marcpope/cortendesk v1.10.1 on GitHub

Scheduler on manual installs: with pcntl_signal in PHP's disable_functions (common on hosting panels), scheduled tasks ran once and then stayed locked, so notifications and the diagnostics heartbeat stopped. Fixed, and task locks now expire after minutes instead of 24 hours. After upgrading, run php artisan schedule:clear-cache once (#70).

1.10.0 came out a few hours earlier; its notes follow.

1.10.0

Server access control. Settings → Server can limit the ID server to approved devices: pending, deleted and unknown devices still show up, but cannot start or receive sessions. Devices can also be marked incoming only, so they can be controlled but cannot start sessions. Enforced by the bundled CortenDesk Server 1.1.0 (#81, #82).
LAN IP. The ID server records the LAN address a device reports during connection setup. Optional column on Devices and a row on the device page (#76).
End-of-session notes. The note box RustDesk clients offer when a session ends now works. Notes show in the connection log, on the device page, in CSV exports and in the admin API (#79).
User detail page. Devices, address books, sign-ins, console actions and connections for one user (#55).
Device detail page. Edit, delete, add to or remove from address books, sent notifications, full UUID. Clicking the alias opens it (#54).
Deleting a device can also remove it from address books you can edit (#85). The admin API delete takes remove_from_address_books.
Client installer uploads up to 512 MB, set with CORTENDESK_DOWNLOADS_MAX_MB. The container applies it to nginx and PHP. Downloads are now sent by nginx directly (#84).
Strategy impact preview. Saving, deleting or restoring a strategy first shows which devices it affects (#64, thanks @AJV20).

The container no longer breaks on platforms that set PORT (Coolify): the ID server and relay ports are fixed (#77).
Signing in over plain HTTP on the LAN works when the console is also served over HTTPS (#78). See Notes.
The web client uses the key and ID server saved in Settings, not only environment variables (#75, #86).
CSV exports escape values that a spreadsheet would run as formulas.
The Address Books screen now writes audit entries for entry, tag and rename changes.

SESSION_SECURE_COOKIE: leave it unset. The session cookie is now marked Secure on HTTPS requests automatically, and plain HTTP still signs in. Setting it to true refuses sign-in over HTTP; the login page says so.
Two migrations run on start (connection notes, device access columns).
Separate hbbs/hbbr (CORTENDESK_EMBEDDED_SERVER=false): server access control needs CortenDesk Server 1.1.0 and the same CORTENDESK_SERVER_SECRET on both sides, plus CORTENDESK_CONSOLE_URL on hbbs. Without them nothing changes.
Behind a reverse proxy, raise its body size limit too if you upload installers larger than it allows.

docker pull marcpope/cortendesk:1.10.1
docker pull ghcr.io/marcpope/cortendesk:1.10.1