HomeFeaturesCompareBlogChangelogDeployGitHubGet started

/changelog

Changelog

Honest notes for operators evaluating LazyBackup. GitHub Releases should follow v* tags; the canonical markdown lives in the repo as CHANGELOG.md.

0.2.1

2026-09-04

Added

  • Docker first-run — Compose pulls ghcr.io/ceneka/lazybackup:latest without a required .env (copy-paste docker compose up).
  • README and landing storefront — screenshots and badges on GitHub; Get started points at the Docker snippet; Open Graph card for sharing.
  • GitHub community files — CODE_OF_CONDUCT, PR/issue templates, Dependabot, FUNDING, and package metadata so the repo looks installable.
  • Dashboard first hour — backup recipes and honest empty stats so a new instance does not look like a perfect backup record.
  • 404, PWA, and version — branded 404/error pages, web app manifest, and a visible app version in Settings.
  • Next cron run — the backup form shows when the schedule will fire next (app timezone).
  • Gotify and Slack — failure-webhook and success-ping presets.
  • Config export — Settings downloads a non-secret lazybackup-config.json (no passwords, SSH/S3 keys, token hashes, or age identities). Session-only; no import yet.
  • Update check — Settings (and Status) compare the running version to the latest GitHub release, cached about 24 hours. Offline or rate-limited checks stay quiet.

Changed

  • MCP read_only catalog — mutating tools are omitted from tools/list (still denied at call time). exec_command is only advertised when remote_exec (or a browser session) is allowed.

Fixed

  • Empty dashboard — recipes no longer stack on an empty Backups card; next-run times use a stable locale to avoid hydration mismatches.
  • Restore on Alpine — inspect archives without requiring GNU tar.
  • Landing restore copy — docs match SSH destination pull and host retarget.

Security

  • Fresh authentication required for age vault changes.
  • Safer restore archives (reject unsafe paths / contents).
  • Browser security headers.
  • Logout is caller-local; outbound connections are pinned after validation.
  • LazyBro control/transfer boundaries tightened; peer object streaming uses bounded memory.

0.2.0

2026-08-13

Added

  • Restore from History — Path, volume, and database restore when the artifact is local, on S3, on Bro, or on an SSH destination with key auth (pulled onto this host first). History can restore onto a different host (server picker). Encrypted .age archives decrypt automatically. Password-only SSH destinations cannot pull for restore. Download the artifact without restoring in place (GET /api/history/:id/download).
  • Bro mailbox retention — Version-count and age/min-keep cleanup use the same rules as S3. LazyBackup advertises deletes[]; LazyBro unlinks and acks. Open recalls are skipped until they finish. Restore/download while the peer still holds the blob returns HTTP 202 (waiting)—not a backup failure.
  • Local Docker socket — Volume packs and docker-exec dumps from this host’s Docker, not only a remote SSH server.
  • SQLite dumps — First-class database engine → .sqlite.gz (native file / sqlite3 .backup only).
  • Multi-arch GHCR — linux/amd64 and linux/arm64.
  • LazyBro binaries — linux-x64, linux-arm64, darwin-arm64, darwin-x64, windows-x64 (release tag lazybro).
  • MCP — validate_backup, get_status, and opt-in read_only API tokens (mutually exclusive with remote_exec).
  • Status missed schedules — warn when enabled crons are overdue. Success-ping presets for Discord, ntfy, and Telegram (plus Healthchecks-style GET).
  • Install catalogs — Unraid Community Applications XML and TrueNAS SCALE compose under deploy/.
  • Landing changelog sync — /changelog is generated from this file at landing build time (landing/scripts/sync-changelog.ts); no hand mirror.
  • Landing compare page (/compare) — LazyBackup vs rsync/cron, with short notes on Restic, Borg, and Duplicati. Positions LazyBackup as a From→To control plane (SSH, Docker volumes, DB dumps, MCP), not a dedup archive CLI.
  • Landing changelog (/changelog) — user-facing release notes on the static site.
  • MCP demo callout on the marketing home page — links to the manage backups with MCP guide.
  • Screenshot gallery entries for Status, Encryption (age vault), API/MCP settings, S3 profiles, and Bro Space (capture when a seeded UI is available).
  • Age vault blog — keys, export, and recovery.

Reliability (recent main)

  • CI — tests and build before GHCR publish; Alpine/musl regressions caught in the image pipeline.
  • Concurrent-run lock — the same backup config cannot overlap itself.
  • Failure webhooks — notify on failed runs; method, headers, and {{tag}} body templates (Settings).
  • Backup validate — probes without transferring data; last validation results persist on the config.
  • Secret redaction — server, S3, and backup API responses strip secrets before JSON leaves the process.

Product surface (context for evaluators)

  • Also on recent main (see README / Features for detail): age encryption vault, Bro Space peer destinations, instance meta-backup, WebAuthn passkeys, Status posture page, S3-compatible endpoints, database dumps, MCP + API tokens with optional remote_exec.

Changes

  • Cut GitHub Releases from CHANGELOG on v* tags, and simplify the landing page.
  • Unify resource cards and S3 pages; show S3 and Bro endpoints on backup details.
  • New Backup first-hour UX: VPS path/volume recipes, cron preset chips, and SSH key gate for path transfers.
  • Self-host Inter so next dev does not fetch Google Fonts.

Tagging practice

  1. Keep bullets under Unreleased in CHANGELOG.md, then move them into a dated [X.Y.Z] section when cutting a release.
  2. Tag vX.Y.Z and push; CI publishes the GHCR image for main and v*.
  3. Optionally open a GitHub Release whose body matches that changelog section.
Compare vs rsync →Features →