0.15.0 — 2026-10-12
The image carries the Ory and edge policy and renders it from the deployment's env and content tree at `/etc/othala`. This is a breaking release: an existing deployment follows the seven Deployment changes steps in CHANGELOG.md, and `deploy/example/` is the end state.
- `node dist/server/config.mjs render` writes `kratos.yml`, `hydra.yml`, the courier templates and `othala.caddy` from env and the content root. It refuses a blank secret, a leftover `${` and malformed YAML, and writes owner-only files. `check` validates env and content offline; `gen-secrets` mints every secret except the SMTP URI.
- `othala.caddy` holds three snippets: `othala-routes`, `othala-forward-auth` and `othala-oidc-app`. They strip client-supplied identity headers by family, rate-limit device and self-service, and answer 403 and 503 in place.
- Content moves to `/etc/othala` (`apps/`, `groups.yaml`, `courier/`). A retired or unknown `OTHALA_*` env name stops the portal and fails `check`.
- `deploy/example/` is a compose deployment, and e2e runs it. Every Ory service runs as uid 10000.
- `scripts/render-config.sh`, `caddy/Caddyfile`, `caddy/snippets/` and `e2e/gen-secrets.sh` are removed.
- Opening Admin from a session that needed a second factor now returns to the admin page instead of a not-found page.
- The `:latest` image tag and its signature move only on a release tag.
- Deployment: breaking; see Deployment changes in CHANGELOG.md.