flohoss/gocron v0.12.0 on GitHub

Features

Reverse proxy support — new server.trusted_proxies (CIDR list) makes request logs and rate limiting use the real client IP from X-Forwarded-For when the request arrives through a trusted proxy. Without it, the direct connection IP is always used, so headers cannot be spoofed.
Rate limiting — opt-in per-IP request limiting via server.rate_limit (disabled by default). Rejected requests get 429 Too Many Requests with Retry-After and X-RateLimit-* headers.
CORS control — restrict cross-origin access with server.cors.allow_origins (defaults to *).
Debug request logging — every request (method, URI, status, latency, remote_ip) is logged at log_level: debug.

Slow SSE subscribers no longer stall everyone — the live event stream was rewritten without the r3labs/sse dependency. Each subscriber gets its own buffer; a stalled reader is disconnected after a write timeout instead of blocking all live updates.
Job runs stay in sync between REST fetches and live SSE updates (run lists could previously diverge after a job finished).
Invalid cron expressions are now reported — a job whose schedule fails to parse logs an error at startup instead of silently never running.
rclone version pinning works — a pinned version produced apt-get install -y <version> (installing a package literally named after the version string); it now installs rclone=<version>.
Software install is Debian-only — non-Debian systems (including non-Debian Linux where apt/cleanup previously ran) are skipped safely.
Unknown /api/* routes return a JSON 404 instead of the SPA's index.html.

Test coverage added: scheduler 0% → 100%, software 0% → 78%, plus regression tests for the Debian guard and SSE write timeouts.
New e2e coverage: SSE broadcasting with concurrent subscribers, software install at startup (apt, skip-if-installed, upstream script paths), and observable version pinning via a pinned not-latest apprise release.
Dependencies: removed r3labs/sse; updated Go and web dependencies; Cypress 16, Node 26, Go 1.27.1.
Docker Compose: Go module/build caches in named volumes for faster test cycles.

Running behind a reverse proxy? Set server.trusted_proxies so logs and rate limiting see real client IPs. Default behavior is unchanged (XFF ignored).
software: entries are now validated like jobs: — an entry missing name fails config validation at startup instead of being silently skipped.

[improve] Update Go dependencies (3fe0f55) by @flohoss
[improve] Update web and e2e dependencies (e23841b) by @flohoss
[meta] Bump pinned compose tool versions (651ac53) by @flohoss
[meta] Cache Go modules and build output in docker volumes (5df7030) by @flohoss
[fix] Prevent a slow SSE subscriber from blocking all live updates (0fb4378) by @flohoss
[fix] Keep job runs in sync between REST and SSE updates (5dd9571) by @flohoss
[feature] Make proxy, CORS and rate limiting configurable (8dac09d) by @flohoss
[fix] Return JSON 404 for unknown API routes (92b8021) by @flohoss
[improve] Add end-to-end coverage for the live event stream (aa35c3c) by @flohoss
[docs] Document server proxy, CORS and rate limiting options (86b4d98) by @flohoss
[docs] Allow short comments in tests (db6da2d) by @flohoss
[docs] Test all packages in the documented test command (a1c0804) by @flohoss
[fix] Surface cron parse errors instead of silently never scheduling (9fa48b8) by @flohoss
[fix] Disconnect stalled SSE clients after a write timeout (b986f9e) by @flohoss
[fix] Correct rclone version pins and the Debian-only install guard (75ec00b) by @flohoss
[improve] Add e2e coverage for software install and version pinning (12edc53) by @flohoss
[docs] Document interactive Cypress GUI workflow (5e50ca1) by @flohoss
[docs] Sync features list and software install notes with v0.12 behavior (4d6489a) by @flohoss

Full Changelog: v0.11.0...v0.12.0

docker pull ghcr.io/flohoss/gocron:v0.12.0
docker pull ghcr.io/flohoss/gocron:latest

Download one of the attached binaries extracted from the release image:

Verify with ./gocron_<version>_linux_<arch> --version.

Image digest:

ghcr.io/flohoss/gocron:v0.12.0@sha256:660d850886468915b71248456c5ca90eba423907a530d0161606bccb058912a5