v0.1.25

Changelog

• bc6efef Merge fix/rollback-host-ingress-port: keep the fixed host port on rollback
• e7b61d5 chore: changelog for 0.1.25
• 93d78e8 fix(rollback): keep the fixed host port, and clear a stopped name collision

v0.1.24

Changelog

• 452ac4d Merge feat/webhook-signing: sign webhook deliveries
• d01ef14 chore: changelog for 0.1.24
• b489794 feat(notify): sign webhook deliveries, and unify the notifier paths

v0.1.23

Changelog

• 5001e31 feat(config): app-level 'publish' for a second host port
• 967694a feat(drift): detect drift from server state when there is no teploy.yml
• a042ac7 fix(env): reject multi-line env values instead of writing a broken env file

v0.1.22

Changelog

• 9f81b40 docs: changelog for v0.1.22
• 42243e2 feat(cli): machine-operation surface, canonical manifest, atomic state

v0.1.21

Changelog

• 364d2b5 docs: changelog for v0.1.21
• 30e04eb feat(cli): release pinning + monorepo path filters for auto-deploy
• a1c2b83 feat(cli): teploy remove — retire an app (containers, route, state)
• 3d60444 feat(deploy): rule-based failure diagnosis — 'Likely cause' + 'Try' on failed deploys
• d5fc593 feat(deploy): zero-config first run — deploy with no teploy.yml offers inline init

v0.1.20

Changelog

• 7965d00 Merge branch 'feat/plan-drift-heal'
• dca3418 access: self-hostable inbound gate (basic auth / forward auth)
• 79d6ec2 audit: emit deploy/rollback events to observe
• a8815ca backup retention + secrets-scanning recipe
• 9ffe889 backup: alert on scheduled (cron) backup failure via webhook
• 0793cef docs(firewall): note remote_ip is the direct peer (Cloudflare caveat)
• db51b1a docs: CI/CD deploy recipe (Forgejo + GitHub Actions + webhook)
• e8b4961 docs: OpenBao secrets integration (teploy vault)
• 2b64716 docs: README — new secret features (HA, seals, static-role, audit timer)
• a475bc2 docs: changelog for v0.1.20
• c2f0097 docs: resilience guide — N+1 topology, durable state, recovery runbook
• 78c3e00 feat(accessories): command: override — enables MinIO/ntfy accessories
• d99cb95 feat(accessories): resolve secret:KEY env references from the encrypted store
• 24a9740 feat(accessory): verify-backup — restore into a scratch container and prove it's usable
• 1241244 feat(backup): S3-compatible endpoints (MinIO/B2/R2) + accessory publish:
• 00a91da feat(backup): self-contained scheduled accessory backups (--local --app)
• 002d651 feat(cli): add plan, drift, and self-heal commands
• f7936df feat(env): env_files — SOPS+age encrypted env files (GitOps secrets)
• a514d13 feat(harden): host-side session/command audit (auditd + sudoreplay)
• 2dfdf7c feat(kv): teploy kv — shared Nucleus KV store for config/flags
• a8d82d1 feat(network): JIT mesh access — grant / grants / revoke
• cec490d feat(notify): ntfy channel type — push notifications for deploy events
• 3aace1a feat(rollout): staged multi-server deploys — canary wave + failure budget
• a268519 feat(scan): Trivy vulnerability gate — scan: true blocks on fixable CRITICALs
• 217ae16 firewall: per-app edge hardening via teploy.yml
• 5ebd564 fix(backup): crash-consistent volume dumps + rewire verify's s3 ls through S3Config.AWS
• 3260e94 fix(backup): never leave partial/verify archives in /tmp
• 9e971a3 fix(cli): fleet deploy safety — best-effort rollback, multi-server volume check, role/tag targeting
• 8719124 fix(deploy): skip the pull for an image already present on the server
• 014d7f2 fix(harden): never fail2ban the operator's own SSH source
• 823259f fix(static): mirror the control channel's host-key policy on the rsync upload
• f4f32a1 secret: KMS + Transit auto-unseal seal options
• ed1ef7d secret: audit streaming timer (secret audit enable/disable)
• de49809 secret: multi-node Raft HA for OpenBao (secret setup --replicas)
• 02ee6c2 secret: static-role rotation (managed rotation of an existing DB user)
• 08b66ff secret: unify OpenBao under provider-abstracted "teploy secret" (drop "vault" name)
• 9ea077f test(harden): cover the audit step in the Harden orchestrator tests
• 03f2954 vault: OpenBao integration Stage 1 — provision + auto-unseal (teploy vault setup)
• cf01c6b vault: Stage 2 — per-app AppRole + scoped policy + put/get/list
• e105d0f vault: Stage 3 — deploy-time env injection from OpenBao
• 29bd0dd vault: Stage 4 — dynamic DB secrets + OpenBao Agent sidecar (auto-rotation)
• a2648bd vault: Stage 5 — ship OpenBao audit into the observe tamper-evident trail

v0.1.19

Changelog

• 0f3dbab fix(validate): honor teploy.yml user: for literal-IP servers
• 9aaffb2 fix(validate): resolve dockerfile:/context:; skip DNS for ingress: external

v0.1.18

Changelog

• 8cfc05c feat(build): dockerfile: and context: for subdir/monorepo Dockerfiles
• e635309 test(cli): make single-word-arg quoting test hermetic

v0.1.17

Changelog

• 39a4389 fix: statically link release binaries (CGO_ENABLED=0)

v0.1.16

Changelog

• dc0e3d8 fix: --json output was broken for template list, registry list, and status