Skip to content

0.3.0

Released 2026-06-08.

The production-readiness and multi-tenancy release. 0.3.0 turns the phase-1 backend into something deployable in a real, multi-tenant production posture: native authentication and TLS, operational endpoints and structured logging, bounded on-disk growth, fast restart, packaged release artifacts, and — the headline — per-tenant isolated graphs.

Unlike 0.2.0, this is not a wire-contract break: a 0.2.x OTLP producer keeps working unchanged. Everything new is opt-in and off by default, so an upgrade with no config changes behaves as before — with the operational endpoints added. The one behavioral change for existing deployments is the on-disk layout, and it is migrated automatically. See the 0.2 → 0.3 migration guide.

Added

  • Multi-tenancy — per-tenant isolated graphs. One Toise instance serves multiple tenants, each with its own {store, projection, change-engine} stack under <data-dir>/<tenant>/. The tenant id is generic and vendor-neutral — the X-Scope-OrgID request metadata (the Mimir/Loki/Tempo/VictoriaMetrics de-facto standard) or a tenant.id resource attribute, falling back to default. Ingest routes per ResourceLogs; queries (GraphQL, MCP, debug UI) are scoped by header; a query for tenant A never sees tenant B. See Multi-tenancy.
  • Native authentication and TLS. Bearer tokens (TOISE_AUTH_TOKENS, environment-only) on the ingest and query surfaces, plus TLS from a cert/key pair. Both off by default; the operational probes and metrics scrape stay public.
  • Operational endpoints and structured logging. /healthz, /readyz (per-tenant), and a Prometheus /metrics endpoint sampled at scrape time. --log-level controls structured-log verbosity.
  • Retention pruning. retention_max_age bounds on-disk growth while preserving the current-state projection.
  • Projection snapshots and backup/restore. snapshot_interval bounds restart time by snapshot age rather than total history; a consistent, lock-free store checkpoint backs up the data dir.
  • Packaged release artifacts. Static binaries (linux/darwin/windows), a distroless OCI image on GHCR, a Dockerfile, and deploy/ systemd + docker-compose examples.

Changed

  • --production hardening. One flag turns off GraphQL introspection, the /playground, and the debug UI; allowed_origins gates browser WebSocket origins.
  • On-disk layout is per tenant. A 0.2.x data directory is migrated under <data-dir>/default/ automatically on first start — back up before upgrading.
  • toise-probe emits connected_to topology relations instead of the legacy adjacent_to.

Security

Authentication, TLS, and --production make an exposed deployment viable. Multi-tenant isolation is by X-Scope-OrgID; a valid token may still set any tenant id, so isolation relies on the upstream OTel Collector authenticating each client and stamping its tenant. Per-token tenant binding is future work.