Spazcat 3D Printing

You are running v1.6 (build 15a4ea0).

Changelog

All notable changes to this project are documented here. Versions are MAJOR.MINOR; the minor number rolls over after .9 (1.9 → 2.0).

[Unreleased]

[1.6] - 2026-11-02

Added

  • Pirate Ship round trip (new 📦 Shipping page in the back office). Pirate Ship has no API, so it works with spreadsheets:
  • Export: tick the orders waiting for a label (orders at Ready or later are pre-ticked) and download a CSV ready for Pirate Ship's spreadsheet upload. It includes name, address, email, phone, weight, box size, and the order number as a passthrough column.
  • Import: upload Pirate Ship's shipment report (CSV). Rows are matched by order number, or by email. The carrier and tracking number are saved, orders move to Shipped, and customers get an email with a "Track your package" button. Refunded labels and rows already imported are skipped.
  • A 🚚 Shipped stage, added automatically just before the final stage. It only appears on the tracker for "Ship it to me" orders. Any stage can now be limited to one fulfillment type on the Stages page.
  • Orders store the package weight (lb + oz), box size, carrier and tracking number, all editable on the order page. Customers see their tracking link on the tracker, in their account and in emails.

Changed

  • The shipping / delivery address is now separate street, apt, city, state and ZIP fields on the quote form and the order page. They're required for delivery and shipping, and pre-filled from the customer's last order. Addresses on older orders are split automatically when you open the order.
  • The site title in the header is left-aligned next to the logo.

[1.5] - 2026-11-02

Changed

  • The staff link is now just a small "Staff" next to the version number in the footer. The customer sign-in page no longer links to staff sign-in.

[1.4] - 2026-11-02

Added

  • "Staff sign in" link in the footer (shows "Back office" once you're signed in), and a staff link on the customer sign-in page, so you no longer need to type /admin.

Changed

  • Calmer typography: the display font is now only used for the site title, hero and page section titles. Form section headings, the submit button, step numbers, the tracker headline and quote prices use the regular bold font.
  • Docs and the proxy-count help text no longer mention Angie. NPM is the only proxy in front of the app.

Fixed

  • An uploaded logo, favicon or font now shows up right away. Branding URLs carry a version that changes with each upload, so browsers no longer keep the old image cached for up to an hour.

[1.3] - 2026-11-01

Added

  • Links in customer-facing notes: write [Pirate Ship™](https://www.pirateship.com) in the pickup / delivery note, payment instructions or large-file instructions and it shows as a link. Everything else stays plain text.

Changed

  • The help text for upload size and the README proxy settings now explain that a single upload request carries all of its files, and cover settings for 1 GB+ uploads.

[1.2] - 2026-10-13

Changed

  • compose.yaml now matches the host's stack layout:
  • All environment variables live inline under environment:, and the separate .env / .env.example file is gone.
  • Data is a bind mount at /mnt/nvme2tbadata/dockerstatic/spazcat-3dp.
  • The container joins the external customnetex network without publishing a port.
  • The image defaults to :latest.
  • Settings that used to be environment-only now have UI fields, and their env var still overrides them:
  • Stay signed in for (days) (SESSION_DAYS) and Secure session cookie (SESSION_COOKIE_SECURE: auto / on / off) on the Staff sign-in tab.
  • Delivery (MAIL_BACKEND: smtp / console) on the Email tab.
  • Log level (LOG_LEVEL) on the Site tab.
  • Every settings field shows the name of the environment variable that overrides it.
  • The System page shows the session lifetime, the secure-cookie state, the log level and whether ADMIN_RESET recovery is on.

Fixed

  • Lock-out protection:
  • If no staff sign-in method is usable at runtime, local login is now forced on and a banner explains why. This covers env vars that disable local login while OIDC is incomplete, and an OIDC secret that no longer decrypts.
  • Before, the guard only ran when settings were saved in the UI.
  • SESSION_COOKIE_SECURE was read from the environment but never applied.
  • An env-pinned value that the UI wouldn't accept (e.g. SMTP_SECURITY=SSL) no longer blocks saving every other setting.

[1.1] - 2026-10-11

Added

  • GitHub issues sync with your repository, in both directions:
  • New Issues page to browse, search and filter by label, plus Bug / Feature / Question submission templates.
  • Edit title, text and labels, comment, and close (completed or not planned) or reopen.
  • Every change is pushed to GitHub immediately. If GitHub is unreachable, changes queue and are retried on the next sync.
  • Changes on GitHub come back through an incremental sync (runs when the page is used, every few minutes), a "Sync now" button, a full resync that also removes deleted items, and an optional signed webhook for instant updates.
  • flask github-sync [--full] command for cron.
  • "🐞 Report issue" button in the admin header, which records the page you were on.
  • Safe Markdown rendering for issue text: raw HTML and script links are stripped, and GitHub-style lists and task boxes are supported.

Changed

  • The GitHub token setting is now also used for issue sync. It needs Issues: read & write on the repository in addition to read access for update checks.

Fixed

  • New-order form no longer errors on a malformed customer selection.

[1.0] - 2026-09-29

Added

  • Public quote page based on the Spazcat design:
  • Light and dark mode, remembered per browser.
  • Multi-file upload with a progress bar and a large-file fallback link.
  • Project type, material, color wheel, strength, detail, finishing, use case, delivery, needed-by date, rush and budget options.
  • Ticket workflow:
  • Order numbers, configurable stages, per-stage default emails and a customer-approval stage.
  • Hold / cancel / reopen, internal notes, public replies and file management.
  • Pizza-tracker status graphic on a public tracking link, in the customer portal and inside status emails.
  • Customer portal: magic-link or password sign-in, order history, one-click quote approval, messaging, file uploads and invoices.
  • Invoices: created from a quote or by hand, with tax, an optional payment link (e.g. PayPal), email delivery, a printable view and paid / void tracking.
  • Admin kanban board with stats, recent activity, and search across orders and customers.
  • Staff sign-in, in any combination: local accounts, OIDC (Authentik), LAN bypass and API bearer tokens.
  • New SSO users stay pending until an admin approves them.
  • All settings editable in the admin UI and stored in SQLite, with secrets encrypted at rest.
  • Environment variables with the same names pin any setting. ADMIN_RESET recovers a locked-out admin.
  • Branding uploads (logo, favicon, display font) from the UI.
  • Email log with preview, retry and a test-send button. Mail is sent in the background.
  • JSON API: /api/v1/orders, /api/v1/stages and stage changes.
  • GitHub release update check, and a /changelog page linked from the version number.
  • Single-container image with automatic migrations and a healthcheck.
  • CI builds one GHCR image and one GitHub release per version bump.