Tedarikçi erişiminde ne değişti — sürüm sürüm, en yenisi üstte.
v0.4.2
A proper visual identity. The console now has a real logo, a typeface with intent, and a refined palette — a more deliberate, enterprise feel throughout.
Highlights
New logo mark. An "aperture gate" glyph — two chevrons closing toward a guarded passage — replaces the generic gradient square, in the sidebar, on the login and setup screens, and as the browser-tab favicon.
IBM Plex type system. Headings and the wordmark are set in IBM Plex Sans; the console's labels and tables move to IBM Plex Mono. Self-hosted (no third-party font CDN); body text stays on the fast system font.
Refined accent. The brand blue deepens into a "Deep Azure" — the old blue→purple gradient (and the purple button-hover) are gone, for a calmer, more coherent look. Both light and dark themes tuned.
Small chrome touches: a themed browser-tab colour and a cleaner page-title format.
Upgrade — trivial
Manager-only, non-breaking. Pull the new manager image and restart it. No connector or data-plane change, no re-enrollment, and no prisma db push — nothing about the schema or data changes.
The dataplane and connector images are re-published at 0.4.2 for version parity but are behaviorally identical to 0.4.1.
New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.
v0.4.1
A real admin dashboard. The post-setup admin home is now an at-a-glance operations overview instead of a bare row of counts.
Highlights
KPI cards. Five stat cards across the top — Connectors online, Sites reachable, Active grants, Pending approvals, Unread alerts — each a live count that links straight to its page. Cards that need attention (pending approvals, unread alerts, sites down) carry a soft accent so they stand out at a glance.
Site health panel. Every Site with its reachability (Reachable / Down / Unknown), latency, and last-checked time — the same signal as the Sites page, summarized on the home screen.
Recent activity panel. The latest allowed and denied access requests from the audit trail, so you can see what's happening without opening the full audit log.
The getting-started checklist is unchanged for a fresh, not-yet-configured install; vendors get a one-line summary of their active grants.
Upgrade — trivial
Manager-only, non-breaking. Pull the new manager image and restart it. No connector or data-plane change, no re-enrollment, and no prisma db push — this release is read-only and changes no schema.
The dataplane and connector images are re-published at 0.4.1 for version parity but are behaviorally identical to 0.4.0.
New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.
v0.4.0
Know when a site goes down. The per-site health probe now raises a notification when a Site becomes unreachable — and again when it recovers. See it in the admin console (a nav bell with an unread count and a notifications list), and optionally push it out to Slack/Teams or any endpoint via a webhook. No mail server required.
Highlights
Down / recovered notifications. The health cron is edge-triggered: it notifies once when a Site transitions to down, and once when it comes back — never every cycle while it stays down. A newly-added, immediately-unreachable Site notifies too.
In-console surface. A Notifications entry in the admin sidebar shows an unread badge; the /admin/notifications page lists events (Down / Recovered, site, reason, relative time) with a one-click Mark all as read.
Optional webhook. Set NOTIFICATION_WEBHOOK_URL and each event is POSTed best-effort as JSON with a ready-to-render text line (Slack/Teams incoming webhooks read text) plus structured fields (event, site, detail, at). Unset = disabled. A slow or failing webhook never affects the health run.
The connector ↔ data-plane tunnel protocol is unchanged — no connector or data-plane redeploy is required, and no re-enrollment.
1. Pull the new manager image and restart it. (The dataplane and connector images are re-published at 0.4.0 for version parity but are byte-identical in behavior to 0.3.0.)
2. Run prisma db push — adds one new Notification table (additive, non-destructive).
3. (Optional) set NOTIFICATION_WEBHOOK_URL in your .env to enable outbound alerts — it is now wired through to the manager in both the dev and production compose files.
Notes & limits
The probe is TCP-connect (as of 0.3.0): it proves the port is reachable, not that the app is serving HTTP correctly.
Notifications are edge-triggered on the cron cadence; there is no flapping debounce yet, so don't schedule the health cron faster than a run takes. Email delivery and per-site notification toggles are planned fast-follows.
New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.
v0.3.0
Lightweight health checks. The automatic per-Site health probe now does a TCP connect through the connector (and reports latency) instead of a full HTTP GET /. It never sends a request to the app, so it doesn't trip auth walls or clutter app logs — and you see reachability at a glance in the console.
Highlights
TCP-connect probe. A new probe tunnel frame; the connector opens a TCP connection to the Site's internal address and reports reachable/unreachable + latency. Zero HTTP traffic to the app.
Same egress boundary. A probe is constrained by the same ALLOWED_TARGETS boundary as a proxied request — it can only reach what a dial can.
Latency in the console. The Sites list shows Reachable · N ms (or the failure reason).
Manual "Test connection" unchanged. That button still does a full HTTP round trip — the two are complementary: TCP for continuous/automatic, HTTP for on-demand verification.
> Note: a TCP connect proves the port is reachable, not that the app is serving HTTP correctly — a deliberately lighter signal than the manual HTTP test.
⚠️ Breaking — upgrade in lockstep
The connector↔data-plane tunnel protocol changed (a new probe frame + a kind field on the dial frame).
1. Pull all three images and restart together — manager, dataplane, connector. No connector re-enrollment; the token in /data persists.
2. Run prisma db push — adds a nullable Site.probeLatencyMs column (non-destructive).
New here? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.
v0.2.0
Config-less connectors. The internal address of an app no longer lives in the connector's UPSTREAMS env — it's now a property of the Site, defined in the Manager and carried to the connector per-request over the tunnel. Adding an internal app is a one-line change in the console, with no connector edit and no restart.
Highlights
No more UPSTREAMS. The generated connector docker run has nothing to hand-edit — just the manager URL, the tunnel URL, and the pairing code.
Sites hold the internal address. Each Site has an Internal address (http://host:port), validated on save. That's the only place the real address lives on the control plane.
Optional ALLOWED_TARGETS boundary. By default a connector dials whatever target the Manager routes to it. Set ALLOWED_TARGETS (e.g. 10.0.5.0/24, a host, or host:port, comma-separated) on the connector to cap what it may reach — useful for regulated / security-sensitive deployments. The connector's path-injection guard is unchanged.
⚠️ Breaking — upgrade in lockstep
The connector↔data-plane protocol and the Site schema both changed. Upgrading one side without the other will not work.
1. Pull all three images and restart together — manager, dataplane, and connector. Connectors do not need to re-enroll (the token in /data persists), just restart on the new image.
2. Run prisma db push. It drops the old upstreamName column and adds upstreamUrl. Existing Sites come out blank and won't route until you set an address.
3. Open each Site and set its Internal address (http://host:port).
4. Drop UPSTREAMS from your connector docker run. Optionally add -e ALLOWED_TARGETS=... to constrain it.
See deploy/README.md → Updating → Breaking change: v0.2.0 for the full walkthrough.
New to the project? Quickstart — a working demo in ~5 minutes with zero DNS. License: Apache-2.0.
v0.1.0
Captivo Access is a self-hosted, VPN-less Zero-Trust access product for giving third-party vendors time-boxed, audited access to internal web applications — without a VPN, without inbound firewall holes, and without handing out network-level reach.
A browser reaches the Manager (in your cloud/DMZ) over HTTPS with a passkey; the Manager talks to a Connector (deep in your network, outbound-only — no inbound ports) over a persistent tunnel; the Connector reverse-proxies to the internal app. Every request is identity-checked and recorded.
This is the first tagged release.
What's included
Passkey-first identity — WebAuthn/passkey login with TOTP recovery; DB-backed revocable sessions; first-admin setup and invite flow.
Outbound-only connector tunnel — a Go data-plane (WSS + yamux) and connector; the connector holds a local allowlist and opens no inbound ports.
Identity-aware reverse proxy — a transparent proxy that resolves the session, the target site, and the access decision on every request.
Approval flow — vendors can request access; admins approve or deny; unapproved requests never grant access.
Recurring schedules — restrict a grant to weekly windows (e.g. weekdays 09:00–18:00) in a chosen timezone.
Tamper-evident audit trail — an append-only, hash-chained log that detects alteration, deletion, splicing, and tail-truncation, with an admin integrity check.
Timezone-aware and self-contained: no external services are required to run it.
Container images
Published to GitHub Container Registry, tagged 0.1.0 and latest:
A production Compose stack with automatic HTTPS (Caddy) is under deploy/ — copy .env.prod.example, set your domain and secrets, and bring it up. The Manager's admin UI generates the exact docker run command to install a Connector inside a customer network.
Notes
Early release — expect rough edges. Feedback and issues are welcome. License: Apache-2.0.