OpenPlex 0.33.0

docs(progress): reviewed third-party extensions

OpenPlex 0.32.0

docs(progress): extension file and alert permissions, Guard checked end to end

OpenPlex 0.31.0

docs(providers): the WHMCS module

OpenPlex 0.30.2

feat(extensions): update installed extensions from their card

An installed extension whose package has no icon shows the marketplace's
(the dashboard's catalogue, and the catalogue last read for the menu). When
the marketplace has a newer version, the card says so and offers the
update, which goes through the usual review; a paid extension's update uses
the licence it was installed with instead of asking for it again.

OpenPlex 0.30.1

feat(extensions): show the icon an extension's package carries

GET /extensions and /extensions/ui answer the installed package's
icon.svg, icon.png or icon.webp as a data URL (checked and capped at
256 KB); the dashboard shows it on the extension's card and its menu
entries, as the marketplace tab already did with the catalogue's.

OpenPlex 0.30.0

feat(providers): image mode, one-time sign-in links, update channel, API reference

• install.sh --image prepares a provider template: everything installed and
  the container images pulled and built (openplexd prepare-image), but the
  service not started, so the template holds no secrets. The panel domain
  defaults to the host name (OPENPLEX_PANEL_DOMAIN=auto, also from
  /etc/hosts). secret.key is now created atomically, so processes starting
  together on first boot agree on it.
• openplexd login-link prints a one-time sign-in link to hand a server
  over; the dashboard signs in with it and lets the account set a password
  without the current one for 30 minutes.
• install.sh --update-url sets a provider's own release feed; signatures
  are still checked against the release keys.
• docs/*/api.md: API reference, kept in step with the router by a test.
• After a password change the dashboard signs out locally too.

OpenPlex 0.29.1

fix(docker): DNS and mail answer over IPv6

The DNS and mail servers were on Docker's default bridge, which has no
IPv6: Docker answered their IPv6 ports with its userland proxy on the
host, where ufw blocked them, and the servers saw the gateway instead
of the client. They now live on openplex_public, a dual-stack network
created like the edge network (engine pool, then a fixed ULA, then IPv4
only), so their ports are published on IPv6 with ip6tables DNAT, the
same path as IPv4. Outgoing mail keeps preferring IPv4.

OpenPlex 0.29.0

feat(i18n): translatable API messages with values

Messages that carry values (quotas, overlapping names, invalid JSON or
ids, PHP settings, allow-lists, size limits, e-mail addresses, captcha
keys...) are now built with internal/msg: a fixed English template with
{name} placeholders and its values. Errors carry the template and the
values next to the English message, and the dashboard translates the
template before filling it in. A test fails when a template has no
Spanish or Catalan entry in web/locales/*/server.json. Unique-constraint
conflicts answer a plain "already exists" instead of the SQLite text.

OpenPlex 0.28.1

perf(ui): leave out the parts of Monaco the panel never loads

The copy of Monaco embedded in openplexd drops the editor's UI
translations (only fetched when a UI language is configured), the old
copies of the language workers (the editor loads them from assets/),
and the 7 MB TypeScript/JavaScript language service, whose features the
editor now turns off so its worker is never started; JavaScript and
TypeScript keep their syntax highlighting. Monaco goes from 25 to
7.5 MB and the binary from 43.9 to 27.0 MB.

OpenPlex 0.28.0

feat(backups): warn when backups are not off the server

The Backups page now says where the repository is compared with the data
it protects. A local repository is traced through /proc/self/mountinfo
and /sys/class/block down to physical disks (partitions, LVM, RAID,
dm-crypt, btrfs; ZFS by pool): on the data's disk it warns, on another
disk it notes that losing the server would still take both, and on a
network filesystem it is off-site. An S3 endpoint that resolves to this
server's own addresses is warned about too.