Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Jul 03:23
v0.2.0
d607b34
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

First tagged release and first published container image. Everything below has
been in main since the project started; this entry marks the point where it
became installable.

Added

  • Short codes computed by a calibrated Feistel network with an ARX round
    function, a bijection over the id space with no code index kept on disk.
  • Pluggable storage: embedded LMDB (default, zero-dependency) or Postgres for
    a multi-node, shared-database deployment.
  • Pluggable cache: in-process by default, with an optional Valkey L2 tier and
    cross-node invalidation over Valkey pub/sub.
  • Pluggable analytics: an embedded sink by default, or ClickHouse for an OLAP
    analytics backend; GET /:code/stats for aggregates and recent events.
  • OIDC login (Authorization Code + PKCE) as an alternative to the admin token,
    with opaque revocable server-side sessions.
  • Signed outgoing webhooks following the Standard Webhooks spec, on
    link.created/updated/deleted/expired/clicked/broken/recovered; a durable
    Postgres outbox with retry, backoff and dead-lettering, best-effort delivery
    on LMDB; Slack/Discord/Telegram notification channels built on the same
    subscription model.
  • API tokens with scopes (links_read, links_write, webhooks,
    analytics, full) and an optional per-token rate limit.
  • Redirect rules: per-link geo/device targeting, first match wins.
  • A/B testing: weighted link variants with per-variant click stats.
  • Deep linking: hosts the iOS apple-app-site-association and Android
    assetlinks.json files, plus device-aware redirect to an app destination.
  • Password-protected links (argon2id), max-visits expiration with an optional
    fallback URL, and broken-link monitoring with webhook notifications on
    status transitions.
  • Conversion forwarding to GA4 and Meta CAPI, dispatched off the redirect hot
    path.
  • Importer for CSV/JSON exports from Bitly, Kutt, YOURLS and a generic format,
    with a partial-success per-row report.
  • Tags, a UTM builder with locally saved templates, and server-side search on
    Postgres (client-side fallback on LMDB).
  • Abuse protection on link creation: per-IP rate limiting and a built-in guard
    against internal/loopback network targets (SSRF).
  • Admin panel (React, Vite, shadcn/ui, TanStack, Recharts): link CRUD, search,
    tags, QR codes, per-link stats, API token management.
  • docker-compose.yml for a full local stack (quark, Postgres, Valkey,
    ClickHouse).
  • quark --version and an X-Quark-Version header on GET /health.

Security

  • AGPL-3.0-only core with a CLA collected on every pull request.
  • Private vulnerability reporting and a written security policy.

Imagem do container

docker pull ghcr.io/lucasolopes/quark:0.2.0

Plataformas: linux/amd64, linux/arm64.
Digest: sha256:fa9b269d898df8d61e2657e5f3c6b03468049ed177731c81c74887ed0f8f427e

Verifique a proveniencia do build:

gh attestation verify oci://ghcr.io/lucasolopes/quark:0.2.0 --repo lucasolopes/quark
Assets 2
Loading