Turn the status page into a full status page generator

Components can be put in groups and given public names. Public incidents carry
posts written for customers (the internal timeline stays internal), the
components they affect, and a page for each incident plus paged history.
Scheduled maintenance has its own window, shows affected components as under
maintenance, and is announced when scheduled, started, ended or canceled.

Branding (title, logo, accent checked for contrast, contact link, footer) and a
custom domain that serves only the status page. Visitors follow by RSS, by
confirmed email, or by webhook that must answer a test request. Admin UI for
all of it, tests, README and design notes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/sandbar/api.go

@@ -21,8 +21,7 @@ func (s *Server) Handler() http.Handler {
 
 	// pages
 	mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) { servePage(w, indexHTML) })
-	mux.HandleFunc("GET /status", func(w http.ResponseWriter, r *http.Request) { servePage(w, statusHTML) })
-	mux.HandleFunc("GET /status.json", s.statusJSON)
+	s.statusRoutes(mux)
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) { io.WriteString(w, "ok") })
 	mux.HandleFunc("GET /metrics", s.metrics)
 	mux.HandleFunc("GET /script.js", s.serveTracker)
@@ -217,7 +216,7 @@ func (s *Server) Handler() http.Handler {
 		fail2(w, s.st.del("incident", r.PathValue("id")))
 	}))
 
-	return secureHeaders(mux)
+	return s.statusHost(secureHeaders(mux))
 }
 
 var ok = map[string]bool{"ok": true}
@@ -233,7 +232,11 @@ func secureHeaders(next http.Handler) http.Handler {
 		h.Set("X-Content-Type-Options", "nosniff")
 		h.Set("Referrer-Policy", "no-referrer")
 		h.Set("X-Frame-Options", "DENY")
-		h.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:")
+		img := "'self' data:"
+		if strings.HasPrefix(r.URL.Path, "/status") {
+			img += " https:" // the status page can show a logo hosted elsewhere
+		}
+		h.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src "+img)
 		next.ServeHTTP(w, r)
 	})
 }
@@ -750,6 +753,9 @@ func (s *Server) declareHTTP(w http.ResponseWriter, r *http.Request) {
 		Summary  string   `json:"summary"`
 		Lead     string   `json:"lead"`
 		AlertIDs []string `json:"alertIds"`
+		// Public puts the incident on the status page, naming the affected components, as it is declared.
+		Public     bool     `json:"public"`
+		Components []string `json:"components"`
 	}
 	if !decode(r, &in) {
 		bad(w, "invalid request")
@@ -764,6 +770,13 @@ func (s *Server) declareHTTP(w http.ResponseWriter, r *http.Request) {
 		bad(w, err.Error())
 		return
 	}
+	if in.Public {
+		pub, comps := true, in.Components
+		if inc, err = s.UpdateIncident(inc.ID, me.Name, IncidentPatch{Public: &pub, Components: &comps}); err != nil {
+			fail(w, err)
+			return
+		}
+	}
 	writeJSON(w, 200, inc)
 }
 
@@ -808,72 +821,6 @@ func (s *Server) heartbeat(w http.ResponseWriter, r *http.Request) {
 	io.WriteString(w, "ok")
 }
 
-// statusJSON feeds the public status page: only monitors and incidents marked public.
-func (s *Server) statusJSON(w http.ResponseWriter, r *http.Request) {
-	type mon struct {
-		Name   string   `json:"name"`
-		Status string   `json:"status"`
-		Uptime float64  `json:"uptime"`
-		Since  int64    `json:"since"`
-		Days   [][2]int `json:"days"` // [checks, failed] per UTC day, oldest first, ending today
-	}
-	type inc struct {
-		Title    string  `json:"title"`
-		Status   string  `json:"status"`
-		Severity string  `json:"severity"`
-		Created  int64   `json:"created"`
-		Resolved int64   `json:"resolved"`
-		Updates  []Event `json:"updates"`
-	}
-	out := struct {
-		Monitors  []mon  `json:"monitors"`
-		Incidents []inc  `json:"incidents"`
-		Overall   string `json:"overall"`
-		Today     string `json:"today"` // the UTC date of the last bar
-	}{[]mon{}, []inc{}, "operational", s.now().UTC().Format("2006-01-02")}
-	mons, _ := listOf[Monitor](s.st, "monitor")
-	for _, m := range mons {
-		if !m.Public || !m.Enabled {
-			continue
-		}
-		st := s.monitorState(m.ID)
-		days := s.dailyUptime(m.ID, uptimeDays, s.now())
-		var checks, fails int
-		for _, d := range days {
-			checks, fails = checks+d[0], fails+d[1]
-		}
-		uptime := -1.0 // no checks yet
-		if checks > 0 {
-			uptime = float64(checks-fails) * 100 / float64(checks)
-		}
-		out.Monitors = append(out.Monitors, mon{m.Name, st.Status, uptime, st.Since, days})
-		if st.Status == "down" {
-			out.Overall = "outage"
-		}
-	}
-	incs, _ := listOf[Incident](s.st, "incident")
-	sortIncidents(incs)
-	cut := s.now().AddDate(0, 0, -14).Unix()
-	for _, in := range incs {
-		if !in.Public || (in.Status == "resolved" && in.Resolved < cut) {
-			continue
-		}
-		var ups []Event
-		for _, e := range s.st.events("incident", in.ID) {
-			if e.Kind == "update" || e.Kind == "declared" {
-				e.Actor = "" // staff names stay off the public page
-				ups = append(ups, e)
-			}
-		}
-		out.Incidents = append(out.Incidents, inc{in.Title, in.Status, in.Severity, in.Created, in.Resolved, ups})
-		if in.Status != "resolved" && out.Overall == "operational" {
-			out.Overall = "degraded"
-		}
-	}
-	w.Header().Set("Cache-Control", "max-age=15")
-	writeJSON(w, 200, out)
-}
-
 func sortIncidents(list []Incident) {
 	for i := 1; i < len(list); i++ { // newest first; lists are short
 		for j := i; j > 0 && list[j].Created > list[j-1].Created; j-- {

internal/sandbar/incident.go

@@ -21,7 +21,8 @@ type Incident struct {
 	Comms      string   `json:"comms"`    // user id
 	Summary    string   `json:"summary"`
 	Postmortem string   `json:"postmortem"`
-	Public     bool     `json:"public"` // shown on the status page
+	Public     bool     `json:"public"`     // shown on the status page
+	Components []string `json:"components"` // monitor ids the status page says are affected
 	Created    int64    `json:"created"`
 	Resolved   int64    `json:"resolved"`
 	AlertIDs   []string `json:"alertIds"`
@@ -66,7 +67,7 @@ func (s *Server) DeclareIncident(title, severity, summary, lead, actor string, a
 		return nil, errors.New("severity must be sev1, sev2 or sev3")
 	}
 	now := s.now()
-	in := &Incident{ID: newID(), Title: title, Severity: severity, Status: "investigating", Lead: lead, Summary: summary, Created: now.Unix(), AlertIDs: []string{}}
+	in := &Incident{ID: newID(), Title: title, Severity: severity, Status: "investigating", Lead: lead, Summary: summary, Created: now.Unix(), AlertIDs: []string{}, Components: []string{}}
 	for _, id := range alertIDs {
 		if a, err := s.getAlert(id); err == nil {
 			in.AlertIDs = append(in.AlertIDs, a.ID)
@@ -96,15 +97,16 @@ func firstNonEmpty(v ...string) string {
 
 // IncidentPatch holds the fields an update may change; nil means unchanged.
 type IncidentPatch struct {
-	Title      *string `json:"title"`
-	Severity   *string `json:"severity"`
-	Status     *string `json:"status"`
-	Lead       *string `json:"lead"`
-	Comms      *string `json:"comms"`
-	Summary    *string `json:"summary"`
-	Postmortem *string `json:"postmortem"`
-	Public     *bool   `json:"public"`
-	Note       string  `json:"note"` // text for the update announcement and timeline
+	Title      *string   `json:"title"`
+	Severity   *string   `json:"severity"`
+	Status     *string   `json:"status"`
+	Lead       *string   `json:"lead"`
+	Comms      *string   `json:"comms"`
+	Summary    *string   `json:"summary"`
+	Postmortem *string   `json:"postmortem"`
+	Public     *bool     `json:"public"`
+	Components *[]string `json:"components"`
+	Note       string    `json:"note"` // text for the update announcement and timeline
 }
 
 func (s *Server) UpdateIncident(id, actor string, p IncidentPatch) (*Incident, error) {
@@ -113,6 +115,7 @@ func (s *Server) UpdateIncident(id, actor string, p IncidentPatch) (*Incident, e
 		return nil, err
 	}
 	now := s.now()
+	prevStatus := in.Status
 	var changes []string
 	if p.Severity != nil && *p.Severity != in.Severity {
 		if !validSeverity(*p.Severity) {
@@ -151,12 +154,17 @@ func (s *Server) UpdateIncident(id, actor string, p IncidentPatch) (*Incident, e
 	if p.Postmortem != nil {
 		in.Postmortem = *p.Postmortem
 	}
+	wasPublic, statusChanged := in.Public, in.Status != prevStatus
 	if p.Public != nil {
 		in.Public = *p.Public
 	}
+	if p.Components != nil {
+		in.Components = cleanIDs(*p.Components)
+	}
 	if err := s.st.put("incident", in.ID, in); err != nil {
 		return nil, err
 	}
+	s.postToStatusPage(in, wasPublic, statusChanged, p.Note, now)
 	if len(changes) > 0 || p.Note != "" {
 		text := strings.Join(changes, "; ")
 		if p.Note != "" {

internal/sandbar/monitor.go

@@ -30,15 +30,17 @@ type Monitor struct {
 	Target       string `json:"target"` // URL, host:port, hostname, or host[:port] for tls
 	IntervalS    int    `json:"intervalS"`
 	TimeoutS     int    `json:"timeoutS"`
-	Retries      int    `json:"retries"`  // failures in a row before it is down (default 2)
-	Expect       string `json:"expect"`   // http: accepted status, e.g. "200-299" (default)
-	Keyword      string `json:"keyword"`  // http: text the body must contain
-	WarnDays     int    `json:"warnDays"` // tls: fail when the certificate expires within this many days (default 14)
-	GraceS       int    `json:"graceS"`   // heartbeat: extra time allowed past the interval
-	Token        string `json:"token"`    // heartbeat: the secret in the ping URL
-	PolicyID     string `json:"policyId"` // escalation policy for the alert it raises
-	Severity     string `json:"severity"` // alert severity (default critical)
-	Public       bool   `json:"public"`   // shown on the status page
+	Retries      int    `json:"retries"`    // failures in a row before it is down (default 2)
+	Expect       string `json:"expect"`     // http: accepted status, e.g. "200-299" (default)
+	Keyword      string `json:"keyword"`    // http: text the body must contain
+	WarnDays     int    `json:"warnDays"`   // tls: fail when the certificate expires within this many days (default 14)
+	GraceS       int    `json:"graceS"`     // heartbeat: extra time allowed past the interval
+	Token        string `json:"token"`      // heartbeat: the secret in the ping URL
+	PolicyID     string `json:"policyId"`   // escalation policy for the alert it raises
+	Severity     string `json:"severity"`   // alert severity (default critical)
+	Public       bool   `json:"public"`     // shown on the status page
+	Group        string `json:"group"`      // status page component group id; empty for none
+	PublicName   string `json:"publicName"` // name on the status page; empty to use Name
 	AllowPrivate bool   `json:"allowPrivate"`
 	Enabled      bool   `json:"enabled"`
 }

internal/sandbar/server.go

@@ -61,6 +61,13 @@ type Server struct {
 	anaSecret string
 	anaTry    map[string][]time.Time
 
+	statusMu  sync.Mutex // the status page settings cache and the signing secret
+	statusCfg *StatusSettings
+	statusKey []byte
+	subMu     sync.Mutex // per-address limit on public subscribe requests
+	subTry    map[string][]time.Time
+	notifyWG  sync.WaitGroup // status page notifications in flight
+
 	stop chan struct{}
 	wg   sync.WaitGroup
 }
@@ -75,7 +82,7 @@ func New(opts Options, st *Store) *Server {
 	if opts.HitDays <= 0 {
 		opts.HitDays = 365
 	}
-	return &Server{opts: opts, st: st, hub: newHub(), running: map[string]bool{}, loginTry: map[string][]time.Time{}, anaTry: map[string][]time.Time{}, stop: make(chan struct{})}
+	return &Server{opts: opts, st: st, hub: newHub(), running: map[string]bool{}, loginTry: map[string][]time.Time{}, anaTry: map[string][]time.Time{}, subTry: map[string][]time.Time{}, stop: make(chan struct{})}
 }
 
 func (s *Server) now() time.Time {
@@ -89,12 +96,14 @@ func (s *Server) now() time.Time {
 func (s *Server) Start() {
 	s.every(time.Second, func() { s.runDueMonitors(s.now()) })
 	s.every(5*time.Second, func() { s.escalate(s.now()) })
+	s.every(30*time.Second, func() { s.runMaintenance(s.now()) })
 	s.every(time.Hour, func() { s.st.prune(s.now(), s.opts.MessageDays, s.opts.CheckDays, s.opts.HitDays) })
 }
 
 func (s *Server) Close() {
 	close(s.stop)
 	s.wg.Wait()
+	s.notifyWG.Wait()
 }
 
 func (s *Server) every(d time.Duration, f func()) {

internal/sandbar/statuspage.go

@@ -0,0 +1,774 @@
+package sandbar
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"html"
+	"math"
+	"net"
+	"net/http"
+	"net/url"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// The public status page. Monitors marked public are its components, arranged in groups. Incidents
+// marked public are posted on it, with the updates written for customers. Scheduled maintenance
+// has its own window. People follow all of it by RSS, email or webhook (see statussub.go), and the
+// page can be served from its own domain.
+
+// StatusSettings is the page's branding and where it lives. One document, kind "statuspage".
+type StatusSettings struct {
+	Title       string `json:"title"`
+	Description string `json:"description"`
+	Domain      string `json:"domain"`     // serve the page from this host name as well, such as status.example.com
+	LogoURL     string `json:"logoUrl"`    // https address of an image
+	Accent      string `json:"accent"`     // #rrggbb, for buttons and links; white text must stay readable on it
+	SupportURL  string `json:"supportUrl"` // "Contact us" link: http(s) or mailto
+	Footer      string `json:"footer"`
+}
+
+// StatusGroup is a heading that components sit under.
+type StatusGroup struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Order       int    `json:"order"`
+}
+
+// Maintenance is a planned window. Its components show as under maintenance while it runs.
+type Maintenance struct {
+	ID         string   `json:"id"`
+	Title      string   `json:"title"`
+	Message    string   `json:"message"`
+	Start      int64    `json:"start"`
+	End        int64    `json:"end"`
+	Components []string `json:"components"` // monitor ids
+	Canceled   bool     `json:"canceled"`
+	Created    int64    `json:"created"`
+	StartSent  bool     `json:"startSent"` // subscribers have been told it began
+	EndSent    bool     `json:"endSent"`   // and that it is over
+}
+
+func (m *Maintenance) state(now time.Time) string {
+	switch t := now.Unix(); {
+	case m.Canceled:
+		return "canceled"
+	case t < m.Start:
+		return "scheduled"
+	case t < m.End:
+		return "in_progress"
+	}
+	return "completed"
+}
+
+var (
+	hostRe   = regexp.MustCompile(`^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$`)
+	accentRe = regexp.MustCompile(`^#[0-9a-fA-F]{6}$`)
+)
+
+// contrastWithWhite is the WCAG contrast ratio of a #rrggbb color against white.
+func contrastWithWhite(hex string) float64 {
+	v, _ := strconv.ParseUint(hex[1:], 16, 32)
+	lin := func(c uint64) float64 {
+		f := float64(c) / 255
+		if f <= 0.03928 {
+			return f / 12.92
+		}
+		return math.Pow((f+0.055)/1.055, 2.4)
+	}
+	l := 0.2126*lin(v>>16&255) + 0.7152*lin(v>>8&255) + 0.0722*lin(v&255)
+	return 1.05 / (l + 0.05)
+}
+
+func validateStatusSettings(c *StatusSettings, ownURL string) error {
+	c.Title, c.Description, c.Footer = strings.TrimSpace(c.Title), strings.TrimSpace(c.Description), strings.TrimSpace(c.Footer)
+	c.Domain, c.LogoURL, c.SupportURL, c.Accent = strings.ToLower(strings.TrimSpace(c.Domain)), strings.TrimSpace(c.LogoURL), strings.TrimSpace(c.SupportURL), strings.TrimSpace(c.Accent)
+	if c.Title == "" {
+		c.Title = "Status"
+	}
+	if len(c.Title) > 80 || len(c.Description) > 300 || len(c.Footer) > 300 {
+		return errors.New("the title can be 80 characters, the description and footer 300")
+	}
+	if c.Domain != "" {
+		if !hostRe.MatchString(c.Domain) {
+			return errors.New("the domain must be a host name such as status.example.com, with no https:// or path")
+		}
+		if u, err := url.Parse(ownURL); err == nil && strings.EqualFold(u.Hostname(), c.Domain) {
+			return errors.New("that is Sandbar's own address; use a separate host name for the status page")
+		}
+	}
+	if c.LogoURL != "" {
+		if u, err := url.Parse(c.LogoURL); err != nil || u.Scheme != "https" || u.Host == "" || len(c.LogoURL) > 500 {
+			return errors.New("the logo must be an https:// address")
+		}
+	}
+	if c.SupportURL != "" {
+		u, err := url.Parse(c.SupportURL)
+		if err != nil || len(c.SupportURL) > 500 || !(((u.Scheme == "http" || u.Scheme == "https") && u.Host != "") || (u.Scheme == "mailto" && u.Opaque != "")) {
+			return errors.New("the support link must be an http(s):// address or a mailto: link")
+		}
+	}
+	if c.Accent != "" {
+		if !accentRe.MatchString(c.Accent) {
+			return errors.New("the accent color must look like #1f5c5c")
+		}
+		c.Accent = strings.ToLower(c.Accent)
+		if r := contrastWithWhite(c.Accent); r < 4.5 {
+			return fmt.Errorf("white text is hard to read on that color (contrast %.1f to 1, needs 4.5 to 1); pick a darker one", r)
+		}
+	}
+	return nil
+}
+
+func (s *Server) statusSettings() StatusSettings {
+	s.statusMu.Lock()
+	defer s.statusMu.Unlock()
+	if s.statusCfg == nil {
+		c, err := getOf[StatusSettings](s.st, "statuspage", "main")
+		if err != nil {
+			c = &StatusSettings{}
+		}
+		if c.Title == "" {
+			c.Title = "Status"
+		}
+		s.statusCfg = c
+	}
+	return *s.statusCfg
+}
+
+func (s *Server) saveStatusSettings(c StatusSettings) error {
+	if err := s.st.put("statuspage", "main", c); err != nil {
+		return err
+	}
+	s.statusMu.Lock()
+	s.statusCfg = nil
+	s.statusMu.Unlock()
+	return nil
+}
+
+// ---------- where the page lives ----------
+
+type statusHostKey struct{}
+
+// statusHost serves the status page, and nothing else, to requests for the custom domain: the
+// path is moved under /status, so "/" is the page, "/history" its history, and the admin
+// interface and API are not reachable from there.
+func (s *Server) statusHost(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		d := s.statusSettings().Domain
+		if d == "" || !strings.EqualFold(requestHost(r, s.opts.TrustProxy), d) {
+			next.ServeHTTP(w, r)
+			return
+		}
+		r2 := r.WithContext(context.WithValue(r.Context(), statusHostKey{}, true))
+		r2.URL = new(url.URL)
+		*r2.URL = *r.URL
+		switch p := r.URL.Path; {
+		case p == "/status.json" || strings.HasPrefix(p, "/status/"):
+		case p == "/" || p == "/status":
+			r2.URL.Path = "/status"
+		default:
+			r2.URL.Path = "/status" + p
+		}
+		next.ServeHTTP(w, r2)
+	})
+}
+
+func requestHost(r *http.Request, trustProxy bool) string {
+	h := r.Host
+	if trustProxy {
+		if f := r.Header.Get("X-Forwarded-Host"); f != "" {
+			h = strings.TrimSpace(strings.Split(f, ",")[0])
+		}
+	}
+	if host, _, err := net.SplitHostPort(h); err == nil {
+		h = host
+	}
+	return strings.ToLower(h)
+}
+
+// pagePrefix is what page links start with: nothing on the custom domain, /status elsewhere.
+func pagePrefix(r *http.Request) string {
+	if on, _ := r.Context().Value(statusHostKey{}).(bool); on {
+		return ""
+	}
+	return "/status"
+}
+
+// absStatusURL is a full address for a page path such as "/history", for emails and feeds.
+// r may be nil, as in a background notification.
+func (s *Server) absStatusURL(r *http.Request, path string) string {
+	if d := s.statusSettings().Domain; d != "" && (r == nil || pagePrefix(r) == "") {
+		return "https://" + d + path
+	}
+	base := s.opts.URL
+	if base == "" && r != nil {
+		scheme := "http"
+		if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" && s.opts.TrustProxy {
+			scheme = "https"
+		}
+		base = scheme + "://" + r.Host
+	}
+	return strings.TrimRight(base, "/") + "/status" + path
+}
+
+// ---------- the public view ----------
+
+type pubComponent struct {
+	ID     string   `json:"id"`
+	Name   string   `json:"name"`
+	Group  string   `json:"group"`
+	Status string   `json:"status"` // the monitor: up, down, pending
+	State  string   `json:"state"`  // what the page says: operational, degraded, partial_outage, major_outage, maintenance, pending
+	Uptime float64  `json:"uptime"`
+	Since  int64    `json:"since"`
+	Days   [][2]int `json:"days"` // [checks, failed] per UTC day, oldest first, ending today
+}
+
+type pubPost struct {
+	Time   int64  `json:"time"`
+	Status string `json:"status"`
+	Text   string `json:"text"`
+}
+
+type pubIncident struct {
+	ID         string    `json:"id"`
+	Title      string    `json:"title"`
+	Status     string    `json:"status"`
+	Severity   string    `json:"severity"`
+	Created    int64     `json:"created"`
+	Resolved   int64     `json:"resolved"`
+	Components []string  `json:"components"` // names
+	Updates    []pubPost `json:"updates"`    // newest first
+}
+
+type pubMaintenance struct {
+	ID         string   `json:"id"`
+	Title      string   `json:"title"`
+	Message    string   `json:"message"`
+	Start      int64    `json:"start"`
+	End        int64    `json:"end"`
+	State      string   `json:"state"`
+	Components []string `json:"components"` // names
+}
+
+// worse ranks component states; a higher number is shown over a lower one.
+var stateRank = map[string]int{"operational": 0, "pending": 0, "maintenance": 1, "degraded": 2, "partial_outage": 3, "major_outage": 4}
+
+func (s *Server) publicComponents() (comps []pubComponent, groups []StatusGroup, names map[string]string) {
+	groups, _ = listOf[StatusGroup](s.st, "sgroup")
+	sort.SliceStable(groups, func(i, j int) bool {
+		if groups[i].Order != groups[j].Order {
+			return groups[i].Order < groups[j].Order
+		}
+		return strings.ToLower(groups[i].Name) < strings.ToLower(groups[j].Name)
+	})
+	rank := map[string]int{"": -1}
+	for i, g := range groups {
+		rank[g.ID] = i
+	}
+	mons, _ := listOf[Monitor](s.st, "monitor")
+	names = map[string]string{}
+	now := s.now()
+	for _, m := range mons {
+		if !m.Public || !m.Enabled {
+			continue
+		}
+		name := firstNonEmpty(strings.TrimSpace(m.PublicName), m.Name)
+		names[m.ID] = name
+		if _, ok := rank[m.Group]; !ok {
+			m.Group = "" // its group was deleted
+		}
+		st := s.monitorState(m.ID)
+		days := s.dailyUptime(m.ID, uptimeDays, now)
+		var checks, fails int
+		for _, d := range days {
+			checks, fails = checks+d[0], fails+d[1]
+		}
+		uptime := -1.0 // no checks yet
+		if checks > 0 {
+			uptime = float64(checks-fails) * 100 / float64(checks)
+		}
+		state := map[string]string{"up": "operational", "down": "major_outage"}[st.Status]
+		if state == "" {
+			state = "pending"
+		}
+		comps = append(comps, pubComponent{ID: m.ID, Name: name, Group: m.Group, Status: st.Status, State: state, Uptime: uptime, Since: st.Since, Days: days})
+	}
+	sort.SliceStable(comps, func(i, j int) bool {
+		if ri, rj := rank[comps[i].Group], rank[comps[j].Group]; ri != rj {
+			return ri < rj
+		}
+		return strings.ToLower(comps[i].Name) < strings.ToLower(comps[j].Name)
+	})
+	return
+}
+
+func (s *Server) publicIncident(in Incident, names map[string]string) pubIncident {
+	out := pubIncident{ID: in.ID, Title: in.Title, Status: in.Status, Severity: in.Severity, Created: in.Created, Resolved: in.Resolved, Components: []string{}, Updates: []pubPost{}}
+	for _, id := range in.Components {
+		if n, ok := names[id]; ok {
+			out.Components = append(out.Components, n)
+		}
+	}
+	for _, e := range s.st.events("incident", in.ID) {
+		if e.Kind == "post" {
+			out.Updates = append(out.Updates, pubPost{Time: e.Time, Status: e.Status, Text: e.Text})
+		}
+	}
+	if len(out.Updates) == 0 { // public, but nothing posted yet: show what we know
+		out.Updates = append(out.Updates, pubPost{Time: in.Created, Status: "investigating", Text: firstNonEmpty(in.Summary, defaultPost("investigating"))})
+	}
+	for i, j := 0, len(out.Updates)-1; i < j; i, j = i+1, j-1 { // newest first
+		out.Updates[i], out.Updates[j] = out.Updates[j], out.Updates[i]
+	}
+	return out
+}
+
+func (s *Server) publicMaintenance(m Maintenance, names map[string]string, now time.Time) pubMaintenance {
+	out := pubMaintenance{ID: m.ID, Title: m.Title, Message: m.Message, Start: m.Start, End: m.End, State: m.state(now), Components: []string{}}
+	for _, id := range m.Components {
+		if n, ok := names[id]; ok {
+			out.Components = append(out.Components, n)
+		}
+	}
+	return out
+}
+
+func (s *Server) loadMaintenance() []Maintenance {
+	list, _ := listOf[Maintenance](s.st, "maintenance")
+	sort.Slice(list, func(i, j int) bool { return list[i].Start > list[j].Start })
+	return list
+}
+
+// statusJSON feeds the public status page: only monitors, incidents and maintenance marked public.
+func (s *Server) statusJSON(w http.ResponseWriter, r *http.Request) {
+	now := s.now()
+	cfg := s.statusSettings()
+	comps, groups, names := s.publicComponents()
+	if groups == nil {
+		groups = []StatusGroup{}
+	}
+	if comps == nil {
+		comps = []pubComponent{}
+	}
+	idx := map[string]int{}
+	for i, c := range comps {
+		idx[c.ID] = i
+	}
+	raise := func(id, state string) {
+		if i, ok := idx[id]; ok && stateRank[state] > stateRank[comps[i].State] {
+			comps[i].State = state
+		}
+	}
+
+	out := struct {
+		Settings    StatusSettings   `json:"settings"`
+		Monitors    []pubComponent   `json:"monitors"`
+		Groups      []StatusGroup    `json:"groups"`
+		Incidents   []pubIncident    `json:"incidents"`
+		Maintenance []pubMaintenance `json:"maintenance"`
+		Overall     string           `json:"overall"`
+		Today       string           `json:"today"` // the UTC date of the last bar
+		Subscribe   map[string]bool  `json:"subscribe"`
+	}{Settings: cfg, Groups: groups, Incidents: []pubIncident{}, Maintenance: []pubMaintenance{}, Today: now.UTC().Format("2006-01-02"),
+		Subscribe: map[string]bool{"email": s.mailEnabled(), "webhook": true, "rss": true}}
+	out.Settings.Domain = "" // not for visitors
+
+	overall := "operational"
+	lift := func(level string) {
+		if level == "outage" || overall == "outage" {
+			overall = "outage"
+		} else if level == "degraded" || overall == "degraded" {
+			overall = "degraded"
+		} else if level == "maintenance" {
+			overall = "maintenance"
+		}
+	}
+
+	incs, _ := listOf[Incident](s.st, "incident")
+	sortIncidents(incs)
+	cut := now.AddDate(0, 0, -14).Unix()
+	for _, in := range incs {
+		if !in.Public || (in.Status == "resolved" && in.Resolved < cut) {
+			continue
+		}
+		out.Incidents = append(out.Incidents, s.publicIncident(in, names))
+		if in.Status == "resolved" {
+			continue
+		}
+		impact := map[string]string{"sev1": "major_outage", "sev2": "partial_outage"}[in.Severity]
+		if impact == "" {
+			impact = "degraded"
+		}
+		for _, id := range in.Components {
+			raise(id, impact)
+		}
+		if impact == "major_outage" && len(in.Components) > 0 {
+			lift("outage")
+		} else {
+			lift("degraded")
+		}
+	}
+
+	for _, m := range s.loadMaintenance() {
+		st := m.state(now)
+		if st == "canceled" || st == "completed" {
+			continue
+		}
+		out.Maintenance = append(out.Maintenance, s.publicMaintenance(m, names, now))
+		if st == "in_progress" {
+			for _, id := range m.Components {
+				if i, ok := idx[id]; ok {
+					comps[i].State = "maintenance" // planned work explains a failing check
+				}
+			}
+			lift("maintenance")
+		}
+	}
+	sort.SliceStable(out.Maintenance, func(i, j int) bool { return out.Maintenance[i].Start < out.Maintenance[j].Start })
+
+	for _, c := range comps {
+		switch c.State {
+		case "major_outage":
+			lift("outage")
+		case "partial_outage", "degraded":
+			lift("degraded")
+		}
+	}
+	out.Monitors, out.Overall = comps, overall
+	w.Header().Set("Cache-Control", "max-age=15")
+	writeJSON(w, 200, out)
+}
+
+type historyEntry struct {
+	Type        string          `json:"type"` // incident or maintenance
+	Time        int64           `json:"time"`
+	Incident    *pubIncident    `json:"incident,omitempty"`
+	Maintenance *pubMaintenance `json:"maintenance,omitempty"`
+}
+
+// historyJSON lists everything that was ever public, newest first, a page at a time.
+// before is the time of the last entry of the previous page.
+func (s *Server) historyJSON(w http.ResponseWriter, r *http.Request) {
+	before, _ := strconv.ParseInt(r.URL.Query().Get("before"), 10, 64)
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	if limit <= 0 || limit > 100 {
+		limit = 30
+	}
+	now := s.now()
+	_, _, names := s.publicComponents()
+	var all []historyEntry
+	incs, _ := listOf[Incident](s.st, "incident")
+	for _, in := range incs {
+		if in.Public {
+			p := s.publicIncident(in, names)
+			all = append(all, historyEntry{Type: "incident", Time: in.Created, Incident: &p})
+		}
+	}
+	for _, m := range s.loadMaintenance() {
+		if st := m.state(now); st == "completed" || st == "in_progress" {
+			p := s.publicMaintenance(m, names, now)
+			all = append(all, historyEntry{Type: "maintenance", Time: m.Start, Maintenance: &p})
+		}
+	}
+	sort.SliceStable(all, func(i, j int) bool { return all[i].Time > all[j].Time })
+	if before > 0 {
+		k := sort.Search(len(all), func(i int) bool { return all[i].Time < before })
+		all = all[k:]
+	}
+	next := int64(0)
+	if len(all) > limit {
+		all = all[:limit]
+		next = all[limit-1].Time
+	}
+	if all == nil {
+		all = []historyEntry{}
+	}
+	w.Header().Set("Cache-Control", "max-age=15")
+	writeJSON(w, 200, map[string]any{"entries": all, "next": next})
+}
+
+func (s *Server) incidentJSON(w http.ResponseWriter, r *http.Request) {
+	in, err := getOf[Incident](s.st, "incident", r.PathValue("id"))
+	if err != nil || !in.Public {
+		writeJSON(w, 404, map[string]string{"error": "not found"})
+		return
+	}
+	_, _, names := s.publicComponents()
+	w.Header().Set("Cache-Control", "max-age=15")
+	writeJSON(w, 200, s.publicIncident(*in, names))
+}
+
+// servePage fills the page shell with the title and the prefix its links start with.
+func (s *Server) serveStatusPage(w http.ResponseWriter, r *http.Request) {
+	page := strings.NewReplacer("__TITLE__", html.EscapeString(s.statusSettings().Title), "__BASE__", pagePrefix(r)).Replace(string(statusHTML))
+	servePage(w, []byte(page))
+}
+
+func (s *Server) statusRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("GET /status", s.serveStatusPage)
+	mux.HandleFunc("GET /status/history", s.serveStatusPage)
+	mux.HandleFunc("GET /status/incidents/{id}", s.serveStatusPage)
+	mux.HandleFunc("GET /status.json", s.statusJSON)
+	mux.HandleFunc("GET /status/api/history", s.historyJSON)
+	mux.HandleFunc("GET /status/api/incidents/{id}", s.incidentJSON)
+	mux.HandleFunc("GET /status/feed.rss", s.statusFeed)
+	mux.HandleFunc("POST /status/subscribe", s.followStatusHTTP)
+	mux.HandleFunc("GET /status/confirm", s.confirmSubscription)
+	mux.HandleFunc("GET /status/unsubscribe", s.unsubscribeRedirect)
+	mux.HandleFunc("POST /status/unsubscribe", s.unsubscribeHTTP)
+
+	// administration
+	mux.HandleFunc("GET /api/v1/statuspage", s.auth(false, func(w http.ResponseWriter, r *http.Request) {
+		writeJSON(w, 200, map[string]any{"settings": s.statusSettings(), "pageUrl": s.absStatusURL(nil, ""), "feedUrl": s.absStatusURL(nil, "/feed.rss"), "email": s.mailEnabled()})
+	}))
+	mux.HandleFunc("PUT /api/v1/statuspage", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		var c StatusSettings
+		if !decode(r, &c) {
+			bad(w, "invalid request")
+			return
+		}
+		if err := validateStatusSettings(&c, s.opts.URL); err != nil {
+			bad(w, err.Error())
+			return
+		}
+		if err := s.saveStatusSettings(c); err != nil {
+			fail(w, err)
+			return
+		}
+		writeJSON(w, 200, map[string]any{"settings": c, "pageUrl": s.absStatusURL(nil, ""), "feedUrl": s.absStatusURL(nil, "/feed.rss"), "email": s.mailEnabled()})
+	}))
+	s.crud(mux, "status-groups", "sgroup", true, func() any { return &StatusGroup{} }, func(v any, id string) error {
+		g := v.(*StatusGroup)
+		g.ID, g.Name, g.Description = id, strings.TrimSpace(g.Name), strings.TrimSpace(g.Description)
+		if g.Name == "" {
+			return errors.New("give the group a name")
+		}
+		return nil
+	}, nil)
+	s.maintenanceRoutes(mux)
+	mux.HandleFunc("GET /api/v1/status-subscribers", s.auth(true, s.listSubscribers))
+	mux.HandleFunc("DELETE /api/v1/status-subscribers/{id}", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		res, err := s.st.db.Exec(`DELETE FROM subscribers WHERE id=?`, r.PathValue("id"))
+		if n, _ := res.RowsAffected(); err == nil && n == 0 {
+			err = errNotFound
+		}
+		fail2(w, err)
+	}))
+}
+
+// ---------- incident posts ----------
+
+func defaultPost(status string) string {
+	return map[string]string{
+		"investigating": "We are investigating this issue.",
+		"identified":    "The cause has been identified and we are working on a fix.",
+		"monitoring":    "A fix has been applied and we are monitoring the results.",
+		"resolved":      "This incident has been resolved.",
+	}[status]
+}
+
+func cleanIDs(ids []string) []string {
+	out, seen := []string{}, map[string]bool{}
+	for _, id := range ids {
+		if id = strings.TrimSpace(id); id != "" && !seen[id] {
+			seen[id] = true
+			out = append(out, id)
+		}
+	}
+	return out
+}
+
+// postToStatusPage publishes an update of a public incident and tells subscribers. An update is a
+// change of status or a note; making an incident public posts what is known so far. The note is
+// the only text customers see from an update: the internal timeline stays internal.
+func (s *Server) postToStatusPage(in *Incident, wasPublic, statusChanged bool, note string, now time.Time) {
+	if !in.Public {
+		return
+	}
+	note = strings.TrimSpace(note)
+	var text string
+	event := "incident.updated"
+	switch {
+	case !wasPublic:
+		text, event = firstNonEmpty(note, in.Summary, defaultPost(in.Status)), "incident.created"
+		if in.Status == "resolved" {
+			event = "incident.resolved"
+		}
+	case statusChanged || note != "":
+		text = firstNonEmpty(note, defaultPost(in.Status))
+		if statusChanged && in.Status == "resolved" {
+			event = "incident.resolved"
+		}
+	default:
+		return
+	}
+	s.st.addPost(in.ID, in.Status, text, now)
+	s.notifySubscribers(statusNote{Event: event, Title: in.Title, Status: in.Status, Message: text, URL: s.absStatusURL(nil, "/incidents/"+in.ID), Time: now.Unix()})
+}
+
+// ---------- scheduled maintenance ----------
+
+type maintView struct {
+	Maintenance
+	State string `json:"state"`
+}
+
+func (s *Server) validateMaintenance(m *Maintenance, creating bool) error {
+	m.Title, m.Message = strings.TrimSpace(m.Title), strings.TrimSpace(m.Message)
+	if m.Title == "" {
+		return errors.New("give the maintenance a title")
+	}
+	if len(m.Title) > 120 || len(m.Message) > 2000 {
+		return errors.New("the title can be 120 characters and the details 2000")
+	}
+	if m.Start <= 0 || m.End <= m.Start {
+		return errors.New("the maintenance must end after it starts")
+	}
+	if creating && m.End <= s.now().Unix() {
+		return errors.New("the maintenance window is already over")
+	}
+	m.Components = cleanIDs(m.Components)
+	return nil
+}
+
+func (s *Server) maintenanceRoutes(mux *http.ServeMux) {
+	view := func(m Maintenance) maintView { return maintView{m, m.state(s.now())} }
+	mux.HandleFunc("GET /api/v1/maintenance", s.auth(false, func(w http.ResponseWriter, r *http.Request) {
+		out := []maintView{}
+		for _, m := range s.loadMaintenance() {
+			out = append(out, view(m))
+		}
+		writeJSON(w, 200, out)
+	}))
+	mux.HandleFunc("POST /api/v1/maintenance", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		var m Maintenance
+		if !decode(r, &m) {
+			bad(w, "invalid request")
+			return
+		}
+		if err := s.validateMaintenance(&m, true); err != nil {
+			bad(w, err.Error())
+			return
+		}
+		m.ID, m.Created, m.Canceled, m.StartSent, m.EndSent = newID(), s.now().Unix(), false, false, false
+		if err := s.st.put("maintenance", m.ID, m); err != nil {
+			fail(w, err)
+			return
+		}
+		if m.Start > s.now().Unix() {
+			s.announceMaintenance("maintenance.scheduled", m)
+		}
+		writeJSON(w, 200, view(m))
+	}))
+	mux.HandleFunc("PUT /api/v1/maintenance/{id}", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		old, err := getOf[Maintenance](s.st, "maintenance", r.PathValue("id"))
+		if err != nil {
+			fail(w, err)
+			return
+		}
+		m := *old
+		var in Maintenance
+		if !decode(r, &in) {
+			bad(w, "invalid request")
+			return
+		}
+		m.Title, m.Message, m.Start, m.End, m.Components = in.Title, in.Message, in.Start, in.End, in.Components
+		if err := s.validateMaintenance(&m, false); err != nil {
+			bad(w, err.Error())
+			return
+		}
+		if m.Canceled || m.state(s.now()) == "completed" && old.EndSent {
+			bad(w, "that maintenance is over; schedule a new one")
+			return
+		}
+		moved := m.Start != old.Start || m.End != old.End
+		if moved && m.Start > s.now().Unix() {
+			m.StartSent, m.EndSent = false, false
+		}
+		if err := s.st.put("maintenance", m.ID, m); err != nil {
+			fail(w, err)
+			return
+		}
+		if moved && !m.StartSent {
+			s.announceMaintenance("maintenance.rescheduled", m)
+		}
+		writeJSON(w, 200, view(m))
+	}))
+	mux.HandleFunc("POST /api/v1/maintenance/{id}/cancel", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		m, err := getOf[Maintenance](s.st, "maintenance", r.PathValue("id"))
+		if err != nil {
+			fail(w, err)
+			return
+		}
+		if m.Canceled || m.EndSent {
+			bad(w, "that maintenance is already over")
+			return
+		}
+		m.Canceled = true
+		if err := s.st.put("maintenance", m.ID, m); err != nil {
+			fail(w, err)
+			return
+		}
+		s.announceMaintenance("maintenance.canceled", *m)
+		writeJSON(w, 200, view(*m))
+	}))
+	mux.HandleFunc("DELETE /api/v1/maintenance/{id}", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		fail2(w, s.st.del("maintenance", r.PathValue("id")))
+	}))
+}
+
+func (s *Server) announceMaintenance(event string, m Maintenance) {
+	when := fmtWindow(m.Start, m.End)
+	msg := map[string]string{
+		"maintenance.scheduled":   "Scheduled maintenance: " + when + ".",
+		"maintenance.rescheduled": "The maintenance window has changed: " + when + ".",
+		"maintenance.started":     "Maintenance has started and is planned to finish by " + time.Unix(m.End, 0).UTC().Format("15:04 UTC") + ".",
+		"maintenance.completed":   "Maintenance is complete.",
+		"maintenance.canceled":    "This maintenance has been canceled.",
+	}[event]
+	if m.Message != "" && event != "maintenance.completed" {
+		msg += "\n\n" + m.Message
+	}
+	status := strings.TrimPrefix(event, "maintenance.")
+	s.notifySubscribers(statusNote{Event: event, Title: m.Title, Status: status, Message: msg, URL: s.absStatusURL(nil, ""), Time: s.now().Unix()})
+}
+
+func fmtWindow(from, to int64) string {
+	f, t := time.Unix(from, 0).UTC(), time.Unix(to, 0).UTC()
+	if f.YearDay() == t.YearDay() && f.Year() == t.Year() {
+		return f.Format("Jan 2, 2006, 15:04") + " to " + t.Format("15:04 UTC")
+	}
+	return f.Format("Jan 2, 2006, 15:04") + " to " + t.Format("Jan 2, 2006, 15:04 UTC")
+}
+
+// runMaintenance tells subscribers when windows begin and end.
+func (s *Server) runMaintenance(now time.Time) {
+	for _, m := range s.loadMaintenance() {
+		if m.Canceled || m.EndSent {
+			continue
+		}
+		t, changed := now.Unix(), false
+		if !m.StartSent && t >= m.Start {
+			m.StartSent, changed = true, true
+			if t < m.End { // a window missed entirely, such as while Sandbar was down, is not announced
+				s.announceMaintenance("maintenance.started", m)
+			} else {
+				m.EndSent = true
+			}
+		}
+		if t >= m.End && !m.EndSent {
+			m.EndSent, changed = true, true
+			s.announceMaintenance("maintenance.completed", m)
+		}
+		if changed {
+			s.st.put("maintenance", m.ID, m)
+		}
+	}
+}

internal/sandbar/statuspage_test.go

@@ -0,0 +1,700 @@
+package sandbar
+
+import (
+	"encoding/json"
+	"encoding/xml"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+type sentMail struct{ to, subject, body string }
+
+type mailBox struct {
+	mu   sync.Mutex
+	sent []sentMail
+}
+
+func (m *mailBox) send(to, subject, body string) error {
+	m.mu.Lock()
+	m.sent = append(m.sent, sentMail{to, subject, body})
+	m.mu.Unlock()
+	return nil
+}
+
+func (m *mailBox) all() []sentMail {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return append([]sentMail(nil), m.sent...)
+}
+
+func statusTestServer(t *testing.T) (*Server, *fakeClock, *mailBox, *httptest.Server) {
+	t.Helper()
+	s, clk, _ := newTestServer(t)
+	mb := &mailBox{}
+	s.opts.Mailer = mb.send
+	ts := httptest.NewServer(s.Handler())
+	t.Cleanup(ts.Close)
+	return s, clk, mb, ts
+}
+
+func getJSON(t *testing.T, url string, v any) int {
+	t.Helper()
+	resp, err := http.Get(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if v != nil {
+		json.NewDecoder(resp.Body).Decode(v)
+	}
+	return resp.StatusCode
+}
+
+func postJSON(t *testing.T, url string, body any) (int, map[string]string) {
+	t.Helper()
+	b, _ := json.Marshal(body)
+	resp, err := http.Post(url, "application/json", strings.NewReader(string(b)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	var out map[string]string
+	json.NewDecoder(resp.Body).Decode(&out)
+	return resp.StatusCode, out
+}
+
+type statusDoc struct {
+	Settings    StatusSettings `json:"settings"`
+	Overall     string
+	Groups      []StatusGroup
+	Monitors    []pubComponent
+	Incidents   []pubIncident
+	Maintenance []pubMaintenance
+	Subscribe   map[string]bool
+}
+
+func TestStatusSettingsValidation(t *testing.T) {
+	cases := []struct {
+		name string
+		in   StatusSettings
+		ok   bool
+	}{
+		{"empty gets a title", StatusSettings{}, true},
+		{"domain", StatusSettings{Domain: "Status.Example.com"}, true},
+		{"domain with scheme", StatusSettings{Domain: "https://status.example.com"}, false},
+		{"domain with path", StatusSettings{Domain: "status.example.com/x"}, false},
+		{"single label", StatusSettings{Domain: "localhost"}, false},
+		{"own address", StatusSettings{Domain: "sandbar.test"}, false},
+		{"http logo", StatusSettings{LogoURL: "http://x.test/a.png"}, false},
+		{"https logo", StatusSettings{LogoURL: "https://x.test/a.png"}, true},
+		{"javascript support link", StatusSettings{SupportURL: "javascript:alert(1)"}, false},
+		{"mailto support link", StatusSettings{SupportURL: "mailto:help@example.com"}, true},
+		{"accent", StatusSettings{Accent: "#1F5C5C"}, true},
+		{"accent too light for white text", StatusSettings{Accent: "#ffee00"}, false},
+		{"accent not a hex color", StatusSettings{Accent: "teal"}, false},
+		{"title too long", StatusSettings{Title: strings.Repeat("x", 81)}, false},
+	}
+	for _, c := range cases {
+		err := validateStatusSettings(&c.in, "https://sandbar.test")
+		if (err == nil) != c.ok {
+			t.Errorf("%s: err = %v, want ok=%v", c.name, err, c.ok)
+		}
+	}
+	c := StatusSettings{Domain: "Status.Example.com", Accent: "#1F5C5C"}
+	validateStatusSettings(&c, "")
+	if c.Domain != "status.example.com" || c.Accent != "#1f5c5c" || c.Title != "Status" {
+		t.Fatalf("not normalised: %+v", c)
+	}
+	if r := contrastWithWhite("#000000"); r < 20.9 || r > 21.1 {
+		t.Fatalf("black on white is 21:1, got %.2f", r)
+	}
+}
+
+// Components sit in groups, take their state from monitors, incidents and maintenance, and the
+// banner shows the worst of them.
+func TestStatusPageComponentsAndOverall(t *testing.T) {
+	s, clk, _, ts := statusTestServer(t)
+	s.st.put("sgroup", "g2", &StatusGroup{ID: "g2", Name: "Apps", Order: 2})
+	s.st.put("sgroup", "g1", &StatusGroup{ID: "g1", Name: "Infrastructure", Order: 1})
+	s.st.put("monitor", "web", &Monitor{ID: "web", Name: "web-1", PublicName: "Website", Kind: "http", Target: "http://x", Enabled: true, Public: true, Group: "g2"})
+	s.st.put("monitor", "db", &Monitor{ID: "db", Name: "Database", Kind: "tcp", Target: "x:1", Enabled: true, Public: true, Group: "g1"})
+	s.st.put("monitor", "old", &Monitor{ID: "old", Name: "Orphan", Kind: "tcp", Target: "x:1", Enabled: true, Public: true, Group: "deleted"})
+	s.st.put("monitor", "hid", &Monitor{ID: "hid", Name: "Hidden", Kind: "tcp", Target: "x:1", Enabled: true, Group: "g1"})
+	for _, id := range []string{"web", "db", "old", "hid"} {
+		s.saveState(MonitorState{MonitorID: id, Status: "up", Since: clk.Now().Unix()})
+	}
+
+	var d statusDoc
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Overall != "operational" || len(d.Monitors) != 3 {
+		t.Fatalf("all up: %+v", d)
+	}
+	if got := []string{d.Monitors[0].ID, d.Monitors[1].ID, d.Monitors[2].ID}; got[0] != "old" && got[0] != "db" {
+		t.Fatalf("order %v", got)
+	}
+	// ungrouped (a deleted group counts as none) first, then groups by order; the public name wins
+	if d.Monitors[0].ID != "old" || d.Monitors[0].Group != "" || d.Monitors[1].ID != "db" || d.Monitors[2].Name != "Website" {
+		t.Fatalf("order or names wrong: %+v", d.Monitors)
+	}
+	if len(d.Groups) != 2 || d.Groups[0].ID != "g1" {
+		t.Fatalf("groups: %+v", d.Groups)
+	}
+
+	// A sev2 incident on one component makes only that one partially down.
+	s.st.put("incident", "i1", &Incident{ID: "i1", Title: "Slow pages", Severity: "sev2", Status: "identified", Public: true, Created: clk.Now().Unix(), Components: []string{"web"}})
+	getJSON(t, ts.URL+"/status.json", &d)
+	states := map[string]string{}
+	for _, c := range d.Monitors {
+		states[c.ID] = c.State
+	}
+	if states["web"] != "partial_outage" || states["db"] != "operational" || d.Overall != "degraded" {
+		t.Fatalf("sev2: %v overall %s", states, d.Overall)
+	}
+	if len(d.Incidents) != 1 || len(d.Incidents[0].Components) != 1 || d.Incidents[0].Components[0] != "Website" {
+		t.Fatalf("incident components should be public names: %+v", d.Incidents)
+	}
+
+	// A failing monitor is a major outage.
+	s.saveState(MonitorState{MonitorID: "db", Status: "down", Since: clk.Now().Unix()})
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Overall != "outage" {
+		t.Fatalf("overall = %s", d.Overall)
+	}
+
+	// Maintenance in progress explains the failure instead of showing an outage.
+	start := clk.Now().Add(-time.Minute).Unix()
+	s.st.put("maintenance", "m1", &Maintenance{ID: "m1", Title: "Database upgrade", Start: start, End: start + 3600, Components: []string{"db"}, StartSent: true})
+	s.st.put("incident", "i1", &Incident{ID: "i1", Title: "Slow pages", Severity: "sev2", Status: "resolved", Resolved: clk.Now().Unix(), Public: true, Created: clk.Now().Unix()})
+	getJSON(t, ts.URL+"/status.json", &d)
+	for _, c := range d.Monitors {
+		states[c.ID] = c.State
+	}
+	if states["db"] != "maintenance" || d.Overall != "maintenance" || len(d.Maintenance) != 1 || d.Maintenance[0].State != "in_progress" {
+		t.Fatalf("maintenance: %v overall %s %+v", states, d.Overall, d.Maintenance)
+	}
+
+	// Once the window is over, the failure shows again, and the window moves to the history.
+	clk.Advance(2 * time.Hour)
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Overall != "outage" || len(d.Maintenance) != 0 {
+		t.Fatalf("after maintenance: %s %+v", d.Overall, d.Maintenance)
+	}
+}
+
+// Customers see the posts written for them. Internal comments, names and private incidents stay out.
+func TestIncidentPostsArePublicAndInternalNotesAreNot(t *testing.T) {
+	s, _, _, ts := statusTestServer(t)
+	u := mustUser(t, s, "Alice")
+	s.st.put("monitor", "web", &Monitor{ID: "web", Name: "Website", Kind: "http", Target: "http://x", Enabled: true, Public: true})
+
+	hidden, _ := s.DeclareIncident("Secret outage", "sev1", "internal only", u.ID, u.Name, nil)
+	inc, _ := s.DeclareIncident("Checkout errors", "sev2", "Some orders fail.", u.ID, u.Name, nil)
+	s.CommentIncident(inc.ID, u.Name, "ALICE-INTERNAL-COMMENT")
+	if code := getJSON(t, ts.URL+"/status/api/incidents/"+inc.ID, nil); code != 404 {
+		t.Fatalf("a private incident is public: %d", code)
+	}
+
+	yes, comps := true, []string{"web"}
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes, Components: &comps})
+	ident, mon, done := "identified", "monitoring", "resolved"
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &ident, Note: "A bad deploy is the cause."})
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &mon})
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Note: "Rolled back; watching error rates."})
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &done})
+
+	var pi pubIncident
+	if code := getJSON(t, ts.URL+"/status/api/incidents/"+inc.ID, &pi); code != 200 {
+		t.Fatalf("public incident: %d", code)
+	}
+	var texts, statuses []string
+	for _, p := range pi.Updates {
+		texts, statuses = append(texts, p.Text), append(statuses, p.Status)
+	}
+	// newest first
+	wantStatus := []string{"resolved", "monitoring", "monitoring", "identified", "investigating"}
+	if strings.Join(statuses, ",") != strings.Join(wantStatus, ",") {
+		t.Fatalf("statuses %v, want %v", statuses, wantStatus)
+	}
+	if texts[0] != defaultPost("resolved") || texts[1] != "Rolled back; watching error rates." || texts[3] != "A bad deploy is the cause." || texts[4] != "Some orders fail." {
+		t.Fatalf("texts: %q", texts)
+	}
+	raw, _ := json.Marshal(pi)
+	for _, leak := range []string{"ALICE-INTERNAL-COMMENT", "Alice", "alice@", "Secret outage", "bad deploy is the cause by"} {
+		if strings.Contains(string(raw), leak) {
+			t.Fatalf("public incident leaks %q: %s", leak, raw)
+		}
+	}
+	var h struct {
+		Entries []historyEntry
+		Next    int64
+	}
+	getJSON(t, ts.URL+"/status/api/history", &h)
+	if len(h.Entries) != 1 || h.Entries[0].Incident.ID != inc.ID {
+		t.Fatalf("history should hold only the public incident, not %s: %+v", hidden.ID, h.Entries)
+	}
+}
+
+func TestHistoryPaging(t *testing.T) {
+	s, clk, _, ts := statusTestServer(t)
+	for i := 0; i < 5; i++ {
+		id := string(rune('a' + i))
+		s.st.put("incident", id, &Incident{ID: id, Title: "Incident " + id, Severity: "sev3", Status: "resolved", Public: true, Created: clk.Now().Unix() - int64(i)*100, Resolved: clk.Now().Unix()})
+	}
+	var h struct {
+		Entries []historyEntry
+		Next    int64
+	}
+	getJSON(t, ts.URL+"/status/api/history?limit=2", &h)
+	if len(h.Entries) != 2 || h.Entries[0].Incident.ID != "a" || h.Next == 0 {
+		t.Fatalf("page 1: %+v", h)
+	}
+	var seen []string
+	for next := int64(1); next != 0; {
+		getJSON(t, ts.URL+"/status/api/history?limit=2&before="+itoa(h.Next), &h)
+		for _, e := range h.Entries {
+			seen = append(seen, e.Incident.ID)
+		}
+		next = h.Next
+		if len(seen) > 10 {
+			t.Fatal("paging does not end")
+		}
+	}
+	if strings.Join(seen, "") != "cde" {
+		t.Fatalf("later pages %v", seen)
+	}
+}
+
+func itoa(n int64) string { b, _ := json.Marshal(n); return string(b) }
+
+var linkRe = regexp.MustCompile(`https?://\S+`)
+
+func TestEmailSubscriptionFlow(t *testing.T) {
+	s, _, mb, ts := statusTestServer(t)
+	u := mustUser(t, s, "Alice")
+	s.saveStatusSettings(StatusSettings{Title: "Acme status"})
+
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "not an address"}); code != 400 {
+		t.Fatalf("bad address: %d", code)
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "Bob <bob@example.com>"}); code != 400 {
+		t.Fatalf("display name accepted: %d", code)
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "bob@example.com"}); code != 200 {
+		t.Fatalf("subscribe: %d", code)
+	}
+	mails := mb.all()
+	if len(mails) != 1 || mails[0].to != "bob@example.com" || !strings.Contains(mails[0].subject, "Confirm") {
+		t.Fatalf("confirmation mail: %+v", mails)
+	}
+	confirm := linkRe.FindString(mails[0].body)
+
+	// Not confirmed yet: updates go nowhere.
+	yes := true
+	inc, _ := s.DeclareIncident("API errors", "sev2", "Elevated errors.", u.ID, u.Name, nil)
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes})
+	s.notifyWG.Wait()
+	if n := len(mb.all()); n != 1 {
+		t.Fatalf("an unconfirmed address got %d mails", n)
+	}
+
+	// A forged link does nothing; the real one confirms and sends the visitor to the page.
+	noRedirect := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	forged := confirm[:len(confirm)-1] + "z"
+	if resp, _ := noRedirect.Get(strings.Replace(forged, "http://sandbar.test", ts.URL, 1)); resp.Header.Get("Location") != "/status/?notice=invalid" {
+		t.Fatalf("forged link: %v", resp.Header.Get("Location"))
+	}
+	resp, _ := noRedirect.Get(strings.Replace(confirm, "http://sandbar.test", ts.URL, 1))
+	if resp.StatusCode != 303 || resp.Header.Get("Location") != "/status/?notice=confirmed" {
+		t.Fatalf("confirm: %d %s", resp.StatusCode, resp.Header.Get("Location"))
+	}
+	if !strings.HasPrefix(confirm, "http://sandbar.test/status/confirm?token=") {
+		t.Fatalf("confirm link: %s", confirm)
+	}
+
+	// Subscribing again says the same thing and sends nothing more.
+	postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "bob@example.com"})
+	if n := len(mb.all()); n != 1 {
+		t.Fatalf("re-subscribing a confirmed address sent mail: %d", n)
+	}
+
+	fixed := "resolved"
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &fixed, Note: "Fixed."})
+	s.notifyWG.Wait()
+	mails = mb.all()
+	if len(mails) != 2 || mails[1].subject != "[Acme status] Resolved: API errors" || !strings.Contains(mails[1].body, "Fixed.") ||
+		!strings.Contains(mails[1].body, "http://sandbar.test/status/incidents/"+inc.ID) {
+		t.Fatalf("update mail: %+v", mails)
+	}
+
+	// The unsubscribe link needs a click on the page; a GET alone changes nothing.
+	unsub := linkRe.FindString(mails[1].body[strings.Index(mails[1].body, "Unsubscribe:"):])
+	resp, _ = noRedirect.Get(strings.Replace(unsub, "http://sandbar.test", ts.URL, 1))
+	if resp.StatusCode != 303 || !strings.HasPrefix(resp.Header.Get("Location"), "/status/?unsubscribe=") {
+		t.Fatalf("unsubscribe redirect: %d %s", resp.StatusCode, resp.Header.Get("Location"))
+	}
+	token, _ := url.Parse(unsub)
+	if code, _ := postJSON(t, ts.URL+"/status/unsubscribe", map[string]string{"token": "x.y"}); code != 400 {
+		t.Fatalf("bad token: %d", code)
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/unsubscribe", map[string]string{"token": token.Query().Get("token")}); code != 200 {
+		t.Fatalf("unsubscribe: %d", code)
+	}
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Note: "More detail."})
+	s.notifyWG.Wait()
+	if n := len(mb.all()); n != 2 {
+		t.Fatalf("an unsubscribed address got mail: %d", n)
+	}
+}
+
+func TestEmailSubscriptionsNeedMailAndAreRateLimited(t *testing.T) {
+	s, _, _, ts := statusTestServer(t)
+	s.opts.Mailer = nil // no SMTP configured
+	var d statusDoc
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Subscribe["email"] {
+		t.Fatal("email offered with no SMTP server")
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "a@example.com"}); code != 400 {
+		t.Fatalf("email accepted without SMTP: %d", code)
+	}
+	for i := 0; i < 10; i++ {
+		postJSON(t, ts.URL+"/status/subscribe", map[string]string{"webhook": "nonsense"})
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"webhook": "nonsense"}); code != 429 {
+		t.Fatalf("no rate limit: %d", code)
+	}
+}
+
+func TestWebhookSubscription(t *testing.T) {
+	s, _, _, ts := statusTestServer(t)
+	u := mustUser(t, s, "Alice")
+	var mu sync.Mutex
+	var got []map[string]any
+	status := 200
+	hook := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var m map[string]any
+		json.NewDecoder(r.Body).Decode(&m)
+		mu.Lock()
+		got = append(got, m)
+		w.WriteHeader(status)
+		mu.Unlock()
+	}))
+	defer hook.Close()
+	s.opts.HTTPClient = hook.Client() // tests stand in for the guarded client, which refuses loopback
+
+	status = 500
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"webhook": hook.URL}); code != 400 {
+		t.Fatalf("a webhook that fails its test was accepted: %d", code)
+	}
+	status = 200
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"webhook": hook.URL}); code != 200 {
+		t.Fatalf("subscribe: %d", code)
+	}
+	yes := true
+	inc, _ := s.DeclareIncident("DNS trouble", "sev1", "Lookups fail.", u.ID, u.Name, nil)
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes})
+	s.notifyWG.Wait()
+
+	mu.Lock()
+	defer mu.Unlock()
+	last := got[len(got)-1]
+	if last["event"] != "incident.created" || last["title"] != "DNS trouble" || last["status"] != "investigating" || last["message"] != "Lookups fail." ||
+		!strings.Contains(last["url"].(string), "/status/incidents/"+inc.ID) || !strings.Contains(last["unsubscribe"].(string), "/status/unsubscribe?token=") {
+		t.Fatalf("webhook payload: %v", last)
+	}
+	if got[len(got)-2]["event"] != "subscription.created" {
+		t.Fatalf("first request should be the test: %v", got)
+	}
+}
+
+func TestMaintenanceLifecycleNotifiesSubscribers(t *testing.T) {
+	s, clk, mb, _ := statusTestServer(t)
+	s.addSubscriber("email", "bob@example.com", true)
+	start := clk.Now().Add(2 * time.Hour)
+	m := Maintenance{ID: "m1", Title: "Network upgrade", Message: "Brief packet loss.", Start: start.Unix(), End: start.Add(time.Hour).Unix(), Created: clk.Now().Unix()}
+	s.st.put("maintenance", m.ID, m)
+	s.announceMaintenance("maintenance.scheduled", m)
+	s.notifyWG.Wait()
+
+	s.runMaintenance(clk.Now()) // before the window: nothing
+	clk.Advance(2*time.Hour + time.Minute)
+	s.runMaintenance(clk.Now())
+	s.runMaintenance(clk.Now()) // a second pass must not repeat itself
+	clk.Advance(time.Hour)
+	s.runMaintenance(clk.Now())
+	s.notifyWG.Wait()
+
+	var subjects []string
+	for _, ml := range mb.all() {
+		subjects = append(subjects, ml.subject)
+	}
+	want := []string{"[Status] Scheduled maintenance: Network upgrade", "[Status] Maintenance started: Network upgrade", "[Status] Maintenance complete: Network upgrade"}
+	if strings.Join(subjects, "|") != strings.Join(want, "|") {
+		t.Fatalf("mails %q, want %q", subjects, want)
+	}
+	if body := mb.all()[0].body; !strings.Contains(body, "Brief packet loss.") || !strings.Contains(body, "Jan 5, 2026, 11:00 to 12:00 UTC") {
+		t.Fatalf("scheduled mail: %s", body)
+	}
+
+	// A window that passes while Sandbar is stopped is not announced after the fact.
+	s.st.put("maintenance", "m2", &Maintenance{ID: "m2", Title: "Missed", Start: clk.Now().Add(-3 * time.Hour).Unix(), End: clk.Now().Add(-2 * time.Hour).Unix()})
+	before := len(mb.all())
+	s.runMaintenance(clk.Now())
+	s.notifyWG.Wait()
+	if len(mb.all()) != before {
+		t.Fatal("a missed window was announced")
+	}
+}
+
+func TestMaintenanceAdminAPI(t *testing.T) {
+	s, clk, _, ts := statusTestServer(t)
+	c := newAPIClient(t, ts)
+	c.setup()
+	_ = s
+	now := clk.Now()
+	body := map[string]any{"title": "Upgrade", "message": "m", "start": now.Add(time.Hour).Unix(), "end": now.Add(2 * time.Hour).Unix(), "components": []string{"a", "a", " "}}
+	var created maintView
+	if code := c.do("POST", "/api/v1/maintenance", body, &created); code != 200 || created.State != "scheduled" || len(created.Components) != 1 {
+		t.Fatalf("create: %d %+v", code, created)
+	}
+	if code := c.do("POST", "/api/v1/maintenance", map[string]any{"title": "x", "start": now.Unix() + 10, "end": now.Unix() + 5}, nil); code != 400 {
+		t.Fatalf("end before start: %d", code)
+	}
+	if code := c.do("POST", "/api/v1/maintenance", map[string]any{"title": "x", "start": now.Unix() - 100, "end": now.Unix() - 50}, nil); code != 400 {
+		t.Fatalf("window already over: %d", code)
+	}
+	body["title"] = "Upgrade, moved"
+	if code := c.do("PUT", "/api/v1/maintenance/"+created.ID, body, &created); code != 200 || created.Title != "Upgrade, moved" {
+		t.Fatalf("update: %d %+v", code, created)
+	}
+	if code := c.do("POST", "/api/v1/maintenance/"+created.ID+"/cancel", nil, &created); code != 200 || created.State != "canceled" {
+		t.Fatalf("cancel: %d %+v", code, created)
+	}
+	if code := c.do("POST", "/api/v1/maintenance/"+created.ID+"/cancel", nil, nil); code != 400 {
+		t.Fatalf("second cancel: %d", code)
+	}
+	var d statusDoc
+	getJSON(t, ts.URL+"/status.json", &d)
+	if len(d.Maintenance) != 0 {
+		t.Fatalf("a canceled window is still listed: %+v", d.Maintenance)
+	}
+	if code := newAPIClient(t, ts).do("POST", "/api/v1/maintenance", body, nil); code != 401 {
+		t.Fatalf("anonymous create: %d", code)
+	}
+}
+
+func TestStatusSettingsAPIAndBranding(t *testing.T) {
+	_, _, _, ts := statusTestServer(t)
+	c := newAPIClient(t, ts)
+	c.setup()
+	if code := c.do("PUT", "/api/v1/statuspage", StatusSettings{Title: "Acme", Accent: "#ffee00"}, nil); code != 400 {
+		t.Fatalf("low contrast accent: %d", code)
+	}
+	if code := c.do("PUT", "/api/v1/statuspage", StatusSettings{Title: "Acme <Status>", Description: "Live status", Accent: "#0b5394", LogoURL: "https://acme.test/logo.svg", Domain: "status.acme.test"}, nil); code != 200 {
+		t.Fatalf("save: %d", code)
+	}
+	var d statusDoc
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Settings.Title != "Acme <Status>" || d.Settings.Accent != "#0b5394" || d.Settings.Domain != "" {
+		t.Fatalf("public settings: %+v", d.Settings)
+	}
+	resp, _ := http.Get(ts.URL + "/status")
+	page, _ := io.ReadAll(resp.Body)
+	if !strings.Contains(string(page), "<title>Acme &lt;Status&gt;</title>") || strings.Contains(string(page), "__") {
+		t.Fatalf("page shell: %s", page[:300])
+	}
+	if csp := resp.Header.Get("Content-Security-Policy"); !strings.Contains(csp, "img-src 'self' data: https:") {
+		t.Fatalf("a logo needs img-src https: on the status page: %s", csp)
+	}
+	resp, _ = http.Get(ts.URL + "/")
+	if csp := resp.Header.Get("Content-Security-Policy"); strings.Contains(csp, "https:") {
+		t.Fatalf("the admin app should not allow remote images: %s", csp)
+	}
+}
+
+// The custom domain serves the status page at its root and nothing else.
+func TestCustomDomain(t *testing.T) {
+	s, _, mb, ts := statusTestServer(t)
+	s.saveStatusSettings(StatusSettings{Title: "Acme status", Domain: "status.acme.test"})
+	s.st.put("monitor", "web", &Monitor{ID: "web", Name: "Website", Kind: "http", Target: "http://x", Enabled: true, Public: true})
+	u := mustUser(t, s, "Alice")
+	yes := true
+	inc, _ := s.DeclareIncident("Outage", "sev2", "Down.", u.ID, u.Name, nil)
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes})
+
+	get := func(host, path string) (int, string) {
+		req, _ := http.NewRequest("GET", ts.URL+path, nil)
+		req.Host = host
+		resp, err := (&http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}).Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		b, _ := io.ReadAll(resp.Body)
+		return resp.StatusCode, string(b)
+	}
+	host := "Status.Acme.Test:443"
+	if code, body := get(host, "/"); code != 200 || !strings.Contains(body, "<title>Acme status</title>") || !strings.Contains(body, "const BASE = '';") {
+		t.Fatalf("root on the custom domain: %d %.200s", code, body)
+	}
+	for _, path := range []string{"/history", "/incidents/" + inc.ID} {
+		if code, body := get(host, path); code != 200 || !strings.Contains(body, "<main") {
+			t.Fatalf("%s: %d", path, code)
+		}
+	}
+	if code, body := get(host, "/status.json"); code != 200 || !strings.Contains(body, "Website") {
+		t.Fatalf("status.json: %d", code)
+	}
+	if code, body := get(host, "/feed.rss"); code != 200 || !strings.Contains(body, "<rss") {
+		t.Fatalf("feed: %d", code)
+	}
+	for _, path := range []string{"/api/v1/users", "/healthz", "/metrics", "/alerts/sse", "/script.js", "/statusx"} {
+		if code, _ := get(host, path); code != 404 {
+			t.Fatalf("%s should not exist on the status domain, got %d", path, code)
+		}
+	}
+	// On Sandbar's own address the app is where it was, and the status page stays under /status.
+	if code, body := get("sandbar.test", "/"); code != 200 || !strings.Contains(body, "Sandbar") {
+		t.Fatalf("admin root: %d", code)
+	}
+	if code, body := get("sandbar.test", "/status"); code != 200 || !strings.Contains(body, "const BASE = '/status';") {
+		t.Fatalf("own address: %d", code)
+	}
+
+	// Subscriber links point at the custom domain; the redirect after confirming stays on it.
+	s.opts.URL = "https://sandbar.test"
+	s.addSubscriber("email", "bob@example.com", true)
+	s.notifyWG.Wait()
+	n := len(mb.all())
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Note: "Still working."})
+	s.notifyWG.Wait()
+	mails := mb.all()
+	if len(mails) != n+1 || !strings.Contains(mails[n].body, "https://status.acme.test/incidents/"+inc.ID) || !strings.Contains(mails[n].body, "https://status.acme.test/unsubscribe?token=") {
+		t.Fatalf("links in mail: %+v", mails[n:])
+	}
+	req, _ := http.NewRequest("POST", ts.URL+"/status/subscribe", strings.NewReader(`{"email":"carol@example.com"}`))
+	req.Host = "status.acme.test"
+	http.DefaultClient.Do(req)
+	conf := mb.all()[len(mb.all())-1]
+	if !strings.Contains(conf.body, "https://status.acme.test/confirm?token=") {
+		t.Fatalf("confirm link: %s", conf.body)
+	}
+	req, _ = http.NewRequest("GET", ts.URL+strings.TrimPrefix(linkRe.FindString(conf.body), "https://status.acme.test"), nil)
+	req.Host = "status.acme.test"
+	resp, _ := (&http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}).Do(req)
+	if resp.Header.Get("Location") != "/?notice=confirmed" {
+		t.Fatalf("confirming on the custom domain should stay on it, got %s", resp.Header.Get("Location"))
+	}
+}
+
+func TestFeedIsValidRSS(t *testing.T) {
+	s, clk, _, ts := statusTestServer(t)
+	u := mustUser(t, s, "Alice")
+	s.saveStatusSettings(StatusSettings{Title: "Acme status"})
+	yes := true
+	inc, _ := s.DeclareIncident("Login <broken> & slow", "sev2", "We are looking.", u.ID, u.Name, nil)
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes})
+	clk.Advance(10 * time.Minute)
+	done := "resolved"
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &done, Note: "All good."})
+	hidden, _ := s.DeclareIncident("Private thing", "sev3", "", u.ID, u.Name, nil)
+	_ = hidden
+	s.st.put("maintenance", "m", &Maintenance{ID: "m", Title: "Planned", Start: clk.Now().Add(time.Hour).Unix(), End: clk.Now().Add(2 * time.Hour).Unix(), Created: clk.Now().Unix()})
+
+	resp, err := http.Get(ts.URL + "/status/feed.rss")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "application/rss+xml") {
+		t.Fatalf("content type %s", ct)
+	}
+	var feed struct {
+		Channel struct {
+			Title string `xml:"title"`
+			Link  string `xml:"link"`
+			Items []struct {
+				Title       string `xml:"title"`
+				Link        string `xml:"link"`
+				GUID        string `xml:"guid"`
+				PubDate     string `xml:"pubDate"`
+				Description string `xml:"description"`
+			} `xml:"item"`
+		} `xml:"channel"`
+	}
+	if err := xml.NewDecoder(resp.Body).Decode(&feed); err != nil {
+		t.Fatalf("not XML: %v", err)
+	}
+	c := feed.Channel
+	if c.Title != "Acme status" || c.Link != "http://sandbar.test/status" || len(c.Items) != 3 {
+		t.Fatalf("channel: %+v", c)
+	}
+	var resolved bool
+	for _, it := range c.Items {
+		if strings.Contains(it.Title, "Private") {
+			t.Fatal("private incident in feed")
+		}
+		if it.Title == "Resolved: Login <broken> & slow" && it.Description == "All good." && it.Link == "http://sandbar.test/status/incidents/"+inc.ID {
+			resolved = true
+		}
+		if _, err := time.Parse(time.RFC1123Z, it.PubDate); err != nil {
+			t.Fatalf("pubDate %q: %v", it.PubDate, err)
+		}
+	}
+	if !resolved {
+		t.Fatalf("resolved item missing: %+v", c.Items)
+	}
+}
+
+// Declaring with public set goes live and tells subscribers in one step; existing databases with
+// events from before posts existed still load.
+func TestDeclarePublicAndLegacyEvents(t *testing.T) {
+	s, _, mb, ts := statusTestServer(t)
+	c := newAPIClient(t, ts)
+	c.setup()
+	s.addSubscriber("email", "bob@example.com", true)
+	var inc Incident
+	if code := c.do("POST", "/api/v1/incidents", map[string]any{"title": "Slow", "severity": "sev3", "summary": "Pages are slow.", "public": true, "components": []string{"x"}}, &inc); code != 200 || !inc.Public {
+		t.Fatalf("declare: %d %+v", code, inc)
+	}
+	s.notifyWG.Wait()
+	if m := mb.all(); len(m) != 1 || !strings.Contains(m[0].subject, "New incident: Slow") {
+		t.Fatalf("mails: %+v", m)
+	}
+	// Old rows: an events table without the status column is upgraded in place and keeps its rows.
+	s.st.db.Exec(`DROP TABLE events`)
+	s.st.db.Exec(`CREATE TABLE events (id INTEGER PRIMARY KEY AUTOINCREMENT, scope TEXT NOT NULL, ref TEXT NOT NULL, time INTEGER NOT NULL, kind TEXT NOT NULL, actor TEXT NOT NULL, text TEXT NOT NULL)`)
+	s.st.db.Exec(`INSERT INTO events(scope,ref,time,kind,actor,text) VALUES('incident','x',1,'update','a','t')`)
+	s.st.db.Exec(`ALTER TABLE events ADD COLUMN status TEXT NOT NULL DEFAULT ''`)
+	if ev := s.st.events("incident", "x"); len(ev) != 1 || ev[0].Status != "" {
+		t.Fatalf("events: %+v", ev)
+	}
+}
+
+func TestPruneForgetsStaleUnconfirmedSubscribers(t *testing.T) {
+	s, clk, _, _ := statusTestServer(t)
+	old, _, _ := s.addSubscriber("email", "old@example.com", false)
+	s.addSubscriber("email", "kept@example.com", true)
+	s.st.db.Exec(`UPDATE subscribers SET created=? WHERE id=?`, clk.Now().AddDate(0, 0, -8).Unix(), old.ID)
+	s.st.db.Exec(`UPDATE subscribers SET created=? WHERE kind='email' AND confirmed=1`, clk.Now().AddDate(0, 0, -300).Unix())
+	s.st.prune(clk.Now(), 30, 30, 365)
+	subs := s.confirmedSubscribers()
+	var n int
+	s.st.db.QueryRow(`SELECT COUNT(*) FROM subscribers`).Scan(&n)
+	if n != 1 || len(subs) != 1 || subs[0].Target != "kept@example.com" {
+		t.Fatalf("after prune: %d rows, confirmed %+v", n, subs)
+	}
+	// Addresses are sealed at rest.
+	var raw string
+	s.st.db.QueryRow(`SELECT target FROM subscribers`).Scan(&raw)
+	if strings.Contains(raw, "kept@") {
+		t.Fatalf("address stored in the clear: %s", raw)
+	}
+}

internal/sandbar/statussub.go

@@ -0,0 +1,414 @@
+package sandbar
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"net/mail"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+)
+
+// Following the status page: email (confirmed by a link), webhook (confirmed by answering a test
+// request) and RSS. Every update to a public incident, and every maintenance window, goes to all
+// confirmed subscribers.
+
+// statusNote is one update, as sent to subscribers.
+type statusNote struct {
+	Event   string `json:"event"` // incident.created, incident.updated, incident.resolved, maintenance.scheduled, .rescheduled, .started, .completed, .canceled
+	Title   string `json:"title"`
+	Status  string `json:"status"`
+	Message string `json:"message"`
+	URL     string `json:"url"`
+	Time    int64  `json:"time"`
+}
+
+func (n statusNote) subject(page string) string {
+	label := map[string]string{
+		"incident.created": "New incident", "incident.updated": "Incident update", "incident.resolved": "Resolved",
+		"maintenance.scheduled": "Scheduled maintenance", "maintenance.rescheduled": "Maintenance rescheduled",
+		"maintenance.started": "Maintenance started", "maintenance.completed": "Maintenance complete", "maintenance.canceled": "Maintenance canceled",
+	}[n.Event]
+	return "[" + page + "] " + label + ": " + n.Title
+}
+
+type subscriber struct {
+	ID        string `json:"id"`
+	Kind      string `json:"kind"` // email or webhook
+	Target    string `json:"target"`
+	Confirmed bool   `json:"confirmed"`
+	Created   int64  `json:"created"`
+}
+
+func (s *Server) mailEnabled() bool { return s.opts.Mailer != nil || s.opts.SMTP.Host != "" }
+
+// ---------- links that act for a subscriber ----------
+
+// statusSecret signs confirm and unsubscribe links, so none needs a stored token.
+func (s *Server) statusSecret() []byte {
+	s.statusMu.Lock()
+	defer s.statusMu.Unlock()
+	if s.statusKey == nil {
+		var v struct{ Value string }
+		if s.st.get("secret", "status", &v) != nil || v.Value == "" {
+			v.Value = newToken()
+			s.st.put("secret", "status", v)
+		}
+		s.statusKey = []byte(v.Value)
+	}
+	return s.statusKey
+}
+
+func (s *Server) subToken(purpose, id string) string {
+	m := hmac.New(sha256.New, s.statusSecret())
+	m.Write([]byte(purpose + "." + id))
+	return id + "." + hex.EncodeToString(m.Sum(nil))[:32]
+}
+
+func (s *Server) parseSubToken(purpose, tok string) (string, bool) {
+	id, _, ok := strings.Cut(tok, ".")
+	return id, ok && hmac.Equal([]byte(tok), []byte(s.subToken(purpose, id)))
+}
+
+// ---------- storage ----------
+
+func subKey(kind, target string) string { return hashToken(kind + ":" + strings.ToLower(target)) }
+
+// addSubscriber stores a subscriber, or returns the one already stored for that address.
+func (s *Server) addSubscriber(kind, target string, confirmed bool) (sub subscriber, existed bool, err error) {
+	var n int
+	s.st.db.QueryRow(`SELECT COUNT(*) FROM subscribers`).Scan(&n)
+	key := subKey(kind, target)
+	if got, ok := s.subscriberBy(`key=?`, key); ok {
+		return got, true, nil
+	}
+	if n >= 20000 {
+		return sub, false, errors.New("this status page cannot take more subscribers")
+	}
+	sub = subscriber{ID: newID(), Kind: kind, Target: target, Confirmed: confirmed, Created: s.now().Unix()}
+	_, err = s.st.db.Exec(`INSERT INTO subscribers(id,kind,target,key,confirmed,created) VALUES(?,?,?,?,?,?)`,
+		sub.ID, kind, s.st.seal(target), key, boolInt(confirmed), sub.Created)
+	return sub, false, err
+}
+
+func boolInt(b bool) int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+func (s *Server) subscriberBy(where string, args ...any) (subscriber, bool) {
+	var sub subscriber
+	var sealed string
+	var conf int
+	err := s.st.db.QueryRow(`SELECT id,kind,target,confirmed,created FROM subscribers WHERE `+where, args...).Scan(&sub.ID, &sub.Kind, &sealed, &conf, &sub.Created)
+	if errors.Is(err, sql.ErrNoRows) || err != nil {
+		return sub, false
+	}
+	sub.Target, sub.Confirmed = s.st.open(sealed), conf == 1
+	return sub, true
+}
+
+func (s *Server) confirmedSubscribers() []subscriber {
+	rows, err := s.st.db.Query(`SELECT id,kind,target,created FROM subscribers WHERE confirmed=1`)
+	if err != nil {
+		return nil
+	}
+	defer rows.Close()
+	var out []subscriber
+	for rows.Next() {
+		var sub subscriber
+		var sealed string
+		if rows.Scan(&sub.ID, &sub.Kind, &sealed, &sub.Created) == nil {
+			sub.Target, sub.Confirmed = s.st.open(sealed), true
+			out = append(out, sub)
+		}
+	}
+	return out
+}
+
+// listSubscribers is for administrators. A webhook address often carries a secret, so only its host is shown.
+func (s *Server) listSubscribers(w http.ResponseWriter, r *http.Request) {
+	out := []subscriber{}
+	rows, err := s.st.db.Query(`SELECT id,kind,target,confirmed,created FROM subscribers ORDER BY created DESC LIMIT 1000`)
+	if err != nil {
+		fail(w, err)
+		return
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var sub subscriber
+		var sealed string
+		var conf int
+		if rows.Scan(&sub.ID, &sub.Kind, &sealed, &conf, &sub.Created) != nil {
+			continue
+		}
+		sub.Target, sub.Confirmed = s.st.open(sealed), conf == 1
+		if sub.Kind == "webhook" {
+			if u, err := url.Parse(sub.Target); err == nil {
+				sub.Target = u.Host
+			}
+		}
+		out = append(out, sub)
+	}
+	writeJSON(w, 200, out)
+}
+
+// ---------- sending ----------
+
+func (s *Server) notifySubscribers(n statusNote) {
+	subs := s.confirmedSubscribers()
+	if len(subs) == 0 {
+		return
+	}
+	title := s.statusSettings().Title
+	s.notifyWG.Add(1)
+	go func() {
+		defer s.notifyWG.Done()
+		for _, sub := range subs {
+			if err := s.deliver(sub, n, title); err != nil {
+				log.Printf("status page subscriber %s: %v", sub.ID, err)
+			}
+		}
+	}()
+}
+
+func (s *Server) deliver(sub subscriber, n statusNote, pageTitle string) error {
+	unsub := s.absStatusURL(nil, "/unsubscribe?token="+url.QueryEscape(s.subToken("unsubscribe", sub.ID)))
+	switch sub.Kind {
+	case "email":
+		body := n.Message + "\n\n" + n.URL + "\n\nYou get this because you subscribed to updates from " + pageTitle + ". Unsubscribe: " + unsub
+		return s.Mail(sub.Target, n.subject(pageTitle), body)
+	case "webhook":
+		return s.postWebhook(sub.Target, map[string]any{"page": pageTitle, "event": n.Event, "title": n.Title, "status": n.Status, "message": n.Message,
+			"url": n.URL, "time": n.Time, "unsubscribe": unsub})
+	}
+	return errors.New("unknown subscriber kind")
+}
+
+func (s *Server) postWebhook(target string, payload any) error {
+	b, _ := json.Marshal(payload)
+	req, err := http.NewRequest("POST", target, bytes.NewReader(b))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", "Sandbar status page")
+	resp, err := s.httpClient(false).Do(req) // visitors choose these addresses, so private networks stay out of reach
+	if err != nil {
+		return err
+	}
+	resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("the webhook answered %s", resp.Status)
+	}
+	return nil
+}
+
+// ---------- public endpoints ----------
+
+// subscribeAllowed lets each address make a handful of requests an hour.
+func (s *Server) subscribeAllowed(ip string) bool {
+	s.subMu.Lock()
+	defer s.subMu.Unlock()
+	now := s.now()
+	keep := s.subTry[ip][:0]
+	for _, t := range s.subTry[ip] {
+		if now.Sub(t) < time.Hour {
+			keep = append(keep, t)
+		}
+	}
+	if len(keep) >= 6 {
+		s.subTry[ip] = keep
+		return false
+	}
+	if len(s.subTry) > 5000 { // forget addresses that have gone quiet
+		for k, v := range s.subTry {
+			if len(v) == 0 || now.Sub(v[len(v)-1]) >= time.Hour {
+				delete(s.subTry, k)
+			}
+		}
+	}
+	s.subTry[ip] = append(keep, now)
+	return true
+}
+
+func (s *Server) followStatusHTTP(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		Email   string `json:"email"`
+		Webhook string `json:"webhook"`
+	}
+	if !decode(r, &in) {
+		bad(w, "invalid request")
+		return
+	}
+	if !s.subscribeAllowed(s.realIP(r)) {
+		writeJSON(w, 429, map[string]string{"error": "Too many attempts. Try again in an hour."})
+		return
+	}
+	title := s.statusSettings().Title
+	switch {
+	case strings.TrimSpace(in.Email) != "":
+		if !s.mailEnabled() {
+			bad(w, "email updates are not set up on this page")
+			return
+		}
+		addr := strings.TrimSpace(in.Email)
+		if a, err := mail.ParseAddress(addr); err != nil || a.Address != addr || len(addr) > 254 || strings.ContainsAny(addr, "\r\n<>") {
+			bad(w, "enter a valid email address")
+			return
+		}
+		sub, existed, err := s.addSubscriber("email", addr, false)
+		if err != nil {
+			bad(w, err.Error())
+			return
+		}
+		// The answer is the same whether or not the address was known, so the form cannot be used to probe it.
+		if !(existed && sub.Confirmed) {
+			link := s.absStatusURL(r, "/confirm?token="+url.QueryEscape(s.subToken("confirm", sub.ID)))
+			body := "Confirm that you want email updates from " + title + " by opening this link:\n\n" + link + "\n\nIf you did not ask for this, ignore this email and nothing will be sent."
+			if err := s.Mail(addr, "["+title+"] Confirm your subscription", body); err != nil {
+				log.Printf("status page confirmation to %s: %v", addr, err)
+				writeJSON(w, 502, map[string]string{"error": "The confirmation email could not be sent. Try again later."})
+				return
+			}
+		}
+		writeJSON(w, 200, map[string]string{"message": "Check your email and open the link to finish subscribing."})
+	case strings.TrimSpace(in.Webhook) != "":
+		target := strings.TrimSpace(in.Webhook)
+		if u, err := url.Parse(target); err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" || len(target) > 500 {
+			bad(w, "the webhook must be an http:// or https:// address")
+			return
+		}
+		sub, existed, err := s.addSubscriber("webhook", target, false)
+		if err != nil {
+			bad(w, err.Error())
+			return
+		}
+		if existed && sub.Confirmed {
+			writeJSON(w, 200, map[string]string{"message": "That webhook is subscribed."})
+			return
+		}
+		// Answering a test request shows the address belongs to something that wants these updates.
+		unsub := s.absStatusURL(r, "/unsubscribe?token="+url.QueryEscape(s.subToken("unsubscribe", sub.ID)))
+		if err := s.postWebhook(target, map[string]any{"page": title, "event": "subscription.created", "message": "This address is now subscribed to " + title + ".", "time": s.now().Unix(), "unsubscribe": unsub}); err != nil {
+			s.st.db.Exec(`DELETE FROM subscribers WHERE id=?`, sub.ID)
+			bad(w, "that address did not accept a test request, so it was not subscribed; check the URL and try again")
+			return
+		}
+		s.st.db.Exec(`UPDATE subscribers SET confirmed=1 WHERE id=?`, sub.ID)
+		writeJSON(w, 200, map[string]string{"message": "Subscribed. A test request was sent to the webhook."})
+	default:
+		bad(w, "enter an email address or a webhook address")
+	}
+}
+
+func (s *Server) confirmSubscription(w http.ResponseWriter, r *http.Request) {
+	notice := "invalid"
+	if id, ok := s.parseSubToken("confirm", r.URL.Query().Get("token")); ok {
+		if res, err := s.st.db.Exec(`UPDATE subscribers SET confirmed=1 WHERE id=?`, id); err == nil {
+			if n, _ := res.RowsAffected(); n > 0 {
+				notice = "confirmed"
+			}
+		}
+	}
+	http.Redirect(w, r, pagePrefix(r)+"/?notice="+notice, http.StatusSeeOther)
+}
+
+// unsubscribeRedirect opens the page with a button instead of acting on a GET, since mail
+// scanners follow every link in a message.
+func (s *Server) unsubscribeRedirect(w http.ResponseWriter, r *http.Request) {
+	http.Redirect(w, r, pagePrefix(r)+"/?unsubscribe="+url.QueryEscape(r.URL.Query().Get("token")), http.StatusSeeOther)
+}
+
+func (s *Server) unsubscribeHTTP(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		Token string `json:"token"`
+	}
+	decode(r, &in)
+	id, ok := s.parseSubToken("unsubscribe", in.Token)
+	if !ok {
+		bad(w, "that unsubscribe link is not valid")
+		return
+	}
+	s.st.db.Exec(`DELETE FROM subscribers WHERE id=?`, id)
+	writeJSON(w, 200, map[string]string{"message": "You are unsubscribed."})
+}
+
+// ---------- RSS ----------
+
+type rssItem struct {
+	Title   string `xml:"title"`
+	Link    string `xml:"link"`
+	GUID    string `xml:"guid"`
+	PubDate string `xml:"pubDate"`
+	Desc    string `xml:"description"`
+	t       int64
+}
+
+func (s *Server) statusFeed(w http.ResponseWriter, r *http.Request) {
+	now := s.now()
+	cfg := s.statusSettings()
+	_, _, names := s.publicComponents()
+	var items []rssItem
+	add := func(id string, t int64, title, link, text string) {
+		items = append(items, rssItem{Title: title, Link: link, GUID: id, PubDate: time.Unix(t, 0).UTC().Format(time.RFC1123Z), Desc: text, t: t})
+	}
+	incs, _ := listOf[Incident](s.st, "incident")
+	for _, in := range incs {
+		if !in.Public {
+			continue
+		}
+		pi := s.publicIncident(in, names)
+		for _, u := range pi.Updates {
+			add(fmt.Sprintf("%s-%d", in.ID, u.Time), u.Time, statusLabel(u.Status)+": "+in.Title, s.absStatusURL(r, "/incidents/"+in.ID), u.Text)
+		}
+	}
+	for _, m := range s.loadMaintenance() {
+		if m.Canceled {
+			continue
+		}
+		add("maintenance-"+m.ID, m.Created, "Scheduled maintenance: "+m.Title, s.absStatusURL(r, ""), strings.TrimSpace(fmtWindow(m.Start, m.End)+". "+m.Message))
+	}
+	sort.SliceStable(items, func(i, j int) bool { return items[i].t > items[j].t })
+	if len(items) > 50 {
+		items = items[:50]
+	}
+	type channel struct {
+		Title         string    `xml:"title"`
+		Link          string    `xml:"link"`
+		Description   string    `xml:"description"`
+		LastBuildDate string    `xml:"lastBuildDate"`
+		Items         []rssItem `xml:"item"`
+	}
+	feed := struct {
+		XMLName xml.Name `xml:"rss"`
+		Version string   `xml:"version,attr"`
+		Channel channel  `xml:"channel"`
+	}{Version: "2.0", Channel: channel{Title: cfg.Title, Link: s.absStatusURL(r, ""), Description: firstNonEmpty(cfg.Description, "Incidents and maintenance for "+cfg.Title),
+		LastBuildDate: now.UTC().Format(time.RFC1123Z), Items: items}}
+	w.Header().Set("Content-Type", "application/rss+xml; charset=utf-8")
+	w.Header().Set("Cache-Control", "max-age=60")
+	w.Write([]byte(xml.Header))
+	enc := xml.NewEncoder(w)
+	enc.Indent("", " ")
+	enc.Encode(feed)
+}
+
+func statusLabel(status string) string {
+	if l := map[string]string{"investigating": "Investigating", "identified": "Identified", "monitoring": "Monitoring", "resolved": "Resolved"}[status]; l != "" {
+		return l
+	}
+	return "Update"
+}

internal/sandbar/store.go

@@ -69,6 +69,10 @@ CREATE TABLE IF NOT EXISTS events (
 	id INTEGER PRIMARY KEY AUTOINCREMENT, scope TEXT NOT NULL, ref TEXT NOT NULL, time INTEGER NOT NULL,
 	kind TEXT NOT NULL, actor TEXT NOT NULL, text TEXT NOT NULL);
 CREATE INDEX IF NOT EXISTS events_ref ON events(scope, ref, time);
+-- People who follow the public status page by email or webhook. The address is sealed; key is a hash of it, for lookups.
+CREATE TABLE IF NOT EXISTS subscribers (
+	id TEXT PRIMARY KEY, kind TEXT NOT NULL, target TEXT NOT NULL, key TEXT NOT NULL UNIQUE,
+	confirmed INTEGER NOT NULL, created INTEGER NOT NULL);
 `
 
 // OpenStore opens (creating if needed) the database in dir.
@@ -87,6 +91,8 @@ func OpenStore(dir string, box *secretbox.Box) (*Store, error) {
 		db.Close()
 		return nil, err
 	}
+	// Older databases have no status column on events: public incident posts carry the status they announce.
+	db.Exec(`ALTER TABLE events ADD COLUMN status TEXT NOT NULL DEFAULT ''`)
 	st := &Store{db: db, box: box}
 	st.backfillDaily()
 	return st, nil
@@ -233,24 +239,31 @@ type Event struct {
 	Kind  string `json:"kind"`
 	Actor string `json:"actor"`
 	Text  string `json:"text"`
+	// Status is set on posts only: the incident status the post announces.
+	Status string `json:"status,omitempty"`
 }
 
 func (s *Store) events(scope, ref string) []Event {
 	out := []Event{}
-	rows, err := s.db.Query(`SELECT time,kind,actor,text FROM events WHERE scope=? AND ref=? ORDER BY time, id`, scope, ref)
+	rows, err := s.db.Query(`SELECT time,kind,actor,text,status FROM events WHERE scope=? AND ref=? ORDER BY time, id`, scope, ref)
 	if err != nil {
 		return out
 	}
 	defer rows.Close()
 	for rows.Next() {
 		var e Event
-		if rows.Scan(&e.Time, &e.Kind, &e.Actor, &e.Text) == nil {
+		if rows.Scan(&e.Time, &e.Kind, &e.Actor, &e.Text, &e.Status) == nil {
 			out = append(out, e)
 		}
 	}
 	return out
 }
 
+// addPost records a public incident update: the text and status the status page shows.
+func (s *Store) addPost(incidentID, status, text string, at time.Time) {
+	s.db.Exec(`INSERT INTO events(scope,ref,time,kind,actor,text,status) VALUES('incident',?,?,'post','',?,?)`, incidentID, at.Unix(), text, status)
+}
+
 // prune deletes data past its retention.
 func (s *Store) prune(now time.Time, messageDays, checkDays, hitDays int) {
 	s.db.Exec(`DELETE FROM hits WHERE time < ?`, now.AddDate(0, 0, -hitDays).Unix())
@@ -258,5 +271,6 @@ func (s *Store) prune(now time.Time, messageDays, checkDays, hitDays int) {
 	s.db.Exec(`DELETE FROM checks WHERE time < ?`, now.AddDate(0, 0, -checkDays).Unix())
 	s.db.Exec(`DELETE FROM daily WHERE day < ?`, now.UTC().AddDate(0, 0, -400).Format("2006-01-02"))
 	s.db.Exec(`DELETE FROM sessions WHERE expires < ?`, now.Unix())
+	s.db.Exec(`DELETE FROM subscribers WHERE confirmed=0 AND created < ?`, now.AddDate(0, 0, -7).Unix())
 	s.db.Exec(`DELETE FROM alerts WHERE status='resolved' AND resolved_at < ? AND incident_id=''`, now.AddDate(0, 0, -90).Unix())
 }

internal/sandbar/web/index.html

@@ -445,14 +445,15 @@ const PAGES = {
   monitors:  ['Monitors', 'Checks that tell you when a website, port, certificate or scheduled job stops working.'],
   websites:  ['Websites', 'Count visitors and page views on your sites, without cookies or personal data.'],
   topics:    ['Topics', 'Publish and subscribe to messages with plain HTTP requests. Phones can use the ntfy app.'],
-  channels:  ['Channels', 'Email addresses and webhooks that receive every alert and incident update.'],
+  statuspage:['Status page', 'What customers see: components, incidents, scheduled maintenance, and who follows along.'],
+  channels:  ['Channels','Email addresses and webhooks that receive every alert and incident update.'],
   users:     ['People', 'Everyone who can sign in, and how to reach them.'],
   account:   ['Account', 'Your password, API keys and personal topic.'],
 };
 const NAV = [
   ['Respond', [['alerts', 'Alerts', 'alerts'], ['incidents', 'Incidents', 'incidents'], ['oncall', 'On-call', 'oncall']]],
   ['Observe', [['monitors', 'Monitors', 'monitors'], ['websites', 'Websites', 'websites'], ['topics', 'Topics', 'topics']]],
-  ['Set up', [['channels', 'Channels', 'channels'], ['users', 'People', 'users']]],
+  ['Set up', [['statuspage', 'Status page', 'status'], ['channels', 'Channels', 'channels'], ['users', 'People', 'users']]],
 ];
 function route() {
   const [tab, arg] = (location.hash.replace(/^#\/?/, '') || 'alerts').split('/');
@@ -468,7 +469,7 @@ async function render() {
     side.push(h('div', {class:'navsec'}, sec));
     for (const [k, l, i] of items) side.push(nav(k, l, i));
   }
-  side.push(h('div', {class:'navsec'}, 'Public'), h('a', {class:'navitem', href:'/status', target:'_blank', rel:'noopener'}, icon('status'), 'Status page'));
+  side.push(h('div', {class:'navsec'}, 'Public'), h('a', {class:'navitem', href:'/status', target:'_blank', rel:'noopener'}, icon('status'), 'View status page'));
   side.push(h('div', {class:'grow'}), h('div', {class:'userbox'}, h('div', {class:'who'}, S.me.email), nav('account', 'Account', 'account'),
     h('button', {class:'navitem', onclick:toggleTheme}, icon('dark'), 'Switch theme'),
     h('button', {class:'navitem', onclick: act(async () => { await api('POST', V1 + '/logout'); S.me = null; boot(); })}, icon('out'), 'Sign out')));
@@ -566,7 +567,8 @@ function raiseAlertDialog() {
 const KINDS = [['http', 'Website (HTTP)'], ['tcp', 'Port (TCP)'], ['dns', 'DNS lookup'], ['tls', 'Certificate expiry'], ['heartbeat', 'Heartbeat (cron job or service pings us)']];
 views.monitors = async () => {
   S.headerAction = ['Add monitor', () => monitorDialog()];
-  const [mons, states] = await Promise.all([api('GET', V1 + '/monitors'), api('GET', V1 + '/monitor-states')]);
+  const [mons, states, groups] = await Promise.all([api('GET', V1 + '/monitors'), api('GET', V1 + '/monitor-states'), api('GET', V1 + '/status-groups')]);
+  S.sgroups = groups;
   if (!mons.length) return emptyState('monitors', 'No monitors yet', 'Add a check for a website, a port, a certificate or a scheduled job. Failures raise an alert.', h('button', {class:'btn', onclick:() => monitorDialog()}, 'Add monitor'));
   const statusBadge = (m, st) => !m.enabled ? badge('Paused') : st.status === 'up' ? badge('Up', 'success') : st.status === 'down' ? badge('Down', 'danger') : badge('Waiting for first check');
   return table(['Name', 'Check', 'Status', 'Last check', 'Uptime', ''], mons.map(m => { const st = states[m.id] || {};
@@ -589,6 +591,7 @@ function monitorDialog(m) {
     warn: h('input', {type:'number', min:1, value:m.warnDays || 14}), grace: h('input', {type:'number', min:0, value:m.graceS || 0}),
     pol: select([['', 'None, only broadcast'], ...S.policies.map(p => [p.id, p.name])], m.policyId || ''),
     sev: select([['critical', 'Critical'], ['warning', 'Warning'], ['info', 'Info']], m.severity || 'critical'),
+    group: select([['', 'No group'], ...(S.sgroups || []).map(g => [g.id, g.name])], m.group || ''), pubname: h('input', {value:m.publicName || ''}),
     pub: chk('Show on the public status page', m.public), priv: chk('Allow targets on private networks', m.allowPrivate), on: chk('Run this check', m.enabled) };
   const only = (kinds, el) => { const w = h('div', {class:'stack'}, el); w.kinds = kinds; return w; };
   const groups = [
@@ -606,11 +609,12 @@ function monitorDialog(m) {
   groups.push(hbOnly); sync();
   dialogForm(e ? 'Edit ' + m.name : 'Add a monitor', null, [field('Name', f.name), field('Type', f.kind), ...groups,
     h('div', {class:'grid'}, field('Check every (seconds)', f.interval, 'At least 10.'), field('Timeout (seconds)', f.timeout), field('Failures before down', f.retries, 'A blip is ignored.')),
-    h('div', {class:'grid'}, field('Alert severity', f.sev), field('Escalation policy', f.pol)), f.pub, f.on], e ? 'Save changes' : 'Add monitor',
+    h('div', {class:'grid'}, field('Alert severity', f.sev), field('Escalation policy', f.pol)), f.pub,
+    h('div', {class:'grid'}, field('Status page group', f.group, 'Groups are managed under Status page.'), field('Name on the status page', f.pubname, 'Leave empty to use the monitor name.')), f.on], e ? 'Save changes' : 'Add monitor',
   async () => {
     const body = {...m, name:f.name.value, kind:f.kind.value, target:f.target.value, intervalS:+f.interval.value, timeoutS:+f.timeout.value, retries:+f.retries.value,
       expect:f.expect.value, keyword:f.keyword.value, warnDays:+f.warn.value, graceS:+f.grace.value, policyId:f.pol.value, severity:f.sev.value,
-      public:f.pub.box.checked, allowPrivate:f.priv.box.checked, enabled:f.on.box.checked};
+      public:f.pub.box.checked, group:f.group.value, publicName:f.pubname.value.trim(), allowPrivate:f.priv.box.checked, enabled:f.on.box.checked};
     const saved = await api(e ? 'PUT' : 'POST', V1 + '/monitors' + (e ? '/' + m.id : ''), body);
     toast(e ? 'Monitor saved.' : 'Monitor added.'); refresh();
     if (!e && saved.kind === 'heartbeat') { const done = modal('Heartbeat address', h('div', {class:'stack'}, h('p', {class:'dim', style:'margin:0'}, 'Have your job request this address each time it runs. It goes down when the requests stop.'), cmdBox(`${origin()}/api/v1/hb/${saved.token}`), h('div', {class:'actions form-actions'}, h('button', {class:'btn', onclick:() => done()}, 'Done')))); }
@@ -687,10 +691,22 @@ views.incidents = async () => {
     h('td', {}, h('a', {href:'#incidents/' + i.id}, i.title), i.public ? h('div', {}, badge('On status page', 'accent')) : null),
     h('td', {}, incStatus(i.status)), h('td', {}, userName(i.lead) || 'Nobody'), h('td', {class:'num'}, fmtTime(i.created)))));
 };
-function declareDialog(alertIds, title) {
-  const f = { title: h('input', {value:title || ''}), sev: select(SEVS, 'sev2'), sum: h('textarea'), lead: select(userOpts('Me'), '') };
-  dialogForm('Declare an incident', 'Everyone subscribed to the incidents topic and every channel is told.', [field('Title', f.title, 'What is wrong, in a few words.'), field('Severity', f.sev), field('What we know so far', f.sum), field('Incident lead', f.lead)], 'Declare incident',
-    async () => { const i = await api('POST', V1 + '/incidents', {title:f.title.value, severity:f.sev.value, summary:f.sum.value, lead:f.lead.value, alertIds:alertIds || []}); toast('Incident declared.'); location.hash = 'incidents/' + i.id; });
+// monitors that are on the status page, which are the components an incident can affect
+const publicMonitors = async () => (await api('GET', V1 + '/monitors')).filter(m => m.public && m.enabled);
+const monName = m => m.publicName || m.name;
+// a list of checkboxes, one per component; values() gives the ids that are ticked
+function componentPicker(mons, selected) {
+  const boxes = mons.map(m => chk(monName(m), (selected || []).includes(m.id)));
+  const box = h('div', {class:'stack'}, boxes.length ? boxes : h('p', {class:'small dim', style:'margin:0'}, 'No monitors are on the status page yet. Tick "Show on the public status page" on a monitor.'));
+  return Object.assign(box, {values: () => mons.filter((m, i) => boxes[i].box.checked).map(m => m.id)});
+}
+async function declareDialog(alertIds, title) {
+  const mons = await publicMonitors(), picker = componentPicker(mons, []);
+  const f = { title: h('input', {value:title || ''}), sev: select(SEVS, 'sev2'), sum: h('textarea'), lead: select(userOpts('Me'), ''), pub: chk('Post it on the status page and tell subscribers', false) };
+  const comps = h('div', {class:'stack'}, field('Affected components', picker, 'Shown on the status page.'));
+  f.pub.box.onchange = () => { comps.style.display = f.pub.box.checked ? '' : 'none'; }; comps.style.display = 'none';
+  dialogForm('Declare an incident', 'Everyone subscribed to the incidents topic and every channel is told.', [field('Title', f.title, 'What is wrong, in a few words.'), field('Severity', f.sev), field('What we know so far', f.sum, 'If you post it on the status page, customers see this text.'), field('Incident lead', f.lead), f.pub, comps], 'Declare incident',
+    async () => { const i = await api('POST', V1 + '/incidents', {title:f.title.value, severity:f.sev.value, summary:f.sum.value, lead:f.lead.value, alertIds:alertIds || [], public:f.pub.box.checked, components:picker.values()}); toast('Incident declared.'); location.hash = 'incidents/' + i.id; });
 }
 async function incidentDetail(id) {
   S.noHeader = true;
@@ -698,13 +714,24 @@ async function incidentDetail(id) {
   const patch = act(async (body, msg) => { await api('PATCH', `${V1}/incidents/${id}`, body); toast(msg || 'Incident updated.'); refresh(); });
   const status = select(STATUSES, i.status, {onchange:e => patch({status:e.target.value})}), sev = select(SEVS, i.severity, {onchange:e => patch({severity:e.target.value})});
   const lead = select(userOpts('Nobody'), i.lead, {onchange:e => patch({lead:e.target.value})}), comms = select(userOpts('Nobody'), i.comms, {onchange:e => patch({comms:e.target.value})});
+  const mons = await publicMonitors(), picker = componentPicker(mons, i.components);
   const pub = chk('Show on the public status page', i.public, v => patch({public:v}));
+  const post = () => {
+    const f = { status: select(STATUSES, i.status), text: h('textarea', {placeholder:'What customers should know'}) };
+    dialogForm('Post an update', 'Customers and subscribers see this text and the status. The timeline and names stay internal.', [field('Status', f.status), field('Update', f.text, 'Leave empty to use the standard wording for the status.')], 'Post update',
+      async () => { await api('PATCH', `${V1}/incidents/${id}`, {status:f.status.value, note:f.text.value}); toast('Update posted.'); refresh(); });
+  };
   const sum = h('textarea', {}, i.summary), pm = h('textarea', {style:'min-height:220px', class:'mono'}, i.postmortem), note = h('input', {placeholder:'Add a comment for the timeline'});
   const say = act(async () => { if (!note.value.trim()) return; await api('POST', `${V1}/incidents/${id}/comments`, {text:note.value}); note.value = ''; refresh(); });
   note.addEventListener('keydown', e => e.key === 'Enter' && say());
   setTimeout(() => { S.noHeader = false; });
   return h('div', {}, h('div', {class:'page-h'}, h('div', {}, h('a', {href:'#incidents', class:'small'}, 'Back to incidents'), h('h1', {}, i.title), h('p', {}, 'Declared ' + fmtTime(i.created) + (i.resolved ? ', resolved ' + fmtTime(i.resolved) : ''))), h('div', {}, incStatus(i.status))),
-    card('Status', h('div', {class:'grid'}, field('Status', status), field('Severity', sev), field('Lead', lead), field('Communications', comms)), pub),
+    card('Status', h('div', {class:'grid'}, field('Status', status), field('Severity', sev), field('Lead', lead), field('Communications', comms))),
+    card('Status page', h('div', {class:'stack'}, pub,
+      i.public ? h('p', {class:'small dim', style:'margin:0'}, 'Changing the status above, or posting an update, adds a post to the public page and emails subscribers.') : h('p', {class:'small dim', style:'margin:0'}, 'Turning this on posts the summary below and tells subscribers.'),
+      field('Affected components', picker, 'The page shows these as affected until the incident is resolved.'),
+      h('div', {class:'actions form-actions'}, h('button', {class:'ghost', onclick:() => patch({components:picker.values()}, 'Components saved.')}, 'Save components'),
+        i.public ? h('button', {class:'btn', onclick:post}, 'Post an update') : null))),
     card('Summary', h('div', {class:'stack'}, sum, h('div', {class:'actions form-actions'}, h('button', {class:'ghost', onclick:() => patch({summary:sum.value}, 'Summary saved.')}, 'Save summary')))),
     card('Timeline', timeline(i.timeline || []), h('div', {class:'actions', style:'margin-top:16px'}, h('div', {style:'flex:1;min-width:200px'}, note), h('button', {class:'ghost', onclick:say}, 'Add comment'))),
     card('Post-mortem', h('div', {class:'stack'}, pm, h('div', {class:'actions form-actions'},
@@ -739,6 +766,85 @@ views.topics = async () => {
     card('From the command line', cmdBox(`curl -H "Authorization: Bearer <api key>" -H "Title: Disk full" -H "Priority: urgent" -d "web-1 is at 98%" ${base}/alerts\ncurl -H "Authorization: Bearer <api key>" -N ${base}/alerts/sse`)));
 };
 
+// ---------- status page ----------
+const MSTATE = {scheduled:['Scheduled', ''], in_progress:['In progress', 'accent'], completed:['Completed', 'success'], canceled:['Canceled', '']};
+views.statuspage = async () => {
+  const which = S.spTab || 'page';
+  const tabs = h('div', {class:'tabs2', role:'group', 'aria-label':'Status page sections'}, [['page', 'Page'], ['groups', 'Groups'], ['maintenance', 'Maintenance'], ['subscribers', 'Subscribers']].map(([k, l]) =>
+    h('button', {class:which === k ? 'on' : '', 'aria-pressed':which === k, onclick:() => { S.spTab = k; refresh(); }}, l)));
+  const admin = isAdmin();
+  if (which === 'groups') {
+    S.headerAction = admin ? ['Add group', () => groupDialog()] : null;
+    const [groups, mons] = await Promise.all([api('GET', V1 + '/status-groups'), api('GET', V1 + '/monitors')]);
+    S.sgroups = groups;
+    if (!groups.length) return h('div', {}, tabs, emptyState('status', 'No groups yet', 'Groups put related components under one heading, such as Website, API and Infrastructure. Components without a group are listed first.', admin ? h('button', {class:'btn', onclick:() => groupDialog()}, 'Add group') : null));
+    return h('div', {}, tabs, table(['Group', 'Components', 'Order', ''], groups.sort((a, b) => a.order - b.order || a.name.localeCompare(b.name)).map(g => {
+      const inside = mons.filter(m => m.public && m.group === g.id);
+      return h('tr', {}, h('td', {}, g.name, g.description ? h('div', {class:'small dim'}, g.description) : null), h('td', {}, inside.length ? inside.map(monName).join(', ') : 'None yet'), h('td', {class:'num'}, g.order),
+        h('td', {}, admin ? h('div', {class:'actions'}, h('button', {class:'ghost', onclick:() => groupDialog(g)}, 'Edit'),
+          h('button', {class:'ghost danger', onclick:ask({title:`Delete ${g.name}?`, body:'Its components move to the top of the page, ungrouped. The monitors are not changed. This cannot be undone.', confirm:'Delete group'}, async () => { await api('DELETE', `${V1}/status-groups/${g.id}`); toast('Group deleted.'); refresh(); })}, 'Delete')) : null));
+    })));
+  }
+  if (which === 'maintenance') {
+    S.headerAction = admin ? ['Schedule maintenance', () => maintenanceDialog()] : null;
+    const [list, mons] = await Promise.all([api('GET', V1 + '/maintenance'), api('GET', V1 + '/monitors')]);
+    const name = id => { const m = mons.find(x => x.id === id); return m ? monName(m) : null; };
+    if (!list.length) return h('div', {}, tabs, emptyState('status', 'No maintenance scheduled', 'Planned work is announced on the status page and sent to subscribers when it is scheduled, when it starts and when it ends. Affected components show as under maintenance meanwhile.', admin ? h('button', {class:'btn', onclick:() => maintenanceDialog()}, 'Schedule maintenance') : null));
+    return h('div', {}, tabs, table(['Maintenance', 'Window', 'Status', ''], list.map(m => { const st = MSTATE[m.state] || [m.state, ''], open = m.state === 'scheduled' || m.state === 'in_progress';
+      return h('tr', {}, h('td', {}, m.title, h('div', {class:'small dim'}, m.components.map(name).filter(Boolean).join(', ') || 'No components named')), h('td', {class:'num'}, fmtTime(m.start) + ' to ' + fmtTime(m.end)), h('td', {}, badge(st[0], st[1])),
+        h('td', {}, admin ? h('div', {class:'actions'}, open ? h('button', {class:'ghost', onclick:() => maintenanceDialog(m)}, 'Edit') : null,
+          open ? h('button', {class:'ghost danger', onclick:ask({title:`Cancel ${m.title}?`, body:'Subscribers are told it is canceled. It stays in the history.', confirm:'Cancel maintenance', cancel:'Keep it'}, async () => { await api('POST', `${V1}/maintenance/${m.id}/cancel`); toast('Maintenance canceled.'); refresh(); })}, 'Cancel') : null,
+          h('button', {class:'ghost danger', onclick:ask({title:`Delete ${m.title}?`, body:'It is removed from the status page and its history. This cannot be undone.', confirm:'Delete maintenance'}, async () => { await api('DELETE', `${V1}/maintenance/${m.id}`); toast('Maintenance deleted.'); refresh(); })}, 'Delete')) : null));
+    })));
+  }
+  if (which === 'subscribers') {
+    S.headerAction = null;
+    if (!admin) return h('div', {}, tabs, emptyState('users', 'Administrators only', 'Ask an administrator to see who follows the status page.'));
+    const list = await api('GET', V1 + '/status-subscribers');
+    if (!list.length) return h('div', {}, tabs, emptyState('users', 'No subscribers yet', 'People subscribe with the button on the public page. Confirmed email addresses and webhooks appear here.'));
+    return h('div', {}, tabs, table(['Type', 'Address', 'Status', 'Subscribed', ''], list.map(s => h('tr', {}, h('td', {}, s.kind === 'email' ? 'Email' : 'Webhook'), h('td', {class:'mono small'}, s.target),
+      h('td', {}, s.confirmed ? badge('Confirmed', 'success') : badge('Waiting for confirmation')), h('td', {class:'num'}, fmtTime(s.created)),
+      h('td', {}, h('div', {class:'actions'}, h('button', {class:'ghost danger', onclick:ask({title:`Remove ${s.target}?`, body:'They stop getting updates. They can subscribe again from the page.', confirm:'Remove subscriber'}, async () => { await api('DELETE', `${V1}/status-subscribers/${s.id}`); toast('Subscriber removed.'); refresh(); })}, 'Remove')))))));
+  }
+  S.headerAction = null;
+  const r = await api('GET', V1 + '/statuspage'), c = r.settings;
+  const f = { title: h('input', {value:c.title}), desc: h('textarea', {}, c.description), logo: h('input', {type:'url', value:c.logoUrl, placeholder:'https://example.com/logo.svg'}),
+    accent: h('input', {value:c.accent, placeholder:'#1f5c5c'}), support: h('input', {value:c.supportUrl, placeholder:'https://example.com/support or mailto:help@example.com'}),
+    footer: h('input', {value:c.footer}), domain: h('input', {value:c.domain, placeholder:'status.example.com'}) };
+  const save = act(async () => {
+    await api('PUT', V1 + '/statuspage', {title:f.title.value, description:f.desc.value, logoUrl:f.logo.value, accent:f.accent.value, supportUrl:f.support.value, footer:f.footer.value, domain:f.domain.value});
+    toast('Status page saved.'); refresh();
+  });
+  if (!admin) [...Object.values(f)].forEach(i => i.disabled = true);
+  return h('div', {}, tabs,
+    card('Address', h('div', {class:'stack'}, h('p', {class:'small dim', style:'margin:0'}, 'Monitors and incidents appear here when you mark them to show on the public status page.'),
+      h('div', {}, h('div', {class:'small dim'}, 'Status page'), h('a', {href:r.pageUrl, target:'_blank', rel:'noopener', class:'mono'}, r.pageUrl)),
+      h('div', {}, h('div', {class:'small dim'}, 'RSS feed'), h('a', {href:r.feedUrl, target:'_blank', rel:'noopener', class:'mono'}, r.feedUrl)),
+      r.email ? null : h('p', {class:'small dim', style:'margin:0'}, 'Email subscriptions are off until an SMTP server is set (SANDBAR_SMTP_HOST). Webhooks and RSS work without it.'))),
+    card('Branding', h('div', {class:'stack'}, field('Title', f.title), field('Description', f.desc, 'Shown under the title.'), h('div', {class:'grid'}, field('Logo address', f.logo, 'An https:// address of an image.'),
+      field('Accent color', f.accent, 'Buttons and links, as #rrggbb. Leave empty for the default. White text must stay readable on it.')),
+      h('div', {class:'grid'}, field('Contact link', f.support, 'Adds a Contact us button.'), field('Footer text', f.footer)))),
+    card('Custom domain', h('div', {class:'stack'}, field('Host name', f.domain, 'Serve the page at the root of this host name, such as status.example.com. Leave empty to use the address above only.'),
+      h('p', {class:'small dim', style:'margin:0'}, 'Point a DNS record for it at the server that runs Sandbar, and have your reverse proxy forward that host name to Sandbar with the Host header unchanged. Sandbar serves only the status page on that host. The proxy provides the certificate.'))),
+    admin ? h('div', {class:'actions form-actions'}, h('button', {class:'btn', onclick:save}, 'Save status page')) : null);
+};
+function groupDialog(g) {
+  const e = !!g; g = g || {order:(S.sgroups || []).length + 1};
+  const f = { name: h('input', {value:g.name || ''}), desc: h('input', {value:g.description || ''}), order: h('input', {type:'number', value:g.order})};
+  dialogForm(e ? 'Edit ' + g.name : 'Add a group', null, [field('Name', f.name), field('Description', f.desc, 'Optional, shown under the name.'), field('Order', f.order, 'Groups are listed from the lowest number to the highest.')], e ? 'Save changes' : 'Add group',
+    async () => { await api(e ? 'PUT' : 'POST', V1 + '/status-groups' + (e ? '/' + g.id : ''), {name:f.name.value, description:f.desc.value, order:+f.order.value || 0}); toast('Group saved.'); refresh(); });
+}
+async function maintenanceDialog(m) {
+  const e = !!m, mons = await publicMonitors(), soon = Math.ceil(Date.now() / 3600000) * 3600 + 3600;
+  m = m || {start:soon, end:soon + 3600, components:[]};
+  const picker = componentPicker(mons, m.components);
+  const f = { title: h('input', {value:m.title || ''}), msg: h('textarea', {}, m.message || ''), start: h('input', {type:'datetime-local', value:fromUnix(m.start)}), end: h('input', {type:'datetime-local', value:fromUnix(m.end)}) };
+  dialogForm(e ? 'Edit ' + m.title : 'Schedule maintenance', 'Subscribers are told now, when it starts and when it ends. Times are in your time zone.',
+    [field('Title', f.title, 'What is happening, in a few words.'), field('Details', f.msg, 'What customers should expect.'), h('div', {class:'grid'}, field('Starts', f.start), field('Ends', f.end)), field('Affected components', picker, 'They show as under maintenance during the window.')],
+    e ? 'Save changes' : 'Schedule maintenance',
+    async () => { await api(e ? 'PUT' : 'POST', V1 + '/maintenance' + (e ? '/' + m.id : ''), {title:f.title.value, message:f.msg.value, start:toUnix(f.start.value), end:toUnix(f.end.value), components:picker.values()}); toast('Maintenance saved.'); refresh(); });
+}
+
 // ---------- channels ----------
 views.channels = async () => {
   S.headerAction = isAdmin() ? ['Add channel', () => channelDialog()] : null;

internal/sandbar/web/status.html

@@ -4,7 +4,8 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="color-scheme" content="light dark">
-<title>Status</title>
+<title>__TITLE__</title>
+<link rel="alternate" type="application/rss+xml" title="__TITLE__" href="__BASE__/feed.rss">
 <style>
   /* tokens:begin  Design tokens, the Lightwell design language (docs/design.md). This is the only place raw colors and sizes are defined. */
   :root {
@@ -33,18 +34,36 @@
   /* tokens:end */
 
   *, *::before, *::after { box-sizing:border-box; }
+  [hidden] { display:none !important; }
   body { margin:0; background:var(--bg); color:var(--text); font:var(--text-base)/var(--leading) var(--font); -webkit-font-smoothing:antialiased; }
-  h1, h2 { margin:0; line-height:1.25; font-weight:600; letter-spacing:-.01em; }
-  h1 { font-size:var(--text-2xl); } h2 { font-size:var(--text-lg); margin:var(--s6) 0 var(--s3); }
-  main { max-width:var(--content-max); margin:0 auto; padding:var(--s6) var(--s4) var(--s8); }
+  h1, h2, h3 { margin:0; line-height:1.25; font-weight:600; letter-spacing:-.01em; }
+  h1 { font-size:var(--text-2xl); } h2 { font-size:var(--text-lg); margin:var(--s6) 0 var(--s3); } h3 { font-size:var(--text-base); }
+  main { max-width:var(--content-max); margin:0 auto; padding:var(--s6) var(--s4) var(--s5); }
+  footer { max-width:var(--content-max); margin:0 auto; padding:0 var(--s4) var(--s8); color:var(--text-muted); font-size:var(--text-sm); }
+  footer .links { display:flex; gap:var(--s4); flex-wrap:wrap; margin-bottom:var(--s2); }
+  a { color:var(--accent-text); }
+  p { margin:0; }
   .dim { color:var(--text-muted); } .small { font-size:var(--text-sm); } .num { font-variant-numeric:tabular-nums; }
+  .head { display:flex; align-items:center; justify-content:space-between; gap:var(--s4); flex-wrap:wrap; }
+  .brand { display:flex; align-items:center; gap:var(--s3); min-width:0; }
+  .brand img { max-height:40px; max-width:160px; object-fit:contain; }
+  .brand a { color:inherit; text-decoration:none; }
+  .actions { display:flex; gap:var(--s2); flex-wrap:wrap; }
+  .btn, .ghost { display:inline-flex; align-items:center; justify-content:center; min-height:36px; padding:var(--s2) var(--s4); border-radius:var(--radius); font:inherit; font-weight:500; text-decoration:none; cursor:pointer; border:var(--border-w) solid transparent; }
+  .btn { background:var(--accent); color:var(--accent-contrast); }
+  .ghost { background:var(--surface); color:var(--text); border-color:var(--border-strong); }
+  .btn:hover { filter:brightness(1.1); } .ghost:hover { background:var(--surface-2); }
+  .desc { margin-top:var(--s2); color:var(--text-muted); }
   .banner { margin-top:var(--s4); padding:var(--s4) var(--s5); border-radius:var(--radius-lg); border:var(--border-w) solid var(--border); font-weight:600; background:var(--surface-2); }
   .banner.operational { background:var(--success-bg); color:var(--success); border-color:var(--success); }
-  .banner.degraded { background:var(--warning-bg); color:var(--warning); border-color:var(--warning); }
+  .banner.degraded, .banner.maintenance { background:var(--warning-bg); color:var(--warning); border-color:var(--warning); }
   .banner.outage { background:var(--danger-bg); color:var(--danger); border-color:var(--danger); }
+  .notice { margin-top:var(--s4); padding:var(--s3) var(--s4); border-radius:var(--radius); border:var(--border-w) solid var(--border-strong); background:var(--surface); display:flex; align-items:center; justify-content:space-between; gap:var(--s3); flex-wrap:wrap; }
   .card { background:var(--surface); border:var(--border-w) solid var(--border); border-radius:var(--radius-lg); overflow:hidden; }
+  .card + .card { margin-top:var(--s3); }
   .row { display:flex; align-items:center; justify-content:space-between; gap:var(--s3); flex-wrap:wrap; padding:var(--s3) var(--s4); border-bottom:var(--border-w) solid var(--border); }
   .row:last-child { border-bottom:0; }
+  .ghead { display:flex; align-items:baseline; justify-content:space-between; gap:var(--s3); flex-wrap:wrap; padding:var(--s3) var(--s4); background:var(--surface-2); border-bottom:var(--border-w) solid var(--border); }
   .svc { padding:var(--s3) var(--s4) var(--s4); border-bottom:var(--border-w) solid var(--border); }
   .svc:last-child { border-bottom:0; }
   .svc .top { display:flex; align-items:center; justify-content:space-between; gap:var(--s3); flex-wrap:wrap; }
@@ -60,29 +79,52 @@
   .badge-success { background:var(--success-bg); color:var(--success); }
   .badge-warning { background:var(--warning-bg); color:var(--warning); }
   .badge-danger { background:var(--danger-bg); color:var(--danger); }
+  .badge-accent { background:var(--accent-soft); color:var(--accent-text); }
   .inc { padding:var(--s4); border-bottom:var(--border-w) solid var(--border); }
   .inc:last-child { border-bottom:0; }
-  .inc ul { margin:var(--s2) 0 0; padding-left:var(--s5); }
+  .inc h3 a { color:inherit; }
+  .posts { list-style:none; margin:var(--s3) 0 0; padding:0 0 0 var(--s4); border-left:2px solid var(--border); display:flex; flex-direction:column; gap:var(--s3); }
+  .posts p { white-space:pre-wrap; }
+  .month { font-size:var(--text-sm); font-weight:600; color:var(--text-muted); margin:var(--s5) 0 var(--s2); }
+  .sub { padding:var(--s4); display:grid; gap:var(--s4); }
+  .sub form { display:flex; gap:var(--s2); flex-wrap:wrap; align-items:flex-end; }
+  .sub label { display:flex; flex-direction:column; gap:var(--s1); flex:1; min-width:200px; font-size:var(--text-sm); font-weight:500; }
+  input { font:inherit; min-height:36px; padding:var(--s2) var(--s3); border-radius:var(--radius); border:var(--border-w) solid var(--border-strong); background:var(--surface); color:var(--text); }
+  .mono { font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; font-size:var(--text-sm); word-break:break-all; }
   :focus-visible { outline:2px solid var(--focus); outline-offset:2px; border-radius:var(--radius); }
+  @media (pointer:coarse) { .btn, .ghost, input { min-height:44px; } input { font-size:16px; } }
+  @media (prefers-reduced-motion:no-preference) { .btn, .ghost { transition:background-color .12s, filter .12s; } }
 </style>
 </head>
 <body>
 <div class="tip" id="tip" role="presentation" hidden></div>
-<main>
-  <h1>Status</h1>
-  <div id="banner" class="banner" role="status">Loading</div>
-  <h2>Services</h2>
-  <div class="card" id="services"></div>
-  <h2>Incidents</h2>
-  <div class="card" id="incidents"></div>
+<main id="main" tabindex="-1">
+  <div class="head">
+    <div class="brand" id="brand"></div>
+    <div class="actions" id="actions"></div>
+  </div>
+  <p class="desc" id="desc" hidden></p>
+  <div id="notice"></div>
+  <div id="view" aria-live="polite"><div class="banner" role="status">Loading</div></div>
 </main>
+<footer id="foot"></footer>
 <script>
+const BASE = '__BASE__';
 const $ = id => document.getElementById(id);
 const el = (tag, cls, text) => { const e = document.createElement(tag); if (cls) e.className = cls; if (text != null) e.textContent = text; return e; };
+const link = (href, text, cls) => { const a = el('a', cls, text); a.href = href; return a; };
+const home = BASE || '/';
 const when = t => new Date(t * 1000).toLocaleString(undefined, {month:'short', day:'numeric', year:'numeric', hour:'numeric', minute:'2-digit'});
-const label = { operational: 'All systems are operational', degraded: 'Some systems are affected', outage: 'There is a service outage' };
-const statusBadge = s => s === 'up' ? el('span', 'badge badge-success', 'Operational') : s === 'down' ? el('span', 'badge badge-danger', 'Down') : el('span', 'badge', 'Waiting for first check');
-const incStatus = { investigating: 'Investigating', identified: 'Identified', monitoring: 'Monitoring', resolved: 'Resolved' };
+const monthOf = t => new Date(t * 1000).toLocaleDateString(undefined, {month:'long', year:'numeric'});
+
+const overallLabel = { operational: 'All systems are operational', degraded: 'Some systems are affected', outage: 'There is a service outage', maintenance: 'Scheduled maintenance is in progress' };
+const stateBadge = {
+  operational: ['Operational', 'success'], degraded: ['Degraded performance', 'warning'], partial_outage: ['Partial outage', 'warning'],
+  major_outage: ['Major outage', 'danger'], maintenance: ['Under maintenance', 'accent'], pending: ['Waiting for first check', ''],
+};
+const badge = (text, tone) => el('span', 'badge' + (tone ? ' badge-' + tone : ''), text);
+const incLabel = { investigating: 'Investigating', identified: 'Identified', monitoring: 'Monitoring', resolved: 'Resolved' };
+const incTone = s => s === 'resolved' ? 'success' : s === 'monitoring' ? 'accent' : 'warning';
 
 // One bar per UTC day, oldest first. A day is green with no failed checks, amber when at least 99% passed,
 // and red below that. Color is never the only signal: the tooltip and the label say it in words.
@@ -101,11 +143,11 @@ function showTip(e, lines) {
   const w = tip.offsetWidth, x = Math.min(Math.max(8, e.clientX - w / 2), innerWidth - w - 8);
   tip.style.left = x + 'px'; tip.style.top = Math.max(8, e.clientY - tip.offsetHeight - 14) + 'px';
 }
-function service(m, today) {
+function component(m, today) {
   const box = el('div', 'svc'), top = el('div', 'top');
   top.append(el('span', '', m.name));
-  const right = el('span', 'small dim num');
-  right.append(statusBadge(m.status), document.createTextNode(m.uptime >= 0 ? ' ' + m.uptime.toFixed(2) + '% uptime' : ''));
+  const right = el('span', 'small dim num'), b = stateBadge[m.state] || stateBadge.pending;
+  right.append(badge(b[0], b[1]), document.createTextNode(m.uptime >= 0 ? ' ' + m.uptime.toFixed(2) + '% uptime' : ''));
   top.append(right); box.append(top);
   const days = m.days || [], bars = el('div', 'bars');
   const bad = days.filter(d => dayClass(d) === 'bad').length, warn = days.filter(d => dayClass(d) === 'warn').length;
@@ -113,12 +155,12 @@ function service(m, today) {
   bars.setAttribute('aria-label', m.name + ', the last ' + days.length + ' days: ' + (m.uptime >= 0 ? m.uptime.toFixed(2) + '% uptime' : 'no checks yet') +
     (bad || warn ? ', ' + bad + ' days with an outage and ' + warn + ' with short failures' : ', no failures'));
   days.forEach((d, i) => {
-    const b = el('span', 'bar ' + dayClass(d));
+    const s = el('span', 'bar ' + dayClass(d));
     const lines = dayText(d, i, days.length, today);
-    b.addEventListener('pointerenter', e => showTip(e, lines));
-    b.addEventListener('pointermove', e => showTip(e, lines));
-    b.addEventListener('pointerleave', () => { tip.hidden = true; });
-    bars.append(b);
+    s.addEventListener('pointerenter', e => showTip(e, lines));
+    s.addEventListener('pointermove', e => showTip(e, lines));
+    s.addEventListener('pointerleave', () => { tip.hidden = true; });
+    bars.append(s);
   });
   const axis = el('div', 'axis'); axis.setAttribute('aria-hidden', 'true');
   axis.append(el('span', '', days.length + ' days ago'), el('span', '', 'Today'));
@@ -126,27 +168,206 @@ function service(m, today) {
   return box;
 }
 
-async function load() {
-  let d;
-  try { d = await (await fetch('/status.json')).json(); } catch (e) { $('banner').textContent = 'The status could not be loaded. Try again in a moment.'; return; }
-  $('banner').className = 'banner ' + d.overall;
-  $('banner').textContent = label[d.overall] || d.overall;
+const worst = ['operational', 'pending', 'maintenance', 'degraded', 'partial_outage', 'major_outage'];
+function groups(d) {
+  const out = [], byId = {};
+  const open = (id, g) => { byId[id] = { g, items: [] }; out.push(byId[id]); };
+  open('', null);
+  for (const g of d.groups) open(g.id, g);
+  for (const m of d.monitors) (byId[m.group] || byId['']).items.push(m);
+  return out.filter(x => x.items.length);
+}
+function services(d) {
+  const wrap = el('div');
+  if (!d.monitors.length) { const c = el('div', 'card'); c.append(el('div', 'row dim', 'No services are published yet.')); wrap.append(c); return wrap; }
+  for (const { g, items } of groups(d)) {
+    const card = el('div', 'card');
+    if (g) {
+      const head = el('div', 'ghead'), left = el('div');
+      left.append(el('h3', '', g.name));
+      if (g.description) left.append(el('div', 'small dim', g.description));
+      const w = items.map(i => i.state).reduce((a, s) => worst.indexOf(s) > worst.indexOf(a) ? s : a, 'operational'), b = stateBadge[w];
+      head.append(left, badge(b[0], b[1])); card.append(head);
+    }
+    for (const m of items) card.append(component(m, d.today));
+    wrap.append(card);
+  }
+  return wrap;
+}
 
-  const sv = $('services'); sv.replaceChildren();
-  if (!d.monitors.length) sv.append(el('div', 'row dim', 'No services are published yet.'));
-  for (const m of d.monitors) sv.append(service(m, d.today));
+function posts(list) {
+  const ul = el('ul', 'posts');
+  for (const u of list) {
+    const li = el('li'), head = el('div', 'small');
+    head.append(el('strong', '', incLabel[u.status] || 'Update'), el('span', 'dim num', ' · ' + when(u.time)));
+    li.append(head, el('p', '', u.text)); ul.append(li);
+  }
+  return ul;
+}
+function incident(i, full) {
+  const b = el('div', 'inc'), head = el('h3');
+  head.append(full ? document.createTextNode(i.title) : link(BASE + '/incidents/' + i.id, i.title), document.createTextNode(' '), badge(incLabel[i.status] || i.status, incTone(i.status)));
+  b.append(head);
+  b.append(el('div', 'small dim', 'Started ' + when(i.created) + (i.resolved ? ', resolved ' + when(i.resolved) : '') + (i.components.length ? ' · Affects ' + i.components.join(', ') : '')));
+  b.append(posts(i.updates));
+  return b;
+}
+function maintenance(m) {
+  const b = el('div', 'inc'), head = el('h3');
+  head.append(document.createTextNode(m.title + ' '), m.state === 'in_progress' ? badge('In progress', 'accent') : m.state === 'scheduled' ? badge('Scheduled', '') : badge('Completed', 'success'));
+  b.append(head, el('div', 'small dim', when(m.start) + ' to ' + when(m.end) + (m.components.length ? ' · Affects ' + m.components.join(', ') : '')));
+  if (m.message) { const p = el('p', '', m.message); p.style.whiteSpace = 'pre-wrap'; p.style.marginTop = 'var(--s2)'; b.append(p); }
+  return b;
+}
 
-  const ic = $('incidents'); ic.replaceChildren();
+// ---------- branding, header, footer ----------
+function brand(d) {
+  const s = d.settings;
+  if (s.accent) { document.documentElement.style.setProperty('--accent', s.accent); }
+  const b = $('brand'); b.replaceChildren();
+  if (s.logoUrl) { const img = el('img'); img.src = s.logoUrl; img.alt = ''; img.referrerPolicy = 'no-referrer'; img.addEventListener('error', () => img.remove()); b.append(img); }
+  const h = el('h1'); h.append(link(home, s.title)); b.append(h);
+  const desc = $('desc'); desc.textContent = s.description || ''; desc.hidden = !s.description;
+  const a = $('actions'); a.replaceChildren();
+  const sub = el('button', 'btn', 'Subscribe to updates'); sub.type = 'button'; sub.setAttribute('aria-expanded', 'false'); sub.setAttribute('aria-controls', 'subpanel');
+  sub.addEventListener('click', () => { const p = $('subpanel'); if (!p) return location.assign(home + '#subscribe'); p.hidden = !p.hidden; sub.setAttribute('aria-expanded', String(!p.hidden)); if (!p.hidden) p.querySelector('input').focus(); });
+  a.append(sub);
+  if (s.supportUrl) a.append(link(s.supportUrl, 'Contact us', 'ghost'));
+  const f = $('foot'); f.replaceChildren();
+  const links = el('div', 'links');
+  links.append(link(BASE + '/history', 'Incident history'), link(BASE + '/feed.rss', 'RSS feed'));
+  f.append(links);
+  if (s.footer) f.append(el('p', '', s.footer));
+}
+
+// ---------- subscribe ----------
+async function post(path, body) {
+  const r = await fetch(path, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok) throw new Error(j.error || 'Something went wrong. Try again in a moment.');
+  return j;
+}
+function subscribePanel(d) {
+  const p = el('div', 'card sub'); p.id = 'subpanel'; p.hidden = location.hash !== '#subscribe';
+  p.append(el('h3', '', 'Get notified when something changes'));
+  const msg = el('p', 'small'); msg.setAttribute('role', 'status');
+  const form = (kind, label, type, hint, button) => {
+    const f = el('form'), l = el('label', '', label), i = el('input');
+    i.type = type; i.required = true; i.name = kind; i.autocomplete = kind === 'email' ? 'email' : 'off';
+    if (kind === 'webhook') i.placeholder = 'https://example.com/hooks/status';
+    l.append(i); f.append(l);
+    const b = el('button', 'btn', button); b.type = 'submit'; f.append(b);
+    f.addEventListener('submit', async e => {
+      e.preventDefault(); b.disabled = true; msg.textContent = '';
+      try { const j = await post(BASE + '/subscribe', { [kind]: i.value.trim() }); msg.textContent = j.message; i.value = ''; }
+      catch (err) { msg.textContent = err.message; }
+      b.disabled = false;
+    });
+    const w = el('div'); w.append(f); if (hint) w.append(el('p', 'small dim', hint)); w.lastChild.style.marginTop = 'var(--s2)';
+    return w;
+  };
+  if (d.subscribe.email) p.append(form('email', 'Email address', 'email', 'We send a link to confirm. Every update comes with a link to unsubscribe.', 'Subscribe by email'));
+  if (d.subscribe.webhook) p.append(form('webhook', 'Webhook address', 'url', 'We send a JSON request for every update. Your server has to answer a test request first.', 'Subscribe with a webhook'));
+  const rss = el('div'); rss.append(el('p', 'small', 'Or follow the RSS feed:'));
+  const a = link(BASE + '/feed.rss', location.origin + BASE + '/feed.rss', 'mono'); rss.append(a);
+  p.append(rss, msg);
+  return p;
+}
+
+// ---------- pages ----------
+async function getJSON(path) {
+  const r = await fetch(path);
+  if (!r.ok) throw new Error(String(r.status));
+  return r.json();
+}
+async function showHome() {
+  const d = await getJSON('/status.json');
+  document.title = d.settings.title;
+  brand(d);
+  const v = el('div');
+  const ban = el('div', 'banner ' + d.overall, overallLabel[d.overall] || d.overall); ban.setAttribute('role', 'status');
+  v.append(ban);
+  if (d.subscribe.email || d.subscribe.webhook) { const sp = subscribePanel(d); sp.style.marginTop = 'var(--s4)'; v.append(sp); }
+  if (d.maintenance.length) {
+    v.append(el('h2', '', 'Scheduled maintenance'));
+    const c = el('div', 'card'); for (const m of d.maintenance) c.append(maintenance(m)); v.append(c);
+  }
+  v.append(el('h2', '', 'Services'), services(d));
+  v.append(el('h2', '', 'Incidents'));
+  const ic = el('div', 'card');
   if (!d.incidents.length) ic.append(el('div', 'row dim', 'No incidents in the last 14 days.'));
-  for (const i of d.incidents) {
-    const b = el('div', 'inc');
-    const head = el('div'); head.append(el('strong', '', i.title + ' '), el('span', 'badge ' + (i.status === 'resolved' ? 'badge-success' : 'badge-warning'), incStatus[i.status] || i.status));
-    b.append(head, el('div', 'small dim', 'Started ' + when(i.created) + (i.resolved ? ', resolved ' + when(i.resolved) : '')));
-    if (i.updates.length) { const ul = el('ul', 'small'); for (const u of i.updates) ul.append(el('li', '', when(u.time) + ': ' + u.text)); b.append(ul); }
-    ic.append(b);
+  for (const i of d.incidents) ic.append(incident(i, false));
+  v.append(ic);
+  const more = el('p', 'small'); more.style.marginTop = 'var(--s3)'; more.append(link(BASE + '/history', 'See all past incidents'));
+  v.append(more);
+  const old = $('subpanel'), open = old && !old.hidden;
+  $('view').replaceChildren(v);
+  if (open) { $('subpanel').hidden = false; }
+}
+async function showHistory() {
+  const first = await getJSON('/status.json');
+  document.title = 'History - ' + first.settings.title;
+  brand(first);
+  const v = el('div'), list = el('div'), btn = el('button', 'ghost', 'Show older'); btn.type = 'button'; btn.style.marginTop = 'var(--s4)';
+  v.append(el('h2', '', 'Incident history'), list, btn);
+  $('view').replaceChildren(v);
+  let next = 0, last = '';
+  const load = async () => {
+    const h = await getJSON('/status/api/history' + (next ? '?before=' + next : ''));
+    let card = null;
+    for (const e of h.entries) {
+      const m = monthOf(e.time);
+      if (m !== last) { last = m; v.insertBefore(el('div', 'month', m), btn); card = el('div', 'card'); v.insertBefore(card, btn); }
+      card.append(e.type === 'incident' ? incident(e.incident, false) : maintenance(e.maintenance));
+    }
+    if (!list.children.length && !h.entries.length && !next) list.append(el('div', 'card')), list.firstChild.append(el('div', 'row dim', 'Nothing has been posted yet.'));
+    next = h.next; btn.hidden = !next;
+  };
+  btn.addEventListener('click', () => load().catch(fail));
+  await load();
+}
+async function showIncident(id) {
+  const [d, i] = await Promise.all([getJSON('/status.json'), getJSON('/status/api/incidents/' + encodeURIComponent(id))]);
+  document.title = i.title + ' - ' + d.settings.title;
+  brand(d);
+  const v = el('div'), back = el('p', 'small'); back.style.marginTop = 'var(--s5)'; back.append(link(BASE + '/history', 'Back to incident history'));
+  const c = el('div', 'card'); c.style.marginTop = 'var(--s3)'; c.append(incident(i, true));
+  v.append(back, c);
+  $('view').replaceChildren(v);
+}
+
+function fail(e) {
+  const v = $('view');
+  if (e && e.message === '404') { v.replaceChildren(el('div', 'banner', 'That page does not exist. Go back to the ')); v.firstChild.append(link(home, 'status page'), document.createTextNode('.')); return; }
+  if (!v.querySelector('.card')) v.replaceChildren(el('div', 'banner', 'The status could not be loaded. Try again in a moment.'));
+}
+
+// ---------- notices from confirm and unsubscribe links ----------
+function notices() {
+  const q = new URLSearchParams(location.search), n = $('notice');
+  const note = (text, ...extra) => { const d = el('div', 'notice'); d.setAttribute('role', 'status'); d.append(el('span', '', text), ...extra); n.replaceChildren(d); return d; };
+  if (q.get('notice') === 'confirmed') note('You are subscribed. You will get an email for each update.');
+  else if (q.get('notice') === 'invalid') note('That link is not valid. Subscribe again to get a new one.');
+  const token = q.get('unsubscribe');
+  if (token) {
+    const b = el('button', 'btn', 'Unsubscribe'); b.type = 'button';
+    const d = note('Stop getting updates from this page?', b);
+    b.addEventListener('click', async () => {
+      b.disabled = true;
+      try { const j = await post(BASE + '/unsubscribe', { token }); d.replaceChildren(el('span', '', j.message)); history.replaceState(null, '', location.pathname); }
+      catch (e) { d.replaceChildren(el('span', '', e.message)); }
+    });
   }
 }
-load(); setInterval(load, 30000);
+
+const rel = location.pathname.slice(BASE.length).replace(/\/+$/, '');
+let run;
+if (rel === '/history') run = showHistory;
+else if (rel.startsWith('/incidents/')) run = () => showIncident(decodeURIComponent(rel.slice(11)));
+else run = showHome;
+notices();
+run().catch(fail);
+if (run === showHome) setInterval(() => { if (!document.hidden && !document.activeElement.matches('input')) showHome().catch(() => {}); }, 30000);
 </script>
 </body>
 </html>