You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Merge rc.1, rc.2, and unreleased entries into a single 3.0.0 entry.
Drop internal CI/lint/refactoring noise and rewrite fix language into
feature descriptions appropriate for a first public release.
@@ -4,101 +4,9 @@ All notable changes to Muximux are documented in this file.
4
4
5
5
## [Unreleased]
6
6
7
-
### Added
8
-
9
-
-**Config restore in onboarding wizard** — New "Restore from Backup" option on the welcome screen lets you import an existing `config.yaml` to skip the setup wizard entirely.
10
-
11
-
### Fixed
12
-
13
-
-**Data directory now resolves relative to the binary**, not the working directory. Previously, starting muximux from a different CWD (e.g. after `cd web && npm run build`) would cause config to be read/written at the wrong path.
-**TypeScript errors** in test files (`window.location` mock, `require()` replaced with async `import()`).
31
-
-**Release workflow** — `latest` Docker tag now correctly applied to stable releases (was broken on tag pushes due to `is_default_branch` check).
32
-
-**42 SonarCloud code quality issues** — duplicate string constants extracted, unnecessary variables inlined, `window` → `globalThis` for SSR safety, shell `[` → `[[`, Dockerfile package sort, and redundant type alias removed.
33
-
34
-
### Added
35
-
36
-
-**Test coverage improvements** — new tests for authStore logout redirect, SecurityTab component, forward auth presets utility, and Go auth/server logout_url code paths (387 → 408 frontend tests).
37
-
-**API documentation** — `logout_url` field now documented in auth status and auth method switch examples.
38
-
39
-
---
40
-
41
-
## [3.0.0-rc.1] - 2026-02-20
42
-
43
-
### Changed
44
-
45
-
-**Health checks are now opt-in** — Apps no longer have health checks enabled by default. Enable per-app with `health_check: true` or in bulk from Settings. TLS certificate verification is skipped for health checks to support self-signed certs common in homelabs.
46
-
-**Build tag split** — Go builds no longer require a `dist/` placeholder directory. Dev builds compile without `embed_web` tag; production builds use `-tags embed_web` to embed frontend assets.
47
-
-**Docker PUID/PGID support** — Container entrypoint now creates a runtime user matching `PUID`/`PGID` environment variables for bind-mount permission compatibility (linuxserver.io convention).
-**Settings modal refactored** — Extracted each tab (General, Apps, Theme, Security, About) into its own component, reducing Settings.svelte from ~3800 lines to ~1800.
50
-
-**Button styles standardized** — All buttons in Settings now use the design system classes (`.btn`, `.btn-primary`, `.btn-secondary`, `.btn-ghost`) instead of hand-rolled Tailwind.
51
-
-**Open mode labels** — Consistent display between Add and Edit flows; both now use shared `openModes` constant.
52
-
53
-
### Added
54
-
55
-
-**Iframe caching** — Visited app iframes are kept alive in the DOM when switching between apps. Returning to a previously opened app is instant — no reload, no lost scroll position, no re-authentication. Frames are pruned when apps are deleted or disabled.
56
-
-**Forward auth login page** — When auth method is `forward_auth`, the login page shows an "External Authentication" message instead of a username/password form that can't be used. The `/api/auth/status` endpoint now includes `auth_method` in its response.
57
-
-**Runtime URL interceptor for reverse proxy** — Proxied SPAs (like Plex) that construct URLs dynamically in JavaScript now work correctly. The proxy injects a script that patches `fetch()`, `XMLHttpRequest`, `WebSocket`, `EventSource`, and DOM property setters (`img.src`, etc.) so all requests route through the proxy automatically.
58
-
-**Content-type-aware rewriting** — HTML and CSS get full path rewriting; JS, JSON, and XML use safe-only rewriting (SRI stripping, absolute URLs) to avoid corrupting API data that apps read programmatically.
59
-
-**Dynamic proxy route rebuilds** — Adding, editing, or removing a proxied app in Settings takes effect immediately without restarting Muximux.
60
-
-**Hash-based app routing** — Clicking an app updates the URL hash (e.g., `#plex`), allowing direct links to specific apps and browser back/forward navigation between them.
61
-
-**Debug logging** — Add `?debug=true` to the URL to enable browser console logging across all major subsystems (config, websocket, auth, theme, health, icons, keybindings). Persists via localStorage; disable with `?debug=false`.
62
-
-**Flat bar style** for top/bottom navigation — a streamlined layout that shows apps in a single row separated by group icon dividers, without group headers or collapsible sections.
63
-
-**Per-app keyboard shortcut assignment** — assign number keys (1–9) to specific apps instead of relying on position-based ordering. Configured via `shortcut` field on each app or in Settings > Keybindings.
64
-
-**Per-app health check toggle** — disable health monitoring for individual apps with `health_check: false`. Useful for apps that don't respond to HTTP checks or where you don't care about status. Includes bulk enable/disable in Settings.
65
-
-**Base path support** — serve Muximux at a subpath behind a reverse proxy (e.g., `https://example.com/muximux/`). Configure with `server.base_path` in config, `--base-path` CLI flag, or `MUXIMUX_BASE_PATH` environment variable.
66
-
-**Cancel button on Edit modals** — Edit App and Edit Group modals now have a Cancel button that reverts changes. Previously only "Done" was available, which applied changes immediately.
67
-
-**Validation on Edit modals** — Edit App and Edit Group modals now validate with Zod schemas before accepting, matching the Add flows.
68
-
-**Redirect open mode in UI** — The `redirect` open mode is now available in the Settings dropdown (previously only configurable via YAML).
69
-
-**Dynamic themed favicons** — All favicons (browser tab, apple-touch-icon, Android manifest icon, theme-color meta) now update to match the current theme's accent color instead of using static green PNGs.
70
-
-**Screenshot gallery** — README now includes a collapsible gallery with numbered screenshots covering onboarding, themes, dashboard, and log viewer. Wiki pages reference screenshots inline.
71
-
-**`.btn-danger` design system class** — For destructive action buttons (delete confirmations).
72
-
-**`--accent-on-primary` theme variable** — Dedicated text color for accent-colored buttons, ensuring readable contrast in both dark and light themes.
73
-
-**Docstring coverage enforcement** — CI checks that 80%+ of exported Go identifiers have doc comments (`scripts/check-docstrings.sh`).
74
-
-**CHANGELOG-based release notes** — Release workflow extracts notes from CHANGELOG.md instead of auto-generating from PR titles. Falls back to auto-generation if no entry found.
75
-
-**CONTRIBUTING.md** — Developer guide covering prerequisites, dev mode, building, testing, and PR process.
76
-
-**systemd service file** — `muximux.service` for bare-metal deployments with security hardening.
77
-
-**Snyk Node scan** — CI security workflow now scans frontend npm dependencies in addition to Go and Docker.
78
-
79
-
### Fixed
80
-
81
-
-**Health tooltip showing nanoseconds** — Health check response times in tooltips now correctly display milliseconds instead of raw nanosecond values.
82
-
-**Proxy 404 on double-prefixed URLs** — XML/JSON API responses from proxied apps no longer have root-relative paths statically rewritten, preventing double-prefixing when the SPA embeds those paths in query parameters (e.g., Plex photo transcode URLs).
83
-
-**Proxied app images invisible due to frozen iframe timeline** — Chrome may freeze `document.timeline` inside iframes, stalling CSS/Web Animations. The interceptor detects loaded images stuck at opacity 0 and forces them visible.
84
-
-**Config env var expansion corrupting bcrypt hashes** — Replaced `os.ExpandEnv` with braced-only `${VAR}` expansion so bare `$` signs in bcrypt hashes and other values are not treated as variable references.
85
-
-**Unset `${VAR}` silently replaced with empty string** — `${VAR}` references to undefined environment variables are now preserved literally instead of being silently deleted.
86
-
-**Config export zeroing live password hashes** — Exporting config (`GET /api/config/export`) no longer corrupts in-memory auth state. The shallow struct copy now deep-copies the users slice before stripping sensitive fields.
87
-
-**Config save race between API and auth handlers** — Both handlers now share a single `sync.RWMutex` for all config reads and writes, preventing concurrent saves from silently overwriting each other.
88
-
-**GetApps and GetGroups missing read lock** — These endpoints now acquire the config read lock, preventing data races with concurrent config writes.
89
-
-**Single-app update overwriting proxied app URL** — `PUT /api/app/{name}` now preserves the original backend URL for proxied apps instead of saving the frontend proxy path.
90
-
-**App rename via bulk save dropping auth rules** — Renaming an app in Settings no longer loses its AuthBypass and Access rules; a positional fallback matches renamed apps to their original config.
91
-
-**Theme delete failing when `@theme-id` differs from filename** — Theme ID is now always derived from the filename, ignoring `@theme-id` metadata comments.
92
-
-**Cannot clear user email or display name** — `PUT /api/auth/users/{name}` now accepts empty strings to clear these fields instead of silently ignoring them.
93
-
-**Button text contrast on accent backgrounds** — Primary buttons use `--accent-on-primary` (white) instead of `--bg-base` which was near-black in dark themes.
94
-
-**Theme family cards** — Now use semantic `<button>` elements instead of `<div role="button">` with manual keyboard handlers.
95
-
-**Separated setup and add-user state** — The "Create first user" form in Security no longer shares state with the "Add User" modal.
96
-
-**Icon browser pre-population** — Opening the icon browser for a new app/group now passes the current icon selection.
97
-
-**Static assets blocked by auth middleware** — Root-level static files (manifest.json, favicon.ico, apple-touch-icon.png, etc.) were incorrectly blocked by authentication, causing browser errors. Auth bypass rules now use explicit paths instead of non-functional glob patterns.
98
-
99
-
---
100
-
101
-
## [3.0.0] - 2025-02-15
9
+
## [3.0.0] - 2026-02-21
102
10
103
11
### Ground-Up Rewrite
104
12
@@ -108,23 +16,30 @@ Muximux v3 is a complete rewrite. The original PHP bookmark portal has been repl
108
16
109
17
**Core**
110
18
- Single binary deployment with embedded frontend -- no PHP, no web server, no database
111
-
- YAML-based configuration with environment variable expansion (`${VAR}`)
19
+
- YAML-based configuration with braced `${VAR}`environment variable expansion (literal `$` signs in values like bcrypt hashes are safe)
112
20
- Guided onboarding wizard for first-run setup with live preview
113
-
- Data directory (`data/`) for config, themes, icons, and logs
21
+
- Restore from backup on the onboarding welcome screen -- import an existing `config.yaml` to skip the wizard entirely
22
+
- Data directory (`data/`) for config, themes, icons, and logs -- resolves relative to the binary location regardless of working directory
114
23
- System info and update check API endpoints
24
+
- Docker PUID/PGID support for bind-mount permission compatibility (linuxserver.io convention)
- Base path support for reverse proxy subpaths (e.g. `https://example.com/muximux/`) via config, CLI flag, or `MUXIMUX_BASE_PATH` env var
115
27
116
28
**Built-in Reverse Proxy**
117
29
- Per-app proxy that strips iframe-blocking headers and rewrites HTML, CSS, JS paths
30
+
- Runtime URL interceptor for JavaScript-constructed URLs -- patches `fetch()`, `XMLHttpRequest`, `WebSocket`, `EventSource`, and DOM property setters so proxied SPAs work correctly
31
+
- Content-type-aware rewriting: full path rewriting for HTML/CSS, safe-only rewriting (SRI stripping, absolute URLs) for JS/JSON/XML to avoid corrupting API data
118
32
- WebSocket proxy support for live-updating apps
119
33
- Per-app TLS skip, custom headers, and configurable timeout
120
34
- Gzip-aware content rewriting and SRI neutralization
35
+
- Dynamic proxy route rebuilds -- adding, editing, or removing a proxied app takes effect immediately without restart
121
36
- Separate from TLS/gateway (Caddy) -- works in every deployment mode
122
37
123
38
**Authentication**
124
39
- Built-in username/password auth with bcrypt
125
-
- Forward auth support (Authelia, Authentik)
40
+
- Forward auth support (Authelia, Authentik) with dedicated external authentication login page
126
41
- OIDC provider integration
127
-
- User management with roles (admin, user, guest)
42
+
- User management with roles (admin, power-user, user)
128
43
- Live auth method switching without restart
129
44
- API key authentication for programmatic access
130
45
- Rate-limited login and setup endpoints
@@ -142,16 +57,22 @@ Muximux v3 is a complete rewrite. The original PHP bookmark portal has been repl
142
57
- Persistent log file with rotation
143
58
144
59
**Health Monitoring**
145
-
- Periodic health checks with configurable interval and timeout
60
+
- Opt-in per-app health checks with configurable interval and timeout
61
+
- TLS certificate verification skipped for health checks to support self-signed certs common in homelabs
- CI with linting, testing, security scanning, and code coverage
110
+
- systemd service file for bare-metal deployments with security hardening
111
+
- CONTRIBUTING.md developer guide
184
112
185
113
### Migration from v2
186
114
187
115
Muximux v3 is not backwards-compatible with v2. The PHP application has been replaced entirely. Start fresh with the onboarding wizard or create a new `config.yaml` from `config.example.yaml`.
0 commit comments