What's New
- Security hardening (beta-6): CSRF protection strengthened: state-changing requests without an Origin header now require an X-Requested-With header; the web frontend sends it automatically on all requests.
- Profile-aware recommendation filtering: TMDB recommendations are validated against each profile's genre and language include/exclude rules before points are applied.
- Session lifetime and API rate limiting: Session expiration extended from 24 hours to 30 days with a rolling window that resets on each authenticated request.
- Unified collection hub order: Webhook-triggered and Immaculate Taste refresher jobs now include Fresh Out Of The Oven in the movie hub order.
- Secrets and Overseerr compatibility: Vault page falls back to plaintext when WebCrypto is not available, fixing blank-state issues in certain Docker or non-HTTPS setups.
- Migration repair and dependency updates: Migration repair script logs diagnostics for blocked deploys and reconciles stuck migration rows so Prisma can rerun them safely.
Full Changelog: https://github.com/ohmzi/Immaculaterr/compare/v1.7.1..v1.7.5
Updating
Docker
HTTP-only update (required)
IMM_IMAGE="ghcr.io/ohmzi/immaculaterr:latest"
APP_PORT=5454
docker pull "$IMM_IMAGE"
docker rm -f Immaculaterr 2>/dev/null || true
docker run -d --name Immaculaterr -p ${APP_PORT}:${APP_PORT} -e HOST=0.0.0.0 -e PORT=${APP_PORT} -e TRUST_PROXY=1 -e APP_DATA_DIR=/data -e DATABASE_URL=file:/data/tcp.sqlite -v immaculaterr-data:/data --restart unless-stopped "$IMM_IMAGE"Optional HTTPS sidecar (can run anytime later)
set -euo pipefail
mkdir -p "$HOME/immaculaterr"
curl -fsSL -o "$HOME/immaculaterr/caddy-entrypoint.sh" "https://raw.githubusercontent.com/ohmzi/Immaculaterr/master/docker/immaculaterr/caddy-entrypoint.sh"
curl -fsSL -o "$HOME/immaculaterr/install-local-ca.sh" "https://raw.githubusercontent.com/ohmzi/Immaculaterr/master/docker/immaculaterr/install-local-ca.sh"
chmod +x "$HOME/immaculaterr/caddy-entrypoint.sh" "$HOME/immaculaterr/install-local-ca.sh"
# Needed so install-local-ca.sh can import trust into Firefox profiles
if ! command -v certutil >/dev/null 2>&1; then
sudo apt-get update
sudo apt-get install -y libnss3-tools
fi
docker pull caddy:2.8.4-alpine
docker rm -f ImmaculaterrHttps 2>/dev/null || true
# Keep named volumes stable so certs persist across restarts
docker volume create immaculaterr-caddy-data >/dev/null
docker volume create immaculaterr-caddy-config >/dev/null
docker run -d --name ImmaculaterrHttps --network host -e IMM_ENABLE_HTTP=false -e IMM_ENABLE_HTTPS=true -e IMM_HTTPS_PORT=5464 -e IMM_INCLUDE_LOCALHOST=true -e IMM_ENABLE_LAN_IP=true -e APP_INTERNAL_PORT=5454 -v "$HOME/immaculaterr/caddy-entrypoint.sh:/etc/caddy/caddy-entrypoint.sh:ro" -v immaculaterr-caddy-data:/data -v immaculaterr-caddy-config:/config --restart unless-stopped caddy:2.8.4-alpine /bin/sh /etc/caddy/caddy-entrypoint.sh
# CRITICAL: trust the current Caddy local CA
"$HOME/immaculaterr/install-local-ca.sh"
# Quick verify
curl -I https://localhost:5464Portainer
- In Portainer: Containers → select Immaculaterr
- Click Recreate
- Enable Re-pull image
- Click Recreate