TapQueue server and station 0.18.0

Added

• Startup settings in the console. The settings that could only be changed by editing
  server.toml on the server can now be changed by a full admin on the Server page: client
  sign-in (auth.mode), HTTPS and IPPS (tls.listen, tls.require, the certificate files and
  names), discovery, reverse proxies, and where backups are copied and their passphrase. A change
  is checked first (a certificate file is loaded, a new port tried, and switching to tokens is
  refused while nobody could sign in to the console), kept in the database, and used from the
  next restart, which the page offers; until then it shows both what's running and what's saved.
  What's saved there wins over server.toml; a setting nobody changed keeps following the file.
  server.listen, server.data_dir and admin.token stay in the file only. If a saved setting
  keeps the server from starting, tapqueue-server --forget-console-settings goes back to the
  file. GET and PATCH /api/v1/admin/server/startup. See
  docs/install-server.md.

TapQueue server and station 0.17.0

Added

• Released jobs are followed at the printer. "Released" used to mean the printer accepted the
  job; what happened to it afterwards was never looked at, and the document was already gone. Now
  the server asks the printer about each job until it's finished and keeps the document that
  long. A job the printer aborts is held again, counts against no page limit, and can be released
  at another printer. A job stopped at the printer's panel gives back the pages that didn't print
  when the printer says how many did. The console, tapqueue-admin jobs and the API's printState
  say printing, printed or stopped, and printedPages is the printer's own count
  where it gives one. Printers that can't be asked about a job behave as before. Database schema 19.
• Queues offer what the printers can do. A queue used to tell every PC the same thing: four
  paper sizes, 600 dpi, one tray, no finishing, whatever the printers behind it were. It now
  offers the paper sizes, trays, paper types, finishing and resolutions the printers report, the
  document formats every printer takes, and colour and two-sided only if some printer can do them
  (and the queue's settings allow). A job that asks for a paper size is released only at a printer
  that has it; elsewhere the release is refused with the reason and the job stays held. A colour or
  two-sided job released at a printer that can't prints in black and white or on one side, the
  release result says so (note), and the job is recorded as it came out. See
  docs/how-it-works.md.
• A screen at the station. A tap that found nothing waiting, one that was refused (over a
  page limit, a printer that can't print, not allowed there) and a card nobody has all looked the
  same at the printer: nothing happened. Each station now has a screen page that any browser
  next to the reader can show, on a tablet, an old phone or a monitor: green with a tick for
  printing, amber for nothing waiting, red with the reason for a refusal or an unknown card, and
  between taps whether the printer is ready. Screen link on a station in the console, or
  tapqueue-admin stations screen <id>, makes its address. The station program isn't involved,
  so it works with stations on any version. Database schema 20. See
  docs/release-station.md.
• A tap that printed nothing is explained on the person's PC. With a 0.17 client, the tray
  says "You tapped at Office printer, but nothing was waiting to print", or why a release was
  refused, or that a printer gave up on a job and it's waiting again (GET /api/v1/me/notices).
• Downgrade. The Server page has a Downgrade section (tapqueue-admin server downgrade) that
  takes the whole site back to an older release when an update turned out badly: it hands out that
  release's clients and station build, then installs that release of the server. The running
  server steps its database back first, after making a backup. 0.17.0 is the oldest release that
  can be gone back to. See docs/install-server.md.

Changed

• Client and station builds only come from GitHub releases. Uploading a build is gone: the
  upload forms on the Updates page, tapqueue-admin clients publish, and POST to
  /api/v1/admin/client-builds and /station-builds. Nobody with access to the console can hand
  PCs and stations a program of their own any more. Use Check for updates (or
  tapqueue-admin clients update and stations update), which needs the server to reach GitHub.
• Stations check an update against GitHub before installing it. A station used to install
  whatever build its server handed out. It now fetches the release's list of programs
  (SHA256SUMS.programs) from GitHub itself and installs the build only if it's on it, so a
  server that was taken over can't run a program of its own on the stations. Stations need to
  reach github.com to update. releases_url in station.toml is for sites that build their own.
• The clients share this version number from now on (see the clients' changelog).

TapQueue server and station 0.16.0

Added

• A tap no longer holds up the next person. A release station used to wait for the whole
  release (up to 2 minutes of retrying a busy printer, 5 minutes to send each job) before it read
  another card. Now the server answers a tap after at most 5 seconds and carries on sending by
  itself, and the station reads cards while earlier taps are still being answered. What came of a
  slow release is in the activity log; a job the printer refuses is held again. The wait, how long
  a busy printer is retried and how long one job may take to send are settings (tap-wait,
  printer-busy, printer-send).
• Job history and the activity log are kept as long as you choose. job-history deletes
  finished jobs (document names, owners, source PCs) after a number of days; the default is still
  for ever. activity-log replaces the fixed 90 days. Reports reach back only as far as job
  history is kept.
• Colour and two-sided printing are recorded for each job and added up in reports, the CSV
  and tapqueue-admin report, from the print dialog's choices or what a raster document says. A
  job that left colour to the printer counts as neither; so do jobs from before this version.
• A time zone setting (time-zone, e.g. Europe/Oslo) for where days start: page limit
  periods, reports, and the times of the daily backup and directory sync. Until now it was the
  server machine's, so a server on UTC reset "daily" limits at UTC midnight. The default is
  still the machine's.
• Reverse proxies: server.trusted_proxies in server.toml lists proxies whose
  X-Forwarded-For and X-Forwarded-Proto are believed, so callers behind one are told apart.
  See docs/install-server.md.
• Encrypted backups, and backups off the server's disk. backup.passphrase in server.toml
  encrypts every new backup (AES-256-GCM); backup.copy_to copies each one to a second folder,
  such as a mounted network share, and keeps that folder in step with what the server keeps.
  tapqueue-server --restore decrypts with the passphrase from server.toml or
  --passphrase-file. See docs/backup.md.
• All of the settings above are on the console's Server page and in tapqueue-admin server set.

Changed

• Sign-in lockout is per name and address, not per name. Five wrong passwords for a name used
  to lock that name for everyone, so anyone on the network could keep an admin out of the console.
  Now they lock that name from that address only, and an address that gets 20 wrong over any
  names is refused altogether. The number of tries and the minutes are settings
  (sign-in-attempts, sign-in-lockout).
• Card numbers are hashed with a secret key (HMAC-SHA-256) instead of plain SHA-256, which
  for numbers that short could be reversed by trying them all. The key is made on first start in
  data_dir/secrets/badge.key and is included in backups. Stored cards are converted when this
  version first starts; nobody has to tap again. Going back to 0.15 after that needs the
  upgrade backup made at that start (as any downgrade does): 0.15 can't read the new hashes.
  If you copy the database to another machine by hand, copy secrets/ with it.
• Backups now hold secrets/ as well, and the daily backup's time is in the time zone setting.
• A release station that taps while the server is busy with an earlier tap may get the new
  outcome releasing ("your jobs are on their way") instead of released.

TapQueue server and station 0.15.0

Added

• Email notifications. The server emails the people you list when a printer is unreachable or
  stops (paper jam, out of paper), when a release station stops checking in, and when a PC's
  client crashes, and again when a printer or station recovers. Low toner and other warnings can
  be added. The emails go out through your own mail server or provider: enter its SMTP settings
  on the console's new Notifications page (STARTTLS, TLS, or neither for a local relay), send
  a test email, and turn them on. A printer or station has to stay wrong for 5 minutes first
  (changeable), a PC that keeps crashing sends at most one email an hour, and an email that can't
  be sent is tried again for a day. tapqueue-admin notifications shows the settings, sends a
  test and turns them on or off. See docs/notifications.md.

TapQueue server and station 0.14.0

Added

• People can delete a job they've already released, not only a held one (from the tray app's
  My print queue, client 0.10 on). The server asks the printer to stop it and gives back the
  pages that didn't print: all of them if the printer hadn't started, the rest if it was part way
  and says how many it printed. A printer that had started and doesn't say gives nothing back.
  Page limits and reports count what's left, and the job's page in the console shows what was
  given back. Only jobs released from this version on can be stopped: the server has to have kept
  the printer's number for the job.
• GET /api/v1/queues for the tray app: the queues the signed-in person may print to, as they
  are now rather than when they signed in.

Changed

• Deleting your own job (DELETE /api/v1/me/jobs/<id>) now answers 200 with what happened
  instead of an empty 204. Older tray apps don't mind.
• The database moves to schema 17 (a backup is made first, as always).

TapQueue server and station 0.13.0

Added

• Check for updates for clients and stations, on the console's Updates page. It asks GitHub
  for the newest client release, or the station build that goes with this server (never a newer
  one), and Publish has the server download it, check it against the release's SHA256SUMS
  and hand it out, so PCs and stations update without anyone downloading and uploading programs.
  tapqueue-admin clients update and tapqueue-admin stations update do the same; --check only
  looks. Needs the server to reach api.github.com and github.com, and the same role as
  publishing a build by upload (admin of Updates). Uploading a build still works.

TapQueue server and station 0.12.1

Added

• A limit on how much one person can have waiting to print: 2048 MB of held documents unless
  changed with tapqueue-admin server set held-limit <megabytes> or under Server → Settings
  (0 for no limit). Before, anyone who may print could fill the server's disk with held jobs. A
  job that would go past the limit is refused with a message to release or delete some first.

TapQueue server and station 0.12.0

Added

• Reports: pages printed over any period, added up by person, group, printer, queue, day or
  month. Reports in the console (for anyone with a role in Jobs) with a CSV download,
  tapqueue-admin report [--by ...] [--from ...] [--to ...] [--csv], and
  GET /api/v1/admin/reports/usage. They count what page limits count: released jobs, pages times
  copies. See docs/reports.md.

Changed

• The database goes to schema 16 (an index for reports). The server backs it up first, as it
  does before every schema change since 0.11.

TapQueue server and station 0.11.0

Added

• Backups. The server backs up its database, TLS certificate and Active Directory CA into
  data_dir/backups every day at 02:00 (the newest 7 are kept) and before an upgrade changes the
  database. tapqueue-admin backups and Server → Backups in the console list them, make one
  now, download and delete them and change the schedule; full admins only, since a backup holds
  every hashed password and the server's private key. Restore one with the server stopped:
  sudo -u tapqueue /opt/tapqueue/tapqueue-server --restore <file>, which moves what was there
  aside instead of deleting it. Held documents and published builds aren't in a backup, and the
  backups are on the server's own disk: copy them off with tapqueue-admin backups download latest.
  See docs/backup.md.

TapQueue server and station 0.10.0

Changed

• Each queue needs its own name (whatever the case), at most 127 characters and without tabs or
  line breaks. PCs know their printers by name, so two queues with one name could never both be
  added. If you already have two with the same name, rename one.

Fixed

• Crash reports and rejected tray sign-ins, which need no sign-in to send, each added a line to
  the activity log, so anyone who could reach the server could bury it and fill the disk. The log
  now takes at most five of each a minute from one address; crash reports themselves are still kept.
• Job and user names longer than the 255 characters IPP allows are cut to that instead of being
  stored and logged whole.
• PDFs are counted one at a time, so several large ones arriving together can't use up the
  server's memory.
• An admin console sign-in as a local user who has no console password took less time to refuse
  than a wrong password, which told a guesser which users have one.
• Station: an answer that isn't the server's (a proxy's error page, say) no longer ends its
  heartbeats until the next restart, or stops the station on a tap.