Release v2.1.2

[jakwinkler]

Releases the bootstrap repairs already merged to main (#153). One commit: the version bump and the changelog split.

Why a new version

2.1.1 is published: tagged yesterday at 17:15, with binaries and a Homebrew formula built from commit 0718d02. Every fix merged since then sits on main but has never been built, because a release is only produced when the VERSION file changes. Shipping these under 2.1.1 would mean moving a published tag, so the same version name would refer to different code for people who installed yesterday and today.

Changelog

The 2.1.1 section is restored to exactly what that release shipped: the sudo-rs rules, the first attempt at the PHP repository, the supported-release entry and the narrower passwordless sudo scope.

The new 2.1.2 section carries the fourteen entries added since, all found by running magebox bootstrap on a fresh Ubuntu 26.04 machine. They form a chain where each failure hid the next:

• Bootstrap skipped rewriting an existing sudoers file, so 2.1.1's own fix never reached anyone who had run an older version.
• A repository with nothing for the release made apt update exit non-zero, and bootstrap gave up before reaching the code that repairs that repository.
• One half-configured package made every apt install exit 100, so nothing could be installed at all.
• The repository file was written root-only, so apt run as the user saw no PHP packages and skipped all of them silently.
• Pinning the PPA to an older suite (2.1.1's approach) yields packages whose dependencies 26.04 cannot satisfy. It now uses packages.sury.org, which publishes for this release.
• Run as root, bootstrap built the environment under /root, including an nginx include nginx cannot read.
• php-fpm.conf accumulated duplicate includes until PHP-FPM refused to start, which then broke unrelated package installs.
• One vhost naming a missing certificate stopped nginx entirely.
• Docker permission errors were reported as a stopped daemon.
• dnsmasq counted as installed when only its library package was present, and the resolver override was written mode 600, so systemd-resolved refused it silently.
• DNS was reported working when only dnsmasq answered, not the system resolver.
• The certificate authority counted as installed because a file existed, while the browser trusted a different one.

Four of these share one mistake: checking that a file exists instead of checking that the thing works.

Verification

Check	Result
go test ./...	26 packages pass
golangci-lint v2	0 issues
gofmt	clean
Live Ubuntu 26.04 machine	PHP 8.1–8.5 installed, nginx serving, .test resolving, HTTPS trusted

After merge, the tag has to be deleted and re-pushed locally so the release build runs, as with previous releases.

🤖 Generated with Claude Code

[github-actions]

📦 PR build artifacts

• magebox-darwin-amd64
• magebox-darwin-arm64
• magebox-linux-amd64
• magebox-linux-arm64

Built from b065461 — view run. Artifacts expire in 14 days.

Note: artifact download links require being signed in to GitHub with access to this repository.