v0.7.0 - Secure Operations & Recoverable Deployment

Release Date: 2026-08-06

What's New in Upcode Harbor v0.7.0

Upcode Harbor 0.7.0 is a major operational and security release. It introduces a
fixed privilege boundary, immutable signed updates, recoverable installation,
Linux/PAM-only login, durable background jobs, authenticated cluster transport,
validated App Store templates, and safer network and reverse-proxy management.

---

Highlights

Upcode Harbor Name

• Version 0.7.0 is the first release under the Upcode Harbor name. The new
  name is used throughout the UI, installer, API metadata, CLI output, logs,
  documentation, and release communication.
• The technical namespace is renamed completely: source directories, systemd
  units, service accounts, PAM, filesystem paths, helper binaries, the CLI,
  UPCODE_HARBOR_* variables, manifests, and artifacts all use the new name.
  No compatibility aliases are installed.

Recoverable Installation and Signed Updates

• Releases are installed as immutable, root-owned directories below
  /opt/upcode-harbor/releases and activated through the atomic
  /opt/upcode-harbor/current symlink.
• API, frontend, job worker, health monitoring, and update execution now run in
  separate systemd services with dedicated service identities.
• The update path accepts only a versioned archive with a matching SHA-256 file
  and detached signature. Configuration is backed up before activation and a
  failed readiness check switches back to the previous release.
• install.sh --resume finishes an interrupted installation without replacing
  the release, while install.sh --reinstall moves a broken installation into
  a mode-0700 recovery directory before installing cleanly.
• Fresh interactive installations provide a Space-toggle checklist for Docker,
  K3s, LXC/LXD, and ZFS. OpenSSH is always installed and enabled; automation
  profiles and individual --with-* flags remain available.
• Installation is keyless by default. Node-local TLS, encryption, session, and
  cluster key material is generated automatically. Signed updates are enabled
  only when the external release public key is supplied.

Linux Accounts, Sessions, and Permissions

• Upcode Harbor no longer creates application login accounts. Existing Linux users
  authenticate through /etc/pam.d/upcode-harbor using a root-owned, allowlisted PAM
  broker that receives the password only through standard input.
• Browser sessions are signed, expiring, and revocable through hashed
  server-side session records. Password changes and relevant 2FA operations
  revoke affected sessions.
• Named API tokens replace the legacy plaintext global key. Tokens support
  admin, operator, and read-only roles, scoped actions, expiry, one-time
  plaintext display, and immediate revocation.
• Authorization is deny-by-default: every HTTP method and route has an explicit
  action. Linux groups, API tokens, and cluster principals have separate
  permission paths, and unknown routes fail closed even for administrators.
• Configuration and secret files use owner-only atomic persistence and reject
  unsafe symlink components.

Authenticated Cluster Transport

• Node-to-node traffic uses a dedicated TLS listener on port 9501 instead of
  sharing the browser/API transport.
• Cluster requests carry HMAC-SHA256 signatures over peer identity, key ID,
  timestamp, nonce, method, target, and body digest.
• Persistent replay protection, bounded clock skew, peer identity checks, and
  pinned node CA trust protect internal routes.
• Browser sessions and API tokens, including admin tokens, cannot call internal
  cluster routes.

Durable Jobs, Backups, and Operations

• Backups, replications, exports, security scans, upgrades, and updates run
  through a durable SQLite job queue outside HTTP worker processes.
• The persistent worker provides transactional claims, progress and heartbeat
  updates, timeouts, cancellation, retry, process-group termination, and
  interrupted-job recovery.
• Backup configuration, execution, verification, restore, retention,
  scheduling, remote targets, and SSH key operations now use explicit API
  models and generated OpenAPI client contracts.
• Locked Python/npm dependencies and expanded CI gates cover backend and CLI
  tests, route permissions, generated contracts, App Store validation, shell
  syntax, frontend lint, and the production build.

Validated App Store

• All 62 bundled templates use manifest schema version 1 and intentional image
  versions instead of floating release tags.
• Template validation checks JSON Schema, rendered Docker Compose structure,
  required variables, generated secrets, unsafe credentials, image tags,
  managed paths, and port declarations.
• Mutable templates, Compose projects, and application data live below
  /var/lib/upcode-harbor rather than inside immutable releases.

Network, Reverse Proxy, and UI Improvements

• Reverse Proxy & SSL and VPN management now live in the Network module.
• Every managed proxy entry has an Advanced Settings editor for its Nginx site
  configuration. Only Linux administrators may use it; API tokens and cluster
  principals are denied.
• Advanced Nginx changes are UTF-8 and size validated, written atomically,
  checked with nginx -t, and rolled back when validation or reload fails.
• VM-network command failures now return actionable responses and use dedicated
  permission actions.
• System and container terminals support automatic fitting and live PTY resize;
  shell working-directory/environment behavior and log presentation were also
  improved.
• Proxy deletion now reports successful removal correctly instead of displaying
  Failed to delete: undefined.

---

Upgrade Notes

1. Version 0.7.0 is a clean-install boundary. Its complete technical rename
   is intentionally incompatible with the 0.6.x deployment namespace and
   updater. Back up any existing host separately, stop its services, and deploy
   0.7.0 from a clean checkout or on a clean host. No automatic in-place state
   migration is provided.

2. Signed updates start with the new deployment contract. After 0.7.0 is
   installed with its release public key, stage future root-owned update files
   under /var/lib/upcode-harbor/updates/VERSION/ using these names:

   • upcode-harbor-VERSION.tar.gz
   • upcode-harbor-VERSION.sha256
   • upcode-harbor-VERSION.sig

   Then write VERSION to /var/lib/upcode-harbor/updates/latest and start the
   update through Settings or sudo ./update.sh VERSION.

3. Recover a broken 0.7.0 installation with --reinstall. Run
   sudo ./install.sh --reinstall from a separate 0.7.0 source checkout. The
   current Upcode Harbor release, configuration, state, logs, and system files
   are moved below /var/backups/upcode-harbor/ before a clean installation.

4. Login uses Linux accounts only. Ensure the intended Linux administrator
   belongs to sudo or wheel and has an unlocked PAM password. An account
   configured exclusively for SSH-key login needs a Linux password before it
   can use the web login.

5. Use the printed HTTPS URL. Ports 9200 and 9500 are loopback-only
   upstreams. Remote browser access terminates at nginx on port 443. The
   automatically generated certificate may require initial browser approval.

6. Legacy API keys migrate automatically to a hashed, revocable admin token
   and are removed from settings.json. Create narrower scoped tokens for new
   automation.

7. Upgrade cluster nodes as one maintenance operation. Verify peer
   certificates and connectivity on port 9501 after the update. The custom HA
   implementation does not provide quorum fencing/STONITH and should not be
   treated as a complete split-brain guarantee.

8. No manual database migration is required. Persistent job and backup
   schemas are initialized or upgraded automatically. The updater creates a
   configuration backup before switching releases.

9. Optional host components are installation choices. A signed application
   update does not install Docker, K3s, LXC/LXD, libvirt, or ZFS packages that
   were not selected during host installation.

10. Update webhook receivers for the new brand header. Configured webhook
    secrets are sent as X-Upcode-Harbor-Secret, and the user agent is
    Upcode Harbor/1.0.

Release Artifact

The signed release bundle must be created outside the repository with the
offline private key:

deploy/build-release-artifact 0.7.0 /secure/release-private.pem /tmp/upcode-harbor-0.7.0

The private key is intentionally not part of the source tree. The resulting
archive contains .upcode-harbor-release.json with format 1 and version 0.7.0;
the updater rejects artifacts whose manifest, checksum, or signature does not
match.