v0.1.4

Worth knowing

If you have ever rotated an encryption key, rotate again before retiring the
old one. rewrap claimed to re-encrypt every secret but covered six of
fourteen columns, and missed the SMTP password entirely — while reporting
success either way. An operator who followed the key-rotation runbook and
retired the old key would have found those secrets unreadable, with nothing to
restore them from. Both are fixed here, and a test now checks the list against
the schema so a new secret cannot be missed.

The daily cleanup was destroying things it should not. It removed every
managed database container (volumes survived, so no data was lost, but each
database needed re-provisioning), and it killed backup and restore helpers
while they were still working — a volume restore interrupted partway leaves the
volume empty or half-written. Both needed 24 hours of uninterrupted uptime to
fire, which is why restarting for releases has been hiding them.

Lost your authenticator? A recovery code signs you in and turns two-factor
off. If both are gone, another admin can reset it for you from the Team page.
On a single-admin install, losing both means losing dashboard access — worth
storing the recovery codes somewhere other than the machine Belune runs on.

What's changed

Features

• api,web: opt-in TOTP two-factor authentication
• api: add the servers table and project placement

Fixes

• api: stop the daily cleanup from killing work in progress
• api: stop the daily cleanup from removing managed databases
• web: say that deleting a project destroys database backups

Install

curl -sSL https://raw.githubusercontent.com/weiliang79/belune/v0.1.4/scripts/install.sh \
  | BELUNE_VERSION=v0.1.4 bash

Upgrading an existing install: run update.sh from your install
directory. Take a backup first — 0.x minor releases may contain
breaking changes.

Full changelog: v0.1.3...v0.1.4