v0.4.4

Added

• The admin username and password can be chosen at install time. A fresh install at a terminal asks for both, offering to generate a password (the default) or to take one you type twice, unechoed. Nothing changes for unattended runs — --yes, no terminal, cloud-init — which still create admin with a generated password, printed in the closing banner. DEVGRAIL_ADMIN_USERNAME and DEVGRAIL_ADMIN_PASSWORD set either up front; both are now honoured from the environment, which the password previously was not.

  A generated password is still printed at the end, because nothing else ever shows it. One you typed is not echoed back, and neither is the value an upgrade reads out of deploy/.env — an upgrade asks nothing at all, since the server applies these only when it creates the account.

  A typed password is restricted to letters, digits and ! % * + , - . : ; = ? @ ^ _ ~, 12–72 characters. That is a file-format constraint, not a security opinion: deploy/.env is read verbatim by docker compose, by the installer itself and by the test harnesses, none of which unquote. Passwords set later through the app carry no such restriction.

• Change your password in the dashboard. Settings → Password takes the current password and a new one (POST /auth/password). It re-authenticates first, so a hijacked session cannot lock the owner out, then revokes every session for that user — including the caller's, which is handed a replacement token so the page it was done from keeps working. That makes it a way to evict a session you no longer control, not just a way to rotate a secret.

• sudo devgrail passwd resets a password from the host when nobody can log in. It prompts twice and pipes the result into the server binary's new -set-password mode on stdin — never argv or the environment, both readable via ps and docker inspect — then revokes that user's sessions. It runs against the live stack: SQLite is in WAL mode and sessions are re-checked per request, so no restart is needed. DEVGRAIL_FORCE_ADMIN_PASSWORD=1 still works as the fallback for a host that cannot run the one-shot container.

Changed

• The installer now offers to fix the two Docker daemon settings it used to only complain about. install.sh printed a wall of text about userns-remap and default-address-pools, told the operator to edit /etc/docker/daemon.json by hand, and carried on — advice arriving at the one moment someone is already root at a terminal, and the one moment both changes are still cheap. It now explains each in plain terms, says what applying it costs, and offers to do it: the key is merged into daemon.json with jq (existing keys preserved, the prior file kept as .devgrail-bak-<timestamp>), Docker is restarted, and if the daemon does not come back the change is rolled back and the daemon restarted again — a host left without Docker is worse than either setting is worth. A daemon.json that does not parse is never touched.

  Nothing is applied without an explicit yes, and --yes is deliberately not that yes: restarting dockerd stops every container on the host. Unattended runs opt in on purpose with --userns-remap=yes|no / --address-pools=yes|no or DEVGRAIL_USERNS_REMAP / DEVGRAIL_ADDRESS_POOLS; no also stops the question being re-asked on later upgrades. --dry-run reports what it would offer and changes nothing.

  Two guards decide when the offer is even made. userns-remap is offered only on a host with no Docker images, containers or volumes: it moves the daemon to a per-UID data root, so anything created beforehand — the DevGrail data volume included — would become invisible, and on a host with state the installer explains the backed-up manual path instead of prompting for something it cannot make safe. The address-pool range is checked against this host's own routes before being offered (Docker's own docker0/br-* routes excluded, since they already sit in 172.16/12), falling back to 10.201.0.0/16 and then to declining outright — handing Docker a pool that shadows an operator's VPN or LAN route is worse than the ceiling it would lift. Pools an operator configured deliberately are reported, never rewritten.