v0.4.0 — In-Memory Log Viewer

What's New

In-Memory Log Viewer

A complete log viewing system accessible from Settings > System > Logs.

Backend:

• Ring buffer — thread-safe circular buffer holding the last 1,000 log entries in memory
• TeeHandler — custom slog.Handler that wraps the existing logger and captures entries to the ring buffer without affecting normal log output
• GET /api/v1/system/logs — new API endpoint with ?level= (debug/info/warn/error) and ?limit= query parameters, returns entries in chronological order

Frontend:

• Level filter dropdown (All / DEBUG / INFO / WARN / ERROR)
• Color-coded level badges
• Scrollable log table with sticky column headers
• Click any row with structured fields to expand and view the JSON
• 10-second auto-refresh
• Proper skeleton loading, error, and empty states

Tests:

• 4 ring buffer tests (basic, wrap, copy safety, field preservation)
• 4 tee handler tests (capture, WithAttrs, WithGroup, level filtering)

Full Changelog: v0.3.0...v0.4.0

v0.3.0 — Security Hardening & Code Quality

What's New

Security Hardening

• WebSocket authentication — WebSocket connections now require Sec-Fetch-Site: same-origin (browser) or valid X-Api-Key (external clients) before upgrade
• SSRF protection on notification plugin HTTP clients (Discord, Slack) via safedialer
• Path traversal protection on import endpoint via shared pathutil.ValidateContentPath
• API key masking — config endpoint returns masked key; separate /api/v1/system/config/apikey endpoint for reveal
• Email header injection prevention — CRLF stripping in SMTP headers
• Restore endpoint body limit — 500 MiB override prevents the global 1 MiB limit from blocking database restores
• VACUUM INTO fix — proper SQL quoting prevents injection in backup paths
• Configurable TLS verification for Plex/Emby/Jellyfin media server connections
• Radarr import credentials moved from localStorage to sessionStorage
• Release URL validation — href attributes only render for http:///https:// URLs
• Dead auth middleware removed (had timing-leak vulnerability, was unused)

Code Quality

• Shared dbutil package — extracted BoolToInt, MergeSettings, IsUniqueViolation (eliminated 6+ copy-pasted implementations)
• IsUniqueViolation now uses SQLite error code (2067) instead of fragile string matching
• History filtering pushed into SQL — 3 new filtered queries replace "fetch 1000, filter in Go" pattern
• RSS title matching uses word-boundary alignment to prevent false positives on short titles (e.g., "It")
• Download client auth race fixed — qBittorrent and Deluge ensureAuth now holds the lock during the entire login flow
• CountCutoffUnmet optimized — skips unnecessary Movie object conversion and sorting when only a count is needed
• Releases handler double-fetch eliminated — reuses movie from first DB lookup
• Notification event filtering — proper JSON unmarshal replaces substring matching
• Queue item lookup — direct GetGrabByID replaces O(n) list scan
• Dead CutoffCounter interface removed

Docs

• Docker examples updated to use bind mounts instead of named volumes
• Removed stale TMDB key and auth key references from all docs

Full Changelog: v0.2.0...v0.3.0

v0.2.0 — Update Checker, Rate Limiting & More

What's New

Update Checker

• Backend update endpoint (GET /api/v1/system/updates) — calls GitHub Releases API to check for newer versions
• Update modal on the System page with version badges, rendered markdown release notes, and Docker update instructions (Compose & Pull tabs with copy buttons)

Per-Indexer Rate Limiting

• Token-bucket rate limiter using golang.org/x/time/rate — protects users from hitting private tracker API limits
• New rate_limit setting per indexer (requests/min, 0 = unlimited)
• Rate limiting applies to search, RSS, and test operations — goroutines wait for tokens rather than firing immediately
• No database migration needed — stored in the existing settings JSON blob

Stats & Charts

• Library statistics page with Recharts charts — decades distribution, collection growth over time, genre breakdown
• 4 new API endpoints: collection stats, quality distribution, storage usage, grab history
• Storage snapshots table with daily scheduler job for tracking disk usage over time

App Settings & Theme System

• Settings page with theme picker (light, dark, system)
• CSS custom property-based theme system

Other Improvements

• Plex includeGuids fix for proper metadata matching
• Generalized media server labels (not Plex-specific)
• Release notes now render as proper HTML (via marked) instead of raw markdown
• Documentation updates for library sync and media servers

Configuration

Rate Limiting

Add a rate limit to any indexer via the settings form:

• Rate Limit (requests/min): integer, 0 = unlimited (default)
• Example: set to 5 for a private tracker that allows 5 API calls per minute

No action needed for existing indexers — they default to unlimited.

Upgrade

# Docker Compose
docker compose pull && docker compose up -d

# Docker CLI
docker pull ghcr.io/davidfic/luminarr:latest
docker stop luminarr && docker rm luminarr
# Re-run your docker run command

v0.1.0 — Initial Release

Luminarr v0.1.0 — Initial Release

A self-hosted movie manager for the discerning collector. Luminarr is a modern Radarr alternative built from scratch in Go + React.

Highlights

• Movie management — Add, monitor, and organize your movie collection with TMDB metadata
• Automated downloads — Search indexers (Torznab/Newznab), score releases by quality, and send to download clients (qBittorrent/Deluge)
• Quality system — 4-dimensional quality scoring (resolution, source, codec, HDR) with customizable profiles and definitions
• Library sync — Compare your Luminarr collection against Plex, Emby, or Jellyfin to find gaps
• Notifications — Discord, webhook, email, and custom script notifications for all events
• Custom scripts — Run arbitrary scripts on events (grabs, imports, health changes) with JSON payloads and environment variables
• Calendar view — See upcoming and recent releases at a glance
• Wanted page — Track missing and cutoff-unmet movies
• Manual search — Browse and pick specific releases for any movie
• Bulk editor — Update monitored status, quality profile, or minimum availability across multiple movies
• Backup & restore — Export and import your full configuration and database
• Interactive import — Scan directories and match files to movies with TMDB lookup
• File renaming — Rename movie files according to configurable naming templates
• Radarr import — Migrate your existing Radarr setup (movies, profiles, indexers, download clients)
• Library statistics — Collection, quality, storage, and grab stats with charts
• Security first — API key auth, SSRF protection, secret auto-redaction, CSP headers, no telemetry
• Update checker — Check for new releases from the System page

Docker

docker pull ghcr.io/davidfic/luminarr:latest

Or with Docker Compose:

services:
  luminarr:
    image: ghcr.io/davidfic/luminarr:latest
    ports:
      - "8282:8282"
    volumes:
      - luminarr-config:/config
    environment:
      LUMINARR_DATABASE_PATH: "/config/luminarr.db"

A latest-full tag is also available (Alpine-based with ffprobe for mediainfo scanning).

Links

• Website
• Architecture docs
• Security model
• Custom scripts guide