locadot 2.1.0-beta.1 → 2.1.0-beta.2

package/CHANGELOG.md

@@ -25,6 +25,13 @@
   to a signed-out visitor. It uses a 7-day HttpOnly SameSite=Strict session, rate-limits wrong passwords, and adds a Sign out button to the sidebar.
   Mapped hosts are not affected, and neither are scripts or the CLI that send `X-Locadot-Token`.
 
+### Changed
+- `<domain>.localhost` now opens the sender's own dashboard for an admin peer, with full control (hosts, sharing, peers,
+  settings), instead of a landing page; no port needed. The port picker moved to `<domain>.localhost/_locadot/ports`.
+  The page never carries the sender's API token, the API only accepts calls from that `<domain>.localhost` origin, the sender
+  checks the admin role on every request, `hub:localhost off` turns it off, and a dashboard password still asks for sign-in.
+  Senders must run this version too; an older sender answers `<domain>.localhost` with a 404.
+
 ### Fixed
 - The proxy can now tell a user's `LOCADOT_HTTP_PORT`/`LOCADOT_HTTPS_PORT` from the copies the CLI pins on every spawn
   (`LOCADOT_USER_PORTS`), so saved ports aren't reported as env-overridden.

package/README.md

@@ -111,10 +111,10 @@ short-lived pairing string, and the sender's mappings then show up in the receiv
 | `locadot hub:setup --domain dev.example.com` | Sender: publish through your own named tunnel on your Cloudflare domain (runs `cloudflared` login, creates the tunnel and routes DNS). The address stays the same. |
 | `locadot hub:quick` | Sender: publish on a trycloudflare URL. No account is needed, but **the URL changes if the tunnel restarts**, so receivers have to run `remote:url`. |
 | `locadot hub` / `hub:off` | Show the hub status and URL, or stop it. |
-| `locadot hub:localhost <on\|off>` | Sender: allow or block admin peers from reaching any port on this machine's localhost. |
+| `locadot hub:localhost <on\|off>` | Sender: allow or block admin peers from opening this machine's dashboard and any port on its localhost. |
 | `locadot share --role viewer\|editor\|admin [--hosts a.localhost,b.localhost]` | Sender: print a pairing string. It works once and expires after 5 minutes. `--hosts` limits a viewer to those mappings. |
 | `locadot peers` / `peers:role <id> <role>` / `peers:revoke <id>` | Sender: list the connected machines, change a role, or cut one off. |
-| `locadot connect "<pairing string>" [--name alice] [--domain dev]` | Receiver: connect and import the sender's mappings. If a name clashes, `app.localhost` becomes `app.alice.localhost`. Admins get a local domain to reach the sender's own localhost (see below); `--domain` picks it, otherwise it's a random `adjective-noun`. |
+| `locadot connect "<pairing string>" [--name alice] [--domain dev]` | Receiver: connect and import the sender's mappings. If a name clashes, `app.localhost` becomes `app.alice.localhost`. Admins get a local domain that opens the sender's dashboard and localhost (see below); `--domain` picks it, otherwise it's a random `adjective-noun`. |
 | `locadot remotes` / `remote:sync <name>` / `disconnect <name>` | Receiver: list the connections (with their domain), pull new mappings, or remove the connection and its names. |
 | `locadot remote:domain <name> [domain] [--off]` | Receiver, admin only: set the local domain for a remote's localhost, randomize it (no domain given), or remove it (`--off`). |
 | `locadot remote:alias <name> <remote host> <local host>` | Receiver: give a sender mapping another local name, e.g. `he.localhost`. |
@@ -123,10 +123,12 @@ short-lived pairing string, and the sender's mappings then show up in the receiv
 
 Roles: **viewer** can only browse (optionally limited to the mappings picked on the invite). **editor** can also add and change
 mappings on the sender. **admin** can also delete them and change sharing, and (unless the sender turned it off with
-`hub:localhost off`) reach any port on the sender's own localhost through `https://<domain>.localhost` (the landing page) and
-`https://<port>.<domain>.localhost` (`sender's localhost:<port>`). Traffic goes receiver → Cloudflare → sender →
+`hub:localhost off`) open the sender's own dashboard at `https://<domain>.localhost` and manage it as if they were sitting at it,
+and reach any port on the sender's localhost at `https://<port>.<domain>.localhost` (`sender's localhost:<port>`). The port
+picker is at `https://<domain>.localhost/_locadot/ports`. The admin's browser never gets the sender's API token, so revoking or
+demoting the peer cuts off its dashboard access at once; a dashboard password on the sender still applies. Traffic goes receiver → Cloudflare → sender →
 target, so an editor can reach anything the sender's machine can reach. Only give that role to people you trust. Only hashes
-of the tokens are stored, and failed attempts are rate limited. The sender's dashboard is never reachable through the hub.
+of the tokens are stored, and failed attempts are rate limited. Only admins can open the sender's dashboard through the hub.
 The dashboard has **Remote access** and **Connected machines** cards for all of this.
 
 ### Certificates

package/dist/cli/commands/remote.js

@@ -219,10 +219,10 @@ async function peersRevoke(id) {
     links_1.default.revoke(id);
     (0, shared_1.print)(`🗑️  Revoked peer ${id}.`);
 }
-/** After connect/sync/remote:domain: the sender's own localhost, reachable when this remote has a domain and we're admin. */
+/** After connect/sync/remote:domain: the sender's dashboard and localhost, reachable when this remote has a domain and we're admin. */
 const printDomain = (remote) => {
     if (remote.domain && remote.role === "admin") {
-        (0, shared_1.print)(`🖥️  ${remote.sender.hostname} localhost: ${(0, urls_1.urlFor)(`${remote.domain}.localhost`)}  (any port: ${(0, urls_1.urlFor)(`<port>.${remote.domain}.localhost`)})`);
+        (0, shared_1.print)(`🖥️  ${remote.sender.hostname} dashboard: ${(0, urls_1.urlFor)(`${remote.domain}.localhost`)}  (any port: ${(0, urls_1.urlFor)(`<port>.${remote.domain}.localhost`)})`);
     }
 };
 async function connect(value, options) {

package/dist/constants/template.js

@@ -62,9 +62,10 @@ const upstreamDown = (host, target, reason, dashboardUrl) => page("locadot: upst
     <code>${(0, escape_1.escapeHtml)(host)}</code> → <code>${(0, escape_1.escapeHtml)(target)}</code><br/><br/>
     ${(0, escape_1.escapeHtml)(reason)}. Is the app running?`, dashboardUrl);
 exports.upstreamDown = upstreamDown;
-/** Receiver side: the landing page of `<domain>.localhost`, an admin's door to a sender's whole localhost. */
+/** Receiver side: `<domain>.localhost/_locadot/ports`, the port picker and shared hosts of an admin remote. */
 const remoteLocalhost = (opts) => page(`locadot: ${opts.sender} localhost`, opts.allowed
     ? `<strong style="color: #7ee2a8;">${(0, escape_1.escapeHtml)(opts.sender)}</strong>: localhost<br/><br/>
+    Its dashboard is <a href="/">${(0, escape_1.escapeHtml)(opts.domain)}.localhost</a>.<br/>
     Any port on that machine is at <code>${(0, escape_1.escapeHtml)(opts.portUrl.replace("PORT", "<port>"))}</code>.<br/><br/>
     <form id="go" style="display:flex;gap:8px">
       <input id="port" inputmode="numeric" pattern="[0-9]{1,5}" placeholder="3000" required

package/dist/dashboard/api.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ApiError = void 0;
+exports.isDashboardOrigin = exports.PEER_TOKEN = exports.ApiError = void 0;
 exports.assertTrusted = assertTrusted;
 exports.readJson = readJson;
 exports.route = route;
@@ -59,6 +59,7 @@ const links_1 = __importStar(require("../lib/links"));
 const hub_config_1 = __importDefault(require("../lib/hub-config"));
 const remotes_1 = __importStar(require("../lib/remotes"));
 const ui_auth_1 = __importDefault(require("../lib/ui-auth"));
+const request_1 = require("../proxy/request");
 const MAX_BODY = 64 * 1024;
 class ApiError extends Error {
     constructor(status, message, hint) {
@@ -74,15 +75,25 @@ const safeEqual = (a, b) => {
     const y = Buffer.from(b);
     return x.length === y.length && crypto_1.default.timingSafeEqual(x, y);
 };
-const isDashboardOrigin = (origin) => {
+/**
+ * What the page carries instead of the API token when an admin peer views it through the hub: the hub already
+ * authenticated the peer, and the real token would outlive a revoked peer.
+ */
+exports.PEER_TOKEN = "hub-peer";
+/** The page's own origin: the dashboard hosts, or for an admin peer the receiver's `<domain>.localhost`. */
+const isDashboardOrigin = (req, origin) => {
     try {
-        const hostname = new URL(origin).hostname.replace(/^\[|\]$/g, "");
-        return constants_1.default.dashboardHosts.includes(hostname);
+        const url = new URL(origin);
+        const peerOrigin = (0, request_1.peerOriginOf)(req);
+        if (peerOrigin)
+            return url.host === peerOrigin;
+        return constants_1.default.dashboardHosts.includes(url.hostname.replace(/^\[|\]$/g, ""));
     }
     catch {
         return false;
     }
 };
+exports.isDashboardOrigin = isDashboardOrigin;
 /**
  * Any web page can make the browser send requests to localhost, so every mutating
  * call must prove it came from the dashboard page itself (or a local script that
@@ -91,12 +102,12 @@ const isDashboardOrigin = (origin) => {
  */
 function assertTrusted(req, ctx) {
     const origin = req.headers.origin;
-    if (origin && !isDashboardOrigin(origin))
+    if (origin && !(0, exports.isDashboardOrigin)(req, origin))
         throw new ApiError(403, "Cross-origin requests are not allowed.");
     if (req.headers["sec-fetch-site"] === "cross-site")
         throw new ApiError(403, "Cross-site requests are not allowed.");
     const token = req.headers["x-locadot-token"];
-    if (typeof token !== "string" || !safeEqual(token, ctx.token)) {
+    if (typeof token !== "string" || !safeEqual(token, (0, request_1.peerOriginOf)(req) ? exports.PEER_TOKEN : ctx.token)) {
         throw new ApiError(403, "Missing or wrong X-Locadot-Token.", `Token file: ${constants_1.default.paths.API_TOKEN}`);
     }
 }

package/dist/dashboard/index.js

@@ -40,6 +40,7 @@ exports.handleDashboardRequest = handleDashboardRequest;
 const crypto_1 = __importDefault(require("crypto"));
 const page_1 = require("./page");
 const api_1 = require("./api");
+const request_1 = require("../proxy/request");
 const login_1 = require("./login");
 const ui_auth_1 = __importStar(require("../lib/ui-auth"));
 const system_1 = require("../lib/system");
@@ -141,7 +142,7 @@ function handleDashboardRequest(req, res, ctx) {
     }
     switch (url.pathname) {
         case "/":
-            sendBody(res, method, 200, "text/html; charset=utf-8", (0, page_1.renderPage)(nonce, ctx.token, ui_auth_1.default.enabled()));
+            sendBody(res, method, 200, "text/html; charset=utf-8", (0, page_1.renderPage)(nonce, (0, request_1.peerOriginOf)(req) ? api_1.PEER_TOKEN : ctx.token, ui_auth_1.default.enabled()));
             return;
         case "/favicon.ico":
             res.statusCode = 204;

package/dist/dashboard/login.js

@@ -39,9 +39,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sessionCookie = exports.signedIn = void 0;
 exports.gate = gate;
 const crypto_1 = __importDefault(require("crypto"));
-const constants_1 = __importDefault(require("../constants"));
 const logger_1 = __importDefault(require("../utils/logger"));
 const escape_1 = require("./escape");
+const api_1 = require("./api");
 const ui_auth_1 = __importStar(require("../lib/ui-auth"));
 const MAX_LOGIN_BODY = 4096;
 const loginPage = (nonce, error) => `<!doctype html>
@@ -100,12 +100,7 @@ const sameOrigin = (req) => {
     const origin = req.headers.origin;
     if (!origin || origin === "null")
         return !origin;
-    try {
-        return constants_1.default.dashboardHosts.includes(new URL(origin).hostname.replace(/^\[|\]$/g, ""));
-    }
-    catch {
-        return false;
-    }
+    return (0, api_1.isDashboardOrigin)(req, origin);
 };
 const cookie = (req, value, maxAge) => `${ui_auth_1.SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${isTls(req) ? "; Secure" : ""}`;
 const sendLogin = (res, method, nonce, status, error) => {

package/dist/dashboard/page.js

@@ -1782,7 +1782,7 @@ const clientJs = `
     apiFetch("/api/remotes", { method: "POST", body: JSON.stringify({ string: value, name: name || undefined, domain: domain || undefined }) })
       .then(function (data) {
         var r = data.remote;
-        showToast("Connected to " + r.name, "success", r.domain && r.role === "admin" ? "Its localhost: " + localUrl(r.domain) : (domain && r.role !== "admin" ? "Domain ignored: you're " + r.role + ", not admin." : undefined));
+        showToast("Connected to " + r.name, "success", r.domain && r.role === "admin" ? "Its dashboard: " + localUrl(r.domain) : (domain && r.role !== "admin" ? "Domain ignored: you're " + r.role + ", not admin." : undefined));
         connectForm.reset();
         return Promise.all([loadRemotes(), loadHosts()]);
       })
@@ -1854,7 +1854,7 @@ const clientJs = `
       link.target = "_blank";
       link.rel = "noopener noreferrer";
       link.textContent = remote.domain + ".localhost";
-      link.title = "Any port: " + localUrl(remote.domain, "<port>");
+      link.title = "Its dashboard. Any port: " + localUrl(remote.domain, "<port>");
       row.appendChild(link);
       row.appendChild(makeCopyButton(function () { return localUrl(remote.domain); }));
       var change = document.createElement("button");
@@ -1880,7 +1880,7 @@ const clientJs = `
     apiFetch("/api/hub/localhost", { method: "PUT", body: JSON.stringify({ enabled: next }) })
       .then(function () {
         setSwitch(hubLocalhostSwitch, next);
-        showToast(next ? "Admins can open any port on this machine" : "Localhost access is off", "success");
+        showToast(next ? "Admins can open this dashboard and any port" : "Localhost access is off", "success");
       })
       .catch(function (err) { apiError(err, "Couldn't change localhost access"); })
       .then(function () { hubLocalhostSwitch.disabled = false; });
@@ -3309,10 +3309,10 @@ function renderPage(nonce, token, uiAuth = false) {
           </div>
           <div id="hub-localhost-row" class="toggle-row" hidden>
             <div>
-              <div class="label">Admins can open any port</div>
-              <div class="tile-sub">Admin peers reach this machine's localhost at <span class="mono">&lt;port&gt;.&lt;domain&gt;.localhost</span> on their side.</div>
+              <div class="label">Admins can open this dashboard and any port</div>
+              <div class="tile-sub">Admin peers get this dashboard at <span class="mono">&lt;domain&gt;.localhost</span> and this machine's localhost at <span class="mono">&lt;port&gt;.&lt;domain&gt;.localhost</span> on their side.</div>
             </div>
-            <button type="button" id="hub-localhost" class="switch" role="switch" aria-checked="true" aria-label="Let admins open any port on this machine"><span class="switch-knob"></span></button>
+            <button type="button" id="hub-localhost" class="switch" role="switch" aria-checked="true" aria-label="Let admins open this dashboard and any port on this machine"><span class="switch-knob"></span></button>
           </div>
         </div>
 
@@ -3361,7 +3361,7 @@ function renderPage(nonce, token, uiAuth = false) {
             <div class="role-table">
               <div><strong>Viewer</strong><span>browse the hosts you pick</span></div>
               <div><strong>Editor</strong><span>also add and change hosts here</span></div>
-              <div><strong>Admin</strong><span>also delete hosts, change sharing, and open any port on this machine</span></div>
+              <div><strong>Admin</strong><span>also delete hosts, change sharing, and open this dashboard and any port on this machine</span></div>
             </div>
             <p class="dim">Editors can reach anything this machine can. Change or revoke a role any time under Peers.</p>
           </div>

package/dist/proxy/hub.js

@@ -45,7 +45,7 @@ const logger_1 = __importDefault(require("../utils/logger"));
 const links_1 = __importStar(require("../lib/links"));
 const hosts_1 = __importStar(require("../lib/hosts"));
 const hub_config_1 = __importDefault(require("../lib/hub-config"));
-const localhost_1 = require("../lib/localhost");
+const localhost_1 = __importStar(require("../lib/localhost"));
 const registry_1 = require("../lib/registry");
 const request_1 = require("./request");
 // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -80,6 +80,18 @@ const clientIp = (req) => {
     const value = Array.isArray(header) ? header[0] : header;
     return value || req.socket.remoteAddress || "unknown";
 };
+/** `X-Original-Host` from the receiver, only if it is a `*.localhost` name with an optional port. */
+const receiverHost = (req) => {
+    const header = req.headers["x-original-host"];
+    const raw = typeof header === "string" ? header.trim().toLowerCase() : "";
+    const match = /^([^:]+)(?::(\d{1,5}))?$/.exec(raw);
+    return match && localhost_1.default.isValidLocalhostDomain(match[1]) ? raw : undefined;
+};
+const stripLocadotHeaders = (req) => {
+    for (const name of Object.keys(req.headers))
+        if (name.toLowerCase().startsWith("x-locadot-"))
+            delete req.headers[name];
+};
 const bearerToken = (req) => {
     const header = req.headers.authorization;
     const match = typeof header === "string" ? /^Bearer\s+(\S+)$/i.exec(header) : null;
@@ -103,11 +115,22 @@ function classify(req, publicHost, hosts, opts) {
         return { kind: "deny", status: 401, message: "Unauthorized" };
     }
     const portHeader = req.headers["x-locadot-port"];
-    if (portHeader !== undefined) {
+    const wantsDashboard = req.headers["x-locadot-dashboard"] !== undefined;
+    if (portHeader !== undefined || wantsDashboard) {
         if (!links_1.default.can(peer, "localhost"))
             return { kind: "deny", status: 403, message: "Forbidden" };
         if (opts?.localhost === false)
             return { kind: "deny", status: 403, message: "Localhost access is off on this machine." };
+        // The dashboard's page and API trust this origin in place of their own (see peerOriginOf).
+        if (wantsDashboard) {
+            const origin = receiverHost(req);
+            if (!origin)
+                return { kind: "deny", status: 400, message: "Bad request" };
+            // Keep X-Locadot-Token: the dashboard page sends it on every mutating call.
+            for (const name of ["x-locadot-peer", "x-locadot-dashboard", "x-locadot-host", "x-locadot-port"])
+                delete req.headers[name];
+            return { kind: "dashboard", peer, origin };
+        }
         const raw = typeof portHeader === "string" ? portHeader.trim() : "";
         if (!/^[0-9]+$/.test(raw))
             return { kind: "deny", status: 400, message: "Bad request" };
@@ -116,9 +139,7 @@ function classify(req, publicHost, hosts, opts) {
             return { kind: "deny", status: 400, message: "Bad request" };
         if (opts?.blockedPorts?.includes(port))
             return { kind: "deny", status: 403, message: "Forbidden" };
-        for (const name of Object.keys(req.headers))
-            if (name.toLowerCase().startsWith("x-locadot-"))
-                delete req.headers[name];
+        stripLocadotHeaders(req);
         return { kind: "local", port, peer };
     }
     const hostHeader = req.headers["x-locadot-host"];
@@ -131,9 +152,7 @@ function classify(req, publicHost, hosts, opts) {
     if (!visible.includes(host)) {
         return { kind: "deny", status: 403, message: "Forbidden" };
     }
-    for (const name of Object.keys(req.headers))
-        if (name.toLowerCase().startsWith("x-locadot-"))
-            delete req.headers[name];
+    stripLocadotHeaders(req);
     return { kind: "app", host, peer };
 }
 /* ---------- /_locadot/v1 API ---------- */

package/dist/proxy/remote.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.localOptions = exports.canReachLocalhost = exports.localFor = exports.remoteOptions = exports.remoteFor = void 0;
+exports.localOptions = exports.canReachLocalhost = exports.localFor = exports.LANDING_PATH = exports.remoteOptions = exports.remoteFor = void 0;
 const fs_1 = __importDefault(require("fs"));
 const constants_1 = __importDefault(require("../constants"));
 const request_1 = require("./request");
@@ -50,6 +50,8 @@ const remoteOptions = (req, entry, remote) => ({
     },
 });
 exports.remoteOptions = remoteOptions;
+/** Receiver side: the port picker and shared-host list, on `<domain>.localhost` itself (the rest of it is the dashboard). */
+exports.LANDING_PATH = "/_locadot/ports";
 /** Receiver side: `<domain>.localhost` / `<port>.<domain>.localhost` → the admin remote that owns `domain`. */
 const localFor = (host) => {
     if (!host.endsWith(".localhost"))
@@ -72,6 +74,7 @@ const localFor = (host) => {
 exports.localFor = localFor;
 const canReachLocalhost = (remote) => remote.role === "admin" && remote.localhost !== false;
 exports.canReachLocalhost = canReachLocalhost;
+/** Without a port the sender serves its dashboard. */
 const localOptions = (req, remote, port) => ({
     target: remote.url,
     changeOrigin: true,
@@ -85,7 +88,7 @@ const localOptions = (req, remote, port) => ({
     headers: {
         "X-Original-Host": req.headers.host || "",
         "X-Locadot-Peer": remote.token,
-        "X-Locadot-Port": String(port),
+        ...(port ? { "X-Locadot-Port": String(port) } : { "X-Locadot-Dashboard": "1" }),
     },
 });
 exports.localOptions = localOptions;

package/dist/proxy/request.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTls = exports.viaOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
+exports.isTls = exports.viaOf = exports.peerOriginOf = exports.fromRemote = exports.fromTunnel = exports.mappedHost = exports.hostOf = exports.tag = void 0;
 const tags = new WeakMap();
 const tag = (req, values) => {
     tags.set(req, { ...tags.get(req), ...values });
@@ -21,6 +21,8 @@ const fromTunnel = (req) => Boolean(tags.get(req)?.tunnel);
 exports.fromTunnel = fromTunnel;
 const fromRemote = (req) => Boolean(tags.get(req)?.remote);
 exports.fromRemote = fromRemote;
+const peerOriginOf = (req) => tags.get(req)?.peerOrigin;
+exports.peerOriginOf = peerOriginOf;
 const viaOf = (req) => tags.get(req)?.via;
 exports.viaOf = viaOf;
 /** Tunnel visitors are on https even though cloudflared talks plain http to us. */

package/dist/proxy/router.js

@@ -23,6 +23,10 @@ const resolveHost = (req, ctx, hub) => {
         (0, request_1.tag)(req, { host: hub.host, remote: true, secure: ctx.hub.secure() });
         return hub.host;
     }
+    if (hub?.kind === "dashboard") {
+        (0, request_1.tag)(req, { host: "localhost", remote: true, secure: ctx.hub.secure(), peerOrigin: hub.origin });
+        return "localhost";
+    }
     if (hub?.kind === "local") {
         const host = `localhost:${hub.port}`;
         (0, request_1.tag)(req, { host, remote: true, secure: ctx.hub.secure() });
@@ -161,25 +165,30 @@ function forwardRemote(req, res, ctx, host, entry) {
         res.end((0, template_1.upstreamDown)(host, `${remote.name}: ${entry.remote.host}`, reason(err) || "error", dashboardUrl(req)));
     });
 }
-/** Receiver side: the sender checks the role again and proxies to its own localhost:<port>. */
+/**
+ * Receiver side: `<domain>.localhost` is the sender's dashboard and `<port>.<domain>.localhost` its localhost:<port>.
+ * The sender checks the role again on every request.
+ */
 function forwardLocal(req, res, ctx, host, local) {
     const { remote, domain, port } = local;
     const allowed = (0, remote_1.canReachLocalhost)(remote);
-    if (!port || !allowed) {
+    const landing = !port && (req.url || "/").split("?")[0] === remote_1.LANDING_PATH;
+    if (!allowed || landing) {
         const hosts = (ctx.remoteHosts?.(remote.name) || []).map((h) => ({ local: h, url: `${(0, urls_1.urlFor)(h, (0, request_1.isTls)(req))}/` }));
         const body = (0, template_1.remoteLocalhost)({ domain, name: remote.name, sender: remote.sender.hostname, allowed, hosts, portUrl: portUrl(req, domain), dashboardUrl: dashboardUrl(req) });
-        html(res, port ? 403 : 200, body);
+        html(res, port && !allowed ? 403 : 200, body);
         return;
     }
+    const label = `${remote.name}: ${port ? `localhost:${port}` : "dashboard"}`;
     const started = Date.now();
     res.once("finish", () => (0, stats_1.record)(ctx.stats, host, res.statusCode, Date.now() - started, res.statusCode >= 500));
     ctx.proxy.web(req, res, (0, remote_1.localOptions)(req, remote, port), (err) => {
-        logger_1.default.warn(`${host} → ${remote.name} localhost:${port}: ${reason(err)}`);
+        logger_1.default.warn(`${host} → ${label}: ${reason(err)}`);
         if (res.headersSent) {
             res.destroy();
             return;
         }
-        html(res, 502, (0, template_1.upstreamDown)(host, `${remote.name}: localhost:${port}`, reason(err) || "error", dashboardUrl(req)));
+        html(res, 502, (0, template_1.upstreamDown)(host, label, reason(err) || "error", dashboardUrl(req)));
     });
 }
 function handleUpgrade(req, socket, head, ctx) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "locadot",
-  "version": "2.1.0-beta.1",
+  "version": "2.1.0-beta.2",
   "description": "Secure your local development environment with HTTPS and custom domains like dev.localhost.",
   "homepage": "https://www.npmjs.com/package/locadot",
   "main": "dist/index.js",