v2.1.0

The rest of 2.0's plan: files, sign-in protection and a rate-limit tester.

Added

• Lockout after failed sign-ins (security.loginLockout): an identity that fails
  attempts password sign-ins from one address within minutes gets 429 until the window
  ends, even with the right password; a success clears the count. Shared by every instance.
  Off by default.
• The interval between auth emails is a setting (security.authEmailInterval, 60 seconds
  by default, 5 to 86,400): verification, password reset, email change and one-time
  passwords, per account.
• Files: files.defaultMaxSize sets the largest file for file fields without a size of
  their own (it was always 5 MB), and files.thumbs turns thumbnails off (the original file
  is served instead). Settings → File storage shows both, and each auth collection's session
  and protected-file token lifetimes; Team shows the superusers'.
• A rate-limit tester: Settings → Security & limits says which rule a request would meet
  (POST /api/settings/rate-limits/explain), with the same matcher the guard uses.

Install

• Docker: ghcr.io/ayeshrodz/slonbase:2.1.0
• Debian/Ubuntu: slonbase_2.1.0_amd64.deb / _arm64.deb
• Fedora/RHEL: slonbase-2.1.0-1.x86_64.rpm / .aarch64.rpm
• Binaries: slonbase-2.1.0-linux-{amd64,arm64}.tar.gz

Verify downloads with sha256sum --ignore-missing -c SHA256SUMS. See the installation guide.