@serve.zone/appstore 32.27.0 → 33.0.0

package/apps/cloudly/versions/1.8.0/config.json

@@ -1,173 +0,0 @@
-{
-  "image": "code.foss.global/serve.zone/cloudly@sha256:9a803fbc9db00ffcf6ce4bd584c0c8b5a3016f3a94ce75629ddee2f52d2bf72c",
-  "targetPorts": [
-    {
-      "name": "web",
-      "port": 3000,
-      "protocol": "http",
-      "default": true
-    }
-  ],
-  "envVars": [
-    {
-      "key": "SERVEZONE_ENVIRONMENT",
-      "value": "production",
-      "description": "Cloudly runtime environment.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_PUBLIC_ORIGIN",
-      "value": "https://${SERVICE_DOMAIN}",
-      "description": "Canonical public Cloudly origin including protocol and optional public port.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_LISTENPORT",
-      "value": "3000",
-      "description": "Internal Cloudly HTTP port inside the container.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_SSLMODE",
-      "value": "external",
-      "description": "Use external TLS termination through Onebox or dcrouter.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_SECRET_KEYRING_PATH",
-      "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
-      "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_SECRET_KEYRING_FILE",
-      "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
-      "required": true,
-      "secret": true,
-      "delivery": {
-        "type": "file",
-        "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
-        "uid": 0,
-        "gid": 0,
-        "mode": 256
-      }
-    },
-    {
-      "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
-      "value": "/run/secrets/cloudly-workloadinit-approval.json",
-      "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
-      "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
-      "required": true,
-      "secret": true,
-      "delivery": {
-        "type": "file",
-        "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
-        "uid": 0,
-        "gid": 0,
-        "mode": 256
-      }
-    },
-    {
-      "key": "MONGODB_URL",
-      "value": "${MONGODB_URI}",
-      "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "MONGODB_NAME",
-      "value": "${MONGODB_DATABASE}",
-      "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "MONGODB_USER",
-      "value": "${MONGODB_USERNAME}",
-      "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "MONGODB_PASS",
-      "value": "${MONGODB_PASSWORD}",
-      "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "S3_ENDPOINT",
-      "value": "onebox-corestore",
-      "description": "S3 endpoint host provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "S3_PORT",
-      "value": "9000",
-      "description": "S3 endpoint port provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "S3_USESSL",
-      "value": "false",
-      "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
-      "required": true
-    },
-    {
-      "key": "S3_BUCKET",
-      "value": "${S3_BUCKET}",
-      "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
-      "required": true
-    },
-    {
-      "key": "S3_ACCESSKEY",
-      "value": "${S3_ACCESS_KEY}",
-      "description": "S3 access key provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "S3_SECRETKEY",
-      "value": "${S3_SECRET_KEY}",
-      "description": "S3 secret key provisioned by Onebox Corestore.",
-      "required": true
-    }
-  ],
-  "platformRequirements": {
-    "mongodb": true,
-    "s3": true
-  },
-  "platformOidc": {
-    "redirectPath": "/auth/oidc/callback",
-    "roles": [
-      {
-        "id": "admin",
-        "label": "Administrator",
-        "description": "Full Cloudly administration for this hosted instance."
-      },
-      {
-        "id": "user",
-        "label": "User",
-        "description": "Standard authenticated Cloudly access for this hosted instance."
-      }
-    ],
-    "environmentVariables": {
-      "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
-      "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
-      "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
-      "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
-      "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
-    },
-    "clientAuthenticationMethod": "client_secret_basic"
-  },
-  "minOneboxVersion": "32.4.0",
-  "changelog": "Move Cloudly to 33.5.0, a feature release over 33.4.0: a deployment is reserved only by a deployment machine user. reserveServiceDeployment refuses any other verified actor, an administrator included, with DEPLOYMENT_MACHINE_IDENTITY_REQUIRED before anything is reserved, and the reserve-phase getDeploymentPreflight reports the same blocker; an existing api machine user with its grants already qualifies and needs no change. A deployer that signs in with a username and password, such as tsdeploy with TSDEPLOY_CLOUDLY_USERNAME and TSDEPLOY_CLOUDLY_PASSWORD, is an administrator and is refused, so switch it to a machine-user token before upgrading: create a deployment machine user per deployer with mutateDeploymentMachineUser or Access → Deployment machine users in the dashboard, attach its grants with configureServiceDeploymentMachineUser, and give its username and token to the deployer. An operation an administrator reserved earlier stays awaiting its image; clean it up with cleanupServiceDeployment. mutateDeploymentMachineUser creates an API machine user with one token (create), replaces every token of one with a new token (rotate-token) or removes its tokens while its grants stay (revoke-token); the token is answered once and expires at most a year after the mutation, and getDeploymentMachineUsers lists every deployment machine user with its token expiries and grants and never a token value. The identity getIdentityByToken issues and the registry bearer of a machine login now name the SHA-256 of their token, and every verification checks that the user still holds that unexpired token, so removing a token ends the sessions opened with it. A machine identity or registry bearer issued by an earlier release names no token and is refused, so its holder exchanges its token again: a deployer such as tsdeploy does so on every run, while a long-running API or administrator machine client that keeps its identity across a reconnect calls getIdentityByToken once more after the upgrade; cluster identities, including relays on the shared cluster token, and service workload identities are unaffected. Let no deployment run while Cloudly upgrades: a run in progress keeps its pre-upgrade identity and is refused for the rest of that run, so rerun it or resume it with deploy-retry. The cluster config broadcast now reaches the elected relay of every cluster, so a Corestore endpoint written on a node of a Pallet cluster, and every other broadcast, reaches that cluster's relay at once instead of when it reconnects, and setServiceRuntimeSpec refuses a spec the runtime spec contract rejects as Service runtime operation rejected: invalid. instead of Internal server error, and stores nothing. The runtime contract is unchanged from 1.7.0 and requires Onebox 32.4.0. Cloudly 33.5.0 stores the retained mutation answers in the new collection cloudly_deployment_machine_user_mutations and keeps the data version 0.22.0, so from 1.7.0 there is no data step. From 1.6.0, startup runs the forward-only data migration from 0.21.0 to 0.22.0 through the step runtime-session-protocol-offer, which states protocol: null on every Pallet session row recorded before Cloudly stored the protocol offer its node stated, so such a node counts as unrecorded until it registers again; stop Cloudly and take a verified backup before upgrading, because the step has no inverse and rollback requires a full restore. The published-port ranges of Cloudly 33.4.0 apply too: setServicePublishedPorts publishes a contiguous range through hostPortEnd and same-port outbound through symmetric: true, which needs public egress (published-port-symmetric-without-egress) and owns its inside ports (published-port-symmetric-inside-overlap); new handoff leases translate outbound flows only into the SNAT band 49152-65535, whose ports are refused published-port-reserved, while a node keeps its 1024-65535 lease until its router is re-created; a service network policy write for a service whose deletion has begun is refused service-deleting; and a projection carrying a range or a symmetric entry is withheld as node-contract-behind from a Pallet node whose session states a release below interfaces 32.31.0, or none. From 1.5.0 the same step runs, and the service network egress of Cloudly 33.3.0 applies too: an administrator sets a service's network egress with setServiceNetworkEgress, which states whether the service's attached workloads reach the public internet and which platform endpoints of the protected authority they reach, and reads it with getServiceNetworkEgress; a workload whose enabled database or object-storage binding sits on a node whose Corestore endpoint its network does not select is refused database-endpoint-unselected or objectstorage-endpoint-unselected, and a replica already running keeps running while its target reports the refusal, so grant the endpoint through the service's egress before such a workload is placed again; the default runtime spec of a new service probes its process instead of its first TCP target port. From 1.4.0 the same step runs, and the gateway admin bootstrap of Cloudly 33.2.0 applies too: an administrator hands Cloudly a dcrouter admin token once through bootstrapExternalGatewayCredential or servezone gateway bootstrap, from which Cloudly provisions and stores its own gateway-client credential; a first enrollment turns admin-bootstrap-required, a gateway settings change the held credential cannot carry is staged, a runtime network address plan out of its canonical order is refused plan-unsorted, and a relay naming a node Cloudly does not hold is refused relay-node-unknown: roll out Cloudly 33.5.0 first, then Coreflow 33.2.0, which recognises the relay-node-unknown refusal. From 1.3.0 the same step runs, and the per-node database endpoint of Cloudly 33.1.0 applies too: roll out Cloudly 33.5.0 first, then Coreflow 33.2.0 (33.1.0 at minimum), then Corestore 33.0.0, and set every node's Corestore database endpoint with setClusterNodeCorestoreDatabaseEndpoint, because a database binding on a node without one is not granted and its service is refused database-endpoint-missing, and existing database bindings answer no credential material until they are granted again for the endpoint. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme and then the step runtime-session-protocol-offer to 0.22.0; retire-cluster-relay-acme drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked breaking and manual-review because a username and password deployer, an administrator's deployment reservation and a machine identity or registry bearer issued earlier are refused, and migration-required and backup-before-upgrade because these flags are read from the target version alone, every upgrade from 1.6.0 or earlier runs the 0.21.0 to 0.22.0 step, and an upgrade from 1.2.1 or earlier still runs the migration from 0.20.0 on this image as well. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
-  "breaking": true,
-  "requiresManualReview": true,
-  "migrationRequired": true,
-  "backupBeforeUpgrade": true,
-  "healthCheck": {
-    "path": "/status",
-    "port": 3000,
-    "expectedStatus": 200
-  }
-}

package/apps/cloudly/versions/1.9.0/config.json

@@ -1,173 +0,0 @@
-{
-  "image": "code.foss.global/serve.zone/cloudly@sha256:efcb200497b45ea14ef87155ac67a13a9be8eebd67801680122e84b9f3670c26",
-  "targetPorts": [
-    {
-      "name": "web",
-      "port": 3000,
-      "protocol": "http",
-      "default": true
-    }
-  ],
-  "envVars": [
-    {
-      "key": "SERVEZONE_ENVIRONMENT",
-      "value": "production",
-      "description": "Cloudly runtime environment.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_PUBLIC_ORIGIN",
-      "value": "https://${SERVICE_DOMAIN}",
-      "description": "Canonical public Cloudly origin including protocol and optional public port.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_LISTENPORT",
-      "value": "3000",
-      "description": "Internal Cloudly HTTP port inside the container.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_SSLMODE",
-      "value": "external",
-      "description": "Use external TLS termination through Onebox or dcrouter.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_SECRET_KEYRING_PATH",
-      "value": "/run/secrets/cloudly-secrets-v2-keyring.json",
-      "description": "Path to the Cloudly Secrets v2 keyring mounted by Onebox; the keyring value is never placed in the public environment.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_SECRET_KEYRING_FILE",
-      "description": "Existing Cloudly Secrets v2 keyring. Onebox stores it encrypted and mounts it only as a root-readable file; retain the existing keyring when upgrading.",
-      "required": true,
-      "secret": true,
-      "delivery": {
-        "type": "file",
-        "targetPath": "/run/secrets/cloudly-secrets-v2-keyring.json",
-        "uid": 0,
-        "gid": 0,
-        "mode": 256
-      }
-    },
-    {
-      "key": "SERVEZONE_WORKLOADINIT_APPROVAL_PATH",
-      "value": "/run/secrets/cloudly-workloadinit-approval.json",
-      "description": "Private WorkloadInit release-approval artifact mounted by Onebox for Coreflow secret-runtime registration.",
-      "required": true
-    },
-    {
-      "key": "SERVEZONE_WORKLOADINIT_APPROVAL_FILE",
-      "description": "Operator-approved WorkloadInit release authority. Onebox stores it encrypted and mounts it only as a root-readable file.",
-      "required": true,
-      "secret": true,
-      "delivery": {
-        "type": "file",
-        "targetPath": "/run/secrets/cloudly-workloadinit-approval.json",
-        "uid": 0,
-        "gid": 0,
-        "mode": 256
-      }
-    },
-    {
-      "key": "MONGODB_URL",
-      "value": "${MONGODB_URI}",
-      "description": "Authenticated MongoDB wire-protocol URL provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "MONGODB_NAME",
-      "value": "${MONGODB_DATABASE}",
-      "description": "MongoDB wire-protocol database name provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "MONGODB_USER",
-      "value": "${MONGODB_USERNAME}",
-      "description": "MongoDB wire-protocol username provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "MONGODB_PASS",
-      "value": "${MONGODB_PASSWORD}",
-      "description": "MongoDB wire-protocol password provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "S3_ENDPOINT",
-      "value": "onebox-corestore",
-      "description": "S3 endpoint host provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "S3_PORT",
-      "value": "9000",
-      "description": "S3 endpoint port provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "S3_USESSL",
-      "value": "false",
-      "description": "Use plain HTTP for internal Corestore S3 traffic on the Onebox network.",
-      "required": true
-    },
-    {
-      "key": "S3_BUCKET",
-      "value": "${S3_BUCKET}",
-      "description": "S3 bucket provisioned by Onebox Corestore for Cloudly's registry.",
-      "required": true
-    },
-    {
-      "key": "S3_ACCESSKEY",
-      "value": "${S3_ACCESS_KEY}",
-      "description": "S3 access key provisioned by Onebox Corestore.",
-      "required": true
-    },
-    {
-      "key": "S3_SECRETKEY",
-      "value": "${S3_SECRET_KEY}",
-      "description": "S3 secret key provisioned by Onebox Corestore.",
-      "required": true
-    }
-  ],
-  "platformRequirements": {
-    "mongodb": true,
-    "s3": true
-  },
-  "platformOidc": {
-    "redirectPath": "/auth/oidc/callback",
-    "roles": [
-      {
-        "id": "admin",
-        "label": "Administrator",
-        "description": "Full Cloudly administration for this hosted instance."
-      },
-      {
-        "id": "user",
-        "label": "User",
-        "description": "Standard authenticated Cloudly access for this hosted instance."
-      }
-    ],
-    "environmentVariables": {
-      "issuerUrl": "SERVEZONE_PLATFORM_OIDC_ISSUER",
-      "clientId": "SERVEZONE_PLATFORM_OIDC_CLIENT_ID",
-      "clientSecret": "SERVEZONE_PLATFORM_OIDC_CLIENT_SECRET",
-      "redirectUri": "SERVEZONE_PLATFORM_OIDC_REDIRECT_URI",
-      "audience": "SERVEZONE_PLATFORM_OIDC_AUDIENCE"
-    },
-    "clientAuthenticationMethod": "client_secret_basic"
-  },
-  "minOneboxVersion": "32.4.0",
-  "changelog": "Move Cloudly to 33.6.0, a feature and fix release over 33.5.0. Every new service gets its own deployment namespace, <name>-<id digest>-v<major> with twelve hex digits of the SHA-256 of the service id, so two services of one project on one Cloudly both reserve instead of the second being refused DEPLOYMENT_RESOURCE_COLLISION; a service already holding its project-only namespace keeps it, as does an operation reserved under it, so no deployed service moves and no data changes. Cloudly now stops gracefully on SIGTERM and SIGINT: the first signal runs Cloudly.stop(), which closes the database last, and the process exits 0 when the stop completes and 1 when it fails or has not completed within 8 seconds, below the 10-second stop grace of Docker and Swarm, so stopping or restarting the Cloudly service no longer leaves a database transaction held on the server and the next start no longer crash-loops on EFENCE_BUSY until the server's 30-minute session timeout; a second signal exits at once with 143 (SIGTERM) or 130 (SIGINT), and a process ended by SIGKILL still holds its database session until that timeout. getDeploymentMachineUsers lists a deployment machine user configured under Cloudly 11 again instead of failing the whole listing with an unnamed internal error, a stored user the listing still cannot describe fails it with an error naming the user and the refused part (identity, tokens or grants), and every unexpected failure of getDeploymentMachineUsers or mutateDeploymentMachineUser is logged with each error of its chain. The runtime contract is unchanged from 1.8.0 and requires Onebox 32.4.0. From every earlier version, startup runs the forward-only data migration from 0.22.0 to 0.23.0 through the step deployment-machine-user-grants, which keeps on every deployment machine user exactly the grants a capability check reads, the first valid grant per organization and service, and permanently removes the rest, such as the { serviceId, capabilities } grants stored by Cloudly 11; tokens, names and every deployment's authority stay as they are. Stop Cloudly and take a verified backup before upgrading, because the step has no inverse and rollback requires a full restore. From 1.7.0 or earlier, the deployment machine users of Cloudly 33.5.0 apply too: a deployment is reserved only by a deployment machine user. reserveServiceDeployment refuses any other verified actor, an administrator included, with DEPLOYMENT_MACHINE_IDENTITY_REQUIRED before anything is reserved, and the reserve-phase getDeploymentPreflight reports the same blocker; an existing api machine user with its grants already qualifies and needs no change. A deployer that signs in with a username and password, such as tsdeploy with TSDEPLOY_CLOUDLY_USERNAME and TSDEPLOY_CLOUDLY_PASSWORD, is an administrator and is refused, so switch it to a machine-user token before upgrading from 1.7.0 or earlier: create a deployment machine user per deployer with mutateDeploymentMachineUser or Access → Deployment machine users in the dashboard, attach its grants with configureServiceDeploymentMachineUser, and give its username and token to the deployer. An operation an administrator reserved earlier stays awaiting its image; clean it up with cleanupServiceDeployment. mutateDeploymentMachineUser creates an API machine user with one token (create), replaces every token of one with a new token (rotate-token) or removes its tokens while its grants stay (revoke-token); the token is answered once and expires at most a year after the mutation, and getDeploymentMachineUsers lists every deployment machine user with its token expiries and grants and never a token value. The identity getIdentityByToken issues and the registry bearer of a machine login now name the SHA-256 of their token, and every verification checks that the user still holds that unexpired token, so removing a token ends the sessions opened with it. A machine identity or registry bearer issued by an earlier release names no token and is refused, so its holder exchanges its token again: a deployer such as tsdeploy does so on every run, while a long-running API or administrator machine client that keeps its identity across a reconnect calls getIdentityByToken once more after the upgrade; cluster identities, including relays on the shared cluster token, and service workload identities are unaffected. Let no deployment run while Cloudly upgrades: a run in progress keeps its pre-upgrade identity and is refused for the rest of that run, so rerun it or resume it with deploy-retry. The cluster config broadcast now reaches the elected relay of every cluster, so a Corestore endpoint written on a node of a Pallet cluster, and every other broadcast, reaches that cluster's relay at once instead of when it reconnects, and setServiceRuntimeSpec refuses a spec the runtime spec contract rejects as Service runtime operation rejected: invalid. instead of Internal server error, and stores nothing. From 1.6.0, startup first runs the forward-only data migration from 0.21.0 to 0.22.0 through the step runtime-session-protocol-offer, which states protocol: null on every Pallet session row recorded before Cloudly stored the protocol offer its node stated, so such a node counts as unrecorded until it registers again; that step has no inverse either. The published-port ranges of Cloudly 33.4.0 apply too: setServicePublishedPorts publishes a contiguous range through hostPortEnd and same-port outbound through symmetric: true, which needs public egress (published-port-symmetric-without-egress) and owns its inside ports (published-port-symmetric-inside-overlap); new handoff leases translate outbound flows only into the SNAT band 49152-65535, whose ports are refused published-port-reserved, while a node keeps its 1024-65535 lease until its router is re-created; a service network policy write for a service whose deletion has begun is refused service-deleting; and a projection carrying a range or a symmetric entry is withheld as node-contract-behind from a Pallet node whose session states a release below interfaces 32.31.0, or none. From 1.5.0 the same step runs, and the service network egress of Cloudly 33.3.0 applies too: an administrator sets a service's network egress with setServiceNetworkEgress, which states whether the service's attached workloads reach the public internet and which platform endpoints of the protected authority they reach, and reads it with getServiceNetworkEgress; a workload whose enabled database or object-storage binding sits on a node whose Corestore endpoint its network does not select is refused database-endpoint-unselected or objectstorage-endpoint-unselected, and a replica already running keeps running while its target reports the refusal, so grant the endpoint through the service's egress before such a workload is placed again; the default runtime spec of a new service probes its process instead of its first TCP target port. From 1.4.0 the same step runs, and the gateway admin bootstrap of Cloudly 33.2.0 applies too: an administrator hands Cloudly a dcrouter admin token once through bootstrapExternalGatewayCredential or servezone gateway bootstrap, from which Cloudly provisions and stores its own gateway-client credential; a first enrollment turns admin-bootstrap-required, a gateway settings change the held credential cannot carry is staged, a runtime network address plan out of its canonical order is refused plan-unsorted, and a relay naming a node Cloudly does not hold is refused relay-node-unknown: roll out Cloudly 33.6.0 first, then Coreflow 33.2.0, which recognises the relay-node-unknown refusal. From 1.3.0 the same step runs, and the per-node database endpoint of Cloudly 33.1.0 applies too: roll out Cloudly 33.6.0 first, then Coreflow 33.2.0 (33.1.0 at minimum), then Corestore 33.0.0, and set every node's Corestore database endpoint with setClusterNodeCorestoreDatabaseEndpoint, because a database binding on a node without one is not granted and its service is refused database-endpoint-missing, and existing database bindings answer no credential material until they are granted again for the endpoint. From 1.2.1 or earlier, startup runs the forward-only data migration from 0.20.0 to 0.21.0 through the step retire-cluster-relay-acme and then the steps runtime-session-protocol-offer to 0.22.0 and deployment-machine-user-grants to 0.23.0; retire-cluster-relay-acme drops the relay certificate and DNS collections of Cloudly's retired Cloudflare and Let's Encrypt integration and logs every relay name whose A record Cloudly had written at Cloudflare: remove each such record at the provider. A cluster relay then requires a dcrouter that advertises dns.clientRecords and certificates.exactIssuance, SERVEZONE_SSLMODE=letsencrypt is refused (this template keeps external), and the typed API changes as the Breaking Changes of the Cloudly 33.0.0 changelog list; review them, stop Cloudly and take a verified backup before upgrading, because the 32.9 image refuses the migrated data and rollback requires a full restore. The upgrade is marked migration-required and backup-before-upgrade because every upgrade runs the 0.22.0 to 0.23.0 step, an upgrade from 1.6.0 or earlier runs the 0.21.0 to 0.22.0 step before it and one from 1.2.1 or earlier the migration from 0.20.0 as well, and breaking and manual-review because the step removes stored grants forward-only and, from 1.7.0 or earlier, a username and password deployer, an administrator's deployment reservation and a machine identity or registry bearer issued earlier are refused; hosts read these flags from the target version alone. An installation on 1.1.10 or earlier also runs the 1.2.0 steps first, from 0.10.0, and requires completed Secrets v2 cutover retirement. Preserve existing user and storage identities, OIDC bindings, the encrypted keyring and WorkloadInit approval as dedicated root-readable files.",
-  "breaking": true,
-  "requiresManualReview": true,
-  "migrationRequired": true,
-  "backupBeforeUpgrade": true,
-  "healthCheck": {
-    "path": "/status",
-    "port": 3000,
-    "expectedStatus": 200
-  }
-}

package/apps/ghost/app.json

@@ -1,10 +0,0 @@
-{
-  "id": "ghost",
-  "name": "Ghost",
-  "description": "Professional publishing platform for blogs and newsletters",
-  "category": "CMS",
-  "iconName": "ghost",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone"
-}

package/apps/ghost/versions/1.0.0/config.json

@@ -1,18 +0,0 @@
-{
-  "image": "ghost:latest",
-  "targetPorts": [
-    { "name": "web", "port": 2368, "protocol": "http", "default": true }
-  ],
-  "envVars": [
-    { "key": "database__client", "value": "mysql", "description": "Database client" },
-    { "key": "database__connection__host", "value": "${MARIADB_HOST}", "description": "Database host (auto-injected by platform)" },
-    { "key": "database__connection__port", "value": "${MARIADB_PORT}", "description": "Database port (auto-injected by platform)" },
-    { "key": "database__connection__user", "value": "${MARIADB_USER}", "description": "Database user (auto-injected by platform)" },
-    { "key": "database__connection__password", "value": "${MARIADB_PASSWORD}", "description": "Database password (auto-injected by platform)" },
-    { "key": "database__connection__database", "value": "${MARIADB_DATABASE}", "description": "Database name (auto-injected by platform)" },
-    { "key": "url", "value": "https://${SERVICE_DOMAIN}", "description": "Public URL of the blog" }
-  ],
-  "platformRequirements": {
-    "mariadb": true
-  }
-}

package/apps/gitea/app.json

@@ -1,10 +0,0 @@
-{
-  "id": "gitea",
-  "name": "Gitea",
-  "description": "Lightweight self-hosted Git service",
-  "category": "Development",
-  "iconName": "gitea",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone"
-}

package/apps/gitea/versions/1.0.0/config.json

@@ -1,16 +0,0 @@
-{
-  "image": "gitea/gitea:latest",
-  "targetPorts": [
-    { "name": "web", "port": 3000, "protocol": "http", "default": true }
-  ],
-  "envVars": [
-    { "key": "GITEA__database__DB_TYPE", "value": "mysql", "description": "Database type" },
-    { "key": "GITEA__database__HOST", "value": "${MARIADB_HOST}:${MARIADB_PORT}", "description": "Database host (auto-injected by platform)" },
-    { "key": "GITEA__database__NAME", "value": "${MARIADB_DATABASE}", "description": "Database name (auto-injected by platform)" },
-    { "key": "GITEA__database__USER", "value": "${MARIADB_USER}", "description": "Database user (auto-injected by platform)" },
-    { "key": "GITEA__database__PASSWD", "value": "${MARIADB_PASSWORD}", "description": "Database password (auto-injected by platform)" }
-  ],
-  "platformRequirements": {
-    "mariadb": true
-  }
-}

package/apps/gitops/app.json

@@ -1,14 +0,0 @@
-{
-  "id": "gitops",
-  "name": "GitOps",
-  "description": "Operations dashboard for Git hosting, CI/CD secrets, pipeline logs, and documentation sync.",
-  "category": "Dev Tools",
-  "iconName": "git-branch",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone",
-  "links": {
-    "Source": "https://code.foss.global/serve.zone/gitops",
-    "Docs": "https://serve.zone"
-  }
-}

package/apps/gitops/versions/1.0.0/config.json

@@ -1,28 +0,0 @@
-{
-  "image": "code.foss.global/serve.zone/gitops:2.13.0",
-  "targetPorts": [
-    { "name": "web", "port": 3000, "protocol": "http", "default": true }
-  ],
-  "envVars": [
-    {
-      "key": "GITOPS_PORT",
-      "value": "3000",
-      "description": "Internal GitOps HTTP port inside the container.",
-      "required": true
-    },
-    {
-      "key": "GITOPS_ADMIN_USERNAME",
-      "value": "",
-      "description": "Initial admin username for the GitOps web UI.",
-      "required": true
-    },
-    {
-      "key": "GITOPS_ADMIN_PASSWORD",
-      "value": "",
-      "description": "Initial admin password for the GitOps web UI.",
-      "required": true
-    }
-  ],
-  "volumes": ["/data/.serve.zone/gitops"],
-  "minOneboxVersion": "1.28.0"
-}

package/apps/grafana/app.json

@@ -1,10 +0,0 @@
-{
-  "id": "grafana",
-  "name": "Grafana",
-  "description": "Open-source analytics and monitoring platform",
-  "category": "Monitoring",
-  "iconName": "grafana",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone"
-}

package/apps/grafana/versions/1.0.0/config.json

@@ -1,9 +0,0 @@
-{
-  "image": "grafana/grafana:latest",
-  "targetPorts": [
-    { "name": "web", "port": 3000, "protocol": "http", "default": true }
-  ],
-  "envVars": [
-    { "key": "GF_SECURITY_ADMIN_PASSWORD", "value": "", "description": "Admin password", "required": true }
-  ]
-}

package/apps/mariadb/app.json

@@ -1,10 +0,0 @@
-{
-  "id": "mariadb",
-  "name": "MariaDB",
-  "description": "Community-developed relational database forked from MySQL",
-  "category": "Databases",
-  "iconName": "mariadb",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone"
-}

package/apps/mariadb/versions/1.0.0/config.json

@@ -1,9 +0,0 @@
-{
-  "image": "mariadb:latest",
-  "targetPorts": [
-    { "name": "db", "port": 3306, "protocol": "tcp", "default": true }
-  ],
-  "envVars": [
-    { "key": "MARIADB_ROOT_PASSWORD", "value": "", "description": "Root password", "required": true }
-  ]
-}

package/apps/mattermost/app.json

@@ -1,10 +0,0 @@
-{
-  "id": "mattermost",
-  "name": "Mattermost",
-  "description": "Open-source team messaging and collaboration platform",
-  "category": "Communication",
-  "iconName": "mattermost",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone"
-}

package/apps/mattermost/versions/1.0.0/config.json

@@ -1,6 +0,0 @@
-{
-  "image": "mattermost/mattermost-team-edition:latest",
-  "targetPorts": [
-    { "name": "web", "port": 8065, "protocol": "http", "default": true }
-  ]
-}

package/apps/n8n/app.json

@@ -1,10 +0,0 @@
-{
-  "id": "n8n",
-  "name": "n8n",
-  "description": "Workflow automation platform with visual editor",
-  "category": "Automation",
-  "iconName": "n8n",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone"
-}

package/apps/n8n/versions/1.0.0/config.json

@@ -1,6 +0,0 @@
-{
-  "image": "n8nio/n8n:latest",
-  "targetPorts": [
-    { "name": "web", "port": 5678, "protocol": "http", "default": true }
-  ]
-}

package/apps/nextcloud/app.json

@@ -1,10 +0,0 @@
-{
-  "id": "nextcloud",
-  "name": "Nextcloud",
-  "description": "Self-hosted productivity and file sharing platform",
-  "category": "Cloud Storage",
-  "iconName": "nextcloud",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone"
-}

package/apps/nextcloud/versions/1.0.0/config.json

@@ -1,16 +0,0 @@
-{
-  "image": "nextcloud:latest",
-  "targetPorts": [
-    { "name": "web", "port": 80, "protocol": "http", "default": true }
-  ],
-  "envVars": [
-    { "key": "MYSQL_HOST", "value": "${MARIADB_HOST}", "description": "Database host (auto-injected by platform)" },
-    { "key": "MYSQL_USER", "value": "${MARIADB_USER}", "description": "Database user (auto-injected by platform)" },
-    { "key": "MYSQL_PASSWORD", "value": "${MARIADB_PASSWORD}", "description": "Database password (auto-injected by platform)" },
-    { "key": "MYSQL_DATABASE", "value": "${MARIADB_DATABASE}", "description": "Database name (auto-injected by platform)" }
-  ],
-  "platformRequirements": {
-    "mariadb": true,
-    "valkey": true
-  }
-}

package/apps/nginx/app.json

@@ -1,10 +0,0 @@
-{
-  "id": "nginx",
-  "name": "Nginx",
-  "description": "High-performance web server and reverse proxy",
-  "category": "Web Servers",
-  "iconName": "nginx",
-  "latestVersion": "1.0.0",
-  "versions": ["1.0.0"],
-  "maintainer": "serve.zone"
-}

package/apps/nginx/versions/1.0.0/config.json

@@ -1,6 +0,0 @@
-{
-  "image": "nginx:alpine",
-  "targetPorts": [
-    { "name": "web", "port": 80, "protocol": "http", "default": true }
-  ]
-}

package/apps/openbao/app.json

@@ -1,16 +0,0 @@
-{
-  "id": "openbao",
-  "name": "OpenBao",
-  "description": "Open-source secrets management, encryption, and identity security platform",
-  "category": "Security",
-  "iconName": "shield",
-  "latestVersion": "1.0.0",
-  "versions": [
-    "1.0.0"
-  ],
-  "maintainer": "serve.zone",
-  "links": {
-    "documentation": "https://openbao.org/docs/",
-    "source": "https://github.com/openbao/openbao"
-  }
-}