Everlock 0.6.1

The 0.6.1 release finishes what 0.6.0 started. Administration now has a third outlet — a plain HTTP API with an OpenAPI document and a Swagger UI — generated from the same command registry as the SSH console and MCP. And the API keys that release introduced now work everywhere a password does: calendar clients, contacts clients, registry pulls, protected sites. Binaries are on the download page; container images stay in the 0.6 tag family (cr.everlock.sh/everlock:0.6-qwen3, cr.everlock.sh/everlock:0.6-smolvlm).

Highlights

• Admin HTTP API, OpenAPI, and Swagger UI. Every admin command is a POST /api/<verb path> — POST /api/dns/records/create — served next to the dashboard on the admin vhost. The routes, the OpenAPI 3.1 document at /api/openapi.json, and the Swagger UI at /api all come from the one command registry the SSH console and MCP already use: operation ids equal the MCP tool names, request schemas are the MCP input schemas verbatim, and drift tests hold the projections together. Requests authenticate with HTTP Basic from a browser or a Bearer API key from a script.
• One authentication primitive for every HTTP surface. A single AuthenticatedUser extractor resolves Basic credentials and Bearer API keys, and every backend declares it instead of parsing headers itself. The practical result: an evapi_… key now works wherever a password did — CalDAV and CardDAV clients, OCI registry pulls, protected sites, the OAuth login form. Every 401 answers with the same Basic realm="Everlock", Bearer challenge.
• Per-command authorization, everywhere. The admin outlets' system-admin entry gate is gone. Any authenticated user reaches the admin surfaces and the command engine authorizes each command on its own, exactly as it does over SSH: reads answer with the actor's own resources, privileged commands still require system admin.
• /jobs list shows the next scheduled run. Each handler reports when its schedule loop next fires — next 2026-08-04 10:26 (in 1d 1h) — read from the live loop's armed sleep rather than re-derived from the interval.

Behavior changes

• Admin outlet vhosts are server settings. admin.http.vhost and admin.mcp.vhost in /server settings replace the /backends vhost command, which is removed. The --backend-admin-*-vhost flags remain as bootstrap values; the setting wins and applies at the next restart.
• MCP accepts Basic credentials alongside Bearer API keys, sharing the one credential resolution with every other HTTP surface.

Fixes

• Photo frames receive their native format. Frames announce their firmware as a release tag — v2.15.0 — and the version gate read the leading v as an unparsable version, so every device fell through to the JPEG fallback and had to decode and dither on its own. Frames now get pre-rendered EPDGZ as intended. The fallback JPEG also arrives in the panel's native layout, which spares the device a rotation it cannot always allocate on a large panel.
• Sitemap lastmod dates are per-page and stable, instead of every page carrying the last deploy's date. The underlying store fix — history(path) now reports only the commits that touched that path, and a no-op write leaves history alone — also sharpens CalDAV and CardDAV getlastmodified.
• Self-update completions survive the restart. A self-update run raced its own Succeeded record, so the run that applied an update could leave no trace in /jobs list history. The restart now waits until the terminal record is durably committed.
• Markdown pages with dots in the slug render — a route like /updates/2026-08-02-0.6.0-release answered 404 because the version dots looked like a file extension.

Upgrading

Self-updating servers pick 0.6.1 up on their daily check. For a manual upgrade, download the new binary (or pull the new image tag) and restart — stores, mail, and all versioned content carry over untouched. The full list of changes is in the changelog.