From 60b016222fc9e4f63128673c20d944350260ef05 Mon Sep 17 00:00:00 2001
From: Tyler <53561637+im-tyler@users.noreply.github.com>
Date: Mon, 19 Oct 2026 22:07:56 -0700
Subject: [PATCH] chore(release): v0.1.45

CHANGELOG Unreleased becomes 0.1.45 (D2 folderless reads, D3 backup
target, D4 git sources) with upgrade notes; D3 entries moved out of
### Notes into ### Added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 33 +++++++++++++++++++++++++--------
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fe6ca02..381570f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,24 @@ All notable changes to teploy are documented here. Format follows [Keep a Change
 
 ## [Unreleased]
 
+## [0.1.45] - 2026-10-20
+
+### Upgrade notes
+
+- `teploy setup` moves the age identity from `/deployments/.age-key` to
+  `/etc/teploy/age-key` (0600), out of the Caddy-readable tree. It leaves
+  only a public-key marker at the old path: older CLIs can still encrypt
+  (`secret set`) but can no longer decrypt, so their deploys of apps with
+  secrets fail. Upgrade every machine and CI image to 0.1.45 before
+  running `setup` on a server. Existing secrets keep decrypting with this
+  version.
+- Backup cron lines that embed bucket, region or credentials keep working.
+  `teploy server backup-target set` rewrites them to `teploy backup run`,
+  and `teploy doctor` flags any line that still embeds credentials.
+- Apps that build from `git:` need the server poll timer (`teploy trigger
+  install-timer --host S`); `teploy doctor`'s `git-trigger` check reports
+  a missing one.
+
 ### Added
 
 - Teploy-home apps can build from a git repository: a `git:` block
@@ -49,14 +67,6 @@ All notable changes to teploy are documented here. Format follows [Keep a Change
 - New event kinds `trigger.admit`/`trigger.refuse` detail `reason`, and
   `source.connect` records credential lifecycle (type and fingerprint
   only).
-
-### Notes
-
-- Static Teploy-home apps with `git:` remain refused (static deploys
-  still need a code source); submodules are refused pending
-  implementation; `file://` repositories are accepted as a privileged
-  config change (same-server sources).
-
 - One backup target per server, read at run time (`backup-target-v1`;
   contracts corpus rev 15). `teploy server backup-target set --host S
   --bucket B [--region] [--endpoint] [--prefix]` stores it at
@@ -103,6 +113,13 @@ All notable changes to teploy are documented here. Format follows [Keep a Change
   material; the server-level target event is fanned out to every app
   known on the server).
 
+### Notes
+
+- Static Teploy-home apps with `git:` remain refused (static deploys
+  still need a code source); submodules are refused pending
+  implementation; `file://` repositories are accepted as a privileged
+  config change (same-server sources).
+
 ### Changed
 
 - `backup list --json` now emits the versioned envelope above instead of