v10.0.6-alpha — WebODM single sign-on, TURN alongside NetBird, same-domain email fixed, scheduled backups that actually run

Three user-reported issues fixed end-to-end, plus scheduled TAK Server snapshots that finally work — validated on Ubuntu 22.04, Rocky/RHEL 9, and ARM64.

WebODM: single sign-on + the TAK overlay plugin now appears (#50)

• The TAK Incident Overlay plugin actually shows up now. The upstream plugin ships a packaging defect (an empty __init__.py) that made WebODM silently skip it on every install. The deploy now patches it automatically after cloning.
• The double login is gone. WebODM behind Authentik used to ask for its own username/password after you'd already signed in. infra-TAK now provisions an OAuth2/OpenID provider in Authentik and wires WebODM's native OIDC login — the login page becomes a single "Login with Authentik" button (a "Manual login" fallback remains for local admin accounts). The reverse-proxy gate stays in front, so this is strictly additive security-wise. First OIDC login auto-creates your WebODM account from your Authentik email — SSO users need an email address set in Authentik.
• Existing installs: click "⟳ Reapply Plugin & Config" on the WebODM page after updating. It re-runs the deploy in place — your projects, accounts, and processed data are kept — and applies both fixes. (Uninstall→reinstall is no longer necessary and would have wiped the WebODM database.)

Email Relay: mail to your own domain no longer bounces (#48)

Postfix kept the server's base domain in its local-delivery list, so mail addressed to user@your-domain bounced with 550 User unknown in local recipient table instead of routing through your provider. The relay is now explicitly send-only. Existing boxes: open Email Relay → Switch Provider → reselect your provider (a redeploy) to apply.

TURN for EUD Remote Assist coexists with NetBird (#49)

CoTURN and NetBird both want UDP 3478. Now:

• On boxes running a NetBird hub, CoTURN installs cleanly on an alternate port — the installer detects the conflict and the UI pre-fills a working port (e.g. 3479).
• On legacy NetBird installs (separate coturn container), the console can instead add dedicated Remote-Assist credentials to NetBird's own TURN server — one TURN owner per box.
• Credential fields gained show/hide toggles, on-card masking, and stricter validation. The image is pinned (coturn/coturn:4.14.0).

Thanks to cfd2474 for the coexistence PR this integrates and hardens.

Scheduled TAK Server snapshots actually run now

The snapshot schedule you could configure since v0.9.3 never actually executed — and left a red takserver-snapshot.service in systemctl --failed. Scheduling now runs inside the console itself: it fires on your schedule, catches up a missed run if the server was down at the scheduled time, enforces the retention count (oldest scheduled snapshots are pruned; manual and pre-update snapshots are never touched), and the old broken timer units are removed automatically on update.

Also fixed

• Update Now lockout — after a successful update, the button refused with "already in progress" for up to 20 minutes. Fixed.
• Authentik redis on upgraded boxes — servers upgraded from older releases could have Authentik's redis cache declared but never started; it now starts during the same maintenance pass.
• Snapshots on managed databases (RDS/external DB) — snapshots can now capture a real database dump over TCP instead of skipping it (requires PostgreSQL client tools on the box; otherwise it skips with clear guidance).
• RHEL package-manager noise — a Caddy update check ran the wrong package manager on Rocky/RHEL, logging an error on every poll. Now family-aware.
• SELinux label hygiene on Rocky/RHEL boxes switched to the non-root console.

Upgrade

Applied automatically on the next console update (Update Now or git pull + restart). Post-update, two one-time actions where relevant: WebODM boxes — click Reapply Plugin & Config; Email Relay boxes — redeploy the relay via Switch Provider.