Changelog

Staging environments, deploy visibility, scale hardening, Docker resource caps, Polar license plumbing, and website polish. Grouped by theme.

Staging environments

• Built-in staging per app: push a staging branch (default staging) to a durable host staging--<app>.<appsDomain>, optional own node, promote image to production without copying the staging database.
• Isolated data by default: staging Postgres (<app>_stg), Redis, and S3 bucket; stack workers share the owner’s staging DB. Opt-in share of prod Postgres is discouraged.
• Seed / scrub / S3 mirror: copy prod DB into staging (optional scrub SQL); mirror production bucket into the staging bucket; seed-on-enable option.
• Idle sleep, auto domains, stack promote: sleep after N hours idle; auto staging.<custom-domain> when prod has customs; enable/promote whole stacks from the dashboard or CLI.
• Backups skip staging and preview DBs so coverage does not flag disposable environments.

Scale and control plane

• buildNode: config set buildNode <node> runs docker build on a registered node (tar-streamed context, push to internal registry, scan on control). Empty keeps builds on control.
• Deploy queue: default two workers (different apps in parallel; one job per app); same-app+branch supersedes older queued jobs. pipelineWorkers config (1–4). GET /api/queue, overview card, status like queued (2/3).
• Resource caps: per-app memoryMB, pidsLimit, and cpus (docker --cpus); clearable; dashboard memory presets and multi-select replica placement.
• Backup window metrics: each run writes last-run.json (total duration, per-DB dump time/size, restic/mirror). Dashboard Backup → last window; GET /api/backup/metrics. Dumps run up to two at a time to shorten the window.
• Redis defaults: new Redis containers get a 256MB memory cap with allkeys-lru eviction so one app cannot fill the data node.
• Postgres pressure: connections vs max_connections (warn 70%, critical 90%), by database. Backup page card and overview alerts; GET /api/postgres/pressure.
• Control load budgets: ~10s app-list cache for the dashboard, ~15s probe cache, max 16 concurrent HTTP probes, remote docker stats every few minutes. Status includes last probe pass duration and buildNode.
• One-click update: overview banner when a newer release exists; Update now runs POST /api/update (download, checksum, swap, delayed restart). CLI girder update uses the same path.

Deploy pipeline

• Stage clocks: per-step elapsed time on the Deploys pipeline; live duration while running.
• Cancel queued / redeploy / plan: drop waiting jobs; re-queue a sha with current env; dry-run plan before apply.
• SSE progress + outputs: live stage stream; machine-readable url/image after finish for agents and CI.
• Preview TTL + destroy: previewsTTLHours, lease auto-destroy, dashboard/API teardown for previews; sleep staging from the card.
• Timeline + expiry radar: Activity merges deploys with audit; Status lists cert, license, and preview expiries.
• Deploy freeze: block production deploys for go-live (staging/previews optional); force override on redeploy when needed.
• Agent tools: MCP deploy_plan, redeploy, deploy_progress, deploy_outputs, timeline, expiry_radar, freeze helpers.
• Deploy feed: sidebar deploys page with expandable cards, day groups, filters, build logs, rollback. Runner-style progress during git push build as well as queue/deploy.

Support, product, site

• Support bundle: girder support-bundle or Config → download support bundle. Redacted .tar.gz (no secrets).
• Garage RF upgrade: status + guided RF=2 after a peer is joined.
• License editions + dashboard card: edition on signed licenses; Config → license status; PE-1 authz foundation (multi-user not wired).
• License commerce plumbing: services/license-bridge for Polar order.paid webhooks → signed license email (Resend). Site buy CTAs ready when checkout URLs are set. Ops: docs/LICENSE-CHECKOUT.md.
• Agency playbook and backupSkip for demo/throwaway apps.
• Website: AI-builder homepage and demo, SEO/perf pass, waitlist modal, changelog in header.

• Multi-node app replicas: opt-in nodes: [data-1, data-2] deploys the same image to every listed node, multi-A DNS to healthy IPs, partial success if one node fails. CLI/dashboard config key nodes.
• Preview branches: previews: true puts non-deploy branches at <slug>--<app>.<appsDomain>; branch delete tears them down.
• Build args & deploy hooks: per-app buildArgs for docker build --build-arg; deployHook runs in the new container after health, before traffic flips (failure rolls back).
• App templates: girder apps create --template static|nextjs|worker (dashboard create form too).
• Movable registry: internal Docker registry can leave the control node via registryNode / girder registry migrate (and dashboard move).
• Weekly auto restore + PITR drills on the backup page; disk auto-prune at 85%; deploy queue position in the deploying state.
• Dashboard config page: write-only secret fields (token rotation and R2 flip without SSH).
• Reliability: remote apps no longer flap red on transient SSH/inspect failures; post-health step failures no longer mark a live deploy failed; registry health reflects the actual registry node.

• Licensing model: a valid license runs forever; the expiry date is an update entitlement window. girder update refuses versions released after the window (with a renewal message). Each publish writes a RELEASED marker; unmarked versions are grandfathered.
• girder update --to <version> for pin/downgrade; girder update --list lists available versions.
• Dashboard status: transient check failures show amber unknown instead of flip-flopping red; confirmed outages only after sustained failures.
• Dashboard assets served with Cache-Control: no-cache so hard-refresh is no longer required after upgrades.

• Visitor analytics: a stats page shows requests, unique visitors (Cloudflare-aware real IPs), sessions, and average session duration per app, computed from Traefik access logs, no cookies, no scripts on your sites.
• No more false down alerts: outages now require 3 consecutive failed probes before paging or turning an app red. Transient blips show as amber "flaky" instead.
• The Girder logo lands on the admin: sidebar brand, login card, and favicon.
• Releases now publish at dl.rungirder.com. The installer and self-update live on the Girder domain.
• Rollback now ensures the node's ingress exists first. Rolling back while a node's Traefik is down no longer blackholes the app.
• girder update --force re-fetches even when the version matches, for repairing a broken same-version release.
• Skills renamed to girder-deploy and girder-install; dashboard wording, SECURITY.md, and docs fully rebranded.

• The platform is now Girder: Go module, binaries (girder, girder-mcp), CLI, dashboard, installer, and docs rebranded end to end.
• New installs land in /opt/girder with girder.service; existing installs keep running untouched. Runtime identifiers are unchanged.
• The MCP server registers as girder. Agents deploy and manage the platform under the new name.

• Deploy apps from any git branch, not just main.
• Control-plane watchdog: get paged when the platform itself goes down.
• The restore drill now verifies the offsite object mirror too.
• Deleting an app removes its DNS records along with its containers and services.
• Point-in-time recovery drill runs from the dashboard; build logs refresh live.
• Provision and manage nodes through the MCP server.
• Weekly automatic node patching (opt-in).
• HSTS and transport security headers on every app by default.
• Cloudflare proxying per custom domain (CDN and DDoS protection).
• Cost visibility: live node prices on provision, rescale, and disk growth.
• Backup coverage check flags any database without a fresh dump.
• Uptime probes now cover custom domains, and a global domains page checks every host on demand.

• Initial control plane: git-push deploys with streaming build logs, zero-downtime rollouts, automatic rollback, and the web dashboard.
• Multi-node: provision Hetzner servers from the CLI or dashboard, per-node ingress and DNS, and a dedicated data node for shared Postgres, Redis, and S3.
• Move an app's database between nodes without losing data; deploy history with click-to-rollback.
• Tamper-evident audit log of every change; Trivy scans on every built image.
• Signed customer licenses, enforced at daemon start in release builds.
• Nightly backups with restore drills, per-database dumps, and WAL-G point-in-time recovery.
• Runtime logs over the API, per-node disk usage, and node power controls.