Dev

.env.example

@@ -24,6 +24,10 @@ COMMAND_TIMEOUT_SECS=300
 STATUS_PANEL_USERNAME=admin
 STATUS_PANEL_PASSWORD=admin
 
+# HTTP bind address. Defaults to 127.0.0.1 (loopback) for bare-metal safety.
+# In containers with port mapping, must be 0.0.0.0 to be reachable from the host.
+STATUS_PANEL_BIND=0.0.0.0
+
 # Backup signer / verification
 DEPLOYMENT_HASH=replace-with-secret
 TRYDIRECT_IP=127.0.0.1

.stacker/pipe-scan-cache/018204ecd7ba2b8104c873d668248bd3ac6156202bebe6a8aa38fa20e656cd35.json

@@ -0,0 +1,56 @@
+{
+  "version": 1,
+  "selector": {
+    "mode": "remote",
+    "selector_kind": "app",
+    "selector": "status-panel-web",
+    "deployment_hash": "deployment_a631cf66-a224-440b-9871-12b63548671c",
+    "container": null
+  },
+  "protocols_requested": [
+    "html_forms"
+  ],
+  "capture_samples": true,
+  "cached_at": "2026-05-22T07:55:49.388248+00:00",
+  "report": {
+    "type": "probe_endpoints",
+    "deployment_hash": "deployment_a631cf66-a224-440b-9871-12b63548671c",
+    "app_code": "status-panel-web",
+    "protocols_detected": [
+      "html_forms"
+    ],
+    "protocols_requested": [
+      "html_forms"
+    ],
+    "containers": [],
+    "endpoints": [],
+    "resources": [],
+    "forms": [
+      {
+        "container": "project-status-panel-web-1",
+        "id": "form_contact",
+        "action": "",
+        "method": "POST",
+        "fields": [
+          "name",
+          "email",
+          "subject",
+          "message"
+        ]
+      }
+    ],
+    "probe_attempts": [
+      {
+        "scope": "remote_app",
+        "selector": "status-panel-web",
+        "container": null,
+        "protocols": [
+          "html_forms"
+        ],
+        "outcome": "detected"
+      }
+    ],
+    "target_kind": "html_form",
+    "probed_at": "2026-05-22T07:55:48Z"
+  }
+}

.stacker/pipe-scan-cache/abbfec54b2192c37e34aa64d9bdd8488b78a69d94f6735b7a874423724673f44.json

@@ -0,0 +1,62 @@
+{
+  "version": 1,
+  "selector": {
+    "mode": "remote",
+    "selector_kind": "app",
+    "selector": "status-panel-web",
+    "deployment_hash": "deployment_a631cf66-a224-440b-9871-12b63548671c",
+    "container": null
+  },
+  "protocols_requested": [
+    "html_forms",
+    "openapi",
+    "rest"
+  ],
+  "capture_samples": true,
+  "cached_at": "2026-05-22T07:55:51.452961+00:00",
+  "report": {
+    "type": "probe_endpoints",
+    "deployment_hash": "deployment_a631cf66-a224-440b-9871-12b63548671c",
+    "app_code": "status-panel-web",
+    "protocols_detected": [
+      "html_forms"
+    ],
+    "protocols_requested": [
+      "html_forms",
+      "openapi",
+      "rest"
+    ],
+    "containers": [],
+    "endpoints": [],
+    "resources": [],
+    "forms": [
+      {
+        "container": "project-status-panel-web-1",
+        "id": "form_contact",
+        "action": "",
+        "method": "POST",
+        "fields": [
+          "name",
+          "email",
+          "subject",
+          "message"
+        ]
+      }
+    ],
+    "probe_attempts": [
+      {
+        "scope": "remote_app",
+        "selector": "status-panel-web",
+        "container": null,
+        "protocols": [
+          "html_forms",
+          "openapi",
+          "rest"
+        ],
+        "outcome": "detected"
+      }
+    ],
+    "target_kind": "html_form",
+    "probed_at": "2026-05-22T07:55:50Z"
+  }
+}

.stacker/pipe-scan-cache/latest-c6a71384dbc47f68c3c3ef7bce255c99ef733b27339c9375cdbe499e3a0c8b7a.json

@@ -0,0 +1,62 @@
+{
+  "version": 1,
+  "selector": {
+    "mode": "remote",
+    "selector_kind": "app",
+    "selector": "status-panel-web",
+    "deployment_hash": "deployment_a631cf66-a224-440b-9871-12b63548671c",
+    "container": null
+  },
+  "protocols_requested": [
+    "html_forms",
+    "openapi",
+    "rest"
+  ],
+  "capture_samples": true,
+  "cached_at": "2026-05-22T07:55:51.452961+00:00",
+  "report": {
+    "type": "probe_endpoints",
+    "deployment_hash": "deployment_a631cf66-a224-440b-9871-12b63548671c",
+    "app_code": "status-panel-web",
+    "protocols_detected": [
+      "html_forms"
+    ],
+    "protocols_requested": [
+      "html_forms",
+      "openapi",
+      "rest"
+    ],
+    "containers": [],
+    "endpoints": [],
+    "resources": [],
+    "forms": [
+      {
+        "container": "project-status-panel-web-1",
+        "id": "form_contact",
+        "action": "",
+        "method": "POST",
+        "fields": [
+          "name",
+          "email",
+          "subject",
+          "message"
+        ]
+      }
+    ],
+    "probe_attempts": [
+      {
+        "scope": "remote_app",
+        "selector": "status-panel-web",
+        "container": null,
+        "protocols": [
+          "html_forms",
+          "openapi",
+          "rest"
+        ],
+        "outcome": "detected"
+      }
+    ],
+    "target_kind": "html_form",
+    "probed_at": "2026-05-22T07:55:50Z"
+  }
+}

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "status-panel"
-version = "0.1.9"
+version = "0.2.0"
 edition = "2021"
 
 [features]

development.md.bak

@@ -0,0 +1,21 @@
+## Docker buildx quick reference
+
+Use this to publish the same multi-platform image variants that CI builds for the
+`dev` branch:
+
+```bash
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  --build-context stacker=../stacker \
+  -f Dockerfile.prod \
+  -t trydirect/status:unstable \
+  -t trydirect/status:latest \
+  --push \
+  .
+```
+
+This requires a sibling checkout at `../stacker` because `Cargo.toml` includes
+local path dependencies from that repository.
+
+If you only want to validate the multi-platform build locally without pushing,
+replace `--push` with `--output=type=oci,dest=./status-multiarch.tar`.

docker-compose-dev.yml

@@ -2,14 +2,14 @@ version: '2.2'
 
 services:
   statuspanel:
-    image: status
+    image: trydirect/status:dev
     container_name: statuspanel
     ports:
      - "5000:5000"
     volumes:
-     - .:/app
+     #- .:/app
      - /var/run/docker.sock:/var/run/docker.sock
-     - /data/encrypted:/data/encrypted
+     #- /data/encrypted:/data/encrypted
      # Mount docker CLI from host for deploy_app/remove_app commands
      - /usr/bin/docker:/usr/bin/docker:ro
      - /usr/libexec/docker/cli-plugins:/usr/libexec/docker/cli-plugins:ro

docker-compose.yml

@@ -17,6 +17,8 @@ services:
     environment:
       - NGINX_CONTAINER=nginx
       - COMPOSE_AGENT_ENABLED=true
+      # Container port mapping requires binding all interfaces.
+      - STATUS_PANEL_BIND=0.0.0.0
     # Default: serve with UI
     command: ["serve", "--port", "5000", "--with-ui"]
 

src/security/audit_log.rs

@@ -46,6 +46,10 @@ impl AuditLogger {
         info!(target: "audit", event = "token_rotated", agent_id, request_id = request_id.unwrap_or(""));
     }
 
+    pub fn token_self_issued(&self, deployment_hash: &str, reason: &str) {
+        warn!(target: "audit", event = "token_self_issued", deployment_hash, reason);
+    }
+
     pub fn internal_error(
         &self,
         agent_id: Option<&str>,