Skip to content

v1.30.0 — renamed to theta-suite

Choose a tag to compare

View all tags
@wmantly wmantly released this 01 Aug 22:47
v1.30.0
3287777
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[v1.30.0] - 2026-08-01

The project is renamed theta-env → theta-suite — it has grown from a
docker-compose wiring two projects into an integrated suite of four
applications around a shared OpenBao secrets store, and the name should reflect
that. The GitHub repository is renamed theta42/theta-env →
theta42/theta-suite (old URLs redirect), and the docs site moves to
https://theta42.github.io/theta-suite/.

Changed (theta-suite orchestration)

  • Renamed theta-env → theta-suite across the superproject: docs/_config.yml
    (title + baseurl: /theta-suite + repo URLs), README.md, setup.sh
    (incl. the THETA_SUITE_REEXECED self-update sentinel), docker-compose.yml,
    bootstrap/bootstrap.js, .github/workflows/lint.yml, config.example/*,
    docs/robots.txt, all docs pages, and this changelog.
  • Compose project name note: docker compose derives the project name from
    the clone directory, so named volumes follow it (<project>_openbao-data).
    A fresh git clone of theta-suite uses the theta-suite project name; an
    existing deployment that keeps its theta-env directory keeps its
    theta-env_* volumes — no data migration is required, just don't mix the two.
  • Docs site baseurl is now /theta-suite, matching the renamed repo's
    GitHub Pages URL.

Docs

  • architecture.md rewritten. Replaced the outdated "The two containers"
    / "The three repos" framing with the actual topology — four always-on
    services (openbao, sso-manager, proxy, jump-host) plus the
    ldap-client host-enrollment tool — a real diagram, a full Secrets
    (OpenBao)     section (central store, scoped per-app policies/tokens, the
    @simpleworkjs/bao-conf boot overlay, per-user KV, external-app minting),
    and an OpenBao-aware "how config reaches the apps". Removed the
    LDAP-"legacy apps" wording (direct LDAP binds are first-class: Linux hosts
    PAM/SSSD, sudo, SSH keys).
  • index.md — integrated-suite framing; added Central secrets (OpenBao)
    and ldap-client to "What you get" and "Related projects".
  • standalone.md + README.md — standalone is now framed as an advanced
    opt-in; the integrated ./setup.sh stack is the supported path.

Submodule bump

  • sso-manager-node → v1.16.1 — fixes the 401 on /conf and /vault for
    a logged-in admin. Both view routes 401'd because this app's auth-token is a
    header set by client JS (localStorage), not a cookie, so req.user is
    undefined on a browser navigation; the routes now render the shell and gate
    client-side (app.auth.forceLogin), with /api/conf + /api/vault still
    enforcing auth + OpenBao scope server-side. See the
    sso v1.16.1 release.
Assets 2
Loading