Build the mkdocs User's Guide into WebUI images and surface it in the UI.
post-build.sh runs `mkdocs build` from the top-level mkdocs.yml into
/var/www/guide when the webui package is selected and mkdocs is on the
build host; nginx serves it read-only at /guide/. The build is
best-effort — a missing mkdocs warns and ships without the guide rather
than failing — and minimal images (no webui) skip it.
The WebUI gates a book icon in the topbar and a User Guide item in the
user menu on the docs being present on disk (os.Stat, fail-closed), both
opening /guide/ in a new tab.
CI: a local setup-mkdocs composite action installs mkdocs and the
plugins from mkdocs.yml; the build and release workflows run it before
the build so images produced in CI include the guide. developers-guide
documents the new build dependency and restores the missing
mkdocs-glightbox plugin.
Fixes#633
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Rename the Maintenance > Backup & Restore page to Backup & Support and
add a Support Bundle card. Download support runs the on-device
`support collect` tool, which gathers configuration, logs, routing,
interfaces, hardware inventory, and container and service status into a
single archive; the WebUI runs as root so the collection is complete.
The handler buffers the archive and only commits response headers once
collection succeeds, so a mid-collection failure is a clean error rather
than a truncated download. An optional password encrypts the bundle via
the tool's GPG support, fed on stdin so it never reaches the process
list. Collection blocks for up to a minute with no output, so the write
deadline is extended past the server's 15s WriteTimeout and nginx gets a
matching read timeout; the browser shows a "collecting" state and saves
the blob client-side using the server's filename.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
New Logs page under Maintenance presents the on-disk syslog files
(messages, syslog, kern, auth, routing, firewall, upgrade, debug,
container, mail) with a tab per source and an (empty) chip for files
with no content.
The buffer loads the last 250 lines and pins to the bottom on open and
on tab change, with keyboard focus on the pane so PageUp/PageDown work
immediately. Load earlier pages back 250 lines at a time, preserving
the reader's scroll position as older lines fill in above; once the
current file is exhausted the button re-labels to "Load previous from
<rotation>" and walks back through rotated and gzipped archives.
Live tail streams new entries over SSE. The server runs tail -F -n 0
and debounces output; the client follows the bottom unless the reader
has scrolled up. A status pill shows connecting/live/disconnected.
nginx gets a no-buffering location for the tail stream, mirroring the
software progress endpoint.
Download returns the full archive — current file plus every rotated and
gzipped predecessor — concatenated chronologically.
Severity is coloured by a keyword heuristic since sysklogd writes no
<PRI> to disk; BSD-format lines are shown unconditionally. Filter is
client-side substring or /regex/, focusable with Ctrl/Cmd-F.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Vendor a Lucide icon set under static/img/icons/ and partial:ize the
inline SVGs across base, login, firmware, sidebar, and yang-tree.
Reorganize the sidebar with mirrored Status/Configure section labels.
Rename NACM to Users & Groups and Firmware to Software; swap Routes and
Routing between Status and Configure.
Split Configure > System into General, NTP Client, and DNS Client pages,
which opens up for relocating the Set Time RPC from the Maintenance
section to a new Date & Time card in the System General config page.
Update browser tab title on htmx navigation via an HX-Trigger
setPageTitle event; encode the payload as 7-bit ASCII so the middle
dot in "Page · Context" survives header transit.
Add missing hover-help ⓘ icons to bridge port configuration, and adjust
their alignment slightly. While in interface configuration:
- fix the annoying Save => collapse so one can edit multiple
interface sections without having to re-expand the iface
- add missing dhcpv4 settings
- add missing custom mac (use advanced view for other settings)
- clean up Save button mess (consolidate)
Rename Firmware -> Software everywhere in the Maintenance section and
fix "Install progress stuck at 10%" issue.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds an nginx-side rate limit on POST /login so a brute-force or DoS
attempt can't pin the box on the bcrypt-shaped credential check inside
rousette/PAM. Configuration:
- Keyed on $binary_remote_addr (per source IP), 5 requests/minute
sustained with a burst of 3 nodelay, a real user fumbling their
password three times in a row sails through; the 4th attempt in
the same window returns 429.
- GET /login is unmetered (the keyed map yields the empty string,
which limit_req treats as "no key, no limit"), so a 401-driven
HX-Redirect bouncing the user back to the login page doesn't
eat into the budget.
- 32k zone (~500 IPs, the minimum nginx accepts). At cache
saturation an attacker rotating addresses still tops out around
~2500 attempts/min, all serialised through bcrypt one at a time.
- 429 instead of the default 503 keeps the response out of the
/50x.html error_page rewrite (which auto-refreshes and would
loop a throttled client straight back to /login).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The webui Go code now lives in the infix source tree rather than being
imported as an external module. Switch the module path to match that
reality so the imports read coherently with the rest of the codebase.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Replace the RAUC-centric firmware page with a cleaner layout:
- Show software slots (primary/secondary) using their bootnames rather
than internal RAUC slot names; filter to rootfs-class slots only
- Add boot order display (mirrors `show software` in the CLI)
- Show installed timestamp per slot (truncated to second precision)
- Fix Booted flag comparison: compare against bootname not slot name
- Lay out all three cards (Software, Install from URL, Upload & Install)
in a responsive grid instead of full-width stacked sections
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg