PodHull 1.3.0

PodHull 1.3.0 is about protecting what runs: backups that leave the server encrypted and are tested on a schedule, consistent database dumps, secrets encrypted at rest and rotated, a hardening check of the host, and releases that come with their SBOM and build provenance.

What is new

• Remote backup destinations. S3-compatible storage and SFTP, through the outbound proxy when there is one. Every file is encrypted on the server with the destination's recovery key before it leaves. A volume's schedule copies each backup there with its own retention; the copies are listed and restored from the panel.
• Restore tests. On a schedule or on demand, the newest copy of every volume and the newest installation backup in a destination are decrypted and read through. A failed copy, test or installation backup raises an alert that closes with the next success.
• Installation backup on a schedule. podhull backup --destination NAME and a timer send the whole installation to a destination.
• Database dumps. A volume's schedule can run a job of the app before each backup, such as pg_dump, mysqldump or mariadb-dump into the volume, while the services keep serving; if the job fails, nothing is exported. Templates for the three.
• Secrets encrypted at rest. App secrets are encrypted with the systemd credential service for the app user alone, with the TPM when the host has one.
• Secret rotation. A secret shows the services that use it and can be changed to a value given or generated, with a deploy of the running services that use it. An optional rule raises an alert for secrets not changed in a number of days.
• Hardening check. podhull doctor --hardening compares the host with a published baseline of 21 items: kernel settings, SSH server, crypto policy, audit, time, automatic security updates, TPM, PodHull's own files and UID 0 accounts. It only reads.
• SBOM and provenance. Each archive has an SPDX 2.3 SBOM, and the release an in-toto SLSA v1 provenance, both listed in the signed SHA256SUMS and reproducible from the tags.
• Fixes. The panel's live updates no longer drop every minute behind the proxy, and a download from the panel that takes longer than a minute, such as a large backup, is no longer cut. Long values and table cells wrap on narrow screens.

Backup format

Encrypted backups are now written in format 2, which uses only constructions approved under FIPS 140-3 (D-125). 1.3 still reads the backups that 1.0 to 1.2 wrote; a 1.2 agent cannot read a backup written by 1.3.

Install or upgrade

sudo dnf config-manager --add-repo https://rpm.podhull.lowstack.cc/podhull.repo
sudo dnf install podhull        # or: sudo dnf upgrade podhull
sudo podhull install --domain panel.example.com --acme-email admin@example.com

Accept the repository key only if its fingerprint is 32CF A029 0414 AA3C 39E2 363C 6254 8058 9FEF D740. An upgrade from 1.2.0 keeps all state and does not restart the apps. The full guide is at https://podhull.lowstack.cc/install.

Verify

SHA256SUMS is signed with the release key (keys/podhull-release.pub, ED25519 SHA256:KJd7pZb1HpcUpKAZsrOGxPdSg+iDan16MaVI5OcLehI), and the RPMs carry an OpenPGP signature from the repository key:

tools/release.sh verify keys/podhull-release.pub ./downloads
rpm --import keys/RPM-GPG-KEY-podhull && rpm -K podhull-1.3.0-1.el10.*.rpm

The archives are reproducible: building the v1.3.0 tags of podhull-agent, podhull-proxy, podhull-panel and podhull-dist with Go 1.27.3 gives the same bytes, and release.sh attest on them gives the same SBOMs and provenance.

Components

Component	Version
podhull-agent	1.3.0
podhull-proxy	1.3.0
podhull-panel	1.3.0
podhull-protocol	1.14.1 (the proxy is built with 1.6.0: the proxy document has not changed since)

Tested on Oracle Linux 10.2 (aarch64), including the upgrade from 1.2.0. See COMPATIBILITY.md and the changelog of each repository.

Security

1.3 is the maintained version; 1.2, 1.1 and 1.0 get no further release. Report vulnerabilities privately as described in SECURITY.md.

PodHull 1.2.0

PodHull 1.2.0 is about running apps day to day: alerts where the team already looks, metrics for existing dashboards, certificates from an internal CA, a panel only reachable from known networks, resource limits, private registries, and jobs and migrations that run with the app's own image and isolation.

What is new

• Notifications. Channels for e-mail (SMTP over TLS), Slack, Mattermost and Rocket.Chat, Microsoft Teams, Google Chat, Matrix, ntfy, PagerDuty and a signed webhook. Events for failed deploys, services down, certificates close to expiry or failing renewal, failed backups and jobs, disk and memory thresholds, key changes and sign-ins from new addresses. Alerts repeat and resolve; quiet hours hold the rest for a digest.
• Prometheus metrics. /metrics on the panel's domain, off until a token exists, optionally limited to source networks: services (CPU, memory, processes, OOM kills, health, deploys), certificates, backups, jobs, alerts.
• Custom certificates. Upload a purchased or internal-CA certificate, wildcards included; ACME leaves the names it covers alone. Expiry alerts and metrics as for ACME certificates.
• Panel access policy. Allowed source networks for the panel, with protection against locking yourself out and podhull panel-access clear on the host.
• CPU and disk limits. Per service, in cores and MB/s.
• Private registries. Credentials per app for Quay, Harbor, Artifactory, GHCR and others, checked by the registry when saved. The panel keeps only the host and the user name.
• Jobs. Run a command in a container of a service, with its volumes, secrets, environment and limits and the image it runs, by hand or on a systemd calendar. Each run keeps its result, exit code and output; a failing job raises an alert.
• Deploy commands. A command before the new version starts, such as database migrations: if it fails, the deploy stops and the old version keeps serving. And one after it serves: if it fails, you are told, and nothing is undone.

Install or upgrade

sudo dnf config-manager --add-repo https://rpm.podhull.lowstack.cc/podhull.repo
sudo dnf install podhull        # or: sudo dnf upgrade podhull
sudo podhull install --domain panel.example.com --acme-email admin@example.com

Accept the repository key only if its fingerprint is 32CF A029 0414 AA3C 39E2 363C 6254 8058 9FEF D740. An upgrade from 1.1.0 keeps all state and does not restart the apps. The full guide is at https://podhull.lowstack.cc/install.

Verify

SHA256SUMS is signed with the release key (keys/podhull-release.pub, ED25519 SHA256:KJd7pZb1HpcUpKAZsrOGxPdSg+iDan16MaVI5OcLehI), and the RPMs carry an OpenPGP signature from the repository key:

tools/release.sh verify keys/podhull-release.pub ./downloads
rpm --import keys/RPM-GPG-KEY-podhull && rpm -K podhull-1.2.0-1.el10.*.rpm

The archives are reproducible: building the v1.2.0 tags of podhull-agent, podhull-proxy, podhull-panel and podhull-dist with Go 1.27.3 gives the same bytes.

Components

Component	Version
podhull-agent	1.2.0
podhull-proxy	1.2.0
podhull-panel	1.2.0
podhull-protocol	1.11.0 (the proxy is built with 1.6.0: the proxy document has not changed since)

Tested on Oracle Linux 10.2 (aarch64), including the upgrade from 1.1.0. See COMPATIBILITY.md and the changelog of each repository.

Security

1.2 is the maintained version; 1.1 and 1.0 get no further release. Report vulnerabilities privately as described in SECURITY.md.

PodHull 1.1.0

PodHull 1.1.0 adds what a production server in a company network needs: a signed package repository, work behind a proxy or without internet access, a backup of the whole installation, and apps kept as files.

What is new

• Signed dnf repository. dnf install podhull and dnf upgrade podhull from rpm.podhull.lowstack.cc; packages and repository metadata are signed with the key in keys/RPM-GPG-KEY-podhull.
• Outbound HTTP proxy. podhull install --outbound-proxy URL [--no-proxy LIST] for certificates, image pulls, Git and builds; running containers do not use it.
• No internet access. Packages from a local mirror, images from an internal registry or a Podman mirror, certificates from an internal ACME server with podhull install --acme-directory URL.
• Backup and restore of the whole installation. podhull backup --output FILE writes configuration, panel and proxy state, and every app's secrets, volumes and home to one encrypted file; podhull restore FILE brings it back on the same or a new server and deploys again what ran.
• App files. Export an app as JSON, see the plan of a file against an app (field changes, unit diffs, missing secrets) and apply exactly that plan; create a new app from a file. Secret values never leave the host.
• Volumes. Volumes no unit mounts are listed with their backups and can be deleted; a volume a container still uses is never removed.
• Upgrades. Every release is now tested as an upgrade from the one before it, with apps and data in place. An upgrade restarts the agent too: with 1.0.0 the old agent kept running until the next reboot.

Install or upgrade

sudo dnf config-manager --add-repo https://rpm.podhull.lowstack.cc/podhull.repo
sudo dnf install podhull        # or: sudo dnf upgrade podhull
sudo podhull install --domain panel.example.com --acme-email admin@example.com

Accept the repository key only if its fingerprint is 32CF A029 0414 AA3C 39E2 363C 6254 8058 9FEF D740. An upgrade from 1.0.0 keeps all state and does not restart the apps. The full guide is at https://podhull.lowstack.cc/install.

Verify

SHA256SUMS is signed with the release key (keys/podhull-release.pub, ED25519 SHA256:KJd7pZb1HpcUpKAZsrOGxPdSg+iDan16MaVI5OcLehI), and the RPMs carry an OpenPGP signature from the repository key:

tools/release.sh verify keys/podhull-release.pub ./downloads
rpm --import keys/RPM-GPG-KEY-podhull && rpm -K podhull-1.1.0-1.el10.*.rpm

The archives are reproducible: building the v1.1.0 tags of podhull-agent, podhull-proxy, podhull-panel and podhull-dist with Go 1.27.3 gives the same bytes.

Components

Component	Version
podhull-agent	1.1.0
podhull-proxy	1.1.0 (no changes)
podhull-panel	1.1.0
podhull-protocol	1.3.0

Tested on Oracle Linux 10.2 (aarch64), including the upgrade from 1.0.0. See COMPATIBILITY.md and the changelog of each repository.

Security

1.1 is the maintained version; 1.0 gets no further release. Report vulnerabilities privately as described in SECURITY.md.

PodHull 1.0.0

PodHull 1.0.0 is the first stable release: a self-hosted application platform for one RHEL-family server, built only on Podman, Quadlet and systemd.

What is in 1.0

• Isolation by default. One Linux user per app, rootless Podman, a fixed user ID slice per service, SELinux, nftables rules per app, every capability dropped, and a root agent that only runs allow-listed operations.
• Deployments. Registry images and Git builds, blue-green and recreate strategies, health checks, rollback to earlier images, webhooks from GitHub, GitLab, Forgejo, Gitea or any signed sender, and update checks.
• Exposure. Private services, HTTP routes with automatic TLS from any ACME directory, and TCP ports with an allowlist.
• Data. Named volumes, secrets kept in Podman, local backups with schedules and restore.
• Operations. Live logs, metrics and events, a hash-chained audit log, raw Quadlet editing with revisions, podhull install, podhull doctor, and a purge that leaves no trace.

Install

sudo dnf install ./podhull-1.0.0-1.el10.<arch>.rpm
sudo podhull install --domain panel.example.com --acme-email admin@example.com

Then open https://panel.example.com/setup with the one-time token the installer prints. The full guide is at https://podhull.lowstack.cc/install.

Verify

SHA256SUMS is signed with the release key in this repository (keys/podhull-release.pub, ED25519 SHA256:KJd7pZb1HpcUpKAZsrOGxPdSg+iDan16MaVI5OcLehI):

tools/release.sh verify keys/podhull-release.pub ./downloads

The archives are reproducible: building the v1.0.0 tags of podhull-agent, podhull-proxy, podhull-panel and podhull-dist with Go 1.27.3 gives the same bytes.

Components

Component	Version
podhull-agent	1.0.0
podhull-proxy	1.0.0
podhull-panel	1.0.0
podhull-protocol	1.1.0

Supported systems: RHEL, AlmaLinux, Rocky Linux and Oracle Linux 10.2 or later, on x86_64 and aarch64, with Podman 5.8 or later. See COMPATIBILITY.md for the tested platforms, and the changelog of each repository for the full list of changes.

Security issues: see SECURITY.md.