Skip to content

FluxTuner 0.9.0 — Private Web mode, multi-user auth and polished app shell

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jun 11:15
v0.9.0
540d951
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FluxTuner 0.9.0 is a major Web/server mode release.

This version turns FluxTuner Web into a private, authenticated local web app with multi-user support, first-run administrator setup, protected library data and a much more polished browser UI.

Highlights

Private Web/server mode

  • Added local Web user accounts.
  • Added first-run setup wizard for creating the first administrator.
  • Added optional setup token protection for exposed deployments.
  • Added Argon2id password hashing.
  • Added server-side sessions.
  • Added CSRF protection for private Web API mutations.
  • Added authenticated Web access for favorites, history and manual playlists.
  • Added browser-based Admin UI for managing Web users.
  • Added emergency Web user CLI commands.

Web UI polish

  • Added responsive app shell with compact navigation.
  • Added isolated Admin view.
  • Added compact server-health summary inside Admin.
  • Added browser playlist picker.
  • Added light/dark theme toggle.
  • Added real packaged Web app icon.
  • Improved theme contrast and form/dialog readability.
  • Improved playlist dialog theming in both light and dark modes.
  • Improved player visibility across login/logout.
  • Improved hamburger menu dismissal with outside click and Escape.
  • Fixed logout so browser playback stops immediately.

Fixes

  • Fixed deleting Web favorites by raw stream URL.
  • Fixed default technical Web user permissions.
  • Fixed setup-before-auth initialization.
  • Fixed Web app icon packaging in wheels and containers.
  • Fixed stale Admin view state when switching from admin to non-admin users.
  • Fixed Web resource loading on Python 3.11.

Documentation and packaging

  • Updated README for 0.9.0.

  • Updated changelog.

  • Added and updated secure Web deployment docs.

  • Updated container deployment documentation.

  • Updated architecture and multi-user model docs.

  • Updated Flatpak metadata.

  • Clarified licensing:

    • core/local FluxTuner remains MIT licensed
    • Web/server and multi-user components use the FluxTuner Web Non-Commercial License

Validation

Validated with:

node --check fluxtuner/web/static/app.js
python -m ruff check .
python -m ruff format --check .
python -m pytest
bandit -r fluxtuner
pip-audit --local
python -m build

Also smoke-tested with a clean container and persistent data volume.

Upgrade notes

Web/server deployments should use a persistent FLUXTUNER_DATA_DIR, usually mounted as /data in containers.

For local HTTP testing, set:

FLUXTUNER_WEB_SECURE_COOKIES=false

For LAN or internet-accessible deployments, keep secure cookies enabled and serve FluxTuner Web behind HTTPS:

FLUXTUNER_WEB_SECURE_COOKIES=true

For first-run exposed deployments, set:

FLUXTUNER_WEB_SETUP_TOKEN=<strong-random-token>

See docs/web.md, docs/container.md and docs/secure-web-deployment.md for deployment details.

Assets 4
Loading