v0.1.4

Container identity survives a redeploy

Docker containers were keyed on their container ID. A redeploy issues a new ID, so anything attached to the old row — your notes, your tags, the first_seen date telling you how long that service has been running — could be stranded on a record Homedex had quietly written off.

This came out of the r/golang Small Projects thread, where I raised the two connectors disagreeing about what a container's identity is as an open problem. Two things turned up that are worth stating plainly, because the obvious diagnosis was wrong:

A same-cycle recreate was already handled. An image bump between two scans kept its row, its notes, and its first_seen — the reconciler already adopted the row and re-keyed it. The real failure was narrower: if a scan ran while the container was down, the row was marked gone, and the adoption path skips gone rows. compose down, a scan, then compose up produced a second row and stranded the first along with its notes.

Keying is not why a host scanned by two sources lists things twice. Rows are unique per (connector, natural_key) by design, so each source keeps its own independent view and one source going away can never mark another's services gone. Two sources watching one host still list its containers twice, and making the key strings match would not change that. That is a display question, and it is untouched here.

• Containers are keyed by name, not ID. A name is unique per daemon and a recreate reuses it, so the record — and everything you hung on it — stays put across redeploys and outages.
• The compose service name is not the identity. It looked like the tidier choice, but --scale web=3 gives three live containers the same com.docker.compose.service, which would collapse them into one flapping row. It remains the display label; the container name does the identifying.
• Both collectors now agree. Docker and SSH both key a container as <host>:<container name>. The SSH collector already read {{.Names}}; Docker has been brought in line with it.
• Ports carry their metadata across the re-key. A port's key is derived from its service's, so this change moves every port key once. Ports are now matched by what actually identifies them, so the rows and their notes survive instead of being deleted and recreated.
• Upgrading is silent. The first scan after updating re-keys every existing container. That is bookkeeping, not something that happened in your homelab, so it is not written to the change feed — no wall of "recreated" entries against every service you own. A genuine redeploy still reports, through the image, tag, digest, or state that moved with it.

No migration and no action required. The first scan after upgrading re-keys existing records in place.

---

Not included

Hosts scanned by both a Docker source and an SSH source still list their containers twice. That is per-source isolation working as designed, not the keying bug; merging those views is a separate piece of work.

Also in this release

• Patched the nanoid and postcss advisories in the dev toolchain. Production dependencies remain at zero advisories.

---

Container images are published to ghcr.io/harshshah0203/homedex.
See the upgrade and backup notes before replacing a running instance.

v0.1.3

SSH collector: diagnosable key rejection, and pastes that actually work

Fixes the failure @tslpre hit in #6, where every SSH source failed with an opaque unable to authenticate, attempted methods [none publickey].

I tested the connector against a real sshd with ed25519, ECDSA, RSA (OpenSSH and PKCS#1) keys, encrypted and not, through the HTTP API — the SSH auth itself is correct, including rsa-sha2 negotiation against servers that disable legacy ssh-rsa. That error only reproduces when the server refuses the key we offered, and Homedex printed nothing about which key that was. That opacity was the real bug.

• Key rejection now tells you how to fix it. The error reports the fingerprint, key type, and the exact authorized_keys line Homedex offered, plus the account it used. Copy-paste instead of guesswork.
• Real-world pastes work. Keys pasted with surrounding blank lines or editor indentation used to fail with ssh: no key found. PEM is whitespace sensitive and a browser textarea invites both.
• Browser autofill no longer breaks a valid key. A value autofilled into the passphrase field is ignored for unencrypted keys.
• Clearer mistakes: pasting a public key, or an encrypted key without its passphrase, now say exactly that.
• Form status messages wrap and keep line breaks, so the new multi-line guidance is readable.

Docs: SSH troubleshooting.

v0.1.2

SSH collector: agentless host facts over SSH

Requested by the community in #2 the day of launch — shipped the same week in #6.

Add any Linux box to the ledger with nothing but a read-only SSH account:

• Container facts without exposing the Docker API — docker ps over SSH exec records image, tag, state, compose project, and published/internal ports (IPv4/IPv6 binds deduped)
• Bare hosts count too — listening sockets via ss become port facts even with no Docker anywhere: loopback binds recorded as internal, everything else as published, and listeners already explained by Docker are never double-counted
• Security posture matches the ledger — key-only auth, required host-key pinning (press Test connection once to discover the fingerprint, paste to pin), per-command timeouts, credentials sealed like every connector secret, nothing ever written over the session

Docs: connector guide. Existing databases migrate automatically.

Also in this release: a unified form design system across the setup wizard and every source form, clipboard copy that works over plain http (the common homelab case), and a batch of interaction-feedback fixes from a full UI walkthrough.

Changelog

• aac2ab1 Add the SSH collector: agentless host facts over SSH (#6)
• 11c808c Polish interaction feedback and edge cases found in a full user walkthrough
• b50eb94 Unify record-entry forms with the ledger design system
• 5a14083 Demo seed: register the fixture reverse proxy so route detail names it
• 8f607db Code + security review fixes: data integrity, connector hardening, contract gaps

v0.1.1

Changelog

• 3e040f6 E2E polish: human-readable API errors, honest source states, plural metas
• f4cd3fa Fix Traefik route parsing against real provider-suffixed service names
• 52118a9 Rebrand palette: ledger paper, ink, and carmine
• 49a731d Refine visual design: dense single-line tables, quiet queue line, precise labels
• 0da4717 Refresh README screenshots for the refined UI
• a247fa3 Refresh screenshots after E2E polish
• 2304b27 Refresh screenshots for the paper identity

Container images are published to ghcr.io/harshshah0203/homedex.
See the upgrade and backup notes before replacing a running instance.

v0.1.0

Changelog

• ee5c56d Add README screenshots and capture script
• 53dbd7e Build Homedex v0.1 living homelab inventory (#1)
• 2670dcf Fix multi-arch image builds: native build stages and complete lockfile
• 4a38f9a Fix release image tags: drop invalid is_default_version enable expression
• 1e02fab Initial commit: README, architecture docs, security policy, MIT license
• d6d41fc Redesign UI with ledger brand system; wire wizard, routes register, and reminders
• e0582df Update e2e assertion for socket-proxy endpoint default

Container images are published to ghcr.io/harshshah0203/homedex.
See the upgrade and backup notes before replacing a running instance.