signalk-questdb 1.7.1 → 1.8.0

package/CLAUDE.md

@@ -36,6 +36,8 @@ Both build outputs are shipped in the npm package; `prepublishOnly` rebuilds the
   - **v2** (`src/history-v2.ts`) — `app.registerHistoryApiProvider()`, REST under `/signalk/v2/api/history/`. Aggregates map directly to QuestDB SQL except `sma`/`ema` (computed client-side).
   - **v1** (`src/history-v1.ts`) — `app.registerHistoryProvider()`, WebSocket playback with chunked reads.
 - Retention (`src/retention.ts`) drops old daily partitions on a timer.
+- Startup restore (`src/restore.ts`) optionally replays each vessel's last recorded position back into the live model after a server restart.
+- Console proxy (`src/console-proxy.ts`) reverse-proxies QuestDB's own web console so the embeddable webapp (`public/index.html`) can host it in the admin UI.
 
 ### Container integration
 
@@ -53,6 +55,8 @@ The package is the unscoped `typebox` (1.x), not `@sinclair/typebox` (which stop
 
 All extra plugin endpoints live under `/plugins/signalk-questdb/api/` and are wired in `src/index.ts` via the `IRouter` Signal K passes to `registerWithRouter`. The `/query` endpoint is gated by `isReadOnlySQL` in `src/query-client.ts` — DDL/DML must remain blocked.
 
+⚠️ **`/console` is deliberately NOT gated that way.** It proxies QuestDB's own console, which is a full SQL client and can drop tables. It is safe only because signalk-server gives plugin routes an **admin-only default**, and routes are downgraded to readwrite/readonly _only_ by registering them through `router.access(...)`. Never wrap the console mount in `.access()` — doing so hands non-admins the ability to delete recorded history. The mount is also gated on the `enableConsole` config flag, so turning it off removes the route rather than leaving it to refuse.
+
 Their wire shapes live in `src/api-contract.ts` and are shared by both surfaces: handlers assert responses with `satisfies`, and the panel casts fetch results to the same types. Add or rename a response field there, not inline — that is what stops the server and panel drifting apart silently.
 
 ### Tests

package/README.md

@@ -20,6 +20,7 @@ Stores all vessel data in QuestDB running as a managed container (via [signalk-c
 - **CSV export** -- download historical data via REST endpoint
 - **InfluxDB migration** -- auto-detect InfluxDB 1.x/2.x on localhost or remote URL
 - **One-click updates** -- check for new QuestDB releases and update from the config panel
+- **Console webapp** -- QuestDB's own SQL console embedded in the Signal K admin UI (admin only)
 - **Config panel** -- status dashboard with row counts, version picker, update check, collapsible compression/migration/export sections
 - **SQL injection protection** -- strict input validation on all query endpoints
 - **Container lifecycle** -- container stops when plugin is disabled, starts on enable
@@ -32,7 +33,7 @@ The plugin embeds a React config panel in the Signal K Admin UI showing:
 - **Update check** -- compares running version against latest GitHub release, one-click update
 - **Image Version** -- dropdown with latest, pre-releases, and last 3 stable releases
 - **Connection** -- managed container toggle, host/ports, PostgreSQL port for Grafana
-- **Recording** -- record self, record AIS targets, retention days
+- **Recording** -- record self, record AIS targets, startup restore, console webapp, retention days
 - **Path filtering** (collapsible) -- exclude or include-only paths with glob patterns (e.g. exclude `navigation.position`)
 - **Compression** (collapsible) -- LZ4/ZSTD codec selection for on-disk storage
 - **InfluxDB Migration** (collapsible) -- auto-detect with manual URL for remote instances
@@ -129,6 +130,7 @@ wants to slice it into kopia-dedup-friendly shards. Allowed tables:
 | Record AIS targets         | `true`       | Record other vessels                                                                                  |
 | Restore vessels on startup | `false`      | Replay each vessel's last recorded position after a restart (see Startup restore)                     |
 | Restore max age (minutes)  | `9`          | Only replay values recorded within this window                                                        |
+| QuestDB console webapp     | `true`       | Serve QuestDB's console in the Signal K admin UI, admin only (see Console webapp)                     |
 | Retention (days)           | `0`          | Auto-delete old partitions (0 = keep forever)                                                         |
 | Path filter mode           | `exclude`    | `exclude` matching paths, or `include` only matching paths                                            |
 | Path filter paths          | _(empty)_    | Glob patterns, one per line (e.g. `navigation.position`); empty = record everything                   |
@@ -137,6 +139,37 @@ wants to slice it into kopia-dedup-friendly shards. Allowed tables:
 | Container network          | `sk-network` | Shared network for QuestDB (only applied when binding to 0.0.0.0)                                     |
 | Bind to 0.0.0.0            | `false`      | Expose QuestDB's ports on the LAN (see Connectivity below)                                            |
 
+## Console webapp
+
+QuestDB ships its own web console — a full SQL workbench with schema browsing,
+query history and CSV import. It normally lives on QuestDB's HTTP port (9000),
+which is bound to loopback unless you turn on **Bind to 0.0.0.0**, so from any
+other device on the boat it is effectively unreachable.
+
+With **QuestDB console webapp** enabled (the default) the plugin appears in the
+Signal K webapp list and serves that console inside the admin UI, with Signal
+K's own navigation panel still in place.
+
+**It is admin only.** The console is proxied at
+`/plugins/signalk-questdb/console/`, and Signal K gives plugin routes an
+admin-only default — the plugin deliberately does not relax that. A non-admin
+who opens the webapp sees the page frame and an authorization error, never the
+console.
+
+**It can modify data.** Unlike the read-only `/query` endpoint, which rejects
+anything that is not a `SELECT`, the console is a real SQL client: it can drop
+tables and delete recorded history. That is the point of having it, and it is
+what an administrator would use it for — but it is worth knowing before handing
+someone an admin account.
+
+If you would rather not serve it at all, switch the option off and the route is
+not registered.
+
+> Note this is _safer_ than the alternative it replaces. Reaching the console
+> from another device previously meant enabling **Bind to 0.0.0.0**, which
+> publishes an unauthenticated SQL endpoint on your network. The webapp route
+> requires a Signal K admin session.
+
 ## Startup restore
 
 Signal K's data model lives in memory only. After a server restart every vessel

package/dist/config/schema.d.ts

@@ -19,6 +19,7 @@ export declare const ConfigSchema: Type.TObject<{
     recordOthers: Type.TBoolean;
     restoreOnStart: Type.TBoolean;
     restoreMaxAgeMinutes: Type.TNumber;
+    enableConsole: Type.TBoolean;
     retentionDays: Type.TNumber;
     networkName: Type.TString;
     exposeToContainers: Type.TBoolean;

package/dist/config/schema.js

@@ -86,6 +86,11 @@ export const ConfigSchema = Type.Object({
         title: "Restore max age (minutes)",
         description: "Only replay values recorded within this many minutes. Matches Freeboard's default AIS expiry (9 minutes), so a restored target is one that would still have been on the chart. Raising this puts progressively staler positions on the chart.",
     }),
+    enableConsole: Type.Boolean({
+        default: true,
+        title: "QuestDB console webapp",
+        description: "Serve QuestDB's own web console inside the Signal K admin UI (admin only). The console is a full SQL client — unlike the read-only query endpoint it can modify and delete recorded data. Turn this off to remove the route entirely.",
+    }),
     retentionDays: Type.Number({
         default: 0,
         title: "Retention (days, 0 = keep forever)",
@@ -142,6 +147,10 @@ export function normalizeConfig(config) {
         restoreMaxAgeMinutes: config.restoreMaxAgeMinutes && config.restoreMaxAgeMinutes > 0
             ? config.restoreMaxAgeMinutes
             : 9,
+        // On unless explicitly disabled, matching the recording toggles rather
+        // than restoreOnStart: the console only ever does what an authenticated
+        // admin types, so a missing key should not hide the tool.
+        enableConsole: config.enableConsole !== false,
         // Missing resource limits get the schema defaults. Config-panel saves
         // used to drop these keys entirely (issue #98), which ran QuestDB with
         // NO memory cap instead of the promised 768m — this backfill repairs

package/dist/config/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAU,MAAM,SAAS,CAAC;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,oHAAoH;KACvH,CAAC;IACF,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,4HAA4H;KAC/H,CAAC;IACF,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,4HAA4H;KAC/H,CAAC;IACF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,uHAAuH;KAC1H,CAAC;IACF,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,uBAAuB;KAC/B,CAAC;IAEF,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,gDAAgD;QACvD,WAAW,EAAE,oDAAoD;KAClE,CAAC;IAEF,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,8KAA8K;KACjL,CAAC;IAEF,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,sEAAsE;KACzE,CAAC;IAEF,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE;YACnE,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,aAAa;SACrB,CAAC;QACF,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;YAC/B,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,8CAA8C;SAC5D,CAAC;KACH,CAAC;IAEF,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,gMAAgM;KACnM,CAAC;IAEF,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,wbAAwb;KAC3b,CAAC;IAEF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;QACvD,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,gGAAgG;KACnG,CAAC;IAEF,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mBAAmB;KAC3B,CAAC;IACF,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,oBAAoB;KAC5B,CAAC;IAEF,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC;QAC3B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,0RAA0R;KAC7R,CAAC;IACF,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,+OAA+O;KAClP,CAAC;IAEF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,oCAAoC;KAC5C,CAAC;IAEF,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,8IAA8I;KACjJ,CAAC;IAEF,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,8OAA8O;KACjP,CAAC;IAEF,WAAW,EAAE,IAAI,CAAC,KAAK,CACrB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACjE;QACE,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,wFAAwF;KAC3F,CACF;IACD,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,sCAAsC;KACpD,CAAC;CACH,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,IAAI,SAAS;YAC1C,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;SACtC;QACD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,KAAK;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY,KAAK,KAAK;QAC3C,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,mDAAmD;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI;QAC9C,oBAAoB,EAClB,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC;YAC5D,CAAC,CAAC,MAAM,CAAC,oBAAoB;YAC7B,CAAC,CAAC,CAAC;QACP,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,qBAAqB;QACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM;QACvD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,GAAG;KAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAU,MAAM,SAAS,CAAC;AAEvC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,WAAW;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,oHAAoH;KACvH,CAAC;IACF,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,4HAA4H;KAC/H,CAAC;IACF,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,4HAA4H;KAC/H,CAAC;IACF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,uHAAuH;KAC1H,CAAC;IACF,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,uBAAuB;KAC/B,CAAC;IAEF,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC;QAC7B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,gDAAgD;QACvD,WAAW,EAAE,oDAAoD;KAClE,CAAC;IAEF,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,8KAA8K;KACjL,CAAC;IAEF,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,GAAG;QACZ,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,sEAAsE;KACzE,CAAC;IAEF,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE;YACnE,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,aAAa;SACrB,CAAC;QACF,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE;YAC/B,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,8CAA8C;SAC5D,CAAC;KACH,CAAC;IAEF,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,gMAAgM;KACnM,CAAC;IAEF,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC9B,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,wbAAwb;KAC3b,CAAC;IAEF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;QACvD,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,gGAAgG;KACnG,CAAC;IAEF,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC;QACvB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,mBAAmB;KAC3B,CAAC;IACF,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,oBAAoB;KAC5B,CAAC;IAEF,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC;QAC3B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,0RAA0R;KAC7R,CAAC;IACF,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC;QAChC,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,+OAA+O;KAClP,CAAC;IAEF,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC;QAC1B,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,uOAAuO;KAC1O,CAAC;IAEF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,oCAAoC;KAC5C,CAAC;IAEF,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,YAAY;QACrB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,8IAA8I;KACjJ,CAAC;IAEF,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,8OAA8O;KACjP,CAAC;IAEF,WAAW,EAAE,IAAI,CAAC,KAAK,CACrB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EACjE;QACE,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,wFAAwF;KAC3F,CACF;IACD,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE,sCAAsC;KACpD,CAAC;CACH,CAAC,CAAC;AAIH;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO;QACL,GAAG,MAAM;QACT,UAAU,EAAE;YACV,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,IAAI,SAAS;YAC1C,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;SACtC;QACD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,EAAE;QACzC,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,KAAK;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY,KAAK,KAAK;QAC3C,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,mDAAmD;QACnD,cAAc,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI;QAC9C,oBAAoB,EAClB,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC;YAC5D,CAAC,CAAC,MAAM,CAAC,oBAAoB;YAC7B,CAAC,CAAC,CAAC;QACP,uEAAuE;QACvE,wEAAwE;QACxE,0DAA0D;QAC1D,aAAa,EAAE,MAAM,CAAC,aAAa,KAAK,KAAK;QAC7C,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,qBAAqB;QACrB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM;QACvD,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,GAAG;KAC/C,CAAC;AACJ,CAAC"}

package/dist/console-proxy.d.ts

@@ -0,0 +1,33 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+/**
+ * Reverse proxy for QuestDB's own web console.
+ *
+ * The console is a separate app served by the QuestDB container on its HTTP
+ * port. Rather than rebuild it, this forwards requests to it so the Signal K
+ * admin UI can embed it — keeping Signal K's nav panel in place instead of
+ * sending the user off to `:9000`, which is unreachable from another device
+ * unless the operator publishes the port on the LAN.
+ *
+ * Plain `node:http` piping rather than a proxy library: the plugin's dependency
+ * tree is deliberately lean, and what is needed here (method, path, query,
+ * headers, body, streamed response) is a few lines.
+ *
+ * Path handling is why this works without patching QuestDB's bundle: the
+ * console requests its assets and its API relatively (`./assets/…`, `exec?…`),
+ * so serving it under a prefix needs no rewriting. If a future QuestDB image
+ * switches to absolute paths that breaks visibly as 404s — see the plan's
+ * manual-verification step — rather than silently.
+ *
+ * SECURITY: the console is a full SQL client. Unlike `/api/query`, which is
+ * gated by isReadOnlySQL, it can drop tables. It is reachable only because
+ * routes registered directly on a plugin router are admin-only by default in
+ * signalk-server. Do NOT register the mount through `router.access(...)` —
+ * that would downgrade it to readwrite/readonly and hand non-admins a way to
+ * delete the vessel's recorded history.
+ */
+export interface ConsoleProxyDeps {
+    /** Base URL of QuestDB's HTTP interface, e.g. `http://127.0.0.1:9000`. */
+    baseUrl: () => string | null;
+    debug: (msg: string) => void;
+}
+export declare function createConsoleProxy(deps: ConsoleProxyDeps): (req: IncomingMessage, res: ServerResponse) => void;

package/dist/console-proxy.js

@@ -0,0 +1,162 @@
+import http from "node:http";
+// Hop-by-hop headers must not be forwarded (RFC 7230 §6.1). `host` is dropped
+// separately because it has to name the upstream, not the Signal K server.
+const HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+]);
+/**
+ * Header names `Connection` nominates for removal. RFC 7230 §6.1 lets a hop
+ * list additional single-hop headers there, so the fixed set above is not the
+ * whole story — forwarding a nominated header leaks connection-scoped state
+ * across the hop.
+ */
+function connectionNominated(headers) {
+    const raw = Array.isArray(headers.connection)
+        ? headers.connection.join(",")
+        : (headers.connection ?? "");
+    return new Set(raw
+        .split(",")
+        .map((v) => v.trim().toLowerCase())
+        .filter(Boolean));
+}
+function stripHopByHop(headers) {
+    const nominated = connectionNominated(headers);
+    const out = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        const lower = key.toLowerCase();
+        if (HOP_BY_HOP.has(lower) || nominated.has(lower))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+function forwardableHeaders(headers) {
+    const out = stripHopByHop(headers);
+    // `host` must name the upstream, not the Signal K server.
+    delete out.host;
+    // Signal K's session cookie is not QuestDB's business, and forwarding it
+    // would leak an admin credential to a process that has no use for it.
+    delete out.cookie;
+    delete out.authorization;
+    return out;
+}
+/**
+ * Response headers must be filtered too. The upstream's own hop-by-hop
+ * headers describe ITS connection to us, not ours to the browser; relaying
+ * them lets QuestDB's framing decisions override the ones Node is making for
+ * the client's connection.
+ */
+function returnableHeaders(headers) {
+    const out = stripHopByHop(headers);
+    // The console shares the Signal K origin, so a proxied Set-Cookie would be
+    // applied to it — letting a misconfigured or compromised QuestDB write
+    // cookies that collide with Signal K's own session handling. Nothing is
+    // lost by dropping it: the request side already strips `cookie`, so no
+    // QuestDB cookie could ever have completed a round trip anyway.
+    delete out["set-cookie"];
+    return out;
+}
+export function createConsoleProxy(deps) {
+    return function consoleProxy(req, res) {
+        const base = deps.baseUrl();
+        if (!base) {
+            res.writeHead(503, { "content-type": "text/plain" });
+            res.end("QuestDB is not running.");
+            return;
+        }
+        let target;
+        try {
+            // `req.url` here is already relative to the mount point (Express strips
+            // the matched prefix for `router.use`), so "/" is the console root.
+            target = new URL(req.url ?? "/", base);
+        }
+        catch {
+            res.writeHead(400, { "content-type": "text/plain" });
+            res.end("Bad request path.");
+            return;
+        }
+        // Confine the proxy to the resolved QuestDB origin. `new URL` would
+        // otherwise let a path like `//evil.example.com/` re-target the request,
+        // turning an admin-only route into an open relay.
+        const origin = new URL(base);
+        if (target.origin !== origin.origin) {
+            res.writeHead(400, { "content-type": "text/plain" });
+            res.end("Bad request path.");
+            return;
+        }
+        const upstream = http.request({
+            protocol: origin.protocol,
+            hostname: origin.hostname,
+            port: origin.port,
+            method: req.method,
+            path: target.pathname + target.search,
+            headers: forwardableHeaders(req.headers),
+        }, (proxied) => {
+            const headers = returnableHeaders(proxied.headers);
+            // The console is served under the Signal K origin, so its scripts run
+            // with the admin's session. Signal K's auth cookie is httpOnly, so
+            // script cannot read it — but it IS attached to same-origin requests,
+            // which would let a tampered console drive Signal K's admin API as the
+            // logged-in user. A plugin cannot mint a separate origin, so narrow
+            // what the console may do instead.
+            //
+            // Deliberately NOT `connect-src 'self'`: the console's SQL editor is
+            // Monaco, and the bundle carries a jsdelivr loader path for it. Static
+            // analysis could not settle whether that path is actually taken, and
+            // shipping a policy that blanks out the query editor would be a worse
+            // outcome than the risk it mitigates. `form-action` and `base-uri`
+            // still block the two cheapest ways to redirect an admin's submission
+            // or rewrite relative URLs, and `frame-ancestors` blocks clickjacking
+            // from another site.
+            //
+            // Revisit if QuestDB ever bundles Monaco locally — then `connect-src`
+            // and `default-src 'self'` become safe to tighten, which is the real
+            // fix for a same-origin console.
+            headers["content-security-policy"] =
+                "form-action 'self'; frame-ancestors 'self'; base-uri 'self'";
+            // The console has no reason to be sniffed into a different type.
+            headers["x-content-type-options"] = "nosniff";
+            res.writeHead(proxied.statusCode ?? 502, headers);
+            // A HEAD response carries no body by definition. QuestDB nonetheless
+            // answers HEAD with `405 Transfer-Encoding: chunked` AND a body, which
+            // is protocol-illegal; piping that upstream response through leaves
+            // the client waiting for chunks that never legally arrive and the
+            // connection dies with an empty reply. Terminate the response
+            // ourselves and discard whatever the upstream sent.
+            if (req.method === "HEAD") {
+                proxied.resume();
+                res.end();
+                return;
+            }
+            proxied.pipe(res);
+        });
+        upstream.on("error", (err) => {
+            deps.debug(`console proxy error: ${err.message}`);
+            if (res.headersSent) {
+                res.destroy();
+                return;
+            }
+            // The overwhelmingly common cause is the container being stopped, so say
+            // that rather than surfacing an ECONNREFUSED stack to the browser.
+            res.writeHead(502, { "content-type": "text/plain" });
+            res.end("QuestDB is not reachable. Is the container running?");
+        });
+        // A client that goes away mid-request must not leave the upstream socket
+        // open — the console streams large query results.
+        res.on("close", () => {
+            if (!upstream.destroyed)
+                upstream.destroy();
+        });
+        req.pipe(upstream);
+    };
+}
+//# sourceMappingURL=console-proxy.js.map

package/dist/console-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-proxy.js","sourceRoot":"","sources":["../src/console-proxy.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAmC7B,8EAA8E;AAC9E,2EAA2E;AAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,OAAmC;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAC9B,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC/B,OAAO,IAAI,GAAG,CACZ,GAAG;SACA,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAmC;IAEnC,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC5D,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAmC;IAEnC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,0DAA0D;IAC1D,OAAO,GAAG,CAAC,IAAI,CAAC;IAChB,yEAAyE;IACzE,sEAAsE;IACtE,OAAO,GAAG,CAAC,MAAM,CAAC;IAClB,OAAO,GAAG,CAAC,aAAa,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,OAAmC;IAEnC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACnC,2EAA2E;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,gEAAgE;IAChE,OAAO,GAAG,CAAC,YAAY,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACvD,OAAO,SAAS,YAAY,CAAC,GAAoB,EAAE,GAAmB;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAED,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,wEAAwE;YACxE,oEAAoE;YACpE,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,oEAAoE;QACpE,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B;YACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;YACrC,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;SACzC,EACD,CAAC,OAAO,EAAE,EAAE;YACV,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEnD,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,mCAAmC;YACnC,EAAE;YACF,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,qBAAqB;YACrB,EAAE;YACF,sEAAsE;YACtE,qEAAqE;YACrE,iCAAiC;YACjC,OAAO,CAAC,yBAAyB,CAAC;gBAChC,6DAA6D,CAAC;YAChE,iEAAiE;YACjE,OAAO,CAAC,wBAAwB,CAAC,GAAG,SAAS,CAAC;YAE9C,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;YAClD,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,kEAAkE;YAClE,8DAA8D;YAC9D,oDAAoD;YACpD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,OAAO,CAAC,MAAM,EAAE,CAAC;gBACjB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC,CACF,CAAC;QAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,IAAI,CAAC,KAAK,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,yEAAyE;YACzE,mEAAmE;YACnE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,kDAAkD;QAClD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -42,6 +42,7 @@ declare const _default: (app: App) => {
         recordOthers: import("typebox").TBoolean;
         restoreOnStart: import("typebox").TBoolean;
         restoreMaxAgeMinutes: import("typebox").TNumber;
+        enableConsole: import("typebox").TBoolean;
         retentionDays: import("typebox").TNumber;
         networkName: import("typebox").TString;
         exposeToContainers: import("typebox").TBoolean;

package/dist/index.js

@@ -6,6 +6,7 @@ import { createHistoryProviderV2 } from "./history-v2.js";
 import { createHistoryProviderV1 } from "./history-v1.js";
 import { startRetention } from "./retention.js";
 import { RESTORE_SOURCE, restoreFromHistory } from "./restore.js";
+import { createConsoleProxy } from "./console-proxy.js";
 import { buildFullExportWhere } from "./full-export-range.js";
 import { WalMonitor, buildPendingSegmentsSQL, computeSkipPlan, extractApplyError, isPartitionOpenFailure, skipPlansEqual, } from "./wal-monitor.js";
 import { QUESTDB_INTERNAL_HTTP_PORT, QUESTDB_INTERNAL_ILP_PORT, QUESTDB_INTERNAL_PG_PORT, QUESTDB_ACCESSIBLE_PORTS, resolveManagedEndpoints, resolveLanExposureHost, lanExposureEndpoints, } from "./questdb-endpoint.js";
@@ -236,6 +237,19 @@ export default (app) => {
         const port = currentConfig?.questdbHttpPort ?? QUESTDB_INTERNAL_HTTP_PORT;
         return `http://${host}:${port}`;
     }
+    // Built once; it resolves the upstream lazily on every request so a
+    // container restart (which can change the resolved address) is picked up
+    // without re-registering the route.
+    //
+    // Gated on config rather than on `questdbEndpoints`: that is only populated
+    // on the managed-container path, so keying off it made the console return
+    // 503 forever in external mode, where the host/port come from config and
+    // questdbHttpBaseUrl() already falls back to them. Null only before any
+    // config has loaded, which is the one moment there is nothing to point at.
+    const consoleProxy = createConsoleProxy({
+        baseUrl: () => (currentConfig ? questdbHttpBaseUrl() : null),
+        debug: (msg) => app.debug(msg),
+    });
     /**
      * Compute the bind-mount source for QuestDB's /var/lib/questdb volume.
      *
@@ -1016,6 +1030,27 @@ export default (app) => {
             currentConfig = null;
         },
         registerWithRouter(router) {
+            // QuestDB's own console, proxied so the Signal K admin UI can embed it.
+            //
+            // Registered DIRECTLY on the router and NOT through router.access(...):
+            // plugin routes default to admin-only in signalk-server, and only
+            // .access() downgrades them. The console is a full SQL client that can
+            // drop tables, so downgrading it would hand a non-admin the ability to
+            // delete the vessel's recorded history. Leave this as it is.
+            //
+            // The enableConsole check lives INSIDE the handler, not around the
+            // mount: registerWithRouter runs at plugin registration, before start()
+            // has loaded any configuration, so `currentConfig` is still null here
+            // and gating the mount would ignore a saved opt-out entirely. Checking
+            // per-request also means toggling the option takes effect on plugin
+            // restart without the route going stale.
+            router.use("/console", (req, res, next) => {
+                if (currentConfig?.enableConsole === false) {
+                    next();
+                    return;
+                }
+                consoleProxy(req, res);
+            });
             router.get("/api/status", async (_req, res) => {
                 try {
                     if (!queryClient) {