sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

docs(changelog): document 1.14.0 release + desloppify changes
CI / Test & Lint (push) Has been cancelled
Details
CI / Security audit (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Sami
2026-06-28 03:51:15 -07:00
parent a2e6566958
commit a79dc5a738
1 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+13
View File
@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
### Added
- **Auto-login page served from API (`GET /api/v1/auth/login-page?service=<id>`).** Chat, Plex, Jellyfin, and Emby auto-login pages are now generated by the API instead of living as 5 KB inline HTML blobs inside Caddyfile `respond` blocks. Caddyfile blocks shrink from ~50 lines to 3. Future login-page changes deploy with the container, no `caddy-apply` needed.
### Fixed
- **SSO cookie placeholder bug.** `dashcaddy_auth` Caddy snippet had `header_up Cookie {http.request.cookie}` — an invalid placeholder that resolved to empty string at runtime, silently clearing the session cookie before it reached the `forward_auth` gate. SSO worked only via the IP-session fallback (same-IP). Removed the line; Caddy's `forward_auth` forwards all original request headers automatically.
- **Jellyfin/Emby `merge()` syntax error.** `try` block in the auto-login page's `merge()` helper was missing its closing `}` before `catch`, causing a JS syntax error in the browser that silently broke localStorage token merging.
### Changed
- **CLAUDE.md rewrite.** Was describing the old Windows-local `C:/caddy/` + `caddy-api/` layout. Now accurately documents DNS2 as production (`/opt/dashcaddy/`, `caddy-apply`, correct Tailscale IP, SSO architecture).
- **`.gitignore` coverage.** Runtime-generated data files (`audit-log.json`, `backup-history.json`, `credentials.json`, `health-history.json`, etc.), cert directories (`generated-certs/`, `pki/`), and root-level test scripts now ignored.
## [1.14.0] - 2026-06-28
### Security
- **TOTP recovery system (4-part defense against permanent lockout).** Pre-lockout: `.bak` fallback credentials file checked at every TOTP init, used silently when primary fails. Diagnostic: `/recovery-info` endpoint + `/recovery-panel` UI on the entry screen with one-click "Import Backup" + "Download Backup" buttons. Post-lockout: friction-free `.license-secret` restore flow. (`d230b39`, `3dff49c`, `7bbd969`)