tide 0.1.1

Security and operations improvements for self-hosted tide deployments.

docker run --rm --network host ghcr.io/convex-works/tide:0.1.1

The image and static binaries support linux/amd64 and linux/arm64.

Changes

• Each room's lobby now holds at most 50 waiting guests. Further join
  requests receive HTTP 429 with a message to try again later.
• IPv6 rate limits group clients by /56 rather than /64. Clients in the
  same /56 share rate-limit buckets.
• HTTPS deployments send Strict-Transport-Security: max-age=31536000.
  The Content Security Policy adds base-uri 'none' and form-action 'self'.
• tide version and tide --version print the release version and exit.
  The first startup log line also includes the version. Unknown arguments
  now exit with status 2 and usage before starting the server.

Upgrade

Change your container image tag to ghcr.io/convex-works/tide:0.1.1, then
run docker compose pull && docker compose up -d. For a binary install,
download the binary for your architecture, verify it against SHA256SUMS,
and replace the executable while the service is stopped.

Restarting tide ends active meetings and recordings. Schedule the upgrade
when no meeting is running. No configuration changes are required.