KITPro Server 0.1.0-alpha.14: Opt-in ingress and a clearer first-run setup
KITPro Server v0.1.0-alpha.14 was published on October 29, 2026 as a public alpha. It introduces KITPro-managed nginx ingress, administrator-provided TLS certificates, and a guided nine-step first-run setup. The release connects host readiness, application isolation, and recovery without automatically making installed applications public.
Release record
KITPro Server 0.1.0-alpha.14 · Public alpha prerelease
Original release: . Retrospective release coverage. This article was published on . Created .
KITPro Server v0.1.0-alpha.14 was published on October 29, 2026 as a public alpha. It introduces KITPro-managed nginx ingress, administrator-provided TLS certificates, and a guided nine-step first-run setup. The release connects host readiness, application isolation, and recovery without automatically making installed applications public. This article is retrospective release coverage.
KITPro Server provides browser-based host and trusted-application management on Linux. It is separate from the KITPro Linux Server operating-system distribution. Alpha.14 is intended for administrators evaluating controlled web access for self-hosted applications, with explicit decisions about exposure and certificates.
Every application chooses ingress explicitly
Ingress is an opt-in operation for each application. An upgrade from alpha.13 leaves existing ingress and HTTPS disabled. KITPro-managed nginx applies strict hostname isolation and rejects unknown Host values rather than routing an unrecognized hostname to an arbitrary application.
Configuration changes use a transaction-safe replacement process. Invalid nginx candidates and invalid certificate replacements cannot replace the last known-good generation. This matters when a routing or certificate edit fails: a failed candidate must not become the active configuration simply because files were written.
The release supports managed HTTP and HTTPS with administrator-provided certificates. Private keys are root-owned and excluded from ordinary API responses, user-interface views, logs, audit records, and diagnostics. Operators still need to maintain suitable certificates and understand the network path to the server.
ACME implementation has a qualification limit
Alpha.14 includes ACME HTTP-01 issuance and renewal implementation. Its local challenge routing and regression tests were qualified. Public Let's Encrypt issuance was not live-qualified in the release network. HTTP-01 requires a publicly reachable hostname and inbound TCP port 80; an installation behind an unsuitable network path cannot assume issuance will work.
Cloudflare Tunnel is deferred and is not part of alpha.14. The presence of ingress controls should not be read as a claim that KITPro configures every public-access arrangement. Read the release's network requirements before exposing a service.
Setup and administrator recovery
The nine-step first-run flow improves diagnostics for host state, applications, Docker address pools, storage, and ingress readiness. Those checks help an operator identify the prerequisite that is missing before attempting a privileged change.
Root-local administrator password recovery now revokes sessions globally. The recovery path therefore addresses both access restoration and the existing authenticated sessions that would otherwise remain valid. Redacted support bundles collect build, runtime, application, and ingress status while preserving the release's secret-handling boundaries.
Host-state backup and offline restore also improve handling of databases, WAL and SHM files, certificates, ingress state, and restore holds. These are bounded recovery mechanisms, not a substitute for independent backups or a promise to reverse every upstream application's data migration.
Installation, upgrade, and verification
Debian 13, Ubuntu 26.04 LTS, and Arch Linux with linux-lts are Supported. Rocky Linux 10 remains Experimental and retains the documented Podman staged-generation lifecycle limitation. Review the tagged platform and installation documentation before selecting a package.
Existing alpha.13 users should follow the release's upgrade instructions, preserve a recoverable backup, and check application access after the upgrade. Enabling ingress remains a separate administrator decision. Downloaded packages were built from commit 3578791cc72ad9bf0af470a0642eb4784c640304. The release includes adjacent SHA-256 files, an aggregate checksum file, clean build metadata, a CycloneDX 1.5 software inventory, and a publication manifest.
KITPro Server remains alpha software. The documented ACME qualification limit, explicit ingress opt-in, platform status, and backup requirements are material operating boundaries. The release notes contain the complete change list and verification records.
Resources
Official alpha.14 release, downloads, and checksums
Product screenshots
