Unth Recover v0.4.0-beta

Pre-release (beta) — test it on your own servers; not yet production-certified.

Unth Recover v0.4.0-beta — Google Drive in the panel, Unth Recover Cloud agent, security fix

Everything from v0.3.0-beta (backups proven by a real isolated restore; offsite copies that are
encrypted, signed and downloaded again to prove them) plus:

Security

• Built with Go 1.26.11: fixes GO-2026-6859 (HTTP/1 server crash through a MaxBytesReader
  header race in net/http), which affected unth serve. Update if you expose the panel.

New

• Connect Google Drive in the panel (Settings → Connections): Google's own sign-in and consent
  page; each user connects their own Drive; scope drive.file (unth sees only its own files);
  OAuth with PKCE; the token stays on the server (0600) and is revoked on Disconnect. New offsite
  type gdrive with native Drive support (resumable uploads) — no rclone needed. A new machine
  reuses the existing "Unth Recover Backups" folder.
• unth agent enroll|run|status — connects a server to Unth Recover Cloud
  (app.unthrecover.com) or another control plane: outbound HTTPS only, every request signed with
  the server's own Ed25519 key, jobs managed in the cloud with secrets encrypted to the server's
  key, local schedule keeps running during outages, Run now / Verify now, summaries only (never
  backup data). unth-agent.service in the .deb and .rpm. docs/AGENT.md.

Tested

CI: PostgreSQL 12–17 integration matrix; Google Drive flow against a protocol-faithful fake of
Google OAuth + Drive (PKCE, refresh, revocation, resumable uploads) including fetch on an empty
machine + isolated restore → VERIFIED; agent protocol (signatures, replay, skew, tampering),
managed jobs end to end against a real database and the real cloud; .deb and .rpm install
tests; govulncheck, gosec, gitleaks. Details: docs/TEST_RESULTS.md.

Known limitations

• Release binaries do not yet embed a project Google OAuth client: to connect Google Drive, set
  UNTH_GOOGLE_CLIENT_ID / UNTH_GOOGLE_CLIENT_SECRET (docs/OFFSITE.md) or use rclone
• Not yet tested by the project against real Google Cloud Storage, AWS or Google Drive accounts
• Linux only; the local data directory is not encrypted (offsite copies are)
• Restoring into your production database is manual (pg_restore); roles/privileges are not verified
• Docker socket access is root-equivalent

Install

curl -fsSLO https://raw.githubusercontent.com/unmadethings/unthrecover/main/scripts/install.sh
sudo sh install.sh --version v0.4.0-beta

Or: sudo apt install ./unthrecover_0.4.0-beta_amd64.deb · sudo dnf install ./unthrecover_0.4.0-beta_amd64.rpm ·
download compose.yaml and docker compose up -d · docker pull ghcr.io/unmadethings/unthrecover:v0.4.0-beta

Unth Recover Cloud: create an account at app.unthrecover.com, click Add server and run the
one-time command. Offsite setup: docs/OFFSITE.md · Agent: docs/AGENT.md

Unth Recover v0.3.0-beta

Pre-release (beta) — test it on your own servers; not yet production-certified.

Unth Recover v0.3.0-beta — offsite copies (cloud storage + Google Drive), Coolify/Dokploy, .rpm, Compose

Everything from v0.2.0-alpha (backups proven by a real isolated restore; a backup is VERIFIED
only after every mandatory check passed) plus:

New

• Offsite copies (offsite:) — every VERIFIED backup is also copied off the server:
  • S3-compatible storage: AWS S3, Google Cloud Storage, Cloudflare R2, Backblaze B2, Wasabi, Hetzner, MinIO, …
  • cloud drives via rclone: Google Drive, OneDrive, Dropbox, SFTP, WebDAV, … (rclone is included in the container image)
  • encrypted with age while streaming (artifact and manifest), copy.json Ed25519-signed
  • every copy is downloaded again and proven (signature, hashes, decryption) before anything is pruned → REMOTE_VERIFIED; failure → exit code 5, nothing pruned
  • offsite retention, unth offsite list|check|push|prune
  • disaster recovery: unth offsite fetch on a new machine, then unth verify restores it
• unth keys generate — encryption identity + signing key (never overwritten); offline recovery recipients
• Coolify, Dokploy, Docker Compose: unth discover jobs finds their PostgreSQL databases and writes ready-to-review jobs (same image for the restore test; passwords are never read)
• Packages: .rpm (Fedora, RHEL, Rocky, AlmaLinux) and a compose.yaml (scheduler + panel) pinned to this release
• unth schedule --at 03:00 — built-in scheduler for containers
• Panel: offsite copies on the overview and per backup; --behind-proxy for Coolify/Dokploy/Traefik
• Metadata schema v2 (automatic upgrade)

Tested

CI: PostgreSQL 12–17 integration matrix; offsite end to end against an S3 server (SeaweedFS)
including fetch on an empty machine + isolated restore → VERIFIED, tampered copies and wrong
credentials rejected; rclone backend through the real binary; Compose deployment; Coolify-style
discovery → generated job VERIFIED in the container; .deb (Debian) and .rpm (Rocky 9, Fedora 41)
install tests; govulncheck, gosec, gitleaks. Clean-machine test of the published release.
Not yet tested by the project against real Google Cloud Storage, AWS or Google Drive accounts.
Details: docs/TEST_RESULTS.md.

Known limitations

• Linux only; the local data directory is not encrypted (offsite copies are)
• Single admin token for the panel (no roles yet)
• Restoring into your production database is manual (pg_restore); roles/privileges are not verified
• Docker socket access is root-equivalent

Install

curl -fsSLO https://raw.githubusercontent.com/unmadethings/unthrecover/main/scripts/install.sh
sudo sh install.sh --version v0.3.0-beta

Or: sudo apt install ./unthrecover_0.3.0-beta_amd64.deb · sudo dnf install ./unthrecover_0.3.0-beta_amd64.rpm ·
download compose.yaml and docker compose up -d · docker pull ghcr.io/unmadethings/unthrecover:v0.3.0-beta

Offsite setup (Google Cloud Storage, S3, Google Drive): docs/OFFSITE.md · Coolify/Dokploy: docs/COOLIFY_DOKPLOY.md

Unth Recover v0.2.0-alpha

Pre-release — not production-ready.

Unth Recover v0.2.0-alpha — Self-hosted Community Edition (M1) + web panel (M2 preview)

Everything from v0.1.0-alpha (backups proven by a real isolated restore; a backup is VERIFIED
only after every mandatory check passed) plus:

New

• unth run — the job to schedule: per-job lock → backup → verify → retention → notify
• Retention (unth prune): keep_last / keep_daily / keep_weekly / max_age; the newest VERIFIED backup is never expired
• Notifications: JSON webhook (HMAC-SHA256 signed) and Slack; URLs and keys only from environment variables
• Docker volume backups (unth backup volume) with consistency policies offline / stop and per-file verification in an isolated volume
• Web panel (unth serve): overview, backups with the Created → Integrity checked → Restore tested → Verified pipeline, reports with suggested fixes, Verify now, activity log; token login, TLS required off-loopback
• Packages: .deb (systemd units, unth user), container image ghcr.io/unmadethings/unthrecover:v0.2.0-alpha (PostgreSQL clients 13–17), checksum-verified install.sh
• Version-matched client tools: unth picks the pg_dump/pg_restore of each source's major version (fixes restores from client 17 into PostgreSQL ≤ 16)

Tested

CI: PostgreSQL 12–17 integration matrix, browser test of the panel, .deb install in a clean
container, the container image backing up and verifying PostgreSQL 12/16/17 and a volume, installer
tests, govulncheck, gosec, gitleaks. Details: docs/TEST_RESULTS.md.

Known limitations

• Linux only; backups are not encrypted and checksums are not signatures
• Single admin token for the panel (no roles yet); sessions are in memory
• Roles/privileges are not verified; Docker socket access is root-equivalent

Install

curl -fsSLO https://raw.githubusercontent.com/unmadethings/unthrecover/main/scripts/install.sh
sudo sh install.sh --version v0.2.0-alpha

Or: sudo apt install ./unthrecover_0.2.0.alpha_amd64.deb · docker pull ghcr.io/unmadethings/unthrecover:v0.2.0-alpha

Unth Recover v0.1.0-alpha

Pre-release — not production-ready.

Unth Recover v0.1.0-alpha — PostgreSQL recovery proof (M0)

Backs up a PostgreSQL database and proves it can be recovered: every unth verify restores
the backup into a fresh, isolated PostgreSQL container and compares row counts, table contents,
schema objects, constraints and your own assertion queries with a fingerprint taken in the same
snapshot as the dump. A backup is VERIFIED only if all ten mandatory steps pass — a checksum
alone never verifies a backup.

Included

• unth version | doctor | discover docker|postgres | backup postgres|list|show | verify | report | cleanup | audit list
• Snapshot-consistent pg_dump backups, SHA-256 + manifest, SQLite metadata, audit trail
• Hardened restore sandbox (internal network, no published ports, dropped capabilities, limits) with label-scoped cleanup
• JSON/text reports with explicit verification scope and RTO/RPO caveats

Tested

• Integration suite in CI with PostgreSQL 12, 13, 14, 15, 16 (pg_dump 16) and 17 (pg_dump 17), Docker Engine 28/29, Linux x86_64
• The product code of this build is identical to the code tested in that matrix (later commits changed tests, CI and docs only)
• Large database (local): 5M rows / 1.5 GB → backup 16 s, verification 32 s (restore 26 s)
• The release binary itself is smoke-tested on a clean runner by publish-release.yml

Known limitations

• Linux only; restore sandbox requires host access to Docker bridge networks
• Backups are not encrypted; SHA-256 checksums are not signatures
• Roles, ownership, privileges and cluster settings are not verified
• Scheduling, retention, notifications and Docker volume backups are on main (M1) and will ship in v0.2.0-alpha

Install

curl -fsSLO https://raw.githubusercontent.com/unmadethings/unthrecover/main/scripts/install.sh
sudo sh install.sh --version v0.1.0-alpha

Pre-releases are not "latest", so --version is required. Manual check: sha256sum -c SHA256SUMS --ignore-missing.

Docs: README · docs/QUICKSTART.md · docs/SECURITY_THREAT_MODEL.md · docs/TEST_RESULTS.md