FediHome v1.18.0

[TemujinCalidius]

Your data, protected — and your site, yours to shape. This release pairs a batch of durability and security fixes with the biggest step yet on themeable layout.

---

⚠️ Docker users — one step BEFORE you upgrade

Before v1.18.0 the app container had no volume, so your uploaded media lived inside the container. v1.18.0 adds a bind mount — and a bind mount shadows whatever is already at that path. Copy your files to the host first:

cd /path/to/fedihome
docker compose cp app:/app/public/uploads ./public/uploads
ls public/uploads      # confirm your files are there

Only then git pull and rebuild. One-time step — fresh installs need nothing. Running under pm2/systemd? Nothing to do.

---

🛟 Durability

• 💾 Docker installs no longer destroy your uploads (Docker installs lose ALL uploaded media (and possibly ADMIN_SECRET) on any container recreate — no volume for public/uploads #308) — images, photos, audio and cached feed media lived only in the container's writable layer, so any recreate wiped them: --build, --force-recreate, a prune, even a host reboot. The database always survived and stores paths, so the site came back looking fine with every image and player 404ing. Now bind-mounted to the host.
• 🔑 A lost federation keypair is no longer silent (ensureActorKeys() silently mints a NEW federation keypair when the ActorKeys row is missing #310) — if your ActorKeys row goes missing, FediHome used to quietly mint a new one, rotating your Fediverse identity so followers' cached keys no longer matched. It now warns loudly and raises a dismissible admin alert pointing at recovery.
• 📦 Backup docs actually describe a complete backup (Backup docs cover Postgres only — public/uploads is never mentioned, so a documented restore loses all media #309) — the guidance covered pg_dump only, but public/uploads/ isn't in the database. Backup, restore and migration now cover both halves, with ActorKeys flagged as the most important row.
• 🧰 Setup can't brick an install (Full first-run setup wizard + in-app admin/config panel (eliminate manual file editing) #59) — a failed first run used to mark setup complete before writing .env.local, locking you out with no file-free recovery. It now validates first and rolls back on failure.

🔒 Security

• 🛡️ Two high-severity advisories cleared ([security] js-yaml 4.2.0 — quadratic-CPU DoS via YAML merge keys (GHSA-52cp-r559-cp3m, high) #311, [security] brace-expansion — exponential-time DoS (GHSA-3jxr-9vmj-r5cp, high, dev-only) #312) — both stale lockfile pins, neither reachable at runtime. The unused gray-matter production dependency was removed outright rather than patched around. npm audit: 0 high.

🎨 Theming (#250)

• 🧱 Themeable header, footer and page-width regions — Bar / Centered / Minimal headers, Row / Minimal / Columns footers, Normal / Narrow widths.
• 📐 A sidebar layout — content beside about/bio, recent posts, sections and links: the frame the upcoming "Classic Blog" theme is built on.
• 🏗️ Public pages moved into their own route group so layouts never touch your admin screens. URLs unchanged.

🌐 Configure from the web (#59)

• 👤 Edit your profile in the admin — display name, tagline, bio, Fediverse summary, avatar and banner. Your bio previously had no web UI at all.
• 📊 Set your Tinylytics API key in-app, stored AES-256-GCM-encrypted — the dashboard, kudos and leaderboard now work with no .env editing.
• 🔗 The setup wizard asks for your public site address (validated) and shows a review step before installing.

🧹 Also

• Prisma 7.9.0 (client, CLI and adapter in lockstep), @fedify 2.3.3, postcss 8.5.20.
• npm test no longer runs twice when a worktree lives inside the project (Vitest discovery is unscoped — a nested checkout/worktree makes npm test run the suite twice #303).

Full changelog: https://github.com/TemujinCalidius/FediHome/blob/main/CHANGELOG.md

---

This discussion was created from the release FediHome v1.18.0.