Changelog

New features, improvements and fixes, newest first.

v1.5.0

Safer PHP servers and deploys

  • PHP security updates. Unattended upgrades now install security fixes for the PHP versions that come from the third-party source (ondrej/php on 24.04, deb.sury.org on 26.04), not only for the PHP Ubuntu ships, and the version Ubuntu ships stays on Ubuntu's own builds. Existing servers get the change, and the PHP updates waiting for them, through a fleet rollout. This follows two critical PHP flaws fixed on 21 October (CERT-EU 2026-018).
  • Graceful PHP-FPM reloads. The PHP-FPM reload at the end of a deploy lets requests that are already running finish, for up to 30 seconds, instead of answering them with a 502. Existing servers get it through a fleet rollout or their next PHP deploy.
  • A deploy no longer cuts nginx off from the site's directory for a moment while it prepares the release.
  • New Hummingbird 2 and Vapor projects made from their current templates listen on the port Provisore assigns, so their first deploy passes its health check.
  • A deploy gated on GitHub checks waits while a required workflow is still running instead of being refused, and a required check counts only when it comes from the app that should report it.
  • Rolling back across a Provisore update restores the nginx configuration the release ran with.
  • Every site runs as its own Unix account. The older shared-account mode is gone.
  • Uptime percentages cover the whole window you choose.
  • Saving an environment file that changed since you opened it is refused instead of overwriting the newer version.
  • A security review before launch closed paths that let a Member do more than the role allows, including reaching root on a server, and hardened the GitHub integration, billing webhooks and outgoing requests.
v1.4.0

Terminal, snapshots and costs

  • Browser terminal. A shell on a server in the app's console, as the deploy user or as one site's own account. A session belongs to the sign-in that opened it, and its processes end when it closes.
  • Snapshots and volumes. Snapshot a Hetzner server's disk, then restore it or create a new server from it. Attach, grow and move block volumes between servers.
  • Infrastructure costs. What your servers, volumes, snapshots, object storage and Provisore plan cost a month, priced from Hetzner where Provisore can ask, with a monthly history, CSV export and right-sizing from real load.
  • Checks and promotions. Hold deploys until a repository's GitHub checks pass, and promote the exact commit running on one site to another.
  • Object storage. Connect an S3-compatible account on AWS, Cloudflare R2 or Hetzner and manage its buckets in the app. Backups lists every server's backups in one place.
  • Nginx includes and environment files a site's own account could edit moved to root-owned paths on every server, applied across the fleet.
v1.3.0

The app, rebuilt as a workspace

  • Today. The app opens on what needs someone across every server and site: a failed deploy, a certificate that did not issue, a crashed worker, a missed backup, an open incident. Each row carries its fix, such as Redeploy, Retry certificate or Back up now. E runs it, and H snoozes the row for a day.
  • Fleet sidebar. Every server and its sites, with live status, a spinner on anything deploying and the step a provisioning run has reached. Pin servers to the top, and filter the list once it is long.
  • Action-first ⌘K. Deploy a site, follow its log, restart nginx or PHP-FPM, or run a recipe, starting from the site or server on screen. An action that cannot run now says why.
  • Console dock. Job output and live log tails open as tabs along the bottom of the app and keep streaming while you move between pages. ⌃` shows or hides it. The separate server log pages are gone, and their old links open the dock.
  • Site inspector. ⌘. opens a site's branch, deploy on push, PHP version, linked databases and maintenance mode beside the page. A change applies at once and can be undone from the toast that confirms it.
  • Four settings pages. Account, Team, Billing and Connections hold every setting that is not a server's or a site's. Account now lists each browser and app signed in as you, and signs out any one of them or all the others.
  • Each deployment lists its stages with how long each took, and a failed one names the stage it stopped in.
  • Jobs and deploys name the teammate who started them, and Activity filters by person.
  • Server vitals include network traffic in and out. A server running an older metrics collector links to the update.
  • Ubuntu 26.04 by default. New servers start on Ubuntu 26.04. Swift sites run there from Swift 6.4.0, the first release swift.org builds for it, and an older version is refused when the site is created instead of failing mid-deploy.
  • Through the API, a Swift site can move to another toolchain. The switch is a deploy: the live release keeps serving while the new one compiles, and one that fails its build or its health check leaves the site where it was.
  • Acciti. A fifth notification channel, beside Slack, Discord, email and webhooks. Alerts arrive as push notifications on iPhone, Apple Watch and Mac, and every delivery is signed.
  • provisore.yml. A file at the root of a repository that says what it builds and which paths each domain serves. The deploy reads it from the commit being deployed, refuses one that does not validate before anything is built, and creates, updates or removes the daemons it declares.
  • A static site can name its 404 page, along with the client-side routes that should still fall back to index.html, so a missing path gets a real 404 instead of the home page.
  • A daemon tied to a site reads the site's environment file, and a site's build steps see the variables its build settings allow, bundler included.
  • A deploy that fails its health check prints the service's state and the last lines of its journal, so a process that exits on startup says why.
v1.2.0

Servers that can reach each other

  • Private networks. A WireGuard mesh across your servers, on any provider and on machines you brought yourself. Each server generates its own key and Provisore never holds the private half. The mesh works across datacentres, which a provider's own private network does not.
  • Managed databases and caches can be reached over that mesh, so an application server and its database can be separate machines. An engine stays on loopback until you expose it and is never bound to a public interface. A database user you grant network access is limited to that network.
  • Server roles. A server can be provisioned for what it is for. A database or cache server gets the security baseline and no web stack: no nginx, no certbot, and a firewall that opens SSH only.
  • Migrating off Laravel Forge is out of preview. Provisore reads an estate through the Forge API and a read-only SSH scan and recreates it on a fresh server, without changing the machine you are leaving. You move the data yourself, and the guide covers how.
  • Servers report the updates waiting on them and whether a reboot is pending, including security updates that unattended-upgrades skipped.
  • Provisore tells you when a server is running an older version of its own provisioning, and can re-apply it. Before this, a provisioning fix only reached servers connected after it shipped.
  • Uptime checks can speak TCP and WebSocket, so a database port or a socket server can be checked directly instead of through an HTTP request it was never meant to answer.
  • Sites and servers carry a status that names what is wrong, such as a failed certificate, a deploy that did not land or a daemon that stopped.
  • Logs are colour-coded by severity, timestamp, address and path, in the viewer, the live tail and deploy output.
v1.1.0

Web services

  • Web services. Put a domain in front of a process you run yourself. Provisore terminates TLS and reverse-proxies to the port you name, WebSockets included. You can name the daemon behind the port so the domain and the process show each other, and one daemon can back several services.
  • Static file hosting. A directory Provisore creates and serves but does not build. There is no repository and no deploy pipeline. Copy files in over rsync and they are live.
  • fail2ban no longer counts harmless connection events toward the SSH ban threshold, so a port scan, a monitoring probe or an interrupted handshake cannot lock you out of your own machine.
v1.0.0

Provisore 1.0

  • Provisioning. Bring your own Ubuntu VPS or create one on Hetzner, provisioned over SSH with nginx, PHP, Node and free SSL.
  • Deployments. Push-to-deploy from GitHub, atomic releases with one-click rollback, and live deploy log streaming.
  • Queues, daemons & cron. systemd-supervised workers and scheduled jobs, managed from the app.
  • Databases & backups. Managed databases with per-site users and rotating credentials, plus scheduled backups to your own S3 bucket.
  • Monitoring. Uptime checks, server metrics, and alert rules on load, memory and disk.
  • Notifications. Deploy, server, certificate, backup and uptime events delivered to Slack, Discord, email, or your own HTTPS endpoint.
  • Security. TOTP two-factor with recovery codes, secrets encrypted at rest, an append-only audit log, and every site running as its own isolated Unix account.
  • API. A versioned REST API behind scoped, revocable access tokens, covering everything the app does.