corrosion-admin-panel/docs/reference-repos/adainrivers/release-notes/0.3.7.md

A fix-focused release. Knocks down a cluster of install-time crashes, makes the backup schedule configurable, surfaces the full ServerShutdown broadcast in the admin UI, and adds a guarded cleanup for accumulated database-operation pods.

Reinstall step

After updating the desktop app, click Install / Update on the Management Service card so the refreshed on-host service binary is pushed. If you previously workaround-started the service with sudo ./dune-server-service &, kill that process first so the new systemd / OpenRC unit owns the only running copy.

Fixed

• Management service silently failed to start on install (issues #5, #6). The install flow now pre-creates every directory the systemd / OpenRC unit references (~/.dune, ~/.dune/state, ~/.local, ~/.steam, ~/Steam) with dune:dune ownership, plus the supervisor log file. Previously the unit started, immediately tripped on mount-namespace setup, and exited with status=226/NAMESPACE only visible in journalctl.
• Service now always runs as the dune user, regardless of which account you SSH in as (issue #3). The installer no longer rewrites the systemd unit with the SSH user's home; it pins User=dune Group=dune and paths under /home/dune. Operators logging in as root or ubuntu no longer get a unit pointing at /root/.steam that fails to mount.
• Battlegroup start / stop / restart / update use the registered SSH user for vendor-wrapper impersonation instead of hardcoding dune. Fixes a half-broken state from v0.3.6 where status reads worked but lifecycle actions silently misbehaved.
• Manual ServerShutdown broadcast no longer no-ops. Previously sent an empty payload that the game discarded; now sends the full countdown shape with ShutdownType, ShutdownTimestamp, BroadcastFrequency, and BroadcastDuration.
• OpenRC unit self-heals on every start. start_pre now also creates the parent .dune directory and the supervisor log file via checkpath.
• Install verify step shows why the service is not active by tailing journalctl (systemd) or the supervisor log (OpenRC). No more empty-parenthesis "not active ()" message.

Added

• Configurable backup schedule via 5-field cron expression, with live validation and a preview of the next 5 fire times in your configured timezone. Default is disabled — vendor backups block server I/O for the full dump, so the manager no longer schedules them automatically. Set your own cadence under Management -> Automated Tasks -> Configure.
• Full ServerShutdown broadcast surface in Admin -> Broadcast: ShutdownType selector (Restart / Maintenance / Update), lead time, repeat frequency, display duration, and a "Cancel pending shutdown" toggle that short-circuits the payload (per the protocol parser). The scheduled restart-notice task ships the same shape so manual and automatic flows are now consistent.
• "Clean up database operations" button on Management -> Automated Tasks. Lists every terminal DatabaseOperation CR (Succeeded or Failed, dump or import) with phase badges, lets you tick which to delete, then deletes them via kubectl delete databaseoperation. The .backup files on disk are never touched, in-progress operations are never listed, and the server re-validates every item server-side before deleting.
• Static musl service binary ships in every release, so the daemon runs on Alpine images without a glibc loader.

Changed

• The publish_server_shutdown helper that backs the scheduled restart-notice broadcast now emits BroadcastDuration so its payload matches the manual Admin form and the protocol spec.
• The on-install account discovery no longer follows the SSH login user — it resolves the canonical dune user via getent passwd dune and errors loudly if the vendor setup has not provisioned that account yet.
• Bundled systemd unit marks /funcom/artifacts/database-dumps as optional (- prefix on ReadWritePaths), so a fresh host without k3s + vendor setup no longer namespace-faults on first start.