upgrades and backups), check that BETTER_AUTH_SECRET in your .env has at least 32 characters, then download the new compose.yml and recreate the stack:

curl -fsSL https://raw.githubusercontent.com/Nonetss/Komodo-CD/v2.0.0/compose.yml -o compose.yml
docker compose pull
docker compose up -d --remove-orphans

If a pipeline used an API key to read or change the Komodo connection, ntfy or API keys, do that from the dashboard instead.

Assets 2
Loading