v0.1.20

Changelog

• 7965d00 Merge branch 'feat/plan-drift-heal'
• dca3418 access: self-hostable inbound gate (basic auth / forward auth)
• 79d6ec2 audit: emit deploy/rollback events to observe
• a8815ca backup retention + secrets-scanning recipe
• 9ffe889 backup: alert on scheduled (cron) backup failure via webhook
• 0793cef docs(firewall): note remote_ip is the direct peer (Cloudflare caveat)
• db51b1a docs: CI/CD deploy recipe (Forgejo + GitHub Actions + webhook)
• e8b4961 docs: OpenBao secrets integration (teploy vault)
• 2b64716 docs: README — new secret features (HA, seals, static-role, audit timer)
• a475bc2 docs: changelog for v0.1.20
• c2f0097 docs: resilience guide — N+1 topology, durable state, recovery runbook
• 78c3e00 feat(accessories): command: override — enables MinIO/ntfy accessories
• d99cb95 feat(accessories): resolve secret:KEY env references from the encrypted store
• 24a9740 feat(accessory): verify-backup — restore into a scratch container and prove it's usable
• 1241244 feat(backup): S3-compatible endpoints (MinIO/B2/R2) + accessory publish:
• 00a91da feat(backup): self-contained scheduled accessory backups (--local --app)
• 002d651 feat(cli): add plan, drift, and self-heal commands
• f7936df feat(env): env_files — SOPS+age encrypted env files (GitOps secrets)
• a514d13 feat(harden): host-side session/command audit (auditd + sudoreplay)
• 2dfdf7c feat(kv): teploy kv — shared Nucleus KV store for config/flags
• a8d82d1 feat(network): JIT mesh access — grant / grants / revoke
• cec490d feat(notify): ntfy channel type — push notifications for deploy events
• 3aace1a feat(rollout): staged multi-server deploys — canary wave + failure budget
• a268519 feat(scan): Trivy vulnerability gate — scan: true blocks on fixable CRITICALs
• 217ae16 firewall: per-app edge hardening via teploy.yml
• 5ebd564 fix(backup): crash-consistent volume dumps + rewire verify's s3 ls through S3Config.AWS
• 3260e94 fix(backup): never leave partial/verify archives in /tmp
• 9e971a3 fix(cli): fleet deploy safety — best-effort rollback, multi-server volume check, role/tag targeting
• 8719124 fix(deploy): skip the pull for an image already present on the server
• 014d7f2 fix(harden): never fail2ban the operator's own SSH source
• 823259f fix(static): mirror the control channel's host-key policy on the rsync upload
• f4f32a1 secret: KMS + Transit auto-unseal seal options
• ed1ef7d secret: audit streaming timer (secret audit enable/disable)
• de49809 secret: multi-node Raft HA for OpenBao (secret setup --replicas)
• 02ee6c2 secret: static-role rotation (managed rotation of an existing DB user)
• 08b66ff secret: unify OpenBao under provider-abstracted "teploy secret" (drop "vault" name)
• 9ea077f test(harden): cover the audit step in the Harden orchestrator tests
• 03f2954 vault: OpenBao integration Stage 1 — provision + auto-unseal (teploy vault setup)
• cf01c6b vault: Stage 2 — per-app AppRole + scoped policy + put/get/list
• e105d0f vault: Stage 3 — deploy-time env injection from OpenBao
• 29bd0dd vault: Stage 4 — dynamic DB secrets + OpenBao Agent sidecar (auto-rotation)
• a2648bd vault: Stage 5 — ship OpenBao audit into the observe tamper-evident trail