Everlock 0.5.0

The 0.5.0 release makes HTTPS zero-config, turns the mail backend into a well-behaved internet citizen (outbound STARTTLS, inbound SPF/DKIM verification), and removes the last server restarts from everyday administration — image instances now hot-reload, and server settings are a single documented registry. Binaries are on the download page; container images are published under the 0.5 tag family (cr.everlock.sh/everlock:0.5-qwen3, cr.everlock.sh/everlock:0.5-smolvlm).

Highlights

• Zero-config HTTPS. The ACME contact email is optional — with none set, the account is registered without a contact and certificates for public vhosts issue automatically. A contact can be added at runtime with /server settings set acme.email you@example.com.
• One documented settings entry point. /server settings is backed by a registry of known keys: list shows every key with its value, default, and whether a change applies live or at the next restart; unknown keys and malformed values are rejected; unset returns a key to its default.
• Image instances hot-reload. /image create|set|unset|delete applies live — the backend builds the new instance at runtime and swaps it in. Creating a gallery is a one-liner again, with no restart and no dropped connections.
• Mail, hardened. Outbound delivery and forwarding use STARTTLS whenever the receiving server offers it. Inbound mail is verified against SPF and DKIM, with verdicts recorded in Authentication-Results and exposed as rule conditions. SMTP AUTH is accepted only on encrypted connections, and recipient addresses are validated against the configured domains.
• Identity persistence, fail-closed. User grants persist at mutation time with full credentials, a boot that cannot load its users refuses to start, and /users reload applies store-side identity changes to a running server.
• Admin console polish. /server info reports the running binary's version, commit, variant, and platform; incomplete commands answer with usage lines; AI admin tools reliably invoke the command they name.

Breaking

• /settings is now /server settings. Scripts driving the admin console need the new prefix: /server settings list|get|set|unset.
• SMTP submission requires TLS for AUTH. Clients that authenticated over plaintext connections are rejected with 538 5.7.11 — enable STARTTLS (port 587) or implicit TLS in the client.
• DLNA ContentDirectory browsing is removed. The endpoints answered without authentication while the advertised media URLs never resolved. .local vhosts still appear in Windows "Network" as UPnP devices that open the gallery, and mDNS announcement is unchanged.

Upgrading

Self-updating servers pick 0.5.0 up on their daily check. For a manual upgrade, download the new binary (or pull the new image tag) and restart — stores, mail, and all versioned content carry over untouched. The full list of changes is in the changelog.