v0.3.0 - Improved webhooks and various bug fixes

What's Changed

• [codex] Remove Sentry disable path by @seslly in #11
• [codex] Fix Direct IP disabled port validation by @seslly in #12
• [codex] Mark idle CPU patch as legacy by @seslly in #13
• webhooks: add backup.failed, backup.restore.failed, config.apply.failed, server.crashed by @justintout in #14

Full Changelog: v0.2.1...v0.3.0

v0.2.1 - K8s fs security context fix

What's Changed

• [codex] Prepare v0.2.1 chart security-context hotfix by @seslly in #8

Full Changelog: v0.2.0...v0.2.1

v0.2.0 - Add mod upload support

What's Changed

• [codex] Add staged mod upload support by @seslly in #7

Full Changelog: v0.1.1...v0.2.0

v0.1.1 - Docker compose fixes

What's Changed

• docker-compose: use entrypoint: instead of command: for sidecars by @justintout in #4
• entrypoint: retry SteamCMD app_update + compose ui bind by @seslly in #6

New Contributors

• @justintout made their first contribution in #4

Full Changelog: v0.1.0...v0.1.1

Windrose self hosted linux v0.1.0 stable

First tagged release of windrose-self-hosted — a community deployment bundle for the Windrose dedicated server on Kubernetes (Helm + plain manifests), Docker Compose, and bare-Linux (systemd). Runs the Windows-only server binary under GE-Proton.

Community project, not affiliated with the Windrose developers. Windrose officially supports only Nitrado hosting.

What's in the box

• Three-container model: windrose (game under Proton), xvfb (display server on :99), windrose-ui (stdlib-only Python admin console). All share the PVC + PID namespace.
• Auto-installs from Steam on first boot (anonymous SteamCMD against app id 4129620) — no BYO tarball required for stock Windrose.
• Admin UI: invite code, server/players/resources, config editor with staged diffs, per-world editor, backups (ours + game's), manual WindowsServer update, Discord + generic webhooks.
• Parity across four surfaces: helm/windrose chart, plain k8s manifests (kubectl apply -k .), docker-compose.yaml, and sudo ./bare-linux/install.sh.

Highlights

Idle-CPU binary patch (opt-in)

Windrose burns ~2 cores when idle due to a Boost.Asio spin-loop bug. Enable WINDROSE_PATCH_IDLE_CPU=1 / patchIdleCpu: "1" to inject a Sleep(1) into the hot loop — ~97% idle-CPU reduction on the builds tested. Auto-derives offsets via byte signature so it survives Windrose rebuilds; refuses cleanly if the signature moves. Offered as-is, no warranty — review scripts/patch-idle-cpu.py and the EULA before enabling.

Auto-backup scheduler

• Idle trigger (default 1 min after last player leaves) + floor trigger (default 6 h of continuous active session without an auto-backup).
• Manual and auto are independent clocks (like in-game manual saves vs auto-saves).
• Retention combines count (default 10) and age window (default 7 days) via OR — either rule keeping a backup is enough.
• Pin prefix (manual-*) exempts from retention.
• Row-level source tagging in the UI (auto / manual / pinned).

Server migration round-trip

• GET /api/backups/{id}/download streams a full backup (Saved/ + identity JSONs + runtime config) as .tar.gz.
• POST /api/backups/upload accepts the same shape, lands it as a pinned imported backup, returns the id.
• Four-click flow: download on source → upload + pin on destination → restore → same invite code, same world, same players. Works across deployment surfaces (k8s ↔ bare-Linux).

Honest env knobs

• NET_SERVER_MAX_TICK_RATE (default 60) now actually reconciles Engine.ini's NetServerMaxTickRate + t.MaxFPS on every boot via a shadow-stamp pattern. Hand-edits survive helm upgrades. Lower to 30 on weak hosts, raise to 120 on real hardware.
• Shadow-stamp env-mode for ServerDescription.json now seeds from the live file on first boot (not env intent), so env vars actually apply on subsequent boots instead of silently falling into "operator-modified forever" mode.

Direct IP Connection (Windrose 2026-04 feature)

Full support: USE_DIRECT_CONNECTION, DIRECT_CONNECTION_SERVER_ADDRESS, DIRECT_CONNECTION_SERVER_PORT, DIRECT_CONNECTION_PROXY_ADDRESS. Plumbed through helm values, docker-compose, bare-Linux env, admin UI config editor, and schema validation. Empty server address under Direct IP mode rejected at stage time (silent-bounce footgun the release notes warn about).

Windrose Default_Backups integration

Separate Backups tab in the UI surfaces the game's own on-launch auto-backups under SaveProfiles/Default_Backups/. Restore merges onto the live RocksDB tree and takes a pinned safety snapshot first. Note: game backups are world-only — they don't capture ServerDescription.json, so they can't recover a lost PSID (use our UI backup for that).

Stop / Start / Restart via UI

• k8s + compose: SIGTERM + supervisor auto-restart.
• bare-Linux: polkit rule grants the steam user systemctl start|stop|restart on the three windrose-*.service units, so the UI can drive a real systemd lifecycle without sudo. Narrow scope — only manage-units, not manage-unit-files; enable/disable/mask stay privileged.
• serverControlMode surfaced in /api/status so the UI can show/hide the Start button correctly per surface.

Artifacts

Artifact	Path
Container image	ghcr.io/shipstuff/windrose-server:0.1.0 (also :0.1, :latest)
Helm chart	oci://ghcr.io/shipstuff/charts/windrose:0.1.0

Pull with:

helm upgrade --install windrose oci://ghcr.io/shipstuff/charts/windrose \
  --version 0.1.0 -n games --create-namespace

Critical operator settings

• P2pProxyAddress auto-detects via UDP-connect + getsockname. Override only if your host is multi-homed and auto-detect picks the wrong interface. See README's Critical Setting section — getting this wrong = silent client-side bounce to main menu.
• UI_PASSWORD — required before exposing the admin UI beyond loopback. UI_ENABLE_ADMIN_WITHOUT_PASSWORD=true is an explicit opt-in for LAN-only deploys.
• Backup retention defaults (retain=10 count, retain=7 days, OR-combined) mean the newest 10 backups survive forever — a silent auto-backup failure doesn't eat history.

Known limits

• Windows-only Windrose binary under Proton (no native Linux dedicated server from upstream).
• No RCON. Tune via ServerDescription.json / WorldDescription.json + restart.
• Backend has no US gateway — US operators see ~150ms round-trip to KR or EU.
• Idle-CPU patch is experimental; offered as-is. Sizing floors (validated 2026-04):
  • 1 vCPU: unplayable regardless of RAM — idle bug pegs the core.
  • 2 vCPU / 2 GB: unplayable — delayed allocation crash.
  • 2 vCPU / 4 GB fresh world: marginal on shared vCPUs; use pre-loaded save instead.
  • ≥ 3 vCPU / 4 GB: comfortable.

Test coverage (CI)

11 test suites — shellcheck, yamllint, helm lint, helm template (three config modes), JSON validation, kustomize render, py_compile, plus targeted test files: backup retention, create/restore round-trip, auto-backup scheduler, HTTP integration, systemctl dispatch, schema validation, install.sh env-merge, shadow-stamp contract, Engine.ini reconcile.