detached bac21c6

2026-10-22

bac21c6chore(license): relicense under AGPL-3.0-only GPG Verifiedmain 8/8brice
8345e76ci(release): publish releases on ermite and install from git.bnema.dev GPG Verifiedtag v3.5.09/9brice

2026-10-18

c9e9163Merge pull request #301 from bnema/feat/app-capabilities merge GPG Unverified4/4bnema
694968bfix(apps): refuse reuse of containers exceeding narrowed capability policy GPG Verifiedbrice
2950329feat(apps): add operator-gated Linux capabilities for app services GPG Verifiedbrice
714888adocs(apps): document app capabilities and rootless CDI device nodes GPG Verifiedbrice

2026-10-17

de8f68eMerge pull request 'feat(backup): export OTel metrics for database and volume backups' (#28) from feat/backup-metrics into main merge SSH Unverifiedtag v3.4.1bnema
7be96b1ci: rerun installer job after GitHub network outage GPG Verifiedfeat/backup-metrics brice
f8072b0fix(backup): keep backup successes recorded while seeding reconciles targets GPG Verifiedbrice
229d05edocs(telemetry): note the Collector setting behind host_name in backup alerts GPG Verifiedbrice
e8cb095fix(backup): seed backup metrics from declared targets without per-archive requests GPG Verifiedbrice
39593e0feat(backup): export OTel metrics for database and volume backups GPG Verifiedbrice
108f11bMerge pull request 'fix(install): resolve the latest stable tag without the GitHub API' (#27) from fix/install-latest-without-api into main merge SSH Unverifiedbnema
a549ea6fix(install): resolve the latest stable tag without the GitHub API GPG Verifiedfix/install-latest-without-api brice
593c1c3Merge pull request 'fix(backup): local-time schedules, parallel volume runs, and safe status routes' (#26) from fix/backup-scheduling-and-safety into main merge SSH Unverifiedtag v3.4.0bnema
484c515fix(cron): resolve DST gaps and repeated hours in backup schedules GPG Verifiedfix/backup-scheduling-and-safety brice
b1de2a8fix(backup): local-time schedules, parallel volume runs, and safe disabled routes GPG Verifiedbrice
9697f9dMerge pull request 'feat(backup): configurable S3 storage class for volume archives' (#25) from feat/volume-backup-storage-class into main merge SSH Unverifiedtag v3.3.2bnema
9d56b57docs(backup): list storage_class in the example config and link backup keys from the reference GPG Verifiedfeat/volume-backup-storage-class brice
8f20640feat(backup): configurable S3 storage class for volume archives GPG Verifiedbrice
31f1eecMerge pull request 'fix(apps): compare app env against the activated revision in diffs' (#23) from fix/app-env-diff into main merge SSH Unverifiedtag v3.3.1bnema
d53efe2fix(apps): report stale env keys from every active revision GPG Verifiedbrice
cbddb67Merge pull request 'fix(backup): stream volume archives through attach instead of logs' (#24) from fix/volume-backup-binary-stream into main merge SSH Unverifiedbnema
8155d4cfix(backup): stream volume archives through attach instead of logs GPG Verifiedbrice

2026-10-16

d0f5c6cfix(apps): compare app env against the activated revision in diffs GPG Verifiedbrice
b164fe9Merge pull request 'feat(deployment): replace stateless services without downtime' (#21) from feat/zero-downtime-stateless-deploy into main merge SSH Unverifiedtag v3.3.0bnema
ccc19f7Merge pull request 'feat(traffic): configurable HTTP timeouts with an inactivity deadline' (#20) from feat/configurable-http-timeouts into main merge SSH Unverifiedbnema
253c38ffix(deployment): record a rebuilt execution only after routing accepted it GPG Verifiedfeat/zero-downtime-stateless-deploy brice
5f093c2fix(deployment): record the execution a deploy or restart verified GPG Verifiedbrice
d014001fix(deployment): bound TCP readiness attempts by the readiness timeout GPG Verifiedbrice
a2f0e01feat(deployment): probe stateless single-port TCP services without declared readiness GPG Verifiedbrice
7a64a5afix(deployment): reject TCP readiness when the port relay closes right after accept GPG Verifiedbrice
633b9aefix(deployment): journal a failed stop when pending retirements cannot be loaded GPG Verifiedbrice
a2e0a06docs(deployment): describe per-pass verification and stop/remove of old containers GPG Verifiedbrice
99672d0fix(deployment): verify the successor per pass before retiring a predecessor GPG Verifiedbrice
7d22851docs(deployment): exclude UDP from the overlap and describe marker-based retirement GPG Verifiedbrice
733740bfix(deployment): own overlap retirement with a durable marker GPG Verifiedbrice
2565526docs(middleware): note the full-duplex body drain limit of the inactivity timeout GPG Verifiedfeat/configurable-http-timeouts brice
2a5c221fix(middleware): bound post-handler work and hijack under the inactivity timeout GPG Verifiedbrice
7ce0d9cdocs(deployment): describe the overlap replacement of stateless services GPG Verifiedbrice
7599149feat(deployment): replace stateless services without downtime GPG Verifiedbrice
98315bdfix(middleware): enforce transfer inactivity with a request-scoped timer GPG Verifiedbrice
e5ab890feat(traffic): make HTTP timeouts configurable with an inactivity deadline GPG Verifiedbrice
4fc01faMerge pull request 'fix(proxy): send a trustworthy client IP to upstream containers' (#18) from fix/edge-trusted-real-ip into main merge SSH Unverifiedtag v3.2.0bnema
6e4d05dfix(proxy): send a trustworthy client IP to upstream containers GPG Verifiedbrice

2026-10-14

db3477eMerge pull request 'fix(docker): build on the published golang:1.27-alpine3.23 image' (#15) from chore/go-tooling-maintenance into main merge SSH Unverifiedbnema
944e1c7fix(docker): build on the published golang:1.27-alpine3.23 image GPG Verifiedbrice

2026-10-10

3a9dcaeMerge pull request 'feat(security): v3 secrets hardening' (#14) from feat/v3-secrets-hardening into main merge SSH Unverifiedbnema
beaf875ci(lint): bump golangci-lint to v2.14.0 for Go 1.27.2 GPG Verifiedbrice
2423197fix(security): keep dropped log paths protected and limit log-dir exception to data_dir/logs GPG Verifiedbrice

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close