Quillo v0.9.0: first versioned release

The first versioned release. The in-house blog becomes Quillo, open source under the GNU AGPL-3.0-or-later, with a commercial licence available (see LICENSING.md).

What's in it

• Public site:
  • a big story and sidebar home page;
  • picture-first articles;
  • category pages, search, RSS and a sitemap.
• Admin:
  • a visual editor with a Markdown switch;
  • autosave, revisions and scheduling;
  • a media library, categories and tags, menus and redirects;
  • staff roles: owner, admin, editor, author and contributor.
• Readers: free accounts with email verification, and moderated comments with replies and likes.
• Newsletter: double opt-in, sent through your own email account, with one-click unsubscribe.
• Sponsor banners: first-party banners in 9 places, labelled "Sponsored".
• Search engines and AI answers:
  • structured data and social share images;
  • IndexNow;
  • cookieless analytics (Plausible or Umami).
• Makers' tools: source code boxes, STL and PDF downloads, and a GitHub button.
• Running it: a systemd service, an install script and a Cloudflare Tunnel example in deploy/.

Security

Three security audits, with fixes after each:

• Two-step sign-in with recovery codes.
• Strict content security policies.
• Encrypted secrets.
• Rate limits that survive restarts.
• Upload checks.
• Every dependency pinned exactly, with npm audit clean.

Getting started

Download the zip below, then follow deploy/README.md to put the blog online.

Full details: CHANGELOG.md