Natel 0.5.1

Added

• The settings offer to install Natel as an app: a button where the browser has its own install dialog, such as Chrome and Edge, Android included, and the steps to follow on iPhone and iPad.
• Chrome and Edge show screenshots of Natel on a phone and a computer in their install dialog.

Changed

• The birthday's day, month and year fields each show their label above them.
• On phones, the sign-in screen's red header shrinks to the wordmark and the language choice, so the form starts near the top and the sign-in button shows without scrolling on a 320 × 568 screen. An empty submit now moves the focus to the first field to fill in, and a field's error clears as soon as it is filled in.
• While contacts load, the list shows the sort controls and alphabet index alongside a loading message. Skeleton placeholders are limited to contact rows.
• On a contact's page, Edit is an outline button, so Call is the only filled one.
• Lists of more than 1,000 contacts scroll, sort and search much faster. Above that size, the browser's find in page and screen readers only see the contacts near the screen; the app's search finds them all.
• The sign-in screen's index tabs now run the full height of the red panel.
• A contact without a photo shows its initials at the size of a photo, so the page keeps its layout when editing starts. In the form, the photo buttons are centred on the image.
• Draw the app's own chevron on the menus of the settings, the form and the sign-in screen.

Fixed

• The form offers "Add photo" on a contact without a photo, instead of "Change photo".
• The alphabetical index includes # to reach contacts whose names start with digits, symbols or letters outside A–Z.
• From wide screens, each section title of a contact sits on the same baseline as its first line.
• Contact pages keep phone numbers whole in windows 1024 to 1279 pixels wide, where section titles, and row labels set to Auto, now sit above their values.
• Copy buttons stay aligned across all rows of a contact, including sections with several phone numbers, e-mail addresses or postal addresses.
• On narrow phones, a field's remove button stays beside its type menu instead of falling alone on a line.
• Large address books open much faster. The slowdown grew quickly with size and could reach minutes at 10,000 contacts.
• A contact opened from a direct link now has its row scrolled into view in the list.

Natel 0.5.0

Upgrade notes

• The image no longer turns on Caddy's admin API: its healthcheck now reads a site Caddy serves on 127.0.0.1:2021, set by NATEL_HEALTH_PORT. Containers that set NATEL_ADMIN: "off" and disabled the healthcheck can drop both. Change the port if another service on a shared network namespace uses it, and turn the admin API back on only for a probe or tool of yours that reads port 2019, and never on a shared namespace, where it reopens the issue below. Bare-metal installations that copy the Caddyfile get the listener too and can delete its site block. See deployment and bare metal.

Added

• The address book is in each page's address, as in /contacts/work/ada, so a reload or a shared link opens the same book, and signing in opens the page that was asked for. The settings move to /settings.
• A .vcf file dropped on the window is imported into the selected address book.
• An import first shows what it will do, and lists the cards that look like contacts already in the book, which can be left out.
• Settings offers a button to check for a newer release immediately when server update checks are enabled, with a result or an error shown after the check.
• The move dialog warns that a contact may no longer appear in some groups after moving to another address book and asks you to check its groups afterwards.
• The deployment guide explains that Natel checks no password when Xandikos is exposed directly, and gives a tested Caddy site that protects it.

Changed

• Contact pages show compact initials beside the name and organisation on phones and desktop. Photos keep their full size, and long names wrap beside the avatar.
• Contact forms use text controls for additions and deletion, and contact groups use compact rectangular chips to distinguish them from primary actions.
• Contact photos, initials and organisation icons are round by default. Settings lets you choose rounded squares instead; the choice applies to the list, contact pages and forms and is remembered in your browser.
• Contact forms group optional information in one Add information menu and separate move and delete actions from field additions.
• Contact lists hide dotted leaders when they would shorten a name, giving long names more room without changing the pane width or trailing values.
• Contact pages use compact rows on desktop and lighter sections on phones. Settings lets you keep this automatic layout or place row labels on the left or above values at every screen width, with a live preview. Copy and edit controls align beside the first value of each desktop section.
• The selected contact's red marker is shorter and stays centred beside its image.
• On phones, the top bar's back link names the address book the page belongs to.

Fixed

• The password's show button and the search's clear button sit centred in their fields, and smaller.
• vCard 3.0 text now escapes semicolons as required by the standard, and text birthdays retain their characters across repeated saves. Long vCard lines follow the recommended 75-byte limit. Clients affected by the ical.js semicolon decoding issue, including Nextcloud Contacts, may display an extra backslash; see the compatibility notes.

Security

• Containers that share their network namespace (network_mode: host, a VPN or Tailscale sidecar, a Kubernetes pod) and kept the default NATEL_ADMIN exposed Caddy's unauthenticated admin API to every process on that namespace, which could reconfigure Caddy to collect passwords. The admin API is now off by default; containers on their own Docker network were not affected.
• The image updates Caddy to 2.11.9, and Go, x/net and musl to versions that fix high-severity vulnerabilities a scan reported in 0.4.1; a scan does not show that each one was reachable in Natel. Bare-metal installations update their own Caddy package.
• HTTPS deployments can enable NATEL_HTTPS_ONLY_COOKIE=true to prevent a sibling subdomain from planting an attacker's session when the TLS proxy is bypassable or HTTPS is not detected. The setting defaults to false to preserve HTTP access; see HTTPS session cookies before enabling it.

Natel 0.4.1

Upgrade notes

• Update checks are enabled by default. Your Natel server consults a static version file hosted on GitHub Pages at most once per 24 hours while the app is used. Set NATEL_UPDATE_CHECKS=false to disable these external requests; no contacts or credentials are sent.

Added

• A contact can have several addresses, each with an extended line (c/o, building) and a label of its own, such as "Chalet".
• A contact's address opens a map search for it: by default Apple Maps on Apple devices, the device's maps app on Android, OpenStreetMap elsewhere. The settings choose another, Google Maps included.
• A group on a contact's page filters the list on that group.
• A full birthday shows the age.
• A dot on the settings icon tells you when a newer release is available; the settings link to its release notes and let you ignore that version on this browser.

Changed

• The header loses its red band along the top, a decoration the contact, settings and new-contact screens on phones didn't have.
• After a conflict, overwriting is no longer offered when the phones, e-mails or addresses the user changed were changed elsewhere too: the warning names them and offers to reload.