BaseHarbor v0.4.4

BaseHarbor v0.4.4

BaseHarbor v0.4.4 adds the first provider-neutral traffic/exposure foundation while hardening the v0.4 lifecycle discovered through real-world regression testing.

Why this matters

Until now BaseHarbor could already discover application-owned Compose publishers and verify HTTP/HTTPS readiness, but that logic was still largely CLI/Compose-oriented. v0.4.4 separates two concepts that must stay independent:

• endpoint discovery/observation — understanding an application endpoint without taking ownership;
• managed exposure — explicitly asking BaseHarbor to make a logical workload endpoint reachable through HTTP/HTTPS.

Applications therefore keep ownership of existing publishers. BaseHarbor only provisions traffic infrastructure when the application contract explicitly requests managed exposure.

Added

The new exposure.http/v1 capability describes portable application intent:

workload:
  compose: compose.yaml
  services:
    - web

exposure:
  http:
    - name: public
      service: web
      port: 8080
      protocol: https
      visibility: public

The contract contains no Caddy-specific configuration. Concrete FQDN, host port, certificate source, Compose network and proxy configuration remain deployment/provider state.

Caddy is the first Compose reference provider. It is application-scoped in the provider registry and owns only its proxy/routing state. BaseHarbor's generated workload override owns the stable exposure integration network and attaches only explicitly exposed services; Caddy consumes that network as an external dependency.

visibility: public is the default host-facing realization. visibility: internal is loopback-only in the current Compose provider.

Changed

Existing app-owned HTTP/HTTPS readiness and managed exposure now use the same endpoint/probe semantics:

• redirects are reachable;
• HTTP 5xx is NOT READY;
• unreachable endpoints are NOT READY;
• logical workload service names are stable identities;
• generated Compose container names never become the application contract.

The same typed state feeds lifecycle verification, status/doctor and future API/Web UI/Operator surfaces.

Security

Managed exposure participates in the normal BaseHarbor lifecycle rather than a Caddy-specific side path:

resolve
  -> preflight all
  -> provision
  -> bind
  -> verify

It is coordinated with application apply/up, down/destroy, backup/restore and existing/BYOC TLS updates.

Failed new or changed Caddy realization rolls BaseHarbor-owned traffic state back. Application Compose source and application-owned persistent volumes are never deleted by the exposure provider.

v0.4 hardening included

This release also contains the regression fixes accumulated after exercising v0.4.0-v0.4.3 against real repositories and restart/destroy flows:

• repository manifests are authoritative over heuristic inspection evidence;
• quick init no longer promotes possible env-secret names into required secrets;
• intentionally stopped applications/control plane report STOPPED rather than failed readiness;
• provider-registry corruption fails during preflight before workload mutation;
• failed workload convergence cleans only resources created by the failed attempt;
• runtime mTLS identities are reused unless real rotation is required, preventing stale bind-mounted certificate/key inodes;
• app destroy --full-reset explicitly removes BaseHarbor-owned repository deployment/TLS state while preserving source and application-owned data;
• global baha destroy --yes provides ownership-aware control-plane cleanup;
• fresh OpenBao recovery-file UX is explicit and fail-closed.

Compatibility & upgrade notes

• Manifest version stays at v1.
• Managed exposure is optional and additive; existing manifests require no changes.
• Existing app-owned HTTP/HTTPS publishers keep their previous behavior and ownership.
• Compose remains the complete runtime implementation.
• Provider-specific traffic state is protected BaseHarbor state and does not need to be committed.
• Applications using managed HTTPS currently need the existing/BYOC TLS deployment mode.

Deprecated

Nothing is deprecated in v0.4.4.

Removed

Nothing from the supported v0.4.3 CLI, Manifest v1 workflow or application-owned publisher lifecycle is removed.

Intentionally deferred

v0.4.4 does not claim:

• managed ACME;
• OpenBao PKI certificate issuance;
• automatic certificate renewal/rotation;
• Traefik provider support;
• Kubernetes Gateway API or OpenShift Routes;
• cloud load balancers or service mesh;
• private OCI registry / air-gapped provider distribution.

Those remain separate follow-up tracks so this release keeps one small, testable provider contract.