home-hosted 0.7.4 → 0.7.6

package/docs/NOTIFICATIONS.md

@@ -19,7 +19,7 @@ opt-in, and the bot token never leaves the secrets file.
 TOKEN='123456:ABC...'
 WS='?workspace=default'   # every notifications route is workspace-scoped; omit for the default one
 
-curl -X POST "http://127.0.0.1:3999/api/notifications/token$WS" \
+curl -X PUT "http://127.0.0.1:3999/api/notifications/token$WS" \
   -H 'content-type: application/json' -H "Authorization: Bearer $HH_TOKEN" \
   -d "{\"botToken\":\"$TOKEN\"}"
 

package/docs/REVERSE_PROXY.md

@@ -64,7 +64,7 @@ panel did not start is ever killed.
 | `enabled` | A disabled route stays configured but is not served. |
 | `target` | `server` (a supervised entry), `panel` (this control panel), `external` (any `host:port`). |
 | `workspace` + `server` | For `target: "server"` — an id is only unique inside its workspace. The upstream address is resolved live; a stopped entry leaves the hostname dark and the page says so. |
-| `url` | For `target: "external"`, e.g. `http://10.0.0.5:8080`. An `https://` upstream is dialled with TLS, and **its certificate is not verified** — a homelab upstream behind a self-signed certificate works, and so does an impostor. |
+| `url` | For `target: "external"`, e.g. `http://10.0.0.5:8080`. The port is optional: without one the scheme's own default is used (`:80` for `http:`, `:443` for `https:`). An `https://` upstream is dialled with TLS, and **its certificate is not verified** — a homelab upstream behind a self-signed certificate works, and so does an impostor. |
 | `path` | Optional prefix, so one hostname can serve several apps. |
 | `tls` | `auto` (default), `off`, `manual`. |
 
@@ -79,7 +79,7 @@ refused.
 
 | `tls` | What it means |
 | --- | --- |
-| `auto` | The engine decides. A public name gets a Let's Encrypt certificate (HTTP-01 or TLS-ALPN-01, with ZeroSSL as fallback and renewal in the background). A local-only name gets the engine's own locally-trusted CA. |
+| `auto` | The engine decides. A public name gets a Let's Encrypt certificate (HTTP-01 or TLS-ALPN-01, with renewal in the background). A local-only name gets the engine's own locally-trusted CA. |
 | `off` | Plain HTTP on the http port, no certificate. |
 | `manual` | One of the uploaded pairs, whichever covers the hostname (the engine picks by SNI). A route set to this with no pair covering it is refused, rather than quietly given a certificate from somewhere else. |
 
@@ -115,9 +115,9 @@ back asks the CA instead of serving the old pair. A **disabled** route keeps its
 certificate: it is still configured, and switching it back on should not cost a new
 issuance.
 
-The wait can be shortened by giving the engine's own issuer a shorter `lifetime` in the
-generated policy; the row reads the interval from the certificate, so the confirmation
-follows whatever is configured.
+The panel derives that wait from the certificate itself: certmagic renews once a third of
+the lifetime is left, so two thirds of it is the wait — about 8 hours for the engine's own
+12-hour CA. The interval is read, never configured, so there is no knob to shorten it.
 
 A hostname **no route claims** gets a page saying so, on both ports — not a redirect into
 a handshake that cannot finish. A visitor with no hostname at all (a bare IP on the HTTPS

package/docs/SERVERS.md

@@ -186,8 +186,9 @@ normal process, so it is still subject to:
   own lifecycle to be the only thing that decides.
 - **A container.** Docker stops everything in the container's PID namespace, so persistence means the
   panel's lifetime inside that container, not the host's.
-- **Windows, on the forced path.** `taskkill /T` walks the parent tree, and `down --force` uses it;
-  the graceful path (which is what `down` normally takes) leaves a persistent entry alone.
+- **Windows, on the forced path.** `taskkill /T` walks the parent tree, and `down` takes that path
+  automatically when the panel has not exited 20s after the shutdown request; the graceful path
+  (which is what `down` normally takes) leaves a persistent entry alone.
 
 ## Editing fields
 

package/docs/UI_CREATION.md

@@ -132,14 +132,14 @@ naming one that does not exist is a `404 UNKNOWN_WORKSPACE`, never a silent fall
 | `GET /api/events` | **the live feed**: `hello` carries the full state, then `state`, `server`, `log` |
 | `GET /api/servers/:id/stream` | one server's `server` + `log` frames |
 | `POST /api/servers/:id/{start,stop,restart}`, `/api/servers/{start-all,stop-all}` | lifecycle (workspace-scoped) |
-| `POST /api/servers/:id/free-port` | ask whatever holds that server's port to stop (`403`-safe: supervised listeners are refused) |
+| `POST /api/servers/:id/free-port` | ask whatever holds that server's port to stop (`409` when nothing can be freed — a supervised listener is refused, never killed) |
 | `GET` / `POST /api/servers`, `PATCH` / `DELETE /api/servers/:id` | the entries themselves, in one workspace |
 | `GET /api/logs`, `/api/logs/:id?tail=&search=`, `/api/logs/:id/download?file=` | persisted logs, for one workspace |
 | `GET` / `PATCH /api/settings` | the panel-wide settings (`control.label`, host thresholds, backups, UI) |
 | `GET` / `PATCH /api/settings/workspace` | one workspace's settings: server defaults, log retention, notifications |
 | `POST` / `DELETE /api/settings/ui` | install or revert a UI — what Global settings calls |
 | `POST` / `DELETE /api/settings/tls` | upload or clear a PEM pair |
-| `GET` / `PATCH /api/proxy`, `POST /api/proxy/{engine,start,stop,apply,revert}`, `PUT` / `DELETE /api/proxy/tls` | the panel-wide reverse proxy: engine, route table, its own PEM pair. Its live view also rides in the state frame as an optional `proxy` — read it defensively |
+| `GET` / `PATCH /api/proxy`, `POST /api/proxy/{engine,start,stop,apply,revert}`, `PUT` / `DELETE /api/proxy/certificates/:id`, `POST /api/proxy/routes/:id/retry-certificate` | the panel-wide reverse proxy: engine, route table, its uploaded PEM pairs. Its live view also rides in the state frame as an optional `proxy` — read it defensively |
 | `GET` / `POST /api/backups`, `/api/backups/restore`, `/api/backups/:name/download` | archives; entries are global (`global:settings`, `global:secrets`, `global:tls`) or per workspace, whose leaves are `workspace:<id>:settings`, `:servers`, `:secrets` plus `data:<path>`; a create/restore body `include` selects them |
 | `POST` / `DELETE /api/notifications/token`, `/api/notifications/test`, `/detect-chats` | Telegram, per workspace |
 | `POST /api/auth/login`, `GET /api/auth/session`, `POST /api/auth/logout` | the session |
@@ -163,8 +163,9 @@ and `GET /api/settings` includes `ui` — which UI is being served, and its meta
 
 An entry body is partial by design: `POST /api/servers` and `PATCH /api/servers/:id` take only the
 fields the person decided, and the workspace's **Server defaults** fill the rest. Sending a value the
-person never chose freezes it against those defaults, so build the body as a diff
-(`inheritBaseline` and `diffFields` in `src/shared/patch-diff.ts`).
+person never chose freezes it against those defaults, so build the body as a diff: `diffFields` comes
+from `src/shared/patch-diff.ts`, while comparing against the defaults (`inheritBaseline`) is each
+UI's own job — see `uis/stock/src/components/server/addServerForm.ts`.
 
 ### Failures
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "home-hosted",
   "type": "module",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "packageManager": "pnpm@12.5.1",
   "description": "Self-hosted control panel that keeps your home-server processes alive: supervision, restarts, port conflicts, logs — and a UI you can replace.",
   "author": "NamesMT <dangquoctrung123@gmail.com>",