Update all locale seeding files and seeding logic to parse the new format Only add new labels, units, and foods during seeding (checking against existing names)
* New translations en-us.json (Hungarian)
* New translations en-us.json (Portuguese)
* New translations en-us.json (Slovenian)
* New translations en-us.json (Turkish)
* New translations en-us.json (Ukrainian)
* override the check method to not care about the id token if we have a valid mealie token
* prevent auto log in with auth check is already good
* fix check
* simplify check logic
* change ALLOW_SIGNUP to default to false
* add 1.4.0 tag for OIDC docs
* new notes on security inline with security/policy review
* safer transport for external requests
* fix linter errors
* docs: Tidy up wording/formatting
* fix request errors
* whoops
* fix implementation with std lib
* format
* Remove check on netloc_parts. It only includes URL after any @
---------
Co-authored-by: boc-the-git <3479092+boc-the-git@users.noreply.github.com>
Co-authored-by: Brendan <b.oconnell14@gmail.com>
* New translations en-us.json (Greek)
* New translations en-us.json (Japanese)
* New translations en-us.json (Korean)
* New translations en-us.json (Greek)
* New translations en-us.json (Greek)
* New translations en-us.json (Japanese)
* New translations en-us.json (Japanese)
* New translations en-us.json (Japanese)
* New translations en-us.json (Japanese)
* fix several state issues with explore page
- update state when there are no query params
- only call search if the query params actually changed
- wait until ready to call API
* store last search query in user prefs
* restore chip tag click to anonymous user
* add route for getting group-only users
* add new api route to frontend
* update shopping list user getAll call
* tests
* fixed bad import
* replace UserOut with UserSummary
* fix params
* extract user registration form into a composable
* added base wizard component
* added partial setup implementation
* removed unused attrs
* added setup bypass
* made setup page more readable
* add checkbox hints to autoform
* added common settings pages and initial submit logic
* bypass setup in demo
* add full name to user registration
* added fullname and pw handling to setup
* fixed wizard indentation
* added post-setup suggestions
* added tests for backend changes
* renamed Wizard to BaseWizard
* lint fixes
* pass hardcoded default password instead of backend nonsense
* removed old test
* fix e2e
* added setup skip to e2e testing for all admin users
---------
Co-authored-by: Hayden <64056131+hay-kot@users.noreply.github.com>
* initial oidc implementation
* add dynamic scheme
* e2e test setup
* add caching
* fix
* try this
* add libldap-2.5 to runtime dependencies (#2849)
* New translations en-us.json (Norwegian) (#2851)
* New Crowdin updates (#2855)
* New translations en-us.json (Italian)
* New translations en-us.json (Norwegian)
* New translations en-us.json (Portuguese)
* fix
* remove cache
* cache yarn deps
* cache docker image
* cleanup action
* lint
* fix tests
* remove not needed variables
* run code gen
* fix tests
* add docs
* move code into custom scheme
* remove unneeded type
* fix oidc admin
* add more tests
* add better spacing on login page
* create auth providers
* clean up testing stuff
* type fixes
* add OIDC auth method to postgres enum
* add option to bypass login screen and go directly to iDP
* remove check so we can fallback to another auth method oauth fails
* Add provider name to be shown at the login screen
* add new properties to admin about api
* fix spec
* add a prompt to change auth method when changing password
* Create new auth section. Add more info on auth methods
* update docs
* run ruff
* update docs
* format
* docs gen
* formatting
* initialize logger in class
* mypy type fixes
* docs gen
* add models to get proper fields in docs and fix serialization
* validate id token before using it
* only request a mealie token on initial callback
* remove unused method
* fix unit tests
* docs gen
* check for valid idToken before getting token
* add iss to mealie token
* check to see if we already have a mealie token before getting one
* fix lock file
* update authlib
* update lock file
* add remember me environment variable
* add user group setting to allow only certain groups to log in
---------
Co-authored-by: Carter Mintey <cmintey8@gmail.com>
Co-authored-by: Carter <35710697+cmintey@users.noreply.github.com>
description:"CONTRIBUTORS ONLY: Submit a Task that needs to be completed"
title:"[v1.0.0b] [Task] - TASK DESCRIPTION"
title:"[Task] - TASK DESCRIPTION"
labels:
- task
- v1
- v2
body:
- type:markdown
attributes:
value:|
Thanks for your interest in Mealie! 🚀
This is a place for Mealie contributors to find tasks that need to get done around the repository. Tasks are different than issues as they are generally related to providing a new feature or improve an existing feature. They are _generally_ not related to an issue.
This is a place for Mealie contributors to find tasks that need to get done around the repository. Tasks are different than issues as they are generally related to providing a new feature or improving an existing feature. They are _generally_ not related to an issue.
**DO NOT** create a task unless
- You are a contributors who has prior approval via discord/discussions
- You are a contributor who has prior approval via discord/discussions
- You have otherwise been given approval to post the tasks
Otherwise, your post will be closed/deleted.
**Interested in Taking This?**
If you're interested in completing this tasks and it hasn't already been taken, comment below and to let others know you're working on it. As you work through the task, I ask that you submit a draft pull request as soon as possible, and tag this issue so we can all collaborate as best as possible.
If you're interested in completing this task and it hasn't already been taken, comment below and to let others know you're working on it. As you work through the task, I ask that you submit a draft pull request as soon as possible, and tag this issue so we can all collaborate as best as possible.
- type:textarea
id:problem
attributes:
@@ -33,6 +33,6 @@ body:
id:solution
attributes:
label:Proposed/Possible Solution(s)?
placeholder:Provide as much context around the idea as possible with potential files and roadblocks that may come up
placeholder:Provide as much context around the idea as possible with potential files and roadblocks that may come up.
Mealie is a self-hosted recipe manager, meal planner, and shopping list application with a FastAPI backend (Python 3.12) and Nuxt 3 frontend (Vue 3 + TypeScript). It uses SQLAlchemy ORM with support for SQLite and PostgreSQL databases.
**Development vs Production:**
- **Development:** Frontend (port 3000) and backend (port 9000) run as separate processes
- **Production:** Frontend is statically generated and served via FastAPI's SPA module (`mealie/routes/spa/`) in a single container
## Architecture & Key Patterns
### Backend Architecture (mealie/)
**Repository-Service-Controller Pattern:**
- **Controllers** (`mealie/routes/**/controller_*.py`): Inherit from `BaseUserController` or `BaseAdminController`, handle HTTP concerns, delegate to services
- **Services** (`mealie/services/`): Business logic layer, inherit from `BaseService`, coordinate repos and external dependencies
- **Repositories** (`mealie/repos/`): Data access layer using SQLAlchemy, accessed via `AllRepositories` factory
- Get repos via dependency injection: `repos: AllRepositories = Depends(get_repositories)`
- All repos scoped to group/household context automatically
**Route Organization:**
- Routes in `mealie/routes/` organized by domain (auth, recipe, groups, households, admin)
- Use `APIRouter` with FastAPI dependency injection
- Apply `@router.get/post/put/delete` decorators with Pydantic response models
- Route controllers use `HttpRepo` mixin for common CRUD operations (see `mealie/routes/_base/mixins.py`)
**Schemas & Type Generation:**
- Pydantic schemas in `mealie/schema/` with strict separation: `*In`, `*Out`, `*Create`, `*Update` suffixes
- Auto-exported from submodules via `__init__.py` files (generated by `task dev:generate`)
5. **Composables for shared logic:** Prefer composables in `composables/` over inline code duplication
6. **Translations:** Only modify `en-US` locale files when adding new translation strings - other locales are managed via Crowdin and **must never be modified** (PRs modifying non-English locales will be rejected)
### Cross-Cutting Concerns
1. **Code generation is source of truth:** After Pydantic schema changes, run `task dev:generate` to update:
- TypeScript types (`frontend/lib/api/types/`)
- Schema exports (`mealie/schema/*/__init__.py`)
- Test data paths and routes
2. **Multi-tenancy:** All data scoped to **groups** and **households**:
This template provides some ideas of things to include in your PR description.
To start, try providing a short summary of your changes in the Title above.
To start, try providing a short summary of your changes in the Title above. We follow Conventional Commits syntax, please ensure your title is prefixed with one of:
-`feat: `
-`fix: `
-`docs: `
-`chore: `
-`dev:`
If a section of the PR template does not apply to this PR, then delete that section.
PLEASE READ:
@@ -13,19 +20,6 @@
-->
## What type of PR is this?
_(REQUIRED)_
<!--
Delete any of the following that do not apply:
-->
- bug
- cleanup
- documentation
- feature
## What this PR does / why we need it:
_(REQUIRED)_
@@ -36,6 +30,8 @@ _(REQUIRED)_
Briefly explain any decisions you made with respect to the changes.
Include anything here that you didn't include in *Release Notes*
above, such as changes to CI or changes to internal methods.
If there is a UI component to the change, please include before/after images.
-->
## Which issue(s) this PR fixes:
@@ -44,7 +40,7 @@ _(REQUIRED)_
<!--
If this PR fixes one of more issues, list them here.
args:"🚀 Version {{ EVENT_PAYLOAD.release.tag_name }} of Mealie has been released. See the release notes https://github.com/mealie-recipes/mealie/releases/tag/{{ EVENT_PAYLOAD.release.tag_name }}"
update-image-tags:
name:Update image tag in sample docker-compose files
needs:
- build-release
runs-on:ubuntu-latest
permissions:
contents:write
pull-requests:write
steps:
- name:Checkout 🛎
uses:actions/checkout@v4
- name:Modify version strings
run:|
sed -i 's/:v[0-9]*.[0-9]*.[0-9]*/:${{ github.event.release.tag_name }}/' docs/docs/documentation/getting-started/installation/sqlite.md
sed -i 's/:v[0-9]*.[0-9]*.[0-9]*/:${{ github.event.release.tag_name }}/' docs/docs/documentation/getting-started/installation/postgres.md
- name:Create Pull Request
uses:peter-evans/create-pull-request@v6
# This doesn't currently work for us because it creates the PR but the workflows don't run.
# TODO: Provide a personal access token as a parameter here, that solves that problem.
stale-issue-message:'This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.'
days-before-issue-stale:30
days-before-issue-close:5
stale-issue-message:'This issue has been automatically marked as stale because it has been open 90 days with no activity.'
days-before-issue-stale:90
# This stops an issue from ever getting closed automatically.
days-before-issue-close:-1
stale-pr-label:'stale'
stale-pr-message:'This PR is stale because it has been open 45 days with no activity.'
days-before-pr-stale:45
stale-pr-message:'This PR has been automatically marked as stale because it has been open 90 days with no activity.'
days-before-pr-stale:90
# This stops a PR from ever getting closed automatically.
days-before-pr-close:-1
# If an issue/PR has a milestone, it's exempt from being marked as stale.
Mealie is a self hosted recipe manager and meal planner with a RestAPI backend and a reactive frontend application built in Vue for a pleasant user experience for the whole family. Easily add recipes into your database by providing the URL and Mealie will automatically import the relevant data, or add a family recipe with the UI editor. Mealie also provides an API for interactions from 3rd party applications.
Mealie is a self hosted recipe manager, meal planner and shopping list with a RestAPI backend and a reactive frontend built in Vue for a pleasant user experience for the whole family. Easily add recipes into your database by providing the URL and Mealie will automatically import the relevant data, or add a family recipe with the UI editor. Mealie also provides an API for interactions from 3rd party applications.
- [Remember to join the Discord](https://discord.gg/QuStdQGSGK)!
- [Documentation](https://nightly.mealie.io)
- [Documentation](https://docs.mealie.io/)
## Key Features
- Recipe imports: Create recipes, by **importing from a URL** or entering data manually
- Meal Planner: Use the **Meal Planner** to plan your what you'll cook for the next week
- Shopping List: Put the necessary ingredients on your **Shopping List**, organised into sections of your local supermarket
- Cookbooks: Group recipes into **Cookbooks** based on your own criteria
- Docker: Easy **Docker** deployment
- Localisation: **Translations** for 35+ languages
<!-- CONTRIBUTING -->
## Contributing
@@ -58,7 +66,7 @@ If you are not a coder, you can still contribute financially. Financial contribu
### Translations
Translations can be a great way for **non-coders** to contribute to project. We use [Crowdin](https://crowdin.com/project/mealie) to allow several contributors to work on translating Mealie. You can simply help by voting for your preferred translations, or even by completely translating Mealie into a new language.
Translations can be a great way for **non-coders** to contribute to the project. We use [Crowdin](https://crowdin.com/project/mealie) to allow several contributors to work on translating Mealie. You can simply help by voting for your preferred translations, or even by completely translating Mealie into a new language.
For more information, check out the translation page on the [contributor's guide](https://nightly.mealie.io/contributors/translating/).
@@ -80,16 +88,17 @@ Thanks to Depot for providing build instances for our Docker image builds.
"value":"view, Open Mealie, https://mealie.example/admin/backups; view, Open n8n, https://n8n.example"
}
]
},
"sendBody":true,
"contentType":"raw",
"body":"\"Full Panic!\"",
"options":{}
},
"id":"40ba81a5-5741-4b15-98af-1a9e6b34f997",
"name":"Ntfy Warning",
"type":"n8n-nodes-base.httpRequest",
"typeVersion":4.1,
"position":[
1000,
520
],
"onError":"continueRegularOutput"
},
{
"parameters":{
"url":"https://mealie.example/api/admin/backups",
"authentication":"genericCredentialType",
"genericAuthType":"httpHeaderAuth",
"options":{}
},
"id":"b75571d0-d926-440c-897f-55b89c6a5080",
"name":"Get all backups",
"type":"n8n-nodes-base.httpRequest",
"typeVersion":4.1,
"position":[
520,
820
],
"credentials":{
"httpHeaderAuth":{
"id":"GSL12tNi3MPvTZux",
"name":"Mealie API"
}
}
},
{
"parameters":{
"fieldToSplitOut":"imports",
"options":{}
},
"id":"943d0e83-682b-4500-9faf-53284cfb02c6",
"name":"Split Out",
"type":"n8n-nodes-base.splitOut",
"typeVersion":1,
"position":[
720,
820
]
},
{
"parameters":{
"jsCode":"// Get input data\nconst inputData = items.map(item => item.json);\n\n// Sort the data based on the 'date' field in descending order\ninputData.sort((a, b) => new Date(b.date) - new Date(a.date));\n\n// Get all records except the latest 7\nconst allExceptLatest7 = inputData.slice(7);\n\n// Map the output data back to the required format\nreturn allExceptLatest7.map(record => ({ json: record }));\n"
- Fixed Can't delete recipe after changing name - Closes Closes #67
- Fixed No image when added by URL, and can't add an image - Closes Closes #66
- Fixed Images saved with no way to delete when add recipe via URL fails - Closes Closes #43
### Features
- Additional Language Support
- Improved deployment documentation
- Additional database! SQlite is now supported! - Closes #48
- All site data is now backed up.
- Support for Prep Time, Total Time, and Cook Time field - Closes #63
- New backup import process with support for themes and site settings
- **BETA** ARM support! - Closes #69
### Code / Developer Improvements
- Unified Database Access Layers
- Poetry / pyproject.toml support over requirements.txt
- Local development without database is now possible!
- Local mkdocs server added to docker-compose.dev.yml
- Major code refactoring to support new database layer
- Global variable refactor
### Breaking Changes
- Internal docker port is now 80 instead of 9000. You MUST remap the internal port to connect to the UI.
!!! error "Breaking Changes"
As I've adopted the SQL database model I find that using 2 different types of databases will inevitably hinder development. As such after release v0.1.0 support for mongoDB will no longer be available. Prior to upgrading to v0.2.0 you will need to export your site and import after updating. This should be a painless process and require minimal intervention on the users part. Moving forward we will do our best to minimize changes that require user intervention like this and make updates a smooth process.
## v0.0.2 - Pre-release Second Patch
A quality update with major props to [zackbcom](https://github.com/zackbcom) for working hard on making the theming just that much better!
### Bug Fixes
- Fixed empty backup failure without markdown template
- Fixed opacity issues with marked steps - [mtoohey31](https://github.com/mtoohey31)
- Fixed hot-reloading development environment - [grssmnn](https://github.com/grssmnn)
- Fixed recipe not saving without image - Closes #7 + Closes #54
- Added Persistent storage to vuex - [zackbcom](https://github.com/zackbcom)
- General Color/Theme Improvements
- More consistent UI
- More minimalist coloring
- Added API key extras to Recipe Data - [See Documentation](/api/api-usage/)
- Users can now add custom json key/value pairs to all recipes via the editor for access in 3rd part applications. For example users can add a "message" field in the extras that can be accessed on API calls to play a message over google home.
- Improved image rendering (nearly x2 speed)
- Improved documentation + API Documentation
- Improved recipe parsing - Closes #51
- User feedback on backup importing
## v0.0.1 - Pre-release Patch
### General
- Updated Favicon
- Renamed Frontend Window
- Added Debug folder to dump scraper data prior to processing.
### Recipes
- Added user feedback on bad URL
- Better backend data validation for updating recipes, avoid small syntax errors corrupting database entry. [Closes #8](https://github.com/mealie-recipes/mealie/issues/8)
- Fixed spacing Closes while editing new recipes in JSON
## v0.0.0 - Initial Pre-release
The initial pre-release. It should be semi-functional but does not include a lot of user feedback You may notice errors that have no user feedback and have no idea what went wrong.
### Recipes
- Automatic web scrapping for common recipe platforms
- Interactive API Documentation thanks to [FastAPI](https://fastapi.tiangolo.com/) and [Swagger](https://petstore.swagger.io/)
- UI Recipe Editor
- JSON Recipe Editor in browser
- Custom tags and categories
- Rate recipes
- Add notes to recipes
- Migration From Other Platforms
- Chowdown
### Meal Planner
- Random Meal plan generation based off categories
- Expose notes in the API to allow external applications to access relevant information for meal plans
### Database Import / Export
- Easily Import / Export your recipes from the UI
- Export recipes in markdown format for universal access
- Fixes upload image error when no photo was scrapped
- Fixes no last_recipe.json not updating
- Added markdown rendering for notes
- New notifications
- Minor UI improvements
- Recipe editor refactor
- Settings/Theme models refactor
### Development / Misc
- Added async file response for images, downloading files.
- Breakup recipe view component
# v0.2.0 - Now with Test!
This is, what I think, is a big release! Tons of new features and some great quality of life improvements with some additional features. You may find that I made promises to include some fixes/features in v0.2.0. The short of is I greatly underestimated the work needed to refactor the database to a usable state and integrate categories in a way that is useful for users. This shouldn't be taken as a sign that I'm dropping those feature requests or ignoring them. I felt it was better to push a release in the current state rather than drag on development to try and fulfil all of the promises I made.
!!! warning "Upgrade Process"
Database Breaks! I have not yet implemented a database migration service. As such, upgrades cannot be done by simply pulling the image. You must first export your recipes, update your deployment, and then import your recipes. This pattern is likely to be how upgrades take place prior to v1.0. After v1.0 migrations will be done automatically.
### Bug Fixes
- Remove ability to save recipe with no name
- Fixed data validation error on missing parameters
- Fixed failed database initialization at startup - Closes #98
- Fixed misaligned text on various cards
- Fixed bug that blocked opening links in new tabs - Closes #122
- Fixed router link bugs - Closes #122
- Fixed navigation on keyboard selection - Closes #139
### Features and Improvements
- 🐳 Dockerfile now 1/5 of the size!
- 🌎 UI Language Selection + Additional Supported Language
- **Home Page**
- By default your homepage will display only the recently added recipes. You can configured sections to show on the home-screen based of categories on the settings page.
- A new sidebar is now shown on the main page that lists all the categories in the database. Clicking on them navigates into a page that shows only recipes.
- Basic Sort functionality has been added. More options are on the way!
- **Meal Planner**
- Improved Search (Fuzzy Search)
- New Scheduled card support
- **Recipe Editor**
- Ingredients are now sortable via drag-and-drop
- Known categories now show up in the dropdown - Closes 83
- Initial code for data validation to prevent errors
- **Migrations**
- Card based redesign
- Upload from the UI
- Unified Chowdown / Nextcloud import process. (Removed Git as a dependency)
- **API**
- Category and Tag endpoints added
- Major Endpoint refactor
- Improved API documentation
- Link to your Local API is now on your `/settings/site`. You can use it to explore your API.
- **Style**
- Continued work on button/style unification
- Adding icons to buttons
- New Color Theme Picker UI
### Development
- Fixed Vetur config file. Autocomplete in VSCode works!
- File/Folder restructuring
- Added Prettier config
- Fixed incorrect layout code
- FastAPI Route tests for major operations - WIP (shallow testing)
### Breaking Changes
!!! error "Breaking Changes"
- API endpoints have been refactored to adhere to a more consistent standard. This is a WIP and more changes are likely to occur.
- Officially Dropped MongoDB Support
- Database Breaks! We have not yet implemented a database migration service. As such, upgrades cannot be done by simply pulling the image. You must first export your recipes, update your deployment, and then import your recipes. This pattern is likely to be how upgrades take place prior to v1.0. After v1.0 migrations will be done automatically.
- Fixed open search on `/` when in input. - Closes #174
- Error when importing recipe: KeyError: '@type' - Closes #145
- Fixed Import Issue - bhg.com - Closes #138
- Scraper not working with recipe containing HowToSection - Closes #73
### Features and Improvements
- Improved Nextcloud Imports
- Improved Recipe Parser!
- Open search with `/` hotkey!
- Database and App version are now split
- Unified and improved snackbar notifications
- New Category/Tag endpoints to filter all recipes by Category or Tag
- Category sidebar now has show/hide behavior on mobile
- Settings menu on mobile is improved
- **Meal Planner**
- You can now restrict recipe categories used for random meal-plan creation in the settings menu
- Recipe picker dialog will now display recipes when the search bar is empty
- Minor UI improvements
- **Shopping lists!** Shopping list can now be generated from a meal plan. Currently ingredients are split by recipes or there is a beta feature that attempts to sort them by similarity.
- **Recipe Viewer**
- Categories, Tags, and Notes will now be displayed below the steps on smaller screens
- **Recipe Editor**
- Text areas now auto grow to fit content
- Description, Steps, and Notes support Markdown! This includes inline html in Markdown.
- **Imports**
- A revamped dialog has been created to provide more information on restoring backups. Exceptions on the backend are now sent to the frontend and are easily viewable to see what went wrong when you restored a backup. This functionality will be ported over to the migrations in a future release.
A new database will be created. You must export your data and then import it after upgrading.
#### Site Settings
With the addition of group settings and a re-write of the database layer of the application backend, there is no migration path for your current site settings. Webhooks Settings, Meal Plan Categories are now managed by groups. Site settings, mainly homepage settings, are now site specific and managed by administrators. When upgrading be sure to uncheck the settings when importing your old data.
#### ENV Variables
Names have been changed to be more consistent with industry standards. See the [Installation Page](/mealie/getting-started/install/) for new parameters.
## Bug Fixes
- Fixed Search Results Limited to 100 - #198
- Fixed recipes from marmiton.org not fully scrapped - #196
- Fixed Unable to get a page to load - #194
- Fixed Recipe's from Epicurious don't upload. - #193
- Fixed Edited blank recipe in meal plan is not saved - #184
- Fixed Create a new meal plan allows selection of an end date that is prior to the start date - #183
- Fixed Original URL not saved to imported recipe in 0.3.0-dev - #183
- Fixed "IndexError: list index out of range" when viewing shopping list for meal plan containing days without a recipe selected - #178
- The API Reference is now better embedded inside of the docs
- New default external port in documentation (Port 9000 -> 9925). This is only the port exposed by the host to the docker image. It doesn't change any existing functionality.
### User Authentication
- Authentication! Tons of stuff went into creating a flexible authentication platform for a lot of different use cases. Review the documentation for more information on how to use the authentication, and how everything works together. More complex management of recipes and user restrictions are in the works, but this is a great start! Some key features include
- Sign Up Links
- Admin and User Roles
- Password Change
- Group Management
- Create/Edit/Delete Restrictions
### Custom Pages
- You can now create custom pages that are displayed on the homepage sidebar to organize categories of recipes into pages. For example, if you have several categories that encompass "Entrée" you can group all those categories together under the "Entrée" page. See [Building Pages](/mealie/site-administration/building-pages/) for more information.
!!! tip
Note that this replaces the behavior of automatically adding categories to the sidebar.
### UI Improvements
- Completed Redesign of the Admin Panel
- Profile Pages
- Side Panel Menu
- Improved UI for Recipe Search
- Language selector is now displayed on all pages and does not require an account
### Recipe Data
- Recipe Database Refactoring. Tons of new information is now stored for recipes in the database. Not all is accessible via the UI, but it's coming.
- Nutrition Information
- calories
- fatContent
- fiberContent
- proteinContent
- sodiumContent
- sugarContent
- recipeCuisine has been added
- "categories" has been migrated to "recipeCategory" to adhere closer to the standard schema
While it *shouldn't* be a breaking change, I feel it is important to note that you may experience issues with the new image migration. Recipe images are now minified, this is done on start-up, import, migration, and when a new recipe is created. The initial boot or load may be a bit slow if you have lots of recipes but you likely won't notice. What you may notice is that if your recipe slug and the image name do not match, you will encounter issues with your images showing up. This can be resolved by finding the image directory and rename it to the appropriate slug. I did fix multiple edge cases, but it is likely more exists. As always make a backup before you update!
On the plus side, this comes with a huge performance increase! 🎉
- Add markdown support for ingredients - Resolves #32
- Ingredients editor improvements
- Fix Tags/Categories render problems on recipes
- Tags redirect to new tag pages
- Categories redirect to category pages
- Fix Backup download blocked by authentication
- Random meal-planner will no longer duplicate recipes unless no other options
- New Quick Week button to generate next 5 day week of recipe slots.
- Minor UI tweaks
- Recipe Cards now display 2 recipe tags
- Recipe images are now minified. This comes with a serious performance improvement. On initial startup you may experience some delays. Images are migrated to the new structure on startup, depending on the size of your database this can take some time.
- Note that original images are still kept for large displays like on the individual recipe pages.
- A smaller image is used for recipe cards
- A 'tiny' image is used for search images.
- Advanced Search Page. You can now use the search page to filter recipes to include/exclude tags and categories as well as select And/Or matching criteria.
- Added link to advanced search on quick search
- Better support for NextCloud imports
- Translate keywords to tags
- Fix rollback on failure
- Recipe Tag/Category Input components have been unified and now share a single way to interact. To add a new category in the recipe editor you need to click to '+' icon next to the input and fill out the form. This is the same for adding a Tag.
1. With a recent refactor some users been experiencing issues with an environmental variable not being set correct. If you are experiencing issues, please provide your comments [Here](https://github.com/mealie-recipes/mealie/issues/281).
2. If you are a developer, you may experience issues with development as a new environmental variable has been introduced. Setting `PRODUCTION=false` will allow you to develop as normal.
## Bug Fixes
- Fixed Initialization script (v0.4.1a Hot Fix) - Closes #274
- Fixed nested list error on recipe scrape - Closes #306
- Fixed ingredient checkboxes - Closes #304
- Removed link on recent - Closes #297
- Categories sidebar is auto generated if no pages are created - Closes #291
- Fix tag issues on creating custom pages - Closes #290
- Validate paths on export - Closes #275
- Walk Nextcloud import directory - Closes #254
## General Improvements
- Improved Nextcloud Migration. Mealie will now walk the directories in a zip file looking for directories that match the pattern of a Nextcloud Recipe. Closes #254
- Rewrite Keywords to Tag Fields
- Rewrite url to orgURL
- Improved Chowdown Migration
- Migration report is now similar to the Backup report
- Tags/Categories are now title cased on import "dinner" -> "Dinner"
- Depreciate `ENV` variable to `PRODUCTION`
- Set `PRODUCTION` env variable to default to true
- Unify Logger across the backend
- mealie.log and last_recipe.json are now downloadable from the frontend from the /admin/about
- New download schema where you request a token and then use that token to hit a single endpoint to download a file. This is a notable change if you are using the API to download backups.
- Recipe images can now be added directly from a URL - [See #117 for details](https://github.com/mealie-recipes/mealie/issues/117)
Database version has been bumped from v0.4.x -> v0.5.0. You will need to export and import your data. Moving forward, we will be using database migrations (BETA) to do this automatically. Note that you still must backup your data. If you don't, it's entirely possible something may go wrong and you could lose your data on upgrade.
#### Image Directory
the /data/img directory has been depreciated. All images are now stored in the /recipes/{slug}/image directory. Images should be migrated automatically, but you may experience issues related to this change.
#### API Usage
If you have been using the API directly, many of the routes and status codes have changed. You may experience issues with directly consuming the API.
#### Arm/v7 Support
Mealie will no longer build in CI/CD due to a issue with the rust compiler on 32 bit devices. You can reference [this issue on the matrix-org/synapse](https://github.com/matrix-org/synapse/issues/9403) Github page that are facing a similar issue. You may still be able to build the docker image you-self.
!!! warning "Potential Data Loss"
With this release comes a major rework of how files are stored on disk and where things belong. Migration of files should be done automatically. We have tested extensively with many different backups and user bases and have found that no one experienced data-loss. HOWEVER, with all the major changes that have occurred, it is vital that to prevent any data-loss you must create a backup and store that backup outside of your mealie instance. If you do not do this, you may lose your data.
## Bug Fixes
- Fixed #25 - Allow changing rating without going into edit
- Fixed #475 - trim whitespace on login
- Fixes #435 - Better Email Regex
- Fixed #428 - Meal Planner now works on iOS devices
- Fixed #419 - Typos
- Fixed #418 - You can now "export" shopping lists
- Fixed #356 - Shopping List items are now grouped
- Fixed #329 - Fixed profile image not loading
- Fixed #461 - Proper JSON serialization on webhooks
- Fixed #332 - Language settings are saved for one browser
- Fixes #281 - Slow Handling of Large Sets of Recipes
- Significant improvement in supported sites with the new [Recipe Scraper Library](https://github.com/hhursev/recipe-scrapers)
- UI Debugging now available at `/recipes/debugger`
- Better error messages on failure
- ⚠️ last_recipe.json is now depreciated
- Beta Support for Postgres! 🎉 See the getting started page for details
- Recipe Features
- New button bar for editors with improved accessibility and performance
- Step Sections now supported
- Recipe Assets
- Add Asset image to recipe step
- Additional View Settings.
- Better print support
- New Toolbox Page!
- Bulk assign categories and tags by keyword search
- Title case all Categories or Tags with 1 click
- Create/Rename/Delete Operations for Tags/Categories
- Remove Unused Categories or Tags with 1 click
- Recipe Cards now have a menu button for quick actions!
- Edit
- Delete
- Integrated Share with supported OS/Browsers
- Print
- New Profile Dashboard!
- Edit Your Profile
- Create/Edit Themes
- View other users in your Group
- See what's for dinner
- Manage Long Live API Tokens (New)
- New Admin Dashboard! 🎉
- Now you can get some insight on your application with application statistics and events.
- See uncategorized/untagged recipes and organize them!
- Backup/Restore right from your dashboard
- See server side events. Now you can know who deleted your favorite recipe!
- New Event Notifications through the Apprise Library
- Get notified when specific server side events occur
### Meal Planner
- Multiple Recipes per day
- Supports meals without recipes (Enter title and description)
- Generate share-link from created meal-planners
- Shopping lists can be directly generated from the meal plan
### General
- User can now favorite recipes
- New 'Dark' Color Theme Packaged with Mealie
- Updated Recipe Card Sections Toolbar
- New Sort Options (They work this time!)
- Alphabetical
- Rating
- Created Date
- Updated Date
- Shuffle (Random Sort)
- New 'Random' Recipe button on recipe sections. Random recipes are selected from the filtered results below. For example, on the "Cakes" category page, you will only get recipes in the "Cakes" category.
- Rating can be updated without entering the editor - Closes #25
- Updated recipe editor styles and moved notes to below the steps.
- Redesigned search bar
- 'Dinner this week' shows a warning when no meal is planned yet
- 'Dinner today' shows a warning when no meal is planned yet
- More localization
- Start date for Week is now selectable
- Languages are now managed through Crowdin
- Application Bar was Rewritten
- Sidebar can now be toggled everywhere.
- New and improved mobile friendly bottom bar
- Improved styling for search bar in desktop
- Improved search layout on mobile
- Profile image now shown on all sidebars
- Switched from Flash Messages to Snackbar (Removed dependency)
### Performance
- Images are now served up by the Caddy increase performance and offloading some loads from the API server
- Requesting all recipes from the server has been rewritten to refresh less often and manage client side data better.
- All images are now converted to .webp for better compression
### Behind the Scenes
- The database layer has been added for future recipe scaling.
- Black and Flake8 now run as CI/CD checks
- New debian based docker image
- Unified Sidebar Components
- Refactor UI components to fit Vue best practices (WIP)
- The API returns more consistent status codes
- The API returns error code instead of error text when appropriate
- ⚠️ May cause side-effects if you were directly consuming the API
- Fixed #617 - Section behavior when adding a step
- Fixed #615 - Recipe Settings are not available when creating new recipe
- Fixed #625 - API of today's image returns strange characters
- Fixed [#590](https://github.com/mealie-recipes/mealie/issues/590) - Duplicate Events when using Gunicorn Workers
## Features and Improvements
### General
- Recipe Instructions now collapse when checked
- Default recipe settings can be set through ENV variables
- Recipe Ingredient lists can now container ingredient sections.
- You can now download and upload individual recipes
### Localization
Huge thanks to [@sephrat](https://github.com/sephrat) for all his work on the project. He's very consistent in his contributions to the project and nearly every release has had some of his code in it! Here's some highlights from this release
- [#1140](https://github.com/mealie-recipes/mealie/issues/1140) - Error in processing the quantity of ingredients #1140 - UI Now prevents entering not-allowed characters in quantity field
- UI now allows no value to be set in addition to a zero (0) value.
- [#1237](https://github.com/mealie-recipes/mealie/issues/1237) - UI: Saving a 0 quantity ingredient displays 0 until the page is refreshed #1237 - UI Now properly reacts to changes in the quantity field.
- Consolidated Frontend Types thanks to [@PFischbeck](https://github.com/Fischbeck)
- Added support for SSL/No Auth Email [@nkringle](https://github.com/nkringle)
- [Implement several notifications for server actions ](https://github.com/mealie-recipes/mealie/pull/1234)[@miroito](https://github.com/Miroito)
- Fix display issue for shared recipe rendering on server [@PFischbeck](https://github.com/Fischbeck)
## v1.0.0b - 2022-05-09
- Change MIT license to AGPLv3
## v1.0.0b - 2022-05-08
- Rewrote the registration flow for new users.
- Added support for seed data at anytime through the user interface.
- Improved security for sanitizing HTML inputs for user input.
- Added support for importing keywords as tags during scraping - [@miroito](https://github.com/Miroito)
- Changed default recipe settings to "disable_amount=True" for new groups.
- Add support for merging food, and units.
- Allow tags, category, and tool creation - [@miroito](https://github.com/Miroito)
- Added additional and more comprehensive filter options for cookbooks
- Fixed bookmarklets error
## v1.0.0b - 2022-03-29
- Mealie now stores the original text from parsed ingredients, with the ability to peak at the original text from a recipe. [@miroito](https://github.com/Miroito)
- Added some management / utility functions for administrators to manage data and cleanup artifacts from the file system.
- Fix clear url action in recipe creation [#1101](https://github.com/mealie-recipes/mealie/pull/1101) [@miroito](https://github.com/Miroito)
- Add group statistics calculations and data storage measurements
- No hard limits are currently imposed on groups - though this may be implemented in the future.
## v1.0.0b - 2022-03-25
- Mealie now packages the last git commit as the build ID
- Admin section now has a "Maintenance" page where you can check some health metrics like data directory size, logs file size, and if there are some non compliant directories or images. You can also perform clean-up operations to resolve some of these issues.
- Dropped 2 dependencies and moved to using our own base model within the project
- Removed lots of dead backup code
- Recipe names will now be auto-incremented when a conflict is found. So if you're adding a recipe named "Tomato Soup" and that recipe name already exists in your database one will be created with the name "Tomato Soup (1)". Currently this is done in a loop until a suitable name is found, however it will error out after 10 attempts so it's best to find a more descriptive name for your recipe.
- Fixed broken PWA where it wouldn't render any content
- Added database connection retry loop to ensure that the database is available prior to starting
- Reorganized group routes to be more consistent with the rest of the application
## v1.0.0b Beta Release!
!!! error "Breaking Changes"
As you may have guessed, this release comes with some breaking changes. If you are/were consuming the API you will need to validate all endpoints as nearly all of them have changed.
To import your data into Mealie v1 from the most recent previous release, you'll need to export and import your data using the built in method. **Note that only your recipes will be usable in the migration**.
### ✨ What's New (What isn't?!?!)
#### 🥳 General
- Mealie will by default only be accessible to users. Future plans are to create spaces for non-users to access a specific group.
- Mealie has gone through a big redesign and has tried to standardize it's look a feel a bit more across the board.
- User/Group settings are now completely separated from the Administration page.
- All settings and configurations pages now have some sort of self-documenting help text. Additional text or descriptions are welcome from PRs
- New experimental banner for the site to give users a sense of what features are still "in development" and provide a link to a github issue that provides additional context.
- Groups now offer full multi-tenant support so you can all groups have their own set of data.
##### ⚙️ Site Settings Page
- Site Settings has been completely revamped. All site-wide settings at defined on the server as ENV variables. The site settings page now only shows you the non-secret values for reference. It also has some helpers to let you know if something isn't configured correctly.
- Server Side Bare URL will let you know if the BASE_URL env variable has been set
- Secure Site let's you know if you're serving via HTTPS or accessing by localhost. Accessing without a secure site will render some of the features unusable.
- Email Configuration Status will let you know if all the email settings have been provided and offer a way to send test emails.
#### 👨👩👧👦 Users and Groups
- All members of a group can generate invitation tokens for other users to join their group
- Users now a have "Advanced" setting to enable/disable features like Webhooks and API tokens. This will also apply to future features that are deemed as advanced.
- "Pages" have been dropped in favor of Cookbooks which are now group specific so each group can have it's own set of cookbooks
- Default recipe settings can now be set by the group instead of environmental variables.
- Password reset via email
- Invitation to group by email
- Manage group member permissions
#### 📦 Data Migrations
- Migrations have been moved from the Admin Page to a Group Migration page. Migrations from applications (or previous versions of Mealie) can now be imported into Mealie via the Group Migration pages where all recipes will be imported into the group.
- **Supported Migrations**
- Mealie Pre v1.0.0
- Nextcloud Recipes
- Chowdown
#### 🛒 Shopping Lists
- Shopping Lists has been completely revamped to be more flexible and user friendly.
- Add recipe ingredients to a shopping list
- Manually add item/ingredient to shopping list
- Copy as markdown or plain text
- Sort by food/item Labels
- Checked items are now hidden
- Uncheck all Items
- Delete all checked items
#### 📢 Apprise Integration
- Server based Apprise notifications have been deprecated. An effort has been made to improve logging overall in the application and make it easier to monitor/debug through the logs.
- The Apprise integration has been updated to the latest version and is now used asynchronously.
- Notifiers now support a wider variety of events.
- Notifiers can now be managed by-group instead of by the server.
#### 🗓 Meal Plans
- Meal plans have been completely redesigned to use a calendar approach so you'll be able to see what meals you have planned in a more traditional view
- Drag and Drop meals between days
- Add Recipes or Notes to a specific day
- New context menu action for recipes to add a recipe to a specific day on the meal-plan
- New rule based meal plan generator/selector. You can now create rules to restrict the addition of recipes for specific days or meal types (breakfast, lunch, dinner, side). You can also create rules that match against "all" days or "all" meal types to create global rules based around tags and categories. This gives you the most flexibility in creating meal plans.
#### 🥙 Recipes
##### 🔍 Search
- Search now includes the ability to fuzzy search ingredients
- Search now includes an additional filter for "Foods" which will filter (Include/Exclude) matches based on your selection.
##### 🍴 Recipe General
- Recipe Pages now implement a screen lock on supported devices to keep the screen from going to sleep.
- Recipes are now only viewable by group members
- Recipes can be shared with share links
- Shared recipes can now render previews for the recipe on sites like Twitter, Facebook, and Discord.
- Recipes now have a `tools` attribute that contains a list of required tools/equipment for the recipe. Tools can be set with a state to determine if you have that tool or not. If it's marked as on hand it will show checked by default.
- Recipe Extras now only show when advanced mode is toggled on
- You can now import multiple URLs at a time pre-tagged using the bulk importer. This task runs in the background so no need to wait for it to finish.
- Foods/Units for Ingredients are now supported (toggle inside your recipe settings)
- Common Food and Units come pre-packaged with Mealie
- Landscape and Portrait views are now available
- Users with the advanced flag turned on will now be able to manage recipe data in bulk and perform the following actions:
- Set Categories
- Set Tags
- Delete Recipes
- Export Recipes
- Recipes now have a `/cook` page for a simple view of the recipe where you can click through each step of a recipe and it's associated ingredients.
- The Bulk Importer has received many additional upgrades.
- Trim Whitespace: automatically removes leading and trailing whitespace
- Trim Prefix: Removes the first character of each line. Useful for when you paste in a list of ingredients or instructions that have 1. or 2. in front of them.
- Split By Numbered Line: Attempts to split a paragraph into multiple lines based on the patterns matching '1.', '1:' or '1)'.
##### 🍞 Recipe Ingredients
- Recipe ingredients can now be scaled when the food/unit is defined
- Recipe ingredients can now be copied as markdown lists
- example `- [ ] 1 cup of flour`
- You can now use Natural Language Processing (NLP) to process ingredients and attempt to parse them into amounts, units, and foods. There is an additional "Brute Force" processor that can be used as pattern matching parser to try and determine ingredients. **Note** if you are processing a Non-English language you will have terrible results with the NLP and will likely need to use the Bruce Force processor.
##### 📜 Recipe Instructions
- Can now be merged with the above step automatically through the action menu
- Recipe Ingredients can be linked directly to recipe instructions for improved display
- There is an option in the linking dialog to automatically link ingredients. This works by using a key-word matching algorithm to find the ingredients. It's not perfect so you'll need to verify the links after use, additionally you will find that it doesn't work for non-english languages.
- Recipe Instructions now have a preview tab to show the rendered markdown before saving.
#### ⚠️ Other things to know...
- Themes have been deprecated for specific users. You can still set specific themes for your site through ENV variables. This approach should yield much better results for performance and some weirdness users have experienced.
- If you've experienced slowness in the past, you may notice a significant improvement in the "All Recipes" and "Search" pages, or wherever large payloads of recipes are being displayed. This is due to not validating responses from the database, as such if you are consuming these API's you may get extra values that are unexpected.
#### 👨💻 Backend/Development Goodies
- Codebase is significantly more organized both Frontend and Backend
- We've moved to Nuxt for SSR and Typescript for better type safety and less bugs 🎉
- Backend now using a Class based architecture to maximize code reuse
- Tons of performance improvements across the board
- Significant work was done by [@PFischbeck](https://github.com/PFischbeck) to improve type safety on the frontend server and fix many type related errors/bugs!
In this case if a attacker try to load a huge file then server will try to load the file and eventually server use its all memory which will dos the server
##### Mitigation
HTML is now scraped via a Stream and canceled after a 15 second timeout to prevent arbitrary data from being loaded into the server.
#### v1.0.0beta-3 and Under - Recipe Assets: Remote Code Execution
!!! error "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"
As a low privileged user, Create a new recipe and click on the "+" to add a New Asset.
Select a file, then proxy the request that will create the asset.
Since mealie/routes/recipe/recipe_crud_routes.py:306 is calling slugify on the name POST parameter, we use $ which slugify() will remove completely.
Since mealie/routes/recipe/recipe_crud_routes.py:306 is concatenating raw user input from the extension POST parameter into the variable file_name, which ultimately gets used when writing to disk, we can use a directory traversal attack in the extension (e.g. ./../../../tmp/pwn.txt) to write the file to arbitrary location on the server.
As an attacker, now that we have a strong attack primitive, we can start getting creative to get RCE. Since the files were being created by root, we could add an entry to /etc/passwd, create a crontab, etc. but since there was templating functionality in the application that peaked my interest. The PoC in the HTTP request above creates a Jinja2 template at /app/data/template/pwn.html. Since Jinja2 templates execute Python code when rendered, all we have to do now to get code execution is render the malicious template. This was easy enough.
##### Mitigation
We've added proper path sanitization to ensure that the user is not allowed to write to arbitrary locations on the server.
!!! warning "Breaking Change Incoming"
As this has shown a significant area of exposure in the templates that Mealie was provided for exporting recipes, we'll be removing this feature in the next Beta release and will instead rely on the community to provide tooling around transforming recipes using templates. This will significantly limit the possible exposure of users injecting malicious templates into the application. The template functionality will be completely removed in the next beta release v1.0.0beta-5
#### All version Markdown Editor: Cross Site Scripting
A low privilege user can insert malicious JavaScript code into the Recipe Instructions which will execute in another person's browser that visits the recipe.
`<img src=x onerror=alert(document.domain)>`
##### Mitigation
This issues is present on all pages that allow markdown input. This error has been mitigated by wrapping the 3rd Party Markdown component and using the `domPurify` library to strip out the dangerous HTML.
#### v1.0.0beta-3 and Under - Image Scraper: Server-Side Request Forgery
In the recipe edit page, is possible to upload an image directly or via an URL provided by the user. The function that handles the fetching and saving of the image via the URL doesn't have any URL verification, which allows to fetch internal services.
Furthermore, after the resource is fetch, there is no MIME type validation, which would ensure that the resource is indeed an image. After this, because there is no extension in the provided URL, the application will fallback to jpg, and original for the image name.
Then the result is saved to disk with the original.jpg name, that can be retrieved from the following URL: http://<domain>/api/media/recipes/<recipe-uid>/images/original.jpg. This file will contain the full response of the provided URL.
**Impact**
An attacker can get sensitive information of any internal-only services running. For example, if the application is hosted on Amazon Web Services (AWS) platform, its possible to fetch the AWS API endpoint, https://169.254.169.254, which returns API keys and other sensitive metadata.
##### Mitigation
Two actions were taken to reduce exposure to SSRF in this case.
1. The application will not prevent requests being made to local resources by checking for localhost or 127.0.0.1 domain names.
2. The mime-type of the response is now checked prior to writing to disk.
If either of the above actions prevent the user from uploading images, the application will alert the user of what error occurred.
### Bug Fixes
- For erroneously-translated datetime config ([#1362](https://github.com/mealie-recipes/mealie/issues/1362))
- Fixed text color on RecipeCard in RecipePrintView and implemented ingredient sections ([#1351](https://github.com/mealie-recipes/mealie/issues/1351))
- Ingredient sections lost after parsing ([#1368](https://github.com/mealie-recipes/mealie/issues/1368))
- Increased float rounding precision for CRF parser ([#1369](https://github.com/mealie-recipes/mealie/issues/1369))
- Infinite scroll bug on all recipes page ([#1393](https://github.com/mealie-recipes/mealie/issues/1393))
- Fast fail of bulk importer ([#1394](https://github.com/mealie-recipes/mealie/issues/1394))
- Bump @mdi/js from 5.9.55 to 6.7.96 in /frontend ([#1279](https://github.com/mealie-recipes/mealie/issues/1279))
- Bump @nuxtjs/i18n from 7.0.3 to 7.2.2 in /frontend ([#1288](https://github.com/mealie-recipes/mealie/issues/1288))
- Bump date-fns from 2.23.0 to 2.28.0 in /frontend ([#1293](https://github.com/mealie-recipes/mealie/issues/1293))
- Bump fuse.js from 6.5.3 to 6.6.2 in /frontend ([#1325](https://github.com/mealie-recipes/mealie/issues/1325))
- Bump core-js from 3.17.2 to 3.23.1 in /frontend ([#1383](https://github.com/mealie-recipes/mealie/issues/1383))
- All-recipes page now sorts alphabetically ([#1405](https://github.com/mealie-recipes/mealie/issues/1405))
- Sort recent recipes by created_at instead of date_added ([#1417](https://github.com/mealie-recipes/mealie/issues/1417))
- Only show scaler when ingredients amounts enabled ([#1426](https://github.com/mealie-recipes/mealie/issues/1426))
- Add missing types for API token deletion ([#1428](https://github.com/mealie-recipes/mealie/issues/1428))
- Added "last-modified" header to supported record types ([#1379](https://github.com/mealie-recipes/mealie/issues/1379))
- Re-write get all routes to use pagination ([#1424](https://github.com/mealie-recipes/mealie/issues/1424))
- Advanced filtering API ([#1468](https://github.com/mealie-recipes/mealie/issues/1468))
- Restore frontend sorting for all recipes ([#1497](https://github.com/mealie-recipes/mealie/issues/1497))
- Implemented local storage for sorting and dynamic sort icons on the new recipe sort card ([1506](https://github.com/mealie-recipes/mealie/pull/1506))
- create new foods and units from their Data Management pages ([#1511](https://github.com/mealie-recipes/mealie/pull/1511))
### Miscellaneous Tasks
- Bump dev deps ([#1418](https://github.com/mealie-recipes/mealie/issues/1418))
- Bump @vue/runtime-dom in /frontend ([#1423](https://github.com/mealie-recipes/mealie/issues/1423))
Released packages are [built and published via GitHub actions](maintainers.md#drafting-releases).
## Python packages
To build Python packages locally for testing, use [`task`](starting-dev-server.md#without-dev-containers). After installing `task`, run `task py:package` to perform all the steps needed to build the package and a requirements file. To do it manually, run:
To install with the latest but still compatible dependency versions, instead run `pip3 install dist/mealie-$VERSION-py3-none-any.whl` (where `$VERSION` is the version of mealie to install).
## Docker image
One way to build the Docker image is to run the following command in the project root directory:
[Please Join the Discord](https://discord.gg/QuStdQGSGK). We are building a community of developers working on the project.
## We Develop with Github
We use github to host code, to track issues and feature requests, as well as accept pull requests.
## We Develop with GitHub
We use GitHub to host code, to track issues and feature requests, as well as accept pull requests.
## We Use [Github Flow](https://docs.github.com/en/get-started/using-github/github-flow), So All Code Changes Happen Through Pull Requests
Pull requests are the best way to propose changes to the codebase (we use [Github Flow](https://docs.github.com/en/get-started/using-github/github-flow)). We actively welcome your pull requests:
## We Use [GitHub Flow](https://docs.github.com/en/get-started/using-github/github-flow), So All Code Changes Happen Through Pull Requests
Pull requests are the best way to propose changes to the codebase (we use [GitHub Flow](https://docs.github.com/en/get-started/using-github/github-flow)). We actively welcome your pull requests:
1. Fork the repo and create your branch from `mealie-next`.
2. Checkout the Discord, the PRs page, or the Projects page to get an idea of what's already being worked on.
@@ -14,13 +14,13 @@ Pull requests are the best way to propose changes to the codebase (we use [Githu
4. Once you've got an idea of what changes you want to make, create a draft PR as soon as you can to let us know what you're working on and how we can help!
5. If you've changed APIs, update the documentation.
6. Run tests, including `task py:check`.
6. Issue that pull request! First make a draft PR, make sure that the automated github tests all pass, then mark as ready for review.
7. Be sure to add release notes to the pull request.
7. Issue that pull request! First make a draft PR, make sure that the automated GitHub tests all pass, then mark as ready for review. We follow Conventional Commits syntax; please title your PR as described in the PR template.
8. Be sure to add release notes to the pull request.
## Any contributions you make will be under the AGPL Software License
In short, when you submit code changes, your submissions are understood to be under the same [AGPL License](https://choosealicense.com/licenses/agpl-3.0/) that covers the project. Feel free to contact the maintainers if that's a concern.
## Report bugs using Github's [issues](https://github.com/mealie-recipes/mealie/issues)
## Report bugs using GitHub's [issues](https://github.com/mealie-recipes/mealie/issues)
We use GitHub issues to track public bugs. Report a bug by [opening a new issue](https://github.com/mealie-recipes/mealie/issues/new); it's that easy!
## Write bug reports with detail, background, and sample code
This document is open to improvement; please share any insights you have/develop.
## Overview
When modifying the database, you will most likely need to change the files under `/mealie/db/models/`.
How exactly you need to modify it is of course highly contextual to the change you're making.
## Using Alembic to generate upgrade script
In your dev container you can run something like (change the message) `task py:migrate -- "Add creation tag to group preferences"` to have Alembic generate an upgrade script for you.
Alembic's script migration isn't perfect, so you will need to review which changes are generated. You will also need to make sure any custom operations work on both SQLite and Postgres.
There are some known limitations with our migrations and Alembic's auto-generation, which is accounted for in `/alembic/env.py`. If any of your migrations overlap with the columns in `include_object`, you may need to manually adjust the migration.
@@ -6,7 +6,7 @@ This is the start of the maintainers guide for Mealie developers. Those who have
If you are working on issues, it can be helpful to understand the workflow for our repository. When an issue comes in it is tagged with the `bug` and `triage` flags. This is to indicate that they need to be reviewed by a maintainer to determine validity.
After you've reviered an issue it will generally move into one of two states:
After you've reviewed an issue it will generally move into one of two states:
`bug:confirmed`
: Your were able to verify the issue and we determined we need to fix it
This guide is a reference for developers maintaining custom integrations with Mealie. While we aim to keep breaking changes to a minimum, major versions are likely to contain at least *some* breaking changes. To clarify: *most users do not need to worry about this, this is **only** for those maintaining integrations and/or leveraging the API*.
While this guide aims to simplify the migration process for developers, it's not necessarily a comprehensive list of breaking changes. Starting with v2, a comprehensive list of breaking changes are highlighted in the release notes.
## V1 → V2
The biggest change between V1 and V2 is the introduction of Households. For more information on how households work in relation to groups/users, check out the [Groups and Households](./features.md#groups-and-households) section in the Features guide.
### `updateAt` is now `updatedAt`
We have renamed the `updateAt` field to `updatedAt`. While the API will still accept `updateAt` as an alias, the API will return it as `updatedAt`. The field's behavior has otherwise been unchanged.
### Backend Endpoint Changes
These endpoints have moved, but are otherwise unchanged:
`/groups/members` previously returned a `UserOut` object, but now returns a `UserSummary`. Should you need the full user information (username, email, etc.), rather than just the summary, see `/households/members` instead for the household members.
`/groups/members` previously returned a list of users, but now returns paginated users (similar to all other list endpoints).
These endpoints have been completely removed:
-`/admin/analytics` (no longer used)
-`/groups/permissions` (see household permissions)
-`/groups/statistics` (see household statistics)
-`/groups/categories` (see organizer endpoints)
-`/recipes/summary/untagged` (no longer used)
-`/recipes/summary/uncategorized` (no longer used)
-`/users/group-users` (see `/groups/members` and `/households/members`)
Mealie uses Conditional Random Fields (CRFs) for parsing and processing ingredients. The model used for ingredients is based off a data set of over 100,000 ingredients from a dataset compiled by the New York Times. I believe that the model used is sufficient enough to handle most of the ingredients, therefore, more data to train the model won't necessarily help improve the model.
Mealie uses Conditional Random Fields (CRFs) for parsing and processing ingredients. The model used for ingredients is based off a data set of over 100,000 ingredients from a dataset compiled by the New York Times. I believe that the model used is sufficient enough to handle most of the ingredients, therefore, more data to train the model won't necessarily help improve the model.
## Improving The CRF Parser
To improve results with the model, you'll likely need to focus on improving the tokenization and parsing of the original string to aid the model in determine what the ingredient is. Data science is not my forte, but I have done some tokenization to improve the model. You can find that code under `/mealie/services/parser_services/crfpp` along with some other utility functions to aid in the tokenization and processing of ingredient strings.
To improve results with the model, you'll likely need to focus on improving the tokenization and parsing of the original string to aid the model in determine what the ingredient is. Data science is not my forte, but I have done some tokenization to improve the model. You can find that code under `/mealie/services/parser_services/crfpp` along with some other utility functions to aid in the tokenization and processing of ingredient strings.
The best way to test on improving the parser is to register additional test cases in `/mealie/tests/unit_tests/test_crfpp_parser.py` and run the test after making changes to the tokenizer. Note that the test cases DO NOT run in the CI environment, therefore you will need to have CRF++ installed on your machine. If you're using a Mac the easiest way to do this is through brew.
When submitting a PR to improve the parser it is important to provide your test cases, the problem you were trying to solve, and the results of the changes you made. As the tests don't run in CI, not providing these details may delay your PR from being merged.
When submitting a PR to improve the parser it is important to provide your test cases, the problem you were trying to solve, and the results of the changes you made. As the tests don't run in CI, not providing these details may delay your PR from being merged.
## Alternative Parsers
Alternatively, you can register a new parser by fulfilling the `ABCIngredientParser` interface. Satisfying this single method interface allows us to register additional parsing strategies at runtime and gives the user several options when trying to parse a recipe.
Alternatively, you can register a new parser by fulfilling the `ABCIngredientParser` interface. Satisfying this single method interface allows us to register additional parsing strategies at runtime and gives the user several options when trying to parse a recipe.
@@ -9,8 +9,8 @@ We love your input! We want to make contributing to this project as easy and tra
- Becoming a maintainer
- Help translate to a new language or improve current translations
[Remember to join the Discord and stay in touch with other developers working on the project](https://discord.gg/QuStdQGSGK)!
[Remember to join the Discord and stay in touch with other developers working on the project](https://discord.gg/QuStdQGSGK)!
Additionally, you can buy me a coffee and support the project. When I get financial support it helps me know that there's real interest in the project and that it's worth the time to keep developing.
Additionally, you can buy me a coffee and support the project. When I get financial support it helps me know that there's real interest in the project and that it's worth the time to keep developing.
<a href="https://www.buymeacoffee.com/haykot" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-green.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
<a href="https://www.buymeacoffee.com/haykot" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-green.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
This guide was submitted by a community member. Find something wrong? Submit a PR to get it fixed!
Mealie supports adding the ingredients of a recipe to your [Bring](https://www.getbring.com/) shopping list, as you can
see [here](https://docs.mealie.io/documentation/getting-started/features/#recipe-actions).
However, for this to work, your Mealie instance needs to be exposed to the open Internet so that the Bring servers can access its information. If you don't want your server to be publicly accessible for security reasons, you can use the [Mealie-Bring-API](https://github.com/felixschndr/mealie-bring-api) written by a community member. This integration is entirely local and does not require any service to be exposed to the Internet.
This is a small web server that runs locally next to your Mealie instance, and instead of Bring pulling the data from you, it pushes the data to Bring. [Check out the project](https://github.com/felixschndr/mealie-bring-api) for more information and installation instructions.
This guide was submitted by a community member. Find something wrong? Submit a PR to get it fixed!
This guide was submitted by a community member. Find something wrong? Submit a PR to get it fixed!
In a lot of ways, Home Assistant is why this project exists! Since Mealie has a robust API it makes it a great fit for interacting with Home Assistant and pulling information into your dashboard.
### Display Today's Meal in Lovelace
## Display Today's Meal in Lovelace
You can use the Mealie API to get access to meal plans in Home Assistant like in the image below.
Create an API token from Mealie's User Settings page (https://hay-kot.github.io/mealie/documentation/users-groups/user-settings/#api-key-generation)
Create an API token from Mealie's User Settings page (see [this page](https://docs.mealie.io/documentation/getting-started/api-usage/#getting-a-token) to learn how).
#### 2. Create Home Assistant Sensors
### 2. Create Home Assistant Sensors
Create REST sensors in home assistant to get the details of today's meal.
We will create sensors to get the name and ID of the first meal in today's meal plan (note that this may not be what is wanted if there is more than one meal planned for the day). We need the ID as well as the name to be able to retreive the image for the meal.
We will create sensors to get the name and ID of the first meal in today's meal plan (note that this may not be what is wanted if there is more than one meal planned for the day). We need the ID as well as the name to be able to retrieve the image for the meal.
Make sure the url and port (`http://mealie:9000`) matches your installation's address and _API_ port.
Make sure the url and port (`http://mealie:9000`) matches your installation's address and _API_ port.
We will create a camera entity to display the image of today's meal in Lovelace.
@@ -58,7 +52,7 @@ In the still image url field put in:
Under the entity page for the new camera, rename it.
e.g. `camera.mealie_todays_meal_image`
#### 4. Create a Lovelace Card
### 4. Create a Lovelace Card
Create a picture entity card and set the entity to `mealie_todays_meal` and the camera entity to `camera.mealie_todays_meal_image` or set in the yaml directly.
@@ -82,4 +76,4 @@ card_mod:
```
!!! tip
Due to how Home Assistant works with images, I had to include the additional styling to get the images to not appear distorted. This requires an [additional installation](https://github.com/thomasloven/lovelace-card-mod) from HACS.
Due to how Home Assistant works with images, I had to include the additional styling to get the images to not appear distorted. This requires an [additional installation](https://github.com/thomasloven/lovelace-card-mod) from HACS.
@@ -7,15 +7,15 @@ You can use bookmarklets to generate a bookmark that will take your current loca
You can use a [bookmarklet generator site](https://caiorss.github.io/bookmarklet-maker/) and the code below to generate a bookmark for your site. Just change the `http://localhost:8080` to your sites web address and follow the instructions.
```js
varurl=document.URL;
varurl=document.URL.endsWith('/')?
document.URL.slice(0,-1):
document.URL;
varmealie="http://localhost:8080";
vargroup_slug="home"// Change this to your group slug. You can obtain this from your URL after logging-in to Mealie
varuse_keywords="&use_keywords=1"// Optional - use keywords from recipe - update to "" if you don't want that
varedity="&edit=1"// Optional - keep in edit mode - update to "" if you don't want that
This guide was submitted by a community member. Find something wrong? Submit a PR to get it fixed!
An easy way to add recipes to Mealie from an Apple device is via an Apple Shortcut. This is a short guide to install an configure a shortcut able to add recipes via a link or image(s).
!!! note
If adding via images make sure to enable [Mealie's OpenAI Integration](https://docs.mealie.io/documentation/getting-started/installation/open-ai/)
## Javascript can only be run via Shortcuts on the Safari browser on MacOS and iOS. If you do not use Safari you may skip this section
Some sites have begun blocking AI scraping bots, inadvertently blocking the recipe scraping library Mealie uses as well. To circumvent this, the shortcut uses javascript to capture the raw html loaded in the browser and sends that to mealie when possible.
An API key is needed to authenticate with mealie. To create an api key for a user, navigate to http://YOUR_MEALIE_URL/user/profile/api-tokens. Alternatively you can create a key via the mealie home page by clicking the user's profile pic in the top left -> Api Tokens
The shortcut can be installed via **[This link](https://www.icloud.com/shortcuts/52834724050b42aebe0f2efd8d067360)**. Upon install, replace "MEALIE_API_KEY" with the API key generated previously and "MEALIE_URI" with the full URL used to access your mealie instance e.g. "http://10.0.0.5:9000" or "https://mealie.domain.com".
## Using the Shortcut
Once installed, the shortcut will automatically appear as an option when sharing an image or webpage. It can also be useful to add the shortcut to the home screen of your device. If selected from the home screen or shortcuts app, a menu will appear with prompts to import via **taking photo(s)**, **selecting photo(s)**, **scanning a URL**, or **pasting a URL**.
!!! note
Despite the Mealie API being able to accept multiple recipe images for import it is currently impossible to send multiple files in 1 web request via Shortcuts. Instead, the shortcut combines the images into a singular, vertically-concatenated image to send to mealie. This can result in slightly less-accurate text recognition.
This guide was submitted by a community member. Find something wrong? Submit a PR to get it fixed!
Don't know what an iOS shortcut is? Neither did I! Experienced iOS users may already be familiar with this utility but for the uninitiated, here is the official Apple explanation:
> A shortcut is a quick way to get one or more tasks done with your apps. The Shortcuts app lets you create your own shortcuts with multiple steps. For example, build a “Surf Time” shortcut that grabs the surf report, gives an ETA to the beach, and launches your surf music playlist.
Basically it is a visual scripting language that lets a user build an automation in a guided fashion. The automation can be [shared with anyone](https://www.icloud.com/shortcuts/94aa272af5ff4d2c8fe5e13a946f89a9) but if it is a user creation, you'll have to jump through a few hoops to make an untrusted automation work on your device.
## Setup Video
The following YouTube video walks through setting up the shortcut in 3 minutes for those who prefer following along visually.
Before setting up the shortcut, make sure you have the following information ready and easily accessable on your Apple device.
1. The URL of your Mealie instance
2. An API Key for your user
3. A Gemini API Key from [Google AI Studio](https://makersuite.google.com)
!!! note
A Gemini API Key is not required for importing URLs from Safari or your Camera, however you will not be able to take a photo of a recipe and import it without a Gemini key.
Google AI Studio is currently only available in [certain countries and languages](https://ai.google.dev/available_regions). Most notably it is not currently available in Europe.
### Setup
On the Apple device you wish to add the shortcut to, click on [this link](https://www.icloud.com/shortcuts/94aa272af5ff4d2c8fe5e13a946f89a9) to begin the setup of the shortcut.

Next, you need to replace `url` and `port` with the information for your Mealie instance.
If you have a domain that you use (e.g. `https://mealie.example.com`), put that here. If you just run local, then you need to put in your Mealie instance IP and the port you use (e.g. the default is `9925`).

Next, you need to replace `MEALIE_API_KEY` with your API token.

Finally, replace `GEMINI_API_KEY` with the one you got from [Google AI Studio](https://makersuite.google.com)

You may wish to [add the shortcut to your home screen](https://support.apple.com/guide/shortcuts/add-a-shortcut-to-the-home-screen-apd735880972/ios) for easier access.
## Features
- Share a website from Safari with Mealie to import via URL.
- Share a recipe photo from photos to perform OCR and import a physical recipe.
- Trigger the shortcut and take a photo of a physical recipe to import.
- Trigger the shortcut to select a photo from your Photos app to import.
- Trigger the shortcut to take a picture of a URL (like on the bottom of a printed recipe) to import.
## Troubleshooting
Sometimes Gemini will not be able to parse a recipe, and you will get an error. Users have found success with a combination of the following:
1. #### Try Again
Sometimes Gemini returns the wrong information which causes the import to fail. Often, trying again will be successful.
2. #### Photo Quality
Make sure there is no large glare or shadow over the picture, and you have all the text in frame.
3. #### Edit the Photo
Users have found success by cropping the picture to just the recipe card, adding a "mono" filter, and cranking up the exposure before importing.
## History
User [brasilikum](https://github.com/brasilikum) opened an issue on the main repo about how they had created an [iOS shortcut](https://github.com/mealie-recipes/mealie/issues/103) for interested users.
This original method broke after the transition to version 1.X and an issue was raised on [Github](https://github.com/mealie-recipes/mealie/issues/2092) GitHub user [Zippyy](https://github.com/zippyy) has helped to create a working shortcut for version 1.X.
When OCR was removed from Mealie, GitHub user [hunterjm](https://github.com/zippyy) created a new shortcut that uses Apple's built-in OCR and Google Gemini to enhance and replace that functionality.
This guide was submitted by a community member. Find something wrong? Submit a PR to get it fixed!
[n8n](https://github.com/n8n-io/n8n) is a free and source-available fair-code licensed workflow automation tool. It's an alternative to tools like Zapier or Make, allowing you to use a UI to create automated workflows.
This example workflow:
1. Creates a Mealie backup every morning via an API call
2. Keeps the last 7 backups, deleting older ones
!!! warning "Important"
This only automates the backup function, this does not backup your data to anywhere except your local instance. Please make sure you are backing up your data to an external source.
3. Paste `https://github.com/mealie-recipes/mealie/blob/mealie-next/docs/docs/assets/other/n8n/n8n-mealie-backup.json` and click 'Import'
4. Click through the nodes and update the URLs for your environment
### API Credentials
#### Generate Mealie API Token
1. Head to `<YOUR MEALIE INSTANCE>/user/profile/api-tokens`
!!! tip
If you dont see this screen make sure that "Show advanced features" is checked under `<YOUR MEALIE INSTANCE>/user/profile/edit`
2. Under token name, enter the name of the token (for example, 'n8n') and hit 'Generate'
3. Copy and keep this API Token somewhere safe, this is like your password!
!!! tip
You can use your normal user for this, but assuming you're an admin you could also choose to create a user named n8n and generate the API key against that user.
#### Setup Credentials in n8n
See also [n8n Docs](https://docs.n8n.io/credentials/add-edit-credentials/).
Please use error notifications of some kind. It's very easy to set and forget an automation, then have the worst happen and lose data.
[ntfy](https://github.com/binwiederhier/ntfy) is a great open source, self-hostable tool for sending notifications.
If you want to use ntfy, you will need to install it on your environment, or sign up for their service, and configure it with the webhook URL.
If you want to use another notification service, you can create a new node in n8n that sends the notification using whatever method you like.
- For example, if you want to send a push notification via [Pushover](https:/pushover.net/) you could create a new node that uses the Pushover API and sends the notification.
- You can use the [Send Email](https://docs.n8n.io/integrations/builtincore-nodes/n8n-nodes-base.sendemail/) node in n8n as an example of how to create your own custom node.
- You can send it off to InfluxDB, Slack, Discord etc. Go nuts.
If you're using another method for backups we'd love to hear about it. Pop in [Discord](https://discord.gg/QuStdQGSGK) and say hi!
This guide was submitted by a community member. Find something wrong? Submit a PR to get it fixed!
This guide was submitted by a community member. Find something wrong? Submit a PR to get it fixed!
To make the setup of a Reverse Proxy much easier, Linuxserver.io developed [SWAG](https://github.com/linuxserver/docker-swag).
To make the setup of a Reverse Proxy much easier, Linuxserver.io developed [SWAG](https://github.com/linuxserver/docker-swag)
SWAG - Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let's Encrypt™) sets up an Nginx web server and reverse proxy with PHP support and a built-in certbot client that automates free SSL server certificate generation and renewal processes (Let's Encrypt and ZeroSSL). It also contains fail2ban for intrusion prevention.
## Step 1: Get a domain
@@ -48,7 +47,7 @@ services:
restart:unless-stopped
```
Don't forget to change the <code>mydomain.duckns</code> into your personal domain and the <code>duckdnstoken</code> into your token and remove the brackets.
Don't forget to change the <code>mydomain.duckdns</code> into your personal domain and the <code>duckdnstoken</code> into your token and remove the brackets.
Breaking changes to OIDC Authentication were introduced with Mealie v2. Please see the below for [migration steps](#migration-from-mealie-v1x).
Looking instead for the docs for Mealie :octicons-tag-24: v1.x? [Click here](./oidc.md)
Mealie supports 3rd party authentication via [OpenID Connect (OIDC)](https://openid.net/connect/), an identity layer built on top of OAuth2. OIDC is supported by many Identity Providers (IdP), including:
Signing in with OAuth will automatically find your account in Mealie and link to it. If a user does not exist in Mealie, then one will be created (if enabled), but will be unable to log in with any other authentication method. An admin can configure another authentication method for such a user.
If a user previously accessed Mealie via credentials and you want to no longer allow users to log in with `LDAP` or `Mealie` credentials, then you can set the user's *Authentication Method* to `OIDC`. Conversely, if a user's auth method is not `OIDC`, then they can still log in with whatever their auth method is as well as OIDC.
## Provider Setup
Before you can start using OIDC Authentication, you must first configure a new client application in your identity provider. Your identity provider must support the OAuth **Authorization Code flow with PKCE**. The steps will vary by provider, but generally, the steps are as follows.
1. Create a new client application
- The Provider type should be OIDC or OAuth2
- The Grant type should be `Authorization Code`
- The Client type should be `confidential` (you should have a **Client Secret**)
2. Configure redirect URI
The redirect URI(s) that are needed:
1.`http(s)://DOMAIN:PORT/login`
2.`http(s)://DOMAIN:PORT/login?direct=1`
1. This URI is only required if your IdP supports [RP-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) such as Keycloak. You may also be able to combine this into the previous URI by using a wildcard: `http(s)://DOMAIN:PORT/login*`
The redirect URI(s) should include any URL that Mealie is accessible from. Some examples include
http://localhost:9091/login
https://mealie.example.com/login
3. Configure allowed scopes
The scopes required are `openid profile email`
If you plan to use the [groups](#groups) to configure access within Mealie, you will need to also add the scope defined by the `OIDC_GROUPS_CLAIM` environment variable. The default claim is `groups`
## Mealie Setup
Take the client id and your discovery URL and update your environment variables to include the required OIDC variables described in [Installation - Backend Configuration](../installation/backend-config.md#openid-connect-oidc).
You might also want to set ALLOW_PASSWORD_LOGIN to false, to hide the username+password inputs, if you want to allow logins only via OIDC.
### Groups
There are two (optional) [environment variables](../installation/backend-config.md#openid-connect-oidc) that can control which of the users in your IdP can log in to Mealie and what permissions they will have. Keep in mind that these groups **do not necessarily correspond to groups in Mealie**. The groups claim is configurable via the `OIDC_GROUPS_CLAIM` environment variable. The groups should be **defined in your IdP** and be returned in the configured claim value.
`OIDC_USER_GROUP`: Users must be a part of this group (within your IdP) to be able to log in.
`OIDC_ADMIN_GROUP`: Users that are in this group (within your IdP) will be made an **admin** in Mealie. Users in this group do not need to be in the `OIDC_USER_GROUP`
## Examples
Example configurations for several Identity Providers have been provided by the Community in the [GitHub Discussions](https://github.com/mealie-recipes/mealie/discussions/categories/oauth-provider-example).
If you don't see your provider and have successfully set it up, please consider [creating your own example](https://github.com/mealie-recipes/mealie/discussions/new?category=oauth-provider-example) so that others can have a smoother setup.
## Migration from Mealie v1.x
**High level changes**
- A Client Secret is now required
- CORS is no longer a requirement since all authentication happens server-side
- A user will be successfully authenticated if they are part of *either*`OIDC_USER_GROUP` or `OIDC_ADMIN_GROUP`. Admins no longer need to be part of both groups
- ID Token signing algorithm is now inferred using the `id_token_signing_alg_values_supported` metadata from the discovery URL
### Changes in your IdP
**Required**
- You must change the Mealie client in your IdP to be **confidential**. The option is different for every provider, but you need to obtain a **client secret**.
**Optional**
- You may now also remove the `OIDC_USER_GROUP` from your admin users if you so desire. Users within the `OIDC_ADMIN_GROUP` will now be able to successfully authenticate with only that group.
- You may remove any CORS configuration. i.e. configured origins
### Changes in Mealie
**Required**
- After obtaining the **client secret** from your IdP, you must add it to Mealie using the `OIDC_CLIENT_SECRET` environment variable or via [docker secrets](../installation/backend-config.md#docker-secrets). This secret will not be logged on startup.
**Optional**
- Remove `OIDC_SIGNING_ALGORITHM` from your environment. It will no longer have any effect.
Mealie supports 3rd party authentication via [OpenID Connect (OIDC)](https://openid.net/connect/), an identity layer built on top of OAuth2. OIDC is supported by many Identity Providers (IdP), including:
Signing in with OAuth will automatically find your account in Mealie and link to it. If a user does not exist in Mealie, then one will be created (if enabled), but will be unable to log in with any other authentication method. An admin can configure another authentication method for such a user.
## Provider Setup
Before you can start using OIDC Authentication, you must first configure a new client application in your identity provider. Your identity provider must support the OAuth **Authorization Code flow with PKCE**. The steps will vary by provider, but generally, the steps are as follows.
1. Create a new client application
- The Provider type should be OIDC or OAuth2
- The Grant type should be `Authorization Code`
- The Application type should be `Web` or `SPA`
- The Client type should be `public`
2. Configure redirect URI
The redirect URI(s) that are needed:
1.`http(s)://DOMAIN:PORT/login`
2.`http(s)://DOMAIN:PORT/login?direct=1`
1. This URI is only required if your IdP supports [RP-Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html) such as Keycloak. You may also be able to combine this into the previous URI by using a wildcard: `http(s)://DOMAIN:PORT/login*`
The redirect URI(s) should include any URL that Mealie is accessible from. Some examples include
http://localhost:9091/login
https://mealie.example.com/login
If you are hosting Mealie behind a reverse proxy (nginx, Caddy, ...) to terminate TLS, make sure to start Mealie's Gunicorn server
with `--forwarded-allow-ips=<ip-of-proxy>`, otherwise the `X-Forwarded-*` headers will be ignored and the generated OIDC redirect
URI will use the wrong scheme (http instead of https). This will lead to authentication errors with strict OIDC providers.
3. Configure origins
If your identity provider enforces CORS on any endpoints, you will need to specify your Mealie URL as an Allowed Origin.
4. Configure allowed scopes
The scopes required are `openid profile email`
If you plan to use the [groups](#groups) to configure access within Mealie, you will need to also add the scope defined by the `OIDC_GROUPS_CLAIM` environment variable. The default claim is `groups`
## Mealie Setup
Take the client id and your discovery URL and update your environment variables to include the required OIDC variables described in [Installation - Backend Configuration](../installation/backend-config.md#openid-connect-oidc).
### Groups
There are two (optional) [environment variables](../installation/backend-config.md#openid-connect-oidc) that can control which of the users in your IdP can log in to Mealie and what permissions they will have. Keep in mind that these groups **do not necessarily correspond to groups in Mealie**. The groups claim is configurable via the `OIDC_GROUPS_CLAIM` environment variable. The groups should be **defined in your IdP** and be returned in the configured claim value.
`OIDC_USER_GROUP`: Users must be a part of this group (within your IdP) to be able to log in.
`OIDC_ADMIN_GROUP`: Users that are in this group (within your IdP) will be made an **admin** in Mealie.
## Examples
Example configurations for several Identity Providers have been provided by the Community in the [GitHub Discussions](https://github.com/mealie-recipes/mealie/discussions/categories/oauth-provider-example).
If you don't see your provider and have successfully set it up, please consider [creating your own example](https://github.com/mealie-recipes/mealie/discussions/new?category=oauth-provider-example) so that others can have a smoother setup.
You might have noticed that scaling up a recipe or making a shopping list doesn't by default handle the ingredients in a way you might expect. Depending on your settings, scaling up might yield things like `2 1 cup broth` instead of `2 cup broth`. And making shopping lists from reciepes that have shared ingredients can yield multiple lines of the same ingredient. **But**, mealie has a mechanism to intelligently handle ingredients and make your day better. How?
### Set up your Foods and Units
Do the following just **once**. Doing this applies to your whole group, so be careful.
??? question "How do I enable 'smart' ingredient handling?"
1. Click on your name in the upper left corner to get to your settings
2. In the bottom right, select `Manage Data`
3. In the Management page, make sure that a little orange button says `Foods`
4. If your Foods database is empty, click `Seed` and choose your language. You should end up with a list of foods. (Wait bit for seeding to happen, and try not to seed more than once or you will have duplicates)
5. Click the little orange `Foods` button and now choose `Units`.
6. Click `Seed` and choose your language. You should end up with a list of units (e.g. `tablespoon`)
### How do I enable "smart" ingredient handling?
Initial seeding of Units is pretty complete, but there are many Foods in the world. You'll probably find that you need to add Foods to the database during parsing for the first several recipes. Once you have a well-populated Food database, there are API routes to parse ingredients automatically in bulk. But this is not a good idea without a very complete set of Foods.
You might have noticed that scaling up a recipe or making a shopping list doesn't by default handle the ingredients in a way you might expect. Depending on your settings, scaling up might yield things like `2 1 cup broth` instead of `2 cup broth`. And, making shopping lists from recipes that have shared ingredients can yield multiple lines of the same ingredient. **But**, Mealie has a mechanism to intelligently handle ingredients and make your day better. How?
### Set up Recipes to use Foods and Units
Do the following for each recipe you want to intelligently handle ingredients.
<p style="font-size: 0.75rem; font-weight: 500;">Set up your Foods and Units</p>
Do the following just **once**. Doing this applies to your whole group, so be careful.
1.Go to a recipe
2.Click the Edit button/icon
3.Click the Recipe Settings gear and deselect `Disable Ingredient Amounts`
4.Save
5. The ingredients should now look a little weird (`1 1 cup broth` and so on)
6. Click the Edit button/icon again
7. Scroll to the ingredients and you should see new fields for Amount, Unit, Food, and Note. The Note in particular will contain the original text of the Recipe.
8. Click `Parse` and you will be taken to the ingredient parsing page.
9. Choose your parser. The `Natural Language Parser` works very well, but you can also use the `Brute Parser`.
10. Click `Parse All`, and your ingredients should be separated out into Units and Foods based on your seeding in Step 1 above.
11. For ingredients where the Unit or Food was not found, you can click a button to accept an automatically suggested Food to add to the database. Or, manually enter the Unit/Food and hit `Enter` (or click `Create`) to add it to the database
12. When done, click `Save All` and you will be taken back to the recipe. Now the Unit and Food fields of the recipe should be filled out.
1.Click on your name in the upper left corner to get to your settings
2.In the bottom right, select `Manage Data`
3.In the Management page, make sure that a little orange button says `Foods`
4.If your Foods database is empty, click `Seed` and choose your language. You should end up with a list of foods. (Wait a bit for seeding to happen, and try not to seed more than once or you will have duplicates)
5. Click the little orange `Foods` button and now choose `Units`.
6. Click `Seed` and choose your language. You should end up with a list of units (e.g. `tablespoon`)
Scaling up this recipe or adding it to a Shopping List will now smartly take care of ingredient amounts and duplicate combinations.
Initial seeding of Units is pretty complete, but there are many Foods in the world. You'll probably find that you need to add Foods to the database during parsing for the first several recipes. Once you have a well-populated Food database, there are API routes to parse ingredients automatically in bulk. But this is not a good idea without a very complete set of Foods.
## Is it Safe to Upgrade Mealie?
<p style="font-size: 0.75rem; font-weight: 500;">Set up Recipes to use Foods and Units</p>
Yes. If you are using the v1 branches (including beta), you can upgrade to the latest version of Mealie without performing a site Export/Restore. This process was required in previous versions of Mealie, however we've automated the database migration process to make it easier to upgrade. Not that if you were using the v0.5.x version, you CANNOT upgrade to the latest version automatically. You must follow the migration instructions in the documentation.
Do the following for each recipe you want to intelligently handle ingredients.
- [Migration From v0.5.x](./migrating-to-mealie-v1.md)
1. Go to a recipe
2. Click the Edit button/icon
3. Click the Recipe Settings gear and deselect `Disable Ingredient Amounts`
4. Save
5. The ingredients should now look a little weird (`1 1 cup broth` and so on)
6. Click the Edit button/icon again
7. Scroll to the ingredients and you should see new fields for Amount, Unit, Food, and Note. The Note in particular will contain the original text of the Recipe.
8. Click `Parse` and you will be taken to the ingredient parsing page.
9. Choose your parser. The `Natural Language Parser` works very well, but you can also use the `Brute Parser`, or the `OpenAI Parser` if you've [enabled OpenAI support](./installation/backend-config.md#openai).
10. Click `Parse All`, and your ingredients should be separated out into Units and Foods based on your seeding in Step 1 above.
11. For ingredients where the Unit or Food was not found, you can click a button to accept an automatically suggested Food to add to the database. Or, manually enter the Unit/Food and hit `Enter` (or click `Create`) to add it to the database
12. When done, click `Save All` and you will be taken back to the recipe. Now the Unit and Food fields of the recipe should be filled out.
## How can I change the theme?
You can change the theme by settings the environment variables.
No. Due to limitations from the Javascript Framework, mealie doesn't support serving Mealie on a subpath.
## Can I install Mealie without docker?
Yes, you can install Mealie on your local machine. HOWEVER, it is recommended that you don't. Managing non-system versions of python, node, and npm is a pain. Moreover, updating and upgrading your system with this configuration is unsupported and will likely require manual interventions.
## What is fuzzy search and how do I use it?
Mealie can use fuzzy search, which is robust to minor typos. For example, searching for "brocolli" will still find your recipe for "broccoli soup". But fuzzy search is only functional on a Postgres database backend. To enable fuzzy search you will need to migrate to Postgres:
1. Backup your database and download the .zip file (same as when [migrating](./migrating-to-mealie-v1.md))
2. Set up a [Postgres](./installation/postgres.md) instance of Mealie
3. Upload the backup .zip and click to apply it (as as migration)
## How can I attach an image or video to a Recipe?
Mealie's Recipe Steps and other fields support markdown syntax and therefore support images and videos. To attach an image to the recipe, you can upload it as an asset and use the provided copy button to generate the html image tag required to render the image. For videos, Mealie provides no way to host videos. You'll need to host your videos with another provider and embed them in your recipe. Generally, the video provider will provide a link to the video and the html tag required to render the video. For example, YouTube provides the following link that works inside a step. You can adjust the width and height attributes as necessary to ensure a fit.
```html
<iframewidth="560"height="315"src="https://www.youtube.com/embed/nAUwKeO93bY"title="YouTube video player"frameborder="0"allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"allowfullscreen></iframe>
```
## How can I unlock my account?
If your account has been locked by bad password attempts, you can use an administrator account to unlock another account. Alternatively, you can unlock all accounts via a script within the container.
```shell
docker exec -it mealie-next bash
python /app/mealie/scripts/reset_locked_users.py
```
## How can I change my password?
You can change your password by going to the user profile page and clicking the "Change Password" button. Alternatively you can use the following script to change your password via the CLI if you are locked out of your account.
```shell
docker exec -it mealie-next bash
python /app/mealie/scripts/change_password.py
```
## How do private groups and recipes work?
Managing private groups and recipes can be confusing. The following diagram and notes should help explain how they work to determine if a recipe can be shared publicly.
- Private links that are generated from the recipe page using the `Share` button bypass all group and recipe permissions
- Private groups block all access to recipes, including those that are public, except as noted above.
- Groups with "Allow users outside of your group to see your recipes" disabled block all access to recipes, except as noted above.
- Private recipes block all access to the recipe from public links. This does not affect Private Links.
```mermaid
stateDiagram-v2
r1: Request Access
p1: Using Private Link?
p2: Is Group Private?
p3: Is Recipe Private?
s1: Deny Access
n1: Allow Access
Scaling up this recipe or adding it to a Shopping List will now smartly take care of ingredient amounts and duplicate combinations.
r1 --> p1
p1 --> p2: No
p1 --> n1: Yes
??? question "How do I enable Nutritional Values?"
p2 --> s1: Yes
p2 --> p3: No
### How do I enable Nutritional Values?
p3 --> s1: Yes
p3 --> n1: No
```
Mealie can store Nutritional Information for Recipes. Please note that the values you enter are static for the recipe and no scaling is being done when changing Servings / Yield.
For more information, check out the [Permissions and Public Access guide](./usage/permissions-and-public-access.md).
Do the following to enable Nutritional Values on individual Recipes, or to modify your Household Recipe Preferences
## Can I use fail2ban with mealie?
Yes, mealie is configured to properly forward external IP addresses into the `mealie.log` logfile. Note that due to restrictions in docker, IP address forwarding only works on Linux.
**Show Nutritional Values on a Single Recipe**
Your fail2ban usage should look like the following:
```
Use datepattern : %d-%b-%y %H:%M:%S : Day-MON-Year2 24hour:Minute:Second
Use failregex line : ^ERROR:\s+Incorrect username or password from <HOST>
```
1. Go to a recipe
2. Click the Edit button/icon
3. Click the Recipe Settings gear and select `Show Nutritional Values`
4. Scroll down to manually fill out the Nutritional Values
5. Save
## Why An API?
An API allows integration into applications like [Home Assistant](https://www.home-assistant.io/) that can act as notification engines to provide custom notifications based on Meal Plan data to remind you to defrost the chicken, marinade the steak, or start the CrockPot. Additionally, you can access nearly any backend service via the API giving you total control to extend the application. To explore the API spin up your server and navigate to http://yourserver.com/docs for interactive API documentation.
**Show Nutritional Values by default**
## Why a Database?
Some users of static-site generator applications like ChowDown have expressed concerns about their data being stuck in a database. Considering this is a new project, it is a valid concern to be worried about your data. Mealie specifically addresses this concern by provided automatic daily backups that export your data in json, plain-text markdown files, and/or custom Jinja2 templates. **This puts you in control of how your data is represented** when exported from Mealie, which means you can easily migrate to any other service provided Mealie doesn't work for you.
1. Click your username in the top left
2. Click the 'Household Settings' button
3. Under 'Household Recipe Preferences', click to select 'Show nutrition information'
4. Click 'Update'
As to why we need a database?
- **Developer Experience:** Without a database, a lot of the work to maintain your data is taken on by the developer instead of a battle-tested platform for storing data.
- **Multi User Support:** With a solid database as backend storage for your data, Mealie can better support multi-user sites and avoid read/write access errors when multiple actions are taken at the same time.
??? question "Why Link Ingredients to a Recipe Step?"
### Why Link Ingredients to a Recipe Step?
Mealie allows you to link ingredients to specific steps in a recipe, ensuring you know exactly when to add each ingredient during the cooking process.
**Link Ingredients to Steps in a Recipe**
1. Go to a recipe
2. Click the Edit button/icon
3. Scroll down to the step you want to link ingredients to
4. Click the ellipsis button next to the step and click 'Link Ingredients'
5. Check off the Ingredient(s) that you want to link to that step
6. Optionally, click 'Next step' to continue linking remaining ingredients to steps, or click 'Save' to Finish
7. Click 'Save' on the Recipe
You can optionally link the same ingredient to multiple steps, which is useful for prepping an ingredient in one step and using it in another.
??? question "What is fuzzy search and how do I use it?"
### What is fuzzy search and how do I use it?
Mealie can use fuzzy search, which is robust to minor typos. For example, searching for "brocolli" will still find your recipe for "broccoli soup". But fuzzy search is only functional on a Postgres database backend. To enable fuzzy search you will need to migrate to Postgres:
1. Backup your database and download the .zip file (same as when [migrating](./migrating-to-mealie-v1.md))
2. Set up a [Postgres](./installation/postgres.md) instance of Mealie
3. Upload the backup .zip and click to apply it (as as migration)
??? question "How can I attach an image or video to a Recipe?"
### How can I attach an image or video to a Recipe?
Mealie's Recipe Steps and other fields support markdown syntax and therefore support images and videos. To attach an image to the recipe, you can upload it as an asset and use the provided copy button to generate the html image tag required to render the image. For videos, Mealie provides no way to host videos. You'll need to host your videos with another provider and embed them in your recipe. Generally, the video provider will provide a link to the video and the html tag required to render the video. For example, YouTube provides the following link that works inside a step. You can adjust the width and height attributes as necessary to ensure a fit.
No. Due to limitations from the JavaScript Framework, Mealie doesn't support serving Mealie on a subpath.
??? question "Can I install Mealie without docker?"
### Can I install Mealie without docker?
Yes, you can install Mealie on your local machine. HOWEVER, it is recommended that you don't. Managing non-system versions of python, node, and npm is a pain. Moreover, updating and upgrading your system with this configuration is unsupported and will likely require manual interventions.
## Account Management
??? question "How can I unlock my account?"
### How can I unlock my account?
If your account has been locked by bad password attempts, you can use an administrator account to unlock another account. Alternatively, you can unlock all accounts via a script within the container.
You can change your password by going to the user profile page and clicking the "Change Password" button. Alternatively you can use the following script to change your password via the CLI if you are locked out of your account.
??? question "I can't log in with external auth. How can I change my authentication method?"
### I can't log in with external auth. How can I change my authentication method?
Follow the [steps above](#how-can-i-change-my-password) for changing your password. You will be prompted if you would like to switch your authentication method back to local auth so you can log in again.
## Collaboration and Privacy
??? question "How do private groups, households, and recipes work?"
### How do private groups, households, and recipes work?
Managing private groups and recipes can be confusing. The following diagram and notes should help explain how they work to determine if a recipe can be shared publicly.
- Private links that are generated from the recipe page using the `Share` button bypass all group and recipe permissions
- Private groups block all access to recipes, including those that are public, except as noted above.
- Private households, similar to private groups, block all access to recipes, except as noted above.
- Households with "Allow users outside of your group to see your recipes" disabled block all access to recipes, except as noted above.
- Private recipes block all access to the recipe from public links. This does not affect Private Links.
```mermaid
stateDiagram-v2
r1: Request Access
p1: Using Private Link?
p2: Is Group Private?
p3: Is Household Private?
p4: Is Recipe Private?
s1: Deny Access
n1: Allow Access
r1 --> p1
p1 --> p2: No
p1 --> n1: Yes
p2 --> s1: Yes
p2 --> p3: No
p3 --> s1: Yes
p3 --> p4: No
p4 --> s1: Yes
p4 --> n1: No
```
For more information on public access, check out the [Permissions and Public Access guide](./usage/permissions-and-public-access.md). For more information on groups vs. households, check out the [Groups and Households](./features.md#groups-and-households) section in the Features guide.
## Security and Maintenance
??? question "How can I use Mealie externally?"
### How can I use Mealie externally
Exposing Mealie or any service to the internet can pose significant security risks. Before proceeding, carefully evaluate the potential impacts on your system. Due to the unique nature of each network, we cannot provide specific steps for your setup.
There is a community guide available for one way to potentially set this up, and you could reach out on Discord for further discussion on what may be best for your network.
??? question "Can I use fail2ban with Mealie?"
### Can I use fail2ban with Mealie?
Yes, Mealie is configured to properly forward external IP addresses into the `mealie.log` logfile. Note that due to restrictions in docker, IP address forwarding only works on Linux.
Your fail2ban usage should look like the following:
```
Use datepattern : %d-%b-%y %H:%M:%S : Day-MON-Year2 24hour:Minute:Second
Use failregex line : ^ERROR:\s+Incorrect username or password from <HOST>
```
??? question "Is it safe to upgrade Mealie?"
### Is it safe to upgrade Mealie?
Yes. If you are using the v1 branches (including beta), you can upgrade to the latest version of Mealie without performing a site Export/Restore. This process was required in previous versions of Mealie, however we've automated the database migration process to make it easier to upgrade. Note that if you were using the v0.5.x version, you CANNOT upgrade to the latest version automatically. You must follow the migration instructions in the documentation.
- [Migration From v0.5.x](./migrating-to-mealie-v1.md)
## Technical Considerations
??? question "Why setup Email?"
### Why setup Email?
Mealie uses email to send account invites and password resets. If you don't use these features, you don't need to set up email. There are also other methods to perform these actions that do not require the setup of Email.
Email settings can be adjusted via environment variables on the backend container:
Note that many email providers (e.g., Gmail, Outlook) are disabling SMTP Auth and requiring Modern Auth, which Mealie currently does not support. You may need to use an SMTP relay or third-party SMTP provider, such as SMTP2GO.
??? question "Why an API?"
### Why an API?
An API allows integration into applications like [Home Assistant](https://www.home-assistant.io/) that can act as notification engines to provide custom notifications based on Meal Plan data to remind you to defrost the chicken, marinate the steak, or start the CrockPot. Additionally, you can access nearly any backend service via the API giving you total control to extend the application. To explore the API spin up your server and navigate to http://yourserver.com/docs for interactive API documentation.
??? question "Why a database?"
### Why a database?
Some users of static-site generator applications like ChowDown have expressed concerns about their data being stuck in a database. Considering this is a new project, it is a valid concern to be worried about your data. Mealie specifically addresses this concern by providing automatic daily backups that export your data in json, plain-text markdown files, and/or custom Jinja2 templates. **This puts you in control of how your data is represented** when exported from Mealie, which means you can easily migrate to any other service provided Mealie doesn't work for you.
As to why we need a database?
- **Developer Experience:** Without a database, a lot of the work to maintain your data is taken on by the developer instead of a battle-tested platform for storing data.
- **Multi User Support:** With a solid database as backend storage for your data, Mealie can better support multi-user sites and avoid read/write access errors when multiple actions are taken at the same time.
## Usability
??? question "Why is there no 'Keep Screen Alive' button when I access a recipe?"
### Why is there no "Keep Screen Alive" button when I access a recipe?
You've perhaps visited the Mealie Demo and noticed that it had a "Keep Screen Alive" button, but it doesn't show up in your own Mealie instance.
There are typically two possible reasons for this:
1. You're accessing your Mealie instance without using HTTPS. The Wake Lock API is only available if HTTPS is used. Read more here: https://developer.mozilla.org/en-US/docs/Web/API/Screen_Wake_Lock_API
2. You're accessing your Mealie instance on a browser which doesn't support the API. You can test this here: https://vueuse.org/core/useWakeLock/#demo
Solving the above points will most likely resolve your issues. However, if you're still having problems, you are welcome to create an issue. Just remember to add that you've tried the above two options first in your description.
@@ -14,10 +14,15 @@ Mealie offers two main ways to create recipes. You can use the integrated recipe
Mealie supports importing recipes from a few other sources besides websites. Currently the following sources are supported:
-Mealie Pre v1
-Tandoor
- Nextcloud Cookbooks
- Paprika
- Chowdown
- Plan to Eat
- Recipe Keeper
- Copy Me That
- My Recipe Box
- DVO Cook'n X3
You can access these options on your installation at the `/group/migrations` page on your installation. If you'd like to see another source added, feel free to request so on Github.
@@ -31,8 +36,7 @@ Mealie has a robust and flexible recipe organization system with a few different
#### Categories
Categories are the overarching organizer for recipes. You can assign as many categories as you'd like to a recipe, but we recommend that you try to limit the categories you assign to a recipe to one or two. This helps keep categories as focused as possible while still allowing you to find recipes that are related to each other. For example, you might assign a recipe to the category **Breakfast**, **Lunch**, **Dinner**, or **Side**.
Categories are the overarching organizer for recipes. You can assign as many categories as you'd like to a recipe, but we recommend that you try to limit the categories you assign to a recipe to one or two. This helps keep categories as focused as possible while still allowing you to find recipes that are related to each other. For example, you might assign a recipe to the category **Breakfast**, **Lunch**, **Dinner**, **Side**, or **Drinks**.
@@ -69,24 +73,103 @@ Mealie uses a calendar like view to help you plan your meals. It shows you the p
!!! tip
You can also add a "Note" type entry to your meal-plan when you want to include something that might not have a specific recipes. This is great for leftovers, or for ordering out.
The meal planner has the concept of plan rules. These offer a flexible way to use your organizers to customize how a random recipe is inserted into your meal plan. You can set rules to restrict the pool of recipes based on the Tags and/or Categories of a recipe. Additionally, since meal plans have a Breakfast, Lunch, Dinner, and Snack labels, you can specifically set a rule to be active for a **specific meal type** or even a **specific day of the week.**
The shopping lists feature is a great way to keep track of what you need to buy for your next meal. You can add items directly to the shopping list or link a recipe and all of it's ingredients to track meals during the week.
!!! warning
At this time there isn't a tight integration between meal-plans and shopping lists; however, it's something we have planned for the future.
Managing shopping lists can be done from the Sidebar > Shopping Lists.
Here you will be able to:
- See items already on the Shopping List
- See linked recipes with ingredients
- Toggling via the 'Pot' icon will show you the linked recipe, allowing you to click to access it.
- Check off an item
- Add / Change / Remove / Sort Items via the grid icon
- Be sure if you are modifying an ingredient to click the 'Save' icon.
- Add / Change / Remove / Sort Labels
- 'No Label' will always be on the top, others can be Reordered via the 'Reorder Labels' button
!!! tip
If you accidentally checked off an item, you can uncheck it by expanding 'items checked' and unchecking it. This will add it back to the Shopping List.
!!! tip
You can use Labels to categorize your ingredients. You may want to Label by Food Type (Frozen, Fresh, etc), by Store, Tool, Recipe, or more. Play around with this to see what works best for you.
!!! tip
You can toggle 'Food' on items so that if you add multiple of the same food / ingredient, Mealie will automatically combine them together. Do this by editing an item in the Shopping List and clicking the 'Apple' icon. If you then have recipes that contain "1 | cup | cheese" and "2 | cup | cheese" this would be combined to show "3 cups of cheese."
[See FAQ for more information](../getting-started/faq.md)
[Shopping List Demo](https://demo.mealie.io/shopping-lists){ .md-button .md-button--primary }
## Integrations
Mealie is designed to integrate with many different external services. There are several ways you can integrate with Mealie to achieve custom IoT automations, data synchronization, and anything else you can think of. [You can work directly with Mealie through the API](./api-usage.md), or leverage other services to make seamless integrations.
### Notifiers
Notifiers are event-driven notifications sent when specific actions are performed within Mealie. Some actions include:
- Creating / Updating a recipe
- Adding items to a shopping list
- Creating a new mealplan
Notifiers use the [Apprise library](https://github.com/caronc/apprise/wiki), which integrates with a large number of notification services. In addition, certain custom notifiers send basic event data to the consumer (e.g. the `id` of the resource). These include:
Unlike notifiers, which are event-driven notifications, Webhooks allow you to send scheduled notifications to your desired endpoint. Webhooks are sent on the day of a scheduled mealplan, at the specified time, and contain the mealplan data in the request.
Recipe Actions are custom actions you can add to all recipes in Mealie. This is a great way to add custom integrations that are fired manually. There are two types of recipe actions:
1. link - these actions will take you directly to an external page. Merge fields can be used to customize the URL for each recipe
2. post - these actions will send a `POST` request to the specified URL, with the recipe JSON in the request body. These can be used, for instance, to manually trigger a webhook in Home Assistant
When using the "link" action type, Recipe Action URLs can include merge fields to inject the current recipe's data. For instance, you can use the following URL to include a Google search with the recipe's slug:
```
https://www.google.com/search?q=${slug}
```
When the action is clicked on, the `${slug}` field is replaced with the recipe's slug value. So, for example, it might take you to this URL on one of your recipes:
```
https://www.google.com/search?q=pasta-fagioli
```
A common use case for "link" recipe actions is to integrate with the Bring! shopping list. Simply add a Recipe Action with the following URL:
Mealie lets you fully customize how you organize your users. You can use Groups to host multiple instances (or tenants) of Mealie which are completely isolated from each other. Within each Group you can organize users into Households which allow users to share recipes, but keep other items separate (e.g. meal plans and shopping lists).
### Groups
Groups are fully isolated instances of Mealie. Think of a goup as a completely separate, fully self-contained site. There is no data shared between groups. Each group has its own users, recipes, tags, categories, etc. A user logged-in to one group cannot make any changes to another.
Common use cases for groups include:
- Hosting multiple instances of Mealie for others who want to keep their data private and secure
- Creating completely isolated recipe pools
### Households
Households are subdivisions within a single Group. Households maintain their own users and settings, while sharing their recipes with other households. Households also share organizers (tags, categories, etc.) with the entire group. Meal Plans, Shopping Lists, and Integrations are only accessible within a household.
Common use cases for households include:
- Sharing a common recipe pool amongst families
- Maintaining separate meal plans and shopping lists from other households
- Maintaining separate integrations and customizations from other households
| SQLITE_MIGRATE_JOURNAL_WAL | False | If set to true, switches SQLite's journal mode to WAL, which allows for multiple concurrent accesses. This can be useful when you have a decent amount of concurrency or when using certain remote storage systems such as Ceph. |
| POSTGRES_USER<super>[†][secrets]</super> | mealie | Postgres database user |
| SMTP_USER<super>[†][secrets]</super> | None | Required if SMTP_AUTH_STRATEGY is 'TLS' or 'SSL' |
| SMTP_PASSWORD<super>[†][secrets]</super> | None | Required if SMTP_AUTH_STRATEGY is 'TLS' or 'SSL' |
### Webworker
Changing the webworker settings may cause unforeseen memory leak issues with Mealie. It's best to leave these at the defaults unless you begin to experience issues with multiple users. Exercise caution when changing these settings
| WEB_GUNICORN |false | Enables Gunicorn to manage Uvicorn web for multiple works |
| WORKERS_PER_CORE | 1 | Set the number of workers to the number of CPU cores multiplied by this value (Value \* CPUs). More info [here][workers_per_core] |
| MAX_WORKERS | None | Set the maximum number of workers to use. Default is not set meaning unlimited. More info [here][max_workers] |
| WEB_CONCURRENCY | 2 | Override the automatic definition of number of workers. More info [here][web_concurrency] |
| LDAP_TLS_INSECURE | False | Do not verify server certificate when using secure LDAP |
| LDAP_TLS_CACERTFILE | None | File path to Certificate Authority used to verify server certificate (e.g. `/path/to/ca.crt`) |
| LDAP_ENABLE_STARTTLS | False | Optional. Use STARTTLS to connect to the server |
| LDAP_BASE_DN | None | Starting point when searching for users authentication (e.g. `CN=Users,DC=xx,DC=yy,DC=de`) |
| LDAP_QUERY_BIND | None | Optional bind user for LDAP search queries (e.g. `cn=admin,cn=users,dc=example,dc=com`). If `None` then anonymous bind will be used |
| LDAP_QUERY_PASSWORD | None | Optional password for the bind user used in LDAP_QUERY_BIND |
| LDAP_USER_FILTER | None | Optional LDAP filter to narrow down eligible users (e.g. `(memberOf=cn=mealie_user,dc=example,dc=com)`) |
| LDAP_ADMIN_FILTER | None | Optional LDAP filter, which tells Mealie the LDAP user is an admin (e.g. `(memberOf=cn=admins,dc=example,dc=com)`) |
| LDAP_ID_ATTRIBUTE | uid | The LDAP attribute that maps to the user's id |
| LDAP_NAME_ATTRIBUTE | name | The LDAP attribute that maps to the user's name |
| LDAP_MAIL_ATTRIBUTE | mail | The LDAP attribute that maps to the user's email |
| LDAP_TLS_INSECURE | False | Do not verify server certificate when using secure LDAP |
| LDAP_TLS_CACERTFILE | None | File path to Certificate Authority used to verify server certificate (e.g. `/path/to/ca.crt`) |
| LDAP_ENABLE_STARTTLS | False | Optional. Use STARTTLS to connect to the server |
| LDAP_BASE_DN | None | Starting point when searching for users authentication (e.g. `CN=Users,DC=xx,DC=yy,DC=de`) |
| LDAP_QUERY_BIND | None | Optional bind user for LDAP search queries (e.g. `cn=admin,cn=users,dc=example,dc=com`). If `None` then anonymous bind will be used |
| LDAP_QUERY_PASSWORD<super>[†][secrets]</super> | None | Optional password for the bind user used in LDAP_QUERY_BIND |
| LDAP_USER_FILTER | None | Optional LDAP filter to narrow down eligible users (e.g. `(memberOf=cn=mealie_user,dc=example,dc=com)`) |
| LDAP_ADMIN_FILTER | None | Optional LDAP filter, which tells Mealie the LDAP user is an admin (e.g. `(memberOf=cn=admins,dc=example,dc=com)`) |
| LDAP_ID_ATTRIBUTE | uid | The LDAP attribute that maps to the user's id |
| LDAP_NAME_ATTRIBUTE | name | The LDAP attribute that maps to the user's name |
| LDAP_MAIL_ATTRIBUTE | mail | The LDAP attribute that maps to the user's email |
### Themeing
### OpenID Connect (OIDC)
:octicons-tag-24: v1.4.0
For usage, see [Usage - OpenID Connect](../authentication/oidc-v2.md)
| OIDC_SIGNUP_ENABLED | True | Enables new users to be created when signing in for the first time with OIDC |
| OIDC_CONFIGURATION_URL<super>[†][secrets]</super> | None | The URL to the OIDC configuration of your provider. This is usually something like https://auth.example.com/.well-known/openid-configuration |
| OIDC_CLIENT_ID<super>[†][secrets]</super> | None | The client id of your configured client in your provider |
| OIDC_CLIENT_SECRET<super>[†][secrets]</super> <br/> :octicons-tag-24: v2.0.0 | None | The client secret of your configured client in your provider |
| OIDC_USER_GROUP | None | If specified, only users belonging to this group will be able to successfully authenticate, regardless of the `OIDC_ADMIN_GROUP`. For more information see [this page](../authentication/oidc.md#groups) |
| OIDC_ADMIN_GROUP | None | If specified, users belonging to this group will be made an admin. For more information see [this page](../authentication/oidc.md#groups) |
| OIDC_AUTO_REDIRECT | False | If `True`, then the login page will be bypassed an you will be sent directly to your Identity Provider. You can still get to the login page by adding `?direct=1` to the login URL |
| OIDC_PROVIDER_NAME | OAuth | The provider name is shown in SSO login button. "Login with <OIDC_PROVIDER_NAME\>" |
| OIDC_REMEMBER_ME | False | Because redirects bypass the login screen, you cant extend your session by clicking the "Remember Me" checkbox. By setting this value to true, a session will be extended as if "Remember Me" was checked |
| OIDC_SIGNING_ALGORITHM | RS256 | The algorithm used to sign the id token (examples: RS256, HS256) |
| OIDC_USER_CLAIM | email | This is the claim which Mealie will use to look up an existing user by (e.g. "email", "preferred_username") |
| OIDC_NAME_CLAIM | name | This is the claim which Mealie will use for the users Full Name |
| OIDC_GROUPS_CLAIM | groups | Optional if not using `OIDC_USER_GROUP` or `OIDC_ADMIN_GROUP`. This is the claim Mealie will request from your IdP and will use to compare to `OIDC_USER_GROUP` or `OIDC_ADMIN_GROUP` to allow the user to log in to Mealie or is set as an admin. **Your IdP must be configured to grant this claim** |
| OIDC_SCOPES_OVERRIDE | None | Advanced configuration used to override the scopes requested from the IdP. **Most users won't need to change this**. At a minimum, 'openid profile email' are required. |
| OIDC_TLS_CACERTFILE | None | File path to Certificate Authority used to verify server certificate (e.g. `/path/to/ca.crt`) |
### OpenAI
:octicons-tag-24: v1.7.0
Mealie supports various integrations using OpenAI. For more information, check out our [OpenAI documentation](./open-ai.md).
For custom mapping variables (e.g. OPENAI_CUSTOM_HEADERS) you should pass values as JSON encoded strings (e.g. `OPENAI_CUSTOM_PARAMS='{"k1": "v1", "k2": "v2"}'`)
| OPENAI_BASE_URL<super>[†][secrets]</super> | None | The base URL for the OpenAI API. If you're not sure, leave this empty to use the standard OpenAI platform |
| OPENAI_API_KEY<super>[†][secrets]</super> | None | Your OpenAI API Key. Enables OpenAI-related features |
| OPENAI_MODEL | gpt-4o | Which OpenAI model to use. If you're not sure, leave this empty |
| OPENAI_CUSTOM_HEADERS | None | Custom HTTP headers to add to all OpenAI requests. This should generally be left empty unless your custom service requires them |
| OPENAI_CUSTOM_PARAMS | None | Custom HTTP query params to add to all OpenAI requests. This should generally be left empty unless your custom service requires them |
| OPENAI_ENABLE_IMAGE_SERVICES | True | Whether to enable OpenAI image services, such as creating recipes via image. Leave this enabled unless your custom model doesn't support it, or you want to reduce costs |
| OPENAI_WORKERS | 2 | Number of OpenAI workers per request. Higher values may increase processing speed, but will incur additional API costs |
| OPENAI_SEND_DATABASE_DATA | True | Whether to send Mealie data to OpenAI to improve request accuracy. This will incur additional API costs |
| OPENAI_REQUEST_TIMEOUT | 300 | The number of seconds to wait for an OpenAI request to complete before cancelling the request. Leave this empty unless you're running into timeout issues on slower hardware |
### Theming
Setting the following environmental variables will change the theme of the frontend. Note that the themes are the same for all users. This is a break-change when migration from v0.x.x -> 1.x.x.
| THEME_DARK_PRIMARY | #E58325 | Dark Theme Config Variable |
| THEME_DARK_ACCENT | #007A99 | Dark Theme Config Variable |
| THEME_DARK_SECONDARY | #973542 | Dark Theme Config Variable |
| THEME_DARK_SUCCESS | #43A047 | Dark Theme Config Variable |
| THEME_DARK_INFO | #1976D2 | Dark Theme Config Variable |
| THEME_DARK_WARNING | #FF6D00 | Dark Theme Config Variable |
| THEME_DARK_ERROR | #EF5350 | Dark Theme Config Variable |
!!! info
If you're setting these variables but not seeing these changes persist, try removing the `#` character. Also, depending on which syntax you're using, double-check you're using quotes correctly.
If using YAML mapping syntax, be sure to include quotes around these values, otherwise they will be treated as comments in your YAML file:<br>`THEME_LIGHT_PRIMARY: '#E58325'` or `THEME_LIGHT_PRIMARY: 'E58325'`
If using YAML sequence syntax, don't include any quotes:<br>`THEME_LIGHT_PRIMARY=#E58325` or `THEME_LIGHT_PRIMARY=E58325`
| THEME_DARK_ERROR | #EF5350 | Error messages and alerts |
#### Theming Examples
The examples below provide copy-ready Docker Compose environment configurations for three different color palettes. Copy and paste the desired theme into your `docker-compose.yml` file's environment section.
!!! info
These themes are functional and ready to use, but they are provided primarily as examples. The color palettes can be adjusted or refined to better suit your preferences.
=== "Blue Theme"
```yaml
environment:
# Light mode colors
THEME_LIGHT_PRIMARY: '#5E9BD1'
THEME_LIGHT_ACCENT: '#A3C9E8'
THEME_LIGHT_SECONDARY: '#4F89BA'
THEME_LIGHT_SUCCESS: '#4CAF50'
THEME_LIGHT_INFO: '#4A9ED8'
THEME_LIGHT_WARNING: '#EAC46B'
THEME_LIGHT_ERROR: '#E57373'
# Dark mode colors
THEME_DARK_PRIMARY: '#5A8FBF'
THEME_DARK_ACCENT: '#90B8D9'
THEME_DARK_SECONDARY: '#406D96'
THEME_DARK_SUCCESS: '#81C784'
THEME_DARK_INFO: '#78B2C0'
THEME_DARK_WARNING: '#EBC86E'
THEME_DARK_ERROR: '#E57373'
```
=== "Green Theme"
```yaml
environment:
# Light mode colors
THEME_LIGHT_PRIMARY: '#75A86C'
THEME_LIGHT_ACCENT: '#A8D0A6'
THEME_LIGHT_SECONDARY: '#638E5E'
THEME_LIGHT_SUCCESS: '#4CAF50'
THEME_LIGHT_INFO: '#4A9ED8'
THEME_LIGHT_WARNING: '#EAC46B'
THEME_LIGHT_ERROR: '#E57373'
# Dark mode colors
THEME_DARK_PRIMARY: '#739B7A'
THEME_DARK_ACCENT: '#9FBE9D'
THEME_DARK_SECONDARY: '#56775E'
THEME_DARK_SUCCESS: '#81C784'
THEME_DARK_INFO: '#78B2C0'
THEME_DARK_WARNING: '#EBC86E'
THEME_DARK_ERROR: '#E57373'
```
=== "Pink Theme"
```yaml
environment:
# Light mode colors
THEME_LIGHT_PRIMARY: '#D97C96'
THEME_LIGHT_ACCENT: '#E891A7'
THEME_LIGHT_SECONDARY: '#C86C88'
THEME_LIGHT_SUCCESS: '#4CAF50'
THEME_LIGHT_INFO: '#2196F3'
THEME_LIGHT_WARNING: '#FFC107'
THEME_LIGHT_ERROR: '#E57373'
# Dark mode colors
THEME_DARK_PRIMARY: '#C2185B'
THEME_DARK_ACCENT: '#FF80AB'
THEME_DARK_SECONDARY: '#AD1457'
THEME_DARK_SUCCESS: '#81C784'
THEME_DARK_INFO: '#64B5F6'
THEME_DARK_WARNING: '#FFD54F'
THEME_DARK_ERROR: '#E57373'
```
### Docker Secrets
> <super>†</super> Starting in version `2.4.2`, any environment variable in the preceding lists with a dagger
> symbol next to them support the Docker Compose secrets pattern, below.
[Docker Compose secrets][docker-secrets] can be used to secure sensitive information regarding the Mealie implementation
by managing control of each secret independently from the single `.env` file. This is helpful for users that may need
different levels of access for various, sensitive environment variables, such as differentiating between hardening
operations (e.g., server endpoints and ports) and user access control (e.g., usernames, passwords, and API keys).
To convert any of these environment variables to a Docker Compose secret, append `_FILE` to the environment variable and
connect it with a Docker Compose secret, per the [Docker documentation][docker-secrets].
If both the base environment variable and the secret pattern of the environment variable are set, the secret will always
take precedence.
For example, a user that wishes to harden their operations by only giving some access to their database URL, but who
wish to place additional security around their user access control, may have a Docker Compose configuration similar to:
@@ -31,7 +31,7 @@ To deploy mealie on your local network, it is highly recommended to use Docker t
We've gone through a few versions of Mealie v1 deployment targets. We have settled on a single container deployment, and we've begun publishing the nightly container on github containers. If you're looking to move from the old nightly (split containers _or_ the omni image) to the new nightly, there are a few things you need to do:
1. Take a backup just in case!
2. Replace the image for the API container with `ghcr.io/mealie-recipes/mealie:v1.0.0-RC1.1`
2. Replace the image for the API container with `ghcr.io/mealie-recipes/mealie:v3.8.0`
3. Take the external port from the frontend container and set that as the port mapped to port `9000` on the new container. The frontend is now served on port 9000 from the new container, so it will need to be mapped for you to have access.
4. Restart the container
@@ -58,16 +58,16 @@ The following steps were tested on a Ubuntu 20.04 server, but should work for mo
4. Create a docker-compose.yaml file in the mealie directory: `touch docker-compose.yaml`
5. Use the text editor of your choice to edit the file and copy the contents of the docker-compose template for the deployment type you want to use: `nano docker-compose.yaml` or `vi docker-compose.yaml`
## Step 2: Customizing The `docker-compose.yaml` files.
## Step 3: Customizing The `docker-compose.yaml` files.
After you've decided setup the files it's important to set a few ENV variables to ensure that you can use all the features of Mealie. I recommend that you verify and check that:
After you've decided how to setup your files, it's important to set a few ENV variables to ensure that you can use all the features of Mealie. Verify that:
- [x] You've configured the relevant ENV variables for your database selection in the `docker-compose.yaml` files.
- [x] You've configured the [SMTP server settings](./backend-config.md#email) (used for invitations, password resets, etc). You can setup a [google app password](https://support.google.com/accounts/answer/185833?hl=en) if you want to send email via gmail.
- [x] You've set the [`BASE_URL`](./backend-config.md#general) variable.
- [x] You've set the `DEFAULT_EMAIL` and `DEFAULT_GROUP` variable.
- [x] You've set the `DEFAULT_EMAIL`, `DEFAULT_GROUP`, and `DEFAULT_HOUSEHOLD` variables.
## Step 3: Startup
## Step 4: Startup
After you've configured your database and updated the `docker-compose.yaml` files, you can start Mealie by running the following command in the directory where you've added your `docker-compose.yaml`.
@@ -87,11 +87,11 @@ You should see the containers start up without error. You should now be able to
**Password:** MyPassword
## Step 4: Validate Installation
## Step 5: Validate Installation
After the startup is complete, you should see a login screen. Use the default credentials above to log in and navigate to `/admin/site-settings`. Here, you'll find a summary of your configuration details and their respective status. Before proceeding, you should validate that the configuration is correct. For any warnings or errors the page will display an error and notify you of what you need to verify.
## Step 5: Backup
## Step 6: Backup
While v1.0.0 is a great step to data-stability and security, it's not a backup. Mealie provides a full site data backup mechanism through the UI.
@@ -101,7 +101,7 @@ These backups are just plain .zip files that you can download from the UI or acc
### Docker Tags
See all available tags on [GitHub](https://github.com/mealie-recipes/mealie/pkgs/container/mealie). We do not currently publish new images to Dockerhub.
See all available tags on [GitHub](https://github.com/mealie-recipes/mealie/pkgs/container/mealie).
`ghcr.io/mealie-recipes/mealie:nightly`
@@ -117,7 +117,7 @@ The latest tag provides the latest released image of Mealie.
- Logs are written to `/app/data/mealie.log` by default in the container.
- Logs are also written to stdout and stderr.
- You can adjust the log level using the `LOG_LEVEL` environment variable.
## Configuration
Starting in v1.5.0 logging is now highly configurable. Using the `LOG_CONFIG_OVERRIDE` you can provide the application with a custom configuration to log however you'd like. This configuration file is based off the [Python Logging Config](https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig). It can be difficult to understand the configuration at first, so here are some resources to help get started.
- This [YouTube Video](https://www.youtube.com/watch?v=9L77QExPmI0) for a great walkthrough on the logging file format.
Mealie's OpenAI integration enables several features and enhancements throughout the application. To enable OpenAI features, you must have an account with OpenAI and configure Mealie to use the OpenAI API key (for more information, check out the [backend configuration](./backend-config.md#openai)).
## Configuration
For most users, supplying the OpenAI API key is all you need to do; you will use the regular OpenAI service with the default language model. Note that while OpenAI has a free tier, it's not sufficiently capable for Mealie (or most other production use cases). For more information, check out [OpenAI's rate limits](https://platform.openai.com/docs/guides/rate-limits). If you deposit $5 into your OpenAI account, you will be permanently bumped up to Tier 1, which is sufficient for Mealie. Cost per-request is dependant on many factors, but Mealie tries to keep token counts conservative.
Alternatively, if you have another service you'd like to use in-place of OpenAI, you can configure Mealie to use that instead, as long as it has an OpenAI-compatible API. For instance, a common self-hosted alternative to OpenAI is [Ollama](https://ollama.com/). To use Ollama with Mealie, change your `OPENAI_BASE_URL` to `http://localhost:11434/v1` (where `http://localhost:11434` is wherever you're hosting Ollama, and `/v1` enables the OpenAI-compatible endpoints). Note that you *must* provide an API key, even though it is ultimately ignored by Ollama.
If you wish to disable image recognition features (to save costs, or because your custom model doesn't support them) you can set `OPENAI_ENABLE_IMAGE_SERVICES` to `False`. For more information on what configuration options are available, check out the [backend configuration](./backend-config.md#openai).
## OpenAI Features
- The OpenAI Ingredient Parser can be used as an alternative to the NLP and Brute Force parsers. Simply choose the OpenAI parser while parsing ingredients (:octicons-tag-24: v1.7.0)
- When importing a recipe via URL, if the default recipe scraper is unable to read the recipe data from a webpage, the webpage contents will be parsed by OpenAI (:octicons-tag-24: v1.9.0)
- You can import an image of a written recipe, which is sent to OpenAI and imported into Mealie. The recipe can be hand-written or typed, as long as the text is in the picture. You can also optionally have OpenAI translate the recipe into your own language (:octicons-tag-24: v1.12.0)
When upgrading postgresql major versions, manual steps are required [Postgres#37](https://github.com/docker-library/postgres/issues/37).
PostgreSQL might be considered if you need to support many concurrent users. In addition, some features are only enabled on PostgreSQL, such as fuzzy search.
This page is a collection of security considerations for Mealie. It mostly deals with reported issues and how it's possible to mitigate them. Note that this page is for you to use as a guide for how secure you want to make your deployment. It's important to note that most of these will not apply to you, if you:
1. Run behind a VPN
2. Use a strong password
3. Disable Sign-Ups
4. Don't host for malicious users
Use your best judgement when deciding what to do.
## Denial of Service
By default, the API is **not** rate limited. This leaves Mealie open to a potential **Denial of Service Attack**. While it's possible to perform a **Denial of Service Attack** on any endpoint, there are a few key endpoints that are more vulnerable than others.
-`/api/recipes/create/url`
-`/api/recipes/{id}/image`
These endpoints are used to scrape data based off a user provided URL. It is possible for a malicious user to issue multiple requests to download an arbitrarily large external file (e.g a Debian ISO) and sufficiently saturate a CPU assigned to the container. While we do implement some protections against this by chunking the response, and using a timeout strategy, it's still possible to overload the CPU if an attacker issues multiple requests concurrently.
### Mitigation
If you'd like to mitigate this risk, we suggest that you rate limit the API in general, and apply strict rate limits to these endpoints. You can do this by utilizing a reverse proxy. See the following links to get started:
Given the nature of these APIs it's possible to perform a **Server Side Request Forgery** attack. This is where a malicious user can issue a request to an internal network resource, and potentially exfiltrate data. We _do_ perform some checks to mitigate access to resources within your network but at the end of the day, users of Mealie are allowed to trigger HTTP requests on **your server**.
### Mitigation
If you'd like to mitigate this risk, we suggest that you isolate the container that Mealie is running in to ensure that it's access to internal resources is limited only to what is required. _Note that Mealie does require access to the internet for recipe imports._ You might consider isolating Mealie from your home network entirely and only allowing access to the external internet.
<!-- Updating This? Be Sure to also update the Postgres Annotations -->
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.