Open registration let anyone with the URL create an account. Two
changes address that:
- REGISTRATION_CODE (.env, optional): when set, registration requires
entering it correctly. Empty/unset keeps registration open, so
existing installs are unaffected until configured.
- is_admin flag on User: the first account ever created on an install
becomes admin automatically (existing installs get their oldest
account promoted via the startup migration, so nobody is locked
out of user management after upgrading).
Admins get a new "Benutzerverwaltung" panel in Einstellungen listing
every account (email, link/prompt counts, join date) with a delete
button per account — deleting cascades to that user's links and
prompts via the existing relationship cascade. Deleting your own
account through this page is blocked (redirects with an error) to
avoid accidental admin lockout. Non-admins get a 403 on the
/settings/users routes.
Also fixes several pre-existing German pluralization bugs found while
writing the new counts ("2 Linke" -> "2 Links", "Kontoen"/"Konton" ->
"Konten") — irregular plurals need a full word swap, not a suffix.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Debian LXC templates default to UTC, which made the "hinzugefügt am"
timestamps and export filenames look wrong. Add a TIMEZONE variable
(default Europe/Berlin) applied via timedatectl during install, and
document it in the README.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New /prompts section extends the existing database (new Prompt model,
same SQLite file) and mirrors the Links experience: add a prompt, get
it auto-categorized and tagged by AI, filter by category, full-text
search, sort, edit, or have the AI re-categorize it. A header nav
switch ("Links" / "Prompts") toggles between the two collections; the
shared topbar/menu markup was factored into _topbar.html and
_topbar_actions.html so both pages (and settings) stay in sync.
Each prompt card has a dedicated copy-to-clipboard icon next to
edit/delete, so a stored prompt can be reused immediately. Copying
uses the raw markdown source (not the rendered HTML) so structure
survives when pasted into another AI tool. The copy handler tries the
async Clipboard API first and falls back to a hidden-textarea +
execCommand('copy') for plain-http/non-secure contexts, with clear
success/failure icon feedback either way.
Prompt content supports Markdown and is rendered server-side
(app/mdrender.py) for the card preview. Since this is user-supplied
HTML-adjacent content, rendering goes through two defenses: the raw
text is escaped (only '<' and '&', not '>', so blockquotes keep
working) before conversion so no raw tag can survive, and the
resulting HTML is passed through bleach with a tag/attribute/protocol
allowlist so Markdown-generated links can't carry a javascript: URL.
Verified against raw <script>, <img onerror>, and javascript: link
payloads. The edit form always shows the raw Markdown source, never
the rendered HTML.
Also bumps the default APP_VERSION (shown in the footer) from 1.0.0
to 2.0.0 to mark this feature addition.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The feature list was missing the recently added link editing, AI
re-description, sorting, and added-date display. Also document
APP_VERSION, which controls the version shown in the footer.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Drop the Authorization header/GIT_TOKEN requirement from the default
examples since the repo is no longer private; keep it documented as
a fallback for if the repo is made private again.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Make explicit that the plain "bash scripts/proxmox/update-linkvault.sh"
form only works if the repo was cloned onto the Proxmox host itself and
you're running it from within that checkout — this was the cause of a
"No such file or directory" error when tried directly.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The example was missing "export GIT_TOKEN=...", causing an empty
Authorization header when copy-pasted as-is.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds scripts/proxmox/update-linkvault.sh to pull the latest git
changes, refresh dependencies, and restart the systemd service on an
existing container. Documents usage in the README.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The repo is private, so unauthenticated curl/git clone returns 404.
Add GIT_TOKEN support for both the raw-file download and the git
clone inside the container, and document it in the README.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Add usage instructions, raw-link one-liner, config table, and
post-install steps for the helper script.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Creates a Debian 12 LXC container and sets up LinkVault as a systemd
service inside it, following the tteck/community-scripts pattern.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
