BBSFirewall v1.3.5

Highlights

• Two-factor authentication for the web config editor — TOTP authenticator app support with one-time backup codes, plus scrypt-hashed passwords replacing the old plaintext .env login.
• Admin UI refresh — section icons, a dedicated Lists tab, official Sysop Network branding, and a System Stats tab with bandwidth and disk-usage metrics.
• Logs tab — browse, view, and delete per-proxy log files right from the browser, automatically grouped by type and folded into per-month sections once they're older than 30 days.
• Management API — a key-authenticated REST API that mirrors everything the admin UI can do, for automating configuration from your own tooling.
• Logging on by default, with configurable retention and automatic daily pruning.

Security

Admin login no longer lives in .env. Run node setup-admin.js once to create the account — it stores a scrypt password hash (and, if you enable it, a TOTP secret and hashed one-time backup codes) in .admin-security.json, kept out of .env entirely.

• Two-factor auth — turn it on from Security Settings (under your username in the header): scan a QR code with any TOTP authenticator app, save your backup codes, done. A locked-out admin can be recovered from the box itself with node disable-mfa.js --yes.
• Security Settings page — change your password, enable/disable MFA, regenerate backup codes, and whitelist your own IP, all without touching .env.
• Login and MFA attempts each get their own 5-fail/15-minute IP lockout, so guessing one can't burn through the other's budget.

Admin UI refresh

• Lists — the Whitelist / Blocklist / Trusted Hosts / Triggers / API Trusted Hosts editors now live in their own tab, with "Add my IP" / "/24" / "/29" quick-add buttons on Whitelist and Blocklist.
• System Stats (renamed from Performance) — CPU, load average, memory, disk, and now bandwidth (current / average / peak) and disk usage broken out for the BBSFirewall folder and its log files.
• Small icons throughout Settings and Tools, and the BBSFirewall logo + favicon in place of a plain text header.

Logs tab

• Files are grouped by proxy type (telnet / SSH / SSH passthrough / web), each with its own collapsible section and a file-count + total-size summary.
• Anything older than 30 days is automatically folded into per-month sub-sections, so a board that's been running a long time doesn't end up with one endless table.
• View a file's content (large files are tailed to the last 512 KB) or permanently delete one.

Management API

Enable with API_ENABLED=true and API_KEY (minimum 24 characters) to reach the same operations as the browser UI over REST, on the same HTTPS port under /api/* — no cookie, just a bearer key on every request.

GET  /api/config          Full .env + list-file contents
GET  /api/health          Cert / GeoIP / SSH host key status
GET  /api/stats           Live host + firewall metrics
POST /api/save            Write .env and/or list files
POST /api/restart         Restart the firewall
POST /api/geoip           Download/update the GeoIP database
POST /api/sshkey          Generate the SSH host key
POST /api/cert            Issue a Let's Encrypt certificate

Full reference, response shapes, and curl/Node/Python samples: API.md. A runnable smoke test ships as api-smoke.sh.

Logging

LOG_FILE_ENABLED is now on by default (verbosity connections), with a new LOG_RETENTION_DAYS (1–3650, default 30) and automatic daily pruning of anything older.

Upgrading from 1.2.x

1. npm install — no new dependencies, but run it anyway.
2. Run node setup-admin.js once. If you already have CONFIG_EDITOR_USERNAME / CONFIG_EDITOR_PASSWORD set, it offers to import them directly — your login keeps working unchanged. Remove those two lines from .env once you've confirmed you can log in.
3. Two-factor auth is opt-in — enable it from Security Settings whenever you're ready.
4. Everything else (list files, triggers, GeoIP database, certificates) carries over with no changes needed.

See CHANGELOG.md for the categorized version of the above.