Initial version of release changes and deployment files

deployment/common/ssl-proxy.conf

@@ -60,4 +60,45 @@ server {
         proxy_redirect off;
         proxy_pass http://app_server;
     }
+
+    # Enterprise edition maps locations
+    # Embeddable map view - allow framing from any origin
+    location ^~ /maps/embed/ {
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $http_host;
+        # we don't want nginx trying to do something clever with
+        # redirects, we set the Host: header above already.
+        proxy_redirect off;
+        proxy_pass http://app_server;
+
+        proxy_hide_header X-Frame-Options;
+        proxy_hide_header Content-Security-Policy;
+        add_header Content-Security-Policy "frame-ancestors *;" always;
+        # add_header here disables inheritance of server-level headers, so repeat them
+        add_header X-Robots-Tag "none";
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    }
+
+    # OGC API endpoints - allow cross-origin requests from any origin
+    location ^~ /v2/ogc/ {
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Authorization, Content-Type, Range" always;
+        add_header Access-Control-Max-Age 5 always;
+        # add_header here disables inheritance of server-level headers, so repeat them
+        add_header X-Robots-Tag "none";
+        add_header Content-Security-Policy "frame-ancestors 'self';" always;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+        if ($request_method = OPTIONS) {
+            return 204;
+        }
+
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $http_host;
+        proxy_redirect off;
+        proxy_pass http://app_server;
+    }
 }

deployment/enterprise/.env.template

@@ -108,6 +108,7 @@ MAIL_SERVER=fixme
 #MAIL_USERNAME=NODEFAULT
 MAIL_USERNAME=fixme
 
+#EMAIL_TEMPLATES_DIR=
 
 # data sync
 
@@ -187,6 +188,9 @@ ACCOUNT_EXPIRATION=1
 #MERGIN_LOGO_URL=  # for link to logo in emails
 MERGIN_LOGO_URL=https://merginmaps.com/MM_logo_HORIZ_COLOR_TRANSPARENT_no_padding.png
 
+#DASHBOARD_LOGO_URL for logo in web dashboard (default is same as MERGIN_LOGO_URL)
+#DASHBOARD_LOGO_URL=$MERGIN_LOGO_URL
+
 # global workspace related bits - ignored in non-CE versions
 # GLOBAL_WORKSPACE mergin
 
@@ -217,16 +221,29 @@ MERGIN_LOGO_URL=https://merginmaps.com/MM_logo_HORIZ_COLOR_TRANSPARENT_no_paddin
 
 MAPS_ENABLED=True
 
+# Enable OGC API for projects
+OGC_API_ENABLED=True
+
+# Enable sharing of maps with public link
+MAPS_SHARING_ENABLED=True
+
 OVERVIEW_DATA=/overviews
 
-VECTOR_TILES_URL=https://tiles-ee.merginmaps.com/data/default/{z}/{x}/{y}.pbf
+VECTOR_TILES_URL=https://tiles.merginmaps.com/data/default/{z}/{x}/{y}.pbf
+
+VECTOR_TILES_STYLE_URL=https://tiles.merginmaps.com/styles/default.json
+
+VECTOR_TILES_LIGHT_STYLE_URL=https://tiles.merginmaps.com/styles/light.json
 
-VECTOR_TILES_STYLE_URL=https://tiles-ee.merginmaps.com//styles/default.json
+VECTOR_TILES_DARK_STYLE_URL=https://tiles.merginmaps.com/styles/dark.json
 
 #WMTS_SERVER_URL=http://mergin-qgis-nginx:80
 
 #OVERVIEW_MAX_FILE_SIZE=1048576 # 1MB
 
+# If patch geopackage file journal mode
+#MAPS_SET_JOURNAL_MODE=True
+
 ### Diagnostic logs from Mobile and QGIS Plugin
 DIAGNOSTIC_LOGS_DIR=/diagnostic_logs
 
@@ -254,5 +271,12 @@ SSO_SERVER_URL=http://localhost:8081
 # Default value is mergin-maps-product string
 # SSO_SERVER_PRODUCT_ID=mergin-maps-product
 
+### Audit logs ###########################################################################################################
+
+AUDIT_LOGS_ENABLED=True
+
 ### Telemetry ############################################################################################################
-OTEL_ENABLED=0
+OTEL_ENABLED=0
+
+### Caching ############################################################################################################
+REDIS_URL=redis://merginmaps-redis:6379/1

deployment/enterprise/README.md

@@ -72,6 +72,6 @@ docker compose -f docker-compose.maps.yml up -d
 
 ## Running telemetry stack
 
-Running telemetry is optional and it is disabled by default. Mergimaps supports OpenTelemetry standard. Check [Readme](deployment/common/README.md) for example of how to run telemetry stack locally.
+Running telemetry is optional and it is disabled by default. Mergimaps supports OpenTelemetry standard. Check [README](/deployment/common/README.md) for example of how to run telemetry stack locally.
 
 To enable telemetry in Mergin Maps, please set `OTEL_ENABLED=1` in `.prod.env`. In case of custom telemetry deployment also check [.otel.env](deployment/common/telemetry/.otel.env) file for more details on how to send data to your telemetry stack.

deployment/enterprise/docker-compose.maps.yml

@@ -6,7 +6,7 @@ networks:
 services:
   qgis:
     container_name: mergin-qgis
-    image: lutraconsulting/qgis-server:2025.1.0
+    image: lutraconsulting/qgis-server:2026.4.0
     user: 1000:999
     networks:
       - mergin-net
@@ -16,11 +16,13 @@ services:
       - QGIS_SERVER_WMS_MAX_HEIGHT=1536
       - QGIS_SERVER_WMS_MAX_WIDTH=1536
       - QGIS_SERVER_LOG_LEVEL=2
+      - QGIS_SERVER_SERVICE_URL=http://localhost:5555
+      - QGIS_SERVER_API_WFS3_ROOT_PATH=/wfs3
     volumes:
       - ./map_data:/overviews
   qgis_nginx:
     container_name: mergin-qgis-nginx
-    image: nginxinc/nginx-unprivileged:1.27
+    image: nginxinc/nginx-unprivileged:1.30
     user: 101:999
     networks:
       - mergin-net
@@ -30,7 +32,7 @@ services:
       - ./qgis_nginx.conf:/etc/nginx/conf.d/default.conf
   qgis_extractor:
     container_name: mergin-qgis-extractor
-    image: lutraconsulting/qgis-extractor:2025.3.1
+    image: lutraconsulting/qgis-extractor:2026.4.1
     user: 901:999
     networks:
       - mergin-net

deployment/enterprise/docker-compose.yml

@@ -5,7 +5,7 @@ networks:
 
 services:
   server:
-    image: lutraconsulting/merginmaps-backend-ee:2025.7.3
+    image: lutraconsulting/merginmaps-backend-ee:2026.10.1
     container_name: merginmaps-server
     restart: always
     user: 901:999
@@ -25,7 +25,7 @@ services:
     networks:
       - mergin
   web:
-    image: lutraconsulting/merginmaps-frontend-ee:2025.7.3
+    image: lutraconsulting/merginmaps-frontend-ee:2026.10.1
     container_name: merginmaps-web
     restart: always
     depends_on:
@@ -35,7 +35,7 @@ services:
     networks:
       - mergin
   proxy:
-    image: nginxinc/nginx-unprivileged:1.27
+    image: nginxinc/nginx-unprivileged:1.30
     container_name: merginmaps-proxy
     restart: always
     # run nginx as built-in user but with group mergin-family for files permissions
@@ -55,7 +55,7 @@ services:
       - server
 
   celery-beat:
-    image: lutraconsulting/merginmaps-backend-ee:2025.7.3
+    image: lutraconsulting/merginmaps-backend-ee:2026.10.1
     container_name: merginmaps-celery-beat
     restart: always
     user: 901:999
@@ -74,7 +74,7 @@ services:
       - mergin
 
   celery-worker:
-    image: lutraconsulting/merginmaps-backend-ee:2025.7.3
+    image: lutraconsulting/merginmaps-backend-ee:2026.10.1
     container_name: merginmaps-celery-worker
     restart: always
     user: 901:999
@@ -98,7 +98,7 @@ services:
     networks:
       - mergin
   db:
-    image: postgres:14
+    image: postgres:17
     container_name: merginmaps-db
     restart: always
     volumes:

server/mergin/version.py

@@ -4,4 +4,4 @@
 
 
 def get_version():
-    return "2026.5.0"
+    return "2026.10.1"

server/setup.py

@@ -6,7 +6,7 @@
 
 setup(
     name="mergin",
-    version="2026.5.0",
+    version="2026.10.1",
     url="https://github.com/MerginMaps/mergin",
     license="AGPL-3.0-only",
     author="Lutra Consulting Limited",