SimpleDeploy 1.3.0

1.3.0 is the first release since 1.2.0 and it’s a large one. Hundreds of commits, much of it focused on making SimpleDeploy safer to put on a public IP, plus three feature areas worth calling out.

Full notes: CHANGELOG.

Backups v2

The backup subsystem was rewritten end to end.

• Six built-in strategies (sqlite, postgres, mysql, files, docker volumes, custom command), each behind the same interface.
• New scheduler with hot-reload, retention rules, pre/post lifecycle hooks, and a pipeline processor.
• Target detection so the dashboard can suggest the right strategy for each app.
• Per-backup checksum verification.
• A BackupWizard in the UI walks non-technical users through configuration in four steps.
• Per-app Backups tab and a BackupHealthCard on the dashboard.
• Backup events flow through the alert system, so a failed nightly snapshot can page you the same way a downed app does.

Existing backups are migrated automatically.

Multi-endpoint routing and local TLS

The reverse proxy gained two long-requested capabilities.

• Multi-endpoint apps. A single app can publish more than one domain, each routed to a different service. No more splitting an app across compose stacks just to expose two hostnames.
• Local TLS mode. Caddy’s internal issuer can now sign certs for local development or air-gapped installs. The dashboard exposes a trust page with a one-click CA download so a fresh laptop trusts the install in under a minute.
• Shared simpledeploy-public network with container-IP upstreams, removing the host-port hop for proxied traffic.

Realtime UI

The dashboard is now event-driven.

• A notify-only WebSocket bus (GET /api/events) streams state changes; REST stays the source of truth.
• Live terminal output for deploys, restores, and other long-running actions through a new ActionModal.
• Inline scale controls, activity feed, alert history with active-only toggle, deploy-version delete, and a degraded-app status badge.

Security hardening

A coordinated pass closed a long list of issues found during a security review. Highlights:

• JWT signing key derived per install via HKDF from master_secret, plus server-side invalidation via token version.
• Login lockout rekeyed to (user, ip) and CIDR-aware trusted-proxy handling.
• Management dashboard binds to 127.0.0.1 by default; published app ports pin to 127.0.0.1 unless explicitly public.
• WebSocket Origin checks, periodic re-auth on long-lived streams, capped frame sizes on log/deploy streams.
• Per-handler request body limits, panic-recovery middleware, slowloris defenses (ReadHeaderTimeout, IdleTimeout).
• CSP on the SPA, default security headers injected by Caddy.
• Backup restore validates the tar stream and caps gzip decompression to block compression bombs.
• Compose validation expanded to cover container-escape vectors, applied in both deploy and reconciler scan paths.
• Webhook SSRF DNS-rebinding window closed; reserved-IP filter expanded.
• Audit rows recorded for rollback, profile self-update, and gitsync config changes; preserved across app purge.
• Tighter file modes for secrets and app config; hardened simpledeploy.service systemd unit.

A full security architecture and threat model now live in SECURITY.md and the contributor docs.

Upgrade

Homebrew:

brew update && brew upgrade simpledeploy

APT:

sudo apt update && sudo apt install --only-upgrade simpledeploy

Binary tarball: GitHub Releases.

No manual migration steps. Backup v2 migrates on first start; existing schedules keep running.