A website resource can now redirect to a full address (301 or 302), optionally
keeping the path and query, with no target or login. The Add resource wizard
has a Domain redirect choice that opens the HTTPS and HTTP sides together.
Deleting a site no longer removes redirects. Uses Reef v0.1.10 and Blacktip v0.1.9.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sandbar channels raise and resolve alerts through its API, with the API key
sealed at rest and never returned to the browser. Resources and sites can be
tagged and filtered by tag; sites can be renamed. The secretbox package now
comes from Reef v0.1.9 instead of a private copy.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A website on 0.0.0.0 and websites on named addresses can use the same port. An https resource with
the redirect on also uses port 80 at its address, so a raw port there is refused, in either order.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A hostname under a domain that points at one of the edge's addresses selects that address. An address
saved earlier stays selectable even before the edge reports it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dialog buttons are Cancel then the primary action at the bottom right, and each page has one primary
action. List pages no longer repeat their title. Dates have the month written out. Fields in a row
line up, hints sit under fields instead of inside labels, and long certificate errors are clamped.
Organizations show whether local access is on and name the action; setting a user's password uses a
dialog instead of a browser prompt. Server errors for sign-in and ranges are reworded with a next step,
and the stray scrollbar inside tables is gone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Warm neutrals, teal accent, 15px type, and Lightwell's component shapes. Status is a badge with text
instead of a colored dot. Every destructive action asks first, naming the object and what is lost.
Dialogs trap focus, close on Escape and return focus. The sidebar is a drawer on phones, there is a
theme switch, loading shows skeleton rows, and empty states explain what belongs there. Emoji and
dashes are gone, and server errors are capitalized and tell visitors what to do next.
Adds scripts/lint-design.mjs and docs/design.md.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The updater reports each step (checking, downloading with percent, verifying, installing, restarting).
Edges and sites send that progress and their log with their reports; Hammerhead serves it to a dialog
that opens when an update starts, and keeps its own last update log on disk across the restart.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A new resource starts by choosing what is being shared (website, TCP, UDP, TCP+UDP, TLS passthrough,
plain HTTP), then where it points, how people reach it, who can open it (websites only) and a final
name-and-review step. Each step shows only its own fields; health checks, rules and redirects sit
under More options. The existing form is still used for editing.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Edges and sites report their version and whether auto-update is on. Hammerhead can ask a machine that
has auto-update on to install the newest release, and shows the outcome. Requests carry an ID so a
stale result can't answer a new one.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Saving settings replaced the whole Settings value, which would have dropped SelfEdgeID and made the
next start create a second self edge with a new token.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
HAMMERHEAD_SELF_DOMAIN creates an edge for this machine, writes its token to <data>/self-edge.env
and adds an https route for the dashboard to that edge's config, so no reverse proxy is needed.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Pages are served at /resources, /sites, /domains, /mail-egress, /alerts, /access, /logs,
/apps, /account and /server/*, with working links, reloads and back button. Mail egress,
alerts, access, users, organizations, SSO and DKIM follow the same header-button and dialog
pattern as the other pages.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Spacing scale, 6/10px radii, flat bordered cards, pill badges, accent-tinted navigation,
segmented tabs and a single control height, in light and dark. Class names are unchanged.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Dashboard and API, accounts (organizations, roles, invitations, 2FA, OIDC
single sign-on, API keys, revocable sessions), an encrypted SQLite database,
resource logins, alerts and /metrics, mail egress management with DKIM keys,
and the .env loader. Split out of the original single repository; depends on
Reef for the shared types. The end-to-end tests that run Hammerhead, Blacktip
and Bamboo together live in e2e/.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
