v0.5.0

🔐 OpenSecDash v0.5.0: The Front Door Now Has a Lock

OpenSecDash v0.5.0 is a security, reliability, and operations release. It adds optional OpenID Connect sign-in, a protected first-admin setup for new installations, safer remote integrations, stronger browser and input boundaries, and release gates for large databases and real upgrades.

In other words: the dashboard has not merely received another shiny graph. It has learned to lock the front door, check who is knocking, and avoid drinking arbitrary JSON from the internet.

⚠️ Breaking Changes: Read Before Upgrading

Action may be required: Review the authentication, SMTP, bare-metal, and custom container-command notes below before deploying v0.5.0. Surprise lockouts are funny only when they happen to somebody else's lab.

🔑 Internal Sign-In Is Now the Default for New Installations

Brand-new installations no longer start with an open dashboard. The first visit opens a restricted setup page where the first local Admin account is created. Completing that setup requires a trusted reverse proxy, HTTPS on external port 443, an explicitly configured OSD_TRUSTED_PROXIES value, and a matching authentication hostname.

To run a new installation without OpenSecDash's internal sign-in—for example behind a VPN or an existing forward-auth layer—set OSD_AUTH_DISABLED=true and restart. Every visitor who can reach the instance then has full access, so the surrounding network or authentication proxy must provide the protection.

Existing installations are not locked out by the upgrade:

• Existing installations with internal sign-in enabled continue unchanged.
• Existing open installations remain open and fully usable, but show a permanent security prompt until an administrator enables internal sign-in or deliberately sets OSD_AUTH_DISABLED=true.
• Existing users, roles, sessions, password hashes, OIDC settings, and authentication hostnames are preserved.

The former Disable internal sign-in button has been removed. Once internal sign-in is enabled, OSD_AUTH_DISABLED=true is the only bypass and recovery mechanism.

➡️ Setup, migration behavior, and recovery:
Authentication

✉️ SMTP TLS Certificates Are Now Verified

STARTTLS and SSL/TLS connections now verify both the mail-server certificate and its hostname. Installations using a public CA should continue to work without changes.

Action required for private or self-signed mail CAs: Mount the CA certificate into the container and configure Custom CA certificate file. Certificate verification cannot be disabled.

➡️ SMTP setup:
Notifications

🐍 Bare-Metal Installations Use the Pinned Python Runtime

The exact Python version in backend/.python-version—3.14.6 for this release—is now the validated runtime for development, CI, release checks, and production. Bare-metal operators should install that version and recreate or synchronize the environment with the pinned uv release before restarting OpenSecDash. Docker users receive the correct runtime with the image.

➡️ Updated installation steps:
Bare-metal installation

🐳 Custom Container Commands No Longer Run Through a Shell

The standard image command is unchanged from an operator's perspective, but the entrypoint now launches Uvicorn directly as PID 1. This gives the process clean signal handling and graceful shutdown.

Action required only if the image command is overridden: Pass the executable and arguments in exec/array form. Shell expansion, pipelines, and compound command strings are no longer interpreted implicitly.

🧱 Update Your Compose Deployment

Existing Compose deployments continue to start, but operators should update their docker-compose.yml using the new example. The hardened configuration makes the container root filesystem read-only, provides a small temporary filesystem, enables no-new-privileges, drops unnecessary Linux capabilities, and adds sensible CPU, memory, and process limits.

The container keeps only CHOWN, SETUID, and SETGID during startup so it can repair ownership of existing /data volumes before launching OpenSecDash as its unprivileged application user. Keep these three capabilities unless volume ownership is managed separately and the consequences have been tested.

Recommended action for Docker Compose users: Compare your deployment with the current docker-compose.example.yml and adopt the new hardening options. Adjust the resource limits to match unusually large event volumes, but keep the security boundaries wherever possible.

➡️ Configuration details and volume-upgrade guidance:
Docker installation

✨ What This Release Represents

The headline addition is optional single sign-on with one OpenID Connect provider, such as Authentik, Authelia, Keycloak, or Pocket ID. Password sign-in remains available by default, provider accounts map to local OpenSecDash users, and roles remain under local administrator control. Existing users and sessions survive the database migration.

The less visible work is just as important:

• 🛡️ Global security headers, CSRF origin checks, safer redirects, bounded request and response bodies, and stricter permissions reduce the blast radius of exposed routes.
• 🌐 Remote integrations validate destinations, redirects, TLS behavior, and response sizes more carefully while keeping private homelab services usable.
• ⚡ Event search, live updates, startup maintenance, and background database sessions behave predictably on large SQLite installations.
• 📦 Locked dependencies, runtime-parity checks, upgrade benchmarks, container scans, and a hardened Compose example make the shipped artifact match the tested one.
• 🔎 Remote GeoIP is off by default for new installations because the bundled free provider receives uncached public IPs over plain HTTP. Existing explicit settings are preserved and surfaced with a warning.

Together, these changes make OpenSecDash more defensive without turning it into an enterprise maze: one container, one SQLite database, understandable controls, and no new telemetry or hidden external data flows.

➡️ Full upgrade guidance:
Updating OpenSecDash

---

What's Changed

⚠️ Breaking changes

• Auth admin onboarding by @konkos1 in #80

✨ Enhancements

• App hardening by @konkos1 in #70
• OIDC authentication by @konkos1 in #77
• Expand authentication debug report by @konkos1 in #97
• Global csrf origin check by @konkos1 in #58
• Harden login backoff against xff spoofing by @konkos1 in #60
• Verify smtp tls certificates by @konkos1 in #61
• Seed legacy settings in upgrade benchmark fixture by @konkos1 in #81
• Key login throttling on trusted client, not shared proxy by @konkos1 in #82
• Enforce insight rule size limits while streaming download by @konkos1 in #83
• Harden login throttling against rotation, account DoS by @konkos1 in #84
• Harden deployment and remote integrations by @konkos1 in #88
• Lock oidc provider controls with password login off by @konkos1 in #94

🐛 Fixes

• Centralize safe local redirects by @konkos1 in #59
• Move legacy view migration out of get requests by @konkos1 in #62
• Persist offline detection state by @konkos1 in #63
• Fold asset lookup into event query by @konkos1 in #64
• Index insight cooldown queries by @konkos1 in #65
• Own background loop sessions in their worker thread by @konkos1 in #76
• Bound login verification without shared lockouts by @konkos1 in #86
• Close remaining review findings by @konkos1 in #87
• Keep github token editable without asset plugins by @konkos1 in #95
• Fix dashboard empty state banner by @konkos1 in #96
• Match canonical CrowdSec decision IPs by @konkos1 in #98

🔧 Other changes

• build(deps): bump the python-dependencies group across 1 directory with 4 updates by @dependabot[bot] in #69
• build(deps): bump actions/setup-python from 6.3.0 to 7.0.0 by @dependabot[bot] in #72
• build(deps): bump actions/setup-node from 6.5.0 to 7.0.0 by @dependabot[bot] in #73
• build(deps): bump anchore/sbom-action from 0.20.6 to 0.24.0 by @dependabot[bot] in #71
• build(deps): bump astral-sh/uv from 0.11.23 to 0.11.31 in /docker by @dependabot[bot] in #74
• build(deps): bump python from 3.13.14-slim-trixie to 3.14.6-slim-trixie in /docker by @dependabot[bot] in #75

New Contributors

• @dependabot[bot] made their first contribution in #69

Full Changelog: v0.4.2...v0.5.0