• Welcome to the Chevereto User Community!

    Here, users from all over the world come together to learn, share, and collaborate on everything related to Chevereto. It's a place to exchange ideas, ask questions, and help improve the software.

    Please keep in mind:

    • This community is user-driven. Always be polite and respectful to others.
    • Support development by purchasing a Chevereto license, which also gives you priority support.
    • Go further by joining the Community Subscription for even faster response times and to help sustain this space

Work in progress Chevereto v4.4.0 announcement

Rodolfo

Rodolfo

👑 Chevereto Godlike
Chevereto Staff
Administrator
Hey there,

I’m confirming the ongoing development of Chevereto v4.4.0 (Vivaracho)
This version introduces multi-tenancy, a major feature that allows a single Chevereto installation to host and manage multiple independent sites under one shared core.

Each tenant keeps its own data, configuration, and identity, while benefiting from a common codebase and shared infrastructure. That means less duplication, easier scaling, and more consistent updates across every site. In other words, distributing Chevereto installations will be much cheaper, with better resource use, simpler deployment, and lower maintenance costs.

For service providers, multi-tenancy opens the door to offering hosted Chevereto services or managing multiple client sites from a single instance.

This release lays the foundation for Chevereto Cloud and sets the stage for a more scalable, sustainable, and accessible media hosting ecosystem.


Code: 
- Added support for multitenancy
- Added Tenants API
- Added Tenants CLI
- Added multi-user support on all editions
- Added last seen tracking for login cookies
- Added HMAC signatures for tokens and uploads
- Added cipher support for system variables (encryption)
- Added disabled web installation for service context
- Added "stats-rebuild" CLI command
- Added /powered-by route
- Fixed bug with albums created by guests
- Fixed invalid file checksum upload bug
- Merged images_hash table into images table
- Renamed "metrics" CLI command to "stats"
- Renamed "update" CLI command to "database-migrate"
- Updated password hashing to use Argon2id algorithm
 
Added last seen tracking for login cookies

This release adds tracking for "last seen at" datetime which will enable to display all sorts of related information like how many users are online. Thanks for the RFC.
 
Removed images_hash table (merged into images table)

The images_hash table is no longer needed as the delete_hash will be now stored under images table.
 
Added HMAC signature to tokens and uploads

We have added HMAC signature to tokens concerning login, confirmation tokens, and chunked uploading. This will prevent continuing the request or even hitting the database if the payload is not signed. We added a separate key for each subject 😉
 
Added "stat-rebuild" CLI command to recalculate stats

With Chevereto v4.4.0 you will be able to also re-build the application stats via CLI with the new stat-rebuild command. You can also do it via /dashboard as usual.

Code: 
app/bin/cli -C stat-rebuild
 
Renamed "metrics" CLI command to "stat"

To keep things sane, the metrics command has been renamed to stat.

Code: 
app/bin/cli -C stat
 
Added support for multitenancy

Multitenancy is the grand new addition on Chevereto v4.4. It introduces a completely new servicing layer that enables anyone to easily scale Chevereto to support multiple tenants. Whether you're offering Chevereto-based hosting or managing multiple websites for any purpose, this feature opens a new market where you can build, automate, and monetize Chevereto installations.

Check the Multitenancy documentation for a complete overview of this new feature.
 
Added /powered-by route

To support software self-preservation and transparency, a new /powered-by route has been introduced. This endpoint publicly indicates that the service operates using Chevereto software. It includes a disclaimer clarifying the runtime context and explicitly stating that Chevereto Software has no affiliation or responsibility for the content hosted by the instance.

In recent months, we've received a growing number of complaints and misuse reports directed toward Chevereto Software, even though the issues originated from third-party services using the software. This confusion arises because end users often can’t distinguish between Chevereto Software (the developer) and the independent operators running their own instances.

The /powered-by route provides a clear, verifiable way to identify the software behind a service while making it explicit that Chevereto has no operational or content-related involvement with these third-party instances.
 
Added multi-user support as a core feature

Multi-user support is now available on all editions, including chevereto/chevereto. This extends to roles, and guest (API, upload, etc), and it will suit more use cases.
 
Added cipher support for system variables (encryption)

We are now storing HMAC secret keys in the database, so we extended the cipher support for the system variables. These secrets are now encrypted.
 
Added Tenants CLI

Chevereto v4.4 introduces the Tenants CLI, available at app/bin/tenants, which allows you to manually manage your multi-tenant Chevereto infrastructure. With this tool you can:
  • Add, retrieve, edit, and delete tenants
  • Manage tenant cache
  • Handle plans and plan assignments
  • Run and supervise background job workers
  • Carry out updates across your tenant ecosystem
1763223244365.png
 
Added Tenants API

Chevereto v4.4 introduces the Tenants API, available at /api/4/_/, which allows you to remote control and manage your multi-tenant Chevereto infrastructure. With this tool, you can perform the same operations as the Tenants CLI but over HTTP, using an API key plus a private/public key pair for additional security.

Thanks to this, you can now shape any business on top of Chevereto multitenancy. The system is entirely config driven, allowing you to tailor it precisely for your audience, market, and needs. Whether you're launching a massive SaaS, a niche community platform, or a fully automated hosting product, the Tenants API empowers you to build it with precision, speed, and virtually unlimited scalability.
 
Updated password hashing to use Argon2id algorithm

Before Chevereto v4.4, password and API key hashing relied on the bcrypt algorithm. While solid, bcrypt has a significant limitation: it only processes the first 72 characters, silently ignoring the rest. For long, high-entropy secrets, this reduces the effective entropy of the stored hash.

Starting with Chevereto v4.4, all new hashes now use the Argon2id algorithm. Argon2id is a modern, memory-hard hashing function designed to resist GPU/ASIC cracking and avoid the issues inherent to bcrypt. It provides stronger security, better performance tuning, and is a far more suitable choice for Chevereto's use cases.
 
Added disabled web installation for service context

Added support for disabling the web installer when running in a service (SaaS) context. When the system is operating as SaaS or when tenant support is enabled, the web-based installation process is automatically blocked.
 
Renamed "update" CLI command to "database-migrate"

The update command is often interpreted as "application update" so in this new version the command is now database-migrate. The old update command is now alias for database-migrate.
 
You must log in or register to reply here.
Back
Top