Changelog

This page mirrors CHANGELOG.md in the repository. Update both together.

0.12.2 (2026-10-30)

Proxmox: the Proxmox settings page now generates the command that connects the dashboard to the cluster. Run it on any node: it creates a read-only dashboard@pve user, a privilege-separated API token and the PVEAuditor permission, and prints the secret once. User and token names are editable, with Copy and Use token ID buttons.

0.12.1 (2026-10-21)

Fixes from live testing.

Storage Health: every source (TrueNAS, ASUSTOR 1/2, UniFi NAS 1/2) now has its own Test button in its admin section, with a clear "Not configured" answer when it is empty. The module-level button is now "Test all sources".
qBittorrent: the login pause after a rejected password (5 to 15 minutes) is cleared as soon as you save a new password, instead of making the next test and poll fail with "paused". Network errors in the admin test no longer leave the button stuck.

0.12.0 (2026-10-21)

One design language across the whole app. The dense view and the wallboard already used it; now the classic dashboard, the admin console, the sign-in screens, Lab View, the details drill-down and the diagnostics panel do too. There are no data or API changes, and settings and history are untouched.

What changed visually

Flat, opaque panels with 1px hairline borders and one corner radius. No gradients, glow, blur, animated background or hover movement.
A compact console header (uppercase title, mono chips) instead of the large hero.
Blue means normal and red means a problem everywhere. Status that used green and amber now uses blue and red, and per-service brand colors no longer tint the cards.
Outline buttons by default and a single filled blue button for the primary action (sign in, create admin, save settings). Mono uppercase labels, lighter font weights, and native controls (checkboxes, number inputs, select menus) that follow the theme instead of showing white.
Light mode follows the same language with darker accents so text stays readable.
Second sweep: remaining bold weights, accent-tinted borders, violet text, tiny type and hover movement removed from the classic and admin screens; a computed-style audit of every screen and state is now clean apart from the intentional primary buttons and active-nav bar.

Contrast and accessibility

Text colors were measured against WCAG 2.1 AA. Two weak spots were found and fixed: the "faint" gray (3.4:1) was lightened for the dense view and wallboard, and the light-theme blue accent (4.1:1) was darkened. All four accent presets now pass in both themes. See docs/design-language.md.

Upgrade notes

Accent choices changed to Blue, Cyan, Violet and Slate. Red is reserved for problems, so the Amber and Rose accents were replaced; a saved Amber or Rose preference falls back to Blue. The Signal theme preset now uses Cyan.
The "Panel depth" slider was removed because panels are opaque now.
Everything else is the same as 0.10.0. If you already run 0.10.0, pulling this build changes only how the app looks.

0.10.0 (2026-10-14)

The largest update so far: a security and reliability pass, new integrations, and two new views.

Upgrade notes (read before deploying)

Set TRUST_PROXY_HOPS=1 if nginx (or another reverse proxy) sits in front of the dashboard. The default is 0, which ignores X-Forwarded-For. Behind a proxy that makes every client look like the proxy, so login rate limits are shared by all users. Never set it when clients can reach port 3000 directly.
Origin checks. Browser writes and WebSocket connections are rejected when their Origin host does not match the request Host. A standard proxy config that passes Host through needs nothing. If yours rewrites Host, list the public origin in DASHBOARD_ALLOWED_ORIGINS. A blocked request logs Rejected POST ... from origin ....
The container runs as a non-root user. On start it fixes ownership of /data, so existing volumes keep working. The image now includes a healthcheck.
The default view changed. / is now the dense operations console. The original card dashboard is at /classic (there is a "Dense view" button to return).
Full settings backup is now a POST that asks for your admin password again. The Recovery page handles this; scripts that called GET /api/admin/settings/backup must change.
Optional: DASHBOARD_SETUP_TOKEN (protects first-run admin creation) and DASHBOARD_DISPLAY_KEY (read-only key for a wall display).
Never set DASHBOARD_DEMO on a real deployment. It replaces all data with synthetic samples.

Security and reliability

Fixed two unauthenticated crashes (a malformed URL path, a malformed cookie).
Login rate limiting can no longer be bypassed with a forged X-Forwarded-For; unknown usernames take as long as real ones; password hashing no longer blocks the server.
Origin checks on writes and sockets, a Content-Security-Policy, a whitelist on the Seerr request endpoint, atomic database writes, graceful shutdown that flushes the database.
Webhook delivery has a timeout, retries failures after a cooldown, and never echoes the webhook URL. SNMP errors no longer echo the community string. UniFi discovery will not send a saved API key to a changed URL.
0 known vulnerabilities in dependencies; the image ships only production dependencies.

Behavior fixes

Alerts now fire with no browser open: one server-side poller replaces per-browser timers, with per-integration poll intervals (DASHBOARD_POLL_<ID>_SECONDS).
Proxmox cluster memory no longer double-counts guest RAM (this caused false memory alerts); shared storage is counted and queried once; backup lookups send far fewer requests.
The diagnostic trend window used the oldest samples instead of the newest, so trend warnings could never clear.
UniFi discovery threw an error on every call. TrueNAS no longer loses all its data when one call fails. UniFi NAS reuses its login session (this fixes login-attempt rate limits). Kavita and Grimmory work behind a URL sub-path.
A failing check no longer raises a second integration-wide alert, which roughly halves duplicate webhooks.

New

qBittorrent and SABnzbd integrations (speeds, errors and failures, free disk space).
/wall: a wallboard for a wall-mounted TV. A fixed 1920x1080 canvas scaled to any screen, nine panels, blue for normal and red for problems, a loud NO LIVE DATA screen when data stops, and an optional read-only display key. See Wallboard.
Dense work view at /: a monospace console with grouped rows, expandable details, search (press /), a capacity panel, a timeline and response-time sparklines.
Integrations return structured stats; the wallboard backup limit follows the existing "Backup max age hours" alert rule.
Demo mode (DASHBOARD_DEMO=ok|warn), npm run docs:screenshots, and a module setup guide with screenshots (Module Setup).
npm run test:hardening (57 checks) and typed stats readers in src/stats.ts.

Checklist for testing a build on the live host

docker compose logs shows Homelab Dashboard listening on 3000 and (behind a proxy) trusting 1 proxy hop, with no errors.
Sign in, then open / (dense), /classic, and /admin.
Settings still show as configured; Test saved connection works for each module.
Add qBittorrent and SABnzbd in Admin (URL plus credentials or API key) and confirm they report.
Open /wall and compare each panel with the real systems. Note anything that looks wrong or empty.
Optional: set DASHBOARD_DISPLAY_KEY, open /wall?key=... in a private window, and confirm it works without a login.
Stop the container and confirm the wall shows NO LIVE DATA after about 90 seconds.
To roll back, set the compose image back to :latest and docker compose up -d. Settings and history are unchanged by this release.