# Changelog & recent features

This file summarizes **notable plugin and API behaviour** that may not fit in the short README tables. The full user guide remains **[README.md](../README.md)** (English and German in one file).

---

## 🇬🇧 English

### Core app (2026-06) — security hardening

| Topic | Change |
|--------|--------|
| **Encrypted widget passwords** | Widget-config passwords (AdGuard, Pi-hole, FRITZ!Box, Fritz-Energy, Selfstream/-Emby) are sealed with **AES-256-GCM** (`sdsec1:` prefix) on save **and** on first read of existing configs. The browser only ever sees ciphertext; plugin servers decrypt server-side. Key: `SELFDASHBOARD_CALENDAR_KEY` / `<dataDir>/.calendar-key`. |
| **SSRF guard everywhere** | All proxy plugins now resolve DNS and block loopback / link-local / cloud-metadata targets (incl. IPv4-mapped IPv6). Private LAN IPs stay allowed by default (`SELFDASHBOARD_BLOCK_PRIVATE_CALENDAR_URLS=1` to block). Blocked requests return `blocked_url` (HTTP 400). |
| **TOTP replay protection** | Each TOTP code/step is valid **once** (new `totp_last_step` column, auto-migrated). |
| **Non-root container** | App runs as UID **1001**; entrypoint chowns `/app/data` + `/app/plugins/custom` on start (opt-out `SELFDASHBOARD_SKIP_CHOWN=1`) and adds read perms on `/crowdsec-data` (opt-out `SELFDASHBOARD_FIX_CROWDSEC_PERMS=0`). |
| **Image build** | `npm ci` (reproducible), `HEALTHCHECK` on `/api/auth/setup-status`, plugin-id validation on store installs, scoped TLS handling for FRITZ! self-signed certs (no more global `NODE_TLS_REJECT_UNAUTHORIZED`). |
| **Theme reactivity** | The theme provider now subscribes to the theme value reactively — light/dark and colour schemes apply **instantly app-wide** (previously only after a page reload; only CrowdSec updated live). Picking a theme also clears custom colours. |

### Plugins (2026-06) — store update recommended

| Plugin | Version | Change |
|--------|---------|--------|
| AdGuard / Pi-hole | **1.2.2** | SSRF guard + sealed-password support |
| FRITZ!Box | **2.5.7** | SSRF guard, sealed passwords, scoped TLS agent |
| Fritz-Energy | **1.3.3** | SSRF guard, sealed passwords, scoped TLS agent |
| Selfstream | **1.1.2** | SSRF guard + sealed-password support (also used by Selfstream-Emby) |
| Uptime Kuma | **1.0.6** | SSRF guard |
| Philips Hue | **Beta** | Hue-app-style room/light control: toggles, brightness, real light colour, colour picker |
| Homematic / RaspberryMatic | **Beta** | Heating (target temp + Auto/Manual/Boost), switches, RGBW colour, window contacts, sensors, sysvars, programs; auto-grouped by CCU room (drag-and-drop, multi-column), renamable devices; JSON-RPC login |

After **Update all**: **Ctrl+F5**. Existing plaintext passwords are migrated automatically on next load.

### Core app (2026-05) — post-beta

| Topic | Change |
|--------|--------|
| **Legacy API removed** | Old paths (`/api/weather`, `/api/calendar/*`, `/api/mail/*`, …) removed. Use **`/api/plugins/<id>/…`** only. Requires **new app image**. |

### Core app (2026-05)

| Topic | Change |
|--------|--------|
| **Public kiosk `/kiosk`** | View-only wall-tablet URL without admin login; optional password & session duration. Admin: **Settings → Users → Kiosk**. Edit widgets on `/dashboard/<id>`. |
| **TOTP 2FA** | Authenticator apps — **Settings → Users**; enforced at login when enabled. |
| **Multi-user UI** | Password change, 2FA, and kiosk moved to **Settings → Users**. |
| **Design backgrounds** | **Settings → Design**: navbar wallpaper; dashboard background **off / single / dual** (JPG/PNG/WebP, overlay %). Persisted in `dashboard.json`. |
| **`/api/plugins/weather/*`** | Server proxy for Open-Meteo geocode + forecast (hourly + daily). Required for current Weather plugin. |
| **Settings modal** | Fixed width `720px`; log list scrolls internally. |

### Weather plugin **1.3.x**

| Topic | Change |
|--------|--------|
| **Day blocks** | Under current summary: temps for **0–6**, **6–12**, **12–18**, **18–24** (today, from hourly API). |
| **7-day strip** | Shows **next 7 days starting tomorrow** (API `forecast_days=8`, skips index 0). |
| **Removed** | Full-width hourly timeline that replaced the 7-day view in 1.3.0. |

### Unraid plugin **1.5.x**

| Topic | Change |
|--------|--------|
| **Version** | Targets **Unraid 7.2+** GraphQL (not 7.3-only). |
| **Disks** | Pool/cache rows; optional suffix: role / `fsType` / comment. |
| **Browser** | Direct `fetch` to `https://NAS/graphql` — **CORS** must allow your dashboard origin per NAS. |

---

## 🇩🇪 Deutsch

### Kern-App (2026-06) — Security-Härtung

| Thema | Änderung |
|--------|----------|
| **Verschlüsselte Widget-Passwörter** | Widget-Passwörter (AdGuard, Pi-hole, FRITZ!Box, Fritz-Energy, Selfstream/-Emby) werden mit **AES-256-GCM** versiegelt (`sdsec1:`-Präfix) — beim Speichern **und** beim ersten Laden bestehender Configs. Der Browser sieht nur noch Ciphertext; Plugin-Server entschlüsseln serverseitig. Schlüssel: `SELFDASHBOARD_CALENDAR_KEY` / `<dataDir>/.calendar-key`. |
| **SSRF-Schutz überall** | Alle Proxy-Plugins lösen DNS auf und blocken Loopback / Link-Local / Cloud-Metadata (inkl. IPv4-mapped IPv6). Private LAN-IPs bleiben standardmäßig erlaubt (`SELFDASHBOARD_BLOCK_PRIVATE_CALENDAR_URLS=1` zum Blocken). Geblockte Anfragen liefern `blocked_url` (HTTP 400). |
| **TOTP-Replay-Schutz** | Jeder TOTP-Code/Step gilt nur **einmal** (neue Spalte `totp_last_step`, automatische Migration). |
| **Non-root-Container** | App läuft als UID **1001**; Entrypoint chownt `/app/data` + `/app/plugins/custom` beim Start (Opt-out `SELFDASHBOARD_SKIP_CHOWN=1`) und setzt Leserechte auf `/crowdsec-data` (Opt-out `SELFDASHBOARD_FIX_CROWDSEC_PERMS=0`). |
| **Image-Build** | `npm ci` (reproduzierbar), `HEALTHCHECK` auf `/api/auth/setup-status`, Plugin-ID-Validierung bei Store-Installs, gescopetes TLS-Handling für selbstsignierte FRITZ!-Zertifikate (kein globales `NODE_TLS_REJECT_UNAUTHORIZED` mehr). |
| **Theme-Reaktivität** | Der Theme-Provider abonniert den Theme-Wert jetzt reaktiv — Hell/Dunkel und Farbschemata greifen **sofort app-weit** (vorher erst nach Reload; live aktualisierte sich nur CrowdSec). Eine Theme-Auswahl setzt außerdem die Eigenfarben zurück. |

### Plugins (2026-06) — Store-Update empfohlen

| Plugin | Version | Änderung |
|--------|---------|----------|
| AdGuard / Pi-hole | **1.2.2** | SSRF-Schutz + versiegelte Passwörter |
| FRITZ!Box | **2.5.7** | SSRF-Schutz, versiegelte Passwörter, gescopeter TLS-Agent |
| Fritz-Energy | **1.3.3** | SSRF-Schutz, versiegelte Passwörter, gescopeter TLS-Agent |
| Selfstream | **1.1.2** | SSRF-Schutz + versiegelte Passwörter (auch von Selfstream-Emby genutzt) |
| Uptime Kuma | **1.0.6** | SSRF-Schutz |
| Philips Hue | **Beta** | Räume/Lampen im Hue-App-Stil: Toggles, Helligkeit, echte Lichtfarbe, Farbwähler |
| Homematic / RaspberryMatic | **Beta** | Heizung (Soll-Temp + Auto/Manuell/Boost), Schalter, RGBW-Farbe, Fensterkontakte, Sensoren, Sysvars, Programme; auto-gruppiert nach CCU-Raum (Drag-and-Drop, mehrspaltig), umbenennbare Geräte; JSON-RPC-Login |

Nach **Update all**: **Strg+F5**. Bestehende Klartext-Passwörter werden beim nächsten Laden automatisch migriert.

### Kern-App (2026-05) — nach Beta

| Thema | Änderung |
|--------|----------|
| **Legacy-API entfernt** | Alte Pfade (`/api/weather`, `/api/calendar/*`, `/api/mail/*`, …) entfernt. Nur noch **`/api/plugins/<id>/…`**. **Neues App-Image** nötig. |

### Kern-App (2026-05)

| Thema | Änderung |
|--------|----------|
| **Öffentlicher Kiosk `/kiosk`** | Nur-Ansicht fürs Wand-Tablet ohne Admin-Login; optional Passwort & Sitzungsdauer. Admin: **Einstellungen → Benutzer → Kiosk**. Bearbeiten unter `/dashboard/<id>`. |
| **TOTP 2FA** | Authenticator-Apps — **Einstellungen → Benutzer**; beim Login wenn aktiv. |
| **Mehrbenutzer-UI** | Passwort, 2FA, Kiosk unter **Einstellungen → Benutzer**. |
| **Hintergrundbilder** | **Einstellungen → Design**: Navbar + Dashboard (**Aus / 1 / 2 Bilder**, Overlay). In `dashboard.json`. |
| **`/api/plugins/weather/*`** | Server-Proxy für Open-Meteo (Geocoding + Forecast). |
| **Einstellungs-Dialog** | Feste Breite; Protokoll-Liste scrollt intern. |

### Wetter-Plugin **1.3.x**

| Thema | Änderung |
|--------|----------|
| **Tagesabschnitte** | Unter aktuellem Wetter: **0–6**, **6–12**, **12–18**, **18–24**. |
| **7-Tage** | Ab **morgen** (8 API-Tage, heute ausgeblendet). |
| **Entfernt** | Stündliche Gesamt-Leiste aus 1.3.0. |

### Unraid-Plugin **1.5.x**

| Thema | Änderung |
|--------|----------|
| **Version** | **Unraid 7.2+** GraphQL (nicht nur 7.3). |
| **Disks** | Pool/Cache; Zusatz-Label: Rolle / `fsType` / Kommentar. |
| **Browser** | Direkt `https://NAS/graphql` — **CORS** pro NAS für Dashboard-Origin. |

---

## 🇬🇧 English (older entries)

### Docker plugin **1.7.9** (core: `src/lib/dockerEngine.ts`)

| Topic | Change |
|--------|--------|
| **RAM** | Matches **`docker stats`** / Docker CLI: working set = `memory_stats.usage` minus page cache (`total_inactive_file` on cgroup v1, `inactive_file` on v2). Aligns better with Unraid’s Docker tab and other UIs that follow the same rule — not raw cgroup `usage`. |
| **CPU %** | Same delta formula as the Engine / CLI. Ignores samples where the `system_cpu_usage` delta is **&lt; 10 ms** (nanoseconds threshold) to avoid meaningless spikes from ultra-short windows. |
| **Stats HTTP call** | Prefers `GET /containers/{id}/stats?stream=false&one-shot=false` so the daemon can populate **`precpu_stats`** for a valid CPU delta. If the daemon returns **HTTP 400** (very old engines), falls back to `stream=false` only. |

**APIs (unchanged paths):** `GET /api/docker-containers?…&stats=1`, `POST /api/docker-container-stats` — response shape unchanged; numeric **RAM** values may differ from pre-1.7.9 builds because of the definition above.

---

### Calendar plugin **1.4.x**

| Topic | Description |
|--------|-------------|
| **API** | Unified under **`/api/calendar/*`**: `accounts`, `events`, `calendars`, `sync`, `status`, `summary`, `conflicts` (no separate `calendar-ics` / `calendar-caldav` routes). |
| **ICS / Webcal** | Read-only feeds via account type **ICS**; server-side fetch (no browser CORS; LAN URLs work). |
| **CalDAV** | Two-way accounts: Basic auth; sync via **`POST /api/calendar/accounts/[id]/sync`** (GET/REPORT as needed, e.g. Nextcloud, Synology). |
| **Storage** | `data/calendar/` on the server; credentials encrypted (AES-256-GCM). |
| **Widget** | Month/week views, day panel, local events; background sync (`CALENDAR_SYNC_INTERVAL_SECONDS`, default 5 min). |

---

### Selfstream plugin **1.0.x**

| Topic | Description |
|--------|-------------|
| **Data** | Active IPTV sessions from Selfstream admin via **`POST /api/selfstream`**. |
| **Widget** | Lists live streams (user, channel/program, duration); optional client IP; configurable refresh interval. |
| **Auth** | Admin password in plugin settings; proxied server-side (not stored in the central error log). |

---

### FRITZ!Box WAN throughput plugin **2.3.x**

| Topic | Description |
|--------|-------------|
| **Data** | TR-064 byte counters via **`POST /api/fritzbox`**; optional **`lite: true`** for counter-only updates. |
| **History** | Last chart points cached in **`localStorage`** (per base URL + username), up to **7 days**, so the chart is not empty after reload. |
| **Layout & UI** | Vertical vs horizontal layout; toggles for title, legend, live values, chart, time-axis hint, stat tiles. |
| **Plot height** | **`0`** = default **168 px**; **`1–220`** = exact height in pixels. |
| **Y-axis** | **`0` Mbit/s max** = auto scale from data; fixed max caps the scale. |
| **Sanity cap** | Optional max measured rate (Mbit/s) for both directions; **`0`** uses TR-064 Layer1 hints + small headroom where available. |
| **Polling** | Full TR-064 interval **0–300 s** (`0` = only on dashboard load); **live counter** interval **0** or **3–15 s** for smoother curves. |
| **Language** | Auto / German / English for UI strings. |

---

## 🇩🇪 Deutsch (ältere Einträge)

### Docker-Plugin **1.7.9** (Kern: `src/lib/dockerEngine.ts`)

| Thema | Änderung |
|--------|----------|
| **RAM** | Entspricht **`docker stats`** / Docker-CLI: nutzbarer Speicher = `memory_stats.usage` minus Datei-Cache (`total_inactive_file` bei cgroup v1, `inactive_file` bei v2). Passt besser zur Unraid-Docker-Ansicht und ähnlichen Oberflächen — nicht der rohe cgroup-`usage`-Wert. |
| **CPU-%** | Gleiche Delta-Formel wie Engine/CLI. Messungen mit `system_cpu_usage`-Delta **&lt; 10 ms** werden verworfen, um sinnlose Spitzen zu vermeiden. |
| **Stats-HTTP-Aufruf** | Bevorzugt `GET …/stats?stream=false&one-shot=false`, damit **`precpu_stats`** zuverlässig gefüllt ist. Bei **HTTP 400** (sehr alte Daemons) Fallback nur `stream=false`. |

**APIs:** `GET /api/docker-containers?…&stats=1`, `POST /api/docker-container-stats` — gleiche Pfade und Felder; **RAM-Zahlen** können sich gegenüber älteren Builds ändern (siehe Definition oben).

---

### Kalender-Plugin **1.4.x**

| Thema | Beschreibung |
|--------|----------------|
| **API** | Einheitlich unter **`/api/calendar/*`**: `accounts`, `events`, `calendars`, `sync`, `status`, `summary`, `conflicts` (keine separaten Routen `calendar-ics` / `calendar-caldav`). |
| **ICS / Webcal** | Nur-Lese-Feeds über Kontotyp **ICS**; serverseitiger Abruf (kein CORS im Browser; LAN-URLs möglich). |
| **CalDAV** | Zwei-Wege-Konten: Basic-Auth; Sync über **`POST /api/calendar/accounts/[id]/sync`** (GET/REPORT je nach Server, z. B. Nextcloud, Synology). |
| **Speicher** | `data/calendar/` auf dem Server; Zugangsdaten verschlüsselt (AES-256-GCM). |
| **Widget** | Monat/Woche, Tagespanel, lokale Termine; Hintergrund-Sync (`CALENDAR_SYNC_INTERVAL_SECONDS`, Standard 5 min). |

---

### Selfstream-Plugin **1.0.x**

| Thema | Beschreibung |
|--------|----------------|
| **Daten** | Aktive IPTV-Sessions aus dem Selfstream-Admin über **`POST /api/selfstream`**. |
| **Widget** | Liste laufender Streams (Nutzer, Sender/Sendung, Laufzeit); optional Client-IP; Aktualisierungsintervall einstellbar. |
| **Auth** | Admin-Passwort in den Plugin-Einstellungen; serverseitiger Proxy (nicht im zentralen Protokoll gespeichert). |

---

### Fritzbox-Plugin **2.3.x** (Internet-Verlauf)

| Thema | Beschreibung |
|--------|----------------|
| **Daten** | TR-064-Bytezähler über **`POST /api/fritzbox`**; optional **`lite: true`** nur für Zähler. |
| **Verlauf** | Kurvenpunkte im **`localStorage`** (pro Basis-URL + Benutzer), bis **7 Tage**. |
| **Layout & UI** | Vertikal/waagerecht; Schalter für Überschrift, Legende, Live-Werte, Kurve, Zeitachsen-Hinweis, Stat-Karten. |
| **Plot-Höhe** | **`0`** = Standard **168 px**; **`1–220`** = exakte Pixelhöhe. |
| **Y-Achse** | **`0` Mbit/s** = aus Daten; fester Wert = oben begrenzt. |
| **Ausreißer** | Optional **Max. Messrate (Mbit/s)**; **`0`** = Layer1-Hinweise von der Box + Puffer. |
| **Abfragen** | Voller TR-064-Takt **0–300 s**; **Zähler-Takt** **0** oder **3–15 s**. |
| **Sprache** | Auto / Deutsch / Englisch. |

---

### FRITZ! smart plug energy (`fritz-energy`) **1.1.x**

| Topic | Description |
|--------|-------------|
| **Data** | TR-064 Homeauto via **`POST /api/fritz-energy`**; current W, today / 7 days / month kWh; history under `data/fritz-energy/`. |
| **Widget** | Grid (2×2 fill) or carousel; optional compact UI; silent background refresh (no “Updating…” flash). |
| **Setup** | AIN + same TR-064 credentials as WAN plugin; Smart Home rights on the FRITZ!Box user. |

**DE:** Steckdose Energie im Image — README **FRITZ! Steckdose Energie**.

---

### Kiosk mode (core)

| Topic | Description |
|--------|-------------|
| **Settings** | **General → Kiosk mode** — auto-hide navbar after **3–60 s** idle (default **5**). |
| **UI** | Hidden bar uses `translateY` (no layout gap); widgets start at the top. |
| **Reveal** | Accent **Menu** / **Leiste** button only — not mouse over widgets. Edit mode keeps the bar visible. |

**DE:** README **Kiosk-Modus (Wand-Tablet)**.

---

### AdGuard Home **1.1.6**

2×2 stat tiles stretch to full widget height (no empty band at the bottom).

**DE:** Kacheln füllen die Widget-Höhe.

---

## Plugin versions (reference)

Builtin plugin `meta.version` values in the repo (see each `plugins/<id>/index.tsx`):

| Plugin | Version (approx.) |
|--------|-------------------|
| Docker | 1.7.9 |
| FRITZ!Box Internet | 2.4.3 |
| FRITZ! Steckdose Energie | 1.1.3 |
| Calendar | 1.4.2 |
| Bookmarks | 1.6.0 |
| Unraid Docker | 0.4.4 |
| Iframe | 2.1.4 |
| Weather | 1.2.3 |
| AdGuard Home | 1.1.6 |
| Clock | 1.2.1 |
| Unraid | 1.5.3 |
| Emby | 1.0.3 |
| Scratchpad | 1.1.1 |

*(Versions ship with the Docker image; bump dates are git history.)*