Skip to content

v0.3.30

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Apr 09:04
· 454 commits to main since this release
v0.3.30
be5d84c

Security

Closes the last deferred item from the v0.3.28/0.3.29 hardening pass.

Added

  • Per-node worker tokens. Remote workers now carry a per-node auth secret on top of the shared X-Api-Key. On first heartbeat the server generates a token with secrets.token_hex(24), persists it in the worker_nodes table, and returns it in the response body. The worker writes it to /app/data/worker_token (mode 0600) and sends it on every subsequent call as X-Node-Token. The server compares with hmac.compare_digest and returns 401 on mismatch. Even if the shared API key leaks, an attacker who registers a fresh node can't impersonate an existing one.
  • Admin rotation (Nodes → [node] → Settings → Rotate token): invalidates the stored token immediately. The worker drops its cached copy on the next 401 and re-bootstraps on its next heartbeat — no worker restart needed.
  • docs/remote-workers.md documents the bootstrap + rotation flow; docs/security.md moves per-node tokens out of "deferred" into shipped defences.

Fixed

  • GET /api/nodes no longer returns the token column to the frontend. The read surface now exposes a has_token boolean + token_issued_at ISO timestamp instead — the token itself never leaves the server.

Changed

  • Encoder-aware rename. Files encoded with NVENC now rename to *.h265.* instead of *.x265.* — x265 is a specific libx265 binary, h265 (a.k.a. HEVC) is the codec. libx265 jobs keep the x265 tag. The scan dedup logic considers both siblings so existing x265-named NVENC outputs are still recognised on rescan. rename_x264_to_x265 is kept as a back-compat alias.
  • Settings → Video → Conversion Guide now has full libx265 preset + CRF tables and a recommended-combinations table alongside the existing NVENC ones, so CPU-only users see matching guidance. Expanded the tips section with NVENC-vs-libx265 quality equivalence, preset scaling, and CRF semantics.
  • Settings → Metadata APIs shows a green "TMDB is already connected" banner when the bundled key is active, so users on fresh installs see that posters / native-language detection work out of the box and the TMDB input is strictly optional polish.

Docker images

Pinned to this release:

docker pull ghcr.io/i-ial9000/shrinkerr:0.3.30         # portable (amd64 + arm64, CPU)
docker pull ghcr.io/i-ial9000/shrinkerr:0.3.30-nvenc   # x86_64 + NVIDIA GPU (NVENC)
docker pull ghcr.io/i-ial9000/shrinkerr:0.3.30-edge    # as above but ffmpeg master
docker pull ghcr.io/i-ial9000/shrinkerr:0.3.30-edge-nvenc

Floating tags (:latest, :edge, :nvenc, :edge-nvenc) track the most recent release of each lineage.

Assets 2
Loading