doctor-io/homeio v1.9.1

Homeio v1.9.1

on GitHub

Ships the four issues reported while migrating from CasaOS — #31, #32, #33, #35 — and the faults that turned up around them while testing each fix on a real server.

Fixed for the reporters

• App store sources disappearing (#32) — registry writes are serialised, so adding one source no longer drops the others. A corrupt registry now reports the problem instead of silently falling back to the official catalog.
• App link cannot be set (#33) — an app's link can be set explicitly, for when the address Homeio guesses is not the one that reaches it.
• Notifications out of order (#35) — the ordering is applied to the merged list, not to each half.
• Containers from an existing CasaOS install (#31) — containers Homeio did not deploy are listed on the desktop in a muted state.

Added

Cloudflare Tunnel (#34) — publish any installed app on a public hostname from Settings → Integrations. Homeio creates the DNS record and the ingress rule through the Cloudflare API and keeps the catch-all rule last. Paste the whole cloudflared service install eyJ… command and the token is taken out of it.

Fixed while testing

None of these were reported; all were found by driving the real thing.

• Restoring a backup could empty the database and delete every backup on the machine, then show the registration screen as though the install were new. The reset dropped only public while the migration journal lives in drizzle, so the dump's own CREATE SCHEMA drizzle failed 25 lines in, with the wipe already committed. Reset and reload are now one transaction, the archive is checked for a dump before anything is deleted, and stored backups are excluded from the wipe.
• docker compose up -d did not start — the compose file shipped the placeholder session secret, which production refuses by name. The entrypoint generates one now and persists it.
• uninstall.sh could take a live server off the air by re-enabling nginx's default vhost on a run that removed nothing.
• A restore left added app stores behind, and ended with no container running.
• A tunnel pointed at localhost returned 502 on any tunnel with more than one connector.
• The Docker image had no docker CLI and could not reach the socket.

Security

Archive extraction rejects entries that escape their destination, disk wipes validate their target, and sign-in rate limiting counts per account as well as per address.

Full detail in CHANGELOG.md.

Upgrade

curl -fsSL https://raw.githubusercontent.com/doctor-io/homeio/main/scripts/update.sh | sudo bash