Files
Hermes 3a74cc423a [glm-grade=B] feat(monitoring): host journald log viewer (DC-055)
Adds a dedicated dashboard surface for host journald logs (caddy, docker,
dashcaddy-api, ssh, ...) via a read-only bind-mount of /var/log/journal +
journalctl. Closes queue item #2: the only way to see the recurring
'100.120.159.34:5000 i/o timeout' spam in Caddy's health_checker logs was
SSH into DNS2.

Backend (dashcaddy-api/):
- src/monitoring/journald-reader.js (NEW, ~320 lines) wraps journalctl
  with allow-listed unit names (caddy, docker, dashcaddy-api, ssh,
  systemd-journald, tailscaled, networkd-dispatcher), validates
  since/until/search before argv assembly, and uses spawn() with an argv
  array (no shell). Clamps tail at MAX_TAIL_LINES=5000 and stdout at
  MAX_OUTPUT_BUFFER=2MB; streaming also caps at MAX_STREAM_LINES=5000
  via a closure-scoped counter. Maps ENOENT cleanly to 'journalctl
  unavailable'.
- routes/logs.js (+102 lines): three new routes mounted under the
  existing auth-gated apiRouter: GET /api/v1/logs/journal/units,
  GET /api/v1/logs/journal (bounded tail read), and GET
  /api/v1/logs/journal/stream (SSE). Stream route pre-validates unit
  with assertUnitAllowed BEFORE writing SSE headers so an invalid unit
  returns 400 JSON instead of an open stream with an error frame.
- 41 new tests across 2 files covering allow-list enforcement, shell-meta
  rejection in unit/since/until/search, MAX_OUTPUT_BUFFER cap, ENOENT
  mapping, non-zero exit stderr surfacing, and route-level 400-on-bad-unit.
  Full local suite 1831/1831 (+41 net).

Container plumbing (start.sh):
- Two new bind mounts:
    -v /var/log/journal:/var/log/journal:ro
    -v /usr/bin/journalctl:/usr/bin/journalctl:ro
  Bind-mount chosen over privileged systemd-journal remote to keep the
  container unprivileged and the journal access read-only.

Frontend (status/js/):
- journald.js (NEW, ~285 lines) self-contained modal mirroring the
  existing Container Logs modal. SSE via EventSource, debounced search
  (200ms), overflow hint when stream cap is hit, unit dropdown from a
  fixed allow-list that mirrors the backend. Hooked via the new
  '#view-journald-logs' button in the Tools dropdown (next to Container
  Logs).
- build.js (+4 lines) adds journald.js to the features bundle. Bundle
  rebuild succeeded (features.js 27 files, 466 KB raw / 1229 KB min).
  CSP hash unchanged (no inline script changes).

GLM judge (round 1, 178s, 14 tool calls, cold diff + 8 file reads):
GRADE=B. Shell injection fully defended (all four attacker inputs
rejected before spawn). Route-level allow-list holds (streamEntries not
called for bad unit). SSE cleanup correct. Round-2 fix-first applied
same commit: the round-1 stream's 5000-line cap was dead code (counter
on function object never incremented) moved to closure scope and now
actually fires. Also dropped deprecated req.on('aborted') listener
(Node 18+ fires 'close' for both clean and abort).

Container live HEAD 901df86 [glm-grade=B]; deploy via start.sh atomic
swap. Live verify: status.sami=200, container Up + healthy, the new
bundle and index.html served.
2026-08-18 01:29:19 -07:00

119 lines
3.5 KiB
JavaScript

const CACHE = 'dashcaddy-shell-a24ef15882';
const PRECACHE = [
'/',
'/index.html',
'/css/themes.css',
'/css/dashboard.css',
'/css/driver.min.css',
'/css/onboarding.css',
'/dist/core.js',
'/dist/features.js',
'/dist/init.js',
'/dist/onboarding.js',
'/assets/fonts.css',
'/assets/site.webmanifest',
'/assets/favicon.svg',
'/assets/dashcaddy-favicon.ico',
'/assets/icon-192.png',
'/assets/icon-512.png',
'/assets/apple-touch-icon.png',
'/assets/dashcaddy-logo-dark.png',
'/assets/dashcaddy-logo-light.png',
'/assets/sami7777-logo.png',
'/assets/fonts/sami-grotesk/SamiGrotesk-Regular.woff2',
'/assets/fonts/sami-grotesk/SamiGrotesk-Medium.woff2',
'/assets/fonts/sami-grotesk/SamiGrotesk-Bold.woff2',
'/assets/fonts/DSEG7Classic-Bold.woff2',
'/assets/weather/clear-day.svg',
'/assets/weather/clear-night.svg',
'/assets/weather/partly-cloudy-day.svg',
'/assets/weather/partly-cloudy-night.svg',
'/assets/weather/cloudy.svg',
'/assets/weather/fog.svg',
'/assets/weather/drizzle.svg',
'/assets/weather/rain.svg',
'/assets/weather/sleet.svg',
'/assets/weather/snow.svg',
'/assets/weather/thunderstorm.svg',
'/assets/weather/wind.svg'
];
function isNavigationRequest(request) {
return request.mode === 'navigate';
}
function isStaticAsset(pathname) {
return pathname.startsWith('/assets/')
|| pathname.startsWith('/css/')
|| pathname.startsWith('/dist/');
}
async function networkFirst(request, preloadResponsePromise) {
const cache = await caches.open(CACHE);
try {
const preloadResponse = preloadResponsePromise ? await preloadResponsePromise : null;
if (preloadResponse) {
cache.put(request, preloadResponse.clone()).catch(() => {});
return preloadResponse;
}
const response = await fetch(request);
cache.put(request, response.clone()).catch(() => {});
return response;
} catch (_) {
return caches.match(request) || caches.match('/index.html');
}
}
async function staleWhileRevalidate(request) {
const cache = await caches.open(CACHE);
const cached = await cache.match(request);
const networkPromise = fetch(request)
.then((response) => {
cache.put(request, response.clone()).catch(() => {});
return response;
})
.catch(() => null);
if (cached) return cached;
return networkPromise.then((response) => response || Response.error());
}
self.addEventListener('install', (event) => {
self.skipWaiting();
event.waitUntil(
caches.open(CACHE).then((cache) =>
cache.addAll(PRECACHE.map((url) => new Request(url, { cache: 'reload' })))
)
);
});
self.addEventListener('activate', (event) => {
event.waitUntil((async () => {
const keys = await caches.keys();
await Promise.all(keys.filter((key) => key !== CACHE).map((key) => caches.delete(key)));
if ('navigationPreload' in self.registration) {
await self.registration.navigationPreload.enable();
}
await self.clients.claim();
})());
});
self.addEventListener('fetch', (event) => {
const { request } = event;
if (request.method !== 'GET') return;
const url = new URL(request.url);
if (url.origin !== self.location.origin) return;
if (url.pathname.startsWith('/api/v1/') || url.pathname.startsWith('/probe/')) return;
if (isNavigationRequest(request) || url.pathname === '/' || url.pathname.endsWith('/index.html')) {
event.respondWith(networkFirst(request, event.preloadResponse));
return;
}
if (isStaticAsset(url.pathname)) {
event.respondWith(staleWhileRevalidate(request));
}
});