Release v2.1.0 — team accounts, TOTP & passkeys · Open-Cosmic-Software/tacilytics

Tacilytics 2.1.0 — team accounts, optional TOTP + passkeys

Accounts & team roles (owner / admin / viewer, viewers limited to chosen sites), one-time invite links.
Optional 2FA: TOTP (RFC 6238, replay-protected, 10 recovery codes) and passkeys (WebAuthn).
CLI: tacilytics users, tacilytics reset-login <name> for lock-outs.
Once the first account exists, the old WEB_PASSWORD login (and its sessions) is switched off.

Rate limits no longer trust the client-written first X-Forwarded-For entry; they use the address seen by your proxy (TRUST_PROXY).
TOTP sign-in: 5 codes per password entry, plus a per-account limit independent of the IP.
Password hashing (scrypt) runs async, so sign-ins never stall event collection.
npm audit: 0 vulnerabilities.

TRUST_PROXY = the number of reverse proxies in front of Tacilytics (default 1, e.g. Caddy/nginx). Cloudflare + Caddy → set 2. If it is too low, every visitor looks like your outer proxy and unique visitors collapse; if it is too high, clients can bypass the limits. Tacilytics binds to 127.0.0.1, so 0 is almost always wrong.
This value now also feeds the visitor hash (previously the first X-Forwarded-For entry), so unique-visitor counts may shift once when you upgrade.
Set TACILYTICS_ORIGIN to your public dashboard URL if you use passkeys (a warning is logged when accounts exist and it is missing).
Known and intended: 20 wrong passwords per hour for one username lock that account's password login for an hour. Passkeys keep working.

Reviewed by Tyto 🦉 and Kiro 🐺.