Skip to content

Commit cb026c7

Browse files
cmos486cmos486
committed
chore: bump version to 1.1.0 + CHANGELOG + release notes
1 parent 22ff297 commit cb026c7

5 files changed

Lines changed: 296 additions & 2 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,140 @@ All notable changes to argos-edge are documented here. Format
44
follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
55
versions use [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
66

7+
## [1.1.0] - 2026-04-21
8+
9+
Minor feature release. Focus on certificate lifecycle: three ACME
10+
challenge types, enriched renewal visibility, and full import
11+
support for operator-owned certificates including disaster-recovery
12+
materialisation on boot. Plus the navbar / layout refinements and
13+
the Security / Logs / Settings documentation pages that landed
14+
incrementally since v1.0.
15+
16+
### Added
17+
18+
- **ACME challenge selector** — new per-host `tls_challenge` field
19+
supporting `dns` (default, Cloudflare DNS-01 — unchanged from
20+
v1.0), `http` (HTTP-01 on :80), `tls-alpn` (TLS-ALPN-01 on
21+
:443). Host form gains a radio + amber reachability warning for
22+
the port-dependent challenges. See
23+
[Reverse proxy → TLS challenges](docs/features/reverse-proxy.md#tls-challenges).
24+
- **Auto-renewal UI** — `/certs` (now at `/certificates`) is
25+
enriched with status badges (`ok` / `warning` / `critical` /
26+
`expired` / `unknown`), days-left column, last Caddy-error event
27+
(green/red dot + deep-link to filtered logs), next renewal
28+
estimate, and a **Renew now** button that re-pushes the Caddy
29+
config so certmagic re-evaluates every cert.
30+
- **Import own certificates (Feature 5)** — new **Certificates →
31+
Imported tab** with an **Import certificate** modal. Upload
32+
cert + key + optional chain; argos validates (cert/key match,
33+
domain covered including wildcards, lifetime, chain well-formed),
34+
encrypts the key with `ARGOS_MASTER_KEY`, writes files to the
35+
new `caddy_manual_certs` volume, and flips the host to
36+
`tls_mode=manual` atomically. Host edit modal shows a read-only
37+
summary card for manual hosts plus a link to the Certificates
38+
page. Full docs at
39+
[Manual certificates](docs/features/manual-certs.md) and
40+
[Import own cert](docs/workflows/import-own-cert.md).
41+
- **Manual cert DR reconciler** — on panel boot, after migrations
42+
and before the first Caddy reconcile, every `host_manual_certs`
43+
row is checked against the shared volume. Missing `.crt` / `.key`
44+
files are decrypted from the DB and materialised on disk. Makes
45+
the argos backup tarball (DB only) a self-contained DR unit for
46+
manual certs — `caddy_manual_certs` does not need out-of-band
47+
replication as long as `ARGOS_MASTER_KEY` is kept safe.
48+
- **`manual_cert_expiring_soon` notification event** — daily cron
49+
fires at 30 / 14 / 7 / 1 days before expiry for each manual
50+
cert. Wire a notification rule to get a reminder before the
51+
cert lapses (manual certs have no auto-renewal by design).
52+
- **ACME CA toggle** (from v1.0.1, included in this release) —
53+
global `acme.ca_url` setting + per-host `tls_acme_ca_url`
54+
override + `ARGOS_ACME_CA_URL` env var. Switch the whole panel
55+
or one host to LE staging for development without burning
56+
production rate limits.
57+
- **Cert troubleshooting operations page** —
58+
[docs/operations/cert-troubleshooting.md](docs/operations/cert-troubleshooting.md)
59+
walks through the common failure modes per challenge type, rate
60+
limits, and when to use **Renew now** vs restoring from a
61+
backup.
62+
- **Security overview, Logs browser, Settings** feature docs —
63+
three new pages under docs/features/ covering `/security`,
64+
`/logs`, and `/settings`.
65+
- **GeoIP status card** in System → shows loaded DB versions, size,
66+
last refresh, next refresh, and a manual Refresh now button
67+
(from v1.0.x).
68+
69+
### Changed
70+
71+
- **Certificates page**: renamed from `/certs` to `/certificates`,
72+
split into `Active` / `Imported` tabs. `/certs` route redirects
73+
to `/certificates` for external-link compatibility.
74+
- **Host update API**: `tls_mode` validator now accepts `manual`.
75+
Round-tripping a manual-mode host no longer errors. Direct flip
76+
auto/none → manual without an upload is rejected with a clear
77+
message pointing at the import flow. Reverse flip (manual →
78+
auto/none) cascades cleanup of the manual cert row + files.
79+
- **Navbar / layout**: always-on hamburger, status pills (AppSec
80+
always visible, LAN-mode conditional), content width cap at
81+
1400 px, bigger logo, relative-timestamp component used across
82+
all list views.
83+
- **Caddy config generation**: `acmeIssuer` emits a `ca` field when
84+
resolution returns non-empty (for staging / custom CA); omitted
85+
otherwise to preserve pre-1.0.1 behaviour.
86+
87+
### Database
88+
89+
- **Migration 021**: `hosts.tls_acme_ca_url TEXT NOT NULL DEFAULT ''`.
90+
- **Migration 022**: `hosts.tls_challenge TEXT NOT NULL DEFAULT 'dns'`
91+
with CHECK constraint.
92+
- **Migration 023** (Go hook): creates `host_manual_certs` table
93+
(host_id, cert_pem, key_pem_encrypted, chain_pem, not_after,
94+
not_before, sans, fingerprint, uploaded_at, uploaded_by) and
95+
extends `hosts.tls_mode` CHECK to accept `'manual'`. Uses the
96+
SQLite `writable_schema` pattern to update the CHECK in place
97+
without a full table rebuild.
98+
99+
All migrations are additive and roll forward cleanly from v1.0.
100+
101+
### Volumes
102+
103+
- **New**: `caddy_manual_certs` (host-side name:
104+
`argos_caddy_manual_certs`) shared read-write into argos-panel
105+
and read-only into argos-caddy. Panel writes uploaded cert + key
106+
files here; Caddy reads them via `tls.certificates.load_files`.
107+
108+
Operators running a second instance via the
109+
[multi-instances override](docs/operations/running-multiple-instances.md)
110+
must rename this volume alongside the others to avoid cross-stack
111+
collision — the override template is updated accordingly.
112+
113+
### Documentation
114+
115+
- Installation Volumes table: listed 3 of the 8 volumes; rewritten
116+
to cover all 8 with backup-scope + "lose it and what happens"
117+
columns.
118+
- `ARGOS_MASTER_KEY` is-part-of-your-backup callout added to
119+
installation, upgrading, and restore workflows.
120+
- `docker compose down -v` danger callout added to upgrading +
121+
restore workflows (previously only in installation).
122+
123+
### Upgrade notes
124+
125+
Standard upgrade — schema migrations run automatically on boot,
126+
all backwards-compatible:
127+
128+
```bash
129+
cd argos-edge
130+
git fetch --tags
131+
git pull
132+
docker compose pull
133+
docker compose up -d
134+
```
135+
136+
Existing `tls_mode=auto` hosts keep DNS-01 via Cloudflare as the
137+
default challenge (migration 022 seeds every row with
138+
`tls_challenge='dns'`). No action required unless you want to
139+
switch a host to HTTP-01 / TLS-ALPN-01.
140+
7141
## [1.0.1] - 2026-04-21
8142

9143
Safety-net release before the v1.1 cert-lifecycle push. Makes the

‎backend/cmd/argos/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ import (
4343
// The source-tree default tracks the most recent released tag; CI
4444
// overrides with the exact tag on release builds and with
4545
// "<tag>-dev-<short-sha>" on main builds between tags.
46-
var argosVersion = "1.0.1"
46+
var argosVersion = "1.1.0"
4747

4848
// argosCommit is baked in at build time via -ldflags "-X main.argosCommit=...".
4949
var argosCommit = ""

‎docs/release-notes/v1.1.0.md‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
# v1.1.0 — 2026-04-21
2+
3+
Minor feature release focused on certificate lifecycle. Three ACME
4+
challenge types, enriched renewal visibility, and full import
5+
support for operator-owned certificates with disaster-recovery
6+
materialisation on boot.
7+
8+
No breaking changes. Standard upgrade path; all migrations
9+
(021 / 022 / 023) are additive.
10+
11+
## Highlights
12+
13+
### ACME challenges — all three supported
14+
15+
`tls_mode=auto` hosts now pick one of three ACME challenges:
16+
17+
- **DNS-01 (Cloudflare)** — default, unchanged from v1.0. Works
18+
behind CGNAT, supports wildcards. Requires
19+
`CLOUDFLARE_API_TOKEN` on the caddy container.
20+
- **HTTP-01** — port 80 reachable from the internet. No DNS API
21+
token needed. No wildcards.
22+
- **TLS-ALPN-01** — port 443 reachable from the internet. Useful
23+
when port 80 is blocked. No wildcards.
24+
25+
The host form surfaces a radio with inline reachability warnings.
26+
Full matrix in [Reverse proxy → TLS challenges](../features/reverse-proxy.md#tls-challenges).
27+
28+
### Cert renewal visibility
29+
30+
`/certs` is now `/certificates` with two tabs.
31+
32+
**Active tab** replaces the old flat certs list with:
33+
34+
- Status badges (`ok` / `warning` / `critical` / `expired` /
35+
`unknown`) keyed to the 30-day / 7-day thresholds.
36+
- Days-left column.
37+
- Last Caddy-error event per domain with a green/red dot and a
38+
deep-link to `/logs?source=caddy_error&q=<domain>`.
39+
- Next renewal estimate (cert.not_after minus 30d).
40+
- **Renew now** button that re-pushes the Caddy config so
41+
certmagic re-evaluates the cert. Honest: a cert comfortably
42+
outside the renewal window is still a no-op, which is the
43+
correct behaviour (LE rate limits are tight).
44+
45+
### Import your own certificates (Feature 5)
46+
47+
**Imported tab** under Certificates hosts the new **Import
48+
certificate** modal. Upload `cert.pem` + `key.pem` + optional
49+
chain; argos validates, encrypts the key, writes files to a new
50+
`caddy_manual_certs` volume, and flips the host to
51+
`tls_mode=manual` in a single SQL transaction.
52+
53+
Use cases:
54+
55+
- Private / internal CAs (Step-CA, Smallstep, Vault PKI).
56+
- Self-signed certs for LAN hosts.
57+
- Commercial certs from a non-ACME CA.
58+
- DNS-01 issued out of band via `certbot --manual` (the v1.2
59+
replacement for DNS-01 manual is tracked; until then, imported
60+
certbot certs work today via this flow).
61+
62+
Full walkthrough: [Import own cert](../workflows/import-own-cert.md).
63+
64+
### Manual cert disaster recovery
65+
66+
When you restore `argos.db` onto fresh infrastructure (wiped or
67+
never-existed `caddy_manual_certs` volume), the plaintext cert +
68+
key files do not come back automatically — Caddy's
69+
`load_files` entries would point at non-existent paths.
70+
71+
v1.1.0 ships a **boot reconciler**: after migrations, for every
72+
`host_manual_certs` row whose files are missing, the panel
73+
decrypts the key from the DB and writes both files to the shared
74+
volume. Idempotent (already-present files are skipped). The argos
75+
backup tarball plus `.env` (for `ARGOS_MASTER_KEY`) is now a
76+
self-contained DR unit — no separate out-of-band replication of
77+
`caddy_manual_certs` is required.
78+
79+
See [Manual certificates → Disaster recovery](../features/manual-certs.md#disaster-recovery).
80+
81+
### ACME CA toggle (from v1.0.1, included)
82+
83+
Global `acme.ca_url` setting + per-host `tls_acme_ca_url` override
84+
+ `ARGOS_ACME_CA_URL` env var. Switch the panel or a single host
85+
to LE staging for development without burning production rate
86+
limits.
87+
88+
### Documentation polish
89+
90+
- Installation Volumes table rewritten: all 8 volumes listed
91+
with backup-scope + "lose it and what happens" columns.
92+
- `ARGOS_MASTER_KEY` is-part-of-your-backup callout in install,
93+
upgrade, and restore docs.
94+
- `docker compose down -v` danger callout in upgrade and restore
95+
workflows.
96+
- New operations page:
97+
[Cert troubleshooting](../operations/cert-troubleshooting.md).
98+
- New feature pages: Security overview, Logs browser, Settings,
99+
Manual certificates.
100+
101+
## Upgrade
102+
103+
```bash
104+
cd argos-edge
105+
git fetch --tags
106+
git pull
107+
docker compose pull
108+
docker compose up -d
109+
```
110+
111+
Migrations 021 / 022 / 023 apply automatically. Existing
112+
`tls_mode=auto` hosts default to `tls_challenge='dns'` —
113+
no behavioural change from v1.0.
114+
115+
## New DB surface
116+
117+
- `hosts.tls_acme_ca_url TEXT NOT NULL DEFAULT ''`
118+
- `hosts.tls_challenge TEXT NOT NULL DEFAULT 'dns' CHECK (...)`
119+
- `hosts.tls_mode` CHECK extended to `('auto', 'none', 'manual')`
120+
- Table `host_manual_certs` (host_id + cert_pem +
121+
key_pem_encrypted + chain_pem + not_after + not_before +
122+
sans + fingerprint + uploaded_by + uploaded_at)
123+
124+
## New volume
125+
126+
- `caddy_manual_certs` (host-side: `argos_caddy_manual_certs`).
127+
RW in argos-panel at `/data/manual-certs`, RO in argos-caddy at
128+
`/etc/caddy/manual-certs`.
129+
130+
## Known limitations / roadmap
131+
132+
- **DNS-01 manual** (Feature 1 of the original ACME roadmap) is
133+
deferred to v1.2. Until then, use `certbot --manual` out of
134+
band plus this release's Import flow as the replacement.
135+
- **DNS providers beyond Cloudflare** are not yet wired through
136+
xcaddy — roadmap item, not targeted for v1.2.
137+
- **Renew now for comfortably-valid certs** triggers a Caddy
138+
re-check but does not force a fresh ACME order. This is
139+
intentional to avoid wasting LE quota.
140+
141+
## Acknowledgments
142+
143+
This release was driven start-to-finish by the solo maintainer
144+
running incremental audits and dogfooding on a demo deploy. Every
145+
feature landed with its own docs page + tests; every regression
146+
discovered during dogfooding resulted in a fix in the same session
147+
(notable: the nested-forms bug that blocked manual cert upload on
148+
first release — reshaped into the current Import modal UX — and
149+
the tls_mode validator that rejected `manual` on round-trip
150+
saves). Appreciation to the mkdocs-material, Caddy, certmagic,
151+
Coraza, and CrowdSec projects, all of which this panel is a thin
152+
wrapper over.
153+
154+
## Related
155+
156+
- [CHANGELOG](https://github.com/cmos486/argos-edge/blob/main/CHANGELOG.md)
157+
- [Manual certificates](../features/manual-certs.md)
158+
- [Import own cert](../workflows/import-own-cert.md)
159+
- [Cert troubleshooting](../operations/cert-troubleshooting.md)

‎frontend/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "argos-edge-frontend",
33
"private": true,
4-
"version": "1.0.1",
4+
"version": "1.1.0",
55
"type": "module",
66
"scripts": {
77
"dev": "vite",

‎mkdocs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,7 @@ nav:
147147
- reference/cli.md
148148
- reference/database-schema.md
149149
- Release notes:
150+
- v1.1.0: release-notes/v1.1.0.md
150151
- v1.0.1: release-notes/v1.0.1.md
151152
- v1.0.0: release-notes/v1.0.0.md
152153

0 commit comments

Comments
 (0)