v0.4.1

Coolify only, and it is the tab you could not find. If your install has no
Account → Deployment screen, this is why. Redeploy from the platform and it
appears.

The images are byte-identical to v0.4.0 and this tag runs them. Nothing here
touches an ordinary docker-compose.yml install, which never had the bug.

What was wrong

OA_CREDENTIAL_KEYRING was filled from Coolify's SERVICE_BASE64_KEYRING. That
generator produces 32 base64 characters, which decode to 24 bytes. The
keyring wants a key of exactly 32 bytes, and credential-vault.ts checks the
length rather than trusting it, so every install came up with:

revenue_not_mounted   reason: OA_CREDENTIAL_KEYRING invalid_key_material

The keyring is also what the deployment-settings surface encrypts with, and that
surface closes without one. So the Account → Deployment tab was never drawn:
no mail relay, no assistant provider, no revenue connections, and nothing on
screen saying why. Measured on a live install before it was changed: 32
characters in, 24 bytes out.

Why the fix is a generator and not a longer variable

No magic variable on the platform produces 32 bytes. SERVICE_BASE64_ is 32
characters, SERVICE_BASE64_64_ is 48 bytes, SERVICE_BASE64_128_ is 96. Base64
of 32 bytes is 44 characters and there is no _44_.

So the keyring joins the three signing pairs, which are there for exactly the
same reason: keygen writes it with openssl rand -base64 32, only when it is
missing, and the api and the worker read it through
OA_CREDENTIAL_KEYRING_FILE. Never rewriting an existing one is the load-bearing
part. Rotating a keyring on a redeploy would strand every provider credential a
customer had already connected.

Proven before it shipped

On a real host, with the command rendered exactly as Compose hands it to the
shell:

• the keyring it wrote is 44 base64 characters, 32 decoded bytes, mode
  0400, owned by uid 1000;
• a second run left all three key pairs and the keyring alone;
• the published v0.4.0 api image started against it and logged
  revenue_mounted, active_key_version: k1.

Also in this tag

COOLIFY.md stops claiming the branch can be changed in Settings. On Coolify
4.3.2 that field does not appear after the first deploy either. It does not need
to: the compose file pins the images, not the checkout. Every image: line reads
${OA_IMAGE_TAG:-v0.4.1}, so a clone of main runs the release named in the
file it just cloned.

The wiring test now accepts X_FILE as satisfying X. A path is another way
to supply any declared variable, and supplying both is an error, so the two
spellings are alternatives. A test that demanded the inline one would force the
wrong fix on exactly the values a platform cannot express.

Images

Ten, published to ghcr.io/openlabs-so/openanalytics and tagged v0.4.1:
migrate, tracker-build, api, collector, worker, query-gateway,
realtime, web, clickhouse, valkey. amd64. Their contents are unchanged
from v0.4.0; the tag moves because the compose file ships with them and a
release is one commit.

Full changelog: v0.4.0...v0.4.1