v0.9.1

Changed

• The map is a dependency mesh. One node per monitor, with its icon and a
  status badge; declared parents are arrows that shape the hierarchy, agent
  services, hypervisor guests, relays and LLDP neighbours are lighter lines. A
  monitor that is down stands out with everything it hides (suppressed).
  Hovering a node lights up what it depends on and what depends on it; a click
  opens its panel.
• Remote sites, found on their own. Monitors behind a relay agent, on an
  agent that declares a site, or with a site tag are drawn as islands joined
  to the main site by a WAN link. No configuration needed.
• Folders only on request. The map ignores folders unless Group by
  folder is on (remembered in the browser); the folder and site filter is
  gone. Export to SVG/PNG and printing are unchanged.
• Reproducible builds. Two builds of the same commit now give bit-for-bit
  identical binaries (server, Linux, Windows and FreeBSD agents), web UI files
  and Docker images: the web UI version identifier is the commit instead of
  the build time, embedded files carry no modification date, the Windows agent
  gets a fixed link date, and the images are built with the commit date as
  SOURCE_DATE_EPOCH (rewrite-timestamp). A new workflow builds every
  change twice on two runners and fails on any difference. How to check a
  release yourself:
  Reproducible builds.
• Phones: minimal and still. Under 640 px the Overview fits one screen,
  lists scroll under a fixed toolbar, Tiles show two per row, decorative
  animations (cascades, blurred titles, breathing lights, the animated sky) are
  off, the bottom bar has four entries and field hints appear only while
  typing. Nothing changes on a computer.

Fixed

• Status page and report availability no longer forgets the days before a
  monitor's labels changed (renamed, tags edited, or the upgrade to
  0.1.0-alpha.7 that stopped copying type options such as port into tag_*
  labels): every dumbmonit_up series of a device and every
  dumbmonit_probe_success series of an HTTP/uptime monitor is now merged, so
  those days show their real uptime instead of "no data" or a partial figure.
  The response-time graph of the status page merges them the same way.

• Status page uptime bars now come with a colour key (99.5% or more, 95 to
  99.5%, under 95%, no data), so a day with some downtime is no longer read as
  a day the service was down; the thresholds live in one place shared by the bars
  and the key.

• Alert notifications. An alert whose condition came back right after it
  resolved fired again without telling anyone; it is now announced as a new
  alert. A resolution is announced even when the alert has meanwhile been
  suppressed by a parent or silenced, as long as its firing was announced. The
  handoff to the escalation channel is no longer lost when the first
  announcement left late (after a maintenance window) or when the severity
  escalation fell due in the same cycle.

• Last hardcoded strings. API error messages and hints, the error page and
  the quick-silence name follow the interface language, and absolute dates use
  the locale's format.

• Stale alerts. Disabling a rule now clears its alerts at once (active ones
  leave a silent "rule disabled" entry in the history) instead of leaving them
  firing in the UI, or dropping them without a trace. An evaluation cycle
  running while a monitor or rule was removed no longer brings its alerts back
  (which then "resolved" with a notification). Deleting a rule also deletes its
  per-monitor overrides, so a new rule with the same name no longer inherits
  them.

• Failed notifications. A delivery refused for good (revoked webhook,
  deleted bot, broken channel settings) is no longer resent every cycle: the
  error is shown on the channel and the message dropped. Temporary failures
  (timeout, 429, 5xx) are retried with a growing delay, from 1 minute up to
  30 minutes.

• Agent backlog. An error page from a reverse proxy (400 or 404 without
  DumbMonit's error format, for instance during maintenance) no longer makes
  the agent throw away its whole buffer: it keeps the measurements and
  retries. A batch too large for a proxy (413) is split into smaller ones
  instead of being lost. When the server keeps none of a batch's
  measurements, the agent now warns that the machine's clock is probably off.

• Shutdown. Stopping the container no longer loses the last measurements
  still waiting to be written: they are flushed to VictoriaMetrics before it
  stops. Stopping while the embedded VictoriaMetrics waits to restart after a
  crash now returns at once instead of waiting for the full grace period.

• SNMP survives a lost packet. Each request now gets a few seconds with up
  to two resends instead of one request lasting the whole probe, so a single
  dropped UDP datagram no longer marks a device down. An SNMPv1 device that
  does not know one of the requested values no longer loses the other values
  of the batch.

• Uptime checks with a long timeout. A check whose own timeout is longer
  than DUMBMONIT_PROBE_TIMEOUT_SECS (up to 60 s) is no longer cut short and
  reported as unreachable; it records its failure like any other check.

• Synology and certificate errors. A Synology NAS whose system,
  utilization and storage calls all fail is reported down (timeout) or
  misconfigured (refused login) instead of up. On Proxmox VE, PBS, PDM, PMG,
  Redfish and Synology, only a rejected certificate counts as a configuration
  error: a host name containing tls or a handshake cut by a rebooting device
  now raises the down alert.

• Relay agents with a wrong clock. Values relayed with a timestamp more than
  30 days old or more than an hour ahead are dropped, as they already were for
  agents.

• Metrics API when VictoriaMetrics is down. /api/metrics/query and
  /api/metrics/query_range answer 502 instead of 400 when the metrics
  database is unreachable or failing; 400 is kept for queries it rejects.

• Editing a user is all or nothing. A password refused by
  PUT /api/users/{id} no longer leaves the role or display name changed.

• Editing one secret of a channel keeps the others. Secrets are merged by
  key (Pushover's user key survives a new token). "secrets": {} still clears
  them all, and a new kind or destination still asks for every secret again.

• HTTP probe headers stay with their target. Custom headers (API keys,
  tokens) are no longer sent to another origin on a redirect, like the
  credential.

• Agents keep their binding on foreign 403s. Only the server's own binding
  refusal makes an agent forget its secret, not a 403 from a reverse proxy or a
  firewall.

v0.9.0

Upgrading from 0.1.0-alpha.8

• Version numbers. Releases are now plain 0.MINOR.PATCH: this one is
  0.9.0, the next 0.10.0, and a fix-only release bumps the last number.
  Nothing to do; :latest still follows releases and :edge is built from the
  dev branch.
• Existing Docker Compose file: nothing to do. The image still runs as user
  65532 and your current docker-compose.yml keeps working as it is.
• Bind mounts. The new docker-compose.yml starts the container as root
  (user: "0:0" with four capabilities in cap_add) so that a host directory
  such as ./dumbmonit or /mnt/user/appdata/dumbmonit works without
  preparation: the server hands /data to 65532 at startup, then drops root
  for good. Take the new file if you want that. On SELinux hosts (Fedora, RHEL)
  add :Z to the volume. A named volume needs none of this.
• Reinstall the Linux agent (systemd) if its alpha.8 installation failed. A
  bug in the installer could kill the shell while it wrote the service (the
  command ended on "Killed", the unit was empty or masked, the agent never
  started). On that machine, run
  sudo rm /etc/systemd/system/dumbmonit-agent.service && sudo systemctl daemon-reload,
  then run the installation command again from the agent page. Agents that were
  already running are not affected.
• Monitors are now Monitors. The interface and the documentation say
  monitor, and the built-in rule Device unreachable is now Monitor
  unreachable (same identifier: overrides and silences are kept). The API,
  URLs and metric names do not change.
• Agent services become monitors. On its first report after the update, each
  agent moves its rule overrides, machine-only rules, silences and open alerts
  to the new per-service monitors (Docker, Plakar, restic/Borg, ZFS, libvirt,
  WireGuard, IPsec, speed test). Older history stays under the machine, so a
  chart may show a break at the update. Review the machine's list of modules
  found, and untick the ones you do not want as monitors.
• Security score is opt-in. The Security page is gone and /security opens
  the setting. An installation that already monitored a rated monitor keeps the
  score on; a new one starts with it off. Turn it on in Settings → Monitoring →
  Security score. A few products (pfSense, UniFi, NTP, nginx/Apache, GitLab,
  Forgejo) are no longer rated.
• Agent with Docker Compose. docker-compose.agent.yml is shorter and now
  keeps the agent's binding in a volume. If you copied the old file, take the
  new one (the options moved to the agent page) so that recreating the
  container no longer unbinds it.
• Notification links. Acknowledge and snooze links in alert messages are
  active as soon as a public URL is configured; turn Acknowledge and snooze
  from notifications off in the notification policy if you do not want them.
• Heartbeat to set again after a restore. The outgoing heartbeat URL is not
  part of the encrypted configuration bundle: enter it again after restoring
  onto a new instance (Settings → System → DumbMonit itself).
• New versions of the bundle. VictoriaMetrics 1.154.0 and rustls 0.23.46
  (see Security); the bundled VictoriaMetrics is replaced when you pull the
  new image.

Added

• Acknowledge or snooze an alert from the notification. Alert messages
  carry Acknowledge (until it resolves) and Snooze 1 h: buttons on
  ntfy, Telegram and Web Push (operators and admins only), links on Discord,
  Slack, email and the other channels, {{ack_url}} / {{snooze_url}} for
  custom webhooks; none on PagerDuty and Opsgenie. A link opens a confirmation
  page that works without signing in; nothing happens until its button is
  pressed, so link previews and mail scanners act on nothing. Each link is
  signed with a key derived from the instance secret, covers one gesture on
  the alerts of its message (that firing only: a later re-fire is not
  covered), works once and for 24 hours, and is recorded in the audit log as
  "via notification link". On by default when a public URL is set;
  Acknowledge and snooze from notifications in the notification policy
  turns it off and revokes the links already sent. New public endpoints
  POST /api/public/alert-action/inspect and POST /api/public/alert-action,
  action_links in the notification policy, actions in GET /api/notify/kinds.
  See Acknowledge or snooze from the notification.
• Who watches the watcher. An optional outgoing heartbeat
  (Settings → System → DumbMonit itself): DumbMonit calls a URL of yours
  (Healthchecks.io, an Uptime Kuma push monitor, Better Stack…) every 60
  seconds by default, only while the scheduler runs, SQLite answers and
  VictoriaMetrics is reachable, so that an outside service alerts you when the
  host, the container or the engine goes quiet. A Test button, an optional
  failure signal (/fail, or status=down for Uptime Kuma), the URL stored
  encrypted and never shown again, the same outbound guard as the notification
  channels. Six new built-in rules on DumbMonit's own health, through the usual
  channels: data volume almost full, embedded VictoriaMetrics restarting in a
  loop, scheduler stalled, polls running late, metric writes failing, database
  growing fast, from new dumbmonit_instance_* series written every minute.
  New endpoints GET /api/self-monitoring, PUT /api/self-monitoring/heartbeat
  and POST /api/self-monitoring/heartbeat/test. See
  Watching DumbMonit itself.
• Docker health status. The server image now carries a HEALTHCHECK
  (dumbmonit healthcheck, a local call to /api/health), so Docker, Portainer
  and Unraid show the container as healthy.
• Each service an agent finds is its own monitor. Docker, Plakar,
  restic/Borg, ZFS, libvirt, WireGuard, IPsec and the speed test no longer pile
  up on the machine's page: each one becomes an agent_service monitor under
  the machine, with its own status, alerts, rules and silences, hidden behind
  the machine when it goes down. The machine keeps CPU, memory, disks, network,
  SMART, sensors and OS health; every series is written once, under the monitor
  it belongs to. The machine's page lists the modules found and not found:
  untick one to drop its monitor (the agent stops collecting it), tick one to
  watch it before it shows up. Nothing to choose at install time. See
  Services found by the agent.
• Topology map. A new Map page (/map, from the ⋯ menu of the Monitors page
  and the command palette) draws the whole infrastructure from the
  links DumbMonit already knows, nothing to type in: declared parents, relay
  agents, hypervisor guests (Proxmox, XCP-ng, Nutanix, vSphere, libvirt) and
  LLDP neighbours of SNMP switches, matched to a monitor only when the name is
  unambiguous. What is down and what sits behind it (impacted, alerts
  suppressed) stand out, in words as well as colour. Zoom and pan, a folder or
  relay-site filter, a list view on phones, and Export to SVG, PNG or a
  clean A4/A3 landscape print. New endpoint GET /api/topology. See
  Topology map.
• Import from Uptime Kuma. On Add a monitor, drop the backup file of
  Uptime Kuma 1.x (Settings, Backup, Export; version 2 has no export) and get a
  preview of what will be created and what is skipped, and why: HTTP, keyword and
  JSON-query monitors become http, ping, TCP port and DNS keep their type, push
  monitors become heartbeats (with a new URL), groups become folders and tags
  become monitor tags. Notifications, credentials, headers and request bodies are
  never imported. New endpoint POST /api/targets/import/kuma. See
  Coming from Uptime Kuma.
• XCP-ng / XenServer. A new xcpng monitor reads a whole pool through XAPI
  (JSON-RPC, read-only role): hosts disabled or offline, VMs and their power
  state, storage repositories filling up, and high availability (protected VMs
  found halted, an overcommitted pool). A pool member's HOST_IS_SLAVE answer
  is followed to the coordinator. Four built-in rules. See
  XCP-ng / XenServer.
• Nutanix AHV. A new nutanix monitor reads Prism Central's v4 API
  (pc.2024.3 or later, Prism Viewer role): clusters, hosts degraded or in
  maintenance, AHV VMs, storage container fill level and unresolved alerts by
  severity. Three built-in rules. See Nutanix AHV.
• OpenVPN server monitor type: version, whether the server reports itself
  connected, and every client in session with its addresses and traffic, read
  through the management interface (read-only: version, state, status 3).
• KVM virtual machines on the Linux agent. A new libvirt module reads
  virsh -c qemu:///system (domains, their state, vCPUs and memory; storage
  pools and their fill level), silent where virsh is absent. Two built-in
  rules: a crashed domain, a pool almost full. See
  the agent page.
• IPsec tunnels in the agent (module ipsec): every strongSwan tunnel
  configured, up or down, read with swanctl --list-conns / --list-sas, with
  traffic and time to the next rekey, an IPsec panel on the monitor page, and
  the IPsec tunnel down rule.
• Internet speed test in the agent: download and upload rate, latency and
  jitter against an endpoint you name (LibreSpeed, Cloudflare, your own), at
  most once per period (6 h by default, 5 min minimum). Off by default since
  it uses bandwidth; the Internet download rate low, upload rate low
  and latency high rules stay silent until a threshold is set.
• New security checks. Linux hosts: SSH ...

v0.1.0-alpha.8

Added

• News on the wall. Off by default, set in Settings → Wall news: a
  headline ticker along the bottom (smooth marquee; one fading headline at a time
  under reduced motion) and a muted live channel in a tile (YouTube, Dailymotion
  or Twitch, small to large, right column or centre). Pick a country and tick
  its sources (France, Switzerland, Belgium, Germany, UK, US, Canada, Spain,
  Italy, Portugal, Brazil, Russia, China, international; each feed checked), or
  add any RSS/Atom feed with a Test that shows its first headline. The server
  reads the feeds (RSS 2.0, RDF, Atom) behind the internal-address guard with
  time and size limits and a five-minute cache. New routes GET /api/wall/news,
  GET|PUT /api/wall/news/settings, GET /api/wall/news/presets,
  POST /api/wall/news/test. See Wall mode.

• Product icons on the wall's problems, as in the device lists.

• Missing server prerequisites are shown where they matter. Adding or editing
  a website-change device (headless browser for screenshots) or a ping device
  (ICMP sysctl) shows a notice when the server cannot do it, with the Compose
  lines to copy and a link to the matching section of
  Install with Docker;
  GET /api/collectors gains an optional requirements field.

• Website health & SEO: more control over what alerts. Each metadata check
  (final address, title, description, canonical URL, robots directives, Open
  Graph, language, h1 count, hreflang, Google verification tag) can be switched
  off on its own, and a change is reported after a configurable number of
  consecutive checks (2 by default, 1 to 10). The hreflang languages and the
  google-site-verification tag are now tracked, with new alerts "Website
  Google verification changed" and "Website SEO markup changed". See
  Website health & SEO.

• Nearly empty pages. Besides the blank-page threshold, the visible text of
  a site is compared with a slowly moving reference: a sharp drop (80% by
  default, confirmed like any change) raises "Website page nearly empty".

• Website categories. Sites get a category (E-commerce, Blog, Web app,
  Showcase) guessed from clear signs, or set with the new Category option.
  The CSV import takes a category column, files unclassified sites under
  Websites/<category> and keeps Websites/<platform> when the page does not
  say. The category is the category label of dumbmonit_website_info.

• Agent: choose its modules. A modules list in agent.yaml
  (--modules=docker,plakar for install.sh, -Modules for install.ps1,
  DUMBMONIT_AGENT_MODULES) runs only the listed optional modules: the others
  send nothing and raise no alert. The enrolment screen and Settings → Agents
  have a Choose the modules switch that writes it into the install
  commands. Without a list, every module still detects itself.
  install.sh --plakar-klosets=@name picks the Plakar klosets to read.

• Rule "Plakar kloset unreadable" (warning, 30 min): a kloset the agent
  cannot open no longer raises the critical "Plakar backup failed", which now
  only means a snapshot with errors.

Fixed

• Wall: the problems on the left no longer overlap the devices or run past
  the screen. With many problems or on a 720p display, the big tiles used to
  spill over the device tiles below; they now shrink to one line each, then fold
  into "And N more". A long device name no longer pushes the cause out of a row.
• Watching a site that redirects to another host reads the whole site. A
  start page redirecting from example.com to www.example.com used to leave
  every link outside the watch, which then only covered the start page. Only
  a host of the same site is adopted (www., the bare domain, a subdomain,
  http to https): a start page that redirects to a sign-in page or a
  third-party domain only has its start page read.
  Tracking parameters (utm_…, fbclid, gclid…) no longer make one page
  several; Ignore query strings drops the whole ?… part. When Max
  pages stops a crawl, the device page now says how many pages were found.
  New User agent option for sites that turn robots away.
• Every website check that finds changes is notified, and says which
  pages. The "Website changed" alert stayed open while consecutive checks
  kept finding changes, so only the first of them was ever notified, and the
  message only gave a count. While the alert fires, every further check that
  finds changes is now notified again, naming the pages ("/pricing, /contact
  and 2 more"); it stays one alert per device, so an acknowledgement or a
  snooze taken on it covers the following checks, and it resolves once, at the
  first check that finds nothing new. See
  Alerts.
• Dragging a monitor into a folder works again. Pressing a row on its name
  or address grabbed the link instead: the browser started its own drag of it,
  cancelled the gesture, and the monitor never moved. Rows can be dragged from
  anywhere again, onto another row or onto a folder header.
• Instant metric reads failed with "latency_offset=0ms is out of allowed
  range". VictoriaMetrics refuses a zero offset, so every panel reading the
  latest value (device pages, Docker, Plakar…) showed an error. The offset is
  now 1 ms.
• Plakar was never found by an agent installed as a systemd service. The
  unit hid /home (ProtectHome=yes), so ~/.config/plakar/stores.yml was
  invisible, and Plakar refused to start without HOME. The unit now uses
  ProtectHome=read-only and a CacheDirectory; the agent runs plakar with
  the owner's HOME and plugins (-datadir) and its own -cachedir, and
  warns when /home looks empty. Re-run the install command to get the new
  unit.
• Docker alerts for containers nobody expects to run. A one-shot
  docker run that finished, a container never started, or one stopped by
  hand without a restart policy no longer raises "Container stopped"
  (new series dumbmonit_container_stop_expected). A stopped container no
  longer reports its stale health verdict, so "Container unhealthy" stops
  firing next to "Container stopped".
• Plakar log noise. An unreadable kloset is logged once, again when the
  reason changes, and when it recovers — not every ten minutes.
• With system_health switched off, the agent still reports the OS identity
  (dumbmonit_agent_os_info) the device page shows.

Changed

• Website changes ignore the site's menus, header and footer. They are the
  same on every page, so one new menu entry used to mark every page of a
  watched site as changed. The navigation, the site header and footer and the
  sidebars are now left out of the comparison (their links are still
  followed); Compare menus, header and footer brings them back. New
  options: Watched area compares only some elements (main, #content),
  Excluded areas leaves more out (.cookie-banner). The same edit found on
  several pages by one check is shown once, "+N pages"; changing Max pages
  now takes a new reference instead of reporting every added page as new; and
  500 changes are kept per device instead of 100. Existing watches take a new
  reference at their next check after the update. See
  What part of the page.
• Minimal docker-compose.yml. About 15 lines, no .env and no ${VAR}: port, secret, retention, external VictoriaMetrics, password reset and the screenshots browser are now environment: examples in the installation guide. To build from a checkout, add the docker-compose.dev.yml overlay.

v0.1.0-alpha.7

Security

• Custom webhook headers are now a secret. Extra headers moved from the
  channel settings, which every viewer and read token could read, to the
  encrypted secrets: they are never returned, are kept when you edit the
  channel without retyping them, and their values are masked in error
  messages. Existing channels are migrated at startup (and after a restore).
  See Custom channel settings.
• Status page subscriber emails are admin only. Viewers, operators and
  read tokens can no longer list them.
• API and agent token lists are admin only, like creating and revoking.
• Redirects never leave the configured host. Built-in integrations
  (Proxmox, Synology, GitLab, Kubernetes…) and notification channels follow a
  redirect only to the same host (or from http to https): a hostile device
  can no longer bounce a probe to the loopback or a metadata service, and
  custom credential headers (X-Api-Key, PRIVATE-TOKEN…) are never sent to
  another host.
• Notification channels cannot target DumbMonit itself. A webhook, a
  self-hosted service URL or an SMTP relay that resolves to the embedded
  VictoriaMetrics or to the server's own loopback listener is refused with a
  configuration error, checked after DNS resolution, at connection time and on
  every redirect. Other loopback and LAN addresses stay allowed.
• Web Push limits. An account holds at most 10 push devices, and a test
  notification can be sent once every 30 seconds.
• Secret-looking device options are masked for non-admins. Options whose
  name contains key, token, password…, HTTP check headers and the
  password of a user:pass@host address read *** for viewers, operators,
  read tokens and the assistant tools.
• Status page links ignore forged forwarded headers. The RSS feed and the
  link stored for subscription emails use X-Forwarded-Host and
  X-Forwarded-Proto only from DUMBMONIT_TRUSTED_PROXIES.
• The session cookie is Secure over HTTPS even without
  DUMBMONIT_COOKIE_SECURE, when the browser's Origin or a trusted proxy
  shows the page is on https://.
• /api/health no longer shows failure details to anonymous callers, which
  could include the address and credentials of an external VictoriaMetrics.
• The first-run setup code is rate limited per address only, so someone
  else on the network can no longer keep the owner locked out of /setup.
• The WordPress status banner escapes the fetch error it shows in the settings
  screen.

Added

• Website health & SEO, in bulk. A new website device type reads a
  site once per check, following its redirects (http → https and example.com
  → www.example.com are normal; a loop or too many hops is an error), and
  reports a site that is down or answers an error, a page gone blank, missing
  expected text, noindex (meta tag or X-Robots-Tag), a robots.txt that
  blocks everything, a slow answer, and changes of the title, description,
  canonical URL or final address — only once two checks in a row have seen
  them, so A/B tests stay quiet. Each site's platform (WordPress, Shopify,
  Wix, Next.js…) is detected and exposed as dumbmonit_website_info{platform}.
  Nine built-in alert rules. See Website health & SEO.

• Import websites from a CSV. Import websites (CSV), on the add-device
  page and on the device list, creates one website device per row from pasted
  or uploaded text (url required; name, folder, tags, interval and
  expect_text optional; up to 1000 rows). A preview shows each row's folder
  and errors before anything is created, sites already monitored are skipped,
  and rows without a folder land in Websites/<platform> (WordPress, Shopify,
  Wix…) after one page fetch each. A template is one click away. Also
  available as POST /api/targets/import.

• A custom domain for a status page. The page editor's Public domain
  field (for example status.example.com) makes DumbMonit show that page at
  the root of the name when your reverse proxy (Traefik, Nginx Proxy Manager,
  Caddy, Nginx, Cloudflare Tunnel) sends it there with the original Host
  header. Nothing else of DumbMonit answers on that name — no sign-in, no API,
  no other page — and subscriber emails, the RSS feed and the share snippets
  link to it. Kept in backups. See
  Custom domain.

• An operator role, between viewer and admin. Operators read everything
  and handle alerts — acknowledge, snooze, ignore a rule for one device,
  schedule or delete maintenance windows, clear resolved history — but change
  no configuration: devices, rules, channels, notification policy, status
  pages, settings, backups, tokens and accounts stay admin only, and an
  operator can never change a role. Pick it under Settings → Users, or map it
  from your identity provider with the new Operator groups SSO setting
  (DUMBMONIT_OIDC_OPERATOR_GROUPS). The API marks the operations open to
  operators with x-roles: [admin, operator]. See
  Users.

• Push notifications on phones and computers, without an app. A new
  Web Push channel sends alerts as native notifications through the
  browser's push service, even with DumbMonit closed. Each account enables
  its own devices in Settings → Push notifications (Enable on this
  device, Send a test, list of subscribed devices); on iPhone and iPad,
  add DumbMonit to the Home Screen first. HTTPS is required. The server's
  VAPID key pair is generated at first start and stored encrypted, messages
  are end-to-end encrypted (RFC 8291), subscription addresses must be HTTPS
  on public IPs, and subscriptions the push service reports as gone (404/410)
  are removed. The interface gains a service worker that only shows
  notifications and caches nothing. See
  Push notifications (PWA).

• Periodic email reports. Settings > Reports sends the team a weekly
  (or daily, or monthly) email: availability per group and device, the
  period's incidents, the least stable devices and the comparison with the
  previous period. Plain HTML tables with a text version, no remote image,
  sent once per slot, with a Send a preview button. Kept in backups. See
  Email reports.

• Guided updates. The server looks at the latest GitHub release at most
  once a day (one anonymous request, nothing about your instance is sent) and
  shows Update available: vX in the corner and in Settings → About,
  with a How to update panel (back up the database and /data/secret.key,
  then docker compose pull && docker compose up -d), a link to the release
  notes, Check now and See what's new. Pre-releases compare correctly
  (alpha.10 is newer than alpha.9). Nothing is installed automatically.
  Turn it off in Settings → About or with DUMBMONIT_UPDATE_CHECK=off for
  air-gapped instances. New GET /api/update. See
  Update.

• A status banner for your own website. A published status page now serves
  banner.js, a dependency-free script that shows "2 services are down" on any
  site, and its public JSON can be read from other origins. Copy-paste
  integrations for plain HTML, WordPress and PHP live in integrations/. See
  Website banner.

• A city scene behind the status page banner. The page editor's Scene
  setting takes up to six of Venice, Paris, Tokyo, New York, London and Rome
  (none by default), with a rotation of every visit, minute, ten minutes or
  hour when there are several. Both settings are kept in backups. See
  Status pages.

• A "What's new" window after an update. The first screen after an
  upgrade lists the headline changes of the new version once, with a link to
  the full release notes; Settings → About reopens it.

Changed

• The tip bubbles are gone. Pip's tips and the "Did you know" card on the
  overview are removed.
• The documentation is available in 9 languages (English, German, Spanish,
  French, Italian, Portuguese, Brazilian Portuguese, Russian, Simplified
  Chinese).

Fixed

• Every channel type can be saved. The database still only accepted the
  first seven channel types (Discord, ntfy, Gotify, Telegram, Slack, webhook,
  email): saving a Matrix, Teams, Pushover or other channel failed with an
  internal error. The table is rebuilt without that list at upgrade; existing
  channels and queued notifications are kept.

• Nginx, Apache and NTP devices are available on the server. The three
  kinds existed in the shared collectors but were missing from the server's
  list, so they could not be added. See Nginx and
  Apache.

• Per-host series no longer collapse into one. Nginx Proxy Manager now
  labels its hosts proxy_host, vSphere esxi and Ceph ceph_host, instead
  of a host label that the device's own host label overwrote. Existing
  series and silences keyed on the old host label start new series: update
  your rules and silences to the new label. A label that still collides is
  kept as exported_<name>. See Nginx Proxy Manager.

• Options and secret-looking tags are no longer copied as tag_* labels.
  A device's settings (port, insecure_tls, CA certificate…) stay settings,
  and free tags named like a secret (password, token, key…) or longer
  than 256 characters are not written to the metrics store.

• Saving a device without group_name keeps its folder. PUT /api/targets/{id} used to clear the folder when the field was left out;
  now only "" or null clears it. The OpenAPI description is updated.

• **Self-signed certificates for se...

v0.1.0-alpha.6

Security

• Hosts that never bound to their agent are refused. The transition
  window for hosts enrolled before agent binding is closed: their batches,
  container commands and relayed probes are now refused with a message that
  says what to do, and an agent too old to be bound is no longer enrolled. The
  device page shows Not bound — re-enrol this host with the Allow
  re-enrolment button; the next batch inside that window binds the host. See
  Hosts that predate binding.
• The first admin account needs a setup code. While no administrator
  exists, the server prints a one-time code in its logs at startup
  (docker compose logs dumbmonit), kept in memory and changed at every
  restart; /setup asks for it, and wrong codes are rate-limited. Someone else
  on the network can no longer claim a fresh instance first.
  DUMBMONIT_SETUP_CODE presets it for automated deployments.
• Agent installs always verify the binary. The install commands now carry
  the expected SHA-256 of each binary the server ships (--sha256=…,
  -Sha256 …), and install.sh / install.ps1 refuse a download that does
  not match, that has no checksum, or that cannot be hashed — no more
  warning-only. --insecure-skip-checksum (-InsecureSkipChecksum) is the
  explicit, loud escape hatch for air-gapped setups. After a server upgrade,
  copy a fresh install command.
• Single sign-on no longer creates accounts unless asked. Create accounts
  on first sign-in is off by default, for new installs and wherever it was
  never set (DUMBMONIT_OIDC_AUTO_CREATE unset, or settings saved before the
  option existed); Settings → Single sign-on says so. A value saved explicitly
  is kept.
• Hardening from the autumn audit. The login lockout is keyed on account
  and address; agent tokens are checked before request bodies are read and
  heartbeat tokens are hidden from viewers; the OIDC login is bound to the
  browser that started it and spoofed forwarded headers are distrusted; the
  Windows agent's configuration directory is locked down; the private-address
  guard also covers website-change screenshots; a secret must be re-entered
  when its destination changes; the Prometheus read proxy and the
  VictoriaMetrics import stream are tightened; backup key derivation is capped
  and runs off the async runtime.

Added

• Integration packs. A device type can now be added without a release: one
  YAML file declares HTTP or Prometheus sources on the device, the metrics to
  extract (JSONPath, regular expressions, Prometheus families, rows discovered
  in a list), its options and its alert rules, or SNMP profiles in the usual
  format. Installed through POST /api/packs, the type is available at once
  as pack.<id>, its metrics under dumbmonit_<id>_, its rules as
  pack:<id>:<name> (never rewritten by an update). Every request stays on
  the device's own address: other hosts, absolute URLs and redirects elsewhere
  are refused, loopback needs the device's explicit option, responses are
  capped at 4 MiB, credentials only go into headers. dumbmonit pack lint and
  dumbmonit pack test check a pack and replay its fixtures offline. Three
  reference packs: node-exporter, shelly-plug, speedtest-tracker. Packs
  are part of backups.

• Status pages worth showing to users. Each service's history bar now
  tells a day's minutes of downtime on hover and on keyboard focus (one tab
  stop, arrow keys between days), days without any measurement stay grey, and
  uptime is given over 30 days and, on a 90-day page, 90 days. Badges for
  a README: uptime (?days=1|7|30|90, never beyond the page's history) and
  response time next to the status badge, for the page and for each service
  (/components/<key>/…), flat colours readable on light and dark READMEs,
  cached a minute. Look: an uploaded logo (PNG, JPEG or WebP, 256 KiB,
  checked by content, never SVG), an accent from a closed set that stays
  readable by day and night, a footer text and a link to the organisation's
  site — no custom CSS or HTML. Embed: /s/<slug>/embed, a compact view
  for an iframe (?theme=, ?history=0); it and the page are now the only
  framable addresses. Email subscribers through an SMTP channel you
  already have: double opt-in, an email per announcement, update and status
  change, a one-click unsubscribe link and List-Unsubscribe-Post in every
  message, a rate-limited public endpoint, and the list in the editor. The
  editor's new Share panel builds the badge and iframe snippets. A test
  walks every public route and checks none reveals a device name, address or
  type.

• Server hardware over Redfish (redfish): the management controller of a
  server (Supermicro, Dell iDRAC, HPE iLO, Lenovo XClarity, ASRock Rack,
  OpenBMC) read through the DMTF standard API with a read-only account. Fans,
  temperatures with the critical threshold each sensor declares, voltages, power
  supplies and their redundancy, consumption, drives with predicted failure and
  remaining SSD life, memory and processor summaries, system and controller
  health, and the event logs counted by severity (never read). Both generations
  of the schema — Thermal/Power and ThermalSubsystem/PowerSubsystem/
  Sensors — give the same dumbmonit_redfish_… series. Status.State = Absent or Disabled produces no health series, so an empty power supply bay
  or DIMM slot is never an alert. Six built-in rules: fan failed, temperature
  above critical, power supply redundancy lost, power supply failed, drive
  failure predicted, system health critical. Basic authentication by default;
  auth = session reuses one Redfish session and closes the one it replaces.

• Redfish device page: a server read over Redfish gets its own panel. It
  says first whether the server is healthy, in one word, with every component
  that drives it; then each fan and temperature against the thresholds the
  controller declares for that sensor (caution and critical temperatures, a
  fan's minimum, now collected as temperature_upper_caution_celsius and
  fan_lower_critical_rpm); whether power redundancy holds and the state of
  each supply; the drives with predicted failure and life left; memory,
  processor and controller summaries; and the event-log counts by severity.
  Redfish, TrueNAS, OPNsense, Mail Gateway and Datacenter Manager now sit with
  the other devices in the "Add a device" picker instead of under "Other".

• Zyxel switch SNMP profile, checked against a real XS1930-10: CPU (one and
  five minutes), memory and firmware from Zyxel's private branch, plus a new
  Ethernet switch profile (included by it, selectable by hand for any other
  switch) with per-port frame errors by cause from EtherLike-MIB (FCS,
  alignment, symbol, late and excessive collisions, MAC errors), the negotiated
  duplex, broadcast and multicast in 64-bit counters, and LLDP neighbours. The
  host resources profile gains the Net-SNMP load averages, which are all a
  Supermicro BMC's own agent offers about its CPU. Two built-in rules for every
  SNMP device: Port accumulating errors and Port flapping.

• OPNsense device (opnsense): the open source firewall that sits in front
  of most homelabs, read through its API with a key that can only look at
  status pages. Every gateway with its round-trip time and packet loss — the
  multi-WAN failover that happened three weeks ago and that nobody noticed is
  exactly the failure this is for — the pf state table against its configured
  limit, interface counters and the public address of the moment, WireGuard,
  OpenVPN and IPsec tunnels up or down, DHCP leases counted per server, the
  Unbound resolver, services, CARP (including the persistent maintenance mode
  everyone forgets to switch off), FreeBSD network buffers, temperatures and
  pending updates. dumbmonit_opnsense_… metrics, twelve built-in rules,
  GET /api/targets/{id}/opnsense/… and a documentation page. OPNsense writes
  "none" for a gateway that is fine and "~" for one it does not monitor:
  the first is read as online, the second produces one series fewer rather
  than a zero pretending to be a measurement. The firmware check is never
  triggered — only its last result is read, so a DumbMonit probe never sends
  the firewall to the update mirror.

• TrueNAS device (truenas): the ZFS pool whose mirror or RAIDZ vdev lost a
  disk and still serves its data — the failure nobody sees until the second
  disk goes — with the disk named on the device page; scrubs and resilvers in
  progress and the result of the last scrub, pool and dataset usage against
  their quotas, snapshot counts, replication and periodic snapshot tasks with
  their last run and error, disk temperatures read from TrueNAS's cache (a
  sleeping disk is never woken), SMART self-test results, the alerts TrueNAS
  raises itself, and services. dumbmonit_truenas_… metrics, thirteen built-in
  rules, GET /api/targets/{id}/truenas/… and a documentation page, which says
  plainly that TrueNAS's REST API accepts only a full-administrator key.

• Five more kinds of service monitor, each one beginning a real session in
  the service's own protocol rather than checking that a port opens.
  SMTP (smtp) runs the greeting, EHLO, STARTTLS and, if the target
  carries a credential, AUTH — and never sends a message; a refused password
  is reported as reason="auth", not as an outage. PostgreSQL
  (postgres) and MySQL/MariaDB (mysql) connect, authenticate and run
  one query (SELECT 1 by default, which reads no table), timing the
  connection and the query separately: the "the database is up but no longer
  answering" signal. Replace the query with one that returns a number and it
  becomes a chart. MQTT (mqtt) connects, subscribes to a topic and can
  wait for a ...