v0.4.10

Added

• Session, lockout, OAuth and HSTS lifetimes are settings now, not constants compiled into the binary. Every one of them was a Go value, so the only way to run a test or staging host on different numbers was to build your own image. Two cases made that hurt. A host running automated auth suites trips the login lockout constantly, and the counters are in-process — restarting the server was the only way to clear one. And a staging hostname that took the two-year Strict-Transport-Security header could never be served over plain HTTP again, because only max-age=0 undoes that and there was no way to send it. DEVGRAIL_SESSION_TTL, DEVGRAIL_SCOPED_TOKEN_TTL, DEVGRAIL_LOGIN_MAX_FAILURES, DEVGRAIL_LOGIN_LOCKOUT, the three DEVGRAIL_OAUTH_*_TTL values and DEVGRAIL_HSTS_MAX_AGE are all optional and all documented in deploy/.env.example; leaving them unset is exactly what shipped before, because the defaults still live in the packages that enforce them rather than being copied into the configuration.

  A value that does not parse is a startup error, not a skipped assignment. DEVGRAIL_SESSION_TTL=24 leaving 24h quietly in force under a name that says it changed is the failure these variables exist to prevent.

• GET /settings/policy tells the dashboard what this binary actually validates against. Settings carried its own copy of the minimum password length and the SSH port bounds, kept in step with the server by a comment. Raise the minimum and the form went on accepting a password the API would reject; the message the user got was the API's, arriving after they had typed it twice. The page now reads the rules — password lengths, SSH port range and defaults — from the server it is talking to. If that fetch fails it offers no hint and no input bounds at all and lets the API decide, rather than falling back to a number that may be wrong.

Changed

• The Traefik image is a setting. TRAEFIK_IMAGE in deploy/.env names the full reference, pin included, so an install can pull it from a private mirror or an air-gapped registry. Unset, it is the same pinned version the compose file has always used.

• The Claude.ai OAuth callback is no longer unconditional. The connector's redirect URI was accepted whatever a client registered, and there was no way to say "none" — an install that will never talk to claude.ai carried it anyway. oauth_extra_redirect_uris in config.yaml (or DEVGRAIL_OAUTH_EXTRA_REDIRECT_URIS) sets the list; unset still means the documented Claude.ai callback, so nothing changes unless you change it, and an empty list means none.

• A server with no registry configured says so instead of pointing at the vendor. registry_url had a compiled-in default, so an install that was never pointed at a registry silently asked devgrail.com about updates, and Settings → About offered an upgrade link on an origin that host had nothing to do with. It now does nothing and logs why, and the link is omitted rather than pointing at a page this server does not serve. install.sh has always written the key, so no installed host is affected.

• The backup directory is reported from configuration rather than assumed to be /opt/devgrail/backups. install.sh records where it actually put it, and the two messages that send an operator to find a snapshot — the schema-too-new refusal and the missing-jwt_secret refusal — name that path instead of a default that may not be where the backups are.