v0.1.6

What's changed

Features

• api,web: enforce token scopes and the tokens-cannot-destroy boundary (#16)
• api,web: create and revoke personal access tokens (#15)
• api: add api_tokens, audit attribution, and Bearer PAT auth (#13)
• api,web: let a project be shared with every member (#12)

Documentation

• mark the v0.1.6 changelog entry released
• v0.1.6 release notes and API access guide (#17)
• require react-form and the Label primitive in new frontend code

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.6/scripts/install.sh \
  | BELUNE_VERSION=v0.1.6 bash

Upgrading an existing install: run update.sh from your install
directory. Take a backup first — 0.x minor releases may contain
breaking changes.

Full changelog: v0.1.5...v0.1.6

v0.1.5

What's changed

Deleting a database no longer destroys its backups. They are kept by default,
listed under the project's Backups page, and you can restore a replacement
database from one — it comes back under its original name and credentials, so
applications reconnect without any configuration change. Kept backups expire 90
days after the deletion (orphaned_backup_retention_days, or 0 to keep them
indefinitely).

⚠️ One thing to check after upgrading

This release also fixes a leak in the other direction: deleting an application
used to leave its volume-backup objects behind in your backup destination, with
nothing left recording where they were. They are now erased with the application.

Objects leaked before this release are still in your destination and have to be
removed by hand — Belune no longer has a record of their keys. If you have ever
deleted an application that had volume backups, it is worth a look at your
bucket. Installs that never used volume backups are unaffected.

Upgrading

update.sh takes a backup first, as always. This release adds migration
000064; nothing existing is rewritten, and every backup you already have keeps
reading exactly as it did before. No infra restart is needed.

Features

• api,web: let backups outlive their database, and stop leaking volume backups (#10)

Fixes

• api: stop SSE streams panicking when their subscription closes (#11)

Internal

• worker: reap orphans by label and per server (#9)
• api: resolve the container runtime through a resolver (#8)

Documentation

• mark the v0.1.5 changelog entry released

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.5/scripts/install.sh \
  | BELUNE_VERSION=v0.1.5 bash

Upgrading an existing install: run update.sh from your install
directory. Take a backup first — 0.x minor releases may contain
breaking changes.

Full changelog: v0.1.4...v0.1.5

v0.1.4

Worth knowing

If you have ever rotated an encryption key, rotate again before retiring the
old one. rewrap claimed to re-encrypt every secret but covered six of
fourteen columns, and missed the SMTP password entirely — while reporting
success either way. An operator who followed the key-rotation runbook and
retired the old key would have found those secrets unreadable, with nothing to
restore them from. Both are fixed here, and a test now checks the list against
the schema so a new secret cannot be missed.

The daily cleanup was destroying things it should not. It removed every
managed database container (volumes survived, so no data was lost, but each
database needed re-provisioning), and it killed backup and restore helpers
while they were still working — a volume restore interrupted partway leaves the
volume empty or half-written. Both needed 24 hours of uninterrupted uptime to
fire, which is why restarting for releases has been hiding them.

Lost your authenticator? A recovery code signs you in and turns two-factor
off. If both are gone, another admin can reset it for you from the Team page.
On a single-admin install, losing both means losing dashboard access — worth
storing the recovery codes somewhere other than the machine Belune runs on.

What's changed

Features

• api,web: opt-in TOTP two-factor authentication
• api: add the servers table and project placement

Fixes

• api: stop the daily cleanup from killing work in progress
• api: stop the daily cleanup from removing managed databases
• web: say that deleting a project destroys database backups

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.4/scripts/install.sh \
  | BELUNE_VERSION=v0.1.4 bash

Upgrading an existing install: run update.sh from your install
directory. Take a backup first — 0.x minor releases may contain
breaking changes.

Full changelog: v0.1.3...v0.1.4

v0.1.3

This release fixes cases where Belune reported success while quietly doing
something else: backups that looked restorable but were not, a deletion that
destroyed more than it admitted, and a feature that accepted configuration it
never applied.

Backups now record where they were written

A backup stored its object key but not its destination. At restore time the
destination was resolved by following the backup's schedule to whatever that
schedule pointed at right then — and a schedule is editable. Repoint one, or
delete it, and every backup it had already produced pointed at storage its data
was never in. Nothing surfaced until a restore was attempted, which is the worst
possible moment to find out.

Backups now record the destination they were actually written to, and restores,
retention and cleanup all read that record instead of re-deriving it. Existing
backups are backfilled with their schedule's current destination — the same
answer the old code would have given, frozen so it can no longer drift.

Two new restrictions follow from this, and both are deliberate:

• A destination holding backups cannot be deleted. The error names how many.
• A destination's type, endpoint and bucket cannot be changed once it holds
  backups. On AWS S3 the region is locked too, because with no explicit endpoint
  the region is the address. Name, prefix and credentials stay editable —
  rotating an access key is expected and moves nothing.

To write to different storage, add a second destination and point your schedules
at it. The original keeps serving restores of what it already holds.

This does not recover backups already lost. If a destination was repointed
before upgrading, Belune has no record of where those objects went; they will
still fail to restore even though the backup list shows them as successful.
This stops the bleeding — it cannot undo it.

Deleting a database now says what it destroys

Deleting a database also deletes every backup ever taken of it, remote copies
included. Nothing said so. The dialog now states how many backups will go and
names the destinations holding them, requires typing the database name, and
records the count and destinations in the audit log — so "where did those
backups go" has an answer afterwards.

The count deliberately counts artifacts, not rows: a failed backup that never
wrote a file is not counted, so the dialog does not promise to destroy something
that was never there.

Known gap: deleting a project removes its databases and their backups the
same way, without itemising any of it. Delete databases individually if you want
the consequences spelled out first. Tracked in #3.

Per-domain rate limiting withdrawn

The rate_limit route feature was accepted, stored, and then emitted no proxy
configuration at all — the bundled Caddy image has no rate-limiting module, so a
domain could look rate-limited while being wide open. It is now refused with an
explanation rather than silently ignored, and returns in 0.2.0 with the custom
Caddy image.

The dashboard never offered this feature, so it could only have been set through
a direct API call. Existing rows keep serving traffic — the route still builds,
now with a warning naming the domain. This does not affect Belune's own
per-user API rate limiting, which is unchanged.

Configuration warnings

Installs created before v0.1.0 carry JWT_EXPIRY_HOURS=24 in their .env,
issuing access tokens valid 24x longer than the current default of 1 hour.
Access tokens cannot be revoked, so a stolen one stays usable for that whole
window.

Belune now warns at startup and on the Projects page when the value exceeds 12
hours. Remove the line from your .env and restart — sessions are
unaffected, since refresh tokens already cover them. update.sh deliberately
does not edit your .env for you: silently rewriting an operator's
configuration during an upgrade is a worse precedent than the setting itself.

Upgrading

Run update.sh from your install directory as usual. No host update is
required, and no infrastructure restart: this release adds one forward-only,
additive migration and touches nothing in infra/ or scripts/.

Take a backup first, as with any 0.x upgrade.

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.3/scripts/install.sh \
  | BELUNE_VERSION=v0.1.3 bash

Upgrading an existing install: run update.sh from your install directory.
Take a backup first — 0.x minor releases may contain breaking changes.

Full changelog: v0.1.2...v0.1.3

v0.1.2

Control-plane backups overhaul — worker-owned with an in-app cron sweep, dashboard-managed remote S3 storage, Local destinations, editable retention, and per-run encryption status — plus a round of docs-driven refinements and the new belune.dev docs site.

What's changed

Features

• site: add belune.dev landing + docs site
• api,web: add Root Directory build setting for monorepo support
• web: rework the env vars editor with search, sort, and reveal
• backups: include app volume backups in the project activity feed
• backups: per-run Encrypted indicator + read-only encryption status
• backups: dashboard-editable retention + Configure sheet for control-plane backups
• web: paginate the Recent Runs table on the Backups tab
• backups: add a Local destination type for DB and volume backups
• backups: dashboard-managed remote storage for control-plane backups
• backups: worker-owned control-plane backups + in-app cron sweep

Fixes

• api,web: derive MySQL default user from slug instead of root
• web: scroll overflow in create-database dialog + confirm-to-delete
• api: fix env var secret mask round-trip + add reveal-on-demand
• inherit the app's container port for a blank per-domain port
• backups: show a parsed provider name on the destination type badge
• backups: show the owning app name beside volume rows in the activity feed
• web: allow a PAT on URL-sourced app creation, not just edit
• web: probe the session in the auth-page guards so they redirect

Internal

• web: move Recent Runs' Remote key into the row detail
• web: merge Schedule and Remote Storage into one card

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.2/scripts/install.sh \
  | BELUNE_VERSION=v0.1.2 bash

Upgrading an existing install: run update.sh from your install directory. Take a backup first — 0.x minor releases may contain breaking changes.

⚠️ Brief full-stack restart: this release changes the Compose file, the belune-backup systemd units, and the helper scripts, so update.sh recreates the whole stack (not just the API) — expect a few seconds of interrupted routing. It also runs forward-only migrations (000057–000060) on boot. update.sh handles both.

Full changelog: v0.1.1...v0.1.2

v0.1.1

Belune v0.1.1

A bug-fix release. Recommended for all v0.1.0 installs.

⚠️ Updating briefly restarts the whole stack. This release changes the
Compose file (the file-mounts fix), so update.sh reconciles the infra and
recreates the containers — a few seconds of downtime for Caddy / Redis /
Postgres / BuildKit, not just the API. update.sh takes a pre-update backup
for you.

Fixed

• GitHub App creation now works on installs that don't set PUBLIC_BASE_URL.
  It falls back to your configured dashboard domain — the same way connecting a
  provider via OAuth already did — so creating a GitHub App no longer errors with
  "PUBLIC_BASE_URL must be set…".
• File & config mounts now work on the standard containerised deploy. They
  previously failed on reload with mkdir /opt/belune: permission denied, because
  the managed file directory wasn't shared into the API container. update.sh
  creates and permissions the directory as part of this update.
• Create Application dialog: removed a duplicate Branch field in
  connected-account mode (the branch is taken from the repository picker), and the
  dialog now scrolls instead of overflowing when the repository fields appear.

Upgrade

cd /opt/belune && sudo bash scripts/update.sh

Fresh installs are unaffected — the one-line installer already includes these fixes.

Full changelog: v0.1.0...v0.1.1

v0.1.0

Belune v0.1.0 — first public release

Belune is a self-hosted platform-as-a-service for a single Docker host. Deploy
apps straight from a Git push or a prebuilt image, run managed databases, and get
automatic HTTPS — all from one dashboard, on a VPS you control.

This is the first public release. It has been through an extended pre-release
hardening pass (rc1–rc11) covering fresh-install, deploy, backup/restore, TLS, and
upgrade paths on real VPS hosts.

---

Quick start

On a fresh Linux VPS (the installer installs Docker if it's missing):

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/refs/heads/main/scripts/install.sh | bash

Then open the URL the installer prints (your server's detected IP) and create the
first admin account.

Requirements: a Linux host (amd64 or arm64) with Docker + Compose v2. Runs on a
1 vCPU / 1 GB box — service CPU caps are clamped to the host's core count at install.

---

What's included

Deploys

• Git deploys with automatic builds via railpack / Cloud Native Buildpacks — no
  Dockerfile required (Dockerfile builds are supported too).
• Prebuilt-image deploys with digest pinning.
• Git provider integrations: GitHub App and OAuth (GitHub / Gitea), so you deploy
  from private repos without pasting a token.
• Auto-deploy: push webhooks for Git apps and per-app deploy hooks for CI /
  image apps.
• Rollbacks, per-deploy logs, and live build-log streaming.

Managed databases

• PostgreSQL, MySQL, MongoDB, Redis, plus a generic "other" image type.
• Backups — scheduled and on-demand — to local storage or S3-compatible
  destinations, with retention.
• Guarded major-version upgrades (dump → rebuild → restore, with a pre-upgrade
  backup and automatic rollback on failure).
• External access over an SSH tunnel (bound to loopback, never exposed publicly).
• Reload — recreate a database's container from its stored config to recover one
  that was deleted or has drifted, with the data volume preserved.

Networking & TLS

• Automatic HTTPS via Caddy (Let's Encrypt), with a per-domain HTTP→HTTPS toggle.
• Domain- and path-based routing (path prefix, strip, internal path).
• Live TLS/certificate status surfaced in the dashboard, including ACME failure
  reasons.

Templates

• One-click application templates for common services, instantiated as native
  Belune resources.

Storage

• Volume mounts and file / config mounts (managed host files bind-mounted
  read-only, with reveal-on-demand for secrets).

Observability

• Leveled logs (Debug/Info/Warning/Error) for the platform, applications, and
  database containers, with live streaming and history.
• Metrics (per-app and host) and a read-only Docker admin view
  (containers / images / volumes / networks).
• Open-standard exporters (Prometheus / OTLP).

Notifications

• Delivery of platform events to external channels (e.g. email, Discord).

Operations

• One-line installer that installs Docker if absent, lays out the stack, clamps
  CPU limits to the host, and auto-detects and pins the server's public IP.
• Version-pinned updater (update.sh) that takes a pre-update backup, reconciles
  the version-matched infra files, moves the image pin, and health-checks the result
  — with clear rollback instructions.
• Server maintenance: granular disk cleanup, Caddy reconcile, and stuck-job
  clearing.
• Optional systemd units for auto-start on reboot and daily backups.

Security

• Session auth with CSRF protection, encrypted-at-rest credentials and secrets,
  audit logging, and per-user rate limiting.
• The API is bound to loopback and served only through Caddy; database external
  access is loopback-only.

---

Upgrading

Belune installs are pinned to a version, never :latest, so a routine pull can't
move you across a migration boundary. To move to a new release (takes a backup first):

cd /opt/belune && sudo bash scripts/update.sh

---

Notes & known limitations

• Single host. Belune manages one Docker host; multi-server is not in this release.
• Restore is host-side by design. Database restore runs from the server via
  scripts/restore.sh (guarded), not from the dashboard.
• Preview environments are present but unfinished and intentionally hidden in this
  release.

---

Links

• Install & first-deploy runbook: docs/runbooks/install.md
• Configuration reference: docs/configuration.md
• License: Apache-2.0

Thanks for trying Belune. Issues and feedback welcome on the tracker.

v0.1.0-rc9

What's changed

Features

• web: colour the project running-count pill by ratio
• reload a database to recover a deleted or drifted container

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.0-rc9/scripts/install.sh \
  | BELUNE_VERSION=v0.1.0-rc9 bash

Upgrading an existing install: run update.sh from your install
directory. Take a backup first — 0.x minor releases may contain
breaking changes.

Full changelog: v0.1.0-rc8...v0.1.0-rc9

v0.1.0-rc8

What's changed

Fixes

• web: strip ANSI from NDJSON build logs after JSON.parse revives the escape

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.0-rc8/scripts/install.sh \
  | BELUNE_VERSION=v0.1.0-rc8 bash

Upgrading an existing install: run update.sh from your install
directory. Take a backup first — 0.x minor releases may contain
breaking changes.

Full changelog: v0.1.0-rc7...v0.1.0-rc8

v0.1.0-rc11

What's changed

Features

• install: detect and pin the server's public IP at install time

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.0-rc11/scripts/install.sh \
  | BELUNE_VERSION=v0.1.0-rc11 bash

Upgrading an existing install: run update.sh from your install
directory. Take a backup first — 0.x minor releases may contain
breaking changes.

Full changelog: v0.1.0-rc10...v0.1.0-rc11