What's New?
This is a huge release that hardens Multi-Scrobbler deployments so that you can use it in a public environment.
Included in this release:
- A new, hardened Docker Image
- Single-User Authentication
- Public Dashboard 👀
- Improved Service ID UI
Hardened Docker Image
Alongside the Authentication introduced below, MS now uses a rebuilt-from-scratch, hardened, distroless docker image.
This image entirely removes root and shell functionality, includes only necessary dependencies to run MS (basically no OS), and defaults to running the container as a non-privileged user. These changes make it much harder for a malicious actor to compromise the container, use any kind of exploits, and gain a privileged foothold in your host system.
- The drawback of this change is that there are breaking changes for your compose stack related to container and file/folder ownership.
- The good news is that these changes are relatively straightforward and for the majority of users should be only a few changed lines in their compose file.
Important
The 0.21.0 docker image contains BREAKING CHANGES that will require you to make changes to your docker-compose.yaml file and potentially host-level file/folder ownership.
Failing to make these changes is not destructive but your instance will likely exit on startup due to insufficient permissions. You can make these changes at any time and simply re-deploy your container.
Follow the 0.21.0 Upgrade Guide in the docs to update your compose stack and fix file ownership.
Single-User Authentication
I have planned features that will allow more modification of MS and downstream scrobble data. However MS (until now) still did not have any kind of authentication which puts users in a hard position of exposing their instance to malicious actors or potentially losing connectivity to some Sources. This would have been made worse by the planned features. So the time has come...
Multi-Scrobbler now supports single-user authentication using Better-Auth 🎉
Upgrading and Initial Setup
I have gone to great lengths to make sure upgrading is painless.
When you upgrade, before even setting up auth, your MS instance will continue to work exactly as it does today for backend, Sources, Clients, polling, etc...the only thing that changes is how the web dashboard is initially accessed.
Additionally, nothing changes for your Ingress Sources, like Listenbrainz Endpoint, even after setting up auth. Any external clients that use these Sources will continue to work as-is.
Use the 0.21.0 Upgrade Guide in the docs for upgrading/setting up Auth.
Api Keys
Since your instance's API will now be authenticated, you can now use API Keys found in Settings -> Account to generate keys for use with external services (Prometheus, other apps that want to consume MS apis).
Note
This does not apply to Ingress Sources like Listenbrainz Endpoint, those are always open and already authenticated by their own config (like token in LZ config).
Users with Existing Auth Solutions
If you have already secured MS with your own auth like a reverse proxy + authelia/authentik/keycloak etc.. and are happy with that there is an escape hatch for you:
To disable all auth and have MS behave (almost) exactly as it does pre 0.21.0, use Bring Your Own Auth (BYOA) mode by setting the ENV AUTH_MODE=disabled. This is also covered in the upgrade guide.
Note
BYOA mode will lock you out of using some new public features, like the Public Dashboard below, and planned features like OIDC auth.
Data Directory Usage
Standardized application directories for storing config, data, and log files separately were introduced in 0.15.0. However, many of the cache/auth flow files used by MS are still stored in the config directory.
In 0.21.0, MS now looks for these files in the data directory.
Important
If you are a docker user and do not use the DATA_DIR env then no action is required.
Non-docker users and anyone who has set DATA_DIR will need to use the 0.21.0 upgrade guide doc to determine how to proceed.
Worst-case scenario is you will need to re-authenticate some Sources/Clients.
Public Dashboard
As a carrot 🥕 to entice you to (please!) upgrade, this release also include a Public Dashboard that unauthenticated users can view when visiting your secured instance.
This is a strictly opt-in feature and you control what (privacy-restricted) data is shown and how often it is shown. Find this feature's setting in the logged-in dashboard in the menu Settings -> Publish Dashboard.
Some highlights:
- Animated stats for total number of Plays, Scrobbles, and minutes listened
- Animated stats/icons for number of Sources/Clients and what types you are running
- A configurable Recent Scrobbles lists, optionally with a Now Playing card
- An embeddable/iframe page so you can show off your activity and stats on your blog!
Service ID Indicator Improvements
Service ID/Icons got a glowup with a new, animated stacking style, merged icons when multiple of the same id exist (like Musicbrainz release and release-group), and a popup to make ids/links acessible to screen readers, keyboards, and mobile touch navigation.
Other Changelog Highlights
🐛 Bug Fixes
- (spotify) fixed regression that dropped
localeparam in search requests #768 thanks @DigitalStarSys - (listenbrainz) fixed incorrectly parsing forward slashes in artist names #760
📚 Documentation
- Added new Security section for authentication guidance
- Reworked usage of Base URL everywhere so it uses placeholders
⚙️ CI/CD
- Rewrote Github Actions to remove reliance on
pull_request_target- Publishing PRs from external contributors now requires an explicit comment with commit SHA each time it should be built
- Moved testing workflow into a docker image build step to improve security and leverage already built layers