Repository navigation
docs: 0.1.0 upgrade notes for retention, encryption key and closed signup #152
Description
Items that docs/releases/0.1.0.md and the PT-BR docs must cover before the 0.1.0 tag. They come from the reviews of #148, #149 and #150.
- feat(backend)!: 30-day default recording retention and THINKER_RECORDING_* names #148 (Gravações de requisição: retenção padrão de 30 dias #28):
- Recordings now default to 30-day retention, down from 365. On upgrade, the next retention run deletes recordings older than 30 days. Set
THINKER_RECORDING_RETENTION_DAYS=365to keep the old behavior. - The
REQUEST_RECORDING_*variables are renamed toTHINKER_RECORDING_*.
- Recordings now default to 30-day retention, down from 365. On upgrade, the next retention run deletes recordings older than 30 days. Set
- feat(backend)!: require THINKER_ENCRYPTION_KEY, separate from BETTER_AUTH_SECRET #150 (THINKER_ENCRYPTION_KEY obrigatória e separada do BETTER_AUTH_SECRET #27):
THINKER_ENCRYPTION_KEYis mandatory and has no fallback toBETTER_AUTH_SECRET. It must be at least 32 characters. To rotate the key, useTHINKER_ENCRYPTION_KEY_PREVIOUS. - feat(backend)!: close public sign-up and require a one-time setup token #149 (Fechar o cadastro público depois do primeiro admin #29):
- Public signup is closed.
- The first admin needs the one-time setup token, which is printed in the server log.
THINKER_ALLOW_SIGNUP=truereopens signup.
- The deploy templates and compose must use
THINKER_RECORDING_*and setTHINKER_ENCRYPTION_KEY. The repo-wide rename PR covers this.
Agente responsável: docs-ptbr (notes), devops/rename PR (templates)
Activity
patrickbrandao commentedon Oct 14, 2026
Added from the #150 review (should-fix 1 and nits):
Document the upgrade recipe for installs that relied on the old
BETTER_AUTH_SECRETfallback:THINKER_ENCRYPTION_KEY.THINKER_ENCRYPTION_KEY_PREVIOUSto the oldBETTER_AUTH_SECRET.The recipe goes in DOCKER_README, the dev guide and the 0.1.0 notes, and the missing-key boot error should point to it.
Fix the
docker/install.shcomment that still mentions the fallback (lines 291-296).Mention this use of PREVIOUS in the
crypto.util.tsdoc comment.patrickbrandao commentedon Oct 14, 2026
From the #150 qa-docker run: pass
THINKER_ENCRYPTION_KEY_PREVIOUS=${THINKER_ENCRYPTION_KEY_PREVIOUS:-}in thedocker/docker-compose.ymlenvironment and document it indocker/.env.example. Without it, key rotation needs a compose override.patrickbrandao commentedon Oct 14, 2026
From #29 (PR #149): the one-time setup token lives in the memory of each process, so on a multi-replica deploy the first setup must hit the replica whose log printed the token (or run with a single replica until the admin exists). Document this alongside the other multi-replica notes.