fadenstack 0.4.2__tar.gz → 0.4.4__tar.gz

{fadenstack-0.4.2 → fadenstack-0.4.4}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.5
 Name: fadenstack
-Version: 0.4.2
+Version: 0.4.4
 Summary: CLI installer and management tool for the Fadenstack platform
-Project-URL: Homepage, https://fadenstack.github.io
+Project-URL: Homepage, https://fadenstack.com
 Project-URL: Repository, https://github.com/fadenstack/fadenstack
-Project-URL: Documentation, https://fadenstack.github.io/docs
+Project-URL: Documentation, https://help.fadenstack.com
 Project-URL: Issues, https://github.com/fadenstack/fadenstack/issues
 Author-email: Sachith Liyanagama <liyanagama@outlook.de>
 Maintainer-email: Sachith Liyanagama <liyanagama@outlook.de>
@@ -50,7 +50,7 @@ faden deploy                 # installs Fadenstack into ~/fadenstack and starts
 ```
 
 The CLI carries the deployment files of its release and runs that release's
-published images: `fadenstack 0.4.2` deploys Fadenstack 0.4.2. To upgrade,
+published images: `fadenstack 0.4.3` deploys Fadenstack 0.4.3. To upgrade,
 upgrade the CLI and run `faden upgrade`. See
 [Installing Fadenstack](https://github.com/fadenstack/fadenstack/blob/main/docs/help/pages/operate/installing.md).
 

{fadenstack-0.4.2 → fadenstack-0.4.4}/README.md

@@ -15,7 +15,7 @@ faden deploy                 # installs Fadenstack into ~/fadenstack and starts
 ```
 
 The CLI carries the deployment files of its release and runs that release's
-published images: `fadenstack 0.4.2` deploys Fadenstack 0.4.2. To upgrade,
+published images: `fadenstack 0.4.3` deploys Fadenstack 0.4.3. To upgrade,
 upgrade the CLI and run `faden upgrade`. See
 [Installing Fadenstack](https://github.com/fadenstack/fadenstack/blob/main/docs/help/pages/operate/installing.md).
 

{fadenstack-0.4.2 → fadenstack-0.4.4}/pyproject.toml

@@ -10,7 +10,7 @@ packages = ["src/faden_cli"]
 
 [project]
 name = "fadenstack"
-version = "0.4.2"
+version = "0.4.4"
 requires-python = ">=3.12,<4.0"
 description = "CLI installer and management tool for the Fadenstack platform"
 authors = [
@@ -49,9 +49,9 @@ dependencies = [
 ]
 
 [project.urls]
-Homepage = "https://fadenstack.github.io"
+Homepage = "https://fadenstack.com"
 Repository = "https://github.com/fadenstack/fadenstack"
-Documentation = "https://fadenstack.github.io/docs"
+Documentation = "https://help.fadenstack.com"
 Issues = "https://github.com/fadenstack/fadenstack/issues"
 
 [project.scripts]

{fadenstack-0.4.2 → fadenstack-0.4.4}/src/faden_cli/__init__.py

@@ -13,4 +13,4 @@ Module activation via Docker Compose profiles.
 All secrets generated securely during init phase.
 """
 
-__version__ = "0.4.2"
+__version__ = "0.4.4"

{fadenstack-0.4.2 → fadenstack-0.4.4}/src/faden_cli/bundle/shared/docker-compose.yaml

@@ -11,6 +11,16 @@
 # unpacks the release into (~/fadenstack by default).
 name: fadenstack
 
+# Docker's own log of every container (what `docker logs` and Alloy read) rotates:
+# at most FADEN_LOG_MAX_FILE files of FADEN_LOG_MAX_SIZE each per container, the
+# oldest dropped. Without it the json-file driver grows until the disk is full.
+# Set in .env (faden deploy --log-max-size / --log-max-file; Help: Installing).
+x-logging: &faden-logging
+  driver: json-file
+  options:
+    max-size: ${FADEN_LOG_MAX_SIZE:-50m}
+    max-file: "${FADEN_LOG_MAX_FILE:-5}"
+
 services:
   # -----------------------------
   # Platform base image (build-only, no runtime container)
@@ -28,6 +38,7 @@ services:
   nginx:
     image: nginx:1-alpine
     container_name: faden-nginx
+    logging: *faden-logging
     restart: unless-stopped
     ports:
       - "${FADEN_HTTP_PORT:-80}:80"
@@ -67,6 +78,7 @@ services:
   postgres:
     image: pgvector/pgvector:pg17
     container_name: faden-postgres
+    logging: *faden-logging
     restart: unless-stopped
     # Parallel index builds (pgvector HNSW) work in shared memory; Docker's
     # default 64 MB /dev/shm fails them ("could not resize shared memory
@@ -106,6 +118,7 @@ services:
     # CLICKHOUSE_IMAGE=clickhouse/clickhouse-server:<tag>
     image: ${CLICKHOUSE_IMAGE:-clickhouse/clickhouse-server:25.10}
     container_name: faden-clickhouse
+    logging: *faden-logging
     restart: unless-stopped
     user: "101:101"
     environment:
@@ -131,13 +144,24 @@ services:
   redis:
     image: redis:7.2
     container_name: faden-redis
+    logging: *faden-logging
     restart: unless-stopped
+    # Capped, so a runaway writer fills Redis rather than the host: at the cap Redis refuses writes
+    # (noeviction) and the writers carry on without them (a chat reply's shared log, device presence).
+    # It is not evicting because Langfuse's queues (BullMQ) and the chat replies' live events must not
+    # be dropped silently. Everything the gateway keeps here has a TTL; what it holds is a few tens
+    # of MB (110 MB for 9,500 replies kept 15 minutes in plain text, now 1 minute), so the 1gb default
+    # leaves a Langfuse backlog room. FADEN_REDIS_MAXMEMORY in .env changes it (Help, Installing).
     command: >
-      --requirepass ${REDIS_AUTH:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)} --maxmemory-policy noeviction
+      --requirepass ${REDIS_AUTH:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)} --maxmemory ${FADEN_REDIS_MAXMEMORY:-1gb} --maxmemory-policy noeviction
+    environment:
+      # redis-cli reads the password from here: on its command line (-a) it showed in `ps`.
+      REDISCLI_AUTH: ${REDIS_AUTH:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
     ports:
       - "127.0.0.1:6379:6379"
     healthcheck:
-      test: ["CMD", "redis-cli", "-a", "${REDIS_AUTH:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}", "ping"]
+      # NOAUTH and the like exit 0 as well, so the answer itself is checked.
+      test: ["CMD-SHELL", "redis-cli ping | grep -q PONG"]
       interval: 3s
       timeout: 10s
       retries: 10
@@ -145,6 +169,7 @@ services:
   minio:
     image: cgr.dev/chainguard/minio:latest
     container_name: faden-minio
+    logging: *faden-logging
     restart: unless-stopped
     entrypoint: sh
     command: -c 'mkdir -p /data/langfuse && minio server --address ":9000" --console-address ":9001" /data'
@@ -169,6 +194,7 @@ services:
   langfuse-worker:
     image: docker.io/langfuse/langfuse-worker:3
     container_name: faden-worker
+    logging: *faden-logging
     restart: unless-stopped
     depends_on:
       postgres:
@@ -219,6 +245,7 @@ services:
   langfuse-web:
     image: docker.io/langfuse/langfuse:3
     container_name: faden-web
+    logging: *faden-logging
     restart: unless-stopped
     ports:
       # LLM observability UI (traces / evals / datasets), plain HTTP: on this
@@ -288,6 +315,7 @@ services:
   faden-rmq:
     image: rabbitmq:4.2.1-management-alpine
     container_name: faden-rmq
+    logging: *faden-logging
     restart: unless-stopped
     ports:
       - "127.0.0.1:5672:5672"
@@ -322,6 +350,7 @@ services:
   faden-gateway-migrator:
     image: ${REGISTRY:-ghcr.io/fadenstack}/gateway:${VERSION:-latest}
     container_name: faden-gateway-migrator
+    logging: *faden-logging
     restart: on-failure:5
     command: ["sh", "-c", "sleep 5 && alembic upgrade head"]
     depends_on:
@@ -333,6 +362,11 @@ services:
       FADEN_GATEWAY_DB_USER: ${POSTGRES_USER:-postgres}
       FADEN_GATEWAY_DB_PASS: ${POSTGRES_PASSWORD:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
       FADEN_GATEWAY_DB_BASE: faden_gateway
+      # The migration that seals the provider API keys (pr0vk3yg) uses the backend's master key; without it
+      # the migrator used the published development default.
+      FADEN_GATEWAY_SETTINGS_MASTER_KEY: ${FADEN_BACKEND_SETTINGS_MASTER_KEY:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
+      # That migration refuses the published development key unless the install keeps it on purpose.
+      FADEN_GATEWAY_ALLOW_PUBLISHED_KEYS: ${FADEN_ALLOW_PUBLISHED_KEYS:-false}
 
   # -----------------------------
   # faden_gateway (OpenAI-compatible endpoint gateway)
@@ -346,6 +380,7 @@ services:
       args:
         BASE_IMAGE: ${REGISTRY:-ghcr.io/fadenstack}/base:${VERSION:-latest}
     container_name: faden-gateway
+    logging: *faden-logging
     restart: unless-stopped
     depends_on:
       postgres:
@@ -372,6 +407,9 @@ services:
       # These two env vars enable that path; no static JWT_SECRET env var is needed.
       FADEN_GATEWAY_BACKEND_DB_BASE: faden_backend
       FADEN_GATEWAY_SETTINGS_MASTER_KEY: ${FADEN_BACKEND_SETTINGS_MASTER_KEY:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
+      # Set only while `faden secrets rotate` is unfinished: values sealed with the old key still open.
+      FADEN_GATEWAY_SETTINGS_MASTER_KEY_PREVIOUS: ${FADEN_BACKEND_SETTINGS_MASTER_KEY_PREVIOUS:-}
+      FADEN_GATEWAY_ENCRYPTION_KEY_PREVIOUS: ${FADEN_GATEWAY_ENCRYPTION_KEY_PREVIOUS:-}
       # An install that has stored data under the published development key may
       # keep it, with a warning at every start, until it is changed (Help:
       # Installing, Secrets in .env). Outside development the service refuses it otherwise.
@@ -405,6 +443,7 @@ services:
       # PII module integration (set via .env or COMPOSE_PROFILES)
       FADEN_GATEWAY_PII_ENABLED: ${FADEN_GATEWAY_PII_ENABLED:-false}
       FADEN_GATEWAY_PII_SERVICE_URL: ${FADEN_GATEWAY_PII_SERVICE_URL:-http://faden-pii:8000}
+      FADEN_GATEWAY_PII_SERVICE_TOKEN: ${FADEN_GATEWAY_PII_SERVICE_TOKEN:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
       # MCP tool registry integration (set via .env or COMPOSE_PROFILES)
       FADEN_GATEWAY_MCP_ENABLED: ${FADEN_GATEWAY_MCP_ENABLED:-false}
       FADEN_GATEWAY_MCP_SERVICE_URL: ${FADEN_GATEWAY_MCP_SERVICE_URL:-http://faden-mcp:8000}
@@ -431,6 +470,13 @@ services:
       FADEN_GATEWAY_DB_MAX_OVERFLOW: ${FADEN_GATEWAY_DB_MAX_OVERFLOW:-5}
       FADEN_GATEWAY_RABBIT_POOL_SIZE: ${FADEN_GATEWAY_RABBIT_POOL_SIZE:-2}
       FADEN_GATEWAY_RABBIT_CHANNEL_POOL_SIZE: ${FADEN_GATEWAY_RABBIT_CHANNEL_POOL_SIZE:-10}
+    volumes:
+      # Chat attachments (chat_file_store_root). In the container layer until this release: every upgrade
+      # and restore replaced the container and lost them. With FADEN_DATA_DIR set in .env the source is
+      # that directory plus /chat-files on the host (a company's own storage); empty, the named volume
+      # below. `faden upgrade` copies what the old container holds into it first. FADEN_DATA_DIR covers this
+      # and the knowledge files only; never the database, the models or the observability data.
+      - ${FADEN_DATA_DIR:-faden_chat_files}${FADEN_DATA_DIR:+/chat-files}:/data/faden/chat-files
     healthcheck:
       test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health', timeout=3).read()"]
       interval: 5s
@@ -443,6 +489,7 @@ services:
   faden-backend-migrator:
     image: ${REGISTRY:-ghcr.io/fadenstack}/backend:${VERSION:-latest}
     container_name: faden-backend-migrator
+    logging: *faden-logging
     restart: on-failure:5
     command: ["sh", "-c", "sleep 5 && alembic upgrade head"]
     depends_on:
@@ -454,6 +501,11 @@ services:
       FADEN_BACKEND_DB_USER: ${POSTGRES_USER:-postgres}
       FADEN_BACKEND_DB_PASS: ${POSTGRES_PASSWORD:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
       FADEN_BACKEND_DB_BASE: faden_backend
+      # The migration that seals the remote providers' API keys (pr0vk3ys) seals them with this key.
+      # Without it the migrator used the published development default, and the backend could not open them.
+      FADEN_BACKEND_SETTINGS_MASTER_KEY: ${FADEN_BACKEND_SETTINGS_MASTER_KEY:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
+      # That migration refuses the published development key unless the install keeps it on purpose.
+      FADEN_BACKEND_ALLOW_PUBLISHED_KEYS: ${FADEN_ALLOW_PUBLISHED_KEYS:-false}
 
   faden-backend:
     image: ${REGISTRY:-ghcr.io/fadenstack}/backend:${VERSION:-latest}
@@ -467,6 +519,7 @@ services:
       args:
         BASE_IMAGE: ${REGISTRY:-ghcr.io/fadenstack}/base:${VERSION:-latest}
     container_name: faden-backend
+    logging: *faden-logging
     restart: unless-stopped
     depends_on:
       postgres:
@@ -504,6 +557,11 @@ services:
       FADEN_BACKEND_RABBIT_VHOST: /
       FADEN_BACKEND_GATEWAY_URL: ${FADEN_BACKEND_GATEWAY_URL:-http://faden-gateway:8000}
       FADEN_BACKEND_SETTINGS_MASTER_KEY: ${FADEN_BACKEND_SETTINGS_MASTER_KEY:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
+      # Set only while `faden secrets rotate` is unfinished: values sealed with the old key still open.
+      FADEN_BACKEND_SETTINGS_MASTER_KEY_PREVIOUS: ${FADEN_BACKEND_SETTINGS_MASTER_KEY_PREVIOUS:-}
+      # What the machines' credential hashes are keyed with. Once the master key itself; a rotation
+      # changes the master key and must not change this, or every machine would have to enroll again.
+      FADEN_BACKEND_CREDENTIAL_PEPPER: ${FADEN_BACKEND_CREDENTIAL_PEPPER:?set it in .env, as faden upgrade does (it keeps the machines' credentials valid; Help, Rotating the keys)}
       # An install that has stored data under the published development key may
       # keep it, with a warning at every start, until it is changed (Help:
       # Installing, Secrets in .env). Outside development the service refuses it otherwise.
@@ -528,6 +586,7 @@ services:
       # Module enabled flags + service URLs (Docker-internal for health probes)
       FADEN_BACKEND_PII_ENABLED: ${FADEN_BACKEND_PII_ENABLED:-false}
       FADEN_BACKEND_PII_SERVICE_URL: ${FADEN_BACKEND_PII_SERVICE_URL:-http://faden-pii:8000/api}
+      FADEN_BACKEND_PII_SERVICE_TOKEN: ${FADEN_BACKEND_PII_SERVICE_TOKEN:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
       FADEN_BACKEND_INTERNAL_TOKEN: ${FADEN_BACKEND_INTERNAL_TOKEN:-}
       FADEN_BACKEND_MCP_ENABLED: ${FADEN_BACKEND_MCP_ENABLED:-false}
       FADEN_BACKEND_MCP_SERVICE_URL: ${FADEN_BACKEND_MCP_SERVICE_URL:-http://faden-mcp:8000}
@@ -561,8 +620,10 @@ services:
       - faden_models:/srv/faden/models
       # Knowledge base uploads (rag_lite.file_store_root): written here, read by faden-backend-worker,
       # which ingests them. Each container had its own: the worker found no file, every ingest failed,
-      # and the uploads went with the container.
-      - faden_rag_lite:/data/faden/rag-lite
+      # and the uploads went with the container. With FADEN_DATA_DIR set in .env the source is that
+      # directory plus /knowledge on the host; empty, the named volume. The CLI copies the volume's files
+      # into the folder before the container is created.
+      - ${FADEN_DATA_DIR:-faden_rag_lite}${FADEN_DATA_DIR:+/knowledge}:/data/faden/rag-lite
       # Runtime monitoring — shared with the prometheus + grafana
       # services (see their mounts). The backend generates
       # prometheus/targets.json and dashboards/*.json here; grafana
@@ -588,6 +649,7 @@ services:
   faden-backend-worker:
     image: ${REGISTRY:-ghcr.io/fadenstack}/backend:${VERSION:-latest}
     container_name: faden-backend-worker
+    logging: *faden-logging
     restart: unless-stopped
     command:
       - taskiq
@@ -621,6 +683,11 @@ services:
       FADEN_BACKEND_RABBIT_VHOST: /
       FADEN_BACKEND_GATEWAY_URL: ${FADEN_BACKEND_GATEWAY_URL:-http://faden-gateway:8000}
       FADEN_BACKEND_SETTINGS_MASTER_KEY: ${FADEN_BACKEND_SETTINGS_MASTER_KEY:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
+      # Set only while `faden secrets rotate` is unfinished: values sealed with the old key still open.
+      FADEN_BACKEND_SETTINGS_MASTER_KEY_PREVIOUS: ${FADEN_BACKEND_SETTINGS_MASTER_KEY_PREVIOUS:-}
+      # What the machines' credential hashes are keyed with. Once the master key itself; a rotation
+      # changes the master key and must not change this, or every machine would have to enroll again.
+      FADEN_BACKEND_CREDENTIAL_PEPPER: ${FADEN_BACKEND_CREDENTIAL_PEPPER:?set it in .env, as faden upgrade does (it keeps the machines' credentials valid; Help, Rotating the keys)}
       FADEN_BACKEND_LLM_GRAPH_DB_HOST: postgres
       FADEN_BACKEND_LLM_GRAPH_DB_USER: ${POSTGRES_USER:-postgres}
       FADEN_BACKEND_LLM_GRAPH_DB_PASS: ${POSTGRES_PASSWORD:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
@@ -631,6 +698,7 @@ services:
       FADEN_BACKEND_MCP_ENABLED: ${FADEN_BACKEND_MCP_ENABLED:-false}
       FADEN_BACKEND_SKILLS_ENABLED: ${FADEN_BACKEND_SKILLS_ENABLED:-false}
       FADEN_BACKEND_PII_SERVICE_URL: ${FADEN_BACKEND_PII_SERVICE_URL:-http://faden-pii:8000/api}
+      FADEN_BACKEND_PII_SERVICE_TOKEN: ${FADEN_BACKEND_PII_SERVICE_TOKEN:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
       FADEN_BACKEND_INTERNAL_TOKEN: ${FADEN_BACKEND_INTERNAL_TOKEN:-}
       FADEN_BACKEND_MCP_SERVICE_URL: ${FADEN_BACKEND_MCP_SERVICE_URL:-http://faden-mcp:8000}
       FADEN_BACKEND_MCP_SERVICE_TOKEN: ${FADEN_BACKEND_MCP_SERVICE_TOKEN:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
@@ -652,7 +720,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - faden_models:/srv/faden/models
-      - faden_rag_lite:/data/faden/rag-lite
+      - ${FADEN_DATA_DIR:-faden_rag_lite}${FADEN_DATA_DIR:+/knowledge}:/data/faden/rag-lite
 
   # -----------------------------
   # frontend (React admin console)
@@ -666,6 +734,7 @@ services:
       additional_contexts:
         docs: ../docs
     container_name: faden-frontend
+    logging: *faden-logging
     restart: unless-stopped
     depends_on:
       faden-backend:
@@ -691,6 +760,7 @@ services:
       args:
         BASE_IMAGE: ${REGISTRY:-ghcr.io/fadenstack}/base:${VERSION:-latest}
     container_name: faden-pii
+    logging: *faden-logging
     restart: unless-stopped
     depends_on:
       faden-rmq:
@@ -702,6 +772,9 @@ services:
       FADEN_PII_ENVIRONMENT: ${FADEN_PII_ENVIRONMENT:-production}
       FADEN_PII_BACKEND_URL: http://faden-backend:8000
       FADEN_PII_BACKEND_TOKEN: ${FADEN_PII_BACKEND_TOKEN:-}
+      # What the gateway, the backend and MCP present on every call but health. Required: empty, the
+      # service would refuse them all.
+      FADEN_PII_SERVICE_TOKEN: ${FADEN_PII_SERVICE_TOKEN:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
       FADEN_PII_RABBIT_HOST: faden-rmq
       FADEN_PII_RABBIT_PORT: 5672
       FADEN_PII_RABBIT_USER: faden-pii
@@ -721,6 +794,7 @@ services:
     profiles: ["pii"]
     image: ${REGISTRY:-ghcr.io/fadenstack}/pii:${VERSION:-latest}
     container_name: faden-pii-worker
+    logging: *faden-logging
     restart: unless-stopped
     command:
       - taskiq
@@ -750,6 +824,7 @@ services:
     profiles: ["mcp"]
     image: ${REGISTRY:-ghcr.io/fadenstack}/mcp:${VERSION:-latest}
     container_name: faden-mcp-migrator
+    logging: *faden-logging
     restart: on-failure:5
     command: ["sh", "-c", "sleep 5 && alembic upgrade head"]
     depends_on:
@@ -772,6 +847,7 @@ services:
       args:
         BASE_IMAGE: ${REGISTRY:-ghcr.io/fadenstack}/base:${VERSION:-latest}
     container_name: faden-mcp
+    logging: *faden-logging
     restart: unless-stopped
     depends_on:
       postgres:
@@ -795,8 +871,10 @@ services:
       FADEN_MCP_REDIS_PASS: ${REDIS_AUTH:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
       FADEN_MCP_REDIS_BASE: 3
       FADEN_MCP_PII_SERVICE_URL: ${FADEN_MCP_PII_SERVICE_URL:-http://faden-pii:8000}
+      FADEN_MCP_PII_SERVICE_TOKEN: ${FADEN_MCP_PII_SERVICE_TOKEN:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
       FADEN_MCP_SERVICE_TOKEN: ${FADEN_MCP_SERVICE_TOKEN:?set it in .env, as faden deploy and faden upgrade do (Help, Installing, Secrets in .env)}
       FADEN_MCP_ENCRYPTION_KEY: ${FADEN_MCP_ENCRYPTION_KEY:?set it in .env; an install that ran without it keeps its data only with the old default value (Help, Installing, Secrets in .env)}
+      FADEN_MCP_ENCRYPTION_KEY_PREVIOUS: ${FADEN_MCP_ENCRYPTION_KEY_PREVIOUS:-}
       # An install that has stored data under the published development key may
       # keep it, with a warning at every start, until it is changed (Help:
       # Installing, Secrets in .env). Outside development the service refuses it otherwise.
@@ -820,6 +898,7 @@ services:
     profiles: ["skills"]
     image: ${REGISTRY:-ghcr.io/fadenstack}/skills:${VERSION:-latest}
     container_name: faden-skills-migrator
+    logging: *faden-logging
     restart: on-failure:5
     command: ["sh", "-c", "sleep 5 && alembic upgrade head"]
     depends_on:
@@ -842,6 +921,7 @@ services:
       args:
         BASE_IMAGE: ${REGISTRY:-ghcr.io/fadenstack}/base:${VERSION:-latest}
     container_name: faden-skills
+    logging: *faden-logging
     restart: unless-stopped
     depends_on:
       postgres:
@@ -885,6 +965,7 @@ services:
     # compose-private.
     image: prom/prometheus:v2.53.0
     container_name: faden-prometheus
+    logging: *faden-logging
     restart: unless-stopped
     ports:
       # Not 9090 on the host: MinIO's API is published there in this stack,
@@ -910,6 +991,7 @@ services:
   loki:
     image: grafana/loki:3.0.0
     container_name: faden-loki
+    logging: *faden-logging
     restart: unless-stopped
     # Loki has no authentication — it must never be reachable from the
     # network. Default to the loopback interface only; set LOKI_BIND
@@ -930,6 +1012,7 @@ services:
     # back needs the backup the upgrade makes.
     image: grafana/grafana:12.4.12@sha256:a3b504df900c24db125e5ec0646f3ac3428db38161302d69f05d0db70a330a90
     container_name: faden-grafana
+    logging: *faden-logging
     restart: unless-stopped
     ports:
       # Dashboards, anonymous read-only (login form disabled), plain HTTP. The
@@ -970,6 +1053,7 @@ services:
     # last. --disable-reporting: no usage reports to Grafana Labs.
     image: grafana/alloy:v1.20.1@sha256:2aa2099af76c0098d4af7a4d6e48f86cb66dc1a000222ad927a1c67c6542d13f
     container_name: faden-alloy
+    logging: *faden-logging
     restart: unless-stopped
     ports:
       - "127.0.0.1:12345:12345"
@@ -996,3 +1080,4 @@ volumes:
   prom_data:
   faden_models:
   faden_rag_lite:
+  faden_chat_files:

{fadenstack-0.4.2 → fadenstack-0.4.4}/src/faden_cli/bundle/shared/nginx/locations.conf

@@ -97,6 +97,7 @@ location = /api/health {
     proxy_set_header X-Real-IP         $remote_addr;
     proxy_set_header X-Forwarded-For   $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host  $http_host;
 }
 
 # ── Backend API (/api/*) ──────────────────────────────────────
@@ -119,6 +120,7 @@ location /api/ {
     proxy_set_header X-Real-IP         $remote_addr;
     proxy_set_header X-Forwarded-For   $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host  $http_host;
 
     # SSE streaming: disable buffering
     proxy_buffering off;
@@ -132,6 +134,25 @@ location /api/ {
     proxy_set_header Connection $connection_upgrade;
 }
 
+# ── Backend API docs (/api/docs, /api/redoc, /api/openapi.json) ─
+# The schema lists every route of the admin API, so it is for a signed-in
+# console session only: the same check as /grafana/ (/_console_access/grafana
+# below). A regex location wins over the /api/ prefix above.
+location ~ ^/api/(docs|redoc|openapi\.json)$ {
+    if (-f /etc/nginx/faden/maintenance.flag) {
+        return 503;
+    }
+    error_page 502 503 = @faden_maintenance_api;
+    auth_request /_console_access/grafana;
+    set $backend http://faden-backend:8000;
+    proxy_pass $backend;
+    proxy_set_header Host              $http_host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host  $http_host;
+}
+
 # ── OpenAI-compatible API (/v1/*) ─────────────────────────────
 # External API clients (curl, SDKs) can hit /v1/* through the
 # same origin instead of needing a separate port.
@@ -146,6 +167,7 @@ location /v1/ {
     proxy_set_header X-Real-IP         $remote_addr;
     proxy_set_header X-Forwarded-For   $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host  $http_host;
 
     # SSE streaming
     proxy_buffering off;
@@ -171,6 +193,8 @@ location /gateway-static/ {
 # ── Gateway API docs (iframe-friendly path) ──────────────────
 # Proxies /gateway-docs/* → faden-gateway /api/*
 location /gateway-docs/ {
+    # Signed-in console sessions only, as for the backend's docs above.
+    auth_request /_console_access/grafana;
     set $gateway_docs http://faden-gateway:8000;
     rewrite ^/gateway-docs/(.*)$ /api/$1 break;
     proxy_pass $gateway_docs;
@@ -178,6 +202,7 @@ location /gateway-docs/ {
     proxy_set_header X-Real-IP         $remote_addr;
     proxy_set_header X-Forwarded-For   $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host  $http_host;
 
     # Rewrite absolute asset paths in Swagger/ReDoc HTML so they
     # load through /gateway-static/ and /gateway-docs/ instead of
@@ -206,6 +231,7 @@ location /grafana/ {
     proxy_set_header X-Real-IP         $remote_addr;
     proxy_set_header X-Forwarded-For   $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host  $http_host;
 
     # WebSocket support for Grafana Live
     proxy_http_version 1.1;
@@ -223,6 +249,7 @@ location = /_console_access/grafana {
     proxy_set_header Cookie            $http_cookie;
     proxy_set_header Authorization     $http_authorization;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host  $http_host;
 }
 
 # ── Frontend (everything else) ────────────────────────────────
@@ -238,6 +265,7 @@ location / {
     proxy_set_header X-Real-IP         $remote_addr;
     proxy_set_header X-Forwarded-For   $remote_addr;
     proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Host  $http_host;
 
     proxy_http_version 1.1;
     proxy_set_header Upgrade    $http_upgrade;

{fadenstack-0.4.2 → fadenstack-0.4.4}/src/faden_cli/cli.py

@@ -98,6 +98,7 @@ def register_core_commands(group: click.Group | None = None) -> None:
     from faden_cli.commands.tls import tls_group
     from faden_cli.commands.ports import ports_cmd
     from faden_cli.commands.maintenance import maintenance_group
+    from faden_cli.commands.secrets import secrets_group
 
     target.add_command(version_cmd, "version")
     target.add_command(doctor_cmd, "doctor")
@@ -120,6 +121,7 @@ def register_core_commands(group: click.Group | None = None) -> None:
     target.add_command(tls_group, "tls")
     target.add_command(ports_cmd, "ports")
     target.add_command(maintenance_group, "maintenance")
+    target.add_command(secrets_group, "secrets")
 
 
 register_core_commands()

{fadenstack-0.4.2 → fadenstack-0.4.4}/src/faden_cli/commands/admin.py

@@ -51,6 +51,8 @@ def reset_password_cmd(*, email: str, password: str | None, yes: bool) -> None:
 
     This bypasses the API and sets the password hash in PostgreSQL.
     The backend container must be running (needed for password hashing).
+    It changes the console sign-in only: Grafana, Langfuse and RabbitMQ
+    have passwords of their own in .env, which it leaves as they are.
     """
     # Validate email early to prevent any injection
     if not _EMAIL_RE.match(email):
@@ -110,8 +112,9 @@ def reset_password_cmd(*, email: str, password: str | None, yes: bool) -> None:
 
     # Both `hashed` (bcrypt output we generated) and `email` (validated
     # above by regex) are safe for SQL string interpolation here.
+    # The sign-ins end with the old password (sessions_valid_after): a reset is often meant to lock someone out.
     sql = (
-        f"UPDATE \"user\" SET hashed_password = '{hashed}' "
+        f"UPDATE \"user\" SET hashed_password = '{hashed}', sessions_valid_after = now() "
         f"WHERE email = '{email}';"
     )
 
@@ -138,6 +141,8 @@ def reset_password_cmd(*, email: str, password: str | None, yes: bool) -> None:
         sys.exit(1)
 
     success(f"Password reset for '{email}'.")
+    # Only the console's password: Grafana, Langfuse and RabbitMQ have passwords of their own in .env.
+    info("Grafana, Langfuse and RabbitMQ sign-ins are not touched: their passwords are in .env.")
 
     # ── 3. Display credentials ────────────────────────────────
     from rich.panel import Panel

{fadenstack-0.4.2 → fadenstack-0.4.4}/src/faden_cli/commands/backup.py

@@ -17,7 +17,7 @@ from pathlib import Path
 
 import click
 
-from faden_cli.core.backup import create_backup
+from faden_cli.core.backup import BACKUP_KINDS, DEFAULT_KIND, create_backup
 from faden_cli.core.compose import build_context_from_config
 from faden_cli.core.console import console, error, info, success, warning
 from faden_cli.core.private_files import private_dir
@@ -44,7 +44,14 @@ from faden_cli.core.settings import load_config
     type=int,
     default=5,
     show_default=True,
-    help="Keep only the N most recent backups.",
+    help="Keep only the N most recent backups of this kind (nightly, manual and upgrade backups count apart).",
+)
+@click.option(
+    "--kind",
+    type=click.Choice(BACKUP_KINDS),
+    default=DEFAULT_KIND,
+    hidden=True,
+    help="What the backup is, recorded in it; --retain only counts backups of the same kind. The nightly timer sets it.",
 )
 @click.option(
     "--db-only",
@@ -60,6 +67,7 @@ def backup_cmd(
     output_dir: str,
     include_volumes: bool,
     retain: int,
+    kind: str,
     db_only: bool,
     yes: bool,
 ) -> None:
@@ -88,6 +96,7 @@ def backup_cmd(
         include_volumes=include_volumes,
         db_only=db_only,
         retain=retain,
+        kind=kind,
     )
 
     if not result.ok:
@@ -113,7 +122,7 @@ def backup_cmd(
 
 @backup_cmd.command("schedule")
 @click.option("--at", "at", default="03:00", show_default=True, help="Time of day, HH:MM (server time).")
-@click.option("--retain", type=int, default=7, show_default=True, help="Keep the N most recent backups.")
+@click.option("--retain", type=int, default=7, show_default=True, help="Keep the N most recent nightly backups.")
 @click.option("--off", is_flag=True, default=False, help="Stop the nightly backup.")
 def schedule_cmd(*, at: str, retain: int, off: bool) -> None:
     """Back up every night, keeping the most recent few.