v0.4.2

🚀 The Biggest OpenSecDash Update Yet

The release v0.4.x is a major milestone for OpenSecDash and the most substantial update in the project's history. Since v0.3.1, we have not merely added isolated features: core parts of the application have been expanded, redesigned, and brought together into a more complete security experience. With this release, OpenSecDash includes the full feature set defined by the current Architecture Decision Records for the first stable v1 version. Further additions such as more notification channels, an asynchronous action queue, advanced Level 2 correlations, and full offline operation remain deliberately reserved for later versions.

✨ What This Release Represents

Major additions include the complete Action Framework for controlled and auditable responses, the redesigned Insights and correlation engine, a customizable plugin-driven dashboard, shared filters and saved views for Events and Access, and the new notification framework with SMTP support.

The release also introduces optional internal authentication with user roles, personal preferences, instance branding, a significantly improved responsive interface with installable PWA support, progressive loading for data-intensive areas, and secure reverse-proxy header handling.

Together, these changes evolve OpenSecDash from a compact security dashboard into a complete—but intentionally understandable—security interface for homelabs:

• 📥 Datasources collect security and infrastructure events.
• 🔎 Enrichment, Insights, and correlations add useful context.
• 📊 Explorers and the customizable dashboard support investigations.
• 🔔 Notifications surface relevant activity without unnecessary alert floods.
• 🛡️ Controlled Actions allow operators to respond directly.

Despite the much broader feature set, the project's technical direction remains unchanged: self-hosted, plugin-oriented, server-side rendered, transparent, and free from unnecessary external data flows.

⚠️ Breaking Change: CrowdSec Is Now LAPI-Only

Action required for cscli users: Configure a CrowdSec LAPI URL and dedicated machine credentials after upgrading. Existing connection-mode and cscli executable-path settings are no longer used.

The previous cscli integration has been removed. CrowdSec decision synchronization and ban/unban actions now operate exclusively through the CrowdSec Local API (LAPI). Installations that already use LAPI do not require a fundamental migration.

🔐 Why cscli Was Removed

The change was made because of security concerns with the previous subprocess model. Using cscli required mounting a host executable and CrowdSec configuration into the OpenSecDash container. A configurable executable path also created an unnecessary code-execution primitive if an attacker gained access to the settings and could place or select a suitable executable.

LAPI provides everything OpenSecDash needs without mounting host binaries or CrowdSec configuration files into the container. It uses dedicated machine credentials that can be revoked independently at any time. OpenSecDash also strictly validates the configured LAPI URL and does not follow redirects for authenticated LAPI requests, helping ensure that credentials and bearer tokens are sent only to the intended endpoint.

➡️ Migration and setup instructions are available in the CrowdSec documentation.

---

What's Changed

🐛 Fixes

• Restore moved settings by @konkos1 in #56
• Support touch tooltips on trend bars by @konkos1 in #57

Full Changelog: v0.4.1...v0.4.2