- embedded React admin UI at /admin/ui (go:embed), login with ADMIN_SECRET
via signed HttpOnly session cookie, X-ADMIN-KEY still works for scripts
- admin API: overview stats, indexing queue, addon management (priority,
reindex, delete/restore/purge, bulk), whitelist CRUD, duplicate hashes,
traffic, metrics explorer, services, events/audit log, system info
- built-in metrics: request latency per route, visitors, top addons and
searches, indexer/scraper counters; minute buckets in the DB with hourly
rollups and retention; optional Prometheus /metrics (METRICS_TOKEN)
- POST /back/telemetry for indexers/scrapers (metrics, events, heartbeat)
and a stdlib-only Go client in telemetry/
- auth hardening: empty secrets no longer allow access, constant-time
compare, CORS not applied to /admin and /back, TRUSTED_PROXIES setting
- Dockerfile builds the UI and no longer bakes config.yaml into the image;
CI builds the UI, runs tests and builds arm64 with CGO
ilbinek