draft for user delegation setups; https://github.com/zrepl/zrepl/discussions/926

README.md

@@ -126,17 +126,13 @@ The procedure to issue a release is as follows:
     claude --permission-mode default '/draft-release v0.7.0'
     ```
     This command will verify that artifacts are ready, create the draft release, and upload all artifacts.
-  * Review the draft release on GitHub, then publish,
+  * Review the draft release on GitHub, then publish.
-    with the box checked to create a GitHub "Discussion" for the release.
-* Immediately after hitting publish.
-  * Update the release on GitHub to link to the discussion.
-  * Update `docs/changelog.rst` to link to the GitHub release.
-  * Update `docs/_templates/versions.html` to link to the GitHub release.
-  * Announce release in the zrepl Matrix channel & other socials as applicable.
-    Link to the GitHub release as the entrypoint.
-* After a couple of days
   * Add the .rpm and .deb files to the official zrepl repos.
     * Code for management of these repos: https://github.com/zrepl/package-repo-ops (private repo at this time)
+* Update docs version list:
+  * Update `docs/_templates/versions.html` with the new release.
+  * Verify the link to `zrepl-noarch.tar` in the GitHub release works.
+  * Merge to `master` (docs auto-publish).
 
 #### Patch releases, Go toolchain updates, APT/RPM Package rebuilds
 

docs/_templates/versions.html

@@ -7,7 +7,6 @@
   <div class="rst-other-versions">
     <dl>
       <dt>Releases</dt>
-      <dd><a href="https://github.com/zrepl/zrepl/releases/tag/v0.7.0">v0.7.0</a></dd>
       <dd><a href="https://github.com/zrepl/zrepl/releases/tag/v0.6.1">v0.6.1</a></dd>
       <dd><a href="https://github.com/zrepl/zrepl/releases/tag/v0.5.0">v0.5.0</a></dd>
       <dd><a href="https://github.com/zrepl/zrepl/releases/tag/v0.4.0">v0.4.0</a></dd>

docs/changelog.rst

@@ -16,8 +16,6 @@ Changelog
 0.7.0
 -----
 
-`GitHub Release <https://github.com/zrepl/zrepl/releases/tag/v0.7.0>`_
-
 * |feature| Config file inclusion using ``include`` directive.
   This allows distributing zrepl job definitions across multiple YAML files in a ``conf.d`` style directory.
   (:commit:`4d6583e`, thanks, `@ZeyadTamimi <https://github.com/zeyadtamimi>`_).

docs/installation/user-privileges.rst

@@ -3,10 +3,56 @@
 User Privileges
 ---------------
 
-It is possible to run zrepl as an unprivileged user in combination with
+zrepl can run as an unprivileged user with `ZFS delegation <https://www.freebsd.org/doc/handbook/zfs-zfs-allow.html>`_.
-`ZFS delegation <https://www.freebsd.org/doc/handbook/zfs-zfs-allow.html>`_.
+**Help us document working setups on this page** by opening a PR!
-Also, there is the possibility to run it in a jail on FreeBSD by delegating a dataset to the jail.
 
-.. TIP::
+.. NOTE::
 
-    Note: check out the :ref:`installation-freebsd-jail-with-iocage` for FreeBSD jail setup instructions.
+   Keep in mind that ``zfs send``/``recv`` was never designed with
+   untrusted input in mind. An attacker controlling the send-recv stream could probably crash the
+   receive-side kernel, exploit bugs to get code execution, or induce stateful damage to the receive-side pool.
+
+
+Known Working Setups
+^^^^^^^^^^^^^^^^^^^^
+
+.. list-table::
+   :header-rows: 1
+   :widths: 15 40 20
+
+   * - OS
+     - Use Case
+     - Last Tested Version
+   * - Linux
+     - sink job (receiving)
+     - v0.7.0
+
+.. _installation-user-privileges-my-example-setup:
+
+My Example Setup
+^^^^^^^^^^^^^^^^
+
+I'm on Linux (Ubuntu ...) and run ``zrepl daemon`` as an unprivileged user, using a custom systemd unit file.
+
+:: code-block:: bash
+   ...
+   [Service]
+   User=zrepl
+   Group=zrepl
+   ...
+
+I set up the ZFS persmissions as follows:
+
+.. code-block:: bash
+
+   # receiving side root filesystem
+   zfs allow -u zrepl bookmark,create,destroy,hold,mount,mountpoint,receive,refreservation,userprop backuppool/zrepl
+   # sending side
+   zfs allow -u zrepl bookmark,destroy,hold,send,userprop prodpool
+
+**Notes:**
+
+* ``snapshot`` is NOT needed for receiving (only for pruning operations)
+* ``refreservation`` avoids non-sparse volume issues on receiving side
+* Add ``snapshot`` if your jobs perform sender or receiver-side pruning
+* Encryption and other features may require additional permissions

docs/supporters.rst

@@ -35,11 +35,6 @@ We would like to thank the following people and organizations for supporting zre
 ..
    The list below is (roughly) sorted by date of latest contribution, newest first.
 
-  ..
-     ↓ post v0.7.0
-
-* |supporter-std| `drbawb <https://git.sr.ht/~hime>`_
-
   ..
      ↓ claude --permission-mode default /update-supporters v0.6.1..v0.7.0
 

docs/uv.lock

@@ -143,11 +143,11 @@ wheels = [
 
 [[package]]
 name = "pygments"
-version = "2.20.0"
+version = "2.19.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
 ]
 
 [[package]]

packaging/rpm/zrepl.spec

@@ -69,7 +69,7 @@ cp -a   internal/config/samples                         %{buildroot}%{_datadir}/
 %{_bindir}/zrepl
 %config %{_unitdir}/zrepl.service
 %dir %{_sysconfdir}/zrepl
-%config(noreplace) %{_sysconfdir}/zrepl/zrepl.yml
+%config %{_sysconfdir}/zrepl/zrepl.yml
 %{_datadir}/zsh/site-functions/_zrepl
 %{_datadir}/bash-completion/completions/zrepl
 %{_datadir}/doc/zrepl