Hop3 0.6 release notes¶

This page holds the full notes for each 0.6 release, newest first. The changelog gives each release's date and a summary.

0.6.2¶

The deploy host doubles as the admin domain: hop3-deploy --host h.example.com now serves the Web UI at https://h.example.com/ when no --admin-domain is given. IPs, localhost, or Docker targets keep the previous behavior (UI on port 8000).
Follow-up hints remember your selectors: when a command suggests a next step, the CLI renders it with the --context / --app you typed. Copy-paste now stays on the right target.
Usage strings show --app as optional: the app-scoped flag is now [--app <app>], reflecting that the app is normally resolved implicitly.
hop3 app env removed: the hidden duplicate of hop3 env show --sources is gone.

Bare host no longer serves the wrong app: the control-plane vhost claims default_server, so requests with no matching Host reach the Web UI. Distro default sites are cleaned up on redeploy.
Admin-domain TLS fixed on rootd hosts: acme.sh reloaded nginx as the hop3 user (blocked by rootd). The deploy now reloads nginx itself and checks for the cert on disk, which acme.sh's exit code did not guarantee.
Self-signed cert upgraded to Let's Encrypt: a previously-issued self-signed certificate is now replaced when --acme-email is added. When self-signed, the deploy tells you why.
Server knows its own admin domain: hop3-deploy records ADMIN_DOMAIN so magic links and addon expose URLs use the right hostname.
Dashboard login lasts across redeploys: web auth now uses a signed JWT cookie, matching the CLI credential. Stays valid across restarts.
HOP3_UNSAFE production override now works: the auth guards re-read the env on every call.
Unknown CLI flags fail loud: the RPC argument parser rejects unrecognized tokens with an error, where they used to be dropped without a word. This also fixed hop3 backup list --app X ignoring the filter.
hop3 context use recognizes global contexts: it no longer answers "not found", and points to the right mechanism (hop3 login --context or --context per command).

A consolidation release: simpler context model, pinned nixpkgs for reproducible builds, experimental email addon, and a round of fixes.

Experimental email / SMTP relay addon: provision an outbound relay as an addon, with environment injection following ADR 051 conventions.
Config-injection conventions (ADR 051): documented how Hop3 wires addon settings into apps; vikunja and monica now honor injected SMTP.
hop3 auth get-token: print the current bearer token. login and auth login unified; login --web fixed.

One context model (BREAKING, ADR 042): credentialed servers and project contexts are consolidated. A context is a deploy environment declared in hop3.toml under [contexts.<name>]. Credentials become invisible plumbing in ~/.config/hop3-cli/credentials.toml; config.toml is secret-free. Existing connections are migrated on first run.
Reproducible Nix builds: nixpkgs is now pinned to a specific commit across all recipes. Builds resolve the same toolchain regardless of the host's nix-channel.

--context resolution fails loud: the CLI shows the full resolution chain.
Nix GC root retained across rebuilds: prevents a running worker's closure from being garbage-collected mid-deploy.
Elixir runtime env: MIX_HOME no longer clobbered.
Discourse: assets precompiled at build time so the container binds $PORT within the health-check window.
Kanboard: schema migrations finish before the readiness probe runs.
Addon create: edge case that could report success when the addon wasn't created.
Nix flake builds and NixOS CI: repaired and re-enabled.
App packaging: archived Focalboard dropped; shlink/piwigo validations corrected; bugsink start-timeout raised; native Monica marked expects-failure.
Test Lab reporting: completed-with-failures runs are recorded as failed; variant and demo name show correctly; quieter scheduler logs; queue details expanded.

hop3.toml holds zero secrets: a committed-credential tripwire rejects secret-shaped values in committed env. Per-environment secrets are set server-side with hop3 env set.

Per-app resource limits and volumes, richer addon commands, a signed app catalog, and a published ADR collection.

Resource limits (ADR 046): declare memory and CPU caps under [limits], enforced for native and containerized apps. Server can set defaults and ceilings.
Volumes (ADR 046): persistent bind mounts and tmpfs, provisioned through rootd behind a default-deny allow-list.
Addon management: hop3 addon <type> gains query, clone, export, import, restore, flush, exists, promote, endpoint, expose, and tunnel.
App catalog (ADR 049): load a signed catalog of installable apps; browse from the dashboard.
Configurable backup contents: [backup].paths / [backup].exclude.
Static sites without a Procfile: serve from [build].static-dir.
Fixed-port registry (ADR 045): non-HTTP apps claim a stable host port from hop3.toml, optionally with source CIDRs.
Generated env secrets: SECRET_KEY = { generate = "urlsafe" } under [env].

--app flag only (ADR 036): deprecated positional argument removed.
Python 3.12+ required (BREAKING).
Command renames (aliases kept): launch → create, backup info → backup show, addon ps → addon activity, domains → domain, env migrate → app migrate.
Single source for server secret (ADR 048).
Idempotent redeploys: re-running the installer preserves existing secrets and operator config.

Redeploy no longer kills the git push: the reaper leaves git receive-pack alone.
Stable app port across redeploys.
Smaller deploy uploads: build-output directories excluded.
Redis health check fixed when no password is set.
Let's Encrypt email forwarded to the installer on redeploy.