maquina-generators 0.4.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca10b8ebcd86d74709ad16f64e6366457b53fc9a55da72a997f9084c5819d267
-  data.tar.gz: 3147bb48486e66744e0b2af74ab06368a7b6e782a77b8c3946069f6c6178d76f
+  metadata.gz: d8023146b756cacff577544a89e379d751c5f4f1e1df5fd1cb61932a514049bd
+  data.tar.gz: 1bff652af72d0e15d9dbd66e90e758b8f900200d5ae5dbd5c783157cfaa49f3a
 SHA512:
-  metadata.gz: 6d3ab8cb8656f06fa0c1ced220473bf6bfc76c7931ea70133a91405fdc28b866d2f840f35ced6f9056a382b812a4c03898e2b94ec40f7ab76c39297900789b39
-  data.tar.gz: 7c5cec9099144f5a9216afe62df79d5c5561d23886accd332017d2e491bf29fe25d787129288f743ec0784d19ff9c85cfe15274f00976c60c554fe018d84007e
+  metadata.gz: 882a19b2e1d69f38e9acc0e73a312bb5a9750155b7521c6a2dc9597ddb93c1934c83536d5525a74916b7750a49f3bfd94543bd09dcd01a43a2aa2d8b0525d794
+  data.tar.gz: b9a6a548f3b6dbf7f6871e68588066f97bad710e2fc5a978dc9dcb32636b2448c60c86928dbc874b87cc4b3012030f94becc893049635418fb0df6e29e19b474

data/README.md

@@ -10,13 +10,13 @@ A collection of Rails generators from the Maquina umbrella. Each generator produ
 
 #### What it generates
 
-- **Models:** `User`, `Session`, `EmailVerification`, `Current`
+- **Models:** `Account`, `User`, `Session`, `EmailVerification`, `Current`
 - **Controllers:** Sign-in/sign-up flows with email code verification
 - **Views:** Minimal, responsive forms styled with Tailwind CSS
 - **Mailer:** Verification code emails (HTML + text)
 - **Job:** Cleanup job for expired sessions and verifications
 - **Locale files:** English and Spanish translations
-- **Migrations:** 3 migrations (users, sessions, email_verifications)
+- **Migrations:** 4 migrations (accounts, users, sessions, email_verifications)
 - **Test helper:** `sign_in_as(user)` and `sign_out` for integration tests
 
 #### Installation
@@ -24,7 +24,7 @@ A collection of Rails generators from the Maquina umbrella. Each generator produ
 Add to your Gemfile:
 
 ```ruby
-gem "maquina_generators", group: :development
+gem "maquina-generators", group: :development
 ```
 
 Run the generator:
@@ -114,8 +114,10 @@ All generated code lives in your app -- edit it directly:
 
 - **BackstageController:** Inherits from `ActionController::Base` (bypasses app's ApplicationController concerns)
 - **Initializer:** Credentials-first auth with ENV variable fallback, database connection config
-- **Route:** Mounts `SolidErrors::Engine` under a configurable prefix
-- **Admin navigation:** Shared navigation bar linking Solid Errors and Mission Control Jobs dashboards
+- **Route:** Mounts `SolidErrors::Engine` at `<prefix>/errors`
+- **Mailer templates:** Self-contained `error_occurred` HTML and text templates, so `send_emails` works without the dashboard's helpers
+- **Admin navigation:** Shared navigation bar with Overview, Errors, Jobs and Security tabs
+- **Admin overview:** `BackstageDashboardController` at the prefix root with cards for each installed dashboard and a `@metrics` slot for your own aggregate counts; answers 503 until backstage credentials are set
 - **Custom layout:** Tailwind-styled layout with admin navigation and toast flash messages
 - **Stimulus controllers:** `clipboard_controller.js` and `backtrace_filter_controller.js`
 - **Custom views:** Tailwind-styled views to override the gem defaults (included by default, use `--no-copy-views` to skip)
@@ -156,8 +158,9 @@ Credentials are resolved in order:
 - **BackstageController:** Inherits from `ActionController::Base` with maquina_components helpers (bypasses app's ApplicationController concerns)
 - **Helper:** `MissionControlHelper` with `job_status_badge_variant` and `nav_icon_for_section`
 - **Initializer:** Sets base controller class, credentials-first auth with ENV variable fallback
-- **Route:** Mounts `MissionControl::Jobs::Engine` under a configurable prefix
-- **Admin navigation:** Shared navigation bar linking Solid Errors and Mission Control Jobs dashboards
+- **Route:** Mounts `MissionControl::Jobs::Engine` at `<prefix>/jobs`
+- **Admin navigation:** Shared navigation bar with Overview, Errors, Jobs and Security tabs
+- **Admin overview:** `BackstageDashboardController` at the prefix root with cards for each installed dashboard and a `@metrics` slot for your own aggregate counts; answers 503 until backstage credentials are set
 - **Custom layout:** Tailwind-styled layout with admin navigation, toast flash messages, application/server selection, and tab navigation
 - **Custom views:** Tailwind-styled views for jobs, queues, workers, and recurring tasks (included by default, use `--no-copy-views` to skip)
 
@@ -218,28 +221,104 @@ rails g maquina:solid_queue --database postgresql # PostgreSQL
 
 ### Rack Attack -- Request Protection
 
-**Rack Attack** installs the [rack-attack](https://github.com/rack/rack-attack) gem with default security rules to block common vulnerability scans and throttle abusive requests.
+**Rack Attack** installs the [rack-attack](https://github.com/rack/rack-attack) gem with rules that ban vulnerability scanners and addresses that ignore the throttle.
 
 #### What it generates
 
-- **Initializer:** `config/initializers/rack_attack.rb` with blocklists, safelists, and throttles
+- **Initializer:** `config/initializers/rack_attack.rb` with the bans, throttles, safelist, 403 responder and an `[ATTACK]` log line per refusal. Its knobs are constants on `Rack::Attack` (`SCANNER_*`, `GENERAL_*`, `FLOOD_*`, `LOGIN_*`) and `Rack::Attack.banned?(ip)` answers whether an address is banned now.
 
 #### Usage
 
 ```bash
 rails g maquina:rack_attack
+rails g maquina:rack_attack --login-path /sign_in   # Throttle a different sign-in path
 ```
 
 The generator automatically runs `bundle install`.
 
 #### Default Protections
 
-- **Blocklists:** PHP files (`*.php`), WordPress paths (`wp-admin`, `wp-login`, etc.), sensitive files (`.env`, `.git`, `/etc/passwd`, etc.), scanner targets (`phpmyadmin`, `cgi-bin`, etc.)
+- **Scanner ban (Fail2Ban):** three scanner paths in 10 minutes bans the IP for 7 days. Scanner paths are PHP files (`*.php`), WordPress paths (`wp-admin`, `wp-login`, etc.), sensitive files anywhere in the path (`.env`, `.git`, `/etc/passwd`, etc.), backup archives (`.zip`, `.sql`, `.tar.gz`, `.bak`, etc.) and scanner targets (`phpmyadmin`, `cgi-bin`, etc.). `/rails/active_storage` is exempt.
+- **Flood ban (Allow2Ban):** 600 requests in 5 minutes (twice the general throttle) bans the IP for 1 day.
+- **Throttles:** 300 requests/5min per IP (general; `/assets` and `/rails/active_storage` exempt), 5 `POST /session`/20s per IP
 - **Safelists:** Localhost (`127.0.0.1`, `::1`)
-- **Throttles:** 300 requests/5min per IP (general), 5 login attempts/20s per IP
-- **Responses:** 403 Forbidden for blocklisted, 429 Too Many Requests for throttled
+- **Responses:** 403 Forbidden for blocklisted and banned, 429 Too Many Requests for throttled
 
-Customize rules in `config/initializers/rack_attack.rb`.
+Bans live in `Rails.cache`, so they need a shared cache store (Solid Cache) in production. Customize rules in `config/initializers/rack_attack.rb`. To see the refusals, add `maquina:security`.
+
+---
+
+### Security -- Rack::Attack with an Abuse Dashboard
+
+**Security** records every Rack::Attack refusal in its own database and summarises the last week on a backstage page next to Solid Errors and Mission Control Jobs.
+
+#### What it generates
+
+- **Rack::Attack rules:** runs `maquina:rack_attack` unless `config/initializers/rack_attack.rb` already defines `Rack::Attack.banned?` (an older initializer without it is replaced)
+- **Subscriber:** `config/initializers/rack_attack_events.rb` writes a `Security::AbuseEvent` per throttled, blocked or banned request; a failed write never turns a 403 into a 500
+- **Models:** `Security::Record` (`connects_to` the `security` database), `Security::AbuseEvent` (30-day retention), `Security::AbuseReport` (the page's figures)
+- **Database:** `db/security_schema.rb` and a `security:` entry in every multi-database environment of `config/database.yml` (and `config/database.yml.example`)
+- **Retention:** a daily `purge_abuse_events` task in `config/recurring.yml`
+- **BackstageController**, **controller** (`Backstage::SecurityController`), **route** (`<prefix>/security`), **layout** and **views**: stats, throttled addresses, blocked addresses (banned now, expired or not yet banned), scanner paths, sign-in throttles, targeted hosts, refusals by day, recent refusals (views skipped with `--no-copy-views`)
+- **Admin navigation:** a Security tab, added to an existing `_admin_navigation` partial too
+- **Admin overview:** the shared dashboard at the prefix root, if Solid Errors or Mission Control Jobs have not installed it already
+
+#### What the page shows
+
+The last 7 days of refusals, top five of each, read from `Security::AbuseEvent` through `Security::AbuseReport`. It is a briefing, not a log viewer: no filters, no pagination. Times are UTC.
+
+- **Stats:** refused requests, throttled, blocked or banned, and distinct addresses
+- **Throttled addresses:** over the general or sign-in limit, busiest first, with the rules they hit
+- **Blocked addresses:** every address a blocklist refused, marked **Banned now** (Rack::Attack's own answer at render time), **Expired**, or **Not banned** -- an address with a strike or two on the scanner rule, or a slow scanner that stays under three paths in ten minutes
+- **Most requested blocked paths:** what the scanners were after. A banned address is refused on every path, its ordinary pages included, so only the paths `Rack::Attack.scanner_path?` recognises are listed
+- **Sign-in throttles:** addresses refused on `POST <login-path>`, kept apart so scanner noise never buries them
+- **Targeted hosts:** which hostnames the refusals were aimed at
+- **By day:** throttled, blocked and banned per day, zeros kept so a spike reads against its neighbours
+- **Recent refusals:** the last 20, newest first
+
+#### Usage
+
+```bash
+rails g maquina:security --prefix /admin
+bin/rails db:prepare
+```
+
+The generator automatically runs `bundle install`. The page needs maquina_components.
+
+#### Options
+
+```bash
+rails g maquina:security --prefix /admin                      # Default
+rails g maquina:security --prefix /admin --login-path /sign_in  # Different sign-in path
+rails g maquina:security --prefix /admin --no-copy-views      # Without views
+rails g maquina:security --prefix /backstage \
+  --user-env-var ADMIN_USER --password-env-var ADMIN_PASSWORD  # Custom env vars
+```
+
+#### Authentication
+
+HTTP Basic Auth, with credentials resolved in order:
+
+1. `Rails.application.credentials.backstage.username` / `.password`
+2. `ENV["SECURITY_USER"]` / `ENV["SECURITY_PASSWORD"]` (configurable)
+
+The page answers 503 until one of them is set, so it is never left open.
+
+#### Trying it locally
+
+Localhost is safelisted, so your own requests are never refused. Rack::Attack trusts `X-Forwarded-For` from `127.0.0.1`, so send one to stand in for another address:
+
+```bash
+for path in /wp-login.php /.env /backup.zip /; do
+  curl -s -o /dev/null -w "%{http_code} $path\n" -H "X-Forwarded-For: 203.0.113.10" http://localhost:3000$path
+done
+# 403 /wp-login.php
+# 403 /.env
+# 403 /backup.zip   <- third scanner path: banned for 7 days
+# 403 /             <- banned, so every path is refused
+```
+
+Development's `:memory_store` keeps bans inside the server process, so they reset on restart and a `bin/rails runner` script cannot see them. Production needs a shared store (Solid Cache).
 
 ---
 
@@ -259,10 +338,10 @@ Customize rules in `config/initializers/rack_attack.rb`.
 8. Sets up ActiveStorage JavaScript imports
 9. Adds turbo morphing, `yield :head`, and simplifies `<main>` tag in layout
 10. Optionally installs authentication (`maquina:clave` or `maquina:registration`)
-11. Invokes sub-generators: `maquina:rack_attack`, `maquina:mission_control_jobs`, `maquina:solid_errors`
-12. Runs external installers: `solid_queue:install`, `solid_errors:install`, `solid_cache:install`, `solid_cable:install`, `maquina_components:install`
+11. Invokes sub-generators: `maquina:mission_control_jobs`, `maquina:solid_errors`
+12. Runs external installers: `solid_queue:install`, `solid_errors:install`, `solid_cache:install`, `solid_cable:install`, `maquina_components:install`, then `maquina:security` (which installs the `maquina:rack_attack` rules)
 13. Restores custom layouts overwritten by gem installers
-14. Configures multi-database `database.yml` (primary, queue, cache, cable, errors)
+14. Configures multi-database `database.yml` (primary, queue, cache, cable, errors, security)
 15. Creates a HomeController with root route
 16. Generates a README and `database.yml.example`
 17. Runs `db:prepare`
@@ -277,7 +356,7 @@ rails g maquina:app --auth registration
 
 #### Options
 
-- `--prefix` (default: `/admin`) -- Base path prefix for backstage tools (Solid Errors, Mission Control Jobs)
+- `--prefix` (default: `/admin`) -- Base path prefix for backstage tools (Solid Errors, Mission Control Jobs, Security)
 - `--port` (default: `3000`) -- Default port for the development server
 - `--auth` (default: `none`) -- Authentication type: `none`, `clave`, or `registration`
 

data/lib/generators/maquina/app/app_generator.rb

@@ -20,7 +20,16 @@ module Maquina
         content = File.read(gemfile_path)
 
         remove_gems = ["rubocop-rails-omakase"]
-        dev_gems = {"brakeman" => nil, "bundle-audit" => nil, "letter_opener" => nil, "standard" => nil}
+        # standard >= 1.54: avoids the inoperative placeholder releases
+        # (1.34.0.1 / 1.35.0.1) whose too-loose `rubocop ~> 1.62` requirement
+        # makes bundler backtrack onto them and pair them with an incompatible
+        # rubocop, so the `standard` binary refuses to run.
+        #
+        # standard.rb runs through the generated .rubocop.yml (see
+        # create_config_files) — that file is standard.rb's runner bridge, not
+        # custom RuboCop rules, so it ships even though guidance says "no
+        # .rubocop.yml".
+        dev_gems = {"brakeman" => nil, "bundle-audit" => nil, "letter_opener" => nil, "standard" => ">= 1.54"}
         runtime_gems = {"rails-i18n" => nil, "maquina-components" => nil}
         production_gems = {"aws-sdk-s3" => nil}
 
@@ -28,22 +37,19 @@ module Maquina
           gsub_file "Gemfile", /^\s*gem\s+["']#{gem_name}["'].*\n/, ""
         end
 
-        dev_gems.each do |gem_name, _|
-          unless content.include?("gem \"#{gem_name}\"")
-            append_to_file "Gemfile", "\ngem \"#{gem_name}\", group: :development\n"
-          end
+        dev_gems.each do |gem_name, version|
+          next if content.include?("gem \"#{gem_name}\"")
+          append_to_file "Gemfile", "\n#{gem_line(gem_name, version, group: :development)}\n"
         end
 
-        runtime_gems.each do |gem_name, _|
-          unless content.include?("gem \"#{gem_name}\"")
-            append_to_file "Gemfile", "\ngem \"#{gem_name}\"\n"
-          end
+        runtime_gems.each do |gem_name, version|
+          next if content.include?("gem \"#{gem_name}\"")
+          append_to_file "Gemfile", "\n#{gem_line(gem_name, version)}\n"
         end
 
-        production_gems.each do |gem_name, _|
-          unless content.include?("gem \"#{gem_name}\"")
-            append_to_file "Gemfile", "\ngem \"#{gem_name}\", group: :production\n"
-          end
+        production_gems.each do |gem_name, version|
+          next if content.include?("gem \"#{gem_name}\"")
+          append_to_file "Gemfile", "\n#{gem_line(gem_name, version, group: :production)}\n"
         end
 
         return unless rails_app?
@@ -193,7 +199,6 @@ module Maquina
       def install_maquina_generators
         return unless rails_app?
 
-        generate "maquina:rack_attack", "--quiet"
         generate "maquina:mission_control_jobs", "--prefix", options[:prefix], "--quiet"
         generate "maquina:solid_errors", "--prefix", options[:prefix], "--quiet"
 
@@ -204,6 +209,10 @@ module Maquina
           system("bin/rails generate solid_cable:install", chdir: destination_root)
           system("bin/rails generate maquina_components:install", chdir: destination_root)
         end
+
+        # After solid_queue:install, so config/recurring.yml exists for the purge.
+        # Installs the maquina:rack_attack rules too.
+        generate "maquina:security", "--prefix", options[:prefix], "--quiet"
       end
 
       # 13. Restore custom layouts overwritten by gem installers
@@ -255,7 +264,45 @@ module Maquina
         end
       end
 
-      # 18. Run all migrations
+      # 18. Restore database.yml from its example in bin/setup. config/database.yml
+      #     is gitignored (it differs per environment), so a fresh clone has only
+      #     the committed example — bin/setup must copy it before db:prepare.
+      def configure_bin_setup
+        setup_file = File.join(destination_root, "bin/setup")
+        return unless File.exist?(setup_file)
+        return if File.read(setup_file).include?("config/database.yml.example")
+
+        inject_into_file "bin/setup",
+          after: %r{system\("bundle check"\) \|\| system!\("bundle install"\)\n} do
+          <<~RUBY.indent(2)
+
+            # config/database.yml is gitignored; restore it from the committed example
+            unless File.exist?("config/database.yml")
+              puts "\\n== Copying config/database.yml =="
+              FileUtils.cp "config/database.yml.example", "config/database.yml"
+            end
+          RUBY
+        end
+      end
+
+      # 19. Restore database.yml from its example in CI. Without it, the test job
+      #     boots with no database.yml and every Rails task fails. Only touched
+      #     when the host app already has a GitHub Actions workflow.
+      def configure_ci
+        ci_file = File.join(destination_root, ".github/workflows/ci.yml")
+        return unless File.exist?(ci_file)
+        return if File.read(ci_file).include?("config/database.yml.example")
+
+        inject_into_file ".github/workflows/ci.yml",
+          before: /^      - name: Run tests$/ do
+          <<~YAML.indent(6)
+            - name: Prepare database config
+              run: cp config/database.yml.example config/database.yml
+          YAML
+        end
+      end
+
+      # 20. Run all migrations
       def run_migrations
         return unless rails_app?
 
@@ -264,7 +311,7 @@ module Maquina
         end
       end
 
-      # 19. Post-install message
+      # 21. Post-install message
       def show_post_install
         say ""
         say "=" * 60, :green
@@ -279,10 +326,12 @@ module Maquina
         say "  2. Start the app: bin/dev"
         say ""
         say "Installed components:", :yellow
-        say "  - Rack::Attack: rate limiting and blocklists (config/initializers/rack_attack.rb)"
+        say "  - Rack::Attack: scanner and flood bans, throttles (config/initializers/rack_attack.rb)"
+        say "  - Security: Rack::Attack refusals at #{options[:prefix]}/security"
         say "  - Solid Queue: background jobs (config/solid_queue.yml)"
-        say "  - Mission Control Jobs: job dashboard at #{options[:prefix]}/mission_control_jobs"
-        say "  - Solid Errors: error tracking at #{options[:prefix]}/solid_errors"
+        say "  - Mission Control Jobs: job dashboard at #{options[:prefix]}/jobs"
+        say "  - Solid Errors: error tracking at #{options[:prefix]}/errors"
+        say "  - Admin overview: #{options[:prefix]}"
         say "  - Maquina Components: UI components"
         if options[:auth] != "none"
           say ""
@@ -298,6 +347,13 @@ module Maquina
 
       private
 
+      def gem_line(name, version, group: nil)
+        line = "gem \"#{name}\""
+        line << ", \"#{version}\"" if version
+        line << ", group: :#{group}" if group
+        line
+      end
+
       def rails_app?
         File.exist?(File.join(destination_root, "bin/rails"))
       end

data/lib/generators/maquina/app/templates/.rubocop.yml

@@ -1,3 +1,9 @@
+# standard.rb's runner bridge, not custom RuboCop rules.
+#
+# This is the entry point RuboCop (and editors/LSP) need to run the Standard
+# ruleset — all style comes from the `standard` gem via config/base.yml below.
+# Keep this file even though general guidance says "no .rubocop.yml": for
+# standard.rb this IS the runner config, not a custom rule set.
 require:
   - standard
 

data/lib/generators/maquina/app/templates/README.md.erb

@@ -34,15 +34,17 @@ Your app will be running at **http://localhost:<%= options[:port] %>**.
 | **WebSockets** | Solid Cable |
 | **Rich Text** | Action Text |
 | **File Storage** | Active Storage (S3-ready in production) |
-| **Multi-database** | Separate databases for queue, cache, cable, and errors |
+| **Multi-database** | Separate databases for queue, cache, cable, errors, and security |
 
 ## Development URLs
 
 | URL | Description |
 |-----|-------------|
 | http://localhost:<%= options[:port] %> | Application |
-| http://localhost:<%= options[:port] %><%= options[:prefix] %>/mission_control_jobs | Jobs dashboard |
-| http://localhost:<%= options[:port] %><%= options[:prefix] %>/solid_errors | Errors dashboard |
+| http://localhost:<%= options[:port] %><%= options[:prefix] %> | Admin overview |
+| http://localhost:<%= options[:port] %><%= options[:prefix] %>/errors | Errors dashboard |
+| http://localhost:<%= options[:port] %><%= options[:prefix] %>/jobs | Jobs dashboard |
+| http://localhost:<%= options[:port] %><%= options[:prefix] %>/security | Security dashboard |
 <% if options[:auth] != "none" -%>
 | http://localhost:<%= options[:port] %>/session/new | Sign in |
 <% if options[:auth] == "registration" -%>
@@ -65,7 +67,7 @@ Edit credentials with:
 bin/rails credentials:edit
 ```
 
-Add backstage credentials for the jobs and errors dashboards:
+Add backstage credentials for the admin dashboards (overview, errors, jobs, security):
 
 ```yaml
 backstage:

data/lib/generators/maquina/app/templates/app/views/home/index.html.erb

@@ -32,17 +32,17 @@
 <%% if authenticated? %>
   <section class="max-w-5xl mx-auto px-5 py-12">
     <p class="text-sm font-semibold uppercase tracking-wider text-primary mb-4">Admin Tools</p>
-    <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+    <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
       <%%= render "components/card" do %>
         <%%= render "components/card/header" do %>
           <div class="flex items-center gap-2">
-            <%%= icon_for(:activity, class: "size-5 text-primary") %>
+            <%%= icon_for(:triangle_alert, class: "size-5 text-primary") %>
             <%%= render "components/card/title", text: "Solid Errors" %>
           </div>
           <%%= render "components/card/description", text: "Browse, resolve, and clean up application exceptions in real time." %>
         <%% end %>
         <%%= render "components/card/footer" do %>
-          <%%= link_to "Open Dashboard", "<%= options[:prefix] %>/solid_errors", data: { component: "button", variant: "outline", size: "sm" } %>
+          <%%= link_to "Open Dashboard", "<%= options[:prefix] %>/errors", data: { component: "button", variant: "outline", size: "sm" } %>
         <%% end %>
       <%% end %>
 
@@ -55,7 +55,20 @@
           <%%= render "components/card/description", text: "Monitor queues, retry failed jobs, and manage background processing." %>
         <%% end %>
         <%%= render "components/card/footer" do %>
-          <%%= link_to "Open Dashboard", "<%= options[:prefix] %>/mission_control_jobs", data: { component: "button", variant: "outline", size: "sm" } %>
+          <%%= link_to "Open Dashboard", "<%= options[:prefix] %>/jobs", data: { component: "button", variant: "outline", size: "sm" } %>
+        <%% end %>
+      <%% end %>
+
+      <%%= render "components/card" do %>
+        <%%= render "components/card/header" do %>
+          <div class="flex items-center gap-2">
+            <%%= icon_for(:slash, class: "size-5 text-primary") %>
+            <%%= render "components/card/title", text: "Security" %>
+          </div>
+          <%%= render "components/card/description", text: "See what Rack::Attack throttled, blocked, and banned this week." %>
+        <%% end %>
+        <%%= render "components/card/footer" do %>
+          <%%= link_to "Open Dashboard", "<%= options[:prefix] %>/security", data: { component: "button", variant: "outline", size: "sm" } %>
         <%% end %>
       <%% end %>
     </div>
@@ -109,7 +122,7 @@
         <%%= render "components/card/title", text: "Rate Limiting" %>
       <%% end %>
       <%%= render "components/card/content" do %>
-        <p class="text-sm text-muted-foreground">Rack::Attack configured with blocklists and throttles. Protect login, registration, and API endpoints.</p>
+        <p class="text-sm text-muted-foreground">Rack::Attack bans scanners and floods and throttles sign-in. Every refusal shows on the Security dashboard.</p>
       <%% end %>
     <%% end %>
 

data/lib/generators/maquina/app/templates/config/database.yml.tt

@@ -29,6 +29,10 @@ development:
     <<: *default
     database: storage/development_errors.sqlite3
     migrations_paths: db/errors_migrate
+  security:
+    <<: *default
+    database: storage/development_security.sqlite3
+    migrations_paths: db/security_migrate
 
 # Warning: The database defined as "test" will be erased and
 # re-generated from your development database when you run "rake".
@@ -53,6 +57,10 @@ test:
     <<: *default
     database: storage/test_errors.sqlite3
     migrations_paths: db/errors_migrate
+  security:
+    <<: *default
+    database: storage/test_security.sqlite3
+    migrations_paths: db/security_migrate
 
 # Store production database in the storage/ directory, which by default
 # is mounted as a persistent Docker volume in config/deploy.yml.
@@ -76,3 +84,7 @@ production:
     <<: *default
     database: storage/production_errors.sqlite3
     migrations_paths: db/errors_migrate
+  security:
+    <<: *default
+    database: storage/production_security.sqlite3
+    migrations_paths: db/security_migrate

data/lib/generators/maquina/mission_control_jobs/mission_control_jobs_generator.rb

@@ -49,7 +49,7 @@ module Maquina
 
       # 5. Routes
       def add_route
-        mount_path = "#{options[:prefix]}/mission_control_jobs"
+        mount_path = "#{options[:prefix]}/jobs"
 
         route "mount MissionControl::Jobs::Engine, at: \"#{mount_path}\""
       end
@@ -67,6 +67,13 @@ module Maquina
         layout_files.each { |f| copy_file f, f }
       end
 
+      # 7b. Backstage dashboard — admin overview at the prefix root, linking to
+      #     the installed engines. Shared with the solid_errors generator, so
+      #     guard every step for idempotency when both run.
+      def create_backstage_dashboard
+        install_backstage_dashboard
+      end
+
       # 8. Custom views
       def copy_views
         return unless options[:copy_views]
@@ -105,6 +112,30 @@ module Maquina
         File.exist?(File.join(destination_root, "bin/rails"))
       end
 
+      # Idempotent install of the shared backstage dashboard (controller, layout,
+      # prefix-aware view, and the prefix-root route). Safe to run from both this
+      # generator and solid_errors.
+      def install_backstage_dashboard
+        unless File.exist?(File.join(destination_root, "app/controllers/backstage_dashboard_controller.rb"))
+          copy_file "app/controllers/backstage_dashboard_controller.rb",
+            "app/controllers/backstage_dashboard_controller.rb"
+        end
+
+        unless File.exist?(File.join(destination_root, "app/views/layouts/admin.html.erb"))
+          copy_file "app/views/layouts/admin.html.erb", "app/views/layouts/admin.html.erb"
+        end
+
+        unless File.exist?(File.join(destination_root, "app/views/backstage_dashboard/index.html.erb"))
+          template "app/views/backstage_dashboard/index.html.erb.tt",
+            "app/views/backstage_dashboard/index.html.erb"
+        end
+
+        routes_path = File.join(destination_root, "config/routes.rb")
+        if File.exist?(routes_path) && !File.read(routes_path).include?("backstage_dashboard#index")
+          route %(get "#{options[:prefix]}" => "backstage_dashboard#index", as: :backstage_dashboard)
+        end
+      end
+
       def layout_files
         layouts_dir = File.join(self.class.source_root, "app/views/layouts/mission_control")
         Dir.glob("**/*.erb", base: layouts_dir).map do |file|

data/lib/generators/maquina/mission_control_jobs/templates/app/controllers/backstage_dashboard_controller.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# Admin overview — a backstage surface alongside the SolidErrors and Mission
+# Control Jobs engines, under the same backstage Basic auth.
+#
+# Out of the box it shows the installed engine entry points and an empty metrics
+# area. Populate @metrics in #index with aggregate, non-sensitive counts for
+# your app — counts, not names or per-record detail.
+class BackstageDashboardController < BackstageController
+  layout "admin"
+
+  before_action :require_backstage_credentials
+  before_action :authenticate_backstage
+
+  def index
+    @generated_at = Time.current
+
+    # Add overview metrics here. Each entry renders as a card:
+    #
+    #   @metrics = [
+    #     {label: "Accounts", icon: :folder, value: Account.count, hint: "tenants"},
+    #     {label: "Users", icon: :user, value: User.count, hint: "members"}
+    #   ]
+    #
+    # Keep them aggregate-only. :total and :hint are optional.
+    @metrics = []
+  end
+
+  private
+
+  # Closed (503) until credentials.backstage is set. Without this an unset
+  # username and password are both "", and an empty Basic header matches them.
+  def require_backstage_credentials
+    backstage = Rails.application.credentials.backstage || {}
+    head :service_unavailable if backstage[:username].blank? || backstage[:password].blank?
+  end
+
+  # Same backstage credentials the engines use.
+  def authenticate_backstage
+    authenticate_or_request_with_http_basic("Admin") do |username, password|
+      backstage = Rails.application.credentials.backstage || {}
+
+      ActiveSupport::SecurityUtils.secure_compare(username.to_s, backstage[:username].to_s) &
+        ActiveSupport::SecurityUtils.secure_compare(password.to_s, backstage[:password].to_s)
+    end
+  end
+end