v0.5.1

New

• Volumes on the canvas. Every card shows its volumes under it, with a short name and its size, like Railway. Sizes update every minute; hover shows the full volume name and where it is mounted.
• Data kept from deleted services. Delete a database, app or compose stack and keep its data, and a dashed card stays in its project: "From deleted ", with its size. Start a database on it brings a database back on that data, and Delete data removes it for good (type its name and your password). Folders on the server and volumes made outside Serve are only forgotten, never deleted. Kept data also shows in the grid and list views.
• Read replicas can be started again. A stopped replica has a Start button. Starting or restarting the database starts its replicas on every server, and a redeploy starts each replica on its own, so one server that does not answer no longer keeps the others down.
• The API lists and deletes kept data: GET /environments/{id}/kept-data, DELETE /kept-data/{kind}/{id}.

Fixed

• A stopped read replica marked its whole database as down. Only the database itself, or its pooler, does now.

Commits

• 27a6cbfc Kept data: starting a database on it is limited to members who can reach its project, as deleting it; a size check without a volume list keeps the sizes
• cb601d57 Volumes on the canvas: short names with sizes, one divider, measured every minute; kept data stays where it is, can be dragged, and shows in grid and list too
• 0072a71a Canvas: volumes under each card, and dashed cards for data kept from deleted services, with start and delete
• b148ebd8 Canvas cards know their volumes and sizes; the layout makes room for taller cards and places kept data below
• d8140486 New service: ?kept= opens the database form on that kept data
• d7128ba5 Read replicas: a Start button for a stopped one, started with the database everywhere, each started on its own in a redeploy, and a stopped one no longer marks the database down
• 7bee624e API: list an environment's kept data and delete kept data
• 3262a174 Kept data can be deleted: Serve's own volumes are removed, folders and outside volumes only forgotten, volumes in use refused
• 5922a02c Worker measures every volume's size on each server every 6 hours
• 8a5c1e70 Apps and stacks deleted with their data kept remember their volumes; kept databases remember their environment
• a8897df5 Tables for kept volumes and volume sizes; kept databases remember their project and environment

v0.5.0

Serve 0.5.0 sums up everything since 0.4.0: one app on many servers, backups you can trust, public status pages, a login wall for any app, and an API and CLI that cover the whole dashboard.

Highlights since 0.4.0

One app, many servers

• Load balancing across servers. Tick extra servers, turn on load balancing, deploy. Visitors reach replicas on every server through the private network. DNS only points at the main server; the others need no records and no open ports.
• Health checked every 5 seconds. A replica that stops answering gets no visitors until it is back. Each server switches to a new version only once its replicas are healthy.
• Pick how visitors are spread: round robin, least busy (good for uploads, streams and AI calls), sticky sessions, or main server first with failover to the others in about 10 seconds.
• Switch the main server without a redeploy. Domains, certificates and load balancing move over, and Serve moves the Cloudflare DNS records and tunnel domains it made. If the main server dies, make another one main and the app is back.
• Build once, run anywhere. A built app runs on several servers, or uses a build server, without a registry: Serve copies the image.

Backups you can trust

• Every restore is safe. Serve backs up everything first, and puts it back at once when a restore fails.
• Backup tests. Serve restores a backup into a throwaway database, by hand or every day, and tells you when one fails.
• Encrypted with your own passphrase, in a format openssl opens without Serve. Every backup has a checksum that is checked before it is restored.
• Several buckets, with the next one used when one is down. Backups before each deploy, users and passwords included if you want, MySQL, MariaDB and ClickHouse compressed.
• Import any dump from a file, a URL or a bucket, with the restore window showing the upload's progress. Compose stacks back up and import their databases, volumes and folders.
• Compose stacks can roll back to exactly the files and images a past deployment ran.

Status pages

• A public status page in minutes. Components follow your uptime checks, incidents and maintenance with updates, postmortems, and outages that show up on their own.
• Your design and your domain: four looks, logos, colors, fonts, any language, a response time chart, password or draft visibility, and your own domain through the server's IP or a Cloudflare Tunnel. Serve creates the DNS record when Cloudflare manages it.
• Subscribers follow by email, Slack, Discord, webhook or RSS, and pick the components they care about. A badge, a website widget and JSON come with every page, and CI can post incidents through the API.

A login wall for any app

• Only my team puts a sign-in in front of any app: admin panels, internal tools, staging sites. Members with access to the project get in.
• Guest logins let people without a Serve account in, with an email and password set per app. Works with nginx, Caddy and Traefik.

See every request

• Request log: each request through the proxy, with which server and replica answered, live in Metrics and Logs, with status and path filters.

Domains, previews and sign-in

• Edit a domain like you add one: its name, route or redirect, port, tunnel or IP, HTTPS and certificate, and its Cloudflare record and proxy.
• Pull request previews comment on GitHub, GitLab, Gitea/Forgejo and Bitbucket.
• Sign in with Microsoft, GitLab and Bitbucket, or your company's login with presets for Keycloak, Authentik, Okta, Auth0, Zitadel, Pocket ID and more.
• Deleting servers, services and projects asks for your password.

API and CLI for everything

• 305 API operations cover what the dashboard does, from status pages and database add-ons to deploy rules, Cloudflare and Git credentials. The CLI gained replicas, database settings, tokens, the request log, compose backups, proxy actions and status page incidents.

Fixed in 0.5.0

• A status page served with a Cloudflare Origin certificate got a DNS only record, and browsers refused the certificate. Serve now makes its record with Cloudflare's proxy on.
• Check DNS says when a status page reaches the server directly with a Cloudflare Origin certificate, and Turn on Cloudflare proxy fixes the record Serve made.
• Automatic picks a certificate browsers trust before a Cloudflare Origin one, and the status page picker says when a certificate is a Cloudflare Origin one.

Every release in between, with all its fixes: changelog.

Commits

• d58b7670 Status pages served with a Cloudflare Origin certificate get a proxied record, and say so when theirs is DNS only; trusted certificates come before Cloudflare Origin ones

v0.4.19

New

• Edit a domain like you add one: its name, route or redirect, port, Cloudflare Tunnel or server IP, HTTPS and certificate, and its Cloudflare DNS record and proxy.
• Compose stacks can roll back. Each deployment records its compose file, commit and images, and a rollback runs exactly those. Deployments made before this release cannot roll back.
• Status pages: Serve creates the A record of their domain when a connected Cloudflare account manages it, and removes it with the page. A Create A record button fixes a missing one.
• Preview comments on GitLab, Gitea/Forgejo and Bitbucket, as on GitHub.
• ClickHouse has a Users tab: add logins, change passwords and access, delete them.
• The API covers what the dashboard does: status pages, database pooler and public access, main database, deploy rules and approvals, HTTP options, compose storage, request log settings, preview databases, server variables, OS updates, Cloudflare, Git credentials, repository webhooks and tailnets.
• The CLI gained database replicas, settings, public port and domain, preview and replica variables, tokens create, the request log, compose backups, proxy actions, trusted proxies, status page incidents and branch clean-up SQL.

Fixed

• Promoting a read replica could leave the old database running, so two writable copies. It now stops unless the old one is confirmed gone.
• ClickHouse in compose stacks was never offered for backups. It is now, and every one of its databases is backed up, not only default.
• A renewed certificate that a proxy could not load passed as loaded. It is now shown on the certificate and alerted.
• Removing a domain, service or project hid DNS records, replicas and certificates it could not remove. You now get a warning, and the activity log keeps it.
• Anyone who could comment on a pull request could get Serve to edit their comment instead of its own. Existing GitHub preview comments get one new comment on the next deploy.
• The primary domain could be turned into a redirect.
• Restore errors from ClickHouse and MongoDB showed a useless line instead of the reason.
• API paths were decoded more than once, so a compose backup key with / or % needed odd encoding. Encode once now.

Polished

• Every site serves the best certificate covering its name: its own before a wildcard, then the one valid longest. The status page picker says which one Automatic uses.
• A failed preview DNS record is reported instead of a link that does not work.
• Over 80 new tests for the job queue, backups, certificates, nginx sites, variables and shell quoting.

Commits

• 8ef9a890 Edit domain: the port sits beside the name
• 235a87fa Domains: the primary one cannot become a redirect; status page DNS records are changed by admins only, as for app domains
• 2f191759 Domains: edit everything as when adding: name, route or redirect, port, tunnel or IP, HTTPS and certificate, and the Cloudflare record and its proxy
• c19b84e7 Preview comments are found by a marker only this instance can make, so a copied marker never gets someone else's comment edited
• 36ec0086 Certificates: every site serves the best one covering its name (its own before a wildcard, then the longest valid); Automatic says which
• 377d4807 Status pages: Serve makes the A record of their domain when a connected Cloudflare account manages it, and removes it with them
• 2d91daec Test: the truncated-backup check gets time for its four slow key derivations
• 606f3cbb API: paths are decoded once, so a compose backup key with / or % is one segment encoded once
• 987bf31b Restore errors name ClickHouse's and mongorestore's own reason, not the line after it
• 78018e11 CLI: database replicas, settings, public port and domain; preview and replica variables; tokens create; request log; compose backups; proxy actions and trusted proxies; status page incidents; branch clean-up SQL
• 68f10e9e API: connect and disconnect Cloudflare and change zone settings, add and remove Git tokens and deploy keys, repository webhooks, and tailnets
• d9d5794c Compose stacks can roll back: each deployment records its compose file, commit and images, and a rollback runs exactly those
• 8106bdf4 API: server variables, redeploying what uses shared variables, OS updates, default server, an app's main server, and the instance's proxy configuration
• 348692ab Removals say what they could not take with them: DNS records, replicas, certificates, tunnel routes; the activity log keeps it
• 70bf1c23 API: HTTP options and custom proxy site, compose storage, request log settings, preview databases and pointing a domain at the main server
• 620a8fe4 Test custom certificates, nginx site rendering, variable resolution and shell quoting
• 819d413b Test backup encryption, import helpers, checksums and restore targets
• 2334ffe1 Test job queue claim, finish, fail and recovery statements
• d45ac9cd Preview comments on GitLab, Gitea/Forgejo and Bitbucket, edited on removal; a preview DNS record that fails is said, not linked
• 2824c389 Certificates: what could not load one is counted for everyone and named only in its log
• 9b7ab031 API: database pooler and public access, main database, certificate retry, redeploying services, deleting volumes, and deploy rules
• d1ae7d21 Certificates: a proxy or database that could not load a new or renewed one is shown on it and alerted
• a8ce77f8 Users tab for ClickHouse: list, add, change password, access and delete logins
• 854ecf27 API: create, change and delete status pages, their domain, visibility, subscriptions, components and subscribers
• 08d23b2b Promoting a replica stops unless the old database is confirmed gone; its public domains go only once promoted
• 80048b10 Compose stacks: ClickHouse is found for backups, and every one of its databases is backed up

v0.4.18

Fixed

• A backup, restore or import that ran past its time limit kept running in the background while a new restore could start on the same database. Its commands are stopped now, and the next one waits until they have.
• Choosing the main database in Settings → Credentials was only shown to admins; it needs the same permission as on the Connect card.

Commits

• ef4d2eb8 A backup, restore or import past its time limit stops its commands, and holds its lock until they have stopped
• 78c41403 Settings: choosing the main database needs services.manage, like on Overview

v0.4.17

Breaking

• A restore now leaves the database exactly as the backup is. Restoring a whole backup removes every database on the server first (not branches, not the engine's own), then brings back the backup's databases and tables under their own names. Restore only some databases by unticking the others.

New

• A backup of everything is taken before every restore, and put back at once when the restore fails, for the databases it had changed. Tick Keep a backup of the current database to keep it afterwards.
• Backups have their own pages: Backups, Import backup and Auto backup.
• Import backup brings a file in first and opens the restore window with the upload's progress. Cancel deletes the file. A dump made for another engine is refused before anything changes.
• Backups can be encrypted with your own passphrase, in a format openssl opens without Serve.
• Backups can include the server's users and passwords (PostgreSQL, MySQL, MariaDB).
• Backup tests restore a backup into a throwaway database, by hand or every day, and tell you when one fails.
• Backups can go to several buckets; when one is down the next one is used.
• Apps can back up their databases before each deploy.
• Back up now can store a backup elsewhere, with users or without encryption, for that backup only.
• MySQL, MariaDB and ClickHouse backups are compressed, and every backup has a checksum that is checked before it is restored.
• ClickHouse in compose stacks, and compose stacks can import backups into their databases, volumes and folders.
• The connection URL can name any database of the server, from the Connect card or Settings → Credentials. A restore whose backup lacks the main database makes its first database the main one.
• The Connect card shows the pooled and read replica connection URLs while they are on.
• The API and CLI cover all of it: restore choices, backup tests, downloads, uploads and backup settings.

Fixed

• MySQL row counts in the data explorer were 0 after a restore.
• A PostgreSQL dump made without --clean failed on tables that already existed.
• A dump with one database went into the main database whatever its name; it keeps its name now.
• Compose database passwords were visible on the server's process list during backups.
• Instance backup downloads failed after an S3 change.

Polished

• Auto backup is one card with its settings side by side, and only shows them while it is on.
• Imported files keep their own name, and their safety backup is listed under them.
• From bucket says where to add S3 storage when there is none.
• Restore errors show the database's own reason.

Commits

• 1e3605f0 Data explorer: MySQL row counts and sizes are always current
• c382446c Restores keep the dump's database names, empty databases too
• ceb0f7ff Restore the dump's users and passwords on request (Postgres, MySQL, MariaDB)
• 9252fc39 Backups: compose database passwords stay off the command line; instance downloads use the backup's own S3 destination
• ee2286a7 Notifications for restores and imports
• 58acff14 Restore window: choose databases, new names, single tables, or another service
• de8cd8ac MySQL, MariaDB and ClickHouse backups are compressed (.sql.gz)
• 0ed23e73 Backup checksums: SHA-256 recorded when made, verified before every restore
• d44b9fb1 Encrypted backups with a passphrase (openssl-compatible)
• bdce6b39 Backup proof: test-restore a backup into a throwaway database
• 7ce51eb1 Backup security: 600,000 PBKDF2 rounds, checksum before listing, no passphrase to the browser
• d21ae7c2 Backups to several buckets, and keeping by age, day, week, month and year
• 81a49ce2 Back up databases before each deploy
• 2bf5add2 ClickHouse in compose stacks and several ClickHouse databases; users of multi-database MongoDB and compose backups
• de79b3fd ClickHouse backups of several databases: escape backslashes in database names
• 3cac3f93 Import into compose stack backups: database containers, volumes and folders
• f4926989 Backup API: restore choices, contents, test, download, upload import, settings, compose backups, instance backup delete
• 43e08142 CLI: restore choices, backup tests, downloads, backup settings, file imports
• 13dc228b MySQL and MariaDB restores recount table rows
• 6531f2ec Backup review fixes: single-table restores, Mongo database choices, honest test results
• f2ee5044 Backups can include users and passwords; the backup settings fold away while the schedule is off
• 73a7dc9d Backup settings summary reads as a sentence
• c1eef873 Backup settings show only while automatic backups are on
• 7ee02e90 Keep longer rules: one row each, so they fit the card
• 5444beba Remove the keep longer rules from backups
• 964de211 Database backups: Backups, Import backup and Auto backup pages with a sidebar, like settings
• c9388617 Auto backup page: settings-style cards for the schedule, databases, storage, options and encryption
• 52cccbdd Auto backup: one card with labeled sections across the width; compact schedule editor
• 6799914d Import from bucket: the tab opens without S3 storage and says where to add one
• 932a7965 Back up now: choose where it is stored, whether it holds users and whether it is encrypted, for that backup only
• fe8c6b7b Back up now: only admins can ask for an unencrypted backup, whatever the passphrase is when asked
• 5990d63a Backup review fixes: Back up now choices need permission to change settings; restored MySQL proxy rights never name protected accounts
• 42373722 Format the Back up now button
• 3e5efc48 Backup fixes: dumps of another engine are refused, Serve's pooler and replica logins are never restored, environment copies skip the users form
• cc2567e6 Imports: keep their own file name, show on the backups list right away, and sit above their safety backup
• 3adee19c Imports show Restoring while their safety backup runs
• 564e8cab Choose the main database: the connection URL can name another database on the server
• 15af9699 Main database: plain names only, and connection URLs encode the database name
• 2231a5df Choose where restored data goes, and which database a connection URL names
• 656bfb68 Import in two steps for databases: the file comes in, then the restore window sets what goes where
• 02aa046d Restore: two databases of a backup never go into the same database
• 0aab7bea Restor...

v0.4.16

Fixed

• The password field in confirmation dialogs fills in from the password manager again. The type-to-confirm field above it stays empty.

Commits

• 6ca95436 Confirm dialogs: the password fills in again, paired with the account's email

Compare: v0.4.15 → v0.4.16

v0.4.15

New

• Guest logins on the login wall: people without a Serve account sign in with an email and password set per app.
• Access control is now in a service's Settings as well as in Domains.

Fixed

• Confirmation dialogs no longer get saved credentials filled in by the browser.

Polished

• Access control is split into three cards: HTTP Basic Auth, Login wall and IP rules. Basic Auth has its switch in the card header.
• Guests are added from a small form; saved guests show without a password field.
• A removed guest, or one with a new password, is signed out within 30 seconds. Sign-in attempts are limited to 10 per 15 minutes.
• The login wall page is a single card with a short note, without the sign-in side panel.
• The README overview banner is 16:9.

Commits

• 27841dc3 Guest logins for the login wall
• 63304e11 Login wall page: the form in a card, the app's address as a tag
• fb12e982 Login wall page: a short note instead of the address
• bb406fd2 Confirm dialogs: no autofill in the confirmation and password fields
• 413fd645 Access control in a service's Settings too
• f9060a80 Access control as three cards; guests added from a form, saved guests without a password field
• 795fa12e Access control: HTTP Basic Auth card first
• 4afa5784 README: 16:9 overview banner without deploy activity

Compare: v0.4.14 → v0.4.15

v0.4.14

New

• A login wall for any app: turn on "Only my team" in an app's Domains → Access control to put a sign-in in front of it, good for admin panels, internal tools and staging sites.
• Visitors sign in to Serve first. Members who can open the app's project get in; everyone else sees "No access".
• The app's domain keeps the sign-in for 7 days. Signing out of Serve, or removing a member, closes the wall within 30 seconds.
• Serve's own uptime checks still reach the app.
• Works with nginx, Caddy and Traefik, on the dashboard's server and on other servers.
• The app's Overview and Domains pages show "Team only" when it is on.
• Give the dashboard its own domain first, since visitors sign in there.

Polished

• The service Details card shows only what differs from the defaults.
• The sidebar logo is as tall as the name and version next to it.

Commits

• c34ea514 Add a login wall for apps: Only my team
• 0f1e4afa Show when an app is behind Only my team
• 0d6cdc90 Details card: show only what differs from the defaults
• 2718f89b Login wall: close on sign-out, rotate the monitor key, prefer HTTPS to the dashboard
• b481c6d1 Sidebar: logo as tall as the name and version

Compare: v0.4.13 → v0.4.14

v0.4.13

New

• Visitors can follow a status page. A page's new Subscribers tab lets you choose which ways it offers: Email (the address is confirmed with a link first, and every email has a one-click unsubscribe), Slack and Discord (visitors paste a channel webhook, and Serve sends a test message before saving it), Webhook (any https URL gets a JSON message for each post; addresses in private networks are refused), and RSS as before.
• Subscribers can pick the components they care about. They hear about new incidents, updates, planned maintenance, and when a maintenance window starts and ends. A page can also send the outages its uptime checks find.
• Notification messages carry the page's branding: Discord and Slack show the page's name and icon, with the status, impact and affected components as fields and maintenance times in each reader's own time zone; emails show the page's logo and a colored status line.
• A status page can post every incident and update to your organization's notification channels too. Each post picks who hears about it: which subscriber types and which channels, or nobody for a quiet fix.
• New API endpoints let CI and scripts post and update incidents and maintenance: /api/v1/status-pages/{pageId}/incidents and its updates, with the same choice of who is notified.

Fixed

• A status page behind a Cloudflare Tunnel now links to its https address.
• The notification channel API no longer asks for scope, quiet hours and throttle: new channels get the same defaults as in the dashboard, and a change keeps the fields it leaves out.

Polished

• Unused code and an unused package were removed from the project.

Commits

• 8a1e6896 Status page subscribers (email, Slack, Discord, webhook, RSS; the page picks which), team channel posts, maintenance start and end messages, and an incident API
• 95a74ea8 Status page posts pick who is notified: subscriber types and team channels, in the dialog and the API
• 28500169 Branded status page messages: Discord and Slack show the page as the sender with status fields and local times; emails carry the logo, a status line and a one-click unsubscribe
• e7e58124 Status page links use https through a Cloudflare Tunnel, so messages carry the page's icon
• 51b046a1 Discord status messages show the page's icon once, as the sender's picture
• 7073b50d Remove dead code and the unused motion package; one route maker for the status page email links
• c7eada2e Notification channel API: new channels take the dashboard's defaults, changes keep what is left out

Compare: v0.4.12 → v0.4.13

v0.4.12

New

• Status pages: a public page that shows visitors how your services are doing, opened from Status pages in the sidebar.
• Components follow the uptime checks of the services you pick; visitors see the names you give them, never service names or addresses. Group them under headings and set their order.
• Incidents and maintenance: report an incident and post updates as you learn more. Plan maintenance with a start and an end. Outages found by uptime checks show up on their own, unless you turn that off.
• Templates fill in a saved incident message in one click. Postmortems add a longer write-up to a resolved incident.
• Design with a live preview for desktop and phone: four ready-made looks, logos for light and dark, a favicon, accent color, theme, font, corners, spacing, daily bars for 30, 60 or 90 days, uptime percent, a response time chart, a banner, header links, footer text and custom CSS.
• Words and language: reword or translate any text on the page, and show dates in a chosen language.
• Who can see it: public, behind a password, or a draft only your team can open.
• Own domain, like status.example.com, reached through the server's public IP or a Cloudflare Tunnel, with HTTP or HTTPS and an automatic certificate or one of your own; only the status page answers on that domain.
• Use it elsewhere: an SVG badge, a website widget, JSON and RSS.
• A new Status pages permission controls who can manage them. Owners, Admins and Developers have it by default.

Polished

• The "App unavailable" and "No app here" pages show your branding icon in the browser tab.
• Unticking a server in Servers & registry saves at once, even when that server is gone; its cleanup runs in the background. Moving an app off a server that no longer answers does not wait for it either.

Commits

• c433d26e Public status pages: components from uptime checks, incidents and maintenance, a customizable look, password or draft access, an own domain, and a badge, JSON and RSS
• ffa6d4ac Status page DNS check understands domains behind Cloudflare's proxy
• 841b491e Status page domains: route through a Cloudflare Tunnel or the public IP, HTTP or HTTPS, automatic or own certificate
• 4cddbb06 Status pages get their own favicon (falling back to the logo, then the instance branding) and a full-width settings tab
• 0c697c31 Status pages: response time chart, website widget, incident templates, postmortems, and reworded or translated texts
• cbc81e98 Status page preview frame takes the phone's width; past incidents group by the visitor's own day
• a26156b6 Status page preview shows the response time chart as soon as its switch is on
• af8137bf Status page bar tooltip shows the impact each incident gave the day
• e5d06e0b Status page response time: chart after two hours of checks, the average before; lone half hours draw a dash
• 6a449ba1 Proxy error pages carry the branding icon
• 5fd99f2b Removing a server from an app or moving an app off one no longer waits for that server: its cleanup runs in the background

Compare: v0.4.11 → v0.4.12