keeporgd (0.10.0) unstable; urgency=medium * New Account page in the web interface: every signed-in browser and client with a button to sign each out, or all but the current one; two-factor setup, replacement and removal; the password form, moved from the vault page. Matching API: GET and DELETE /api/v1/auth/sessions, DELETE /api/v1/auth/totp. Replacing or removing an active second factor now needs the password and a current code. Administrators can sign a user out everywhere. -- Azer Abdullaev Mon, 02 Nov 2026 13:27:12 +0100 keeporgd (0.9.0) unstable; urgency=medium * A client starting a browser sign-in may pass return_url, a keeporg: URL, and the approval page then links back to it, after a password or single sign-on alike. The Android app uses it to come back from the browser. -- Azer Abdullaev Mon, 02 Nov 2026 13:11:01 +0100 keeporgd (0.8.0) unstable; urgency=medium * The public base URL can be set with the KEEPORG_EXTERNAL_URL environment variable. It overrides external_url in the configuration file; -url overrides it. -- Azer Abdullaev Mon, 02 Nov 2026 12:37:29 +0100 keeporgd (0.7.0) unstable; urgency=medium * Deleting a database now requires the caller's own account password -- tiredsysadmin Fri, 30 Oct 2026 12:54:05 +0100 keeporgd (0.6.0) unstable; urgency=medium * Add the administration pages: groups and their members, accounts, invites and vault grants from a browser -- tiredsysadmin Fri, 30 Oct 2026 12:28:50 +0100 keeporgd (0.5.0) unstable; urgency=medium * Single sign-on now works from the web interface. The link on the sign-in page started a flow that only a waiting client could finish, so it always failed; a browser sign-in now ends in a session cookie. * New endpoint for changing an account password. It requires the current password, and the one-time code when a second factor is enrolled, and revokes that account's other sessions. * New keeporgd -reset-admin, for when the password printed at first start was not kept. It prints a new one, clears any second factor on that account and revokes its sessions. The server must be stopped first. -- tiredsysadmin Fri, 30 Oct 2026 10:45:31 +0100 keeporgd (0.4.0) unstable; urgency=medium * Read the master key from the file named by KEEPORG_MASTER_KEY_FILE, the convention compose, swarm and Kubernetes use for a provisioned secret. The file may hold base64 or exactly 32 raw bytes. * Neither master-key environment variable is ever created by the server: a secret that failed to mount is reported at startup and vault creation is refused, rather than replaced with a new key that would open none of the existing vaults. Only the configured master_key_file is created on first run. -- tiredsysadmin Fri, 30 Oct 2026 09:42:50 +0100 keeporgd (0.3.0) unstable; urgency=medium * Container image: a scratch-based image of about 9 MB holding the static binary and a CA bundle, running as an unprivileged user. It has no shell, so HEALTHCHECK runs the binary's own -healthcheck probe. * New -master-key-file flag, so a mounted secret can be used without a configuration file. * At startup the server now reports whether the master key still opens the stored vault keys. A container restarted without its key would otherwise discover this one failed merge at a time. -- tiredsysadmin Fri, 30 Oct 2026 09:15:50 +0100 keeporgd (0.2.0) unstable; urgency=medium * Server-side merging. A vault the server can open has its two concurrent saves folded together in memory, by KeePass's own synchronization rules, instead of one being refused. The losing version of an edited entry is kept in that entry's history. * New vault creation: a web interface at /web, and `keeporg vault -create`, both of which build the KDBX file and set its password. * Vault keys are stored encrypted under a master key in /etc/keeporg/master.key, created on first start. Back it up separately from /var/lib/keeporg. * The KDBX 4 codec, its merge engine, and the ChaCha20, BLAKE2b and Argon2 it needs are part of the package; they carry no new dependencies. -- tiredsysadmin Thu, 29 Oct 2026 17:28:45 +0100 keeporgd (0.1.0) unstable; urgency=medium * First release. * keeporgd: synchronization server with nested group access control, invite-link and OIDC registration, built-in TOTP second factor, versioned KDBX blobs and server-sent update notifications. * keeporg: desktop client that mirrors assigned databases as ordinary .kdbx files, pushes every save and applies remote changes, with server-wins, client-wins and manual merge strategies. -- tiredsysadmin Thu, 29 Oct 2026 12:00:00 +0000