upright 0.2.0 → 0.4.0

data/app/models/upright/service/daily_status.rb

@@ -0,0 +1,39 @@
+class Upright::Service::DailyStatus
+  attr_reader :date, :status, :uptime_fraction
+
+  def initialize(date:, status: nil, uptime_fraction: nil)
+    @date            = date
+    @status          = status
+    @uptime_fraction = uptime_fraction
+  end
+
+  def operational?
+    status == :operational
+  end
+
+  def date_label
+    date == Date.current ? "Today" : date.to_fs(:month_day)
+  end
+
+  def detail
+    if uptime_fraction
+      [ "%.2f%% uptime" % (uptime_fraction * 100), downtime ].compact.join(" · ")
+    elsif status
+      status.to_s.humanize.downcase
+    else
+      "no data"
+    end
+  end
+
+  def aria_label
+    "#{date_label}: #{detail}"
+  end
+
+  private
+    def downtime
+      if uptime_fraction && uptime_fraction < 1
+        minutes = ((1 - uptime_fraction) * 24 * 60).round
+        minutes.zero? ? "<1 min down" : "#{minutes} #{'min'.pluralize(minutes)} down"
+      end
+    end
+end

data/app/models/upright/service/incident_history.rb

@@ -0,0 +1,24 @@
+class Upright::Service::IncidentHistory
+  attr_reader :service, :page
+
+  delegate :daily_status_history, :maintenance_active?, :name, to: :service
+
+  def self.for(service, page: nil)
+    new service, page: GearedPagination::Recordset.new(
+      service.incidents.past.reorder(nil).preload(:updates), ordered_by: { starts_at: :desc }
+    ).page(page)
+  end
+
+  def initialize(service, page:)
+    @service = service
+    @page = page
+  end
+
+  def active_incidents
+    @active_incidents ||= service.incidents.reactive.active.preload(:updates)
+  end
+
+  def past_incidents
+    page.records
+  end
+end

data/app/models/upright/service/outage.rb

@@ -0,0 +1,15 @@
+class Upright::Service::Outage < Data.define(:service, :status, :started_at)
+  IMPACT_BY_STATUS = {
+    degraded: "minor",
+    partial_outage: "major",
+    major_outage: "critical"
+  }
+
+  def impact
+    IMPACT_BY_STATUS.fetch(status)
+  end
+
+  def started_at_or_lookback(observed_at:)
+    started_at || observed_at - Upright::Services::LiveStatus::OUTAGE_LOOKBACK
+  end
+end

data/app/models/upright/service/status_page.rb

@@ -0,0 +1,35 @@
+class Upright::Service::StatusPage
+  attr_reader :services, :active_incidents, :active_maintenances, :upcoming_maintenances
+
+  def self.current
+    services = Upright::Service.public_facing
+
+    new services: services,
+      active_incidents: Upright::Incident.public_facing.reactive.active.order(starts_at: :desc),
+      active_maintenances: Upright::Maintenance.public_facing.active.order(:starts_at),
+      upcoming_maintenances: Upright::Maintenance.public_facing.upcoming.order(:starts_at)
+  end
+
+  def initialize(services:, active_incidents:, active_maintenances:, upcoming_maintenances:)
+    @services = services
+    @active_incidents = active_incidents
+    @active_maintenances = active_maintenances
+    @upcoming_maintenances = upcoming_maintenances
+  end
+
+  def overall_status
+    services.overall_status(incidents: Upright::Incident.public_facing)
+  end
+
+  def outages
+    services.degraded
+  end
+
+  def active_events
+    active_incidents.to_a + active_maintenances.to_a
+  end
+
+  def service_histories
+    services.by_history
+  end
+end

data/app/models/upright/service.rb

@@ -0,0 +1,101 @@
+class Upright::Service < FrozenRecord::Base
+  include Upright::Services::LiveStatus
+  include Upright::Services::MaintenanceStatus
+
+  def self.file_path
+    Upright.configuration.services_path.to_s
+  end
+
+  scope :public_facing, -> { where(public: true) }
+
+  # The public status page passes `incidents: Upright::Incident.public_facing`
+  # so internal-only incidents and maintenances never color the public banner.
+  def self.overall_status(incidents: Upright::Incident.all)
+    probe_statuses = all.reject(&:maintenance_active?).map(&:live_status)
+    worst = Upright::Status.worst(probe_statuses + incidents.active_statuses)
+    worst == :operational && incidents.planned.active.any? ? :maintenance : worst
+  end
+
+  def self.by_history(past: 90.days)
+    all.to_h { |service| [ service, service.daily_status_history(past: past) ] }
+  end
+
+  def self.degraded
+    all.filter_map(&:current_outage)
+  end
+
+  def current_outage
+    return if maintenance_active?
+
+    live_status.then do |status|
+      Upright::Service::Outage.new(service: self, status: status, started_at: current_outage_started_at) unless status == :operational
+    end
+  end
+
+  def incidents
+    Upright::Incident.public_facing.for_service(code)
+  end
+
+  def incident_history(page: nil)
+    Upright::Service::IncidentHistory.for(self, page: page)
+  end
+
+  def incident_update_template(key)
+    self[:incident_updates]&.fetch(key.to_s, nil)
+  end
+
+  DEFAULT_UPTIME_PROBE_TYPES = %w[ http ]
+
+  # Probe types whose results decide this service's live status and daily
+  # uptime: HTTP unless `uptime_probe_types` in services.yml says otherwise.
+  # Other types bound to the service are still probed, rolled up and alerted on.
+  # A type that isn't registered raises rather than matching nothing, since an
+  # empty match would report the service operational.
+  def uptime_probe_types
+    types = Array(self[:uptime_probe_types]).map(&:to_s).presence || DEFAULT_UPTIME_PROBE_TYPES
+    unknown = types - Upright.configuration.probe_types.types
+
+    if unknown.any?
+      raise Upright::ConfigurationError, "#{code}: uptime_probe_types #{unknown.join(", ")} not registered with config.probe_types"
+    end
+
+    types
+  end
+
+  # Rollups written before probe_type was recorded (July 2026) have none and
+  # keep counting, so an upgrade doesn't drop history.
+  def probe_rollups
+    Upright::Rollups::ProbeRollup.where(probe_service: code, probe_type: [ *uptime_probe_types, nil ])
+  end
+
+  def uptime_for(day)
+    probe_rollups.where(period_start: day.beginning_of_day).minimum(:uptime_fraction)
+  end
+
+  def daily_uptime(past: 90.days)
+    probe_rollups
+      .where(period_start: past.ago.beginning_of_day..)
+      .group(:period_start)
+      .minimum(:uptime_fraction)
+  end
+
+  # Unified day-by-day view: past days from ProbeRollup, today from live
+  # Prometheus state, missing days as no-data. Callers iterate without caring
+  # which source backs each entry.
+  def daily_status_history(past: 90.days)
+    rollup_by_day = daily_uptime(past: past)
+
+    (past.ago.to_date.next_day..Date.current).map do |date|
+      if date == Date.current
+        DailyStatus.new(date: date, status: live_status)
+      else
+        fraction = rollup_by_day[date.beginning_of_day]
+        DailyStatus.new(
+          date: date,
+          status: Upright::Status.for(fraction),
+          uptime_fraction: fraction
+        )
+      end
+    end
+  end
+end

data/app/models/upright/status.rb

@@ -0,0 +1,21 @@
+module Upright::Status
+  VALUES   = %i[ operational degraded partial_outage major_outage ]
+  PRIORITY = VALUES.reverse  # worst first — for picking overall_status across services
+
+  # nil fraction means we have no measurement for the period — distinct from
+  # :operational, so we return nil rather than guessing.
+  def self.worst(statuses)
+    PRIORITY.find { |status| statuses.include?(status) } || :operational
+  end
+
+  def self.for(uptime_fraction)
+    if uptime_fraction
+      case uptime_fraction
+      when 1.0..  then :operational
+      when ...0.5 then :major_outage
+      when ...0.9 then :partial_outage
+      else             :degraded
+      end
+    end
+  end
+end

data/app/models/upright/traceroute/ip_metadata_lookup.rb

@@ -3,7 +3,14 @@ require "json"
 require "resolv"
 
 class Upright::Traceroute::IpMetadataLookup
+  # ip-api.com only offers TLS with a paid key (the free /batch endpoint
+  # rejects HTTPS outright). With IP_API_KEY set, lookups use the TLS pro
+  # endpoint. Without a key they fall back to plain HTTP, which exposes the
+  # looked-up hop IPs to on-path observers — the response is public geo
+  # metadata, but consider a paid key or a local GeoIP database (e.g. maxmind's
+  # GeoLite2 via the maxmind-geoip2 gem) if that leak matters to you.
   API_URL = "http://ip-api.com/batch"
+  TLS_API_URL = "https://pro.ip-api.com/batch"
   TIMEOUT = 5.seconds
   GEOHASH_PRECISION = 6
   CACHE_TTL = 24.hours
@@ -48,12 +55,12 @@ class Upright::Traceroute::IpMetadataLookup
       end
 
       def fetch_batch(ips)
-        uri = URI(API_URL)
+        uri = api_uri
         request = Net::HTTP::Post.new(uri)
         request.content_type = "application/json"
         request.body = ips.to_json
 
-        response = Net::HTTP.start(uri.hostname, uri.port, read_timeout: TIMEOUT, open_timeout: TIMEOUT) do |http|
+        response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https", read_timeout: TIMEOUT, open_timeout: TIMEOUT) do |http|
           http.request(request)
         end
 
@@ -64,6 +71,18 @@ class Upright::Traceroute::IpMetadataLookup
         end
       end
 
+      def api_uri
+        if api_key.present?
+          URI("#{TLS_API_URL}?key=#{api_key}")
+        else
+          URI(API_URL)
+        end
+      end
+
+      def api_key
+        ENV["IP_API_KEY"]
+      end
+
       def parse_response(results)
         results.select { |result| result["status"] == "success" }.to_h do |result|
           [ result["query"], build_metadata(result) ]

data/app/models/upright/traceroute/result.rb

@@ -4,6 +4,11 @@ class Upright::Traceroute::Result
   PROBE_COUNT = 10
   MAX_HOPS = 30
 
+  # Hostnames, IPv4, and IPv6 addresses (including a link-local zone such as
+  # fe80::1%eth0) only. The first character may not be a dash, so a configured
+  # host can never be mistaken for an mtr flag.
+  HOST_PATTERN = /\A[a-z0-9:][a-z0-9:._-]*(?:%[a-z0-9._-]+)?\z/i
+
   attr_reader :host, :hops, :raw_json
 
   def self.for(host)
@@ -11,6 +16,8 @@ class Upright::Traceroute::Result
   end
 
   def initialize(host)
+    raise ArgumentError, "invalid traceroute host: #{host.inspect}" unless HOST_PATTERN.match?(host.to_s)
+
     @host = host
     @hops = []
   end
@@ -32,7 +39,7 @@ class Upright::Traceroute::Result
         "--aslookup",
         "--report-cycles", PROBE_COUNT.to_s,
         "--max-ttl", MAX_HOPS.to_s,
-        host.to_s
+        "--", host.to_s
       )
 
       Rails.logger.info stdout

data/app/views/layouts/upright/_header.html.erb

@@ -4,17 +4,27 @@
     <% if Upright::Current.site.present? %>
       <span class="header__site"><%= site_name(Upright::Current.site) %></span>
     <% end %>
+    <% unless Rails.env.production? %>
+      <span class="header__env"><%= Rails.env %></span>
+    <% end %>
   </div>
 
   <nav class="header__nav">
     <%= link_to "Probes", upright.site_root_url(subdomain: current_or_default_site.code), class: "header__link" %>
     <%= link_to "Uptime", upright.dashboards_uptime_url(subdomain: Upright.configuration.global_subdomain), class: "header__link" %>
     <%= link_to "Status", upright.dashboards_probe_status_url(subdomain: Upright.configuration.global_subdomain), class: "header__link" %>
+    <%= link_to "Incidents", upright.incidents_url(subdomain: Upright.configuration.global_subdomain), class: "header__link" %>
     <span class="header__divider"></span>
     <%= link_to "Jobs", upright.jobs_url(subdomain: current_or_default_site.code), class: "header__link" %>
     <span class="header__divider"></span>
-    <%= link_to "Prometheus", upright.prometheus_url(subdomain: Upright.configuration.global_subdomain), class: "header__link" %>
-    <%= link_to "Alertmanager", upright.alertmanager_url(subdomain: Upright.configuration.global_subdomain), class: "header__link" %>
+    <% if metrics_subdomain %>
+      <%= link_to "Prometheus", upright.prometheus_url(subdomain: metrics_subdomain), class: "header__link" %>
+      <%= link_to "Alertmanager", upright.alertmanager_url(subdomain: metrics_subdomain), class: "header__link" %>
+    <% else %>
+      <% available_on = "Available on #{metrics_sites_sentence}" %>
+      <%= tag.span "Prometheus", class: "header__link unavailable", title: available_on %>
+      <%= tag.span "Alertmanager", class: "header__link unavailable", title: available_on %>
+    <% end %>
   </nav>
 
   <div class="header__user">

data/app/views/layouts/upright/application.html.erb

@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html lang="en">
   <head>
-    <title>Upright</title>
+    <%= page_title_tag %>
     <meta name="viewport" content="width=device-width,initial-scale=1">
     <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)">
     <meta name="theme-color" content="#1f2937" media="(prefers-color-scheme: dark)">
@@ -16,6 +16,9 @@
     <% if signed_in? %>
       <%= render "layouts/upright/header" %>
       <main class="main">
+        <% flash.each do |type, message| %>
+          <p class="flash flash--<%= type %>"><%= message %></p>
+        <% end %>
         <%= yield %>
       </main>
     <% else %>

data/app/views/layouts/upright/public.html.erb

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <%= page_title_tag "Status" %>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <%= csrf_meta_tags %>
+    <%= csp_meta_tag %>
+    <%= upright_stylesheet_link_tag "data-turbo-track": "reload" %>
+    <%= javascript_importmap_tags "upright/public" %>
+  </head>
+  <body class="public">
+    <%= render "upright/public/branding" %>
+    <main class="main">
+      <%= yield %>
+    </main>
+    <%= render "upright/public/footer" %>
+  </body>
+</html>

data/app/views/layouts/upright/public.rss.builder

@@ -0,0 +1 @@
+xml << yield

data/app/views/upright/active_storage/attachments/_attachment.html.erb

@@ -10,7 +10,7 @@
           <% end %>
           <div class="artifact__probe-time" title="<%= probe_result.created_at.to_fs(:db) %>"><%= time_ago_in_words(probe_result.created_at) %> ago</div>
         <% end %>
-        <h3 class="artifact__title"><%= artifact_icon(attachment) %> <%= attachment.filename %></h3>
+        <h3 class="artifact__title"><%= link_to "#{artifact_icon(attachment)} #{attachment.filename} ↓", main_app.rails_blob_path(attachment, disposition: :attachment), download: attachment.filename %></h3>
       </div>
       <button type="button" class="artifact__close" data-action="popover#close" aria-label="Close">×</button>
     </header>

data/app/views/upright/artifacts/show.html.erb

@@ -3,6 +3,14 @@
     <video controls width="960" preload="none" autoplay muted>
       <source src="<%= main_app.rails_blob_path(@artifact, disposition: :inline) %>" type="video/webm">
     </video>
+  <% elsif trace?(@artifact) %>
+    <div class="artifact__trace">
+      <% if (viewer = trace_viewer_url_for(@artifact)) %>
+        <p><%= link_to "Open in the Playwright Trace Viewer ↗", viewer, target: "_blank", rel: "noopener noreferrer" %></p>
+      <% else %>
+        <p>Download the trace above, then open it with <code>npx playwright show-trace <%= @artifact.filename %></code>.</p>
+      <% end %>
+    </div>
   <% else %>
     <pre><%= @artifact.download %></pre>
   <% end %>

data/app/views/upright/dashboards/_uptime_probe_row.html.erb

@@ -1,5 +1,5 @@
 <div class="data-table__row uptime-bars__row">
-  <%= link_to upright.site_root_url(subdomain: Upright.sites.first.code, probe_type: probe.type, probe_name: probe.name), class: "data-table__probe" do %>
+  <%= link_to upright.site_root_url(subdomain: current_or_default_site.code, probe_type: probe.type, probe_name: probe.name), class: "data-table__probe" do %>
     <%= probe_type_icon(probe.type) %>
     <span class="data-table__probe-name"><%= probe.name %></span>
   <% end %>
@@ -11,8 +11,10 @@
       <% else %>
         <% uptime_percent = uptime * 100 %>
         <% downtime_minutes = ((1 - uptime) * 24 * 60).round %>
-        <div class="uptime-bar uptime-bar--<%= uptime_label(uptime_percent) %>"
-             title="<%= uptime_bar_tooltip(date, uptime_percent, downtime_minutes) %>"></div>
+        <%= link_to "", upright.site_root_url(subdomain: current_or_default_site.code, probe_type: probe.type, probe_name: probe.name, date: date.iso8601),
+              class: "uptime-bar uptime-bar--#{uptime_label(uptime_percent)}",
+              title: uptime_bar_tooltip(date, uptime_percent, downtime_minutes),
+              aria: { label: uptime_bar_tooltip(date, uptime_percent, downtime_minutes) } %>
       <% end %>
     <% end %>
   </div>

data/app/views/upright/dashboards/probe_statuses/show.html.erb

@@ -4,7 +4,7 @@
 
     <div class="dashboard-filters">
       <%= form_with url: dashboards_probe_status_path, method: :get, data: { controller: "form", turbo_frame: :probe_status_matrix } do %>
-        <%= collection_select nil, :probe_type, Upright::Probeable::TYPES, :itself, :titleize,
+        <%= collection_select nil, :probe_type, Upright.probe_types, :type, :name,
               { selected: @probe_type },
               { class: "input--select", data: { action: "change->form#submit" } } %>
       <% end %>

data/app/views/upright/dashboards/uptimes/show.html.erb

@@ -4,7 +4,7 @@
 
     <div class="dashboard-filters">
       <%= form_with url: dashboards_uptime_path, method: :get, data: { controller: "form", turbo_frame: :uptime_bars } do %>
-        <%= collection_select nil, :probe_type, Upright::Probeable::TYPES, :itself, :titleize,
+        <%= collection_select nil, :probe_type, Upright.probe_types, :type, :name,
               { selected: @probe_type },
               { class: "input--select", data: { action: "change->form#submit" } } %>
       <% end %>

data/app/views/upright/incidents/_form.html.erb

@@ -0,0 +1,93 @@
+<% url = @incident.new_record? ? incidents_path : incident_path(@incident) %>
+<%= form_with model: @incident, scope: :incident, url: url,
+      class: class_names("incident-form",
+        "incident-form--maintenance" => @incident.persisted? && @incident.maintenance?,
+        "incident-form--incident" => @incident.persisted? && !@incident.maintenance?) do |f| %>
+  <span class="incident-form__spine" aria-hidden="true"></span>
+
+  <div class="incident-form__body">
+    <header class="incident-form__head">
+      <p class="incident-form__eyebrow"><%= @incident.new_record? ? "New event" : (@incident.maintenance? ? "Maintenance" : "Incident") %></p>
+      <% unless @incident.new_record? %>
+        <h1 class="incident-form__title"><%= @incident.title %></h1>
+      <% end %>
+    </header>
+
+    <% if @incident.errors.any? %>
+      <ul class="incident-errors">
+        <% @incident.errors.full_messages.each do |message| %>
+          <li><%= message %></li>
+        <% end %>
+      </ul>
+    <% end %>
+
+    <% if @incident.new_record? %>
+      <div class="field">
+        <span class="field__label">Type</span>
+        <div class="segmented" role="radiogroup" aria-label="Type">
+          <input type="radio" name="maintenance" id="kind_incident" value="false" <%= "checked" unless @incident.maintenance? %>>
+          <label for="kind_incident">Incident</label>
+          <input type="radio" name="maintenance" id="kind_maintenance" value="true" <%= "checked" if @incident.maintenance? %>>
+          <label for="kind_maintenance">Maintenance</label>
+        </div>
+      </div>
+    <% end %>
+
+    <div class="field">
+      <%= f.label :title, "Title", class: "field__label" %>
+      <%= f.text_field :title, class: "field__input",
+            placeholder: "Short summary customers will see", autofocus: @incident.new_record? %>
+    </div>
+
+    <div class="field field--incident">
+      <span class="field__label">Impact</span>
+      <div class="impact-picker" role="radiogroup" aria-label="Impact">
+        <% Upright::Incident::IMPACTS.each do |level| %>
+          <label class="impact impact--<%= level %>">
+            <%= f.radio_button :impact, level, id: "impact_#{level}" %>
+            <span class="impact__dot" aria-hidden="true"></span>
+            <span class="impact__name"><%= level.humanize %></span>
+          </label>
+        <% end %>
+      </div>
+    </div>
+
+    <div class="field">
+      <%= f.label :starts_at, "Starts", class: "field__label" %>
+      <%= f.datetime_field :starts_at, class: "field__input" %>
+    </div>
+
+    <div class="field field--maintenance">
+      <%= f.label :ends_at, "Ends", class: "field__label" %>
+      <%= f.datetime_field :ends_at, class: "field__input" %>
+      <span class="field__hint">Affected services read as “Under maintenance” for this window and stay out of the outage alarm.</span>
+    </div>
+
+    <div class="field">
+      <span class="field__label">Affected services</span>
+      <div class="chips">
+        <input type="hidden" name="incident[service_codes][]" value="">
+        <% Upright::Service.all.each do |service| %>
+          <label class="chip">
+            <%= check_box_tag "incident[service_codes][]", service.code,
+                  @incident.service_codes.include?(service.code), id: "service_#{service.code}" %>
+            <%= service.name %>
+          </label>
+        <% end %>
+      </div>
+    </div>
+
+    <% if @incident.new_record? %>
+      <div class="field">
+        <%= label_tag "incident_body", "First update", class: "field__label" %>
+        <%= text_area_tag "incident[body]", nil, id: "incident_body", class: "field__input",
+              placeholder: "What’s happening, and what you’re doing about it." %>
+      </div>
+    <% end %>
+
+    <div class="incident-form__actions">
+      <%= link_to "Cancel", incidents_path, class: "incident-form__cancel" %>
+      <%= f.submit(@incident.new_record? ? "Create" : "Save changes", class: "btn") %>
+    </div>
+  </div>
+<% end %>

data/app/views/upright/incidents/_row.html.erb

@@ -0,0 +1,15 @@
+<%= link_to edit_incident_path(incident), class: "incident-row incident-row--#{incident.maintenance? ? "maintenance" : incident.impact}" do %>
+  <span class="incident-row__spine" aria-hidden="true"></span>
+  <div class="incident-row__main">
+    <div class="incident-row__top">
+      <span class="incident-row__kind"><%= incident.maintenance? ? "Maintenance" : "Incident" %></span>
+      <span class="incident-row__status"><%= incident.status.humanize %></span>
+    </div>
+    <span class="incident-row__title"><%= incident.title %></span>
+    <p class="incident-row__meta">
+      <% if incident.services.any? %><%= incident.services.map(&:name).to_sentence %> · <% end %>
+      <time datetime="<%= incident.starts_at.iso8601 %>"><%= when_label %></time>
+      <% if incident.created_by.present? %> · Declared by <%= incident.created_by %><% end %>
+    </p>
+  </div>
+<% end %>

data/app/views/upright/incidents/edit.html.erb

@@ -0,0 +1,64 @@
+<% @page_title = @incident.title %>
+
+<div class="incident-editor incident-editor--<%= @incident.maintenance? ? "maintenance" : @incident.impact %>">
+  <%= link_to "← All incidents", incidents_path, class: "incident-editor__back" %>
+
+  <%= render "form" %>
+
+  <section class="incident-section">
+    <h2 class="incident-section__title">Lifecycle</h2>
+    <ol class="lifecycle">
+      <% statuses = @incident.class::STATUSES %>
+      <% current = statuses.index(@incident.status) %>
+      <% statuses.each_with_index do |status, index| %>
+        <li class="lifecycle__step <%= "lifecycle__step--done" if current && index < current %> <%= "lifecycle__step--current" if index == current %>"><%= status.humanize %></li>
+      <% end %>
+    </ol>
+  </section>
+
+  <section class="incident-section">
+    <h2 class="incident-section__title">Post an update</h2>
+    <%= form_with url: incident_updates_path(@incident), scope: :incident_update, class: "composer", data: { controller: "template" } do |f| %>
+      <div class="field">
+        <%= f.label :status, "Status", class: "field__label" %>
+        <%= f.select :status, @incident.class::STATUSES.map { |status| [ status.humanize, status ] },
+              { selected: @incident.status }, class: "input--select" %>
+      </div>
+      <div class="field">
+        <%= f.label :body, "Message", class: "field__label" %>
+        <% unless @incident.maintenance? %>
+          <div class="composer__templates">
+            <% @incident.class::TEMPLATES.each_key do |template| %>
+              <%= button_tag template.to_s.humanize, type: "button", class: "btn btn--small",
+                    data: { action: "template#fill", template_body_param: @incident.update_body_for(template) } %>
+            <% end %>
+          </div>
+        <% end %>
+        <%= f.text_area :body, class: "field__input", placeholder: "What changed.", data: { template_target: "body" } %>
+      </div>
+      <div class="incident-form__actions">
+        <%= f.submit "Post update", class: "btn" %>
+      </div>
+    <% end %>
+  </section>
+
+  <section class="incident-section">
+    <h2 class="incident-section__title">Timeline</h2>
+    <ol class="timeline">
+      <% @incident.updates.each do |update| %>
+        <li class="timeline__item">
+          <span class="timeline__status"><%= update.status.humanize %></span>
+          <time class="timeline__time" datetime="<%= update.created_at.iso8601 %>"><%= update.created_at.strftime("%b %-d, %H:%M %Z") %></time>
+          <span class="timeline__author">by <%= update.created_by %></span>
+          <% if update.body.present? %><p class="timeline__body"><%= update.body %></p><% end %>
+        </li>
+      <% end %>
+    </ol>
+  </section>
+
+  <section class="incident-section">
+    <%= button_to "Delete #{@incident.maintenance? ? "maintenance" : "incident"}",
+          incident_path(@incident), method: :delete, class: "btn",
+          form: { data: { turbo_confirm: "Delete this #{@incident.maintenance? ? "maintenance" : "incident"}?" } } %>
+  </section>
+</div>