Little updates.
Big plot twists.

• ✳Keep static publications working when the active Orbit controller and the selected Space run on different servers.
• ✳Route verification now uses the shared cluster router, so a controller that does not receive public HTTP traffic can still confirm a healthy deployment. The public hostname and release checksum are checked.
• ✳Access to the selected Space is maintained for the current controllers without opening unrelated application networks. Existing sites, files and settings are preserved.

Full release notes on GitHub ↗

• ✳Project and application settings now share a clearer layout, with publication choices that reflect how a site is actually served.
• ✳Published static sites hide the Kubernetes tab and container-only controls. Static projects still using containers keep those controls.
• ✳Updating preserves saved settings and the current publication mode. It does not move a site into a Space or start a deployment.

Full release notes on GitHub ↗

• ✳Publish static websites through an existing Space, with shared file servers instead of an image and application pod for every site.
• ✳Release files stay separate by site, environment and deployment under a reserved prefix. Existing uploads remain untouched, and traffic only changes after the new files are verified.
• ✳Keep ten successful file versions with rollback. Server-side rendering and server functions still require a container; local caches do not replace Space backups.

Full release notes on GitHub ↗

• ✳Fix Git deployments and application placement when an Orbit standby becomes the active server.

Full release notes on GitHub ↗

• ✳Connect servers across providers and NAT through a managed WireGuard network, including an existing installation.

Full release notes on GitHub ↗

• ✳Spaces, backups, activity and operations get Orbit's illustrated look, and database storage becomes easier to understand.

Full release notes on GitHub ↗

• ✳Databases get illustrated cards, clearer navigation and a place for each part of their daily care.

Full release notes on GitHub ↗

• ✳Settings gets a place for everything, with search, theme previews and Ted at the controls.

Full release notes on GitHub ↗

• ✳The three-server dialog knows which servers can reach each other, and the server fleet gets Orbit's illustrated look.

Full release notes on GitHub ↗

• ✳Creating a project feels alive, and the catalog has its own place in the navigation.

Full release notes on GitHub ↗

• ✳A server that cannot join the control plane goes back to being an agent instead of staying broken.

Full release notes on GitHub ↗

• ✳A terminal in the browser, a catalog of ready applications, imports from Coolify, Dokploy, Heroku and Render, and the high availability acceptance running on real servers in one command.

Full release notes on GitHub ↗

• ✳Configure an existing domain's DNS directly from Orbit, starting with Cloudflare.

Full release notes on GitHub ↗

• ✳The project page gets a mission-control overview, with Ted reacting to the application's reported state and a clearer branch choice for each environment.

Full release notes on GitHub ↗

• ✳DigitalOcean migrations have a guided flow from discovery to a verified DNS switch.

Full release notes on GitHub ↗

• ✳Backups can keep a number of good copies, and wait for a restarting database before taking a snapshot.

Full release notes on GitHub ↗

• ✳People can sign in with GitHub or Google, to the account whose email the provider has verified, and accept invitations the same way.

Full release notes on GitHub ↗

• ✳S3 storage becomes Spaces: a place for files with its own list, its own button and a page that talks about files.

Full release notes on GitHub ↗

• ✳The console can answer at a hostname of your own, chosen while installing or later in Settings, without ever locking you out.

Full release notes on GitHub ↗

• ✳A database's page shows what its storage is made of and why it grows, and the storage it uses reads with one decimal.

Full release notes on GitHub ↗

• ✳A database's memory and planned storage change from the console, a database that runs out of memory opens an incident, and backups no longer use the database's memory.

Full release notes on GitHub ↗

• ✳Signing in to Orbit can take a code from an authenticator app, and the administrator can require it for everyone.

Full release notes on GitHub ↗

• ✳Orbit warns before something breaks: a disk filling up, a server short of memory or CPU, a database near its storage, a certificate about to expire or a scheduled backup that did not run.

Full release notes on GitHub ↗

• ✳A new kind of database, S3 storage, gives applications a bucket for files that is referenced and backed up like any other data.

Full release notes on GitHub ↗

• ✳Orbit checks that every web application answers, opens an incident when one stops, and can publish a public status page.

Full release notes on GitHub ↗

• ✳Restore tests run on their own schedule, can be run by hand, and stop at a time limit.

Full release notes on GitHub ↗

• ✳The console and previews can go through Cloudflare Tunnel too.

Full release notes on GitHub ↗

• ✳Servers that cannot receive traffic on ports 80 and 443 can serve applications through Cloudflare Tunnel.

Full release notes on GitHub ↗

• ✳Scripts and CI pipelines can use Orbit's API with workspace API tokens, and orbit deploy deploys from a pipeline.

Full release notes on GitHub ↗

• ✳Servers that join get a token that can only add agents, and the cluster's join tokens can be renewed from the console.

Full release notes on GitHub ↗

• ✳A PostgreSQL database whose cluster is changing or cannot recover says so on its page.

Full release notes on GitHub ↗

• ✳Every server keeps the addresses of the others up to date in its firewall.

Full release notes on GitHub ↗

• ✳Backups of databases larger than a few dozen kilobytes pass their restore test again, and restores copy the whole backup.

Full release notes on GitHub ↗

• ✳Applications on a server that joined from another network reach the cluster, and every join checks that they do.

Full release notes on GitHub ↗

• ✳Servers on separate networks with the same private range now actually join through their public addresses.

Full release notes on GitHub ↗

• ✳Servers on separate networks, such as two Oracle Cloud VCNs, can now share one cluster through their public addresses.

Full release notes on GitHub ↗

• ✳A server on another private network with the same range is told so, and a server whose installation failed can be discarded.

Full release notes on GitHub ↗

• ✳A server you stop adding before its installation can be discarded from every step, and a server on a private network that its peers cannot reach on it says so.

Full release notes on GitHub ↗

• ✳See what each project costs a month, from the prices of your servers.

Full release notes on GitHub ↗

• ✳Retrying a server that stopped at "Installing the agent" after Orbit restarted now finishes.

Full release notes on GitHub ↗

• ✳On Oracle Cloud, a server that cannot join now tells you the exact rule to add and where, and Orbit gets through the firewall Oracle's images ship with.

Full release notes on GitHub ↗

• ✳An operation that stopped running can be cancelled again, and no longer blocks updates.

Full release notes on GitHub ↗

• ✳Adding a server on a private network, such as Oracle Cloud's, no longer waits forever at "Starting services".

Full release notes on GitHub ↗

• ✳Pull request previews can now open on your own domain, under one wildcard certificate.

Full release notes on GitHub ↗

• ✳Database clients can now save the tunnel to a database, and Lily DB opens it in one click.

Full release notes on GitHub ↗

• ✳Orbit can now create the DNS records of custom domains in Cloudflare.

Full release notes on GitHub ↗

• ✳Adding a server no longer stops while installing the runtime.

Full release notes on GitHub ↗

• ✳Orbit now sends email: notifications to a list of addresses, and workspace invitations.

Full release notes on GitHub ↗

• ✳A project can now run more than one application on the same database.

Full release notes on GitHub ↗

• ✳Losing the main server no longer leaves the cluster without DNS when another server came back before.

Full release notes on GitHub ↗

• ✳Workspaces now have members with roles.

Full release notes on GitHub ↗

• ✳Notifications now reach Discord too.

Full release notes on GitHub ↗

• ✳Orbit now tells a Slack channel when something needs you.

Full release notes on GitHub ↗

• ✳Orbit now builds and deploys from Bitbucket Cloud.

Full release notes on GitHub ↗

• ✳Orbit now builds and deploys from GitLab, on gitlab.com or your own GitLab.

Full release notes on GitHub ↗

• ✳Orbit now runs MongoDB next to PostgreSQL, MySQL and Redis.

Full release notes on GitHub ↗

• ✳Orbit now has an acceptance test for losing any one server, and this release fixes what it found.

Full release notes on GitHub ↗

• ✳Orbit can now keep copies of itself on the control plane and come back on another server when the main server is lost.

Full release notes on GitHub ↗

• ✳Orbit now works on providers that give the server only an address inside their network, such as Oracle Cloud, AWS, Google Cloud and Azure.

Full release notes on GitHub ↗

• ✳Kubernetes can now run its control plane on three servers, so the cluster keeps working when the main server is lost.

Full release notes on GitHub ↗

• ✳Receive traffic on a server's card runs the router there too. Orbit waits for it, checks that the server answers on port 80, and takes the change back if it does not, with the firewall rule to add.
• ✳With more than one server receiving traffic, every custom domain lists an A record per server, subdomains included. A domain that was already verified shows the records again and keeps being checked until all of them resolve.
• ✳The Servers page marks the servers that receive traffic, and the activity says which addresses traffic enters through.
• ✳Limit — Generated sslip.io addresses still point to the main server only.
• ✳Limit — When a server that receives traffic is lost, visitors whose DNS picked it get no answer until their resolver stops returning it. In testing, requests through the main server kept working, apart from those sent to the lost server's instance: 8 of 71 failed in the first 52 seconds.
• ✳Limit — If the main server is lost, the others keep answering, but requests sent to the instances that ran on it fail, because the control plane that would take them out of the routers' lists runs there.

Full release notes on GitHub ↗

• ✳The Servers preview simulates losing each chosen server. If the others would not have room for the instances that move to them, next to everything already there, it refuses and names the server and the missing memory. When it fits, it says how much room would be left.
• ✳Every server keeps that room. A later change on it, such as another application, a database or a resize, is refused if it would take the room away.
• ✳Resizing a spread application runs the same check.
• ✳The Servers page shows how much memory each server keeps for instances that would move there, and which loss needs it.

Full release notes on GitHub ↗

• ✳Servers in an application's settings moves it to another server or spreads its instances across several. A preview shows how many instances each server would hold and what stays free, and refuses a server that is not ready, has no room or has another CPU architecture than a built image.
• ✳When a server is lost, the instances it ran start again on the other servers. In testing this took about a minute and a half, and the other instances kept serving meanwhile.
• ✳Built images are copied to every chosen server before an instance starts there.
• ✳Limit — With one instance, the application still stops until that instance starts on another server. Use two or more.
• ✳Limit — Traffic still enters through the main server, and moving instances needs the control plane that runs there. Losing the main server stops both. That is why Orbit does not call this high availability yet.

Full release notes on GitHub ↗

• ✳Orbit's documentation is public at orbit.getcortexlabs.com, in English and Portuguese.
• ✳The documentation covers installing, projects, applications, GitHub and previews, Compose imports, databases, replicas and failover, backups and recovery, more servers, running and updating Orbit, security, and what Orbit does not promise.
• ✳Warnings in the console that state a limit now link to the page that explains it, in your language. This covers the single control plane, data loss with asynchronous replication, synchronous replication with two instances, and several instances on one server.
• ✳The recovery guide shown when an update is interrupted, and the Documentation= line of the systemd units, point to the new site instead of a private repository.

Full release notes on GitHub ↗

• ✳Rebuild from the archive. When every instance of a PostgreSQL database is gone, its page offers to rebuild it from the last base backup and the archived WAL. Orbit recreates the instances on the same servers and tells you up to which commit the data came back.
• ✳Measured failovers. Every failover and switchover records how long the database had no primary. It also records what was kept: every committed write with synchronous replication, or the time of the newest write the new primary has with asynchronous replication. The activity, the timeline and the database page show both.
• ✳The database panel is now called Instances and replication. Orbit does not call it high availability while its control plane runs on one server.
• ✳With asynchronous replication, a primary cut off from the network now stops accepting writes about half a minute after the cut, well before a replica takes over. Before, sessions it already had could keep writing for up to three minutes, so two primaries could accept writes at the same time.
• ✳Synchronous replication only promotes a replica that holds every committed write.
• ✳The preview refuses synchronous replication with two instances, since losing either server would stop all writes.
• ✳A WAL file that is not full is archived after one minute instead of five, so losing every instance loses at most about a minute of writes.
• ✳A stopped server meant about 64 seconds without a primary, and no acknowledged write was lost.
• ✳A server cut off from the network meant 96 seconds without a primary, and there were never two writable primaries.
• ✳Restoring to the second before a destructive change took about a minute.
• ✳Rebuilding from the archive brought writes back 51 seconds after every instance was lost.

Full release notes on GitHub ↗

• ✳A PostgreSQL database on CloudNativePG runs one to three instances, each on a different server. The preview picks the servers and refuses when there are not enough with room for the database.
• ✳Replication is asynchronous by default. Synchronous replication makes each commit wait for a replica.
• ✳When the primary's server is lost, a replica is promoted and the database's address follows it, so applications keep their variables.
• ✳Make primary promotes a replica on purpose. In testing this took about 10 seconds.
• ✳The database page lists each instance with its server, its role and how far it is behind. Failovers and switchovers appear in the activity and on the timeline.

Full release notes on GitHub ↗

• ✳A database on CloudNativePG whose backups go to external storage also archives its WAL there, continuously.
• ✳The database page shows the window you can restore to, from the oldest base backup kept to the last archived WAL. It says so when archiving falls behind or fails, and the database shows as degraded.
• ✳Restore to a point in time takes any second in that window. Orbit keeps a copy of the current data first, recovers the archive into a temporary cluster at that moment, copies the data back in one transaction and restarts the applications that use the database.

Full release notes on GitHub ↗

• ✳Orbit installs the CloudNativePG operator and its Barman Cloud plugin when the first PostgreSQL database is created.
• ✳Existing PostgreSQL databases show Move to CloudNativePG. A preview says how long writes pause, where the backup goes and whether the server has disk for a second copy. Orbit backs up, copies the data while reads keep working, switches the database's address and restarts the applications that use it.
• ✳If a step of the move fails, the old database is put back and accepts writes again. Its volume stays on the server, read-only, until you remove it.

Full release notes on GitHub ↗

• ✳Scale automatically in an application's settings adds instances while CPU stays above a target, and removes them after 5 minutes below it.
• ✳The resource preview reserves room for the maximum number of instances, so scaling up never runs out of room on the server.
• ✳Deploys and resource changes keep the number of instances the autoscaler chose.
• ✳An Instances chart shows the scaling, and the timeline lists each change with the CPU that caused it.

Full release notes on GitHub ↗

• ✳Settings > Orbit updates shows the running version and any newer release, with its notes.
• ✳Before an update starts, a preflight checks the release's signature, free disk, running operations and the server's agent.
• ✳An update backs up Orbit's data, downloads and verifies the release, restarts on the new version and applies its migrations.
• ✳If the new version never starts, a guard puts the previous one back after three minutes. If the console is unreachable, orbit update rollback does the same from the server.
• ✳Releases are now signed with Ed25519. Orbit refuses to update from a release whose signature does not match the key it ships with.

Full release notes on GitHub ↗

• ✳When an application is killed for running out of memory twice within 30 minutes, Orbit opens an incident.
• ✳The incident shows the restarts, memory against the limit, incoming traffic and the last deploy, each with where it came from, and keeps possible causes separate from facts.
• ✳Raising the limit from the incident goes through the resource preview. The incident resolves after 10 minutes without a restart.

Full release notes on GitHub ↗

• ✳An application's memory, CPU and number of instances can be changed from its settings on a real server.
• ✳A preview shows what the change reserves on the server and how it rolls out. It warns when builds lose their headroom or the new limit is below recent usage, and blocks a change that does not fit.
• ✳If the new instances do not become ready, the previous values are put back.

Full release notes on GitHub ↗

• ✳Metrics. Every 30 seconds Orbit samples CPU, memory, network and restarts for each application, storage and connections for each database, and usage for each server. It keeps eight days. Charts show gaps where sampling stopped, and a timeline lists deploys, rollbacks, restarts and changes.
• ✳Browse data. A database's tables, their rows and Redis keys can be browsed from the console. The Query tab runs one read-only SQL statement, limited to 15 seconds and 500 rows, and every query is recorded in the activity.

Full release notes on GitHub ↗

• ✳Import data brings a database in from another server, using its connection URL, or from a dump file of up to 64 GiB. The import becomes a backup marked as imported and goes through the same isolated restore test before you restore it. The URL is never written to logs.
• ✳Fixed — An application that stops right after starting now fails with its exit code and its last lines, instead of looking like a health check that never answered.

Full release notes on GitHub ↗

• ✳Show credentials on a database's page gives the user, the password and the command for an SSH tunnel through the main server. You can then connect psql, DBeaver or TablePlus from your computer without making the database public. Every reveal is recorded in the activity.

Full release notes on GitHub ↗

• ✳Backups can run every hour or every few hours at a chosen minute, every day at a chosen time, on chosen weekdays, or on a custom cron. They follow any time zone, including daylight saving changes.
• ✳The policy shows the next three backups before you save it. A new database asks for its daily backup time and time zone.
• ✳Fixed — Creating a database from the new database dialog or from a Compose import no longer fails on a real server for lack of a backup schedule.
• ✳Fixed — The console no longer shows sample text from the demo on a real installation.

Full release notes on GitHub ↗

• ✳Projects can be renamed and recolored. Staging and development environments can be removed, and so can whole projects, applications and databases. Each removal asks you to type the name. Backup files are kept.
• ✳Fixed — Enrolling an agent again revokes the certificates its server had before.
• ✳Fixed — Orbit refuses commands from an agent enrolled for a server it does not know, and its log names that server.

Full release notes on GitHub ↗

• ✳Fixed — Updating with the install command now restarts the agent when its binary changed. Before, it kept running the old version until the server rebooted.

Full release notes on GitHub ↗

• ✳Pull request previews. Every pull request from a branch of the repository gets its own copy of the services built from it, with empty databases, at its own address. The preview is removed when the pull request closes. Pull requests from forks never get a preview.
• ✳Docker Compose import. A Compose file from a repository or pasted in becomes a plan to review. Databases become managed databases, services become applications or workers, and variables become variables, secrets or references.
• ✳MySQL 8.4 databases, with verified backups and restores that never leave a half-loaded database.
• ✳Kubernetes view. With advanced mode on in your account settings, applications and databases show their Kubernetes resources, manifests and events, read-only and without secrets.

Full release notes on GitHub ↗

• ✳More servers. Add Server connects over SSH, checks the machine and joins it to the cluster, with traffic between servers encrypted by WireGuard. New services can be placed on it. More servers add room, not high availability.
• ✳Fixed — A real console no longer shows the demo's sample user or its "simulated data" notice.

Full release notes on GitHub ↗

• ✳Workers and jobs. An application can have workers, which run without an address, and scheduled jobs, which run on a cron schedule in UTC or on demand with Run now. Orbit keeps the last five successful and five failed runs of a job with their output.

Full release notes on GitHub ↗

• ✳Deploy on push. A push to an application's branch deploys that commit when "Deploy automatically" is on. GitHub's deliveries are signed, and the same delivery never deploys twice.

Full release notes on GitHub ↗

• ✳Workspaces. Projects, the GitHub connection, registry credentials, backup storages and activity belong to a workspace, and the console can switch, create and rename them. Servers are shared. Everything that existed before is in a workspace called "Default".

Full release notes on GitHub ↗

• ✳The GitHub App can now be installed on your account or on any of your organizations.
• ✳The App is named after its server ("Orbit" plus the server's name), and Settings > Integrations offers Orbit's logo to upload on GitHub.

Full release notes on GitHub ↗

• ✳Orbit installs on Ubuntu 26.04 LTS.

Full release notes on GitHub ↗

• ✳Install. The install command checks the machine and installs K3s, Traefik, cert-manager, BuildKit and Orbit's agent. If it stops halfway, running it again resumes where it stopped.
• ✳Console. The console is published at its own HTTPS address on the server, with a Let's Encrypt certificate.
• ✳Applications. Deploy from a container image, or from a GitHub repository that Orbit builds on the server. Each gets an HTTPS address, custom domains, variables and secrets, health checks, rollbacks and logs with secrets removed.
• ✳Databases. PostgreSQL and Redis databases can be connected to applications through references. Credentials can be rotated, access can be made public, and versions can be upgraded.
• ✳Backups. Backups go to S3-compatible storage on a schedule. Each one is restored in isolation before it counts as verified, and a restore can take a copy of the current data first.
• ✳Your data. orbit backup and orbit restore save and recover Orbit's own data from the server.

Full release notes on GitHub ↗