release: v1.5.3

New: NodeCircle auto-sync from a subscription. Linking a circle to a
subscription makes every refresh keep its membership current — nodes the panel
still serves are kept or added (including one that returned under a new address,
which arrives as a new id and previously needed re-adding by hand), dropped ones
leave, and members added by hand or from another subscription are preserved.
Unlinked circles keep the old prune + "check members" behaviour, so nothing
changes without opting in. Reported as circle.synced in Recent Events. Adds
nodecircle.subscription_id (migration 023) and forces a dataplane re-apply when
an enabled circle's membership moves, which the existing reload heuristic missed
because freshly imported ids are in neither changed_ids nor the running config.

New: whole-box configuration backup (Settings -> Backup & Restore). One JSON
bundle covering settings, subscriptions, nodes, routing sets and rules, DNS
rules, balancer groups, circles, devices and UA templates. Secrets are opt-in,
so a shared file carries no credentials, and restoring a secret-less bundle
never blanks credentials already on the box. Restore previews per-section
add/update/delete counts and warnings before writing; merge adds and updates,
replace also deletes rows absent from the bundle. Settings are matched by their
unique key so a restore can't duplicate one. The dataplane is regenerated and
xray reloaded afterwards. Runtime tables and users are deliberately out of scope.

Frontend build + 82 tests green; backend suites (backup, subscriptions,
nodecircle, config_gen) 142 passing. Alembic head is a single revision, 023.

Author: DaveBugg

CHANGELOG.md

@@ -4,6 +4,37 @@ All notable user-facing changes to PiTun. Full per-release detail lives in the
 [GitHub Releases](https://github.com/DaveBugg/PiTun/releases); this file is the
 committed summary.
 
+## v1.5.3 — 2026-08-11
+
+Two ways to stop hand-maintaining state: a NodeCircle can now track a
+subscription automatically, and the whole configuration can be exported to (and
+restored from) a single file. Ships DB migration 023.
+
+### Added
+
+- **NodeCircle auto-sync from a subscription.** Link a circle to a subscription
+  and every refresh keeps its membership current: nodes the panel still serves
+  are kept or **added** — including one that came back under a new address, which
+  arrives as a new id and previously had to be re-added by hand — while nodes the
+  panel dropped leave. Members you picked yourself, or that came from another
+  subscription, are always preserved. Unlinked circles behave exactly as before
+  (dangling ids pruned, "check members" badge), so nothing changes unless you opt
+  in. Membership changes are reported in Recent Events as `circle.synced`.
+- **Whole-box configuration backup.** **Settings → Backup & Restore** exports
+  settings, subscriptions, nodes, routing sets and rules, DNS rules, balancer
+  groups, node circles, devices and UA templates as one JSON file, and restores
+  it onto a fresh box.
+  - **Secrets are opt-in** (`include_secrets`, off by default), so the file you
+    share for debugging carries no node credentials or subscription URLs — and
+    restoring such a file never blanks the credentials already on the box.
+  - **Restore previews before it writes**: per-section add / update / delete
+    counts plus warnings, then an explicit confirm. `merge` adds and updates;
+    `replace` additionally deletes rows the backup doesn't contain.
+  - The dataplane is regenerated and xray reloaded afterwards, so restored
+    routing and DNS take effect immediately.
+  - Endpoints: `GET /api/system/backup`, `POST /api/system/backup/preview`,
+    `POST /api/system/backup/restore`.
+
 ## v1.5.2 — 2026-08-06
 
 Adds HTTPS for the panel (per-install cert + downloadable local CA), disables

backend/alembic/versions/023_add_circle_subscription_link.py

@@ -0,0 +1,39 @@
+"""Add nodecircle.subscription_id — auto-sync a circle from a subscription.
+
+Linking a circle to a subscription makes every refresh of that subscription
+rebuild the circle's membership: nodes the panel still serves are kept/added,
+dropped ones removed, and hand-added members (or ones from a different
+subscription) preserved.
+
+NULL default keeps every existing circle manually managed, which is exactly
+how they behaved before this migration.
+
+The model declares `foreign_key="subscription.id"` (same convention as
+`node.subscription_id`), but this migration adds a plain column: SQLite can't
+attach a constraint via ALTER TABLE, and re-creating the table for it buys
+nothing here — a stale link is harmless (the sync path simply finds no
+subscription and leaves the circle alone) and the app layer already clears
+circle references when nodes disappear.
+
+Revision ID: 023
+Revises: 022
+Create Date: 2026-08-11
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "023"
+down_revision: Union[str, None] = "022"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("nodecircle", sa.Column("subscription_id", sa.Integer(), nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("nodecircle", "subscription_id")