Skip to content

v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Aug 22:59
· 54 commits to main since this release
v0.6.0
d02c87b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🔔 OpenSecDash v0.6.0: Every Insight Gets Its Own Bell

OpenSecDash v0.6.0 is a visibility, notification, and release-transparency update. It adds individual notification controls for every Insight, a privacy-conscious IPLocate GeoIP option, provider reachability diagnostics, a more useful 30-day Dashboard trend, and complete third-party license evidence.

In other words: the dashboard has stopped ringing one large alarm bell for every Insight. It now has a labeled bell for each one, knows whether somebody installed the wiring, and can explain why a bell is temporarily quiet.

⚠️ Upgrade Notes: No Breaking Changes

Existing installations can upgrade without changing their deployment configuration. Database and settings updates run automatically with the normal migration process.

There are three behavior changes worth knowing about:

  • Existing GeoIP settings are preserved. An installation using ip-api.com keeps using it; the upgrade never switches providers or starts a new external data flow. Only new installations pre-select IPLocate, and GeoIP still starts disabled.
  • The shared Scanner detected notification rule is retired. If it was enabled, currently known high-severity Insights inherit that enabled state as separate rules. The old wildcard rule is disabled to prevent duplicate mail. New Insight rules start disabled.
  • Custom event-producing plugins should declare event_types. OpenSecDash uses this metadata to determine whether dependent Insight notification rules are available. Missing metadata does not stop the plugin, but its dependent notification controls cannot be enabled until their event producers are known.

No surprise provider swap, no surprise email storm, and no surprise wizard demanding an enterprise architecture diagram.

➡️ Upgrade details:
Updating OpenSecDash

🔔 One Notification Rule per Insight

Every built-in, downloaded, or plugin-provided Insight now receives its own persistent notification rule. Administrators can choose exactly which findings deserve an email instead of enabling one shared high-severity wildcard.

  • Each Insight keeps its own enabled state, time window, and cooldown across restarts and ruleset updates.
  • Declarative ruleset updates can refresh names and metadata without replacing the administrator's choices.
  • A rule is selectable only while enabled plugins can produce all event types required by that Insight.
  • Disabling a required plugin temporarily disables the control but preserves its saved value. Re-enable the plugin and the rule returns with its previous choice.
  • Removed Insights are retired cleanly instead of leaving active notification rules behind like tiny email-producing ghosts.

The availability check follows enabled plugin capabilities, not temporary health. A short-lived plugin error therefore does not erase configuration or make controls flicker.

➡️ Rule behavior and SMTP setup:
Notifications

🌍 GeoIP Gets a Safer Provider Choice

The GeoIP plugin now supports the IPLocate EU endpoint alongside the existing ip-api.com integration. New installations pre-select IPLocate while keeping GeoIP disabled, so no lookup leaves the homelab until an administrator opts in.

IPLocate lookups use a fixed HTTPS EU endpoint, verify certificates, refuse redirects, and send the required API key in a request header rather than the URL. The key is write-only in Settings: the browser only learns whether one is stored, an empty field keeps it, and deletion requires a separate confirmed action. OpenSecDash requests and stores only country, city, ASN, and provider information; threat scores, coordinates, and other unused response fields stay out.

The legacy ip-api.com provider remains available without an API key, including for existing installations, but still uses unencrypted HTTP. There is no automatic fallback between providers. Cache entries are provider-specific, so switching providers refreshes an address instead of quietly serving data from the old source.

GeoIP enrichment now lives fully inside the plugin behind a generic bounded enrichment hook. Failed and incomplete lookups are retried without blocking the application event loop, while public-address checks ensure private, local, reserved, and otherwise non-global addresses never reach a remote provider.

➡️ Provider setup, privacy details, and caching:
GeoIP

🩺 GeoIP Diagnostics Report Real Reachability

Diagnostics now reports the outcome and time of the latest real lookup for the selected GeoIP provider. It does not generate a separate probe just to make the status light feel busy.

Before the first lookup, reachability is shown as unverified. A transport failure adds practical DNS, firewall, proxy, and outbound-connection checks; a later successful lookup restores the normal provider status automatically. Debug reports include only aggregate enrichment and cache health, never the looked-up address, API key, location result, or raw provider error.

📈 The 30-Day Trend Keeps Its Daily Detail

Daily rollups are now retained for every calendar month that still overlaps the Dashboard's rolling 30-day trend. A completed month is compacted only after all of its days leave that window, so month boundaries no longer turn recent daily data into a coarser summary too early.

This remains independent of raw-event retention: even a homelab with a shorter raw data window keeps enough daily rollups for the complete Dashboard trend. Older completed months still become compact monthly rows, keeping SQLite pleasantly un-dramatic.

➡️ Retention and historical summaries:
Dashboard rollups

📜 Licenses and Source Evidence Are Now Part of the Release

OpenSecDash now generates and verifies third-party notices for Python runtime packages, browser components, and website dependencies. A public Licenses page exposes the project license, bundled component notices, and source-availability information without requiring sign-in.

Tagged releases add the evidence needed to match the published container to its source:

  • generated application and website notices;
  • an SPDX software bill of materials;
  • the Linux container package and source report;
  • verified source references and archives for covered Python dependencies; and
  • a corresponding-source archive for container packages that require it.

The release workflow checks the actual Linux runtime inventory, verifies source archive digests and sizes against the lockfile, and keeps the GitHub Release as a draft until both the evidence and the verified image are ready. Legal paperwork may not be the most exciting Dashboard widget, but it is an excellent one to have before somebody asks.

✨ Smaller Improvements and Fixes

  • Asset filters now use checkboxes, making multi-value selections clearer and easier to adjust.
  • Account and sign-out navigation uses dedicated icons, while authentication and Settings text is shorter and more consistent in English and German.
  • Informational hints have clearer styling, and the offline page now directs users back to the application more cleanly.
  • Browser interactions affected by the strict Content Security Policy work again without reintroducing inline event handlers.
  • GeoIP provider configuration errors survive background refreshes, so Diagnostics does not accidentally hide the useful part of a failure.
  • Event-notification deduplication stays bounded and refreshes pending payloads after enrichment without queueing the same event twice.
  • FastAPI, httpx2, uv, and release workflow actions received routine dependency updates.

🎯 What This Release Represents

v0.6.0 makes OpenSecDash more selective about what it reports, more transparent about remote enrichment, and more precise about what it ships. The user-facing controls stay small and understandable, while plugin metadata, diagnostics, and release evidence do more of the careful bookkeeping underneath.

The result remains deliberately homelab-sized: one dashboard, explicit external data flows, useful investigation context, and fewer mysterious bells ringing at 03:00.

What's Changed

✨ Enhancements

  • feat: add geoip provider IPlocate by @konkos1 in #101
  • feat: third party license compliance by @konkos1 in #102
  • change: use checkboxes for asset filters by @konkos1 in #104
  • feat: add per-insight notification rules by @konkos1 in #105
  • enhance: report GeoIP reachability in diagnostics by @konkos1 in #106

🐛 Fixes

🔧 Other changes

  • build(deps): bump astral-sh/setup-uv from 7.6.0 to 9.0.0 by @dependabot[bot] in #89
  • build(deps): bump docker/login-action from 4.4.0 to 4.6.0 by @dependabot[bot] in #90
  • build(deps): bump actions/download-artifact from 7.0.0 to 8.0.1 by @dependabot[bot] in #91
  • build(deps): bump the python-dependencies group in /backend with 2 updates by @dependabot[bot] in #92
  • build(deps): bump astral-sh/uv from 0.11.31 to 0.11.32 in /docker by @dependabot[bot] in #93

Full Changelog: v0.5.0...v0.6.0

Contributors

dependabot and konkos1
Assets 10
Loading