v0.9.56-alpha — Portal & CloudTAK deploy reliability + Authentik database hygiene

Cloud and gateway-fronted deployments get more reliable, and Authentik stops growing its database without bound.

TAK Portal — reliable connection to a local TAK Server

On deployments where your domain resolves to a TLS-terminating front end (an App Gateway or load balancer) instead of TAK Server directly, the Portal could no longer reach TAK — the front end's certificate doesn't chain to TAK's CA, so the connection was refused. The Portal now connects to an on-box TAK Server through the Docker host, which works regardless of what the public domain points at. It also derives the TAK certificate password from the certificate itself, so a stale or mismatched password setting can't silently break Portal↔TAK sync.

CloudTAK — fresh deploys come up clean

A fresh CloudTAK deploy used to publish its video port on all interfaces, which collided with the web proxy's video listener — the proxy reload then failed and the map page came up blank. CloudTAK now hardens its container port bindings before the containers start, so the map serves correctly on the very first deploy.

Authentik — database hygiene

Authentik's event-log retention defaulted to a full year, letting the events table — and the database CPU spent sweeping it — grow without bound on long-running boxes. Retention is now capped to a sane window so the table stays small.

Hardened posture refinements

• The 30-minute idle auto-logout now truly re-prompts through single sign-on, instead of silently refreshing the session.
• New off-box audit option (syslog/CEF to your SIEM) keeps a tamper-resistant copy of the console's audit trail off the box.

Upgrade

Applied automatically on the next console restart. The CloudTAK port fix takes effect on its next deploy. Default posture is unchanged.