Two faults from #37, both affecting servers published on a public hostname — which our own documentation recommends.
Security — registration stayed open on script installs
install.sh wrote AUTH_ALLOW_REGISTRATION=true and never turned it off, so registration never closed behind the first account. On a server reachable from the internet, anyone who reached the endpoint could create a full account — and Homeio has no roles, so that account carries the same access as yours: terminal, files, Docker, disk operations, factory reset.
The register page redirects away once an account exists, so the UI hid this; the API enforced nothing behind it. Docker installs left the variable unset, which evaluates to false, and were never affected.
The variable is removed rather than corrected. The database decides: one account, and registration closes behind it.
If you installed with install.sh and published your server, check Settings → Users for accounts you did not create. Existing accounts keep working after this update — nothing is migrated or deleted, and every user lookup is keyed on username. The change only prevents new ones.
Fixed — a cache in front could lock you out
The proxy set no Cache-Control, so a tunnel or CDN was free to keep its answers — including the 307 → /register an install gives while it is still empty. Once that was cached, every visitor was sent to registration however many accounts existed, and an authenticated one had their session cleared on the way back. Incognito and a second device did not help, because the cache sat upstream of both.
Every non-static response now says private, no-store. Immutable assets keep their long-lived caching.
A failed "are there any accounts" lookup was also being read as "fresh install", which turned any momentary database hiccup into the same lockout.
Fixed — container logs
Containers that colour their output had their escape sequences printed as literal [36m noise, and \x1b[33mWARN: leaves no word boundary before WARN — so level detection missed it and every warning was labelled a red error.
Upgrade
curl -fsSL https://raw.githubusercontent.com/doctor-io/homeio/main/scripts/update.sh | sudo bashSupersedes 1.9.2, which carried the registration hole. Full detail in CHANGELOG.md.