Release v0.6.0 · happyDomain/happydomain

Highlights

Admin interface: A full administration panel is now available, with user, provider, domain, zone, and session management, plus backup/restore.
Major security hardening: Session management, authentication, and OIDC flows have been significantly strengthened — see the Security section below.
Redesigned frontend: The web UI has been modernized with interactive tables, a zone sidebar, service detail pages, DNS syntax highlighting, and many UX improvements.
CAPTCHA support: Login and registration can now be protected with a pluggable CAPTCHA provider (reCAPTCHA, hCaptcha, Turnstile, Altcha).
Configurable base path: happyDomain can now be hosted at a sub-path (e.g. /happydomain/).

Admin panel with users, providers, domains, zones, and sessions management; backup/restore; generated admin API. (0d4348f, 5896fe8, 0a0f71c, a231731, 42c36db, abe5814, 41e477d, f934c83, 014ecad, 69c9884)
Generic CAPTCHA adapter for login and registration, with support for reCAPTCHA, hCaptcha, Turnstile and Altcha. (0090054, e0d8526)
Configurable BasePath for hosting at a sub-path. (64c86df, f0bf1b0)
New DNS providers: DNScale, Gidinet, Infomaniak, MikroTik, UniFi (Hexonet dropped). (e80481a, 323389d)
Zone diff summary endpoint for efficient diff count retrieval. (30a3f7e)
Service details offcanvas with DNS records view and quick actions. (ba29d13)
Zone sidebar synchronized with visible subdomains, with domain part highlighting. (eb5e0ad, 36bf664, 7217b6a)
Replace service modal with a dedicated page and sidebar. (acf7c0d)
Replace zone export modal with a dedicated export page. (044c6da)
DNS syntax highlighting with highlight.js. (efebd7e)
Interactive tables for domains and providers lists, with URL-synced filtering. (03be1f7, 827a92e, 5f6b9a2)
Onboarding flow accessible via ?onboarding on the home page. (e8af55a)
Provider and domain creation via modals instead of separate pages. (6a00090, 7b8e660)
Provider edit page relook with sidebar. (0677b82)
Current session highlighted with a badge in session list. (dcde50f)
Improved Chinese localization and simplified Chinese README. (38b5364)

Fix SPF directive insertion before -all even when it's the only entry. (464c7db)
Fix infinite loop on 401 when user is not logged in. (36890cc)
Fix LastLoggedIn not updated on successful password login. (a60489d)
Fix ServiceCombined JSON serialization for new service creation. (8cf6431)
Fix provider filtering on home page. (dc06c8b)
Fix service worker caching bugs. (ac441a0)
Fix session delete returning wrong status code (now 204). (378227d)
Fix session fingerprint display to use SHA-256. (6565b25)
Fix default TTL set to 0 for new DNS records to avoid confusion. (20e0a5c)
Fix TTL and Class display when using defaults. (bc0ff97)
Don't display full email on small screens. (aea880f)
Fix Gitlab Pages verification code migration. (60cab40)

A detailed write-up of the security improvements in this release is available on our blog: https://blog.happydomain.org/release-0.6.0/

Session hardening: rotate session ID on login (fixation prevention), 15-day lifetime with 7-day auto-renewal, session ID format validation, proper error propagation on session delete. (90f07a2, 68a783b, f9d66bf, 8ab02df)
OIDC hardening: PKCE (S256), nonce validation, SHA-256 for user ID derivation, redacted internal error details, preserved redirect destination, deferred session key deletion. (c6a2a8c, 4bab664, 8e90d7b, cae068c, b4ad9f8, d4970a1)
Password security: bcrypt cost increased to 12, 72-character max length enforced, transparent rehash on login for outdated cost. (46a5d15, 043b81a, c16e9c2)
Anti-enumeration: constant-time email checks, PII removed from error messages, timing side-channel prevention. (d6e442f, a2c0606)
Open redirect prevention: validate next redirect parameter. (d979cce)
Decouple failure tracking from captcha provider. (b0b79ef)

Migrated frontend to openapi-ts code generation. (d392a4e)
Removed UsecaseDependancies service locator pattern. (c9552fa)
Modernized Go idioms: interface{} → any, removed deprecated ioutil, fixed go vet warnings. (f457071, 759fcf5, 001b919, 15298c4)
Added missing json tags on all structs for better OpenAPI generation. (bee17f7)
Removed last generation date from generated files for build reproducibility. (7427ed7)
Refactored RR relativization to use subdomain-aware helpers. (74ef579)
HTML lang attribute now syncs with active locale. (08bdb98)
Updated to dnscontrol v4.36, Go 1.26, and bumped major dependencies.
Added Codeberg, GitHub and local Forgejo release publishing steps on tag in CI. (e73b6df)