Show a progress bar and live log while Hammerhead, edges and sites update

The updater reports each step (checking, downloading with percent, verifying, installing, restarting).
Edges and sites send that progress and their log with their reports; Hammerhead serves it to a dialog
that opens when an update starts, and keeps its own last update log on disk across the restart.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -21,6 +21,14 @@ HAMMERHEAD_MASTER_KEY=
 # Leave empty and /metrics does not exist.
 #HAMMERHEAD_METRICS_TOKEN=
 
+# Serve the dashboard through a Blacktip edge on this same machine, at this name, with an
+# automatic HTTPS certificate: no Caddy or other web server in front of Hammerhead. Hammerhead
+# makes the edge itself and writes its token to <data>/self-edge.env (BLACKTIP_TOKEN=...).
+# deploy/setup.sh --domain sets this up for you. Needs HAMMERHEAD_URL set to the same name.
+#HAMMERHEAD_SELF_DOMAIN=hammerhead.example.com
+# The edge's public WireGuard address for sites; default <HAMMERHEAD_SELF_DOMAIN>:51820.
+#HAMMERHEAD_SELF_TUNNEL=hammerhead.example.com:51820
+
 # How long access logs are kept (days). Default 30.
 #HAMMERHEAD_LOG_DAYS=30
 
@@ -38,3 +46,7 @@ HAMMERHEAD_MASTER_KEY=
 # Token from Sites -> Show command.
 #BAMBOO_HAMMERHEAD=https://hammerhead.example.com
 #BAMBOO_TOKEN=
+
+# Check for new releases every few hours and update and restart by itself (Linux and macOS).
+# setup.sh turns this on; remove it to update by hand.
+#HAMMERHEAD_AUTO_UPDATE=1

.gitea/workflows/ci.yml

@@ -44,7 +44,7 @@ jobs:
       # Catches platform-specific breakage before a release is tagged.
       - name: Every release platform compiles
         run: |
-          for t in linux/amd64 linux/arm64 linux/arm windows/amd64 darwin/amd64 darwin/arm64; do
+          for t in linux/amd64 windows/amd64; do
             echo "building for $t"
             GOOS=${t%/*} GOARCH=${t#*/} GOARM=7 CGO_ENABLED=0 go build -o /dev/null ./cmd/hammerhead
           done

.gitea/workflows/release.yml

@@ -59,4 +59,4 @@ jobs:
             *-*) ;;                       # pre-releases (v1.0.0-rc1) don't move :latest
             *) tags="$tags -t $image:latest" ;;
           esac
-          docker buildx build --platform linux/amd64,linux/arm64 $tags --push .
+          docker buildx build --platform linux/amd64 $tags --push .

README.md

@@ -41,19 +41,19 @@ ports. Then open ports on the **Resources** page.
 
 ## Deploying
 
-Releases are built by Gitea Actions. Pushing a tag such as `v0.2.0` runs `.gitea/workflows/release.yml`, which tests the code, builds Hammerhead for Linux (amd64, arm64, armv7), Windows (amd64) and macOS (amd64, arm64), publishes the archives with a `SHA256SUMS` file on the Releases page, and pushes a multi-architecture container image to this server's registry (`git.veillax.com/veillax/hammerhead`). Every push and pull request runs `.gitea/workflows/ci.yml`: formatting, vet, tests, and a check that every release platform still compiles.
+Releases are built by Gitea Actions. Pushing a tag such as `v0.2.0` runs `.gitea/workflows/release.yml`, which tests the code, builds Hammerhead for Linux (amd64) and Windows (amd64), publishes the archives with a `SHA256SUMS` file on the Releases page, and pushes a container image (linux/amd64) to this server's registry (`git.veillax.com/veillax/hammerhead`). Every push and pull request runs `.gitea/workflows/ci.yml`: formatting, vet, tests, and a check that every release platform still compiles.
 
 **Fastest: one script on a fresh VPS**
 
-`deploy/setup.sh` (also inside the Linux archives) installs everything for you on a systemd Linux: the service, a generated master key, the firewall rules, and optionally HTTPS.
+`deploy/setup.sh` (also inside the Linux archives) installs everything for you on a systemd Linux: the services, a generated master key, the firewall rules and HTTPS.
 
 ```
-sudo sh setup.sh --domain hammerhead.example.com            # Hammerhead + Caddy for HTTPS
-sudo sh setup.sh edge  --hammerhead https://hammerhead.example.com --token <edge token> --ports 25565,30000-30100
-sudo sh setup.sh agent --hammerhead https://hammerhead.example.com --token <site token>
+sudo sh setup.sh --domain hammerhead.example.com            # Hammerhead and an edge on this machine
+sudo sh setup.sh agent --hammerhead https://hammerhead.example.com --token <site token>   # on each site
+sudo sh setup.sh edge  --hammerhead https://hammerhead.example.com --token <edge token>   # more public servers
 ```
 
-`edge` installs Blacktip (with its bundled Traefik) and lists every IP address on the machine that ports can be opened on; `agent` installs Bamboo on the machine that hosts your services. All three can run on one machine or on three.
+With `--domain`, Hammerhead listens only on `127.0.0.1:8080` and gets an edge of its own (`HAMMERHEAD_SELF_DOMAIN`): the Blacktip on the same machine serves the dashboard at `https://<domain>` with an automatic certificate, so no Caddy or other web server is needed. The route is built in, not a mapping you can edit or delete by mistake. DNS for the name must point at the server and ports 80 and 443 must be free. `--caddy` keeps the old style: Hammerhead alone, with Caddy providing HTTPS. Add `--ports 25565,30000-30100` to open game or mail ports in the firewall, and `--no-auto-update` to leave updates to you.
 
 **On a Linux server (systemd)**
 
@@ -67,7 +67,13 @@ sudoedit /etc/hammerhead/hammerhead.env   # your settings and secrets
 sudo systemctl start hammerhead
 ```
 
-Use `linux_arm64` or `linux_arm` for Raspberry Pi and other ARM machines. To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/hammerhead` and `/var/lib/hammerhead` alone. `hammerhead -version` tells you which build is running.
+Releases are published for x86-64 only; for ARM machines build it yourself (`TARGETS=linux/arm64 sh deploy/build.sh`). To upgrade, repeat the same steps: your settings and data are kept. `sudo ./install.sh --uninstall` removes the service and binary but leaves `/etc/hammerhead` and `/var/lib/hammerhead` alone. `hammerhead -version` tells you which build is running.
+
+**Updates**
+
+Set `HAMMERHEAD_AUTO_UPDATE=1` (or pass `-auto-update`) and Hammerhead checks this server for a newer release every few hours, verifies it against `SHA256SUMS`, checks that the new binary runs, swaps it in and restarts itself. It only follows full releases (never pre-releases), never downgrades, and keeps the old binary if anything looks wrong. `setup.sh` turns it on. It is not available on Windows, and it is for the systemd and plain-binary installs: with Docker, pull a new image instead.
+
+Edges and sites report their version, so Server → Edges and Sites show which release each one runs and flag a newer one. An **Update** button appears for any machine that runs with auto-update on (`BLACKTIP_AUTO_UPDATE=1` / `BAMBOO_AUTO_UPDATE=1`): it asks that machine to install the newest release now, and the result is shown in the table. Under Server → Settings, **Check for updates** does the same lookup for Hammerhead itself, with an **Update now** button when auto-update is on. A machine without auto-update never installs anything on request. Starting an update opens a progress bar with the live log of what the machine is doing (checking, downloading, verifying, installing, restarting). Hammerhead keeps the log of its own last update in `update.log` in its data folder, so it is still there after the restart.
 
 **With Docker**
 

agent.go

@@ -73,6 +73,10 @@ func (s *Server) edgeConfig(w http.ResponseWriter, r *http.Request) {
 			cfg.Mappings = append(cfg.Mappings, *m)
 		}
 	}
+	if m := s.selfMapping(e); m != nil {
+		cfg.Mappings = append(cfg.Mappings, *m)
+	}
+	cfg.UpdateID = e.UpdateID
 	cfg.MailEgress = []model.MailPolicy{}
 	for _, x := range s.st.MailEgress {
 		if x.EdgeID == e.ID && x.Enabled {
@@ -107,6 +111,9 @@ func (s *Server) edgeReport(w http.ResponseWriter, r *http.Request) {
 	}
 	e.LastSeen = time.Now()
 	e.IPs = in.IPs
+	oldVersion := e.Version
+	answered := noteUpdateReport(&e.Version, &e.AutoUpdate, &e.UpdateID, &e.UpdateMsg, in.Version, in.AutoUpdate, in.UpdateID, in.UpdateMsg)
+	s.recordUpdateProgress(e.ID, in.UpdateID, in.UpdateStage, in.UpdatePct, in.UpdateLog, oldVersion, e.Version)
 	for _, x := range s.st.MailEgress {
 		if x.EdgeID == e.ID {
 			if chk, found := in.MailChecks[x.ID]; found {
@@ -143,6 +150,8 @@ func (s *Server) edgeReport(w http.ResponseWriter, r *http.Request) {
 	if e.PublicKey != in.PublicKey {
 		e.PublicKey = in.PublicKey
 		s.bump() // sites need the edge's new key
+	} else if answered {
+		s.bump() // the edge's config no longer carries the update request
 	} else {
 		s.save()
 	}
@@ -202,7 +211,7 @@ func (s *Server) siteConfig(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	st.LastSeen = time.Now()
-	cfg := model.SiteConfig{Version: s.st.Version, SiteID: st.ID, TunnelIP: st.TunnelIP, Edges: []model.EdgeRef{}, MailEgress: []model.MailSpec{}}
+	cfg := model.SiteConfig{Version: s.st.Version, SiteID: st.ID, TunnelIP: st.TunnelIP, Edges: []model.EdgeRef{}, MailEgress: []model.MailSpec{}, UpdateID: st.UpdateID}
 	seen := map[string]bool{}
 	addEdge := func(id string) {
 		if seen[id] {
@@ -246,6 +255,9 @@ func (s *Server) siteReport(w http.ResponseWriter, r *http.Request) {
 		in.Connected = []string{}
 	}
 	st.Connected = in.Connected
+	oldVersion := st.Version
+	answered := noteUpdateReport(&st.Version, &st.AutoUpdate, &st.UpdateID, &st.UpdateMsg, in.Version, in.AutoUpdate, in.UpdateID, in.UpdateMsg)
+	s.recordUpdateProgress(st.ID, in.UpdateID, in.UpdateStage, in.UpdatePct, in.UpdateLog, oldVersion, st.Version)
 	s.containers[st.ID] = in.Containers
 	for _, x := range s.st.MailEgress {
 		if x.SiteID != st.ID {
@@ -260,6 +272,8 @@ func (s *Server) siteReport(w http.ResponseWriter, r *http.Request) {
 	if in.PublicKey != "" && st.PublicKey != in.PublicKey {
 		st.PublicKey = in.PublicKey
 		s.bump() // every edge this site talks to needs the new key
+	} else if answered {
+		s.bump() // the site's config no longer carries the update request
 	}
 	ok(w)
 }

cmd/hammerhead/main.go

@@ -2,9 +2,11 @@
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"log"
+	"net"
 	"net/http"
 	"os"
 	"strconv"
@@ -13,11 +15,25 @@ import (
 	"git.veillax.com/Veillax/hammerhead"
 	"git.veillax.com/Veillax/hammerhead/internal/secretbox"
 	"git.veillax.com/Veillax/reef/dotenv"
+	"git.veillax.com/Veillax/reef/selfupdate"
 )
 
 // version is set at build time (deploy/build.sh).
 var version = "dev"
 
+// localAddr turns a listen address into one this machine can dial: ":8080" and "0.0.0.0:8080"
+// become "127.0.0.1:8080".
+func localAddr(listen string) string {
+	host, port, err := net.SplitHostPort(listen)
+	if err != nil {
+		return listen
+	}
+	if host == "" || host == "0.0.0.0" || host == "::" {
+		host = "127.0.0.1"
+	}
+	return net.JoinHostPort(host, port)
+}
+
 func env(k, def string) string {
 	if v := os.Getenv(k); v != "" {
 		return v
@@ -39,6 +55,7 @@ func main() {
 	url := flag.String("url", env("HAMMERHEAD_URL", ""), "public URL people reach hammerhead at (used for login redirects and SSO); can also be set in Settings")
 	flag.String("env", ".env", "file to read secrets and settings from")
 	genkey := flag.Bool("genkey", false, "print a new random HAMMERHEAD_MASTER_KEY and exit")
+	autoUpdate := flag.Bool("auto-update", os.Getenv("HAMMERHEAD_AUTO_UPDATE") == "1", "check for new releases every few hours and update and restart by itself (Linux and macOS)")
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	flag.Parse()
 	if *showVersion {
@@ -58,11 +75,19 @@ func main() {
 		MasterKey:        os.Getenv("HAMMERHEAD_MASTER_KEY"),
 		MetricsToken:     os.Getenv("HAMMERHEAD_METRICS_TOKEN"),
 		LogRetentionDays: days,
+		SelfDomain:       os.Getenv("HAMMERHEAD_SELF_DOMAIN"),
+		SelfTarget:       localAddr(*listen),
+		SelfTunnel:       os.Getenv("HAMMERHEAD_SELF_TUNNEL"),
+		Version:          version,
+		AutoUpdate:       *autoUpdate,
 	})
 	if err != nil {
 		log.Fatal(err)
 	}
 	defer srv.Close()
+	if *autoUpdate {
+		go selfupdate.Run(context.Background(), selfupdate.Config{Server: "https://git.veillax.com", Repo: "Veillax/hammerhead", App: "hammerhead", Current: version, Logf: log.Printf, Restart: func(exe string) error { srv.Close(); return selfupdate.Restart(exe) }})
+	}
 	log.Printf("hammerhead %s listening on %s (open it in a browser to finish setup)", version, *listen)
 	hs := &http.Server{Addr: *listen, Handler: srv.Handler(), ReadHeaderTimeout: 10 * time.Second}
 	log.Fatal(hs.ListenAndServe())

deploy/build.sh

@@ -8,12 +8,13 @@
 #   dist/hammerhead_<version>_<os>_<arch>.tar.gz or .zip
 #   dist/SHA256SUMS
 #
-# Set TARGETS="linux/amd64 linux/arm64" to build fewer platforms.
+# Releases are published for linux/amd64 and windows/amd64 only. Set TARGETS="linux/arm64 darwin/arm64"
+# (any GOOS/GOARCH pair Go supports) to build something else by hand.
 set -eu
 NAME=hammerhead
 cd "$(dirname "$0")/.."
 VERSION=${1:-$(git describe --tags --always 2>/dev/null || echo dev)}
-TARGETS=${TARGETS:-"linux/amd64 linux/arm64 linux/arm windows/amd64 darwin/amd64 darwin/arm64"}
+TARGETS=${TARGETS:-"linux/amd64 windows/amd64"}
 
 rm -rf dist
 mkdir -p dist/bin dist/stage

deploy/hammerhead.service

@@ -8,7 +8,7 @@ Wants=network-online.target
 User=hammerhead
 Group=hammerhead
 EnvironmentFile=-/etc/hammerhead/hammerhead.env
-ExecStart=/usr/local/bin/hammerhead -listen :8080 -data /var/lib/hammerhead
+ExecStart=/usr/local/lib/hammerhead/hammerhead -listen :8080 -data /var/lib/hammerhead
 WorkingDirectory=/var/lib/hammerhead
 Restart=on-failure
 RestartSec=3
@@ -16,7 +16,7 @@ RestartSec=3
 # It only needs its own data folder and the network.
 NoNewPrivileges=true
 ProtectSystem=strict
-ReadWritePaths=/var/lib/hammerhead
+ReadWritePaths=/var/lib/hammerhead /usr/local/lib/hammerhead
 ProtectHome=true
 PrivateTmp=true
 ProtectKernelTunables=true

deploy/install.sh

@@ -5,7 +5,7 @@
 #   sudo ./install.sh --start      the same, then start (or restart) the service
 #   sudo ./install.sh --uninstall  remove the service and binary (keeps the settings and data)
 #
-# Files: /usr/local/bin/hammerhead, /etc/systemd/system/hammerhead.service,
+# Files: /usr/local/lib/hammerhead/hammerhead (linked from /usr/local/bin/hammerhead), /etc/systemd/system/hammerhead.service,
 #        /etc/hammerhead/hammerhead.env (your settings and secrets), /var/lib/hammerhead (data).
 # Set DESTDIR=/some/dir to stage everything there without touching the system.
 set -eu
@@ -17,6 +17,7 @@ UNIT=$ROOT/etc/systemd/system/$NAME.service
 CONF=$ROOT/etc/$NAME
 ENVFILE=$CONF/$NAME.env
 DATA=$ROOT/var/lib/$NAME
+LIB=$ROOT/usr/local/lib/$NAME # the program lives here, owned by the service, so auto-update can replace it
 
 say() { printf '%s\n' "$*"; }
 real() { [ -z "${DESTDIR:-}" ]; } # are we touching the real system?
@@ -30,7 +31,7 @@ if [ "${1:-}" = "--uninstall" ]; then
 	if real; then
 		systemctl disable --now "$NAME" > /dev/null 2>&1 || true
 	fi
-	rm -f "$UNIT" "$BIN"
+	rm -f "$UNIT" "$BIN" "$LIB/$NAME"
 	if real; then
 		systemctl daemon-reload || true
 	fi
@@ -46,15 +47,20 @@ if real && ! id "$NAME" > /dev/null 2>&1; then
 fi
 
 mkdir -p "$ROOT/usr/local/bin" "$ROOT/etc/systemd/system" "$CONF" "$DATA"
-install -m 0755 "$HERE/$NAME" "$BIN.new"
-mv -f "$BIN.new" "$BIN" # atomic, so upgrading a running service is safe
+mkdir -p "$LIB"
+install -m 0755 "$HERE/$NAME" "$LIB/$NAME.new"
+mv -f "$LIB/$NAME.new" "$LIB/$NAME" # atomic, so upgrading a running service is safe
+rm -f "$BIN"
+LINK=/usr/local/lib/$NAME/$NAME
+[ -z "${DESTDIR:-}" ] || LINK=$LIB/$NAME # staging: point inside the staging folder
+ln -s "$LINK" "$BIN"
 install -m 0644 "$HERE/$NAME.service" "$UNIT"
 if [ ! -f "$ENVFILE" ]; then
 	install -m 0600 "$HERE/.env.example" "$ENVFILE"
 	say "Created $ENVFILE. Edit it before starting."
 fi
 if real; then
-	chown -R "$NAME:$NAME" "$DATA"
+	chown -R "$NAME:$NAME" "$DATA" "$LIB"
 fi
 
 if real; then
@@ -66,7 +72,7 @@ if real; then
 	fi
 fi
 
-say "Installed $("$BIN" -version 2> /dev/null || echo "$NAME")."
+say "Installed $("$LIB/$NAME" -version 2> /dev/null || echo "$NAME")."
 say "Next:"
 say "  1. edit $ENVFILE"
 say "  2. systemctl start $NAME      (or run this again with --start)"

deploy/publish-release.sh

@@ -42,19 +42,30 @@ else
 	echo "release $TAG already exists (id $id): replacing its files"
 fi
 
-existing=$(curl -fsS -H "$AUTH" "$API/releases/$id/assets" | json 'import sys, json
+# the ids of the release's assets with a given name (a failed upload can leave a partial one behind)
+asset_ids() {
+	curl -fsS -H "$AUTH" "$API/releases/$id/assets" | "$PY" -c 'import sys, json
 for a in json.load(sys.stdin):
-    print(a["id"], a["name"])')
+    if a["name"] == sys.argv[1]:
+        print(a["id"])' "$1"
+}
 
 for f in dist/*.tar.gz dist/*.zip dist/SHA256SUMS; do
 	[ -f "$f" ] || continue
 	name=$(basename "$f")
-	echo "$existing" | while read -r aid aname; do
-		if [ "$aname" = "$name" ]; then
+	n=1
+	while :; do
+		for aid in $(asset_ids "$name"); do
 			curl -fsS -X DELETE -H "$AUTH" "$API/releases/$id/assets/$aid" > /dev/null
-		fi
 		done
-	echo "uploading $name"
-	curl -fsS -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null
+		echo "uploading $name (attempt $n)"
+		if curl -fsS --max-time 1200 -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null; then
+			break
+		fi
+		# large uploads can hit a proxy timeout (HTTP 502); try again
+		[ "$n" -lt 5 ] || { echo "giving up on $name after $n attempts" >&2; exit 1; }
+		n=$((n + 1))
+		sleep $((n * 10))
+	done
 done
 echo "published $SERVER/$REPO/releases/tag/$TAG"

deploy/setup.sh

@@ -1,34 +1,45 @@
 #!/bin/sh
 # One-shot setup for a VPS. Run as root.
 #
-#   sh setup.sh [--domain hh.example.com] [--version v0.1.0]     Hammerhead (dashboard and API)
-#   sh setup.sh edge  --hammerhead URL --token TOKEN [--ports 25565,30000-30100] [--version V]
-#   sh setup.sh agent --hammerhead URL --token TOKEN [--version V]
+#   sh setup.sh --domain hh.example.com [options]     Hammerhead and a Blacktip edge on this machine
+#   sh setup.sh edge  --hammerhead URL --token TOKEN [options]    another edge
+#   sh setup.sh agent --hammerhead URL --token TOKEN [options]    a site agent
 #
-# Hammerhead: installs it as a systemd service (with a generated master key, kept in
-#   /etc/hammerhead/hammerhead.env), and with --domain also Caddy, which gets and renews
-#   the HTTPS certificate for that name. DNS for the name must already point here.
-# edge:  installs Blacktip, with its bundled Traefik, on this machine (or any other VPS),
-#   opens the firewall and lists every IP address it can open ports on.
-# agent: installs Bamboo, the site agent, on the machine that hosts your services.
+# With --domain, this installs Hammerhead (the dashboard) and a Blacktip edge on the same
+# machine. The edge serves the dashboard itself at https://<domain> with an automatic
+# certificate, so no separate web server is needed. DNS for the domain must already point here,
+# and ports 80 and 443 must be free (stop Pangolin, Caddy, nginx... first).
 #
-# Edge and agent need a token, which only exists once Hammerhead is up: create the edge under
-# Server -> Edges (or the site under Sites) in the dashboard and copy the values from "Show command".
+# Options:
+#   --version V         release of Hammerhead (or of the edge/agent for those modes); default newest
+#   --edge-version V    release of the Blacktip installed next to Hammerhead; default newest
+#   --ports 25565,30000-30100   also open these (TCP and UDP) in the firewall
+#   --tunnel HOST:PORT  the edge's public WireGuard address; default <domain>:51820
+#   --caddy             old style: Hammerhead alone, with Caddy providing HTTPS (no edge here)
+#   --no-auto-update    don't let the programs update themselves
+#
+# Without --domain, Hammerhead alone is installed on port 8080 over plain HTTP.
+# Edge and agent need a token: create the edge under Server -> Edges (or the site under Sites)
+# in the dashboard and copy the values from "Show command".
 # Safe to run again: it upgrades and keeps your settings and data.
 set -eu
 
 BASE=${SHARKS_BASE:-https://git.veillax.com/Veillax}
 MODE=hammerhead
 case "${1:-}" in edge | agent) MODE=$1; shift ;; esac
-DOMAIN= VERSION= HH= TOKEN= PORTS=
+DOMAIN= VERSION= EDGE_VERSION= HH= TOKEN= PORTS= TUNNEL= CADDY=0 AUTOUP=1
 while [ $# -gt 0 ]; do
 	case "$1" in
 		--domain) DOMAIN=$2; shift 2 ;;
 		--version) VERSION=$2; shift 2 ;;
+		--edge-version) EDGE_VERSION=$2; shift 2 ;;
 		--hammerhead) HH=$2; shift 2 ;;
 		--token) TOKEN=$2; shift 2 ;;
 		--ports) PORTS=$2; shift 2 ;;
-		-h | --help) sed -n '2,16p' "$0"; exit 0 ;;
+		--tunnel) TUNNEL=$2; shift 2 ;;
+		--caddy) CADDY=1; shift ;;
+		--no-auto-update) AUTOUP=0; shift ;;
+		-h | --help) sed -n '2,24p' "$0"; exit 0 ;;
 		*) echo "unknown option $1 (see --help)" >&2; exit 2 ;;
 	esac
 done
@@ -40,9 +51,7 @@ command -v systemctl > /dev/null 2>&1 || die "this needs a systemd-based Linux (
 
 case "$(uname -m)" in
 	x86_64 | amd64) ARCH=amd64 ;;
-	aarch64 | arm64) ARCH=arm64 ;;
-	armv7* | armv6* | arm) ARCH=arm ;;
-	*) die "unsupported CPU: $(uname -m)" ;;
+	*) die "releases are published for x86-64 Linux only, not $(uname -m); build it yourself with: TARGETS=linux/arm64 sh deploy/build.sh" ;;
 esac
 
 pkg_install() { # installs packages with whichever package manager there is
@@ -68,10 +77,10 @@ latest() { # newest release tag of repo $1 (read from git, so no API token is ne
 	git ls-remote --tags --refs "$BASE/$1" 2> /dev/null | sed 's|.*refs/tags/||' | grep -E '^v[0-9]' | sort -V | tail -n 1
 }
 
-# fetch_install <app>: downloads that app's release for this CPU, verifies it and runs its install.sh
+# fetch_install <app> [version]: downloads that app's release for this CPU, verifies it and runs its install.sh
 fetch_install() {
 	app=$1
-	ver=${VERSION:-$(latest "$app")}
+	ver=${2:-$(latest "$app")}
 	[ -n "$ver" ] || die "couldn't find a release of $app at $BASE/$app (use --version, or SHARKS_BASE for a mirror)"
 	dir=$(mktemp -d)
 	say "downloading $app $ver ($ARCH)"
@@ -97,6 +106,12 @@ set_env() {
 	fi
 }
 
+# auto_update <file> <PREFIX>: lets the program update itself unless --no-auto-update was given
+auto_update() {
+	[ "$AUTOUP" = 1 ] && set_env "$1" "$2_AUTO_UPDATE" 1
+	return 0
+}
+
 firewall_open() { # firewall_open 80/tcp 443/tcp ...
 	if command -v ufw > /dev/null 2>&1 && ufw status 2> /dev/null | grep -q "Status: active"; then
 		for p in "$@"; do ufw allow "$p" > /dev/null; done
@@ -119,53 +134,18 @@ wait_active() { # wait_active <service>
 	systemctl is-active --quiet "$1" || { journalctl -u "$1" -n 20 --no-pager; die "$1 didn't start"; }
 }
 
-case $MODE in
-hammerhead)
-	fetch_install hammerhead
-	ENVF=/etc/hammerhead/hammerhead.env
-	if ! grep -q '^HAMMERHEAD_MASTER_KEY=.' "$ENVF"; then
-		say "generating the master key"
-		set_env "$ENVF" HAMMERHEAD_MASTER_KEY "$(/usr/local/bin/hammerhead -genkey)"
-		echo "Saved in $ENVF. Back that file up: without the key the encrypted secrets in the database can't be read."
-	fi
-	if [ -n "$DOMAIN" ]; then
-		set_env "$ENVF" HAMMERHEAD_URL "https://$DOMAIN"
-		# only Caddy needs to reach it
-		sed -i 's|-listen :8080|-listen 127.0.0.1:8080|' /etc/systemd/system/hammerhead.service
-		systemctl daemon-reload
-		if ! command -v caddy > /dev/null 2>&1; then
-			say "installing Caddy (HTTPS certificates for $DOMAIN)"
-			pkg_install caddy || die "couldn't install Caddy from this distribution; see https://caddyserver.com/docs/install and proxy $DOMAIN to 127.0.0.1:8080"
-		fi
-		mkdir -p /etc/caddy
-		printf '%s {\n\treverse_proxy 127.0.0.1:8080\n}\n' "$DOMAIN" > /etc/caddy/Caddyfile
-		systemctl enable caddy > /dev/null 2>&1 || true
-		systemctl restart caddy
-		firewall_open 80/tcp 443/tcp
-		URL="https://$DOMAIN"
-	else
-		firewall_open 8080/tcp
-		ip=$(public_ips | head -n 1)
-		URL="http://${ip:-this-server}:8080"
-		echo "No --domain given, so the dashboard is plain HTTP. Put it behind HTTPS before you create real logins (run this again with --domain)."
-	fi
-	systemctl restart hammerhead
-	wait_active hammerhead
-	say "Hammerhead is running"
-	echo "Open $URL to create the first administrator."
-	echo
-	echo "Next, in the dashboard: Server -> Edges -> add an edge, then on the machine that has your public IPs run"
-	echo "  sh setup.sh edge --hammerhead $URL --token <edge token>"
-	echo "and on each machine that hosts your services (home server, game server...) run"
-	echo "  sh setup.sh agent --hammerhead $URL --token <site token>"
-	echo "Either can be this same machine."
-	;;
-edge)
-	[ -n "$HH" ] && [ -n "$TOKEN" ] || die "edge needs --hammerhead URL and --token TOKEN (Server -> Edges -> Show command)"
-	fetch_install blacktip
+# listeners on 80/443 that would stop an edge serving websites
+port_users() {
+	ss -H -ltnp '( sport = :80 or sport = :443 )' 2> /dev/null | grep -v '"blacktip"\|"traefik"' || true
+}
+
+# edge_setup <hammerhead url> <token> <version>: Blacktip with its bundled Traefik, configured but not started
+edge_setup() {
+	fetch_install blacktip "$3"
 	ENVF=/etc/blacktip/blacktip.env
-	set_env "$ENVF" BLACKTIP_HAMMERHEAD "$HH"
-	set_env "$ENVF" BLACKTIP_TOKEN "$TOKEN"
+	set_env "$ENVF" BLACKTIP_HAMMERHEAD "$1"
+	set_env "$ENVF" BLACKTIP_TOKEN "$2"
+	auto_update "$ENVF" BLACKTIP
 	chmod 600 "$ENVF"
 	say "network"
 	# WireGuard moves a lot of UDP; the stock socket buffers are small
@@ -192,16 +172,98 @@ edge)
 	fi
 	echo "In the dashboard each port picks which of these addresses it listens on."
 	echo "Ports you open later in the dashboard must also be allowed in the firewall: run this again with --ports."
+}
+
+case $MODE in
+hammerhead)
+	fetch_install hammerhead "$VERSION"
+	ENVF=/etc/hammerhead/hammerhead.env
+	auto_update "$ENVF" HAMMERHEAD
+	if ! grep -q '^HAMMERHEAD_MASTER_KEY=.' "$ENVF"; then
+		say "generating the master key"
+		set_env "$ENVF" HAMMERHEAD_MASTER_KEY "$(/usr/local/lib/hammerhead/hammerhead -genkey)"
+		echo "Saved in $ENVF. Back that file up: without the key the encrypted secrets in the database can't be read."
+	fi
+	UNIT=/etc/systemd/system/hammerhead.service
+	if [ -n "$DOMAIN" ]; then
+		set_env "$ENVF" HAMMERHEAD_URL "https://$DOMAIN"
+		# only something on this machine needs to reach it
+		sed -i 's|-listen :8080|-listen 127.0.0.1:8080|' "$UNIT"
+		if [ "$CADDY" = 1 ]; then
+			systemctl daemon-reload
+			if ! command -v caddy > /dev/null 2>&1; then
+				say "installing Caddy (HTTPS certificates for $DOMAIN)"
+				pkg_install caddy || die "couldn't install Caddy from this distribution; see https://caddyserver.com/docs/install and proxy $DOMAIN to 127.0.0.1:8080"
+			fi
+			mkdir -p /etc/caddy
+			printf '%s {\n\treverse_proxy 127.0.0.1:8080\n}\n' "$DOMAIN" > /etc/caddy/Caddyfile
+			systemctl enable caddy > /dev/null 2>&1 || true
+			systemctl restart caddy
+			firewall_open 80/tcp 443/tcp
+			URL="https://$DOMAIN"
+		else
+			# the dashboard is served by the edge on this machine, so Hammerhead gets its own edge
+			set_env "$ENVF" HAMMERHEAD_SELF_DOMAIN "$DOMAIN"
+			[ -z "$TUNNEL" ] || set_env "$ENVF" HAMMERHEAD_SELF_TUNNEL "$TUNNEL"
+			URL="https://$DOMAIN"
+		fi
+	else
+		firewall_open 8080/tcp
+		ip=$(public_ips | head -n 1)
+		URL="http://${ip:-this-server}:8080"
+		echo "No --domain given, so the dashboard is plain HTTP. Put it behind HTTPS before you create real logins (run this again with --domain)."
+	fi
+	systemctl daemon-reload
+	systemctl restart hammerhead
+	wait_active hammerhead
+	say "Hammerhead is running"
+
+	if [ -n "$DOMAIN" ] && [ "$CADDY" = 0 ]; then
+		TOKENFILE=/var/lib/hammerhead/self-edge.env
+		for i in 1 2 3 4 5 6 7 8 9 10; do [ -f "$TOKENFILE" ] && break; sleep 1; done
+		[ -f "$TOKENFILE" ] || die "Hammerhead didn't create $TOKENFILE; check: journalctl -u hammerhead"
+		edge_token=$(sed -n 's/^BLACKTIP_TOKEN=//p' "$TOKENFILE")
+		edge_setup http://127.0.0.1:8080 "$edge_token" "$EDGE_VERSION"
+		# something else on 80/443 would stop the dashboard route from coming up
+		if systemctl is-active --quiet caddy 2> /dev/null; then
+			say "stopping Caddy"
+			echo "Caddy was serving this site and holds ports 80/443, which the edge needs now."
+			systemctl disable --now caddy > /dev/null 2>&1 || true
+		fi
+		others=$(port_users)
+		if [ -n "$others" ]; then
+			echo "$others" >&2
+			die "something else is listening on port 80 or 443 (above). Stop it (for Pangolin: docker compose stop), then run: systemctl restart blacktip"
+		fi
+		systemctl restart blacktip
+		wait_active blacktip
+		say "Blacktip is running"
+		echo "The dashboard is served by the edge on this machine at $URL once the certificate is issued"
+		echo "(a few seconds; $DOMAIN must point at this server). Until then, from your own computer:"
+		echo "  ssh -L 8080:127.0.0.1:8080 you@this-server      then open http://localhost:8080"
+	fi
+	echo
+	echo "Open $URL to create the first administrator."
+	echo
+	echo "Next: on each machine that hosts your services (home server, game server...) run"
+	echo "  sh setup.sh agent --hammerhead $URL --token <site token>"
+	echo "with the token from Sites -> add a site. For more public servers add edges under Server -> Edges and run"
+	echo "  sh setup.sh edge --hammerhead $URL --token <edge token>"
+	;;
+edge)
+	[ -n "$HH" ] && [ -n "$TOKEN" ] || die "edge needs --hammerhead URL and --token TOKEN (Server -> Edges -> Show command)"
+	edge_setup "$HH" "$TOKEN" "$VERSION"
 	systemctl restart blacktip
 	wait_active blacktip
 	say "Blacktip is running"
 	;;
 agent)
 	[ -n "$HH" ] && [ -n "$TOKEN" ] || die "agent needs --hammerhead URL and --token TOKEN (Sites -> Show command)"
-	fetch_install bamboo
+	fetch_install bamboo "$VERSION"
 	ENVF=/etc/bamboo/bamboo.env
 	set_env "$ENVF" BAMBOO_HAMMERHEAD "$HH"
 	set_env "$ENVF" BAMBOO_TOKEN "$TOKEN"
+	auto_update "$ENVF" BAMBOO
 	chmod 600 "$ENVF"
 	if command -v docker > /dev/null 2>&1 && getent group docker > /dev/null 2>&1; then
 		usermod -aG docker bamboo

e2e/e2e_test.go

@@ -241,6 +241,9 @@ func selfSigned(t *testing.T, host string) *tls.Certificate {
 
 // ---------- the environment ----------
 
+// siteCfgHook lets a test adjust the Bamboo that setup starts.
+var siteCfgHook func(*bamboo.Config)
+
 type world struct {
 	t       *testing.T
 	ts      *httptest.Server
@@ -297,7 +300,11 @@ func setup(t *testing.T, tr blacktip.TraefikConfig, opts ...func(*blacktip.Confi
 		t.Fatal(err)
 	}
 	go bt.Run(ctx)
-	bb, err := bamboo.New(bamboo.Config{Hammerhead: w.ts.URL, Token: site.Token, DataDir: t.TempDir()})
+	bbCfg := bamboo.Config{Hammerhead: w.ts.URL, Token: site.Token, DataDir: t.TempDir()}
+	if siteCfgHook != nil {
+		siteCfgHook(&bbCfg)
+	}
+	bb, err := bamboo.New(bbCfg)
 	if err != nil {
 		t.Fatal(err)
 	}

e2e/proxyproto_test.go

@@ -91,7 +91,10 @@ func proxyBackend(t *testing.T, seen chan<- string) int {
 func askFrom(t *testing.T, from, addr, send string) string {
 	t.Helper()
 	var last error
-	for i := 0; i < 50; i++ {
+	// The first connection through the tunnel can wait for the WireGuard handshake, which is
+	// slow on a busy CI runner, so a read timeout is retried until the overall deadline.
+	deadline := time.Now().Add(30 * time.Second)
+	for time.Now().Before(deadline) {
 		d := net.Dialer{LocalAddr: &net.TCPAddr{IP: net.ParseIP(from)}, Timeout: time.Second}
 		c, err := d.Dial("tcp", addr)
 		if err == nil {
@@ -102,9 +105,6 @@ func askFrom(t *testing.T, from, addr, send string) string {
 			if rerr == nil {
 				return strings.TrimSpace(line)
 			}
-			if ne, ok := rerr.(net.Error); ok && ne.Timeout() {
-				t.Fatalf("%s accepted the connection but never answered: %v", addr, rerr) // a real hang, not a startup race
-			}
 			last = rerr
 		} else {
 			last = err

e2e/updates_test.go

@@ -0,0 +1,132 @@
+package e2e
+
+import (
+	"context"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"git.veillax.com/Veillax/bamboo"
+	"git.veillax.com/Veillax/blacktip"
+	"git.veillax.com/Veillax/reef/model"
+)
+
+type edgeRow struct {
+	ID, Version, UpdateMsg string
+	AutoUpdate             bool
+	UpdatePending          bool
+	Online                 bool
+}
+
+func (w *world) edgeRow() edgeRow {
+	var edges []edgeRow
+	w.admin.must("GET", "/api/edges", nil, &edges)
+	for _, e := range edges {
+		if e.ID == w.edge {
+			return e
+		}
+	}
+	w.t.Fatal("edge not listed")
+	return edgeRow{}
+}
+
+func (w *world) siteRow() model.Site {
+	var st struct{ Sites []model.Site }
+	w.admin.must("GET", "/api/orgs/"+w.org+"/state", nil, &st)
+	for _, s := range st.Sites {
+		if s.ID == w.site {
+			return s
+		}
+	}
+	w.t.Fatal("site not listed")
+	return model.Site{}
+}
+
+func waitFor(t *testing.T, what string, ok func() bool) {
+	t.Helper()
+	for i := 0; i < 150; i++ {
+		if ok() {
+			return
+		}
+		time.Sleep(100 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for %s", what)
+}
+
+func TestEdgesAndSitesReportVersionsAndUpdateOnRequest(t *testing.T) {
+	var edgeCalls, siteCalls atomic.Int32
+	siteCfgHook = func(c *bamboo.Config) {
+		c.Version, c.AutoUpdate = "v0.1.0", true
+		c.UpdateNow = func(ctx context.Context, progress func(string, int, string)) (string, error) {
+			siteCalls.Add(1)
+			progress("checking", 10, "Checking for the newest release")
+			progress("done", 100, "Already on the newest release")
+			return "", nil
+		}
+	}
+	defer func() { siteCfgHook = nil }()
+	w := setup(t, blacktip.TraefikConfig{}, func(c *blacktip.Config) {
+		c.Version, c.AutoUpdate = "v0.1.0", true
+		c.UpdateNow = func(ctx context.Context, progress func(string, int, string)) (string, error) {
+			edgeCalls.Add(1)
+			progress("downloading", 40, "Downloading blacktip_v0.2.0_linux_amd64.tar.gz")
+			progress("downloading", 70, "Downloaded 28.0 of 40.0 MB (70%)")
+			progress("restarting", 100, "Installed v0.2.0; restarting into it")
+			return "v0.2.0", nil
+		}
+	})
+
+	waitFor(t, "the edge to report its version", func() bool { e := w.edgeRow(); return e.Version == "v0.1.0" && e.AutoUpdate })
+	waitFor(t, "the site to report its version", func() bool { s := w.siteRow(); return s.Version == "v0.1.0" && s.AutoUpdate })
+
+	w.admin.must("POST", "/api/edges/"+w.edge+"/update", nil, nil)
+	waitFor(t, "the edge to answer the update request", func() bool {
+		e := w.edgeRow()
+		return !e.UpdatePending && e.UpdateMsg == "updated to v0.2.0, restarting"
+	})
+	if edgeCalls.Load() != 1 {
+		t.Fatalf("the edge ran its update %d times, want 1", edgeCalls.Load())
+	}
+	var log struct {
+		Running bool
+		Stage   string
+		Pct     int
+		Lines   []string
+	}
+	w.admin.must("GET", "/api/edges/"+w.edge+"/update/log", nil, &log)
+	text := strings.Join(log.Lines, "; ")
+	if log.Running || log.Stage != "restarting" || log.Pct != 100 || !strings.Contains(text, "Update requested") || !strings.Contains(text, "Downloaded 28.0 of 40.0 MB") || !strings.Contains(text, "restarting into it") {
+		t.Fatalf("edge update log: %+v (%s)", log, text)
+	}
+
+	w.admin.must("POST", "/api/orgs/"+w.org+"/sites/"+w.site+"/update", nil, nil)
+	waitFor(t, "the site to answer the update request", func() bool {
+		s := w.siteRow()
+		return s.UpdateID == "" && s.UpdateMsg == "already on the newest release"
+	})
+	if siteCalls.Load() != 1 {
+		t.Fatalf("the site ran its update %d times, want 1", siteCalls.Load())
+	}
+	w.admin.must("GET", "/api/orgs/"+w.org+"/sites/"+w.site+"/update/log", nil, &log)
+	if log.Running || log.Stage != "done" || !strings.Contains(strings.Join(log.Lines, "; "), "Already on the newest release") {
+		t.Fatalf("site update log: %+v", log)
+	}
+
+	// asking again works and is a fresh request, not a leftover answer
+	w.admin.must("POST", "/api/edges/"+w.edge+"/update", nil, nil)
+	waitFor(t, "a second update request to be answered", func() bool { return edgeCalls.Load() == 2 && !w.edgeRow().UpdatePending })
+}
+
+func TestUpdatesNeedAutoUpdateOnTheMachine(t *testing.T) {
+	w := setup(t, blacktip.TraefikConfig{}) // no version, auto-update off
+	waitFor(t, "the edge to be online", func() bool { return w.edgeRow().Online })
+	code, body := w.admin.do("POST", "/api/edges/"+w.edge+"/update", nil, nil)
+	if code != 400 || !strings.Contains(body, "BLACKTIP_AUTO_UPDATE") {
+		t.Fatalf("update on an edge without auto-update: %d %s", code, body)
+	}
+	code, body = w.admin.do("POST", "/api/orgs/"+w.org+"/sites/"+w.local+"/update", nil, nil)
+	if code != 400 {
+		t.Fatalf("update on a local site: %d %s", code, body)
+	}
+}

go.mod

@@ -3,9 +3,9 @@ module git.veillax.com/Veillax/hammerhead
 go 1.27.3
 
 require (
-	git.veillax.com/Veillax/bamboo v0.1.0
-	git.veillax.com/Veillax/blacktip v0.1.0
-	git.veillax.com/Veillax/reef v0.1.0
+	git.veillax.com/Veillax/bamboo v0.1.5
+	git.veillax.com/Veillax/blacktip v0.1.7
+	git.veillax.com/Veillax/reef v0.1.7
 	github.com/emersion/go-msgauth v0.7.0
 	golang.org/x/crypto v0.58.0
 	modernc.org/sqlite v1.61.0

go.sum

@@ -1,9 +1,29 @@
 git.veillax.com/Veillax/bamboo v0.1.0 h1:16BG1P8982dIkHA2l0LPS0xYQc8d86PruVAGxc8BP84=
 git.veillax.com/Veillax/bamboo v0.1.0/go.mod h1:i4l4uJgG6Ymfwbjnlz0xeTt3qW/+1W1L2JBToMw50n0=
+git.veillax.com/Veillax/bamboo v0.1.3 h1:A66gz9GmmtUq1iIGUAL2ItIeC6iTy5pvqJOoIjRHjFg=
+git.veillax.com/Veillax/bamboo v0.1.3/go.mod h1:UuHV6aNHmV9jpow0xeGlXX0QhMB9glPJUGzgIM7S1MM=
+git.veillax.com/Veillax/bamboo v0.1.4 h1:pgiBJA46CBJx7T3bloCjPekb6wl6W5H8teokFAH5gj0=
+git.veillax.com/Veillax/bamboo v0.1.4/go.mod h1:wzSpfql7U4a3b9mCVH01OPG9H9szrzwSFDufWw02e0g=
+git.veillax.com/Veillax/bamboo v0.1.5 h1:i81c75/7wjayP9tOQ3tSnJWTBhvbjAwNBEPhT+3P2Xk=
+git.veillax.com/Veillax/bamboo v0.1.5/go.mod h1:se4kkcP6c3uCGD4HQd+nDLoblS0lN8qa+eFWLo5Horw=
 git.veillax.com/Veillax/blacktip v0.1.0 h1:L8WpW56gqtvZ1IAapE95Ynl6NKjqTA98WwmEH01kFFk=
 git.veillax.com/Veillax/blacktip v0.1.0/go.mod h1:sj+mr8393rajzWbl0+RRZrstGyDtZ/GHsut6ebScVxg=
+git.veillax.com/Veillax/blacktip v0.1.4 h1:o3uNoA0ucB/qcN9ccofysdFA6RTEU4jKdgeTWuE2Uw0=
+git.veillax.com/Veillax/blacktip v0.1.4/go.mod h1:f7zXCYlQf/9ffDLjPrMHylKAyXX4Nb+aQ7kErmOOhqI=
+git.veillax.com/Veillax/blacktip v0.1.6 h1:dUJzNGXgieWX05ftWjnMfh6norhaeKTqo1P13lJvjtk=
+git.veillax.com/Veillax/blacktip v0.1.6/go.mod h1:ZnPRc2gPh9ElILfPH39G/x3B6KAiHQyeoDLycSDgVPM=
+git.veillax.com/Veillax/blacktip v0.1.7 h1:PjxEkhE4fnGWht9Pj2/l6S8fOX2Iqjir3rc9vfpMFiQ=
+git.veillax.com/Veillax/blacktip v0.1.7/go.mod h1:dVm4wC6wufPjFzK8pvHnqNJJlxroRYmnq8mdkCqOKGc=
 git.veillax.com/Veillax/reef v0.1.0 h1:O0OhEKFx2CsvACJ20sfzJNjGsngomtfDdKdxu4ROpCs=
 git.veillax.com/Veillax/reef v0.1.0/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.3 h1:RxSq2xwaup1+MieAkhlvOTZnYwPf19thFHEAe/7VxsI=
+git.veillax.com/Veillax/reef v0.1.3/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.4 h1:T2+B8P1GAitEyTYRkwMT3UHbG9mN5zXb/inE2muXdQ4=
+git.veillax.com/Veillax/reef v0.1.4/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.6 h1:NgZ4u2Z3hJ+BYD/zX9lov8fox4s2i8txtYNOpIsikVo=
+git.veillax.com/Veillax/reef v0.1.6/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
+git.veillax.com/Veillax/reef v0.1.7 h1:5C2udonlJac2xvDOE5e+zDxej+AbZ9ttrNSE4owmwuU=
+git.veillax.com/Veillax/reef v0.1.7/go.mod h1:ZBUd/BARO5kkpUNTP81TTY1aQXLHFR6bKDhCxckjHso=
 github.com/Microsoft/go-winio v0.6.4 h1:kJF2pamtYCWXf0xAT8sAkwKC0pMl2HYBrRPHAqyUc+g=
 github.com/Microsoft/go-winio v0.6.4/go.mod h1:1xl5JXG4ze/m74GH6Dc4Mwxfc3VL5siRVQjIAlHH07U=
 github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=

infra.go

@@ -24,6 +24,11 @@ type edgeView struct {
 	TunnelAddr string   `json:"tunnelAddr,omitempty"`
 	Token      string   `json:"token,omitempty"`
 	OrgIDs     []string `json:"orgIds,omitempty"`
+
+	Version       string `json:"version,omitempty"`
+	AutoUpdate    bool   `json:"autoUpdate,omitempty"`
+	UpdatePending bool   `json:"updatePending,omitempty"`
+	UpdateMsg     string `json:"updateMsg,omitempty"`
 }
 
 func (s *Server) viewEdge(e *model.Edge, admin bool) edgeView {
@@ -33,6 +38,7 @@ func (s *Server) viewEdge(e *model.Edge, admin bool) edgeView {
 	}
 	if admin {
 		v.TunnelAddr, v.Token, v.OrgIDs = e.TunnelAddr, e.Token, e.OrgIDs
+		v.Version, v.AutoUpdate, v.UpdatePending, v.UpdateMsg = e.Version, e.AutoUpdate, e.UpdateID != "", e.UpdateMsg
 		if v.OrgIDs == nil {
 			v.OrgIDs = []string{}
 		}

paths_test.go

@@ -0,0 +1,34 @@
+package hammerhead
+
+import (
+	"os"
+	"regexp"
+	"testing"
+)
+
+// Every address the dashboard JavaScript navigates to must be served by the server, or a
+// reload on that page would 404.
+func TestDashboardPathsMatchThePage(t *testing.T) {
+	src, err := os.ReadFile("web/index.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	m := regexp.MustCompile(`TAB_PATH = \{([^}]*)\}`).FindSubmatch(src)
+	if m == nil {
+		t.Fatal("TAB_PATH not found in web/index.html")
+	}
+	paths := regexp.MustCompile(`'(/[a-z/-]+)'`).FindAllSubmatch(m[1], -1)
+	if len(paths) < 10 {
+		t.Fatalf("found only %d page paths", len(paths))
+	}
+	for _, p := range paths {
+		if !isDashboardPath(string(p[1])) {
+			t.Errorf("%s is a dashboard page but the server doesn't serve it", p[1])
+		}
+	}
+	for _, p := range []string{"/api/me", "/nope", "/server", "/server/nope"} {
+		if isDashboardPath(p) {
+			t.Errorf("%s should not serve the dashboard", p)
+		}
+	}
+}

selfedge.go

@@ -0,0 +1,71 @@
+package hammerhead
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"git.veillax.com/Veillax/reef/model"
+)
+
+const selfMappingID = "hammerhead-dashboard"
+
+// ensureSelfEdge makes sure this server has an edge of its own, for a Blacktip on the same
+// machine, and writes that edge's token to <data>/self-edge.env for the installer. The edge
+// also carries a built-in https route for the dashboard (see selfMapping), so no separate
+// reverse proxy is needed in front of Hammerhead.
+func (s *Server) ensureSelfEdge() error {
+	o := s.opts
+	if o.SelfDomain == "" {
+		return nil
+	}
+	host, port, err := net.SplitHostPort(o.SelfTarget)
+	if err != nil {
+		return fmt.Errorf("HAMMERHEAD_SELF_DOMAIN needs a listen address like 127.0.0.1:8080: %w", err)
+	}
+	if n, _ := strconv.Atoi(port); n < 1 || host == "" {
+		return errors.New("the dashboard's listen address needs a host and a port")
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	e := s.findEdge(s.st.Settings.SelfEdgeID)
+	if e == nil {
+		e = &model.Edge{ID: newID(), Name: "Hammerhead server", Token: randHex(24), AuthKey: randHex(32),
+			TunnelAddr: o.SelfTunnel, TunnelIP: s.allocIPLocked(), OrgIDs: []string{}, IPs: []string{}}
+		s.st.Edges = append(s.st.Edges, e)
+		s.st.Sites = append(s.st.Sites, &model.Site{ID: newID(), Name: e.Name + " (this machine)",
+			Local: true, EdgeID: e.ID, Connected: []string{}})
+		s.st.Settings.SelfEdgeID = e.ID
+		s.bump()
+	}
+	body := "# written by Hammerhead for the Blacktip on this machine; keep it private\nBLACKTIP_TOKEN=" + e.Token + "\n"
+	return os.WriteFile(filepath.Join(s.dir, "self-edge.env"), []byte(body), 0o600)
+}
+
+// selfMapping is the dashboard's own route on the self edge: https on the configured name,
+// forwarded to Hammerhead's listen address through the edge's local site. It is added to that
+// edge's config and never stored, so it can't be edited or deleted by mistake in the UI.
+// Caller holds s.mu.
+func (s *Server) selfMapping(e *model.Edge) *model.Mapping {
+	o := s.opts
+	if o.SelfDomain == "" || e.ID != s.st.Settings.SelfEdgeID {
+		return nil
+	}
+	host, port, err := net.SplitHostPort(o.SelfTarget)
+	if err != nil {
+		return nil
+	}
+	n, _ := strconv.Atoi(port)
+	for _, st := range s.st.Sites {
+		if st.Local && st.EdgeID == e.ID {
+			return &model.Mapping{ID: selfMappingID, Name: "Hammerhead dashboard", Proto: model.ProtoHTTPS, EdgeID: e.ID,
+				BindIP: "0.0.0.0", Port: 443, Hostname: strings.ToLower(o.SelfDomain), Enabled: true, RedirectHTTP: true,
+				HealthSeconds: -1, Targets: []model.Target{{SiteID: st.ID, Host: host, Port: n}}}
+		}
+	}
+	return nil
+}

selfedge_test.go

@@ -0,0 +1,121 @@
+package hammerhead
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.veillax.com/Veillax/hammerhead/internal/secretbox"
+	"git.veillax.com/Veillax/reef/model"
+)
+
+func edgeConfigOf(t *testing.T, s *Server, token string) model.EdgeConfig {
+	t.Helper()
+	ts := httptest.NewServer(s.Handler())
+	defer ts.Close()
+	req, _ := http.NewRequest("GET", ts.URL+"/edge/config?v=0", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	var cfg model.EdgeConfig
+	if resp.StatusCode != 200 {
+		t.Fatalf("edge config: %s", resp.Status)
+	}
+	json.NewDecoder(resp.Body).Decode(&cfg)
+	return cfg
+}
+
+func tokenFile(t *testing.T, dir string) string {
+	b, err := os.ReadFile(filepath.Join(dir, "self-edge.env"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return strings.TrimSpace(strings.SplitN(strings.SplitN(string(b), "BLACKTIP_TOKEN=", 2)[1], "\n", 2)[0])
+}
+
+var key = secretbox.GenerateKey()
+
+func TestSelfEdgeServesTheDashboardWithoutAProxy(t *testing.T) {
+	dir := t.TempDir()
+	opts := Options{MasterKey: key, SelfDomain: "Hammerhead.Example.com", SelfTarget: "127.0.0.1:8080"}
+	s, err := New(dir, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := tokenFile(t, dir)
+	cfg := edgeConfigOf(t, s, token)
+	if len(cfg.Mappings) != 1 || len(cfg.Local) != 1 {
+		t.Fatalf("mappings=%d local=%d", len(cfg.Mappings), len(cfg.Local))
+	}
+	m := cfg.Mappings[0]
+	if m.Proto != model.ProtoHTTPS || m.Hostname != "hammerhead.example.com" || m.Port != 443 || !m.RedirectHTTP || !m.Enabled ||
+		len(m.Targets) != 1 || m.Targets[0].Host != "127.0.0.1" || m.Targets[0].Port != 8080 || m.Targets[0].SiteID != cfg.Local[0] {
+		t.Fatalf("unexpected dashboard route: %+v", m)
+	}
+	if m.Auth.Protected() {
+		t.Fatal("the dashboard has its own login and must not sit behind resource auth")
+	}
+	edgeID := s.st.Settings.SelfEdgeID
+	if info, _ := os.Stat(filepath.Join(dir, "self-edge.env")); info.Mode().Perm()&0o077 != 0 && os.PathSeparator == '/' {
+		t.Fatalf("token file is readable by others: %v", info.Mode())
+	}
+	s.Close()
+
+	// a restart keeps the same edge and token instead of making a new one
+	s2, err := New(dir, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s2.Close()
+	if s2.st.Settings.SelfEdgeID != edgeID || tokenFile(t, dir) != token || len(s2.st.Edges) != 1 {
+		t.Fatal("restart changed the self edge")
+	}
+	if len(edgeConfigOf(t, s2, token).Mappings) != 1 {
+		t.Fatal("route missing after restart")
+	}
+}
+
+func TestNoSelfEdgeUnlessAsked(t *testing.T) {
+	dir := t.TempDir()
+	s, err := New(dir, Options{MasterKey: key})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close()
+	if len(s.st.Edges) != 0 {
+		t.Fatal("an edge appeared without HAMMERHEAD_SELF_DOMAIN")
+	}
+	if _, err := os.Stat(filepath.Join(dir, "self-edge.env")); err == nil {
+		t.Fatal("token file written without HAMMERHEAD_SELF_DOMAIN")
+	}
+}
+
+func TestSavingSettingsKeepsTheSelfEdge(t *testing.T) {
+	dir := t.TempDir()
+	opts := Options{AdminEmail: "admin@test.local", AdminPassword: "password123", MasterKey: key, SelfDomain: "hh.example.com", SelfTarget: "127.0.0.1:8080"}
+	s, err := New(dir, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	token := tokenFile(t, dir)
+	do := apiClient(t, s)
+	if code, b := do("PUT", "/api/admin/settings", map[string]any{"dashboardUrl": "https://hh.example.com", "acmeEmail": "me@example.com"}); code != 200 {
+		t.Fatalf("settings: %d %s", code, b)
+	}
+	s.Close()
+	s2, err := New(dir, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s2.Close()
+	if len(s2.st.Edges) != 1 || tokenFile(t, dir) != token {
+		t.Fatalf("saving settings lost the self edge: %d edges", len(s2.st.Edges))
+	}
+}

server.go

@@ -21,11 +21,22 @@ func page(html []byte) http.HandlerFunc {
 	}
 }
 
+// dashboardPaths are the addresses the dashboard shows pages at. They all serve the same app,
+// which reads the path to decide what to show. Keep in step with TAB_PATH in web/index.html.
+var dashboardPaths = map[string]bool{
+	"/": true, "/apps": true, "/resources": true, "/sites": true, "/domains": true, "/mail-egress": true,
+	"/alerts": true, "/access": true, "/logs": true, "/account": true,
+	"/server/edges": true, "/server/organizations": true, "/server/users": true, "/server/sso": true,
+	"/server/settings": true, "/server/alerts": true, "/server/audit": true,
+}
+
+func isDashboardPath(p string) bool { return dashboardPaths[p] }
+
 func (s *Server) Handler() http.Handler {
 	mux := http.NewServeMux()
 	index := page(indexHTML)
 	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/" {
+		if !isDashboardPath(r.URL.Path) {
 			http.NotFound(w, r)
 			return
 		}
@@ -86,6 +97,14 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("GET /api/admin/settings", s.withServerAdmin(s.getSettings))
 	mux.HandleFunc("PUT /api/admin/settings", s.withServerAdmin(s.putSettings))
 	mux.HandleFunc("POST /api/admin/settings/test-mail", s.withServerAdmin(s.testMail))
+	mux.HandleFunc("GET /api/admin/update", s.withServerAdmin(s.checkUpdate))
+	mux.HandleFunc("POST /api/admin/update/apply", s.withServerAdmin(s.applyUpdate))
+	mux.HandleFunc("GET /api/admin/update/status", s.withServerAdmin(s.updateStatus))
+	mux.HandleFunc("GET /api/versions", s.withUser(s.latestVersions))
+	mux.HandleFunc("GET /api/edges/{id}/update/log", s.withServerAdmin(s.edgeUpdateLog))
+	mux.HandleFunc("GET /api/orgs/{org}/sites/{id}/update/log", s.withOrg(true, s.siteUpdateLog))
+	mux.HandleFunc("POST /api/edges/{id}/update", s.withServerAdmin(s.updateEdge))
+	mux.HandleFunc("POST /api/orgs/{org}/sites/{id}/update", s.withOrg(true, s.updateSite))
 	mux.HandleFunc("GET /api/admin/audit", s.withServerAdmin(func(w http.ResponseWriter, r *http.Request, p *principal) {
 		writeJSON(w, 200, s.logs.queryAudit("", 300, 0))
 	}))

settings.go

@@ -41,6 +41,7 @@ func (s *Server) putSettings(w http.ResponseWriter, r *http.Request, p *principa
 	if s.opts.DashboardURL != "" {
 		in.DashboardURL = s.st.Settings.DashboardURL // pinned by flag/env
 	}
+	in.SelfEdgeID = s.st.Settings.SelfEdgeID // not editable here; losing it would make the next start create a second self edge
 	s.st.Settings = in
 	s.bump() // edges receive the dashboard URL and ACME settings
 	s.mu.Unlock()

store.go

@@ -111,6 +111,8 @@ type Settings struct {
 	AcmeEmail    string `json:"acmeEmail"`
 	AcmeStaging  bool   `json:"acmeStaging"`
 	SMTP         SMTP   `json:"smtp"`
+	// SelfEdgeID is this server's own edge (see HAMMERHEAD_SELF_DOMAIN).
+	SelfEdgeID string `json:"selfEdgeId,omitempty"`
 }
 
 type Secret struct {
@@ -170,6 +172,22 @@ type Options struct {
 	AlertInterval    time.Duration // how often alerts are evaluated; 0 = 15s
 	AlertDebounce    time.Duration // overrides the per-organization delay before alerting (tests)
 	OfflineAfter     time.Duration // how long an edge or site may stay silent before it counts as down; 0 = 90s
+
+	// SelfDomain (HAMMERHEAD_SELF_DOMAIN) gives this server an edge of its own, with a built-in
+	// https route for the dashboard at that name, so no reverse proxy is needed in front of it.
+	// SelfTarget is the address Hammerhead listens on (e.g. 127.0.0.1:8080); SelfTunnel is the
+	// edge's public WireGuard endpoint (default <SelfDomain>:51820).
+	SelfDomain string
+	SelfTarget string
+	SelfTunnel string
+
+	// Version is the running release (e.g. v0.1.5), shown under Settings with a check for updates.
+	Version string
+	// AutoUpdate says whether this process updates itself (HAMMERHEAD_AUTO_UPDATE), for the same screen.
+	AutoUpdate bool
+	// UpdateServer and UpdateRepo say where releases are published; the defaults are this project's own.
+	UpdateServer string
+	UpdateRepo   string
 }
 
 type Server struct {
@@ -191,6 +209,11 @@ type Server struct {
 	oidc    map[string]*oidcDoc
 
 	alerts   map[string]*alertState // active problems by key (see alerts.go)
+	updRuns  map[string]*updRun     // progress of updates running on edges and sites, by ID
+	selfUpd  selfUpdate             // progress of this server's own update
+	verMu    sync.Mutex             // guards verCache and verAt, the latest releases seen by /api/versions
+	verCache map[string]string
+	verAt    time.Time
 	mtaSent  map[string]time.Time // reminder throttle for repeat notifications
 
 	logs *logStore
@@ -232,6 +255,7 @@ func New(dir string, opts Options) (*Server, error) {
 		oidc:       map[string]*oidcDoc{},
 		alerts:     map[string]*alertState{},
 		mtaSent:    map[string]time.Time{},
+		updRuns:    map[string]*updRun{},
 	}
 	s.st.Sessions = map[string]*Session{}
 	s.st.Secrets = map[string]*Secret{}
@@ -258,6 +282,14 @@ func New(dir string, opts Options) (*Server, error) {
 			return nil, err
 		}
 	}
+	if opts.SelfDomain != "" && opts.SelfTunnel == "" {
+		s.opts.SelfTunnel = opts.SelfDomain + ":51820"
+	}
+	s.finishSelfUpdateLog()
+	if err := s.ensureSelfEdge(); err != nil {
+		db.Close()
+		return nil, err
+	}
 	if err := s.save(); err != nil {
 		db.Close()
 		return nil, err

update.go

@@ -0,0 +1,183 @@
+package hammerhead
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"git.veillax.com/Veillax/reef/selfupdate"
+)
+
+func (s *Server) updateConfig(app, current string) selfupdate.Config {
+	o := s.opts
+	server := o.UpdateServer
+	if server == "" {
+		server = "https://git.veillax.com"
+	}
+	owner := "Veillax"
+	if o.UpdateRepo != "" {
+		owner = strings.SplitN(o.UpdateRepo, "/", 2)[0]
+	}
+	return selfupdate.Config{Server: server, Repo: owner + "/" + app, App: app, Current: current}
+}
+
+// checkUpdate asks the release server whether a newer Hammerhead exists. It only looks.
+func (s *Server) checkUpdate(w http.ResponseWriter, r *http.Request, p *principal) {
+	o := s.opts
+	ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
+	defer cancel()
+	out := map[string]any{"current": o.Version, "autoUpdate": o.AutoUpdate, "checked": time.Now()}
+	latest, newer, err := selfupdate.Check(ctx, s.updateConfig("hammerhead", o.Version))
+	out["latest"], out["newer"] = latest, newer
+	if err != nil {
+		out["error"] = err.Error()
+	}
+	writeJSON(w, 200, out)
+}
+
+// applyUpdate installs the newest release of Hammerhead itself and restarts into it. Like the
+// scheduled check it needs auto-update to be on, which is also what makes the binary replaceable.
+func (s *Server) applyUpdate(w http.ResponseWriter, r *http.Request, p *principal) {
+	if !s.opts.AutoUpdate {
+		fail(w, 400, errors.New("auto-update is off: set HAMMERHEAD_AUTO_UPDATE=1 and restart Hammerhead, or update it by hand"))
+		return
+	}
+	u := &s.selfUpd
+	u.mu.Lock()
+	if u.running {
+		u.mu.Unlock()
+		fail(w, 409, errors.New("an update is already running"))
+		return
+	}
+	u.running, u.stage, u.pct, u.lines = true, "starting", 0, nil
+	u.mu.Unlock()
+	os.WriteFile(s.updateLogPath(), nil, 0o600) // a new run starts a new log
+	cfg := s.updateConfig("hammerhead", s.opts.Version)
+	cfg.Progress = func(e selfupdate.Event) { s.selfNote(e.Stage, e.Pct, e.Line) }
+	cfg.Restart = func(exe string) error {
+		s.selfNote("restarting", 100, "Closing the database and restarting")
+		s.Close()
+		return selfupdate.Restart(exe)
+	}
+	s.selfNote("starting", 0, "Update requested by "+p.User.Email)
+	s.audit("", p.User.Email, "server.update", "")
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+		defer cancel()
+		selfupdate.CheckOnce(ctx, cfg) // on success the process is replaced and this never returns
+		u.mu.Lock()
+		u.running = false
+		u.mu.Unlock()
+	}()
+	writeJSON(w, 200, map[string]any{"started": true})
+}
+
+// latestVersions returns the newest release of each program, for "update available" badges. Results
+// are cached for ten minutes so a busy dashboard doesn't hammer the release server.
+func (s *Server) latestVersions(w http.ResponseWriter, r *http.Request, p *principal) {
+	s.verMu.Lock()
+	if time.Since(s.verAt) > 10*time.Minute || s.verCache == nil {
+		ctx, cancel := context.WithTimeout(r.Context(), 15*time.Second)
+		out := map[string]string{}
+		var mu sync.Mutex
+		var wg sync.WaitGroup
+		for _, app := range []string{"hammerhead", "blacktip", "bamboo"} {
+			wg.Add(1)
+			go func(app string) {
+				defer wg.Done()
+				if tag, _, err := selfupdate.Check(ctx, s.updateConfig(app, "")); err == nil && tag != "" {
+					mu.Lock()
+					out[app] = tag
+					mu.Unlock()
+				}
+			}(app)
+		}
+		wg.Wait()
+		cancel()
+		s.verCache, s.verAt = out, time.Now()
+	}
+	out := s.verCache
+	s.verMu.Unlock()
+	writeJSON(w, 200, out)
+}
+
+// noteUpdateReport records what an edge or site says about its version and any update that was
+// requested of it. It reports whether a pending request was answered, which means the config the
+// agent polls has changed (it no longer carries the request).
+func noteUpdateReport(version *string, auto *bool, updateID, updateMsg *string, inVersion string, inAuto bool, inID, inMsg string) bool {
+	upgraded := *version != "" && inVersion != "" && inVersion != *version
+	if inVersion != "" {
+		*version = inVersion
+	}
+	*auto = inAuto
+	if *updateID == "" {
+		return false
+	}
+	switch {
+	case inID == *updateID && inMsg != "":
+		*updateMsg = inMsg
+	case upgraded:
+		*updateMsg = "updated to " + inVersion
+	default:
+		return false
+	}
+	*updateID = ""
+	return true
+}
+
+func (s *Server) updateEdge(w http.ResponseWriter, r *http.Request, p *principal) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	e := s.findEdge(r.PathValue("id"))
+	if e == nil {
+		fail(w, 404, errors.New("no such edge"))
+		return
+	}
+	if err := requestUpdate(&e.AutoUpdate, &e.UpdateID, &e.UpdateMsg, s.edgeOnline(e), "BLACKTIP"); err != nil {
+		fail(w, 400, err)
+		return
+	}
+	delete(s.updRuns, e.ID) // a new request starts a new log
+	s.bump()
+	s.audit("", p.User.Email, "edge.update", e.Name)
+	ok(w)
+}
+
+func (s *Server) updateSite(w http.ResponseWriter, r *http.Request, c *orgCtx) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	st := s.findSite(r.PathValue("id"))
+	if st == nil || !s.siteVisible(c, st) {
+		fail(w, 404, errors.New("no such site"))
+		return
+	}
+	if st.Local {
+		fail(w, 400, errors.New("this site is the edge's own machine; update the edge instead"))
+		return
+	}
+	if err := requestUpdate(&st.AutoUpdate, &st.UpdateID, &st.UpdateMsg, s.siteOnline(st), "BAMBOO"); err != nil {
+		fail(w, 400, err)
+		return
+	}
+	delete(s.updRuns, st.ID)
+	s.bump()
+	s.audit(c.Org.ID, c.Actor, "site.update", st.Name)
+	ok(w)
+}
+
+// requestUpdate marks an update as wanted. The agent installs it only if it has auto-update on, and
+// the request stays until the agent answers (or reports a new version). Asking again replaces it.
+func requestUpdate(auto *bool, updateID, updateMsg *string, online bool, prefix string) error {
+	if !online {
+		return errors.New("it is offline right now")
+	}
+	if !*auto {
+		return errors.New("it isn't running with auto-update on, so it won't install updates from here (set " + prefix + "_AUTO_UPDATE=1 and restart it)")
+	}
+	*updateID, *updateMsg = randHex(8), ""
+	return nil
+}

update_test.go

@@ -0,0 +1,90 @@
+package hammerhead
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestCheckForUpdates(t *testing.T) {
+	gitea := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/repos/Veillax/hammerhead/releases/latest" {
+			http.NotFound(w, r)
+			return
+		}
+		fmt.Fprint(w, `{"tag_name":"v0.3.0","prerelease":false,"assets":[]}`)
+	}))
+	defer gitea.Close()
+	for _, c := range []struct {
+		version string
+		newer   bool
+	}{{"v0.2.0", true}, {"v0.3.0", false}, {"dev", false}} {
+		s, err := New(t.TempDir(), Options{AdminEmail: "admin@test.local", AdminPassword: "password123", MasterKey: key,
+			Version: c.version, UpdateServer: gitea.URL, UpdateRepo: "Veillax/hammerhead", AutoUpdate: true})
+		if err != nil {
+			t.Fatal(err)
+		}
+		do := apiClient(t, s)
+		code, b := do("GET", "/api/admin/update", nil)
+		var out struct {
+			Current, Latest, Error string
+			Newer, AutoUpdate      bool
+		}
+		json.Unmarshal(b, &out)
+		if code != 200 || out.Current != c.version || out.Latest != "v0.3.0" || out.Newer != c.newer || !out.AutoUpdate || out.Error != "" {
+			t.Errorf("%s: %d %s", c.version, code, b)
+		}
+		s.Close()
+	}
+
+	// an unreachable release server is reported, not fatal
+	s, err := New(t.TempDir(), Options{AdminEmail: "admin@test.local", AdminPassword: "password123", MasterKey: key, Version: "v0.1.0", UpdateServer: "http://127.0.0.1:1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close()
+	code, b := apiClient(t, s)("GET", "/api/admin/update", nil)
+	var out struct{ Error string }
+	json.Unmarshal(b, &out)
+	if code != 200 || out.Error == "" {
+		t.Errorf("unreachable server: %d %s", code, b)
+	}
+}
+
+func TestSelfUpdateLogSurvivesTheRestartItEndsWith(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "update.log"), []byte("12:00:00 Checking\n12:00:09 Installed v0.3.0; restarting into it\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	s, err := New(dir, Options{AdminEmail: "admin@test.local", AdminPassword: "password123", MasterKey: key, Version: "v0.3.0"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer s.Close()
+	do := apiClient(t, s)
+	code, b := do("GET", "/api/admin/update/status", nil)
+	var out struct {
+		Running bool
+		Stage   string
+		Pct     int
+		Lines   []string
+		Version string
+	}
+	json.Unmarshal(b, &out)
+	last := ""
+	if len(out.Lines) > 0 {
+		last = out.Lines[len(out.Lines)-1]
+	}
+	if code != 200 || out.Running || out.Stage != "done" || out.Pct != 100 || len(out.Lines) != 3 || !strings.Contains(last, "now running v0.3.0") {
+		t.Fatalf("status: %d %s", code, b)
+	}
+	// starting an update needs auto-update on
+	if code, b := do("POST", "/api/admin/update/apply", nil); code != 400 || !strings.Contains(string(b), "HAMMERHEAD_AUTO_UPDATE") {
+		t.Fatalf("apply without auto-update: %d %s", code, b)
+	}
+}

updatelog.go

@@ -0,0 +1,152 @@
+package hammerhead
+
+import (
+	"errors"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+)
+
+const maxUpdateLines = 200
+
+// updRun is the progress of one update an edge or site is carrying out, as that agent reported it.
+type updRun struct {
+	ID    string // the update request it belongs to
+	Stage string
+	Pct   int
+	Lines []string
+}
+
+// recordUpdateProgress keeps what an agent says about the update it is running. When the agent
+// reports a new version, the update is finished: its log gets a closing line and is then left alone,
+// so the freshly restarted program (which starts a new, empty log) can't overwrite it.
+// Caller holds s.mu.
+func (s *Server) recordUpdateProgress(agentID, reqID, stage string, pct int, lines []string, oldVersion, newVersion string) {
+	run := s.updRuns[agentID]
+	if run != nil && run.Stage != "done" && oldVersion != "" && newVersion != "" && newVersion != oldVersion {
+		run.Lines = append(run.Lines, time.Now().Format("15:04:05")+" Now running "+newVersion)
+		run.Stage, run.Pct = "done", 100
+		return
+	}
+	if reqID == "" || (stage == "" && len(lines) == 0) {
+		return
+	}
+	if run != nil && run.ID == reqID && run.Stage == "done" {
+		return
+	}
+	s.updRuns[agentID] = &updRun{ID: reqID, Stage: stage, Pct: pct, Lines: lines}
+}
+
+func (s *Server) updateLogView(agentID string, pending bool, msg, version string) map[string]any {
+	out := map[string]any{"running": pending, "msg": msg, "version": version, "stage": "", "pct": 0, "lines": []string{}}
+	if run := s.updRuns[agentID]; run != nil {
+		out["stage"], out["pct"], out["lines"] = run.Stage, run.Pct, run.Lines
+	}
+	return out
+}
+
+func (s *Server) edgeUpdateLog(w http.ResponseWriter, r *http.Request, p *principal) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	e := s.findEdge(r.PathValue("id"))
+	if e == nil {
+		fail(w, 404, errors.New("no such edge"))
+		return
+	}
+	writeJSON(w, 200, s.updateLogView(e.ID, e.UpdateID != "", e.UpdateMsg, e.Version))
+}
+
+func (s *Server) siteUpdateLog(w http.ResponseWriter, r *http.Request, c *orgCtx) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	st := s.findSite(r.PathValue("id"))
+	if st == nil || !s.siteVisible(c, st) {
+		fail(w, 404, errors.New("no such site"))
+		return
+	}
+	writeJSON(w, 200, s.updateLogView(st.ID, st.UpdateID != "", st.UpdateMsg, st.Version))
+}
+
+// selfUpdate is the progress of this server's own update. It is kept in memory and in <data>/update.log,
+// so the page can still show it after the restart that ends a successful update.
+type selfUpdate struct {
+	mu      sync.Mutex
+	running bool
+	stage   string
+	pct     int
+	lines   []string
+}
+
+func (s *Server) updateLogPath() string { return filepath.Join(s.dir, "update.log") }
+
+func (s *Server) selfNote(stage string, pct int, line string) {
+	u := &s.selfUpd
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	if stage != "" {
+		u.stage = stage
+	}
+	if pct >= 0 {
+		u.pct = pct
+	}
+	if line == "" {
+		return
+	}
+	line = time.Now().Format("15:04:05") + " " + line
+	u.lines = append(u.lines, line)
+	if len(u.lines) > maxUpdateLines {
+		u.lines = u.lines[len(u.lines)-maxUpdateLines:]
+	}
+	if f, err := os.OpenFile(s.updateLogPath(), os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600); err == nil {
+		f.WriteString(line + "\n")
+		f.Close()
+	}
+}
+
+func readLines(path string) []string {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil
+	}
+	lines := strings.Split(strings.TrimRight(string(b), "\n"), "\n")
+	if len(lines) == 1 && lines[0] == "" {
+		return nil
+	}
+	if len(lines) > maxUpdateLines {
+		lines = lines[len(lines)-maxUpdateLines:]
+	}
+	return lines
+}
+
+// finishSelfUpdateLog runs at startup: if the last run ended by restarting into this process, say so.
+func (s *Server) finishSelfUpdateLog() {
+	lines := readLines(s.updateLogPath())
+	if n := len(lines); n > 0 && strings.Contains(lines[n-1], "restarting") && s.opts.Version != "" {
+		if f, err := os.OpenFile(s.updateLogPath(), os.O_APPEND|os.O_WRONLY, 0o600); err == nil {
+			f.WriteString(time.Now().Format("15:04:05") + " Hammerhead restarted: now running " + s.opts.Version + "\n")
+			f.Close()
+		}
+	}
+}
+
+// updateStatus returns the progress and log of this server's own update, for the Settings page.
+func (s *Server) updateStatus(w http.ResponseWriter, r *http.Request, p *principal) {
+	u := &s.selfUpd
+	u.mu.Lock()
+	out := map[string]any{"running": u.running, "stage": u.stage, "pct": u.pct, "lines": append([]string(nil), u.lines...), "version": s.opts.Version}
+	u.mu.Unlock()
+	if lines, _ := out["lines"].([]string); len(lines) == 0 {
+		// nothing in memory: this is a fresh process, so show the last update's log from disk
+		if saved := readLines(s.updateLogPath()); len(saved) > 0 {
+			stage := "done"
+			if strings.Contains(saved[len(saved)-1], "Failed:") {
+				stage = "failed"
+			}
+			out["lines"], out["stage"], out["pct"] = saved, stage, 100
+		}
+	}
+	writeJSON(w, 200, out)
+}

web/index.html

@@ -5,84 +5,149 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Hammerhead</title>
 <style>
-  :root { --bg:#0a0a0a; --side:#0f0f10; --panel:#141415; --line:#262628; --text:#fafafa; --dim:#a1a1aa; --muted:#1c1c1e; --accent:#06b6d4; --accent-fg:#fff; --ok:#22c55e; --bad:#ef4444; --warn:#eab308; --shade:rgba(0,0,0,.65); --radius:10px; }
-  @media (prefers-color-scheme: light) { :root { --bg:#fafafa; --side:#fff; --panel:#fff; --line:#e4e4e7; --text:#18181b; --dim:#71717a; --muted:#f4f4f5; --accent:#0891b2; --shade:rgba(24,24,27,.5); } }
+  /* Design tokens: the only place raw colors, spacing and sizes are defined (same system as Lightwell). */
+  :root {
+    --accent:#0891b2; --accent-contrast:#fff;
+    --bg:#fafafa; --surface:#fff; --surface-2:#f4f4f5; --border:#e4e4e7; --border-strong:#d4d4d8;
+    --text:#09090b; --text-muted:#52525b; --text-faint:#71717a;
+    --accent-text:color-mix(in srgb, var(--accent) 85%, #000);
+    --accent-soft:color-mix(in srgb, var(--accent) 10%, var(--surface));
+    --accent-hover:color-mix(in srgb, var(--accent) 86%, #000);
+    --focus:color-mix(in srgb, var(--accent) 65%, #fff);
+    --success:#1c6b3a; --success-bg:#e3f1e8; --warning:#85560a; --warning-bg:#f9eed6; --danger:#a3271e; --danger-bg:#f9e6e3;
+    --overlay:rgb(15 18 22 / .5); --shadow:0 8px 24px rgb(15 18 22 / .14);
+    --s1:4px; --s2:8px; --s3:12px; --s4:16px; --s5:24px; --s6:32px; --s7:48px; --s8:64px;
+    --radius:8px; --radius-lg:12px;
+    --font:system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;
+    --font-mono:ui-monospace,"SF Mono",Menlo,Consolas,monospace;
+    --text-xs:12px; --text-sm:13px; --text-base:14px; --text-lg:16px; --text-xl:20px; --text-2xl:26px;
+    --control-h:36px; --sidebar-w:248px; --content-max:1180px; --ease:140ms ease;
+    color-scheme:light;
+  }
+  @media (prefers-color-scheme: dark) { :root {
+    --accent:#22b8d4; --accent-contrast:#04222a;
+    --bg:#09090b; --surface:#0f0f11; --surface-2:#18181b; --border:#27272a; --border-strong:#3f3f46;
+    --text:#fafafa; --text-muted:#a1a1aa; --text-faint:#71717a;
+    --accent-text:color-mix(in srgb, var(--accent) 80%, #fff); --accent-soft:color-mix(in srgb, var(--accent) 18%, var(--surface)); --accent-hover:color-mix(in srgb, var(--accent) 85%, #fff);
+    --success:#86d3a0; --success-bg:#16301f; --warning:#e8bd6b; --warning-bg:#33280f; --danger:#f19a92; --danger-bg:#3a1b18;
+    --overlay:rgb(0 0 0 / .65); --shadow:0 8px 24px rgb(0 0 0 / .5); color-scheme:dark;
+  } }
   * { box-sizing:border-box; }
   html, body { height:100%; }
-  body { margin:0; background:var(--bg); color:var(--text); font:14px/1.5 Inter,system-ui,-apple-system,Segoe UI,sans-serif; -webkit-font-smoothing:antialiased; }
-  a { color:var(--accent); }
+  body { margin:0; background:var(--bg); color:var(--text); font:var(--text-base)/1.5 var(--font); -webkit-font-smoothing:antialiased; }
+  a { color:var(--accent-text); text-underline-offset:2px; }
+  :focus-visible { outline:2px solid var(--focus); outline-offset:2px; border-radius:var(--radius); }
+  h1, h2 { line-height:1.25; letter-spacing:-.01em; }
+
+  /* shell */
   .app { display:flex; min-height:100vh; }
-  .side { width:248px; flex:none; background:var(--side); border-right:1px solid var(--line); display:flex; flex-direction:column; position:sticky; top:0; height:100vh; padding:14px 12px; gap:4px; overflow-y:auto; }
-  .brand { display:flex; align-items:center; gap:10px; font-weight:700; font-size:16px; padding:4px 8px 12px; }
+  .side { width:var(--sidebar-w); flex:none; background:var(--bg); border-right:1px solid var(--border); display:flex; flex-direction:column; position:sticky; top:0; height:100vh; padding:var(--s5) var(--s3); gap:2px; overflow-y:auto; }
+  .brand { display:flex; align-items:center; gap:var(--s2); font-weight:700; font-size:var(--text-lg); letter-spacing:-.02em; padding:0 var(--s3) var(--s4); }
   .brand svg { color:var(--accent); }
-  .orgsel { margin:0 0 10px; }
-  .orgsel select { background:var(--muted); font-weight:600; }
-  .navsec { font-size:11px; font-weight:600; letter-spacing:.06em; text-transform:uppercase; color:var(--dim); padding:14px 10px 4px; }
-  .navitem { display:flex; align-items:center; gap:10px; width:100%; background:none; border:0; color:var(--dim); padding:8px 10px; border-radius:8px; cursor:pointer; font:inherit; font-weight:500; text-align:left; }
-  .navitem:hover { background:var(--muted); color:var(--text); }
-  .navitem.on { background:color-mix(in srgb, var(--accent) 14%, transparent); color:var(--accent); }
+  .orgsel { margin:0 0 var(--s2); }
+  .navsec { font-size:var(--text-xs); font-weight:600; letter-spacing:.06em; text-transform:uppercase; color:var(--text-faint); padding:var(--s4) var(--s3) var(--s1); }
+  a.navitem { text-decoration:none; }
+  .navitem { display:flex; align-items:center; gap:var(--s3); width:100%; background:none; border:0; color:var(--text-muted); padding:var(--s2) var(--s3); min-height:34px; border-radius:var(--radius); cursor:pointer; font:inherit; font-weight:500; text-align:left; transition:background var(--ease), color var(--ease); }
+  .navitem:hover { background:var(--surface-2); color:var(--text); }
+  .navitem { border-radius:var(--radius); }
+  .navitem.on { background:var(--surface-2); color:var(--text); }
+  .navitem.on svg { color:var(--accent); }
   .navitem svg { flex:none; }
   .grow { flex:1; }
-  .userbox { border-top:1px solid var(--line); padding-top:10px; margin-top:8px; }
-  .userbox .who { padding:4px 10px 8px; font-size:12px; color:var(--dim); overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
+  .userbox { border-top:1px solid var(--border); padding-top:var(--s3); margin-top:var(--s2); }
+  .userbox .who { padding:var(--s1) var(--s3) var(--s2); font-size:var(--text-xs); color:var(--text-muted); overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
   .content { flex:1; min-width:0; }
-  main { max-width:1180px; margin:0 auto; padding:28px 32px 80px; }
-  .page-h { display:flex; align-items:flex-start; justify-content:space-between; gap:16px; margin-bottom:22px; flex-wrap:wrap; }
-  .page-h h1 { font-size:24px; font-weight:700; margin:0; letter-spacing:-.01em; }
-  .page-h p { margin:4px 0 0; color:var(--dim); }
-  .card { background:var(--panel); border:1px solid var(--line); border-radius:var(--radius); padding:18px; margin-bottom:18px; box-shadow:0 1px 2px rgba(0,0,0,.18); }
+  main { max-width:var(--content-max); margin:0 auto; padding:var(--s6) var(--s5) var(--s8); }
+  .page-h { display:flex; align-items:flex-start; justify-content:space-between; gap:var(--s4); margin-bottom:var(--s5); flex-wrap:wrap; }
+  .page-h h1 { font-size:var(--text-2xl); font-weight:600; margin:0; }
+  .page-h p { margin:var(--s1) 0 0; color:var(--text-muted); }
+
+  /* cards, layout */
+  .card { background:var(--surface); border:1px solid var(--border); border-radius:var(--radius-lg); padding:var(--s5); margin-bottom:var(--s4); }
   .card.flush { padding:0; overflow:hidden; }
-  .card > h2 { font-size:15px; font-weight:600; margin:0 0 12px; }
-  .row-h { display:flex; align-items:center; justify-content:flex-end; gap:10px; margin-bottom:12px; flex-wrap:wrap; }
+  .card > h2 { font-size:var(--text-lg); font-weight:600; margin:0 0 var(--s3); }
+  .row-h { display:flex; align-items:center; justify-content:flex-end; gap:var(--s3); margin-bottom:var(--s3); flex-wrap:wrap; }
   .row-h h2 { display:none; }
-  .grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(170px,1fr)); gap:12px; align-items:end; }
-  .stack { display:flex; flex-direction:column; gap:12px; }
-  label { display:flex; flex-direction:column; gap:5px; font-size:12.5px; font-weight:500; color:var(--dim); }
-  label.chk { flex-direction:row; align-items:center; gap:8px; color:var(--text); font-size:14px; font-weight:400; }
-  input, select, textarea { background:var(--bg); color:var(--text); border:1px solid var(--line); border-radius:8px; padding:8px 10px; font:inherit; min-width:0; width:100%; }
-  input[type=checkbox] { width:16px; height:16px; accent-color:var(--accent); }
-  input:focus, select:focus, textarea:focus { outline:2px solid color-mix(in srgb, var(--accent) 55%, transparent); outline-offset:0; border-color:var(--accent); }
-  input:disabled { opacity:.6; }
-  button.btn { background:var(--accent); color:var(--accent-fg); border:0; border-radius:8px; padding:8px 16px; cursor:pointer; font:inherit; font-weight:600; }
-  button.btn:hover { filter:brightness(1.08); }
-  button.ghost { background:var(--panel); border:1px solid var(--line); color:var(--text); border-radius:8px; padding:5px 11px; cursor:pointer; font:inherit; font-weight:500; }
-  button.ghost:hover { background:var(--muted); }
-  button.danger:hover { border-color:var(--bad); color:var(--bad); background:transparent; }
+  .grid { display:grid; grid-template-columns:repeat(auto-fit,minmax(170px,1fr)); gap:var(--s4); align-items:end; }
+  .stack { display:flex; flex-direction:column; gap:var(--s3); }
+  .choices { display:grid; grid-template-columns:repeat(auto-fill,minmax(210px,1fr)); gap:var(--s3); }
+  .choice { text-align:left; background:var(--surface); border:1px solid var(--border); border-radius:var(--radius-lg); padding:var(--s3) var(--s4); color:var(--text); cursor:pointer; font:inherit; display:flex; flex-direction:column; gap:var(--s1); }
+  .choice:hover { border-color:var(--border-strong); background:var(--surface-2); }
+  .choice.on { border-color:var(--accent); background:var(--accent-soft); }
+  .choice-t { font-weight:600; }
+  .sect-h { padding:var(--s3) var(--s4); font-weight:600; border-bottom:1px solid var(--border); }
+  .progress { height:8px; background:var(--surface-2); border-radius:999px; overflow:hidden; }
+  .progress > div { height:100%; background:var(--accent); transition:width .4s ease; }
+  .progress > div.bad { background:var(--danger); }
+  .logbox { margin:0; background:var(--bg); border:1px solid var(--border); border-radius:var(--radius); padding:var(--s3); font:var(--text-xs)/1.6 var(--font-mono); max-height:260px; overflow:auto; white-space:pre-wrap; word-break:break-word; }
+
+  /* forms */
+  label { display:flex; flex-direction:column; gap:var(--s1); font-size:var(--text-sm); font-weight:600; color:var(--text); }
+  label.chk { flex-direction:row; align-items:center; gap:var(--s2); font-size:var(--text-base); font-weight:400; }
+  input, select, textarea { background:var(--surface); color:var(--text); border:1px solid var(--border-strong); border-radius:var(--radius); padding:var(--s2) var(--s3); min-height:var(--control-h); font:inherit; font-weight:400; min-width:0; width:100%; }
+  textarea { min-height:96px; resize:vertical; }
+  input[type=checkbox] { width:16px; height:16px; min-height:0; padding:0; accent-color:var(--accent); }
+  input:focus, select:focus, textarea:focus { outline:2px solid var(--focus); outline-offset:0; border-color:var(--accent); }
+  input:disabled, select:disabled { opacity:.6; }
+  .sub { color:var(--text-muted); font-size:var(--text-sm); font-weight:400; }
+
+  /* buttons: one height, one shape; ghost is the quiet variant */
+  button.btn, button.ghost { display:inline-flex; align-items:center; justify-content:center; gap:var(--s2); min-height:var(--control-h); padding:0 var(--s4); border-radius:var(--radius); font:inherit; font-weight:500; cursor:pointer; white-space:nowrap; transition:background var(--ease), border-color var(--ease); }
+  button.btn { background:var(--accent); color:var(--accent-contrast); border:1px solid var(--accent); }
+  button.btn:hover { background:var(--accent-hover); border-color:var(--accent-hover); }
+  button.ghost { background:var(--surface); border:1px solid var(--border-strong); color:var(--text); }
+  button.ghost:hover { background:var(--surface-2); }
+  button.danger:hover { border-color:var(--danger); color:var(--danger); background:var(--danger-bg); }
+  td button.ghost, .actions button.ghost, .tgt button.ghost { min-height:30px; padding:0 var(--s3); font-size:var(--text-sm); }
+  button:disabled { opacity:.55; cursor:not-allowed; }
+
+  /* toolbar above a table */
+  .toolbar { display:flex; align-items:center; gap:var(--s3); margin-bottom:var(--s3); }
+  .toolbar input[type=search] { max-width:320px; }
+  .page-h .btn { white-space:nowrap; }
+
+  /* tables */
   table { width:100%; border-collapse:collapse; }
-  th { text-align:left; font-size:12px; color:var(--dim); font-weight:600; padding:10px 14px; border-bottom:1px solid var(--line); white-space:nowrap; background:color-mix(in srgb, var(--muted) 55%, transparent); }
-  td { padding:12px 14px; border-bottom:1px solid var(--line); vertical-align:top; }
-  tbody tr:hover td { background:color-mix(in srgb, var(--muted) 45%, transparent); }
+  th { text-align:left; font-size:var(--text-sm); color:var(--text-muted); font-weight:600; padding:var(--s3) var(--s4); border-bottom:1px solid var(--border); white-space:nowrap; background:var(--surface); }
+  td { padding:var(--s3) var(--s4); border-bottom:1px solid var(--border); vertical-align:top; }
+  tbody tr:hover td { background:var(--surface-2); }
   tr:last-child td { border-bottom:0; }
-  .card > table, .card > .scroll > table { margin:-4px 0; }
-  .tag { display:inline-flex; align-items:center; padding:1px 8px; border-radius:6px; font-size:11px; font-weight:600; text-transform:uppercase; letter-spacing:.03em; background:var(--muted); border:1px solid var(--line); color:var(--dim); }
-  .dot { display:inline-block; width:8px; height:8px; border-radius:50%; background:var(--dim); margin-right:7px; flex:none; }
-  .dot.ok { background:var(--ok); box-shadow:0 0 0 3px color-mix(in srgb, var(--ok) 20%, transparent); } .dot.bad { background:var(--bad); } .dot.warn { background:var(--warn); }
-  code, .mono { font-family:ui-monospace,SFMono-Regular,Consolas,monospace; font-size:12.5px; }
-  pre { background:var(--bg); border:1px solid var(--line); border-radius:8px; padding:12px; overflow:auto; margin:8px 0 0; user-select:all; white-space:pre-wrap; word-break:break-all; }
-  .dim { color:var(--dim); } .err { color:var(--bad); } .small { font-size:12px; }
-  .empty { color:var(--dim); padding:28px 12px; text-align:center; }
+  .card > table, .card > .scroll > table { margin:calc(var(--s1) * -1) 0; }
   .scroll { overflow-x:auto; }
-  .actions { display:flex; gap:6px; flex-wrap:wrap; }
-  .center { max-width:400px; margin:11vh auto; padding:0 16px; }
-  .center .brand { justify-content:center; font-size:20px; padding-bottom:18px; }
-  .banner { background:color-mix(in srgb, var(--warn) 12%, transparent); border:1px solid color-mix(in srgb, var(--warn) 60%, transparent); border-radius:var(--radius); padding:12px 16px; margin-bottom:18px; }
-  .shade { position:fixed; inset:0; background:var(--shade); backdrop-filter:blur(2px); display:flex; align-items:flex-start; justify-content:center; padding:4vh 12px; overflow:auto; z-index:10; }
-  .modal { background:var(--panel); border:1px solid var(--line); border-radius:14px; padding:22px; width:100%; max-width:780px; box-shadow:0 20px 60px rgba(0,0,0,.45); }
-  .modal h2 { margin:0 0 16px; font-size:18px; }
-  fieldset { border:1px solid var(--line); border-radius:10px; padding:14px; margin:0; }
-  legend { font-size:12px; font-weight:600; color:var(--dim); padding:0 6px; }
-  .tgt { display:grid; grid-template-columns:1.2fr 1.4fr .7fr auto auto; gap:8px; align-items:end; }
-  .pillrow { display:flex; flex-wrap:wrap; gap:6px 16px; }
-  .sub { color:var(--dim); font-size:12px; font-weight:400; }
-  .tabs2 { display:flex; gap:4px; margin-bottom:16px; background:var(--muted); padding:4px; border-radius:10px; width:fit-content; max-width:100%; flex-wrap:wrap; }
-  .tabs2 button { background:none; border:0; color:var(--dim); border-radius:7px; padding:5px 14px; cursor:pointer; font:inherit; font-weight:500; }
-  .tabs2 button.on { background:var(--panel); color:var(--text); box-shadow:0 1px 2px rgba(0,0,0,.25); }
-  #toast { position:fixed; bottom:20px; right:20px; background:var(--panel); border:1px solid var(--line); padding:11px 16px; border-radius:10px; z-index:30; display:none; max-width:min(420px,90vw); box-shadow:0 10px 30px rgba(0,0,0,.4); }
-  #toast.bad { border-color:var(--bad); color:var(--bad); }
+  .actions { display:flex; gap:var(--s2); flex-wrap:wrap; }
+
+  /* badges and status */
+  .tag { display:inline-flex; align-items:center; gap:var(--s1); padding:2px var(--s2); border-radius:999px; font-size:var(--text-xs); font-weight:600; background:var(--surface-2); color:var(--text-muted); white-space:nowrap; }
+  .dot { display:inline-block; width:8px; height:8px; border-radius:50%; background:var(--text-faint); margin-right:var(--s2); flex:none; }
+  .dot.ok { background:var(--success); box-shadow:0 0 0 3px var(--success-bg); } .dot.bad { background:var(--danger); } .dot.warn { background:var(--warning); }
+  code, .mono { font-family:var(--font-mono); font-size:var(--text-sm); }
+  pre { background:var(--surface-2); border:1px solid var(--border); border-radius:var(--radius); padding:var(--s3); overflow:auto; margin:var(--s2) 0 0; user-select:all; white-space:pre-wrap; word-break:break-all; }
+  .dim { color:var(--text-muted); } .err { color:var(--danger); } .small { font-size:var(--text-sm); }
+  .empty { color:var(--text-muted); padding:var(--s7) var(--s5); text-align:center; border:1px dashed var(--border-strong); border-radius:var(--radius-lg); margin:var(--s3); }
+  .center { max-width:400px; margin:11vh auto; padding:0 var(--s4); }
+  .center .brand { justify-content:center; font-size:var(--text-xl); padding-bottom:var(--s5); }
+  .banner { background:var(--warning-bg); border:1px solid var(--warning); color:var(--warning); border-radius:var(--radius); padding:var(--s3) var(--s4); margin-bottom:var(--s4); }
+
+  /* dialogs, tabs, toast */
+  .shade { position:fixed; inset:0; background:var(--overlay); display:flex; align-items:flex-start; justify-content:center; padding:4vh var(--s3); overflow:auto; z-index:10; }
+  .modal { background:var(--surface); border:1px solid var(--border); border-radius:var(--radius-lg); padding:var(--s5); width:100%; max-width:780px; box-shadow:var(--shadow); }
+  .modal h2 { margin:0 0 var(--s4); font-size:var(--text-lg); }
+  fieldset { border:1px solid var(--border); border-radius:var(--radius-lg); padding:var(--s4); margin:0; }
+  legend { font-size:var(--text-sm); font-weight:600; color:var(--text-muted); padding:0 var(--s2); }
+  .tgt { display:grid; grid-template-columns:1.2fr 1.4fr .7fr auto auto; gap:var(--s2); align-items:end; }
+  .pillrow { display:flex; flex-wrap:wrap; gap:var(--s2) var(--s4); }
+  .tabs2 { display:inline-flex; margin-bottom:var(--s4); border:1px solid var(--border-strong); border-radius:var(--radius); overflow:hidden; max-width:100%; flex-wrap:wrap; background:var(--surface); }
+  .tabs2 button { background:var(--surface); border:0; color:var(--text-muted); padding:0 var(--s3); min-height:var(--control-h); cursor:pointer; font:inherit; font-weight:500; }
+  .tabs2 button + button { border-left:1px solid var(--border-strong); }
+  .tabs2 button:hover { background:var(--surface-2); }
+  .tabs2 button.on { background:var(--accent-soft); color:var(--accent-text); }
+  #toast { position:fixed; bottom:var(--s4); right:var(--s4); background:var(--text); color:var(--bg); padding:var(--s3) var(--s4); border-radius:var(--radius); z-index:30; display:none; max-width:min(420px,90vw); box-shadow:var(--shadow); font-size:var(--text-sm); }
+  #toast.bad { background:var(--danger); color:var(--accent-contrast); }
+  @media (prefers-reduced-motion: reduce) { * { transition:none !important; } }
   @media (max-width:860px) {
-    .app { flex-direction:column; } .side { width:100%; height:auto; position:static; flex-direction:row; flex-wrap:wrap; align-items:center; }
+    .app { flex-direction:column; } .side { width:100%; height:auto; position:static; flex-direction:row; flex-wrap:wrap; align-items:center; border-right:0; border-bottom:1px solid var(--border); }
     .navsec, .userbox .who { display:none; } .userbox { border:0; margin:0; padding:0; display:flex; } .orgsel { margin:0; }
-    main { padding:18px 14px 60px; } .tgt { grid-template-columns:1fr 1fr; }
+    main { padding:var(--s5) var(--s4) var(--s7); } .tgt { grid-template-columns:1fr 1fr; }
   }
 
 </style>
@@ -129,7 +194,65 @@ const ago = d => { if (!d || d.startsWith('0001')) return 'never'; const s = (Da
 const byId = (list, id) => (list || []).find(x => x.id === id);
 const field = (label, el, hint) => h('label', {}, label, el, hint ? h('span', {class:'sub'}, hint) : null);
 const chk = (label, checked, onchange) => { const i = h('input', {type:'checkbox', checked: !!checked}); if (onchange) i.onchange = () => onchange(i.checked); return Object.assign(h('label', {class:'chk'}, i, label), {box:i}); };
+// ----- versions and updates -----
+// A progress bar and live log for an update. load() returns {running, stage, pct, lines}; the panel polls it
+// until the update is over, and keeps going through the gap while a program restarts into its new version.
+function updatePanel(load, onDone) {
+  const bar = h('div', {style:'width:0%'}), stageEl = h('div', {class:'small'}, 'Starting…'), logEl = h('pre', {class:'logbox'}, 'Waiting for the first message…');
+  const el = h('div', {class:'stack'}, stageEl, h('div', {class:'progress'}, bar), logEl);
+  const label = {starting:'Starting', checking:'Checking for the release', downloading:'Downloading', verifying:'Verifying', installing:'Installing', restarting:'Restarting', done:'Done', failed:'Failed'};
+  let misses = 0;
+  const tick = async () => {
+    if (!el.isConnected) return; // the dialog or card was closed
+    let again = true;
+    try {
+      const s = await load(); misses = 0;
+      const pct = Math.max(0, Math.min(100, s.pct || 0)), lines = s.lines || [];
+      bar.style.width = pct + '%'; bar.className = s.stage === 'failed' ? 'bad' : '';
+      stageEl.textContent = (label[s.stage] || s.stage || 'Waiting') + (pct ? ' · ' + pct + '%' : '');
+      if (lines.length) { const atEnd = logEl.scrollTop + logEl.clientHeight >= logEl.scrollHeight - 4; logEl.textContent = lines.join('\n'); if (atEnd) logEl.scrollTop = logEl.scrollHeight; }
+      if (!s.running && (s.stage === 'done' || s.stage === 'failed')) { again = false; if (onDone) onDone(s); }
+    } catch (e) {
+      misses++; // the server is probably restarting into the new version
+      if (misses > 2) stageEl.textContent = 'Restarting… waiting for it to come back';
+      if (misses > 150) { again = false; stageEl.textContent = 'It has not come back after a few minutes. Check its log on the server.'; }
+    }
+    if (again) setTimeout(tick, 800);
+  };
+  setTimeout(tick, 100);
+  return el;
+}
+
+// compares vX.Y.Z strings: -1 if a is older than b, 1 if newer, 0 if equal or not comparable
+const cmpVer = (a, b) => {
+  const p = v => (/^v(\d+)\.(\d+)\.(\d+)$/.exec(v || '') || []).slice(1).map(Number), x = p(a), y = p(b);
+  if (x.length < 3 || y.length < 3) return 0;
+  for (let i = 0; i < 3; i++) if (x[i] !== y[i]) return x[i] < y[i] ? -1 : 1;
+  return 0;
+};
+const latestVersions = async () => { try { return await api('GET', '/api/versions'); } catch (e) { return {}; } };
+// A table cell with a machine's version, a note when a newer release exists, and an Update button
+// when that machine allows being updated from here (it must run with auto-update on).
+const updateDialog = (m, logUrl) => modal('Updating ' + m.name, h('div', {class:'stack'}, updatePanel(() => api('GET', logUrl), () => refresh()), h('p', {class:'small dim'}, 'You can close this; the update carries on.')));
+const versionCell = (m, latest, pending, updateUrl, logUrl) => {
+  const behind = latest && m.version && cmpVer(m.version, latest) < 0, kids = [h('span', {class:'mono small'}, m.version || 'unknown')];
+  if (behind) kids.push(h('div', {class:'small'}, latest + ' is available'));
+  if (pending) {
+    kids.push(h('div', {class:'small dim'}, 'Updating…'));
+    clearTimeout(S.updTimer); S.updTimer = setTimeout(() => refresh(), 4000); // look again for the result
+  } else if (m.updateMsg) kids.push(h('div', {class:'small dim'}, m.updateMsg));
+  if (behind && !pending) kids.push(h('button', {class:'ghost', disabled:!m.autoUpdate,
+    title:m.autoUpdate ? 'Install ' + latest + ' now' : 'Turn on auto-update on that machine (…_AUTO_UPDATE=1) to update it from here',
+    onclick: act(async () => { await api('POST', updateUrl); updateDialog(m, logUrl); refresh(); })}, 'Update'));
+  if (pending || m.updateMsg) kids.push(h('button', {class:'ghost', onclick:() => updateDialog(m, logUrl)}, 'Log'));
+  return h('td', {}, h('div', {class:'stack'}, ...kids));
+};
+
 const card = (title, ...kids) => h('div', {class:'card'}, title ? h('h2', {}, title) : null, ...kids);
+function dialogForm(title, intro, fields, label, submit) {
+  const close = modal(title, h('div', {class:'stack'}, intro ? h('p', {class:'dim'}, intro) : null, ...fields,
+    h('div', {class:'actions'}, h('button', {class:'btn', onclick: act(async () => { await submit(); close(); })}, label), h('button', {class:'ghost', onclick:() => close()}, 'Cancel'))));
+}
 const cmdBox = t => h('pre', {class:'mono'}, t);
 function modal(title, body, opts = {}) {
   const shade = h('div', {class:'shade'});
@@ -182,6 +305,8 @@ async function boot() {
   if (!S.me) return $app.replaceChildren(loginView());
   if (!S.me.orgs.find(o => o.id === S.org)) S.org = (S.me.orgs[0] || {}).id || null;
   if (S.org) localStorage.setItem('org', S.org);
+  const fromPath = tabFromPath(location.pathname);
+  if (fromPath) selectTab(fromPath);
   await render();
 }
 
@@ -248,8 +373,17 @@ const PAGES = {
 // server pages are top-level sidebar entries that map onto serverViews
 const SRV = {edges:'edges', srvorgs:'orgs', users:'users', idps:'idps', settings:'settings', srvalerts:'alerts', srvaudit:'audit'};
 
+// every page has its own address, so links, reloads and the back button work
+const TAB_PATH = {mine:'/apps', ports:'/resources', sites:'/sites', domains:'/domains', egress:'/mail-egress', alerts:'/alerts', access:'/access', logs:'/logs', account:'/account',
+  edges:'/server/edges', srvorgs:'/server/organizations', users:'/server/users', idps:'/server/sso', settings:'/server/settings', srvalerts:'/server/alerts', srvaudit:'/server/audit'};
+const tabFromPath = p => Object.keys(TAB_PATH).find(k => TAB_PATH[k] === p.replace(/\/+$/, '')) || null;
+function selectTab(key) { S.tab = key; if (SRV[key]) serverTab = SRV[key]; }
+window.addEventListener('popstate', () => { const k = tabFromPath(location.pathname); if (S.me && k) { selectTab(k); render(); } });
+
 async function render() {
-  const nav = (key, label, ic) => h('button', {class:'navitem' + (S.tab === key ? ' on' : ''), onclick:() => { S.tab = key; if (SRV[key]) serverTab = SRV[key]; render(); }}, icon(ic), label);
+  const nav = (key, label, ic) => h('a', {class:'navitem' + (S.tab === key ? ' on' : ''), href:TAB_PATH[key], onclick:e => {
+    if (e.metaKey || e.ctrlKey || e.shiftKey || e.button) return;
+    e.preventDefault(); selectTab(key); history.pushState(null, '', TAB_PATH[key]); render(); }}, icon(ic), label);
   const side = [h('div', {}, brand())];
   if (S.me.orgs.length) side.push(h('div', {class:'orgsel'}, h('select', {onchange: act(async e => { S.org = e.target.value; localStorage.setItem('org', S.org); await render(); })},
     S.me.orgs.map(o => h('option', {value:o.id, selected:o.id === S.org}, o.name)))));
@@ -268,6 +402,7 @@ async function render() {
   }
   all.push('account');
   if (!all.includes(S.tab)) S.tab = all[0];
+  if (location.pathname !== TAB_PATH[S.tab]) history.replaceState(null, '', TAB_PATH[S.tab]);
   side.push(h('div', {class:'grow'}), h('div', {class:'userbox'}, h('div', {class:'who'}, S.me.email), nav('account', 'Account', 'account'),
     h('button', {class:'navitem', onclick: act(async () => { await api('POST', '/api/logout'); S.me = null; boot(); })}, icon('out'), 'Sign out')));
   $app.replaceChildren(h('div', {class:'app'}, h('aside', {class:'side'}, side), h('div', {class:'content'}, h('main', {id:'view'}))));
@@ -276,7 +411,8 @@ async function render() {
 
 function pageHeader(tab) {
   const [t, d] = PAGES[tab] || ['', ''];
-  return h('div', {class:'page-h'}, h('div', {}, h('h1', {}, t), d ? h('p', {}, d) : null));
+  const a = S.headerAction;
+  return h('div', {class:'page-h'}, h('div', {}, h('h1', {}, t), d ? h('p', {}, d) : null), a ? h('button', {class:'btn', onclick:a[1]}, '+ ' + a[0]) : null);
 }
 
 let seq = 0;
@@ -284,6 +420,7 @@ async function refresh() {
   const my = ++seq;
   try {
     if (S.org && !SRV[S.tab] && S.tab !== 'account') await loadOrg();
+    S.headerAction = null;
     const view = await (SRV[S.tab] ? views.server() : views[S.tab]());
     if (my !== seq) return;
     const v = document.getElementById('view');
@@ -318,11 +455,15 @@ views.ports = async () => {
   const unsetDash = !st.dashboardUrl && st.mappings.some(m => m.auth && (m.auth.sso || m.auth.password || m.auth.pin || m.auth.email));
   const traffic = await api('GET', O('/traffic?hours=24')).catch(() => ({}));
   const rows = st.mappings.slice().sort((a, b) => a.edgeId.localeCompare(b.edgeId) || a.bindIp.localeCompare(b.bindIp) || a.port - b.port);
-  const table = rows.length ? h('div', {class:'scroll'}, h('table', {},
-    h('thead', {}, h('tr', {}, ['', 'Name', 'Public address', 'Targets', 'Traffic', ''].map(t => h('th', {}, t)))),
-    h('tbody', {}, rows.map(m => mappingRow(m, st, traffic[m.id]))))) : h('div', {class:'empty'}, 'No ports open yet.');
-  return h('div', {}, h('div', {class:'row-h'}, h('button', {class:'btn', onclick:() => portForm()}, '+ Open a port')), unsetDash ? h('div', {class:'banner'}, 'Some ports have a login in front of them, but the dashboard URL isn\'t set. Visitors are sent back to this address\'s login page, so set it under Server → Settings if people reach Hammerhead by a different address.') : null,
-    h('div', {class:'card flush'}, table));
+  const isWebRow = m => m.proto === 'http' || m.proto === 'https' || m.proto === 'tls';
+  const section = (title, list) => list.length ? h('div', {class:'card flush'}, h('div', {class:'sect-h'}, title + ' (' + list.length + ')'), h('div', {class:'scroll'}, h('table', {},
+    h('thead', {}, h('tr', {}, ['', 'Name', title === 'Websites' ? 'Address' : 'Public address', 'Targets', 'Traffic', ''].map(t => h('th', {}, t)))),
+    h('tbody', {}, list.map(m => mappingRow(m, st, traffic[m.id])))))) : null;
+  const table = rows.length ? h('div', {}, section('Websites', rows.filter(isWebRow)), section('Ports', rows.filter(m => !isWebRow(m)))) : h('div', {class:'card'}, h('div', {class:'empty'}, 'Nothing here yet. Use Add resource to share a website or open a port.'));
+  S.headerAction = ['Add resource', () => portForm()];
+  const q = h('input', {type:'search', placeholder:'Search resources…', oninput:() => { const t = q.value.toLowerCase(); table.querySelectorAll('tbody tr').forEach(tr => { tr.style.display = tr.textContent.toLowerCase().includes(t) ? '' : 'none'; }); }});
+  return h('div', {}, unsetDash ? h('div', {class:'banner'}, 'Some ports have a login in front of them, but the dashboard URL isn\'t set. Visitors are sent back to this address\'s login page, so set it under Server → Settings if people reach Hammerhead by a different address.') : null,
+    rows.length > 5 ? h('div', {class:'toolbar'}, q) : null, table);
 };
 
 function spark(series) {
@@ -351,13 +492,13 @@ function mappingRow(m, st, series) {
   }
   const web = m.proto === 'http' || m.proto === 'https';
   const prot = m.auth && (m.auth.sso || m.auth.password || m.auth.pin || m.auth.email);
-  const pubAddr = (m.hostname ? m.hostname + ' @ ' : '') + m.bindIp + ':' + portText(m);
+  const pubAddr = web ? m.proto + '://' + (m.hostname || '*') + (m.port === (m.proto === 'https' ? 443 : 80) ? '' : ':' + portText(m)) : (m.hostname ? m.hostname + ' @ ' : '') + m.bindIp + ':' + portText(m);
   return h('tr', {},
     h('td', {title:why}, h('span', {class:dot})),
     h('td', {}, h('div', {}, m.name, ' ', h('span', {class:'tag'}, m.proto), m.proxyProtocol ? h('span', {class:'tag', style:'margin-left:4px', title:'the target is told the real client address'}, 'proxy ' + m.proxyProtocol) : null, prot ? h('span', {class:'tag', style:'margin-left:4px', title:'login required'}, '🔒') : null),
       s.error ? h('div', {class:'err small mono'}, s.error) : null,
       s.cert && m.proto === 'https' ? h('div', {class:'small ' + (s.cert.startsWith('error') ? 'err' : 'dim')}, '🔐 ' + s.cert) : null),
-    h('td', {class:'mono'}, pubAddr, h('div', {class:'dim small'}, edge ? edge.name : '?')),
+    h('td', {class:'mono'}, pubAddr, h('div', {class:'dim small'}, (edge ? edge.name : '?') + (web && m.bindIp !== '0.0.0.0' ? ' · ' + m.bindIp : ''))),
     h('td', {class:'mono small'}, m.targets.map((t, i) => {
       const th = (s.targets || [])[i], site = byId(st.sites, t.siteId);
       return h('div', {title:th && !th.healthy ? th.detail : ''}, h('span', {class:'dot ' + (th ? (th.healthy ? 'ok' : 'bad') : '')}), (site ? site.name : '?') + ' → ' + t.host + ':' + t.port);
@@ -472,10 +613,109 @@ function portForm(existing) {
     else for (const p of protos) await api('POST', O('/mappings'), {...base, proto:p, targets:p === 'udp' ? targets.slice(0, 1) : targets, proxyProtocol:['tcp', 'tls'].includes(p) ? proxySel.value : ''});
     close(); toast('Saved'); refresh();
   });
-  const close = modal(existing ? 'Edit port' : 'Open a port', h('div', {class:'stack'},
+  const close = existing ? modal('Edit port', h('div', {class:'stack'},
     h('div', {class:'grid'}, field('Name', name), field('Edge', edgeSel), field('Public IP', ipIn), field('Protocol', protoSel), field('Public port', port, 'One port, or a range like 2456-2458 (tcp/udp): each port goes to the target port plus the same offset')),
     ipList, domList, hostBox, proxyBox, h('fieldset', {}, h('legend', {}, 'Where does the traffic go?'), tgtBox), adv, webBox,
-    h('div', {class:'actions'}, h('button', {class:'btn', onclick:save}, existing ? 'Save changes' : 'Open port'), h('button', {class:'ghost', onclick:() => close()}, 'Cancel'))), {sticky:true});
+    h('div', {class:'actions'}, h('button', {class:'btn', onclick:save}, existing ? 'Save changes' : 'Open port'), h('button', {class:'ghost', onclick:() => close()}, 'Cancel'))), {sticky:true}) : wizardModal();
+
+  // The add flow for a new resource: a few short steps that reuse the controls above.
+  function wizardModal() {
+    const TYPES = [
+      ['https', '🌐', 'Website', 'A site or web app, with an automatic HTTPS certificate.'],
+      ['tcp', '🎮', 'Game or app port (TCP)', 'Minecraft, SSH, databases: anything over TCP.'],
+      ['udp', '📡', 'UDP port', 'Voice chat, some games, DNS.'],
+      ['both', '🔁', 'TCP + UDP', 'The same port for both, as many games want.'],
+      ['tls', '🔒', 'TLS passthrough', 'Route encrypted traffic by hostname without decrypting it.'],
+      ['http', '🌍', 'Website, plain HTTP', 'No certificate: for internal use or behind another proxy.'],
+    ];
+    const [accessFs, rulesFs, advFs] = [...webBox.children];
+    let step = 0, chosen = false;
+    const isWeb = () => protoSel.value === 'http' || protoSel.value === 'https';
+    const flow = () => isWeb() ? ['type', 'target', 'reach', 'access', 'finish'] : ['type', 'target', 'reach', 'finish'];
+    const titles = {type:'What are you sharing?', target:'Where does it point?', reach:'How do people reach it?', access:'Who can open it?', finish:'Name it and review'};
+    const body = h('div', {class:'stack'}), crumbs = h('div', {class:'small dim'}), err = h('div', {class:'err small'});
+    const back = h('button', {class:'ghost', type:'button', onclick:() => go(-1)}, 'Back');
+    const next = h('button', {class:'btn', type:'button', onclick:() => go(1)}, 'Next');
+    const portRe = /^(\d+)(?:\s*-\s*(\d+))?$/;
+
+    const summary = () => {
+      const t = targets.map(x => ((byId(st.sites, x.siteId) || {name:'?'}).name) + ' → ' + x.host + ':' + x.port).join(', '), pr = (port.value || '').trim();
+      const protoName = {both:'TCP + UDP', tcp:'TCP', udp:'UDP', tls:'TLS'}[protoSel.value];
+      const where = isWeb() ? protoSel.value + '://' + (host.value.trim() || '*') + (pr && pr !== '443' && pr !== '80' ? ':' + pr : '')
+        : protoName + ' port ' + pr + (protoSel.value === 'tls' && host.value.trim() ? ' for ' + host.value.trim() : '') + ' on ' + (ipIn.value.trim() || 'every address');
+      const login = ssoC.box.checked || pwC.box.checked || pinC.box.checked || mailC.box.checked;
+      return h('div', {class:'stack'}, h('div', {}, h('b', {class:'mono'}, where)), h('div', {class:'small'}, '→ ' + t),
+        isWeb() ? h('div', {class:'small dim'}, login ? 'Visitors have to sign in.' : 'Anyone can open it.') : null);
+    };
+    const validate = cur => {
+      if (cur === 'type') return chosen ? '' : 'Choose what you are sharing.';
+      if (cur === 'target') return targets.every(t => t.siteId && String(t.host).trim() && t.port > 0) ? '' : 'Choose a site and enter the host and port for every target.';
+      if (cur === 'reach') {
+        if ((isWeb() || protoSel.value === 'tls') && !host.value.trim()) return 'Enter the hostname people will visit.';
+        return portRe.test((port.value || '').trim()) ? '' : 'Enter a public port like 25565, or a range like 2456-2458.';
+      }
+      if (cur === 'access') {
+        if (pwC.box.checked && !pwIn.value) return 'Enter the shared password, or turn that option off.';
+        if (pinC.box.checked && !pinIn.value) return 'Enter a PIN, or turn that option off.';
+      }
+      return '';
+    };
+    const prefill = () => {
+      if (port.value) return;
+      const t = protoSel.value;
+      port.value = t === 'https' || t === 'tls' ? '443' : t === 'http' ? '80' : (targets[0] && targets[0].port ? String(targets[0].port) : '');
+    };
+    const pick = v => {
+      protoSel.value = v; chosen = true; protoSel.onchange();
+      if (v === 'https') redir.box.checked = true;
+      port.value = ''; step = 1; draw();
+    };
+    const go = dir => {
+      const cur = flow()[step];
+      if (dir > 0) {
+        const msg = validate(cur);
+        if (msg) { err.textContent = msg; return; }
+        if (cur === 'finish') {
+          if (!name.value.trim()) name.value = host.value.trim() || (protoSel.value.toUpperCase() + ' ' + port.value.trim());
+          save(); return;
+        }
+        step++;
+      } else step = Math.max(0, step - 1);
+      draw();
+    };
+    function draw() {
+      const f = flow(), cur = f[step];
+      err.textContent = '';
+      crumbs.textContent = 'Step ' + (step + 1) + ' of ' + f.length;
+      next.textContent = cur === 'finish' ? (isWeb() ? 'Add website' : 'Open port') : 'Next';
+      next.style.display = cur === 'type' ? 'none' : '';
+      back.style.display = step ? '' : 'none';
+      const kids = [h('h3', {style:'margin:0'}, titles[cur])];
+      if (cur === 'type') {
+        kids.push(h('div', {class:'choices'}, TYPES.map(([v, icon, t, d]) => h('button', {type:'button', class:'choice' + (chosen && protoSel.value === v ? ' on' : ''), onclick:() => pick(v)},
+          h('div', {class:'choice-t'}, icon + ' ' + t), h('div', {class:'small dim'}, d)))));
+      } else if (cur === 'target') {
+        if (st.edges.length > 1) kids.push(field('Public server (edge)', edgeSel, 'The server that listens for visitors.'));
+        kids.push(h('fieldset', {}, h('legend', {}, 'Where does the traffic go?'), tgtBox), proxyBox);
+      } else if (cur === 'reach') {
+        prefill();
+        const web = isWeb();
+        kids.push(h('div', {class:'grid'}, web || protoSel.value === 'tls' ? hostBox : null,
+          field('Public port', port, web ? 'Websites normally use ' + (protoSel.value === 'https' ? '443' : '80') + '.' : 'One port, or a range like 2456-2458: each port goes to the target port plus the same offset.'),
+          field('Public IP', ipIn, '0.0.0.0 means every address on the edge.')), ipList, domList);
+      } else if (cur === 'access') {
+        kids.push(accessFs);
+      } else {
+        kids.push(field('Name', name, 'Optional. Shown in the list.'), h('div', {class:'card', style:'background:var(--surface-2); margin:0'}, summary()),
+          h('details', {}, h('summary', {class:'small dim', style:'cursor:pointer'}, 'More options (health checks' + (isWeb() ? ', rules, redirects' : '') + ')'),
+            h('div', {class:'stack', style:'margin-top:10px'}, adv, ...(isWeb() ? [rulesFs, advFs] : []))));
+      }
+      body.replaceChildren(...kids);
+    }
+    draw();
+    return modal('Add a resource', h('div', {class:'stack'}, crumbs, body, err,
+      h('div', {class:'actions'}, back, next, h('button', {class:'ghost', type:'button', onclick:() => close()}, 'Cancel'))), {sticky:true});
+  }
 }
 
 async function shareDialog(m) {
@@ -503,14 +743,17 @@ views.sites = async () => {
   const add = act(async () => { const s = await api('POST', O('/sites'), {name:name.value}); name.value = ''; showCmd(s); refresh(); });
   const showCmd = s => modal('Run Bamboo at ' + s.name, h('div', {}, h('p', {class:'dim'}, 'Run this on a machine inside that network. It only makes outbound connections. Add --docker to list its containers here.'),
     cmdBox(`bamboo -hammerhead ${dashURL()} -token ${s.token} -docker`)));
+  S.headerAction = ['Add site', () => { const close = modal('Add a site', h('div', {class:'stack'},
+    h('p', {class:'dim'}, 'A site is a private network that holds your services. Every edge also has a built-in "this machine" site for services on the same box as Blacktip.'), field('Name', name),
+    h('div', {class:'actions'}, h('button', {class:'btn', onclick:() => { close(); add(); }}, 'Add site'), h('button', {class:'ghost', onclick:() => close()}, 'Cancel')))); }];
+  const latest = await latestVersions();
   return h('div', {},
-    card('Add a site', h('p', {class:'dim'}, 'A site is a private network that holds your services. Every edge also has a built-in "this machine" site for services on the same box as Blacktip.'),
-      h('div', {class:'grid'}, field('Name', name), h('button', {class:'btn', onclick:add}, 'Add site'))),
-    card('Sites', h('table', {}, h('thead', {}, h('tr', {}, ['', 'Name', 'Kind', 'Tunnels to', 'Containers', ''].map(t => h('th', {}, t)))),
+    card('Sites', h('table', {}, h('thead', {}, h('tr', {}, ['', 'Name', 'Kind', 'Tunnels to', 'Version', 'Containers', ''].map(t => h('th', {}, t)))),
       h('tbody', {}, st.sites.map(s => h('tr', {},
         h('td', {}, h('span', {class:'dot ' + (st.online[s.id] ? 'ok' : 'bad')})), h('td', {}, s.name),
         h('td', {}, s.local ? 'this machine (direct)' : 'bamboo agent'),
         h('td', {}, s.local ? '—' : ((s.connected || []).map(id => (byId(st.edges, id) || {name:id}).name).join(', ') || 'nothing connected')),
+        s.local ? h('td', {class:'dim'}, '—') : versionCell(s, latest.bamboo, !!s.updateId, O(`/sites/${s.id}/update`), O(`/sites/${s.id}/update/log`)),
         h('td', {}, h('button', {class:'ghost', onclick: act(async () => {
           const l = await api('GET', O(`/sites/${s.id}/containers`));
           modal('Containers on ' + s.name, l.length ? h('table', {}, h('thead', {}, h('tr', {}, ['Name', 'Image', 'Ports'].map(t => h('th', {}, t)))), h('tbody', {}, l.map(c => h('tr', {}, h('td', {}, c.name), h('td', {class:'dim'}, c.image), h('td', {class:'mono small'}, c.ports.map(p => (p.public ? p.public + '→' : '') + p.private + '/' + p.type).join(', ')))))) :
@@ -523,9 +766,11 @@ views.sites = async () => {
 // ----- domains -----
 views.domains = async () => {
   const st = S.st, name = h('input', {placeholder:'example.com'}), edgeSel = h('select', {}, st.edges.map(e => h('option', {value:e.id}, e.name))), ip = h('input', {placeholder:'public IP it points at'});
+  S.headerAction = ['Add domain', () => { const close = modal('Add a domain', h('div', {class:'stack'},
+    h('p', {class:'dim'}, 'Hostnames on http, https and tls ports must be under one of your domains. Create the DNS record at your DNS provider, then use Check DNS.'),
+    field('Domain', name), field('Edge', edgeSel), field('IP', ip, 'One of the edge\'s addresses'),
+    h('div', {class:'actions'}, h('button', {class:'btn', onclick: act(async () => { await api('POST', O('/domains'), {name:name.value, edgeId:edgeSel.value, ip:ip.value}); close(); refresh(); })}, 'Add domain'), h('button', {class:'ghost', onclick:() => close()}, 'Cancel')))); }];
   return h('div', {},
-    card('Add a domain', h('p', {class:'dim'}, 'Hostnames on http, https and tls ports must be under one of your domains. Create the DNS record at your DNS provider, then use Check DNS.'),
-      h('div', {class:'grid'}, field('Domain', name), field('Edge', edgeSel), field('IP', ip, 'One of the edge\'s addresses'), h('button', {class:'btn', onclick: act(async () => { await api('POST', O('/domains'), {name:name.value, edgeId:edgeSel.value, ip:ip.value}); refresh(); })}, 'Add'))),
     card('Domains', st.domains.length ? h('table', {}, h('thead', {}, h('tr', {}, ['Domain', 'Edge', 'DNS record to create', ''].map(t => h('th', {}, t)))),
       h('tbody', {}, st.domains.map(d => h('tr', {}, h('td', {}, d.name), h('td', {}, (byId(st.edges, d.edgeId) || {name:'?'}).name),
         h('td', {class:'mono small'}, d.ip ? `A   ${d.name}   ${d.ip}` : '—', h('br'), d.ip ? `A   *.${d.name}   ${d.ip}  (for subdomains)` : ''),
@@ -584,8 +829,8 @@ views.egress = async () => {
           h('button', {class:'ghost', onclick: act(async () => { await api('PUT', O('/mail-egress/' + e.id), {...e, enabled:!e.enabled}); refresh(); })}, e.enabled ? 'Pause' : 'Enable'),
           h('button', {class:'ghost danger', onclick: act(async () => { if (confirm(`Remove ${e.name}?`)) { await api('DELETE', O('/mail-egress/' + e.id)); refresh(); } })}, 'Remove'))));
     })))) : h('div', {class:'empty'}, 'Nothing set up yet. Add one so your mail server sends from the edge\'s IP.');
+  S.headerAction = ['Add mail egress', () => mailForm()];
   return h('div', {},
-    h('div', {class:'row-h'}, h('button', {class:'btn', onclick:() => mailForm()}, '+ Add mail egress')),
     !remote.length ? h('div', {class:'banner'}, 'This runs on a Bamboo site: add the network your mail server lives in on the Sites page and start Bamboo there first.') : null,
     h('div', {class:'card flush'}, table),
     await dkimCard(),
@@ -605,8 +850,8 @@ async function dkimCard() {
       h('td', {}, k.domain), h('td', {class:'mono'}, k.selector), h('td', {}, h('span', {class:'dot ' + chip(k)[0]}), chip(k)[1]),
       h('td', {}, h('div', {class:'actions'}, h('button', {class:'ghost', onclick:() => show(k)}, 'Show DNS record'),
         h('button', {class:'ghost danger', onclick: act(async () => { if (confirm(`Stop signing mail for ${k.domain}?`)) { await api('DELETE', O('/dkim/' + k.id)); refresh(); } })}, 'Remove'))))))) : null,
-    h('div', {class:'grid', style:'margin-top:12px'}, field('Domain', dom), field('Selector (optional)', sel),
-      h('button', {class:'btn', onclick: act(async () => { const k = await api('POST', O('/dkim'), {domain:dom.value, selector:sel.value}); show(k); refresh(); })}, 'Create key')));
+    h('div', {class:'row-h'}, h('button', {class:'btn', onclick:() => dialogForm('Create a DKIM key', 'Make a key for each domain you send mail from, then publish its DNS record.', [field('Domain', dom), field('Selector (optional)', sel)], 'Create key',
+      async () => { const k = await api('POST', O('/dkim'), {domain:dom.value, selector:sel.value}); show(k); refresh(); })}, '+ Create key')));
 }
 
 function mailForm(existing) {
@@ -681,11 +926,12 @@ async function alertsView(base, scoped, trusted) {
         h('button', {class:'ghost', onclick:() => channelForm(base, c, trusted)}, 'Edit'),
         h('button', {class:'ghost danger', onclick: act(async () => { await api('DELETE', base + '/channels/' + c.id); refresh(); })}, 'Remove')))))));
   const debounce = h('input', {type:'number', min:1, max:120, value:d.settings.debounceMin}), repeat = h('input', {type:'number', min:0, max:168, value:d.settings.repeatHours});
+  S.headerAction = ['Add channel', () => channelForm(base, null, trusted)];
   return h('div', {},
     !d.emailConfigured ? h('div', {class:'banner'}, 'Email alerts need an email server. Set one up under Server → Settings, or use a webhook.') : null,
     card('Right now', d.active.length ? h('table', {}, h('tbody', {}, d.active.map(a => h('tr', {}, h('td', {}, h('span', {class:'dot ' + (a.fired ? 'bad' : 'warn')}), a.fired ? 'Firing' : 'Waiting…'), h('td', {}, a.message), h('td', {class:'dim small'}, 'since ' + ago(a.since)))))) :
       h('div', {class:'empty'}, '✓ Nothing is wrong.')),
-    card('Where alerts go', h('div', {class:'row-h'}, h('button', {class:'btn', onclick:() => channelForm(base, null, trusted)}, '+ Add channel')),
+    card('Where alerts go',
       d.channels.length ? channels : h('div', {class:'empty'}, 'No channels yet. Add an email address or a webhook.')),
     scoped ? card('Timing', h('p', {class:'dim'}, 'A problem has to last this long before you are told, so a restart or a brief blip stays quiet. You get one message when it starts and one when it clears.'),
       h('div', {class:'grid'}, field('Wait this many minutes first', debounce), field('Remind me every (hours, 0 = never)', repeat),
@@ -702,17 +948,17 @@ views.access = async () => {
   const email = h('input', {type:'email', placeholder:'person@example.com'}), roleSel = h('select', {}, roles.map(r => h('option', {value:r.id, selected:r.name === 'Member'}, r.name)));
   const rname = h('input', {placeholder:'e.g. Staff'}), radmin = chk('Can manage the organization', false);
   const kname = h('input', {placeholder:'e.g. CI deploy'});
+  S.headerAction = ['Invite someone', () => dialogForm('Invite someone', 'They get a link that works for 7 days.', [field('Email', email), field('Role', roleSel)], 'Create invitation', async () => {
+    const r = await api('POST', O('/invites'), {email:email.value, roleId:roleSel.value}); email.value = '';
+    modal('Invitation created', h('div', {}, h('p', {class:'dim'}, r.emailed ? 'An email was sent. You can also share this link:' : 'Send them this link (it works for 7 days):'), cmdBox(r.link))); refresh(); })];
   return h('div', {},
     card('Members', h('table', {}, h('thead', {}, h('tr', {}, ['Name', 'Email', 'Role', '2FA', ''].map(t => h('th', {}, t)))),
       h('tbody', {}, members.map(mm => h('tr', {}, h('td', {}, mm.name), h('td', {}, mm.email, mm.sso ? h('span', {class:'tag', style:'margin-left:6px'}, 'sso') : null),
         h('td', {}, h('select', {style:'width:auto', onchange: act(async e => { await api('PUT', O('/members/' + mm.userId), {roleId:e.target.value}); toast('Role changed'); })}, roles.map(r => h('option', {value:r.id, selected:r.id === mm.roleId}, r.name)))),
         h('td', {}, mm.totp ? '✓' : '—'),
         h('td', {}, mm.userId === S.me.id ? null : h('button', {class:'ghost danger', onclick: act(async () => { if (confirm('Remove this member?')) { await api('DELETE', O('/members/' + mm.userId)); refresh(); } })}, 'Remove'))))))),
-    card('Invite someone', h('div', {class:'grid'}, field('Email', email), field('Role', roleSel), h('button', {class:'btn', onclick: act(async () => {
-      const r = await api('POST', O('/invites'), {email:email.value, roleId:roleSel.value}); email.value = '';
-      modal('Invitation created', h('div', {}, h('p', {class:'dim'}, r.emailed ? 'An email was sent. You can also share this link:' : 'Send them this link (it works for 7 days):'), cmdBox(r.link))); refresh(); })}, 'Create invitation')),
-      invites.length ? h('table', {style:'margin-top:12px'}, h('tbody', {}, invites.map(i => h('tr', {}, h('td', {}, i.email), h('td', {class:'dim'}, (byId(roles, i.roleId) || {name:'?'}).name), h('td', {class:'dim'}, 'expires ' + new Date(i.expires).toLocaleDateString()),
-        h('td', {}, h('button', {class:'ghost danger', onclick: act(async () => { await api('DELETE', O('/invites/' + i.id)); refresh(); })}, 'Cancel')))))) : null),
+    invites.length ? card('Pending invitations', h('table', {}, h('tbody', {}, invites.map(i => h('tr', {}, h('td', {}, i.email), h('td', {class:'dim'}, (byId(roles, i.roleId) || {name:'?'}).name), h('td', {class:'dim'}, 'expires ' + new Date(i.expires).toLocaleDateString()),
+        h('td', {}, h('button', {class:'ghost danger', onclick: act(async () => { await api('DELETE', O('/invites/' + i.id)); refresh(); })}, 'Cancel'))))))) : null,
     card('Roles', h('p', {class:'dim'}, 'Admin roles manage the organization. Other roles are used to decide who may open protected apps.'),
       h('table', {}, h('tbody', {}, roles.map(r => h('tr', {}, h('td', {}, r.name, r.builtin ? h('span', {class:'tag', style:'margin-left:6px'}, 'built-in') : null), h('td', {class:'dim'}, r.admin ? 'can manage the organization' : 'member'),
         h('td', {}, r.builtin ? null : h('button', {class:'ghost danger', onclick: act(async () => { await api('DELETE', O('/roles/' + r.id)); refresh(); })}, 'Delete')))))),
@@ -771,14 +1017,18 @@ serverViews.edges = async () => {
   const orgChecks = orgs.map(o => ({o, c:chk(o.name, false)}));
   const showCmd = e => modal('Run Blacktip on ' + e.name, h('div', {}, h('p', {class:'dim'}, 'Run this on the public server. The WireGuard UDP port (and any ports you open) must be reachable from the internet. Add -traefik /path/to/traefik to serve web resources with Traefik. Add -docker to list local containers.'),
     cmdBox(`blacktip -hammerhead ${S.me.dashboardUrl || location.origin} -token ${e.token} -tunnel :${e.tunnelAddr.split(':').pop()} -docker`)));
+  S.headerAction = ['Add edge', () => { const close = modal('Add an edge', h('div', {class:'stack'},
+    h('p', {class:'dim'}, 'An edge (Blacktip) is a public server that owns IP addresses and opens ports.'),
+    field('Name', name), field('WireGuard endpoint (public host:UDP port)', addr, 'host:port'),
+    orgs.length > 1 ? h('div', {class:'stack'}, h('div', {class:'sub'}, 'Restrict to these organizations (none ticked = all):'), h('div', {class:'pillrow'}, orgChecks.map(x => x.c))) : null,
+    h('div', {class:'actions'}, h('button', {class:'btn', onclick: act(async () => {
+      const e = await api('POST', '/api/edges', {name:name.value, tunnelAddr:addr.value, orgIds:orgChecks.filter(x => x.c.box.checked).map(x => x.o.id)}); close(); showCmd(e); refresh(); })}, 'Add edge'),
+      h('button', {class:'ghost', onclick:() => close()}, 'Cancel')))); }];
+  const latest = await latestVersions();
   return h('div', {},
-    card('Add an edge', h('p', {class:'dim'}, 'An edge (Blacktip) is a public server that owns IP addresses and opens ports.'),
-      h('div', {class:'grid'}, field('Name', name), field('WireGuard endpoint (public host:UDP port)', addr, 'host:port'), h('button', {class:'btn', onclick: act(async () => {
-        const e = await api('POST', '/api/edges', {name:name.value, tunnelAddr:addr.value, orgIds:orgChecks.filter(x => x.c.box.checked).map(x => x.o.id)}); showCmd(e); refresh(); })}, 'Add edge')),
-      orgs.length > 1 ? h('div', {style:'margin-top:10px'}, h('div', {class:'sub'}, 'Restrict to these organizations (none ticked = all):'), h('div', {class:'pillrow'}, orgChecks.map(x => x.c))) : null),
-    card('Edges', edges.length ? h('table', {}, h('thead', {}, h('tr', {}, ['', 'Name', 'WireGuard endpoint', 'IP addresses', 'Orgs', ''].map(t => h('th', {}, t)))),
+    card('Edges', edges.length ? h('table', {}, h('thead', {}, h('tr', {}, ['', 'Name', 'WireGuard endpoint', 'IP addresses', 'Version', 'Orgs', ''].map(t => h('th', {}, t)))),
       h('tbody', {}, edges.map(e => h('tr', {}, h('td', {}, h('span', {class:'dot ' + (e.online ? 'ok' : 'bad'), title:e.online ? 'online' : 'offline'})), h('td', {}, e.name), h('td', {class:'mono'}, e.tunnelAddr),
-        h('td', {class:'mono small'}, (e.ips || []).join(', ') || '—'), h('td', {class:'small dim'}, (e.orgIds || []).length ? e.orgIds.map(id => (byId(orgs, id) || {name:id}).name).join(', ') : 'all'),
+        h('td', {class:'mono small'}, (e.ips || []).join(', ') || '—'), versionCell(e, latest.blacktip, e.updatePending, '/api/edges/' + e.id + '/update', '/api/edges/' + e.id + '/update/log'), h('td', {class:'small dim'}, (e.orgIds || []).length ? e.orgIds.map(id => (byId(orgs, id) || {name:id}).name).join(', ') : 'all'),
         h('td', {}, h('div', {class:'actions'}, h('button', {class:'ghost', onclick:() => showCmd(e)}, 'Show command'),
           h('button', {class:'ghost danger', onclick: act(async () => { if (confirm('Delete this edge and all its ports?')) { await api('DELETE', '/api/edges/' + e.id); refresh(); } })}, 'Delete'))))))) : h('div', {class:'empty'}, 'None yet.')));
 };
@@ -786,8 +1036,8 @@ serverViews.edges = async () => {
 serverViews.orgs = async () => {
   const name = h('input', {placeholder:'Organization name'}), local = chk('Allow targeting the edge machine itself', false);
   await boot0();
+  S.headerAction = ['New organization', () => dialogForm('New organization', null, [field('Name', name), local], 'Create', async () => { await api('POST', '/api/orgs', {name:name.value, allowLocal:local.box.checked}); S.me = await api('GET', '/api/me'); refresh(); })];
   return h('div', {},
-    card('New organization', h('div', {class:'grid'}, field('Name', name), local, h('button', {class:'btn', onclick: act(async () => { await api('POST', '/api/orgs', {name:name.value, allowLocal:local.box.checked}); S.me = await api('GET', '/api/me'); refresh(); })}, 'Create'))),
     card('Organizations', h('p', {class:'dim'}, '"Local" access lets an organization point ports at services on the edge machine itself (127.0.0.1), which includes Hammerhead. Only turn it on for organizations you fully trust.'),
       h('table', {}, h('tbody', {}, S.me.orgs.map(o => h('tr', {}, h('td', {}, o.name),
         h('td', {}, h('button', {class:'ghost', onclick: act(async () => {
@@ -800,9 +1050,9 @@ async function boot0() { S.me = await api('GET', '/api/me'); }
 serverViews.users = async () => {
   const users = await api('GET', '/api/admin/users');
   const f = {e:h('input', {type:'email'}), n:h('input'), p:h('input', {type:'password'})}, adm = chk('Server administrator', false);
+  S.headerAction = ['Add user', () => dialogForm('Add a user', 'To add someone to an organization by email, use an invitation on the Access page instead.', [field('Email', f.e), field('Name', f.n), field('Password', f.p), adm], 'Create',
+    async () => { await api('POST', '/api/admin/users', {email:f.e.value, name:f.n.value, password:f.p.value, serverAdmin:adm.box.checked}); refresh(); })];
   return h('div', {},
-    card('Add a user', h('p', {class:'dim'}, 'To add someone to an organization by email, use an invitation on the Access tab instead.'),
-      h('div', {class:'grid'}, field('Email', f.e), field('Name', f.n), field('Password', f.p), adm, h('button', {class:'btn', onclick: act(async () => { await api('POST', '/api/admin/users', {email:f.e.value, name:f.n.value, password:f.p.value, serverAdmin:adm.box.checked}); refresh(); })}, 'Create'))),
     card('Users', h('table', {}, h('thead', {}, h('tr', {}, ['Name', 'Email', 'Organizations', 'Flags', ''].map(t => h('th', {}, t)))),
       h('tbody', {}, users.map(u => h('tr', {}, h('td', {}, u.name), h('td', {}, u.email), h('td', {class:'dim'}, u.orgs.join(', ') || '—'),
         h('td', {}, u.serverAdmin ? h('span', {class:'tag'}, 'admin') : null, u.totp ? h('span', {class:'tag', style:'margin-left:4px'}, '2fa') : null, u.sso ? h('span', {class:'tag', style:'margin-left:4px'}, 'sso') : null),
@@ -829,10 +1079,10 @@ serverViews.idps = async () => {
         const body = {name:f.name.value, issuer:f.issuer.value, clientId:f.cid.value, clientSecret:f.sec.value, scopes:f.scopes.value, autoProvision:auto.box.checked, orgId:orgSel.value, allowedDomains:f.dom.value.split(',').map(s => s.trim()).filter(Boolean)};
         await api(e.id ? 'PUT' : 'POST', '/api/admin/idps' + (e.id ? '/' + e.id : ''), body); close(); refresh(); })}, 'Save')), {sticky:true});
   };
+  S.headerAction = ['Add provider', () => form()];
   return card('Single sign-on', h('p', {class:'dim'}, 'Let people sign in with Google, Authentik, Keycloak, Entra ID or any OpenID Connect provider.'),
     idps.length ? h('table', {}, h('tbody', {}, idps.map(i => h('tr', {}, h('td', {}, i.name), h('td', {class:'mono small dim'}, i.issuer), h('td', {}, h('div', {class:'actions'}, h('button', {class:'ghost', onclick:() => form(i)}, 'Edit'),
-      h('button', {class:'ghost danger', onclick: act(async () => { await api('DELETE', '/api/admin/idps/' + i.id); refresh(); })}, 'Delete')))))) ) : h('div', {class:'empty'}, 'None configured.'),
-    h('button', {class:'btn', style:'margin-top:10px', onclick:() => form()}, 'Add provider'));
+      h('button', {class:'ghost danger', onclick: act(async () => { await api('DELETE', '/api/admin/idps/' + i.id); refresh(); })}, 'Delete')))))) ) : h('div', {class:'empty'}, 'None configured.'));
 };
 
 serverViews.settings = async () => {
@@ -843,12 +1093,35 @@ serverViews.settings = async () => {
   const staging = chk('Use the Let\'s Encrypt staging server (untrusted test certificates)', s.acmeStaging);
   const save = act(async () => { await api('PUT', '/api/admin/settings', {dashboardUrl:f.url.value, acmeEmail:f.acme.value, acmeStaging:staging.box.checked,
     smtp:{host:f.host.value, port:+f.port.value, user:f.user.value, pass:f.pass.value, from:f.from.value, mode:f.mode.value}}); S.me = await api('GET', '/api/me'); toast('Saved'); });
+  const updOut = h('div', {class:'dim'}, 'Not checked yet.');
+  const updNow = h('button', {class:'btn', style:'display:none', onclick: act(async () => {
+    await api('POST', '/api/admin/update/apply');
+    updNow.style.display = 'none';
+    showPanel();
+  })}, 'Update now');
+  const updBox = h('div', {style:'margin-top:12px'});
+  const showPanel = () => { updOut.textContent = 'Updating Hammerhead. The page reconnects by itself after the restart.'; updBox.replaceChildren(updatePanel(() => api('GET', '/api/admin/update/status'), async s => { if (s.stage === 'done') updOut.textContent = 'Updated: Hammerhead is now running ' + s.version + '.'; })); };
+  api('GET', '/api/admin/update/status').then(s => {
+    if (s.running) showPanel();
+    else if ((s.lines || []).length) updBox.append(h('button', {class:'ghost', onclick:() => { updBox.replaceChildren(updatePanel(() => api('GET', '/api/admin/update/status'))); }}, 'Show the last update log'));
+  }).catch(() => {});
+  const checkUpdate = act(async () => {
+    updOut.textContent = 'Checking…'; updNow.style.display = 'none';
+    const u = await api('GET', '/api/admin/update');
+    const dev = !/^v\d+\.\d+\.\d+$/.test(u.current || '');
+    if (u.error) updOut.textContent = 'Running ' + (u.current || 'an unknown version') + '. Could not check for updates: ' + u.error;
+    else if (dev) updOut.textContent = 'This is a development build (' + (u.current || 'unversioned') + '). The newest release is ' + u.latest + '.';
+    else if (u.newer) { updOut.textContent = 'Running ' + u.current + '. ' + u.latest + ' is available. ' + (u.autoUpdate ? 'Auto-update is on, so it installs by itself within about six hours, or you can install it now.' : 'Auto-update is off: install it yourself, or set HAMMERHEAD_AUTO_UPDATE=1 and restart.'); if (u.autoUpdate) updNow.style.display = ''; }
+    else updOut.textContent = 'Running ' + u.current + ', which is the newest release.';
+  });
   return h('div', {},
     card('General', h('div', {class:'stack'}, field('Dashboard URL', f.url, 'The address people use to reach Hammerhead. Used for login redirects and SSO. Include https:// if you serve it over TLS.'),
       field('Let\'s Encrypt contact email', f.acme, 'Used for certificate expiry notices'), staging)),
     card('Email', h('p', {class:'dim'}, 'Needed for invitation emails and one-time sign-in codes.'),
       h('div', {class:'grid'}, field('SMTP host', f.host), field('Port', f.port), field('Security', f.mode), field('Username', f.user), field('Password', f.pass), field('From', f.from)),
       h('div', {class:'actions', style:'margin-top:10px'}, h('button', {class:'ghost', onclick: act(async () => { await save(); await api('POST', '/api/admin/settings/test-mail'); toast('Test email sent to ' + S.me.email); })}, 'Save and send a test email'))),
+    card('Updates', h('p', {class:'dim'}, 'Hammerhead, Blacktip and Bamboo can update themselves from new releases when auto-update is on (HAMMERHEAD_AUTO_UPDATE=1). This checks the newest release for Hammerhead; it installs nothing.'),
+      updOut, h('div', {class:'actions', style:'margin-top:10px'}, h('button', {class:'ghost', onclick:checkUpdate}, 'Check for updates'), updNow), updBox),
     h('button', {class:'btn', onclick:save}, 'Save settings'));
 };
 

web/resource.html

@@ -5,22 +5,50 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Sign in</title>
 <style>
-  :root { --bg:#0e1621; --panel:#16212f; --line:#25344a; --text:#e6edf5; --dim:#8da2bb; --accent:#06b6d4; --bad:#ef5350; }
-  @media (prefers-color-scheme: light) { :root { --bg:#f3f6fa; --panel:#fff; --line:#d5dde8; --text:#18222f; --dim:#5b6c80; --accent:#0891b2; } }
+  /* Design tokens: the only place raw colors, spacing and sizes are defined (same system as Lightwell). */
+  :root {
+    --accent:#0891b2; --accent-contrast:#fff;
+    --bg:#f7f8f9; --surface:#fff; --surface-2:#f0f2f4; --border:#e2e5e9; --border-strong:#c6ccd3;
+    --text:#16191d; --text-muted:#566069; --text-faint:#75808b;
+    --accent-text:color-mix(in srgb, var(--accent) 85%, #000);
+    --accent-soft:color-mix(in srgb, var(--accent) 10%, var(--surface));
+    --accent-hover:color-mix(in srgb, var(--accent) 86%, #000);
+    --focus:color-mix(in srgb, var(--accent) 65%, #fff);
+    --success:#1c6b3a; --success-bg:#e3f1e8; --warning:#85560a; --warning-bg:#f9eed6; --danger:#a3271e; --danger-bg:#f9e6e3;
+    --overlay:rgb(15 18 22 / .5); --shadow:0 8px 24px rgb(15 18 22 / .14);
+    --s1:4px; --s2:8px; --s3:12px; --s4:16px; --s5:24px; --s6:32px; --s7:48px; --s8:64px;
+    --radius:6px; --radius-lg:10px;
+    --font:system-ui,-apple-system,"Segoe UI",Roboto,"Helvetica Neue",Arial,sans-serif;
+    --font-mono:ui-monospace,"SF Mono",Menlo,Consolas,monospace;
+    --text-xs:12px; --text-sm:13px; --text-base:14px; --text-lg:16px; --text-xl:20px; --text-2xl:26px;
+    --control-h:36px; --sidebar-w:248px; --content-max:1180px; --ease:140ms ease;
+    color-scheme:light;
+  }
+  @media (prefers-color-scheme: dark) { :root {
+    --accent:#22b8d4; --accent-contrast:#04222a;
+    --bg:#0c0d0f; --surface:#141517; --surface-2:#1d1f22; --border:#2a2d31; --border-strong:#41454b;
+    --text:#eceef0; --text-muted:#aab1b9; --text-faint:#8a929b;
+    --accent-text:color-mix(in srgb, var(--accent) 80%, #fff); --accent-soft:color-mix(in srgb, var(--accent) 18%, var(--surface)); --accent-hover:color-mix(in srgb, var(--accent) 85%, #fff);
+    --success:#86d3a0; --success-bg:#16301f; --warning:#e8bd6b; --warning-bg:#33280f; --danger:#f19a92; --danger-bg:#3a1b18;
+    --overlay:rgb(0 0 0 / .65); --shadow:0 8px 24px rgb(0 0 0 / .5); color-scheme:dark;
+  } }
   * { box-sizing:border-box; }
-  body { margin:0; background:var(--bg); color:var(--text); font:15px/1.45 system-ui,sans-serif; display:grid; place-items:center; min-height:100vh; padding:16px; }
-  .card { background:var(--panel); border:1px solid var(--line); border-radius:12px; padding:24px; width:100%; max-width:380px; }
-  h1 { font-size:18px; margin:0 0 4px; }
-  .sub { color:var(--dim); margin:0 0 16px; font-size:13px; }
-  .sec { border-top:1px solid var(--line); padding-top:14px; margin-top:14px; display:flex; flex-direction:column; gap:8px; }
+  body { margin:0; background:var(--bg); color:var(--text); font:var(--text-base)/1.5 var(--font); display:grid; place-items:center; min-height:100vh; padding:var(--s4); -webkit-font-smoothing:antialiased; }
+  .card { background:var(--surface); border:1px solid var(--border); border-radius:var(--radius-lg); padding:var(--s5); width:100%; max-width:400px; }
+  h1 { font-size:var(--text-xl); font-weight:600; letter-spacing:-.01em; margin:0 0 var(--s1); }
+  .sub { color:var(--text-muted); margin:0 0 var(--s4); font-size:var(--text-sm); }
+  .sec { border-top:1px solid var(--border); padding-top:var(--s4); margin-top:var(--s4); display:flex; flex-direction:column; gap:var(--s2); }
   .sec:first-of-type { border-top:0; padding-top:0; margin-top:0; }
-  h2 { font-size:12px; text-transform:uppercase; letter-spacing:.6px; color:var(--dim); margin:0; }
-  input { background:var(--bg); color:var(--text); border:1px solid var(--line); border-radius:6px; padding:9px 10px; font:inherit; width:100%; }
-  input:focus { outline:2px solid var(--accent); outline-offset:-1px; }
-  button, a.btn { background:var(--accent); color:#fff; border:0; border-radius:6px; padding:9px 12px; font:inherit; font-weight:600; cursor:pointer; text-align:center; text-decoration:none; display:block; }
-  button.ghost, a.ghost { background:none; border:1px solid var(--line); color:var(--text); }
-  #err { color:var(--bad); min-height:18px; font-size:13px; margin-top:10px; }
-  .ok { color:var(--dim); font-size:13px; }
+  h2 { font-size:var(--text-xs); text-transform:uppercase; letter-spacing:.06em; color:var(--text-faint); margin:0; font-weight:600; }
+  input { background:var(--surface); color:var(--text); border:1px solid var(--border-strong); border-radius:var(--radius); padding:var(--s2) var(--s3); min-height:var(--control-h); font:inherit; width:100%; }
+  input:focus { outline:2px solid var(--focus); outline-offset:0; border-color:var(--accent); }
+  :focus-visible { outline:2px solid var(--focus); outline-offset:2px; border-radius:var(--radius); }
+  button, a.btn { display:flex; align-items:center; justify-content:center; min-height:var(--control-h); padding:0 var(--s4); background:var(--accent); color:var(--accent-contrast); border:1px solid var(--accent); border-radius:var(--radius); font:inherit; font-weight:500; cursor:pointer; text-decoration:none; transition:background var(--ease); }
+  button:hover, a.btn:hover { background:var(--accent-hover); border-color:var(--accent-hover); }
+  button.ghost, a.ghost { background:var(--surface); border:1px solid var(--border-strong); color:var(--text); }
+  button.ghost:hover, a.ghost:hover { background:var(--surface-2); border-color:var(--border-strong); }
+  #err { color:var(--danger); min-height:18px; font-size:var(--text-sm); margin-top:var(--s3); }
+  .ok { color:var(--text-muted); font-size:var(--text-sm); }
   [hidden] { display:none !important; }
 </style>
 </head>