Tags

v260918

Hermes SEG v260918

Auto Recipient Provisioning (#332): read the relay recipient roster from
a directory on a schedule, then stage it for review or provision it
unattended. Three connectors, all Community edition:

  LDAP / Active Directory
  Google Workspace via the Admin SDK (#336), works on every Workspace tier
  Microsoft 365 via Microsoft Graph (#337)

Enumeration and authentication are independent, so the directory the
recipient list is read from need not be the one recipients authenticate
against. Provisioning recipients who authenticate remotely is Pro, as
RemoteAuth always has been.

RemoteAuth TLS (#335): certificates are written where slapd can read
them, an uploaded CA is combined with the system trust store instead of
replacing it, client certificates are supported, and the Test Connection
probe judges whether the bind was accepted rather than whether the user
could read anything.

Quarantine release links are rotated off a weak key derivation. Links
issued in the 72 hours before upgrading stop working; the messages are
still releasable from the User Portal.

MariaDB (#339): the configured binary log expiry never ran, because
every automatic purge waits for a replica that does not exist. The
database healthcheck passed no credentials, so it logged a failed login
every ten seconds while reporting healthy regardless.

v260912

v260815

v260814

Hermes SEG v260814

Fresh-install release. Two defects that could strand a new gateway partway
through its first install, plus a dashboard failure affecting running
gateways.

  #313  Nextcloud got one install attempt and could never recover from
        failing it. The installer now drives the install itself and applies
        the trusted domains the entrypoint would otherwise have set.
  #314  A wrong host clock took DNS down and the preflight blamed the
        forwarders. Now diagnosed and named, with no new gate on a healthy
        install.

Also: a failed disk probe no longer takes down the admin console, and the
release workflow can run its own drift check.

No schema changes. No image changes: v260814 ships the v260807 images.

v260807

v260731

Hermes SEG v260731 — update-pipeline repair (#288)

Four scheduled jobs were never running, the update checker was dead, and
fresh installs reported the wrong version. config.ini is now rendered from
ofelia_jobs at install and on every upgrade, build_no is derived from the
release directory, and the smoke test fails when scheduled jobs diverge
from the database.

v260723

Hermes SEG v260723 — quarantine notifier flood fix (#287)

v260722

Hermes SEG v260722 — Pause Outbound Delivery + legacy→Docker migration hardening (#150, #284, #285)

v260630

Hermes SEG v260630 — public landing page at / + login relocated to /auth (#283)

v260628

Hermes SEG v260628

v260612