locadot 2.4.0 → 2.6.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # Changelog
 
+## 2.6.0 (2026-09-30)
+
+### Added
+- http → https redirect. `locadot https:redirect on` (or Settings → Proxy in the dashboard, or
+  `PUT /api/settings {"httpsRedirect": true}`) sends plain `http://` requests for every domain and the dashboard to
+  `https://` with a 307. Per domain, `locadot add/update --https-redirect on|off|default` (the edit row in the
+  dashboard, `httpsRedirect: true|false|null` in the API) overrides it either way. Off by default; applies without a
+  restart. Shared links, remote access, WebSockets and the dashboard's `/api` and `/healthz` are left alone.
+
+### Fixed
+- `locadot start --port/--https-port` no longer drops other settings saved in the config file.
+
+## 2.5.0 (2026-09-29)
+
+### Changed
+- Dashboard redesign. Pages are grouped: Hosts has All/Shared tabs (Public sharing moved in), Remote has This
+  machine/Connected machines tabs, Settings has General/Security/Preferences/Developer tabs. Old links redirect.
+- Hosts: Add host opens a dialog; each row has one main action plus a ⋯ menu (edit, share, access, password, remove).
+- Phones and tablets: bottom tab bar, bottom-sheet menus and dialogs, card layouts, icon rail below 1100px; subtle
+  enter/exit animations that respect reduced motion. Logs get level colours, copy and a sticky toolbar.
+
 ## 2.4.0 (2026-09-29)
 
 ### Added

package/README.md

@@ -79,6 +79,7 @@ Options for `add` / `update`:
 | `-t, --target <url>` | Any http(s) upstream. A bare `host:port` means `http://host:port`. |
 | `-k, --insecure` | Don't verify the TLS certificate of an `https` target (self-signed upstreams). |
 | `--cors` / `--no-cors` | Bypass CORS for this domain. The upstream gets `Origin`/`Referer` as its own origin, preflights are answered locally, any origin may read responses (with credentials), and cookies become `SameSite=None` over HTTPS. The page's calls to other domains go through locadot automatically, with no extra mapping (see [Sites that call other domains](#sites-that-call-other-domains---cors)). |
+| `--https-redirect on\|off\|default` | Send plain `http://` requests for this domain to `https://` (`on`), never (`off`), or follow `locadot https:redirect` (`default`, the initial state). `locadot update --host h --https-redirect on` changes only this, without a target. |
 | `--no-start` | Save the mapping without starting the proxy. |
 
 ### Proxy
@@ -88,6 +89,7 @@ Options for `add` / `update`:
 | `locadot start [--port 8080] [--https-port 8443]` | Start the central proxy. Default ports are 80 and 443. Ports you pass are remembered for later commands and start-at-boot, and a running proxy is moved to them. Fails loudly with the reason if it can't bind its ports. |
 | `locadot stop` | Stop the proxy. Mappings and logs are kept. |
 | `locadot restart [--port …] [--https-port …]` | Stop, then start. |
+| `locadot https:redirect [on\|off]` | Redirect plain `http://` requests to `https://` (307) for every domain and the dashboard; without an argument, show the setting. Off by default. A domain's own `--https-redirect` wins. Applies at once, without a restart. Shared links, remote access, WebSockets and the dashboard's `/api` and `/healthz` are never redirected. |
 | `locadot kill` | Stop the proxy, remove all mappings and clear the logs. |
 | `locadot status [--json]` | Is it running, its PID, ports, number of hosts, CA trust, start-at-boot, dashboard URL. |
 | `locadot doctor [--host h]` | Check the proxy, ports, permissions, CA trust, the registry and every target. Exits 1 if anything fails. |
@@ -276,6 +278,7 @@ each time the proxy starts.
 | `GET /api/logs?lines=200` | | `{ lines: [...] }` |
 | `POST /api/hosts` | `{ "host": "app.localhost", "target": "3000", "insecure": false, "cors": false }` | Add a mapping (201; 409 if it exists). |
 | `PUT /api/hosts/:host` | `{ "target": "https://example.com", "insecure": false, "cors": true }` | Change a mapping (404 if unknown). |
+| `PUT /api/hosts/:host` | `{ "httpsRedirect": true }` | Redirect this mapping's plain http to https (`true`), never (`false`), or follow the global setting (`null`). Also accepted by `POST /api/hosts` and alongside `target`. Rows show `httpsRedirect: true \| false \| null`. |
 | `PUT /api/hosts/:host` | `{ "allow": ["localhost:3000"] }` | Replace the internal addresses shared visitors may reach (normalized; `[]` clears; 400 if one is invalid). |
 | `PUT /api/hosts/:host` | `{ "protect": { "password": "…", "scopes": ["shared", "remote", "local"] } }` | Ask for a password on those paths in (at least one; `password` may be left out to keep the current one). `{ "protect": null }` removes it. Rows show `protect: { scopes, updatedAt }`, never the password. |
 | `PUT /api/hosts/:host` | `{ "tunnel": true, "domain": "app.example.com" }` | Share on a public URL: with `domain`, on that hostname through a named Cloudflare tunnel, without it on a random trycloudflare.com URL. `{ "tunnel": false }` stops sharing (400 for a bad hostname, 409 if another mapping uses it). |
@@ -284,8 +287,9 @@ each time the proxy starts.
 | `POST /api/trust` | `{ "trusted": true }` | Trust or untrust the CA. |
 | `POST /api/logs/clear` | | Clear the log. |
 | `POST /api/proxy/stop` | | Stop the proxy. Use `locadot start` to bring it back. |
-| `GET /api/settings` | | Running ports/bind, `logLevel`, `stateDir`, `saved`/`env` overrides, and `restartRequired`. |
+| `GET /api/settings` | | Running ports/bind, `logLevel`, `stateDir`, `saved`/`env` overrides, `restartRequired` and `httpsRedirect`. |
 | `PUT /api/settings` | `{ "httpPort": 8080, "httpsPort": 8443 }` | Save new ports to the config file (400 if invalid or equal). Takes effect after a restart. |
+| `PUT /api/settings` | `{ "httpsRedirect": true }` | Turn the global http → https redirect on or off; takes effect at once. |
 | `POST /api/proxy/restart` | | Restart the proxy (e.g. to pick up saved ports). |
 | `PUT /api/settings/ui-password` | `{ "password": "…", "current": "…" }` or `{ "enabled": false, "current": "…" }` | Set, change or remove the dashboard password (`current` is required once one is set). |
 | `GET /api/hub` | | Hub status/config, plus `localhost` (sender: is localhost access on) and `panel` (is the dashboard shared). |

package/dist/cli/commands/hosts.js

@@ -48,6 +48,18 @@ const hosts_1 = __importDefault(require("../../lib/hosts"));
 const allow_1 = require("../../lib/allow");
 const urls_1 = require("../../lib/urls");
 const shared_1 = require("../shared");
+const parseRedirect = (value) => {
+    if (value === undefined)
+        return undefined;
+    if (value === "on")
+        return true;
+    if (value === "off")
+        return false;
+    if (value === "default")
+        return null;
+    throw new localhost_1.InputError(`❌ --https-redirect takes on, off or default, got "${value}".`);
+};
+const redirectNote = (entry) => entry.httpsRedirect === undefined ? "" : entry.httpsRedirect ? "  (https redirect)" : "  (no https redirect)";
 const resolveTarget = (options) => {
     if (options.port !== undefined && options.target !== undefined) {
         throw new localhost_1.InputError("❌ Use either --port or --target, not both.");
@@ -64,6 +76,7 @@ const mapping = (options) => ({
     insecure: options.insecure,
     cors: options.cors,
     allow: options.allow,
+    httpsRedirect: parseRedirect(options.httpsRedirect),
 });
 const warnIfDown = async (entry) => {
     const probe = await localhost_1.default.probe(entry.target, 1500, entry.insecure);
@@ -80,6 +93,12 @@ async function add(options) {
     await warnIfDown(entry);
 }
 async function update(options) {
+    if (options.port === undefined && options.target === undefined && options.httpsRedirect !== undefined) {
+        const { host, entry } = await hosts_1.default.setHttpsRedirect({ host: options.host, httpsRedirect: parseRedirect(options.httpsRedirect) });
+        await (0, shared_1.ensureRunning)(options);
+        (0, shared_1.print)(`✅ ${(0, urls_1.urlFor)(host)}: ${entry.httpsRedirect === undefined ? "https redirect follows the global setting (locadot https:redirect)" : entry.httpsRedirect ? "plain http redirects to https" : "plain http is never redirected"}`);
+        return;
+    }
     const { host, entry } = await hosts_1.default.update(mapping(options));
     await (0, shared_1.ensureRunning)(options);
     (0, shared_1.print)(`✅ Updated ${(0, urls_1.urlFor)(host)} → ${entry.target}`);
@@ -126,7 +145,7 @@ async function list(options) {
     }
     const width = Math.max(...hosts.map(([host]) => (0, urls_1.urlFor)(host).length));
     for (const [host, entry] of hosts) {
-        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}${entry.allow?.length ? `  (allow ${entry.allow.join(", ")})` : ""}${entry.protect ? `  (password: ${entry.protect.scopes.join(", ")})` : ""}`);
+        (0, shared_1.print)(`${(0, urls_1.urlFor)(host).padEnd(width)}  →  ${entry.target}${entry.insecure ? "  (insecure)" : ""}${entry.cors ? "  (cors)" : ""}${entry.allow?.length ? `  (allow ${entry.allow.join(", ")})` : ""}${entry.protect ? `  (password: ${entry.protect.scopes.join(", ")})` : ""}${redirectNote(entry)}`);
     }
     (0, shared_1.print)(`☑️ Total: ${hosts.length}.`);
 }

package/dist/cli/commands/proxy.js

@@ -7,14 +7,14 @@ exports.status = status;
 exports.start = start;
 exports.stop = stop;
 exports.restart = restart;
+exports.httpsRedirect = httpsRedirect;
 exports.kill = kill;
-const fs_1 = __importDefault(require("fs"));
 const localhost_1 = require("../../lib/localhost");
 const proxy_control_1 = __importDefault(require("../../lib/proxy-control"));
 const registry_1 = __importDefault(require("../../lib/registry"));
 const urls_1 = require("../../lib/urls");
 const constants_1 = __importDefault(require("../../constants"));
-const file_1 = __importDefault(require("../../utils/file"));
+const config_1 = __importDefault(require("../../lib/config"));
 const startup_1 = __importDefault(require("../../utils/startup"));
 const trust_1 = require("../../utils/trust");
 const shared_1 = require("../shared");
@@ -35,8 +35,7 @@ const usePorts = (options) => {
     if (httpPort === httpsPort)
         throw new localhost_1.InputError(`❌ HTTP and HTTPS can't share port ${httpPort}.`);
     Object.assign(constants_1.default.server, { httpPort, httpsPort });
-    file_1.default.ensureDir();
-    fs_1.default.writeFileSync(constants_1.default.paths.CONFIG_FILE, JSON.stringify({ httpPort, httpsPort }, null, 2) + "\n");
+    config_1.default.write({ httpPort, httpsPort });
     return true;
 };
 async function status(options) {
@@ -53,6 +52,7 @@ async function status(options) {
         bind: info?.bind ?? constants_1.default.server.bind,
         hosts,
         caTrusted: trusted,
+        httpsRedirect: config_1.default.httpsRedirect(),
         startupEnabled: startup,
         dashboard: (0, urls_1.urlFor)("localhost"),
         stateDir: constants_1.default.paths.HOME,
@@ -65,6 +65,7 @@ async function status(options) {
     (0, shared_1.print)(`   Ports:     http ${report.httpPort}, https ${report.httpsPort} on ${report.bind.join(", ")}`);
     (0, shared_1.print)(`   Hosts:     ${hosts}`);
     (0, shared_1.print)(`   CA:        ${trusted === undefined ? "unknown" : trusted ? "trusted" : "not trusted (run `locadot trust`)"}`);
+    (0, shared_1.print)(`   Redirect:  ${report.httpsRedirect ? "http → https" : "off"}`);
     (0, shared_1.print)(`   Startup:   ${startup ? "enabled" : "disabled"}`);
     (0, shared_1.print)(`   Dashboard: ${report.dashboard}`);
     (0, shared_1.print)(`   State dir: ${report.stateDir}`);
@@ -94,6 +95,16 @@ async function restart(options = {}) {
     const info = await proxy_control_1.default.restart();
     (0, shared_1.print)(`☑️ Proxy restarted on http ${info.httpPort}, https ${info.httpsPort} (pid ${info.pid}).`);
 }
+/** The global http → https redirect; the running proxy picks the change up without a restart. */
+async function httpsRedirect(value) {
+    if (value !== undefined && value !== "on" && value !== "off")
+        throw new localhost_1.InputError('❌ Use "on" or "off".');
+    if (value !== undefined)
+        config_1.default.write({ httpsRedirect: value === "on" || undefined });
+    const on = config_1.default.httpsRedirect();
+    (0, shared_1.print)(on ? `🔒 Plain http is redirected to https (${(0, urls_1.urlFor)("localhost")}).` : "☑️ Plain http is served as-is (no https redirect).");
+    (0, shared_1.print)("   Per domain: locadot update --host <host> --https-redirect on|off|default");
+}
 async function kill() {
     await proxy_control_1.default.kill();
     (0, shared_1.print)(constants_1.default.proxyInfo.proxyClose);

package/dist/dashboard/api.js

@@ -59,6 +59,7 @@ const links_1 = __importStar(require("../lib/links"));
 const hub_config_1 = __importDefault(require("../lib/hub-config"));
 const remotes_1 = __importStar(require("../lib/remotes"));
 const ui_auth_1 = __importDefault(require("../lib/ui-auth"));
+const config_1 = __importDefault(require("../lib/config"));
 const request_1 = require("../proxy/request");
 const MAX_BODY = 64 * 1024;
 class ApiError extends Error {
@@ -152,6 +153,12 @@ const optionalBool = (value, name) => {
         throw new ApiError(400, `\`${name}\` must be true or false.`);
     return value;
 };
+/** A mapping's https redirect: true/false, or null to follow the global setting. */
+const optionalRedirect = (value) => {
+    if (value === undefined || value === null || typeof value === "boolean")
+        return value;
+    throw new ApiError(400, "`httpsRedirect` must be true, false or null (follow the global setting).");
+};
 const requiredBool = (value, name) => {
     const result = optionalBool(value, name);
     if (result === undefined)
@@ -215,18 +222,8 @@ const sanitizeRemote = (remote) => {
     const { token, ...rest } = remote;
     return rest;
 };
-/** Reads CONFIG_FILE as-is (whatever `locadot start --port/--https-port` last wrote), tolerating a missing/corrupt file. */
-function readConfig() {
-    try {
-        const raw = JSON.parse(fs_1.default.readFileSync(constants_1.default.paths.CONFIG_FILE, "utf8"));
-        return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-    }
-    catch {
-        return {};
-    }
-}
 const savedPorts = () => {
-    const config = readConfig();
+    const config = config_1.default.read();
     return {
         httpPort: constants_1.default.validPort(config.httpPort),
         httpsPort: constants_1.default.validPort(config.httpsPort),
@@ -252,6 +249,7 @@ function buildSettingsBody(ctx, warning) {
         saved,
         env,
         restartRequired,
+        httpsRedirect: config_1.default.httpsRedirect(),
         uiAuth: { enabled: ui_auth_1.default.enabled(), updatedAt: ui_auth_1.default.read()?.updatedAt },
         ...(warning ? { warning } : {}),
     };
@@ -373,23 +371,29 @@ async function route(req, url, ctx) {
         if (path === "/api/settings" && method === "PUT") {
             const newHttp = validPortInput(body.httpPort, "httpPort");
             const newHttps = validPortInput(body.httpsPort, "httpsPort");
-            if (newHttp === undefined && newHttps === undefined)
-                throw new ApiError(400, "Provide `httpPort` and/or `httpsPort`.");
-            const config = readConfig();
-            const saved = savedPorts();
-            const finalHttp = newHttp ?? saved.httpPort ?? ctx.proxyInfo.httpPort;
-            const finalHttps = newHttps ?? saved.httpsPort ?? ctx.proxyInfo.httpsPort;
-            if (finalHttp === finalHttps)
-                throw new ApiError(400, "`httpPort` and `httpsPort` can't be the same.");
-            file_1.default.ensureDir();
-            fs_1.default.writeFileSync(constants_1.default.paths.CONFIG_FILE, JSON.stringify({ ...config, httpPort: finalHttp, httpsPort: finalHttps }, null, 2) + "\n");
-            logger_1.default.info(`⚙️ dashboard: settings saved → http ${finalHttp}, https ${finalHttps}`);
-            const warnings = [];
-            if (newHttp !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTP_PORT") !== undefined) {
-                warnings.push("LOCADOT_HTTP_PORT is set and overrides this");
+            const httpsRedirect = optionalBool(body.httpsRedirect, "httpsRedirect");
+            if (newHttp === undefined && newHttps === undefined && httpsRedirect === undefined) {
+                throw new ApiError(400, "Provide `httpPort`, `httpsPort` and/or `httpsRedirect`.");
+            }
+            if (httpsRedirect !== undefined) {
+                config_1.default.write({ httpsRedirect: httpsRedirect || undefined });
+                logger_1.default.info(`⚙️ dashboard: http → https redirect ${httpsRedirect ? "on" : "off"}`);
             }
-            if (newHttps !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTPS_PORT") !== undefined) {
-                warnings.push("LOCADOT_HTTPS_PORT is set and overrides this");
+            const warnings = [];
+            if (newHttp !== undefined || newHttps !== undefined) {
+                const saved = savedPorts();
+                const finalHttp = newHttp ?? saved.httpPort ?? ctx.proxyInfo.httpPort;
+                const finalHttps = newHttps ?? saved.httpsPort ?? ctx.proxyInfo.httpsPort;
+                if (finalHttp === finalHttps)
+                    throw new ApiError(400, "`httpPort` and `httpsPort` can't be the same.");
+                config_1.default.write({ httpPort: finalHttp, httpsPort: finalHttps });
+                logger_1.default.info(`⚙️ dashboard: settings saved → http ${finalHttp}, https ${finalHttps}`);
+                if (newHttp !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTP_PORT") !== undefined) {
+                    warnings.push("LOCADOT_HTTP_PORT is set and overrides this");
+                }
+                if (newHttps !== undefined && constants_1.default.userEnvPort("LOCADOT_HTTPS_PORT") !== undefined) {
+                    warnings.push("LOCADOT_HTTPS_PORT is set and overrides this");
+                }
             }
             return { status: 200, body: buildSettingsBody(ctx, warnings.length ? warnings.join("; ") : undefined) };
         }
@@ -400,6 +404,7 @@ async function route(req, url, ctx) {
                 insecure: optionalBool(body.insecure, "insecure"),
                 cors: optionalBool(body.cors, "cors"),
                 allow: body.allow,
+                httpsRedirect: optionalRedirect(body.httpsRedirect),
             });
             ctx.reload();
             logger_1.default.info(`➕ dashboard: ${host} → ${entry.target}`);
@@ -429,13 +434,19 @@ async function route(req, url, ctx) {
                 const scopes = updated.entry.protect?.scopes;
                 logger_1.default.info(`🔒 dashboard: ${scopes ? `${updated.host} asks for a password on ${scopes.join(", ")}${protect?.password ? " (new password)" : ""}` : `${updated.host} is no longer password protected`}`);
             }
-            if (body.target !== undefined || (tunnel === undefined && body.allow === undefined && body.protect === undefined)) {
+            const httpsRedirect = optionalRedirect(body.httpsRedirect);
+            if (httpsRedirect !== undefined && body.target === undefined) {
+                updated = await hosts_1.default.setHttpsRedirect({ host, httpsRedirect });
+                logger_1.default.info(`✏️ dashboard: ${updated.host} https redirect ${httpsRedirect === null ? "follows the global setting" : httpsRedirect ? "on" : "off"}`);
+            }
+            if (body.target !== undefined || (tunnel === undefined && body.allow === undefined && body.protect === undefined && httpsRedirect === undefined)) {
                 updated = await hosts_1.default.update({
                     host,
                     target: body.target,
                     insecure: optionalBool(body.insecure, "insecure"),
                     cors: optionalBool(body.cors, "cors"),
                     allow: body.allow,
+                    httpsRedirect,
                 });
                 logger_1.default.info(`✏️ dashboard: ${updated.host} → ${updated.entry.target}`);
             }

package/dist/dashboard/index.js

@@ -95,6 +95,7 @@ async function buildHosts(ctx) {
             allow: entry.allow ?? [],
             tunnelDomain: entry.tunnelDomain ?? null,
             protect: entry.protect ? { scopes: entry.protect.scopes, updatedAt: host_auth_1.default.updatedAt(host) ?? null } : null,
+            httpsRedirect: entry.httpsRedirect ?? null,
             createdAt: entry.createdAt,
             updatedAt: entry.updatedAt,
             urls: hostUrls(host, httpPort, httpsPort),