v0.14.0

Upgrade recommended for every site. This release closes two install-wizard endpoints that stayed open on installed sites (#663).

What's Changed

• Close the database wizard's endpoints once the site is installed in #663 — security
• Install without GitHub: a setup code, then an admin account with a password in #664 (closes #654, #658)
• GOBLOG_DATA_DIR: one directory for everything goblog writes in #661 (closes #653)
• A fresh install works on MySQL; install smoke test for all three databases in #652 (closes #651)
• Session cookie works over plain http on a local-network host in #672 (closes #665)
• Neutral install defaults instead of the author's personal details in #660 (closes #657)
• The wizard no longer asks for social profile URLs in #662
• The wizard no longer logs the login code and GitHub's token response in #659 (closes #655)

Security: wizard endpoints on installed sites

POST /wizard_db and POST /test_db belong to the install wizard's database step. They took no credentials and nothing turned them off once a site was installed. Both now answer 403 on a site that has a database and an admin.

Installing no longer needs a GitHub OAuth app

While a site has no admin, goblog prints a setup code to its log at startup:

GoBlog setup code: ABCD-EFGH-JKMN

The wizard asks for it before anything else, so only someone who can read the server's log can install the site. Until now the wizard, including saving settings and uploading files, worked for anyone who found a half-installed site.

The wizard's last step creates an admin account with an email and a password, signs you in and finishes. GitHub is still offered as the alternative. The login page has a password form, and goblog reset-admin-password prints a new password if you forget it (with Docker: docker exec <container> ./goblog reset-admin-password).

One volume keeps a Docker site

docker run -p 7000:7000 -e GOBLOG_DATA_DIR=/data -v goblog-data:/data compscidr/goblog:latest

With GOBLOG_DATA_DIR set, .env, the SQLite database, uploads and installed plugins and themes all live under that directory. The old one-line quick start wrote them inside the container, so replacing the container lost the site. When the variable is not set, every path is where it was.

MySQL works

A fresh install on MySQL failed at the migration step, and every settings query failed after that because key is a reserved word there. Both are fixed. A new CI job installs goblog from the Docker image on SQLite, MySQL and PostgreSQL on every push: it walks the wizard, creates the admin, replaces the container, signs in and resets the password.

Also

• Over plain http on an IP address or a local name (.local, .lan, a bare host name), the session cookie is no longer marked Secure, so a home-server install can log in. On a public host name it still is; SESSION_SECURE=true or false overrides either way.
• A fresh install starts as "My Blog" with a placeholder About page, instead of the original author's name, tags, profile links and biography.
• The session key is no longer written to the log.

Upgrading

Nothing to do beyond replacing the binary or image. A site that already has an admin sees no setup code and no change to its login page. The database gains one column (blog_users.password_hash), added automatically.

Existing Docker deployments keep working with their current mounts. To move one into a single data directory, see #670.

Not included

• Forest, Minimal and the site theme do not show the password form yet (#666). A site whose only login is a password still gets goblog's own login page, and /login?password=1 always works.
• The wizard's database step drops the session key from .env, so the first restart after an install signs everyone out (#667).

Full Changelog: v0.13.2...v0.14.0