v2.31.0-dev 67f96d9

2026-04-01

67f96d9Merge pull request #153 from bnema/feat/internal-ca-ondemand-tls merge GPG Unverifiedtag v2.31.0-devbnema
937d56dfix(app): handle error from srv.Shutdown in closeStarted cleanup GPG Verifiedbrice
b1d7815fix(pki): derive cache expiry from real leaf NotAfter; extract validateLoadedIntermediate GPG Verifiedbrice

2026-03-31

29dcc3bfix: address CodeRabbit review findings GPG Verifiedbrice
2604a62fix: harden PKI lifecycle, middleware coverage, and startup cleanup GPG Verifiedbrice
67e87d2fix: address all findings from deep code review GPG Verifiedbrice
a6947b2feat(server): add custom TLS certs, HTTPS redirect, and atomic intermediate store GPG Verifiedbrice

2026-03-30

5bf3a89refactor(pki): simplify after code review GPG Verifiedbrice
450331cfix(pki): add control character check to domain validation GPG Verifiedbrice
63f113efeat(server): add tls_port=0 opt-out and use unprivileged default ports GPG Verifiedbrice

2026-03-29

30b9539security(pki): harden internal CA and onboarding endpoints GPG Verifiedbnema
6cb035cfix(pki): use append in RootFingerprint to satisfy gosec G602 GPG Verifiedbrice
d623483chore: fix import ordering and add MinVersion to test TLS clients GPG Verifiedbrice
32363a8refactor(pki): simplify after code review GPG Verifiedbrice
dddcd1achore: fix lint issues in onboarding handler and ca CLI GPG Verifiedbrice
000e12atest(pki): add TLS handshake integration tests GPG Verifiedbrice
14736d4feat(pki): wire internal CA into server — dual HTTP/HTTPS handler chains, on-demand TLS GPG Verifiedbrice
1659415refactor: remove deprecated TLS config fields, forceHSTS, and self-signed cert generation GPG Verifiedbrice
848492cfeat(cli): add gordon ca export/install/info commands GPG Verifiedbrice
923d96ffeat(pki): add CA onboarding HTTP handler with cert download and landing page GPG Verifiedbrice
ad80185feat(pki): implement use case service with cert cache, allowlist, and renewal GPG Verifiedbrice
1c01096feat(pki): add trust store wrapper and iOS mobileconfig generation GPG Verifiedbrice
b939cf1feat(pki): implement CA adapter with root, intermediate, and leaf issuance GPG Verifiedbrice
2242016feat(pki): add CertificateAuthority boundary interface GPG Verifiedbrice
cce6418deps: add go.step.sm/crypto and smallstep/truststore for internal CA GPG Verifiedbrice
1983e1bfix(security): add missing FOWNER and DAC_OVERRIDE capabilities GPG Verifiedtag v2.30.1brice

2026-03-28

3ef732bdocs: remove stale password auth references GPG Verifiedbrice
06c2247docs: add missing CLI docs and fix broken wiki links GPG Verifiedbrice
83e8199docs(cli): update index for v2.30.0 GPG Verifiedbrice
3ee801cMerge pull request #151 from bnema/security/hardening-production merge GPG Unverifiedtag v2.30.0tag v2.30.0-pre7bnema
c5f57f6test: add ProxyCIDRAllowlist coverage for redirect listener bypass GPG Verifiedbrice
5a1e21dfix: address CodeRabbit review findings on security hardening GPG Verifiedbrice

2026-03-27

552aacarefactor: deduplicate CIDR allowlist code and clean up GPG Verifiedbnema
66e4d1bfix: address CodeRabbit review feedback GPG Verifiedbnema
bcbd4d9security: harden production deployment defaults GPG Verifiedbnema
851aaceMerge pull request #150 from bnema/fix/registry-prune-space-reclaimed merge GPG Unverifiedbnema
1660658test(registry): assert SpaceReclaimed in blob GC test GPG Verifiedbrice
52cf0dffix(registry): accumulate blob sizes into SpaceReclaimed during prune GPG Verifiedbrice
f5d3652chore: regenerate mockery mocks for updated DeleteBlob signature GPG Verifiedbrice
ae1a7a4fix(registry): change DeleteBlob to return size of removed blob GPG Verifiedbrice

2026-03-25

511705fMerge pull request #149 from bnema/fix/preview-orphan-gc-network merge GPG Unverifiedtag v2.30.0-pre6bnema
a7406bcdocs(app): fix stale docstring on cleanupOrphanDomainResources GPG Verifiedbrice
b035b02fix(preview): move network removal after container removal GPG Verifiedbrice
7568a1cMerge pull request #147 from bnema/feat/preview-orphan-gc merge GPG Unverifiedtag v2.30.0-pre5bnema
9209a14refactor(app): split cleanupOrphanDomainResources into focused helpers GPG Verifiedbrice
8b31c1cfix(preview): propagate cleanup errors and defer container removal GPG Verifiedbrice
b32e7e8fix(preview): address CodeRabbit review feedback GPG Verifiedbrice
470ef27refactor(app): extract preview teardown functions to reduce complexity GPG Verifiedbrice
a67455dfeat(preview): wire orphan GC into ticker, change interval to 1h GPG Verifiedbrice
fd61806feat(preview): add CollectOrphans method to service GPG Verifiedbrice

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 8

Tags 106

↑↓ moveenter openesc close