First stable release of the self-hosted secrets stack.
What's included
Core stack (ba1e0fe)
- Passbolt CE + Infisical behind Caddy with automatic TLS via ACME DNS-01 — no inbound ports required
- Digest-pinned images throughout; internal-only data tier network; log rotation caps; non-root hardening
- Backup/restore pipeline with age encryption, verified GPG/JWT key handling, and Tailscale-first access model
Security hardening (2f0ab7c, 98f3d56, 674daf4)
- Backup auth, ufw/DOCKER-USER bypass coverage, invite-only signup fixes
- Restore path hardening: safe archive extraction (validated members, no links/traversal, size limits), clean-target enforcement, .env consistency checks
CI / CVE gate (e2b38bf, 111aa4a)
- Full lint suite (shellcheck, yamllint, hadolint, compose-validate) + gitleaks secret scanning with correct PR permissions
- Trivy CVE gate (HIGH/CRITICAL, fail on fixable) over every image, weekly scheduled scans
- Custom builds to stay patched between upstream releases: Caddy with DNS plugin + pinned Go modules; Passbolt image with build-time apt security upgrades
- Current image set: Passbolt 5.15.0-1-ce, Infisical v0.162.24, MariaDB 11.8.8, PostgreSQL 16.14, Redis 8.8.0, Caddy 2.11.4
Merged PRs: #2 (gitleaks-action v3.0.0), #4 (actions/checkout v7.0.1), #5 (hadolint-action v3.4.0), #6 (restore hardening)
See docs/GO-LIVE.md for deployment and docs/RESTORE.md for disaster recovery.