Rename the Maintenance > Backup & Restore page to Backup & Support and
add a Support Bundle card. Download support runs the on-device
`support collect` tool, which gathers configuration, logs, routing,
interfaces, hardware inventory, and container and service status into a
single archive; the WebUI runs as root so the collection is complete.
The handler buffers the archive and only commits response headers once
collection succeeds, so a mid-collection failure is a clean error rather
than a truncated download. An optional password encrypts the bundle via
the tool's GPG support, fed on stdin so it never reaches the process
list. Collection blocks for up to a minute with no output, so the write
deadline is extended past the server's 15s WriteTimeout and nginx gets a
matching read timeout; the browser shows a "collecting" state and saves
the blob client-side using the server's filename.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New Diagnostics page under Maintenance runs ping, traceroute, mtr and
nmap with live output, plus a one-shot DNS lookup. A tab per tool
shares a target field, source-interface and address-family selectors,
and per-tool options; the field is focused on load and Enter runs the
active tool from any field.
Ping and traceroute stream their output line by line over SSE. mtr
runs --raw and its records are translated into a live hop table —
Loss%, Snt, Last, Avg, Best, Worst updating in place — running
continuously until Stop, or for a set number of cycles. nmap offers a
fixed set of scan profiles (quick, standard, service/version, host
discovery); a CIDR target sweeps a subnet.
Address family is forced with an explicit -4/-6 flag on the base
binary, so a dual-stack hostname no longer follows the system's
IPv6-first resolver preference on hosts that only have IPv4 routes.
The streamer hands the child a real OS pipe and reaps it on exit, so a
client disconnect (Stop closing the EventSource) kills the tool without
leaking processes. User input is guarded: targets reject a leading
dash and whitespace, the source interface is allow-listed against
configured interfaces, and arguments are always passed as a slice. The
target field keeps a history in localStorage.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New Logs page under Maintenance presents the on-disk syslog files
(messages, syslog, kern, auth, routing, firewall, upgrade, debug,
container, mail) with a tab per source and an (empty) chip for files
with no content.
The buffer loads the last 250 lines and pins to the bottom on open and
on tab change, with keyboard focus on the pane so PageUp/PageDown work
immediately. Load earlier pages back 250 lines at a time, preserving
the reader's scroll position as older lines fill in above; once the
current file is exhausted the button re-labels to "Load previous from
<rotation>" and walks back through rotated and gzipped archives.
Live tail streams new entries over SSE. The server runs tail -F -n 0
and debounces output; the client follows the bottom unless the reader
has scrolled up. A status pill shows connecting/live/disconnected.
nginx gets a no-buffering location for the tail stream, mirroring the
software progress endpoint.
Download returns the full archive — current file plus every rotated and
gzipped predecessor — concatenated chronologically.
Severity is coloured by a keyword heuristic since sysklogd writes no
<PRI> to disk; BSD-format lines are shown unconditionally. Filter is
client-side substring or /regex/, focusable with Ctrl/Cmd-F.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
GET /keystore was just an http.Redirect to /configure/keystore — no
actual status view ever existed; the link landed users in Configure
and folded the Status group on the way, which was confusing.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Vendor a Lucide icon set under static/img/icons/ and partial:ize the
inline SVGs across base, login, firmware, sidebar, and yang-tree.
Reorganize the sidebar with mirrored Status/Configure section labels.
Rename NACM to Users & Groups and Firmware to Software; swap Routes and
Routing between Status and Configure.
Split Configure > System into General, NTP Client, and DNS Client pages,
which opens up for relocating the Set Time RPC from the Maintenance
section to a new Date & Time card in the System General config page.
Update browser tab title on htmx navigation via an HX-Trigger
setPageTitle event; encode the payload as 7-bit ASCII so the middle
dot in "Page · Context" survives header transit.
Add missing hover-help ⓘ icons to bridge port configuration, and adjust
their alignment slightly. While in interface configuration:
- fix the annoying Save => collapse so one can edit multiple
interface sections without having to re-expand the iface
- add missing dhcpv4 settings
- add missing custom mac (use advanced view for other settings)
- clean up Save button mess (consolidate)
Rename Firmware -> Software everywhere in the Maintenance section and
fix "Install progress stuck at 10%" issue.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Status overview gains a Speed column reading ietf-interfaces:speed +
ethernet/duplex. Interface detail page surfaces PHY type, PMD type,
supported and advertised PMDs.
Configure > Interfaces gains a per-row Ethernet panel: auto-negotiation
toggle, advertised PMDs picker, duplex tri-state, mdi-x tri-state. Each
has a reset-to-YANG-default button. Backend writes leaf-by-leaf via
PATCH+DELETE since a single PUT silently drops the duplex leaf.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds an nginx-side rate limit on POST /login so a brute-force or DoS
attempt can't pin the box on the bcrypt-shaped credential check inside
rousette/PAM. Configuration:
- Keyed on $binary_remote_addr (per source IP), 5 requests/minute
sustained with a burst of 3 nodelay, a real user fumbling their
password three times in a row sails through; the 4th attempt in
the same window returns 429.
- GET /login is unmetered (the keyed map yields the empty string,
which limit_req treats as "no key, no limit"), so a 401-driven
HX-Redirect bouncing the user back to the login page doesn't
eat into the budget.
- 32k zone (~500 IPs, the minimum nginx accepts). At cache
saturation an attacker rotating addresses still tops out around
~2500 attempts/min, all serialised through bcrypt one at a time.
- 429 instead of the default 503 keeps the response out of the
/50x.html error_page rewrite (which auto-refreshes and would
loop a throttled client straight back to /login).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The webui Go code now lives in the infix source tree rather than being
imported as an external module. Switch the module path to match that
reality so the imports read coherently with the rest of the codebase.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
renderSaveError lost the HX-Trigger header during the Configure-mode
fold, leaving forms with hx-swap="none" silent on validation errors.
Re-emit `{"cfgError":...}` so the toast layer still gets the event.
DeleteKey's response goes back to a bare 200 to match the other
configure_users.go endpoints; the activity-log redirect form belongs
on the Add/Edit flows.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The "Running config has unsaved changes" banner kept showing after a
power cycle even though the device reloaded running from startup at
boot. The cookie was just "1" with a 24-hour MaxAge, so the browser
held on to it and the banner stayed up — but the state it referred to
was long gone.
Carry a unix timestamp in the cookie value (when set) and compare
against a webuiStartTime captured at process start. Cookies whose
timestamp predates this run are from a previous boot or webui restart;
running was reloaded from startup since then, so they no longer
describe reality and the banner must stay hidden.
- Apply / Restore-to-running: cookie = now → banner shown.
- Power cycle, page load: webuiStartTime > cookie ts → banner hidden.
- Save / Apply-and-Save: cookie cleared (unchanged).
- Legacy "1" / unparseable values: treated as stale.
Also centre the "Device unreachable" connectivity banner past the
sidebar on desktop — left:0 leaves its text drifting behind the
sidebar's z-index. On ≤1024px the sidebar slides off-screen so the
banner reclaims full width.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Five pages drew their per-row delete control as a bespoke <svg> "X"
glyph instead of the icon-trash partial used by Hardware, Routes,
Firewall, Interfaces and the yang tree fragments.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Clicking a section header (Status / Configure / Maintenance) used to
fold the previously-open section AND fire a click on the first page
link inside the just-opened section. That meant going from
"Status > Overview" to "Configure > Hardware" was three clicks worth
of page loads: Configure header expands and lands you on Configure >
Interfaces, then you click Hardware and wait again.
Toggle now just expands or collapses its own section. Sibling
sections stay open until a real page-link click, at which point
updateActiveNav() already closes the others to leave only the
section containing the active page open.
Configure's enter-POST (running → candidate snapshot) still fires
the first time the Configure accordion opens per page lifecycle, so
the candidate datastore is ready by the time the user clicks a
Configure page.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Mirrors the CLI's "show hardware" command — a single page that summarises
everything ietf-hardware exposes about the device:
- Board (chassis info: model, manufacturer, serial, base MAC)
- USB Ports (state + description)
- WiFi Radios (bands, standards, max-AP)
- GPS Receivers
- Sensors (grouped by parent component, all status values)
- Other Components (fallback so the page is exhaustive)
This is Phase 1 of webui-roadmap-v2. Phase 2 will trim the dashboard's
Sensors card to a few key vitals with an "All sensors →" link here,
fixing the existing height-clipping regression in the process.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The NTP page showed a red "Failed to fetch NTP data" banner whenever
/data/ietf-ntp:ntp returned 404 — which is the normal RESTCONF response
when NTP isn't configured at all. Treat 404 as the not-configured case
and render the empty-state card with a Configure → link, mirroring the
DHCP status page.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The errors.As(err, &rcErr) + StatusCode == http.StatusNotFound boilerplate
was repeated across six handlers. Replace with the IsNotFound helper
introduced in restconf/errors.go, dropping the now-unused errors import
from each affected file along the way.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds a per-user inactivity countdown that POSTs /logout after a
configurable timeout (default 15 min, persisted in localStorage)
and navigates to /login. Background pollers (watchdog, *counters
refresh) are excluded from the activity reset so they don't keep
the session alive indefinitely. htmx:responseError on 401 short-
circuits straight to /login so a server-side expiration doesn't
leave the UI failing silently.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Idea of wizard is to simplify:
- Re-adding Ethernet interfaces you've accidentally removed
- Setting up WiFi access point/station, incl. radio & PSK
- VLAN filtering bridges
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds Configure > Routes page for viewing, adding, editing, and deleting
IPv4 and IPv6 static routes. Each route row expands in-place to an edit
form; YANG field descriptions are shown as ⓘ tooltips.
Also fixes a goyang bug where inline augments inside a uses block were
never applied to the expanded tree, making it so next-hop-address and
outgoing-interface were missing from the schema — and therefore had no
tooltip text.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit introduces xpath coverage test report. It plugs into transport layer of test system and generates .md report.
Commit also introduces "make xpath-coverage-report" used to generate pdf out of md.
Resolves: #581
Signed-off-by: Ejub Sabic <ejub1946@outlook.com>
Navigating interfaces now work, and the tree follows the accordion style
like the rest of the UI.
Also, some updates to the curated pages: online help, lists of leafrefs
instead of hard-coded list options.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Implements the configure accordion section with a candidate datastore
workflow: opening Configure copies running → candidate (Enter), each
card saves directly to candidate, Apply copies candidate → running
atomically, and Abort discards by resetting candidate from running.
- RESTCONF client: add Put, Patch, Delete, GetDatastore, PutDatastore,
CopyDatastore, and a shared doRequest/writeJSON helper
- Handlers: ConfigureHandler (enter/apply/abort), ConfigureSystemHandler
(hostname, clock, NTP, DNS, motd, editor), ConfigureUsersHandler
(add/delete user, shell, password, SSH keys, NACM group membership)
- Status > NACM page: read-only group permission matrix derived from
ietf-netconf-acm groups + rule-list mappings
- Sticky Apply/Abort toolbar with custom confirm dialog; server returns
HX-Redirect:/ so HTMX does a full-page reload, keeping sidebar in sync
- Accordion persistence fixed: Configure excluded from localStorage so it
never auto-reopens after Abort/Apply; restore no longer closes an
accordion that contains the active page
- Password hashing by shelling out to mkpasswd(1)
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Group nav items by purpose:
- Security: Firewall, WireGuard, NACM
- Services: Services, DHCP, NTP, LLDP, mDNS (moved from Network)
- Network trimmed to: Interfaces, Routing, WiFi
Rename Dashboard → Overview for clearer Status > System > Overview
navigation hierarchy.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a zone-to-zone traffic matrix matching the CLI's traffic_flow logic:
- HOST row/column always present; zone→HOST uses zone action + services
(not policies), producing allow/conditional/deny verdicts correctly
- Clicking a matrix cell shows a detail panel with the policy or zone
reason for the verdict
- Conditional (⚠) detection for zones with services or port-forwarding
Enrich the policy and zone tables:
- Immutable (built-in) policies flagged with ⚷ in column header and row
- Policy rows show description as tooltip; sorted by priority
- Zones table renamed "Host Services" column; Policies drops Priority column
- Wide tables (Zones, Policies) span two grid columns like Dashboard WiFi
Fix the info-grid layout: #content lacked width:100% so margin:0 auto
was overriding flex stretch, collapsing the grid to a single column on
both the firewall and dashboard pages.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Display interfaces in a hierarchical tree: bridge and LAG parent rows
show a ▼ toggle in the tree column that collapses/expands their member
ports. The vertical connector line disappears when collapsed. Member
ports within each group are sorted alphabetically; loopback interfaces
always appear first, the rest alphabetically.
A ⚑ forwarding-flag column indicates which interfaces have IP
forwarding enabled, fetched concurrently from ietf-routing:routing.
The "Address" and "Detail" columns are replaced by a single "Data"
column matching the CLI layout: IP addresses, VLAN id, WiFi SSID/mode,
WireGuard peer count, etc. Table rows are top-aligned so interfaces
with multiple addresses don't cause odd vertical centering on other
cells; the two narrow icon columns (⚑ and tree) stay middle-aligned.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Expandable detail row per key. Clicking the ▶ arrow left of the name
unfolds a full-width row showing labeled key fields (Value / Public Key
/ Private Key) as word-wrapped monospace blocks (max-width: 72ch),
making base64 data easy to read and copy.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Split the old monolithic Hardware card into dedicated Board, WiFi, and
Sensors cards, matching the structure of `show system` / `show hardware`
in the CLI:
- System Information: add Current Time row, rename Firmware → Boot Partition
- Board: model, manufacturer, Base MAC only (no sensors)
- WiFi (new, conditional): all radios with supported bands, standards
(11n/11ac/11ax), and max AP count; card spans 2 grid columns so the
table never needs horizontal scroll
- Sensors (new, conditional, collapsible): all hardware sensors grouped
by parent component (SFP sub-sensors indent under sfp1/sfp2 headings);
JS "Show more" button injected only when content overflows 300 px
- Disk Usage: replaced wide multi-column table with a per-mount widget
(path + % on one line, health bar, "X free of Y" below); health colour
follows the same warn/crit thresholds as the memory bar
- Fix humanKiB to output IEC units (MiB / GiB) with a space, matching
the memory display style
- Fix info-table th wrapping (width:1%; white-space:nowrap)
- Fix JS collapsible init to run on DOMContentLoaded, not immediately in
<head>, so scrollHeight check has a real DOM to inspect
- CSS scroll-shadow on data-table-wrap: pure-CSS right-edge shadow
indicates overflow without needing JS or a scroll listener
- Equal-height grid rows via align-items:stretch; info-grid-span-2 for
cards with wide tables
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace the RAUC-centric firmware page with a cleaner layout:
- Show software slots (primary/secondary) using their bootnames rather
than internal RAUC slot names; filter to rootfs-class slots only
- Add boot order display (mirrors `show software` in the CLI)
- Show installed timestamp per slot (truncated to second precision)
- Fix Booted flag comparison: compare against bootname not slot name
- Lay out all three cards (Software, Install from URL, Upload & Install)
in a responsive grid instead of full-width stacked sections
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Drop the useless 768–1024px icon-only sidebar mode; everything up to
1024px now uses the hamburger overlay and full-width sidebar.
Fix the user dropdown on touch devices: click now toggles aria-expanded
so CSS-driven visibility works without hover. A document click listener
closes the menu when tapping outside.
Give the sidebar proper light/dark tokens instead of hardcoded dark
values. Introduce --sidebar-hover-fg (primary in light, white in dark)
so nav-link hover text is legible in both themes.
Fix dropdown hover background using --border instead of --border-subtle,
which had zero contrast against the surface in dark mode.
Keep active nav link in sync with the current URL via JS so it updates
correctly after htmx navigation instead of staying on the initial
server-rendered page. Also, add YouTube-style progress when laoding
pages that take time, e.g., Dashboard.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Anonymise the login page: generic "Login" title, lock icon instead
of product logo — makes the device harder to fingerprint.
Add a floating theme toggle button to the login page so users can
switch theme before logging in (cycles auto→light→dark).
Replace the four cluttered sidebar footer buttons (theme, download
config, reboot, logout) with an always-visible topbar user menu.
The dropdown shows the username, three theme options with a checkmark
on the active one, download config, reboot, and logout.
Refactor all handler page-data structs to embed PageData instead of
repeating the four base fields, and add Username (sourced from the
request context) so the topbar can display the logged-in user.
Polish pass on the login card: spacing, focus styles, button weights.
Replace the AES-encrypted-cookie session model with an opaque random
token backed by an in-memory map. The vendored design embedded the
user's username, password, CSRF, and feature flags into the cookie
and persisted the AES key under /var/lib/misc, making the keyfile a
passive credential-recovery oracle — anyone who could read it could
decrypt any captured cookie and recover the plaintext admin password.
Now: cookie is 32 bytes of crypto/rand, base64-url-encoded; sessions
live only in process memory; reboot/respawn/upgrade drops every
active session and the UI's 401 handler bounces the user to /login.
Sliding-window refresh on user activity, janitor goroutine sweeps
expired entries. --session-key flag and /var/lib/misc/webui-session.key
are gone.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace flat nav-section-header labels with collapsible <details>/<summary>
accordion groups (Network, Wireless, VPN, Services, System). Groups default
open; user state persists via localStorage. Tablet icon-only mode always
shows all items regardless of open/closed state.
Add badge-up/down/warning/info/neutral utility classes with full dark mode
support, complementing the existing firewall-specific badge variants.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
avahi resolves mDNS hostname conflicts at runtime by appending -2, -3, …
but the advertiser writes its adminurl TXT record with the configured
hostname and never updates it. A device renamed infix-2.local thus keeps
advertising adminurl=http://infix.local, so its card linked to the other
device. Rebase the adminurl onto the actually-resolved host (keeping
scheme, port, and path); a no-op in the common single-device case.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Include /run and /tmp in mount-points, likely more interesting than /.
- Include advertised link modes in operational to compare with supported
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The contact and location leaves were absent from the operational
datastore. Fetch each leaf from the running ds tool and inject
into ietf-system:system.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The test-report target fed a pre-baked report.adoc to asciidoctor-pdf.
Let 9pm's report.py, the author of result.json, both generate and
render the report instead. It is invoked with Infix's own theme, fonts
and logo so the output is unchanged; downstream projects need only
override LOGO to rebrand it.
Signed-off-by: Richard Alpe <richard@bit42.se>
Two unrelated must expressions referenced schema nodes that don't exist,
emitting warnings on every schema load (and in netopeer2-cli):
- NTP: the iburst/burst deviations put the must on the leaf, so
"ntp:iburst"/"ntp:burst" resolved as a child of the leaf. Use ".".
- WireGuard: deref() of a key *-ref lands on the key's "name" leaf, so
"deref(.)/ks:public-key-format" looked under "name". Use
"deref(.)/../...", and descend into the "public-key" list for the
truststore public-key-bag.
Joachim Wiberg