Release ArrSight v1.3.0 · Cyxno/Arrsight

Highlights

Modular backend — server.js (1,100+ lines) is split into focused lib/ service
modules and routes/ handlers. All API routes, response shapes, configuration files,
and management modes are unchanged, so this release is a drop-in upgrade.
Safer login throttling behind reverse proxies — when ARRSIGHT_TRUST_PROXY=true
is set, throttling keys on X-Forwarded-For; without it, forwarded headers are
ignored and cannot be spoofed to bypass rate limiting.
Resilient snapshots — a single offline integration (Sonarr, Bazarr, download
client, Docker, mounts, …) now degrades only its own panel instead of failing the
whole /api/snapshot request. The dashboard stays usable while a service is down.

Proxy-aware client-IP detection for login throttling, gated behind the existing
ARRSIGHT_TRUST_PROXY=true opt-in. Security model otherwise unchanged: scrypt
password hashing, timing-safe comparisons, expiring HttpOnly/SameSite sessions,
same-origin checks, one-time setup code, container allowlists, and server-side
management-mode enforcement.
Documented the intentional integration-URL trust model in SECURITY.md: ArrSight
performs server-side requests to configured services in your own Docker/LAN and
deliberately does not block private ranges or Docker DNS names.

Backend responses are now fully structured ({"ok":false,"code":"…"}) with neutral
English text; the remaining Dutch backend strings were removed.
Incident titles and advice, action results, and pipeline stage labels are now
localized in the existing EN/NL catalogs, with server text as fallback.
The media pipeline stage previously labeled "InfiniDysk" is now "Download client"
(NL: "Downloadclient").

Docker stats/logs for the download client now follow config.infinidysk.containerName
(legacy InfiniDysk container name still works as a fallback).
Management action responses use stable machine-readable codes
(management_disabled, container_not_allowed, full_management_required, …).

Docker image labels point at this repository; the Unraid template is now
unraid/arrsight.xml; snapshot exports are named arrsight-snapshot-*.json.
CI syntax checks now cover all lib/ and routes/ modules.

No configuration migration required — existing config.json files keep working.
Compatible with existing Docker, Docker Compose, Unraid and reverse-proxy setups
(AMD64 + ARM64).
If you scripted against raw action message/error strings, read code instead.

Full changelog: v1.2.1...v1.3.0