KRATE 0.7.0 beta.9

KRATE 0.7.0

Tag	v0.7.0-beta.9
Channel	pre-release (beta)

Packages

Platform	File	SHA256
debian13-amd64	krate_0.7.0.beta.9-trixie_amd64.deb	024fc3e6abb8e7a98bc60cd56ce2f6fb130ad132f626a3a2537cd431cabe94b1

Install

zen pull --check
zen pull

The update channel (stable or pre-release) is configured with update_channel in
/etc/krate/environment.d/zenfw.conf (overrides in zenfw.conf.local).
zen pull resolves the matching release automatically when conditions are met.

Changes

console (115a8f8)

• fix(provider): detect OVH VPS via cloud-init and hostname markers (115a8f8) — @tomcdj71
• fix(zen): repair set domain validation and pull --check snapshots (d27510e) — @tomcdj71
• fix(license): use canonical KRATE/zen/1.0 User-Agent for API calls (9f0ebf4) — @tomcdj71
• feat(license): unify payload contract and enforce free update delay (a6b376d) — @tomcdj71
• fix(license): upgrade local-free fallback when the API is reachable (b47b374) — @tomcdj71
• fix(software): qualify Options in subdomain install defaults helper (f1c788b) — @tomcdj71
• fix(provider): broaden OVH detection on modern VPS images (308b441) — @tomcdj71
• feat(license): add license::request and refresh API-signed licenses. (c5ed87b) — @tomcdj71
• feat(software): default CLI installs to subdomain when user routing is on (d2a57c9) — @tomcdj71
• refactor(domain): subdomain routing opt-out instead of opt-in (2af39b2) — @tomcdj71
• fix(domain): honor autocomplete -s for subdomain install eligibility (f32b576) — @tomcdj71
• fix(caddy): use parent-relative imports in per-user site template (f41df9f) — @tomcdj71
• fix(domain): repair missing user site block when subdomain label exists (f18f2e8) — @tomcdj71
• fix(tmpfiles): add www-data-writable zen job log directory (422a9fd) — @tomcdj71
• feat(domain): auto-provision default user subdomain labels (eb68c4b) — @tomcdj71
• feat(domain): regenerate VSFTPD TLS cert when apex domain changes (decca33) — @tomcdj71
• fix(domain): parse OpenSSL SAN values from continuation line (1765542) — @tomcdj71
• feat(domain): add domain::cert::list for Caddy and VSFTPD certificates (16a37f1) — @tomcdj71
• fix(lifecycle): resolve url_base before proxy routing is computed (24b9602) — @tomcdj71
• fix(pull): compare installed KRATE upstream version reliably (40b5c38) — @tomcdj71
• fix(support): terminate sshx session on disable (b0e0b31) — @tomcdj71
• fix(support): resolve audit session dir for remote shells (7f54993) — @tomcdj71
• fix(support): ensure session wrapper is executable at install (d3f5096) — @tomcdj71
• fix(Support): gate session readiness on captured sshx URL (91e34b7) — @tomcdj71
• fix(Caddy): prune stale template artifacts from /etc/caddy (5461dc1) — @tomcdj71
• fix(Support): stop krate-supportd from killing session during startup (c485b0b) — @tomcdj71
• fix(Support): tolerate null JSON fields in krate-supportd session state (13079b2) — @tomcdj71
• fix(Support): resolve build_status_json compile errors in CI (a09bfa1) — @tomcdj71
• feat(Support): add JSON output for status and audit commands (fcd6438) — @tomcdj71
• fix(Caddy): import public TLS fragment at site level (02abed1) — @tomcdj71
• fix(Dependency): use 7200s timeout for platform apt install phases (b4f52ac) — @tomcdj71
• fix(Support): find prebuilt zenfw package when building krate-supportd (bdcd400) — @tomcdj71
• feat(License): gate user and firewall CLI on premium license features (a10fc3a) — @tomcdj71
• chore(Branding): drop get.runkrate.com from zenfw trusted hosts (d45ce83) — @tomcdj71
• chore(Branding): point console services and license client to runkrate.com (9e2de5e) — @tomcdj71
• fix(BashCompletion): call _software_flag_expects_value outside [[ ]] (39621b9) — @tomcdj71
• feat(Rollback): add i18n strings for setup --rollback recovery (127498f) — @tomcdj71
• fix(Support): bound support code random index to alphabet size (61b26bd) — @tomcdj71
• docs(Support): document auditable support and audit UX (cdc7dca) — @tomcdj71
• feat(zen): add zen support audit subcommand (e1f9379) — @tomcdj71
• feat(zen): wire zen support to auditable session flow (0d86e54) — @tomcdj71
• feat(Support): add krate-supportd and auditable session scripts (1107bd3) — @tomcdj71
• feat(zen): show opaque support code with 6h expiry and progress (1d933f7) — @tomcdj71
• fix(zenfw): keep Tailwind CLI binaries executable under var/tailwind (2700137) — @tomcdj71
• fix(zenfw): reuse existing trim_copy in APT recent_changes parser (ffb6db0) — @tomcdj71

setup (7f5752b)

• fix(setup): stop using zenfw::license::k_license_user_agent in activateLicense (7f5752b) — @tomcdj71
• fix(license): send canonical User-Agent on setup activation (c0d9afa) — @tomcdj71
• feat(setup): align local-free license with canonical payload contract (58cab9c) — @tomcdj71
• feat(setup): add account_email for paid license activation (d0c3d7e) — @tomcdj71
• fix(setup): wait for apt lock before package steps (07b539b) — @tomcdj71
• fix(Caddy): prune package-only templates after copying Caddy tree (0b2f5de) — @tomcdj71
• fix(Caddy): import public TLS fragment at site level during setup (1a65480) — @tomcdj71
• fix(Rollback): repair stop-services shell and wait for apt lock (cf336bd) — @tomcdj71
• feat(License): disable premium features on free local license (e918f8e) — @tomcdj71
• chore(Branding): use runkrate.com endpoints in setup installer (9c9ba52) — @tomcdj71
• feat(Rollback): restore APT snapshot on failure and via setup --rollback (e6b4195) — @tomcdj71
• feat(SystemUpdate): refresh update snapshot via zen pull --check after install (b46307a) — @tomcdj71
• fix(Permissions): resolve krate group with getgrnam in zenfw.conf.local permissions (472b622) — @tomcdj71
• fix(Permissions): call intl::timezone::set and defer krate group on zenfw.conf.local (c022cd4) — @tomcdj71
• feat(ZenConfig): default cli.mode=original during install (8991da0) — @tomcdj71
• fix(ZenConfig): pass CommandArgs to intl::set_timezone zen_invoke (cca64dc) — @tomcdj71
• fix(Install): persist public.base.url for app install infobox URLs (85a9324) — @tomcdj71
• fix(Install): show detected IP or configured domain instead of localhost (6ed230a) — @tomcdj71
• feat(PlatformSettings): persist platform locale settings and print install summary (695ebff) — @tomcdj71
• fix(PHP): apply 99-krate.ini permissions after template edits (fce87b2) — @tomcdj71
• feat(SystemUpdate): refresh update snapshot at end of installation (58ccd8a) — @tomcdj71
• fix(CI): build against older zenfw prefix and fix CI app token input (80f6b61) — @tomcdj71
• feat(Install): seed SMTP sender from install email and PHP 8.5 stack (641bf53) — @tomcdj71
• chore(ci): bump github-app-token and upload-artifact actions (7ac7225) — @tomcdj71
• chore(ci): bump actions/checkout to v6 (81d661c) — @tomcdj71
• fix(ZenConfig): persist zenfw.command.timeout during install (34c0019) — @tomcdj71
• fix(PHP): stop pinning APP_ENV in the PHP-FPM pool (c4a6aed) — @tomcdj71
• fix(ZenConfig): persist krate.conf branch=beta to zenfw.conf.local (5ef8ce7) — @tomcdj71
• fix(Permissions): declare zenfw_conf_finalize_local_permissions after permission_set (1b27a26) — @tomcdj71
• fix(Permissions): normalize krate runtime permissions for timers and vault (9db0cb2) — @tomcdj71
• fix(PHP): restart PHP instead of reload after pool changes (891c984) — @tomcdj71
• fix(PHP): grant Caddy access to php-fpm socket via listen.acl_users. (47d6dd2) — @tomcdj71
• fix(Firewall): pre-declare SSH and web ports before nftables default-deny. (326a6fe) — @tomcdj71
• fix(Firewall): open firewall port 443/tcp for Caddy after nftables init. (2fb9e22) — @tomcdj71
• fix(HarmonyUI): ensure var/ is writable by krate before Harmony migrations. (716093e) — @tomcdj71
• feat(Firewall): wire nftables firewall into SSH/FTP setup phase (4264b8d) — @tomcdj71
• fix(HarmonyUI): expose APP_ENV=prod to php-fpm for HarmonyUI (c41b5cf) — @tomcdj71
• feat(HarmonyUI): enable HarmonyUI messenger worker after install (113fb95) — @tomcdj71
• docs: document update_channel setup flow in README (f9cbc56) — @tomcdj71
• feat(ZenConfig): persist update_channel from krate.conf branch to zenfw.conf.local (38b0011) — @tomcdj71
• chore: reinit console repo (049392c) — @tomcdj71
• Initial branch (a74d37d) — @tomcdj71

web (HarmonyUI) (9ffb05e)

• fix(web): resolve /opt/Krate/bin/zen for system update checks (9ffb05e) — @tomcdj71
• feat(web): surface pending system updates during free-tier delay (fbb3ac8) — @tomcdj71
• fix(install): sync access groups when fixtures already created them (91ee978) — @tomcdj71
• test(license): cover LicenseOverviewService request and status flows. (2c4a928) — @tomcdj71
• feat(settings): wire license overview to zen license::request. (bbc452a) — @tomcdj71
• refactor(subdomain): drive install routing from profile, remove wizard toggle (be30d0f) — @tomcdj71
• fix(subdomain): default app installs to host mode when profile routing is on (5376f6e) — @tomcdj71
• fix(system-update): use writable log dir for detached zen jobs (03e80f0) — @tomcdj71
• feat(app-store): reorganize sidebar with expandable footer search (845139b) — @tomcdj71
• fix(app-store): close install wizard modal on confirm (b5b8ae6) — @tomcdj71
• fix(app-store): restore green/red state on wizard toggle switches (a31ceb8) — @tomcdj71
• docs(certificates): note VSFTPD cert sync on primary host change (82c22da) — @tomcdj71
• feat(certificates): redesign overview panel and issuer display (b6203d1) — @tomcdj71
• fix(profile): resolve site host from Caddy DOMAIN or root URL (2791028) — @tomcdj71
• fix(profile): improve routing preference copy and light-mode contrast (1ba5909) — @tomcdj71
• fix(profile): show subdomain routing toggle in Preferences (4ecb039) — @tomcdj71
• feat(profile): move subdomain routing toggle to Account Informations (b01b4cf) — @tomcdj71
• feat(web): add per-user subdomain routing API (b8d91d3) — @tomcdj71
• refactor(web): reorder settings nav by usage priority (690ee37) — @tomcdj71
• fix(profile): drop shell row and link to access groups (6cffba5) — @tomcdj71
• fix(profile): compact Account Informations secret fields (dd46883) — @tomcdj71
• fix(web): settings nav active state and missing translations (07744b4) — @tomcdj71
• feat(web): add certificates settings page backed by domain::cert::list (23c69a9) — @tomcdj71
• fix(mobile): actually relocate dashboard controls into the navbar (1d6c534) — @tomcdj71
• fix(mobile): slim the top navbar and dock dashboard controls into it (3b9498a) — @tomcdj71
• fix(dashboard): let mobile widget cards grow to fit the donut (a70ead3) — @tomcdj71
• feat(i18n): add strings for access groups, management nav and subdomain URL (3d1bc86) — @tomcdj71
• feat(app-store): redesign install wizard with subdomain toggle and URL preview (cbe4c2e) — @tomcdj71
• feat(app-store): full-screen mobile modal and responsive navigation (a44b693) — @tomcdj71
• fix(layout): fixed full-viewport backdrop and mobile dashboard widgets (bd08e12) — @tomcdj71
• fix(nav): rework mobile drawer with scrim and header logo (1cc9c34) — @tomcdj71
• feat(nav): add Management section and consolidate settings navigation (6eb77d2) — @tomcdj71
• feat(access-groups): redesign admin access group screens (514dcd6) — @tomcdj71
• feat(access-groups): enforce access across store API, commands and forms (ac4dfb1) — @tomcdj71
• feat(access-groups): add declarative registry and access service (f15dfd3) — @tomcdj71
• feat(nav): add logout to main sidebar profile menu (b62fe1d) — @tomcdj71
• feat(app-store): refine sidebar with sources, quota and settings menu (c195510) — @tomcdj71
• feat(app-store): show license limits in App Store UI (76c4139) — @tomcdj71
• fix(license): cache license overview per request (cb60b6a) — @tomcdj71
• feat(app-store): add license entitlement resolver and API enrichment (c7eeec2) — @tomcdj71
• feat(license): align playback Flagception flag with license gate (15461b8) — @tomcdj71
• fix(dashboard): close notification center on outside click and Escape (f028f6c) — @tomcdj71
• fix(dashboard): prevent double-binding of widget order menu handlers (d523b04) — @tomcdj71
• fix(HarmonyUI): unify dashboard widget reorder panel with notifications (20c3eb0) — @tomcdj71
• refactor(Profile): unify /me page headers and full-width layout (8d0a4e3) — @tomcdj71

official apps (e3c0db6)

• refactor(meta): subdomain routing opt-out policy for official apps (9a4ed23) — @tomcdj71
• chore(Caddy): drop obsolete /etc/caddy/auth/users.json from manifests (121140b) — @tomcdj71
• chore(Branding): update radarr handler contact to runkrate.com (7a19bac) — @tomcdj71
• fix(apps): write custom Caddy snippets under path or host tier (50aa2ef) — @tomcdj71
• fix(wizarr): clone repository using configured update branch (c330928) — @tomcdj71
• chore(apps): align meta.yaml branch and install UI options (1c16658) — @tomcdj71
• refactor(apps): migrate *arr manifests to main/beta release branches (67f4e30) — @tomcdj71
• feat(apps): add version.probes to official app manifests (257ce73) — @tomcdj71
• fix(rutorrent): rely on lifecycle php_fpm_unit with php-fpm fallback (5884d2d) — @tomcdj71
• refactor(rutorrent): slim handler to 5 functions and ~150 lines (16080f2) — @tomcdj71
• fix(rutorrent): prefer php_fpm_unit from lifecycle in _restart_php_fpm (9e1d972) — @tomcdj71
• fix(rutorrent): restart php-fpm only when SCGI access requires it (b9e8774) — @tomcdj71
• fix(rutorrent): ensure SCGI access and Novik 5.x plugin compatibility (c91afe9) — @tomcdj71
• refactor(rutorrent): simplify lifecycle handler (bc92628) — @tomcdj71
• fix(rutorrent): close awk exit parenthesis in plugin allowlist check (b9e457b) — @tomcdj71
• fix(rutorrent): filter extension deploy and run initplugins after SCGI (b223bb8) — @tomcdj71
• fix(rutorrent): preserve WebUI prefs and surface initplugins failures (3123d4f) — @tomcdj71
• fix(rutorrent): apply Krate patches after apps-extensions plugin deploy (9f79f0e) — @tomcdj71
• fix(rutorrent): deploy apps-extensions plugins into plugins/ (3604103) — @tomcdj71
• fix(rutorrent): deploy apps-extensions themes into plugins/theme/themes (7f42523) — @tomcdj71
• fix(rutorrent): always restart php-fpm and sync Novik app on update (30769b1) — @tomcdj71
• fix(rutorrent): ensure www-data can reach rTorrent SCGI socket on install (bdeb8ac) — @tomcdj71
• fix(jellyfin): dedicated handle block for WebSocket subpath proxy (853c5b5) — @tomcdj71
• fix(ci): use client-id input for create-github-app-token v3 (b34233e) — @tomcdj71
• fix(jellyfin): render Caddy fragment from app template with path matcher (871fc44) — @tomcdj71
• fix(emby): use Krate env file and force EMBY_DATA on each config (6dd3da7) — @tomcdj71
• chore(ci): bump create-github-app-token to v3 (730e0c0) — @tomcdj71
• chore(ci): bump actions/checkout to v6 (a7ba0e7) — @tomcdj71
• fix(jellyfin): map beta channel to stable Jellyfin releases (4dca417) — @tomcdj71
• fix(emby): pass -programdata so server uses user data_dir (bc44ac0) — @tomcdj71
• fix(rtorrent): run pre script via sh without requiring execute bit (b7fb662) — @tomcdj71
• fix(jellyfin): verify Users/Public after wizard and enable proxy URI by request (0f5a240) — @tomcdj71
• fix(tautulli): allow 180s for CherryPy to become active after start/restart (e1838aa) — @tomcdj71
• fix(rtorrent): point ExecStartPre at official pre script and extend service wait (4d48822) — @tomcdj71
• fix(tautulli): install release deps via uv pip with filtered requirements (d46510a) — @tomcdj71
• fix(rtorrent): use oneshot unit for tmux detached session (9ed9fc4) — @tomcdj71
• fix(jellyfin): do not fail install when playback API key is missing (d17db3a) — @tomcdj71
• fix(emby): use loopback root URL and tolerate two-phase startup (3e32288) — @tomcdj71
• fix(deluge): install venv deps with uv pip and split Pillow install (ec3eaa9) — @tomcdj71
• fix(decluttarr): install deps via uv pip instead of venv::build (95f4e9c) — @tomcdj71
• fix(byparr): printf env file and soften systemd start before probe (dd1da54) — @tomcdj71
• fix(rtorrent): use systemd Type=simple for tmux session (8f7880e) — @tomcdj71
• fix(tautulli): harden uv venv provisioning on Python 3.13 (549ca6f) — @tomcdj71

community apps (21ceee3)

• chore: init repo (21ceee3) — @tomcdj71

Contributors

• @tomcdj71