Changelog

All notable changes to Alta VMS are documented here. Versions follow date-based build tags (vYY.MM.DD[-suffix]); builds with a suffix such as -rc1 are pre-release candidates.

v26.07.31 — 2026-07-31

Operator CLI release: altavms grows a full command surface for running the service, diagnosing problems, and backing up data — plus a VOD playback fix.

Upgrade notes

• No database migrations in this release.
• If you edit http.allowed_origins, the value is now also pushed to Alta’s OTT allow_origin setting on startup — see below. No action needed, but the first restart after upgrading corrects a gap that could otherwise break archive playback silently.

Command line

• A full operator CLI — beyond install, uninstall, and reset-password, altavms now wraps day-to-day service management and diagnostics:

  • altavms start|stop|restart|enable|disable|logs — thin, transparent wrappers around systemctl/journalctl that validate the config before start/restart so a bad edit can’t take the service down.
  • altavms status and altavms doctor — a live health screen and an offline checkup that works even when the service won’t start, each finding paired with its fix.
  • altavms backup / altavms restore — a consistent hot backup (no downtime) and a guarded, verified restore.
  • altavms config validate / altavms config print — check or print the effective configuration exactly as boot sees it, secrets redacted.

  See CLI Reference and Backup & Restore.

• The generated /etc/altavms/config.yaml now comes from the same reference the binary validates against, so a fresh install can’t drift from what altavms config print --reference documents.

Fixed

• Archive playback while a camera is offline — Alta was trimming archive playback windows without a matching browser Origin, so VOD could fail with no Access-Control-Allow-Origin header. http.allowed_origins is now synced into Alta’s OTT allow_origin setting at startup, closing the gap.

v26.07.30 — 2026-07-30

Reconcile-sweep safety release: the hourly cleanup of orphaned Alta-side resources now proves ownership before deleting anything, plus camera- and server-level config-drift detection with one-click recovery.

Upgrade notes

• This release adds an ownership-claim ledger; its database migration runs automatically on startup and backfills claims for every resource a current VMS record still references.
• The reconcile sweep is now stricter, not looser. It previously inferred permission to delete an Alta-side resource from its name; it now deletes only resources this installation can prove it created. A resource orphaned before this upgrade carries no such proof and will no longer be auto-deleted — see “Cleaning up old orphans” below.
• Two new sweep safety settings are available via the settings API (not yet in the Connections page): connection.reconcile_max_deletes_per_tick and connection.reconcile_candidate_ratio_guard. Defaults are conservative; you don’t need to touch them.

Alta servers & health

• Cross-installation protection — two Alta VMS installations pointed at the same physical Alta server can no longer delete each other’s cameras’ streaming resources. The reconcile sweep now requires a confirmed, recorded ownership claim before it will delete anything, never a guess based on a resource’s name.
• Config-drift detection now covers cameras, not just servers — a camera missing its receiver or channel on Alta, or one whose source, name, storage, or enabled state has diverged, is now detected and shown alongside server-level drift.
• Guided recovery, one click at a time — from the Config drift dialog you can now recreate a missing camera receiver/channel, push a diverged authorizer or storage setting to Alta, or reconcile the VOD access path, each a single audited action. Fields that can only be fixed in the VMS (not on Alta) are labeled accordingly.
• See what’s on Alta but not in the VMS — a new reverse-direction list surfaces Alta-side resources with no matching VMS record, with Import (adopt as a camera), Ignore (leave it alone, permanently), and Delete from Alta actions.
• Corroborated Alta-restart-vs-connectivity-blip detection and 2-sample hysteresis for Alta-class health failures (carried over from the v26.07.21-dev1 pre-release).

Interface

• The Config drift dialog groups changes into Configuration, Cameras missing on Alta, On Alta, not in VMS, and Ignored, with Fix all safe and Restore all bulk actions.
• Two badges distinguish what the sweep protects from what it merely resembles: auto-cleanup pending (we created it; the sweep will remove it after the grace period) and VMS-shaped, not ours (named like ours, but we have no record of creating it — usually another installation sharing the same Alta server).

Administration

• Authorizer IDs are now derived from the full Alta server ID instead of a timestamp-heavy prefix, removing a rare collision when two servers were added in quick succession. Existing servers are unaffected.
• Fixed: several audit-log entries for authenticated actions weren’t recording which user performed them; a per-camera permission check that could be bypassed by a group-scoped viewer; /readyz not detecting a dead background worker; background workers left disabled in the example config.

Cleaning up old orphans

Resources orphaned before this upgrade have no ownership record and are no longer auto-deleted. Open Settings → Connections → Config drift for each server: leftover resources appear under On Alta, not in VMS. Use Delete from Alta to remove ones you recognize as leftovers, or Ignore to permanently exclude a resource you want left alone.

v26.07.21 — 2026-07-21

Alta health-detection, observability, and admin-recovery release. Most changes are automatic after update; two database migrations run on startup.

Upgrade notes

• This release adds the alta_server_restarted and alta_server_blip event types; their database migrations run automatically on startup.
• A new alta_prober worker is enabled by default and pings each Alta server about once a second to catch short outages. Its cadence is tunable with the new Server ping interval setting on Settings → Connections (1–10 seconds).

Alta servers & health

• Faster outage detection — a sustained Alta outage is now caught in about 5 seconds instead of around 30.
• Short restarts are no longer invisible — a 1–2 second Alta restart that previously passed unrecorded now produces a single recovered-incident event instead of silently flickering cameras offline and back.
• Restarts told apart from blips — an Alta server restarted alert (warning) now means a confirmed restart, corroborated against the server’s runtime instance ID and uptime. A transient outage that recovered without a restart is reported as an Alta connectivity blip (info) instead.
• Fewer false camera-offline alerts — an Alta-class health failure now needs two consecutive samples before a camera is marked offline, so a brief blip no longer flips a whole server’s cameras offline and back.
• Runtime telemetry — each Alta server now reports host CPU, memory, uptime, version, and per-volume storage usage.

Interface

• Server telemetry panel — expand any connected server on Settings → Connections to see its CPU, memory, uptime, Alta version, and storage fill. Servers running older Alta builds omit the panel.
• Realtime status — Live and group pages now update camera and server status as it changes, instead of only at page load or manual refresh. Operators without admin access can now see when a server hosting their cameras goes down.
• Coordinated recovery — when a server comes back, all affected live tiles recover together instead of each retrying on its own.
• Alert bell refresh — the alert row was redesigned with inline acknowledge and resolve actions and an expandable panel that shows an event’s details in place.

Administration

• Offline password recovery — recover a forgotten admin login with a single root command, with no manual database editing. Run on the server:

  sudo altavms reset-password <email>

  It prints a one-time reset link (valid 7 days) that opens the normal reset-password page and immediately signs out that user’s existing sessions. No password is ever typed, generated, or printed, and the service does not need to be stopped.

v26.07.17 — 2026-07-17

Stability, security, and reliability release. Most changes are automatic after update; see the upgrade notes for administrator-visible effects.

Upgrade notes

• All users are signed out once and must log in again after the update because sessions now use a revocable access/refresh token model.
• This release includes database migrations for session revocation and durable alert/notification delivery. Migrations run automatically on startup.
• The JWT secret and encryption key must be two different values. Startup fails if they match.
• The first run of the new reconcile worker may remove Alta-side resources left behind by previously failed operations. Each removal is written to the audit log.
• Stable releases now update the latest CDN alias. Pre-release tags do not.

Downloads

• Release downloads now use the correct vms CDN paths.
• Pinned builds are available as vms-<tag> and the latest stable Linux tarball is served as vms-linux-x86_64.tar.gz.
• The latest installer is published alongside the latest stable build, and the tarball packages the binary as altavms.

Sessions & security

• Sign-in now uses short-lived access tokens plus rotating refresh tokens. Logout is durable across server restarts.
• Changing a user’s password, role, or disabled state now signs that user out everywhere immediately.
• Token verification was hardened with strict signing-algorithm and key handling.
• Audit and event CSV exports are safer to open in spreadsheet software.
• CORS handling, audit redaction, and user-management audit logging were hardened.

Alerts & notifications

• Alerts and notifications are now stored before delivery, so they survive server restarts and load bursts.
• Failed email, webhook, Telegram, and push deliveries retry with persisted backoff instead of blocking worker capacity.
• Notification throttling is recorded only after confirmed delivery.
• SMTP delivery now has real I/O deadlines plus per-host isolation, so a slow mail server does not delay other channels.
• Browser reconnects now catch up more reliably after long disconnects.

Cameras, Alta servers & storage

• Camera and Alta server operations are safer when a multi-step change fails partway; failed side effects are rolled back where possible.
• A reconcile worker detects and cleans Alta resources orphaned by crashes or interrupted operations.
• Cameras stuck in provisioning can now recover through the health worker path.
• Health and motion workers now process cameras with bounded concurrency, improving status freshness on larger installations.
• New worker tuning options are available: workers.motion_concurrency and workers.health_probe_concurrency.
• Storage mount handling and network-storage recovery were improved.
• Screenshot, RTSP, preview cache, storage, and camera IO paths now have stronger timeout and recovery behavior.

Interface

• Unavailable actions are now hidden instead of shown as disabled controls.
• Camera health toast behavior is now enabled consistently.
• Camera detail, Investigate Events, Investigate Clips, and Logs pages received state-sync and stale-state fixes.
• Small UI polish fixes landed for maps, timeline, storage dialogs, data tables, date range picker, dropdowns, camera tiles, and recording indicators.

API & administration

• API errors now use a consistent envelope with request IDs for log correlation.
• Idempotency, rate-limit, and request-ID behavior is more predictable.
• Search filters now escape LIKE wildcards correctly.
• Pagination and database query edge cases were fixed.
• Last-admin protection now runs inside user-service transactions.
• Database migration behavior was tightened.

v26.06.29-rc1 — 2026-06-29

First release candidate.

Live & archive

• Live monitoring — multi-camera video wall with 1/2/3 grid layouts, WebRTC (WHEP) streaming with automatic HLS fallback, per-tile transport switch, live stats, and a full-screen camera overlay.
• Archive playback — DVR-style timeline with event markers, variable playback speed, and clip export from a selection.
• Client-side screenshots — capture the frame you’re watching straight from the browser (overlay button or the S key), so manual captures work even on single-connection cameras.

Cameras, groups & maps

• Cameras & Groups — manage cameras across multiple Alta servers; organize them into groups with per-group operator/viewer roles.
• Maps — place cameras on floor plans with field-of-view cones and open them live from the map.
• Bulk actions — multi-select rows on any list page to delete, enable/disable, toggle recording, acknowledge, or activate in one step (up to 200 at a time).

Events & alerts

• Events — review motion and external-recognition events with filtering and acknowledgement.
• Clips & screenshots — export MP4 clips from the archive and browse captured screenshots.
• Alerts — rule-based alerts (offline, degraded, online, motion, Alta unavailable/restored, config drift) delivered live in-app over SSE, with per-user alert preferences.
• Notifications — three-layer delivery model (Connections → Recipients → Rules) with Email (SMTP), Web Push, Telegram, and Webhook channels.

Administration

• Users & access — JWT authentication, role-based access control, user invitations, self-service password change from your profile, and an audit log.
• Storages & retention — manage storage backends and retention policies; archive storages can now be deleted (detaching their cameras).
• Self-installing binary — altavms install provisions a systemd service, dedicated system user, generated secrets, and config under /etc/altavms with data in /var/lib/altavms.
• Configuration — config.yaml with environment-variable overrides; production validation for origins, JWT secret, and encryption key; per-endpoint auth rate limiting and brute-force lockout.
• Config drift inspection — a per-server, field-by-field report showing exactly which Alta settings diverge from what Alta VMS expects, with shortcuts to fix them.

Notes

• Default HTTP port is 3303.
• Single Go binary with the web UI and SQLite embedded; schema migrations run automatically on startup.
• The Alta callback base URL is now an explicit per-server setting, replacing the previously request-derived value.