fix: prevent pipefail abort when redis-cli fails on restarting container

CHANGELOG.md

@@ -1,3 +1,8 @@
+# v1.31.0
+- feat: Integrate full suite CI/CD
+- feat: Update plugins ecosystem documentation
+- chore: Bump all submodules to latest tags
+
 # Changelog
 
 All notable changes to this project are documented here. Format loosely
@@ -8,32 +13,6 @@ orchestration code; see each submodule's own `CHANGELOG.md`
 [sso-manager-node](https://github.com/theta42/sso-manager-node/blob/master/CHANGELOG.md))
 for what changed inside the apps it composes.
 
-## [v1.34.0] - 2026-08-02
-
-### Added
-- **theta-agent**: Added the agent submodule and C2 WebSocket endpoint integrations to the suite.
-- **PKI Certificates**: Integrated PKI certificate generation and management capabilities.
-
-### Changed
-- **Submodules bumped**:
-  - `sso-manager-node` updated to `v1.19.2` (Includes Discovery graph merge fix).
-  - `proxy` updated to `v1.14.1` (Removed invalid documentation copy from Dockerfile).
-  - `jump-host` updated to `v1.16.1`.
-- **`setup.sh`**: Added robust `|| true` fallback to Redis `LASTSAVE` and `CONFIG GET` commands to gracefully bypass snapshoting if the target container is in a crash-loop.
-- **Docs**: Removed all standalone deployment documentation to officially deprecate standalone mode.
-- **CI/CD**: Removed redundant submodule unit test jobs from the main orchestration pipeline.
-
-## [v1.33.0] - 2026-08-02
-
-### Changed
-- **Submodules bumped** for OpenBao secret integration.
-
-## [v1.32.0] - 2026-08-01
-
-### Added
-- **CI/CD**: Added robust GitHub Actions CI/CD workflows for the suite.
-- **Docs**: Updated plugin ecosystem documentation.
-
 ## [v1.31.1] - 2026-08-01
 
 Pairs the sso v1.17.2 post-deploy fixes with the theta-suite half of the

README.md

@@ -140,7 +140,8 @@ Optional extra ports (only if you need them):
 
 ### 4. Docker + Docker Compose
 
-You must use the modern Docker Compose v2 plugin (`docker compose`). The older v1 standalone (`docker-compose`) is not compatible with the BuildKit images generated by this suite and will fail with a `ContainerConfig` KeyError during deployment.
+Any recent Docker with Compose — the v2 plugin (`docker compose`) or the v1
+standalone (`docker-compose`) both work.
 
 ---
 

bootstrap/bootstrap.js

@@ -426,16 +426,12 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		macAddress: HOST_FACTS.mac,
 		os: HOST_FACTS.os,
 		kernel: HOST_FACTS.kernel,
-		sshPort: 22,
 	}, ['stack-host']);
 	await ensure('service', 'SSO Manager', 'sso-manager', host.id, {
 		address: `https://${SSO_HOST}`,
 		port: 3001,
 		gitRepo: 'https://github.com/theta42/sso-manager-node',
 		subType: 'web',
-		icon: 'mdi:shield-account',
-		tagline: 'Home-lab identity and access management.',
-		requestable: false,
 	});
 	// Proxy = the node management UI; OpenResty = the data plane every hostname
 	// in the stack actually flows through (80/443). Two faces, two entries.
@@ -444,9 +440,6 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		port: 3000,
 		gitRepo: 'https://github.com/theta42/proxy',
 		subType: 'web',
-		icon: 'mdi:server-network',
-		tagline: 'Reverse proxy and API gateway.',
-		requestable: false,
 	});
 	// OpenLDAP is independently consumed — Linux hosts authenticate against it
 	// (PAM/SSSD, sudoRole, sshPublicKey) and LDAP-native apps bind directly
@@ -458,12 +451,8 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		address: `ldaps://${LDAPS_HOST}:636`,
 		port: 389,
 		externalPort: 636,
-		portMappings: [{ proto: 'tcp', external: 636, internal: 389, comment: 'LDAPS' }],
 		gitRepo: 'https://github.com/theta42/sso-manager-node',
 		subType: 'openldap',
-		icon: 'mdi:book-open-outline',
-		tagline: 'LDAP directory for identity.',
-		requestable: false,
 	});
 	// Wildcard address: OpenResty fronts every host under the domain (same
 	// */** wildcard convention the proxy's Host records use). Its config lives
@@ -473,9 +462,6 @@ async function seedDirectory(token, clientId, jumpClientId) {
 		port: 443,
 		gitRepo: 'https://github.com/theta42/proxy',
 		subType: 'openresty',
-		icon: 'mdi:router-network',
-		tagline: 'Data plane.',
-		requestable: false,
 	});
 
 	// SSH jump host service (core component — always registered).
@@ -487,9 +473,6 @@ async function seedDirectory(token, clientId, jumpClientId) {
 			port: 3002,
 			gitRepo: 'https://github.com/theta42/jump-host',
 			subType: 'ssh',
-			icon: 'mdi:ssh',
-			tagline: 'Secure SSH jump host.',
-			requestable: false,
 		});
 	}
 
@@ -590,6 +573,7 @@ function writeJumpSecrets(apiToken, oidc, localAdminPass) {
 // sshPublicKey attribute (key injection); for a hardened deployment use a
 // scoped account with an sshPublicKey write-ACL instead (see jump-host README).
 module.exports = {
+\tname: ${JSON.stringify(sso.name || 'SSO Manager')},
 \tldap: {
 \t\t// ldaps:// (636), not ldap:// (389): @simpleworkjs/ldap's client always
 \t\t// sets tlsOptions (see jump-host's models/user_ldap.js), and ldapts

docs/quickstart.md

@@ -12,7 +12,8 @@ description: Step-by-step first run for theta-suite — prerequisites, setup.env
 
 ## Prerequisites
 
-- A Linux host with **Docker + Docker Compose** (you must use the modern `docker compose` v2 plugin; the older `docker-compose` v1 standalone will fail on BuildKit images).
+- A Linux host with **Docker** + **Docker Compose** (the v2 plugin `docker
+  compose` or the v1 standalone `docker-compose` both work).
 - Two hostnames that resolve to the host: one for the SSO UI (your `stack.ssoHost`),
   one for the proxy mgmt UI (your `stack.proxyHost`). On a real network add DNS
   records; for a local try, add them to `/etc/hosts`.
@@ -140,13 +141,6 @@ then converges the stack to your `./config/` values (LDAP service account + admi
 passwords are reset to the config; the OAuth client is kept if `proxy-secrets.js`
 already holds its creds).
 
-> **Troubleshooting: "A newer version is available" after running setup.sh?**
-> If the UI shows this warning immediately after you ran `./setup.sh`, the latest
-> GitHub release tag might not yet be merged into the default tracking branch for
-> the submodules, or Docker may have cached the `COPY` step if the `package.json`
-> didn't change. You can force a clean rebuild by running
-> `docker compose build --no-cache` and then re-running `./setup.sh`.
-
 ---
 
 ## Direct LDAP for LDAP-native clients and Linux hosts

setup.sh

@@ -61,7 +61,6 @@ set -euo pipefail
 
 cd "$(dirname "$0")"
 
-CFG_ADMIN_PASS="${CFG_ADMIN_PASS:-}"
 CONFIG_DIR=./config
 BACKUP_DIR=./backups
 BACKUP_KEEP="${BACKUP_KEEP:-5}"
@@ -796,7 +795,6 @@ HCL
 ensure_policy sso-admin <<'HCL'
 path "secret/data/*" { capabilities = ["create", "read", "update", "delete", "list"] }
 path "secret/metadata" { capabilities = ["list", "read", "delete"] }
-path "secret/metadata/" { capabilities = ["list", "read", "delete"] }
 path "secret/metadata/*" { capabilities = ["list", "read", "delete"] }
 HCL
 # proxy / jump-host — read only their own boot conf.
@@ -1046,7 +1044,7 @@ echo "$JUMP_HOSTS_OUT" | sed 's/^/[setup] /'
 
 # ── 8. Summary ───────────────────────────────────────────────────────────────
 echo
-printf '\033[1;34m[setup]\033[0m \033[1;32mDone. Your SSO + proxy stack is up.\033[0m\n'
+info "\033[1;32mDone. Your SSO + proxy stack is up.\033[0m"
 echo
 echo "  SSO Manager UI:    https://${SSO_HOST}   (fronted by the proxy under TLS)"
 echo "                      first-run fallback: http://127.0.0.1:${SSO_PORT:-3001}"
@@ -1058,7 +1056,7 @@ echo "  Jump host (web):    https://${JUMP_HOST:-jump.${SSO_HOST#sso.}}   (audit
 echo
 echo "  First admin login credentials are in ./config/sso-secrets.js:"
 echo "    user: ${ADMIN_UID}"
-echo "    pass: ${CFG_ADMIN_PASS:-<see ./config/sso-secrets.js>}"
+echo "    pass: ${CFG_ADMIN_PASS}"
 echo
 echo "  Proxy local admin (anti-lockout fallback if the SSO is unreachable):"
 echo "    user: proxyadmin2"