0.8.4 — Passkeys that sign in, updates that roll back

Passkeys that sign in, updates that roll back

Passkey sign-in works again behind the dashboard's own proxy, and the backend stops reporting unhealthy. An update now installs exactly the release it offered and goes back to the previous version if it fails. Sign-in, audit records and job controls are tighter, pages say when they could not read something, and Next.js and Go are on current patch releases.

Security

• Copies of .env are kept in check and removed on uninstall
  • Port changes now keep the newest five .env.jd-port-previous-* copies, and a wiping uninstall removes them all.
• Repeated wrong two-factor codes lock the second factor for 15 minutes
  • Recovery codes count too. A correct code is refused while it lasts, and an administrator's reset clears it.
• Forms that ask for your password share one attempt budget
  • This covers changing your password, turning two-factor off and registering a passkey. Wrong attempts on one form can briefly delay the others.
• New recovery codes ask for your password
  • An open session is no longer enough, as with turning two-factor off.
• Stopping a job takes the capability that started it
  • A limited account can still stop database dumps, base backups and package index refreshes. The job console hides Stop on the others.
• Audit fields have a size limit, and failed sign-ins always count
  • Usernames, targets and paths are capped in the audit log and the process log. Sign-in failures arriving together are each counted.
• A password typed on a saved domain stays out of browser storage
  • It is held in memory until you save, so a reload clears it. The rest of the draft is kept.

Added

• A failed update goes back to the previous version
  • The images it replaces are kept under a :previous tag. If the build or health check fails, they are restored and the checkout returns to where it was, without discarding local edits. This applies from the update after this one.
• Missing and broken pages have a way back
  • An unknown address inside the dashboard keeps the sidebar, and errors outside it get their own page instead of the browser's default.
• Browser tabs are named after the page
  • A tab reads like Files · Just Dashboard, so several open tabs can be told apart.

Changed

• An update installs exactly the release it offered
  • It uses the release's tag when there is one and checks the changelog before changing anything. A branch that has moved past the offered version is refused until you check again.
• Next.js, Go and other dependencies are on current patch releases
  • Next.js 16.4.3, Go 1.26.10 and updated x/net, with overrides for DOMPurify, lodash-es and nanoid.
• Installs need fewer leftovers and containers run with less
  • A fresh install removes the first password from .env once the dashboard answers. Logs rotate, the proxy has a health check, and the frontend and proxy drop capabilities they do not need. The first start on this release recreates all three containers.

Fixed

• Passkey sign-in works in Chromium browsers behind the proxy
  • The proxy's Permissions-Policy forbade using a passkey, though not enrolling one. If a page's policy still forbids it, the page now says so.
• The backend no longer reports unhealthy after working with host files
  • The main thread could stay in the host's mount namespace, so Docker's health check looked for the binary in the wrong filesystem.
• Timeouts stop host commands
  • A cancelled command run through nsenter could keep running and hold its request open. It now stops at its deadline.
• The dashboard's own ports stay put across lifecycle runs
  • A helper container that could not see the backend's process took its port for someone else's and moved it. A port that has already moved stays where it is.
• The installer checks the full password rule up front
  • A password the backend would refuse no longer leaves a half-finished install, and a kept .env without JD_SITE no longer ends the script silently.
• Documented ACME and ingress settings reach the backend
  • JD_ACME_DIRECTORY, JD_ACME_CA_ROOT and JD_INGRESS_CONTAINER were ignored when set in .env. If you set one, it now takes effect.
• Failed reads no longer look like nothing there
  • Passkeys, Promote and Docker cleanup show the error with a retry. The archive confirmation names what it could not read and waits for its reads to finish.
• Coming back to a hidden tab refreshes it right away
  • Polled pages used to wait for their next timer, which browsers slow down in the background.
• Sizes under one byte no longer read undefined
  • Very quiet network rates showed as 512.0 undefined.
• A release can no longer be skipped by a failed first run
  • The release workflow now publishes any version main carries that has no release yet.

0.8.3 — A map that unused volumes cannot bury

A map that unused volumes cannot bury

On a server with many unused Docker volumes, the Map's Everything else section grew into a column hundreds of boxes tall. The Map now leaves those volumes to the Volumes page. The Git page can also bring a checkout back in line with its remote in one step, and switching to a branch far behind its remote now brings it up to date.

Added

• Match origin cleans up a checkout in one step
  • The Branches tab fetches, shows what would change, then updates every branch, deletes the ones origin no longer has and ends on the default branch. A branch with commits origin lacks is kept unless you tick it, and uncommitted work goes into a stash.

Fixed

• Unused volumes no longer fill the Map's Everything else section
  • A volume that nothing mounts and nothing backs up is no longer drawn on the Map. A volume with a backup or one in use is still drawn, and the Volumes page still lists every volume.
• Switching to a branch behind its remote brings it up to date
  • A local branch behind its remote now offers Switch and update, and a remote branch keeps its Check out button when a local copy exists.

0.8.2 — Staging, canaries and warm rollbacks, and a map of the whole server

Staging, canaries and warm rollbacks, and a map of the whole server

Deployments gain what hosted platforms put between a commit and production: a staging environment and one exact image promoted from a pull request's preview through staging to production, release tasks rehearsed on a restored copy of the database, recorded traffic replayed and a canary tried before the cutover, and the previous release kept warm and switched back to on its own when the new one does worse. Domains get redirects, sign-in, maintenance pages, edge rules, rate limits, wildcard certificates, DNS records and Cloudflare Tunnel; releases can run as replicas, sleep when idle or live only on the tailnet; variables can come from six secret stores; output, requests and traces ship to the tools you already run, and every image is scanned for known vulnerabilities. Deploy keys, the jd command line and an OpenAPI description with generated Go and TypeScript clients open it all to pipelines, and the catalogue grows by a hundred templates and keeps your own. Beside deployments: a Map of the whole server, host alerts, passkeys, SFTP and rclone backups that another server can import, and a session cookie that no longer reaches the apps the dashboard publishes on its own name.

Security

• The dashboard's session cookie no longer reaches the apps it publishes on its own name
  • Browsers send a cookie to every port of a host name, so a browser signed in to the dashboard on its tailnet name sent the session to every preview and tailnet app served on that name, a pull request's own code included. The cookie is now __Host-jd_session, and every tailnet address goes through a front that takes the dashboard's cookies out of the request before it reaches the app. Upgrading signs nobody out: the old cookie is swapped for the new one on the next request.
• A deploy key never reads a variable's value and reaches nothing outside deployments
  • It lists variable names, never values, and generated values are not returned to it; reveals, saved registry and Git credentials, pull request merges and comments, and the removals that take a typed phrase stay a signed-in person's. A deploy key cannot point a variable at a saved credential, a database or a secret store, and a narrowed key reaches only routes about its own deployments.
• The audit log names the API key behind every request made with one
  • Every request made with any API key records the key as well as its account, the audit page shows it beside the actor, and a deploy key refused at the gate is recorded too.
• An MCP key is offered the whole deployment API as tools only when its owner turns them on
  • Every route a deploy key may call can now be an MCP tool, 100 beside the 13 written by hand, held to the key's grant, its owner's role and the deployments it is narrowed to, and run through the dashboard's own routes and audit as a deploy key's request would be. Offer every deployment route as a tool, in Databases → MCP server, is ticked for a new key and off for every key made before this release, which keeps exactly the tools it had; an MCP key's deployments can now be narrowed as a deploy key's are.
• Scan every release's image for known vulnerabilities, and rebuild it on a newer base
  • Each release's image and the bases it was pinned on are scanned with Trivy after the build and daily while the release is live, and the project overview's Vulnerabilities panel lists the findings that have a fix beside Rebuild, which builds again on the base's current digest. A host alert fires when a live release has a fixable finding at or above the environment's floor, High unless set in Build settings, and a newer base exists. The vulnerability database is downloaded by the dashboard from mirror.gcr.io, or ghcr.io, about once a day.
• The image scanner runs with no network and never sees the Docker socket
  • Trivy runs as a one-shot container as nobody, with no network, no capabilities, a read-only root and limits on memory, processors and processes, reading only the image archive it is handed. The dashboard downloads and checks the database itself, so the scanner has nothing to reach.
• The last way in cannot be closed from System users
  • Deleting, disabling, locking, removing the last key, changing the shell or taking away sudo is refused when nobody else could sign in over SSH and become root. Accounts a package made are read-only until editing is turned on for them, a login shell has to be one the host lists, and a new person's account has to be given a way in or be said to need none.

Added

• Add a staging environment and promote its exact image into production
  • Staging is a second, long-lived environment of a deployment with its own branch, domain, variables, volumes and database links, built and deployed exactly as production is. Promote to production runs a staging release's image, with nothing rebuilt, under production's own configuration, variables, release tasks, readiness checks and cutover, and production's history says which staging release each promotion came from. One switch makes production take only promotions, so new code reaches it only as an image staging already ran.
• Promote a pull request preview's exact image into staging
  • A preview whose live commit carries the pull request's current approval can be promoted into staging, never straight into production, and runs there with staging's own plan and variables, never the preview's. With staging's promotion to production, the image that was reviewed in the preview is the image production runs.
• Rehearse a release's tasks against a restored copy of the database before they touch production
  • With rehearsal on in Build settings, the linked database is restored from its point-in-time archive or newest backup dump into a throwaway copy, the release tasks run there with the same image, variables and timeout, and the run reports how long each took and which locks it held. A task that fails against the copy stops the release before production is touched, and a promotion rehearses production's tasks the same way. It is off by default, because it holds a second copy of the database for as long as it runs.
• Replay recorded requests against a new release before traffic moves to it
  • Traffic replay sends the last distinct GET and HEAD requests your domains answered to the candidate's own address, before anything is routed to it, and compares its answers and p95 with the live release's. Requests whose answer depended on who asked, that carry a credential in their query or that scanners sent are left out. It is set beside the release strategy in Runtime settings and is off by default.
• Try a canary release on a share of the live route before its cutover
  • The Canary strategy sends between 1 and 50 percent of the live route's requests to the candidate for the window you choose, records the two releases' answers apart and judges the candidate by the rule the warm rollback uses. One that does worse is removed with the live release untouched; one that does not is promoted at the end of the window when Promote on its own is set, or by Promote now. The run page shows the countdown, both releases side by side, and Abort.
• Keep the previous release warm after a cutover, and switch traffic back to it on its own
  • After a blue/green cutover the release it replaced is paused rather than removed, for ten minutes by default, while the new release's 5xx share and p95 are compared with the old one's from the ingress's own request record. If either crosses its line over enough requests, traffic goes back to the warm container in seconds, with no build or cold start, and the rollback is recorded with its measured reason and told to your notification channels. It is on by default for blue/green releases and is turned off per environment under Runtime settings → After a release goes live; while a window is open the project overview offers Roll back instantly and Keep release.
• Keep each visitor on the release that first answered them
  • With skew protection on, a cookie keeps a visitor on the release that served their page for as long as that release is kept warm, so a page loaded before a cutover never asks the new release for scripts, styles or data it does not have. A cookie naming a release that is gone is ignored and replaced.
• Bring a linked database back as it was when an older release went live, into a copy beside production
  • Each release now records, for every database it links, the moment in the point-in-time archive or the backup it can be brought back to, shown as a data point on the release's row. Restore data as of this release restores each linked PostgreSQL, MySQL or MariaDB database from that point into a side copy to compare with or restore from; production's data is never touched.
• Preview a pull request of a Compose stack, with every service isolated
  • Pull request previews of Compose releases were refused. Each service of a preview now gets the preview's own network, fresh volumes and no published ports, the public service is reached only through the preview's route, and anything that cannot be isolated, such as a host path mounted into a service, is left out and named in the run transcript.
• Give a pull request's preview its own branch of a linked database
  • Settings → Databases → Previews can give each preview a copy of a linked database restored from its newest backup, with chosen columns masked in their own shape before anything reads them. The branch sits on the preview's own network with a generated password, production's database is never reachable from it, a fork's preview never gets one, and it is removed with the preview.
• Redirect a deployment's domains, set response headers and allow only listed addresses
  • A domain can send its visitors to another of the deployment's hostnames with the path and query kept, the way an old www. name is kept for links, with the status code you choose. Sett...

0.8.1 — A streamed Mac that connects once and lines up

A streamed Mac that connects once and lines up

0.8 made a streamed Mac reconnect up to three times, come out stretched, and leave the pointer off where it was drawn. A stream now stays at one size for the whole session, Sunshine's black padding is cut off at the frame's edges instead of avoided by asking again, and the pointer lands where the screen is drawn.

Fixed

• A streamed Mac connects once, unstretched, with the pointer where it is drawn
  • 0.8 read the screen's shape off Sunshine's black padding and loaded the stream again at that shape. Sunshine kept the first session's capture for the overlapping new one, so the picture came out stretched, the stretched padding read as yet another shape, and the pointer met the Mac's own only at the centre. The stream is now asked for at the quality's 16:9 size and never loaded again for a new shape; the picture is drawn past the frame's edges by the padding, so the frame still takes the computer's shape and fills the content area. The shape is read for the whole session, and shapes remembered from 0.8's stretched streams are not reused.

0.8 — Drawings edited together, and an Overview that opens onto everything

Drawings edited together, and an Overview that opens onto everything

Excalidraw becomes the Workspace's one board: a drawing is edited together live, keeps its images and the shape library on the server, and can hold live cards of your hosts, projects and databases, YouTube, Vimeo and Figma embeds, and diagrams written from a description. The Overview opens on shortcuts to every part of the dashboard, with the open shells, the drawings edited last, the databases and every backup job. A project is drawn by its website's icon wherever the dashboard names it, the web terminal finds what ssh finds, and a reinstall that lost its master key repairs its saved database connections instead of adding a second copy of each. Stickyboard and the schema comparison page are gone.

Added

• Edit a drawing together with everyone who has it open
  • Everyone with a drawing open joins its live room, a relay that keeps nothing: changes, pointers and names reach the others as they are made. Once an editor has joined, its saves merge with the stored drawing element by element instead of being refused because another editor saved first, and an element someone deleted stays deleted.
• Keep a drawing's images and the shape library on the server
  • Images are stored apart from the drawing and sent once, as soon as they are placed; an older drawing's embedded images move out on its next save. The shape library is kept on the server, one per install, and packs from libraries.excalidraw.com are downloaded by the server, since the page's security policy keeps the browser from fetching them.
• Put live cards of hosts, projects and databases in a drawing, embed YouTube, Vimeo and Figma, and describe a diagram to have it drawn
  • A server card reads its host, project or database as it is now, each time the drawing is open. Describe a diagram writes Mermaid through the SQL assistant's provider and places it on the canvas, and the menu and the empty canvas are the dashboard's own.
• Open the Overview on shortcuts to everything the dashboard does
  • Terminal, Excalidraw, Files, Remote Desktop, Databases and Backups were nowhere on the landing page, or one figure each. It now opens on shortcuts that count what each adds to, pairs the open shells with the drawings edited last and the databases with every backup job, and each row opens the thing it names; a shell opens the terminal on that session.
• Draw a project by its website's icon wherever the dashboard names it
  • A database's reader, a site's application, a port's owner, a backup's source and job, the Overview's activity, the logs' request records, the command palette and a drawing's card picker drew a deployment as a cloud or its container's image. They now show the project's icon, and keep the old mark where a project has none.
• Show a database a deployment variable reaches by its address
  • A project whose DATABASE_URL was written out as this server's address and the port its database publishes had no link to that database, so Settings → Databases & backups said none was linked. The page now matches the project's variables against the databases on the server and draws each one it names as a card reached by address.

Changed

• The web terminal logs in through the account's own shell, so it finds what ssh finds
  • A bash account keeps ~/.local/bin in ~/.profile, which the terminal's zsh never read, so commands such as claude were not found in the dashboard while ssh ran them. The login now runs the account's own shell first, and the bundled zsh adds ~/bin and ~/.local/bin when they exist.
• A remote desktop session takes the whole content area, and a stream keeps the computer's screen shape
  • A 16:10 Mac was letterboxed twice, by Sunshine and again by the bridge. The stream is now asked for in the computer's own shape, read once and remembered per computer, and drawn in a frame of that shape.
• Seed data says what it inserts before it inserts anything
  • The panel opens with a notice that it inserts made-up test rows, keeps the rows already there and inserts nothing before the review, named with the connection's environment label and amber where that is production. Each table says what it references and its row count now and after, and each column head fits on two lines.
• Server parameters are readable and say which ones can be changed, and Extensions shows each project's own mark
  • Extensions are grouped under category glyphs with the real logos of the projects behind them.
• Metrics draws its network interfaces on the page's own ground, two to a row, the way it draws disks
• A person with no picture is drawn as a silhouette on a solid colour
• The database import page is centred with its step bar sized to the panel, and the results find strip matches the buttons beside it
• The SQL assistant no longer shows a privacy note under the composer at all times

Fixed

• Database connections sealed under another master key are repaired instead of saved again beside the broken one
  • A reinstall that kept the data directory but not the .env left every saved connection unreadable, and connecting its server again added a second connection beside the red one. A connection made from a server the dashboard found is now resealed in place from that server's own credentials, whenever it is signed in to and by a background pass, and the installer asks for the earlier key when it finds the data without one.
• Discard on a deployment's settings works when the saved Git credential is a GitHub App credential
  • The credential picker does not list GitHub App credentials, so restoring one made the form dirty again however often Discard was pressed. A select no longer reports an empty choice when its value is one its items do not hold yet.
• The Overview's Backups figure no longer hides a failed job behind another job that succeeded after it
  • It read the newest run on the server, so a failed nightly job vanished under an hourly one; every job is now ordered and counted by its own last run.

Removed

• Stickyboard
  • Excalidraw is the Workspace's board. Stickyboard's pages, routes and place in the sidebar, command palette and Overview are gone; the boards made with it in 0.7.2 to 0.7.5 stay in the dashboard's database through the update.
• The database schema comparison page
  • Schema → Compare, added in 0.7.5, and the backend that wrote its migrations are gone.

0.7.5 — Remote Desktop, and databases you can run end to end

Remote Desktop, and databases you can run end to end

Remote Desktop opens your own Windows PCs, Macs and Linux desktops in a browser tab over Tailscale, with no one at the computer, and can stream a screen as video from Sunshine. Databases becomes the place to run them: an assistant beside the SQL editor and an MCP server for your AI clients, point-in-time recovery, TLS, PgBouncer, major-version upgrades, row-level security, schema comparison, measured plans with index trials, seed data, and imports kept current until you cut over. Automatic attention panels and settings recommendations are gone; the tools, updates and safety checks they sat beside remain.

Security

• Keep passwords and other values out of PostgreSQL's statement list
  • Databases → Performance → Statements and the busiest statements on Home showed PostgreSQL's CREATE ROLE and ALTER ROLE with the password in clear, and SET, COMMENT, DEFAULT and DO statements with their values, to any account that may read. Every value in PostgreSQL's statement text is now replaced with a placeholder before it leaves the server, a password or a setting written without quotes included, and the $1 markers the server writes stay, so a statement's plan is still asked for with values put back in. A role created or changed from Access is no longer kept in pg_stat_statements at all when the connection signs in as a superuser.
• A SELECT that runs other SQL or outlives its rollback is no longer a read
  • PostgreSQL's query_to_xml, cursor_to_xml and table_to_xml families, ts_stat, crosstab, connectby and every dblink function run text they are handed as SQL, which can spell a function's name in pieces that no reading of the statement sees. Advisory locks, statistics resets, replication and WAL functions, MySQL and MariaDB named locks and := assignments, sequence values on every engine, and Oracle's DBMS_XMLGEN, DBMS_SQL, UTL_HTTP and similar packages act past the read-only transaction a read runs in. All of these now ask for the destructive capability and a confirmation in the query editor, and are refused on a protected connection.
• Oracle and SQL Server statement lists no longer show what comments said or the literals after one
  • Oracle keeps a statement's text with its line breaks turned into spaces, so a -- comment hid everything after it from the literal masker and the rest of the statement was shown as it was run. Comments are now dropped from the text of Oracle and SQL Server statements, optimizer hints are kept with their literals replaced, and SQL Server's nested comments are read the way it reads them.

Added

• Open your own PCs, Macs and Linux desktops in a browser tab, unattended, over Tailscale
  • Workspace → Remote Desktop draws this browser, this server and each computer you add, with whether its Remote Desktop, Screen Sharing or VNC answers, and offers the tailnet's Windows, Mac and Linux devices not added yet. Control opens a session through guacd with the clipboard both ways, file upload, the key combinations a browser keeps, and a Mac's own account asked for on the page. Stream plays the screen as video from Sunshine on the computer, up to 120 fps, over WebRTC on the tailnet. A session stays connected while you use other pages, and its column says where its round trip goes. The computers are reached over the tailnet, so nothing is opened to the internet.
• Limit the memory and processors a database's container may use
  • A new database can be limited when it is created, with sizes filled in for its engine and held to this server's memory and processors. Settings → Resources changes the limits of a container the dashboard may change, in place and without a restart, beside its peak in the last hour and the engine's own buffer (shared_buffers, innodb_buffer_pool_size, maxmemory and their kind), saying what a limit under that buffer does. Lifting a limit replaces the container after asking, keeping its data. Every change is audited, and a replacement made by the dashboard keeps the limits.
• Recover a PostgreSQL server to any moment, not only to its last dump
  • Databases → Backups can archive the write-ahead log of a PostgreSQL server the dashboard runs with WAL-G, into a directory, S3 or Backblaze B2 — or a backup job's destination — encrypted to a key only a recovery opens, beside base backups on a schedule and as many days kept as asked. The page shows the moments it can go back to, how archiving is going and WAL-G's own words when it fails. A recovery to the latest moment, a moment to the second or a named restore point starts a new server beside the old one, which is never touched; keep both, or switch the copy in for the server, and archiving carries on into an archive of its own.
• Switch a database to TLS with a certificate from the dashboard's own authority
  • Databases → Settings → Network turns TLS on for a PostgreSQL, MySQL, MariaDB, MongoDB, Redis or Valkey server the dashboard started, or off again. The first time, the dashboard makes a certificate authority and seals its key with the master key; each server gets a one-year certificate naming loopback, its db-N.jd.internal name and the address it is published on. TLS can be allowed beside plain text or required, except on Redis and Valkey, where the port then speaks TLS only. The dashboard's own connection verifies the certificate, the CA certificate downloads from the same section with a connection string and command for another machine, and certificates are renewed a month before they end, with an audit entry, by asking the running server to read the new one. The container is restarted only if the server cannot, and the renewal checks the certificate the server presents before it records it. Turning TLS on, off or to required recreates the container; if the server does not come up with it, it is put back as it was. Applications linked to the database keep the connection string they had while TLS is allowed, and are given one that encrypts without checking the certificate once it is required.
• Create, edit and drop functions, procedures and triggers from the schema browser
  • Databases → Schema opens a function, procedure or trigger with Edit and Drop, and the schema offers New function, New procedure and New trigger (a table's Triggers reading has its own). The form has the fields the engine has a word for, the body in the editor and the exact statement under it, sent as one statement, so a MySQL BEGIN … END block, an Oracle PL/SQL block or a SQLite trigger needs no delimiter. PostgreSQL, MySQL, MariaDB, SQL Server and Oracle take all three; SQLite takes triggers. An edit uses CREATE OR REPLACE or CREATE OR ALTER where the engine has one and otherwise drops and creates in one transaction, or puts the old definition back if the new one is refused; Oracle's result is checked for compile errors. A program whose text holds something the form cannot state is shown with the reason and left to the Query tab. Writing one asks for the destructive capability, as the Query tab does for the same CREATE.
• Compare two database schemas and write the SQL that makes one like the other
  • A new Compare page under Schema lists what differs between this connection's schema and another schema of the same engine, side by side: tables with their columns, keys, indexes, constraints and foreign keys, views, sequences, enum types, and functions and procedures as text. The migration is ordered so tables exist before the keys that point at them and a key is dropped before its table, destructive steps are marked, and what the engine cannot change in place is said so in a comment. It is text to copy, save or open in Query and is never run by the dashboard. PostgreSQL, MySQL and MariaDB, SQL Server and SQLite.
• Fill tables with believable mock rows from the Generate page
  • Seed data, beside the code generators, plans rows for every table or the ones chosen: each column filled by what its name and type say it holds (names, emails, addresses, prices, dates in the past or ahead), an enum's labels or a CHECK's list or bounds, and a column the server numbers or computes left to it. Tables are written parents first so every foreign key points at a row that is there, a table that points at itself points at its own earlier rows, and unique columns stay unique when the seed is run again. A tab per table shows its first rows and lets each column's generator be changed; the rows shown are the rows written, by the seed number both carry. Writing shows the statements first and runs as one transaction; a row the table refuses is left out and counted with its reason. Addresses, domains and telephone numbers are the ones reserved for examples and fiction. The preview is open to every role and on a protected connection; writing needs a role that may change data and is refused on a protected one. PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle and ClickHouse, which has no transaction and writes each table on its own.
• Keep each database's statement statistics over time
  • Databases → Performance → Statement history lists what each statement cost over the last hour, six hours, day or week, with its time drawn across the window, and orders the list by its share of the time, calls, mean time, p95, rows or rows examined. A statement opens on charts of its time, calls, time per call and rows. The dashboard reads the statement list every five minutes, including while the page is closed, and keeps what each statement added for seven days. ClickHouse and MySQL 8 give p50, p95 and p99 from their own run times; PostgreSQL, MariaDB, SQL Server and Oracle keep no distribution, and the page says what each figure is made from. Only a statement's shape is kept, as the Statements view shows it, never one execution of it.
• Edit a PostgreSQL table's row-level security and try it as a role
  • Databases → Schema → a table has a Row security reading. Turn security on or off, hold the owner to it, and add, change...

0.7.4 — A shorter first sign-in

A shorter first sign-in

The question a new account is asked after its first sign-in is one screen now, and its answer is the next. Pick what the server is for from big cards, press Continue, and the server appears wired to each purpose you chose, with one button to the dashboard. Choosing sections one by one has moved out of the first sign-in to Account → Workspace, where it always was.

Changed

• The first-run question is two screens instead of three
  • The purposes are big cards with nothing beside them. Continue saves your sidebar and shows your server in the middle of the screen, each purpose you chose drawn around it, with Go to dashboard under it. The screen of fifteen section switches is gone from the first sign-in; Account → Workspace still has it.
• Account → Workspace draws the sidebar preview without a label

0.7.3 — A first sign-in that fits the sidebar to what you use

A first sign-in that fits the sidebar to what you use

Every new account is now asked, once, what it will use the server for, and its sidebar, Overview and search keep only those sections. A hidden section is out of the sidebar, never out of reach: links from other pages still open it, search still finds it, and the role still decides what the account may do. Account → Workspace changes the answer or asks the question again, and accounts that existed before this release keep every section.

Added

• New accounts are asked what the server is for after their first sign-in
  • Shipping apps, running databases, containers, the network, security or working on the box, each drawn as the products it means: any number of them, with what the server already runs chosen in advance and the server drawn wired to each one picked. The answer becomes the sections themselves beside a preview of the sidebar they draw, and Finish saves it to the account, so it follows the person to every browser. Show me everything hides nothing.
• Account → Workspace chooses which sections the sidebar shows
  • The same sections and preview after the fact, and Ask me again goes back to the question. Overview, Monitoring and Settings are always shown, and a section the role cannot open is not offered.

Changed

• A hidden section stays one link or one search away
  • A link into a hidden section, such as a deployment's domain opening its proxy site, still opens it; the sidebar shows the section while you are in it and offers to keep it. Search lists hidden pages as soon as you type, and the Overview leaves out a hidden section's tiles and the reads behind them.
• Sign-in is redrawn, and fits a phone
  • One card, with the server and the products it runs drawn beside the form on colour instead of a grid. The steps it shows are the ones your account actually has, Forgot it? gives the command that resets a password on the server, and a password you are asked to change signs you straight back in.
• The first-run question fits a phone
  • Purposes are rows rather than tiles, each step's button stays at the foot of the screen, and the last screen puts the count and Open the dashboard on one line instead of a row of its own.

Fixed

• A password set from the server is not asked for again at sign-in
  • scripts/reset-password.sh and scripts/create-user.sh set the password the account signs in with. They marked it temporary, so the dashboard demanded a new one the moment you signed in with it.

0.7.2 — Stickyboard, an uninstaller, and findings that lead to their fix

Stickyboard, an uninstaller, and findings that lead to their fix

Stickyboard adds endless boards of sticky notes that link, group into sections and autosave, beside Excalidraw's drawings. Configuration can now uninstall the dashboard, keeping its deployments and data for a reinstall or wiping them. Findings across Docker, Databases, Deployments, Network and Proxy keep only what needs attention and each action opens the control that fixes it. A pull blocked by local changes or root-owned folders offers the ways past it, log panes share one filter row and time window, and the dashboard spends far less work in idle and hidden tabs.

Added

• Stickyboard: endless boards of sticky notes that link, group into sections and autosave
  • A new Workspace page lists every board as a picture of itself and creates boards blank or from a Kanban, retrospective or mind-map template. Notes take Markdown with tickable tasks, nine colours, sizes and typefaces, links are dragged between notes with labels and arrows, and sections carry their notes, with undo, find, clipboard and keyboard shortcuts. Each save is checked by the server and guarded by a revision.
• Uninstall the dashboard from its Configuration page
  • The Danger zone asks one question: keep the deployments, data, backups and key for a reinstall, or wipe the deployments and the dashboard's data, and the backups only when asked and after the server's name is typed. The stack is taken down by a sibling container that writes its transcript to /var/log/just-dashboard-uninstall.log, and a kept install is restored by install.sh on a fresh clone.
• A blocked pull offers the ways past it
  • When local changes or folders owned by another account stop a pull, Git shows what is in the way and offers to stash, discard or give the folders back, each as one step that pulls afterwards. A self-update hands back to the checkout's owner whatever it wrote as root, so the next pull is not blocked by it.

Changed

• Findings keep what needs attention and lead to the control that fixes it
  • Attention lists on Docker, Databases, Deployments, Network, Proxy and Security keep critical and warning findings, show the problem and its consequence before the evidence, and name each action by where it goes. Routine advice stays in the settings or reports it belongs to, and certificate, backup and MongoDB cache wording says only what is known.
• Every log pane has one filter row and one time window
  • Search, Live or a typed span, levels, fields and quick views share one row, and a pane's commands sit after its views as icons. Request Insights counts distinct visitors apart from bots and scripts, and Network DNS, VPN and Interfaces, a deployment's output and a site's upstream gain the logs that belong to them.
• Databases, Boards and Proxy open on what they hold
  • The Databases control center opens on the server's databases as one line, a band of storage, sessions and backups, and cards in each database's hue. Boards is named after Excalidraw, with /boards redirecting to /excalidraw, and its cards are previews of each drawing. The proxy overview counts the Docker Caddy ingress's requests, so Traffic and Live traffic are no longer empty on a host where it holds ports 80 and 443.
• Notable moments group into incidents that pin the charts
  • Metrics gathers notable moments into incidents that pin the charts to their window, with zoom as its own action, and the scanners notice ranks the addresses and the paths they tried, with Block in a column of its own.
• The dashboard does less work while idle, and builds its images one at a time
  • The network-change banner, live metrics, RecentJobs and reconnecting sockets stop spending requests and renders in idle or hidden tabs, sign-in hashes use far less memory, and an idle job queue no longer takes the database's write lock. install.sh, the updater and Settings' rebuild build one service at a time, so the frontend's and backend's compile peaks no longer add up.

Fixed

• A live preview offers Visit at its own address
  • A preview run was compared with production's live release, so every live preview read as superseded with no address. It now reads its own live release and address, and the run header names its PR environment.