Skip to content

bubbles v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Oct 00:21
· 4 commits to main since this release
v0.2.0
1386223

bubbles v0.2.0

Easy onboarding: people create their own accounts, the tray app finds the server, and there is no setup wizard.

What's new

  • The admin password is generated on first start. It is printed in the console (and docker logs) and saved to admin-password.txt.
  • Self sign-up asks for one "Your name" field. The @handle is made automatically. People sign in with their name or their handle.
  • Sign-up opens for 24 hours after first start or factory reset, then closes by itself. Admins can reopen, close, or change the window in Admin > Settings > Sign-up.
  • Admin > Add person creates an account directly.
  • Tray app: Join buttons for bubbles servers found on the network. Confirm the server, the app installs its certificate, then you choose Create account or Sign in.
  • The tray app refuses certificates that are not limited to the local network.
  • The phone onboarding page has a "Create your account" button.
  • Any password works. The server does not enforce password strength.

Security notes

  • Open sign-up is meant for a trusted LAN. Anyone who can reach the server can create an account while sign-up is open.
  • Weak passwords are allowed.
  • The admin password is visible in the console and docker logs, and in the owner-only admin-password.txt, until you change it.
  • Rate limits:
    • Login: 5 attempts per account and 20 per IP per 15 minutes.
    • Sign-up: 20 per IP per hour.
  • To lock down a server:
    • Close sign-up in Admin > Settings > Sign-up.
    • Use invites for new people.
    • Change the admin password.

Upgrading from v0.1.x

  • Sign-up stays closed after an upgrade. Migration 0003 stores open_registration=false on any server that already has users and no stored sign-up setting. Upgraded servers stay invite-only, as they were before.
  • To open sign-up on an upgraded server, an admin turns it on in Admin > Settings > Sign-up. Opening it starts the 24-hour window (or the window length the admin sets).
  • New servers and factory-reset servers open sign-up for 24 hours.
  • Existing users keep their usernames.
  • Display names must be unique only for new registrations and renames.
  • Migration 0002 adds users.display_key.

API changes

  • Removed:
    • GET /api/v1/setup/status
    • POST /api/v1/setup
  • Added:
    • GET /api/v1/status
    • POST /api/v1/auth/device-register
    • POST /api/v1/admin/users
    • POST /api/v1/admin/registration
  • Changed:
    • POST /api/v1/register takes {name, password} only.
    • Invite accept takes {name, password}. The legacy username and display_name fields are still accepted.
    • The FactoryReset response replaces setup_token and setup_url with admin_username, admin_password, and sign_in_url.
    • AdminSettings adds registration_window_hours, open_registration_until (read-only), and registration_open.
    • ServerStatus has new fields. See docs/openapi.yaml.

Downloads

  • Same file layout as v0.1.1, with v0.2.0 in the file names.
  • Docker: ghcr.io/donaldsteele/bubbles:v0.2.0

Field testing still pending

  • Real phones.
  • Tray app on macOS and Linux.
  • See docs/field-checklist.md.

Contributors

handle
Assets 15
Loading