ArrSight v1.3.0

Highlights

• Modular backend — server.js (1,100+ lines) is split into focused lib/ service
  modules and routes/ handlers. All API routes, response shapes, configuration files,
  and management modes are unchanged, so this release is a drop-in upgrade.
• Safer login throttling behind reverse proxies — when ARRSIGHT_TRUST_PROXY=true
  is set, throttling keys on X-Forwarded-For; without it, forwarded headers are
  ignored and cannot be spoofed to bypass rate limiting.
• Resilient snapshots — a single offline integration (Sonarr, Bazarr, download
  client, Docker, mounts, …) now degrades only its own panel instead of failing the
  whole /api/snapshot request. The dashboard stays usable while a service is down.

Changes

Security

• Proxy-aware client-IP detection for login throttling, gated behind the existing
  ARRSIGHT_TRUST_PROXY=true opt-in. Security model otherwise unchanged: scrypt
  password hashing, timing-safe comparisons, expiring HttpOnly/SameSite sessions,
  same-origin checks, one-time setup code, container allowlists, and server-side
  management-mode enforcement.
• Documented the intentional integration-URL trust model in SECURITY.md: ArrSight
  performs server-side requests to configured services in your own Docker/LAN and
  deliberately does not block private ranges or Docker DNS names.

Internationalization

• Backend responses are now fully structured ({"ok":false,"code":"…"}) with neutral
  English text; the remaining Dutch backend strings were removed.
• Incident titles and advice, action results, and pipeline stage labels are now
  localized in the existing EN/NL catalogs, with server text as fallback.
• The media pipeline stage previously labeled "InfiniDysk" is now "Download client"
  (NL: "Downloadclient").

Reliability & correctness

• Docker stats/logs for the download client now follow config.infinidysk.containerName
  (legacy InfiniDysk container name still works as a fallback).
• Management action responses use stable machine-readable codes
  (management_disabled, container_not_allowed, full_management_required, …).

Packaging & docs

• Docker image labels point at this repository; the Unraid template is now
  unraid/arrsight.xml; snapshot exports are named arrsight-snapshot-*.json.
• CI syntax checks now cover all lib/ and routes/ modules.

For updaters

• No configuration migration required — existing config.json files keep working.
• Compatible with existing Docker, Docker Compose, Unraid and reverse-proxy setups
  (AMD64 + ARM64).
• If you scripted against raw action message/error strings, read code instead.

Full changelog: v1.2.1...v1.3.0

ArrSight v1.2.0

The frontend has been completely redesigned: ArrSight is now a Svelte 5 + Vite 6 single-page operations dashboard. The Node.js backend, its APIs, the authentication/session model and the Docker runtime behavior are unchanged.

New frontend

• App shell — sidebar navigation (Overview, Downloads, Providers, Media, Incidents, System, Logs, Settings) with live badge counts, and a top bar with the overall health indicator, last-measurement time, manual refresh and 60-second auto-refresh.
• Interactive media pipeline — Sonarr/Radarr → Usenet provider → InfiniDysk → WebDAV mount → import/library → Bazarr → Plex, with connectors that turn amber or red when data stops flowing. Pure CSS/SVG, no graph library.
• Detail drawer — every card, pipeline stage and incident opens a slide-in drawer with queue rows, mount latency, provider stats, container state or repair history. Keyboard accessible, closes with Escape, near-fullscreen on mobile.
• Downloads / Providers / Media / Incidents / System — dedicated pages replacing the old four-tab layout: queue classification, wanted/cutoff backlog, verifier and periodic-search summaries, provider trips and missing-article signals, network usage per day/week/month/year.
• Log viewer — six sources (verifier, periodic search, watchdog, actions, InfiniDysk, Bazarr) with severity highlighting.
• In-app login and setup — 401 responses show the ArrSight login view in the app and return you to the requested page; unconfigured instances get the 8-step setup wizard in the same UI.
• Dark-first theme (auto/light/dark), English/Dutch localization preserved, prefers-reduced-motion respected, responsive down to phones.

Fixes

• Static branding (favicon, /icon.png, sidebar mark) is now part of the production image build; hashed assets are served with immutable caching.
• Unraid: the container icon is served by the app itself (/icon.png), no longer a raw.githubusercontent URL that 404s on a private repo.

Build / CI

• Multi-stage Dockerfile: frontend build stage → small Node 20 Alpine runtime (no separate frontend container).
• CI builds the frontend and runs the full test suite (62 tests) before publishing ghcr.io/cyxno/arrsight for AMD64 and ARM64.

Upgrade

Pull the new image and recreate the container; existing /config data stays compatible.

ArrSight v1.1.0

ArrSight v1.1.0

First tagged release of ArrSight — a media stack health dashboard for Sonarr, Radarr, Bazarr, Plex and NzbDAV, built for Unraid.

Highlights

• Health at a glance — live status for all Arr apps, Plex, NzbDAV mount, Docker containers and media symlink integrity
• History — persistent metrics, incidents and usage history
• Safe manual actions — queued, audited host actions wired to Unraid user scripts
• Setup wizard & localization — guided first-run config, multi-language UI
• Docker — lightweight Node 20 Alpine image with healthcheck, PUID/PGID support

Security hardening in this release

• Snapshot, logs and action APIs now require authentication
• Session cookies are HttpOnly, SameSite=Strict and Secure over TLS
• New configurable links section with strict URL validation
• X-Forwarded-Proto is only trusted with explicit ARRSIGHT_TRUST_PROXY=true
• 59/59 automated tests passing

Deployment (Unraid)

Image is built locally from this tag: arrsight:1.1.0-local (revision 4fd1aac), container arr-health-dashboard, port 8090.