KRATE 0.7.0 beta.5

KRATE 0.7.0

Tag	v0.7.0-beta.5
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.7.0.beta.5-trixie_amd64.deb	bcfd2a5da1a3510726f24bf225b1696ad9793fc0a6393be08096d21cce05b98e

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (f18f2e8)

• fix(domain): repair missing user site block when subdomain label exists (f18f2e8) — @tomcdj71
• fix(tmpfiles): add www-data-writable zen job log directory (422a9fd) — @tomcdj71
• feat(domain): auto-provision default user subdomain labels (eb68c4b) — @tomcdj71
• feat(domain): regenerate VSFTPD TLS cert when apex domain changes (decca33) — @tomcdj71
• fix(domain): parse OpenSSL SAN values from continuation line (1765542) — @tomcdj71
• feat(domain): add domain::cert::list for Caddy and VSFTPD certificates (16a37f1) — @tomcdj71
• fix(lifecycle): resolve url_base before proxy routing is computed (24b9602) — @tomcdj71
• fix(pull): compare installed KRATE upstream version reliably (40b5c38) — @tomcdj71
• fix(support): terminate sshx session on disable (b0e0b31) — @tomcdj71
• fix(support): resolve audit session dir for remote shells (7f54993) — @tomcdj71
• fix(support): ensure session wrapper is executable at install (d3f5096) — @tomcdj71
• fix(Support): gate session readiness on captured sshx URL (91e34b7) — @tomcdj71
• fix(Caddy): prune stale template artifacts from /etc/caddy (5461dc1) — @tomcdj71
• fix(Support): stop krate-supportd from killing session during startup (c485b0b) — @tomcdj71
• fix(Support): tolerate null JSON fields in krate-supportd session state (13079b2) — @tomcdj71
• fix(Support): resolve build_status_json compile errors in CI (a09bfa1) — @tomcdj71
• feat(Support): add JSON output for status and audit commands (fcd6438) — @tomcdj71
• fix(Caddy): import public TLS fragment at site level (02abed1) — @tomcdj71
• fix(Dependency): use 7200s timeout for platform apt install phases (b4f52ac) — @tomcdj71
• fix(Support): find prebuilt zenfw package when building krate-supportd (bdcd400) — @tomcdj71
• feat(License): gate user and firewall CLI on premium license features (a10fc3a) — @tomcdj71
• chore(Branding): drop get.runkrate.com from zenfw trusted hosts (d45ce83) — @tomcdj71
• chore(Branding): point console services and license client to runkrate.com (9e2de5e) — @tomcdj71
• fix(BashCompletion): call _software_flag_expects_value outside [[ ]] (39621b9) — @tomcdj71
• feat(Rollback): add i18n strings for setup --rollback recovery (127498f) — @tomcdj71
• fix(Support): bound support code random index to alphabet size (61b26bd) — @tomcdj71
• docs(Support): document auditable support and audit UX (cdc7dca) — @tomcdj71
• feat(zen): add zen support audit subcommand (e1f9379) — @tomcdj71
• feat(zen): wire zen support to auditable session flow (0d86e54) — @tomcdj71
• feat(Support): add krate-supportd and auditable session scripts (1107bd3) — @tomcdj71
• feat(zen): show opaque support code with 6h expiry and progress (1d933f7) — @tomcdj71
• fix(zenfw): keep Tailwind CLI binaries executable under var/tailwind (2700137) — @tomcdj71
• fix(zenfw): reuse existing trim_copy in APT recent_changes parser (ffb6db0) — @tomcdj71
• feat(zenfw): add APT recent_changes command from history.log (5c30197) — @tomcdj71
• fix(zen): repair zen pull compile errors after version display change (9667947) — @tomcdj71
• fix(Support): allocate PTY for sshx support session startup (8436b4d) — @tomcdj71
• fix(zen): show full prerelease version after zen pull (f269ab9) — @tomcdj71
• feat(zenfw): add APT list_upgradable and upgrade_packages commands (9c5ce77) — @tomcdj71
• fix(Support): relocate sshx install under /var/lib/krate/support (8456acd) — @tomcdj71
• fix(caddy): allow data URIs in CSP script-src for AssetMapper (d2743ed) — @tomcdj71
• chore(AssetMapper): update dashboard frontend build for AssetMapper (d3124d5) — @tomcdj71
• refactor(zenfw): refresh system-update snapshot via zen pull --check (a03fadd) — @tomcdj71
• fix(zen): refresh system-update snapshot after pull upgrade completes (b0e3e2c) — @tomcdj71
• chore(caddy): remove stray rutorrent.conf from templates (dfb2027) — @tomcdj71
• feat(caddy): add proxy_caddy_fragment_path for app handlers (3a5aaa7) — @tomcdj71

setup (0b2f5de)

• fix(Caddy): prune package-only templates after copying Caddy tree (0b2f5de) — @tomcdj71
• fix(Caddy): import public TLS fragment at site level during setup (1a65480) — @tomcdj71
• fix(Rollback): repair stop-services shell and wait for apt lock (cf336bd) — @tomcdj71
• feat(License): disable premium features on free local license (e918f8e) — @tomcdj71
• chore(Branding): use runkrate.com endpoints in setup installer (9c9ba52) — @tomcdj71
• feat(Rollback): restore APT snapshot on failure and via setup --rollback (e6b4195) — @tomcdj71
• feat(SystemUpdate): refresh update snapshot via zen pull --check after install (b46307a) — @tomcdj71
• fix(Permissions): resolve krate group with getgrnam in zenfw.conf.local permissions (472b622) — @tomcdj71
• fix(Permissions): call intl::timezone::set and defer krate group on zenfw.conf.local (c022cd4) — @tomcdj71
• feat(ZenConfig): default cli.mode=original during install (8991da0) — @tomcdj71
• fix(ZenConfig): pass CommandArgs to intl::set_timezone zen_invoke (cca64dc) — @tomcdj71
• fix(Install): persist public.base.url for app install infobox URLs (85a9324) — @tomcdj71
• fix(Install): show detected IP or configured domain instead of localhost (6ed230a) — @tomcdj71
• feat(PlatformSettings): persist platform locale settings and print install summary (695ebff) — @tomcdj71
• fix(PHP): apply 99-krate.ini permissions after template edits (fce87b2) — @tomcdj71
• feat(SystemUpdate): refresh update snapshot at end of installation (58ccd8a) — @tomcdj71
• fix(CI): build against older zenfw prefix and fix CI app token input (80f6b61) — @tomcdj71
• feat(Install): seed SMTP sender from install email and PHP 8.5 stack (641bf53) — @tomcdj71
• chore(ci): bump github-app-token and upload-artifact actions (7ac7225) — @tomcdj71
• chore(ci): bump actions/checkout to v6 (81d661c) — @tomcdj71
• fix(ZenConfig): persist zenfw.command.timeout during install (34c0019) — @tomcdj71
• fix(PHP): stop pinning APP_ENV in the PHP-FPM pool (c4a6aed) — @tomcdj71
• fix(ZenConfig): persist krate.conf branch=beta to zenfw.conf.local (5ef8ce7) — @tomcdj71
• fix(Permissions): declare zenfw_conf_finalize_local_permissions after permission_set (1b27a26) — @tomcdj71
• fix(Permissions): normalize krate runtime permissions for timers and vault (9db0cb2) — @tomcdj71
• fix(PHP): restart PHP instead of reload after pool changes (891c984) — @tomcdj71
• fix(PHP): grant Caddy access to php-fpm socket via listen.acl_users. (47d6dd2) — @tomcdj71
• fix(Firewall): pre-declare SSH and web ports before nftables default-deny. (326a6fe) — @tomcdj71
• fix(Firewall): open firewall port 443/tcp for Caddy after nftables init. (2fb9e22) — @tomcdj71
• fix(HarmonyUI): ensure var/ is writable by krate before Harmony migrations. (716093e) — @tomcdj71
• feat(Firewall): wire nftables firewall into SSH/FTP setup phase (4264b8d) — @tomcdj71
• fix(HarmonyUI): expose APP_ENV=prod to php-fpm for HarmonyUI (c41b5cf) — @tomcdj71
• feat(HarmonyUI): enable HarmonyUI messenger worker after install (113fb95) — @tomcdj71
• docs: document update_channel setup flow in README (f9cbc56) — @tomcdj71
• feat(ZenConfig): persist update_channel from krate.conf branch to zenfw.conf.local (38b0011) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (5376f6e)

• fix(subdomain): default app installs to host mode when profile routing is on (5376f6e) — @tomcdj71
• fix(system-update): use writable log dir for detached zen jobs (03e80f0) — @tomcdj71
• feat(app-store): reorganize sidebar with expandable footer search (845139b) — @tomcdj71
• fix(app-store): close install wizard modal on confirm (b5b8ae6) — @tomcdj71
• fix(app-store): restore green/red state on wizard toggle switches (a31ceb8) — @tomcdj71
• docs(certificates): note VSFTPD cert sync on primary host change (82c22da) — @tomcdj71
• feat(certificates): redesign overview panel and issuer display (b6203d1) — @tomcdj71
• fix(profile): resolve site host from Caddy DOMAIN or root URL (2791028) — @tomcdj71
• fix(profile): improve routing preference copy and light-mode contrast (1ba5909) — @tomcdj71
• fix(profile): show subdomain routing toggle in Preferences (4ecb039) — @tomcdj71
• feat(profile): move subdomain routing toggle to Account Informations (b01b4cf) — @tomcdj71
• feat(web): add per-user subdomain routing API (b8d91d3) — @tomcdj71
• refactor(web): reorder settings nav by usage priority (690ee37) — @tomcdj71
• fix(profile): drop shell row and link to access groups (6cffba5) — @tomcdj71
• fix(profile): compact Account Informations secret fields (dd46883) — @tomcdj71
• fix(web): settings nav active state and missing translations (07744b4) — @tomcdj71
• feat(web): add certificates settings page backed by domain::cert::list (23c69a9) — @tomcdj71
• fix(mobile): actually relocate dashboard controls into the navbar (1d6c534) — @tomcdj71
• fix(mobile): slim the top navbar and dock dashboard controls into it (3b9498a) — @tomcdj71
• fix(dashboard): let mobile widget cards grow to fit the donut (a70ead3) — @tomcdj71
• feat(i18n): add strings for access groups, management nav and subdomain URL (3d1bc86) — @tomcdj71
• feat(app-store): redesign install wizard with subdomain toggle and URL preview (cbe4c2e) — @tomcdj71
• feat(app-store): full-screen mobile modal and responsive navigation (a44b693) — @tomcdj71
• fix(layout): fixed full-viewport backdrop and mobile dashboard widgets (bd08e12) — @tomcdj71
• fix(nav): rework mobile drawer with scrim and header logo (1cc9c34) — @tomcdj71
• feat(nav): add Management section and consolidate settings navigation (6eb77d2) — @tomcdj71
• feat(access-groups): redesign admin access group screens (514dcd6) — @tomcdj71
• feat(access-groups): enforce access across store API, commands and forms (ac4dfb1) — @tomcdj71
• feat(access-groups): add declarative registry and access service (f15dfd3) — @tomcdj71
• feat(nav): add logout to main sidebar profile menu (b62fe1d) — @tomcdj71
• feat(app-store): refine sidebar with sources, quota and settings menu (c195510) — @tomcdj71
• feat(app-store): show license limits in App Store UI (76c4139) — @tomcdj71
• fix(license): cache license overview per request (cb60b6a) — @tomcdj71
• feat(app-store): add license entitlement resolver and API enrichment (c7eeec2) — @tomcdj71
• feat(license): align playback Flagception flag with license gate (15461b8) — @tomcdj71
• fix(dashboard): close notification center on outside click and Escape (f028f6c) — @tomcdj71
• fix(dashboard): prevent double-binding of widget order menu handlers (d523b04) — @tomcdj71
• fix(HarmonyUI): unify dashboard widget reorder panel with notifications (20c3eb0) — @tomcdj71
• refactor(Profile): unify /me page headers and full-width layout (8d0a4e3) — @tomcdj71
• refactor(Settings): migrate admin pages to unified headers and drop infoboxes (faa3765) — @tomcdj71
• fix(HarmonyUI): align settings and profile base layouts with dashboard theme (f053fc0) — @tomcdj71
• refactor(HarmonyUI): add shared page header and content card macros (f47a500) — @tomcdj71
• refactor(i18n): add concise page purpose strings for settings screens (94024d0) — @tomcdj71
• fix(Troubleshooting): read support state via zen JSON commands (4305faa) — @tomcdj71
• feat(License): enforce premium features in settings UI and routes (7dbb621) — @tomcdj71

official apps (e873d39)

• chore(Caddy): drop obsolete /etc/caddy/auth/users.json from manifests (121140b) — @tomcdj71
• chore(Branding): update radarr handler contact to runkrate.com (7a19bac) — @tomcdj71
• fix(apps): write custom Caddy snippets under path or host tier (50aa2ef) — @tomcdj71
• fix(wizarr): clone repository using configured update branch (c330928) — @tomcdj71
• chore(apps): align meta.yaml branch and install UI options (1c16658) — @tomcdj71
• refactor(apps): migrate *arr manifests to main/beta release branches (67f4e30) — @tomcdj71
• feat(apps): add version.probes to official app manifests (257ce73) — @tomcdj71
• fix(rutorrent): rely on lifecycle php_fpm_unit with php-fpm fallback (5884d2d) — @tomcdj71
• refactor(rutorrent): slim handler to 5 functions and ~150 lines (16080f2) — @tomcdj71
• fix(rutorrent): prefer php_fpm_unit from lifecycle in _restart_php_fpm (9e1d972) — @tomcdj71
• fix(rutorrent): restart php-fpm only when SCGI access requires it (b9e8774) — @tomcdj71
• fix(rutorrent): ensure SCGI access and Novik 5.x plugin compatibility (c91afe9) — @tomcdj71
• refactor(rutorrent): simplify lifecycle handler (bc92628) — @tomcdj71
• fix(rutorrent): close awk exit parenthesis in plugin allowlist check (b9e457b) — @tomcdj71
• fix(rutorrent): filter extension deploy and run initplugins after SCGI (b223bb8) — @tomcdj71
• fix(rutorrent): preserve WebUI prefs and surface initplugins failures (3123d4f) — @tomcdj71
• fix(rutorrent): apply Krate patches after apps-extensions plugin deploy (9f79f0e) — @tomcdj71
• fix(rutorrent): deploy apps-extensions plugins into plugins/ (3604103) — @tomcdj71
• fix(rutorrent): deploy apps-extensions themes into plugins/theme/themes (7f42523) — @tomcdj71
• fix(rutorrent): always restart php-fpm and sync Novik app on update (30769b1) — @tomcdj71
• fix(rutorrent): ensure www-data can reach rTorrent SCGI socket on install (bdeb8ac) — @tomcdj71
• fix(jellyfin): dedicated handle block for WebSocket subpath proxy (853c5b5) — @tomcdj71
• fix(ci): use client-id input for create-github-app-token v3 (b34233e) — @tomcdj71
• fix(jellyfin): render Caddy fragment from app template with path matcher (871fc44) — @tomcdj71
• fix(emby): use Krate env file and force EMBY_DATA on each config (6dd3da7) — @tomcdj71
• chore(ci): bump create-github-app-token to v3 (730e0c0) — @tomcdj71
• chore(ci): bump actions/checkout to v6 (a7ba0e7) — @tomcdj71
• fix(jellyfin): map beta channel to stable Jellyfin releases (4dca417) — @tomcdj71
• fix(emby): pass -programdata so server uses user data_dir (bc44ac0) — @tomcdj71
• fix(rtorrent): run pre script via sh without requiring execute bit (b7fb662) — @tomcdj71
• fix(jellyfin): verify Users/Public after wizard and enable proxy URI by request (0f5a240) — @tomcdj71
• fix(tautulli): allow 180s for CherryPy to become active after start/restart (e1838aa) — @tomcdj71
• fix(rtorrent): point ExecStartPre at official pre script and extend service wait (4d48822) — @tomcdj71
• fix(tautulli): install release deps via uv pip with filtered requirements (d46510a) — @tomcdj71
• fix(rtorrent): use oneshot unit for tmux detached session (9ed9fc4) — @tomcdj71
• fix(jellyfin): do not fail install when playback API key is missing (d17db3a) — @tomcdj71
• fix(emby): use loopback root URL and tolerate two-phase startup (3e32288) — @tomcdj71
• fix(deluge): install venv deps with uv pip and split Pillow install (ec3eaa9) — @tomcdj71
• fix(decluttarr): install deps via uv pip instead of venv::build (95f4e9c) — @tomcdj71
• fix(byparr): printf env file and soften systemd start before probe (dd1da54) — @tomcdj71
• fix(rtorrent): use systemd Type=simple for tmux session (8f7880e) — @tomcdj71
• fix(tautulli): harden uv venv provisioning on Python 3.13 (549ca6f) — @tomcdj71
• fix(decluttarr): harden uv venv provisioning on Python 3.13 (db969c3) — @tomcdj71

community apps (21ceee3)

• chore: init repo (21ceee3) — @tomcdj71

Contributors

• @tomcdj71