Reset version to 1.0.0 and add TODO/CHANGELOG

Reset all Path A script versions from 3.x to 1.0.0 following architectural
decision to treat this as a fresh stable baseline after the Path B cleanup.
Added TODO.md with prioritized audit findings and replaced the old CHANGELOG
with a clean stub.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -1,257 +1,38 @@
 # Changelog
 
-All notable changes to HOPS will be documented in this file.
+All notable changes to HOPS will be documented here.
-
+Format based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [3.3.0] - 2025-01-19
-
-### Added
-- **🔄 Automatic Updates**: Git-based update mechanism with backup functionality
-- **📱 Command Line Interface**: New flags for update management
-  - `--update`: Update HOPS to latest version automatically
-  - `--check-updates`: Check for available updates (returns exit code 1 if updates available)
-  - `--version`: Display current version information
-  - `--help`: Show comprehensive help and usage information
-- **🛡️ Safe Updates**: Automatic backup of local changes before updating
-- **📋 Change Tracking**: Display recent changes and version comparison during updates
-- **🎛️ Interactive Updates**: Update checking integrated into main menu (option 6)
-
-### Changed
-- **Version Numbering**: Updated to v3.3.0 across all components
-- **Menu Structure**: Added "Check for Updates" as menu option 6, shifted other options
-- **Documentation**: Updated README.md and CLAUDE.md with new update functionality
-- **Color Code Handling**: Removed duplicate color definitions, now sourced from lib/common.sh
-
-### Fixed
-- **Script Compatibility**: Resolved readonly variable conflicts between main script and libraries
-- **Update Process**: Robust error handling and rollback for failed updates
-- **Exit Codes**: Proper exit codes for command-line operations
-
-### Security
-- **Backup Protection**: Local changes are automatically backed up before any updates
-- **Git Validation**: Comprehensive validation that HOPS is in a git repository before updates
-- **Privilege Handling**: Updates require appropriate privileges (root/sudo) for system changes
-
-## [3.2.0] - 2024-07-18
-
-### Added
-- **Caddy Support**: Added Caddy reverse proxy as a service option
-- **Enhanced macOS Compatibility**: Comprehensive improvements for macOS installation and operation
-- **Docker Desktop Integration**: Improved Docker Desktop startup and management on macOS
-- **Keychain Integration**: Proper Docker authentication with macOS keychain on macOS
-
-### Fixed
-- **User Directory Fixes**: All directories now use actual user home instead of root on macOS
-- **Password Generation**: Resolved `shuf` command and encoding issues on macOS
-- **Container Creation**: Fixed Docker Compose working directory and execution context issues
-- **Healthcheck Improvements**: Enhanced service health monitoring, particularly for Jellyseerr
-- **File Permissions**: Proper ownership of all directories and files across platforms
-- **Docker Compose Warnings**: Resolved version warnings and compatibility issues
-
-### Changed
-- **macOS File Structure**: Improved directory layout using user home instead of system directories
-- **Error Handling**: Enhanced error messages and troubleshooting information for macOS
-- **Documentation**: Updated platform-specific installation and configuration guides
-
-### Security
-- **Secure Authentication**: Enhanced Docker authentication methods on macOS
-- **File Ownership**: Improved file permission management across all platforms
-
-## [3.1.0-beta] - 2024-06-15
-
-### Added
-- **Encrypted Secret Management**: All passwords and sensitive data now encrypted with AES-256
-- **Input Validation**: Comprehensive validation preventing injection attacks
-- **Privilege Separation**: Root operations separated from user operations for enhanced security
-- **Pinned Container Versions**: All container images use specific versions, not `latest`
-- **Modular Architecture**: Shared code organized in `lib/` directory for better maintainability
-- **Cross-Platform Support**: Native support for Linux, macOS, and Windows (WSL2)
-- **Enhanced Error Handling**: Better error messages and recovery mechanisms
-- **Improved Service Definitions**: Standardized service generation with validation
-- **Complete Documentation**: Added `CLAUDE.md` for development guidance
-
-### Changed
-- **Installation Methods**: New secure installer `setup` script as recommended method
-- **Service Management**: New `user-operations` script for non-privileged service management
-- **Architecture**: Modular library system replacing monolithic scripts
-- **Security Model**: Clear separation between privileged and user operations
-
-### Security
-- **AES-256 Encryption**: All secrets stored encrypted with master key management
-- **Input Sanitization**: Comprehensive validation preventing code injection
-- **Container Security**: Pinned versions preventing supply chain attacks
-- **Privilege Minimization**: Reduced root access requirements
-
-## [3.0.0] - 2024-05-01
-
-### Added
-- **Cross-Platform Support**: Full support for Linux, macOS, and Windows (WSL2)
-- **Automatic Dependency Installation**: Docker and system requirements installed automatically
-- **Platform Detection**: Intelligent OS detection and platform-specific optimizations
-- **Enhanced Service Catalog**: Expanded service definitions with health checks
-- **Comprehensive Logging**: Detailed logging system for troubleshooting
-- **Service Health Monitoring**: Built-in health checks for all services
-- **Rollback Capabilities**: Automatic rollback on deployment failure
-
-### Changed
-- **Installation Process**: Streamlined installation with better user experience
-- **Directory Structure**: Platform-appropriate directory layouts
-- **Service Definitions**: Standardized Docker Compose patterns
-- **Error Handling**: Improved error messages and recovery procedures
-
-### Fixed
-- **Port Conflict Detection**: Better handling of port conflicts
-- **Permission Issues**: Improved file permission management
-- **Service Dependencies**: Enhanced dependency resolution
-
-## [2.1.0] - 2024-03-15
-
-### Added
-- **Huntarr Support**: Missing media discovery and automation
-- **Jellystat Support**: Jellyfin statistics and monitoring
-- **Watchtower Integration**: Automatic container updates
-- **Enhanced Monitoring**: Improved service status monitoring
-- **Backup Utilities**: Built-in backup and recovery tools
-
-### Changed
-- **Service Management**: Improved start/stop/restart functionality
-- **Log Viewing**: Enhanced centralized log viewing
-- **Configuration Management**: Better environment variable handling
-
-### Fixed
-- **Memory Usage**: Optimized resource usage for low-resource systems
-- **Startup Issues**: Resolved service startup race conditions
-- **Network Configuration**: Fixed Docker network isolation issues
-
-## [2.0.0] - 2024-02-01
-
-### Added
-- **Management Interface**: Comprehensive web-based management
-- **Security Hardening**: Automatic firewall configuration and secure passwords
-- **Service Templates**: Standardized service definitions
-- **Real-time Monitoring**: Live service status and resource monitoring
-- **User Interface**: Menu-driven installation and management
-
-### Changed
-- **Architecture**: Complete rewrite with modular design
-- **Installation**: Simplified one-command installation
-- **Configuration**: Centralized configuration management
-
-### Breaking Changes
-- **Directory Structure**: New standardized directory layout
-- **Configuration Format**: Updated environment variable structure
-- **Service Names**: Standardized container and service naming
-
-## [1.2.0] - 2024-01-15
-
-### Added
-- **Authelia Support**: Multi-factor authentication and SSO
-- **Nginx Proxy Manager**: Alternative reverse proxy option
-- **Enhanced SSL**: Automatic SSL certificate management
-- **Service Discovery**: Automatic service registration
-
-### Fixed
-- **Traefik Configuration**: Improved reverse proxy setup
-- **SSL Issues**: Resolved certificate generation problems
-- **Network Routing**: Fixed internal service communication
-
-## [1.1.0] - 2023-12-01
-
-### Added
-- **Traefik Integration**: Automatic reverse proxy with SSL
-- **Service Categories**: Organized services by function
-- **Dependency Management**: Automatic service dependency resolution
-- **Health Checks**: Service health monitoring and restart
-
-### Changed
-- **Service Definitions**: Improved Docker Compose templates
-- **Network Configuration**: Enhanced Docker networking
-
-## [1.0.0] - 2023-11-01
-
-### Added
-- **Initial Release**: Core HOPS functionality
-- **Service Support**: Basic *arr stack, download clients, and media servers
-- **Docker Integration**: Docker Compose based deployment
-- **Linux Support**: Ubuntu/Debian/Mint support
-- **Basic Management**: Simple service management interface
-
-### Features
-- **Automated Installation**: One-command deployment
-- **Service Selection**: Interactive service selection
-- **Basic Security**: Firewall rules and secure passwords
-- **Directory Management**: Automatic directory creation and permissions
 
 ---
 
-## Version Support
+## [Unreleased]
 
-- **v3.3.x**: Current stable release with automatic update support
+### Removed
-- **v3.2.x**: Previous stable release, upgrade recommended
+- Path B install pipeline (setup, privileged-setup, user-operations,
-- **v3.1.x**: Beta features, limited support
+  services-improved, lib/privileges.sh) -- dead code, never wired in
-- **v3.0.x**: Legacy support for critical bugs only
-- **v2.x and earlier**: No longer supported
 
-## Upgrade Path
+### Changed
-
+- Version reset to 1.0.0
-### From v3.2.x to v3.3.0 (Recommended - Automatic)
-```bash
-# Use built-in update system
-cd /path/to/hops
-sudo ./hops --update
-
-# Or use interactive menu
-sudo ./hops
-# Select option 6: Check for Updates
-```
-
-### From v3.1.x to v3.3.0 (Manual)
-```bash
-# Backup current installation
-sudo tar -czf hops-backup-$(date +%Y%m%d).tar.gz ~/hops /opt/appdata
-
-# Pull latest version
-cd ~/hops
-git pull origin main
-
-# Run upgrade
-sudo ./setup --upgrade
-```
-
-### From v3.0.x to v3.2.0
-```bash
-# Major version upgrade requires fresh installation
-# Backup data first
-sudo ./uninstall --keep-data
-sudo ./setup
-```
-
-### From v2.x to v3.2.0
-```bash
-# Migration script available
-sudo ./migrate-from-v2.sh
-```
-
-## Migration Notes
-
-### v3.2.0 Changes
-- **macOS Users**: Directory structure has changed, migration handled automatically
-- **Caddy Users**: Manual Caddyfile configuration required
-- **Configuration**: Encrypted secrets now default for new installations
-
-### v3.1.0 Changes
-- **Security**: All passwords moved to encrypted storage
-- **Architecture**: New modular library system
-- **Privileges**: Installation process now uses privilege separation
-
-### v3.0.0 Changes
-- **Cross-Platform**: New platform detection and configuration
-- **Directories**: Platform-specific directory structures
-- **Services**: Updated service definitions and health checks
 
 ---
 
-For detailed upgrade instructions, see [INSTALLATION.md](INSTALLATION.md).  
+## [1.0.0] - TBD
-For breaking changes and migration help, see [ADVANCED.md](ADVANCED.md).
+
+Full rewrite and stabilization of the Path A install pipeline.
+
+### Fixed
+- Infinite recursion in get_timezone_mount() and get_gpu_devices() on Linux
+- ((x++)) abort under set -e across hops and install
+- Glob stored as string breaking multi-user directory detection
+- Missing hops_service_definitions.sh reference in firewall setup
+
+### Security
+- Replace broken AES-GCM encryption with supported cipher
+- Move passphrases off command line (use fd-based passphrase input)
+- Remove committed default Authelia credential
+- Use mktemp for temp files instead of predictable /tmp paths
+
+### Changed
+- Single canonical service catalog (services)
+- Latest image tags throughout
+- lib/secrets.sh wired into install flow for .env encryption at rest

README.md

@@ -1,7 +1,7 @@
 # HOPS - Homelab Orchestration Provisioning Script
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/Version-3.3.0-blue.svg)]()
+[![Version](https://img.shields.io/badge/Version-1.0.0-blue.svg)]()
 [![Platform](https://img.shields.io/badge/Platform-Linux%20%7C%20macOS%20%7C%20Windows-orange.svg)]()
 
 **HOPS** is a comprehensive automation tool for deploying homelab infrastructure using Docker Compose. Deploy and manage popular homelab services including media servers, download clients, monitoring tools, and more through an intuitive menu-driven interface.

TODO.md

@@ -0,0 +1,263 @@
+# HOPS TODO
+
+Generated by codebase audit (2026-06-10). Ranked by severity.
+
+## Decisions (2026-06-10)
+
+- **Canonical pipeline**: Path A (`hops` -> `install` -> `services`). Path B deleted.
+- **Deleted**: `setup`, `privileged-setup`, `user-operations`, `services-improved`,
+  `lib/privileges.sh` -- all Path B artifacts, gone.
+- **Service catalog**: `services` is the single source of truth. Latest tags kept.
+- **`lib/secrets.sh`**: keep and fix. Goal is to encrypt the `.env` file at rest
+  (passwords/API keys written by `install`). Fix the broken AES-GCM crypto and
+  wire encryption/decryption into the install flow.
+- **macOS**: future roadmap. Linux is the target for now.
+
+---
+
+## CRITICAL BUGS (breaks primary use cases)
+
+### B1 -- Infinite recursion in `services` on Linux [CRITICAL]
+- File: `services:25-46`
+- `get_timezone_mount()` and `get_gpu_devices()` call themselves on the non-Darwin
+  branch via `echo "$(get_timezone_mount)"`. Hits bash FUNCNEST limit on every
+  Linux compose generation. Main `./hops` install is broken on Linux.
+- Fix: replace the recursive calls with the literal YAML strings they should emit.
+
+### B2 -- Brace mismatch in `lib/privileges.sh` [CRITICAL] -- RESOLVED: delete file
+- File: `lib/privileges.sh:429,612`
+- Moot -- `lib/privileges.sh` is Path B dead code, scheduled for deletion (see A3).
+
+---
+
+## HIGH BUGS
+
+### B3 -- Glob stored as string, directory detection always fails [HIGH]
+- Files: `hops:154-166`, `uninstall:127-147`
+- `homelab_dirs=( "/home/*/hops" )` stores a literal glob; the quoted for-loop
+  never expands it. Multi-user detection is broken, `cd "$HOMELAB_DIR"` fails
+  under `set -e`.
+- Fix: iterate unquoted or use `compgen -G "/home/*/hops"`.
+
+### B4 -- Missing service definitions file reference [HIGH]
+- File: `install:916`
+- `setup_firewall()` sources `"$SCRIPT_DIR/hops_service_definitions.sh"` which
+  does not exist (the file is named `services`). Per-service firewall rules are
+  silently never applied.
+- Fix: correct the filename to `services`.
+
+### B5 -- `((x++))` aborts script under `set -e` [HIGH]
+- Files: `hops:299,317`, `install:784`, and others
+- `((running_count++))` returns exit code 1 when the pre-increment value is 0,
+  which kills the script under `set -e`.
+- Fix: use `running_count=$((running_count + 1))` or append `|| true`.
+
+### B6 -- `hops` entry point is Linux-only despite macOS library support [HIGH]
+- File: `hops:108-136,263`
+- `check_dependencies` requires `systemctl`, `check_system_requirements` calls
+  `free` and `df -BG`, `show_service_status` calls `systemctl`. All Linux-only.
+  The documented entry point fails immediately on macOS.
+- Fix: add OS guards or document `hops` as Linux-only.
+
+### B7 -- Port collisions not detected within a selection [HIGH]
+- File: `services` (port map)
+- sabnzbd and traefik dashboard both use 8080; traefik and nginx-proxy-manager
+  both bind 80/443; authelia and transmission both use 9091.
+- `check_all_ports` only checks host listeners, not intra-selection conflicts,
+  so users can generate an un-startable compose silently.
+- Fix: add intra-selection conflict check before compose generation.
+
+---
+
+## MEDIUM BUGS
+
+### B8 -- Watchtower assigned a bogus port [MED]
+- Files: `lib/docker.sh:47`, `services-improved:90`
+- Watchtower has no web UI. Assigning it port 8080 emits a spurious `ports:`
+  block and broken healthcheck in the generated compose.
+
+### B9 -- Update backup copies into itself [MED]
+- File: `hops:586-595`
+- `update_hops` does `cp -r "$SCRIPT_DIR" "$backup_dir"` where `$backup_dir`
+  is inside `$SCRIPT_DIR`. Results in recursive self-copy including `.git/`.
+- Fix: create the backup dir outside the script directory.
+
+### B10 -- `secure_delete` `stat` flag wrong on macOS [MED]
+- File: `lib/secrets.sh:146`
+- Uses `stat -c%s` (GNU) which fails on macOS (`stat -f%z`).
+  Manual-overwrite fallback silently no-ops on macOS.
+
+### B11 -- `jellystat` generated with wrong template in `services-improved` [MED]
+- File: `services-improved:422`
+- Routed through the generic media-server template; gets no postgres DB and no
+  JWT_SECRET, so it cannot run. The hand-written `services` version is correct.
+
+### B12 -- Empty-password detection regex broken [LOW]
+- File: `lib/security.sh:361-384`
+- `grep "PASSWORD=\s*$"` without `-E` or `-P` means `\s` is matched literally,
+  not as whitespace. Empty-password detection is dead.
+
+---
+
+## SECURITY
+
+### S1 -- Broken/unauthenticated encryption [HIGH]
+- File: `lib/secrets.sh:85,115`
+- `openssl enc -aes-256-gcm` via the CLI does not handle the GCM auth tag.
+  This is not authenticated encryption and round-trips unreliably.
+- Fix: use a supported openssl mode or switch to `gpg --symmetric`.
+
+### S2 -- Passphrases/keys exposed in process list [HIGH]
+- Files: `lib/secrets.sh:85,115`, `lib/security.sh:140,156,175,204,416,442`
+- `-pass pass:"$key"` and `--passphrase "$x"` on the command line are visible
+  to any local user via `ps`.
+- Fix: use `-pass fd:N` or `--passphrase-fd N` with a file descriptor.
+
+### S3 -- Committed default Authelia credential [HIGH]
+- File: `services:1148-1157`
+- `users_database.yml` ships a default admin account with a known password hash
+  (hash of literal "password"). Every Authelia deploy has this credential.
+- Fix: force password change on first login or generate the hash at deploy time.
+
+### S4 -- Traefik dashboard exposed with no auth [MED]
+- File: `services:672-673,684`
+- `api.insecure=true` exposes the Traefik dashboard on :8080 with no auth.
+  Consider disabling or requiring middleware auth.
+
+### S5 -- `eval` on environment-derived value [MED]
+- Files: `install:598,671`, `uninstall:136,462`, `lib/system.sh:306`, others
+- `eval echo "~$SUDO_USER"` expands an env-sourced value through eval.
+- Fix: `getent passwd "$SUDO_USER" | cut -d: -f6`
+
+### S6 -- Predictable temp file paths [MED]
+- Files: `lib/secrets.sh:16,188,288`, `uninstall:374`
+- `/tmp/hops_env_$$` etc. in world-writable `/tmp` are symlink-race targets
+  before the `chmod 600` runs.
+- Fix: use `mktemp` and assign before use.
+
+### S7 -- Commands built as strings, run unquoted [MED]
+- File: `install:731-736,755,773-779`
+- `pull_cmd="sudo -u $SUDO_USER docker compose pull"` run as `$pull_cmd`
+  is fragile with unusual usernames and bypasses quoting.
+- Fix: use bash arrays.
+
+### S9 -- Non-idempotent sysctl append [LOW]
+- File: `privileged-setup:224`
+- `echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf` appended every run.
+  Accumulates duplicate lines.
+- Fix: check before appending (`grep -q ... || echo ... >>`)
+
+---
+
+## ARCHITECTURE / DESIGN
+
+### A1 -- Two divergent install pipelines [HIGH] -- RESOLVED
+- Path A chosen. Delete: `setup`, `privileged-setup`, `user-operations`,
+  `services-improved`.
+
+### A2 -- Three sources of truth for the service catalog [HIGH]
+- `services`: `get_service_ports()` + inline image strings (CANONICAL)
+- `services-improved`: scheduled for deletion (Path B)
+- `lib/docker.sh`: `HOPS_SERVICES` array -- reconcile or remove duplicates
+- Fix: `lib/docker.sh` service maps must match `services`; remove anything
+  only used by Path B.
+
+### A3 -- `lib/privileges.sh` is dead code [MED] -- RESOLVED: delete
+- Path B artifact. Delete it.
+
+### A4 -- `lib/secrets.sh` crypto needs fixing and wiring in [MED]
+- Goal: encrypt the `.env` file at rest after `install` writes it.
+- Fix broken AES-GCM (use `gpg --symmetric` or a supported openssl mode).
+- Fix passphrase-on-command-line exposure (S1, S2).
+- Wire encrypt/decrypt calls into `install` flow.
+
+### A5 -- `hops` duplicates functions from `lib/common.sh` [MED]
+- `log`, `error_exit`, `warning`, `success`, `info`, `validate_timezone`,
+  `validate_password`, `generate_secure_password`, `create_docker_networks`,
+  `get_service_port/image` are all defined twice (or three times).
+- Fix: source `lib/common.sh` from `hops` and remove local duplicates.
+
+### A6 -- Caddy is unreachable via the menu [LOW]
+- `services` defines `generate_caddy` but the `select_services` menu in
+  `install` never lists caddy as a selectable option.
+
+### A7 -- Committed dev artifacts [LOW]
+- `summary7-19.txt` and `discord-header.md` should not be in the repo.
+  Add to `.gitignore` or delete.
+
+---
+
+## MISSING / INCOMPLETE
+
+### M1 -- RESOLVED (Path B deleted)
+
+### M2 -- RESOLVED (Path B deleted)
+
+### M3 -- RESOLVED (Path B deleted)
+
+### M4 -- RESOLVED (`lib/privileges.sh` deleted)
+
+---
+
+## PLATFORM SUPPORT
+
+### P2 -- `uninstall` is Linux-only [HIGH] -- deferred (Linux-first)
+- Unconditional `apt-get`, `dpkg`, `systemctl`, `groupdel`, `ufw` with no
+  OS branching. Acceptable for now; revisit when macOS support is scoped.
+
+### P3 -- RESOLVED (Path B deleted)
+
+### P4 -- No WSL2 detection [MED]
+- README claims WSL2 support but there is no WSL2 detection.
+  `systemctl`-based service management fails on WSL distros without systemd.
+
+### P5 -- Inconsistent port-check tools [MED]
+- `lib/common.sh` uses `ss`; `install` uses `lsof`. `ss` is absent on macOS.
+
+### P6 -- Hardcoded render GID for Jellyfin GPU [LOW]
+- File: `services:435`
+- `group_add: "109"` is the render GID on a specific distro, wrong on most
+  systems and meaningless on macOS.
+
+---
+
+## CODE QUALITY
+
+### Q1 -- Three separate error-handling implementations [MED]
+- `hops`, `uninstall`, and `lib/common.sh` each define their own `error_exit`
+  and `log` with different formats. Consolidate in `lib/common.sh`.
+
+### Q2 -- `set -e` + intentional non-zero returns is a minefield [MED]
+- `validate_password` returns 1/2/3, `check_port` returns 1 -- these work only
+  because they happen to be in conditionals. Combined with B5 this is fragile.
+  Consider `set -euo pipefail` with explicit `|| true` where non-zero is intended.
+
+### Q3 -- Debug `echo` statements left in production code [LOW]
+- Files: `lib/system.sh:605,823,1043,1046,1084,1089,1149-1156`,
+  `privileged-setup:72`
+- `DEBUG:` prefixed echo lines should be removed or gated behind a `$DEBUG` flag.
+
+### Q4 -- `services-improved` leaks `set -e` when sourced [LOW]
+- File: `services-improved` top of file
+- File sets `set -e` then is sourced by `user-operations` and `privileges`,
+  leaking the option into the caller's shell.
+
+---
+
+## SUGGESTED ORDER OF ATTACK
+
+1. Delete Path B files: `setup`, `privileged-setup`, `user-operations`,
+   `services-improved`, `lib/privileges.sh` (A1/A3 -- resolved)
+2. Fix B1 (infinite recursion in `services`) -- unblocks all Linux installs
+3. Fix B5 (`((x++))` under `set -e`) -- prevents silent aborts
+4. Fix B3 (glob directory detection) -- fixes multi-user and uninstall
+5. Fix B4 (wrong filename in firewall setup)
+6. Reconcile `lib/docker.sh` service maps with `services` (A2)
+7. Security pass: S3 (default Authelia cred), S2/S6 (passphrase on cmdline,
+   mktemp), S5 (eval on env var), S7 (string-built commands)
+8. Fix and wire in `lib/secrets.sh`: replace broken crypto, hook into install
+   flow to encrypt `.env` at rest (A4/S1/S2)
+9. Fix B12 empty-password regex, B8 watchtower port, B9 backup self-copy
+10. Consolidate duplicate functions into `lib/common.sh` (A5, Q1)
+11. Remove debug echo statements (Q3)
+12. macOS / WSL2 support (B6, P4) -- future roadmap

hops

@@ -2,13 +2,13 @@
 
 # HOPS - Homelab Orchestration Provisioning Script
 # Primary Management Script
-# Version: 3.3.0
+# Version: 1.0.0
 
 # Exit on any error
 set -e
 
 # Script version and metadata
-readonly SCRIPT_VERSION="3.3.0"
+readonly SCRIPT_VERSION="1.0.0"
 readonly SCRIPT_NAME="HOPS"
 readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 

install

@@ -8,7 +8,7 @@ install_hops() {
     set -e
 
     # Script version for update tracking
-    local SCRIPT_VERSION="3.2.0"
+    local SCRIPT_VERSION="1.0.0"
     local SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
     # Load system utilities

lib/common.sh

@@ -2,7 +2,7 @@
 
 # HOPS - Common Utility Functions
 # Shared functions for logging, error handling, and UI
-# Version: 3.2.0
+# Version: 1.0.0
 
 # Prevent multiple sourcing
 if [[ -n "${HOPS_COMMON_LOADED:-}" ]]; then
@@ -101,7 +101,7 @@ show_hops_header() {
     local subtitle="$2"
     
     if [[ -z "$version" ]]; then
-        version="3.2.0"
+        version="1.0.0"
     fi
     
     clear

lib/docker.sh

@@ -2,7 +2,7 @@
 
 # HOPS - Docker Service Management
 # Functions for Docker service management and monitoring
-# Version: 3.1.0-beta
+# Version: 1.0.0
 
 # Source common functions
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

lib/secrets.sh

@@ -2,7 +2,7 @@
 
 # HOPS - Secret Management System
 # Secure encryption and management of sensitive configuration data
-# Version: 3.1.0-beta
+# Version: 1.0.0
 
 # Source common functions
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -190,7 +190,7 @@ create_encrypted_environment() {
     cat > "$temp_env_file" << EOF
 # HOPS Environment Configuration
 # Generated on: $(date)
-# Version: 3.1.0-beta
+# Version: 1.0.0
 
 # Core Configuration
 PUID=$puid

lib/security.sh

@@ -2,7 +2,7 @@
 
 # HOPS - Security Functions
 # Password generation, validation, and security utilities
-# Version: 3.2.0
+# Version: 1.0.0
 
 # Source common functions
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

lib/system.sh

@@ -2,7 +2,7 @@
 
 # HOPS - System Validation Functions
 # Functions for system checks, OS detection, and requirements validation
-# Version: 3.2.0
+# Version: 1.0.0
 
 # Source common functions
 LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

lib/validation.sh

@@ -2,7 +2,7 @@
 
 # HOPS - Input Validation and Sanitization Functions
 # Comprehensive input validation and sanitization utilities
-# Version: 3.1.0-beta
+# Version: 1.0.0
 
 # Source common functions
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

services

@@ -2,7 +2,7 @@
 
 # HOPS Service Definitions
 # Contains all Docker Compose service configurations
-# Version: 3.2.0
+# Version: 1.0.0
 
 # This script provides functions to generate Docker Compose service definitions
 # Usage: Source this script and call generate_service_definition <service_name>
@@ -1349,7 +1349,7 @@ list_available_services() {
 # Usage information
 show_usage() {
     cat <<EOF
-HOPS Service Definitions Script v3.2.0
+HOPS Service Definitions Script v1.0.0
 
 Usage:
   source services

uninstall

@@ -8,7 +8,7 @@ uninstall_hops() {
     set +e
 
     # Script version for consistency
-    local SCRIPT_VERSION="3.1.0-beta"
+    local SCRIPT_VERSION="1.0.0"
 
     # --------------------------------------------
     # LOGGING SETUP