Orca v0.53.0

Workspaces: your team's local setup, in one repo

A workspace is a git repo with an orca-workspace.yaml. It describes everything a developer needs to work on your team's projects locally: the shared services everyone uses, the Docker network they meet on, your own domain and certificate, and every project with its setup steps and secrets. A new developer installs Orca, joins the workspace, and has any project running in minutes. Or they ask Claude to "spin up billing".

• Join in one step. Open Workspace in the sidebar and paste the repo's URL. You can also click an orca://workspace?repo=… link from your wiki, or run orca workspace join <url>. Orca then:
  • clones the repo and creates the network;
  • serves *.<your domain> with your team's certificate;
  • starts the shared services and adds every route.
• Projects are a menu. Each one shows Running, Cloned or Not cloned. Set up runs these steps:
  1. Clones the project, or uses the checkout you already have.
  2. Creates its .env from the template.
  3. Fills in secrets.
  4. Runs its setup command once.
  5. Starts the shared services it uses.
  6. Starts it and shows its URLs.
• Secrets stay in your secret manager. The workspace file holds references only: passbolt:<id> or op://vault/item/field.
  • Without the manager's CLI, each missing value comes with a link to open its exact entry.
  • With go-passbolt-cli or the 1Password CLI set up, Fill in automatically fetches them all.
  • Values only ever go into the project's .env, which only your user can read.
• AI tools set projects up for you. With Orca connected over MCP, "set up the CRM" finds the project (workspace_status) and sets it up (setup_project), then gives you its URLs. AI tools are told never to ask for secrets in the chat.
• Always up to date. Orca pulls the workspace when it starts and applies whatever changed: a new project, a route, a shared service or a renewed certificate. Update does it right away. Leave puts your gateway's domain and certificate back as they were.
• Coming from a hand-run reverse proxy? orca workspace import-haproxy haproxy.cfg turns an HAProxy config into workspace routes, and the gateway now handles what such setups need (below).

More on the site: orca-desktop.com/workspaces, and eight new docs pages starting at Workspaces.

Your apps, grouped

The dashboard's Your apps now groups your stacks by where they come from: the workspace's projects first, with its shared services as one compact row of links, then each project's worktree instances by branch, then everything else. Click a group's name to fold it. Hover a card to pin it to the top or hide it.

Gateway

• Hostname patterns. A route for *-shop matches north-shop, south-shop and every other tenant. A route for * alone catches every hostname under the domain. The most specific route wins.
• WebSocket-only routes. websocket: true sends only WebSocket connections to a container, so an app's Reverb or Vite socket can live apart from its pages.
• Path routes that work. A route with a path no longer matches every request to its hostname, and a longer path wins over a shorter one (/api/admin/* before /api/*).
• A wildcard certificate per pattern with Orca's certificate authority, and your own certificate is in place before the gateway's first start.

Also

• orca workspace join|status|setup|update|leave|import-haproxy on the command line.
• After-start hooks in a stack's orca.yaml also run for stacks whose compose file is in a subfolder.
• A failing setup command shows the end of its output, wherever the tool printed its error.