v3.4.0 — Sign in with a username

Sign in with a username

Asked for in #5, and the reason is a fair one: a username is what you chose, an email address is what your mail provider gave you. The sign-in box now takes either, and the server works out which it was handed. Case does not matter for either.

The field itself was part of the problem: it was type="email", so the browser refused a bare name before anything was ever sent.

Two things had to be settled first, and both are worth knowing about.

A username is not unique in the database. The constraint was lost in an early migration, and a username is derived from the local part of the address — alice@example.com and alice@other.org both become alice. A name that answers for two accounts identifies neither, and choosing between them would be choosing whose account a stranger signs into, so it signs nobody in and those accounts keep their email address. New accounts and renames that would take a username already in use are now refused, so no more are created. An installation that already holds duplicates can free the name by giving one of the accounts a different one in Settings → Admin → Users.

The lockout after repeated failures used to be counted against whatever was typed. One account answering to two names would have had one budget of attempts per name, and anyone alternating between them would never have exhausted either. It is now counted against the account. Existing lockout counters reset once on upgrade.

Running as root, written down

#6 asked how to run the server as root to reach a root-owned mount, and tried Compose's user: root without effect. That is not the knob: the entrypoint always finishes with gosu appuser, so user: decides who runs the entrypoint — already root — and not who runs the server. PUID=0 and PGID=0 do, and nothing said so.

Running as root now explains it, along with what it costs.

No code change there — if it works for you today, nothing about it changed.

Upgrading

Nothing to do beyond pulling the image. No schema migration, no configuration change.