EinVault 1.0.7

This release keeps the Immich integration working with Immich v3, which changed its API in ways that broke the picker. Older Immich v2 servers keep working too. The full 1.0 announcement is reprinted below so it stays put.

Immich v3 support

• Immich v3 removed the album assets list from its API, which broke EinVault's album-scoped picker. The picker now lists album photos through Immich's search endpoint instead, which behaves the same on v2 and v3, so one build supports both.
• Archived photos stay out of the picker on v3. Immich widened its search defaults there, so EinVault now asks for timeline photos explicitly.
• The API key you give EinVault no longer needs the album.read permission. asset.read and asset.view are enough, with or without IMMICH_ALBUM_ID.
• Small behaviour change: album photos in the picker are sorted newest first now, matching the whole-library view, instead of following the album's own order.

Upgrading

Pull the new image. Nothing in your config changes. If you use IMMICH_ALBUM_ID, you can trim album.read off the API key or leave it; both work.

---

EinVault 1.0

EinVault started as a way to keep track of my own pup without handing his health records to some cloud service, and 1.0 is the version I'm truly pleased with. It still does what it always did: track health records, daily activities, and care schedules for your companions, all on hardware you control. It just looks a whole lot better now, and it picked up a few things along the way.

The redesign

Almost every screen got reworked. New colors, calmer layouts, and empty states that actually tell you what to do instead of staring back at you blankly. The member, admin, and caretaker views were pulled into line with each other, the settings pages finally share one layout, and dark mode behaves itself everywhere. If you've been running an older build, the first thing you'll notice on launch is that it doesn't look like the same app.

Ein

EinVault has a mascot now. Ein is a little corgi who shows up on the login screen, greets you on a fresh dashboard, and turns up looking appropriately confused when you hit a 404.

Two-factor auth

You can lock your account down with an authenticator app. Turn it on under Settings > Security, scan the code, and write down your backup codes somewhere safe. If you run EinVault for other people, you can require 2FA across the board (or just for admins), and reset it for anyone who loses their phone. SSO logins are left alone, since your identity provider already handles that. One thing to know before you flip it on: see the upgrade notes below.

Odds and ends

• Page icons and colors are consistent now (weight, health, reminders, activity each have their own look), across both the owner and caretaker sides.
• Role badges are actually distinguishable at a glance.
• New favicon, proper app icons, and a web manifest, so it installs cleanly to a phone home screen.
• Added a medication schedule alongside feeding and walks.
• Six languages (English, German, Spanish, French, Italian, Portuguese). Fair warning: everything but English is machine-translated and may read a little off. Corrections welcome.

Upgrading to 1.0

Pulling the new image is all you need. Migrations run on boot, and none of your existing config changes.

The only new knob is for 2FA: set TWOFA_ENC_KEY to a 32-byte base64 key (openssl rand -base64 32) and it encrypts the stored TOTP secrets. Leave it unset and 2FA just stays off. It doesn't touch any of your OIDC settings.

Also quietly bumped a build-time dependency (esbuild) to clear a security advisory. Nothing in the running server was affected.

Thanks for using EinVault. If something's broken or rough, open an issue. If there's something you'd like me to consider adding or changing, open an issue! Many of the ideas for features that have been added over the past few months have come from a small group of dedicated users.