Ivan-Malinovski/calino v0.12.0

on GitHub

[0.12.0] - 2026-06-10

New Features

• Self-hosted account preloading — ship Calino with preconfigured CalDAV accounts protected by a master password. Users enter the password once to unlock all accounts. Config is baked into the JS bundle at build time — no separate file served to clients. See docs/SELF_HOSTED_CONFIG.md.
• Setup wizard (/setup) — browser-based config generator with connection testing, password encryption, and one-click download. No Node.js required — works on any Calino instance, including the hosted one.
• Lock button — appears in the settings dropdown when preconfigured accounts are active. Clears the master password from storage; prompt reappears on next page load.
• CALINO_SELF_HOSTED env var — set to true (default in Docker) to hide "Try with sample data" and "I'll do it later" from the onboarding flow.
• Auto-create GitHub Release on version bump via scripts/release.sh.

Security

• Full config encryption — server URLs, usernames, and passwords are all encrypted with AES-256-GCM using the master password. Only the account name (display label) is readable in the config.
• Master password encrypted at rest — stored in localStorage as encrypted { iv, data } JSON, same as CalDAV credentials. Plaintext never touches persistent storage.
• PBKDF2 iterations bumped to 600,000 — each key derivation takes ~2 seconds, making brute-force inherently expensive.
• Brute-force protection — 5 failed attempts trigger a 1-minute cooldown. Tracked in localStorage (shared across tabs).
• Blur behind master password prompt — prevents reading calendar data through the overlay.

Improvements

• "Offline calendar" removed after auto-connect — when preconfigured CalDAV accounts connect, the default offline calendar is cleaned up if it has no events.
• CLI script updated — encrypt-password.mjs now accepts --url, --username, and --password flags, encrypting all three fields for a complete config entry.
• Docs updated — SELF_HOSTED_CONFIG.md, AGENTS.md, and README.md reflect the new setup wizard, security model, and self-hosting workflow.

Notable Fixes

• GitHub Pages redirect handler for non-calendar routes (/setup, /settings, /privacy)
• Auto-connect runs sequentially to avoid localStorage race conditions in credential storage
• Module-level guard prevents auto-connect from running across multiple hook instances
• Base64url encoding handled correctly in crypto decoder
• Docker paths corrected from nginx to Caddy (/srv instead of /usr/share/nginx/html)
• CALINO_SELF_HOSTED build arg properly declared in Dockerfile