SupiVPN v0.10.0

SupiVPN v0.10.0

Changes since v0.9.1.
Release commit: 7369ca98d3f74caa50fd1a96ded4408fb25c009a.

Changes

• Add essential Prometheus-format metrics without new dependencies. Metrics are
  disabled by default and enabled explicitly in configuration. VM components
  use a separate TLS listener; public Lambda requires a dedicated Bearer token
  loaded from Secrets Manager. Collection has bounded work, timeouts and caching.
  See metrics configuration.
• Finish the profile migration announced in v0.8.0: remove unbound admission,
  the legacy agent/metadata mode and controller node allowlist. Both VM and
  Lambda enforce active profile proof and verified SAML ownership. Historical
  unbound logins cannot complete authorization, deliver a grant or acknowledge
  it after the upgrade.
• Remove offline unbound issuance through supivpn-profile -out/-template.
  Wrapping-key initialization with -init remains supported; obtain client
  profiles through SAML-authorized download or OpenVPN Connect import.
• Update the pinned Pages upload/deploy actions to native Node.js 24 versions,
  keeping the signing, artifact checks and publication gates unchanged.

Compatibility

Breaking for unbound users: v0.8.x and v0.9.x were the migration window;
v0.9.x, starting with v0.9.1, is the last compatible series with the explicit legacy listener.
Complete migration there before installing v0.10.0. Download bound replacements
through SAML, verify them, drain/stop legacy agents and OpenVPN listeners, and
close their old ports/routes. Remove legacy_profile_nodes from every combined,
public and agent controller configuration, even if empty or null. Old legacy
configuration now fails validation instead of silently enabling weaker access.
See upgrade and rollback.

Schema remains 12 with the same runtime grants. No database migration or
reissue of existing bound profiles is needed. Preserve wrapping keys, TLS trust
and existing bound endpoint/ports. Bound UDP-only and UDP/TCP profiles remain
supported; TCP and metrics are disabled by default. OpenVPN is unmodified.

Upgrade controller/Lambda and node binaries together in a maintenance window;
mixed v0.9/v0.10 server components are not a supported rolling-upgrade matrix.
A Lambda update alone does not stop an existing unbound tunnel. Preserve
revocations, replay history and node generations; do not delete live login rows
or down-migrate the database. Rollback requires a tested, matching schema-12
server pair and saved configuration. Re-enabling v0.9.x legacy mode restores
its old profile-sharing/relay risk.

VM metrics intentionally have TLS without application authentication in the
minimal deployment; restrict reachability to monitoring hosts. Lambda metrics
require separate route, IAM/KMS and token configuration. Native Connect,
live AWS metrics deployment and a full Debian VM metrics acceptance run remain
deployment acceptance checks; do not infer them from unit or container tests.

Validation

Main Checks, CodeQL, automatic Real Okta and pre-release Real Okta passed on 7369ca98d3f74caa50fd1a96ded4408fb25c009a. Each Okta run passed all 23 expected checks and six profile downloads, including plaintext/encrypted policies, incorrect-key refusal, group denial, cookie/replay checks and cleanup. Tag-specific checks and artifact provenance remain required before publication.

Local unit/race, PostgreSQL integration with combined VM and isolated Lambda roles, vet, repository audit, native OpenVPN and OpenVPN 3 Linux checks passed. Historical unbound login completion, fetch and new applied ACK are refused; bound UDP-only and UDP/TCP profiles remain covered. Debian package lifecycle checks and Linux/Lambda builds passed for ARM64 and AMD64. Package checks do not establish running-systemd or reboot acceptance.

A bounded Codex Security review of the unbound removal examined all 27 changed source files, including deleted files, and reported no findings. The metrics change had a separate completed review with no findings. These scoped reviews do not prove the absence of all vulnerabilities; no Deep Scan was used.

Packages

Commit: 7369ca98d3f74caa50fd1a96ded4408fb25c009a. License: AGPL-3.0-only.

Verified native ARM64 and AMD64 builds from Checks for this signed tag. Both bundles use format 3.

Debian 13 packages for ARM64 and AMD64, a shared metapackage and native Debian source are included. Install verified matching packages with apt install ./supivpn*.deb; see DEPLOYMENT.md.

GitHub build provenance was verified for all binary archives, Debian assets and Corresponding Source, including the tag commit and Checks run attempt 1.

Database schema: 12; compatible VM schemas: 7, 8, 9, 10, 11, 12.
Isolated Lambda required schema: 12.

Corresponding Source accompanies the binaries. Verify SHA256SUMS.asc with the pinned SupiVPN release key, then verify the downloaded files against SHA256SUMS before use.