-
kw released this
2026-08-18 10:19:41 +00:00 | 333 commits to main since this releasePasskeys, as a way in and as a second factor. The private half never leaves the
device and the signature is bound to the origin, so a convincing copy of the
sign-in page at another address gets nothing. Logging in asks for no email — the
device knows which account its key belongs to, which also means the sign-in page
cannot be used to find out who has an account here. A key that verified its owner
completes the login; one that only proved possession still meets the TOTP step.The relying party id comes from VERDANDE_BASE_URL, and an IP address is refused up
front: no browser accepts one, and without the check the server issues a challenge
happily and the browser throws SecurityError long afterwards.Verdande can ask the panel to restart it, from its own settings. A container cannot
replace its own image, so the panel recreates it and pulls :latest on the way —
which is what makes a restart an update. Needs VERDANDE_PANEL_URL, _TOKEN and
_SERVER_ID; the page names whichever are missing.Section headings are bands rather than hairlines, so a project's grouping can be
counted without reading a word. Board and Calendar use the full width — a rule that
had been in the stylesheet since the board was built and could never match, because
.boardlives in a child component and Svelte scopes a selector to the component
that wrote it.The Inbox follows the interface language. It is the one project name nobody chose;
rename it and that is your name for it, in every language.One migration, 0013, and it only adds two tables.
Downloads