Changelog

All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

(no unreleased changes yet)

First semver release. Brings this template to the fleet standard established in keycloak-traefik-letsencrypt-docker-compose v1.2.0.

Credentials untracked from git. The repository previously shipped a tracked .env with a generated-looking database password; anyone who deployed without editing it ran production on credentials published on GitHub. .env is now gitignored; .env.example ships change_me_* placeholders with generation commands, and the compose file fails fast via ${VAR:?} when required secrets are unset.
Zabbix bumped 6.4.6 → 7.0.30 LTS (server, web, and agent2 images move together). The 6.4 line has been end-of-life since 2024-12-31; 7.0 is the LTS line supported until 2029. The server migrates the database schema automatically on first start — back up before pulling.
Traefik bumped 3.2 → 3.7 (traefik:3.7@sha256:9c2a54d8…). Traefik 3.2's vendored Docker client cannot talk to Docker Engine 29 — the docker provider fails in a retry loop and the stack silently serves 404s on hosts running current Docker.
All five images pinned by tag@sha256:digest (postgres:15 digest-pinned; PostgreSQL major deliberately unchanged so existing data directories keep working).

Image pins live in the compose file as interpolation defaults (x-images block): git pull alone delivers the tested version combination, .env carries only secrets and deliberate overrides, and an override set in .env still wins.
Operational variables (log level, timezone, DB names, cache size, backup schedule and paths) now have compose-level defaults — the minimal .env is secrets and hostnames only.
Backup-loop variables escaped ($$VAR) so the container shell resolves them at runtime from the environment: block, where the compose-level defaults live.

Deployment Verification workflow rebuilt: shellcheck + actionlint lint job; Trivy scans of all five pinned images (SARIF to the Security tab); weekly check-pin-freshness job that re-resolves every pinned tag against its registry, compares the pinned Zabbix version against the latest patch of its LTS line via endoflife.date (failing loudly if the line itself goes EOL), and checks the Traefik minor against the latest upstream release; and a deploy-and-test job that stands up the full stack with ephemeral credentials, waits for the zabbix-server healthcheck, and requires the web API (apiinfo.version) to answer through Traefik — the shipped configuration must produce a working Zabbix instance, not just started containers.

Shellcheck findings in the restore script (read -r, removed an unused unquoted variable).