Refer to the mobile companion by its name, Remora

# Conflicts:
#	internal/sandbar/api.go

.env.example

@@ -23,9 +23,21 @@ SANDBAR_MASTER_KEY=
 # Leave empty and /metrics does not exist.
 #SANDBAR_METRICS_TOKEN=
 
+# Install new releases by itself: checks every few hours, then downloads, verifies and restarts.
+# Works in Docker too (the new binary is kept in <data>/bin). Off by default.
+#SANDBAR_AUTO_UPDATE=1
+# Where releases come from, if not this project on git.veillax.com.
+#SANDBAR_UPDATE_SERVER=https://git.veillax.com
+#SANDBAR_UPDATE_REPO=Veillax/sandbar
+
+# Behind a reverse proxy, take the client address from X-Forwarded-For. Needed for website analytics and
+# the sign-in limit to tell visitors apart. Only set it when the proxy is the only way to reach Sandbar.
+#SANDBAR_TRUST_PROXY=1
+
 # How long topic messages and monitor results are kept, in days.
 #SANDBAR_MESSAGE_DAYS=30
 #SANDBAR_CHECK_DAYS=30
+#SANDBAR_ANALYTICS_DAYS=365
 
 # Outgoing email, for email channels and for paging people by email.
 #SANDBAR_SMTP_HOST=smtp.example.com
@@ -33,3 +45,17 @@ SANDBAR_MASTER_KEY=
 #SANDBAR_SMTP_USER=
 #SANDBAR_SMTP_PASSWORD=
 #SANDBAR_SMTP_FROM=sandbar@example.com
+
+# Mobile companion app (the Remora PWA): Web Push, served from Sandbar or from another site.
+# Folder holding the app's files; Sandbar serves them at /app/. Needs HTTPS (or localhost) for push.
+#SANDBAR_APP_DIR=../remora/public
+# If the app is hosted on another origin instead, allow it to call the API.
+#SANDBAR_APP_ORIGIN=https://sandbar-app.example.com
+# Contact that push services (Google, Apple, Mozilla) can reach if Sandbar misbehaves. Defaults to SANDBAR_URL when that is https.
+#SANDBAR_VAPID_SUBJECT=mailto:you@example.com
+# Development only: allow push endpoints on plain http and private addresses.
+#SANDBAR_PUSH_DEV=1
+# Show Hammerhead's edges and tunnel state in the app. Use an account without two-factor sign-in, read-only if you can.
+#SANDBAR_HAMMERHEAD_URL=https://hammerhead.example.com
+#SANDBAR_HAMMERHEAD_EMAIL=
+#SANDBAR_HAMMERHEAD_PASSWORD=

.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

.gitea/workflows/ci.yml

@@ -31,6 +31,10 @@ jobs:
             exit 1
           fi
 
+      - name: Shell scripts parse
+        run: |
+          for f in deploy/*.sh; do sh -n "$f"; done
+
       - name: Vet
         run: go vet ./...
 

.gitea/workflows/release.yml

@@ -1,18 +1,22 @@
 name: Release
 
-# Push a tag such as v0.1.0 to build and publish the container image:
-#   git tag -a v0.1.0 -m "sandbar v0.1.0" && git push origin v0.1.0
+# Push a tag such as v0.2.0 to build and publish a release:
+#   git tag -a v0.2.0 -m "sandbar v0.2.0" && git push origin v0.2.0
+# The release carries the archives and SHA256SUMS that self-update downloads, and the
+# container image is pushed to the registry on this server.
 on:
   push:
     tags: ['v*']
 
 jobs:
-  image:
+  release:
     runs-on: ubuntu-latest
     env:
       GOPRIVATE: git.veillax.com
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # release notes come from the history since the previous tag
 
       - uses: actions/setup-go@v5
         with:
@@ -28,19 +32,22 @@ jobs:
           go vet ./...
           go test ./...
 
-      # The Dockerfile packages these binaries, so the arm64 image needs no emulation.
-      - name: Build the binaries
-        run: |
-          for a in amd64 arm64; do
-            mkdir -p dist/bin/linux_$a
-            CGO_ENABLED=0 GOOS=linux GOARCH=$a go build -trimpath \
-              -ldflags "-s -w -X main.version=${GITHUB_REF_NAME}" \
-              -o dist/bin/linux_$a/sandbar ./cmd/sandbar
-          done
+      - name: Build release archives
+        run: sh deploy/build.sh "${GITHUB_REF_NAME}"
 
-      # Optional secret REGISTRY_TOKEN (and variable REGISTRY_USER): an access token with
-      # package write permission, for servers where the job token can't push.
+      # Optional secret RELEASE_TOKEN: an access token that can write releases, for
+      # servers where the automatic job token can't.
+      - name: Publish the release
+        env:
+          TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}
+        run: sh deploy/publish-release.sh "${GITHUB_REF_NAME}"
+
+      # Skipped when the repository variable PUBLISH_DOCKER is "false", or fails alone
+      # if this runner has no Docker: the release above is already published by then.
+      # Optional secret REGISTRY_TOKEN (and variable REGISTRY_USER): an access token
+      # with package write permission, for servers where the job token can't push.
       - name: Build and push the container image
+        if: ${{ vars.PUBLISH_DOCKER != 'false' }}
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN || secrets.GITHUB_TOKEN }}
           REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}

.gitignore

@@ -5,3 +5,4 @@
 master.key
 .devdata/
 bin/
+dist/

README.md

@@ -3,12 +3,13 @@
 Self-hosted notifications, monitoring, on-call and incident response in one small program.
 One binary, one SQLite file, and everything is done in the web UI.
 
-Sandbar covers the ground of four tools:
+Sandbar covers the ground of five tools:
 
 | Area | Like | What it does |
 |---|---|---|
 | **Topics** | ntfy | Publish a message to a topic with one HTTP request. Subscribe in the browser, with `curl`, or with the ntfy phone app |
-| **Monitors** | Tianji, Uptime Kuma | Website, port, DNS and certificate checks, heartbeats for cron jobs, and a public status page |
+| **Monitors** | Tianji, Uptime Kuma | Website, port, DNS and certificate checks, heartbeats for cron jobs, and a status page with groups, incident posts, maintenance and subscribers |
+| **Websites** | Tianji, Plausible, Umami | Page views, visitors, referrers, browsers, countries and custom events for your own sites, with no cookies and no personal data |
 | **On-call** | Opsgenie | Rotating schedules, escalation policies, and alerts that are acknowledged, snoozed or resolved |
 | **Incidents** | incident.io | Declare, assign, update and close an incident, with a timeline and a post-mortem |
 
@@ -47,6 +48,7 @@ services:
     env_file: .env
     environment:
       SANDBAR_URL: https://sandbar.example.com
+      SANDBAR_AUTO_UPDATE: "1"   # optional, see Updating below
     volumes:
       - sandbar-data:/data
 
@@ -62,12 +64,12 @@ docker compose up -d
   a folder instead, make it writable by 65532 (`chown 65532:65532 ./data`).
 - Set `SANDBAR_MASTER_KEY` yourself. Without it a key is generated inside `/data`, next to the database it protects.
 - To build the image locally, see the comment at the top of `Dockerfile`.
-- Update with `docker compose pull && docker compose up -d`. Your data stays in the volume. Copy the data folder
-  before upgrading, since there is no migration tooling yet.
+- Update by hand with `docker compose pull && docker compose up -d`, or let Sandbar do it (see Updating below).
+  Your data stays in the volume. Copy the data folder before upgrading, since there is no migration tooling yet.
 
 ### Binary
 
-Build `sandbar` (`go build -o bin/ ./cmd/sandbar`; releases only publish the container image), copy it to the server with a `.env` file, and run it
+Download an archive from the release page (Linux amd64 and arm64, Windows amd64) or build it (`go build -o bin/ ./cmd/sandbar`), copy it to the server with a `.env` file, and run it
 under a service manager. A minimal systemd unit:
 
 ```ini
@@ -87,10 +89,32 @@ WantedBy=multi-user.target
 
 Put `SANDBAR_DATA=/var/lib/sandbar` in the env file and make `/etc/sandbar/.env` readable only by the `sandbar` user.
 
+### Updating
+
+Pushing a version tag publishes a release with archives and `SHA256SUMS` as well as the image. Sandbar can install
+new releases itself, in Docker and as a plain binary, on Linux and macOS.
+
+- **Automatic:** set `SANDBAR_AUTO_UPDATE=1` (or pass `-auto-update`). Sandbar checks a few minutes after start and
+  then every few hours, downloads the archive for its platform, checks it against `SHA256SUMS`, checks that the new
+  binary runs, replaces itself and restarts. Pre-releases (`v1.0.0-rc1`) are never installed.
+- **On demand:** an administrator can see the newest release and click **Update** on the Account page, with or
+  without automatic updates on.
+- **In Docker:** the image is read-only to Sandbar, and a change inside the container would be lost when it is
+  recreated. So the new binary is written to `<data>/bin/sandbar` on the data volume. At every start Sandbar runs
+  that file when it is a newer release than the image, and deletes it once the image has caught up. The container
+  keeps running through the update (it re-executes in place, so the process id does not change), and
+  `docker compose pull` still works: a newer image takes over from the volume copy.
+- **Pin a version:** leave automatic updates off and use an image tag such as `:v0.2.0` instead of `:latest`.
+- **Requirements:** the release page must be readable without signing in, so the repository has to be public. A
+  development build (`dev`) and Windows never update themselves. `SANDBAR_UPDATE_SERVER` and `SANDBAR_UPDATE_REPO`
+  point it at a different Gitea server or fork. If a bad update leaves Sandbar unable to start, delete
+  `<data>/bin/sandbar` (or set `SANDBAR_NO_OVERLAY=1`) and it starts from the image again.
+
 ### HTTPS and a reverse proxy
 
 Sandbar serves plain HTTP, so put a reverse proxy in front of it and set `SANDBAR_URL` to the public address, since
-links in notifications use it. Caddy needs one line:
+links in notifications use it. Also set `SANDBAR_TRUST_PROXY=1`, so website analytics and the sign-in limit see the
+real client address instead of the proxy's. Caddy needs one line:
 
 ```
 sandbar.example.com {
@@ -136,6 +160,21 @@ A topic is 1 to 64 letters, digits, `-` or `_`. Publishing and subscribing both
 API key (create one on the Account page). Clients that use basic auth can send the key as the password.
 Messages are kept for `SANDBAR_MESSAGE_DAYS` (default 30).
 
+`?since=` also takes unix seconds, a duration such as `10m`, or the id of the last message you have, and
+`?poll=1` returns just that replay and closes, which is how the ntfy apps catch up.
+
+### Phone app (ntfy)
+
+1. Create an API key on the Account page and copy it.
+2. In the ntfy app, open Settings, then Default server, and enter your Sandbar address
+   (`https://sandbar.example.com`). Or tick "Use another server" when you add each subscription.
+3. Add a subscription. For a page when an escalation reaches you, use your personal topic from the Account page
+   (`u-<id>`). For everything, use `alerts` and `incidents`.
+4. Under Manage users, add a user for the server. The username can be anything and the password is the API key.
+
+The Android app keeps a connection open, so messages arrive at once. The iPhone app depends on ntfy.sh's push
+relay, which Sandbar does not use, so there messages arrive only when the app polls.
+
 Two topics are filled for you: `alerts` gets every alert and its recovery, and `incidents` gets every incident
 update. Each person also has a personal topic (`u-<id>`, shown on the Account page). Subscribe to it in the ntfy
 app to be paged on your phone when an escalation policy reaches you.
@@ -151,12 +190,105 @@ app to be paged on your phone when an escalation policy reaches you.
 | Heartbeat | Your job requests `/api/v1/hb/<token>` within its interval plus the allowed delay | A request on a down heartbeat recovers it at once |
 
 A monitor goes down after the set number of failures in a row (default 2), raises an alert with the monitor's
-escalation policy, and recovers on the first success. Monitors marked public appear on `/status`, together with
+escalation policy, and recovers on the first success. Monitors marked public appear on the status page (see below), together with
 incidents marked public. The status page never shows staff names or private monitors.
 
+The status page shows each public monitor as 90 daily uptime bars, like most hosted status pages. A day is green with
+no failed checks, amber when at least 99% of checks passed, red below that, and grey with no data. Hovering a bar
+(or tapping it on a phone) gives the date, the uptime and the number of failed checks. Days are UTC. Counts are kept
+in a small per-day table, so the bars go back 90 days even though raw check results are kept for
+`SANDBAR_CHECK_DAYS` only.
+
 Monitors cannot probe private or internal addresses unless you tick **Allow targets on private networks** on that
 monitor, so a user who can add a monitor cannot use Sandbar to scan your network.
 
+## Status page
+
+The public page is at `/status` (and at the root of its own domain, see below). Everything is set up under
+**Status page** in the sidebar.
+
+- **Components and groups.** Every monitor with **Show on the public status page** ticked is a component, shown as
+  90 daily uptime bars (see Monitors). Create groups on the Groups tab, then pick a group, and optionally a different
+  public name, in the monitor's form. Groups are ordered by their order number; components without a group come first.
+- **Incidents.** An incident marked public is posted with its status, the components it affects, and the updates you
+  write. Declare it as public, or switch it on later. **Post an update** (or changing the status) adds a post with
+  your text, or standard wording if you leave it empty. Customers see only the posts. The internal timeline,
+  comments, names and post-mortem never leave Sandbar. The page shows the last 14 days; everything older is on
+  `/status/history`, and each incident has its own page with the full list of updates.
+- **What the page says.** A component is *Major outage* when its monitor is down or a sev1 incident names it,
+  *Partial outage* for sev2, *Degraded performance* for sev3, and *Under maintenance* during a maintenance window for
+  it. The banner shows the worst of them.
+- **Scheduled maintenance.** Give a window (your local time in the form, stored as UTC) and the affected
+  components. It is announced when scheduled, listed on the page until it ends, and subscribers are told when it
+  starts and when it ends. During the window its components show as under maintenance instead of as an outage.
+  Windows can be moved or canceled, and subscribers are told. Alerts for failing checks still fire as usual.
+- **Branding.** Title, description, logo (an https address), accent color, a contact link and footer text. The
+  accent is checked so that white text on it stays readable (WCAG 4.5 to 1).
+- **Custom domain.** Enter a host name such as `status.example.com`, point its DNS at your server and have the
+  reverse proxy forward that host to Sandbar with the `Host` header unchanged (Caddy does this by default; with nginx
+  add `proxy_set_header Host $host;`). Sandbar then serves the status page at `/` on that host, and nothing else:
+  the app, API and topics are not reachable through it. Links in emails and feeds use `https://<domain>`. The proxy
+  provides the certificate. With `SANDBAR_TRUST_PROXY=1` the host is read from `X-Forwarded-Host` when present.
+
+### Following the page
+
+Visitors choose **Subscribe to updates** on the page:
+
+- **Email.** Needs `SANDBAR_SMTP_HOST`; the form is hidden without it. A visitor gets a confirmation link, and no
+  mail is sent until it is opened. Every message has an unsubscribe link, which asks for one click on the page, so
+  mail scanners cannot unsubscribe people. Unconfirmed addresses are forgotten after 7 days.
+- **Webhook.** The address must answer a test request with a 2xx status before it is subscribed. Requests to private
+  networks are refused. Each update is a JSON `POST`:
+  `{"page","event","title","status","message","url","time","unsubscribe"}`. The events are `incident.created`,
+  `incident.updated`, `incident.resolved`, `maintenance.scheduled`, `maintenance.rescheduled`, `maintenance.started`,
+  `maintenance.completed` and `maintenance.canceled`. The `unsubscribe` link works with a `POST` of
+  `{"token": ...}` to `/status/unsubscribe`, or can be opened in a browser.
+- **RSS.** `/status/feed.rss` has every incident update and maintenance announcement, newest first.
+
+Subscribers can be seen and removed on the Subscribers tab (webhook addresses show only the host). Addresses are
+stored encrypted. Subscribing is limited to 6 requests per hour per address.
+
+### Status page API
+
+| Request | |
+|---|---|
+| `GET /status.json` | Settings, groups, components with their 90 days, current incidents, upcoming and running maintenance |
+| `GET /status/api/history?before=<time>&limit=<n>` | Past incidents and maintenance, newest first, with the time to pass as `before` for the next page |
+| `GET /status/api/incidents/<id>` | One public incident with all its updates |
+| `GET/PUT /api/v1/statuspage` | Settings (PUT is for administrators) |
+| `/api/v1/status-groups` | Groups, as the other configuration lists |
+| `/api/v1/maintenance`, `POST .../<id>/cancel` | Scheduled maintenance (writes are for administrators) |
+| `PATCH /api/v1/incidents/<id>` | Also takes `components` (monitor ids) and `note` (the text of the public post) |
+
+## Websites (analytics)
+
+Add a website on the Websites page, then paste its one-line tracking code into the head of your pages:
+
+```html
+<script defer src="https://sandbar.example.com/script.js" data-website="WEBSITE_ID"></script>
+```
+
+The page for each website shows visitors, page views, visits, bounce rate and who is online now, a chart over the last
+24 hours, 7, 30 or 90 days, and top lists for pages, referrers, browsers, operating systems, devices, countries,
+languages and events.
+
+- **Single-page apps** are counted as people move between pages. Add `data-hash` to count `#hash` changes as pages,
+  or `data-auto="false"` to send nothing until your code calls `sandbar.view()`.
+- **Events:** call `sandbar.track("signup", { plan: "pro" })` from your code.
+- **Private by design:** no cookies, nothing stored in the browser, no IP address or user agent kept (only the labels
+  "Chrome", "macOS", "Mobile" and so on), and nothing is sent when the visitor has Do Not Track on. A visitor is a hash
+  of the address, the browser and the website with a secret and the date, so the same person is one visitor for a day
+  and cannot be followed beyond it. Query strings are dropped from paths and only the referrer's host is kept.
+- **Domain:** a website's optional domain makes Sandbar ignore visits from other hosts. Bots, and anything sending
+  more than 120 hits a minute from one address, are ignored.
+- **Countries** come from the `CF-IPCountry` or `CloudFront-Viewer-Country` header, so they appear only behind
+  Cloudflare or CloudFront. Sandbar bundles no location database. Without the header, visits count as Unknown.
+- **Behind a reverse proxy,** set `SANDBAR_TRUST_PROXY=1` so the client address comes from `X-Forwarded-For`. Without
+  it every visitor looks like the proxy. Only set it when the proxy is the only way to reach Sandbar.
+- Hits are kept for `SANDBAR_ANALYTICS_DAYS` (default 365).
+
+Not included: funnels, goals, session replay, a public share link, and comparison with the previous period.
+
 ## On-call
 
 - A **schedule** rotates through people, handing over every N hours from a start time. **Overrides** cover a
@@ -213,7 +345,7 @@ than their retention are pruned hourly. Back up by copying the data folder while
 - One instance, one organization. SQLite means no clustering.
 - No ICMP ping monitor, no SMS or voice, and no two-factor or single sign-on yet.
 - Sandbar serves plain HTTP. Put it behind HTTPS and set `-url`, or keep it on a private network.
-- Sign-in attempts are limited to 10 per 10 minutes per address.
+- Sign-in attempts are limited to 10 per 10 minutes per address (the client address, see `SANDBAR_TRUST_PROXY`).
 - Tests: `go test ./...`. Style: `node scripts/lint-design.mjs` (see `docs/design.md`).
 
 ## License

cmd/sandbar/main.go

@@ -18,6 +18,7 @@ import (
 
 	"git.veillax.com/Veillax/reef/dotenv"
 	"git.veillax.com/Veillax/reef/secretbox"
+	"git.veillax.com/Veillax/reef/selfupdate"
 	"git.veillax.com/Veillax/sandbar/internal/sandbar"
 )
 
@@ -45,6 +46,7 @@ func main() {
 	data := flag.String("data", env("SANDBAR_DATA", "./sandbar-data"), "directory for the database")
 	url := flag.String("url", env("SANDBAR_URL", ""), "public URL (used for links in notifications)")
 	flag.String("env", ".env", "file to read secrets and settings from")
+	autoUpdate := flag.Bool("auto-update", os.Getenv("SANDBAR_AUTO_UPDATE") == "1", "check for new releases every few hours and update and restart by itself (Linux and macOS, including Docker)")
 	genkey := flag.Bool("genkey", false, "print a new random SANDBAR_MASTER_KEY and exit")
 	showVersion := flag.Bool("version", false, "print the version and exit")
 	flag.Parse()
@@ -58,6 +60,9 @@ func main() {
 		return
 	}
 
+	// In a container, an update lives on the data volume and takes over from the image.
+	sandbar.UseNewerOverlay(*data, version, log.Printf)
+
 	key, err := masterKey(*data)
 	if err != nil {
 		log.Fatal(err)
@@ -72,20 +77,50 @@ func main() {
 	}
 	defer st.Close()
 
+	var hs *http.Server
 	atoi := func(k string) int { n, _ := strconv.Atoi(os.Getenv(k)); return n }
-	srv := sandbar.New(sandbar.Options{
+	var srv *sandbar.Server
+	srv = sandbar.New(sandbar.Options{
 		DataDir:      *data,
 		URL:          strings.TrimRight(*url, "/"),
 		MetricsToken: os.Getenv("SANDBAR_METRICS_TOKEN"),
 		MessageDays:  atoi("SANDBAR_MESSAGE_DAYS"),
 		CheckDays:    atoi("SANDBAR_CHECK_DAYS"),
+		HitDays:      atoi("SANDBAR_ANALYTICS_DAYS"),
+		TrustProxy:   os.Getenv("SANDBAR_TRUST_PROXY") == "1",
+		AppDir:       os.Getenv("SANDBAR_APP_DIR"),
+		AppOrigin:    os.Getenv("SANDBAR_APP_ORIGIN"),
+		VapidSubject: os.Getenv("SANDBAR_VAPID_SUBJECT"),
+
+		PushAllowPrivate:   os.Getenv("SANDBAR_PUSH_DEV") == "1",
+		HammerheadURL:      os.Getenv("SANDBAR_HAMMERHEAD_URL"),
+		HammerheadEmail:    os.Getenv("SANDBAR_HAMMERHEAD_EMAIL"),
+		HammerheadPassword: os.Getenv("SANDBAR_HAMMERHEAD_PASSWORD"),
+		Version:            version,
+		AutoUpdate:         *autoUpdate,
+		UpdateServer:       os.Getenv("SANDBAR_UPDATE_SERVER"),
+		UpdateRepo:         os.Getenv("SANDBAR_UPDATE_REPO"),
+		Restart: func(exe string) error {
+			// Let go of the port and the database, then become the new binary. If that fails, exit
+			// so the container or service manager starts it again, now from the new file.
+			hs.Close()
+			srv.Close()
+			st.Close()
+			err := selfupdate.Restart(exe)
+			log.Printf("could not restart into %s, exiting: %v", exe, err)
+			os.Exit(1)
+			return err
+		},
 		SMTP: sandbar.SMTPConfig{Host: os.Getenv("SANDBAR_SMTP_HOST"), Port: os.Getenv("SANDBAR_SMTP_PORT"),
 			User: os.Getenv("SANDBAR_SMTP_USER"), Password: os.Getenv("SANDBAR_SMTP_PASSWORD"), From: env("SANDBAR_SMTP_FROM", "sandbar@localhost")},
 	}, st)
 	srv.BootstrapAdmin(os.Getenv("SANDBAR_ADMIN_EMAIL"), os.Getenv("SANDBAR_ADMIN_PASSWORD"))
 	srv.Start()
+	if *autoUpdate {
+		go srv.RunAutoUpdate(context.Background())
+	}
 
-	hs := &http.Server{Addr: *listen, Handler: srv.Handler(), ReadHeaderTimeout: 10 * time.Second, IdleTimeout: 2 * time.Minute}
+	hs = &http.Server{Addr: *listen, Handler: srv.Handler(), ReadHeaderTimeout: 10 * time.Second, IdleTimeout: 2 * time.Minute}
 	go func() {
 		log.Printf("sandbar %s listening on %s", version, *listen)
 		if err := hs.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {

deploy/build.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# Builds sandbar for every release platform and packs the archives into dist/.
+#
+#   deploy/build.sh [version]      version defaults to `git describe`
+#
+# Output:
+#   dist/bin/<os>_<arch>/sandbar             the raw binaries (the Docker image uses the linux ones)
+#   dist/sandbar_<version>_<os>_<arch>.tar.gz or .zip
+#   dist/SHA256SUMS
+#
+# Self-update downloads the linux tar.gz archives, so both linux architectures are always built.
+# Set TARGETS="linux/arm64 darwin/arm64" (any GOOS/GOARCH pair Go supports) to build something else by hand.
+set -eu
+NAME=sandbar
+cd "$(dirname "$0")/.."
+VERSION=${1:-$(git describe --tags --always 2>/dev/null || echo dev)}
+TARGETS=${TARGETS:-"linux/amd64 linux/arm64 windows/amd64"}
+
+rm -rf dist
+mkdir -p dist/bin dist/stage
+for t in $TARGETS; do
+	os=${t%/*}
+	arch=${t#*/}
+	ext=""
+	[ "$os" = windows ] && ext=".exe"
+	out="dist/bin/${os}_${arch}"
+	mkdir -p "$out"
+	echo "building $NAME $VERSION for $os/$arch"
+	CGO_ENABLED=0 GOOS=$os GOARCH=$arch GOARM=7 \
+		go build -trimpath -ldflags "-s -w -X main.version=$VERSION" -o "$out/$NAME$ext" "./cmd/$NAME"
+
+	pkg="${NAME}_${VERSION}_${os}_${arch}"
+	stage="dist/stage/$pkg"
+	mkdir -p "$stage"
+	cp "$out/$NAME$ext" "$stage/"
+	for f in LICENSE README.md .env.example; do
+		[ -f "$f" ] && cp "$f" "$stage/"
+	done
+	if [ "$os" = windows ] && command -v zip >/dev/null 2>&1; then
+		(cd dist/stage && zip -qr "../$pkg.zip" "$pkg")
+	else
+		tar -C dist/stage -czf "dist/$pkg.tar.gz" "$pkg"
+	fi
+done
+rm -rf dist/stage
+(cd dist && sha256sum $(ls | grep -E '\.(tar\.gz|zip)$') > SHA256SUMS)
+echo "done: $(ls dist | grep -cE '\.(tar\.gz|zip)$') archives in dist/"

deploy/publish-release.sh

@@ -0,0 +1,71 @@
+#!/bin/sh
+# Creates (or updates) the Gitea release for a tag and uploads what deploy/build.sh made.
+#
+#   TOKEN=<access token that can write releases> deploy/publish-release.sh v0.2.0
+#
+# In Gitea Actions GITHUB_SERVER_URL and GITHUB_REPOSITORY are already set. Safe to
+# re-run: an existing release is reused and assets with the same name are replaced.
+set -eu
+TAG=${1:?usage: publish-release.sh <tag>}
+: "${TOKEN:?set TOKEN to a Gitea access token that can write releases}"
+SERVER=${GITHUB_SERVER_URL:-${GITEA_SERVER_URL:-https://git.veillax.com}}
+REPO=${GITHUB_REPOSITORY:-Veillax/sandbar}
+API="$SERVER/api/v1/repos/$REPO"
+AUTH="Authorization: token $TOKEN"
+
+# a JSON helper without needing jq: any python will do
+PY=python3
+python3 -c 'pass' > /dev/null 2>&1 || PY=python
+json() { "$PY" -c "$1"; }
+
+# release notes: the commit subjects since the previous tag
+prev=$(git describe --tags --abbrev=0 "$TAG^" 2>/dev/null || true)
+if [ -n "$prev" ]; then
+	notes=$(git log --pretty='format:- %s' "$prev..$TAG")
+else
+	notes=$(git log --pretty='format:- %s' "$TAG")
+fi
+prerelease=false
+case "$TAG" in *-*) prerelease=true ;; esac
+
+body=$(NOTES="$notes" TAG="$TAG" PRE="$prerelease" json '
+import json, os
+print(json.dumps({"tag_name": os.environ["TAG"], "name": os.environ["TAG"], "body": os.environ["NOTES"],
+                  "draft": False, "prerelease": os.environ["PRE"] == "true"}))')
+
+# reuse the release when a failed job is re-run
+id=$(curl -fsS -H "$AUTH" "$API/releases/tags/$TAG" 2>/dev/null | json 'import sys, json; print(json.load(sys.stdin)["id"])' 2>/dev/null || true)
+if [ -z "$id" ]; then
+	echo "creating release $TAG"
+	id=$(curl -fsS -X POST -H "$AUTH" -H 'Content-Type: application/json' -d "$body" "$API/releases" | json 'import sys, json; print(json.load(sys.stdin)["id"])')
+else
+	echo "release $TAG already exists (id $id): replacing its files"
+fi
+
+# the ids of the release's assets with a given name (a failed upload can leave a partial one behind)
+asset_ids() {
+	curl -fsS -H "$AUTH" "$API/releases/$id/assets" | "$PY" -c 'import sys, json
+for a in json.load(sys.stdin):
+    if a["name"] == sys.argv[1]:
+        print(a["id"])' "$1"
+}
+
+for f in dist/*.tar.gz dist/*.zip dist/SHA256SUMS; do
+	[ -f "$f" ] || continue
+	name=$(basename "$f")
+	n=1
+	while :; do
+		for aid in $(asset_ids "$name"); do
+			curl -fsS -X DELETE -H "$AUTH" "$API/releases/$id/assets/$aid" > /dev/null
+		done
+		echo "uploading $name (attempt $n)"
+		if curl -fsS --max-time 1200 -X POST -H "$AUTH" -F "attachment=@$f" "$API/releases/$id/assets?name=$name" > /dev/null; then
+			break
+		fi
+		# large uploads can hit a proxy timeout (HTTP 502); try again
+		[ "$n" -lt 5 ] || { echo "giving up on $name after $n attempts" >&2; exit 1; }
+		n=$((n + 1))
+		sleep $((n * 10))
+	done
+done
+echo "published $SERVER/$REPO/releases/tag/$TAG"

docs/design.md

@@ -14,7 +14,7 @@ Sandbar's pages follow the Lightwell design language, as Hammerhead does. The re
 | File | What it holds |
 | --- | --- |
 | `internal/sandbar/web/index.html` | The app. The token block sits between `tokens:begin` and `tokens:end`; raw colors are allowed only there. |
-| `internal/sandbar/web/status.html` | The public status page. Same token block, repeated. |
+| `internal/sandbar/web/status.html` | The public status page: home, history and incident pages in one file. Same token block, repeated. |
 
 Both are single files with no build step. Change a token in both, and in Hammerhead when the language changes.
 
@@ -28,11 +28,20 @@ The helpers at the top of the script in `index.html` are the same as Hammerhead'
 | `rowList(addLabel, make, initial)` | A list the person adds to and removes from, such as people in a rotation or steps in a policy |
 | `timeline(events)` | Dated entries for an alert or an incident |
 
+## Status page bars and charts
+
+* **Uptime bars** on the public page are one bar per UTC day, 90 of them. Green is no failures, amber is at least 99% passing, red is below that, grey is no data. Color is never the only signal: the row carries a text status badge and the uptime percentage, each bar's tooltip says the date and the numbers in words, and the whole strip has an `aria-label` summary.
+* **Component states** are badges with text: Operational (success), Degraded performance and Partial outage (warning), Major outage (danger), Under maintenance (accent). A group heading shows the worst state of its components.
+* **Incident posts** are a short list with a rule on the left: the status in bold, the time, then the text, newest first. Maintenance windows use the same card with a Scheduled, In progress or Completed badge.
+* **Branding** changes one token only, `--accent`, which the page sets from the saved color. The admin form refuses colors that give white text less than 4.5 to 1, so the contrast rule survives any choice.
+* **Analytics charts** are plain bars made of tokens, with two series (visitors in the accent, page views in a lighter mix of it), a legend with text, a native tooltip per bar, and an `aria-label` that gives the totals. There are no chart libraries.
+* **Top lists** are tables with a proportional bar behind the name, so the numbers stay readable without the bar.
+
 ## Icons
 
 Lucide style, outline only, stroke 1.75, round caps, `currentColor`. Sizes are 16, 18 and 22 pixels. They are inline in the `ICONS` table. An icon goes with a text label, and icon-only buttons carry an `aria-label`.
 
-Approved names: `sandbar`, `alerts`, `incidents`, `oncall`, `monitors`, `topics`, `channels`, `status`, `users`, `account`, `out`, `menu`, `close`, `add`, `check`, `back`, `light`, `dark`, `alert`. Add a name here and in `ICONS` together.
+Approved names: `sandbar`, `alerts`, `incidents`, `oncall`, `monitors`, `websites`, `topics`, `channels`, `status`, `users`, `account`, `out`, `menu`, `close`, `add`, `check`, `back`, `light`, `dark`, `alert`. Add a name here and in `ICONS` together.
 
 ## Patterns
 

docs/mobile-api.md

@@ -0,0 +1,20 @@
+# Mobile companion API
+
+Used by the Remora PWA. All calls take `Authorization: Bearer <api key>`.
+
+| Call | What it does |
+| --- | --- |
+| `POST /api/v1/mobile/login` `{email, password, device}` | Returns `{token, keyId, user}`. The token is a new API key named `Mobile: <device>`; delete it under API keys to sign that phone out. No cookie is set. |
+| `GET /api/v1/push/key` | The VAPID public key (base64url) for `pushManager.subscribe`. Created on first use, stored sealed in the database. |
+| `POST /api/v1/push/subscriptions` `{endpoint, keys:{p256dh, auth}, topics, device}` | Registers or updates a device (matched by endpoint). The caller's personal topic is always added. |
+| `GET /api/v1/push/subscriptions` | The caller's devices. |
+| `DELETE /api/v1/push/subscriptions/{id}` | Removes one. |
+| `POST /api/v1/push/test` | Sends a test push to the caller's devices and reports each result. |
+| `POST /api/v1/alerts/{id}/escalate` | Runs the alert's next escalation step now. |
+| `GET /api/v1/hammerhead/edges` | Read-only edges and online state from a linked Hammerhead (`{configured, edges}`). |
+
+Push payload (JSON, encrypted with aes128gcm): `id, topic, title, message, priority, tags, time, status`, plus `alert`
+(the alert id) on on-call alerts, so the app can offer Acknowledge, Snooze and Escalate. Messages are cut to 1200 characters.
+A push service answering 404 or 410 removes the subscription.
+
+`SANDBAR_APP_DIR` serves the app at `/app/`. `SANDBAR_APP_ORIGIN` lets an app hosted elsewhere call `/api/v1/*` (CORS).

internal/sandbar/analytics.go

@@ -0,0 +1,431 @@
+package sandbar
+
+import (
+	"crypto/sha256"
+	_ "embed"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/url"
+	"regexp"
+	"sort"
+	"strings"
+	"time"
+)
+
+// Website analytics, in the manner of Tianji, Plausible and Umami: a small script on a site sends
+// page views and custom events here, and the Websites page shows visitors, pages, referrers,
+// browsers, systems, devices, countries and events.
+//
+// Privacy by construction: no cookies, no stored IP address or user agent. A visitor is a hash of the
+// IP address, the user agent and the website, salted with a secret and the UTC date, so the same
+// person is the same visitor within a day and cannot be followed beyond it.
+
+//go:embed web/script.js
+var trackerJS []byte
+
+// Website is a site whose visits are counted.
+type Website struct {
+	ID     string `json:"id"`
+	Name   string `json:"name"`
+	Domain string `json:"domain"` // optional: when set, only hits from this host and its subdomains count
+}
+
+func prepareWebsite(v any, id string) error {
+	w := v.(*Website)
+	w.ID = id
+	w.Name = strings.TrimSpace(w.Name)
+	if w.Name == "" {
+		return errors.New("give the website a name")
+	}
+	d := strings.ToLower(strings.TrimSpace(w.Domain))
+	if d != "" {
+		if !strings.Contains(d, "//") {
+			d = "//" + d
+		}
+		u, err := url.Parse(d)
+		if err != nil || u.Hostname() == "" {
+			return errors.New("the domain should look like example.com")
+		}
+		d = u.Hostname()
+	}
+	w.Domain = d
+	return nil
+}
+
+func (s *Server) deleteWebsiteData(id string) {
+	s.st.db.Exec(`DELETE FROM hits WHERE website=?`, id)
+}
+
+// realIP is the address of the client. Behind a reverse proxy, set TrustProxy so the address the
+// proxy added (the last entry of X-Forwarded-For) is used; otherwise every visitor looks like the proxy.
+func (s *Server) realIP(r *http.Request) string {
+	if s.opts.TrustProxy {
+		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+			parts := strings.Split(xff, ",")
+			if ip := strings.TrimSpace(parts[len(parts)-1]); net.ParseIP(ip) != nil {
+				return ip
+			}
+		}
+		if ip := strings.TrimSpace(r.Header.Get("X-Real-IP")); net.ParseIP(ip) != nil {
+			return ip
+		}
+	}
+	h, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return h
+}
+
+func (s *Server) serveTracker(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/javascript; charset=utf-8")
+	w.Header().Set("Cache-Control", "public, max-age=3600")
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	w.Write(trackerJS)
+}
+
+var botRe = regexp.MustCompile(`(?i)bot|crawl|spider|slurp|headless|lighthouse|preview|monitor|curl/|wget|python-requests|go-http-client|okhttp`)
+
+// parseUA reduces a user agent to a browser, a system and a kind of device. Only these labels are stored.
+func parseUA(ua string) (browser, os, device string) {
+	switch {
+	case strings.Contains(ua, "Edg/") || strings.Contains(ua, "EdgA/") || strings.Contains(ua, "EdgiOS/"):
+		browser = "Edge"
+	case strings.Contains(ua, "OPR/") || strings.Contains(ua, "Opera"):
+		browser = "Opera"
+	case strings.Contains(ua, "SamsungBrowser"):
+		browser = "Samsung Internet"
+	case strings.Contains(ua, "Firefox/") || strings.Contains(ua, "FxiOS/"):
+		browser = "Firefox"
+	case strings.Contains(ua, "Chrome/") || strings.Contains(ua, "CriOS/"):
+		browser = "Chrome"
+	case strings.Contains(ua, "Safari/"):
+		browser = "Safari"
+	default:
+		browser = "Other"
+	}
+	switch {
+	case strings.Contains(ua, "Windows"):
+		os = "Windows"
+	case strings.Contains(ua, "Android"):
+		os = "Android"
+	case strings.Contains(ua, "iPhone") || strings.Contains(ua, "iPad") || strings.Contains(ua, "iPod"):
+		os = "iOS"
+	case strings.Contains(ua, "Mac OS X") || strings.Contains(ua, "Macintosh"):
+		os = "macOS"
+	case strings.Contains(ua, "CrOS"):
+		os = "ChromeOS"
+	case strings.Contains(ua, "Linux") || strings.Contains(ua, "X11"):
+		os = "Linux"
+	default:
+		os = "Other"
+	}
+	switch {
+	case strings.Contains(ua, "iPad") || strings.Contains(ua, "Tablet") || (strings.Contains(ua, "Android") && !strings.Contains(ua, "Mobile")):
+		device = "Tablet"
+	case strings.Contains(ua, "Mobi") || strings.Contains(ua, "iPhone"):
+		device = "Mobile"
+	default:
+		device = "Desktop"
+	}
+	return
+}
+
+// secret is the random value that salts visitor hashes. It is made once and kept with the other settings.
+func (s *Server) analyticsSecret() string {
+	s.anaMu.Lock()
+	defer s.anaMu.Unlock()
+	if s.anaSecret != "" {
+		return s.anaSecret
+	}
+	var v struct{ Secret string }
+	if s.st.get("setting", "analytics", &v) != nil || v.Secret == "" {
+		v.Secret = newToken()
+		s.st.put("setting", "analytics", &v)
+	}
+	s.anaSecret = v.Secret
+	return v.Secret
+}
+
+func (s *Server) visitorID(website, ip, ua string, now time.Time) string {
+	h := sha256.Sum256([]byte(s.analyticsSecret() + "|" + now.UTC().Format("2006-01-02") + "|" + website + "|" + ip + "|" + ua))
+	return hex.EncodeToString(h[:8])
+}
+
+// hitAllowed limits how fast one address can send hits: a script that loops must not fill the database.
+func (s *Server) hitAllowed(ip string) bool {
+	now := s.now()
+	s.anaMu.Lock()
+	defer s.anaMu.Unlock()
+	if len(s.anaTry) > 20000 {
+		s.anaTry = map[string][]time.Time{}
+	}
+	recent := s.anaTry[ip][:0]
+	for _, t := range s.anaTry[ip] {
+		if now.Sub(t) < time.Minute {
+			recent = append(recent, t)
+		}
+	}
+	if len(recent) >= 120 {
+		s.anaTry[ip] = recent
+		return false
+	}
+	s.anaTry[ip] = append(recent, now)
+	return true
+}
+
+func clip(s string, n int) string {
+	s = strings.TrimSpace(s)
+	if len(s) > n {
+		s = strings.ToValidUTF8(s[:n], "")
+	}
+	return s
+}
+
+// collect receives a page view or event from the tracker script. It is public by design, so it
+// answers 204 to everything it ignores and gives nothing away.
+func (s *Server) collect(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	w.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
+	w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
+	if r.Method == http.MethodOptions {
+		w.WriteHeader(204)
+		return
+	}
+	defer w.WriteHeader(204)
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 4<<10))
+	if err != nil {
+		return
+	}
+	var in struct {
+		Website, Path, Referrer, Hostname, Language, Event string
+		Data                                               map[string]any
+	}
+	if json.Unmarshal(body, &in) != nil {
+		return
+	}
+	var site Website
+	if s.st.get("website", in.Website, &site) != nil {
+		return
+	}
+	host := strings.ToLower(in.Hostname)
+	if site.Domain != "" && host != site.Domain && !strings.HasSuffix(host, "."+site.Domain) {
+		return
+	}
+	ua := r.UserAgent()
+	if ua == "" || botRe.MatchString(ua) {
+		return
+	}
+	ip := s.realIP(r)
+	if !s.hitAllowed(ip) {
+		return
+	}
+	path := in.Path
+	if i := strings.IndexAny(path, "?"); i >= 0 {
+		path = path[:i]
+	}
+	if !strings.HasPrefix(path, "/") {
+		path = "/" + path
+	}
+	ref := ""
+	if u, err := url.Parse(in.Referrer); err == nil && u.Host != "" {
+		if rh := strings.TrimPrefix(strings.ToLower(u.Hostname()), "www."); rh != strings.TrimPrefix(host, "www.") {
+			ref = rh
+		}
+	}
+	country := strings.ToUpper(clip(r.Header.Get("CF-IPCountry"), 2))
+	if country == "" {
+		country = strings.ToUpper(clip(r.Header.Get("CloudFront-Viewer-Country"), 2))
+	}
+	if country == "XX" || country == "T1" {
+		country = ""
+	}
+	lang := strings.ToLower(clip(in.Language, 12))
+	if i := strings.IndexAny(lang, "-_"); i > 0 {
+		lang = lang[:i]
+	}
+	data := ""
+	if in.Event != "" && len(in.Data) > 0 {
+		if b, err := json.Marshal(in.Data); err == nil && len(b) <= 1024 {
+			data = string(b)
+		}
+	}
+	browser, osName, device := parseUA(ua)
+	now := s.now()
+	s.st.db.Exec(`INSERT INTO hits(website,time,visitor,event,path,referrer,browser,os,device,country,lang,data) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)`,
+		site.ID, now.Unix(), s.visitorID(site.ID, ip, ua, now), clip(in.Event, 80), clip(path, 200), ref, browser, osName, device, country, lang, data)
+}
+
+// ---------- reading ----------
+
+type topRow struct {
+	Name     string `json:"name"`
+	Visitors int    `json:"visitors"`
+	Views    int    `json:"views"` // page views, or the number of times for an event
+}
+
+type seriesPoint struct {
+	Time     int64 `json:"t"`
+	Views    int   `json:"views"`
+	Visitors int   `json:"visitors"`
+}
+
+type siteStats struct {
+	Range      string        `json:"range"`
+	Bucket     string        `json:"bucket"` // "hour" or "day"
+	Visitors   int           `json:"visitors"`
+	Views      int           `json:"views"`
+	Visits     int           `json:"visits"`
+	BounceRate float64       `json:"bounceRate"` // percent of visits with one page view; -1 if no visits
+	Online     int           `json:"online"`     // distinct visitors in the last 5 minutes
+	Series     []seriesPoint `json:"series"`
+	Pages      []topRow      `json:"pages"`
+	Referrers  []topRow      `json:"referrers"`
+	Browsers   []topRow      `json:"browsers"`
+	Systems    []topRow      `json:"systems"`
+	Devices    []topRow      `json:"devices"`
+	Countries  []topRow      `json:"countries"`
+	Languages  []topRow      `json:"languages"`
+	Events     []topRow      `json:"events"`
+}
+
+var ranges = map[string]time.Duration{"24h": 24 * time.Hour, "7d": 7 * 24 * time.Hour, "30d": 30 * 24 * time.Hour, "90d": 90 * 24 * time.Hour}
+
+// visitGap is how long a visitor can be quiet before their next page view starts a new visit.
+const visitGap = 30 * 60
+
+func (s *Server) websiteStats(id, rng string) (*siteStats, error) {
+	span, ok := ranges[rng]
+	if !ok {
+		rng, span = "7d", ranges["7d"]
+	}
+	now := s.now()
+	from := now.Add(-span).Unix()
+	out := &siteStats{Range: rng, Bucket: "day", BounceRate: -1, Series: []seriesPoint{}}
+	step := int64(86400)
+	if rng == "24h" {
+		out.Bucket, step = "hour", 3600
+	}
+	db := s.st.db
+
+	db.QueryRow(`SELECT count(DISTINCT visitor), count(*) FROM hits WHERE website=? AND time>=? AND event=''`, id, from).Scan(&out.Visitors, &out.Views)
+	db.QueryRow(`SELECT count(DISTINCT visitor) FROM hits WHERE website=? AND time>=?`, id, now.Add(-5*time.Minute).Unix()).Scan(&out.Online)
+
+	// Visits and bounces: a visitor's page views, split wherever they were quiet for half an hour.
+	if rows, err := db.Query(`SELECT visitor,time FROM hits WHERE website=? AND time>=? AND event='' ORDER BY visitor,time`, id, from); err == nil {
+		var prev string
+		var prevT int64
+		views, bounces := 0, 0
+		closeVisit := func() {
+			if views > 0 {
+				out.Visits++
+			}
+			if views == 1 {
+				bounces++
+			}
+		}
+		for rows.Next() {
+			var v string
+			var t int64
+			if rows.Scan(&v, &t) != nil {
+				continue
+			}
+			if v != prev || t-prevT > visitGap {
+				closeVisit()
+				views = 0
+			}
+			views++
+			prev, prevT = v, t
+		}
+		closeVisit()
+		rows.Close()
+		if out.Visits > 0 {
+			out.BounceRate = float64(bounces) * 100 / float64(out.Visits)
+		}
+	}
+
+	// The chart: one point per hour or UTC day, empty ones included so the line has no gaps.
+	buckets := map[int64]seriesPoint{}
+	if rows, err := db.Query(`SELECT (time/?)*?, count(*), count(DISTINCT visitor) FROM hits WHERE website=? AND time>=? AND event='' GROUP BY 1`, step, step, id, from); err == nil {
+		for rows.Next() {
+			var p seriesPoint
+			if rows.Scan(&p.Time, &p.Views, &p.Visitors) == nil {
+				buckets[p.Time] = p
+			}
+		}
+		rows.Close()
+	}
+	for t := (from / step) * step; t <= now.Unix(); t += step {
+		p := buckets[t]
+		p.Time = t
+		out.Series = append(out.Series, p)
+	}
+
+	top := func(col string, events bool, empty string) []topRow {
+		cond := "event=''"
+		sel := col
+		if events {
+			cond, sel = "event!=''", "event"
+		}
+		rows, err := db.Query(`SELECT `+sel+`, count(DISTINCT visitor), count(*) FROM hits WHERE website=? AND time>=? AND `+cond+
+			` GROUP BY 1 ORDER BY 3 DESC, 1 LIMIT 10`, id, from)
+		list := []topRow{}
+		if err != nil {
+			return list
+		}
+		defer rows.Close()
+		for rows.Next() {
+			var r topRow
+			if rows.Scan(&r.Name, &r.Visitors, &r.Views) == nil {
+				if r.Name == "" {
+					r.Name = empty
+				}
+				list = append(list, r)
+			}
+		}
+		return list
+	}
+	out.Pages = top("path", false, "/")
+	out.Referrers = top("referrer", false, "Direct")
+	out.Browsers = top("browser", false, "Other")
+	out.Systems = top("os", false, "Other")
+	out.Devices = top("device", false, "Other")
+	out.Countries = top("country", false, "Unknown")
+	out.Languages = top("lang", false, "Unknown")
+	out.Events = top("", true, "")
+	sort.SliceStable(out.Series, func(i, j int) bool { return out.Series[i].Time < out.Series[j].Time })
+	return out, nil
+}
+
+func (s *Server) websiteStatsHandler(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	var site Website
+	if s.st.get("website", id, &site) != nil {
+		writeJSON(w, 404, map[string]string{"error": "No such website."})
+		return
+	}
+	st, _ := s.websiteStats(id, r.URL.Query().Get("range"))
+	writeJSON(w, 200, st)
+}
+
+// websiteSummary gives the list page a number for each site: visitors and page views in the last day.
+func (s *Server) websiteSummary(w http.ResponseWriter, r *http.Request) {
+	out := map[string]map[string]int{}
+	since := s.now().Add(-24 * time.Hour).Unix()
+	rows, err := s.st.db.Query(`SELECT website, count(DISTINCT visitor), count(*) FROM hits WHERE time>=? AND event='' GROUP BY website`, since)
+	if err == nil {
+		defer rows.Close()
+		for rows.Next() {
+			var id string
+			var v, p int
+			if rows.Scan(&id, &v, &p) == nil {
+				out[id] = map[string]int{"visitors": v, "views": p}
+			}
+		}
+	}
+	writeJSON(w, 200, out)
+}

internal/sandbar/analytics_test.go

@@ -0,0 +1,175 @@
+package sandbar
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+const (
+	uaChrome = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
+	uaPhone  = "Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1"
+)
+
+func TestParseUA(t *testing.T) {
+	for _, c := range []struct{ ua, browser, os, device string }{
+		{uaChrome, "Chrome", "Windows", "Desktop"},
+		{uaPhone, "Safari", "iOS", "Mobile"},
+		{"Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0", "Firefox", "Linux", "Desktop"},
+		{"Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 Chrome/126.0 Safari/537.36 Edg/126.0", "Edge", "Windows", "Desktop"},
+		{"Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 Chrome/126.0 Mobile Safari/537.36", "Chrome", "Android", "Mobile"},
+		{"Mozilla/5.0 (Linux; Android 13; SM-X700) AppleWebKit/537.36 Chrome/126.0 Safari/537.36", "Chrome", "Android", "Tablet"},
+	} {
+		b, o, d := parseUA(c.ua)
+		if b != c.browser || o != c.os || d != c.device {
+			t.Errorf("%q: got %s/%s/%s, want %s/%s/%s", c.ua, b, o, d, c.browser, c.os, c.device)
+		}
+	}
+}
+
+func TestWebsiteAnalytics(t *testing.T) {
+	s, _, _ := newTestServer(t)
+	s.st.put("website", "w1", &Website{ID: "w1", Name: "Blog", Domain: "example.com"})
+	ts := httptest.NewServer(s.Handler())
+	defer ts.Close()
+
+	send := func(ua string, body string) int {
+		req, _ := http.NewRequest("POST", ts.URL+"/api/send", strings.NewReader(body))
+		req.Header.Set("Content-Type", "text/plain")
+		req.Header.Set("User-Agent", ua)
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+		return resp.StatusCode
+	}
+	view := func(ua, path, ref string) {
+		b, _ := json.Marshal(map[string]string{"website": "w1", "hostname": "www.example.com", "path": path, "referrer": ref, "language": "en-GB"})
+		if code := send(ua, string(b)); code != 204 {
+			t.Fatalf("send: %d", code)
+		}
+	}
+	view(uaChrome, "/", "https://news.example.org/story?id=1")
+	view(uaChrome, "/about?utm=x", "")
+	view(uaPhone, "/", "")
+	send(uaChrome, `{"website":"w1","hostname":"example.com","path":"/pricing","event":"signup","data":{"plan":"pro"}}`)
+
+	// Things that must not be counted.
+	send("Googlebot/2.1", `{"website":"w1","hostname":"example.com","path":"/bot"}`)
+	send(uaChrome, `{"website":"w1","hostname":"evil.test","path":"/wrong-host"}`)
+	send(uaChrome, `{"website":"nope","hostname":"example.com","path":"/unknown-site"}`)
+	send(uaChrome, `not json`)
+
+	c := newAPIClient(t, ts)
+	if code := c.do("GET", "/api/v1/websites/w1/stats", nil, nil); code != 401 {
+		t.Fatalf("stats without sign-in: %d", code)
+	}
+	c.setup()
+	var st siteStats
+	if code := c.do("GET", "/api/v1/websites/w1/stats?range=7d", nil, &st); code != 200 {
+		t.Fatalf("stats: %d", code)
+	}
+	if st.Views != 3 || st.Visitors != 2 || st.Visits != 2 || st.BounceRate != 50 {
+		t.Fatalf("totals: views %d visitors %d visits %d bounce %.0f", st.Views, st.Visitors, st.Visits, st.BounceRate)
+	}
+	has := func(rows []topRow, name string, views int) bool {
+		for _, r := range rows {
+			if r.Name == name && r.Views == views {
+				return true
+			}
+		}
+		return false
+	}
+	for _, c := range []struct {
+		what string
+		rows []topRow
+		name string
+		n    int
+	}{
+		{"page /", st.Pages, "/", 2}, {"page /about without the query", st.Pages, "/about", 1},
+		{"referrer host only", st.Referrers, "news.example.org", 1}, {"direct", st.Referrers, "Direct", 2},
+		{"browser", st.Browsers, "Chrome", 2}, {"os", st.Systems, "iOS", 1},
+		{"device", st.Devices, "Mobile", 1}, {"language", st.Languages, "en", 3}, {"event", st.Events, "signup", 1},
+	} {
+		if !has(c.rows, c.name, c.n) {
+			t.Errorf("%s: %q x%d not in %+v", c.what, c.name, c.n, c.rows)
+		}
+	}
+	for _, p := range st.Pages {
+		if p.Name == "/bot" || p.Name == "/wrong-host" || p.Name == "/unknown-site" || p.Name == "/pricing" {
+			t.Errorf("counted something it should not: %+v", p)
+		}
+	}
+	if st.Online != 2 {
+		t.Fatalf("online %d", st.Online)
+	}
+	nonEmpty := 0
+	for _, p := range st.Series {
+		if p.Views > 0 {
+			nonEmpty++
+		}
+	}
+	if nonEmpty != 1 || len(st.Series) < 7 {
+		t.Fatalf("series: %d points, %d with views", len(st.Series), nonEmpty)
+	}
+
+	// No IP address or user agent is stored.
+	var n int
+	s.st.db.QueryRow(`SELECT count(*) FROM hits WHERE visitor LIKE '%127.0.0.1%' OR browser LIKE '%Mozilla%'`).Scan(&n)
+	if n != 0 {
+		t.Fatal("raw identifiers stored")
+	}
+
+	// The script and the browser preflight.
+	resp, _ := http.Get(ts.URL + "/script.js")
+	body := make([]byte, 64)
+	resp.Body.Read(body)
+	resp.Body.Close()
+	if resp.StatusCode != 200 || !strings.Contains(resp.Header.Get("Content-Type"), "javascript") {
+		t.Fatalf("script.js: %d %s", resp.StatusCode, resp.Header.Get("Content-Type"))
+	}
+	req, _ := http.NewRequest("OPTIONS", ts.URL+"/api/send", nil)
+	resp, _ = http.DefaultClient.Do(req)
+	resp.Body.Close()
+	if resp.StatusCode != 204 || resp.Header.Get("Access-Control-Allow-Origin") != "*" {
+		t.Fatalf("preflight: %d", resp.StatusCode)
+	}
+
+	// Deleting the website deletes its hits.
+	if code := c.do("DELETE", "/api/v1/websites/w1", nil, nil); code != 200 {
+		t.Fatalf("delete: %d", code)
+	}
+	s.st.db.QueryRow(`SELECT count(*) FROM hits`).Scan(&n)
+	if n != 0 {
+		t.Fatalf("%d hits left after deleting the website", n)
+	}
+}
+
+func TestHitRateLimitAndProxy(t *testing.T) {
+	s, _, _ := newTestServer(t)
+	for i := 0; i < 120; i++ {
+		if !s.hitAllowed("1.2.3.4") {
+			t.Fatalf("hit %d refused too early", i)
+		}
+	}
+	if s.hitAllowed("1.2.3.4") {
+		t.Fatal("the 121st hit in a minute should be refused")
+	}
+	if !s.hitAllowed("5.6.7.8") {
+		t.Fatal("another address has its own allowance")
+	}
+
+	r := httptest.NewRequest("GET", "/", nil)
+	r.RemoteAddr = "10.0.0.1:5555"
+	r.Header.Set("X-Forwarded-For", "6.6.6.6, 9.9.9.9")
+	if ip := s.realIP(r); ip != "10.0.0.1" {
+		t.Fatalf("without TrustProxy the connection address is used, got %s", ip)
+	}
+	s.opts.TrustProxy = true
+	if ip := s.realIP(r); ip != "9.9.9.9" {
+		t.Fatalf("the proxy's entry is the last one, got %s", ip)
+	}
+}

internal/sandbar/api.go

@@ -21,10 +21,12 @@ func (s *Server) Handler() http.Handler {
 
 	// pages
 	mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) { servePage(w, indexHTML) })
-	mux.HandleFunc("GET /status", func(w http.ResponseWriter, r *http.Request) { servePage(w, statusHTML) })
-	mux.HandleFunc("GET /status.json", s.statusJSON)
+	s.statusRoutes(mux)
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) { io.WriteString(w, "ok") })
 	mux.HandleFunc("GET /metrics", s.metrics)
+	mux.HandleFunc("GET /script.js", s.serveTracker)
+	mux.HandleFunc("POST /api/send", s.collect)
+	mux.HandleFunc("OPTIONS /api/send", s.collect)
 	mux.HandleFunc("GET /api/v1/hb/{token}", s.heartbeat)
 	mux.HandleFunc("POST /api/v1/hb/{token}", s.heartbeat)
 
@@ -34,6 +36,15 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /api/v1/login", s.apiLogin)
 	mux.HandleFunc("POST /api/v1/logout", func(w http.ResponseWriter, r *http.Request) { s.logout(w, r); writeJSON(w, 200, ok) })
 
+	// mobile companion
+	mux.HandleFunc("POST /api/v1/mobile/login", s.mobileLogin)
+	mux.HandleFunc("GET /api/v1/push/key", s.auth(false, s.pushKeyHTTP))
+	mux.HandleFunc("GET /api/v1/push/subscriptions", s.auth(false, s.listPushSubs))
+	mux.HandleFunc("POST /api/v1/push/subscriptions", s.auth(false, s.savePushSub))
+	mux.HandleFunc("DELETE /api/v1/push/subscriptions/{id}", s.auth(false, s.deletePushSub))
+	mux.HandleFunc("POST /api/v1/push/test", s.auth(false, s.testPush))
+	mux.HandleFunc("GET /api/v1/hammerhead/edges", s.auth(false, s.hammerheadEdges))
+
 	// topics, ntfy-style
 	mux.HandleFunc("POST /{topic}", s.auth(false, s.publishHTTP))
 	mux.HandleFunc("PUT /{topic}", s.auth(false, s.publishHTTP))
@@ -105,6 +116,11 @@ func (s *Server) Handler() http.Handler {
 		}
 		return nil
 	}, nil)
+	s.crud(mux, "websites", "website", true, func() any { return &Website{} }, prepareWebsite, nil)
+	mux.HandleFunc("GET /api/v1/websites/{id}/stats", s.auth(false, s.websiteStatsHandler))
+	mux.HandleFunc("GET /api/v1/website-summary", s.auth(false, s.websiteSummary))
+	mux.HandleFunc("GET /api/v1/system/update", s.auth(true, s.updateStatus))
+	mux.HandleFunc("POST /api/v1/system/update", s.auth(true, s.updateApply))
 	mux.HandleFunc("POST /api/v1/channels/{id}/test", s.auth(true, s.testChannel))
 	mux.HandleFunc("GET /api/v1/oncall", s.auth(false, s.onCallNow))
 
@@ -143,6 +159,9 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /api/v1/alerts/{id}/ack", s.auth(false, func(w http.ResponseWriter, r *http.Request) {
 		fail2(w, s.AckAlert(r.PathValue("id"), userFrom(r.Context()).Name))
 	}))
+	mux.HandleFunc("POST /api/v1/alerts/{id}/escalate", s.auth(false, func(w http.ResponseWriter, r *http.Request) {
+		fail2(w, s.EscalateAlert(r.PathValue("id"), userFrom(r.Context()).Name))
+	}))
 	mux.HandleFunc("POST /api/v1/alerts/{id}/resolve", s.auth(false, func(w http.ResponseWriter, r *http.Request) {
 		fail2(w, s.ResolveAlert(r.PathValue("id"), userFrom(r.Context()).Name))
 	}))
@@ -209,7 +228,7 @@ func (s *Server) Handler() http.Handler {
 		fail2(w, s.st.del("incident", r.PathValue("id")))
 	}))
 
-	return secureHeaders(mux)
+	return s.statusHost(s.appRoutes(secureHeaders(mux)))
 }
 
 var ok = map[string]bool{"ok": true}
@@ -225,7 +244,11 @@ func secureHeaders(next http.Handler) http.Handler {
 		h.Set("X-Content-Type-Options", "nosniff")
 		h.Set("Referrer-Policy", "no-referrer")
 		h.Set("X-Frame-Options", "DENY")
-		h.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:")
+		img := "'self' data:"
+		if strings.HasPrefix(r.URL.Path, "/status") {
+			img += " https:" // the status page can show a logo hosted elsewhere
+		}
+		h.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; img-src "+img)
 		next.ServeHTTP(w, r)
 	})
 }
@@ -347,6 +370,9 @@ func (s *Server) crud(mux *http.ServeMux, path, kind string, adminWrite bool, ne
 		if kind == "monitor" {
 			s.deleteMonitorData(id)
 		}
+		if kind == "website" {
+			s.deleteWebsiteData(id)
+		}
 		fail2(w, s.st.del(kind, id))
 	}))
 }
@@ -518,11 +544,14 @@ func (s *Server) publishHTTP(w http.ResponseWriter, r *http.Request) {
 		bad(w, err.Error())
 		return
 	}
+	m.Event = "message"
 	writeJSON(w, 200, m)
 }
 
 // subscribeHTTP streams a topic as server-sent events (/sse) or JSON lines (/json).
-// ?since=<unix seconds>|all replays stored messages first.
+// ?since= replays stored messages first: "all", unix seconds, a duration such as 10m, or the id
+// of the last message the client saw. ?poll=1 sends only that replay and then ends, which is
+// how the ntfy apps catch up.
 func (s *Server) subscribeHTTP(w http.ResponseWriter, r *http.Request) {
 	topic := r.PathValue("topic")
 	if !validTopic(topic) {
@@ -543,7 +572,14 @@ func (s *Server) subscribeHTTP(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Cache-Control", "no-cache")
 	w.Header().Set("X-Accel-Buffering", "no")
 	bw := bufio.NewWriter(w)
+	event := func(kind string) {
+		b, _ := json.Marshal(map[string]any{"id": newID(), "time": s.now().Unix(), "event": kind, "topic": topic})
+		fmt.Fprintf(bw, "%s\n", b)
+		bw.Flush()
+		fl.Flush()
+	}
 	write := func(m Message) bool {
+		m.Event = "message"
 		b, _ := json.Marshal(m)
 		var err error
 		if sse {
@@ -560,21 +596,22 @@ func (s *Server) subscribeHTTP(w http.ResponseWriter, r *http.Request) {
 	defer unsub()
 	seen := map[string]bool{}
 	if q := r.URL.Query().Get("since"); q != "" {
-		since := int64(0)
-		if q != "all" {
-			since, _ = strconv.ParseInt(q, 10, 64)
-		}
-		for _, m := range s.MessagesSince(topic, since, 500) {
+		for _, m := range s.replaySince(topic, q) {
 			seen[m.ID] = true
 			if !write(m) {
 				return
 			}
 		}
 	}
+	if r.URL.Query().Get("poll") == "1" {
+		return
+	}
 	if sse {
 		fmt.Fprint(bw, ": connected\n\n")
 		bw.Flush()
 		fl.Flush()
+	} else {
+		event("open")
 	}
 	keepalive := time.NewTicker(30 * time.Second)
 	defer keepalive.Stop()
@@ -594,13 +631,38 @@ func (s *Server) subscribeHTTP(w http.ResponseWriter, r *http.Request) {
 		case <-keepalive.C:
 			if sse {
 				fmt.Fprint(bw, ": keepalive\n\n")
-			} else {
-				fmt.Fprint(bw, "\n")
-			}
 				bw.Flush()
 				fl.Flush()
+			} else {
+				event("keepalive")
 			}
 		}
+	}
+}
+
+// replaySince returns the stored messages a subscriber should see first for a ?since= value.
+func (s *Server) replaySince(topic, q string) []Message {
+	if q == "all" {
+		return s.MessagesSince(topic, 0, 500)
+	}
+	if n, err := strconv.ParseInt(q, 10, 64); err == nil {
+		return s.MessagesSince(topic, n, 500)
+	}
+	if d, err := time.ParseDuration(q); err == nil {
+		return s.MessagesSince(topic, s.now().Add(-d).Unix(), 500)
+	}
+	// Otherwise it is the id of the last message the client has: send what came after it.
+	var at int64
+	if s.st.db.QueryRow(`SELECT time FROM messages WHERE topic=? AND id=?`, topic, q).Scan(&at) != nil {
+		return nil
+	}
+	all := s.MessagesSince(topic, at, 500)
+	for i, m := range all {
+		if m.ID == q {
+			return all[i+1:]
+		}
+	}
+	return all
 }
 
 // ---------- alerts in ----------
@@ -703,6 +765,9 @@ func (s *Server) declareHTTP(w http.ResponseWriter, r *http.Request) {
 		Summary  string   `json:"summary"`
 		Lead     string   `json:"lead"`
 		AlertIDs []string `json:"alertIds"`
+		// Public puts the incident on the status page, naming the affected components, as it is declared.
+		Public     bool     `json:"public"`
+		Components []string `json:"components"`
 	}
 	if !decode(r, &in) {
 		bad(w, "invalid request")
@@ -717,6 +782,13 @@ func (s *Server) declareHTTP(w http.ResponseWriter, r *http.Request) {
 		bad(w, err.Error())
 		return
 	}
+	if in.Public {
+		pub, comps := true, in.Components
+		if inc, err = s.UpdateIncident(inc.ID, me.Name, IncidentPatch{Public: &pub, Components: &comps}); err != nil {
+			fail(w, err)
+			return
+		}
+	}
 	writeJSON(w, 200, inc)
 }
 
@@ -761,61 +833,6 @@ func (s *Server) heartbeat(w http.ResponseWriter, r *http.Request) {
 	io.WriteString(w, "ok")
 }
 
-// statusJSON feeds the public status page: only monitors and incidents marked public.
-func (s *Server) statusJSON(w http.ResponseWriter, r *http.Request) {
-	type mon struct {
-		Name   string  `json:"name"`
-		Status string  `json:"status"`
-		Uptime float64 `json:"uptime"`
-		Since  int64   `json:"since"`
-	}
-	type inc struct {
-		Title    string  `json:"title"`
-		Status   string  `json:"status"`
-		Severity string  `json:"severity"`
-		Created  int64   `json:"created"`
-		Resolved int64   `json:"resolved"`
-		Updates  []Event `json:"updates"`
-	}
-	out := struct {
-		Monitors  []mon  `json:"monitors"`
-		Incidents []inc  `json:"incidents"`
-		Overall   string `json:"overall"`
-	}{[]mon{}, []inc{}, "operational"}
-	mons, _ := listOf[Monitor](s.st, "monitor")
-	for _, m := range mons {
-		if !m.Public || !m.Enabled {
-			continue
-		}
-		st := s.monitorState(m.ID)
-		out.Monitors = append(out.Monitors, mon{m.Name, st.Status, st.Uptime30, st.Since})
-		if st.Status == "down" {
-			out.Overall = "outage"
-		}
-	}
-	incs, _ := listOf[Incident](s.st, "incident")
-	sortIncidents(incs)
-	cut := s.now().AddDate(0, 0, -14).Unix()
-	for _, in := range incs {
-		if !in.Public || (in.Status == "resolved" && in.Resolved < cut) {
-			continue
-		}
-		var ups []Event
-		for _, e := range s.st.events("incident", in.ID) {
-			if e.Kind == "update" || e.Kind == "declared" {
-				e.Actor = "" // staff names stay off the public page
-				ups = append(ups, e)
-			}
-		}
-		out.Incidents = append(out.Incidents, inc{in.Title, in.Status, in.Severity, in.Created, in.Resolved, ups})
-		if in.Status != "resolved" && out.Overall == "operational" {
-			out.Overall = "degraded"
-		}
-	}
-	w.Header().Set("Cache-Control", "max-age=15")
-	writeJSON(w, 200, out)
-}
-
 func sortIncidents(list []Incident) {
 	for i := 1; i < len(list); i++ { // newest first; lists are short
 		for j := i; j > 0 && list[j].Created > list[j-1].Created; j-- {

internal/sandbar/auth.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"database/sql"
 	"errors"
-	"net"
 	"net/http"
 	"strings"
 	"time"
@@ -144,19 +143,27 @@ func (s *Server) noteFailure(ip string) {
 	s.loginMu.Unlock()
 }
 
-func clientIP(r *http.Request) string {
-	h, _, err := net.SplitHostPort(r.RemoteAddr)
-	if err != nil {
-		return r.RemoteAddr
-	}
-	return h
-}
-
 var errThrottled = errors.New("too many attempts, try again in a few minutes")
 
 // login checks credentials and starts a session.
 func (s *Server) login(w http.ResponseWriter, r *http.Request, email, password string) (*User, error) {
-	ip := clientIP(r)
+	u, err := s.checkLogin(r, email, password)
+	if err != nil {
+		return nil, err
+	}
+	tok := newToken()
+	exp := s.now().Add(sessionTTL)
+	if _, err := s.st.db.Exec(`INSERT INTO sessions(hash,user_id,expires) VALUES(?,?,?)`, hashToken(tok), u.ID, exp.Unix()); err != nil {
+		return nil, err
+	}
+	http.SetCookie(w, &http.Cookie{Name: sessionCookie, Value: tok, Path: "/", Expires: exp, HttpOnly: true,
+		SameSite: http.SameSiteStrictMode, Secure: strings.HasPrefix(s.opts.URL, "https://")})
+	return u, nil
+}
+
+// checkLogin verifies an email and password, counting failures against the client's address.
+func (s *Server) checkLogin(r *http.Request, email, password string) (*User, error) {
+	ip := s.realIP(r)
 	if s.throttled(ip) {
 		return nil, errThrottled
 	}
@@ -169,13 +176,6 @@ func (s *Server) login(w http.ResponseWriter, r *http.Request, email, password s
 		s.noteFailure(ip)
 		return nil, errors.New("wrong email or password")
 	}
-	tok := newToken()
-	exp := s.now().Add(sessionTTL)
-	if _, err := s.st.db.Exec(`INSERT INTO sessions(hash,user_id,expires) VALUES(?,?,?)`, hashToken(tok), u.ID, exp.Unix()); err != nil {
-		return nil, err
-	}
-	http.SetCookie(w, &http.Cookie{Name: sessionCookie, Value: tok, Path: "/", Expires: exp, HttpOnly: true,
-		SameSite: http.SameSiteStrictMode, Secure: strings.HasPrefix(s.opts.URL, "https://")})
 	return u, nil
 }
 

internal/sandbar/bars_test.go

@@ -0,0 +1,88 @@
+package sandbar
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+// Every check lands in a per-day count that outlives the raw checks, and the status page
+// gets one [checks, failed] pair per day, oldest first and ending today.
+func TestUptimeBars(t *testing.T) {
+	s, clk, _ := newTestServer(t)
+	m := &Monitor{ID: "m", Name: "Site", Kind: "http", Target: "http://x", Enabled: true, Public: true, Retries: 1}
+	s.st.put("monitor", m.ID, m)
+
+	// Two days ago: 4 checks, 1 failed. Yesterday: nothing. Today: 2 checks, both fine.
+	clk.Advance(-48 * time.Hour)
+	for i := 0; i < 4; i++ {
+		var err error
+		if i == 3 {
+			err = errors.New("timeout")
+		}
+		s.recordResult(m, s.monitorState(m.ID), clk.Now(), 10*time.Millisecond, err)
+	}
+	clk.Advance(48 * time.Hour)
+	s.recordResult(m, s.monitorState(m.ID), clk.Now(), 10*time.Millisecond, nil)
+	s.recordResult(m, s.monitorState(m.ID), clk.Now(), 10*time.Millisecond, nil)
+
+	days := s.dailyUptime(m.ID, 5, clk.Now())
+	want := [][2]int{{0, 0}, {0, 0}, {4, 1}, {0, 0}, {2, 0}}
+	for i := range want {
+		if days[i] != want[i] {
+			t.Fatalf("days = %v, want %v", days, want)
+		}
+	}
+
+	// The rollup survives pruning the raw checks.
+	s.st.prune(clk.Now().AddDate(0, 0, 60), 30, 1, 365)
+	if got := s.dailyUptime(m.ID, 5, clk.Now()); got[2] != [2]int{4, 1} {
+		t.Fatalf("rollup lost after pruning: %v", got)
+	}
+
+	ts := httptest.NewServer(s.Handler())
+	defer ts.Close()
+	resp, err := http.Get(ts.URL + "/status.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	var out struct {
+		Today    string
+		Monitors []struct {
+			Uptime float64
+			Days   [][2]int
+		}
+	}
+	json.NewDecoder(resp.Body).Decode(&out)
+	if out.Today != "2026-01-05" || len(out.Monitors) != 1 || len(out.Monitors[0].Days) != uptimeDays {
+		t.Fatalf("status.json: %+v", out)
+	}
+	m0 := out.Monitors[0]
+	if last := m0.Days[uptimeDays-1]; last != [2]int{2, 0} {
+		t.Fatalf("today's bar: %v", last)
+	}
+	if want := 100 * 5.0 / 6.0; m0.Uptime < want-0.01 || m0.Uptime > want+0.01 {
+		t.Fatalf("uptime %.2f, want %.2f", m0.Uptime, want)
+	}
+}
+
+// A database from before the daily table gets it built from the checks it has.
+func TestDailyBackfill(t *testing.T) {
+	s, clk, _ := newTestServer(t)
+	now := clk.Now().Unix()
+	s.st.db.Exec(`INSERT INTO checks(monitor_id,time,ok,ms,detail) VALUES('m',?,1,5,''),('m',?,0,5,'x')`, now, now+1)
+	s.st.db.Exec(`DELETE FROM daily`)
+	var have int
+	s.st.db.QueryRow(`SELECT count(*) FROM daily`).Scan(&have)
+	if have != 0 {
+		t.Fatal("setup")
+	}
+	s.st.backfillDaily()
+	if got := s.dailyUptime("m", 1, clk.Now()); got[0] != [2]int{2, 1} {
+		t.Fatalf("backfill: %v", got)
+	}
+}

internal/sandbar/incident.go

@@ -22,6 +22,7 @@ type Incident struct {
 	Summary    string   `json:"summary"`
 	Postmortem string   `json:"postmortem"`
 	Public     bool     `json:"public"`     // shown on the status page
+	Components []string `json:"components"` // monitor ids the status page says are affected
 	Created    int64    `json:"created"`
 	Resolved   int64    `json:"resolved"`
 	AlertIDs   []string `json:"alertIds"`
@@ -66,7 +67,7 @@ func (s *Server) DeclareIncident(title, severity, summary, lead, actor string, a
 		return nil, errors.New("severity must be sev1, sev2 or sev3")
 	}
 	now := s.now()
-	in := &Incident{ID: newID(), Title: title, Severity: severity, Status: "investigating", Lead: lead, Summary: summary, Created: now.Unix(), AlertIDs: []string{}}
+	in := &Incident{ID: newID(), Title: title, Severity: severity, Status: "investigating", Lead: lead, Summary: summary, Created: now.Unix(), AlertIDs: []string{}, Components: []string{}}
 	for _, id := range alertIDs {
 		if a, err := s.getAlert(id); err == nil {
 			in.AlertIDs = append(in.AlertIDs, a.ID)
@@ -104,6 +105,7 @@ type IncidentPatch struct {
 	Summary    *string   `json:"summary"`
 	Postmortem *string   `json:"postmortem"`
 	Public     *bool     `json:"public"`
+	Components *[]string `json:"components"`
 	Note       string    `json:"note"` // text for the update announcement and timeline
 }
 
@@ -113,6 +115,7 @@ func (s *Server) UpdateIncident(id, actor string, p IncidentPatch) (*Incident, e
 		return nil, err
 	}
 	now := s.now()
+	prevStatus := in.Status
 	var changes []string
 	if p.Severity != nil && *p.Severity != in.Severity {
 		if !validSeverity(*p.Severity) {
@@ -151,12 +154,17 @@ func (s *Server) UpdateIncident(id, actor string, p IncidentPatch) (*Incident, e
 	if p.Postmortem != nil {
 		in.Postmortem = *p.Postmortem
 	}
+	wasPublic, statusChanged := in.Public, in.Status != prevStatus
 	if p.Public != nil {
 		in.Public = *p.Public
 	}
+	if p.Components != nil {
+		in.Components = cleanIDs(*p.Components)
+	}
 	if err := s.st.put("incident", in.ID, in); err != nil {
 		return nil, err
 	}
+	s.postToStatusPage(in, wasPublic, statusChanged, p.Note, now)
 	if len(changes) > 0 || p.Note != "" {
 		text := strings.Join(changes, "; ")
 		if p.Note != "" {

internal/sandbar/mobile.go

@@ -0,0 +1,159 @@
+package sandbar
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/cookiejar"
+	"path"
+	"strings"
+	"time"
+)
+
+// The mobile companion is a PWA that lives in its own repository (remora). Sandbar can
+// serve it at /app/ (AppDir), or the app can be hosted elsewhere and allowed to call the API
+// (AppOrigin). Either way it signs in with mobileLogin, which returns an API key instead of a cookie.
+
+// appRoutes serves the companion app and answers cross-origin calls from AppOrigin. It runs
+// before the router because /app/... would otherwise clash with the ntfy-style /{topic}/... routes.
+func (s *Server) appRoutes(next http.Handler) http.Handler {
+	var files http.Handler
+	if s.opts.AppDir != "" {
+		files = http.StripPrefix("/app/", http.FileServer(http.Dir(s.opts.AppDir)))
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if o := r.Header.Get("Origin"); o != "" && s.opts.AppOrigin != "" && o == s.opts.AppOrigin && strings.HasPrefix(r.URL.Path, "/api/v1/") {
+			h := w.Header()
+			h.Set("Access-Control-Allow-Origin", o)
+			h.Set("Vary", "Origin")
+			h.Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
+			h.Set("Access-Control-Allow-Methods", "GET, POST, PUT, PATCH, DELETE, OPTIONS")
+			h.Set("Access-Control-Max-Age", "600")
+			if r.Method == "OPTIONS" {
+				w.WriteHeader(204)
+				return
+			}
+		}
+		if files != nil && (r.URL.Path == "/app" || strings.HasPrefix(r.URL.Path, "/app/")) {
+			if r.URL.Path == "/app" {
+				http.Redirect(w, r, "/app/", http.StatusMovedPermanently)
+				return
+			}
+			if path.Base(r.URL.Path) == "sw.js" || r.URL.Path == "/app/" {
+				w.Header().Set("Cache-Control", "no-cache") // a new service worker must be noticed at once
+			}
+			h := w.Header()
+			h.Set("X-Content-Type-Options", "nosniff")
+			h.Set("Referrer-Policy", "no-referrer")
+			// The app may be pointed at a Sandbar on another address, so connect-src is open; scripts stay local.
+			h.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src *; manifest-src 'self'; worker-src 'self'")
+			files.ServeHTTP(w, r)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// mobileLogin signs a phone in. It returns a new API key named after the device, which the app
+// sends as a bearer token, so no cookie crosses origins and signing out of one phone (deleting
+// its key) leaves the others alone.
+func (s *Server) mobileLogin(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		Email, Password, Device string
+	}
+	if !decode(r, &in) {
+		bad(w, "invalid request")
+		return
+	}
+	u, err := s.checkLogin(r, in.Email, in.Password)
+	if err != nil {
+		code := 401
+		if errors.Is(err, errThrottled) {
+			code = 429
+		}
+		writeJSON(w, code, map[string]string{"error": err.Error()})
+		return
+	}
+	device := truncate(strings.TrimSpace(in.Device), 60)
+	if device == "" {
+		device = "phone"
+	}
+	id, tok, err := s.createAPIKey(u.ID, "Mobile: "+device)
+	if err != nil {
+		fail(w, err)
+		return
+	}
+	writeJSON(w, 200, map[string]any{"token": tok, "keyId": id, "user": u})
+}
+
+// hammerheadEdges shows the edges and tunnel state of a linked Hammerhead, read-only. Hammerhead
+// lists edges only for signed-in people, so Sandbar signs in with the configured account and keeps
+// the session. Edge tokens and tunnel secrets are dropped before anything reaches the phone.
+func (s *Server) hammerheadEdges(w http.ResponseWriter, r *http.Request) {
+	if s.opts.HammerheadURL == "" {
+		writeJSON(w, 200, map[string]any{"configured": false, "edges": []any{}})
+		return
+	}
+	type edge struct {
+		ID      string   `json:"id"`
+		Name    string   `json:"name"`
+		Online  bool     `json:"online"`
+		IPs     []string `json:"ips"`
+		Version string   `json:"version,omitempty"`
+	}
+	var edges []edge
+	for attempt := 0; ; attempt++ {
+		code, body, err := s.hammerheadGet("/api/edges", attempt > 0)
+		if err != nil {
+			writeJSON(w, 502, map[string]string{"error": "Could not reach Hammerhead: " + err.Error()})
+			return
+		}
+		if code == 401 && attempt == 0 {
+			continue // the session expired: sign in again once
+		}
+		if code != 200 {
+			writeJSON(w, 502, map[string]string{"error": "Hammerhead answered " + http.StatusText(code) + ". Check SANDBAR_HAMMERHEAD_EMAIL and SANDBAR_HAMMERHEAD_PASSWORD, and that the account has no two-factor sign-in."})
+			return
+		}
+		if err := json.Unmarshal(body, &edges); err != nil {
+			writeJSON(w, 502, map[string]string{"error": "Hammerhead sent something unexpected"})
+			return
+		}
+		break
+	}
+	if edges == nil {
+		edges = []edge{}
+	}
+	writeJSON(w, 200, map[string]any{"configured": true, "edges": edges})
+}
+
+// hammerheadGet reads one path from Hammerhead, signing in first when there is no session (or relogin is set).
+func (s *Server) hammerheadGet(p string, relogin bool) (int, []byte, error) {
+	s.hhMu.Lock()
+	defer s.hhMu.Unlock()
+	base := strings.TrimRight(s.opts.HammerheadURL, "/")
+	if s.hhClient == nil || relogin {
+		jar, _ := cookiejar.New(nil)
+		c := *s.httpClient(true) // an admin chose this address, and Hammerhead is often on a private network
+		c.Jar = jar
+		c.Timeout = 10 * time.Second
+		body, _ := json.Marshal(map[string]string{"email": s.opts.HammerheadEmail, "password": s.opts.HammerheadPassword})
+		resp, err := c.Post(base+"/api/login", "application/json", strings.NewReader(string(body)))
+		if err != nil {
+			return 0, nil, err
+		}
+		resp.Body.Close()
+		if resp.StatusCode != 200 {
+			return resp.StatusCode, nil, nil
+		}
+		s.hhClient = &c
+	}
+	resp, err := s.hhClient.Get(base + p)
+	if err != nil {
+		return 0, nil, err
+	}
+	defer resp.Body.Close()
+	b, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	return resp.StatusCode, b, err
+}

internal/sandbar/monitor.go

@@ -39,6 +39,8 @@ type Monitor struct {
 	PolicyID     string `json:"policyId"`   // escalation policy for the alert it raises
 	Severity     string `json:"severity"`   // alert severity (default critical)
 	Public       bool   `json:"public"`     // shown on the status page
+	Group        string `json:"group"`      // status page component group id; empty for none
+	PublicName   string `json:"publicName"` // name on the status page; empty to use Name
 	AllowPrivate bool   `json:"allowPrivate"`
 	Enabled      bool   `json:"enabled"`
 }
@@ -233,6 +235,37 @@ func (s *Server) monitorState(id string) MonitorState {
 	return st
 }
 
+// uptimeDays is how many days of bars the status page shows.
+const uptimeDays = 90
+
+// dailyUptime returns [checks, failed] for each of the last n UTC days, oldest first, so the
+// last entry is today. A day with no checks is [0, 0].
+func (s *Server) dailyUptime(monitorID string, n int, now time.Time) [][2]int {
+	out := make([][2]int, n)
+	today := now.UTC().Truncate(24 * time.Hour)
+	rows, err := s.st.db.Query(`SELECT day,checks,fails FROM daily WHERE monitor_id=? AND day>=?`,
+		monitorID, today.AddDate(0, 0, -(n-1)).Format("2006-01-02"))
+	if err != nil {
+		return out
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var day string
+		var c, f int
+		if rows.Scan(&day, &c, &f) != nil {
+			continue
+		}
+		d, err := time.Parse("2006-01-02", day)
+		if err != nil {
+			continue
+		}
+		if i := n - 1 - int(today.Sub(d).Hours()/24); i >= 0 && i < n {
+			out[i] = [2]int{c, f}
+		}
+	}
+	return out
+}
+
 func (s *Server) saveState(st MonitorState) {
 	s.st.db.Exec(`INSERT INTO mstate(monitor_id,status,since,last_check,last_ms,fails,last_ping,detail) VALUES(?,?,?,?,?,?,?,?)
 		ON CONFLICT(monitor_id) DO UPDATE SET status=excluded.status, since=excluded.since, last_check=excluded.last_check,
@@ -309,6 +342,8 @@ func (s *Server) recordResult(m *Monitor, st MonitorState, now time.Time, dur ti
 		okInt = 1
 	}
 	s.st.db.Exec(`INSERT INTO checks(monitor_id,time,ok,ms,detail) VALUES(?,?,?,?,?)`, m.ID, now.Unix(), okInt, dur.Milliseconds(), errText(err))
+	s.st.db.Exec(`INSERT INTO daily(monitor_id,day,checks,fails) VALUES(?,?,1,?)
+		ON CONFLICT(monitor_id,day) DO UPDATE SET checks=checks+1, fails=fails+excluded.fails`, m.ID, now.UTC().Format("2006-01-02"), 1-okInt)
 	st.LastCheck, st.LastMS, st.Detail = now.Unix(), int(dur.Milliseconds()), errText(err)
 	key := "monitor:" + m.ID
 	if ok {
@@ -369,6 +404,7 @@ func (s *Server) Heartbeat(token string) bool {
 func (s *Server) deleteMonitorData(id string) {
 	s.st.db.Exec(`DELETE FROM mstate WHERE monitor_id=?`, id)
 	s.st.db.Exec(`DELETE FROM checks WHERE monitor_id=?`, id)
+	s.st.db.Exec(`DELETE FROM daily WHERE monitor_id=?`, id)
 	s.ResolveAlertKey("monitor:"+id, "monitor deleted")
 }
 

internal/sandbar/notify.go

@@ -25,12 +25,14 @@ import (
 
 type Message struct {
 	ID       string   `json:"id"`
-	Topic    string   `json:"topic"`
 	Time     int64    `json:"time"`
+	Event    string   `json:"event"` // always "message"; the ntfy apps ignore lines without it
+	Topic    string   `json:"topic"`
 	Title    string   `json:"title,omitempty"`
 	Message  string   `json:"message"`
 	Priority int      `json:"priority"`
 	Tags     []string `json:"tags,omitempty"`
+	Alert    string   `json:"alert,omitempty"` // id of the on-call alert this is about; only on live delivery and push, not stored
 }
 
 var topicRe = regexp.MustCompile(`^[A-Za-z0-9_-]{1,64}$`)
@@ -100,6 +102,10 @@ func parseTags(s string) []string {
 
 // Publish stores a message and delivers it to live subscribers.
 func (s *Server) Publish(topic, title, body string, prio int, tags []string) (Message, error) {
+	return s.publish(topic, title, body, prio, tags, "", "")
+}
+
+func (s *Server) publish(topic, title, body string, prio int, tags []string, alertID, status string) (Message, error) {
 	if !validTopic(topic) {
 		return Message{}, errors.New("a topic is 1-64 letters, digits, - or _")
 	}
@@ -109,7 +115,9 @@ func (s *Server) Publish(topic, title, body string, prio int, tags []string) (Me
 		m.ID, m.Topic, m.Time, m.Title, m.Message, m.Priority, string(tj)); err != nil {
 		return m, err
 	}
+	m.Alert = alertID
 	s.hub.publish(m)
+	s.pushMessage(m, status)
 	return m, nil
 }
 
@@ -154,6 +162,7 @@ type Note struct {
 	Severity string `json:"severity,omitempty"`
 	Link     string `json:"link,omitempty"`
 	Time     int64  `json:"time"`
+	Alert    string `json:"alert,omitempty"` // the alert's id, for alerts
 }
 
 func (n Note) subject() string {
@@ -290,7 +299,7 @@ func (s *Server) Mail(to, subject, body string) error {
 // broadcast sends a note to the topic named by the source and every enabled channel.
 func (s *Server) broadcast(n Note, topics ...string) {
 	for _, t := range topics {
-		if _, err := s.Publish(t, n.subject(), n.text(), n.priority(), n.tags()); err != nil {
+		if _, err := s.publish(t, n.subject(), n.text(), n.priority(), n.tags(), n.Alert, n.Status); err != nil {
 			log.Printf("publish %s: %v", t, err)
 		}
 	}

internal/sandbar/oncall.go

@@ -162,7 +162,7 @@ func (s *Server) RaiseAlert(key, source, summary, detail, severity, policyID str
 		return nil, false, err
 	}
 	s.st.addEvent("alert", a.ID, "created", source, summary, now)
-	s.broadcast(Note{Status: "firing", Kind: "alert", Title: summary, Message: s.alertText(a), Severity: severity, Link: s.link("/#alerts"), Time: now.Unix()}, "alerts")
+	s.broadcast(Note{Status: "firing", Kind: "alert", Title: summary, Message: s.alertText(a), Severity: severity, Link: s.link("/#alerts"), Time: now.Unix(), Alert: a.ID}, "alerts")
 	return a, true, nil
 }
 
@@ -195,7 +195,7 @@ func (s *Server) ResolveAlert(id, actor string) error {
 		return err
 	}
 	s.st.addEvent("alert", id, "resolved", actor, "resolved", now)
-	s.broadcast(Note{Status: "resolved", Kind: "alert", Title: a.Summary, Message: "Resolved: " + a.Summary, Severity: a.Severity, Link: s.link("/#alerts"), Time: now.Unix()}, "alerts")
+	s.broadcast(Note{Status: "resolved", Kind: "alert", Title: a.Summary, Message: "Resolved: " + a.Summary, Severity: a.Severity, Link: s.link("/#alerts"), Time: now.Unix(), Alert: a.ID}, "alerts")
 	return nil
 }
 
@@ -212,7 +212,7 @@ func (s *Server) AckAlert(id, actor string) error {
 		return err
 	}
 	s.st.addEvent("alert", id, "acked", actor, "acknowledged", now)
-	s.broadcast(Note{Status: "acked", Kind: "alert", Title: a.Summary, Message: "Acknowledged by " + actor + ": " + a.Summary, Time: now.Unix()}, "alerts")
+	s.broadcast(Note{Status: "acked", Kind: "alert", Title: a.Summary, Message: "Acknowledged by " + actor + ": " + a.Summary, Time: now.Unix(), Alert: a.ID}, "alerts")
 	return nil
 }
 
@@ -233,6 +233,23 @@ func (s *Server) SnoozeAlert(id, actor string, d time.Duration) error {
 	return nil
 }
 
+// EscalateAlert moves a firing alert to its next step now instead of waiting for the delay.
+func (s *Server) EscalateAlert(id, actor string) error {
+	a, err := s.getAlert(id)
+	if err != nil {
+		return err
+	}
+	if a.Status != "firing" {
+		return errors.New("only a firing alert can be escalated")
+	}
+	if a.PolicyID == "" {
+		return errors.New("this alert has no escalation policy")
+	}
+	s.st.addEvent("alert", id, "note", actor, "escalated by hand", s.now())
+	s.runStep(id, s.now())
+	return nil
+}
+
 // ---------- escalation ----------
 
 // escalate runs every alert step that has come due.
@@ -289,7 +306,7 @@ func (s *Server) runStep(id string, now time.Time) {
 	for _, uid := range people {
 		if u, err := s.userByID(uid); err == nil {
 			s.notifyUser(u, Note{Status: "firing", Kind: "alert", Title: a.Summary, Message: s.alertText(a), Severity: a.Severity,
-				Link: s.link("/#alerts"), Time: now.Unix()})
+				Link: s.link("/#alerts"), Time: now.Unix(), Alert: a.ID})
 			names = append(names, u.Name)
 		}
 	}
@@ -314,7 +331,7 @@ func (s *Server) runStep(id string, now time.Time) {
 // notifyUser reaches one person: a message on their personal topic (u-<id>, which
 // their phone subscribes to) and an email if the server can send mail.
 func (s *Server) notifyUser(u *User, n Note) {
-	s.Publish(userTopic(u.ID), n.subject(), n.text(), n.priority(), n.tags())
+	s.publish(userTopic(u.ID), n.subject(), n.text(), n.priority(), n.tags(), n.Alert, n.Status)
 	if u.Email != "" && (s.opts.SMTP.Host != "" || s.opts.Mailer != nil) {
 		go func() {
 			if err := s.Mail(u.Email, n.subject(), n.text()); err != nil {

internal/sandbar/push.go

@@ -0,0 +1,437 @@
+package sandbar
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/ecdh"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/hkdf"
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"math/big"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+// Web Push lets the mobile companion (a PWA) get a notification while it is closed. Each
+// device registers a push subscription and the topics it wants; Publish then sends one
+// encrypted push per matching device. It is implemented here with the standard library only:
+// VAPID (RFC 8292) identifies Sandbar to the push service, and the payload is encrypted with
+// aes128gcm (RFC 8291) so the push service never sees the message.
+
+const (
+	vapidKind    = "vapid"
+	pushRecord   = 4096
+	pushMaxBody  = 1200 // characters of message body sent in a push; the app fetches the rest
+	pushTTL      = 4 * 60 * 60
+	maxPushSubs  = 20 // per person
+	pushSendWait = 10 * time.Second
+)
+
+// PushSub is one device registered for push.
+type PushSub struct {
+	ID       string   `json:"id"`
+	UserID   string   `json:"-"`
+	Endpoint string   `json:"endpoint"`
+	P256dh   string   `json:"-"`
+	Auth     string   `json:"-"`
+	Topics   []string `json:"topics"`
+	Device   string   `json:"device"`
+	Created  int64    `json:"created"`
+}
+
+// vapidKey returns the server's VAPID key pair, creating it on first use. The private key
+// is stored sealed with the master key like channel secrets.
+func (s *Server) vapidKey() (*ecdsa.PrivateKey, string, error) {
+	s.pushMu.Lock()
+	defer s.pushMu.Unlock()
+	if s.vapid != nil {
+		return s.vapid, s.vapidPub, nil
+	}
+	var doc struct {
+		Priv string `json:"priv"`
+	}
+	var k *ecdsa.PrivateKey
+	if err := s.st.get(vapidKind, "key", &doc); err == nil {
+		if raw, err := base64.RawURLEncoding.DecodeString(s.st.open(doc.Priv)); err == nil {
+			if ek, err := ecdh.P256().NewPrivateKey(raw); err == nil {
+				k = ecdhToECDSA(ek)
+			}
+		}
+	}
+	if k == nil {
+		ek, err := ecdh.P256().GenerateKey(rand.Reader)
+		if err != nil {
+			return nil, "", err
+		}
+		doc.Priv = s.st.seal(base64.RawURLEncoding.EncodeToString(ek.Bytes()))
+		if err := s.st.put(vapidKind, "key", doc); err != nil {
+			return nil, "", err
+		}
+		k = ecdhToECDSA(ek)
+	}
+	s.vapid = k
+	pub, _ := k.PublicKey.ECDH()
+	s.vapidPub = base64.RawURLEncoding.EncodeToString(pub.Bytes())
+	return s.vapid, s.vapidPub, nil
+}
+
+func ecdhToECDSA(k *ecdh.PrivateKey) *ecdsa.PrivateKey {
+	pub := k.PublicKey().Bytes()
+	x, y := elliptic.Unmarshal(elliptic.P256(), pub)
+	d := new(big.Int).SetBytes(k.Bytes())
+	return &ecdsa.PrivateKey{PublicKey: ecdsa.PublicKey{Curve: elliptic.P256(), X: x, Y: y}, D: d}
+}
+
+func (s *Server) vapidSubject() string {
+	if s.opts.VapidSubject != "" {
+		return s.opts.VapidSubject
+	}
+	if strings.HasPrefix(s.opts.URL, "https://") {
+		return s.opts.URL
+	}
+	return "mailto:sandbar@localhost"
+}
+
+// vapidAuth builds the Authorization header for a push endpoint.
+func (s *Server) vapidAuth(endpoint string) (string, error) {
+	k, pub, err := s.vapidKey()
+	if err != nil {
+		return "", err
+	}
+	u, err := url.Parse(endpoint)
+	if err != nil {
+		return "", err
+	}
+	hdr := base64.RawURLEncoding.EncodeToString([]byte(`{"typ":"JWT","alg":"ES256"}`))
+	claims, _ := json.Marshal(map[string]any{"aud": u.Scheme + "://" + u.Host, "exp": s.now().Add(12 * time.Hour).Unix(), "sub": s.vapidSubject()})
+	signing := hdr + "." + base64.RawURLEncoding.EncodeToString(claims)
+	h := sha256.Sum256([]byte(signing))
+	r, sg, err := ecdsa.Sign(rand.Reader, k, h[:])
+	if err != nil {
+		return "", err
+	}
+	sig := make([]byte, 64)
+	r.FillBytes(sig[:32])
+	sg.FillBytes(sig[32:])
+	return "vapid t=" + signing + "." + base64.RawURLEncoding.EncodeToString(sig) + ", k=" + pub, nil
+}
+
+// encryptPush encrypts payload for a subscription (RFC 8291, aes128gcm, one record).
+func encryptPush(payload []byte, p256dh, authSecret string) ([]byte, error) {
+	uaRaw, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(p256dh, "="))
+	if err != nil {
+		return nil, errors.New("bad p256dh key")
+	}
+	auth, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(authSecret, "="))
+	if err != nil || len(auth) != 16 {
+		return nil, errors.New("bad auth secret")
+	}
+	uaPub, err := ecdh.P256().NewPublicKey(uaRaw)
+	if err != nil {
+		return nil, errors.New("bad p256dh key")
+	}
+	if len(payload) > pushRecord-17-1 {
+		return nil, errors.New("payload too large")
+	}
+	asKey, err := ecdh.P256().GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, err
+	}
+	secret, err := asKey.ECDH(uaPub)
+	if err != nil {
+		return nil, err
+	}
+	asPub := asKey.PublicKey().Bytes()
+	salt := make([]byte, 16)
+	if _, err := rand.Read(salt); err != nil {
+		return nil, err
+	}
+	prkKey, err := hkdf.Extract(sha256.New, secret, auth)
+	if err != nil {
+		return nil, err
+	}
+	keyInfo := append(append([]byte("WebPush: info\x00"), uaRaw...), asPub...)
+	ikm, err := hkdf.Expand(sha256.New, prkKey, string(keyInfo), 32)
+	if err != nil {
+		return nil, err
+	}
+	prk, err := hkdf.Extract(sha256.New, ikm, salt)
+	if err != nil {
+		return nil, err
+	}
+	cek, err := hkdf.Expand(sha256.New, prk, "Content-Encoding: aes128gcm\x00", 16)
+	if err != nil {
+		return nil, err
+	}
+	nonce, err := hkdf.Expand(sha256.New, prk, "Content-Encoding: nonce\x00", 12)
+	if err != nil {
+		return nil, err
+	}
+	blk, err := aes.NewCipher([]byte(cek))
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(blk)
+	if err != nil {
+		return nil, err
+	}
+	ct := gcm.Seal(nil, []byte(nonce), append(append([]byte{}, payload...), 2), nil)
+	var out bytes.Buffer
+	out.Write(salt)
+	out.Write([]byte{0, 0, byte(pushRecord >> 8), byte(pushRecord & 0xff), byte(len(asPub))})
+	out.Write(asPub)
+	out.Write(ct)
+	return out.Bytes(), nil
+}
+
+// pushPayload is what the service worker receives.
+type pushPayload struct {
+	ID       string   `json:"id"`
+	Topic    string   `json:"topic"`
+	Title    string   `json:"title"`
+	Message  string   `json:"message"`
+	Priority int      `json:"priority"`
+	Tags     []string `json:"tags,omitempty"`
+	Time     int64    `json:"time"`
+	Alert    string   `json:"alert,omitempty"` // set on a firing on-call alert so the app can offer Acknowledge
+	Status   string   `json:"status,omitempty"`
+}
+
+func truncate(s string, n int) string {
+	if utf8.RuneCountInString(s) <= n {
+		return s
+	}
+	r := []rune(s)
+	return string(r[:n]) + "..."
+}
+
+// sendPush delivers one payload to one subscription. A gone subscription is removed.
+func (s *Server) sendPush(sub PushSub, payload []byte, urgency string) error {
+	body, err := encryptPush(payload, sub.P256dh, sub.Auth)
+	if err != nil {
+		return err
+	}
+	authz, err := s.vapidAuth(sub.Endpoint)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequest("POST", sub.Endpoint, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Encoding", "aes128gcm")
+	req.Header.Set("Content-Type", "application/octet-stream")
+	req.Header.Set("TTL", strconv.Itoa(pushTTL))
+	req.Header.Set("Urgency", urgency)
+	req.Header.Set("Authorization", authz)
+	c := *s.httpClient(s.opts.PushAllowPrivate)
+	c.Timeout = pushSendWait
+	resp, err := c.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
+	if resp.StatusCode == 404 || resp.StatusCode == 410 {
+		s.st.db.Exec(`DELETE FROM push_subs WHERE id=?`, sub.ID)
+		return fmt.Errorf("subscription gone (%d), removed", resp.StatusCode)
+	}
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("push service answered %d", resp.StatusCode)
+	}
+	return nil
+}
+
+func urgencyFor(prio int) string {
+	switch {
+	case prio >= 5:
+		return "high"
+	case prio == 4:
+		return "normal"
+	case prio == 2:
+		return "low"
+	case prio <= 1:
+		return "very-low"
+	}
+	return "normal"
+}
+
+// pushMessage sends a published message to every device subscribed to its topic.
+func (s *Server) pushMessage(m Message, status string) {
+	subs := s.pushSubsForTopic(m.Topic)
+	if len(subs) == 0 {
+		return
+	}
+	p, _ := json.Marshal(pushPayload{ID: m.ID, Topic: m.Topic, Title: m.Title, Message: truncate(m.Message, pushMaxBody), Priority: m.Priority,
+		Tags: m.Tags, Time: m.Time, Alert: m.Alert, Status: status})
+	for _, sub := range subs {
+		sub := sub
+		go func() {
+			if err := s.sendPush(sub, p, urgencyFor(m.Priority)); err != nil {
+				log.Printf("push to %s: %v", sub.ID, err)
+			}
+		}()
+	}
+}
+
+const pushCols = `id,user_id,endpoint,p256dh,auth,topics,device,created`
+
+func scanSub(r scanner) (PushSub, error) {
+	var p PushSub
+	var tj string
+	err := r.Scan(&p.ID, &p.UserID, &p.Endpoint, &p.P256dh, &p.Auth, &tj, &p.Device, &p.Created)
+	json.Unmarshal([]byte(tj), &p.Topics)
+	if p.Topics == nil {
+		p.Topics = []string{}
+	}
+	return p, err
+}
+
+func (s *Server) pushSubs(where string, args ...any) []PushSub {
+	out := []PushSub{}
+	rows, err := s.st.db.Query(`SELECT `+pushCols+` FROM push_subs `+where, args...)
+	if err != nil {
+		return out
+	}
+	defer rows.Close()
+	for rows.Next() {
+		if p, err := scanSub(rows); err == nil {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func (s *Server) pushSubsForTopic(topic string) []PushSub {
+	var out []PushSub
+	for _, p := range s.pushSubs(`ORDER BY created`) { // topics live in a JSON column; there are few devices
+		for _, t := range p.Topics {
+			if t == topic {
+				out = append(out, p)
+				break
+			}
+		}
+	}
+	return out
+}
+
+// ---------- HTTP ----------
+
+func (s *Server) pushKeyHTTP(w http.ResponseWriter, r *http.Request) {
+	_, pub, err := s.vapidKey()
+	if err != nil {
+		fail(w, err)
+		return
+	}
+	writeJSON(w, 200, map[string]string{"publicKey": pub})
+}
+
+func (s *Server) listPushSubs(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, 200, s.pushSubs(`WHERE user_id=? ORDER BY created`, userFrom(r.Context()).ID))
+}
+
+func (s *Server) savePushSub(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		Endpoint string `json:"endpoint"`
+		Keys     struct {
+			P256dh string `json:"p256dh"`
+			Auth   string `json:"auth"`
+		} `json:"keys"`
+		Topics []string `json:"topics"`
+		Device string   `json:"device"`
+	}
+	if !decode(r, &in) {
+		bad(w, "invalid request")
+		return
+	}
+	u := userFrom(r.Context())
+	ep, err := url.Parse(in.Endpoint)
+	if err != nil || (ep.Scheme != "https" && !(s.opts.PushAllowPrivate && ep.Scheme == "http")) || ep.Host == "" || len(in.Endpoint) > 1024 {
+		bad(w, "the push endpoint must be an https address")
+		return
+	}
+	// Prove the keys are usable now rather than when the first alert fails to reach the phone.
+	if _, err := encryptPush([]byte("x"), in.Keys.P256dh, in.Keys.Auth); err != nil {
+		bad(w, err.Error())
+		return
+	}
+	topics := []string{userTopic(u.ID)} // the personal topic always comes along: it carries on-call pages
+	seen := map[string]bool{topics[0]: true}
+	for _, t := range in.Topics {
+		if t = strings.TrimSpace(t); validTopic(t) && !seen[t] {
+			seen[t] = true
+			topics = append(topics, t)
+		}
+	}
+	if len(topics) > 50 {
+		bad(w, "subscribe to at most 50 topics")
+		return
+	}
+	tj, _ := json.Marshal(topics)
+	device := truncate(strings.TrimSpace(in.Device), 80)
+	var id string
+	err = s.st.db.QueryRow(`SELECT id FROM push_subs WHERE endpoint=?`, in.Endpoint).Scan(&id)
+	switch {
+	case err == nil:
+		_, err = s.st.db.Exec(`UPDATE push_subs SET user_id=?,p256dh=?,auth=?,topics=?,device=? WHERE id=?`, u.ID, in.Keys.P256dh, in.Keys.Auth, string(tj), device, id)
+	case errors.Is(err, sql.ErrNoRows):
+		var n int
+		s.st.db.QueryRow(`SELECT COUNT(*) FROM push_subs WHERE user_id=?`, u.ID).Scan(&n)
+		if n >= maxPushSubs {
+			bad(w, "this account has too many registered devices, remove one first")
+			return
+		}
+		id = newID()
+		_, err = s.st.db.Exec(`INSERT INTO push_subs(`+pushCols+`) VALUES(?,?,?,?,?,?,?,?)`, id, u.ID, in.Endpoint, in.Keys.P256dh, in.Keys.Auth, string(tj), device, s.now().Unix())
+	}
+	if err != nil {
+		fail(w, err)
+		return
+	}
+	p, err := scanSub(s.st.db.QueryRow(`SELECT `+pushCols+` FROM push_subs WHERE id=?`, id))
+	if err != nil {
+		fail(w, err)
+		return
+	}
+	writeJSON(w, 200, p)
+}
+
+func (s *Server) deletePushSub(w http.ResponseWriter, r *http.Request) {
+	_, err := s.st.db.Exec(`DELETE FROM push_subs WHERE id=? AND user_id=?`, r.PathValue("id"), userFrom(r.Context()).ID)
+	fail2(w, err)
+}
+
+// testPush sends a test notification to the caller's own devices and says how each one went.
+func (s *Server) testPush(w http.ResponseWriter, r *http.Request) {
+	u := userFrom(r.Context())
+	p, _ := json.Marshal(pushPayload{ID: newID(), Topic: userTopic(u.ID), Title: "Sandbar test", Message: "If you can read this, push notifications work on this device.",
+		Priority: 3, Time: s.now().Unix(), Status: "test"})
+	type result struct {
+		ID     string `json:"id"`
+		Device string `json:"device"`
+		Error  string `json:"error,omitempty"`
+	}
+	out := []result{}
+	for _, sub := range s.pushSubs(`WHERE user_id=?`, u.ID) {
+		res := result{ID: sub.ID, Device: sub.Device}
+		if err := s.sendPush(sub, p, "normal"); err != nil {
+			res.Error = err.Error()
+		}
+		out = append(out, res)
+	}
+	writeJSON(w, 200, out)
+}

internal/sandbar/push_test.go

@@ -0,0 +1,331 @@
+package sandbar
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/ecdh"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/hkdf"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"math/big"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+// fakeDevice plays the browser: it owns the subscription keys and can decrypt what arrives.
+type fakeDevice struct {
+	priv   *ecdh.PrivateKey
+	auth   []byte
+	srv    *httptest.Server
+	mu     sync.Mutex
+	got    []pushPayload
+	vapid  string
+	status int
+}
+
+func newFakeDevice(t *testing.T) *fakeDevice {
+	t.Helper()
+	priv, _ := ecdh.P256().GenerateKey(rand.Reader)
+	d := &fakeDevice{priv: priv, auth: make([]byte, 16), status: 201}
+	rand.Read(d.auth)
+	d.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		d.mu.Lock()
+		defer d.mu.Unlock()
+		d.vapid = r.Header.Get("Authorization")
+		if d.status != 201 {
+			w.WriteHeader(d.status)
+			return
+		}
+		pt, err := d.decrypt(body)
+		if err != nil {
+			t.Errorf("decrypt: %v", err)
+			w.WriteHeader(400)
+			return
+		}
+		var p pushPayload
+		json.Unmarshal(pt, &p)
+		d.got = append(d.got, p)
+		w.WriteHeader(201)
+	}))
+	t.Cleanup(d.srv.Close)
+	return d
+}
+
+func (d *fakeDevice) keys() map[string]string {
+	return map[string]string{
+		"p256dh": base64.RawURLEncoding.EncodeToString(d.priv.PublicKey().Bytes()),
+		"auth":   base64.RawURLEncoding.EncodeToString(d.auth),
+	}
+}
+
+// decrypt is RFC 8291 from the receiving side, written independently of encryptPush.
+func (d *fakeDevice) decrypt(b []byte) ([]byte, error) {
+	salt, idlen := b[:16], int(b[20])
+	asPubRaw := b[21 : 21+idlen]
+	ct := b[21+idlen:]
+	asPub, err := ecdh.P256().NewPublicKey(asPubRaw)
+	if err != nil {
+		return nil, err
+	}
+	secret, _ := d.priv.ECDH(asPub)
+	prkKey, _ := hkdf.Extract(sha256.New, secret, d.auth)
+	info := append(append([]byte("WebPush: info\x00"), d.priv.PublicKey().Bytes()...), asPubRaw...)
+	ikm, _ := hkdf.Expand(sha256.New, prkKey, string(info), 32)
+	prk, _ := hkdf.Extract(sha256.New, ikm, salt)
+	cek, _ := hkdf.Expand(sha256.New, prk, "Content-Encoding: aes128gcm\x00", 16)
+	nonce, _ := hkdf.Expand(sha256.New, prk, "Content-Encoding: nonce\x00", 12)
+	blk, _ := aes.NewCipher([]byte(cek))
+	gcm, _ := cipher.NewGCM(blk)
+	pt, err := gcm.Open(nil, []byte(nonce), ct, nil)
+	if err != nil {
+		return nil, err
+	}
+	return bytes.TrimRight(pt, "\x00")[:len(bytes.TrimRight(pt, "\x00"))-1], nil // drop the 0x02 delimiter
+}
+
+func (d *fakeDevice) payloads() []pushPayload {
+	d.mu.Lock()
+	defer d.mu.Unlock()
+	return append([]pushPayload(nil), d.got...)
+}
+
+func waitFor(t *testing.T, what string, ok func() bool) {
+	t.Helper()
+	for i := 0; i < 200; i++ {
+		if ok() {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for %s", what)
+}
+
+func pushSetup(t *testing.T) (*Server, http.Handler, *User, string) {
+	t.Helper()
+	s, _, _ := newTestServer(t)
+	s.opts.PushAllowPrivate = true
+	u, err := s.createUser("Ana", "ana@example.com", "correct horse battery", "admin", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, key, _ := s.createAPIKey(u.ID, "test")
+	return s, s.Handler(), u, key
+}
+
+func call(h http.Handler, method, path, key string, body any) *httptest.ResponseRecorder {
+	var rd io.Reader
+	if body != nil {
+		b, _ := json.Marshal(body)
+		rd = bytes.NewReader(b)
+	}
+	r := httptest.NewRequest(method, path, rd)
+	if key != "" {
+		r.Header.Set("Authorization", "Bearer "+key)
+	}
+	if body != nil {
+		r.Header.Set("Content-Type", "application/json")
+	}
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	return w
+}
+
+func TestPushDeliversEncryptedMessage(t *testing.T) {
+	s, h, u, key := pushSetup(t)
+	dev := newFakeDevice(t)
+
+	if w := call(h, "GET", "/api/v1/push/key", "", nil); w.Code != 401 {
+		t.Fatalf("push key without sign-in: %d", w.Code)
+	}
+	var k struct{ PublicKey string }
+	json.Unmarshal(call(h, "GET", "/api/v1/push/key", key, nil).Body.Bytes(), &k)
+	if raw, err := base64.RawURLEncoding.DecodeString(k.PublicKey); err != nil || len(raw) != 65 {
+		t.Fatalf("bad VAPID key %q", k.PublicKey)
+	}
+
+	w := call(h, "POST", "/api/v1/push/subscriptions", key, map[string]any{
+		"endpoint": dev.srv.URL + "/push/abc", "keys": dev.keys(), "topics": []string{"alerts", "bad topic!"}, "device": "Pixel"})
+	if w.Code != 200 {
+		t.Fatalf("subscribe: %d %s", w.Code, w.Body)
+	}
+	var sub PushSub
+	json.Unmarshal(w.Body.Bytes(), &sub)
+	if len(sub.Topics) != 2 || sub.Topics[0] != userTopic(u.ID) || sub.Topics[1] != "alerts" {
+		t.Fatalf("topics: %v", sub.Topics)
+	}
+
+	s.Publish("alerts", "Disk full", "db1 is at 98%", 5, []string{"warning"})
+	s.Publish("other", "ignored", "not subscribed", 3, nil)
+	waitFor(t, "push", func() bool { return len(dev.payloads()) == 1 })
+	p := dev.payloads()[0]
+	if p.Title != "Disk full" || p.Message != "db1 is at 98%" || p.Priority != 5 || p.Topic != "alerts" {
+		t.Fatalf("payload: %+v", p)
+	}
+
+	// The VAPID header must be a valid ES256 JWT for the endpoint's origin, signed by the advertised key.
+	dev.mu.Lock()
+	hdr := dev.vapid
+	dev.mu.Unlock()
+	tok := strings.TrimPrefix(strings.Split(hdr, ", k=")[0], "vapid t=")
+	parts := strings.Split(tok, ".")
+	if len(parts) != 3 || !strings.HasSuffix(hdr, ", k="+k.PublicKey) {
+		t.Fatalf("authorization: %s", hdr)
+	}
+	sig, _ := base64.RawURLEncoding.DecodeString(parts[2])
+	raw, _ := base64.RawURLEncoding.DecodeString(k.PublicKey)
+	pub, _ := ecdh.P256().NewPublicKey(raw)
+	ek := ecdsa.PublicKey{Curve: elliptic.P256(), X: new(big.Int).SetBytes(pub.Bytes()[1:33]), Y: new(big.Int).SetBytes(pub.Bytes()[33:])}
+	hh := sha256.Sum256([]byte(parts[0] + "." + parts[1]))
+	if !ecdsa.Verify(&ek, hh[:], new(big.Int).SetBytes(sig[:32]), new(big.Int).SetBytes(sig[32:])) {
+		t.Fatal("VAPID signature does not verify")
+	}
+	claims, _ := base64.RawURLEncoding.DecodeString(parts[1])
+	if !strings.Contains(string(claims), `"aud":"`+dev.srv.URL+`"`) {
+		t.Fatalf("claims: %s", claims)
+	}
+
+	// The key survives a restart: it is stored, not regenerated.
+	s.vapid = nil
+	if _, pub2, _ := s.vapidKey(); pub2 != k.PublicKey {
+		t.Fatal("VAPID key changed")
+	}
+}
+
+func TestPushOnCallAlertCarriesAlertID(t *testing.T) {
+	s, h, u, key := pushSetup(t)
+	dev := newFakeDevice(t)
+	call(h, "POST", "/api/v1/push/subscriptions", key, map[string]any{"endpoint": dev.srv.URL + "/p", "keys": dev.keys(), "topics": []string{"alerts"}})
+	a, _, err := s.RaiseAlert("test:cpu", "test", "CPU high", "load 12", "critical", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitFor(t, "push", func() bool { return len(dev.payloads()) == 1 })
+	if p := dev.payloads()[0]; p.Alert != a.ID || p.Status != "firing" {
+		t.Fatalf("payload: %+v", p)
+	}
+	if w := call(h, "POST", "/api/v1/alerts/"+a.ID+"/ack", key, map[string]any{}); w.Code != 200 {
+		t.Fatalf("ack: %d %s", w.Code, w.Body)
+	}
+	_ = u
+}
+
+func TestPushGoneSubscriptionIsRemoved(t *testing.T) {
+	s, h, _, key := pushSetup(t)
+	dev := newFakeDevice(t)
+	dev.status = 410
+	call(h, "POST", "/api/v1/push/subscriptions", key, map[string]any{"endpoint": dev.srv.URL + "/p", "keys": dev.keys(), "topics": []string{"alerts"}})
+	s.Publish("alerts", "x", "y", 3, nil)
+	waitFor(t, "removal", func() bool { return len(s.pushSubs("")) == 0 })
+}
+
+func TestPushSubscriptionRules(t *testing.T) {
+	_, h, _, key := pushSetup(t)
+	dev := newFakeDevice(t)
+	if w := call(h, "POST", "/api/v1/push/subscriptions", key, map[string]any{"endpoint": "ftp://x/y", "keys": dev.keys()}); w.Code != 400 {
+		t.Fatalf("bad endpoint accepted: %d", w.Code)
+	}
+	if w := call(h, "POST", "/api/v1/push/subscriptions", key, map[string]any{"endpoint": dev.srv.URL, "keys": map[string]string{"p256dh": "AAAA", "auth": "AAAA"}}); w.Code != 400 {
+		t.Fatalf("bad keys accepted: %d", w.Code)
+	}
+	body := map[string]any{"endpoint": dev.srv.URL + "/p", "keys": dev.keys(), "topics": []string{"a"}}
+	call(h, "POST", "/api/v1/push/subscriptions", key, body)
+	body["topics"] = []string{"b"}
+	call(h, "POST", "/api/v1/push/subscriptions", key, body) // same endpoint updates in place
+	var list []PushSub
+	json.Unmarshal(call(h, "GET", "/api/v1/push/subscriptions", key, nil).Body.Bytes(), &list)
+	if len(list) != 1 || list[0].Topics[len(list[0].Topics)-1] != "b" {
+		t.Fatalf("list: %+v", list)
+	}
+	if w := call(h, "POST", "/api/v1/push/test", key, map[string]any{}); !strings.Contains(w.Body.String(), "Pixel") && w.Code != 200 {
+		t.Fatalf("test push: %d %s", w.Code, w.Body)
+	}
+	if w := call(h, "DELETE", "/api/v1/push/subscriptions/"+list[0].ID, key, nil); w.Code != 200 {
+		t.Fatalf("delete: %d", w.Code)
+	}
+}
+
+func TestMobileLoginAndEscalate(t *testing.T) {
+	s, h, _, _ := pushSetup(t)
+	if w := call(h, "POST", "/api/v1/mobile/login", "", map[string]string{"email": "ana@example.com", "password": "nope nope nope"}); w.Code != 401 {
+		t.Fatalf("wrong password: %d", w.Code)
+	}
+	w := call(h, "POST", "/api/v1/mobile/login", "", map[string]string{"email": "ana@example.com", "password": "correct horse battery", "device": "Pixel 8"})
+	var out struct{ Token string }
+	json.Unmarshal(w.Body.Bytes(), &out)
+	if w.Code != 200 || !strings.HasPrefix(out.Token, "sb_") {
+		t.Fatalf("login: %d %s", w.Code, w.Body)
+	}
+	if len(w.Result().Cookies()) != 0 {
+		t.Fatal("mobile login must not set a cookie")
+	}
+	if w := call(h, "GET", "/api/v1/alerts", out.Token, nil); w.Code != 200 {
+		t.Fatalf("token rejected: %d", w.Code)
+	}
+	if err := s.EscalateAlert("missing", "ana"); err == nil {
+		t.Fatal("escalating a missing alert should fail")
+	}
+}
+
+func TestAppServingAndCORS(t *testing.T) {
+	s, _, _, _ := pushSetup(t)
+	dir := t.TempDir()
+	os.WriteFile(dir+"/index.html", []byte("<h1>app</h1>"), 0o644)
+	s.opts.AppDir = dir
+	s.opts.AppOrigin = "https://app.example.com"
+	h := s.Handler()
+	if w := call(h, "GET", "/app/", "", nil); w.Code != 200 || !strings.Contains(w.Body.String(), "<h1>app</h1>") {
+		t.Fatalf("app: %d %s", w.Code, w.Body)
+	}
+	r := httptest.NewRequest("OPTIONS", "/api/v1/alerts", nil)
+	r.Header.Set("Origin", "https://app.example.com")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	if w.Code != 204 || w.Header().Get("Access-Control-Allow-Origin") != "https://app.example.com" {
+		t.Fatalf("preflight: %d %v", w.Code, w.Header())
+	}
+	r = httptest.NewRequest("OPTIONS", "/api/v1/alerts", nil)
+	r.Header.Set("Origin", "https://evil.example.com")
+	w = httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	if w.Header().Get("Access-Control-Allow-Origin") != "" {
+		t.Fatal("foreign origin allowed")
+	}
+}
+
+func TestHammerheadEdgesProxy(t *testing.T) {
+	s, h, _, key := pushSetup(t)
+	if w := call(h, "GET", "/api/v1/hammerhead/edges", key, nil); !strings.Contains(w.Body.String(), `"configured":false`) {
+		t.Fatalf("unconfigured: %s", w.Body)
+	}
+	hh := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api/login":
+			http.SetCookie(w, &http.Cookie{Name: "hh_session", Value: "x", Path: "/"})
+			io.WriteString(w, "{}")
+		case "/api/edges":
+			if _, err := r.Cookie("hh_session"); err != nil {
+				w.WriteHeader(401)
+				return
+			}
+			io.WriteString(w, `[{"id":"e1","name":"edge-eu","ips":["1.2.3.4"],"online":true,"token":"SECRET","tunnelAddr":"1.2.3.4:51820"}]`)
+		}
+	}))
+	defer hh.Close()
+	s.opts.HammerheadURL, s.opts.HammerheadEmail, s.opts.HammerheadPassword = hh.URL, "a@b.c", "pw"
+	w := call(h, "GET", "/api/v1/hammerhead/edges", key, nil)
+	if w.Code != 200 || !strings.Contains(w.Body.String(), "edge-eu") || strings.Contains(w.Body.String(), "SECRET") || strings.Contains(w.Body.String(), "51820") {
+		t.Fatalf("edges: %d %s", w.Code, w.Body)
+	}
+}

internal/sandbar/sandbar_test.go

@@ -453,6 +453,56 @@ func TestAPIAuthSetupAndTopics(t *testing.T) {
 		t.Fatal("subscriber got nothing")
 	}
 
+	// The ntfy apps catch up with ?poll=1&since=<last id> and ignore lines without "event".
+	var ids []string
+	for _, body := range []string{"one", "two", "three"} {
+		r, _ := http.NewRequest("POST", ts.URL+"/phone", strings.NewReader(body))
+		r.Header.Set("Authorization", "Bearer "+key["token"])
+		resp, err := http.DefaultClient.Do(r)
+		if err != nil || resp.StatusCode != 200 {
+			t.Fatalf("publish %s: %v %v", body, err, resp)
+		}
+		var pm Message
+		json.NewDecoder(resp.Body).Decode(&pm)
+		resp.Body.Close()
+		if pm.Event != "message" {
+			t.Fatalf("publish response event: %q", pm.Event)
+		}
+		ids = append(ids, pm.ID)
+	}
+	pollLines := func(query string) []Message {
+		req, _ := http.NewRequest("GET", ts.URL+"/phone/json?poll=1&"+query, nil)
+		req.Header.Set("Authorization", "Bearer "+key["token"])
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		var got []Message
+		sc := bufio.NewScanner(resp.Body)
+		for sc.Scan() {
+			var m Message
+			json.Unmarshal(sc.Bytes(), &m)
+			if m.Event != "message" {
+				t.Fatalf("poll line without event: %s", sc.Text())
+			}
+			got = append(got, m)
+		}
+		return got
+	}
+	if got := pollLines("since=all"); len(got) != 3 {
+		t.Fatalf("poll since=all: %d messages", len(got))
+	}
+	if got := pollLines("since=" + ids[0]); len(got) != 2 || got[0].Message != "two" {
+		t.Fatalf("poll since=<id>: %+v", got)
+	}
+	if got := pollLines("since=" + ids[2]); len(got) != 0 {
+		t.Fatalf("poll since=<last id>: %+v", got)
+	}
+	if got := pollLines("since=10m"); len(got) != 3 {
+		t.Fatalf("poll since=10m: %d messages", len(got))
+	}
+
 	// Reserved topics are refused.
 	for _, reserved := range []string{"/api", "/status"} {
 		r, _ := http.NewRequest("POST", ts.URL+reserved, strings.NewReader("x"))

internal/sandbar/server.go

@@ -1,6 +1,7 @@
 package sandbar
 
 import (
+	"crypto/ecdsa"
 	_ "embed"
 	"log"
 	"net/http"
@@ -25,6 +26,28 @@ type Options struct {
 	SMTP         SMTPConfig
 	MessageDays  int  // how long topic messages are kept (default 30)
 	CheckDays    int  // how long monitor results are kept (default 30)
+	HitDays      int  // how long website analytics are kept (default 365)
+	TrustProxy   bool // take the client address from X-Forwarded-For, for use behind a reverse proxy
+
+	// Mobile companion (see push.go and mobile.go).
+	AppDir           string // folder with the companion PWA, served at /app/
+	AppOrigin        string // origin allowed to call the API from another site, such as https://sandbar-app.example.com
+	VapidSubject     string // contact sent to push services: a mailto: or https: address (default: URL, if https)
+	PushAllowPrivate bool   // allow push endpoints on private addresses and plain http, for development only
+
+	// Hammerhead link: when set, GET /api/v1/hammerhead/edges shows its edge and tunnel status.
+	HammerheadURL      string
+	HammerheadEmail    string
+	HammerheadPassword string
+
+	// Self-update (see update.go). Version is the running release, such as v0.2.0; anything else
+	// ("dev") never updates. Restart is called after a new binary is installed and should close
+	// what the process holds open before re-executing it.
+	Version      string
+	AutoUpdate   bool
+	UpdateServer string // default https://git.veillax.com
+	UpdateRepo   string // default Veillax/sandbar
+	Restart      func(exe string) error
 
 	// Tests replace these.
 	Now        func() time.Time
@@ -44,6 +67,26 @@ type Server struct {
 	loginMu  sync.Mutex
 	loginTry map[string][]time.Time
 
+	upd updateState
+
+	pushMu   sync.Mutex // the VAPID key pair, loaded or created on first use
+	vapid    *ecdsa.PrivateKey
+	vapidPub string
+
+	hhMu     sync.Mutex
+	hhClient *http.Client
+
+	anaMu     sync.Mutex // website analytics: the visitor salt and a per-address rate limit
+	anaSecret string
+	anaTry    map[string][]time.Time
+
+	statusMu  sync.Mutex // the status page settings cache and the signing secret
+	statusCfg *StatusSettings
+	statusKey []byte
+	subMu     sync.Mutex // per-address limit on public subscribe requests
+	subTry    map[string][]time.Time
+	notifyWG  sync.WaitGroup // status page notifications in flight
+
 	stop chan struct{}
 	wg   sync.WaitGroup
 }
@@ -55,7 +98,10 @@ func New(opts Options, st *Store) *Server {
 	if opts.CheckDays <= 0 {
 		opts.CheckDays = 30
 	}
-	return &Server{opts: opts, st: st, hub: newHub(), running: map[string]bool{}, loginTry: map[string][]time.Time{}, stop: make(chan struct{})}
+	if opts.HitDays <= 0 {
+		opts.HitDays = 365
+	}
+	return &Server{opts: opts, st: st, hub: newHub(), running: map[string]bool{}, loginTry: map[string][]time.Time{}, anaTry: map[string][]time.Time{}, subTry: map[string][]time.Time{}, stop: make(chan struct{})}
 }
 
 func (s *Server) now() time.Time {
@@ -69,12 +115,14 @@ func (s *Server) now() time.Time {
 func (s *Server) Start() {
 	s.every(time.Second, func() { s.runDueMonitors(s.now()) })
 	s.every(5*time.Second, func() { s.escalate(s.now()) })
-	s.every(time.Hour, func() { s.st.prune(s.now(), s.opts.MessageDays, s.opts.CheckDays) })
+	s.every(30*time.Second, func() { s.runMaintenance(s.now()) })
+	s.every(time.Hour, func() { s.st.prune(s.now(), s.opts.MessageDays, s.opts.CheckDays, s.opts.HitDays) })
 }
 
 func (s *Server) Close() {
 	close(s.stop)
 	s.wg.Wait()
+	s.notifyWG.Wait()
 }
 
 func (s *Server) every(d time.Duration, f func()) {

internal/sandbar/statuspage.go

@@ -0,0 +1,774 @@
+package sandbar
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"html"
+	"math"
+	"net"
+	"net/http"
+	"net/url"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// The public status page. Monitors marked public are its components, arranged in groups. Incidents
+// marked public are posted on it, with the updates written for customers. Scheduled maintenance
+// has its own window. People follow all of it by RSS, email or webhook (see statussub.go), and the
+// page can be served from its own domain.
+
+// StatusSettings is the page's branding and where it lives. One document, kind "statuspage".
+type StatusSettings struct {
+	Title       string `json:"title"`
+	Description string `json:"description"`
+	Domain      string `json:"domain"`     // serve the page from this host name as well, such as status.example.com
+	LogoURL     string `json:"logoUrl"`    // https address of an image
+	Accent      string `json:"accent"`     // #rrggbb, for buttons and links; white text must stay readable on it
+	SupportURL  string `json:"supportUrl"` // "Contact us" link: http(s) or mailto
+	Footer      string `json:"footer"`
+}
+
+// StatusGroup is a heading that components sit under.
+type StatusGroup struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	Order       int    `json:"order"`
+}
+
+// Maintenance is a planned window. Its components show as under maintenance while it runs.
+type Maintenance struct {
+	ID         string   `json:"id"`
+	Title      string   `json:"title"`
+	Message    string   `json:"message"`
+	Start      int64    `json:"start"`
+	End        int64    `json:"end"`
+	Components []string `json:"components"` // monitor ids
+	Canceled   bool     `json:"canceled"`
+	Created    int64    `json:"created"`
+	StartSent  bool     `json:"startSent"` // subscribers have been told it began
+	EndSent    bool     `json:"endSent"`   // and that it is over
+}
+
+func (m *Maintenance) state(now time.Time) string {
+	switch t := now.Unix(); {
+	case m.Canceled:
+		return "canceled"
+	case t < m.Start:
+		return "scheduled"
+	case t < m.End:
+		return "in_progress"
+	}
+	return "completed"
+}
+
+var (
+	hostRe   = regexp.MustCompile(`^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$`)
+	accentRe = regexp.MustCompile(`^#[0-9a-fA-F]{6}$`)
+)
+
+// contrastWithWhite is the WCAG contrast ratio of a #rrggbb color against white.
+func contrastWithWhite(hex string) float64 {
+	v, _ := strconv.ParseUint(hex[1:], 16, 32)
+	lin := func(c uint64) float64 {
+		f := float64(c) / 255
+		if f <= 0.03928 {
+			return f / 12.92
+		}
+		return math.Pow((f+0.055)/1.055, 2.4)
+	}
+	l := 0.2126*lin(v>>16&255) + 0.7152*lin(v>>8&255) + 0.0722*lin(v&255)
+	return 1.05 / (l + 0.05)
+}
+
+func validateStatusSettings(c *StatusSettings, ownURL string) error {
+	c.Title, c.Description, c.Footer = strings.TrimSpace(c.Title), strings.TrimSpace(c.Description), strings.TrimSpace(c.Footer)
+	c.Domain, c.LogoURL, c.SupportURL, c.Accent = strings.ToLower(strings.TrimSpace(c.Domain)), strings.TrimSpace(c.LogoURL), strings.TrimSpace(c.SupportURL), strings.TrimSpace(c.Accent)
+	if c.Title == "" {
+		c.Title = "Status"
+	}
+	if len(c.Title) > 80 || len(c.Description) > 300 || len(c.Footer) > 300 {
+		return errors.New("the title can be 80 characters, the description and footer 300")
+	}
+	if c.Domain != "" {
+		if !hostRe.MatchString(c.Domain) {
+			return errors.New("the domain must be a host name such as status.example.com, with no https:// or path")
+		}
+		if u, err := url.Parse(ownURL); err == nil && strings.EqualFold(u.Hostname(), c.Domain) {
+			return errors.New("that is Sandbar's own address; use a separate host name for the status page")
+		}
+	}
+	if c.LogoURL != "" {
+		if u, err := url.Parse(c.LogoURL); err != nil || u.Scheme != "https" || u.Host == "" || len(c.LogoURL) > 500 {
+			return errors.New("the logo must be an https:// address")
+		}
+	}
+	if c.SupportURL != "" {
+		u, err := url.Parse(c.SupportURL)
+		if err != nil || len(c.SupportURL) > 500 || !(((u.Scheme == "http" || u.Scheme == "https") && u.Host != "") || (u.Scheme == "mailto" && u.Opaque != "")) {
+			return errors.New("the support link must be an http(s):// address or a mailto: link")
+		}
+	}
+	if c.Accent != "" {
+		if !accentRe.MatchString(c.Accent) {
+			return errors.New("the accent color must look like #1f5c5c")
+		}
+		c.Accent = strings.ToLower(c.Accent)
+		if r := contrastWithWhite(c.Accent); r < 4.5 {
+			return fmt.Errorf("white text is hard to read on that color (contrast %.1f to 1, needs 4.5 to 1); pick a darker one", r)
+		}
+	}
+	return nil
+}
+
+func (s *Server) statusSettings() StatusSettings {
+	s.statusMu.Lock()
+	defer s.statusMu.Unlock()
+	if s.statusCfg == nil {
+		c, err := getOf[StatusSettings](s.st, "statuspage", "main")
+		if err != nil {
+			c = &StatusSettings{}
+		}
+		if c.Title == "" {
+			c.Title = "Status"
+		}
+		s.statusCfg = c
+	}
+	return *s.statusCfg
+}
+
+func (s *Server) saveStatusSettings(c StatusSettings) error {
+	if err := s.st.put("statuspage", "main", c); err != nil {
+		return err
+	}
+	s.statusMu.Lock()
+	s.statusCfg = nil
+	s.statusMu.Unlock()
+	return nil
+}
+
+// ---------- where the page lives ----------
+
+type statusHostKey struct{}
+
+// statusHost serves the status page, and nothing else, to requests for the custom domain: the
+// path is moved under /status, so "/" is the page, "/history" its history, and the admin
+// interface and API are not reachable from there.
+func (s *Server) statusHost(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		d := s.statusSettings().Domain
+		if d == "" || !strings.EqualFold(requestHost(r, s.opts.TrustProxy), d) {
+			next.ServeHTTP(w, r)
+			return
+		}
+		r2 := r.WithContext(context.WithValue(r.Context(), statusHostKey{}, true))
+		r2.URL = new(url.URL)
+		*r2.URL = *r.URL
+		switch p := r.URL.Path; {
+		case p == "/status.json" || strings.HasPrefix(p, "/status/"):
+		case p == "/" || p == "/status":
+			r2.URL.Path = "/status"
+		default:
+			r2.URL.Path = "/status" + p
+		}
+		next.ServeHTTP(w, r2)
+	})
+}
+
+func requestHost(r *http.Request, trustProxy bool) string {
+	h := r.Host
+	if trustProxy {
+		if f := r.Header.Get("X-Forwarded-Host"); f != "" {
+			h = strings.TrimSpace(strings.Split(f, ",")[0])
+		}
+	}
+	if host, _, err := net.SplitHostPort(h); err == nil {
+		h = host
+	}
+	return strings.ToLower(h)
+}
+
+// pagePrefix is what page links start with: nothing on the custom domain, /status elsewhere.
+func pagePrefix(r *http.Request) string {
+	if on, _ := r.Context().Value(statusHostKey{}).(bool); on {
+		return ""
+	}
+	return "/status"
+}
+
+// absStatusURL is a full address for a page path such as "/history", for emails and feeds.
+// r may be nil, as in a background notification.
+func (s *Server) absStatusURL(r *http.Request, path string) string {
+	if d := s.statusSettings().Domain; d != "" && (r == nil || pagePrefix(r) == "") {
+		return "https://" + d + path
+	}
+	base := s.opts.URL
+	if base == "" && r != nil {
+		scheme := "http"
+		if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" && s.opts.TrustProxy {
+			scheme = "https"
+		}
+		base = scheme + "://" + r.Host
+	}
+	return strings.TrimRight(base, "/") + "/status" + path
+}
+
+// ---------- the public view ----------
+
+type pubComponent struct {
+	ID     string   `json:"id"`
+	Name   string   `json:"name"`
+	Group  string   `json:"group"`
+	Status string   `json:"status"` // the monitor: up, down, pending
+	State  string   `json:"state"`  // what the page says: operational, degraded, partial_outage, major_outage, maintenance, pending
+	Uptime float64  `json:"uptime"`
+	Since  int64    `json:"since"`
+	Days   [][2]int `json:"days"` // [checks, failed] per UTC day, oldest first, ending today
+}
+
+type pubPost struct {
+	Time   int64  `json:"time"`
+	Status string `json:"status"`
+	Text   string `json:"text"`
+}
+
+type pubIncident struct {
+	ID         string    `json:"id"`
+	Title      string    `json:"title"`
+	Status     string    `json:"status"`
+	Severity   string    `json:"severity"`
+	Created    int64     `json:"created"`
+	Resolved   int64     `json:"resolved"`
+	Components []string  `json:"components"` // names
+	Updates    []pubPost `json:"updates"`    // newest first
+}
+
+type pubMaintenance struct {
+	ID         string   `json:"id"`
+	Title      string   `json:"title"`
+	Message    string   `json:"message"`
+	Start      int64    `json:"start"`
+	End        int64    `json:"end"`
+	State      string   `json:"state"`
+	Components []string `json:"components"` // names
+}
+
+// worse ranks component states; a higher number is shown over a lower one.
+var stateRank = map[string]int{"operational": 0, "pending": 0, "maintenance": 1, "degraded": 2, "partial_outage": 3, "major_outage": 4}
+
+func (s *Server) publicComponents() (comps []pubComponent, groups []StatusGroup, names map[string]string) {
+	groups, _ = listOf[StatusGroup](s.st, "sgroup")
+	sort.SliceStable(groups, func(i, j int) bool {
+		if groups[i].Order != groups[j].Order {
+			return groups[i].Order < groups[j].Order
+		}
+		return strings.ToLower(groups[i].Name) < strings.ToLower(groups[j].Name)
+	})
+	rank := map[string]int{"": -1}
+	for i, g := range groups {
+		rank[g.ID] = i
+	}
+	mons, _ := listOf[Monitor](s.st, "monitor")
+	names = map[string]string{}
+	now := s.now()
+	for _, m := range mons {
+		if !m.Public || !m.Enabled {
+			continue
+		}
+		name := firstNonEmpty(strings.TrimSpace(m.PublicName), m.Name)
+		names[m.ID] = name
+		if _, ok := rank[m.Group]; !ok {
+			m.Group = "" // its group was deleted
+		}
+		st := s.monitorState(m.ID)
+		days := s.dailyUptime(m.ID, uptimeDays, now)
+		var checks, fails int
+		for _, d := range days {
+			checks, fails = checks+d[0], fails+d[1]
+		}
+		uptime := -1.0 // no checks yet
+		if checks > 0 {
+			uptime = float64(checks-fails) * 100 / float64(checks)
+		}
+		state := map[string]string{"up": "operational", "down": "major_outage"}[st.Status]
+		if state == "" {
+			state = "pending"
+		}
+		comps = append(comps, pubComponent{ID: m.ID, Name: name, Group: m.Group, Status: st.Status, State: state, Uptime: uptime, Since: st.Since, Days: days})
+	}
+	sort.SliceStable(comps, func(i, j int) bool {
+		if ri, rj := rank[comps[i].Group], rank[comps[j].Group]; ri != rj {
+			return ri < rj
+		}
+		return strings.ToLower(comps[i].Name) < strings.ToLower(comps[j].Name)
+	})
+	return
+}
+
+func (s *Server) publicIncident(in Incident, names map[string]string) pubIncident {
+	out := pubIncident{ID: in.ID, Title: in.Title, Status: in.Status, Severity: in.Severity, Created: in.Created, Resolved: in.Resolved, Components: []string{}, Updates: []pubPost{}}
+	for _, id := range in.Components {
+		if n, ok := names[id]; ok {
+			out.Components = append(out.Components, n)
+		}
+	}
+	for _, e := range s.st.events("incident", in.ID) {
+		if e.Kind == "post" {
+			out.Updates = append(out.Updates, pubPost{Time: e.Time, Status: e.Status, Text: e.Text})
+		}
+	}
+	if len(out.Updates) == 0 { // public, but nothing posted yet: show what we know
+		out.Updates = append(out.Updates, pubPost{Time: in.Created, Status: "investigating", Text: firstNonEmpty(in.Summary, defaultPost("investigating"))})
+	}
+	for i, j := 0, len(out.Updates)-1; i < j; i, j = i+1, j-1 { // newest first
+		out.Updates[i], out.Updates[j] = out.Updates[j], out.Updates[i]
+	}
+	return out
+}
+
+func (s *Server) publicMaintenance(m Maintenance, names map[string]string, now time.Time) pubMaintenance {
+	out := pubMaintenance{ID: m.ID, Title: m.Title, Message: m.Message, Start: m.Start, End: m.End, State: m.state(now), Components: []string{}}
+	for _, id := range m.Components {
+		if n, ok := names[id]; ok {
+			out.Components = append(out.Components, n)
+		}
+	}
+	return out
+}
+
+func (s *Server) loadMaintenance() []Maintenance {
+	list, _ := listOf[Maintenance](s.st, "maintenance")
+	sort.Slice(list, func(i, j int) bool { return list[i].Start > list[j].Start })
+	return list
+}
+
+// statusJSON feeds the public status page: only monitors, incidents and maintenance marked public.
+func (s *Server) statusJSON(w http.ResponseWriter, r *http.Request) {
+	now := s.now()
+	cfg := s.statusSettings()
+	comps, groups, names := s.publicComponents()
+	if groups == nil {
+		groups = []StatusGroup{}
+	}
+	if comps == nil {
+		comps = []pubComponent{}
+	}
+	idx := map[string]int{}
+	for i, c := range comps {
+		idx[c.ID] = i
+	}
+	raise := func(id, state string) {
+		if i, ok := idx[id]; ok && stateRank[state] > stateRank[comps[i].State] {
+			comps[i].State = state
+		}
+	}
+
+	out := struct {
+		Settings    StatusSettings   `json:"settings"`
+		Monitors    []pubComponent   `json:"monitors"`
+		Groups      []StatusGroup    `json:"groups"`
+		Incidents   []pubIncident    `json:"incidents"`
+		Maintenance []pubMaintenance `json:"maintenance"`
+		Overall     string           `json:"overall"`
+		Today       string           `json:"today"` // the UTC date of the last bar
+		Subscribe   map[string]bool  `json:"subscribe"`
+	}{Settings: cfg, Groups: groups, Incidents: []pubIncident{}, Maintenance: []pubMaintenance{}, Today: now.UTC().Format("2006-01-02"),
+		Subscribe: map[string]bool{"email": s.mailEnabled(), "webhook": true, "rss": true}}
+	out.Settings.Domain = "" // not for visitors
+
+	overall := "operational"
+	lift := func(level string) {
+		if level == "outage" || overall == "outage" {
+			overall = "outage"
+		} else if level == "degraded" || overall == "degraded" {
+			overall = "degraded"
+		} else if level == "maintenance" {
+			overall = "maintenance"
+		}
+	}
+
+	incs, _ := listOf[Incident](s.st, "incident")
+	sortIncidents(incs)
+	cut := now.AddDate(0, 0, -14).Unix()
+	for _, in := range incs {
+		if !in.Public || (in.Status == "resolved" && in.Resolved < cut) {
+			continue
+		}
+		out.Incidents = append(out.Incidents, s.publicIncident(in, names))
+		if in.Status == "resolved" {
+			continue
+		}
+		impact := map[string]string{"sev1": "major_outage", "sev2": "partial_outage"}[in.Severity]
+		if impact == "" {
+			impact = "degraded"
+		}
+		for _, id := range in.Components {
+			raise(id, impact)
+		}
+		if impact == "major_outage" && len(in.Components) > 0 {
+			lift("outage")
+		} else {
+			lift("degraded")
+		}
+	}
+
+	for _, m := range s.loadMaintenance() {
+		st := m.state(now)
+		if st == "canceled" || st == "completed" {
+			continue
+		}
+		out.Maintenance = append(out.Maintenance, s.publicMaintenance(m, names, now))
+		if st == "in_progress" {
+			for _, id := range m.Components {
+				if i, ok := idx[id]; ok {
+					comps[i].State = "maintenance" // planned work explains a failing check
+				}
+			}
+			lift("maintenance")
+		}
+	}
+	sort.SliceStable(out.Maintenance, func(i, j int) bool { return out.Maintenance[i].Start < out.Maintenance[j].Start })
+
+	for _, c := range comps {
+		switch c.State {
+		case "major_outage":
+			lift("outage")
+		case "partial_outage", "degraded":
+			lift("degraded")
+		}
+	}
+	out.Monitors, out.Overall = comps, overall
+	w.Header().Set("Cache-Control", "max-age=15")
+	writeJSON(w, 200, out)
+}
+
+type historyEntry struct {
+	Type        string          `json:"type"` // incident or maintenance
+	Time        int64           `json:"time"`
+	Incident    *pubIncident    `json:"incident,omitempty"`
+	Maintenance *pubMaintenance `json:"maintenance,omitempty"`
+}
+
+// historyJSON lists everything that was ever public, newest first, a page at a time.
+// before is the time of the last entry of the previous page.
+func (s *Server) historyJSON(w http.ResponseWriter, r *http.Request) {
+	before, _ := strconv.ParseInt(r.URL.Query().Get("before"), 10, 64)
+	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
+	if limit <= 0 || limit > 100 {
+		limit = 30
+	}
+	now := s.now()
+	_, _, names := s.publicComponents()
+	var all []historyEntry
+	incs, _ := listOf[Incident](s.st, "incident")
+	for _, in := range incs {
+		if in.Public {
+			p := s.publicIncident(in, names)
+			all = append(all, historyEntry{Type: "incident", Time: in.Created, Incident: &p})
+		}
+	}
+	for _, m := range s.loadMaintenance() {
+		if st := m.state(now); st == "completed" || st == "in_progress" {
+			p := s.publicMaintenance(m, names, now)
+			all = append(all, historyEntry{Type: "maintenance", Time: m.Start, Maintenance: &p})
+		}
+	}
+	sort.SliceStable(all, func(i, j int) bool { return all[i].Time > all[j].Time })
+	if before > 0 {
+		k := sort.Search(len(all), func(i int) bool { return all[i].Time < before })
+		all = all[k:]
+	}
+	next := int64(0)
+	if len(all) > limit {
+		all = all[:limit]
+		next = all[limit-1].Time
+	}
+	if all == nil {
+		all = []historyEntry{}
+	}
+	w.Header().Set("Cache-Control", "max-age=15")
+	writeJSON(w, 200, map[string]any{"entries": all, "next": next})
+}
+
+func (s *Server) incidentJSON(w http.ResponseWriter, r *http.Request) {
+	in, err := getOf[Incident](s.st, "incident", r.PathValue("id"))
+	if err != nil || !in.Public {
+		writeJSON(w, 404, map[string]string{"error": "not found"})
+		return
+	}
+	_, _, names := s.publicComponents()
+	w.Header().Set("Cache-Control", "max-age=15")
+	writeJSON(w, 200, s.publicIncident(*in, names))
+}
+
+// servePage fills the page shell with the title and the prefix its links start with.
+func (s *Server) serveStatusPage(w http.ResponseWriter, r *http.Request) {
+	page := strings.NewReplacer("__TITLE__", html.EscapeString(s.statusSettings().Title), "__BASE__", pagePrefix(r)).Replace(string(statusHTML))
+	servePage(w, []byte(page))
+}
+
+func (s *Server) statusRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("GET /status", s.serveStatusPage)
+	mux.HandleFunc("GET /status/history", s.serveStatusPage)
+	mux.HandleFunc("GET /status/incidents/{id}", s.serveStatusPage)
+	mux.HandleFunc("GET /status.json", s.statusJSON)
+	mux.HandleFunc("GET /status/api/history", s.historyJSON)
+	mux.HandleFunc("GET /status/api/incidents/{id}", s.incidentJSON)
+	mux.HandleFunc("GET /status/feed.rss", s.statusFeed)
+	mux.HandleFunc("POST /status/subscribe", s.followStatusHTTP)
+	mux.HandleFunc("GET /status/confirm", s.confirmSubscription)
+	mux.HandleFunc("GET /status/unsubscribe", s.unsubscribeRedirect)
+	mux.HandleFunc("POST /status/unsubscribe", s.unsubscribeHTTP)
+
+	// administration
+	mux.HandleFunc("GET /api/v1/statuspage", s.auth(false, func(w http.ResponseWriter, r *http.Request) {
+		writeJSON(w, 200, map[string]any{"settings": s.statusSettings(), "pageUrl": s.absStatusURL(nil, ""), "feedUrl": s.absStatusURL(nil, "/feed.rss"), "email": s.mailEnabled()})
+	}))
+	mux.HandleFunc("PUT /api/v1/statuspage", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		var c StatusSettings
+		if !decode(r, &c) {
+			bad(w, "invalid request")
+			return
+		}
+		if err := validateStatusSettings(&c, s.opts.URL); err != nil {
+			bad(w, err.Error())
+			return
+		}
+		if err := s.saveStatusSettings(c); err != nil {
+			fail(w, err)
+			return
+		}
+		writeJSON(w, 200, map[string]any{"settings": c, "pageUrl": s.absStatusURL(nil, ""), "feedUrl": s.absStatusURL(nil, "/feed.rss"), "email": s.mailEnabled()})
+	}))
+	s.crud(mux, "status-groups", "sgroup", true, func() any { return &StatusGroup{} }, func(v any, id string) error {
+		g := v.(*StatusGroup)
+		g.ID, g.Name, g.Description = id, strings.TrimSpace(g.Name), strings.TrimSpace(g.Description)
+		if g.Name == "" {
+			return errors.New("give the group a name")
+		}
+		return nil
+	}, nil)
+	s.maintenanceRoutes(mux)
+	mux.HandleFunc("GET /api/v1/status-subscribers", s.auth(true, s.listSubscribers))
+	mux.HandleFunc("DELETE /api/v1/status-subscribers/{id}", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		res, err := s.st.db.Exec(`DELETE FROM subscribers WHERE id=?`, r.PathValue("id"))
+		if n, _ := res.RowsAffected(); err == nil && n == 0 {
+			err = errNotFound
+		}
+		fail2(w, err)
+	}))
+}
+
+// ---------- incident posts ----------
+
+func defaultPost(status string) string {
+	return map[string]string{
+		"investigating": "We are investigating this issue.",
+		"identified":    "The cause has been identified and we are working on a fix.",
+		"monitoring":    "A fix has been applied and we are monitoring the results.",
+		"resolved":      "This incident has been resolved.",
+	}[status]
+}
+
+func cleanIDs(ids []string) []string {
+	out, seen := []string{}, map[string]bool{}
+	for _, id := range ids {
+		if id = strings.TrimSpace(id); id != "" && !seen[id] {
+			seen[id] = true
+			out = append(out, id)
+		}
+	}
+	return out
+}
+
+// postToStatusPage publishes an update of a public incident and tells subscribers. An update is a
+// change of status or a note; making an incident public posts what is known so far. The note is
+// the only text customers see from an update: the internal timeline stays internal.
+func (s *Server) postToStatusPage(in *Incident, wasPublic, statusChanged bool, note string, now time.Time) {
+	if !in.Public {
+		return
+	}
+	note = strings.TrimSpace(note)
+	var text string
+	event := "incident.updated"
+	switch {
+	case !wasPublic:
+		text, event = firstNonEmpty(note, in.Summary, defaultPost(in.Status)), "incident.created"
+		if in.Status == "resolved" {
+			event = "incident.resolved"
+		}
+	case statusChanged || note != "":
+		text = firstNonEmpty(note, defaultPost(in.Status))
+		if statusChanged && in.Status == "resolved" {
+			event = "incident.resolved"
+		}
+	default:
+		return
+	}
+	s.st.addPost(in.ID, in.Status, text, now)
+	s.notifySubscribers(statusNote{Event: event, Title: in.Title, Status: in.Status, Message: text, URL: s.absStatusURL(nil, "/incidents/"+in.ID), Time: now.Unix()})
+}
+
+// ---------- scheduled maintenance ----------
+
+type maintView struct {
+	Maintenance
+	State string `json:"state"`
+}
+
+func (s *Server) validateMaintenance(m *Maintenance, creating bool) error {
+	m.Title, m.Message = strings.TrimSpace(m.Title), strings.TrimSpace(m.Message)
+	if m.Title == "" {
+		return errors.New("give the maintenance a title")
+	}
+	if len(m.Title) > 120 || len(m.Message) > 2000 {
+		return errors.New("the title can be 120 characters and the details 2000")
+	}
+	if m.Start <= 0 || m.End <= m.Start {
+		return errors.New("the maintenance must end after it starts")
+	}
+	if creating && m.End <= s.now().Unix() {
+		return errors.New("the maintenance window is already over")
+	}
+	m.Components = cleanIDs(m.Components)
+	return nil
+}
+
+func (s *Server) maintenanceRoutes(mux *http.ServeMux) {
+	view := func(m Maintenance) maintView { return maintView{m, m.state(s.now())} }
+	mux.HandleFunc("GET /api/v1/maintenance", s.auth(false, func(w http.ResponseWriter, r *http.Request) {
+		out := []maintView{}
+		for _, m := range s.loadMaintenance() {
+			out = append(out, view(m))
+		}
+		writeJSON(w, 200, out)
+	}))
+	mux.HandleFunc("POST /api/v1/maintenance", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		var m Maintenance
+		if !decode(r, &m) {
+			bad(w, "invalid request")
+			return
+		}
+		if err := s.validateMaintenance(&m, true); err != nil {
+			bad(w, err.Error())
+			return
+		}
+		m.ID, m.Created, m.Canceled, m.StartSent, m.EndSent = newID(), s.now().Unix(), false, false, false
+		if err := s.st.put("maintenance", m.ID, m); err != nil {
+			fail(w, err)
+			return
+		}
+		if m.Start > s.now().Unix() {
+			s.announceMaintenance("maintenance.scheduled", m)
+		}
+		writeJSON(w, 200, view(m))
+	}))
+	mux.HandleFunc("PUT /api/v1/maintenance/{id}", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		old, err := getOf[Maintenance](s.st, "maintenance", r.PathValue("id"))
+		if err != nil {
+			fail(w, err)
+			return
+		}
+		m := *old
+		var in Maintenance
+		if !decode(r, &in) {
+			bad(w, "invalid request")
+			return
+		}
+		m.Title, m.Message, m.Start, m.End, m.Components = in.Title, in.Message, in.Start, in.End, in.Components
+		if err := s.validateMaintenance(&m, false); err != nil {
+			bad(w, err.Error())
+			return
+		}
+		if m.Canceled || m.state(s.now()) == "completed" && old.EndSent {
+			bad(w, "that maintenance is over; schedule a new one")
+			return
+		}
+		moved := m.Start != old.Start || m.End != old.End
+		if moved && m.Start > s.now().Unix() {
+			m.StartSent, m.EndSent = false, false
+		}
+		if err := s.st.put("maintenance", m.ID, m); err != nil {
+			fail(w, err)
+			return
+		}
+		if moved && !m.StartSent {
+			s.announceMaintenance("maintenance.rescheduled", m)
+		}
+		writeJSON(w, 200, view(m))
+	}))
+	mux.HandleFunc("POST /api/v1/maintenance/{id}/cancel", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		m, err := getOf[Maintenance](s.st, "maintenance", r.PathValue("id"))
+		if err != nil {
+			fail(w, err)
+			return
+		}
+		if m.Canceled || m.EndSent {
+			bad(w, "that maintenance is already over")
+			return
+		}
+		m.Canceled = true
+		if err := s.st.put("maintenance", m.ID, m); err != nil {
+			fail(w, err)
+			return
+		}
+		s.announceMaintenance("maintenance.canceled", *m)
+		writeJSON(w, 200, view(*m))
+	}))
+	mux.HandleFunc("DELETE /api/v1/maintenance/{id}", s.auth(true, func(w http.ResponseWriter, r *http.Request) {
+		fail2(w, s.st.del("maintenance", r.PathValue("id")))
+	}))
+}
+
+func (s *Server) announceMaintenance(event string, m Maintenance) {
+	when := fmtWindow(m.Start, m.End)
+	msg := map[string]string{
+		"maintenance.scheduled":   "Scheduled maintenance: " + when + ".",
+		"maintenance.rescheduled": "The maintenance window has changed: " + when + ".",
+		"maintenance.started":     "Maintenance has started and is planned to finish by " + time.Unix(m.End, 0).UTC().Format("15:04 UTC") + ".",
+		"maintenance.completed":   "Maintenance is complete.",
+		"maintenance.canceled":    "This maintenance has been canceled.",
+	}[event]
+	if m.Message != "" && event != "maintenance.completed" {
+		msg += "\n\n" + m.Message
+	}
+	status := strings.TrimPrefix(event, "maintenance.")
+	s.notifySubscribers(statusNote{Event: event, Title: m.Title, Status: status, Message: msg, URL: s.absStatusURL(nil, ""), Time: s.now().Unix()})
+}
+
+func fmtWindow(from, to int64) string {
+	f, t := time.Unix(from, 0).UTC(), time.Unix(to, 0).UTC()
+	if f.YearDay() == t.YearDay() && f.Year() == t.Year() {
+		return f.Format("Jan 2, 2006, 15:04") + " to " + t.Format("15:04 UTC")
+	}
+	return f.Format("Jan 2, 2006, 15:04") + " to " + t.Format("Jan 2, 2006, 15:04 UTC")
+}
+
+// runMaintenance tells subscribers when windows begin and end.
+func (s *Server) runMaintenance(now time.Time) {
+	for _, m := range s.loadMaintenance() {
+		if m.Canceled || m.EndSent {
+			continue
+		}
+		t, changed := now.Unix(), false
+		if !m.StartSent && t >= m.Start {
+			m.StartSent, changed = true, true
+			if t < m.End { // a window missed entirely, such as while Sandbar was down, is not announced
+				s.announceMaintenance("maintenance.started", m)
+			} else {
+				m.EndSent = true
+			}
+		}
+		if t >= m.End && !m.EndSent {
+			m.EndSent, changed = true, true
+			s.announceMaintenance("maintenance.completed", m)
+		}
+		if changed {
+			s.st.put("maintenance", m.ID, m)
+		}
+	}
+}

internal/sandbar/statuspage_test.go

@@ -0,0 +1,700 @@
+package sandbar
+
+import (
+	"encoding/json"
+	"encoding/xml"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+type sentMail struct{ to, subject, body string }
+
+type mailBox struct {
+	mu   sync.Mutex
+	sent []sentMail
+}
+
+func (m *mailBox) send(to, subject, body string) error {
+	m.mu.Lock()
+	m.sent = append(m.sent, sentMail{to, subject, body})
+	m.mu.Unlock()
+	return nil
+}
+
+func (m *mailBox) all() []sentMail {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return append([]sentMail(nil), m.sent...)
+}
+
+func statusTestServer(t *testing.T) (*Server, *fakeClock, *mailBox, *httptest.Server) {
+	t.Helper()
+	s, clk, _ := newTestServer(t)
+	mb := &mailBox{}
+	s.opts.Mailer = mb.send
+	ts := httptest.NewServer(s.Handler())
+	t.Cleanup(ts.Close)
+	return s, clk, mb, ts
+}
+
+func getJSON(t *testing.T, url string, v any) int {
+	t.Helper()
+	resp, err := http.Get(url)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if v != nil {
+		json.NewDecoder(resp.Body).Decode(v)
+	}
+	return resp.StatusCode
+}
+
+func postJSON(t *testing.T, url string, body any) (int, map[string]string) {
+	t.Helper()
+	b, _ := json.Marshal(body)
+	resp, err := http.Post(url, "application/json", strings.NewReader(string(b)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	var out map[string]string
+	json.NewDecoder(resp.Body).Decode(&out)
+	return resp.StatusCode, out
+}
+
+type statusDoc struct {
+	Settings    StatusSettings `json:"settings"`
+	Overall     string
+	Groups      []StatusGroup
+	Monitors    []pubComponent
+	Incidents   []pubIncident
+	Maintenance []pubMaintenance
+	Subscribe   map[string]bool
+}
+
+func TestStatusSettingsValidation(t *testing.T) {
+	cases := []struct {
+		name string
+		in   StatusSettings
+		ok   bool
+	}{
+		{"empty gets a title", StatusSettings{}, true},
+		{"domain", StatusSettings{Domain: "Status.Example.com"}, true},
+		{"domain with scheme", StatusSettings{Domain: "https://status.example.com"}, false},
+		{"domain with path", StatusSettings{Domain: "status.example.com/x"}, false},
+		{"single label", StatusSettings{Domain: "localhost"}, false},
+		{"own address", StatusSettings{Domain: "sandbar.test"}, false},
+		{"http logo", StatusSettings{LogoURL: "http://x.test/a.png"}, false},
+		{"https logo", StatusSettings{LogoURL: "https://x.test/a.png"}, true},
+		{"javascript support link", StatusSettings{SupportURL: "javascript:alert(1)"}, false},
+		{"mailto support link", StatusSettings{SupportURL: "mailto:help@example.com"}, true},
+		{"accent", StatusSettings{Accent: "#1F5C5C"}, true},
+		{"accent too light for white text", StatusSettings{Accent: "#ffee00"}, false},
+		{"accent not a hex color", StatusSettings{Accent: "teal"}, false},
+		{"title too long", StatusSettings{Title: strings.Repeat("x", 81)}, false},
+	}
+	for _, c := range cases {
+		err := validateStatusSettings(&c.in, "https://sandbar.test")
+		if (err == nil) != c.ok {
+			t.Errorf("%s: err = %v, want ok=%v", c.name, err, c.ok)
+		}
+	}
+	c := StatusSettings{Domain: "Status.Example.com", Accent: "#1F5C5C"}
+	validateStatusSettings(&c, "")
+	if c.Domain != "status.example.com" || c.Accent != "#1f5c5c" || c.Title != "Status" {
+		t.Fatalf("not normalised: %+v", c)
+	}
+	if r := contrastWithWhite("#000000"); r < 20.9 || r > 21.1 {
+		t.Fatalf("black on white is 21:1, got %.2f", r)
+	}
+}
+
+// Components sit in groups, take their state from monitors, incidents and maintenance, and the
+// banner shows the worst of them.
+func TestStatusPageComponentsAndOverall(t *testing.T) {
+	s, clk, _, ts := statusTestServer(t)
+	s.st.put("sgroup", "g2", &StatusGroup{ID: "g2", Name: "Apps", Order: 2})
+	s.st.put("sgroup", "g1", &StatusGroup{ID: "g1", Name: "Infrastructure", Order: 1})
+	s.st.put("monitor", "web", &Monitor{ID: "web", Name: "web-1", PublicName: "Website", Kind: "http", Target: "http://x", Enabled: true, Public: true, Group: "g2"})
+	s.st.put("monitor", "db", &Monitor{ID: "db", Name: "Database", Kind: "tcp", Target: "x:1", Enabled: true, Public: true, Group: "g1"})
+	s.st.put("monitor", "old", &Monitor{ID: "old", Name: "Orphan", Kind: "tcp", Target: "x:1", Enabled: true, Public: true, Group: "deleted"})
+	s.st.put("monitor", "hid", &Monitor{ID: "hid", Name: "Hidden", Kind: "tcp", Target: "x:1", Enabled: true, Group: "g1"})
+	for _, id := range []string{"web", "db", "old", "hid"} {
+		s.saveState(MonitorState{MonitorID: id, Status: "up", Since: clk.Now().Unix()})
+	}
+
+	var d statusDoc
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Overall != "operational" || len(d.Monitors) != 3 {
+		t.Fatalf("all up: %+v", d)
+	}
+	if got := []string{d.Monitors[0].ID, d.Monitors[1].ID, d.Monitors[2].ID}; got[0] != "old" && got[0] != "db" {
+		t.Fatalf("order %v", got)
+	}
+	// ungrouped (a deleted group counts as none) first, then groups by order; the public name wins
+	if d.Monitors[0].ID != "old" || d.Monitors[0].Group != "" || d.Monitors[1].ID != "db" || d.Monitors[2].Name != "Website" {
+		t.Fatalf("order or names wrong: %+v", d.Monitors)
+	}
+	if len(d.Groups) != 2 || d.Groups[0].ID != "g1" {
+		t.Fatalf("groups: %+v", d.Groups)
+	}
+
+	// A sev2 incident on one component makes only that one partially down.
+	s.st.put("incident", "i1", &Incident{ID: "i1", Title: "Slow pages", Severity: "sev2", Status: "identified", Public: true, Created: clk.Now().Unix(), Components: []string{"web"}})
+	getJSON(t, ts.URL+"/status.json", &d)
+	states := map[string]string{}
+	for _, c := range d.Monitors {
+		states[c.ID] = c.State
+	}
+	if states["web"] != "partial_outage" || states["db"] != "operational" || d.Overall != "degraded" {
+		t.Fatalf("sev2: %v overall %s", states, d.Overall)
+	}
+	if len(d.Incidents) != 1 || len(d.Incidents[0].Components) != 1 || d.Incidents[0].Components[0] != "Website" {
+		t.Fatalf("incident components should be public names: %+v", d.Incidents)
+	}
+
+	// A failing monitor is a major outage.
+	s.saveState(MonitorState{MonitorID: "db", Status: "down", Since: clk.Now().Unix()})
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Overall != "outage" {
+		t.Fatalf("overall = %s", d.Overall)
+	}
+
+	// Maintenance in progress explains the failure instead of showing an outage.
+	start := clk.Now().Add(-time.Minute).Unix()
+	s.st.put("maintenance", "m1", &Maintenance{ID: "m1", Title: "Database upgrade", Start: start, End: start + 3600, Components: []string{"db"}, StartSent: true})
+	s.st.put("incident", "i1", &Incident{ID: "i1", Title: "Slow pages", Severity: "sev2", Status: "resolved", Resolved: clk.Now().Unix(), Public: true, Created: clk.Now().Unix()})
+	getJSON(t, ts.URL+"/status.json", &d)
+	for _, c := range d.Monitors {
+		states[c.ID] = c.State
+	}
+	if states["db"] != "maintenance" || d.Overall != "maintenance" || len(d.Maintenance) != 1 || d.Maintenance[0].State != "in_progress" {
+		t.Fatalf("maintenance: %v overall %s %+v", states, d.Overall, d.Maintenance)
+	}
+
+	// Once the window is over, the failure shows again, and the window moves to the history.
+	clk.Advance(2 * time.Hour)
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Overall != "outage" || len(d.Maintenance) != 0 {
+		t.Fatalf("after maintenance: %s %+v", d.Overall, d.Maintenance)
+	}
+}
+
+// Customers see the posts written for them. Internal comments, names and private incidents stay out.
+func TestIncidentPostsArePublicAndInternalNotesAreNot(t *testing.T) {
+	s, _, _, ts := statusTestServer(t)
+	u := mustUser(t, s, "Alice")
+	s.st.put("monitor", "web", &Monitor{ID: "web", Name: "Website", Kind: "http", Target: "http://x", Enabled: true, Public: true})
+
+	hidden, _ := s.DeclareIncident("Secret outage", "sev1", "internal only", u.ID, u.Name, nil)
+	inc, _ := s.DeclareIncident("Checkout errors", "sev2", "Some orders fail.", u.ID, u.Name, nil)
+	s.CommentIncident(inc.ID, u.Name, "ALICE-INTERNAL-COMMENT")
+	if code := getJSON(t, ts.URL+"/status/api/incidents/"+inc.ID, nil); code != 404 {
+		t.Fatalf("a private incident is public: %d", code)
+	}
+
+	yes, comps := true, []string{"web"}
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes, Components: &comps})
+	ident, mon, done := "identified", "monitoring", "resolved"
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &ident, Note: "A bad deploy is the cause."})
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &mon})
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Note: "Rolled back; watching error rates."})
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &done})
+
+	var pi pubIncident
+	if code := getJSON(t, ts.URL+"/status/api/incidents/"+inc.ID, &pi); code != 200 {
+		t.Fatalf("public incident: %d", code)
+	}
+	var texts, statuses []string
+	for _, p := range pi.Updates {
+		texts, statuses = append(texts, p.Text), append(statuses, p.Status)
+	}
+	// newest first
+	wantStatus := []string{"resolved", "monitoring", "monitoring", "identified", "investigating"}
+	if strings.Join(statuses, ",") != strings.Join(wantStatus, ",") {
+		t.Fatalf("statuses %v, want %v", statuses, wantStatus)
+	}
+	if texts[0] != defaultPost("resolved") || texts[1] != "Rolled back; watching error rates." || texts[3] != "A bad deploy is the cause." || texts[4] != "Some orders fail." {
+		t.Fatalf("texts: %q", texts)
+	}
+	raw, _ := json.Marshal(pi)
+	for _, leak := range []string{"ALICE-INTERNAL-COMMENT", "Alice", "alice@", "Secret outage", "bad deploy is the cause by"} {
+		if strings.Contains(string(raw), leak) {
+			t.Fatalf("public incident leaks %q: %s", leak, raw)
+		}
+	}
+	var h struct {
+		Entries []historyEntry
+		Next    int64
+	}
+	getJSON(t, ts.URL+"/status/api/history", &h)
+	if len(h.Entries) != 1 || h.Entries[0].Incident.ID != inc.ID {
+		t.Fatalf("history should hold only the public incident, not %s: %+v", hidden.ID, h.Entries)
+	}
+}
+
+func TestHistoryPaging(t *testing.T) {
+	s, clk, _, ts := statusTestServer(t)
+	for i := 0; i < 5; i++ {
+		id := string(rune('a' + i))
+		s.st.put("incident", id, &Incident{ID: id, Title: "Incident " + id, Severity: "sev3", Status: "resolved", Public: true, Created: clk.Now().Unix() - int64(i)*100, Resolved: clk.Now().Unix()})
+	}
+	var h struct {
+		Entries []historyEntry
+		Next    int64
+	}
+	getJSON(t, ts.URL+"/status/api/history?limit=2", &h)
+	if len(h.Entries) != 2 || h.Entries[0].Incident.ID != "a" || h.Next == 0 {
+		t.Fatalf("page 1: %+v", h)
+	}
+	var seen []string
+	for next := int64(1); next != 0; {
+		getJSON(t, ts.URL+"/status/api/history?limit=2&before="+itoa(h.Next), &h)
+		for _, e := range h.Entries {
+			seen = append(seen, e.Incident.ID)
+		}
+		next = h.Next
+		if len(seen) > 10 {
+			t.Fatal("paging does not end")
+		}
+	}
+	if strings.Join(seen, "") != "cde" {
+		t.Fatalf("later pages %v", seen)
+	}
+}
+
+func itoa(n int64) string { b, _ := json.Marshal(n); return string(b) }
+
+var linkRe = regexp.MustCompile(`https?://\S+`)
+
+func TestEmailSubscriptionFlow(t *testing.T) {
+	s, _, mb, ts := statusTestServer(t)
+	u := mustUser(t, s, "Alice")
+	s.saveStatusSettings(StatusSettings{Title: "Acme status"})
+
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "not an address"}); code != 400 {
+		t.Fatalf("bad address: %d", code)
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "Bob <bob@example.com>"}); code != 400 {
+		t.Fatalf("display name accepted: %d", code)
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "bob@example.com"}); code != 200 {
+		t.Fatalf("subscribe: %d", code)
+	}
+	mails := mb.all()
+	if len(mails) != 1 || mails[0].to != "bob@example.com" || !strings.Contains(mails[0].subject, "Confirm") {
+		t.Fatalf("confirmation mail: %+v", mails)
+	}
+	confirm := linkRe.FindString(mails[0].body)
+
+	// Not confirmed yet: updates go nowhere.
+	yes := true
+	inc, _ := s.DeclareIncident("API errors", "sev2", "Elevated errors.", u.ID, u.Name, nil)
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes})
+	s.notifyWG.Wait()
+	if n := len(mb.all()); n != 1 {
+		t.Fatalf("an unconfirmed address got %d mails", n)
+	}
+
+	// A forged link does nothing; the real one confirms and sends the visitor to the page.
+	noRedirect := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
+	forged := confirm[:len(confirm)-1] + "z"
+	if resp, _ := noRedirect.Get(strings.Replace(forged, "http://sandbar.test", ts.URL, 1)); resp.Header.Get("Location") != "/status/?notice=invalid" {
+		t.Fatalf("forged link: %v", resp.Header.Get("Location"))
+	}
+	resp, _ := noRedirect.Get(strings.Replace(confirm, "http://sandbar.test", ts.URL, 1))
+	if resp.StatusCode != 303 || resp.Header.Get("Location") != "/status/?notice=confirmed" {
+		t.Fatalf("confirm: %d %s", resp.StatusCode, resp.Header.Get("Location"))
+	}
+	if !strings.HasPrefix(confirm, "http://sandbar.test/status/confirm?token=") {
+		t.Fatalf("confirm link: %s", confirm)
+	}
+
+	// Subscribing again says the same thing and sends nothing more.
+	postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "bob@example.com"})
+	if n := len(mb.all()); n != 1 {
+		t.Fatalf("re-subscribing a confirmed address sent mail: %d", n)
+	}
+
+	fixed := "resolved"
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &fixed, Note: "Fixed."})
+	s.notifyWG.Wait()
+	mails = mb.all()
+	if len(mails) != 2 || mails[1].subject != "[Acme status] Resolved: API errors" || !strings.Contains(mails[1].body, "Fixed.") ||
+		!strings.Contains(mails[1].body, "http://sandbar.test/status/incidents/"+inc.ID) {
+		t.Fatalf("update mail: %+v", mails)
+	}
+
+	// The unsubscribe link needs a click on the page; a GET alone changes nothing.
+	unsub := linkRe.FindString(mails[1].body[strings.Index(mails[1].body, "Unsubscribe:"):])
+	resp, _ = noRedirect.Get(strings.Replace(unsub, "http://sandbar.test", ts.URL, 1))
+	if resp.StatusCode != 303 || !strings.HasPrefix(resp.Header.Get("Location"), "/status/?unsubscribe=") {
+		t.Fatalf("unsubscribe redirect: %d %s", resp.StatusCode, resp.Header.Get("Location"))
+	}
+	token, _ := url.Parse(unsub)
+	if code, _ := postJSON(t, ts.URL+"/status/unsubscribe", map[string]string{"token": "x.y"}); code != 400 {
+		t.Fatalf("bad token: %d", code)
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/unsubscribe", map[string]string{"token": token.Query().Get("token")}); code != 200 {
+		t.Fatalf("unsubscribe: %d", code)
+	}
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Note: "More detail."})
+	s.notifyWG.Wait()
+	if n := len(mb.all()); n != 2 {
+		t.Fatalf("an unsubscribed address got mail: %d", n)
+	}
+}
+
+func TestEmailSubscriptionsNeedMailAndAreRateLimited(t *testing.T) {
+	s, _, _, ts := statusTestServer(t)
+	s.opts.Mailer = nil // no SMTP configured
+	var d statusDoc
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Subscribe["email"] {
+		t.Fatal("email offered with no SMTP server")
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"email": "a@example.com"}); code != 400 {
+		t.Fatalf("email accepted without SMTP: %d", code)
+	}
+	for i := 0; i < 10; i++ {
+		postJSON(t, ts.URL+"/status/subscribe", map[string]string{"webhook": "nonsense"})
+	}
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"webhook": "nonsense"}); code != 429 {
+		t.Fatalf("no rate limit: %d", code)
+	}
+}
+
+func TestWebhookSubscription(t *testing.T) {
+	s, _, _, ts := statusTestServer(t)
+	u := mustUser(t, s, "Alice")
+	var mu sync.Mutex
+	var got []map[string]any
+	status := 200
+	hook := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var m map[string]any
+		json.NewDecoder(r.Body).Decode(&m)
+		mu.Lock()
+		got = append(got, m)
+		w.WriteHeader(status)
+		mu.Unlock()
+	}))
+	defer hook.Close()
+	s.opts.HTTPClient = hook.Client() // tests stand in for the guarded client, which refuses loopback
+
+	status = 500
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"webhook": hook.URL}); code != 400 {
+		t.Fatalf("a webhook that fails its test was accepted: %d", code)
+	}
+	status = 200
+	if code, _ := postJSON(t, ts.URL+"/status/subscribe", map[string]string{"webhook": hook.URL}); code != 200 {
+		t.Fatalf("subscribe: %d", code)
+	}
+	yes := true
+	inc, _ := s.DeclareIncident("DNS trouble", "sev1", "Lookups fail.", u.ID, u.Name, nil)
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes})
+	s.notifyWG.Wait()
+
+	mu.Lock()
+	defer mu.Unlock()
+	last := got[len(got)-1]
+	if last["event"] != "incident.created" || last["title"] != "DNS trouble" || last["status"] != "investigating" || last["message"] != "Lookups fail." ||
+		!strings.Contains(last["url"].(string), "/status/incidents/"+inc.ID) || !strings.Contains(last["unsubscribe"].(string), "/status/unsubscribe?token=") {
+		t.Fatalf("webhook payload: %v", last)
+	}
+	if got[len(got)-2]["event"] != "subscription.created" {
+		t.Fatalf("first request should be the test: %v", got)
+	}
+}
+
+func TestMaintenanceLifecycleNotifiesSubscribers(t *testing.T) {
+	s, clk, mb, _ := statusTestServer(t)
+	s.addSubscriber("email", "bob@example.com", true)
+	start := clk.Now().Add(2 * time.Hour)
+	m := Maintenance{ID: "m1", Title: "Network upgrade", Message: "Brief packet loss.", Start: start.Unix(), End: start.Add(time.Hour).Unix(), Created: clk.Now().Unix()}
+	s.st.put("maintenance", m.ID, m)
+	s.announceMaintenance("maintenance.scheduled", m)
+	s.notifyWG.Wait()
+
+	s.runMaintenance(clk.Now()) // before the window: nothing
+	clk.Advance(2*time.Hour + time.Minute)
+	s.runMaintenance(clk.Now())
+	s.runMaintenance(clk.Now()) // a second pass must not repeat itself
+	clk.Advance(time.Hour)
+	s.runMaintenance(clk.Now())
+	s.notifyWG.Wait()
+
+	var subjects []string
+	for _, ml := range mb.all() {
+		subjects = append(subjects, ml.subject)
+	}
+	want := []string{"[Status] Scheduled maintenance: Network upgrade", "[Status] Maintenance started: Network upgrade", "[Status] Maintenance complete: Network upgrade"}
+	if strings.Join(subjects, "|") != strings.Join(want, "|") {
+		t.Fatalf("mails %q, want %q", subjects, want)
+	}
+	if body := mb.all()[0].body; !strings.Contains(body, "Brief packet loss.") || !strings.Contains(body, "Jan 5, 2026, 11:00 to 12:00 UTC") {
+		t.Fatalf("scheduled mail: %s", body)
+	}
+
+	// A window that passes while Sandbar is stopped is not announced after the fact.
+	s.st.put("maintenance", "m2", &Maintenance{ID: "m2", Title: "Missed", Start: clk.Now().Add(-3 * time.Hour).Unix(), End: clk.Now().Add(-2 * time.Hour).Unix()})
+	before := len(mb.all())
+	s.runMaintenance(clk.Now())
+	s.notifyWG.Wait()
+	if len(mb.all()) != before {
+		t.Fatal("a missed window was announced")
+	}
+}
+
+func TestMaintenanceAdminAPI(t *testing.T) {
+	s, clk, _, ts := statusTestServer(t)
+	c := newAPIClient(t, ts)
+	c.setup()
+	_ = s
+	now := clk.Now()
+	body := map[string]any{"title": "Upgrade", "message": "m", "start": now.Add(time.Hour).Unix(), "end": now.Add(2 * time.Hour).Unix(), "components": []string{"a", "a", " "}}
+	var created maintView
+	if code := c.do("POST", "/api/v1/maintenance", body, &created); code != 200 || created.State != "scheduled" || len(created.Components) != 1 {
+		t.Fatalf("create: %d %+v", code, created)
+	}
+	if code := c.do("POST", "/api/v1/maintenance", map[string]any{"title": "x", "start": now.Unix() + 10, "end": now.Unix() + 5}, nil); code != 400 {
+		t.Fatalf("end before start: %d", code)
+	}
+	if code := c.do("POST", "/api/v1/maintenance", map[string]any{"title": "x", "start": now.Unix() - 100, "end": now.Unix() - 50}, nil); code != 400 {
+		t.Fatalf("window already over: %d", code)
+	}
+	body["title"] = "Upgrade, moved"
+	if code := c.do("PUT", "/api/v1/maintenance/"+created.ID, body, &created); code != 200 || created.Title != "Upgrade, moved" {
+		t.Fatalf("update: %d %+v", code, created)
+	}
+	if code := c.do("POST", "/api/v1/maintenance/"+created.ID+"/cancel", nil, &created); code != 200 || created.State != "canceled" {
+		t.Fatalf("cancel: %d %+v", code, created)
+	}
+	if code := c.do("POST", "/api/v1/maintenance/"+created.ID+"/cancel", nil, nil); code != 400 {
+		t.Fatalf("second cancel: %d", code)
+	}
+	var d statusDoc
+	getJSON(t, ts.URL+"/status.json", &d)
+	if len(d.Maintenance) != 0 {
+		t.Fatalf("a canceled window is still listed: %+v", d.Maintenance)
+	}
+	if code := newAPIClient(t, ts).do("POST", "/api/v1/maintenance", body, nil); code != 401 {
+		t.Fatalf("anonymous create: %d", code)
+	}
+}
+
+func TestStatusSettingsAPIAndBranding(t *testing.T) {
+	_, _, _, ts := statusTestServer(t)
+	c := newAPIClient(t, ts)
+	c.setup()
+	if code := c.do("PUT", "/api/v1/statuspage", StatusSettings{Title: "Acme", Accent: "#ffee00"}, nil); code != 400 {
+		t.Fatalf("low contrast accent: %d", code)
+	}
+	if code := c.do("PUT", "/api/v1/statuspage", StatusSettings{Title: "Acme <Status>", Description: "Live status", Accent: "#0b5394", LogoURL: "https://acme.test/logo.svg", Domain: "status.acme.test"}, nil); code != 200 {
+		t.Fatalf("save: %d", code)
+	}
+	var d statusDoc
+	getJSON(t, ts.URL+"/status.json", &d)
+	if d.Settings.Title != "Acme <Status>" || d.Settings.Accent != "#0b5394" || d.Settings.Domain != "" {
+		t.Fatalf("public settings: %+v", d.Settings)
+	}
+	resp, _ := http.Get(ts.URL + "/status")
+	page, _ := io.ReadAll(resp.Body)
+	if !strings.Contains(string(page), "<title>Acme &lt;Status&gt;</title>") || strings.Contains(string(page), "__") {
+		t.Fatalf("page shell: %s", page[:300])
+	}
+	if csp := resp.Header.Get("Content-Security-Policy"); !strings.Contains(csp, "img-src 'self' data: https:") {
+		t.Fatalf("a logo needs img-src https: on the status page: %s", csp)
+	}
+	resp, _ = http.Get(ts.URL + "/")
+	if csp := resp.Header.Get("Content-Security-Policy"); strings.Contains(csp, "https:") {
+		t.Fatalf("the admin app should not allow remote images: %s", csp)
+	}
+}
+
+// The custom domain serves the status page at its root and nothing else.
+func TestCustomDomain(t *testing.T) {
+	s, _, mb, ts := statusTestServer(t)
+	s.saveStatusSettings(StatusSettings{Title: "Acme status", Domain: "status.acme.test"})
+	s.st.put("monitor", "web", &Monitor{ID: "web", Name: "Website", Kind: "http", Target: "http://x", Enabled: true, Public: true})
+	u := mustUser(t, s, "Alice")
+	yes := true
+	inc, _ := s.DeclareIncident("Outage", "sev2", "Down.", u.ID, u.Name, nil)
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes})
+
+	get := func(host, path string) (int, string) {
+		req, _ := http.NewRequest("GET", ts.URL+path, nil)
+		req.Host = host
+		resp, err := (&http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}).Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		b, _ := io.ReadAll(resp.Body)
+		return resp.StatusCode, string(b)
+	}
+	host := "Status.Acme.Test:443"
+	if code, body := get(host, "/"); code != 200 || !strings.Contains(body, "<title>Acme status</title>") || !strings.Contains(body, "const BASE = '';") {
+		t.Fatalf("root on the custom domain: %d %.200s", code, body)
+	}
+	for _, path := range []string{"/history", "/incidents/" + inc.ID} {
+		if code, body := get(host, path); code != 200 || !strings.Contains(body, "<main") {
+			t.Fatalf("%s: %d", path, code)
+		}
+	}
+	if code, body := get(host, "/status.json"); code != 200 || !strings.Contains(body, "Website") {
+		t.Fatalf("status.json: %d", code)
+	}
+	if code, body := get(host, "/feed.rss"); code != 200 || !strings.Contains(body, "<rss") {
+		t.Fatalf("feed: %d", code)
+	}
+	for _, path := range []string{"/api/v1/users", "/healthz", "/metrics", "/alerts/sse", "/script.js", "/statusx"} {
+		if code, _ := get(host, path); code != 404 {
+			t.Fatalf("%s should not exist on the status domain, got %d", path, code)
+		}
+	}
+	// On Sandbar's own address the app is where it was, and the status page stays under /status.
+	if code, body := get("sandbar.test", "/"); code != 200 || !strings.Contains(body, "Sandbar") {
+		t.Fatalf("admin root: %d", code)
+	}
+	if code, body := get("sandbar.test", "/status"); code != 200 || !strings.Contains(body, "const BASE = '/status';") {
+		t.Fatalf("own address: %d", code)
+	}
+
+	// Subscriber links point at the custom domain; the redirect after confirming stays on it.
+	s.opts.URL = "https://sandbar.test"
+	s.addSubscriber("email", "bob@example.com", true)
+	s.notifyWG.Wait()
+	n := len(mb.all())
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Note: "Still working."})
+	s.notifyWG.Wait()
+	mails := mb.all()
+	if len(mails) != n+1 || !strings.Contains(mails[n].body, "https://status.acme.test/incidents/"+inc.ID) || !strings.Contains(mails[n].body, "https://status.acme.test/unsubscribe?token=") {
+		t.Fatalf("links in mail: %+v", mails[n:])
+	}
+	req, _ := http.NewRequest("POST", ts.URL+"/status/subscribe", strings.NewReader(`{"email":"carol@example.com"}`))
+	req.Host = "status.acme.test"
+	http.DefaultClient.Do(req)
+	conf := mb.all()[len(mb.all())-1]
+	if !strings.Contains(conf.body, "https://status.acme.test/confirm?token=") {
+		t.Fatalf("confirm link: %s", conf.body)
+	}
+	req, _ = http.NewRequest("GET", ts.URL+strings.TrimPrefix(linkRe.FindString(conf.body), "https://status.acme.test"), nil)
+	req.Host = "status.acme.test"
+	resp, _ := (&http.Client{CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}).Do(req)
+	if resp.Header.Get("Location") != "/?notice=confirmed" {
+		t.Fatalf("confirming on the custom domain should stay on it, got %s", resp.Header.Get("Location"))
+	}
+}
+
+func TestFeedIsValidRSS(t *testing.T) {
+	s, clk, _, ts := statusTestServer(t)
+	u := mustUser(t, s, "Alice")
+	s.saveStatusSettings(StatusSettings{Title: "Acme status"})
+	yes := true
+	inc, _ := s.DeclareIncident("Login <broken> & slow", "sev2", "We are looking.", u.ID, u.Name, nil)
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Public: &yes})
+	clk.Advance(10 * time.Minute)
+	done := "resolved"
+	s.UpdateIncident(inc.ID, u.Name, IncidentPatch{Status: &done, Note: "All good."})
+	hidden, _ := s.DeclareIncident("Private thing", "sev3", "", u.ID, u.Name, nil)
+	_ = hidden
+	s.st.put("maintenance", "m", &Maintenance{ID: "m", Title: "Planned", Start: clk.Now().Add(time.Hour).Unix(), End: clk.Now().Add(2 * time.Hour).Unix(), Created: clk.Now().Unix()})
+
+	resp, err := http.Get(ts.URL + "/status/feed.rss")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if ct := resp.Header.Get("Content-Type"); !strings.HasPrefix(ct, "application/rss+xml") {
+		t.Fatalf("content type %s", ct)
+	}
+	var feed struct {
+		Channel struct {
+			Title string `xml:"title"`
+			Link  string `xml:"link"`
+			Items []struct {
+				Title       string `xml:"title"`
+				Link        string `xml:"link"`
+				GUID        string `xml:"guid"`
+				PubDate     string `xml:"pubDate"`
+				Description string `xml:"description"`
+			} `xml:"item"`
+		} `xml:"channel"`
+	}
+	if err := xml.NewDecoder(resp.Body).Decode(&feed); err != nil {
+		t.Fatalf("not XML: %v", err)
+	}
+	c := feed.Channel
+	if c.Title != "Acme status" || c.Link != "http://sandbar.test/status" || len(c.Items) != 3 {
+		t.Fatalf("channel: %+v", c)
+	}
+	var resolved bool
+	for _, it := range c.Items {
+		if strings.Contains(it.Title, "Private") {
+			t.Fatal("private incident in feed")
+		}
+		if it.Title == "Resolved: Login <broken> & slow" && it.Description == "All good." && it.Link == "http://sandbar.test/status/incidents/"+inc.ID {
+			resolved = true
+		}
+		if _, err := time.Parse(time.RFC1123Z, it.PubDate); err != nil {
+			t.Fatalf("pubDate %q: %v", it.PubDate, err)
+		}
+	}
+	if !resolved {
+		t.Fatalf("resolved item missing: %+v", c.Items)
+	}
+}
+
+// Declaring with public set goes live and tells subscribers in one step; existing databases with
+// events from before posts existed still load.
+func TestDeclarePublicAndLegacyEvents(t *testing.T) {
+	s, _, mb, ts := statusTestServer(t)
+	c := newAPIClient(t, ts)
+	c.setup()
+	s.addSubscriber("email", "bob@example.com", true)
+	var inc Incident
+	if code := c.do("POST", "/api/v1/incidents", map[string]any{"title": "Slow", "severity": "sev3", "summary": "Pages are slow.", "public": true, "components": []string{"x"}}, &inc); code != 200 || !inc.Public {
+		t.Fatalf("declare: %d %+v", code, inc)
+	}
+	s.notifyWG.Wait()
+	if m := mb.all(); len(m) != 1 || !strings.Contains(m[0].subject, "New incident: Slow") {
+		t.Fatalf("mails: %+v", m)
+	}
+	// Old rows: an events table without the status column is upgraded in place and keeps its rows.
+	s.st.db.Exec(`DROP TABLE events`)
+	s.st.db.Exec(`CREATE TABLE events (id INTEGER PRIMARY KEY AUTOINCREMENT, scope TEXT NOT NULL, ref TEXT NOT NULL, time INTEGER NOT NULL, kind TEXT NOT NULL, actor TEXT NOT NULL, text TEXT NOT NULL)`)
+	s.st.db.Exec(`INSERT INTO events(scope,ref,time,kind,actor,text) VALUES('incident','x',1,'update','a','t')`)
+	s.st.db.Exec(`ALTER TABLE events ADD COLUMN status TEXT NOT NULL DEFAULT ''`)
+	if ev := s.st.events("incident", "x"); len(ev) != 1 || ev[0].Status != "" {
+		t.Fatalf("events: %+v", ev)
+	}
+}
+
+func TestPruneForgetsStaleUnconfirmedSubscribers(t *testing.T) {
+	s, clk, _, _ := statusTestServer(t)
+	old, _, _ := s.addSubscriber("email", "old@example.com", false)
+	s.addSubscriber("email", "kept@example.com", true)
+	s.st.db.Exec(`UPDATE subscribers SET created=? WHERE id=?`, clk.Now().AddDate(0, 0, -8).Unix(), old.ID)
+	s.st.db.Exec(`UPDATE subscribers SET created=? WHERE kind='email' AND confirmed=1`, clk.Now().AddDate(0, 0, -300).Unix())
+	s.st.prune(clk.Now(), 30, 30, 365)
+	subs := s.confirmedSubscribers()
+	var n int
+	s.st.db.QueryRow(`SELECT COUNT(*) FROM subscribers`).Scan(&n)
+	if n != 1 || len(subs) != 1 || subs[0].Target != "kept@example.com" {
+		t.Fatalf("after prune: %d rows, confirmed %+v", n, subs)
+	}
+	// Addresses are sealed at rest.
+	var raw string
+	s.st.db.QueryRow(`SELECT target FROM subscribers`).Scan(&raw)
+	if strings.Contains(raw, "kept@") {
+		t.Fatalf("address stored in the clear: %s", raw)
+	}
+}

internal/sandbar/statussub.go

@@ -0,0 +1,414 @@
+package sandbar
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"net/mail"
+	"net/url"
+	"sort"
+	"strings"
+	"time"
+)
+
+// Following the status page: email (confirmed by a link), webhook (confirmed by answering a test
+// request) and RSS. Every update to a public incident, and every maintenance window, goes to all
+// confirmed subscribers.
+
+// statusNote is one update, as sent to subscribers.
+type statusNote struct {
+	Event   string `json:"event"` // incident.created, incident.updated, incident.resolved, maintenance.scheduled, .rescheduled, .started, .completed, .canceled
+	Title   string `json:"title"`
+	Status  string `json:"status"`
+	Message string `json:"message"`
+	URL     string `json:"url"`
+	Time    int64  `json:"time"`
+}
+
+func (n statusNote) subject(page string) string {
+	label := map[string]string{
+		"incident.created": "New incident", "incident.updated": "Incident update", "incident.resolved": "Resolved",
+		"maintenance.scheduled": "Scheduled maintenance", "maintenance.rescheduled": "Maintenance rescheduled",
+		"maintenance.started": "Maintenance started", "maintenance.completed": "Maintenance complete", "maintenance.canceled": "Maintenance canceled",
+	}[n.Event]
+	return "[" + page + "] " + label + ": " + n.Title
+}
+
+type subscriber struct {
+	ID        string `json:"id"`
+	Kind      string `json:"kind"` // email or webhook
+	Target    string `json:"target"`
+	Confirmed bool   `json:"confirmed"`
+	Created   int64  `json:"created"`
+}
+
+func (s *Server) mailEnabled() bool { return s.opts.Mailer != nil || s.opts.SMTP.Host != "" }
+
+// ---------- links that act for a subscriber ----------
+
+// statusSecret signs confirm and unsubscribe links, so none needs a stored token.
+func (s *Server) statusSecret() []byte {
+	s.statusMu.Lock()
+	defer s.statusMu.Unlock()
+	if s.statusKey == nil {
+		var v struct{ Value string }
+		if s.st.get("secret", "status", &v) != nil || v.Value == "" {
+			v.Value = newToken()
+			s.st.put("secret", "status", v)
+		}
+		s.statusKey = []byte(v.Value)
+	}
+	return s.statusKey
+}
+
+func (s *Server) subToken(purpose, id string) string {
+	m := hmac.New(sha256.New, s.statusSecret())
+	m.Write([]byte(purpose + "." + id))
+	return id + "." + hex.EncodeToString(m.Sum(nil))[:32]
+}
+
+func (s *Server) parseSubToken(purpose, tok string) (string, bool) {
+	id, _, ok := strings.Cut(tok, ".")
+	return id, ok && hmac.Equal([]byte(tok), []byte(s.subToken(purpose, id)))
+}
+
+// ---------- storage ----------
+
+func subKey(kind, target string) string { return hashToken(kind + ":" + strings.ToLower(target)) }
+
+// addSubscriber stores a subscriber, or returns the one already stored for that address.
+func (s *Server) addSubscriber(kind, target string, confirmed bool) (sub subscriber, existed bool, err error) {
+	var n int
+	s.st.db.QueryRow(`SELECT COUNT(*) FROM subscribers`).Scan(&n)
+	key := subKey(kind, target)
+	if got, ok := s.subscriberBy(`key=?`, key); ok {
+		return got, true, nil
+	}
+	if n >= 20000 {
+		return sub, false, errors.New("this status page cannot take more subscribers")
+	}
+	sub = subscriber{ID: newID(), Kind: kind, Target: target, Confirmed: confirmed, Created: s.now().Unix()}
+	_, err = s.st.db.Exec(`INSERT INTO subscribers(id,kind,target,key,confirmed,created) VALUES(?,?,?,?,?,?)`,
+		sub.ID, kind, s.st.seal(target), key, boolInt(confirmed), sub.Created)
+	return sub, false, err
+}
+
+func boolInt(b bool) int {
+	if b {
+		return 1
+	}
+	return 0
+}
+
+func (s *Server) subscriberBy(where string, args ...any) (subscriber, bool) {
+	var sub subscriber
+	var sealed string
+	var conf int
+	err := s.st.db.QueryRow(`SELECT id,kind,target,confirmed,created FROM subscribers WHERE `+where, args...).Scan(&sub.ID, &sub.Kind, &sealed, &conf, &sub.Created)
+	if errors.Is(err, sql.ErrNoRows) || err != nil {
+		return sub, false
+	}
+	sub.Target, sub.Confirmed = s.st.open(sealed), conf == 1
+	return sub, true
+}
+
+func (s *Server) confirmedSubscribers() []subscriber {
+	rows, err := s.st.db.Query(`SELECT id,kind,target,created FROM subscribers WHERE confirmed=1`)
+	if err != nil {
+		return nil
+	}
+	defer rows.Close()
+	var out []subscriber
+	for rows.Next() {
+		var sub subscriber
+		var sealed string
+		if rows.Scan(&sub.ID, &sub.Kind, &sealed, &sub.Created) == nil {
+			sub.Target, sub.Confirmed = s.st.open(sealed), true
+			out = append(out, sub)
+		}
+	}
+	return out
+}
+
+// listSubscribers is for administrators. A webhook address often carries a secret, so only its host is shown.
+func (s *Server) listSubscribers(w http.ResponseWriter, r *http.Request) {
+	out := []subscriber{}
+	rows, err := s.st.db.Query(`SELECT id,kind,target,confirmed,created FROM subscribers ORDER BY created DESC LIMIT 1000`)
+	if err != nil {
+		fail(w, err)
+		return
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var sub subscriber
+		var sealed string
+		var conf int
+		if rows.Scan(&sub.ID, &sub.Kind, &sealed, &conf, &sub.Created) != nil {
+			continue
+		}
+		sub.Target, sub.Confirmed = s.st.open(sealed), conf == 1
+		if sub.Kind == "webhook" {
+			if u, err := url.Parse(sub.Target); err == nil {
+				sub.Target = u.Host
+			}
+		}
+		out = append(out, sub)
+	}
+	writeJSON(w, 200, out)
+}
+
+// ---------- sending ----------
+
+func (s *Server) notifySubscribers(n statusNote) {
+	subs := s.confirmedSubscribers()
+	if len(subs) == 0 {
+		return
+	}
+	title := s.statusSettings().Title
+	s.notifyWG.Add(1)
+	go func() {
+		defer s.notifyWG.Done()
+		for _, sub := range subs {
+			if err := s.deliver(sub, n, title); err != nil {
+				log.Printf("status page subscriber %s: %v", sub.ID, err)
+			}
+		}
+	}()
+}
+
+func (s *Server) deliver(sub subscriber, n statusNote, pageTitle string) error {
+	unsub := s.absStatusURL(nil, "/unsubscribe?token="+url.QueryEscape(s.subToken("unsubscribe", sub.ID)))
+	switch sub.Kind {
+	case "email":
+		body := n.Message + "\n\n" + n.URL + "\n\nYou get this because you subscribed to updates from " + pageTitle + ". Unsubscribe: " + unsub
+		return s.Mail(sub.Target, n.subject(pageTitle), body)
+	case "webhook":
+		return s.postWebhook(sub.Target, map[string]any{"page": pageTitle, "event": n.Event, "title": n.Title, "status": n.Status, "message": n.Message,
+			"url": n.URL, "time": n.Time, "unsubscribe": unsub})
+	}
+	return errors.New("unknown subscriber kind")
+}
+
+func (s *Server) postWebhook(target string, payload any) error {
+	b, _ := json.Marshal(payload)
+	req, err := http.NewRequest("POST", target, bytes.NewReader(b))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", "Sandbar status page")
+	resp, err := s.httpClient(false).Do(req) // visitors choose these addresses, so private networks stay out of reach
+	if err != nil {
+		return err
+	}
+	resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("the webhook answered %s", resp.Status)
+	}
+	return nil
+}
+
+// ---------- public endpoints ----------
+
+// subscribeAllowed lets each address make a handful of requests an hour.
+func (s *Server) subscribeAllowed(ip string) bool {
+	s.subMu.Lock()
+	defer s.subMu.Unlock()
+	now := s.now()
+	keep := s.subTry[ip][:0]
+	for _, t := range s.subTry[ip] {
+		if now.Sub(t) < time.Hour {
+			keep = append(keep, t)
+		}
+	}
+	if len(keep) >= 6 {
+		s.subTry[ip] = keep
+		return false
+	}
+	if len(s.subTry) > 5000 { // forget addresses that have gone quiet
+		for k, v := range s.subTry {
+			if len(v) == 0 || now.Sub(v[len(v)-1]) >= time.Hour {
+				delete(s.subTry, k)
+			}
+		}
+	}
+	s.subTry[ip] = append(keep, now)
+	return true
+}
+
+func (s *Server) followStatusHTTP(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		Email   string `json:"email"`
+		Webhook string `json:"webhook"`
+	}
+	if !decode(r, &in) {
+		bad(w, "invalid request")
+		return
+	}
+	if !s.subscribeAllowed(s.realIP(r)) {
+		writeJSON(w, 429, map[string]string{"error": "Too many attempts. Try again in an hour."})
+		return
+	}
+	title := s.statusSettings().Title
+	switch {
+	case strings.TrimSpace(in.Email) != "":
+		if !s.mailEnabled() {
+			bad(w, "email updates are not set up on this page")
+			return
+		}
+		addr := strings.TrimSpace(in.Email)
+		if a, err := mail.ParseAddress(addr); err != nil || a.Address != addr || len(addr) > 254 || strings.ContainsAny(addr, "\r\n<>") {
+			bad(w, "enter a valid email address")
+			return
+		}
+		sub, existed, err := s.addSubscriber("email", addr, false)
+		if err != nil {
+			bad(w, err.Error())
+			return
+		}
+		// The answer is the same whether or not the address was known, so the form cannot be used to probe it.
+		if !(existed && sub.Confirmed) {
+			link := s.absStatusURL(r, "/confirm?token="+url.QueryEscape(s.subToken("confirm", sub.ID)))
+			body := "Confirm that you want email updates from " + title + " by opening this link:\n\n" + link + "\n\nIf you did not ask for this, ignore this email and nothing will be sent."
+			if err := s.Mail(addr, "["+title+"] Confirm your subscription", body); err != nil {
+				log.Printf("status page confirmation to %s: %v", addr, err)
+				writeJSON(w, 502, map[string]string{"error": "The confirmation email could not be sent. Try again later."})
+				return
+			}
+		}
+		writeJSON(w, 200, map[string]string{"message": "Check your email and open the link to finish subscribing."})
+	case strings.TrimSpace(in.Webhook) != "":
+		target := strings.TrimSpace(in.Webhook)
+		if u, err := url.Parse(target); err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" || len(target) > 500 {
+			bad(w, "the webhook must be an http:// or https:// address")
+			return
+		}
+		sub, existed, err := s.addSubscriber("webhook", target, false)
+		if err != nil {
+			bad(w, err.Error())
+			return
+		}
+		if existed && sub.Confirmed {
+			writeJSON(w, 200, map[string]string{"message": "That webhook is subscribed."})
+			return
+		}
+		// Answering a test request shows the address belongs to something that wants these updates.
+		unsub := s.absStatusURL(r, "/unsubscribe?token="+url.QueryEscape(s.subToken("unsubscribe", sub.ID)))
+		if err := s.postWebhook(target, map[string]any{"page": title, "event": "subscription.created", "message": "This address is now subscribed to " + title + ".", "time": s.now().Unix(), "unsubscribe": unsub}); err != nil {
+			s.st.db.Exec(`DELETE FROM subscribers WHERE id=?`, sub.ID)
+			bad(w, "that address did not accept a test request, so it was not subscribed; check the URL and try again")
+			return
+		}
+		s.st.db.Exec(`UPDATE subscribers SET confirmed=1 WHERE id=?`, sub.ID)
+		writeJSON(w, 200, map[string]string{"message": "Subscribed. A test request was sent to the webhook."})
+	default:
+		bad(w, "enter an email address or a webhook address")
+	}
+}
+
+func (s *Server) confirmSubscription(w http.ResponseWriter, r *http.Request) {
+	notice := "invalid"
+	if id, ok := s.parseSubToken("confirm", r.URL.Query().Get("token")); ok {
+		if res, err := s.st.db.Exec(`UPDATE subscribers SET confirmed=1 WHERE id=?`, id); err == nil {
+			if n, _ := res.RowsAffected(); n > 0 {
+				notice = "confirmed"
+			}
+		}
+	}
+	http.Redirect(w, r, pagePrefix(r)+"/?notice="+notice, http.StatusSeeOther)
+}
+
+// unsubscribeRedirect opens the page with a button instead of acting on a GET, since mail
+// scanners follow every link in a message.
+func (s *Server) unsubscribeRedirect(w http.ResponseWriter, r *http.Request) {
+	http.Redirect(w, r, pagePrefix(r)+"/?unsubscribe="+url.QueryEscape(r.URL.Query().Get("token")), http.StatusSeeOther)
+}
+
+func (s *Server) unsubscribeHTTP(w http.ResponseWriter, r *http.Request) {
+	var in struct {
+		Token string `json:"token"`
+	}
+	decode(r, &in)
+	id, ok := s.parseSubToken("unsubscribe", in.Token)
+	if !ok {
+		bad(w, "that unsubscribe link is not valid")
+		return
+	}
+	s.st.db.Exec(`DELETE FROM subscribers WHERE id=?`, id)
+	writeJSON(w, 200, map[string]string{"message": "You are unsubscribed."})
+}
+
+// ---------- RSS ----------
+
+type rssItem struct {
+	Title   string `xml:"title"`
+	Link    string `xml:"link"`
+	GUID    string `xml:"guid"`
+	PubDate string `xml:"pubDate"`
+	Desc    string `xml:"description"`
+	t       int64
+}
+
+func (s *Server) statusFeed(w http.ResponseWriter, r *http.Request) {
+	now := s.now()
+	cfg := s.statusSettings()
+	_, _, names := s.publicComponents()
+	var items []rssItem
+	add := func(id string, t int64, title, link, text string) {
+		items = append(items, rssItem{Title: title, Link: link, GUID: id, PubDate: time.Unix(t, 0).UTC().Format(time.RFC1123Z), Desc: text, t: t})
+	}
+	incs, _ := listOf[Incident](s.st, "incident")
+	for _, in := range incs {
+		if !in.Public {
+			continue
+		}
+		pi := s.publicIncident(in, names)
+		for _, u := range pi.Updates {
+			add(fmt.Sprintf("%s-%d", in.ID, u.Time), u.Time, statusLabel(u.Status)+": "+in.Title, s.absStatusURL(r, "/incidents/"+in.ID), u.Text)
+		}
+	}
+	for _, m := range s.loadMaintenance() {
+		if m.Canceled {
+			continue
+		}
+		add("maintenance-"+m.ID, m.Created, "Scheduled maintenance: "+m.Title, s.absStatusURL(r, ""), strings.TrimSpace(fmtWindow(m.Start, m.End)+". "+m.Message))
+	}
+	sort.SliceStable(items, func(i, j int) bool { return items[i].t > items[j].t })
+	if len(items) > 50 {
+		items = items[:50]
+	}
+	type channel struct {
+		Title         string    `xml:"title"`
+		Link          string    `xml:"link"`
+		Description   string    `xml:"description"`
+		LastBuildDate string    `xml:"lastBuildDate"`
+		Items         []rssItem `xml:"item"`
+	}
+	feed := struct {
+		XMLName xml.Name `xml:"rss"`
+		Version string   `xml:"version,attr"`
+		Channel channel  `xml:"channel"`
+	}{Version: "2.0", Channel: channel{Title: cfg.Title, Link: s.absStatusURL(r, ""), Description: firstNonEmpty(cfg.Description, "Incidents and maintenance for "+cfg.Title),
+		LastBuildDate: now.UTC().Format(time.RFC1123Z), Items: items}}
+	w.Header().Set("Content-Type", "application/rss+xml; charset=utf-8")
+	w.Header().Set("Cache-Control", "max-age=60")
+	w.Write([]byte(xml.Header))
+	enc := xml.NewEncoder(w)
+	enc.Indent("", " ")
+	enc.Encode(feed)
+}
+
+func statusLabel(status string) string {
+	if l := map[string]string{"investigating": "Investigating", "identified": "Identified", "monitoring": "Monitoring", "resolved": "Resolved"}[status]; l != "" {
+		return l
+	}
+	return "Update"
+}

internal/sandbar/store.go

@@ -45,6 +45,15 @@ CREATE INDEX IF NOT EXISTS messages_topic ON messages(topic, time);
 CREATE TABLE IF NOT EXISTS checks (
 	monitor_id TEXT NOT NULL, time INTEGER NOT NULL, ok INTEGER NOT NULL, ms INTEGER NOT NULL, detail TEXT NOT NULL);
 CREATE INDEX IF NOT EXISTS checks_monitor ON checks(monitor_id, time);
+-- One row per monitor per UTC day, kept far longer than raw checks: it feeds the status page's uptime bars.
+CREATE TABLE IF NOT EXISTS daily (
+	monitor_id TEXT NOT NULL, day TEXT NOT NULL, checks INTEGER NOT NULL, fails INTEGER NOT NULL, PRIMARY KEY (monitor_id, day));
+-- Website analytics: one row per page view or event. No IP address or user agent is kept, only labels.
+CREATE TABLE IF NOT EXISTS hits (
+	website TEXT NOT NULL, time INTEGER NOT NULL, visitor TEXT NOT NULL, event TEXT NOT NULL, path TEXT NOT NULL,
+	referrer TEXT NOT NULL, browser TEXT NOT NULL, os TEXT NOT NULL, device TEXT NOT NULL, country TEXT NOT NULL,
+	lang TEXT NOT NULL, data TEXT NOT NULL);
+CREATE INDEX IF NOT EXISTS hits_site ON hits(website, time);
 CREATE TABLE IF NOT EXISTS mstate (
 	monitor_id TEXT PRIMARY KEY, status TEXT NOT NULL, since INTEGER NOT NULL, last_check INTEGER NOT NULL,
 	last_ms INTEGER NOT NULL, fails INTEGER NOT NULL, last_ping INTEGER NOT NULL, detail TEXT NOT NULL);
@@ -56,10 +65,18 @@ CREATE TABLE IF NOT EXISTS alerts (
 	resolved_at INTEGER NOT NULL DEFAULT 0, incident_id TEXT NOT NULL DEFAULT '');
 CREATE INDEX IF NOT EXISTS alerts_key ON alerts(key, status);
 CREATE INDEX IF NOT EXISTS alerts_due ON alerts(status, next_at);
+-- Web Push registrations, one per installed companion app.
+CREATE TABLE IF NOT EXISTS push_subs (
+	id TEXT PRIMARY KEY, user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE, endpoint TEXT NOT NULL UNIQUE,
+	p256dh TEXT NOT NULL, auth TEXT NOT NULL, topics TEXT NOT NULL, device TEXT NOT NULL, created INTEGER NOT NULL);
 CREATE TABLE IF NOT EXISTS events (
 	id INTEGER PRIMARY KEY AUTOINCREMENT, scope TEXT NOT NULL, ref TEXT NOT NULL, time INTEGER NOT NULL,
 	kind TEXT NOT NULL, actor TEXT NOT NULL, text TEXT NOT NULL);
 CREATE INDEX IF NOT EXISTS events_ref ON events(scope, ref, time);
+-- People who follow the public status page by email or webhook. The address is sealed; key is a hash of it, for lookups.
+CREATE TABLE IF NOT EXISTS subscribers (
+	id TEXT PRIMARY KEY, kind TEXT NOT NULL, target TEXT NOT NULL, key TEXT NOT NULL UNIQUE,
+	confirmed INTEGER NOT NULL, created INTEGER NOT NULL);
 `
 
 // OpenStore opens (creating if needed) the database in dir.
@@ -78,7 +95,21 @@ func OpenStore(dir string, box *secretbox.Box) (*Store, error) {
 		db.Close()
 		return nil, err
 	}
-	return &Store{db: db, box: box}, nil
+	// Older databases have no status column on events: public incident posts carry the status they announce.
+	db.Exec(`ALTER TABLE events ADD COLUMN status TEXT NOT NULL DEFAULT ''`)
+	st := &Store{db: db, box: box}
+	st.backfillDaily()
+	return st, nil
+}
+
+// backfillDaily fills the daily table from the raw checks, but only when it is empty: a database
+// from before the table existed. After that every check is counted as it is recorded.
+func (s *Store) backfillDaily() {
+	var have int
+	if s.db.QueryRow(`SELECT count(*) FROM daily`).Scan(&have) == nil && have == 0 {
+		s.db.Exec(`INSERT OR IGNORE INTO daily(monitor_id,day,checks,fails)
+			SELECT monitor_id, date(time,'unixepoch'), count(*), count(*)-sum(ok) FROM checks GROUP BY monitor_id, date(time,'unixepoch')`)
+	}
 }
 
 func (s *Store) Close() error { return s.db.Close() }
@@ -212,28 +243,38 @@ type Event struct {
 	Kind  string `json:"kind"`
 	Actor string `json:"actor"`
 	Text  string `json:"text"`
+	// Status is set on posts only: the incident status the post announces.
+	Status string `json:"status,omitempty"`
 }
 
 func (s *Store) events(scope, ref string) []Event {
 	out := []Event{}
-	rows, err := s.db.Query(`SELECT time,kind,actor,text FROM events WHERE scope=? AND ref=? ORDER BY time, id`, scope, ref)
+	rows, err := s.db.Query(`SELECT time,kind,actor,text,status FROM events WHERE scope=? AND ref=? ORDER BY time, id`, scope, ref)
 	if err != nil {
 		return out
 	}
 	defer rows.Close()
 	for rows.Next() {
 		var e Event
-		if rows.Scan(&e.Time, &e.Kind, &e.Actor, &e.Text) == nil {
+		if rows.Scan(&e.Time, &e.Kind, &e.Actor, &e.Text, &e.Status) == nil {
 			out = append(out, e)
 		}
 	}
 	return out
 }
 
+// addPost records a public incident update: the text and status the status page shows.
+func (s *Store) addPost(incidentID, status, text string, at time.Time) {
+	s.db.Exec(`INSERT INTO events(scope,ref,time,kind,actor,text,status) VALUES('incident',?,?,'post','',?,?)`, incidentID, at.Unix(), text, status)
+}
+
 // prune deletes data past its retention.
-func (s *Store) prune(now time.Time, messageDays, checkDays int) {
+func (s *Store) prune(now time.Time, messageDays, checkDays, hitDays int) {
+	s.db.Exec(`DELETE FROM hits WHERE time < ?`, now.AddDate(0, 0, -hitDays).Unix())
 	s.db.Exec(`DELETE FROM messages WHERE time < ?`, now.AddDate(0, 0, -messageDays).Unix())
 	s.db.Exec(`DELETE FROM checks WHERE time < ?`, now.AddDate(0, 0, -checkDays).Unix())
+	s.db.Exec(`DELETE FROM daily WHERE day < ?`, now.UTC().AddDate(0, 0, -400).Format("2006-01-02"))
 	s.db.Exec(`DELETE FROM sessions WHERE expires < ?`, now.Unix())
+	s.db.Exec(`DELETE FROM subscribers WHERE confirmed=0 AND created < ?`, now.AddDate(0, 0, -7).Unix())
 	s.db.Exec(`DELETE FROM alerts WHERE status='resolved' AND resolved_at < ? AND incident_id=''`, now.AddDate(0, 0, -90).Unix())
 }

internal/sandbar/update.go

@@ -0,0 +1,255 @@
+package sandbar
+
+import (
+	"context"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"git.veillax.com/Veillax/reef/selfupdate"
+)
+
+// Self-update replaces the running binary with the newest release published on the Gitea
+// server (Reef's selfupdate does the download, checksum and swap).
+//
+// In a container the binary lives in the image, where this user can't write and where a
+// change would be lost when the container is recreated. So an update is written to
+// <data>/bin/sandbar on the data volume instead, and every start checks that file first
+// (UseNewerOverlay): it runs when it is a newer release than the image, and is deleted once
+// the image has caught up.
+
+const defaultUpdateServer = "https://git.veillax.com"
+
+type updateState struct {
+	mu      sync.Mutex
+	running bool
+	stage   string
+	pct     int
+	line    string
+	err     string
+
+	checked  time.Time // the cached answer from the release server
+	latest   string
+	newer    bool
+	checkErr string
+}
+
+func (s *Server) updateConfig() selfupdate.Config {
+	o := s.opts
+	server, repo := o.UpdateServer, o.UpdateRepo
+	if server == "" {
+		server = defaultUpdateServer
+	}
+	if repo == "" {
+		repo = "Veillax/sandbar"
+	}
+	return selfupdate.Config{
+		Server: server, Repo: repo, App: "sandbar", Current: o.Version,
+		ExePath: UpdateTarget(o.DataDir), Restart: o.Restart, Logf: log.Printf,
+	}
+}
+
+// RunAutoUpdate checks for a new release shortly after start and then every few hours until
+// ctx ends, installing what it finds and restarting into it.
+func (s *Server) RunAutoUpdate(ctx context.Context) {
+	selfupdate.Run(ctx, s.updateConfig())
+}
+
+// canInstall says whether this build can update itself, and if not, why.
+func (s *Server) canInstall() (bool, string) {
+	if _, ok := parseVersion(s.opts.Version); !ok {
+		return false, "This is a development build, so it does not update itself."
+	}
+	if runtime.GOOS == "windows" {
+		return false, "A running program can't be replaced on Windows. Download the new release and restart."
+	}
+	return true, ""
+}
+
+// updateStatus reports the running and newest versions. The release server is asked at most
+// every ten minutes unless ?fresh=1.
+func (s *Server) updateStatus(w http.ResponseWriter, r *http.Request) {
+	ok, why := s.canInstall()
+	u := &s.upd
+	u.mu.Lock()
+	stale := time.Since(u.checked) > 10*time.Minute || r.URL.Query().Get("fresh") == "1"
+	running := u.running
+	u.mu.Unlock()
+	if stale && !running {
+		ctx, cancel := context.WithTimeout(r.Context(), 8*time.Second)
+		latest, newer, err := selfupdate.Check(ctx, s.updateConfig())
+		cancel()
+		u.mu.Lock()
+		u.checked, u.latest, u.newer, u.checkErr = time.Now(), latest, newer, ""
+		if err != nil {
+			u.checkErr = err.Error()
+		}
+		u.mu.Unlock()
+	}
+	u.mu.Lock()
+	out := map[string]any{
+		"current": s.opts.Version, "autoUpdate": s.opts.AutoUpdate, "canInstall": ok, "reason": why,
+		"latest": u.latest, "newer": u.newer, "error": u.checkErr,
+		"running": u.running, "stage": u.stage, "pct": u.pct, "line": u.line, "failed": u.err,
+	}
+	u.mu.Unlock()
+	writeJSON(w, 200, out)
+}
+
+// updateApply installs the newest release now. It answers at once; the page polls updateStatus
+// for progress, and the server disappears for a moment when it restarts into the new binary.
+func (s *Server) updateApply(w http.ResponseWriter, r *http.Request) {
+	if ok, why := s.canInstall(); !ok {
+		bad(w, why)
+		return
+	}
+	u := &s.upd
+	u.mu.Lock()
+	if u.running {
+		u.mu.Unlock()
+		writeJSON(w, 409, map[string]string{"error": "An update is already running."})
+		return
+	}
+	u.running, u.stage, u.pct, u.line, u.err = true, "starting", 0, "", ""
+	u.mu.Unlock()
+	cfg := s.updateConfig()
+	cfg.Progress = func(e selfupdate.Event) {
+		u.mu.Lock()
+		defer u.mu.Unlock()
+		u.stage = e.Stage
+		if e.Pct >= 0 {
+			u.pct = e.Pct
+		}
+		if e.Line != "" {
+			u.line = e.Line
+		}
+	}
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
+		defer cancel()
+		_, err := selfupdate.CheckOnce(ctx, cfg) // when it installs, the process is replaced and this never returns
+		u.mu.Lock()
+		u.running = false
+		if err != nil {
+			u.err = err.Error()
+		}
+		u.checked = time.Time{} // look again next time
+		u.mu.Unlock()
+	}()
+	writeJSON(w, 200, map[string]bool{"started": true})
+}
+
+// UpdateTarget is the file an update replaces: the running binary when its folder is writable
+// (a plain install), and otherwise <data>/bin/sandbar (a container).
+func UpdateTarget(dataDir string) string {
+	if exe, err := os.Executable(); err == nil {
+		if exe, err = filepath.EvalSymlinks(exe); err == nil && writableDir(filepath.Dir(exe)) {
+			return exe
+		}
+	}
+	dir, err := filepath.Abs(filepath.Join(dataDir, "bin"))
+	if err != nil {
+		dir = filepath.Join(dataDir, "bin")
+	}
+	os.MkdirAll(dir, 0o755)
+	return filepath.Join(dir, "sandbar")
+}
+
+func writableDir(dir string) bool {
+	f, err := os.CreateTemp(dir, ".sandbar-write-test-*")
+	if err != nil {
+		return false
+	}
+	f.Close()
+	os.Remove(f.Name())
+	return true
+}
+
+// UseNewerOverlay runs <data>/bin/sandbar instead of this binary when that file is a newer
+// release. It returns when there is nothing to switch to, and otherwise replaces the process.
+func UseNewerOverlay(dataDir, current string, logf func(string, ...any)) {
+	if runtime.GOOS == "windows" || os.Getenv("SANDBAR_NO_OVERLAY") == "1" {
+		return
+	}
+	overlay, err := filepath.Abs(filepath.Join(dataDir, "bin", "sandbar"))
+	if err != nil {
+		return
+	}
+	ofi, err := os.Stat(overlay)
+	if err != nil {
+		return
+	}
+	if exe, err := os.Executable(); err == nil {
+		if efi, err := os.Stat(exe); err == nil && os.SameFile(efi, ofi) {
+			return // this already is the overlay
+		}
+	}
+	ver := overlayVersion(overlay)
+	switch {
+	case ver == "":
+		logf("ignoring %s: it did not report a version", overlay)
+	case versionNewer(ver, current):
+		logf("running %s from %s, which is newer than this image's %s", ver, overlay, current)
+		if err := selfupdate.Restart(overlay); err != nil {
+			logf("could not switch to %s: %v", overlay, err)
+		}
+	default:
+		if _, ok := parseVersion(current); ok {
+			os.Remove(overlay) // the image has caught up with it
+		}
+	}
+}
+
+// overlayVersion asks a binary for its version, or returns "" if it will not run.
+func overlayVersion(path string) string {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	out, err := exec.CommandContext(ctx, path, "-version").Output()
+	f := strings.Fields(string(out))
+	if err != nil || len(f) != 2 || f[0] != "sandbar" {
+		return ""
+	}
+	return f[1]
+}
+
+// parseVersion reads vX.Y.Z. Pre-releases and local builds are not versions for this purpose.
+func parseVersion(s string) ([3]int, bool) {
+	var v [3]int
+	if !strings.HasPrefix(s, "v") || strings.ContainsAny(s, "-+") {
+		return v, false
+	}
+	parts := strings.Split(s[1:], ".")
+	if len(parts) != 3 {
+		return v, false
+	}
+	for i, p := range parts {
+		n, err := strconv.Atoi(p)
+		if err != nil || n < 0 {
+			return v, false
+		}
+		v[i] = n
+	}
+	return v, true
+}
+
+// versionNewer reports whether a is a later release than b. Either not being a release is false.
+func versionNewer(a, b string) bool {
+	x, ok1 := parseVersion(a)
+	y, ok2 := parseVersion(b)
+	if !ok1 || !ok2 {
+		return false
+	}
+	for i := range x {
+		if x[i] != y[i] {
+			return x[i] > y[i]
+		}
+	}
+	return false
+}

internal/sandbar/update_test.go

@@ -0,0 +1,109 @@
+package sandbar
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestVersionNewer(t *testing.T) {
+	for _, c := range []struct {
+		a, b string
+		want bool
+	}{
+		{"v0.1.4", "v0.1.3", true},
+		{"v0.2.0", "v0.1.9", true},
+		{"v1.0.0", "v0.9.9", true},
+		{"v0.1.3", "v0.1.3", false},
+		{"v0.1.2", "v0.1.3", false},
+		{"v0.1.10", "v0.1.9", true},
+		{"v0.2.0-rc1", "v0.1.0", false}, // pre-releases are never offered
+		{"v0.2.0", "dev", false},        // a development build never updates
+		{"dev", "v0.1.0", false},
+	} {
+		if got := versionNewer(c.a, c.b); got != c.want {
+			t.Errorf("versionNewer(%q, %q) = %v, want %v", c.a, c.b, got, c.want)
+		}
+	}
+}
+
+// The update page asks the release server and reports whether it has something newer.
+func TestUpdateStatus(t *testing.T) {
+	release := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/repos/Veillax/sandbar/releases/latest" {
+			http.NotFound(w, r)
+			return
+		}
+		w.Write([]byte(`{"tag_name":"v0.2.0","assets":[]}`))
+	}))
+	defer release.Close()
+
+	s, _, _ := newTestServer(t)
+	s.opts.Version, s.opts.UpdateServer = "v0.1.0", release.URL
+	ts := httptest.NewServer(s.Handler())
+	defer ts.Close()
+	c := newAPIClient(t, ts)
+
+	if code := c.do("GET", "/api/v1/system/update", nil, nil); code != 401 {
+		t.Fatalf("signed out: %d", code)
+	}
+	c.setup()
+	var st map[string]any
+	if code := c.do("GET", "/api/v1/system/update", nil, &st); code != 200 {
+		t.Fatalf("status: %d", code)
+	}
+	if st["current"] != "v0.1.0" || st["latest"] != "v0.2.0" || st["newer"] != true {
+		t.Fatalf("status: %v", st)
+	}
+	if st["error"] != "" {
+		t.Fatalf("unexpected error: %v", st["error"])
+	}
+
+	// A development build can look but not install.
+	s.opts.Version = "dev"
+	s.upd.checked = s.upd.checked.AddDate(-1, 0, 0)
+	if code := c.do("POST", "/api/v1/system/update", map[string]string{}, &st); code != 400 {
+		t.Fatalf("a development build must not install: %d %v", code, st)
+	}
+}
+
+// A newer binary on the data volume takes over from the image, and a stale one is removed.
+func TestOverlay(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("self-update is not supported on Windows")
+	}
+	dir := t.TempDir()
+	bin := filepath.Join(dir, "bin")
+	os.MkdirAll(bin, 0o755)
+	overlay := filepath.Join(bin, "sandbar")
+	script := func(version string) {
+		os.WriteFile(overlay, []byte("#!/bin/sh\necho 'sandbar "+version+"'\n"), 0o755)
+	}
+	var logged []string
+	logf := func(f string, a ...any) { logged = append(logged, f) }
+
+	// An older overlay is deleted once the image is a release that has caught up.
+	script("v0.1.0")
+	UseNewerOverlay(dir, "v0.1.5", logf)
+	if _, err := os.Stat(overlay); err == nil {
+		t.Fatal("a stale overlay should be removed")
+	}
+
+	// A development image never deletes or switches to anything.
+	script("v0.9.0")
+	UseNewerOverlay(dir, "dev", logf)
+	if _, err := os.Stat(overlay); err != nil {
+		t.Fatal("a development build must leave the overlay alone")
+	}
+
+	// Something that does not report a version is ignored, not run.
+	os.WriteFile(overlay, []byte("#!/bin/sh\necho hello\n"), 0o755)
+	UseNewerOverlay(dir, "v0.1.5", logf)
+	if len(logged) == 0 || !strings.Contains(logged[len(logged)-1], "did not report a version") {
+		t.Fatalf("log: %v", logged)
+	}
+}

internal/sandbar/web/index.html

@@ -227,6 +227,28 @@
   .feed .empty { margin:0; }
   .msg { border:var(--border-w) solid var(--border); border-radius:var(--radius); padding:var(--s2) var(--s3); display:flex; flex-direction:column; gap:var(--s1); }
   .msg .tag { margin-right:var(--s1); }
+  /* website analytics */
+  .stats { display:grid; grid-template-columns:repeat(auto-fit,minmax(104px,1fr)); gap:var(--s3); margin-bottom:var(--s4); }
+  .stat { background:var(--surface); border:var(--border-w) solid var(--border); border-radius:var(--radius-lg); padding:var(--s3) var(--s4); }
+  .stat .n { font-size:var(--text-xl); font-weight:600; font-variant-numeric:tabular-nums; }
+  .stat .l { font-size:var(--text-sm); color:var(--text-muted); }
+  .chart { display:flex; align-items:flex-end; gap:2px; height:180px; margin-top:var(--s3); }
+  .chart .col { position:relative; flex:1; min-width:0; height:100%; display:flex; align-items:flex-end; }
+  .chart .col:hover { background:var(--surface-2); }
+  .chart .v, .chart .u { position:absolute; left:0; right:0; bottom:0; border-radius:2px 2px 0 0; }
+  .chart .v { background:color-mix(in srgb, var(--accent) 35%, var(--surface)); }
+  .chart .u { background:var(--accent); }
+  .axis2 { display:flex; justify-content:space-between; margin-top:var(--s1); font-size:var(--text-xs); color:var(--text-faint); }
+  .legend { display:flex; gap:var(--s4); font-size:var(--text-sm); color:var(--text-muted); flex-wrap:wrap; }
+  .legend i { display:inline-block; width:10px; height:10px; border-radius:2px; margin-right:var(--s1); vertical-align:baseline; }
+  .cols { display:grid; grid-template-columns:repeat(auto-fit,minmax(300px,1fr)); gap:var(--s4); margin-top:var(--s4); }
+  .cols .card { margin:0; }
+  .top { width:100%; border-collapse:collapse; font-size:var(--text-sm); }
+  .top td { padding:var(--s1) var(--s2); }
+  .top td:first-child { background:linear-gradient(to right, var(--accent-soft) var(--w), transparent var(--w)); overflow-wrap:anywhere; }
+  .top td.num { text-align:right; white-space:nowrap; width:1%; }
+  .top th { text-align:right; font-weight:500; color:var(--text-muted); padding:var(--s1) var(--s2); }
+  .top th:first-child { text-align:left; }
 </style>
 </head>
 <body>
@@ -360,6 +382,7 @@ const ICONS = {
   incidents:'<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4M12 17h.01"/>',
   oncall:'<rect x="3" y="4" width="18" height="18" rx="2"/><path d="M16 2v4M8 2v4M3 10h18"/>',
   monitors:'<path d="M22 12h-4l-3 9L9 3l-3 9H2"/>',
+  websites:'<path d="M3 3v18h18"/><path d="M18 17V9"/><path d="M13 17V5"/><path d="M8 17v-3"/>',
   topics:'<path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z"/>',
   channels:'<path d="m22 2-7 20-4-9-9-4z"/><path d="M22 2 11 13"/>',
   status:'<circle cx="12" cy="12" r="10"/><path d="M2 12h20"/><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"/>',
@@ -420,15 +443,17 @@ const PAGES = {
   incidents: ['Incidents', 'Coordinate the response when something is wrong, and keep a record of what happened.'],
   oncall:    ['On-call', 'Who is responsible right now, and who is told next when nobody answers.'],
   monitors:  ['Monitors', 'Checks that tell you when a website, port, certificate or scheduled job stops working.'],
+  websites:  ['Websites', 'Count visitors and page views on your sites, without cookies or personal data.'],
   topics:    ['Topics', 'Publish and subscribe to messages with plain HTTP requests. Phones can use the ntfy app.'],
-  channels:  ['Channels', 'Email addresses and webhooks that receive every alert and incident update.'],
+  statuspage:['Status page', 'What customers see: components, incidents, scheduled maintenance, and who follows along.'],
+  channels:  ['Channels','Email addresses and webhooks that receive every alert and incident update.'],
   users:     ['People', 'Everyone who can sign in, and how to reach them.'],
   account:   ['Account', 'Your password, API keys and personal topic.'],
 };
 const NAV = [
   ['Respond', [['alerts', 'Alerts', 'alerts'], ['incidents', 'Incidents', 'incidents'], ['oncall', 'On-call', 'oncall']]],
-  ['Observe', [['monitors', 'Monitors', 'monitors'], ['topics', 'Topics', 'topics']]],
-  ['Set up', [['channels', 'Channels', 'channels'], ['users', 'People', 'users']]],
+  ['Observe', [['monitors', 'Monitors', 'monitors'], ['websites', 'Websites', 'websites'], ['topics', 'Topics', 'topics']]],
+  ['Set up', [['statuspage', 'Status page', 'status'], ['channels', 'Channels', 'channels'], ['users', 'People', 'users']]],
 ];
 function route() {
   const [tab, arg] = (location.hash.replace(/^#\/?/, '') || 'alerts').split('/');
@@ -444,7 +469,7 @@ async function render() {
     side.push(h('div', {class:'navsec'}, sec));
     for (const [k, l, i] of items) side.push(nav(k, l, i));
   }
-  side.push(h('div', {class:'navsec'}, 'Public'), h('a', {class:'navitem', href:'/status', target:'_blank', rel:'noopener'}, icon('status'), 'Status page'));
+  side.push(h('div', {class:'navsec'}, 'Public'), h('a', {class:'navitem', href:'/status', target:'_blank', rel:'noopener'}, icon('status'), 'View status page'));
   side.push(h('div', {class:'grow'}), h('div', {class:'userbox'}, h('div', {class:'who'}, S.me.email), nav('account', 'Account', 'account'),
     h('button', {class:'navitem', onclick:toggleTheme}, icon('dark'), 'Switch theme'),
     h('button', {class:'navitem', onclick: act(async () => { await api('POST', V1 + '/logout'); S.me = null; boot(); })}, icon('out'), 'Sign out')));
@@ -542,7 +567,8 @@ function raiseAlertDialog() {
 const KINDS = [['http', 'Website (HTTP)'], ['tcp', 'Port (TCP)'], ['dns', 'DNS lookup'], ['tls', 'Certificate expiry'], ['heartbeat', 'Heartbeat (cron job or service pings us)']];
 views.monitors = async () => {
   S.headerAction = ['Add monitor', () => monitorDialog()];
-  const [mons, states] = await Promise.all([api('GET', V1 + '/monitors'), api('GET', V1 + '/monitor-states')]);
+  const [mons, states, groups] = await Promise.all([api('GET', V1 + '/monitors'), api('GET', V1 + '/monitor-states'), api('GET', V1 + '/status-groups')]);
+  S.sgroups = groups;
   if (!mons.length) return emptyState('monitors', 'No monitors yet', 'Add a check for a website, a port, a certificate or a scheduled job. Failures raise an alert.', h('button', {class:'btn', onclick:() => monitorDialog()}, 'Add monitor'));
   const statusBadge = (m, st) => !m.enabled ? badge('Paused') : st.status === 'up' ? badge('Up', 'success') : st.status === 'down' ? badge('Down', 'danger') : badge('Waiting for first check');
   return table(['Name', 'Check', 'Status', 'Last check', 'Uptime', ''], mons.map(m => { const st = states[m.id] || {};
@@ -565,6 +591,7 @@ function monitorDialog(m) {
     warn: h('input', {type:'number', min:1, value:m.warnDays || 14}), grace: h('input', {type:'number', min:0, value:m.graceS || 0}),
     pol: select([['', 'None, only broadcast'], ...S.policies.map(p => [p.id, p.name])], m.policyId || ''),
     sev: select([['critical', 'Critical'], ['warning', 'Warning'], ['info', 'Info']], m.severity || 'critical'),
+    group: select([['', 'No group'], ...(S.sgroups || []).map(g => [g.id, g.name])], m.group || ''), pubname: h('input', {value:m.publicName || ''}),
     pub: chk('Show on the public status page', m.public), priv: chk('Allow targets on private networks', m.allowPrivate), on: chk('Run this check', m.enabled) };
   const only = (kinds, el) => { const w = h('div', {class:'stack'}, el); w.kinds = kinds; return w; };
   const groups = [
@@ -582,11 +609,12 @@ function monitorDialog(m) {
   groups.push(hbOnly); sync();
   dialogForm(e ? 'Edit ' + m.name : 'Add a monitor', null, [field('Name', f.name), field('Type', f.kind), ...groups,
     h('div', {class:'grid'}, field('Check every (seconds)', f.interval, 'At least 10.'), field('Timeout (seconds)', f.timeout), field('Failures before down', f.retries, 'A blip is ignored.')),
-    h('div', {class:'grid'}, field('Alert severity', f.sev), field('Escalation policy', f.pol)), f.pub, f.on], e ? 'Save changes' : 'Add monitor',
+    h('div', {class:'grid'}, field('Alert severity', f.sev), field('Escalation policy', f.pol)), f.pub,
+    h('div', {class:'grid'}, field('Status page group', f.group, 'Groups are managed under Status page.'), field('Name on the status page', f.pubname, 'Leave empty to use the monitor name.')), f.on], e ? 'Save changes' : 'Add monitor',
   async () => {
     const body = {...m, name:f.name.value, kind:f.kind.value, target:f.target.value, intervalS:+f.interval.value, timeoutS:+f.timeout.value, retries:+f.retries.value,
       expect:f.expect.value, keyword:f.keyword.value, warnDays:+f.warn.value, graceS:+f.grace.value, policyId:f.pol.value, severity:f.sev.value,
-      public:f.pub.box.checked, allowPrivate:f.priv.box.checked, enabled:f.on.box.checked};
+      public:f.pub.box.checked, group:f.group.value, publicName:f.pubname.value.trim(), allowPrivate:f.priv.box.checked, enabled:f.on.box.checked};
     const saved = await api(e ? 'PUT' : 'POST', V1 + '/monitors' + (e ? '/' + m.id : ''), body);
     toast(e ? 'Monitor saved.' : 'Monitor added.'); refresh();
     if (!e && saved.kind === 'heartbeat') { const done = modal('Heartbeat address', h('div', {class:'stack'}, h('p', {class:'dim', style:'margin:0'}, 'Have your job request this address each time it runs. It goes down when the requests stop.'), cmdBox(`${origin()}/api/v1/hb/${saved.token}`), h('div', {class:'actions form-actions'}, h('button', {class:'btn', onclick:() => done()}, 'Done')))); }
@@ -663,10 +691,22 @@ views.incidents = async () => {
     h('td', {}, h('a', {href:'#incidents/' + i.id}, i.title), i.public ? h('div', {}, badge('On status page', 'accent')) : null),
     h('td', {}, incStatus(i.status)), h('td', {}, userName(i.lead) || 'Nobody'), h('td', {class:'num'}, fmtTime(i.created)))));
 };
-function declareDialog(alertIds, title) {
-  const f = { title: h('input', {value:title || ''}), sev: select(SEVS, 'sev2'), sum: h('textarea'), lead: select(userOpts('Me'), '') };
-  dialogForm('Declare an incident', 'Everyone subscribed to the incidents topic and every channel is told.', [field('Title', f.title, 'What is wrong, in a few words.'), field('Severity', f.sev), field('What we know so far', f.sum), field('Incident lead', f.lead)], 'Declare incident',
-    async () => { const i = await api('POST', V1 + '/incidents', {title:f.title.value, severity:f.sev.value, summary:f.sum.value, lead:f.lead.value, alertIds:alertIds || []}); toast('Incident declared.'); location.hash = 'incidents/' + i.id; });
+// monitors that are on the status page, which are the components an incident can affect
+const publicMonitors = async () => (await api('GET', V1 + '/monitors')).filter(m => m.public && m.enabled);
+const monName = m => m.publicName || m.name;
+// a list of checkboxes, one per component; values() gives the ids that are ticked
+function componentPicker(mons, selected) {
+  const boxes = mons.map(m => chk(monName(m), (selected || []).includes(m.id)));
+  const box = h('div', {class:'stack'}, boxes.length ? boxes : h('p', {class:'small dim', style:'margin:0'}, 'No monitors are on the status page yet. Tick "Show on the public status page" on a monitor.'));
+  return Object.assign(box, {values: () => mons.filter((m, i) => boxes[i].box.checked).map(m => m.id)});
+}
+async function declareDialog(alertIds, title) {
+  const mons = await publicMonitors(), picker = componentPicker(mons, []);
+  const f = { title: h('input', {value:title || ''}), sev: select(SEVS, 'sev2'), sum: h('textarea'), lead: select(userOpts('Me'), ''), pub: chk('Post it on the status page and tell subscribers', false) };
+  const comps = h('div', {class:'stack'}, field('Affected components', picker, 'Shown on the status page.'));
+  f.pub.box.onchange = () => { comps.style.display = f.pub.box.checked ? '' : 'none'; }; comps.style.display = 'none';
+  dialogForm('Declare an incident', 'Everyone subscribed to the incidents topic and every channel is told.', [field('Title', f.title, 'What is wrong, in a few words.'), field('Severity', f.sev), field('What we know so far', f.sum, 'If you post it on the status page, customers see this text.'), field('Incident lead', f.lead), f.pub, comps], 'Declare incident',
+    async () => { const i = await api('POST', V1 + '/incidents', {title:f.title.value, severity:f.sev.value, summary:f.sum.value, lead:f.lead.value, alertIds:alertIds || [], public:f.pub.box.checked, components:picker.values()}); toast('Incident declared.'); location.hash = 'incidents/' + i.id; });
 }
 async function incidentDetail(id) {
   S.noHeader = true;
@@ -674,13 +714,24 @@ async function incidentDetail(id) {
   const patch = act(async (body, msg) => { await api('PATCH', `${V1}/incidents/${id}`, body); toast(msg || 'Incident updated.'); refresh(); });
   const status = select(STATUSES, i.status, {onchange:e => patch({status:e.target.value})}), sev = select(SEVS, i.severity, {onchange:e => patch({severity:e.target.value})});
   const lead = select(userOpts('Nobody'), i.lead, {onchange:e => patch({lead:e.target.value})}), comms = select(userOpts('Nobody'), i.comms, {onchange:e => patch({comms:e.target.value})});
+  const mons = await publicMonitors(), picker = componentPicker(mons, i.components);
   const pub = chk('Show on the public status page', i.public, v => patch({public:v}));
+  const post = () => {
+    const f = { status: select(STATUSES, i.status), text: h('textarea', {placeholder:'What customers should know'}) };
+    dialogForm('Post an update', 'Customers and subscribers see this text and the status. The timeline and names stay internal.', [field('Status', f.status), field('Update', f.text, 'Leave empty to use the standard wording for the status.')], 'Post update',
+      async () => { await api('PATCH', `${V1}/incidents/${id}`, {status:f.status.value, note:f.text.value}); toast('Update posted.'); refresh(); });
+  };
   const sum = h('textarea', {}, i.summary), pm = h('textarea', {style:'min-height:220px', class:'mono'}, i.postmortem), note = h('input', {placeholder:'Add a comment for the timeline'});
   const say = act(async () => { if (!note.value.trim()) return; await api('POST', `${V1}/incidents/${id}/comments`, {text:note.value}); note.value = ''; refresh(); });
   note.addEventListener('keydown', e => e.key === 'Enter' && say());
   setTimeout(() => { S.noHeader = false; });
   return h('div', {}, h('div', {class:'page-h'}, h('div', {}, h('a', {href:'#incidents', class:'small'}, 'Back to incidents'), h('h1', {}, i.title), h('p', {}, 'Declared ' + fmtTime(i.created) + (i.resolved ? ', resolved ' + fmtTime(i.resolved) : ''))), h('div', {}, incStatus(i.status))),
-    card('Status', h('div', {class:'grid'}, field('Status', status), field('Severity', sev), field('Lead', lead), field('Communications', comms)), pub),
+    card('Status', h('div', {class:'grid'}, field('Status', status), field('Severity', sev), field('Lead', lead), field('Communications', comms))),
+    card('Status page', h('div', {class:'stack'}, pub,
+      i.public ? h('p', {class:'small dim', style:'margin:0'}, 'Changing the status above, or posting an update, adds a post to the public page and emails subscribers.') : h('p', {class:'small dim', style:'margin:0'}, 'Turning this on posts the summary below and tells subscribers.'),
+      field('Affected components', picker, 'The page shows these as affected until the incident is resolved.'),
+      h('div', {class:'actions form-actions'}, h('button', {class:'ghost', onclick:() => patch({components:picker.values()}, 'Components saved.')}, 'Save components'),
+        i.public ? h('button', {class:'btn', onclick:post}, 'Post an update') : null))),
     card('Summary', h('div', {class:'stack'}, sum, h('div', {class:'actions form-actions'}, h('button', {class:'ghost', onclick:() => patch({summary:sum.value}, 'Summary saved.')}, 'Save summary')))),
     card('Timeline', timeline(i.timeline || []), h('div', {class:'actions', style:'margin-top:16px'}, h('div', {style:'flex:1;min-width:200px'}, note), h('button', {class:'ghost', onclick:say}, 'Add comment'))),
     card('Post-mortem', h('div', {class:'stack'}, pm, h('div', {class:'actions form-actions'},
@@ -715,6 +766,85 @@ views.topics = async () => {
     card('From the command line', cmdBox(`curl -H "Authorization: Bearer <api key>" -H "Title: Disk full" -H "Priority: urgent" -d "web-1 is at 98%" ${base}/alerts\ncurl -H "Authorization: Bearer <api key>" -N ${base}/alerts/sse`)));
 };
 
+// ---------- status page ----------
+const MSTATE = {scheduled:['Scheduled', ''], in_progress:['In progress', 'accent'], completed:['Completed', 'success'], canceled:['Canceled', '']};
+views.statuspage = async () => {
+  const which = S.spTab || 'page';
+  const tabs = h('div', {class:'tabs2', role:'group', 'aria-label':'Status page sections'}, [['page', 'Page'], ['groups', 'Groups'], ['maintenance', 'Maintenance'], ['subscribers', 'Subscribers']].map(([k, l]) =>
+    h('button', {class:which === k ? 'on' : '', 'aria-pressed':which === k, onclick:() => { S.spTab = k; refresh(); }}, l)));
+  const admin = isAdmin();
+  if (which === 'groups') {
+    S.headerAction = admin ? ['Add group', () => groupDialog()] : null;
+    const [groups, mons] = await Promise.all([api('GET', V1 + '/status-groups'), api('GET', V1 + '/monitors')]);
+    S.sgroups = groups;
+    if (!groups.length) return h('div', {}, tabs, emptyState('status', 'No groups yet', 'Groups put related components under one heading, such as Website, API and Infrastructure. Components without a group are listed first.', admin ? h('button', {class:'btn', onclick:() => groupDialog()}, 'Add group') : null));
+    return h('div', {}, tabs, table(['Group', 'Components', 'Order', ''], groups.sort((a, b) => a.order - b.order || a.name.localeCompare(b.name)).map(g => {
+      const inside = mons.filter(m => m.public && m.group === g.id);
+      return h('tr', {}, h('td', {}, g.name, g.description ? h('div', {class:'small dim'}, g.description) : null), h('td', {}, inside.length ? inside.map(monName).join(', ') : 'None yet'), h('td', {class:'num'}, g.order),
+        h('td', {}, admin ? h('div', {class:'actions'}, h('button', {class:'ghost', onclick:() => groupDialog(g)}, 'Edit'),
+          h('button', {class:'ghost danger', onclick:ask({title:`Delete ${g.name}?`, body:'Its components move to the top of the page, ungrouped. The monitors are not changed. This cannot be undone.', confirm:'Delete group'}, async () => { await api('DELETE', `${V1}/status-groups/${g.id}`); toast('Group deleted.'); refresh(); })}, 'Delete')) : null));
+    })));
+  }
+  if (which === 'maintenance') {
+    S.headerAction = admin ? ['Schedule maintenance', () => maintenanceDialog()] : null;
+    const [list, mons] = await Promise.all([api('GET', V1 + '/maintenance'), api('GET', V1 + '/monitors')]);
+    const name = id => { const m = mons.find(x => x.id === id); return m ? monName(m) : null; };
+    if (!list.length) return h('div', {}, tabs, emptyState('status', 'No maintenance scheduled', 'Planned work is announced on the status page and sent to subscribers when it is scheduled, when it starts and when it ends. Affected components show as under maintenance meanwhile.', admin ? h('button', {class:'btn', onclick:() => maintenanceDialog()}, 'Schedule maintenance') : null));
+    return h('div', {}, tabs, table(['Maintenance', 'Window', 'Status', ''], list.map(m => { const st = MSTATE[m.state] || [m.state, ''], open = m.state === 'scheduled' || m.state === 'in_progress';
+      return h('tr', {}, h('td', {}, m.title, h('div', {class:'small dim'}, m.components.map(name).filter(Boolean).join(', ') || 'No components named')), h('td', {class:'num'}, fmtTime(m.start) + ' to ' + fmtTime(m.end)), h('td', {}, badge(st[0], st[1])),
+        h('td', {}, admin ? h('div', {class:'actions'}, open ? h('button', {class:'ghost', onclick:() => maintenanceDialog(m)}, 'Edit') : null,
+          open ? h('button', {class:'ghost danger', onclick:ask({title:`Cancel ${m.title}?`, body:'Subscribers are told it is canceled. It stays in the history.', confirm:'Cancel maintenance', cancel:'Keep it'}, async () => { await api('POST', `${V1}/maintenance/${m.id}/cancel`); toast('Maintenance canceled.'); refresh(); })}, 'Cancel') : null,
+          h('button', {class:'ghost danger', onclick:ask({title:`Delete ${m.title}?`, body:'It is removed from the status page and its history. This cannot be undone.', confirm:'Delete maintenance'}, async () => { await api('DELETE', `${V1}/maintenance/${m.id}`); toast('Maintenance deleted.'); refresh(); })}, 'Delete')) : null));
+    })));
+  }
+  if (which === 'subscribers') {
+    S.headerAction = null;
+    if (!admin) return h('div', {}, tabs, emptyState('users', 'Administrators only', 'Ask an administrator to see who follows the status page.'));
+    const list = await api('GET', V1 + '/status-subscribers');
+    if (!list.length) return h('div', {}, tabs, emptyState('users', 'No subscribers yet', 'People subscribe with the button on the public page. Confirmed email addresses and webhooks appear here.'));
+    return h('div', {}, tabs, table(['Type', 'Address', 'Status', 'Subscribed', ''], list.map(s => h('tr', {}, h('td', {}, s.kind === 'email' ? 'Email' : 'Webhook'), h('td', {class:'mono small'}, s.target),
+      h('td', {}, s.confirmed ? badge('Confirmed', 'success') : badge('Waiting for confirmation')), h('td', {class:'num'}, fmtTime(s.created)),
+      h('td', {}, h('div', {class:'actions'}, h('button', {class:'ghost danger', onclick:ask({title:`Remove ${s.target}?`, body:'They stop getting updates. They can subscribe again from the page.', confirm:'Remove subscriber'}, async () => { await api('DELETE', `${V1}/status-subscribers/${s.id}`); toast('Subscriber removed.'); refresh(); })}, 'Remove')))))));
+  }
+  S.headerAction = null;
+  const r = await api('GET', V1 + '/statuspage'), c = r.settings;
+  const f = { title: h('input', {value:c.title}), desc: h('textarea', {}, c.description), logo: h('input', {type:'url', value:c.logoUrl, placeholder:'https://example.com/logo.svg'}),
+    accent: h('input', {value:c.accent, placeholder:'#1f5c5c'}), support: h('input', {value:c.supportUrl, placeholder:'https://example.com/support or mailto:help@example.com'}),
+    footer: h('input', {value:c.footer}), domain: h('input', {value:c.domain, placeholder:'status.example.com'}) };
+  const save = act(async () => {
+    await api('PUT', V1 + '/statuspage', {title:f.title.value, description:f.desc.value, logoUrl:f.logo.value, accent:f.accent.value, supportUrl:f.support.value, footer:f.footer.value, domain:f.domain.value});
+    toast('Status page saved.'); refresh();
+  });
+  if (!admin) [...Object.values(f)].forEach(i => i.disabled = true);
+  return h('div', {}, tabs,
+    card('Address', h('div', {class:'stack'}, h('p', {class:'small dim', style:'margin:0'}, 'Monitors and incidents appear here when you mark them to show on the public status page.'),
+      h('div', {}, h('div', {class:'small dim'}, 'Status page'), h('a', {href:r.pageUrl, target:'_blank', rel:'noopener', class:'mono'}, r.pageUrl)),
+      h('div', {}, h('div', {class:'small dim'}, 'RSS feed'), h('a', {href:r.feedUrl, target:'_blank', rel:'noopener', class:'mono'}, r.feedUrl)),
+      r.email ? null : h('p', {class:'small dim', style:'margin:0'}, 'Email subscriptions are off until an SMTP server is set (SANDBAR_SMTP_HOST). Webhooks and RSS work without it.'))),
+    card('Branding', h('div', {class:'stack'}, field('Title', f.title), field('Description', f.desc, 'Shown under the title.'), h('div', {class:'grid'}, field('Logo address', f.logo, 'An https:// address of an image.'),
+      field('Accent color', f.accent, 'Buttons and links, as #rrggbb. Leave empty for the default. White text must stay readable on it.')),
+      h('div', {class:'grid'}, field('Contact link', f.support, 'Adds a Contact us button.'), field('Footer text', f.footer)))),
+    card('Custom domain', h('div', {class:'stack'}, field('Host name', f.domain, 'Serve the page at the root of this host name, such as status.example.com. Leave empty to use the address above only.'),
+      h('p', {class:'small dim', style:'margin:0'}, 'Point a DNS record for it at the server that runs Sandbar, and have your reverse proxy forward that host name to Sandbar with the Host header unchanged. Sandbar serves only the status page on that host. The proxy provides the certificate.'))),
+    admin ? h('div', {class:'actions form-actions'}, h('button', {class:'btn', onclick:save}, 'Save status page')) : null);
+};
+function groupDialog(g) {
+  const e = !!g; g = g || {order:(S.sgroups || []).length + 1};
+  const f = { name: h('input', {value:g.name || ''}), desc: h('input', {value:g.description || ''}), order: h('input', {type:'number', value:g.order})};
+  dialogForm(e ? 'Edit ' + g.name : 'Add a group', null, [field('Name', f.name), field('Description', f.desc, 'Optional, shown under the name.'), field('Order', f.order, 'Groups are listed from the lowest number to the highest.')], e ? 'Save changes' : 'Add group',
+    async () => { await api(e ? 'PUT' : 'POST', V1 + '/status-groups' + (e ? '/' + g.id : ''), {name:f.name.value, description:f.desc.value, order:+f.order.value || 0}); toast('Group saved.'); refresh(); });
+}
+async function maintenanceDialog(m) {
+  const e = !!m, mons = await publicMonitors(), soon = Math.ceil(Date.now() / 3600000) * 3600 + 3600;
+  m = m || {start:soon, end:soon + 3600, components:[]};
+  const picker = componentPicker(mons, m.components);
+  const f = { title: h('input', {value:m.title || ''}), msg: h('textarea', {}, m.message || ''), start: h('input', {type:'datetime-local', value:fromUnix(m.start)}), end: h('input', {type:'datetime-local', value:fromUnix(m.end)}) };
+  dialogForm(e ? 'Edit ' + m.title : 'Schedule maintenance', 'Subscribers are told now, when it starts and when it ends. Times are in your time zone.',
+    [field('Title', f.title, 'What is happening, in a few words.'), field('Details', f.msg, 'What customers should expect.'), h('div', {class:'grid'}, field('Starts', f.start), field('Ends', f.end)), field('Affected components', picker, 'They show as under maintenance during the window.')],
+    e ? 'Save changes' : 'Schedule maintenance',
+    async () => { await api(e ? 'PUT' : 'POST', V1 + '/maintenance' + (e ? '/' + m.id : ''), {title:f.title.value, message:f.msg.value, start:toUnix(f.start.value), end:toUnix(f.end.value), components:picker.values()}); toast('Maintenance saved.'); refresh(); });
+}
+
 // ---------- channels ----------
 views.channels = async () => {
   S.headerAction = isAdmin() ? ['Add channel', () => channelDialog()] : null;
@@ -754,9 +884,106 @@ function passwordDialog(u) {
   dialogForm('Set a password for ' + u.name, 'They are signed out everywhere.', [field('New password', pw, 'At least 10 characters')], 'Set password', async () => { await api('POST', `${V1}/users/${u.id}/password`, {password:pw.value}); toast('Password changed.'); });
 }
 
+// ---------- websites (analytics) ----------
+const RANGES = [['24h', 'Last 24 hours'], ['7d', 'Last 7 days'], ['30d', 'Last 30 days'], ['90d', 'Last 90 days']];
+const num = n => Number(n || 0).toLocaleString();
+function regionName(code) { try { return new Intl.DisplayNames(undefined, {type:'region'}).of(code) || code; } catch (e) { return code; } }
+function languageName(code) { try { return new Intl.DisplayNames(undefined, {type:'language'}).of(code) || code; } catch (e) { return code; } }
+
+views.websites = async () => {
+  if (S.arg) return websiteDetail(S.arg);
+  const admin = S.me.role === 'admin';
+  S.headerAction = admin ? ['Add website', () => websiteDialog()] : null;
+  const [sites, sum] = await Promise.all([api('GET', V1 + '/websites'), api('GET', V1 + '/website-summary')]);
+  if (!sites.length) return emptyState('websites', 'No websites yet', 'Add a website, then paste one line of code into its pages. Visitors and page views show up here. No cookies are set and no personal data is kept.',
+    admin ? h('button', {class:'btn', onclick:() => websiteDialog()}, 'Add website') : null);
+  return table(['Website', 'Visitors, last 24 hours', 'Page views, last 24 hours', ''], sites.map(w => { const s = sum[w.id] || {};
+    return h('tr', {}, h('td', {}, h('a', {href:'#websites/' + w.id}, w.name), w.domain ? h('div', {class:'small dim'}, w.domain) : null),
+      h('td', {class:'num'}, num(s.visitors)), h('td', {class:'num'}, num(s.views)),
+      h('td', {}, h('div', {class:'actions'}, h('button', {class:'ghost', onclick:() => trackingDialog(w)}, 'Tracking code'),
+        admin ? h('button', {class:'ghost', onclick:() => websiteDialog(w)}, 'Edit') : null,
+        admin ? h('button', {class:'ghost danger', onclick:ask({title:`Delete ${w.name}?`, body:'The website and all of its visits and events are removed. This cannot be undone.', confirm:'Delete website'}, async () => { await api('DELETE', `${V1}/websites/${w.id}`); toast('Website deleted.'); refresh(); })}, 'Delete') : null)));
+  }));
+};
+function websiteDialog(w) {
+  const e = !!w, f = { name: h('input', {value:w ? w.name : ''}), domain: h('input', {value:w ? w.domain : '', placeholder:'example.com'}) };
+  dialogForm(e ? 'Edit ' + w.name : 'Add a website', null, [field('Name', f.name), field('Domain', f.domain, 'Optional. When set, visits from other domains are ignored, which stops others counting against your site.')], e ? 'Save changes' : 'Add website',
+    async () => { const saved = await api(e ? 'PUT' : 'POST', e ? `${V1}/websites/${w.id}` : V1 + '/websites', {...(w || {}), name:f.name.value, domain:f.domain.value}); toast(e ? 'Website saved.' : 'Website added.'); await refresh(); if (!e) trackingDialog(saved); });
+}
+function trackingDialog(w) {
+  const tag = `<script defer src="${origin()}/script.js" data-website="${w.id}"><\/script>`;
+  const done = modal('Tracking code for ' + w.name, h('div', {class:'stack'},
+    h('p', {class:'dim', style:'margin:0'}, 'Paste this inside the head of every page you want to count.'), cmdBox(tag),
+    h('p', {class:'dim', style:'margin:0'}, 'Single-page sites are counted as people move between pages. To count something else, such as a sign-up, call this from your code:'),
+    cmdBox('sandbar.track("signup", { plan: "pro" })'),
+    h('p', {class:'small dim', style:'margin:0'}, 'The script sets no cookies, keeps no IP address, and does nothing when the visitor has Do Not Track on. Behind a reverse proxy, set SANDBAR_TRUST_PROXY=1 so visitors are told apart.'),
+    h('div', {class:'actions form-actions'}, h('button', {class:'btn', onclick:() => done()}, 'Done'))));
+}
+async function websiteDetail(id) {
+  S.noHeader = true;
+  const range = S.siteRange || '7d';
+  const [sites, st] = await Promise.all([api('GET', V1 + '/websites'), api('GET', `${V1}/websites/${id}/stats?range=${range}`)]);
+  setTimeout(() => { S.noHeader = false; });
+  const w = sites.find(x => x.id === id);
+  if (!w) return emptyState('websites', 'That website no longer exists', 'It may have been deleted.', h('a', {class:'btn', href:'#websites'}, 'Back to websites'));
+  const tabs = h('div', {class:'tabs2', role:'group', 'aria-label':'Time range'}, RANGES.map(([k, l]) => h('button', {class:range === k ? 'on' : '', 'aria-pressed':range === k, onclick:() => { S.siteRange = k; refresh(); }}, l)));
+  const tile = (n, l) => h('div', {class:'stat'}, h('div', {class:'n'}, n), h('div', {class:'l'}, l));
+  const stats = h('div', {class:'stats'}, tile(num(st.visitors), 'Visitors'), tile(num(st.views), 'Page views'), tile(num(st.visits), 'Visits'),
+    tile(st.bounceRate >= 0 ? Math.round(st.bounceRate) + '%' : 'No data', 'Bounce rate'), tile(num(st.online), 'Online now'));
+  const max = Math.max(1, ...st.series.map(p => p.views));
+  const fmt = p => new Date(p.t * 1000).toLocaleString(undefined, st.bucket === 'hour' ? {month:'short', day:'numeric', hour:'numeric'} : {month:'short', day:'numeric', year:'numeric'});
+  const chart = h('div', {class:'chart', role:'img', 'aria-label':`${num(st.views)} page views from ${num(st.visitors)} visitors in the ${RANGES.find(r => r[0] === range)[1].toLowerCase()}`},
+    st.series.map(p => h('div', {class:'col', title:`${fmt(p)}: ${num(p.visitors)} visitors, ${num(p.views)} page views`},
+      h('div', {class:'v', style:`height:${p.views ? Math.max(2, p.views * 100 / max) : 0}%`}), h('div', {class:'u', style:`height:${p.visitors ? Math.max(2, p.visitors * 100 / max) : 0}%`}))));
+  const list = (title, rows, label, nameOf) => {
+    const top = Math.max(1, ...rows.map(r => r.views));
+    return h('div', {class:'card'}, h('h2', {}, title), rows.length ? h('table', {class:'top'}, h('thead', {}, h('tr', {}, h('th', {scope:'col'}, label), h('th', {scope:'col'}, 'Visitors'), h('th', {scope:'col'}, 'Views'))),
+      h('tbody', {}, rows.map(r => h('tr', {}, h('td', {style:`--w:${Math.round(r.views * 100 / top)}%`}, nameOf ? nameOf(r.name) : r.name), h('td', {class:'num'}, num(r.visitors)), h('td', {class:'num'}, num(r.views))))))
+      : h('p', {class:'dim', style:'margin:0'}, 'Nothing yet.'));
+  };
+  const nothing = !st.views && !st.events.length;
+  return h('div', {}, h('div', {class:'page-h'}, h('div', {}, h('a', {href:'#websites', class:'small'}, 'Back to websites'), h('h1', {}, w.name), h('p', {}, w.domain || 'Any domain')),
+      h('button', {class:'ghost', onclick:() => trackingDialog(w)}, 'Tracking code')),
+    tabs, h('div', {style:'height:16px'}), stats,
+    nothing ? emptyState('websites', 'No visits in this period', 'Paste the tracking code into your pages, then open one. The first visit appears within a few seconds.', h('button', {class:'btn', onclick:() => trackingDialog(w)}, 'Show tracking code')) : h('div', {},
+      card('Visitors and page views', h('div', {class:'legend'}, h('span', {}, h('i', {style:'background:var(--accent)'}), 'Visitors'), h('span', {}, h('i', {style:'background:color-mix(in srgb, var(--accent) 35%, var(--surface))'}), 'Page views')), chart,
+        h('div', {class:'axis2', 'aria-hidden':'true'}, h('span', {}, fmt(st.series[0])), h('span', {}, 'Now'))),
+      h('div', {class:'cols'}, list('Pages', st.pages, 'Path'), list('Referrers', st.referrers, 'Source'), list('Browsers', st.browsers, 'Browser'), list('Operating systems', st.systems, 'System'),
+        list('Devices', st.devices, 'Device'), list('Countries', st.countries, 'Country', n => n.length === 2 ? regionName(n) : n), list('Languages', st.languages, 'Language', n => n.length <= 3 ? languageName(n) : n),
+        list('Events', st.events, 'Event'))));
+}
+
 // ---------- account ----------
+// Administrators see which release is running and can install a newer one. The server restarts
+// into the new binary, so the page waits for it to come back.
+function updateCard(u) {
+  const status = h('p', {style:'margin:0'}), detail = h('p', {class:'dim', style:'margin:0'}), actions = h('div', {class:'actions form-actions'});
+  const paint = u => {
+    status.replaceChildren(`Running ${u.current}. `, u.error ? 'The newest release could not be checked.' : u.newer ? `${u.latest} is available.` : u.latest ? 'This is the newest release.' : '');
+    detail.textContent = u.error ? u.error : !u.canInstall ? u.reason : u.autoUpdate ? 'Automatic updates are on. Sandbar checks every few hours.' : 'Automatic updates are off. Set SANDBAR_AUTO_UPDATE=1 and restart to turn them on.';
+    actions.replaceChildren(...[h('button', {class:'ghost', onclick:act(async () => { paint(await api('GET', V1 + '/system/update?fresh=1')); })}, 'Check again'),
+      u.newer && u.canInstall ? h('button', {class:'btn', onclick:ask({title:`Update to ${u.latest}?`, danger:false, confirm:'Update now',
+        body:'Sandbar downloads the release, checks it, and restarts. Monitoring and paging pause for a few seconds. Your data is not changed.'}, async () => {
+        await api('POST', V1 + '/system/update', {}); wait(u.current); })}, `Update to ${u.latest}`) : null].filter(Boolean));
+  };
+  const wait = async from => {
+    actions.replaceChildren(); status.textContent = 'Updating.';
+    for (let i = 0; i < 120; i++) {
+      await new Promise(r => setTimeout(r, 1500));
+      let s; try { s = await api('GET', V1 + '/system/update'); } catch (e) { detail.textContent = 'Restarting.'; continue; }
+      if (s.current !== from) { toast(`Updated to ${s.current}.`); return refresh(); }
+      if (s.failed) { toast(s.failed, true); return paint(s); }
+      detail.textContent = s.line || s.stage;
+    }
+    toast('Sandbar did not come back in time. Check the server.', true);
+  };
+  paint(u);
+  return card('Software update', h('div', {class:'stack'}, status, detail, actions));
+}
+
 views.account = async () => {
   const keys = await api('GET', V1 + '/apikeys'), pw = h('input', {type:'password', autocomplete:'new-password'});
+  const upd = S.me.role === 'admin' ? await api('GET', V1 + '/system/update').catch(() => null) : null;
   S.headerAction = null;
   return h('div', {}, card('Password', h('div', {class:'stack'}, field('New password', pw, 'At least 10 characters. You are signed out on other devices.'),
       h('div', {class:'actions form-actions'}, h('button', {class:'btn', onclick:act(async () => { await api('POST', `${V1}/users/${S.me.id}/password`, {password:pw.value}); pw.value = ''; toast('Password changed. Sign in again.'); S.me = null; boot(); })}, 'Change password')))),
@@ -766,7 +993,7 @@ views.account = async () => {
       h('button', {class:'ghost', onclick:() => { const n = h('input'); dialogForm('Create an API key', null, [field('Name', n, 'Where you will use it, such as "prometheus".')], 'Create key', async () => {
         const k = await api('POST', V1 + '/apikeys', {name:n.value}); refresh();
         const done = modal('Copy your API key', h('div', {class:'stack'}, h('p', {class:'dim', style:'margin:0'}, 'This is the only time it is shown.'), cmdBox(k.token), h('div', {class:'actions form-actions'}, h('button', {class:'btn', onclick:() => done()}, 'Done')))); }); }}, icon('add', 16), 'Create API key')),
-    card('Your personal topic', h('p', {class:'dim'}, 'Subscribe to this topic in the ntfy app, or in a browser on the Topics page, to be paged when an escalation policy reaches you.'), cmdBox(S.me.topic)));
+    card('Your personal topic', h('p', {class:'dim'}, 'Subscribe to this topic in the ntfy app, or in a browser on the Topics page, to be paged when an escalation policy reaches you.'), cmdBox(S.me.topic)), upd ? updateCard(upd) : null);
 };
 
 boot();

internal/sandbar/web/script.js

@@ -0,0 +1,66 @@
+/* Sandbar website analytics. Add to a page:
+   <script defer src="https://sandbar.example.com/script.js" data-website="WEBSITE_ID"></script>
+   It sets no cookies and stores nothing in the browser. It sends the page path, the referrer, the
+   language and the browser's own user agent, and it honors Do Not Track.
+   Options on the tag: data-hash (count #hash changes as pages), data-auto="false" (send nothing
+   until you call sandbar.view() yourself). Custom events: sandbar.track("signup", {plan: "pro"}). */
+(function () {
+  var tag = document.currentScript;
+  if (!tag) return;
+  var site = tag.getAttribute('data-website');
+  if (!site) return;
+  var base = tag.src.replace(/\/script\.js(\?.*)?$/, '');
+  var dnt = navigator.doNotTrack === '1' || window.doNotTrack === '1' || navigator.msDoNotTrack === '1';
+  var withHash = tag.hasAttribute('data-hash');
+  var last = '';
+  var first = true;
+
+  function send(body) {
+    if (dnt) return;
+    body.website = site;
+    body.hostname = location.hostname;
+    body.language = navigator.language || '';
+    var json = JSON.stringify(body);
+    // text/plain keeps this a "simple" cross-origin request, so no preflight is needed
+    try {
+      if (navigator.sendBeacon && navigator.sendBeacon(base + '/api/send', new Blob([json], { type: 'text/plain' }))) return;
+    } catch (e) { /* fall through to fetch */ }
+    try {
+      fetch(base + '/api/send', { method: 'POST', body: json, headers: { 'Content-Type': 'text/plain' }, keepalive: true, mode: 'cors', credentials: 'omit' });
+    } catch (e) { /* analytics must never break the page */ }
+  }
+
+  function view() {
+    var path = location.pathname + (withHash ? location.hash : '');
+    if (path === last) return;
+    last = path;
+    send({ path: path, referrer: first ? document.referrer : '' });
+    first = false;
+  }
+
+  function hook(name) {
+    var orig = history[name];
+    if (!orig) return;
+    history[name] = function () {
+      var r = orig.apply(this, arguments);
+      setTimeout(view, 0);
+      return r;
+    };
+  }
+  hook('pushState');
+  hook('replaceState');
+  window.addEventListener('popstate', function () { setTimeout(view, 0); });
+  if (withHash) window.addEventListener('hashchange', function () { setTimeout(view, 0); });
+
+  window.sandbar = {
+    view: view,
+    track: function (name, data) {
+      if (!name) return;
+      send({ path: location.pathname, event: String(name).slice(0, 80), data: data });
+    }
+  };
+
+  if (tag.getAttribute('data-auto') === 'false') return;
+  if (document.readyState === 'complete') view();
+  else window.addEventListener('load', view);
+})();

internal/sandbar/web/status.html

@@ -4,7 +4,8 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="color-scheme" content="light dark">
-<title>Status</title>
+<title>__TITLE__</title>
+<link rel="alternate" type="application/rss+xml" title="__TITLE__" href="__BASE__/feed.rss">
 <style>
   /* tokens:begin  Design tokens, the Lightwell design language (docs/design.md). This is the only place raw colors and sizes are defined. */
   :root {
@@ -33,72 +34,340 @@
   /* tokens:end */
 
   *, *::before, *::after { box-sizing:border-box; }
+  [hidden] { display:none !important; }
   body { margin:0; background:var(--bg); color:var(--text); font:var(--text-base)/var(--leading) var(--font); -webkit-font-smoothing:antialiased; }
-  h1, h2 { margin:0; line-height:1.25; font-weight:600; letter-spacing:-.01em; }
-  h1 { font-size:var(--text-2xl); } h2 { font-size:var(--text-lg); margin:var(--s6) 0 var(--s3); }
-  main { max-width:var(--content-max); margin:0 auto; padding:var(--s6) var(--s4) var(--s8); }
+  h1, h2, h3 { margin:0; line-height:1.25; font-weight:600; letter-spacing:-.01em; }
+  h1 { font-size:var(--text-2xl); } h2 { font-size:var(--text-lg); margin:var(--s6) 0 var(--s3); } h3 { font-size:var(--text-base); }
+  main { max-width:var(--content-max); margin:0 auto; padding:var(--s6) var(--s4) var(--s5); }
+  footer { max-width:var(--content-max); margin:0 auto; padding:0 var(--s4) var(--s8); color:var(--text-muted); font-size:var(--text-sm); }
+  footer .links { display:flex; gap:var(--s4); flex-wrap:wrap; margin-bottom:var(--s2); }
+  a { color:var(--accent-text); }
+  p { margin:0; }
   .dim { color:var(--text-muted); } .small { font-size:var(--text-sm); } .num { font-variant-numeric:tabular-nums; }
+  .head { display:flex; align-items:center; justify-content:space-between; gap:var(--s4); flex-wrap:wrap; }
+  .brand { display:flex; align-items:center; gap:var(--s3); min-width:0; }
+  .brand img { max-height:40px; max-width:160px; object-fit:contain; }
+  .brand a { color:inherit; text-decoration:none; }
+  .actions { display:flex; gap:var(--s2); flex-wrap:wrap; }
+  .btn, .ghost { display:inline-flex; align-items:center; justify-content:center; min-height:36px; padding:var(--s2) var(--s4); border-radius:var(--radius); font:inherit; font-weight:500; text-decoration:none; cursor:pointer; border:var(--border-w) solid transparent; }
+  .btn { background:var(--accent); color:var(--accent-contrast); }
+  .ghost { background:var(--surface); color:var(--text); border-color:var(--border-strong); }
+  .btn:hover { filter:brightness(1.1); } .ghost:hover { background:var(--surface-2); }
+  .desc { margin-top:var(--s2); color:var(--text-muted); }
   .banner { margin-top:var(--s4); padding:var(--s4) var(--s5); border-radius:var(--radius-lg); border:var(--border-w) solid var(--border); font-weight:600; background:var(--surface-2); }
   .banner.operational { background:var(--success-bg); color:var(--success); border-color:var(--success); }
-  .banner.degraded { background:var(--warning-bg); color:var(--warning); border-color:var(--warning); }
+  .banner.degraded, .banner.maintenance { background:var(--warning-bg); color:var(--warning); border-color:var(--warning); }
   .banner.outage { background:var(--danger-bg); color:var(--danger); border-color:var(--danger); }
+  .notice { margin-top:var(--s4); padding:var(--s3) var(--s4); border-radius:var(--radius); border:var(--border-w) solid var(--border-strong); background:var(--surface); display:flex; align-items:center; justify-content:space-between; gap:var(--s3); flex-wrap:wrap; }
   .card { background:var(--surface); border:var(--border-w) solid var(--border); border-radius:var(--radius-lg); overflow:hidden; }
+  .card + .card { margin-top:var(--s3); }
   .row { display:flex; align-items:center; justify-content:space-between; gap:var(--s3); flex-wrap:wrap; padding:var(--s3) var(--s4); border-bottom:var(--border-w) solid var(--border); }
   .row:last-child { border-bottom:0; }
+  .ghead { display:flex; align-items:baseline; justify-content:space-between; gap:var(--s3); flex-wrap:wrap; padding:var(--s3) var(--s4); background:var(--surface-2); border-bottom:var(--border-w) solid var(--border); }
+  .svc { padding:var(--s3) var(--s4) var(--s4); border-bottom:var(--border-w) solid var(--border); }
+  .svc:last-child { border-bottom:0; }
+  .svc .top { display:flex; align-items:center; justify-content:space-between; gap:var(--s3); flex-wrap:wrap; }
+  .bars { display:flex; gap:2px; height:32px; margin-top:var(--s3); }
+  .bar { flex:1; min-width:0; border-radius:2px; background:var(--neutral-bg); }
+  .bar.ok { background:var(--success); } .bar.warn { background:var(--warning); } .bar.bad { background:var(--danger); }
+  .bar:hover { opacity:.7; }
+  .axis { display:flex; justify-content:space-between; margin-top:var(--s1); font-size:var(--text-xs); color:var(--text-faint); }
+  .tip { position:fixed; z-index:10; pointer-events:none; max-width:240px; padding:var(--s2) var(--s3); border-radius:var(--radius); background:var(--surface); color:var(--text); border:var(--border-w) solid var(--border-strong); font-size:var(--text-sm); }
+  .tip strong { display:block; }
+  @media (max-width:480px) { .bars { gap:1px; } }
   .badge { display:inline-flex; align-items:center; padding:2px var(--s2); border-radius:999px; font-size:var(--text-xs); font-weight:600; background:var(--neutral-bg); color:var(--text-muted); white-space:nowrap; }
   .badge-success { background:var(--success-bg); color:var(--success); }
   .badge-warning { background:var(--warning-bg); color:var(--warning); }
   .badge-danger { background:var(--danger-bg); color:var(--danger); }
+  .badge-accent { background:var(--accent-soft); color:var(--accent-text); }
   .inc { padding:var(--s4); border-bottom:var(--border-w) solid var(--border); }
   .inc:last-child { border-bottom:0; }
-  .inc ul { margin:var(--s2) 0 0; padding-left:var(--s5); }
+  .inc h3 a { color:inherit; }
+  .posts { list-style:none; margin:var(--s3) 0 0; padding:0 0 0 var(--s4); border-left:2px solid var(--border); display:flex; flex-direction:column; gap:var(--s3); }
+  .posts p { white-space:pre-wrap; }
+  .month { font-size:var(--text-sm); font-weight:600; color:var(--text-muted); margin:var(--s5) 0 var(--s2); }
+  .sub { padding:var(--s4); display:grid; gap:var(--s4); }
+  .sub form { display:flex; gap:var(--s2); flex-wrap:wrap; align-items:flex-end; }
+  .sub label { display:flex; flex-direction:column; gap:var(--s1); flex:1; min-width:200px; font-size:var(--text-sm); font-weight:500; }
+  input { font:inherit; min-height:36px; padding:var(--s2) var(--s3); border-radius:var(--radius); border:var(--border-w) solid var(--border-strong); background:var(--surface); color:var(--text); }
+  .mono { font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; font-size:var(--text-sm); word-break:break-all; }
   :focus-visible { outline:2px solid var(--focus); outline-offset:2px; border-radius:var(--radius); }
+  @media (pointer:coarse) { .btn, .ghost, input { min-height:44px; } input { font-size:16px; } }
+  @media (prefers-reduced-motion:no-preference) { .btn, .ghost { transition:background-color .12s, filter .12s; } }
 </style>
 </head>
 <body>
-<main>
-  <h1>Status</h1>
-  <div id="banner" class="banner" role="status">Loading</div>
-  <h2>Services</h2>
-  <div class="card" id="services"></div>
-  <h2>Incidents</h2>
-  <div class="card" id="incidents"></div>
+<div class="tip" id="tip" role="presentation" hidden></div>
+<main id="main" tabindex="-1">
+  <div class="head">
+    <div class="brand" id="brand"></div>
+    <div class="actions" id="actions"></div>
+  </div>
+  <p class="desc" id="desc" hidden></p>
+  <div id="notice"></div>
+  <div id="view" aria-live="polite"><div class="banner" role="status">Loading</div></div>
 </main>
+<footer id="foot"></footer>
 <script>
+const BASE = '__BASE__';
 const $ = id => document.getElementById(id);
 const el = (tag, cls, text) => { const e = document.createElement(tag); if (cls) e.className = cls; if (text != null) e.textContent = text; return e; };
+const link = (href, text, cls) => { const a = el('a', cls, text); a.href = href; return a; };
+const home = BASE || '/';
 const when = t => new Date(t * 1000).toLocaleString(undefined, {month:'short', day:'numeric', year:'numeric', hour:'numeric', minute:'2-digit'});
-const label = { operational: 'All systems are operational', degraded: 'Some systems are affected', outage: 'There is a service outage' };
-const statusBadge = s => s === 'up' ? el('span', 'badge badge-success', 'Operational') : s === 'down' ? el('span', 'badge badge-danger', 'Down') : el('span', 'badge', 'Waiting for first check');
-const incStatus = { investigating: 'Investigating', identified: 'Identified', monitoring: 'Monitoring', resolved: 'Resolved' };
+const monthOf = t => new Date(t * 1000).toLocaleDateString(undefined, {month:'long', year:'numeric'});
 
-async function load() {
-  let d;
-  try { d = await (await fetch('/status.json')).json(); } catch (e) { $('banner').textContent = 'The status could not be loaded. Try again in a moment.'; return; }
-  $('banner').className = 'banner ' + d.overall;
-  $('banner').textContent = label[d.overall] || d.overall;
+const overallLabel = { operational: 'All systems are operational', degraded: 'Some systems are affected', outage: 'There is a service outage', maintenance: 'Scheduled maintenance is in progress' };
+const stateBadge = {
+  operational: ['Operational', 'success'], degraded: ['Degraded performance', 'warning'], partial_outage: ['Partial outage', 'warning'],
+  major_outage: ['Major outage', 'danger'], maintenance: ['Under maintenance', 'accent'], pending: ['Waiting for first check', ''],
+};
+const badge = (text, tone) => el('span', 'badge' + (tone ? ' badge-' + tone : ''), text);
+const incLabel = { investigating: 'Investigating', identified: 'Identified', monitoring: 'Monitoring', resolved: 'Resolved' };
+const incTone = s => s === 'resolved' ? 'success' : s === 'monitoring' ? 'accent' : 'warning';
 
-  const sv = $('services'); sv.replaceChildren();
-  if (!d.monitors.length) sv.append(el('div', 'row dim', 'No services are published yet.'));
-  for (const m of d.monitors) {
-    const r = el('div', 'row');
-    r.append(el('span', '', m.name));
-    const right = el('span', 'small dim num');
-    right.append(statusBadge(m.status), document.createTextNode(m.uptime >= 0 ? ' ' + m.uptime.toFixed(2) + '% uptime' : ''));
-    r.append(right); sv.append(r);
+// One bar per UTC day, oldest first. A day is green with no failed checks, amber when at least 99% passed,
+// and red below that. Color is never the only signal: the tooltip and the label say it in words.
+const dayFmt = new Intl.DateTimeFormat(undefined, {month:'short', day:'numeric', year:'numeric', timeZone:'UTC'});
+const dayClass = ([c, f]) => !c ? '' : !f ? 'ok' : (c - f) / c >= 0.99 ? 'warn' : 'bad';
+function dayText([c, f], i, n, today) {
+  const d = new Date(today + 'T00:00:00Z'); d.setUTCDate(d.getUTCDate() - (n - 1 - i));
+  if (!c) return [dayFmt.format(d), 'No data'];
+  const up = ((c - f) * 100 / c).toFixed(2) + '% uptime';
+  return [dayFmt.format(d), f ? up + ', ' + f.toLocaleString() + ' failed of ' + c.toLocaleString() + ' checks' : up];
+}
+const tip = $('tip');
+function showTip(e, lines) {
+  tip.replaceChildren(el('strong', '', lines[0]), document.createTextNode(lines[1]));
+  tip.hidden = false;
+  const w = tip.offsetWidth, x = Math.min(Math.max(8, e.clientX - w / 2), innerWidth - w - 8);
+  tip.style.left = x + 'px'; tip.style.top = Math.max(8, e.clientY - tip.offsetHeight - 14) + 'px';
+}
+function component(m, today) {
+  const box = el('div', 'svc'), top = el('div', 'top');
+  top.append(el('span', '', m.name));
+  const right = el('span', 'small dim num'), b = stateBadge[m.state] || stateBadge.pending;
+  right.append(badge(b[0], b[1]), document.createTextNode(m.uptime >= 0 ? ' ' + m.uptime.toFixed(2) + '% uptime' : ''));
+  top.append(right); box.append(top);
+  const days = m.days || [], bars = el('div', 'bars');
+  const bad = days.filter(d => dayClass(d) === 'bad').length, warn = days.filter(d => dayClass(d) === 'warn').length;
+  bars.setAttribute('role', 'img');
+  bars.setAttribute('aria-label', m.name + ', the last ' + days.length + ' days: ' + (m.uptime >= 0 ? m.uptime.toFixed(2) + '% uptime' : 'no checks yet') +
+    (bad || warn ? ', ' + bad + ' days with an outage and ' + warn + ' with short failures' : ', no failures'));
+  days.forEach((d, i) => {
+    const s = el('span', 'bar ' + dayClass(d));
+    const lines = dayText(d, i, days.length, today);
+    s.addEventListener('pointerenter', e => showTip(e, lines));
+    s.addEventListener('pointermove', e => showTip(e, lines));
+    s.addEventListener('pointerleave', () => { tip.hidden = true; });
+    bars.append(s);
+  });
+  const axis = el('div', 'axis'); axis.setAttribute('aria-hidden', 'true');
+  axis.append(el('span', '', days.length + ' days ago'), el('span', '', 'Today'));
+  if (days.length) box.append(bars, axis);
+  return box;
+}
+
+const worst = ['operational', 'pending', 'maintenance', 'degraded', 'partial_outage', 'major_outage'];
+function groups(d) {
+  const out = [], byId = {};
+  const open = (id, g) => { byId[id] = { g, items: [] }; out.push(byId[id]); };
+  open('', null);
+  for (const g of d.groups) open(g.id, g);
+  for (const m of d.monitors) (byId[m.group] || byId['']).items.push(m);
+  return out.filter(x => x.items.length);
+}
+function services(d) {
+  const wrap = el('div');
+  if (!d.monitors.length) { const c = el('div', 'card'); c.append(el('div', 'row dim', 'No services are published yet.')); wrap.append(c); return wrap; }
+  for (const { g, items } of groups(d)) {
+    const card = el('div', 'card');
+    if (g) {
+      const head = el('div', 'ghead'), left = el('div');
+      left.append(el('h3', '', g.name));
+      if (g.description) left.append(el('div', 'small dim', g.description));
+      const w = items.map(i => i.state).reduce((a, s) => worst.indexOf(s) > worst.indexOf(a) ? s : a, 'operational'), b = stateBadge[w];
+      head.append(left, badge(b[0], b[1])); card.append(head);
     }
+    for (const m of items) card.append(component(m, d.today));
+    wrap.append(card);
+  }
+  return wrap;
+}
 
-  const ic = $('incidents'); ic.replaceChildren();
+function posts(list) {
+  const ul = el('ul', 'posts');
+  for (const u of list) {
+    const li = el('li'), head = el('div', 'small');
+    head.append(el('strong', '', incLabel[u.status] || 'Update'), el('span', 'dim num', ' · ' + when(u.time)));
+    li.append(head, el('p', '', u.text)); ul.append(li);
+  }
+  return ul;
+}
+function incident(i, full) {
+  const b = el('div', 'inc'), head = el('h3');
+  head.append(full ? document.createTextNode(i.title) : link(BASE + '/incidents/' + i.id, i.title), document.createTextNode(' '), badge(incLabel[i.status] || i.status, incTone(i.status)));
+  b.append(head);
+  b.append(el('div', 'small dim', 'Started ' + when(i.created) + (i.resolved ? ', resolved ' + when(i.resolved) : '') + (i.components.length ? ' · Affects ' + i.components.join(', ') : '')));
+  b.append(posts(i.updates));
+  return b;
+}
+function maintenance(m) {
+  const b = el('div', 'inc'), head = el('h3');
+  head.append(document.createTextNode(m.title + ' '), m.state === 'in_progress' ? badge('In progress', 'accent') : m.state === 'scheduled' ? badge('Scheduled', '') : badge('Completed', 'success'));
+  b.append(head, el('div', 'small dim', when(m.start) + ' to ' + when(m.end) + (m.components.length ? ' · Affects ' + m.components.join(', ') : '')));
+  if (m.message) { const p = el('p', '', m.message); p.style.whiteSpace = 'pre-wrap'; p.style.marginTop = 'var(--s2)'; b.append(p); }
+  return b;
+}
+
+// ---------- branding, header, footer ----------
+function brand(d) {
+  const s = d.settings;
+  if (s.accent) { document.documentElement.style.setProperty('--accent', s.accent); }
+  const b = $('brand'); b.replaceChildren();
+  if (s.logoUrl) { const img = el('img'); img.src = s.logoUrl; img.alt = ''; img.referrerPolicy = 'no-referrer'; img.addEventListener('error', () => img.remove()); b.append(img); }
+  const h = el('h1'); h.append(link(home, s.title)); b.append(h);
+  const desc = $('desc'); desc.textContent = s.description || ''; desc.hidden = !s.description;
+  const a = $('actions'); a.replaceChildren();
+  const sub = el('button', 'btn', 'Subscribe to updates'); sub.type = 'button'; sub.setAttribute('aria-expanded', 'false'); sub.setAttribute('aria-controls', 'subpanel');
+  sub.addEventListener('click', () => { const p = $('subpanel'); if (!p) return location.assign(home + '#subscribe'); p.hidden = !p.hidden; sub.setAttribute('aria-expanded', String(!p.hidden)); if (!p.hidden) p.querySelector('input').focus(); });
+  a.append(sub);
+  if (s.supportUrl) a.append(link(s.supportUrl, 'Contact us', 'ghost'));
+  const f = $('foot'); f.replaceChildren();
+  const links = el('div', 'links');
+  links.append(link(BASE + '/history', 'Incident history'), link(BASE + '/feed.rss', 'RSS feed'));
+  f.append(links);
+  if (s.footer) f.append(el('p', '', s.footer));
+}
+
+// ---------- subscribe ----------
+async function post(path, body) {
+  const r = await fetch(path, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok) throw new Error(j.error || 'Something went wrong. Try again in a moment.');
+  return j;
+}
+function subscribePanel(d) {
+  const p = el('div', 'card sub'); p.id = 'subpanel'; p.hidden = location.hash !== '#subscribe';
+  p.append(el('h3', '', 'Get notified when something changes'));
+  const msg = el('p', 'small'); msg.setAttribute('role', 'status');
+  const form = (kind, label, type, hint, button) => {
+    const f = el('form'), l = el('label', '', label), i = el('input');
+    i.type = type; i.required = true; i.name = kind; i.autocomplete = kind === 'email' ? 'email' : 'off';
+    if (kind === 'webhook') i.placeholder = 'https://example.com/hooks/status';
+    l.append(i); f.append(l);
+    const b = el('button', 'btn', button); b.type = 'submit'; f.append(b);
+    f.addEventListener('submit', async e => {
+      e.preventDefault(); b.disabled = true; msg.textContent = '';
+      try { const j = await post(BASE + '/subscribe', { [kind]: i.value.trim() }); msg.textContent = j.message; i.value = ''; }
+      catch (err) { msg.textContent = err.message; }
+      b.disabled = false;
+    });
+    const w = el('div'); w.append(f); if (hint) w.append(el('p', 'small dim', hint)); w.lastChild.style.marginTop = 'var(--s2)';
+    return w;
+  };
+  if (d.subscribe.email) p.append(form('email', 'Email address', 'email', 'We send a link to confirm. Every update comes with a link to unsubscribe.', 'Subscribe by email'));
+  if (d.subscribe.webhook) p.append(form('webhook', 'Webhook address', 'url', 'We send a JSON request for every update. Your server has to answer a test request first.', 'Subscribe with a webhook'));
+  const rss = el('div'); rss.append(el('p', 'small', 'Or follow the RSS feed:'));
+  const a = link(BASE + '/feed.rss', location.origin + BASE + '/feed.rss', 'mono'); rss.append(a);
+  p.append(rss, msg);
+  return p;
+}
+
+// ---------- pages ----------
+async function getJSON(path) {
+  const r = await fetch(path);
+  if (!r.ok) throw new Error(String(r.status));
+  return r.json();
+}
+async function showHome() {
+  const d = await getJSON('/status.json');
+  document.title = d.settings.title;
+  brand(d);
+  const v = el('div');
+  const ban = el('div', 'banner ' + d.overall, overallLabel[d.overall] || d.overall); ban.setAttribute('role', 'status');
+  v.append(ban);
+  if (d.subscribe.email || d.subscribe.webhook) { const sp = subscribePanel(d); sp.style.marginTop = 'var(--s4)'; v.append(sp); }
+  if (d.maintenance.length) {
+    v.append(el('h2', '', 'Scheduled maintenance'));
+    const c = el('div', 'card'); for (const m of d.maintenance) c.append(maintenance(m)); v.append(c);
+  }
+  v.append(el('h2', '', 'Services'), services(d));
+  v.append(el('h2', '', 'Incidents'));
+  const ic = el('div', 'card');
   if (!d.incidents.length) ic.append(el('div', 'row dim', 'No incidents in the last 14 days.'));
-  for (const i of d.incidents) {
-    const b = el('div', 'inc');
-    const head = el('div'); head.append(el('strong', '', i.title + ' '), el('span', 'badge ' + (i.status === 'resolved' ? 'badge-success' : 'badge-warning'), incStatus[i.status] || i.status));
-    b.append(head, el('div', 'small dim', 'Started ' + when(i.created) + (i.resolved ? ', resolved ' + when(i.resolved) : '')));
-    if (i.updates.length) { const ul = el('ul', 'small'); for (const u of i.updates) ul.append(el('li', '', when(u.time) + ': ' + u.text)); b.append(ul); }
-    ic.append(b);
+  for (const i of d.incidents) ic.append(incident(i, false));
+  v.append(ic);
+  const more = el('p', 'small'); more.style.marginTop = 'var(--s3)'; more.append(link(BASE + '/history', 'See all past incidents'));
+  v.append(more);
+  const old = $('subpanel'), open = old && !old.hidden;
+  $('view').replaceChildren(v);
+  if (open) { $('subpanel').hidden = false; }
+}
+async function showHistory() {
+  const first = await getJSON('/status.json');
+  document.title = 'History - ' + first.settings.title;
+  brand(first);
+  const v = el('div'), list = el('div'), btn = el('button', 'ghost', 'Show older'); btn.type = 'button'; btn.style.marginTop = 'var(--s4)';
+  v.append(el('h2', '', 'Incident history'), list, btn);
+  $('view').replaceChildren(v);
+  let next = 0, last = '';
+  const load = async () => {
+    const h = await getJSON('/status/api/history' + (next ? '?before=' + next : ''));
+    let card = null;
+    for (const e of h.entries) {
+      const m = monthOf(e.time);
+      if (m !== last) { last = m; v.insertBefore(el('div', 'month', m), btn); card = el('div', 'card'); v.insertBefore(card, btn); }
+      card.append(e.type === 'incident' ? incident(e.incident, false) : maintenance(e.maintenance));
+    }
+    if (!list.children.length && !h.entries.length && !next) list.append(el('div', 'card')), list.firstChild.append(el('div', 'row dim', 'Nothing has been posted yet.'));
+    next = h.next; btn.hidden = !next;
+  };
+  btn.addEventListener('click', () => load().catch(fail));
+  await load();
+}
+async function showIncident(id) {
+  const [d, i] = await Promise.all([getJSON('/status.json'), getJSON('/status/api/incidents/' + encodeURIComponent(id))]);
+  document.title = i.title + ' - ' + d.settings.title;
+  brand(d);
+  const v = el('div'), back = el('p', 'small'); back.style.marginTop = 'var(--s5)'; back.append(link(BASE + '/history', 'Back to incident history'));
+  const c = el('div', 'card'); c.style.marginTop = 'var(--s3)'; c.append(incident(i, true));
+  v.append(back, c);
+  $('view').replaceChildren(v);
+}
+
+function fail(e) {
+  const v = $('view');
+  if (e && e.message === '404') { v.replaceChildren(el('div', 'banner', 'That page does not exist. Go back to the ')); v.firstChild.append(link(home, 'status page'), document.createTextNode('.')); return; }
+  if (!v.querySelector('.card')) v.replaceChildren(el('div', 'banner', 'The status could not be loaded. Try again in a moment.'));
+}
+
+// ---------- notices from confirm and unsubscribe links ----------
+function notices() {
+  const q = new URLSearchParams(location.search), n = $('notice');
+  const note = (text, ...extra) => { const d = el('div', 'notice'); d.setAttribute('role', 'status'); d.append(el('span', '', text), ...extra); n.replaceChildren(d); return d; };
+  if (q.get('notice') === 'confirmed') note('You are subscribed. You will get an email for each update.');
+  else if (q.get('notice') === 'invalid') note('That link is not valid. Subscribe again to get a new one.');
+  const token = q.get('unsubscribe');
+  if (token) {
+    const b = el('button', 'btn', 'Unsubscribe'); b.type = 'button';
+    const d = note('Stop getting updates from this page?', b);
+    b.addEventListener('click', async () => {
+      b.disabled = true;
+      try { const j = await post(BASE + '/unsubscribe', { token }); d.replaceChildren(el('span', '', j.message)); history.replaceState(null, '', location.pathname); }
+      catch (e) { d.replaceChildren(el('span', '', e.message)); }
+    });
   }
 }
-load(); setInterval(load, 30000);
+
+const rel = location.pathname.slice(BASE.length).replace(/\/+$/, '');
+let run;
+if (rel === '/history') run = showHistory;
+else if (rel.startsWith('/incidents/')) run = () => showIncident(decodeURIComponent(rel.slice(11)));
+else run = showHome;
+notices();
+run().catch(fail);
+if (run === showHome) setInterval(() => { if (!document.hidden && !document.activeElement.matches('input')) showHome().catch(() => {}); }, 30000);
 </script>
 </body>
 </html>