blockyard 0.0.9 → 0.1.0

package/server/config.js

@@ -27,9 +27,13 @@ Defaults are Bitcoin Core's own, so \`npm start\` works against a stock local no
 
 const DEFAULTS = {
   server: {
-    // Multi-user means the LAN has to reach it, so it binds broadly by default.
-    // Set BLOCKYARD_BIND=127.0.0.1 to keep it on this machine only.
-    host: '0.0.0.0',
+    // THIS MACHINE ONLY, out of the box (2026-09-15, after the first outside review of 0.0.9:
+    // "Default is 0.0.0.0 with auth disabled, so anyone that can hit port 21000 gets node state
+    // plus the read RPC console ... I would run it only bound to 127.0.0.1, with BLOCKYARD_AUTH=1,
+    // behind SSH/TLS" -- operator: "Update the default setup to be hardened"). It bound 0.0.0.0
+    // because multi-user means the LAN has to reach it; now reaching it from elsewhere is a
+    // decision you make -- BLOCKYARD_BIND=0.0.0.0, or a LAN address, or `blockyard setup`.
+    host: '127.0.0.1',
     // 21000 (operator, 2026-09-13: "make default web port 21000 for access"). It was 8088, which
     // sits in the range every other monitor on a box reaches for; this one is ours.
     port: 21000,
@@ -37,15 +41,19 @@ const DEFAULTS = {
     allowCidrs: [],
     trustProxy: false,
     // TLS is off unless both files are named, and then it is on for every listener.
-    // It stays opt-in because this box is a LAN monitor whose certificate has no
-    // issuer: a self-signed cert produces a browser warning on every address change,
-    // and the alternative already documented (an SSH tunnel to 127.0.0.1, or a
-    // reverse proxy that owns the cert) is better on a machine you control.
-    // What was missing until 2026-09-09 was the option at all -- serving a session
-    // cookie and every RPC reply over plain HTTP on a LAN is not a gap you get to
-    // call "documented, therefore fine".
+    // It was opt-in because a self-signed certificate produces a browser warning per
+    // address and an SSH tunnel or a reverse proxy that owns a real certificate is better
+    // on a machine you control. What was missing until 2026-09-09 was the option at all --
+    // serving a session cookie and every RPC reply over plain HTTP on a LAN is not a gap
+    // you get to call "documented, therefore fine".
+    // HTTPS BY DEFAULT since 2026-09-15 (operator: "make https the forced default"): with
+    // no certificate of your own named, the server makes a self-signed one on first start
+    // (server/tls/selfsigned.js, kept under <data>/tls) naming the addresses it is reached
+    // on, and serves HTTPS with it. BLOCKYARD_TLS=0 (server.tls.enabled: false) is the way
+    // to plain HTTP, for a reverse proxy that terminates TLS in front.
     tls: {
-      cert: null,   // PEM; BLOCKYARD_TLS_CERT
+      enabled: true,
+      cert: null,   // PEM; BLOCKYARD_TLS_CERT -- your own certificate, instead of the made one
       key: null,    // PEM; BLOCKYARD_TLS_KEY
       // Sent over TLS responses only. Two days, not the usual year: a LAN address
       // can be reissued to something else, and HSTS is the header that cannot be
@@ -193,10 +201,11 @@ const DEFAULTS = {
     auditKeep: 5,
   },
   auth: {
-    // OPEN BY DEFAULT, like a block explorer: anyone who can reach the listen
-    // addresses reads the dashboard with no account. This is a posture decision, not
-    // a convenience -- see README "Open by default" and the boot warning, which names
-    // the addresses this leaves readable.
+    // SIGN-IN BY DEFAULT (2026-09-15, the same review): the first start creates an `admin`
+    // account and prints its password once (or takes BLOCKYARD_ADMIN_PASSWORD). It shipped OPEN,
+    // like a block explorer, so that anyone who could reach the port could read; that is still
+    // available -- BLOCKYARD_AUTH=0, or auth.enabled: false -- as a posture you choose, announced
+    // by the boot warning that names the addresses it leaves readable.
     //
     // What "open" is bounded by, in server/http/server.js:
     //   * the anonymous role is `viewer` and the ceiling is not configurable; user
@@ -207,9 +216,9 @@ const DEFAULTS = {
     //     should discover by accident);
     //   * rate limits key on the IP, so one noisy tab cannot spend everyone's bucket.
     //
-    // Set BLOCKYARD_AUTH=1 (or auth.enabled in config/local.json) for accounts, roles,
-    // sessions, CSRF and the audit trail-by-user.
-    enabled: false,
+    // Accounts, roles, sessions, CSRF and the audit trail-by-user are on; BLOCKYARD_AUTH=0
+    // (or auth.enabled: false in config/local.json) opens the monitor to readers.
+    enabled: true,
     dataDir: null,
     // THE LONG ONE IS THE ABSOLUTE LIFETIME, the short one the idle ceiling -- which is the way
     // round the names read, and the opposite of what shipped until 2026-09-13. With an 8 h
@@ -273,7 +282,11 @@ const DEFAULTS = {
   },
   // The Markets tab (server/collect/markets.js): public exchange APIs over HTTPS -- the one
   // outbound connection that is not the node. Polled only while someone has the tab open, and
-  // parked idleAfterMs after the last request. BLOCKYARD_MARKETS=0 turns it off.
+  // parked idleAfterMs after the last request. BLOCKYARD_MARKETS=0 removes it altogether.
+  // POLLING IS OFF OUT OF THE BOX regardless (operator, 2026-09-15: "disable markets by default so
+  // we can claim true zero telemetry out of the box" ... "an app wide 'Enable Market Polling'
+  // checkbox"): the feed is built here but asks nobody anything until the switch in Display
+  // settings -> Markets & Price -> Enable market polling is on (http/api.js marketsPollingOn).
   markets: {
     enabled: true,
     tickerMs: 15000,
@@ -395,6 +408,7 @@ export function loadConfig({ configFile = defaultConfigFile(), ifaces = null, no
     'BLOCKYARD_LOG_SOURCE': ['log.enabled', Boolean],
     'BLOCKYARD_MARKETS': ['markets.enabled', Boolean],
     'BLOCKYARD_SECURE_COOKIE': ['auth.secureCookie', Boolean],
+    'BLOCKYARD_TLS': ['server.tls.enabled', Boolean],
     'BLOCKYARD_TLS_CERT': ['server.tls.cert', String],
     'BLOCKYARD_TLS_KEY': ['server.tls.key', String],
     'BLOCKYARD_ACTIONS': ['actions.allow', (v) => v.split(',').map((s) => s.trim()).filter(Boolean)],
@@ -493,8 +507,12 @@ export function configProblems() { return problems; }
 function validateTls(cfg, now = Date.now()) {
   const tls = cfg.server.tls ?? {};
   cfg.server.tls = tls;
-  cfg.tls = Boolean(tls.cert || tls.key);
-  if (!cfg.tls) return;
+  if (tls.enabled === false) { cfg.tls = false; cfg.__tlsAuto = false; return; }   // plain HTTP, chosen
+  cfg.tls = true;
+  // no certificate named: the server makes its own at boot (main.js, ensureSelfSigned) and
+  // inspects it then -- so nothing below applies yet
+  if (!tls.cert && !tls.key) { cfg.__tlsAuto = true; return; }
+  cfg.__tlsAuto = false;
   if (!tls.cert || !tls.key) {
     problems.push(`server.tls needs BOTH cert and key (got ${tls.cert ? 'cert only' : 'key only'}); a half-configured TLS would fall back to plaintext on a port you believe is HTTPS`);
     return;
@@ -507,6 +525,12 @@ function validateTls(cfg, now = Date.now()) {
     }
   }
   if (problems.length) return;
+  inspectTls(cfg, tls, now);
+}
+
+// read the certificate: fingerprint, expiry, whether it is self-signed; problems for an
+// unparseable or expired one, a note for one about to expire
+export function inspectTls(cfg, tls, now = Date.now()) {
   try {
     const x = new crypto.X509Certificate(fs.readFileSync(tls.cert, 'utf8'));
     tls.fingerprint = x.fingerprint256;
@@ -530,7 +554,7 @@ function validate(cfg, ifaces = null, now = Date.now()) {
   if (!Number.isInteger(cfg.server.port) || cfg.server.port < 1 || cfg.server.port > 65535) problems.push('server.port invalid');
   // `hosts` is the truth: one address, a comma list, or an array all normalise here.
   // `host` stays populated with the first entry for anything that still reads it.
-  cfg.server.hosts = hostList(cfg.server.hosts ?? cfg.server.host ?? '0.0.0.0');
+  cfg.server.hosts = hostList(cfg.server.hosts ?? cfg.server.host ?? '127.0.0.1');
   cfg.server.host = cfg.server.hosts[0];
   if (!cfg.server.hosts.length) problems.push('server.hosts is empty; nothing would be served');
   // A hostname here binds whatever DNS says at boot, and fails at listen() with a

package/server/http/api.js

@@ -12,8 +12,36 @@ import { xSearch, xTx, xBlock, xAddress } from './explorer.js';
 
 // Dollar figures for the explorer: a spot price if one is at hand within 1.5 s -- never a slower
 // page for want of one (server/collect/markets.js spot()).
+// THE MARKET SWITCH (operator, 2026-09-15: "disable markets by default so we can claim true zero
+// telemetry out of the box" ... "an app wide 'Enable Market Polling' checkbox"). Two layers:
+//   - BLOCKYARD_MARKETS=0 (markets.enabled=false) removes the feed from the server altogether;
+//     nothing in the browser can turn it on. For machines that must never reach out.
+//   - otherwise the feed exists but polls only while the Display setting
+//     markets.polling is on -- and that ships OFF, so a fresh install makes no outbound
+//     connection but to the node until someone ticks the box.
+// The setting lives in the server's settings file (config/blockyard.json, the same one every
+// screen shares); it is read here per request, cached on the file's mtime and size, so a tick in
+// the panel takes effect on the next call without a restart -- and the next call also PARKS the
+// feed, so unticking stops the exchange traffic at once rather than ten minutes later.
+const MARKETS_OFF = 'market data is off on this server (BLOCKYARD_MARKETS=0 or markets.enabled=false); the switch in Display settings cannot turn it on';
+const POLLING_OFF = 'market polling is off -- the default, so that out of the box this monitor makes no outbound connection but to your node. Turn it on under Display settings → Markets & Price → Enable market polling';
+const pollingCache = new WeakMap();
+export async function marketsPollingOn(app) {
+  const file = app.settingsFile;
+  if (!file) return false;
+  let st;
+  try { st = await fsp.stat(file); } catch { return false; }
+  const hit = pollingCache.get(app);
+  if (hit && hit.mtimeMs === st.mtimeMs && hit.size === st.size) return hit.value;
+  let value = false;
+  try { value = JSON.parse(await fsp.readFile(file, 'utf8'))?.markets?.polling === true; } catch { value = false; }
+  pollingCache.set(app, { mtimeMs: st.mtimeMs, size: st.size, value });
+  return value;
+}
+const pollingOff = (app) => { app.markets?.stop?.(); return { ok: true, enabled: false, polling: false, note: POLLING_OFF }; };
+
 async function withUsd(app, r) {
-  if (!r?.ok || !app.markets) return r;
+  if (!r?.ok || !app.markets || !(await marketsPollingOn(app))) return r;
   const p = await Promise.race([app.markets.spot().catch(() => null), new Promise((res) => { setTimeout(res, 1500, null).unref?.(); })]);
   return { ...r, usd: p?.usd ?? null };
 }
@@ -425,17 +453,33 @@ export const routes = [
   // Exchange prices (server/collect/markets.js). Asking is what keeps the feed polling.
   {
     method: 'GET', path: '/api/markets', auth: 'any',
-    handler: (ctx, app) => {
-      if (!app.markets) return { ok: true, enabled: false, note: 'market data is off on this monitor (BLOCKYARD_MARKETS=0 or markets.enabled=false)' };
+    handler: async (ctx, app) => {
+      if (!app.markets) return { ok: true, enabled: false, note: MARKETS_OFF };
+      if (!(await marketsPollingOn(app))) return pollingOff(app);
       app.markets.touch();
       return app.markets.view();
     },
   },
+  // THE SPOT PRICE, for dollar figures on pages that are not Markets (the Mining tab's reward
+  // stats, 2026-09-15: "Add dollar figures"): the feed's median while it is polling, else the
+  // explorer's cached spot read (two exchanges, at most once a minute) -- and null, saying why,
+  // while market polling is off. Does NOT touch the feed: asking the price here never starts
+  // the week-long polling that Markets does.
+  {
+    method: 'GET', path: '/api/price', auth: 'any',
+    handler: async (ctx, app) => {
+      if (!app.markets) return { ok: true, usd: null, enabled: false, note: MARKETS_OFF };
+      if (!(await marketsPollingOn(app))) return { ok: true, usd: null, polling: false, note: POLLING_OFF };
+      const p = await Promise.race([app.markets.spot().catch(() => null), new Promise((res) => { setTimeout(res, 1500, null).unref?.(); })]);
+      return { ok: true, usd: p?.usd ?? null, at: p?.at ?? null, source: p?.source ?? null };
+    },
+  },
   // The depth chart: the books as cumulative depth, and the snapshot `ago` seconds earlier.
   {
     method: 'GET', path: '/api/markets/depth', auth: 'any',
-    handler: (ctx, app) => {
-      if (!app.markets) return { ok: true, enabled: false, note: 'market data is off on this monitor (BLOCKYARD_MARKETS=0 or markets.enabled=false)' };
+    handler: async (ctx, app) => {
+      if (!app.markets) return { ok: true, enabled: false, note: MARKETS_OFF };
+      if (!(await marketsPollingOn(app))) return pollingOff(app);
       app.markets.touch();
       return app.markets.depthView(Number(ctx.query.ago) || 600);
     },

package/server/http/games.js

@@ -0,0 +1,77 @@
+// THE GAME FILES (operator, 2026-09-15: "I've added doom_dos to the project directory. Get DOOM
+// working as a diversion inside blockyard with zero dependancies"; later "move doom_dos out of the
+// root and move into games", and "get Quake working as a diversion").
+//
+// The DOS Diversions run shareware DOOM and Quake in a PC emulated in the browser (public/js/x86.js,
+// dospc.js, soundcard.js), and the emulator needs the games' own files. They live in games/, one
+// directory a game, where the operator put them -- not in public/, which is the app and is stamped
+// with a build id computed over every file in it (18 MB of PAK in that digest, re-hashed every two
+// seconds of page loads, would be a cost paid by every page for two diversions).
+//
+// Served under /games/<game>/<path>, and only that: a game this file names, and a DOS path of at
+// most one directory and an 8.3 name of a kind the games read (an executable, a WAD, a PAK, a
+// config, Wolfenstein 3D's .WL1 data). No dots but the one in each name, so there is no path to
+// traverse; the lookup is
+// case-insensitive because DOS names are, and the files on disk are upper-case while a browser asks
+// for whatever it was told.
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { securityHeaders } from './static.js';
+
+/** Each game's directory under the games root. */
+export const GAME_DIRS = Object.freeze({ wolf3d: 'wolf3d_dos', doom: 'doom_dos', quake: 'quake_dos' });
+
+export const GAME_PATH = /^\/games\/([a-z0-9]+)\/((?:[A-Za-z0-9_-]{1,8}\/)?[A-Za-z0-9_-]{1,8}\.(?:wad|exe|cfg|pak|wl1))$/i;
+
+/** The file under `dir` at the DOS path `rel` ("ID1/PAK0.PAK"), matching each part ignoring case, or null. */
+export async function findGameFile(dir, rel) {
+  let at = dir;
+  const parts = rel.split('/');
+  for (let i = 0; i < parts.length; i++) {
+    let names;
+    try { names = await fsp.readdir(at, { withFileTypes: true }); } catch { return null; }
+    const want = parts[i].toUpperCase(), last = i === parts.length - 1;
+    const hit = names.find((e) => (last ? e.isFile() : e.isDirectory()) && e.name.toUpperCase() === want);
+    if (!hit) return null;
+    at = path.join(at, hit.name);
+  }
+  return at;
+}
+
+/**
+ * Answer a /games/ request. Returns { status } when it answered, or null when the path is not one
+ * of ours (the caller's 404 applies).
+ */
+export async function serveGame(req, res, urlPath, root, { tls = false, hstsMs = 0 } = {}) {
+  const m = GAME_PATH.exec(urlPath);
+  if (!m || !Object.hasOwn(GAME_DIRS, m[1])) return null;
+  const dirName = GAME_DIRS[m[1]];
+  const file = await findGameFile(path.join(root, dirName), m[2]);
+  const headers = securityHeaders({ tls, hstsMs });
+  if (!file) {
+    res.writeHead(404, { ...headers, 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store' });
+    res.end(req.method === 'HEAD' ? undefined : `${m[2].toUpperCase()} is not in games/${dirName}/`);
+    return { status: 404 };
+  }
+  const st = await fsp.stat(file);
+  const etag = `W/"${st.size.toString(16)}-${Math.floor(st.mtimeMs).toString(16)}"`;
+  if (req.headers['if-none-match'] === etag) {
+    res.writeHead(304, { ...headers, ETag: etag, 'Cache-Control': 'no-cache' });
+    res.end();
+    return { status: 304 };
+  }
+  res.writeHead(200, {
+    ...headers,
+    'Content-Type': 'application/octet-stream',
+    'Content-Length': st.size,
+    'Cache-Control': 'no-cache',
+    ETag: etag,
+    'Last-Modified': new Date(st.mtimeMs).toUTCString(),
+  });
+  if (req.method === 'HEAD') { res.end(); return { status: 200 }; }
+  const { createReadStream } = await import('node:fs');
+  const stream = createReadStream(file);
+  stream.on('error', () => res.destroy());
+  stream.pipe(res);
+  return { status: 200 };
+}

package/server/http/server.js

@@ -7,6 +7,7 @@ import http from 'node:http';
 import https from 'node:https';
 import { URL } from 'node:url';
 import { StaticFiles, SECURITY_HEADERS, securityHeaders } from './static.js';
+import { serveGame } from './games.js';
 import { routes, HttpError } from './api.js';
 import { parseCookies, serializeCookie, csrfOk } from '../auth/sessions.js';
 import { ipDecision } from '../netinfo.js';
@@ -136,6 +137,13 @@ export function createAppServer(app) {
         return res.end();
       }
       if (req.method !== 'GET' && req.method !== 'HEAD') return sendJson(req, res, 405, { error: { message: 'method not allowed', kind: 'method' } });
+      // The DOS Diversions' game files (http/games.js). Behind the session when accounts are on:
+      // twenty megabytes of somebody else's games are not a public asset of this monitor.
+      if (path.startsWith('/games/')) {
+        if (!openAccess && !resolveSession(req, app)) return sendJson(req, res, 401, { error: { message: 'authentication required', kind: 'auth' }, login: '/login' });
+        const done = await serveGame(req, res, path, app.gamesDir, { tls: app.tls, hstsMs });
+        if (done) { app.access({ req, res, path, status: done.status, ms: Date.now() - started, ip, user: null }); return undefined; }
+      }
       const out = await statics.serve(req, res, path);
       if (out?.error) return serveStaticError(req, res, statics, path, out.error, H());
       app.access({ req, res, path, status: out?.status ?? 200, ms: Date.now() - started, ip, user: null });

package/server/main.js

@@ -12,6 +12,9 @@ import { createAppServer } from './http/server.js';
 import { computeBuildId } from './http/static.js';
 import { NodeMonitor } from './collect/monitor.js';
 import { localAddresses, bindProblemMessage, planBinds } from './netinfo.js';
+import { ensureSelfSigned } from './tls/selfsigned.js';
+import { inspectTls } from './config.js';
+import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 
 // ONE PLACE, NOT TWO. This was a literal here AND a "version" field in package.json, and on
@@ -49,6 +52,8 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
     ),
     startedAt: Date.now(),
     publicDir: path.join(ROOT, 'public'),
+    // the DOS Diversions' game files, a directory a game, where the operator put them (http/games.js)
+    gamesDir: path.join(ROOT, 'games'),
     monitors: new Map(),
     stateSeq: 0,
     rssStart: process.memoryUsage().rss,
@@ -66,6 +71,18 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
   // Decided here, before any listener exists, and the cookie follows it: a Secure
   // cookie on an HTTP listener is a cookie the browser will not send, which reads
   // as "login keeps failing" -- so the two settings must not be independently set.
+  // HTTPS BY DEFAULT (2026-09-15): no certificate named means the monitor's own, made here on
+  // first start under <data>/tls and kept, naming every address it can be reached on -- the
+  // bound hosts, this machine's addresses, its hostname, localhost -- and remade when it nears
+  // expiry or stops naming a bound host. BLOCKYARD_TLS=0 is plain HTTP.
+  if (cfg.__tlsAuto) {
+    const bound = (cfg.server.hosts ?? [cfg.server.host]).filter((h) => h && h !== '0.0.0.0' && h !== '::');
+    const sans = ['localhost', os.hostname(), '127.0.0.1', '::1', ...bound, ...localAddresses().map((a) => a.address)];
+    const made = ensureSelfSigned(path.join(cfg.store.dir, 'tls'), { sans, mustName: bound });
+    cfg.server.tls.cert = made.certFile; cfg.server.tls.key = made.keyFile;
+    if (made.made) app.log({ level: 'warn', msg: `made this monitor's own self-signed certificate (${made.why}) at ${made.certFile}, valid to ${new Date(made.notAfter).toISOString().slice(0, 10)}, for ${made.sans.join(', ')} -- browsers warn once per address; name your own with BLOCKYARD_TLS_CERT/KEY, or BLOCKYARD_TLS=0 behind a proxy that terminates TLS` });
+    inspectTls(cfg, cfg.server.tls);   // fingerprint, expiry note, self-signed flag for the log line below
+  }
   app.tls = Boolean(cfg.server.tls?.cert && cfg.server.tls?.key);
   if (app.tls) {
     app.tlsOptions = {
@@ -77,7 +94,8 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
       app.log({ level: 'info', msg: 'TLS is on, so the session cookie is now Secure (a Secure cookie over plain HTTP is never sent, which looks like a login that will not stick)' });
     }
     app.log({ level: 'warn', msg: `TLS on (fingerprint ${String(cfg.server.tls.fingerprint).slice(0, 17)}…${cfg.server.tls.selfSigned ? ', self-signed: expect a browser warning the first time per address' : ''})${cfg.__tlsExpiring ? `; WARNING ${cfg.__tlsExpiring}` : ''}` });
-  } else if (cfg.auth.enabled) {
+  } else if (cfg.auth.enabled && !(cfg.server.hosts ?? [cfg.server.host]).every((h) => LOOPBACK.has(h))) {
+    // (not said for a loopback-only bind -- the default now -- where nothing crosses the LAN)
     app.log({ level: 'warn', msg: 'serving HTTP, not HTTPS: the session cookie and every RPC reply cross the LAN in the clear. Either put a TLS terminator in front (then BLOCKYARD_SECURE_COOKIE=1), name server.tls.cert/key, or bind 127.0.0.1 and use an SSH tunnel -- see README, "TLS, or the lack of it".' });
   }
   app.scheme = app.tls ? 'https' : 'http';
@@ -128,7 +146,7 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
     const where = (cfg.server.hosts ?? [cfg.server.host]).join(', ') || '(wildcard)';
     app.log({
       level: 'warn',
-      msg: `NO SIGN-IN (auth.enabled=false, the default): anyone who can reach ${where}:${cfg.server.port} reads this monitor — charts, the event feed, peer and mempool detail, and the read-only RPC console — as role "viewer". Not open to them: user administration, the audit trail, password changes, and node writes (set BLOCKYARD_AUTH=1 for accounts, roles, sessions and CSRF).`,
+      msg: `NO SIGN-IN (auth.enabled=false -- accounts were switched off; they are on out of the box): anyone who can reach ${where}:${cfg.server.port} reads this monitor — charts, the event feed, peer and mempool detail, and the read-only RPC console — as role "viewer". Not open to them: user administration, the audit trail, password changes, and node writes (BLOCKYARD_AUTH=1, or drop the override, for accounts, roles, sessions and CSRF).`,
     });
   }
 
@@ -342,7 +360,10 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
   }
   const served = plan.bindable.map((h) => `${app.scheme}://${h}:${cfg.server.port}`);
   app.log({ level: 'info', msg: `BlockYard ${VERSION} listening on ${served.join(' and ')}` });
-  if (!plan.bindable.includes('0.0.0.0') && !plan.bindable.includes('::')) {
+  const loopbackOnly = plan.bindable.every((h) => LOOPBACK.has(h));
+  if (loopbackOnly) {
+    app.log({ level: 'info', msg: 'bound to this machine only (the default): reach it from elsewhere over an SSH tunnel, or bind a LAN address with BLOCKYARD_BIND / server.hosts -- docs/INSTALL.md §7' });
+  } else if (!plan.bindable.includes('0.0.0.0') && !plan.bindable.includes('::')) {
     const v4 = localAddresses().filter((a) => a.family === 'IPv4' && !plan.bindable.includes(a.address) && !a.internal);
     const v6 = localAddresses().filter((a) => a.family === 'IPv6' && !plan.bindable.includes(a.address) && !a.internal).length;
     // warn, not info: when loopback is not among the bound addresses, "connection
@@ -352,7 +373,7 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
     app.log({
       level: 'warn',
       msg: `bound to specific interfaces -- NOT reachable on ${v4.map((a) => `${a.address} (${a.name})`).join(', ') || 'other IPv4 addresses'}`
-        + `${v6 ? ` (plus ${v6} IPv6 address(es))` : ''}, and not on 127.0.0.1 either: use one of the addresses above from this machine too.`,
+        + `${v6 ? ` (plus ${v6} IPv6 address(es))` : ''}${plan.bindable.some((h) => LOOPBACK.has(h)) ? '.' : ', and not on 127.0.0.1 either: use one of the addresses above from this machine too.'}`,
     });
     if (plan.missing.length) {
       app.log({ level: 'warn', msg: `skipped at boot: ${plan.missing.join(', ')} -- clients that would have used those addresses will get "connection refused", which is not a crash` });
@@ -443,13 +464,25 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
       // when its RPC slows past the monitor's own threshold (rpc.slowLatencyMs, 5 s) the next file waits
       // until it recovers (2026-09-14, the first Mac install: 18 s answers and 90 s timeouts while the
       // build ran flat out -- which turned out to be gettxoutsetinfo, not the build, but the pacing stays)
+      let phase = null, phaseAt = Date.now(), lastFlag = 0, lastProgressAt = Date.now();
+      const flagLine = () => {
+        const pct = status.total ? Math.round((100 * status.done) / status.total) : 0;
+        const quiet = Date.now() - lastProgressAt;
+        return `the address index is being built: ${status.phase ?? 'starting'} ${Number(status.done ?? 0).toLocaleString()} of ${Number(status.total ?? 0).toLocaleString()} (${pct}%)${status.rows ? `, ${status.rows.toLocaleString()} rows so far` : ''}${status.eta ? `, about ${status.eta} left` : ''}${status.paused ? ' -- paused while the node\'s RPC is slow' : quiet > 120_000 ? ` -- no progress for ${Math.round(quiet / 60000)} min` : ''}`;
+      };
       const pace = rpcPacer(m.rpc, { slowMs: cfg.rpc?.slowLatencyMs ?? 5000, onChange: (held, t) => {
         status.paused = held;
+        lastFlag = Date.now(); m.flagQuality?.('address-index-building', flagLine(), 'info');   // on the flag the moment it changes
         app.log({ level: 'info', msg: held ? `address index build: paused while the node's RPC is ${t.breakerOpen ? 'refused' : t.lastError ? 'failing' : `answering in ${((t.avgLatencyMs ?? 0) / 1000).toFixed(1)} s`}` : 'address index build: resumed' });
       } });
       const say = (text, severity = 'info') => { m.addEvent?.({ kind: 'index', severity, tag: 'index', ts: Date.now(), text }); app.log({ level: severity === 'warn' ? 'warn' : 'info', msg: text }); };
       say(`address index: building ${dir} from ${m.id}'s block files with ${workers} workers -- the Overview shows the progress`);
-      let phase = null, phaseAt = Date.now(), lastFlag = 0;
+      // THE FLAG IS REWRITTEN ON A CLOCK, NOT ONLY ON PROGRESS (2026-09-15: "scan 5,720 of 5,721,
+      // about 1 s left (88m ago)" -- a build that had stopped moving showed its last good line,
+      // and a pause showed nothing at all until the next file finished). Every 30 s it says how
+      // long since anything happened, and a pause is on it the moment it begins.
+      const heartbeat = setInterval(() => { if (Date.now() - lastFlag > 25_000) { lastFlag = Date.now(); m.flagQuality?.('address-index-building', flagLine(), 'info'); } }, 30_000);
+      heartbeat.unref?.();
       buildIndex({
         rpc, blocksDir: path.join(m.cfg.datadir, 'blocks'), out: dir, workers, pace,
         onProgress: (p) => {
@@ -457,13 +490,14 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
           const elapsed = (Date.now() - phaseAt) / 1000;
           const rate = elapsed > 0 && p.done > 0 ? p.done / elapsed : 0;
           Object.assign(status, { phase: p.phase, done: p.done, total: p.total, rows: p.rows ?? status.rows, eta: rate > 0 && p.total > p.done ? HMS((p.total - p.done) / rate) : null });
+          lastProgressAt = Date.now();
           if (Date.now() - lastFlag > 5000) {
             lastFlag = Date.now();
-            const pct = p.total ? Math.round((100 * p.done) / p.total) : 0;
-            m.flagQuality?.('address-index-building', `the address index is being built: ${p.phase} ${p.done.toLocaleString()} of ${p.total.toLocaleString()} (${pct}%)${p.rows ? `, ${p.rows.toLocaleString()} rows so far` : ''}${status.eta ? `, about ${status.eta} left` : ''}${status.paused ? ' -- paused while the node\'s RPC is slow' : ''}`, 'info');
+            m.flagQuality?.('address-index-building', flagLine(), 'info');
           }
         },
       }).then((manifest) => {
+        clearInterval(heartbeat);
         registerIndexBuild(dir, null);
         m.indexBuild = null;
         m.clearQuality?.('address-index-building');
@@ -471,6 +505,7 @@ export async function boot({ configFile, log: logOverride = null } = {}) {
         say(`address index built: ${Number(manifest.rows ?? 0).toLocaleString()} rows to block ${Number(manifest.tip?.height ?? 0).toLocaleString()} in ${mins} min -- address pages are live`);
         try { follow(dir, m); } catch (err) { say(`address index ${dir}: built, but the follower could not start: ${err.message}`, 'warn'); }
       }).catch((err) => {
+        clearInterval(heartbeat);
         status.error = err.message;
         registerIndexBuild(dir, null);
         m.indexBuild = null;
@@ -593,6 +628,8 @@ function installShutdown(app) {
   });
 }
 
+const LOOPBACK = new Set(['127.0.0.1', '::1', 'localhost']);
+
 export function banner(app) {
   const lines = [];
   const host = app.cfg.server.host;
@@ -608,7 +645,15 @@ export function banner(app) {
     // Same content as the boot warning, in the banner: the first thing on screen
     // after `npm start` should be the sentence about who can read the node.
     lines.push('    login    DISABLED — open to anyone who can reach the addresses above (role: viewer, read-only)');
-    lines.push('             user admin, the audit trail and node writes stay closed; BLOCKYARD_AUTH=1 turns accounts on');
+    lines.push('             user admin, the audit trail and node writes stay closed; BLOCKYARD_AUTH=1 turns accounts back on');
+  }
+  // LOOPBACK IS THE DEFAULT (2026-09-15): say how to reach it from anywhere else, because "it
+  // works on the box and nowhere else" is the first thing a new install runs into now
+  const hosts = app.cfg.server.hosts ?? [host];
+  if (hosts.every((h) => LOOPBACK.has(h))) {
+    const p = app.cfg.server.port;
+    lines.push(`    reach    this machine only. From elsewhere: ssh -L ${p}:127.0.0.1:${p} you@this-host, then ${app.scheme}://localhost:${p}`);
+    lines.push('             or bind a LAN address: BLOCKYARD_BIND=192.0.2.10 (or 0.0.0.0 for every interface) — docs/INSTALL.md §7');
   }
   lines.push(`    nodes    ${[...app.monitors.values()].map((m) => `${m.id} -> ${m.rpc.url}`).join(', ')}`);
   if (app.cfg.server.allowCidrs.length) lines.push(`    CIDRs    ${app.cfg.server.allowCidrs.join(', ')}`);

package/server/tls/selfsigned.js

@@ -0,0 +1,160 @@
+// A SELF-SIGNED CERTIFICATE, MADE HERE (operator, 2026-09-15: "Can we make the signing process
+// part of the installer to generate per-user certs for their nodes?" -- then "make https the
+// forced default"). Node can make a key pair and sign bytes but cannot write an X.509
+// certificate, and this repository has no dependencies by decision, so the certificate is
+// assembled by hand: a v3 TBSCertificate in DER, signed with ECDSA P-256 over SHA-256, wrapped
+// in PEM. Every install gets its own key and its own certificate, valid for a little over two
+// years, naming the addresses the monitor is reached on (subjectAltName), and the server makes
+// one on first start when no certificate of the operator's own is configured.
+//
+// The shape is the one `openssl req -x509` produces: issuer == subject (CN=blockyard),
+// basicConstraints CA:TRUE, keyUsage digitalSignature+keyCertSign, extKeyUsage serverAuth. A
+// browser warns once per address, as with any self-signed certificate, and then remembers it.
+// Node's own X509Certificate parses the result, which is what the tests hold it to.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+import path from 'node:path';
+
+// ---------------------------------------------------------------- DER, the little that is needed
+const len = (n) => {
+  if (n < 0x80) return Buffer.from([n]);
+  const b = [];
+  for (let x = n; x > 0; x = Math.floor(x / 256)) b.unshift(x & 0xff);
+  return Buffer.from([0x80 | b.length, ...b]);
+};
+const tlv = (tag, body) => Buffer.concat([Buffer.from([tag]), len(body.length), body]);
+const seq = (...parts) => tlv(0x30, Buffer.concat(parts));
+const set = (...parts) => tlv(0x31, Buffer.concat(parts));
+const int = (v) => {
+  let b = Buffer.isBuffer(v) ? Buffer.from(v) : Buffer.from([v]);
+  while (b.length > 1 && b[0] === 0 && !(b[1] & 0x80)) b = b.subarray(1);
+  if (b[0] & 0x80) b = Buffer.concat([Buffer.from([0]), b]);
+  return tlv(0x02, b);
+};
+const bool = (v) => tlv(0x01, Buffer.from([v ? 0xff : 0]));
+// (arcs as an array, not dotted text: the address-hygiene test reads a four-arc OID as an IPv4 address)
+const oid = (arcs) => {
+  const p = Array.isArray(arcs) ? arcs : String(arcs).split('.').map(Number);
+  const out = [40 * p[0] + p[1]];
+  for (const v of p.slice(2)) {
+    const s = [];
+    let x = v;
+    do { s.unshift(x & 0x7f); x = Math.floor(x / 128); } while (x > 0);
+    for (let i = 0; i < s.length - 1; i++) s[i] |= 0x80;
+    out.push(...s);
+  }
+  return tlv(0x06, Buffer.from(out));
+};
+const utf8 = (s) => tlv(0x0c, Buffer.from(s, 'utf8'));
+const octet = (b) => tlv(0x04, b);
+const bits = (b, unused = 0) => tlv(0x03, Buffer.concat([Buffer.from([unused]), b]));
+const utc = (d) => {
+  const p = (n) => String(n).padStart(2, '0');
+  return tlv(0x17, Buffer.from(`${p(d.getUTCFullYear() % 100)}${p(d.getUTCMonth() + 1)}${p(d.getUTCDate())}${p(d.getUTCHours())}${p(d.getUTCMinutes())}${p(d.getUTCSeconds())}Z`, 'ascii'));
+};
+const ctx = (n, body, constructed = true) => tlv((constructed ? 0xa0 : 0x80) | n, body);
+
+// an IP address as the bytes subjectAltName wants: four for v4, sixteen for v6
+export function ipBytes(addr) {
+  const kind = net.isIP(addr);
+  if (kind === 4) return Buffer.from(addr.split('.').map(Number));
+  if (kind !== 6) return null;
+  let a = addr;
+  // an embedded v4 tail (::ffff:192.0.2.1) becomes its two hextets
+  const m = a.match(/^(.*:)(\d+\.\d+\.\d+\.\d+)$/);
+  if (m) { const b = m[2].split('.').map(Number); a = `${m[1]}${((b[0] << 8) | b[1]).toString(16)}:${((b[2] << 8) | b[3]).toString(16)}`; }
+  const [head, tail = ''] = a.split('::');
+  const hs = head ? head.split(':') : [], ts = tail ? tail.split(':') : [];
+  const fill = a.includes('::') ? 8 - hs.length - ts.length : 0;
+  const hex = [...hs, ...Array(Math.max(0, fill)).fill('0'), ...ts];
+  if (hex.length !== 8) return null;
+  const out = Buffer.alloc(16);
+  hex.forEach((h, i) => out.writeUInt16BE(parseInt(h, 16), i * 2));
+  return out;
+}
+
+const pem = (label, der) => `-----BEGIN ${label}-----\n${der.toString('base64').replace(/(.{64})/g, '$1\n').replace(/\n$/, '')}\n-----END ${label}-----\n`;
+
+/**
+ * Make a self-signed certificate and its private key.
+ * @param {object} [o]
+ * @param {string} [o.cn='blockyard']       the common name (issuer and subject alike)
+ * @param {string[]} [o.sans=[]]            addresses and names the certificate is valid for
+ * @param {number} [o.days=825]             validity, from `now`
+ * @param {number} [o.now=Date.now()]
+ * @returns {{ cert: string, key: string, fingerprint: string, notAfter: number, sans: string[] }}
+ */
+export function makeSelfSigned({ cn = 'blockyard', sans = [], days = 825, now = Date.now() } = {}) {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+  const spki = publicKey.export({ type: 'spki', format: 'der' });
+  const ECDSA_SHA256 = oid([1, 2, 840, 10045, 4, 3, 2]);
+  const name = seq(set(seq(oid([2, 5, 4, 3]), utf8(cn))));
+  const notBefore = new Date(now - 5 * 60 * 1000);                 // five minutes of clock skew
+  const notAfter = new Date(now + days * 86_400_000);
+  const serial = crypto.randomBytes(16); serial[0] &= 0x7f;        // positive, 128 bits
+  // the names: unique, addresses as bytes, everything else as a DNS name
+  const uniq = [...new Set(sans.map((s) => String(s).trim()).filter(Boolean))];
+  // [2] dNSName and [7] iPAddress are IMPLICIT: the tag replaces the string's own, so the body is
+  // the bare bytes (an IA5String TLV inside read back as '"\u0016\u0009localhost"')
+  const names = uniq.map((s) => { const ip = ipBytes(s); return ip ? ctx(7, ip, false) : ctx(2, Buffer.from(s, 'ascii'), false); });
+  const ext = (id, critical, body) => seq(oid(id), ...(critical ? [bool(true)] : []), octet(body));
+  const extensions = [
+    ext([2, 5, 29, 19], true, seq(bool(true))),                                  // basicConstraints CA:TRUE
+    ext([2, 5, 29, 15], true, bits(Buffer.from([0x84]), 2)),                     // keyUsage: digitalSignature, keyCertSign
+    ext([2, 5, 29, 37], false, seq(oid([1, 3, 6, 1, 5, 5, 7, 3, 1]))),                   // extKeyUsage: serverAuth
+    ...(names.length ? [ext([2, 5, 29, 17], false, seq(...names))] : []),        // subjectAltName
+  ];
+  const tbs = seq(
+    ctx(0, int(2)),                       // version 3
+    int(serial),
+    seq(ECDSA_SHA256),
+    name,                                 // issuer
+    seq(utc(notBefore), utc(notAfter)),
+    name,                                 // subject: the same, which is what "self-signed" means
+    spki,
+    ctx(3, seq(...extensions)),
+  );
+  const signature = crypto.sign('sha256', tbs, { key: privateKey, dsaEncoding: 'der' });
+  const cert = pem('CERTIFICATE', seq(tbs, seq(ECDSA_SHA256), bits(signature)));
+  const key = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  const x = new crypto.X509Certificate(cert);
+  return { cert, key, fingerprint: x.fingerprint256, notAfter: Date.parse(x.validTo), sans: uniq };
+}
+
+/** A name as it compares: an IP by its bytes (Node prints v6 expanded and upper-case), a DNS name lower-case. */
+export const canonName = (s) => { const b = ipBytes(String(s).trim()); return b ? `ip:${b.toString('hex')}` : String(s).trim().toLowerCase(); };
+/** The names a certificate carries, canonical (canonName), IPs and DNS names alike. */
+export function certNames(certPem) {
+  const x = new crypto.X509Certificate(certPem);
+  return (x.subjectAltName ?? '').split(',').map((s) => s.trim().replace(/^(DNS|IP Address):/, '')).filter(Boolean).map(canonName);
+}
+
+/**
+ * The monitor's own certificate under `dir`: made on first use, kept after that, remade when it
+ * is within a fortnight of expiry or no longer names one of `mustName`. Returns the files and
+ * whether anything was written.
+ */
+export function ensureSelfSigned(dir, { sans = [], mustName = [], days = 825, now = Date.now(), force = false } = {}) {
+  const certFile = path.join(dir, 'cert.pem'), keyFile = path.join(dir, 'key.pem');
+  let why = null;
+  if (force) why = 'asked to';
+  else if (!fs.existsSync(certFile) || !fs.existsSync(keyFile)) why = 'none yet';
+  else {
+    try {
+      const x = new crypto.X509Certificate(fs.readFileSync(certFile, 'utf8'));
+      const have = certNames(fs.readFileSync(certFile, 'utf8'));
+      const missing = mustName.filter((n) => !have.includes(canonName(n)));
+      if (Date.parse(x.validTo) - now < 14 * 86_400_000) why = `it expires ${x.validTo}`;
+      else if (missing.length) why = `it does not name ${missing.join(', ')}`;
+      else if (!x.checkPrivateKey(crypto.createPrivateKey(fs.readFileSync(keyFile, 'utf8')))) why = 'the key does not match it';
+    } catch (err) { why = `it cannot be read (${err.message})`; }
+  }
+  if (!why) return { certFile, keyFile, made: false, why: null };
+  const made = makeSelfSigned({ sans: [...new Set([...sans, ...mustName])], days, now });
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const write = (file, text) => { const tmp = `${file}.tmp`; fs.writeFileSync(tmp, text, { mode: 0o600 }); fs.renameSync(tmp, file); };
+  write(keyFile, made.key);
+  write(certFile, made.cert);
+  return { certFile, keyFile, made: true, why, fingerprint: made.fingerprint, notAfter: made.notAfter, sans: made.sans };
+}