159 lines
6.6 KiB
Markdown
159 lines
6.6 KiB
Markdown
# Changelog
|
|
|
|
## 0.1.0.0043 — 2026-07-11
|
|
|
|
### Added
|
|
- Edit user button in Access tab — admin can change email and groups (delete + recreate approach)
|
|
- Edit user modal with email, groups fields, and new password display
|
|
|
|
## 0.1.0.0039 — 2026-07-11
|
|
|
|
### Changed
|
|
- Modernized Authelia config format (fixes all deprecation warnings):
|
|
- `server.address: tcp://0.0.0.0:9091` (replaces `host` + `port`)
|
|
- `identity_validation.reset_password.jwt_secret` (replaces `jwt_secret`)
|
|
- `notifier.smtp.address: submission://...` (replaces `host` + `port`)
|
|
- `authentication_backend.file.watch: true` (auto-reload on user changes)
|
|
- `session.remember_me` (replaces `remember_me_duration`)
|
|
|
|
## 0.1.0.0038 — 2026-07-11
|
|
|
|
### Fixed
|
|
- Authelia `authentication_backend.file.watch: true` — YAML changes now auto-reload, so new users can log in immediately after creation
|
|
|
|
### Investigation: User Onboarding Emails
|
|
- SMTP config is correct (`notifier.smtp` → `smtp.openxchange.eu:587`)
|
|
- SMTP connection test passed (TLS handshake successful)
|
|
- authelia-api does NOT send onboarding emails — returns `placeholder_password` in API response instead
|
|
- This is an API feature gap, not a configuration issue
|
|
|
|
## 0.1.0.0037 — 2026-07-11
|
|
|
|
### Changed
|
|
- Simplified groups model: per-app groups (`drive`, `office`, `chat`, etc.) replaced with `users` + `admins` only
|
|
- `config/authelia/configuration.yml` — access_control rules reduced from 12 rules to 4
|
|
- `config/authelia/users_database.yml` — master user groups simplified to `admins`, `users`
|
|
- `config/nextworkspace/apps.yaml` — all user-facing apps use `groups: ["users"]`
|
|
- Admin panel user creation form — 9 checkboxes replaced with 2 (User + Admin)
|
|
|
|
## 0.1.0.0036 — 2026-07-11
|
|
|
|
### Fixed
|
|
- Admin panel user management: `apiProxyHandler` was stripping `/api` prefix before forwarding to authelia-api, causing 404 on all `/api/users` calls. Removed the `TrimPrefix` — authelia-api expects the full `/api/...` path.
|
|
|
|
## 0.1.0.0035 — 2026-07-11
|
|
|
|
### Added
|
|
- `AUTHELIA_API_LISTEN=0.0.0.0:8080` explicitly set in compose (default already correct)
|
|
|
|
## 0.1.0.0034 — 2026-07-11
|
|
|
|
### Added
|
|
- Fixed subnet `172.18.0.0/24` for `nextwks-net`
|
|
- Static IPv4 addresses for all containers (Caddy `.10`, Authelia `.11`, Launcher `.12`)
|
|
|
|
### Changed
|
|
- `compose/stack.yaml`: network config uses `ipv4_address` instead of flat list
|
|
- `tools/nextwks.sh`: network creation now uses `--subnet 172.18.0.0/24`
|
|
|
|
## 0.1.0.0033 — 2026-07-11
|
|
|
|
### Added
|
|
- `tools/firewall-routing.sh` — iptables redirects + VM firewall
|
|
- `storage.encryption_key` to Authelia config (required by v4.38+)
|
|
- Auto-detection of existing install in `--install` mode
|
|
|
|
### Changed
|
|
- **Rootless Podman**: all container commands run without sudo
|
|
- **Ports**: Caddy binds to 8080/8443, iptables redirects 80/443
|
|
- `.gitignore`: `/nextworkspace` (root-scoped) to track `config/nextworkspace/`
|
|
- Configs regenerated on every mode (install/update/destroy)
|
|
- `.env` values single-quoted, written via `tee -a` to preserve `$` in bcrypt hashes
|
|
- Admin password: now 24 mixed-case alphanumeric chars (base64)
|
|
- Containers stopped before binary copy to avoid "Text file busy"
|
|
- Firewall rules persisted via `netfilter-persistent save`
|
|
- Docs: AGENT.md, README.md fully updated
|
|
|
|
### Fixed
|
|
- `SSL_ERROR_INTERNAL_ERROR_ALERT` — Authelia now starts with proper config
|
|
- Password hash corruption — `$2a$...` no longer mangled by `bash -c`
|
|
- "Text file busy" during `--update` — containers stopped before copy
|
|
- `--update` skipped config regeneration (now always regenerates)
|
|
|
|
## 0.1.0.0032 — 2026-07-11
|
|
|
|
### Added
|
|
- `tools/nextwks.sh` — unified install/update/destroy script
|
|
- `AGENT.md` — workflow instructions for agents
|
|
|
|
### Changed
|
|
- Replaced `deploy.sh` and `install.sh` with single `tools/nextwks.sh`
|
|
- Build moved from `/opt/NextWks` (persistent git repo) to `/tmp/nextwks-build` (ephemeral clone)
|
|
- README.md updated for unified script workflow
|
|
- `SESSION_SECRET` persisted in `/opt/backup/.env` for idempotent `--destroy`
|
|
|
|
### Removed
|
|
- `deploy.sh` (replaced by `tools/nextwks.sh --update / --destroy`)
|
|
- `install.sh` (replaced by `tools/nextwks.sh --install`)
|
|
|
|
## 0.1.0.0007 — 2026-07-08
|
|
|
|
### Added
|
|
- Caddy reverse proxy (auto LE TLS, subdomain routing, forward auth)
|
|
- Authelia OIDC provider (2FA, identity store, user management)
|
|
- `compose/caddy.yaml` and `compose/authelia.yaml`
|
|
- `config/caddy/Caddyfile` with `{DOMAIN}` template
|
|
- `config/authelia/configuration.yml` with secret injection
|
|
- `tools/hash-password/` for bcrypt password hashing
|
|
- Certificate backup to `/opt/backup/certificates/` across destroys
|
|
- README.md with architecture overview
|
|
|
|
### Changed
|
|
- Replaced Zoraxy entirely with Caddy + Authelia
|
|
- Binary trusts `Remote-User` header from Caddy forward auth
|
|
- deploy.sh rewritten for Caddy/Authelia deployment
|
|
- install.sh creates Caddy/Authelia directories
|
|
|
|
### Removed
|
|
- Zoraxy compose, configs, proxy rules
|
|
- `tools/nextwks-tool` (no longer needed)
|
|
- `tools/register-certs` (no longer needed)
|
|
- BoltDB logic, `chattr +i`, CSRF handling
|
|
- All Zoraxy-specific deployment code
|
|
|
|
## 0.1.0.0001 — 2026-07-07
|
|
|
|
### Fixed
|
|
- Deploy workflow: start Zoraxy → upload certs via API → stop → write proxy configs → restart
|
|
- Lego runs per-domain instead of SAN cert
|
|
- Removed CSRF token issues by separating config phases
|
|
- `.env` quoting for special chars, email validation in install.sh
|
|
- Configurable subdomains (hub/noc/www/auth)
|
|
|
|
### Changed
|
|
- LE certs backed up to `/opt/backup/certificates/`, persistent across `--destroy`
|
|
- Helper tool `nextwks-tool` for LE (lego) + BoltDB operations
|
|
- Binary simplified: no login form, trusts `X-Forwarded-User` from Zoraxy
|
|
|
|
## 0.1.0 — 2026-07-06
|
|
|
|
### Added
|
|
- Interactive `install.sh` with prompts for domain, TLS email, admin username
|
|
- `.env` vault at `/opt/nextworkspace/.env` for secrets management
|
|
- Zoraxy container deployment with automated admin account creation
|
|
- Let's Encrypt configuration (email, auto-renew) via Zoraxy API
|
|
- Combined binary with path-based routing, HMAC-session auth, login form, logout
|
|
- `app.{domain}` subdomain → binary on `:9000` (launcher + auth)
|
|
- `dns.{domain}` subdomain → Zoraxy admin on `:8000`
|
|
- Health endpoint at `/health`
|
|
- `deploy.sh` with `--destroy` (greenfield) and smart update modes
|
|
|
|
### Fixed
|
|
- Zoraxy config expansion — configs locked with `chattr +i` to prevent overwrite
|
|
- CSRF token handling for Zoraxy admin API calls
|
|
|
|
### Changed
|
|
- Replaced Go subdomain router + certmagic with Zoraxy reverse proxy
|
|
- Replaced Authelia OIDC with Zoraxy built-in admin interface
|
|
- Replaced subdomain-per-app with single `app.{domain}` path-based routing
|
|
- Deployment target consolidated to `/opt/workspace/`
|