arkeep-io/arkeep v0.10.0

on GitHub

✨ Highlights

• OIDC group access - restrict sign-in to allowed groups, map admin groups to the admin role, and cap how long an OIDC session lasts, per provider.
• Official Helm chart - published as an OCI artifact on GHCR and Docker Hub, now bundling PostgreSQL with the official postgres image.
• Test your notifications - send a test email or webhook straight from the settings pages.
• Password management for admins - set a user's password and require a new one at the next sign-in.
• Systemd unit for the server, shipped in the release archives.
• Supply chain hardening - every dependency, toolchain and image is pinned; the embedded restic and rclone are checked against their GPG-signed SHA-256 sums.

⚠️ Upgrade notes

• Helm, bundled PostgreSQL - the Bitnami subchart is gone (its images are no longer published). The chart now runs the official postgres image, values move from postgresql.primary.persistence.* to postgresql.persistence.*, and the data must be moved with pg_dump/pg_restore. Follow Moving from the Bitnami PostgreSQL subchart before upgrading. The old volume is kept, so you can roll back.
• Helm - the server Deployment now uses the Recreate strategy: expect a short downtime during upgrades instead of two servers on the same volume.
• Agent with systemd - copy the new arkeep-agent.service: the agent now runs as root, so it can back up and restore files owned by any user.
• API changes
  • agent labels and the placeholder POST /agents are removed;
  • a policy's repository password can no longer be changed through the API;
  • new repository passwords must be at least 8 characters;
  • an agent still used by policies or destinations can't be deleted.

🔒 Security

• Hook and command-source commands are no longer exposed to the read-only user role.
• Closed email content injection paths flagged by CodeQL.
• SFTP destinations require credentials and can pin the server's host key.
• The last active admin can no longer be demoted or deactivated.

📦 Install

docker pull ghcr.io/arkeep-io/arkeep-server:v0.10.0
docker pull ghcr.io/arkeep-io/arkeep-agent:v0.10.0

Kubernetes: helm install arkeep oci://ghcr.io/arkeep-io/charts/arkeep --version 0.10.0 (also oci://registry-1.docker.io/arkeepio/arkeep).

Images are also published on Docker Hub (arkeepio/arkeep-server, arkeepio/arkeep-agent) for linux/amd64 and linux/arm64. Standalone binaries - server for Linux and macOS, agent for Linux (amd64, arm64, armv7, mips, mipsle), macOS and Windows - are attached below. See the installation docs for Docker Compose, binary and Helm setups.

Changelog

🚀 Features

• feat(deploy): ship a systemd unit for the server (d42ae03) by @Fcrotti1
• feat(gui): add New Repository to the destination page (e013728) by @Fcrotti1
• feat(gui): add shared form validation rules (e7d8987) by @Fcrotti1
• feat(gui): configure oidc group restrictions and session duration #277 (6a2ac8a) by @Fcrotti1
• feat(helm): add telemetry, trusted proxies and metrics token values (5cc39f5) by @Fcrotti1
• feat(helm): bundle PostgreSQL with the official image instead of the Bitnami subchart (4ddb941) by @Fcrotti1
• feat(oidc): add group restriction settings to oidc providers #277 (66600a3) by @Fcrotti1
• feat(oidc): cap oidc sessions with a per-provider maximum duration #277 (a15785b) by @Fcrotti1
• feat(oidc): expose group restrictions and session cap in provider settings #277 (ef4d308) by @Fcrotti1
• feat(oidc): record group restrictions and session cap in the audit log #277 (9dc0d67) by @Fcrotti1
• feat(oidc): restrict login to allowed groups and map admin groups to roles #277 (71d3e38) by @Fcrotti1
• feat(oidc): show group denial reason on the login callback page #277 (54b4ae9) by @Fcrotti1
• feat(server): delete expired refresh tokens and old read notifications daily (7c2c2d5) by @Fcrotti1
• feat: let an admin set a user's password and require a new one at sign-in (1fa6361) by @Fcrotti1
• feat: publish the Helm chart as an OCI artifact on GHCR and Docker Hub (edb7be3) by @Fcrotti1
• feat: send a test email or webhook from the settings pages (a010996) by @Fcrotti1

🐛 Bug Fixes

• fix(agent): end every process a hook started when it times out (9ab1d4d) by @Fcrotti1
• fix(agent): fail a restore that matches nothing in the snapshot (fa3dbaf) by @Fcrotti1
• fix(agent): never recreate a repository that must exist (9dba96b) by @Fcrotti1
• fix(agent): retry enrollment on every reconnect until the agent has a certificate (7dec08d) by @Fcrotti1
• fix(agent): run the post-backup hook on every way out (6280eb1) by @Fcrotti1
• fix(agent): stop backups from failing without saying so (72474e4) by @Fcrotti1
• fix(api): enforce a minimum repository password length on policies (2209e36) by @Fcrotti1
• fix(api): refuse demoting or deactivating the last active admin (1348c36) by @Fcrotti1
• fix(api): validate destination retention keep values (efbe121) by @Fcrotti1
• fix(api): validate hook timeouts on policies (b5c35a4) by @Fcrotti1
• fix(deploy): pass secure cookies, trusted proxies, metrics token and telemetry to the server in compose (5cf5f79) by @Fcrotti1
• fix(deploy): run the agent unit as root so backups and restores work (a05fa8c) by @Fcrotti1
• fix(deps): keep the chart's PostgreSQL image in step with the compose files (1679ed0) by @Fcrotti1
• fix(gui): make pin input slots visible in dark mode (8cc7dfb) by @Fcrotti1
• fix(gui): pin vue-tsc to 3.3.13 to work around a template type regression in 3.3.14 (d2fd72e) by @Fcrotti1
• fix(gui): show source validation errors in the policy form (bcb8d23) by @Fcrotti1
• fix(gui): show the two-factor code step as busy until the login completes (c0a598f) by @Fcrotti1
• fix(gui): validate docker volume sources in the policy schema (deba96f) by @Fcrotti1
• fix(gui): validate hook timeouts in the policy form (150c1fa) by @Fcrotti1
• fix(gui): validate setup and password reset with the shared password rule (ce6af27) by @Fcrotti1
• fix(gui): validate the job queue, log retention and snapshot sync settings (03053c6) by @Fcrotti1
• fix(notification): close email content injection paths flagged by CodeQL (1023c2a) by @Fcrotti1
• fix(notification): retry deliveries after 5 and 30 minutes as documented (1968a75) by @Fcrotti1
• fix(notification): send retried emails to the active admins when no recipients are set (0d70f8f) by @Fcrotti1
• fix(scripts): check the Docker backup's integrity inside the container (187800b) by @Fcrotti1
• fix(server): exit non-zero when the HTTP or gRPC listener fails to start (81c9478) by @Fcrotti1
• fix(server): ship sqlite3 in the image for the documented online database backup (05978da) by @Fcrotti1
• fix(server): wait for background services before closing the database on shutdown (d744ac5) by @Fcrotti1
• fix(server): wait up to 60 seconds for PostgreSQL at startup (601fe83) by @Fcrotti1
• fix: escape the healthcheck event path element for gosec G125 (ef8d943) by @Fcrotti1
• fix: keep hook and command-source commands from the user role (641d02e) by @Fcrotti1
• fix: record when a destination's repository exists (598fe98) by @Fcrotti1
• fix: refuse to change a policy's repository password via the API (b836429) by @Fcrotti1
• fix: refuse to delete an agent that policies or destinations still use (35759b0) by @Fcrotti1
• fix: remove agent labels and the placeholder POST /agents (23c3cd6) by @Fcrotti1
• fix: rename a message constant that gosec G101 took for a credential (d09b389) by @Fcrotti1
• fix: require SFTP credentials and let destinations pin the server's host key (cc4959c) by @Fcrotti1
• fix: satisfy gosec G304 in dbtest (a18afb8) by @Fcrotti1
• fix: say that deleting a snapshot only removes it from the list (4c6abf7) by @Fcrotti1
• fix: show the notification bell to admins only and notify every admin (8c43747) by @Fcrotti1
• fix: skip disabled destinations in backups, retention and checks (b4d794e) by @Fcrotti1
• fix: turn the integrity check on by default for destinations created via the API (6e24b56) by @Fcrotti1
• fix: upgrade the Helm chart with the Recreate strategy (702fa88) by @Fcrotti1
• fix: validate hooks as the agent decodes them (cdc1c1d) by @Fcrotti1

🏗️ Build & CI

• build(agent): pin restic and rclone archives by GPG-verified SHA-256 (06c527f) by @TheGuit
• build(deps): bump the base-images group across 2 directories with 2 updates (d5785d7) by @dependabot[bot]
• build(gui): add vitest with vue test utils and jsdom (4819fd1) by @Fcrotti1
• build(tools): document the gosec pseudo-version exception (3215265) by @TheGuit
• build: bump Go toolchain to 1.27.3 for GO-2026-6809 (c5be944) by @TheGuit
• build: pin Go and Node toolchains, Go tools and npm dependencies exactly (a256700) by @TheGuit
• build: pin base and deployment images by digest, fix Helm default image (2de3442) by @TheGuit
• ci: enforce dependency pinning and automate pin updates (ADR 0013) (6cbdc8b) by @TheGuit
• ci: keep compose image tags on the latest Arkeep release (4afd98b) by @TheGuit

🔐 Verify

sha256sum --check --ignore-missing checksums.txt

Full Changelog: v0.9.1...v0.10.0