Skip to content

v0.2.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@UntoastedToast UntoastedToast released this 11 Oct 10:40
v0.2.0
92573f8

What's new

  • Admin password change. Settings has a new Security tab. Changing the password asks for the current one and logs out all devices.
  • Stronger password rules. New passwords need 12 to 128 characters without spaces and must not be easy to guess (zxcvbn). They are also checked against Have I Been Pwned; only the first 5 characters of the SHA-1 hash are sent. Set HIBP_CHECK=false to make no outgoing request.
  • Local recovery. stalias reset-admin-password sets a new admin password from a terminal on the server.
  • Tighter login rate limit. Failed attempts are now also limited per admin account, and the response carries an exact Retry-After.
  • Alias names from words by default, with a setting to switch back to random characters. Alias domains and alias names now share one settings tab.
  • The documentation is split into focused pages under docs/.

Upgrading

Passwords are now normalized to Unicode NFC and limited to 128 characters. If you cannot log in after updating (for example, your password has decomposed Unicode characters or is longer than 128 characters), run:

docker exec -it stalias /stalias reset-admin-password

The container image is published to ghcr.io/untoastedtoast/stalias by the release workflow. See the README for how to verify its signature and provenance.

Assets 2
Loading