Releases

Every tagged build of gtcnsl, with verified downloads for each architecture.

// Latest release

v1.3.0 latest

2026-07-18

Install the latest in one command

What changed →

$ curl -fsSL https://dl.gtcnsl.com/v1.3.0/gtcnsl-v1.3.0-linux-amd64 -o /usr/local/bin/gtcnsl && chmod +x /usr/local/bin/gtcnsl

✓Every asset is verified with SHA-256 checksums.

Gitea 1.27.x and Runner 2.x are officially supported, verified end to end — and `secrets rotate SECRET_KEY --reencrypt` now refuses to run against any Gitea minor gtcnsl hasn't re-verified its crypto against.
Safe `SECRET_KEY` rotation now covers `SECRET_KEY_URI`-configured instances too: gtcnsl resolves the key exactly the way Gitea does at boot, and rotation keeps the URI-backed file in sync instead of silently diverging from it.
`gtcnsl runner adopt` brings an existing Gitea Actions Runner under management without ever re-registering it — the runner twin of `gitea adopt`.
Runner state — `.runner`, `config.yaml`, its systemd unit — now travels with `gtcnsl backup`/`restore`, so losing the file no longer means a fresh registration token.
First-class `gtcnsl gitea upgrade`/`runner upgrade` commands, and a failed Gitea upgrade now restores the previous binary automatically instead of leaving the host without one.
Runner registration tokens no longer have to sit in process argv: `runner register`/`reconfigure --token-file <path>` reads the token from a file instead.

Download progress no longer floods ssh sessions, CI logs or the TUI: throttled at the source, plain sparse lines on non-terminals, one in-place-updating line in the TUI.

Safe `SECRET_KEY` rotation: `secrets rotate SECRET_KEY --reencrypt` migrates every encrypted database row — Actions secrets, 2FA seeds, webhook auth headers, LDAP bind passwords — to the new key, with a backup and automatic rollback. The rotation Gitea itself has never shipped (go-gitea/gitea#16832).
Safety guard: a plain `secrets rotate SECRET_KEY` now hard-stops before touching anything instead of silently orphaning encrypted data, and `--dry-run` previews exactly what a migration would touch.
`doctor` now warns when `SECRET_KEY` is empty — Gitea then encrypts with a public default baked into its own source, so the data is effectively unprotected.

Fixed: health checks work on sign-in-only instances (`REQUIRE_SIGNIN_VIEW`) — liveness now uses the unauthenticated `/api/healthz` endpoint.

Fixed: health checks against installs with built-in Let's Encrypt no longer fail falsely — `secrets rotate`, `config apply` and in-place upgrades work on ACME hosts again.

Point `gitea install` at a host that already runs Gitea and it upgrades in place — live paths detected, data never moved, a hand-written unit preserved byte-for-byte.
`gtcnsl gitea adopt` brings a hand-rolled install under management without moving any data: secrets out of `app.ini`, permissions tightened, a template for the declarative loop.
Serving profiles at install time: HTTP behind a proxy (default), direct HTTPS with built-in Let's Encrypt, or your own certificate.
`gtcnsl gitea enable-https` switches a live HTTP install to HTTPS — and rolls back to the working config automatically if anything fails.
Doctor now catches the classic time bomb: an https config on :443 whose unit can't actually bind the port.

First stable release — the CLI and on-disk layout are now covered by a SemVer compatibility guarantee (COMPATIBILITY.md).
`gtcnsl backup` / `restore` — snapshot your Gitea install and roll back with a safe, self-undoing flow.
`dind-rootless` runner executor — run the Actions runner in a rootless container, no host binary.
Signing-key self-refresh keeps download verification working across the Gitea key's yearly renewal.
Fixed: in-place `gitea install --to` upgrades now restart onto the new binary.