fips-ui 0.14.2

Fixed

• Works with a fips daemon from 2026-10-26 on, where the IPv6 adapter answers
  for itself on a socket beside the control socket (control-ipv6tun.sock):
  the TUN name, state and effective IPv6 MTU, and show_listening_sockets.
  Against such a daemon the Overview flashed listening: unknown command: show_listening_sockets every few seconds, the "Listening on fips0" panels
  were empty, the node name in the header lost its TUN device, and mesh
  access and the security scan did not learn the TUN name. The adapter socket
  is asked where it exists (override: FIPS_IPV6TUN_SOCKET) and the control
  socket otherwise, so older daemons keep working; where neither answers the
  Overview says so instead of showing a TUN that is not there.

fips-ui 0.14.1

Fixed

• The Security menu item shows on every Linux node for admins. Where the
  helper is older than v13 the page says how to install it; the item was
  hidden there, so nothing told you the page existed.
• deploy/setup-local.sh rebuilds the frontend when the checkout changed
  since it was last built. After git pull and setup-local.sh (to install a
  new helper) a node kept serving the previous frontend, e.g. without the
  Security page. npm run build now records the web/ tree it was built from
  in web/dist/.build-source; the rebuild runs as the UI user after the helper
  is installed and replaces the old frontend only when it succeeds.
• The Security page names the right fix: install-upgrade-helper.sh on Linux
  without systemd, and python3 and ss where a v13 helper cannot scan.

fips-ui 0.14.0

Added

• Security page (admins): a weekly scan of the machine, through a new
  read-only helper command (security-scan, helper v13, Linux). It lists every
  listening service with what the host firewall (nftables, ufw, firewalld or
  iptables) does with a new connection from the LAN and from the mesh, pending
  and security updates and known vulnerabilities from the distribution's own
  tools (apt and debsecan, dnf updateinfo, pacman with arch-audit, zypper),
  reboots and restarts updates wait for, and SSH, kernel, account and fips file
  settings. Findings are scored 0-100 with a grade and a fix for each; the
  newest 12 reports are kept for a trend. Scans run on a chosen weekday and
  hour (a missed one runs when fips-ui is back) or with Scan now
  (docs/security-scan.md).
• Node manager: a Security column with each managed node's grade and score.

fips-ui 0.13.0

Added

• Role superadmin for Web UI over the mesh: admin, plus the upcoming Node
  manager page on a node that manages other nodes. The local listener is now
  superadmin; admin keeps exactly its former rights.
• Node manager page (superadmins): a list of other fips nodes whose fips-ui
  this one reaches over the mesh, probed every 30 seconds for reachability,
  daemon and fips-ui versions, available updates, the helper version and
  whether every manager is listed as an admin there. Standby managers can be
  named for the day this node is lost (docs/fleet.md).
• Open a managed node from the Node manager: every page of this dashboard
  (peers, logs, configuration, firewall, access, upgrade, …) shown for that
  node, through this node's backend, which forwards the node's own API over
  the mesh. The sidebar says which node is open and leads back.
• Sync managers: one click makes every manager (this node and the
  standbys) an admin on a managed node, or on all nodes that lack one; nobody
  is removed or demoted there. A node told to update its fips-ui, or to
  install fips, is shown as restarting until it answers again.

Fixed

• Right after fips-ui starts, a public domain whose zone names this node by its
  npub is accepted as soon as fips-ui knows its own npub, not up to 15 seconds
  later.

fips-ui 0.12.1

Fixed

• The dashboard under a public domain: a zone that names this node by its own
  npub (rather than self) counts as this node's name too, so e.g.
  home.example.org with home: npub1… (this node) is accepted.

fips-ui 0.12.0

Added

• The dashboard under a public domain: over the mesh fips-ui accepts as
  Host the public domain names this node's own fips-pub-domains server answers
  with this node (target self, including * entries) for zones whose claim is
  published, so ui.example.org works like <name>.fips. Names pointing to
  other nodes or left to ordinary DNS stay refused, also under a wildcard.

Fixed

• Copy buttons work when the dashboard is opened over the mesh: plain http on a
  fips0 address has no Clipboard API, so they fall back to the copy command (and
  show the value to copy by hand if that fails too). They are always visible on
  touch screens.
• The copy button next to a hosts-file name copies the npub behind it, not the
  name; the Peers page's DNS row no longer builds a name from the daemon's
  shortened peer label (npub1ab...cdef.fips).
• On NixOS the helper refuses to install or update fips-pub-domains with a clear
  message, instead of failing on the read-only system paths.

fips-ui 0.11.0

What's Changed

• Public domains: install and update fips-pub-domains from its releases, control the units by @fr34aky in #47

Full Changelog: v0.10.1...v0.11.0

fips-ui 0.10.1

What's Changed

• Bump source-map-js from 1.2.1 to 1.2.2 in /web in the npm_and_yarn group across 1 directory by @dependabot[bot] in #45
• Public domains: say what to do when the server runs from --zone flags by @fr34aky in #46

New Contributors

• @dependabot[bot] made their first contribution in #45

Full Changelog: v0.10.0...v0.10.1

fips-ui 0.10.0

What's Changed

• Public domains page: read the pubdom server and resolver over their control sockets by @fr34aky in #43
• Public domains: edit zones and configurations through the helper, act over the sockets, list attestations by @fr34aky in #44

Full Changelog: v0.9.0...v0.10.0

fips-ui 0.9.0

Added

• The followers list labels a node that stopped syncing from this node but now
  syncs below another one as moved under that node, instead of overdue, and
  counts it once in the tree.

• NixOS: a flake with a fips-ui package and a NixOS module
  (services.fips-ui), to use next to upstream fips' services.fips. The
  helper (v10) knows NixOS: it edits /var/lib/fips/fips.yaml, keeps upstream's
  file modes, leaves the firewall and boot-time unit settings to the NixOS
  configuration, and refuses to install fips binaries; the Upgrade page and the
  self-update point to the flake instead. A NixOS VM test (both modules, smoke
  test) runs in CI.

Changed

• The release workflow's changelog commit also sets package.json to the
  released version (the version of builds without git history, such as Nix).

Fixed

• fips-ui's self-update refused a checkout that follows main past the release
  tag (the release workflow commits the changelog after tagging): a checkout
  that already contains the release is now built and restarted instead.