v0.1.1

Fixes the two things a first real deployment ran into. No schema change and no migration — pull the new image and restart.

Reaching a database on another host over TLS

The deployment guide said to append ?sslmode=require. In libpq that means "encrypt and do not check the certificate"; node-postgres does check it. A self-hosted PostgreSQL almost always presents a certificate it signed itself, so the setting the guide recommended was the one that could not work — it failed with DEPTH_ZERO_SELF_SIGNED_CERT, and Node's advice was to install a root CA that does not exist.

Use ?sslmode=no-verify for a self-signed server. Confirmed against the server's own pg_stat_ssl: that gives TLSv1.3, while omitting sslmode gives plaintext. It encrypts, it just stops checking who signed the certificate.

The guide now lays out all three modes and what each does and does not check, and the startup failure names the setting to use rather than leaving an operator with a certificate error and nowhere to go.

The first-run setup code

The code is read only after ALLOWED_EMAILS has turned an address away, so a rule admitting everyone (*) makes it unreachable. The log printed one anyway and said to use it, sending operators looking for a code the sign-up form never asks for.

It is no longer printed where it cannot be used. Where it is still live the log now says which case applies: the only way in when the rule admits nobody, or the way to claim the instance with an address the rule would turn away. That middle case is real — with a named allowlist, an address the list turns away is refused without the code and admitted with it.

Upgrading

docker pull ghcr.io/thtmnisamnstr/simple-balance:0.1.1

Stop and remove the container, start it again with the same settings. Full notes in the changelog.