v1.0.0

First stable release of the self-hosted secrets stack.

What's included

Core stack (ba1e0fe)

• Passbolt CE + Infisical behind Caddy with automatic TLS via ACME DNS-01 — no inbound ports required
• Digest-pinned images throughout; internal-only data tier network; log rotation caps; non-root hardening
• Backup/restore pipeline with age encryption, verified GPG/JWT key handling, and Tailscale-first access model

Security hardening (2f0ab7c, 98f3d56, 674daf4)

• Backup auth, ufw/DOCKER-USER bypass coverage, invite-only signup fixes
• Restore path hardening: safe archive extraction (validated members, no links/traversal, size limits), clean-target enforcement, .env consistency checks

CI / CVE gate (e2b38bf, 111aa4a)

• Full lint suite (shellcheck, yamllint, hadolint, compose-validate) + gitleaks secret scanning with correct PR permissions
• Trivy CVE gate (HIGH/CRITICAL, fail on fixable) over every image, weekly scheduled scans
• Custom builds to stay patched between upstream releases: Caddy with DNS plugin + pinned Go modules; Passbolt image with build-time apt security upgrades
• Current image set: Passbolt 5.15.0-1-ce, Infisical v0.162.24, MariaDB 11.8.8, PostgreSQL 16.14, Redis 8.8.0, Caddy 2.11.4

Merged PRs: #2 (gitleaks-action v3.0.0), #4 (actions/checkout v7.0.1), #5 (hadolint-action v3.4.0), #6 (restore hardening)

See docs/GO-LIVE.md for deployment and docs/RESTORE.md for disaster recovery.