Chronexus Server 0.3.0

Chronexus Server 0.3.0 — maps, tokens and token icons

A GM can now prepare a table the way it is done in Roll20: drop a map, pick a token
from a catalog and click where it goes.

New

• Maps in one step: uploading or dropping a PNG/JPEG/WebP map on the board creates
  a scene at the image size, or replaces the map of the scene being edited. Use as
  map does the same for a library image. Scenes are never shown to players until the
  GM activates them.
• Click placement: saved monsters and library images can be armed and placed on
  clicked cells until Esc; Enter places at the map centre for keyboard use. Each
  monster token keeps private HP/AC and its stat block as a GM note.
• Token icons: the public catalog adds game-icons.net (CC BY 3.0, a few CC0)
  next to Wikimedia Commons images and SRD 2014 monsters. The server looks up the
  icon index on one fixed api.github.com path and single inert SVGs on
  raw.githubusercontent.com; the browser draws the icon in a coloured round token
  and keeps author, licence and a modification note.
• GM library images report their original size; client-supplied sizes are never stored.
• API: new placeMonster board command, optional svg in catalog replies and optional
  width/height on library assets (additive).

Upgrade: no schema change (016). Back up first as usual
(chronexus-server backup FILE).

Works with Chronexus 0.9.0 and later for sharing; tables need Chronexus 0.13.0;
GM maps, tokens and catalogs in the desktop app need Chronexus 0.14.0.

Verified on Windows x64: full Rust test suite, Clippy with warnings denied,
rustfmt, contract drift check, 34 web DOM tests, the live game-icons catalog test,
a browser session and a native desktop GM session on a synthetic loopback server.
Container images are built by GitHub Actions for linux/amd64 and linux/arm64; the
Linux binaries attached here are extracted unchanged from those images. Native
macOS/Linux play, production TLS and LAN latency measurements remain open.

Chronexus Server 0.2.0

Chronexus Server 0.2.0 — Chronexus Table

The first release with the virtual tabletop. A GM creates a table, invites players
and spectators, and runs the game from the server web interface; players join from
the browser or from Chronexus 0.13.0 on the desktop.

New

• Tables and seats (M42–M43): GM accounts (invite --gm), invitation-only seats,
  a live channel with presence and reconnection, explicit per-item GM journal access.
• Maps, grid and tokens (M44): scenes with PNG/JPEG/WebP or Universal VTT maps,
  square and hex grids, calibration, difficult terrain, tokens with movement cost,
  rulers and area templates. Every distance shows feet and metres.
• Combat (M45): initiative (manual or d20), turn order, rounds, delay, conditions
  with durations, owner-only HP/AC and a filtered combat log.
• Fog and vision (M46): manual fog, walls, doors, lights, per-token vision and
  darkvision; hidden information is filtered on the server.
• Monsters, encounters and images (M47): editable SRD 2014/custom monsters with
  source attribution, saved encounters, an image library and Wikimedia Commons import.
• Table workspace: tool palette, zoom/pan/fit map, full screen and a tabbed
  sidebar (Chat, Tokens, Combat, Measure, Scenes, Fog, Library, Players).
• Chat dice and pings: /r 2d20kh1+5, /gr secret rolls and /w gm whispers,
  rolled and scoped by the server; transient map pings on the active scene.

Fixed

• The table join form showed {role} and {date} placeholders.

Upgrade: automatic schema migration 006 → 016, additive only. Back up first
(chronexus-server backup FILE). Existing campaigns, accounts and sessions are kept.

Works with Chronexus 0.9.0 and later for sharing; tables need Chronexus 0.13.0.

Verified on Windows x64: full Rust test suite, Clippy with warnings denied,
rustfmt, contract drift check, 33 web DOM tests, a browser session on a synthetic
loopback server and the desktop three-player live scenario. Container images are
built by GitHub Actions for linux/amd64 and linux/arm64. Native macOS/Linux play,
production TLS and LAN latency measurements remain open.

Downloads: the Linux binaries are extracted unchanged from the CI-built ghcr.io/acelith/chronexus-server:0.2.0 image (revision 40083ed); the container image remains the recommended deployment. No Windows or macOS server binary is published for this version.

Chronexus Server 0.1.1

Chronexus Server 0.1.1

A maintenance release of the self-hosted companion of Chronexus, and the first one shipped as
Linux amd64 and arm64 container builds. The historical registry publication predates the GitHub migration; GHCR publication is pending.

Build from source:

cp .env.example .env     # set CHRONEXUS_DOMAIN
docker compose --profile https up -d --build
docker compose exec -T server chronexus-server invite

Fixed

• The bundled HTTPS profile never started: Docker could give the server the address reserved
  for the proxy. Dynamic addresses now come from 172.30.253.128/25
  (CHRONEXUS_NETWORK_DYNAMIC_RANGE).
• backup and verify failed on macOS hosts (temporary directory behind a symbolic link).
• Two verifications running at the same moment could lock each other's reference file.
• The published OpenAPI document now carries the Apache-2.0 licence.

Works with Chronexus 0.9.x and 0.10.0. Chronexus 0.10.0 adds member management (list,
change role, remove, leave) on top of the same API; no API change in this release.

Verified (27 October 2026): 75 integration tests on macOS arm64 (Rust 1.97), Clippy with
warnings denied, rustfmt, contract drift check; the Compose stack with the bundled Caddy over
HTTPS on Docker (linux/arm64); three real desktop apps (macOS and two Linux containers) passed a
37-step sharing scenario against it, including role changes, leaving, removal and a proxy outage;
an installed Linux release build signed in and downloaded a campaign over HTTPS. The images in
the registry were pulled back by digest and started.

Not verified: a public deployment with real DNS and certificates, a third-party
penetration test, image and dependency vulnerability scans, load testing. Data is not
end-to-end encrypted: the operator can read what users upload.

GitHub assets: the chronexus-server binaries for both Linux architectures (glibc, Debian 12), extracted from the historical container builds, and SHA256SUMS.txt.

Repository migration: GitHub is now the canonical source. The existing binaries and signatures were not rebuilt; their build source identifiers predate the authorized history rewrite.

Chronexus Server 0.1.0

Chronexus Server 0.1.0

The first release of the optional, self-hosted companion for Chronexus 0.9.0 and later. It is
Apache-2.0 licensed, offline-first for the desktop (the app works without it), and keeps your
campaigns on a machine you control. No telemetry, no cloud AI, no third-party service.

What it does

• Invitation-only accounts (Argon2id, hashed tokens, persistent attempt limits, device sessions).
• Campaigns with owner, player and reader roles, one-use invitations, versioned memberships.
• Private-by-default content: pages, sessions, relationships, party members, selected character
  sheet sections and managed images (PNG/JPEG/WebP, original bytes, checksums).
• Continuous replication for the desktop: incremental sync with fail-closed cursors, idempotent
  writes with verifiable request IDs, content-free change notifications, conflicts returned with
  both versions.
• Revocation and deletion: removing a member, deleting your server copy, deleting a campaign (by
  its exact name) or your account; former members are told, nothing local is touched.
• Operations: invite, recover, revoke-sessions, compact, backup, verify, restore,
  automatic pre-upgrade copies, health checks, a generated OpenAPI contract.

Run it: copy .env.example to .env, set CHRONEXUS_DOMAIN, then
docker compose --profile https up -d --build (bundled HTTPS) or docker compose up -d --build
behind your own proxy. See docs/INSTALLATION.md.

Verified (Windows x64, Rust 1.99.1): 71 integration tests (authorization matrix over every
campaign route, hostile inputs, backup/restore and failed-upgrade recovery, lifecycle, sync and
notifications), rustfmt, Clippy with warnings denied, a locked release build and the OpenAPI drift
check; the real Chronexus 0.9.0 client engine ran against this server over loopback HTTP
(two computers aligned with about 160 ms median latency, server restart recovery, conflicts,
revocation, deletion, shared images and sections).

Not verified, so not claimed: the Docker image and the compose files (Docker was unavailable:
no image is published and the compose/Caddy files were only reviewed), Linux and macOS, ARM64, a
real TLS deployment, vulnerability scans of dependencies and images, third-party penetration
testing, and load beyond the built-in limits.

Assets: the Windows x64 executable built from the tagged source, with its SHA-256. Other
platforms: build from source with the pinned toolchain in docs/DEVELOPMENT.md.

Repository migration: GitHub is now the canonical source. The existing binaries and signatures were not rebuilt; their build source identifiers predate the authorized history rewrite.