Skip to content

Calends 1.26.0

Choose a tag to compare

View all tags
@imetn imetn released this 05 Nov 05:36
· 12 commits to main since this release
v1.26.0
f478817

Calends 1.26 adds a Docker-free deployment package and fixes a reverse-proxy login rate-limit bypass in self-hosted installations.

Highlights

  • Run without Docker. Releases now include a ready-to-run tarball, SHA-256 checksum and systemd unit. The package runs the same Worker and SQLite code as the Docker image, with no npm install. It requires Linux, systemd and a system-wide Node 24; see the self-hosting guide. It was tested on Debian 12 in a local virtual machine; long-term operation on a real low-memory host has not been verified.
  • Choose the listening address. The new HOST environment variable lets a systemd deployment listen only on loopback behind a reverse proxy.

Fixes

  • Security: forged visitor IPs could bypass login rate limiting. Self-hosted instances configured with TRUST_PROXY=1 previously trusted the leftmost X-Forwarded-For entry, which a client could forge. Calends now reads the configured number of trusted proxy hops from the right and falls back to the connection address when there are too few entries. Cloudflare deployments are unaffected; the Worker no longer reads this header or receives TRUST_PROXY.

Upgrading

There are no new SQL migrations or read-time data conversions. Docker users should keep the existing data volume and can roll back to 1.25.0.

Review the proxy configuration guide before upgrading:

  • With a CDN or cloudflared in front of Nginx using $proxy_add_x_forwarded_for, set TRUST_PROXY=2 and restrict Nginx to connections from that preceding layer. Otherwise visitors are counted under the CDN or tunnel address and share one rate-limit bucket: someone else's failed attempts can temporarily lock the owner out of the login page. Existing signed-in sessions are unaffected.
  • Caddy and Traefik normally retain only one entry. Configure the preceding layer as a trusted source (trusted_proxies or trustedIPs) before setting TRUST_PROXY=2; do not change it blindly.
  • A single proxy, including cloudflared connected directly to Calends, continues to use TRUST_PROXY=1.
  • Whenever TRUST_PROXY is set, expose the Calends port only to the proxy (for example, -p 127.0.0.1:8787:8787 in Docker). Anyone who can connect directly can still specify the IP used for rate limiting.

Cloudflare runtime configuration, ledger storage and MCP tools/permissions are unchanged. Refresh open tabs after upgrading.

Images

Multi-architecture images (linux/amd64, linux/arm64) are available from Docker Hub and GitHub Container Registry:

docker pull xizozhe/calends:1.26.0
docker pull ghcr.io/imetn/calends:1.26.0

The 1.26 tags follow this release series; latest follows main. The calends-1.26.0.tar.gz package and its .sha256 checksum are attached to this release by the Release tarball workflow.

Assets 4
Loading