mescon/Muximux v3.6.1

on GitHub

Muximux can now be deployed entirely from the environment: the auth method
and every OIDC setting come from MUXIMUX_* variables, with the client
secret in a Docker secret, so a fresh container starts on single sign-on
without a config file or setup wizard. Docker icon labels accept Lucide
icons and image URLs, the Docker badge can be hidden, and the Lucide icon
categories load again.

Upgrade notes:

• The Docker whale on discovered apps is now shown to admins only.
• Environment overrides now apply on a first start without config.yaml;
  a container that relied on them being ignored there will see them take
  effect.
• A muximux.app.health value starting with // or /\ is now ignored.
• A bare muximux.app.icon value containing :, / or spaces is no
  longer stored as a Dashboard Icons slug; use the dashboard:, lucide:
  or URL forms.

Added

• Option to hide the Docker whale in the navigation and overview. The new
  navigation.show_docker_badge setting (Settings, General, "Show Docker
  Badge"; default true) hides the whale on Docker-discovered apps in every
  navigation position and on the overview page. The whale is now shown to
  admins only. Display only: discovery, tracking and sync are unaffected. (#515)
• Docker icon labels accept Lucide icons and URLs. muximux.app.icon and
  muximux.group.icon take lucide:<name>, an https URL (or
  url:<url>) and dashboard:<slug> as well as a bare Dashboard Icons slug,
  which behaves as before -- on import, on label re-sync and for group labels.
  Only https URLs are accepted, and an invalid value is ignored
  with a warning while the stored icon stays (#514).
• Auth and OIDC from environment variables. MUXIMUX_AUTH_METHOD and
  MUXIMUX_OIDC_* configure the auth method and every OIDC setting, with
  MUXIMUX_OIDC_CLIENT_ID_FILE and MUXIMUX_OIDC_CLIENT_SECRET_FILE for
  Docker secrets. A fresh container with only these variables starts on OIDC
  and skips the setup wizard. Values stay in memory and do not reach
  config.yaml, except the method a completed setup wizard saves. Settings
  shows each of them as locked, and the API refuses or ignores changes to
  them. Invalid auth variables, and OIDC variables without
  MUXIMUX_AUTH_METHOD on an instance not already on OIDC, stop startup
  instead of leaving it open. Unknown MUXIMUX_OIDC_* names, and OIDC
  variables the chosen method does not use, are logged. (#513)

Fixed

• Environment overrides apply when config.yaml is missing. A first
  start without a config file ignored every direct override, including
  MUXIMUX_DISCOVERY_AUTO_IMPORT and
  MUXIMUX_DISCOVERY_REQUIRE_EXPLICIT_ENABLE. (#513)
• Lucide icon categories load again. Upstream removed categories.json
  from the Lucide repository, so the icon picker's category metadata had been
  failing with a 404. Categories now come from one request to the
  lucide.dev/api/categories endpoint, and when that fails the icon names are
  still served and the warning is logged once per process rather than on every
  refresh.
• Health labels starting with // or /\ are rejected. A root-relative
  muximux.app.health value is resolved against the container's address only
  when it is a single-slash path; protocol-relative values are treated as
  invalid and ignored (CodeQL go/bad-redirect-check).
• Aborted proxy streams are no longer logged as panics. When a client
  goes away mid-stream the reverse proxy aborts the response the way net/http
  documents; the recovery middleware now lets that through instead of logging
  an ERROR "Panic recovered" with a stack trace.