v1.38.17

The second of two close doses can be logged from the card again, and anyone running their own instance can allow a notification target on a private network.

The second of two close doses can be logged from the card again. On a schedule whose neighbouring doses sit closer than twelve hours (08:00 and 12:00, say), taking the first dose made the card offer tomorrow's first dose, and a skip pressed next landed on tomorrow. A taken, skipped or auto-missed dose counted as settling every scheduled time within a window sized for the twice-daily gap, so the first dose swallowed its neighbour. A logged dose now settles exactly one scheduled time, the nearest within that window, and the adherence ring on the card follows the same rule, so the due slot and the ring cannot disagree. The window still covers a dose logged a little off its time, or across a clock change.

You can allow a webhook or ntfy target on a private network. The senders look the target up at send time and refuse a private, loopback, link-local or CGNAT address. That is the DNS-rebinding protection from #217, and it also stopped a Gotify behind a LAN reverse proxy, with no way to allow it. NOTIFICATION_PRIVATE_ORIGINS is that way now: a comma-separated list of exact origins such as https://gotify.example.com,http://ntfy.lan:8080, read from the server environment only. A listed origin is still looked up, the address it resolved to is the one the connection uses, and redirects are forbidden. Link-local, the metadata range and the unspecified address stay refused even when listed; loopback can be listed for a relay on host networking. A malformed entry is logged once, without its query string or credentials, and allows nothing. Listing a name does not cover its sub-hosts or other ports, because a private name cannot be told from a public one at save time. The grammar is the same as NIGHTSCOUT_PRIVATE_ORIGINS, and existing Nightscout entries behave exactly as before. Reported by @sreeramachandramurthy in #947; thank you for the precise log line.

The test button says why a private target was refused. Saving a private address that is not listed, or testing it, now names the variable to set instead of an internal error that sent you to the log. Saving, testing and the scheduled delivery all take the same decision, and an allowed send is marked in the request log with its channel and origin. A link-local, metadata or unspecified target says that no setting can open it, since telling you to ask the operator would only send you in a circle. The refused save or test is a 422 with meta.errorCode = private_origin_not_approved, or private_origin_not_grantable for a target no setting can open.