notefeed 0.19.0

Released 2026-10-18 · on GitHub

Encryption at rest on the database backends: with NOTEFEED_ENCRYPTION_KEY, or with the main key in OpenBao (NOTEFEED_KMS=openbao), notefeed encrypts every feed's notes, images, metadata, settings and password with a data key of its own before they reach the database or the image store, and stores names and read ids only as fingerprints. A copy of the database, a dump or a bucket shows neither the notes nor a way into a feed. With OpenBao the main key never reaches notefeed, every unwrap is in OpenBao's audit log, and an unreachable OpenBao is a maintenance page (503 with the code unavailable from the API) rather than an error. A note that can't be decrypted is listed as a damaged note in its place instead of breaking its feed, and notefeed's own pages replace Next's plain not-found and error pages.

• #211: Settings: the REST API first under Posting
• #214: CLAUDE.md: commands, architecture and the production repos
• #216: Encryption at rest: envelope encryption on the database backends (#212)
• #217: Key service: the main key in OpenBao (#215)