@yuuki824/kanshi 0.3.0

package/README.md

@@ -0,0 +1,219 @@
+<div align="center">
+
+# kanshi
+
+**A one-page, mobile-first glance at a machine: CPU, memory, a storage map, and every Docker container.**
+
+One small program for Linux or Windows. No database, no agents, no history, no alerting —
+open it, see what's going on, close it. When nobody is looking it does nothing at all.
+
+[![CI](https://github.com/rene-roid/kanshi/actions/workflows/ci.yml/badge.svg)](https://github.com/rene-roid/kanshi/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/rene-roid/kanshi?sort=semver)](https://github.com/rene-roid/kanshi/releases/latest)
+[![Platforms](https://img.shields.io/badge/platforms-Linux%20%7C%20Windows%20%7C%20Docker-0b7285)](#install)
+[![Image](https://img.shields.io/badge/image-ghcr.io%2Frene--roid%2Fkanshi-2496ed?logo=docker&logoColor=white)](https://github.com/rene-roid/kanshi/pkgs/container/kanshi)
+[![License: AGPL-3.0](https://img.shields.io/badge/license-AGPL--3.0-blue)](LICENSE)
+
+</div>
+
+<table>
+<tr>
+<td width="60%">
+
+**Vitals & storage** — live CPU/RAM meters and the storage map
+<img src="docs/screenshots/dashboard-vitals.png" alt="Processor, memory and storage map cards" />
+
+</td>
+<td width="40%">
+
+**Mobile** — the same cards, stacked for a phone
+<img src="docs/screenshots/dashboard-mobile.png" alt="Dashboard on a mobile viewport" />
+
+</td>
+</tr>
+</table>
+
+## Features
+
+- 📊 **Processor** — overall and per-core utilisation, load average, temperature, network and disk throughput
+- 🧠 **Memory & volumes** — RAM, swap, and how full each drive is
+- 🗺 **Storage map** — a treemap of what is using your disk. Tap to drill in; a table below lists every folder and, on request, the largest files. Pin any folder by path
+- 🐳 **Containers** — CPU, memory, network and health for every Docker container, with each published port as a link
+- 🖥 **Linux and Windows** — one executable per platform, or a 10 MB Docker image
+- 🔒 **Private by default** — only this computer can open it until you say otherwise; then pick your LAN, your Tailscale network, or both
+- 😴 **Idles to zero** — with no browser open it stops reading stats, stops talking to Docker, and stops scanning disks
+- 🪶 **Tiny** — ~8 MB of memory, no dependencies, nothing to install alongside it
+
+## Install
+
+Pick one. Every option ends with the dashboard at **<http://localhost:8100>**.
+
+### Windows
+
+1. Download `kanshi-windows-amd64.exe` from the [latest release](https://github.com/rene-roid/kanshi/releases/latest)
+   (`kanshi-windows-arm64.exe` on an ARM laptop).
+2. Double-click it. The dashboard opens in your browser.
+
+Windows may say it *protected your PC* because the file is not code-signed: choose **More info → Run anyway**.
+The storage map covers `C:\`, your user folder and every other fixed drive; run it as administrator to include
+folders your account cannot open. Docker Desktop is picked up automatically if it is running.
+
+### Linux
+
+```sh
+curl -fLo kanshi https://github.com/rene-roid/kanshi/releases/latest/download/kanshi-linux-amd64
+chmod +x kanshi
+./kanshi
+```
+
+Use `kanshi-linux-arm64` on a Raspberry Pi or other 64-bit ARM board. The storage map covers `/` and every
+drive mounted under `/mnt`. To see container stats your user needs to be in the `docker` group.
+
+To run it as a service, see [the installation guide](docs/installation.md#linux-as-a-service).
+
+### Docker Compose (recommended on a Docker host)
+
+```sh
+curl -fLO https://raw.githubusercontent.com/rene-roid/kanshi/main/docker-compose.yml
+docker compose up -d
+```
+
+The container reads the host's `/proc`, its Docker socket and its filesystem (all read-only), so what you see is
+the host, not the container. The image is Linux-only by nature; on Windows use the `.exe`.
+
+### npx
+
+With Node.js 18+ and Docker installed, this runs the same Compose setup without a checkout:
+
+```sh
+npx @yuuki824/kanshi           # start
+npx @yuuki824/kanshi update    # pull the newest image and restart
+npx @yuuki824/kanshi down      # stop
+```
+
+The [installation guide](docs/installation.md) has the details for each: services, permissions, updating,
+uninstalling and troubleshooting.
+
+## Who can open it
+
+Kanshi has no login, so who can reach it is decided entirely by where it listens. **This computer can always
+open it at `localhost`.** On top of that, choose any of:
+
+| Access | Who else can open it |
+|---|---|
+| `local` *(default)* | nobody — only this computer |
+| `lan` | phones and computers on the same local network, wired or Wi-Fi |
+| `tailscale` | your devices on your [Tailscale](https://tailscale.com) network, from anywhere |
+| `all` | anyone who can reach any of this machine's addresses, public ones included |
+
+Combine them with commas: `lan,tailscale`. There are three ways to set it:
+
+- **From the dashboard** — open it on this computer, click **Network** at the bottom, tick what you want, **Save**.
+  The choice is kept in `kanshi.env` and applied immediately, no restart. (Opened from any other device, the
+  panel is read-only: only the machine itself can widen access.)
+- **A flag** — `kanshi --access lan,tailscale`
+- **The environment or a settings file** — `KANSHI_ACCESS=tailscale` in `.env` (Compose) or `kanshi.env`
+
+Kanshi notices network changes on its own: if Tailscale connects after it starts, or the laptop joins a new
+Wi-Fi network, it starts listening there within 30 seconds. At startup it prints every address it can be opened at.
+
+> **Prefer `tailscale` over `all`.** `all` puts your container list and disk layout in front of anyone who can
+> reach the port. Only use it behind a firewall, or a reverse proxy that asks for a login.
+
+## Settings
+
+Every setting is an environment variable, and can also go in a **`kanshi.env`** file using the same
+`KEY=VALUE` lines ([`.env.example`](.env.example) lists them all). Kanshi reads `kanshi.env` from next to the
+executable, or from your config folder (`%APPDATA%\kanshi\` on Windows, `~/.config/kanshi/` on Linux).
+Precedence is: flag, then environment, then file, then the default.
+
+| Variable | Flag | Default | What it does |
+|---|---|---|---|
+| `KANSHI_ACCESS` | `--access` | `local` | Who can open the dashboard ([above](#who-can-open-it)) |
+| `KANSHI_PORT` | `--port` | `8100` | Port to listen on |
+| `KANSHI_CONFIG` | `--config` | *(see above)* | Path of the settings file |
+| | `--open` | on when double-clicked on Windows | Open the dashboard in the browser at startup |
+| `KANSHI_STORAGE_ROOTS` | | `auto` | Folders in the storage map: `auto`, `path`, or `label=path`, comma-separated. `auto,/srv` adds to the defaults |
+| `KANSHI_STORAGE_EXCLUDE` | | *(none)* | Folders to skip entirely, e.g. `/var/lib/docker` |
+| `KANSHI_STORAGE_INTERVAL` | | `21600` | Seconds a folder's size is trusted before opening the folder above it measures it again |
+| `KANSHI_STORAGE_CPU` | | `25` | Share of one core, in %, measuring folders may use. `100` = unthrottled |
+| `KANSHI_TREE_DEPTH` | | `4` | Folder levels remembered from each measurement; deeper folders are measured when you open them |
+| `KANSHI_STORAGE_CACHE` | | `~/.cache/kanshi/storage.cache`, `%LocalAppData%\kanshi\storage.cache`; `/data/storage.cache` in the image | Where folder sizes are cached, so a restart does not measure them again |
+| `KANSHI_POLL_INTERVAL` | | `5` | Seconds between live updates |
+| `KANSHI_IDLE_TIMEOUT` | | `30` | Seconds with no browser before everything stops |
+| `KANSHI_DOCKER_CONCURRENCY` | | `8` | Parallel container stat requests |
+| `DOCKER_HOST` | | platform default | Docker endpoint: `unix://…`, `npipe://…` or `tcp://…` |
+| `KANSHI_HOST_ROOT` | | *(none; `/hostfs` in the image)* | Where the host's `/` is mounted when running in a container |
+| `KANSHI_WEB_DIR` | | *(embedded)* | Serve the frontend from disk, for frontend development |
+
+`kanshi --help` lists the flags; `kanshi --version` prints the version.
+
+### What the storage map covers
+
+With `KANSHI_STORAGE_ROOTS=auto`:
+
+- **Linux:** `/`, plus every real filesystem mounted at or under `/mnt` (`/mnt/data`, `/mnt/usb`, a NAS share…).
+  Drives mounted later appear on their own.
+- **Windows:** the system drive (`C:\`), your user folder, and every other fixed drive (`D:\`, `E:\`…).
+  Your user folder is inside `C:\`, and both come out of a single pass over the drive.
+
+Nothing is scanned up front. Opening a folder lists it on the spot, and each subfolder's size comes from a small
+cache file; the ones it has never seen, or not for six hours, are measured in the background, at the lowest CPU
+and disk priority and throttled to a quarter of one core. The first visit to `/` still measures most of the disk
+once. After that, opening a folder is instant, restarts included, and only folders someone opens are measured
+again. **Rescan** re-measures the folders on screen.
+
+## Updating
+
+- **Windows / Linux binary:** download the new file from [Releases](https://github.com/rene-roid/kanshi/releases) and replace the old one.
+- **Compose:** `docker compose pull && docker compose up -d`
+- **npx:** `npx @yuuki824/kanshi update`
+
+## Building from source
+
+Go 1.25 or newer is the only requirement: there are no third-party modules.
+
+```sh
+go build .            # the binary for this machine
+go test ./...         # the tests
+GOOS=windows go build -o kanshi.exe .   # cross-compile for Windows from anywhere
+docker compose up -d --build            # build the image from this checkout
+```
+
+The frontend is plain HTML, CSS and JavaScript with no build step, embedded into the binary at compile time.
+Set `KANSHI_WEB_DIR=./web` to serve it from disk while editing.
+
+## Releasing
+
+Releases are made by the **Release** workflow, run by hand: *Actions → Release → Run workflow*, enter a version
+such as `v0.2.0`. It runs the full test suite on Linux and Windows, builds the Windows and Linux executables
+(x64 and ARM64), pushes a multi-arch image to `ghcr.io/rene-roid/kanshi`, and publishes a GitHub release with
+the executables, checksums and install notes. After the very first release, set the package's visibility to
+**Public** under the repository's *Packages* settings so `docker pull` works without logging in.
+
+## API
+
+The page holds one Server-Sent Events connection, `/api/stream`, and the server pushes every update over it —
+nothing polls. The stream is gzip-compressed for browsers that accept it: on a host with 30 containers each
+update is ~16 KB of JSON but about 2 KB on the wire.
+
+| Endpoint | What it returns |
+|---|---|
+| `GET /api/stream` | Live updates: vitals, containers and which folder is being measured |
+| `GET /api/vitals` | CPU, memory, swap, network, disk and volume figures |
+| `GET /api/containers` | Per-container stats |
+| `GET /api/storage` | One summary line per storage root |
+| `GET /api/storage/dir?root=0&path=home/you` | One folder, listed live; subfolders not measured yet come back `pending` and are queued |
+| `POST /api/storage/rescan?root=0&path=home/you` | Re-measures that folder's subfolders; needs the `X-Kanshi: 1` header |
+| `GET /api/access`, `POST /api/access` | The access mode; changing it only works from this computer |
+| `GET /api/config` | Version, OS and intervals |
+| `GET /healthz` | `{"ok":true}` |
+
+## How it works
+
+[docs/design.md](docs/design.md) explains the choices behind it: why it stops when nobody is looking, how the disk
+scan stays fast and polite on both platforms, why container stats use Docker's one-shot mode, and what the
+memory number in `docker stats` actually means.
+
+## License
+
+[AGPL-3.0](LICENSE) © rene-roid

package/bin/kanshi.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+
+const { existsSync } = require('node:fs');
+const { spawnSync } = require('node:child_process');
+const { join } = require('node:path');
+
+const packageRoot = join(__dirname, '..');
+const composeFile = join(packageRoot, 'docker-compose.yml');
+const callerDirectory = process.cwd();
+const args = process.argv.slice(2);
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log(`Usage: npx @yuuki824/kanshi [update | docker-compose arguments]
+
+Starts Kanshi with Docker Compose, using the published image
+(ghcr.io/rene-roid/kanshi). A .env file in the current directory is used when
+present. Common commands:
+  npx @yuuki824/kanshi              start it (pulls the image the first time)
+  npx @yuuki824/kanshi update       pull the newest image and restart
+  npx @yuuki824/kanshi logs -f
+  npx @yuuki824/kanshi down
+  npx @yuuki824/kanshi up -d --build   build from source instead of pulling
+
+Docker and the Docker Compose v2 plugin are required.`);
+  process.exit(0);
+}
+
+const dockerCheck = spawnSync('docker', ['compose', 'version'], { stdio: 'ignore' });
+if (dockerCheck.error || dockerCheck.status !== 0) {
+  console.error('Kanshi requires Docker with the Docker Compose v2 plugin.');
+  console.error('Install Docker first, then run this command again.');
+  process.exit(1);
+}
+
+const composeArgs = [
+  'compose',
+  '--project-directory', packageRoot,
+  '--project-name', 'kanshi',
+  '--file', composeFile,
+];
+
+const envFile = join(callerDirectory, '.env');
+if (callerDirectory !== packageRoot && existsSync(envFile)) {
+  composeArgs.push('--env-file', envFile);
+}
+
+function compose(extra) {
+  const result = spawnSync('docker', composeArgs.concat(extra), { stdio: 'inherit' });
+  if (result.error) {
+    console.error(`Could not start Docker: ${result.error.message}`);
+    process.exit(1);
+  }
+  return result.status ?? 1;
+}
+
+if (args.length === 0) {
+  process.exit(compose(['up', '--detach']));
+}
+if (args.length === 1 && args[0] === 'update') {
+  const pulled = compose(['pull']);
+  process.exit(pulled === 0 ? compose(['up', '--detach']) : pulled);
+}
+process.exit(compose(args));

package/docker-compose.yml

@@ -0,0 +1,84 @@
+services:
+  kanshi:
+    # Pulls the published image. `docker compose up -d --build` builds it from
+    # this checkout instead.
+    image: ghcr.io/rene-roid/kanshi:${KANSHI_VERSION:-latest}
+    build: .
+    container_name: kanshi
+    restart: unless-stopped
+
+    # Host networking for two reasons: /proc/net/dev is namespaced, so it is the
+    # only way to report real host network throughput, and it lets Kanshi listen
+    # on the host's own LAN and Tailscale addresses.
+    network_mode: host
+
+    environment:
+      # Who can open the dashboard. localhost always works; add lan, tailscale
+      # (comma-separated), or all. Empty means local only.
+      KANSHI_ACCESS: "${KANSHI_ACCESS:-}"
+      # The older way to say the same thing, still honoured if set.
+      KANSHI_HOST: "${KANSHI_HOST:-}"
+      KANSHI_PORT: "${KANSHI_PORT:-8100}"
+
+      # Live poll cadence. Each tick is one /containers/json plus one /stats per
+      # running container, so keep this conservative.
+      KANSHI_POLL_INTERVAL: "${KANSHI_POLL_INTERVAL:-5}"
+      KANSHI_DOCKER_CONCURRENCY: "${KANSHI_DOCKER_CONCURRENCY:-8}"
+      # Polling stops entirely once no browser has been connected this long.
+      KANSHI_IDLE_TIMEOUT: "${KANSHI_IDLE_TIMEOUT:-30}"
+
+      # Storage map. "auto" is the host's / plus every drive mounted under /mnt.
+      KANSHI_STORAGE_ROOTS: "${KANSHI_STORAGE_ROOTS:-auto}"
+      # A cached folder size older than this many seconds is measured again
+      # the next time the folder around it is opened.
+      KANSHI_STORAGE_INTERVAL: "${KANSHI_STORAGE_INTERVAL:-21600}"
+      # Host paths to skip. /var/lib/docker is ~100k overlay2 files and
+      # dominates the walk time — set it here to trim the walk.
+      KANSHI_STORAGE_EXCLUDE: "${KANSHI_STORAGE_EXCLUDE:-}"
+      # Share of one core, in percent, the walk may average. 100 = unthrottled.
+      KANSHI_STORAGE_CPU: "${KANSHI_STORAGE_CPU:-25}"
+      KANSHI_TREE_DEPTH: "${KANSHI_TREE_DEPTH:-4}"
+
+      # Give the GC a budget below mem_limit so a walk on an unusually large
+      # filesystem degrades into more collection rather than an OOM kill.
+      GOMEMLIMIT: "80MiB"
+      # Two Ps is plenty for a 5s poll loop and one walk, and it keeps the Go
+      # scheduler from spreading across all four cores of a busy box.
+      GOMAXPROCS: "2"
+
+    volumes:
+      # Read-only on the socket is a mount flag, not an API restriction — it is
+      # the access mode above that keeps this out of reach.
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      # The whole host, read-only. rslave lets a drive mounted under /mnt after
+      # the container started show up here too, without a restart.
+      - /:/hostfs:ro,rslave
+      # The folder size cache, so a restart or an update does not walk the
+      # disk again.
+      - kanshi-data:/data
+
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m
+    cap_drop: [ALL]
+    # Read/traverse bypass only — it does NOT grant write bypass (that would be
+    # DAC_OVERRIDE). Without it the walk cannot enter home directories (0750)
+    # and silently under-reports the root filesystem.
+    cap_add: [DAC_READ_SEARCH]
+    security_opt:
+      - no-new-privileges:true
+
+    # Stays out of the way of everything else on a small box. Steady state is
+    # ~0.03% of one core; the ceiling is headroom for the walk.
+    cpus: "1.0"
+    # Measured peak during a full walk of a 2 TB host is ~20 MiB of heap, and
+    # ~8 MiB at rest. The rest of this is reclaimable page cache the walk pulls
+    # in, which the kernel drops again the moment anything else wants it.
+    mem_limit: 96m
+
+    logging:
+      driver: json-file
+      options: { max-size: "10m", max-file: "3" }
+
+volumes:
+  kanshi-data:

package/go.mod

@@ -0,0 +1,3 @@
+module github.com/rene-roid/kanshi
+
+go 1.25

package/internal/access/access.go

@@ -0,0 +1,275 @@
+// Package access decides which addresses the dashboard listens on.
+//
+// Kanshi has no login, so who can reach it is decided entirely by where it
+// listens. Loopback is always on: whatever else is chosen, the machine itself
+// can open http://localhost:<port>. On top of that the mode can add the
+// machine's Tailscale addresses, its private LAN addresses (wired and Wi-Fi),
+// explicit addresses, or every interface at once.
+package access
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+	"sort"
+	"strings"
+)
+
+// Mode is a parsed access setting. The zero value is "local".
+type Mode struct {
+	LAN       bool
+	Tailscale bool
+	All       bool
+	IPs       []netip.Addr
+}
+
+// Parse reads a comma-separated list such as "lan,tailscale". Explicit IP
+// addresses may be mixed in. An empty string is "local".
+func Parse(spec string) (Mode, error) {
+	var m Mode
+	for _, tok := range strings.Split(spec, ",") {
+		tok = strings.ToLower(strings.TrimSpace(tok))
+		switch tok {
+		case "", "local", "localhost", "loopback":
+		case "lan", "wlan", "wifi", "network":
+			m.LAN = true
+		case "tailscale", "ts", "tailnet":
+			m.Tailscale = true
+		case "all", "any", "everywhere", "*", "0.0.0.0", "::", "[::]":
+			m.All = true
+		default:
+			ip, err := netip.ParseAddr(strings.Trim(tok, "[]"))
+			if err != nil {
+				return Mode{}, fmt.Errorf("unknown access mode %q (want local, lan, tailscale, all or an IP address)", tok)
+			}
+			ip = ip.Unmap()
+			if ip.IsUnspecified() {
+				m.All = true
+			} else if !ip.IsLoopback() && !contains(m.IPs, ip) {
+				m.IPs = append(m.IPs, ip)
+			}
+		}
+	}
+	return m, nil
+}
+
+// String is the canonical spelling, which Parse reads back unchanged.
+func (m Mode) String() string {
+	if m.All {
+		return "all"
+	}
+	var parts []string
+	if m.LAN {
+		parts = append(parts, "lan")
+	}
+	if m.Tailscale {
+		parts = append(parts, "tailscale")
+	}
+	for _, ip := range m.IPs {
+		parts = append(parts, ip.String())
+	}
+	if len(parts) == 0 {
+		return "local"
+	}
+	return strings.Join(parts, ",")
+}
+
+// dynamic reports whether the set of addresses depends on the machine's
+// interfaces, and so has to be re-checked as they come and go.
+func (m Mode) dynamic() bool {
+	return !m.All && (m.LAN || m.Tailscale || len(m.IPs) > 0)
+}
+
+// Kind labels an address for the startup banner and the dashboard footer.
+type Kind string
+
+const (
+	KindLocal     Kind = "local"
+	KindLAN       Kind = "lan"
+	KindTailscale Kind = "tailscale"
+	KindAll       Kind = "all"
+	KindCustom    Kind = "custom"
+	KindOther     Kind = "other"
+)
+
+// Endpoint is one address to listen on.
+type Endpoint struct {
+	Addr netip.Addr
+	Kind Kind
+}
+
+// Interface is the part of a network interface that classification needs.
+type Interface struct {
+	Name     string
+	Up       bool
+	Loopback bool
+	Addrs    []netip.Addr
+}
+
+var (
+	tailnet4 = netip.MustParsePrefix("100.64.0.0/10")
+	tailnet6 = netip.MustParsePrefix("fd7a:115c:a1e0::/48")
+	loop4    = netip.AddrFrom4([4]byte{127, 0, 0, 1})
+	loop6    = netip.IPv6Loopback()
+)
+
+// IsTailscale reports whether an address is in the ranges Tailscale assigns.
+// It is decided by address rather than interface name, because the adapter is
+// "tailscale0" on Linux and "Tailscale" on Windows.
+func IsTailscale(a netip.Addr) bool {
+	return tailnet4.Contains(a) || tailnet6.Contains(a)
+}
+
+// isLAN is a private address that another machine on the local network could
+// actually connect to: RFC 1918 for IPv4 and unique-local for IPv6.
+// Link-local addresses are left out because they are unusable without a zone,
+// and public addresses because they are not "the LAN".
+func isLAN(a netip.Addr) bool {
+	return a.IsPrivate() && !IsTailscale(a)
+}
+
+// isVirtual matches interfaces that carry private addresses but are not the
+// LAN: Docker and libvirt bridges, container veths, VPN tunnels, and the
+// Hyper-V switches Windows creates for WSL and Docker Desktop. Listening there
+// would only expose the dashboard to containers and VMs.
+func isVirtual(name string) bool {
+	n := strings.ToLower(name)
+	for _, p := range []string{"docker", "veth", "virbr", "vnet", "cni", "flannel", "cali", "kube", "podman", "lxc", "lxd", "tailscale", "tun", "tap", "wg", "zt", "vethernet", "vmnet"} {
+		if strings.HasPrefix(n, p) {
+			return true
+		}
+	}
+	// Compose networks are "br-" plus 12 hex digits. A plain "br0" is more
+	// likely a real LAN bridge, so it is left alone.
+	if strings.HasPrefix(n, "br-") && len(n) == 15 {
+		return true
+	}
+	for _, s := range []string{"virtualbox", "vmware", "hyper-v", "wsl", "loopback pseudo"} {
+		if strings.Contains(n, s) {
+			return true
+		}
+	}
+	return false
+}
+
+// classify says what kind of address a is on the named interface, or false
+// when it is neither loopback, LAN nor Tailscale.
+func classify(iface Interface, a netip.Addr) (Kind, bool) {
+	switch {
+	case a.IsLoopback():
+		return KindLocal, true
+	case IsTailscale(a):
+		return KindTailscale, true
+	case isVirtual(iface.Name) || a.IsLinkLocalUnicast():
+		return "", false
+	case isLAN(a):
+		return KindLAN, true
+	}
+	return KindOther, true
+}
+
+// Endpoints lists the addresses a mode listens on, given the current
+// interfaces.
+func (m Mode) Endpoints(ifaces []Interface) []Endpoint {
+	if m.All {
+		// The wildcards already cover loopback. Binding 127.0.0.1 as well
+		// would collide with 0.0.0.0 on the same port.
+		return []Endpoint{
+			{netip.IPv4Unspecified(), KindAll},
+			{netip.IPv6Unspecified(), KindAll},
+		}
+	}
+	out := []Endpoint{{loop4, KindLocal}, {loop6, KindLocal}}
+	have := map[netip.Addr]bool{loop4: true, loop6: true}
+	add := func(a netip.Addr, k Kind) {
+		if !have[a] {
+			have[a] = true
+			out = append(out, Endpoint{a, k})
+		}
+	}
+	for _, iface := range ifaces {
+		if !iface.Up || iface.Loopback {
+			continue
+		}
+		for _, a := range iface.Addrs {
+			switch k, ok := classify(iface, a); {
+			case !ok:
+			case k == KindTailscale && m.Tailscale, k == KindLAN && m.LAN:
+				add(a, k)
+			}
+		}
+	}
+	for _, ip := range m.IPs {
+		add(ip, KindCustom)
+	}
+	return out
+}
+
+// Reachable lists the addresses a wildcard listener can be reached on, for
+// display. Loopback comes first, then Tailscale, then LAN, then anything else.
+func Reachable(ifaces []Interface) []Endpoint {
+	out := []Endpoint{{loop4, KindLocal}}
+	for _, iface := range ifaces {
+		if !iface.Up || iface.Loopback {
+			continue
+		}
+		for _, a := range iface.Addrs {
+			if k, ok := classify(iface, a); ok && k != KindLocal {
+				out = append(out, Endpoint{a, k})
+			}
+		}
+	}
+	rank := map[Kind]int{KindLocal: 0, KindTailscale: 1, KindLAN: 2, KindCustom: 3, KindOther: 4}
+	sort.SliceStable(out, func(i, j int) bool { return rank[out[i].Kind] < rank[out[j].Kind] })
+	return out
+}
+
+// SystemInterfaces reads the machine's interfaces. Virtual ones are dropped
+// before their addresses are fetched: a Docker host can have dozens of veths,
+// and each Addrs call is a separate netlink round trip.
+func SystemInterfaces() []Interface {
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return nil
+	}
+	out := make([]Interface, 0, len(ifaces))
+	for _, ni := range ifaces {
+		iface := Interface{
+			Name:     ni.Name,
+			Up:       ni.Flags&net.FlagUp != 0,
+			Loopback: ni.Flags&net.FlagLoopback != 0,
+		}
+		if !iface.Up || iface.Loopback {
+			continue
+		}
+		// Tailscale's own adapter matches isVirtual, so it is kept by name.
+		lower := strings.ToLower(ni.Name)
+		if isVirtual(ni.Name) && !strings.Contains(lower, "tailscale") && !strings.HasPrefix(lower, "utun") {
+			continue
+		}
+		addrs, err := ni.Addrs()
+		if err != nil {
+			continue
+		}
+		for _, a := range addrs {
+			ipnet, ok := a.(*net.IPNet)
+			if !ok {
+				continue
+			}
+			if ip, ok := netip.AddrFromSlice(ipnet.IP); ok {
+				iface.Addrs = append(iface.Addrs, ip.Unmap())
+			}
+		}
+		out = append(out, iface)
+	}
+	return out
+}
+
+func contains(list []netip.Addr, a netip.Addr) bool {
+	for _, x := range list {
+		if x == a {
+			return true
+		}
+	}
+	return false
+}