v0.2.0

Added

• An installation script (install.sh, published on the website and with
  each release) that verifies the download, installs the binary and a
  hardened systemd service, and creates the configuration, an SSH key and
  the first administrator. Running it again upgrades an installation;
  --uninstall removes it and keeps the data.
• helmsight hosts bootstrap prints a script that creates the monitoring
  account on a host, with the public key restricted by restrict,from=.
• helmsight init accepts its answers as options (--listen,
  --public-url, --ssh-user, --ssh-key, --admin), runs without
  questions with --non-interactive, reads the administrator's password
  with --password-stdin and creates an ed25519 key with --generate-key.
• Turkish documentation: README.tr.md, docs/tr/ and a Turkish website
  and documentation under /tr/, with language links between them.
• A troubleshooting page in the documentation.
• More detailed documentation in both languages: requirements, upgrades,
  backups, reverse proxy setup, example alert rules and notification
  channels, safe action design and a security checklist.

Fixed

• The README quick start now changes into the directory unpacked from the
  release archive before running the binary.

v0.1.1

Fixed

• Sign-in and every other state-changing request were refused as
  cross-origin when the web UI was served over TLS with HTTP/2.

v0.1.0

Added

• Agentless collection over SSH with one persistent session per host and a
  single read-only POSIX shell script per tick, tested on Debian, Ubuntu,
  Rocky, Fedora, openSUSE and Alpine.
• Local mode (serve --local) that monitors the machine it runs on.
• Fleet overview with groups, tags, search, sparklines and distinct states
  for unreachable hosts, authentication failures, host key problems and
  partial collections.
• Host detail with live and historical charts, per-core CPU heatmap, top
  processes, listening ports, services, containers and system information.
• History in SQLite with 1-minute and 5-minute rollups and configurable
  retention.
• Inventory snapshots, change timeline and host-to-host or baseline
  comparison.
• Security overview: failed SSH logins, pending and security updates,
  reboot-required flags, ports not on the baseline and TLS certificate
  expiry.
• Alert rules with durations and scopes, built-in rules, acknowledgements,
  silences, reminders, and webhook, Slack and email notifications.
• Opt-in actions with confirmation and a hash-chained, append-only audit log.
• Viewer, operator and admin roles; Argon2id passwords; TOTP; OpenID Connect
  single sign-on with role mapping.
• Wall display mode with revocable, group-scoped display tokens.
• Versioned JSON API with OpenAPI document, server-sent events and a
  Prometheus endpoint.
• TLS with provided certificates or a generated self-signed certificate.
• Secrets encrypted at rest with XChaCha20-Poly1305.
• CLI: serve, init, user, hosts test, config check, secret,
  audit verify.