locadot 2.1.0 → 2.3.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 2.3.0 (2026-09-29)
+
+### Added
+- Share on your own hostname: `locadot tunnel --host app.localhost --domain app.example.com`, or **Share** in the
+  dashboard and choose **Custom domain**. Runs a named Cloudflare tunnel for the mapping (login once, the DNS record is
+  created for you), so the URL doesn't change. `PUT /api/hosts/:host {"tunnel": true, "domain": "…"}`.
+- The dashboard no longer uses the browser's confirm and prompt boxes; confirmations and inputs open in-app dialogs.
+- Internal access for shared mappings: `locadot allow --host app.localhost localhost:3000` (or **Access** on a row in the
+  dashboard) lets tunnel visitors and connected machines, viewers included, reach the listed internal addresses through
+  that `--cors` domain's pass-through. Normally they're limited to public hosts. locadot's own ports stay blocked.
+  `add --allow`, `PUT /api/hosts/:host {"allow": [...]}`.
+
+## 2.2.0 (2026-09-29)
+
+### Added
+- Share the dashboard in a browser: `locadot hub:panel on` (or **Share this dashboard** under Remote access) serves the
+  control panel at the hub's public URL, behind the dashboard password. It can't be turned on without a password, and
+  removing the password turns it off. The visitor's browser never gets the API token; sign-in is rate limited per visitor IP.
+  `GET /api/hub` reports `panel`; `PUT /api/hub/panel` turns it on or off.
+
+### Fixed
+- Start at boot on macOS: `sudo locadot startup:enable` wrote a LaunchAgent into root's home, which never runs; it now
+  installs a LaunchDaemon that starts at boot, before login, as the sudo user with their state dir. Without sudo, the
+  LaunchAgent (starts at login) now clears a disabled override left by an earlier `startup:disable`, carries port
+  overrides, escapes paths, and survives a dashboard restart. Enabling or disabling no longer stops a running proxy.
+- `locadot trust` on macOS failed with "The authorization was denied since no user interaction was possible". It ran
+  `security` through an osascript admin prompt, which can't show the trust-settings dialog macOS requires; it now runs
+  `sudo security` in the terminal (or `security` directly from the dashboard). `sudo locadot trust` is refused on macOS,
+  since it trusted root's CA rather than the one the proxy serves.
+- Through a tunnel or remote access, a stopped or unmapped upstream is now a 503 with locadot's "upstream unreachable"
+  page. With 502, Cloudflare replaced the page with its own "origin bad gateway" error, which hid the real cause.
+
 ## 2.1.0 (2026-09-27)
 
 ### Added

package/README.md

@@ -19,7 +19,13 @@ HTTPS custom domains for local development. Point `https://app.localhost` at you
 - 🔁 **Any destination.** A local port (`--port 3000`), a host and port (`--target 192.168.1.5:8080`), or any URL
   (`--target https://google.com`). Redirects and cookies are rewritten so the browser stays on the `.localhost` name.
 - 🌍 **Share on a public URL.** `locadot tunnel --host app.localhost` (or **Share** in the dashboard) puts a mapping on
-  `https://<random>.trycloudflare.com` through a Cloudflare quick tunnel. No account needed.
+  `https://<random>.trycloudflare.com` through a Cloudflare quick tunnel. No account needed. Or put it on your own
+  hostname (`--domain app.example.com`) through a named tunnel in your Cloudflare account, with a URL that never changes.
+- 🔗 **Remote access, locadot to locadot.** Publish your whole locadot on a Cloudflare hostname and let other machines pair
+  with it as viewer, editor or admin. Your mappings show up in their locadot. Admins can also open your dashboard and any
+  port on your localhost.
+- 🖥️ **Share the dashboard in a browser.** `locadot hub:panel on` serves the control panel at the hub's public URL, behind the
+  dashboard password, so you can manage this machine from anywhere without installing locadot there.
 - 🧩 **`--cors` for sites that call other domains.** Preflights are answered locally and cross-origin calls are routed
   through the page's own origin, so a production frontend works against its real APIs from `.localhost`.
 - 📋 **Control panel at `https://localhost`.** Add, edit, filter and remove mappings, see health and traffic, share them,
@@ -59,6 +65,7 @@ npx locadot open                                    # opens the dashboard at htt
 | `locadot add --host <name>.localhost --target <url>` | Map a domain to any upstream: `3000`, `127.0.0.1:8080`, `http://10.0.0.5:8080/app`, `https://google.com`. |
 | `locadot update --host <name>.localhost --port/--target …` | Change the destination of an existing domain. |
 | `locadot remove --host <name>.localhost` (`rm`) | Remove a domain. |
+| `locadot allow --host <name>.localhost [addresses…] [--rm] [--clear]` | Let people on a tunnel or remote access reach internal addresses (`localhost:3000`) through a `--cors` domain. With no addresses, shows the list. Also `add … --allow a,b`. |
 | `locadot list` (`ls`, `host`) `[--json]` | Show all mappings. |
 | `locadot clear:hosts` | Remove all mappings. |
 | `locadot open [host]` | Open a domain, or the dashboard when no host is given, in your browser. |
@@ -89,7 +96,8 @@ Options for `add` / `update`:
 | Command | What it does |
 | --- | --- |
 | `locadot tunnel --host app.localhost` | Share a mapping on a public `https://<random>.trycloudflare.com` URL through a Cloudflare quick tunnel. No Cloudflare account is needed. `cloudflared` is downloaded on first use. |
-| `locadot tunnel --host app.localhost --off` | Stop sharing it. |
+| `locadot tunnel --host app.localhost --domain app.example.com` | Share it on your own hostname instead, on a domain in your Cloudflare account. The first time, `cloudflared` asks you to log in (the link is printed, and shown on the row in the dashboard). locadot creates a named tunnel for the mapping (`locadot-app-localhost`), points the hostname's DNS at it (replacing an existing record) and runs it. The URL stays the same across restarts. |
+| `locadot tunnel --host app.localhost --off` | Stop sharing it. The custom hostname is remembered for the dashboard; sharing again without `--domain` uses a random URL. |
 | `locadot tunnel` | List the shared mappings and their public URLs. |
 | `locadot tunnel:install` | Download `cloudflared` into the state dir (`<state>/bin`). Set `LOCADOT_CLOUDFLARED` to use your own binary; one on `PATH` is also picked up. |
 
@@ -101,6 +109,17 @@ pass-through calls may only go to public addresses: loopback, LAN, link-local an
 on the address actually dialled, so the tunnel can't be used to reach your machine or network. The dashboard can also do this:
 use **Share** / **Unshare** on a row.
 
+**Internal access.** If the shared frontend calls an internal API (`http://localhost:3000`), allow that address on the
+mapping, and tunnel visitors and connected machines (viewers included) can then reach it through the page:
+
+```sh
+locadot allow --host app.localhost localhost:3000      # add; `--rm` removes, `--clear` empties, no address lists
+```
+
+In the dashboard, click **Access** on the row. An entry is `host:port`, or a host alone for any of its ports. `127.0.0.1`
+and `0.0.0.0` count as `localhost`. Only the page's own requests can use it, and locadot's own ports stay blocked even
+when all of `localhost` is allowed. Allow only what the app needs: anyone who can open the mapping can reach these addresses.
+
 ### Remote access (locadot to locadot)
 
 One machine (the sender) publishes its whole locadot on a Cloudflare hostname. Other machines (receivers) connect with a
@@ -110,8 +129,10 @@ short-lived pairing string, and the sender's mappings then show up in the receiv
 | --- | --- |
 | `locadot hub:setup --domain dev.example.com` | Sender: publish through your own named tunnel on your Cloudflare domain (runs `cloudflared` login, creates the tunnel and routes DNS). The address stays the same. |
 | `locadot hub:quick` | Sender: publish on a trycloudflare URL. No account is needed, but **the URL changes if the tunnel restarts**, so receivers have to run `remote:url`. |
+| `locadot hub:manual --url <url>` | Sender: publish behind a URL something else already forwards to the proxy's HTTP port (ngrok, a reverse proxy). |
 | `locadot hub` / `hub:off` | Show the hub status and URL, or stop it. |
 | `locadot hub:localhost <on\|off>` | Sender: allow or block admin peers from opening this machine's dashboard and any port on its localhost. |
+| `locadot hub:panel <on\|off>` | Sender: serve this dashboard to any browser at the hub's public URL, behind the [dashboard password](#dashboard-password). Off by default. See [Sharing the dashboard](#sharing-the-dashboard-in-a-browser). |
 | `locadot share --role viewer\|editor\|admin [--hosts a.localhost,b.localhost]` | Sender: print a pairing string. It works once and expires after 5 minutes. `--hosts` limits a viewer to those mappings. |
 | `locadot peers` / `peers:role <id> <role>` / `peers:revoke <id>` | Sender: list the connected machines, change a role, or cut one off. |
 | `locadot connect "<pairing string>" [--name alice] [--domain dev]` | Receiver: connect and import the sender's mappings. If a name clashes, `app.localhost` becomes `app.alice.localhost`. Admins get a local domain that opens the sender's dashboard and localhost (see below); `--domain` picks it, otherwise it's a random `adjective-noun`. |
@@ -137,6 +158,31 @@ headers work as they do locally, and origins in the sender's pages are rewritten
 An admin's `<port>.<domain>.localhost` gets the same treatment when a `--cors` mapping points at that port.
 `remote:sync` picks up a sender turning `--cors` on or off.
 
+When a target is down, requests through the hub or a public share get a **503** with locadot's "upstream unreachable" page.
+Cloudflare replaces an origin's 502 with its own generic "bad gateway" error, which would hide the real cause.
+
+#### Sharing the dashboard in a browser
+
+Remote access above needs locadot on both machines. To manage this machine from a browser anywhere (a laptop, a phone),
+share the dashboard itself on the hub's public URL:
+
+```sh
+locadot ui:password     # required: visitors sign in with it
+locadot hub:panel on    # or the "Share this dashboard" switch under Remote access
+locadot hub             # shows the URL, e.g. https://dev.example.com
+```
+
+Opening the hub URL in a browser then shows the sign-in page, and after that the full dashboard. Paired machines keep
+working on the same URL, since they authenticate with their own tokens. Some details:
+
+- It can't be turned on without a dashboard password, and removing the password turns sharing off.
+- The session cookie is `HttpOnly`, `SameSite=Strict` and `Secure` on https. Wrong passwords are rate limited per visitor IP.
+- The browser never gets this machine's API token. Changes are only accepted from the page's own origin.
+- Only the dashboard is shared. Your mappings stay reachable only by paired machines, and links in the dashboard still point
+  at `*.localhost` names, which open on the visitor's own machine.
+- Anyone with the password controls this locadot, including remote access and stopping the proxy. Use a strong one, or
+  prefer a named tunnel (`hub:setup`) behind Cloudflare Access if you need more.
+
 ### Certificates
 
 | Command | What it does |
@@ -152,7 +198,7 @@ An admin's `<port>.<domain>.localhost` gets the same treatment when a `--cors` m
 | `locadot clear:logs` | Clear the log file. |
 | `locadot path` | Show every file locadot uses. `path:logs` and `path:hosts` print a single path. |
 | `locadot token` | Print the dashboard API token, for scripts and AI agents. |
-| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron, macOS LaunchAgent) or logon (a hidden script in the Windows Startup folder, no admin needed). |
+| `locadot startup:enable` / `startup:disable` / `startup:status` | Start the proxy at boot (Linux cron; macOS LaunchDaemon with `sudo`, running as you) or logon (macOS LaunchAgent without `sudo`; a hidden script in the Windows Startup folder, no admin needed). |
 
 ---
 
@@ -184,6 +230,8 @@ hosts become cards:
 Trust and start-at-boot may need elevation. locadot asks the OS for it (polkit on Linux, the password dialog on macOS, UAC on Windows).
 If that isn't possible, for example on a headless Linux box, the panel shows the exact command to run instead: `sudo locadot trust`,
 `locadot startup:enable`, and so on.
+On macOS, run `locadot trust` without `sudo`: it asks for your password itself, and macOS then confirms the trust change in a
+dialog, which only works in Terminal on the Mac, not over SSH. Under `sudo` it would trust root's own CA instead of yours.
 
 ### Dashboard password
 
@@ -196,6 +244,7 @@ echo "$PW" | locadot ui:password --stdin
 ```
 
 You can also set, change or remove it under **Settings → Dashboard password** (changing or removing it there needs the current one).
+It's also what [sharing the dashboard in a browser](#sharing-the-dashboard-in-a-browser) signs visitors in with.
 Only the dashboard is protected. Your mapped hosts work as before, and so do scripts and the CLI that send `X-Locadot-Token`.
 Sessions last 7 days, and changing the password signs everyone out. If you forget it, run `locadot ui:password` again in a terminal.
 
@@ -212,6 +261,8 @@ each time the proxy starts.
 | `GET /api/logs?lines=200` | | `{ lines: [...] }` |
 | `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false, "cors": false }` | Add a mapping (201; 409 if it exists). |
 | `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false, "cors": true }` | Change a mapping (404 if unknown). |
+| `PUT /api/hosts/:host` | `{ "allow": ["localhost:3000"] }` | Replace the internal addresses shared visitors may reach (normalized; `[]` clears; 400 if one is invalid). |
+| `PUT /api/hosts/:host` | `{ "tunnel": true, "domain": "app.example.com" }` | Share on a public URL: with `domain`, on that hostname through a named Cloudflare tunnel, without it on a random trycloudflare.com URL. `{ "tunnel": false }` stops sharing (400 for a bad hostname, 409 if another mapping uses it). |
 | `DELETE /api/hosts/:host` | | Remove a mapping. |
 | `POST /api/startup` | `{ "enabled": true }` | Start at boot on/off. |
 | `POST /api/trust` | `{ "trusted": true }` | Trust or untrust the CA. |
@@ -221,8 +272,9 @@ each time the proxy starts.
 | `PUT /api/settings` | `{ "httpPort": 8080, "httpsPort": 8443 }` | Save new ports to the config file (400 if invalid or equal). Takes effect after a restart. |
 | `POST /api/proxy/restart` | | Restart the proxy (e.g. to pick up saved ports). |
 | `PUT /api/settings/ui-password` | `{ "password": "…", "current": "…" }` or `{ "enabled": false, "current": "…" }` | Set, change or remove the dashboard password (`current` is required once one is set). |
-| `GET /api/hub` | | Hub status/config, plus `localhost` (sender: is localhost access on). |
+| `GET /api/hub` | | Hub status/config, plus `localhost` (sender: is localhost access on) and `panel` (is the dashboard shared). |
 | `PUT /api/hub/localhost` | `{ "enabled": true }` | Sender: turn localhost access for admin peers on/off (400 if the hub isn't configured). |
+| `PUT /api/hub/panel` | `{ "enabled": true }` | Sender: share the dashboard at the hub's public URL on/off (400 if the hub isn't configured, or no dashboard password is set). |
 | `GET /api/remotes` | | Every remote (never the token), including `domain` and `localhost`. |
 | `POST /api/remotes` | `{ "string": "<pairing string>", "name": "alice", "domain": "dev" }` | Receiver: connect using a pairing string; `domain` is optional (admin only, random if omitted). |
 | `PUT /api/remotes/:name` | `{ "domain": "dev" }` or `{ "domain": "random" }` or `{ "domain": null }` | Receiver: set, randomize or remove a remote's local domain (400 invalid, 409 clash, 404 unknown). |

package/dist/cli/commands/hosts.js

@@ -38,12 +38,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.add = add;
 exports.update = update;
+exports.allow = allow;
 exports.remove = remove;
 exports.list = list;
 exports.clearHosts = clearHosts;
 const localhost_1 = __importStar(require("../../lib/localhost"));
 const registry_1 = __importDefault(require("../../lib/registry"));
 const hosts_1 = __importDefault(require("../../lib/hosts"));
+const allow_1 = require("../../lib/allow");
 const urls_1 = require("../../lib/urls");
 const shared_1 = require("../shared");
 const resolveTarget = (options) => {
@@ -61,6 +63,7 @@ const mapping = (options) => ({
     target: resolveTarget(options),
     insecure: options.insecure,
     cors: options.cors,
+    allow: options.allow,
 });
 const warnIfDown = async (entry) => {
     const probe = await localhost_1.default.probe(entry.target, 1500, entry.insecure);
@@ -82,6 +85,31 @@ async function update(options) {
     (0, shared_1.print)(`✅ Updated ${(0, urls_1.urlFor)(host)} → ${entry.target}`);
     await warnIfDown(entry);
 }
+async function allow(addresses, options) {
+    const host = localhost_1.default.requireHost(options.host);
+    const entry = registry_1.default.read().hosts[host];
+    if (!entry)
+        throw new localhost_1.InputError(`❌ ${host} isn't mapped. Add it first: locadot add --host ${host} --port <port> --cors`);
+    if (options.clear && addresses.length)
+        throw new localhost_1.InputError("❌ Use either --clear or addresses, not both.");
+    if (options.rm && !addresses.length)
+        throw new localhost_1.InputError("❌ Pass the addresses to remove.");
+    const current = entry.allow ?? [];
+    let next = current;
+    if (options.clear)
+        next = [];
+    else if (options.rm) {
+        const drop = new Set((0, allow_1.parseAllowList)(addresses));
+        next = current.filter((item) => !drop.has(item));
+    }
+    else if (addresses.length)
+        next = [...current, ...(0, allow_1.parseAllowList)(addresses)];
+    const { entry: saved } = next === current ? { entry } : await hosts_1.default.setAllow({ host, allow: next });
+    const list = saved.allow ?? [];
+    (0, shared_1.print)(list.length ? `🔓 ${(0, urls_1.urlFor)(host)} lets shared visitors reach: ${list.join(", ")}` : `🔒 ${(0, urls_1.urlFor)(host)} lets shared visitors reach public hosts only.`);
+    if (list.length && !saved.cors)
+        (0, shared_1.print)(`ℹ️  Takes effect once --cors is on: locadot update --host ${host} --target ${saved.target} --cors`);
+}
 async function remove(options) {
     const { host } = await hosts_1.default.remove(options);
     (0, shared_1.print)(`🗑️  Removed ${host}.`);
@@ -98,7 +126,7 @@ async function list(options) {
     }
     const width = Math.max(...hosts.map(([host]) => (0, urls_1.urlFor)(host).length));
     for (const [host, entry] of hosts) {
-        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}`);
+        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}${entry.allow?.length ? `  (allow ${entry.allow.join(", ")})` : ""}`);
     }
     (0, shared_1.print)(`☑️ Total: ${hosts.length}.`);
 }

package/dist/cli/commands/remote.js

@@ -9,6 +9,7 @@ exports.hubQuick = hubQuick;
 exports.hubManual = hubManual;
 exports.hubOff = hubOff;
 exports.hubLocalhost = hubLocalhost;
+exports.hubPanel = hubPanel;
 exports.share = share;
 exports.peers = peers;
 exports.peersRole = peersRole;
@@ -102,7 +103,7 @@ const getHub = async () => {
 };
 const HUB_EMOJI = { off: "🔒", starting: "⏳", up: "🌍", error: "❌", login: "🔑" };
 async function hub(options) {
-    const { hub } = await getHub();
+    const { hub, panel } = await getHub();
     if (options.json) {
         console.log(JSON.stringify(hub, null, 2));
         return;
@@ -116,6 +117,8 @@ async function hub(options) {
         (0, shared_1.print)(`   Open to finish login: ${hub.loginUrl}`);
     if (hub.error)
         (0, shared_1.print)(`   ${hub.error}`);
+    if (panel)
+        (0, shared_1.print)(`   Dashboard shared${hub.url ? ` at ${hub.url}` : ""} (password sign-in). Turn off: locadot hub:panel off`);
 }
 async function hubSetup(options) {
     if (!options.domain)
@@ -172,6 +175,23 @@ async function hubLocalhost(value) {
         throw new localhost_1.InputError(`❌ Couldn't update (${status})${json?.error ? `: ${json.error}` : ""}.`);
     (0, shared_1.print)(json.localhost ? "🖥️  Admin peers can now reach this machine's localhost." : "🔒 Admin peers can no longer reach this machine's localhost.");
 }
+async function hubPanel(value) {
+    if (value !== "on" && value !== "off")
+        throw new localhost_1.InputError('❌ Use "on" or "off".');
+    requireRunning();
+    const { status, json } = await dashboardRequest("PUT", "/api/hub/panel", {
+        headers: { "X-Locadot-Token": apiToken() },
+        body: { enabled: value === "on" },
+    });
+    if (status === 400)
+        throw new localhost_1.InputError(`❌ ${json?.error || "Set up the hub first: locadot hub:setup / hub:quick / hub:manual."}${json?.hint ? ` ${json.hint}` : ""}`);
+    if (status !== 200)
+        throw new localhost_1.InputError(`❌ Couldn't update (${status})${json?.error ? `: ${json.error}` : ""}.`);
+    if (!json.panel)
+        return (0, shared_1.print)("🔒 The dashboard is no longer shared.");
+    const { hub } = await getHub();
+    (0, shared_1.print)(`🌍 The dashboard is shared${hub.url ? ` at ${hub.url}` : ""}. Visitors sign in with the dashboard password.`);
+}
 async function share(options) {
     const role = requireRole(options.role);
     if (options.hosts && role !== "viewer") {

package/dist/cli/commands/tunnel.js

@@ -73,7 +73,7 @@ async function installTunnel() {
     const info = await (0, tunnel_1.installCloudflared)();
     (0, shared_1.print)(`✅ cloudflared ${info.version ?? ""} installed at ${info.path}`);
 }
-/** Shares a mapping on a public trycloudflare.com URL, or lists what's shared when no host is given. */
+/** Shares a mapping on a public trycloudflare.com URL or `--domain`, or lists what's shared when no host is given. */
 async function tunnel(options) {
     if (!options.host) {
         const shared = await tunnelRows();
@@ -91,11 +91,17 @@ async function tunnel(options) {
     }
     if (!(0, tunnel_1.cloudflaredInfo)(true).installed)
         await installTunnel();
-    await hosts_1.default.setTunnel({ host, tunnel: true });
+    await hosts_1.default.setTunnel({ host, tunnel: true, domain: options.domain });
     await (0, shared_1.ensureRunning)();
-    const deadline = Date.now() + TUNNEL_TIMEOUT_MS;
+    let deadline = Date.now() + TUNNEL_TIMEOUT_MS;
+    let loginShown = false;
     while (Date.now() < deadline) {
         const state = (await tunnelRows()).find((row) => row.host === host)?.tunnel;
+        if (state?.status === "login" && state.loginUrl && !loginShown) {
+            loginShown = true;
+            deadline = Date.now() + 10 * 60000;
+            (0, shared_1.print)(`🔑 Log in to Cloudflare to finish: ${state.loginUrl}`);
+        }
         if (state?.status === "up") {
             (0, shared_1.print)(`🌍 ${host} is public at ${state.url}`);
             (0, shared_1.print)("   Anyone with the link can reach it. Stop with: locadot tunnel --host " + host + " --off");

package/dist/dashboard/api.js

@@ -321,6 +321,7 @@ function buildHubBody(ctx) {
         hub: ctx.hub(),
         config: config ?? null,
         localhost: config?.localhost !== false,
+        panel: config?.panel === true,
         invites: invites.map(sanitizeInvite),
         peers: peers.map(sanitizePeer),
     };
@@ -355,6 +356,7 @@ async function route(req, url, ctx) {
         (["/api/startup", "/api/trust", "/api/logs/clear", "/api/proxy/stop", "/api/proxy/restart", "/api/cloudflared/install", "/api/hub", "/api/invites", "/api/remotes"].includes(path) &&
             method === "POST") ||
         (path === "/api/hub/localhost" && method === "PUT") ||
+        (path === "/api/hub/panel" && method === "PUT") ||
         (path === "/api/settings" && method === "PUT") ||
         (inviteMatch && method === "DELETE") ||
         (peerMatch && (method === "PUT" || method === "DELETE")) ||
@@ -392,7 +394,13 @@ async function route(req, url, ctx) {
             return { status: 200, body: buildSettingsBody(ctx, warnings.length ? warnings.join("; ") : undefined) };
         }
         if (path === "/api/hosts") {
-            const { host, entry } = await hosts_1.default.add({ host: body.host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
+            const { host, entry } = await hosts_1.default.add({
+                host: body.host,
+                target: body.target,
+                insecure: optionalBool(body.insecure, "insecure"),
+                cors: optionalBool(body.cors, "cors"),
+                allow: body.allow,
+            });
             ctx.reload();
             logger_1.default.info(`➕ dashboard: ${host} → ${entry.target}`);
             return { status: 201, body: { ok: true, host, ...entry, url: hostUrl(host, ctx) } };
@@ -407,13 +415,24 @@ async function route(req, url, ctx) {
             }
             const tunnel = optionalBool(body.tunnel, "tunnel");
             let updated;
-            if (body.target !== undefined || tunnel === undefined) {
-                updated = await hosts_1.default.update({ host, target: body.target, insecure: optionalBool(body.insecure, "insecure"), cors: optionalBool(body.cors, "cors") });
+            if (body.allow !== undefined && body.target === undefined) {
+                updated = await hosts_1.default.setAllow({ host, allow: body.allow });
+                logger_1.default.info(`✏️ dashboard: ${updated.host} allows ${updated.entry.allow?.join(", ") || "no internal addresses"}`);
+            }
+            if (body.target !== undefined || (tunnel === undefined && body.allow === undefined)) {
+                updated = await hosts_1.default.update({
+                    host,
+                    target: body.target,
+                    insecure: optionalBool(body.insecure, "insecure"),
+                    cors: optionalBool(body.cors, "cors"),
+                    allow: body.allow,
+                });
                 logger_1.default.info(`✏️ dashboard: ${updated.host} → ${updated.entry.target}`);
             }
             if (tunnel !== undefined) {
-                updated = await hosts_1.default.setTunnel({ host, tunnel });
-                logger_1.default.info(`🌍 dashboard: ${tunnel ? "sharing" : "stopped sharing"} ${updated.host}`);
+                updated = await hosts_1.default.setTunnel({ host, tunnel, domain: body.domain });
+                const on = updated.entry.tunnelDomain && tunnel ? `sharing ${updated.host} on ${updated.entry.tunnelDomain}` : `sharing ${updated.host}`;
+                logger_1.default.info(`🌍 dashboard: ${tunnel ? on : `stopped sharing ${updated.host}`}`);
             }
             ctx.reload();
             if (tunnel)
@@ -467,6 +486,17 @@ async function route(req, url, ctx) {
             ctx.reloadHub();
             return { status: 200, body: { localhost: enabled } };
         }
+        if (path === "/api/hub/panel" && method === "PUT") {
+            const enabled = requiredBool(body.enabled, "enabled");
+            const config = hub_config_1.default.read();
+            if (!config)
+                throw new ApiError(400, "The hub isn't configured yet. Set it up first: locadot hub:setup / hub:quick / hub:manual.");
+            if (enabled && !ui_auth_1.default.enabled())
+                throw new ApiError(400, "Set a dashboard password first.", "Settings → Dashboard password, or `locadot ui:password`.");
+            hub_config_1.default.write({ ...config, panel: enabled });
+            ctx.reloadHub();
+            return { status: 200, body: { panel: enabled } };
+        }
         if (path === "/api/invites" && method === "POST") {
             if (!isRole(body.role))
                 throw new ApiError(400, "`role` must be viewer, editor or admin.");

package/dist/dashboard/index.js

@@ -91,6 +91,8 @@ async function buildHosts(ctx) {
             target: entry.target,
             insecure: !!entry.insecure,
             cors: !!entry.cors,
+            allow: entry.allow ?? [],
+            tunnelDomain: entry.tunnelDomain ?? null,
             createdAt: entry.createdAt,
             updatedAt: entry.updatedAt,
             urls: hostUrls(host, httpPort, httpsPort),
@@ -177,7 +179,7 @@ function handleDashboardRequest(req, res, ctx) {
 async function uiPassword(req, res, ctx) {
     (0, api_1.assertTrusted)(req, ctx);
     const body = await (0, api_1.readJson)(req);
-    const ip = req.socket.remoteAddress || "";
+    const ip = (0, login_1.loginIp)(req);
     if (ui_auth_1.default.enabled()) {
         if (ui_auth_1.default.limited(ip))
             throw new api_1.ApiError(429, "Too many wrong passwords. Wait a few minutes and try again.");

package/dist/dashboard/login.js

@@ -36,13 +36,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionCookie = exports.signedIn = void 0;
+exports.sessionCookie = exports.signedIn = exports.loginIp = void 0;
 exports.gate = gate;
 const crypto_1 = __importDefault(require("crypto"));
 const logger_1 = __importDefault(require("../utils/logger"));
 const escape_1 = require("./escape");
 const api_1 = require("./api");
 const ui_auth_1 = __importStar(require("../lib/ui-auth"));
+const request_1 = require("../proxy/request");
+const hub_1 = require("../proxy/hub");
 const MAX_LOGIN_BODY = 4096;
 const loginPage = (nonce, error) => `<!doctype html>
 <html lang="en">
@@ -90,7 +92,9 @@ const safeEqual = (a, b) => {
     const y = Buffer.from(b);
     return x.length === y.length && crypto_1.default.timingSafeEqual(x, y);
 };
-const isTls = (req) => Boolean(req.socket.encrypted);
+/** Through the shared dashboard every visitor arrives from cloudflared on loopback, so limit by the visitor's IP. */
+const loginIp = (req) => ((0, request_1.isPanel)(req) ? (0, hub_1.clientIp)(req) : req.socket.remoteAddress || "");
+exports.loginIp = loginIp;
 const sameOrigin = (req) => {
     // Browsers send `Origin: null` on form posts under Referrer-Policy: no-referrer, so trust Sec-Fetch-Site when present.
     // "same-site" is refused: every *.localhost app is same-site with the dashboard.
@@ -102,7 +106,9 @@ const sameOrigin = (req) => {
         return !origin;
     return (0, api_1.isDashboardOrigin)(req, origin);
 };
-const cookie = (req, value, maxAge) => `${ui_auth_1.SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${isTls(req) ? "; Secure" : ""}`;
+// The shared dashboard's public URL is https even though cloudflared talks plain http to us.
+const secure = (req) => ((0, request_1.isPanel)(req) ? (0, request_1.isTls)(req) : Boolean(req.socket.encrypted));
+const cookie = (req, value, maxAge) => `${ui_auth_1.SESSION_COOKIE}=${value}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${secure(req) ? "; Secure" : ""}`;
 const sendLogin = (res, method, nonce, status, error) => {
     // The dashboard's CSP forbids form posts; the login form needs one.
     res.setHeader("Content-Security-Policy", `default-src 'none'; style-src 'nonce-${nonce}'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`);
@@ -149,8 +155,13 @@ exports.sessionCookie = sessionCookie;
  * are let through untouched. Returns true when it answered the request itself.
  */
 function gate(req, res, url, token, nonce) {
-    if (!ui_auth_1.default.enabled())
-        return false;
+    if (!ui_auth_1.default.enabled()) {
+        if (!(0, request_1.isPanel)(req))
+            return false;
+        res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("locadot: set a dashboard password to share the dashboard.\n");
+        return true;
+    }
     const method = req.method || "GET";
     const path = url.pathname;
     if (path === "/login") {
@@ -162,7 +173,7 @@ function gate(req, res, url, token, nonce) {
         }
         if (method !== "POST")
             return false;
-        const ip = req.socket.remoteAddress || "";
+        const ip = (0, exports.loginIp)(req);
         if (!sameOrigin(req)) {
             sendLogin(res, method, nonce, 403, "Cross-site sign-in is not allowed.");
             return true;