Web GUI and nftban ui retired

Web GUI and nftban-ui retired

Type: Archive / Historical record Scope: Web GUI (nftban-ui) and PAM auth daemon (nftban-ui-auth) Status: Retired in v1.100.1b.A

---

What was retired

Two binaries, three systemd units, one PAM bridge, and the templ-rendered HTML surface they served:

Component	Path	Type
nftban-ui	/usr/sbin/nftban-ui	Web server (Go + GOTH stack: templ templates, HTMX)
nftban-ui-auth	/usr/libexec/nftban-ui-auth	PAM-backed authentication daemon (CGO required)
nftban-ui.service	/usr/lib/systemd/system/nftban-ui.service	systemd unit for the web server
nftban-ui-auth.service	/usr/lib/systemd/system/nftban-ui-auth.service	systemd unit for the auth daemon
nftban-ui-auth.socket	/usr/lib/systemd/system/nftban-ui-auth.socket	systemd socket activation for the auth daemon
PAM config	/etc/pam.d/nftban-ui	PAM service definition

These shipped together as the optional Web GUI surface from prior NFTBan releases through v1.100.0.

Retirement schedule

Stage	Version	Action
v1.100.1b.A (this release)	Stop shipping	Binaries no longer built or published. Systemd units no longer included in DEB/RPM payloads. SLSA build coverage scoped to nftban-core only. PAM build dependency dropped from standard packaging. Transitional cleanup (disable + mask + remove unit files + delete orphaned binaries) runs automatically on package upgrade.
v1.100.1b.B (later)	Source tree removal	cmd/nftban-ui/, cmd/nftban-ui-auth/, internal/ui/, internal/auth/, internal/session/, internal/authproto/ deleted from the repository.
v1.100.1b.C (later)	Cross-cutting reference cleanup	Shell modules in cli/lib/ and Go code in internal/installer/, internal/nftbanconf/, internal/api/ updated to no longer reference the retired surface.
v1.100.1b.D (later)	Documentation cleanup	Architecture, contributing, and security wiki/repo docs updated to reflect the retired state.

Operator impact

Existing installs that had the Web GUI running

The package upgrade hooks (DEB prerm and RPM %pre) handle this automatically:

1. Stop nftban-ui.service and nftban-ui-auth.service (and .socket).
2. Disable each unit so it cannot restart on boot.
3. Mask each unit so manual systemctl start is refused.
4. Remove the unit files from /usr/lib/systemd/system/ and /lib/systemd/system/.
5. Delete /usr/sbin/nftban-ui and /usr/libexec/nftban-ui-auth if present.
6. Remove /run/nftban-ui runtime directory.
7. daemon-reload so systemd forgets the masked units.

After upgrade, the operator-visible state is: no Web GUI service, no orphaned binaries, no orphaned unit files. The nftban CLI continues to function unchanged.

Fresh installs

The Web GUI surface is simply not present. There is nothing to disable.

What replaces the Web GUI

Nothing in the v1.100.x train. Operators use the nftban CLI directly:

• nftban status — overall protection state
• nftban health — multi-axis health table
• nftban stats — counters and traffic summary
• nftban search <ip> — IP/port lookup across sets and feeds
• nftban list — banned and whitelisted entries
• nftban metrics — Prometheus exposition

Whether a future visualization surface returns is a separate decision tracked outside this retirement.

Why this was retired

Three reasons, in order of weight:

1. Lifecycle simplification before v2.0. The v1.100 lifecycle work (PR-22 through PR-26 — uninstall, restoration decision, restoration execution, verification gate, maintenance) is mutation-heavy. Removing the Web GUI surface before that work resumes reduces audit scope and removes one class of cross-cutting reference that the lifecycle code would otherwise have to remain compatible with.
2. PAM dependency reduction. nftban-ui-auth was the only consumer of libpam0g-dev (Debian) / pam-devel (Fedora). Removing it removes a build prerequisite for everyone.
3. SLSA coverage simplification. The Web GUI server was its own SLSA build job (build-nftban-ui) with its own provenance artifact. With it removed, SLSA coverage is scoped to nftban-core, matching what most release-channel consumers actually verify.

Affected wiki pages

The following active wiki pages carry an inline retirement notice pointing back to this archive page:

• Binary Verification (SLSA)
• Security Architecture
• Systemd Units Overview
• FHS Compliance
• Deprecations v1.90 — formal deprecation entry

Web Panel Compatibility is not affected — that page is about operator panels (cPanel / Plesk / DirectAdmin / etc.), a distinct surface from the retired Web GUI.

See also

• Pull request: PR #499 — feat(v1.100.1b.A): GOTH PR-D4 stage 1 — stop shipping nftban-ui + nftban-ui-auth (transitional DEB package)
• CHANGELOG entry: v1.100.1b.A
• v1.100.1a precursor (CLI jail surgical rename): PR #498

---

This archive page exists so future maintainers and operators can locate, in one place, what was retired, when, why, and what replaces it. It does not document the historical Web GUI's behavior in detail; that information lives in git history of the deleted source trees and in the CHANGELOG of releases prior to v1.100.1b.A.