ReactorcoremeltdownandClaude Opus 5.5
ef6598fa15
The image passes neither -config nor -url, so a deployment had no way to set external_url and the server built invite links, device-approval pages and the OIDC redirect URI on http://localhost:8765. The variable overrides the configuration file and -url overrides it. The deployment values set it to https://keeporg.tiredsysadmin.cc. Also document every environment variable the server reads, and the standard proxy and CA variables it honours for OIDC. Server version 0.8.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
89 lines
4.0 KiB
Plaintext
89 lines
4.0 KiB
Plaintext
keeporgd (0.8.0) unstable; urgency=medium
|
|
|
|
* The public base URL can be set with the KEEPORG_EXTERNAL_URL
|
|
environment variable. It overrides external_url in the configuration
|
|
file; -url overrides it.
|
|
|
|
-- Azer Abdullaev <github@reactorcoremeltdown.anonaddy.com> Mon, 02 Nov 2026 12:37:29 +0100
|
|
|
|
keeporgd (0.7.0) unstable; urgency=medium
|
|
|
|
* Deleting a database now requires the caller's own account password
|
|
|
|
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 12:54:05 +0100
|
|
|
|
keeporgd (0.6.0) unstable; urgency=medium
|
|
|
|
* Add the administration pages: groups and their members, accounts,
|
|
invites and vault grants from a browser
|
|
|
|
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 12:28:50 +0100
|
|
|
|
keeporgd (0.5.0) unstable; urgency=medium
|
|
|
|
* Single sign-on now works from the web interface. The link on the
|
|
sign-in page started a flow that only a waiting client could finish, so
|
|
it always failed; a browser sign-in now ends in a session cookie.
|
|
* New endpoint for changing an account password. It requires the current
|
|
password, and the one-time code when a second factor is enrolled, and
|
|
revokes that account's other sessions.
|
|
* New keeporgd -reset-admin, for when the password printed at first start
|
|
was not kept. It prints a new one, clears any second factor on that
|
|
account and revokes its sessions. The server must be stopped first.
|
|
|
|
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 10:45:31 +0100
|
|
|
|
keeporgd (0.4.0) unstable; urgency=medium
|
|
|
|
* Read the master key from the file named by KEEPORG_MASTER_KEY_FILE, the
|
|
convention compose, swarm and Kubernetes use for a provisioned secret.
|
|
The file may hold base64 or exactly 32 raw bytes.
|
|
* Neither master-key environment variable is ever created by the server:
|
|
a secret that failed to mount is reported at startup and vault creation
|
|
is refused, rather than replaced with a new key that would open none of
|
|
the existing vaults. Only the configured master_key_file is created on
|
|
first run.
|
|
|
|
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 09:42:50 +0100
|
|
|
|
keeporgd (0.3.0) unstable; urgency=medium
|
|
|
|
* Container image: a scratch-based image of about 9 MB holding the static
|
|
binary and a CA bundle, running as an unprivileged user. It has no
|
|
shell, so HEALTHCHECK runs the binary's own -healthcheck probe.
|
|
* New -master-key-file flag, so a mounted secret can be used without a
|
|
configuration file.
|
|
* At startup the server now reports whether the master key still opens the
|
|
stored vault keys. A container restarted without its key would otherwise
|
|
discover this one failed merge at a time.
|
|
|
|
-- tiredsysadmin <rcmd@garage.rcmd.space> Fri, 30 Oct 2026 09:15:50 +0100
|
|
|
|
keeporgd (0.2.0) unstable; urgency=medium
|
|
|
|
* Server-side merging. A vault the server can open has its two concurrent
|
|
saves folded together in memory, by KeePass's own synchronization rules,
|
|
instead of one being refused. The losing version of an edited entry is
|
|
kept in that entry's history.
|
|
* New vault creation: a web interface at /web, and `keeporg vault -create`,
|
|
both of which build the KDBX file and set its password.
|
|
* Vault keys are stored encrypted under a master key in
|
|
/etc/keeporg/master.key, created on first start. Back it up separately
|
|
from /var/lib/keeporg.
|
|
* The KDBX 4 codec, its merge engine, and the ChaCha20, BLAKE2b and Argon2
|
|
it needs are part of the package; they carry no new dependencies.
|
|
|
|
-- tiredsysadmin <rcmd@garage.rcmd.space> Thu, 29 Oct 2026 17:28:45 +0100
|
|
|
|
keeporgd (0.1.0) unstable; urgency=medium
|
|
|
|
* First release.
|
|
* keeporgd: synchronization server with nested group access control,
|
|
invite-link and OIDC registration, built-in TOTP second factor,
|
|
versioned KDBX blobs and server-sent update notifications.
|
|
* keeporg: desktop client that mirrors assigned databases as ordinary
|
|
.kdbx files, pushes every save and applies remote changes, with
|
|
server-wins, client-wins and manual merge strategies.
|
|
|
|
-- tiredsysadmin <rcmd@garage.rcmd.space> Thu, 29 Oct 2026 12:00:00 +0000
|