Release 1.8.1: Redis persistence fix (#20)

in-flight OAuth logins, and any admin-created API token

redis-server ran with --save '' --appendonly no (deliberately ephemeral,
per the original "audit/metrics/session storage" framing). That stopped
being a safe assumption once API tokens (PATs) lived in this same Redis
-- a PAT is supposed to be a stable, long-lived credential, not
disposable session state, but every `docker rm -f jump-host` + rebuild
silently invalidated every one that existed.

Matches proxy's existing pattern exactly: AOF + periodic RDB persisted
to $REDIS_DATA_DIR (default /data), which the deployment mounts as a
volume (see the companion theta-env change).

Verified against a live container: minted a real PAT, force-recreated
the container (docker rm -f + rebuild), confirmed the same token still
authenticates afterward.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project are documented here. Format loosely
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions
 correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
+## [1.8.1] - 2026-07-28
+
+### Fixed
+- **Redis had zero persistence** (`--save '' --appendonly no`, no data-dir volume) — every container rebuild/recreation silently wiped all sessions, in-flight OAuth logins, and any admin-created API token. This is why re-running `setup.sh` appeared to "break OAuth with jump": the jump-host container gets recreated, and any token or in-flight login vanished with it. Now Redis persists (AOF + periodic RDB) to `/data`, mounted as a named volume (`jump-redis-data`) in theta-env's compose file. Verified live: minted a PAT, force-recreated the container, confirmed the same PAT still authenticated afterward.
+
 ## [1.8.0] - 2026-07-28
 
 ### Fixed

docker-entrypoint.sh

@@ -12,9 +12,17 @@ if [[ -f /config/jump-secrets.js ]]; then
 	info "Loaded config from /config/jump-secrets.js"
 fi
 
-# Redis for audit/metrics/session storage (app connects to 127.0.0.1:6379).
+# Redis for audit/metrics/session AND api-token storage (app connects to
-info "Starting redis..."
+# 127.0.0.1:6379). Persisted (AOF + periodic RDB) to /data, which the
-redis-server --daemonize yes --save '' --appendonly no
+# deployment should mount as a volume -- without this, every container
+# recreation silently wiped every session, in-flight OAuth login, and any
+# admin-created API token, which is especially bad for the last one since a
+# PAT is meant to be a stable, long-lived credential, not session state.
+REDIS_DATA_DIR="${REDIS_DATA_DIR:-/data}"
+mkdir -p "$REDIS_DATA_DIR"
+info "Starting redis (AOF persisted to $REDIS_DATA_DIR)..."
+redis-server --daemonize yes --dir "$REDIS_DATA_DIR" --appendonly yes \
+	--appendfilename appendonly.aof --save 900 1 --save 300 10 --save 60 10000
 
 # Wait for redis to answer before starting the app.
 for _ in $(seq 1 20); do

nodejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "t42-jump-host",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
   "author": [
     {