v0.3.1

Secrets are commits. An app's secrets live in the box's repository, one age-encrypted file per variable. They reach the box over the same signed channel as the Caddyfile, and the box decrypts them into /etc/hotserve/secrets/<app>.env. GitHub and CI only ever hold ciphertext. The reference is docs/secrets.md. This release is the commit that passed as v0.3.1-rc2, after an acceptance run of rc1 and an upgrade from rc1 to rc2 on a real box.

Upgrading:

• On the box, follow docs/upgrading.md. The upgrade no longer asks about /etc/hotserve/Caddyfile (below).
• A box repository made from v0.3.0's template copies in the new files (docs/secrets.md, "From an earlier template").
• If a box repository's HOTSERVE_VERSION variable pinned a candidate, delete it, so its checks use this release.

Behaviour changes since v0.3.0

Secrets are commits. An app's secrets can now live in the box's repository: one age-encrypted file per variable under <host>/secrets/<app>/. The box decrypts them into /etc/hotserve/secrets/<app>.env when it applies a push, and the app reads them at its next launch.

Getting it:

• Update your box repository from the template: Makefile, bin/secrets, bin/signer, bin/apply, bin/check, .gitattributes. The commented env_file line in its Caddyfile names the old path: add the line make secret prints instead (docs/secrets.md, "From an earlier template").
• On the laptop, brew install age (or apt install age).
• Read docs/secrets.md.
• The package makes the box's key when it is installed or upgraded on a running system; hotserve box key, as root, prints it.

Env files you made by hand keep working unchanged. To move one into the repository:

1. ssh root@box cat /etc/hotserve/<app>.env | make secrets-import APP=<app> BOX_KEY=$(ssh root@box hotserve box key)
2. Set env_file /etc/hotserve/secrets/<app>.env in the app's block, and push.
3. Once that run is green, remove the old file.

<host>/secrets is reserved. Beside a box's Caddyfile, secrets is now the box's own: a repository that already has its own secrets entry there is refused until it is moved.

The template's sudoers file is gone. An administrator needs only the adm group. Once your secrets are in the repository, remove the old grant as root: rm /etc/sudoers.d/hotserve-admin && groupdel hotserve-admin.

Upgrades no longer ask about /etc/hotserve/Caddyfile. The starter ships at /usr/share/hotserve/Caddyfile. The package installs it at /etc/hotserve/Caddyfile only when nothing is there, and replaces it only while that file is byte-identical to the starter the package last wrote. Any other file is never touched.

A box still on a v0.3.x starter keeps it. To bring it up to date and have later upgrades follow the starter, run cp /usr/share/hotserve/Caddyfile /etc/hotserve/ and then dpkg-reconfigure hotserve, which records it. The cp alone leaves the next upgrade with a changed starter nothing to match. (Corrected after merge: the original sentence left out dpkg-reconfigure; Copilot on #240.)

apt purge hotserve no longer removes /etc/hotserve/Caddyfile on a box installed from this release on. On a box upgraded from v0.3.x, it still does.

A refused deploy token is always answered 401. Both deploy webhooks, an app's and the box's, answer every refused token with the same flat 401, however often the address has failed. There is no 429 and no Retry-After from them any more. The per-address and process-wide budgets still bound what the journal records (ten and a hundred failures logged a minute). The box template's bin/apply reports a 429, which can now only come from something in front of the box, as red with its status and body. Anything scripted against the 429 needs changing.

The .deb now requires systemd 257 or newer. apt refuses to install it on Debian 12 and earlier or Ubuntu 24.04, naming systemd (>= 257). Those hosts could never run an app: every app's sandbox needs PrivatePIDs=, which systemd 257 added. Before this, they installed and failed only when the first config that defines an app was loaded (#225).

What's Changed

• fix(examples): a pin of just "v" is refused, and the tutorial installs the latest release by @earthlingdavey in #224
• docs(box): what the rc2 walkthrough found: the hidden .github/, GitHub's badge, the 503 quoted, hardening on its own page by @earthlingdavey in #226
• fix(packaging): the .deb needs systemd 257, and step 2 says what it checks by @earthlingdavey in #225
• docs(box): secrets as commits — the design (box PR 7a) by @earthlingdavey in #227
• feat(box): secrets' pure cores — the env-file renderer, the secrets proof, the box key (box PR 7b) by @earthlingdavey in #229
• feat(box): root installs secrets — the set, the key, recovery (box PR 7c) by @earthlingdavey in #231
• feat(examples): secrets as commits — make secret, secrets, rekey (box PR 7e1) by @earthlingdavey in #228
• feat(examples): secrets ride the workflow — bundle, recipient check, e2e; the sudoers file goes (box PR 7e2) by @earthlingdavey in #233
• docs: secrets as commits — the tutorial step and docs/secrets.md (box PR 7f) by @earthlingdavey in #230
• fix(examples): bin/apply names a symlinked box file; two comments say what is true (#223) by @earthlingdavey in #235
• feat(deploytrust): a refused token is always the flat 401; the throttle only samples the journal by @earthlingdavey in #236
• docs(readme): box joins the README — built-in table, install, security, dependencies by @earthlingdavey in #238
• fix(packaging): upgrades never ask about /etc/hotserve/Caddyfile (#237) by @earthlingdavey in #239
• docs: one triage rule for the whole repository, as a skill, scoring the fix as well by @earthlingdavey in #240
• docs(triage): score only failures; operator input is occurrence 5; score backlog items before building by @earthlingdavey in #246

Full Changelog: v0.3.0...v0.3.1