yucca/CHANGELOG.md

Changelog

0.41.0 (2026-09-14)

Features

• first batch of closed beta improvements (#657) (42a9324)
• monk: measure scrub lateness and mirror the mgr not-scrubbed check (#644) (5cafca4)

Bug Fixes

• michael: drain in-flight restic requests before closing the listener on rollout (#660) (0b15733)
• monk: shut down cleanly on SIGTERM and drop the per-PG map allocation (5626011)
• monk: stop cleanly on SIGTERM and drop a per-PG map allocation (#646) (5626011)
• o11y: keep sflow at its native 5s resolution (#659) (33d0bb9)
• o11y: key the deep scrub verdict on lateness, not interval age (#645) (85273ac)
• yucca sdk: report interrupted backup runs to the backend on restart (#651) (a744273)

0.40.2 (2026-09-11)

Bug Fixes

• michael: answer GET of a missing blob or config with 404, not 500 (#650) (dcf3065)
• o11y: show traffic rate in bits per second on all dashboards (#639) (3e213f0)

0.40.1 (2026-09-10)

Bug Fixes

• zod 4.4.3 - explicit defaults for coerce.boolean (#637) (1e4e1b0)

0.40.0 (2026-09-10)

Features

• use zod for validation (#636) (eed6684)

Bug Fixes

• more types that should be integers (#634) (87e0066)

0.39.0 (2026-09-09)

Features

• bot: add dashboard (#622) (85c936a)
• ceph: enable monk on the spice mons and restore its scrape job (#615) (c713549)
• ci: let the ceph converge target one playbook and host (#620) (f0a5c49)
• cnpg: enable quorum commit on the real database clusters (#613) (56a1b18)
• destructive actions - delete repos & disable write-only (#607) (f31f9be)
• enable mise mono repo (#612) (f8497b8)
• infra: activate the futo-backups-bot prod creds (#601) (f164032)
• monk: count scrub completions and track omap bytes (#617) (b9d60c6)
• o11y: put the scrub work-outstanding row on measured metrics (#616) (078c8f7)
• restic proxy (#611) (76d48c2)
• standalone app login & work around Zitadel race condition (#556) (312062e)
• use restic proxy in orchestrator when available (#631) (037745c)

Bug Fixes

• ceph: let recovery outrank scrubbing on spice (#630) (cadcba2)
• explicitly mark keepLast as an integer (#632) (7a04d36)
• flux: gate the database kustomization on a serving primary (#610) (2044b50)
• flux: make the database health check actually apply (#614) (ec696ed)

0.38.0 (2026-09-01)

Features

• ceph: deploy monk onto the mon hosts (#588) (be10b15)
• ceph: enable monk on sietch (#591) (b762917)
• ceph: move user creation inside terraform (#541) (8392f4f)
• ceph: pin monk on spice, gated behind a canary (#599) (55f37fe)
• columbo: add columbo (#585) (88267dc)
• columbo: give the agent fixed fleet-health probes and a bigger tool budget (#600) (bb0cd74)
• columbo: per-investigation audit log, tool-error recovery, pipe-aware log scoping (#586) (b3aa57d)
• columbo: retry model calls with per-attempt deadlines (#598) (8e9cd64)
• columbo: triage-refusal staff notes + per-user telemetry catalog (#596) (500107b)
• futo-backups-bot: /beta-invite with personal links, claim batches, and optional role mention (#571) (9abf625)
• futo-backups-bot: /claim-backups-role grants the customer role (#567) (f7e60f0)
• futo-backups-bot: /staff-notes links the paired staff thread (#566) (2172679)
• futo-backups-bot: allow up to three open tickets per user (#561) (290e3d7)
• futo-backups-bot: bidirectional freshdesk sync for support tickets (#577) (4e56080)
• futo-backups-bot: discord support bot (#544) (474879f)
• futo-backups-bot: grafana per-user link in staff notes (#560) (5eaf0f3)
• futo-backups-bot: sync the stored discord username from interactions (#563) (4442740)
• infra: activate futo-backups-bot staging creds (#549) (2883404)
• infra: activate the claim-flow ids for staging (#568) (1fbed25)
• infra: deploy futo-backups-bot (#545) (5ad08e2)
• infra: force_apply dispatch input for prod/staging (#548) (a757e14)
• infra: wire the freshdesk webhook route, network policy and secrets (#578) (64371fb)
• monk: add monk, a measured ceph scrub-backlog exporter (#587) (919398b)
• o11y: scrape monk on the spice mons and alert on its health (#595) (30c38f7)
• o11y: watch the NetBird overlay and give spice networking a dashboard (#540) (9e4387e)
• web: discord beta-invite redemption on the invite page (#570) (6a37d26)
• web: discord link confirmation page (#543) (93d90e3)
• yucca-admin-api: manage and cancel discord beta-invite drops via yuctl (#575) (b726229)
• yucca-admin-api: manage discord links via admin-api and yuctl (#562) (3167a48)
• yucca-api: discord account linking (#542) (7f61914)
• yucca-api: discord closed-beta invite claims and nonced redemption (#569) (85f3a59)
• yucca-api: discord ticket to freshdesk mapping table and internal endpoints (#576) (121987f)

Bug Fixes

• admin: wire-in the admin-api like prod (#559) (eb89c13)
• align migrations to actual schema & correct migrations task (#608) (a08e47f)
• all: various fixes (#537) (c78ddee)
• ceph: converge-safe pulls, live-ruleset gate, and container hardening for monk (#593) (6eca8f0)
• ceph: drop wt0 interface alerts before they reach alertmanager (#539) (30431b8)
• futo-backups-bot: avoid the privileged thread-member listing (#557) (e61dabe)
• futo-backups-bot: dedupe the support sticky and survive pin failures (#551) (bed87ba)
• futo-backups-bot: fall back to a generic agent name when the profile read is forbidden (#584) (7988ac3)
• futo-backups-bot: ignore interactions from other guilds (#602) (7750b71)
• futo-backups-bot: mention the everyone role as a literal @everyone (#573) (003cb71)
• futo-backups-bot: pull staff into the staff-notes thread (#558) (717ab17)
• futo-backups-bot: survive missing applications.commands scope (#550) (f1bd9cf)
• futo-backups-bot: unbreak the staff-thread spec after the suffix change (#565) (6f892c8)
• michael: log the resolved route plus op and blob_type on access lines (#597) (ce32472)
• monk: harden failure paths, exec handling, and the metric contract (#592) (16d9c70)
• netbird: grant CI tcp/443 to the cls1 networks (#547) (932860d)
• staging: fix ingress locality in staging (#564) (769572d)

0.37.1 (2026-08-24)

Bug Fixes

• migrations: re-date again (#535) (dd12594)

0.37.0 (2026-08-24)

Features

• 'standalone' connection type (#534) (8832cda)
• ceph: log firewall drops over nflog and ship them to o11y (#518) (30eb44e)
• ceph: persist the HDD write-cache disable and guard it to rotational media (#531) (1cdf388)
• common: postmark-backed email repository (#490) (2fc89b1)
• emails: mailpit + mock-postmark local dev stack (#491) (1d92b4b)
• emails: svelte invite email template rendered with the web theme (#489) (54c8802)
• infra: plumb postmark config into staging and prod (#493) (4d3990e)
• yucca sdk: warn status for backups (#520) (4ddc8e4)
• yucca sdk: improve onboarding & path selection (#521) (f91b803)
• yucca-admin-api: send invite emails from the allowlist flow (#492) (30166e0)

0.36.0 (2026-08-21)

Features

• michael: budgeted cross-backend retries in the S3 pool (#527) (bb28f01)
• michael: per-backend circuit breakers with fast-fail load shedding (#528) (6c8092a)
• o11y: michael resilience panels and alerts (#529) (03ea70e)

Bug Fixes

• michael: converge retried WORM puts when the existing blob matches (#526) (f435601)

0.35.1 (2026-08-21)

Bug Fixes

• alerts: make junos-exporter ignore one of em (#524) (359a227)
• cnpg: fix backup alerts (#522) (bbcfa7c)
• go: add golangci-lint (#525) (55488d6)

0.35.0 (2026-08-20)

Features

• o11y: staging observability to o11y staging mesh vmauth over netbird (#517) (d4554a7)

Bug Fixes

• k8s: staging gw via SNI passthrough — mergeGateways is unsupported under GatewayNamespace mode (#516) (57c790d)
• meta: log x-forwarded for IP address (#512) (a3b4294)

0.34.0 (2026-08-20)

Features

• o11y: add spice scrub progress dashboard (#506) (bff3488)

Bug Fixes

• migrations: re-date (#510) (816ce71)
• o11y: field selector on log panels, variable-safe request tracing (#509) (153bf22)

0.33.0 (2026-08-20)

Features

• o11y: per-service log dashboards (#504) (09f10fc)
• o11y: scope alerts to project=yucca, CNPG dashboard, title convention (#508) (d760fb1)

Bug Fixes

• net: bgp (#507) (4eaaaa6)

0.32.0 (2026-08-19)

Features

• cnpg: make better (#496) (045491d)

Bug Fixes

• o11y: point alert rules and imported dashboards at the fleet datasource (#502) (569c17f)

0.31.2 (2026-08-19)

Bug Fixes

• o11y: make slow-cadence alert queries staleness-proof (#501) (552735a)
• o11y: pin 5m staleness lookback on alert rule queries (#499) (0fe43da)

0.31.1 (2026-08-19)

Bug Fixes

• alerts: fix bad alerts (#497) (756e6e0)

0.31.0 (2026-08-19)

Features

• ceph: install hdparm on every ceph node (#479) (5eb353a)
• ceph: rebuild a replaced OSD onto its intended db slot (#462) (48d09d7)
• net: add colt (#488) (ee43e55)
• UI redesign (pt. 2) (#477) (2d0fb98)

Bug Fixes

• ceph: deliver recovery progress and repeat chronic alerts every 12h (#487) (d5972ef)
• ceph: group alertmanager notifications by pool (#463) (9091c1f)
• ceph: inhibit CephPGsUnclean while backfill is moving (#484) (fc0b712)
• ci: point prettierignore at the moved yuctl warp manifests (#486) (edd740e)

0.30.1 (2026-08-12)

Performance Improvements

• net: pin gw alpn to http/1.1 (#475) (a000887)

0.30.0 (2026-08-12)

Features

• new immich nav item, snippet FAQ answers, user manual (#467) (2bae945)
• o11y: add env/provider/region filters to the yucca dashboards (#466) (7b77f82)

Bug Fixes

• bump restic version in test (#473) (541e995)

Performance Improvements

• ci: stop the integration and e2e jobs waiting on rook-ceph (#435) (0e3f47a)

0.29.0 (2026-08-07)

Features

• o11y: pin dashboards to Fleet datasource and conform telemetry labels (#461) (11cda8c)

Bug Fixes

• ceph: unblock spice scrub scheduling (#448) (2f37ba8)
• deps: update aws-sdk-go-v2 monorepo (#359) (c3e5c4f)
• deps: update module github.com/go-chi/chi/v5 to v5.3.1 (#360) (2956998)
• deps: update module github.com/rs/zerolog to v1.35.1 (#361) (a624a52)
• deps: update module go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to v0.19.0 [security] (#425) (5b514fc)
• deps: update opentelemetry-go monorepo to v1.44.0 (#362) (68af7f4)

0.28.0 (2026-08-06)

Features

• infra: add spegel (#436) (75c77ec)
• standalone app (#422) (b23e7b3)
• UI redesign (part 1) (#423) (f79eeea)

Bug Fixes

• infra: monitor all the things (#445) (51472c3)
• yucca-sdk: repair the orchestration-api integration suites (#429) (bf69aee)

0.27.0 (2026-08-05)

Features

• michael: attribute traffic to the client's source asn (#428) (72b343c)
• michael: per-client parallelism and latency metrics (#427) (a4d4227)

Bug Fixes

• yucca-api: format failure (#426) (a4c4b0c)
• yuctl: pin op reads to the team-futo 1Password account (#409) (3dffd93)

0.26.0 (2026-08-03)

Features

• all: connections (#390) (55ece2f)
• ceph: move the ceph config model into terraform, deep scrub interval to global (#410) (5e047f0)
• ceph: ship spice host logs to o11y over netbird (#378) (957afec)
• o11y: add spice recovery/backfill throughput dashboard (#402) (6ef5c24)
• web: connections ui (#415) (8feda20)
• yucca: per-connection billing rollup (#391) (b427a70)
• yucca: per-user feature flags (#389) (94a5df9)

Bug Fixes

• ceph: align the spice mclock model with the live cluster (#411) (caf120d)
• ceph: deliver alertmanager alerts to the configured receiver (#404) (7cfb064)
• ceph: repair the monitoring path from spec apply to Zulip message (#408) (5d60aae)
• ceph: skip the dpkg unhold on nodes where the package is absent (#403) (cbf9114)
• ceph: widen spice deep scrub interval and unblock scrub scheduling (#387) (289a2ee)
• k8s: drop deadlocking topology readyExpr (#401) (c606637)

0.25.0 (2026-07-30)

Features

• ceph: make cluster config a layered, mask-aware model (#377) (ce575b1)
• k8s: fleet topology and meta discovery groundwork (#380) (046aacb)
• michael: storage-cluster routing (#383) (597506a)
• o11y: add spice block.db and BlueFS headroom dashboard (#376) (672cf49)
• orchestrator: meta discovery and placement (#385) (1039337)
• yucca-admin-api: scoped settings (#382) (51ea175)
• yucca: multi-site placement and public /meta (#381) (5a73550)
• yuctl: config commands (#384) (7911c3b)

Bug Fixes

• ceph: compare drift against declared config, not role defaults (#373) (ee7fd68)
• ceph: expect the declared MON quorum in drift detection (#374) (65d75e2)
• ceph: only commit the rgw period when something changed (#372) (c606d25)
• orchestrator: dev backup hook return type (#393) (7306bc4)

0.24.0 (2026-07-29)

Features

• michael: change url (#363) (a0c7054)
• yuctl: more benchmarking (#371) (6e4d6cc)

Bug Fixes

• ceph: take osd specs out of the cephadm serve loop (#364) (3104a35)
• ci: exempt the go-templated yuctl warp manifests from prettier (#370) (b5c36d3)

0.23.1 (2026-07-28)

Bug Fixes

• michael: retry loop (#367) (8d257aa)

0.23.0 (2026-07-28)

Features

• ceph: route spice alertmanager to a real receiver (#355) (4ef8a18)
• net: switch to ecmp, dsr and jumbo frames (#366) (71bce9b)
• yuctl: add tools warp (#356) (9cdeeb1)
• yuctl: digital ocean driven benchmarks (#365) (97652b9)

Bug Fixes

• ceph: pin SATA link power to max_performance on OSD nodes (#347) (866d69f)

0.22.1 (2026-07-27)

Bug Fixes

• yucca sdk: include task and logId for restore (#349) (f6a7dd9)

0.22.0 (2026-07-27)

Features

• store backup file name in tags (#348) (661cc6d)
• yucca: more per user metrics (#345) (9883dfe)

0.21.0 (2026-07-27)

Features

• infra: switch prod over to netkit (#342) (af5ab66)
• yucca: per user dashboards (#344) (7dd44c2)

0.20.0 (2026-07-27)

Features

• admin-cli: make admin-cli faster (#340) (bcc8ef7)
• all: email allowlist for invites (#341) (86a215a)
• all: post-benchmark cleanup (#336) (57a5923)

0.19.3 (2026-07-27)

Bug Fixes

• yucca sdk: export ViewLogModal (#337) (b3cafa2)

0.19.2 (2026-07-24)

Bug Fixes

• michael: dramatically improve michael latencies (#324) (6471d41)

0.19.1 (2026-07-24)

Bug Fixes

• all: adjust benchmark related configs and fix metrics (#332) (1ff83d6)

0.19.0 (2026-07-24)

Features

• admin: make the whole thing benchmarkable (#330) (ecf969b)

Bug Fixes

• admin: make secrets propagate (#329) (001207e)

0.18.0 (2026-07-24)

Features

• admin: make admin go brr (#327) (37ecd7b)

0.17.0 (2026-07-24)

Features

• ceph: enable telemetry phone-home for transparency (#316) (03d9bdd)

Bug Fixes

• admin: correct oidc issuer url (#321) (e1e5e6f)
• ci: fix ci so it works (#323) (434df44)
• ci: fix ci so it works (#325) (28d386d)
• metrics-worker: prevent infinite looping (#326) (4028905)

0.16.1 (2026-07-24)

Bug Fixes

• throw not found exception when item missing (#318) (9b565eb)

0.16.0 (2026-07-23)

Features

• admin: wire up admin (#313) (8afa305)
• o11y: ship dashboards as a signed OCI manifest bundle (#315) (37e8b2f)

0.15.1 (2026-07-23)

Bug Fixes

• ci: change bumping workflow (#311) (c938fc3)

0.15.0 (2026-07-23)

Features

• yucca sdk: hooks for creating db dump & performing rollback (#309) (4cbdde3)

0.14.1 (2026-07-22)

Bug Fixes

• mgmt: vlan interface names exceeded IFNAMSIZ (#305) (9a7b72d)

0.14.0 (2026-07-22)

Features

• ceph: passwordless ops sudo on sietch and spice (#299) (526bbfc)

Bug Fixes

• michael: paginate on more than 1000 objects (#304) (37e603c)

0.13.1 (2026-07-22)

Bug Fixes

• michael: better load balancer initialization (#297) (55ccf7d)

0.13.0 (2026-07-22)

Features

• yucca sdk: pin rest connections to 'availableParallelism' (#264) (6f88b57)

0.12.0 (2026-07-22)

Features

• ceph: netbird ssh server for spice (sso-gated human access) (#290) (b2d49cc)
• o11y: more better monitoring (#291) (cc2e1f4)
• o11y: oci dashboards (#294) (c5f827e)
• o11y: shared crossair, no fill, legend ordering (#295) (832c73e)

Bug Fixes

• o11y: wrong labels (#293) (522630f)

0.11.0 (2026-07-22)

Features

• all: introduce partition/region/ceph-cluster model across the stack (#222) (c6985d9)
• bgp: stand up bgp (#224) (aeee19e)
• ceph: netbird enrollment role for the spice nodes (#287) (2881be6)
• ceph: prod spice cluster on htz-fsn1 (#256) (0357aac)
• ceph: re-add noreen to spice (#273) (0c923c8)
• ceph: trust the netbird overlay interface in nftables (#285) (4782ef8)
• claude: first CLAUDE.md (#226) (745bf59)
• fabric: management plane on a per cluster basis (#240) (baae250)
• k8s: cluster naming (#243) (254b7a4)
• netbird-ansible: better subnet routers (#217) (e039026)
• netbird: ceph peer group, setup key, and CI ssh policy (#286) (12b46f5)
• netbird: k8s (#218) (0ec09f0)
• prod: add mgmt-1 to terraform ownership (bye tailscale) (#230) (f75cc90)
• prod: continue prod (#267) (1f9b84b)
• prod: continue prod (#288) (114904e)
• prod: deploy prod apps (#284) (bd74b16)
• prod: prod (#247) (963364a)
• yucca: add full e2e mgmt provisioning maybe (#182) (481c5e9)

Bug Fixes

• ceph: flush handlers after the sshd kex workaround (#276) (879b8d3)
• ceph: keep established flows alive through firewall activation (#275) (158ca39)
• ceph: mask periodic apt and refresh cache after repo changes (#271) (9f1bb2f)
• ceph: parenthesize the ceph-safety verdict ternary (#272) (f24f0f3)
• ceph: pin mtu-less VLAN sub-interfaces to 1500 (#274) (9f3bea6)
• ceph: render inventories with the partition's op env file (#270) (21f6cdb)
• ceph: seed the grafana admin and provision dashboards from the repo (#283) (017da30)
• ci: apply prettier formatting (#225) (4cf9ac0)
• fabric: depends_on (#246) (789e036)
• fabric: fix fabric deployment (#228) (f78ba50)
• fabric: unhinged fix to duplicate config blocks because this is entirely spaget (#229) (ceba1f0)
• flux: branch ref (#255) (3427483)
• kube: move to local volumes (#241) (e00ea72)
• netbird: add netbird network to trusted list (#219) (4033cc2)
• netbird: comment in the things (#221) (54c410f)
• netbird: comment out lines (#220) (a6235d7)
• netbird: make mutating webhook not go boom (#244) (7858d73)
• netbird: policies (#239) (012db81)
• netbird: restore the talos plan's NetBird connect (revert -refre… (#215) (8474098)
• netbird: restore the talos plan's NetBird connect (revert -refresh=false) (8474098)
• netbird: some issues (#212) (948b15c)
• netbird: take explicit group-name overrides verbatim(#216) (00421f3)
• talos: drop stale luke CP re-key migration (#257) (26b58fe)
• talos: drop stale luke CP re-key migration (state already address-keyed) (26b58fe)
• typo: fix typo (#245) (9ad33c4)
• workflow: gate ansible workflows (#227) (b723285)
• workflow: missing working directory (#223) (48c6220)

0.10.0 (2026-06-26)

Features

• netbird: wire this sweetie up (#209) (031974a)

Bug Fixes

• invert restore snapshot disabled check (#211) (a6146e9)

0.9.1 (2026-06-26)

Bug Fixes

• ceph: reload nftables only when the live ruleset differs (#206) (f0dd618)

0.9.0 (2026-06-26)

Features

• ansible: change (#202) (f49cf82)
• ansible: make it go brrr in ci (#200) (97b4514)
• ceph: add read-only metrics-worker RGW admin user + keys (#188) (983e061)
• k8s: wire in flux notifications-controller for commit statuses (#195) (82f8f44)
• staging: wire in metrics-worker (#181) (5d97a0f)

Bug Fixes

• ansible: add missing deps (#204) (05bb52e)
• device code flow maybe (#158) (ec75076)
• michael: remove duplicate s3 env vars (#194) (fa1683c)
• yucca-api: good secret name (#198) (deed0ba)
• yucca: correct vault for vmwauth (9f7b94b)

0.8.0 (2026-06-26)

Features

• 'bytes stored' metric (#45) (ce6b352)
• admin API (#106) (1f3ee2b)
• asymmetric jwt (#91) (70fd11f)
• backup retention (#89) (e703b08)
• cancel running tasks (& node:fs repository refactor) (#81) (415bb78)
• ceph: add LV-based SSD OSD tier for sietch (#184) (5af389f)
• ceph: add sietch staging ansible inventory (#166) (ecd28e4)
• ceph: add staging/ceph terraform stack (#165) (8d5bb53)
• ceph: authorize ops SSH keys from the identity registry (#174) (8618de8)
• ceph: import yucca-ceph ansible + terraform infrastructure (#86) (63087f6)
• ceph: optional OSD-disk wipe in provision (clean rebuild) (#177) (66740a7)
• ceph: per-role password length, shorter ops (#172) (9c33f90)
• ceph: support per-cluster baseline packages (#169) (86cbe06)
• ci: add kubeconfig / talosconfig to op (#145) (fad10fd)
• configure OpenTelemetry (#29) (c568a50)
• configure schedule repositories (#78) (6ef94e3)
• customer API: repository API (#31) (6dee484)
• customer portal: OIDC login (#30) (2e288c2)
• device code flow (#93) (aac9163)
• dns: add s3.staging.austin RGW records for sietch (#167) (9562a46)
• dns: Cloudflare-managed DNS for futo.cloud (#121) (b36f63f)
• Dockerfile for michael (#76) (9303cc1)
• fabric terraform (#170) (80d15f2)
• Immich integration (#65) (ccdcf37)
• immich integration (& assorted fixes) (#77) (e57db5e)
• immich integration UX (#87) (b0d8f2c)
• import repositories (#59) (b9aafef)
• initial commit (#27) (0b99068)
• k8s: point michael at the staging RGW endpoint (#185) (3815637)
• key flow modal (#44) (521c193)
• local k8s (#85) (070e22a)
• metrics worker (radosgw ingest) (#123) (faa2880)
• michael: make michael also do load balancing since he's not too… (#179) (065ff3d)
• more fabric things!! (#171) (a6802df)
• reconfigure primary repository backend (#118) (10c0a3b)
• replace restic-api with michael (#57) (4665f5c)
• repository backend (#49) (9b0d2e6)
• restore backups (#62) (e11a654)
• schedule database backups (#58) (48e468d)
• staging (#135) (f700b18)
• staging: normalize logs (#164) (bc8136d)
• staging: wire in oidc (#148) (7d5af45)
• sync metrics to customer API (#84) (aa0a346)
• talos: hyper-converged Talos Kubernetes on the Sietch Ceph hosts (#120) (30fdf6d)
• telemetry & start up error reporting / robustness (#132) (27d1ac1)
• use .well-known/yucca.json to discover backend (#126) (65b585a)
• yucca api: configurable JWT expiry (#80) (c64e90c)
• yucca SDK (#36) (957c3f8)
• yucca sdk: add authentication handoff (#39) (e5981e7)
• yucca sdk: sqlite database for configuration (#42) (e383fba)

Bug Fixes

• add package metadata for provenance (#130) (64b5fa7)
• ceph: converge RGW S3 user to exactly the 1P key on rotation (#159) (1cf742b)
• ceph: enforce dashboard admin password on every converge (#154) (94e7b99)
• ceph: enforce Grafana admin login password from the vault (#157) (27ffe9d)
• ceph: harden deploy-ceph for from-scratch reimage (#183) (f82728c)
• ceph: open cephadm service discovery port 8765 in firewall (#156) (7eaa9e2)
• ceph: parameterize secrets vault for non-dev clusters (#163) (0794082)
• ceph: use --force-password for dashboard password on Tentacle (#178) (3d52829)
• chunked uploads fail checksum checks (#38) (c7f78f3)
• ci: adjust secret name (#142) (a6eeb8b)
• ci: fix secret not having write access (#144) (02dab5b)
• ci: op wrong secret field (#143) (a4e1512)
• demo padding (#103) (86fff0f)
• deps: update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 [security] (#69) (489d28c)
• fabic: a lot of custom stuff there (#180) (9b39abf)
• fabric stuff (#173) (6d4056d)
• include python3 in Nix flake, needed for Tilt (#122) (fcecc8d)
• mark incomplete runs as failed on bootstrap (#108) (3244657)
• missing GatewayEvent export (#162) (1d94beb)
• package imports for orchestrator api (#160) (4956b51)
• redirect to / on login & un-delete migration (#43) (6b11685)
• staging: a lot (#147) (df65da6)
• staging: correct vmauth url (#153) (03e2802)
• staging: missing quotes (#150) (b03327f)
• staging: oidc unfun (#151) (8f8be89)
• staging: set web port (#152) (1736b7c)
• staging: something (#149) (a92d39f)
• staging: typo (#146) (ff995bc)
• tf/ceph: stop writing rendered inventories via local_file (#155) (83dab28)
• use repo metrics as source of truth for immich integration card (#79) (42635f4)

0.7.0 (2026-06-26)

Features

• 'bytes stored' metric (#45) (ce6b352)
• admin API (#106) (1f3ee2b)
• asymmetric jwt (#91) (70fd11f)
• backup retention (#89) (e703b08)
• cancel running tasks (& node:fs repository refactor) (#81) (415bb78)
• ceph: add LV-based SSD OSD tier for sietch (#184) (5af389f)
• ceph: add sietch staging ansible inventory (#166) (ecd28e4)
• ceph: add staging/ceph terraform stack (#165) (8d5bb53)
• ceph: authorize ops SSH keys from the identity registry (#174) (8618de8)
• ceph: import yucca-ceph ansible + terraform infrastructure (#86) (63087f6)
• ceph: optional OSD-disk wipe in provision (clean rebuild) (#177) (66740a7)
• ceph: per-role password length, shorter ops (#172) (9c33f90)
• ceph: support per-cluster baseline packages (#169) (86cbe06)
• ci: add kubeconfig / talosconfig to op (#145) (fad10fd)
• configure OpenTelemetry (#29) (c568a50)
• configure schedule repositories (#78) (6ef94e3)
• customer API: repository API (#31) (6dee484)
• customer portal: OIDC login (#30) (2e288c2)
• device code flow (#93) (aac9163)
• dns: add s3.staging.austin RGW records for sietch (#167) (9562a46)
• dns: Cloudflare-managed DNS for futo.cloud (#121) (b36f63f)
• Dockerfile for michael (#76) (9303cc1)
• fabric terraform (#170) (80d15f2)
• Immich integration (#65) (ccdcf37)
• immich integration (& assorted fixes) (#77) (e57db5e)
• immich integration UX (#87) (b0d8f2c)
• import repositories (#59) (b9aafef)
• initial commit (#27) (0b99068)
• k8s: point michael at the staging RGW endpoint (#185) (3815637)
• key flow modal (#44) (521c193)
• local k8s (#85) (070e22a)
• metrics worker (radosgw ingest) (#123) (faa2880)
• michael: make michael also do load balancing since he's not too… (#179) (065ff3d)
• more fabric things!! (#171) (a6802df)
• reconfigure primary repository backend (#118) (10c0a3b)
• replace restic-api with michael (#57) (4665f5c)
• repository backend (#49) (9b0d2e6)
• restore backups (#62) (e11a654)
• schedule database backups (#58) (48e468d)
• staging (#135) (f700b18)
• staging: normalize logs (#164) (bc8136d)
• staging: wire in oidc (#148) (7d5af45)
• sync metrics to customer API (#84) (aa0a346)
• talos: hyper-converged Talos Kubernetes on the Sietch Ceph hosts (#120) (30fdf6d)
• telemetry & start up error reporting / robustness (#132) (27d1ac1)
• use .well-known/yucca.json to discover backend (#126) (65b585a)
• yucca api: configurable JWT expiry (#80) (c64e90c)
• yucca SDK (#36) (957c3f8)
• yucca sdk: add authentication handoff (#39) (e5981e7)
• yucca sdk: sqlite database for configuration (#42) (e383fba)

Bug Fixes

• add package metadata for provenance (#130) (64b5fa7)
• ceph: converge RGW S3 user to exactly the 1P key on rotation (#159) (1cf742b)
• ceph: enforce dashboard admin password on every converge (#154) (94e7b99)
• ceph: enforce Grafana admin login password from the vault (#157) (27ffe9d)
• ceph: harden deploy-ceph for from-scratch reimage (#183) (f82728c)
• ceph: open cephadm service discovery port 8765 in firewall (#156) (7eaa9e2)
• ceph: parameterize secrets vault for non-dev clusters (#163) (0794082)
• ceph: use --force-password for dashboard password on Tentacle (#178) (3d52829)
• chunked uploads fail checksum checks (#38) (c7f78f3)
• ci: adjust secret name (#142) (a6eeb8b)
• ci: fix secret not having write access (#144) (02dab5b)
• ci: op wrong secret field (#143) (a4e1512)
• demo padding (#103) (86fff0f)
• fabic: a lot of custom stuff there (#180) (9b39abf)
• fabric stuff (#173) (6d4056d)
• include python3 in Nix flake, needed for Tilt (#122) (fcecc8d)
• mark incomplete runs as failed on bootstrap (#108) (3244657)
• missing GatewayEvent export (#162) (1d94beb)
• package imports for orchestrator api (#160) (4956b51)
• redirect to / on login & un-delete migration (#43) (6b11685)
• staging: a lot (#147) (df65da6)
• staging: correct vmauth url (#153) (03e2802)
• staging: missing quotes (#150) (b03327f)
• staging: oidc unfun (#151) (8f8be89)
• staging: set web port (#152) (1736b7c)
• staging: something (#149) (a92d39f)
• staging: typo (#146) (ff995bc)
• tf/ceph: stop writing rendered inventories via local_file (#155) (83dab28)
• use repo metrics as source of truth for immich integration card (#79) (42635f4)

0.6.0 (2026-06-25)

Features

• 'bytes stored' metric (#45) (ce6b352)
• admin API (#106) (1f3ee2b)
• asymmetric jwt (#91) (70fd11f)
• backup retention (#89) (e703b08)
• cancel running tasks (& node:fs repository refactor) (#81) (415bb78)
• ceph: import yucca-ceph ansible + terraform infrastructure (#86) (63087f6)
• ci: add kubeconfig / talosconfig to op (#145) (fad10fd)
• configure OpenTelemetry (#29) (c568a50)
• configure schedule repositories (#78) (6ef94e3)
• customer API: repository API (#31) (6dee484)
• customer portal: OIDC login (#30) (2e288c2)
• device code flow (#93) (aac9163)
• dns: Cloudflare-managed DNS for futo.cloud (#121) (b36f63f)
• Dockerfile for michael (#76) (9303cc1)
• Immich integration (#65) (ccdcf37)
• immich integration (& assorted fixes) (#77) (e57db5e)
• immich integration UX (#87) (b0d8f2c)
• import repositories (#59) (b9aafef)
• initial commit (#27) (0b99068)
• key flow modal (#44) (521c193)
• local k8s (#85) (070e22a)
• metrics worker (radosgw ingest) (#123) (faa2880)
• reconfigure primary repository backend (#118) (10c0a3b)
• replace restic-api with michael (#57) (4665f5c)
• repository backend (#49) (9b0d2e6)
• restore backups (#62) (e11a654)
• schedule database backups (#58) (48e468d)
• staging (#135) (f700b18)
• staging: wire in oidc (#148) (7d5af45)
• sync metrics to customer API (#84) (aa0a346)
• talos: hyper-converged Talos Kubernetes on the Sietch Ceph hosts (#120) (30fdf6d)
• telemetry & start up error reporting / robustness (#132) (27d1ac1)
• use .well-known/yucca.json to discover backend (#126) (65b585a)
• yucca api: configurable JWT expiry (#80) (c64e90c)
• yucca SDK (#36) (957c3f8)
• yucca sdk: add authentication handoff (#39) (e5981e7)
• yucca sdk: sqlite database for configuration (#42) (e383fba)

Bug Fixes

• add package metadata for provenance (#130) (64b5fa7)
• ceph: converge RGW S3 user to exactly the 1P key on rotation (#159) (1cf742b)
• ceph: enforce dashboard admin password on every converge (#154) (94e7b99)
• ceph: enforce Grafana admin login password from the vault (#157) (27ffe9d)
• ceph: open cephadm service discovery port 8765 in firewall (#156) (7eaa9e2)
• chunked uploads fail checksum checks (#38) (c7f78f3)
• ci: adjust secret name (#142) (a6eeb8b)
• ci: fix secret not having write access (#144) (02dab5b)
• ci: op wrong secret field (#143) (a4e1512)
• demo padding (#103) (86fff0f)
• include python3 in Nix flake, needed for Tilt (#122) (fcecc8d)
• mark incomplete runs as failed on bootstrap (#108) (3244657)
• missing GatewayEvent export (#162) (1d94beb)
• package imports for orchestrator api (#160) (4956b51)
• redirect to / on login & un-delete migration (#43) (6b11685)
• staging: a lot (#147) (df65da6)
• staging: correct vmauth url (#153) (03e2802)
• staging: missing quotes (#150) (b03327f)
• staging: oidc unfun (#151) (8f8be89)
• staging: set web port (#152) (1736b7c)
• staging: something (#149) (a92d39f)
• staging: typo (#146) (ff995bc)
• tf/ceph: stop writing rendered inventories via local_file (#155) (83dab28)
• use repo metrics as source of truth for immich integration card (#79) (42635f4)

0.5.0 (2026-06-25)

Features

• ci: add kubeconfig / talosconfig to op (#145) (fad10fd)
• staging (#135) (f700b18)
• staging: wire in oidc (#148) (7d5af45)

Bug Fixes

• package imports for orchestrator api (#160) (4956b51)
• ceph: converge RGW S3 user to exactly the 1P key on rotation (#159) (1cf742b)
• ceph: enforce dashboard admin password on every converge (#154) (94e7b99)
• ceph: enforce Grafana admin login password from the vault (#157) (27ffe9d)
• ceph: open cephadm service discovery port 8765 in firewall (#156) (7eaa9e2)
• ci: adjust secret name (#142) (a6eeb8b)
• ci: fix secret not having write access (#144) (02dab5b)
• ci: op wrong secret field (#143) (a4e1512)
• staging: a lot (#147) (df65da6)
• staging: correct vmauth url (#153) (03e2802)
• staging: missing quotes (#150) (b03327f)
• staging: oidc unfun (#151) (8f8be89)
• staging: set web port (#152) (1736b7c)
• staging: something (#149) (a92d39f)
• staging: typo (#146) (ff995bc)
• tf/ceph: stop writing rendered inventories via local_file (#155) (83dab28)

0.4.0 (2026-06-19)

Features

• telemetry & start up error reporting / robustness (#132) (27d1ac1)
• use .well-known/yucca.json to discover backend (#126) (65b585a)

0.3.0 (2026-06-17)

Features

• 'bytes stored' metric (#45) (ce6b352)
• admin API (#106) (1f3ee2b)
• asymmetric jwt (#91) (70fd11f)
• backup retention (#89) (e703b08)
• cancel running tasks (& node:fs repository refactor) (#81) (415bb78)
• ceph: import yucca-ceph ansible + terraform infrastructure (#86) (63087f6)
• configure OpenTelemetry (#29) (c568a50)
• configure schedule repositories (#78) (6ef94e3)
• customer API: repository API (#31) (6dee484)
• customer portal: OIDC login (#30) (2e288c2)
• device code flow (#93) (aac9163)
• dns: Cloudflare-managed DNS for futo.cloud (#121) (b36f63f)
• Dockerfile for michael (#76) (9303cc1)
• Immich integration (#65) (ccdcf37)
• immich integration (& assorted fixes) (#77) (e57db5e)
• immich integration UX (#87) (b0d8f2c)
• import repositories (#59) (b9aafef)
• initial commit (#27) (0b99068)
• key flow modal (#44) (521c193)
• local k8s (#85) (070e22a)
• metrics worker (radosgw ingest) (#123) (faa2880)
• reconfigure primary repository backend (#118) (10c0a3b)
• replace restic-api with michael (#57) (4665f5c)
• repository backend (#49) (9b0d2e6)
• restore backups (#62) (e11a654)
• schedule database backups (#58) (48e468d)
• sync metrics to customer API (#84) (aa0a346)
• talos: hyper-converged Talos Kubernetes on the Sietch Ceph hosts (#120) (30fdf6d)
• yucca api: configurable JWT expiry (#80) (c64e90c)
• yucca SDK (#36) (957c3f8)
• yucca sdk: add authentication handoff (#39) (e5981e7)
• yucca sdk: sqlite database for configuration (#42) (e383fba)

Bug Fixes

• chunked uploads fail checksum checks (#38) (c7f78f3)
• demo padding (#103) (86fff0f)
• include python3 in Nix flake, needed for Tilt (#122) (fcecc8d)
• mark incomplete runs as failed on bootstrap (#108) (3244657)
• redirect to / on login & un-delete migration (#43) (6b11685)
• use repo metrics as source of truth for immich integration card (#79) (42635f4)