Changelog

Notable changes to AI Admin Panel, newest first. The in-product Settings → Updates page also shows the release notes for the version you can update to.

2.11.0 — 2026-07-17 — A built-in secrets manager, customer bring-your-own-key, and metered AI

Every credential now lives in a built-in secrets manager, not a database column. A new internal-only vault (OpenBao) is installed automatically — no wizard step, no terminal — and stores your AI provider keys and the passwords and tokens your deployed apps generate (database superuser passwords, gateway tokens, and so on). Each customer gets their own private compartment, created and cleaned up automatically. Existing installs migrate their keys into the vault in the background on their next update, and everything keeps working even if the vault is briefly down (reads fall back, writes fail loudly rather than silently). You can turn it off with SECRETS_BACKEND=file.
A Secrets page to browse, reveal, and rotate credentials — no terminal. A new Secrets entry (for both the operator and the customer portal) lists every stored credential grouped by service and by AI provider, each with a masked value, an audited Reveal button that auto-hides after 30 seconds, and version history. Database passwords (PostgreSQL, MySQL/MariaDB) and other rotatable secrets get a one-click Rotate that generates a fresh value, applies it to the live service, and restarts it. A customer only ever sees their own secrets — never another customer's or the operator's.
Point one service's setting at another's secret — no copy-pasting. The environment-variable editor gains a "use a stored secret" picker: choose a secret and the panel inserts a reference to it. Rotate the source secret and every service that points at it follows automatically — nothing to re-type.
Customers can bring their own AI provider key. A new capability lets a customer store their own OpenRouter / OpenAI / Anthropic / Ollama key, so the AI usage of the apps they deploy bills to their account, not yours. Who's allowed to use it is decided by a three-level cascade you control — a global switch in Settings → AI → Capabilities, a per-plan choice, and a per-customer override — and it ships off. When it's on, an AI page appears in the customer portal where they store their key (write-only — never shown back) and choose whose key their deployed apps use.
Sell metered access to your own AI — per-customer keys, budgets, and rate limits. For customers who don't have their own AI account, you can now sell them access to the panel's bundled AI gateway under limits you set: a monthly budget (to the cent), a tokens-per-minute cap, and a requests-per-minute cap, set per plan or per customer. When it's on, the customer's portal grows a Metered AI card: one click mints a budgeted key shown once (with reveal, rotate, and revoke), the gateway endpoint is displayed, their deployed apps are wired to it automatically, and a spend meter tracks month-to-date usage — warning at 80% and refusing calls past 100%. You set the selling price of the bundled model, and month-to-date spend also shows on each customer's admin page.
Security + upgrade note. The bundled AI gateway no longer ships with a shared default master key — every install uses its own generated key. If your install pre-dates the metered gateway, getting metered AI takes a one-time host bring-up (the gateway gains its own database), documented on the How AI Works page; brand-new installs get everything automatically.

2.10.0 — 2026-07-11 — Install with no domain, a self-renewing free domain, and a tidier Settings

Install without owning a domain. Leaving the installer's domain prompt empty — or running unattended with no PANEL_DOMAIN — now claims a free temporary domain like aap-x7k2f9.aiadminpanel.host and lands you in a fully working HTTPS panel with zero DNS setup. The domain is provisional for 7 days; verifying your email in the panel keeps it renewing automatically. Bring-your-own-domain installs are unaffected, and the temporary-domain path can be turned off with MANAGED_DOMAIN=off.
The panel keeps your free domain alive for you — and the verify link brings you home. Verify an email in the setup wizard's "Keep your free domain" step or in Settings → DNS & Domains, and your temporary domain's 7-day provisional lease becomes a 60-day lease that renews itself automatically — no terminal, no cron job to set up. Clicking the link in the verification email now drops you straight back onto that Settings page, where a confirmation message appears and the card flips to verified on the spot (no manual reload). A banner reminds you as the deadline nears and tells you if renewal is struggling. Bring-your-own-domain installs never see any of this.
Settings is organized into categories. The Settings page's long row of tabs — which used to overflow into an easy-to-miss "…" menu — is now grouped under a left sidebar: General, Connectivity, AI, System, and Security & License, with the tabs for the selected category across the top. Every existing Settings bookmark keeps working, and the sidebar is fully translated.
Fixes worth calling out. The Account → Preferences language picker now lists all seven shipped languages (not just English and German); the Account → Security "Enable/Disable 2FA" buttons now open the real two-factor flow instead of a dead page; services deployed from the LiteLLM template are named litellm-proxy-* instead of a slug that read like a description; the template deploy wizard now tells you — right at the button — why "Next: Review" didn't advance and jumps you to the empty required field; and the SSL-provisioning tooltip no longer surfaces the internal proxy name "Traefik" (and is now translated everywhere).

2.9.0 — 2026-07-07 — A panel-wide redesign, fully translated, and a smarter Services overview

The whole panel now wears one polished, on-brand design. Every screen — Dashboard, Customers, Organizations, Plans, Projects, Templates, AI Models, the Customer Portal, Settings, the AI Assistant, and the login and setup-wizard flows — has been rebuilt on the same Ant Design Pro layout that Services adopted in 2.8.0. Consistent headers, tables, forms, and cards throughout; everything you did before still works, now faster to scan and easier on the eyes.
Everything is translated — in all seven languages. The redesign came with a top-to-bottom localization pass: dozens of screens that had been quietly showing English to non-English operators (the customer create wizard, the template toolkit, the plans pages, the reseller flows, the chat assistant, and more) are now fully translated in English, German, Spanish, French, Italian, Chinese, and Arabic. A new automated check makes it impossible for a missing translation to slip back in unnoticed.
The Services overview tells you more at a glance. Each service now shows a live uptime that ticks up in real time, a one-click Open button that launches the running app in a new tab, and mini CPU / RAM sparklines showing live load per service — no need to open a service to see how it's doing. A card view is available alongside the table, and a background sampler keeps the load charts populated for every running service.
A friendlier AI-model picker at setup. The AI-configuration step — in both the first-run wizard and Settings → AI — now offers a curated dropdown of current models per provider instead of an empty text box, with an "enter a custom model" escape hatch. Much easier for a first-time operator to get right.
One email setup powers all panel mail. Invitations and password-reset emails now use the same email configuration as everything else, so once mail works, it works everywhere — no more invites or resets silently failing on a separate, unconfigured path.
Fixes worth calling out. Inviting a user to a customer now actually creates their sign-in (previously every invite reported success while the person could never log in); the setup wizard's License step no longer rejects valid keys or trap you in a wizard→login→wizard loop on a fresh install; and the customer portal's plan-features list now shows in the customer's own language.

2.8.0 — 2026-07-01 — Template growth, Ant Pro Services & licensing/security hardening

Three new one-click templates. DeerFlow (a ByteDance "super-agent" that plans long tasks, runs tools in a built-in sandbox, and produces reports/slides/pages — bring your own LLM key), ContextForge MCP Gateway (IBM's governed front door for your MCP tools and servers, behind one authenticated endpoint), and Qdrant (a fast vector database — the missing building block for RAG and semantic search, with an auto-generated API key). Each deploys with secure defaults and generated secrets.
The Services area got a cleaner, more capable redesign. The service list is now a sortable, filterable data table, and the service detail and deploy screens use the same polished, on-brand layout (Ant Design Pro) — the first step of a panel-wide UI refresh. Everything you did before (start/stop/restart/remove, bulk actions, search) still works, now faster to scan.
Buying the Web Host edition unlocks the reseller area immediately. Upgrading a panel from Power User to Web Host now reveals the Customers, Resellers, Roles, Plans, and Audit Log navigation right away — previously the reseller tier could be activated without the reseller menus appearing until other settings were changed.
The License settings page now speaks your language. The whole licensing surface — status, the activate/validate/re-bind dialogs, the edition comparison, and the trial/grace banners — is fully translated in all seven languages, instead of showing English to non-English operators.
Legal documents are built into the panel. The EULA, Privacy Policy, and Acceptable Use Policy are now bundled with the product and rendered cleanly in-app (no dead links to the marketing site, works offline), so the first-run acceptance step always resolves.
Stronger container security by default. The per-service hardening the panel promised — dropping dangerous Linux capabilities and setting no-new-privileges — is now actually applied to every deployed container (it had been written into config but silently never enforced). Verified across the template catalog so nothing breaks.
The bundled AI uses your GPU automatically. On a GPU server, the panel's built-in Ollama now claims the GPU at install instead of running CPU-only, so local AI "just works" on the hardware you paid for. On a CPU-only box, nothing changes.
Multi-port apps route correctly. Templates that expose more than one web port (like Qdrant's REST + gRPC) no longer fail with a certificate/404 error — each port gets its own working address.
Honest version + a current default AI model. The panel now reports its real running version on the license record and diagnostics (instead of a frozen placeholder), and the default Anthropic model offered at setup is the latest Claude Opus.
Crash reporting is now an explicit, opt-in choice — off by default. During setup you'll see a clearly-worded toggle to share anonymous crash reports (stack traces and the page where an error happened — never customer data, API keys, or admin credentials). It's off by default and nothing leaves your server unless you turn it on during setup; crash reports go to Sentry on EU servers in Frankfurt.
Settings → AI Providers now honestly reflects that each app picks its own AI. The page reads as a source manager: it explains that each AI app picks its source at deploy (apps that support it get wired automatically; others show where to point them), the Local AI option notes it's available to apps that support a local endpoint, and the old "Bring your own API key" card is now the Provider AI source — a central endpoint your apps can select at deploy, with a Configured badge when a key is set up (including one your host bundled at install). Earlier copy implied every AI app used one panel-wide setting and was injected through a generic variable no app actually read; that misleading wording is gone, and all of it is translated in every supported language.
Choose where each AI app gets its model, right in the deploy form. When you deploy an AI app, you can now pick its AI source — Provider AI (your configured or bundled endpoint), Local AI (the bundled Ollama on your server), Bring your own key, or Configure later — and the panel wires that source straight into the app so it works on first boot. The choices shown are honest: only sources the app can actually use appear (for example, a remote provider isn't offered for an app that only talks to a local Ollama, and "bring your own key" only shows for apps that have a key field). Your choice is remembered if the service is later reassigned to another customer. Apps that can't be auto-wired are clearly marked "configure in-app" instead.
Hosting providers can pre-load a shared AI endpoint at install. A provider can bundle their own AI inference endpoint and key with the installer, so the AI apps your customers deploy work on first boot without anyone pasting a key. It's set up once at install time, stored encrypted on your own server, and always editable afterwards under Settings → AI Providers. Leave it unset and nothing changes — the panel stays fully sovereign with no AI endpoint configured by default.
Deployed AI apps now work out of the box, with an honest choice of AI. New AI app deployments default to Local AI (your GPU) — the panel's own bundled Ollama running on your server, which uses the GPU when one is present, needs no external API key, and keeps data on the box. Prefer your own provider? Enter a key under Settings → AI Providers → Bring your own API key and it takes precedence. The AI Providers page now clearly shows the two options and which one is active, and you can turn the Local AI default off.
A more consistent, on-brand look. A design-system pass replaced some off-brand accent colors (a stray indigo that had crept into the services, organizations, and settings pages) with the panel's own navy-and-gold palette, and standardized the page layout behind a single shared header. The result is a more polished, enterprise-grade feel — and a guard now prevents the off-brand color from creeping back in.
The Ollama "use deployed instance" toggle now confirms it saved. Flipping the AI-provider routing toggle in Settings → AI Providers now shows a confirmation message saying which Ollama instance panel AI will use, so it's clear the change took effect (it previously gave no feedback).
Database templates now install a fixed, tested version. The PostgreSQL template (and the other database templates) used to install whatever "latest" happened to be — which recently jumped to a new major version that wouldn't start, leaving fresh deploys stuck restarting. Database templates now pin a known-good version (PostgreSQL 16, Redis 7.4, MariaDB 11.7, MySQL 8.0, MongoDB 7.0, Milvus 2.6) so a deploy is predictable and a surprise upstream release can't break it.
A failed deploy no longer uses up a template's instance limit. If deploying a template failed, the leftover failed service still counted toward "how many of this template you can run" — so a customer could get stuck unable to redeploy it. Failed deploys (which run nothing) no longer count; a previously-running instance that crashed still does.
Unhealthy services are no longer shown as healthy. A service whose container is running but failing its health check now shows a degraded status (instead of a green "running" badge), with a note on the service page explaining that the URL may be unreachable until it recovers. Previously such a service looked healthy in the panel while its address returned an error.
Opt-in scheduled auto-updates. Turn on a daily time + timezone in Settings → Updates and the panel applies an available on-channel update automatically — using the same safe path as Update now (database backup → signature verification → health check → automatic rollback). Off by default. A pinned version is never auto-updated, a rolled-back release is not auto-retried, and every outcome (success, rollback, or failure) sends a notification. Configuring it requires the Admin-only system.update.apply permission.

2.7.0 — 2026-06-23 — One-click in-product updates

Update now (one-click). Apply an update from the UI with no terminal: the panel takes a pg_dump backup first, verifies the target image's signature (fail-closed — an unsigned or tampered image is refused), swaps the image, health-checks, and automatically rolls back to the previous version if the new one isn't healthy.
No docker.sock in any container for updates. The panel only writes a request file; a host systemd service performs the swap and rollback as root — the sole privileged actor.
Admin-only apply. Triggering a panel-wide update requires the system.update.apply permission; viewing and channel/pin remain on the shared system.update.

2.6.0 — 2026-06-22 — AI Models cockpit + in-product updates

AI Models cockpit — a scannable overview plus per-instance detail pages with hardware health, inference telemetry, and model management.
In-product update detection — Settings → Updates shows your version vs. the latest release, with release channels (Stable/Beta), pin-to-freeze, and a global "update available" banner.

2.5.0 — 2026-06-22 — Stability milestone

Broad stability and reliability hardening across deployment, backups, and the setup wizard.

The complete, commit-level history lives in CHANGELOG.md in the repository.