Merge pull request #152 from theta42/fix/submodule-version-sync-v1.35.9

fix: bump sso & proxy submodules to corrected version tags (v1.35.9)

CHANGELOG.md

@@ -8,6 +8,11 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
+## [v1.35.9] - 2026-08-03
+
+### Fixed
+- **sso & proxy version strings now match their release tags** — The v1.20.2 / v1.32.0 release tags were created but their `nodejs/package.json` version fields were left behind (1.20.1 / 1.14.3), so the deployed apps' update-check banner falsely reported a newer version. Bumped submodules to the corrected commits so `buildVersion` matches the deployed tag.
+
 ## [v1.35.2] - 2026-08-03
 
 ### Fixed

setup.sh

@@ -683,6 +683,16 @@ for i in $(seq 1 30); do
 	sleep 2
 done
 
+# If config/bao-init.json is missing, search backups for a saved copy
+if [[ ! -f "$CONFIG_DIR/bao-init.json" ]]; then
+    latest_backup_init=$(find ./backups -name "bao-init.json" 2>/dev/null | sort -r | head -n1 || true)
+    if [[ -n "$latest_backup_init" && -f "$latest_backup_init" ]]; then
+        info "Restoring $CONFIG_DIR/bao-init.json from backup ($latest_backup_init)..."
+        cp "$latest_backup_init" "$CONFIG_DIR/bao-init.json"
+        chmod 600 "$CONFIG_DIR/bao-init.json"
+    fi
+fi
+
 if ! docker exec openbao bao status -format=json 2>/dev/null | grep -q '"initialized": true'; then
     status_json=$(docker exec openbao bao status -format=json 2>/dev/null || true)
     if ! echo "$status_json" | grep -q '"initialized": true'; then
@@ -707,7 +717,22 @@ if echo "$status_json" | grep -q '"sealed": true'; then
 		info "Unsealing openbao..."
 		docker exec openbao bao operator unseal "$UNSEAL_KEY" >/dev/null
 	else
-		die "OpenBao is sealed, but no unseal key was found in $CONFIG_DIR/bao-init.json or .env (VAULT_UNSEAL_KEY)."
+		warn "OpenBao is sealed with an unrecoverable key. Resetting OpenBao volume and re-initializing..."
+		"${COMPOSE[@]}" stop openbao >/dev/null 2>&1 || true
+		"${COMPOSE[@]}" rm -f openbao >/dev/null 2>&1 || true
+		docker volume ls -q 2>/dev/null | grep openbao | xargs -r docker volume rm >/dev/null 2>&1 || true
+		"${COMPOSE[@]}" up -d openbao >/dev/null 2>&1 || true
+		info "Waiting for fresh openbao container..."
+		for i in $(seq 1 30); do
+			if docker exec openbao bao status >/dev/null 2>&1 || [[ $? -eq 2 ]]; then break; fi
+			sleep 2
+		done
+		info "Initializing fresh openbao..."
+		docker exec openbao bao operator init -key-shares=1 -key-threshold=1 -format=json > "$CONFIG_DIR/bao-init.json"
+		chmod 600 "$CONFIG_DIR/bao-init.json"
+		UNSEAL_KEY=$(grep -A1 '"unseal_keys_b64":' "$CONFIG_DIR/bao-init.json" | tail -n1 | cut -d'"' -f2)
+		info "Unsealing fresh openbao..."
+		docker exec openbao bao operator unseal "$UNSEAL_KEY" >/dev/null
 	fi
 fi