v1.7.0 — Admin web console

v1.7.0 — Admin web console

Adds a restricted admin console for diagnostics inside the step-ui container.

Changes

• Added /admin/console POST flow for admin-only command execution.
• Free shell input is disabled; only predefined allowlist commands are available.
• Commands run through exec.CommandContext without /bin/sh.
• Added 8-second timeout and 16 KB output limit.
• Added audit log entries for successful runs and denied command IDs.
• Added 2FA status warning on the console page.
• Removed the old console stub badge from admin navigation.
• Updated README badges, current release notes and project history.

Available diagnostics

• date, hostname, id
• disk usage, process list, app directories
• step version, step-ca health
• OpenSSL version
• PostgreSQL readiness

Verification

• bash -n install.sh
• bash -n step-ca-bootstrap.sh
• docker compose config --quiet
• go test ./...
• docker compose build step-ui
• local /admin/console login + command run check
• local allowlist denial check
• local audit log check

v1.6.3 — Password recovery UX cleanup

v1.6.3 — Password recovery UX cleanup

Patch release for the public password recovery flow.

Changes

• Removed the SMTP/account hint from the forgot password form copy.
• Kept neutral public reset responses to avoid account enumeration.
• Cleared the login/email field after reset request processing.
• Updated README badges, current release notes and project history.

Verification

• bash -n install.sh
• bash -n step-ca-bootstrap.sh
• docker compose config --quiet
• go test ./...
• docker compose build step-ui

v1.6.2 - Password recovery

v1.6.2 — Password recovery

Added

• Public forgot password and reset password pages.
• SMTP configuration in Admin -> Notifications.
• Password reset tokens stored as SHA-256 hashes only.
• Reset token TTL: 30 minutes.
• Reset request rate limit: 3 requests per IP per 15 minutes.
• Neutral public reset response to avoid account enumeration.
• Audit trail for reset requests, SMTP missing/failure, email sent and reset completion.

Changed

• Login page now links to password recovery.
• Security log labels reset events separately from normal logins.
• README badges and current release blocks updated to v1.6.2.

Verified

• go test ./...
• docker compose build step-ui
• local step-ui container healthy after rebuild
• password reset token flow with token consumption and login after reset

v1.6.1 - Admin audit and responsive navigation

v1.6.1 — Admin audit and responsive navigation

Added

• Admin audit events for user create/delete, role changes, block/unblock and password reset.
• Audit events for temporary user creation.
• Audit events for local and Let's Encrypt private key downloads.
• Audit events for backup downloads.
• Audit events for notification settings and Let's Encrypt settings changes without logging secrets.
• Responsive top navigation with dropdown groups for narrow windows in both the main certificate UI and admin workspace.

Changed

• Security log now distinguishes login, logout, 2FA, audit and failed events.
• README badges and current release blocks updated to v1.6.1.

Verified

• go test ./...
• docker compose build step-ui
• local step-ui container healthy after rebuild

v1.6.0 — TOTP 2FA and UI polish

v1.6.0 — TOTP 2FA and UI polish

Added

• TOTP two-factor authentication for user accounts.
• Authenticator app enrollment with QR code and manual secret.
• Login challenge after password verification for users with 2FA enabled.
• Recovery codes stored as bcrypt hashes.
• 2FA disable flow protected by current password and TOTP code.

Improved

• Reworked /profile/2fa visual layout.
• Polished main page hero, quick actions and project summary.
• Fixed certificate list layout on wide and narrow screens.
• Improved certificate filters and action buttons responsiveness.

Verified

• go test ./...
• docker compose config --quiet
• Docker build and deployment check on the test server.

v1.5.2

v1.5.2

Certificate templates and policy presets release.

Added

• Added certificate issue templates: Server TLS, Internal service, Wildcard and Client identity.
• Templates now set policy defaults for key type, duration and domain placeholder.
• Added backend policy normalization and validation for allowed templates, durations and key types.
• Added wildcard guardrail requiring domains like *.example.com.
• Added deploy snippets to certificate details for nginx, Apache and Traefik file provider.

Changed

• Certificate issue history now records template, key type and duration.
• Bumped application version to 1.5.2.

Verified

• go test ./...
• bash -n install.sh
• bash -n step-ca-bootstrap.sh
• docker compose config --quiet
• docker compose build step-ui
• Staging test on 192.168.100.103: issue templates rendered, wildcard policy error worked, internal template issued a cert, details page showed deploy snippets

v1.5.1

v1.5.1

Certificate details and validation release.

Added

• Added certificate details page at /certificates/{id}.
• Added Details action in the certificate list.
• Display certificate subject, issuer, serial, fingerprints, validity, public key, signature algorithm, SANs and key usages.
• Added validation checks for certificate file readability, validity window, hostname/IP match, private key pair match and CA chain verification.

Verified

• go test ./...
• bash -n install.sh
• bash -n step-ca-bootstrap.sh
• docker compose config --quiet
• docker compose build step-ui
• Staging test on 192.168.100.103: /certificates/1 returned 200 and validation checks were OK

v1.5.0

v1.5.0

CA integrity and update guardrails release.

Added

• Added /admin/integrity for CA integrity checks.
• Added admin navigation entry for CA integrity.
• Added root CA, intermediate CA and full-chain validation.
• Added provisioner lookup and TLS duration claim checks.
• Added provisioner password sync check between Step-CA UI and step-ca secret.
• Added STEP_CA_IMAGE configuration.

Changed

• Pinned step-ca image to smallstep/step-ca:0.30.2 by default instead of latest.
• Updated README and .env.example with the pinned image setting.
• Bumped application version to 1.5.0.

Verified

• go test ./...
• bash -n install.sh
• bash -n step-ca-bootstrap.sh
• docker compose config --quiet
• docker compose build step-ui
• Upgrade test on 192.168.100.103 with preserved volumes

v1.4.11

v1.4.11

Hotfix release after the v1.4.10 admin UI polish.

Fixed

• Fixed admin session cookie scope by setting Path=/ explicitly.
• Reset invalid/stale session cookies instead of silently redirecting forever.
• Disabled HSTS by default for self-signed installs via ENABLE_HSTS=false; HSTS should be enabled only with a trusted TLS certificate.
• Fixed admin theme mapping: dark, light and blue themes now render as separate palettes.

Verified

• bash -n install.sh
• bash -n step-ca-bootstrap.sh
• docker compose config --quiet
• go test ./...
• docker compose build step-ui
• Clean test deployment on 192.168.100.103

v1.4.10

Что нового

• Обновлён внешний вид админ-панели.
• Админские стили вынесены из inline CSS в static/css/admin.css.
• Палитра стала спокойнее и контрастнее: нейтральные surfaces, синий action accent, отдельные цвета для OK/WARN/ERROR.
• Уменьшены слишком крупные метрики и заголовки.
• Улучшены таблицы: перенос длинных путей, стабильная ширина preflight, нормальный вид code-значений.
• Улучшена боковая навигация: компактнее, ровнее активные пункты, корректные badge'и.
• Добавлена мобильная адаптация админки: навигация становится горизонтальной, формы и гриды переходят в одну колонку.
• Версия UI обновлена до 1.4.10.

Проверено

• bash -n install.sh
• bash -n step-ca-bootstrap.sh
• docker compose config --quiet
• go test ./...
• docker compose build --no-cache step-ui
• Развёрнут candidate на Ubuntu test server 192.168.100.103
• /admin, /admin/about, /admin/backup: HTTP 200
• Контейнеры postgres, step-ca, step-ui: healthy