What's New
OIDC Single Sign-On (#70)
Generic OpenID Connect SSO support — works with Keycloak, Authentik, Azure AD, Google Workspace, Okta, Auth0, Authelia, and any OIDC-compliant provider.
- Settings > Authentication tab for configuration
- SSO button on login page alongside existing password login
- New user handling: deny access, pending admin approval, or copy permissions from a template user
- SSO users skip 2FA (rely on identity provider for auth strength)
- Optional OIDC logout (sign out of IdP when logging out of BBS)
- Documentation
Job Cancellation (#91)
Cancel now properly stops running backups. The server signals the agent via the progress response, the agent kills the borg subprocess within ~5 seconds, and a break-lock job is automatically queued to clean up any stale locks.
JS Timezone Consistency (#87)
All JavaScript time formatting now uses the BBS profile timezone instead of the browser's local timezone. Prevents times from jumping after AJAX refresh when the browser timezone differs from the profile setting.
Fixes
ClickHouse Stability (#88)
Reverted thread pool limits and stderr redirect that were causing ClickHouse to fail to start on some installations. Logging cap (warning level, 10MB rotation) remains.
ClickHouse Docker Startup (#83)
Increased startup health check wait from 15 to 30 seconds for slower VMs.
Installer Fix (#86)
ClickHouse table creation deferred until after BBS code is downloaded — was failing because it referenced schema files before git clone.
Borg Update Retry Loop (#79)
Auto-update no longer re-queues failed borg updates every 30 seconds. Waits 24 hours before retrying.