4 releases 4 tags

RSS feed

• v1.1.1 499af2bd2c

  Compare

  v1.1.1 Stable

  claude-bot released this 2026-09-26 05:49:05 +00:00 | 36 commits to main since this release

  Fixed

  • Settings in .env now reach the container — 19 of them did not (#147).
    docker-compose.yml passed configuration through a hand-maintained
    environment: list, a second copy of .env.example that nothing kept in
    step. Everything added since v1.0.0 was missing from it: METRICS_ENABLED,
    BACKUP_REMOTE_PATH and the BACKUP_S3_* family, AURORA_ENABLED /
    AURORA_MIN_KP, RAMP_ON_MINUTES / RAMP_OFF_MINUTES,
    DAILY_BACKUP_RETAIN_COUNT, and the morning-window block. Setting any of
    them in .env did nothing, silently: the app's own .env loading resolves
    to /app/.env inside the container, which is never mounted, so each one fell
    back to its default. For the runtime settings the Settings page still worked;
    for the ten env-only ones — metrics, off-site backup and aurora — there was
    no way to turn them on at all, despite the v1.1.0 notes saying how.

    The list is gone: env_file: .env passes the whole file, so there is nothing
    left to drift. Two tests stop it coming back. A pytest fails if
    .env.example names a variable Settings does not define, and a CI step
    renders docker compose config against a sentinel .env and asserts the
    values arrive in the service's environment. That second one matters because
    the E2E container is started with docker run, so nothing else in the suite
    ever crossed the compose-to-container boundary where this broke.

    Upgrading: anything already in your .env now takes effect. That is the
    point, but check for values you set, saw do nothing, and forgot about — a
    METRICS_ENABLED=true from last month will now publish /metrics.

  • Iris now refuses to start with the default SESSION_SECRET while
    authentication is on (#147). It used to log one CRITICAL line and start
    anyway, signing session cookies with a publicly known key. The real guard was
    compose's ${SESSION_SECRET:?…}, which only protected people running this
    exact compose file, and removing the environment: list above removed it
    too. The check now lives in the app, so it holds however the image is run. A
    missing secret now shows up as a container that exits at startup with the
    fix in its log, rather than as docker compose up refusing to run.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads