keeporgd (0.3.0) unstable; urgency=medium

  * Container image: a scratch-based image of about 9 MB holding the static
    binary and a CA bundle, running as an unprivileged user. It has no
    shell, so HEALTHCHECK runs the binary's own -healthcheck probe.
  * New -master-key-file flag, so a mounted secret can be used without a
    configuration file.
  * At startup the server now reports whether the master key still opens the
    stored vault keys. A container restarted without its key would otherwise
    discover this one failed merge at a time.

 -- tiredsysadmin <rcmd@garage.rcmd.space>  Fri, 30 Oct 2026 09:15:50 +0100

keeporgd (0.2.0) unstable; urgency=medium

  * Server-side merging. A vault the server can open has its two concurrent
    saves folded together in memory, by KeePass's own synchronization rules,
    instead of one being refused. The losing version of an edited entry is
    kept in that entry's history.
  * New vault creation: a web interface at /web, and `keeporg vault -create`,
    both of which build the KDBX file and set its password.
  * Vault keys are stored encrypted under a master key in
    /etc/keeporg/master.key, created on first start. Back it up separately
    from /var/lib/keeporg.
  * The KDBX 4 codec, its merge engine, and the ChaCha20, BLAKE2b and Argon2
    it needs are part of the package; they carry no new dependencies.

 -- tiredsysadmin <rcmd@garage.rcmd.space>  Thu, 29 Oct 2026 17:28:45 +0100

keeporgd (0.1.0) unstable; urgency=medium

  * First release.
  * keeporgd: synchronization server with nested group access control,
    invite-link and OIDC registration, built-in TOTP second factor,
    versioned KDBX blobs and server-sent update notifications.
  * keeporg: desktop client that mirrors assigned databases as ordinary
    .kdbx files, pushes every save and applies remote changes, with
    server-wins, client-wins and manual merge strategies.

 -- tiredsysadmin <rcmd@garage.rcmd.space>  Thu, 29 Oct 2026 12:00:00 +0000