Live page: upload gets a light area too

Download and upload are both lines over light, see-through areas, so
upload no longer looks less important when it is the larger one.

README.md

@@ -27,16 +27,24 @@ dependencies on the server: the binary installs, updates and removes itself.
 - **IPv4 and IPv6:** IPv6 inside the tunnel is turned on automatically when the
   server has a global IPv6 address.
 - **Traffic history:** kept in `stats.json`, hourly for 48 h and daily for
-  400 days by default (Settings → Data retention).
+  400 days by default (Settings → Logs & history).
+- **Live view:** the speed of every peer right now, updated every 2 seconds,
+  with the last 2 minutes as a chart. Kept in memory only.
 - **Connection history:** every online session per peer, with start, duration,
   address and traffic. A new session starts when a device changes networks.
   Country and network operator come from the free
   [DB-IP Lite](https://db-ip.com) databases (CC BY 4.0). GHOSTWIRE downloads
   them monthly (about 20 MB) and looks addresses up locally, so peer addresses
-  never leave the server. You can switch this off under Settings → Data
+  never leave the server. You can switch this off under Settings → Logs &
-  retention.
+  history.
 - **Logs:** written to `GHOSTWIRE.jsonl`, rotated at 10 MB with 5 old files
-  kept by default. Changes are marked as audit entries.
+  kept by default, and shown on the Log page. Changes are marked as audit
+  entries.
+- **Update notice:** once a day the server asks Gitea or GitHub (your choice
+  under Settings → Updates) for the latest release. A newer one shows in the
+  sidebar, on the Dashboard and in Settings, with its release notes and the
+  commands to update this server. Nothing about the server is sent; the check
+  can be switched off.
 - **HTTPS built in:** Let's Encrypt, a self-signed certificate, your own
   certificate files, or plain HTTP behind a reverse proxy.
 
@@ -176,7 +184,7 @@ the running service.
 | Command | What it does |
 |---|---|
 | `GHOSTWIRE install [-domain d] [-email e] [-endpoint h] [-port p] [-y]` | Sets up and starts the service, as above. Asks for the settings no flag gave; `-y` never asks. |
-| `GHOSTWIRE update [-force]` | Run from the new binary, e.g. `sudo /tmp/GHOSTWIRE update`. Checks that it can read the current `config.json` (nothing changes if not), backs up the config to `config.json.bak-<old version>`, replaces the binary, updates the unit if needed and restarts. If the new version does not stay up, the old binary and config are put back and restarted. It refuses older versions without `-force`. |
+| `GHOSTWIRE update [-force]` | Run from the new binary, e.g. `sudo /tmp/GHOSTWIRE update`. Checks that it can read the current `config.json` (nothing changes if not), backs up the config to `config.json.bak-<old version>` (keeping the newest 3 such copies), replaces the binary, updates the unit if needed and restarts. If the new version does not stay up, the old binary and config are put back and restarted. It refuses older versions without `-force`. |
 | `GHOSTWIRE uninstall [-purge] [-y]` | Stops and removes the service, `wg0` and the firewall table. `-purge` also deletes `/opt/ghostwire` and the user. |
 | `GHOSTWIRE passwd [username]` | Sets a user's password (default: the first user) and reloads the running service. The way back in if you are locked out. |
 | `GHOSTWIRE version` | Prints the version. |
@@ -218,6 +226,7 @@ After editing `config.json` by hand, run `sudo systemctl reload ghostwire`.
 |---|---|
 | `GHOSTWIRE` | the program |
 | `config.json` | all settings, server key, peers, pending setup links with their PINs, user password hashes, authenticator app secrets, passkeys, recovery code and token hashes (0600) |
+| `config.json.bak-*` | copies of `config.json` made by `update`; the newest 3 are kept, and Settings → Upkeep lists and removes them |
 | `stats.json` | traffic and connection history per peer |
 | `geo-country.mmdb`, `geo-asn.mmdb` | DB-IP Lite databases for country and network lookups |
 | `GHOSTWIRE.jsonl` | log, one JSON object per line. Changes carry `"audit":true` |
@@ -227,27 +236,28 @@ After editing `config.json` by hand, run `sudo systemctl reload ghostwire`.
 
 Base path `/api/v1`. The web interface signs in with a session cookie; every
 user is an admin. Apps and scripts use `Authorization: Bearer <token>`; create
-the token under Settings → Pair iOS app, or in the iOS app under Settings →
+the token under Settings → Pair iOS app. A token belongs to the user who made
-Access → API tokens. A token belongs to the user who made
 it and is revoked when that user is deleted. A read-only token may only use
-GET. Full-access tokens can do everything the web interface does except backup
+GET. Full-access tokens can do everything the web interface does except the
-and restore. Users, passwords and API tokens need a full-access token even for
+endpoints marked "signed in": users, passwords, API tokens, the sign-in rules,
-reading.
+backup and restore.
 
 For a user with two-step sign-in, `POST /auth/login` answers
 `{"mfa": true, "ticket": "…", "methods": ["key", "totp", "recovery"]}`
 instead of starting a session; the ticket is good for 5 minutes, and one of
 the `/auth/login/…` steps turns it into the session. `PATCH /settings`
-`{"signin": {"requireMfa": true}}` requires two-step sign-in for every user.
+`{"signin": {"requireMfa": true}}` requires two-step sign-in for every user;
+only a signed-in user can change it.
 
 `POST /users` and `POST /users/{id}/reset-password` take
 `{"password": "…", "mustChangePassword": true}`; with `true` (the default) the
 user can do nothing but choose a new password at the next sign-in.
 
 ```
-POST   /auth/login · /auth/logout        GET /auth/me        POST /auth/password (own password)
+POST   /auth/login · /auth/logout        GET /auth/me
-GET    /users      POST /users           PATCH /users/{id}   DELETE /users/{id}
+signed in: POST /auth/password (own password)
-POST   /users/{id}/reset-password    POST /users/{id}/reset-mfa
+signed in: GET|POST /users · PATCH|DELETE /users/{id}
+signed in: POST /users/{id}/reset-password · /users/{id}/reset-mfa
 GET    /auth/options (public: is passkey sign-in offered here)
 POST   /auth/login/totp · /auth/login/recovery {"ticket", "code"}
 POST   /auth/login/key/begin {"ticket"} · /auth/login/key/finish?ticket=  (body: the WebAuthn credential)
@@ -256,6 +266,8 @@ signed in: GET /auth/mfa · POST /auth/mfa/totp/setup · /auth/mfa/totp/confirm
 signed in: POST /auth/mfa/keys/begin · /auth/mfa/keys/finish?name= · PATCH|DELETE /auth/mfa/keys/{id}
 signed in: POST /auth/mfa/recovery-codes
 GET    /status                           GET /stats?range=24h|7d|30d|90d
+GET    /live?since=                      (speed per peer, last 2 minutes in 2-second steps)
+GET    /live/stream                      (the same as server-sent events)
 GET    /server         PATCH /server     POST /server/rotate-key     GET /server/detect-ip
 GET    /peers          POST /peers       (returns the config and QR once)
 GET    /peers/{id}     PATCH /peers/{id} DELETE /peers/{id}
@@ -263,10 +275,10 @@ POST   /peers/{id}/enable | /disable | /issue-config
 GET    /peers/{id}/stats?range=…        GET /peers/{id}/sessions?limit=100
 GET    /peers/{id}/latency               (24 h, one point per 5 minutes)
 GET    /peers/{id}/setup (not read-only) DELETE /peers/{id}/setup
-GET    /settings       PATCH /settings   POST /restart
+GET    /settings       PATCH /settings   POST /restart   POST /updates/check
 GET    /logs?level=&limit=&audit=1       GET /logs/download
-GET    /tokens     POST /tokens          DELETE /tokens/{id}
+signed in: GET|POST /tokens · DELETE /tokens/{id} · GET /backup · POST /restore
-signed in: GET /backup · POST /restore
+signed in: GET|DELETE /update-backups · DELETE /update-backups/{name}   (config copies made by update)
 public: GET /setup/{token} · POST /setup/{token} {"pin"}   (what a setup link opens)
 ```
 
@@ -275,9 +287,22 @@ public: GET /setup/{token} · POST /setup/{token} {"pin"}   (what a setup link o
 setup link (`setup.url`, `setup.pin`, `setup.qr`) instead of a config. With a
 link, the peer's current keys keep working until the link is opened.
 
+`GET /settings` includes `updates`: the running and latest version,
+`available`, the release notes and the download links for this server's
+platform. `PATCH /settings` `{"updates": {"source": "gitea"|"github",
+"check": false}}` picks the source or switches the daily check off;
+`POST /updates/check` checks now. `GET /auth/me` has `updateAvailable` with
+the newer version while there is one.
+
 Traffic is reported from the peer's point of view: `down` is what the peer
 downloaded, `up` is what it uploaded.
 
+`GET /live` answers `{"step": 2, "size": 60, "points": [{"t": …, "peers":
+{"<id>": [down, up]}}]}` with speeds in bits per second, kept only in memory.
+With `since` (unix seconds) it returns only newer steps. `GET /live/stream`
+sends the same messages as server-sent events: the history first, then one
+message per new step.
+
 Latency is measured by pinging the peer's tunnel address every 30 seconds. Set
 it per peer with `PATCH /peers/{id}` `{"latencyCheck": "off"|"active"|"always"}`
 (default `off`). `active` pings only while the device sends traffic, so idle
@@ -296,13 +321,16 @@ override a drop in another table, so if ufw or firewalld is active, allow UDP
 ## iOS app
 
 The native iPhone app (SwiftUI, iOS 17+) lives in its own project,
-GHOSTWIRE-Companion. It does everything the web interface does except
+GHOSTWIRE-Companion. It manages peers, the server and the app settings and
-backup and restore, and adding an authenticator app or passkeys for two-step
+shows stats and logs. Users, passwords, API tokens, two-step sign-in, backup
-sign-in. Pair it in the web interface under
+and restore stay in the web interface. Pair it in the web interface under
 Settings → Pair iOS app: scan the QR code, or tap "Copy pairing code" and paste
 it into the app's "Enter manually". Self-signed certificates are pinned during
 pairing.
 
+The iOS app is currently in beta testing. For an invite, email
+[engineroom@redetzke.aero](mailto:engineroom@redetzke.aero).
+
 ## Development
 
 On macOS (or any non-Linux system), `make dev` starts the app on

api.go

@@ -21,11 +21,13 @@ type App struct {
 	kernel   Kernel
 	recon    *Reconciler
 	stats    *Stats
+	speeds   *Speeds // nil in tests
 	auth     *Auth
 	tls      *webTLS
 	logPath  string
 	logw     *rotatingWriter // nil in tests
 	geo      *Geo            // nil in tests
+	updates  *Updater        // nil in tests
 	started  time.Time
 	shutdown func() // graceful stop; systemd restarts the service
 }
@@ -97,17 +99,6 @@ func (a *App) guard(adminOnly bool, h http.HandlerFunc) http.HandlerFunc {
 	}
 }
 
-// fullAccess refuses read-only tokens, also for GET.
-func fullAccess(h http.HandlerFunc) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		if who(r).Scope == "ro" {
-			writeJSON(w, http.StatusForbidden, map[string]string{"error": "this token is read-only"})
-			return
-		}
-		h(w, r)
-	}
-}
-
 // applyResult saves-then-applies: the config is already stored, so a kernel
 // error is reported but does not undo the change.
 func (a *App) apply() string {
@@ -121,8 +112,6 @@ func (a *App) routes() http.Handler {
 	mux := http.NewServeMux()
 	g := func(pattern string, h http.HandlerFunc) { mux.HandleFunc(pattern, a.guard(false, h)) }
 	adm := func(pattern string, h http.HandlerFunc) { mux.HandleFunc(pattern, a.guard(true, h)) }
-	// full is for signed-in users and full-access tokens, even for reading.
-	full := func(pattern string, h http.HandlerFunc) { mux.HandleFunc(pattern, a.guard(false, fullAccess(h))) }
 
 	mux.HandleFunc("POST /api/v1/auth/login", a.login)
 	mux.HandleFunc("POST /api/v1/auth/logout", a.logout)
@@ -146,16 +135,18 @@ func (a *App) routes() http.Handler {
 	adm("DELETE /api/v1/auth/mfa/keys/{id}", a.keyRemove)
 	adm("POST /api/v1/auth/mfa/recovery-codes", a.newRecoveryCodesHandler)
 	g("GET /api/v1/auth/me", a.me)
-	full("POST /api/v1/auth/password", a.changePassword)
+	adm("POST /api/v1/auth/password", a.changePassword)
-	full("GET /api/v1/users", a.listUsers)
+	adm("GET /api/v1/users", a.listUsers)
-	full("POST /api/v1/users", a.createUser)
+	adm("POST /api/v1/users", a.createUser)
-	full("PATCH /api/v1/users/{id}", a.patchUser)
+	adm("PATCH /api/v1/users/{id}", a.patchUser)
-	full("POST /api/v1/users/{id}/reset-password", a.resetPassword)
+	adm("POST /api/v1/users/{id}/reset-password", a.resetPassword)
-	full("DELETE /api/v1/users/{id}", a.deleteUser)
+	adm("DELETE /api/v1/users/{id}", a.deleteUser)
-	full("POST /api/v1/users/{id}/reset-mfa", a.resetMFA)
+	adm("POST /api/v1/users/{id}/reset-mfa", a.resetMFA)
 
 	g("GET /api/v1/status", a.status)
 	g("GET /api/v1/stats", a.allStats)
+	g("GET /api/v1/live", a.liveSpeeds)
+	g("GET /api/v1/live/stream", a.liveStream)
 
 	g("GET /api/v1/server", a.getServer)
 	g("PATCH /api/v1/server", a.patchServer)
@@ -182,17 +173,22 @@ func (a *App) routes() http.Handler {
 	mux.HandleFunc("POST /api/v1/setup/{token}", a.setupRedeem)
 
 	// Full-access tokens (the iOS app) may change app settings, read logs and
-	// manage users and tokens. Backups need a signed-in user.
+	// restart. Users, passwords, API tokens, the sign-in rules and backups
+	// need a signed-in user.
 	g("GET /api/v1/settings", a.getSettings)
 	g("PATCH /api/v1/settings", a.patchSettings)
+	g("POST /api/v1/updates/check", a.checkUpdates)
 	g("POST /api/v1/restart", a.restart)
-	full("GET /api/v1/tokens", a.listTokens)
+	adm("GET /api/v1/tokens", a.listTokens)
-	full("POST /api/v1/tokens", a.createToken)
+	adm("POST /api/v1/tokens", a.createToken)
-	full("DELETE /api/v1/tokens/{id}", a.deleteToken)
+	adm("DELETE /api/v1/tokens/{id}", a.deleteToken)
 	g("GET /api/v1/logs", a.logs)
 	g("GET /api/v1/logs/download", a.downloadLog)
 	adm("GET /api/v1/backup", a.backup)
 	adm("POST /api/v1/restore", a.restore)
+	adm("GET /api/v1/update-backups", a.listUpdateBackups)
+	adm("DELETE /api/v1/update-backups", a.removeUpdateBackups)
+	adm("DELETE /api/v1/update-backups/{name}", a.removeUpdateBackup)
 
 	mux.HandleFunc("/api/", func(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusNotFound, map[string]string{"error": "no such endpoint"})
@@ -232,7 +228,7 @@ func (a *App) login(w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		slog.Warn("login failed", "user", in.Username, "remote", ip, "reason", err.Error())
 		code := http.StatusUnauthorized
-		if errors.Is(err, errLocked) {
+		if errors.Is(err, errLocked) || errors.Is(err, errBusy) {
 			code = http.StatusTooManyRequests
 		}
 		writeJSON(w, code, map[string]string{"error": err.Error()})
@@ -270,8 +266,8 @@ func (a *App) me(w http.ResponseWriter, r *http.Request) {
 		"id": p.UserID, "name": p.Name, "isAdmin": p.IsAdmin, "scope": p.Scope,
 		"mustChangePassword": p.MustChangePassword, "mfaSetupRequired": p.MFASetupRequired, "version": version, "session": p.Session,
 	}
-	if p.TokenID != "" {
+	if v := a.updates.Available(); v != "" {
-		out["tokenId"] = p.TokenID // lets an app find its own token in /tokens
+		out["updateAvailable"] = v
 	}
 	if _, u := a.store.Get().userByID(p.UserID); u != nil {
 		out["username"], out["note"], out["created"] = u.Username, u.Note, u.Created
@@ -405,6 +401,60 @@ func (a *App) allStats(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, map[string]any{"range": rng, "points": a.stats.series(nil, rng)})
 }
 
+// liveSpeeds returns each peer's speed over the last 2 minutes; with since
+// (unix seconds) only the newer steps.
+func (a *App) liveSpeeds(w http.ResponseWriter, r *http.Request) {
+	var since int64
+	fmt.Sscan(r.URL.Query().Get("since"), &since)
+	points := []SpeedPoint{}
+	if a.speeds != nil {
+		points = a.speeds.Since(since)
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"step": int(speedStep / time.Second), "size": speedPoints, "points": points})
+}
+
+// liveStream sends the same data as server-sent events: the current points
+// first, then each new step as soon as it is sampled. The session is checked
+// again with every step, so signing out ends the stream.
+func (a *App) liveStream(w http.ResponseWriter, r *http.Request) {
+	if a.speeds == nil {
+		writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "live speeds are not available"})
+		return
+	}
+	rc := http.NewResponseController(w)
+	_ = rc.SetWriteDeadline(time.Time{}) // the server's write timeout would cut the stream
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-store")
+	w.Header().Set("X-Accel-Buffering", "no") // nginx: do not buffer
+	points, ch, cancel := a.speeds.Subscribe()
+	defer cancel()
+	send := func(points []SpeedPoint) bool {
+		b, _ := json.Marshal(map[string]any{"step": int(speedStep / time.Second), "size": speedPoints, "points": points})
+		if _, err := fmt.Fprintf(w, "data: %s\n\n", b); err != nil {
+			return false
+		}
+		return rc.Flush() == nil
+	}
+	if !send(points) {
+		return
+	}
+	for {
+		select {
+		case <-r.Context().Done():
+			return
+		case <-a.speeds.Done():
+			return
+		case pt := <-ch:
+			if _, ok := a.auth.Authenticate(r); !ok {
+				return
+			}
+			if !send([]SpeedPoint{pt}) {
+				return
+			}
+		}
+	}
+}
+
 func (a *App) peerStats(w http.ResponseWriter, r *http.Request) {
 	cfg := a.store.Get()
 	if _, p := cfg.peerByID(r.PathValue("id")); p == nil {
@@ -1008,15 +1058,15 @@ func (a *App) issueConfig(w http.ResponseWriter, r *http.Request) {
 func (a *App) getSettings(w http.ResponseWriter, r *http.Request) {
 	cfg := a.store.Get()
 	writeJSON(w, http.StatusOK, map[string]any{
-		"web":           cfg.Web,
+		"web":         cfg.Web,
-		"log":           cfg.Log,
+		"log":         cfg.Log,
-		"stats":         cfg.Stats,
+		"stats":       cfg.Stats,
-		"decoy":         cfg.Decoy,
+		"decoy":       cfg.Decoy,
-		"signin":        cfg.SignIn,
+		"signin":      cfg.SignIn,
-		"geo":           a.geoStatus(),
+		"geo":         a.geoStatus(),
-		"adminUsername": a.username(cfg, who(r).UserID), // kept for older iOS app versions
+		"updates":     a.updates.Status(),
-		"fingerprint":   a.tls.Fingerprint(),
+		"fingerprint": a.tls.Fingerprint(),
-		"logPath":       a.logPath,
+		"logPath":     a.logPath,
 	})
 }
 
@@ -1026,18 +1076,25 @@ func (a *App) patchSettings(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, err)
 		return
 	}
-	if _, ok := m["adminUsername"]; ok {
+	if _, ok := m["signin"]; ok && !who(r).IsAdmin {
-		writeErr(w, badRequest("usernames are changed under /users"))
+		writeJSON(w, http.StatusForbidden, map[string]string{"error": "API tokens cannot change the sign-in rules; sign in to the web interface"})
 		return
 	}
 	var restart bool
 	err = a.store.Update(func(c *Config) error {
-		before, _ := json.Marshal(c.Web)
+		// Session length applies to the next sign-in; everything else in
+		// web needs a restart.
+		listen := func() string {
+			w := c.Web
+			w.SessionHours = 0
+			b, _ := json.Marshal(w)
+			return string(b)
+		}
+		before := listen()
 		if err := field(m, "web", &c.Web); err != nil {
 			return err
 		}
-		after, _ := json.Marshal(c.Web)
+		restart = listen() != before
-		restart = string(before) != string(after)
 		if err := field(m, "stats", &c.Stats); err != nil {
 			return err
 		}
@@ -1047,6 +1104,9 @@ func (a *App) patchSettings(w http.ResponseWriter, r *http.Request) {
 		if err := field(m, "signin", &c.SignIn); err != nil {
 			return err
 		}
+		if err := field(m, "updates", &c.Updates); err != nil {
+			return err
+		}
 		return field(m, "log", &c.Log)
 	})
 	if err != nil {
@@ -1192,6 +1252,17 @@ func (a *App) applyRuntime(c *Config) {
 		a.logw.SetLimits(c.Log.MaxSizeMB, c.Log.MaxFiles)
 	}
 	a.geo.SetEnabled(c.Stats.geoEnabled())
+	a.updates.Set(c.Updates)
+}
+
+// checkUpdates asks the release source now and returns what it found.
+func (a *App) checkUpdates(w http.ResponseWriter, r *http.Request) {
+	if a.updates == nil || !a.updates.Status().Enabled {
+		writeErr(w, badRequest("the update check is switched off"))
+		return
+	}
+	a.updates.Check(r.Context())
+	writeJSON(w, http.StatusOK, a.updates.Status())
 }
 
 func (a *App) geoStatus() GeoStatus {

app.css

@@ -69,7 +69,10 @@ a.brand, a.brand:hover { color: #fff; text-decoration: none; }
 .side .acct strong { font-size: 14px; font-weight: 500; color: #fff; overflow: hidden; text-overflow: ellipsis; }
 .side .acct span span { color: #a9aaa5; }
 .side .avatar { width: 28px; height: 28px; border-radius: 50%; background: #3a3b41; display: grid; place-items: center; flex: none; font-size: 13px; font-weight: 600; color: #fff; }
-.side .footrow { display: flex; justify-content: space-between; padding: 10px 12px 0; }
+.side .footrow { display: flex; justify-content: space-between; align-items: center; gap: 8px; padding: 10px 12px 0; }
+.side .footrow .upd { font-size: 11.5px; font-weight: 500; color: #cfe2f8; background: #1f3550; border: 1px solid #2d4a6e; padding: 2px 8px; border-radius: 999px; text-decoration: none; white-space: nowrap; }
+.side .footrow .upd:hover { color: #fff; }
+.side .nav .pip { margin-left: auto; width: 7px; height: 7px; border-radius: 50%; background: #6aa6ea; }
 .main { flex: 999 1 560px; min-width: 0; padding: 32px 32px 56px; }
 /* Beside the page (not stacked above it on a phone), the sidebar stays in
    place while the page scrolls, so the account link is always visible. */
@@ -129,6 +132,9 @@ h1 { margin: 0; font-size: 26px; font-weight: 600; letter-spacing: -0.01em; over
 .tag { display: inline-block; font-size: 11px; font-weight: 600; padding: 2px 8px; border-radius: 999px; background: var(--warn-bg); color: var(--warn-ink); margin-left: 6px; vertical-align: 1px; }
 .notice { display: flex; gap: 10px; align-items: flex-start; padding: 12px 14px; border-radius: 10px; background: var(--warn-bg); color: var(--warn-ink); font-size: 13px; }
 .notice.err { background: #fbefee; color: var(--bad-ink); }
+.notice.new { background: #e8f0fa; color: #174d8f; flex-wrap: wrap; align-items: center; }
+.notice.new .actions { margin-left: auto; }
+.btn.ghost { background: transparent; border-color: transparent; }
 .notice .btn { margin-left: auto; }
 
 /* tables */
@@ -144,6 +150,8 @@ td { padding: 12px; border-bottom: 1px solid var(--line-2); vertical-align: midd
 tr:last-child td { border-bottom: 0; }
 .num { text-align: right; font-variant-numeric: tabular-nums; white-space: nowrap; }
 td .note { font-size: 12px; color: var(--ink-3); }
+a.pname { color: var(--ink); font-weight: 600; text-decoration: none; }
+a.pname:hover, a.pname:focus-visible { color: var(--ink); text-decoration: underline; text-underline-offset: 3px; }
 .empty { padding: 24px 12px; margin: 0; text-align: center; color: var(--ink-3); }
 
 /* forms */
@@ -171,10 +179,50 @@ fieldset { border: 0; margin: 0; padding: 0; min-width: 0; display: flex; flex-d
 .kv dt { color: var(--ink-2); }
 .kv dd { margin: 0; min-width: 0; overflow-wrap: anywhere; }
 
-/* checks */
+/* health: public addresses on the left, one row per check on the right */
-.chk { display: flex; gap: 10px; align-items: center; padding: 10px 0; border-bottom: 1px solid var(--line-2); font-size: 13px; }
+.hcbody { display: grid; grid-template-columns: minmax(0, 5fr) minmax(0, 7fr); gap: 12px; margin-top: 16px; }
-.chk:last-child { border-bottom: 0; }
+.hchead { display: flex; align-items: baseline; gap: 12px; flex-wrap: wrap; }
-.chk b { font-weight: 500; min-width: 160px; }
+.hchead > span { font-size: 13px; color: var(--ink-2); }
+.hchead > span.bad { color: var(--bad-ink); font-weight: 500; }
+.hcaddrs { display: flex; flex-direction: column; gap: 12px; }
+.hcaddr { flex: 1; display: flex; flex-direction: column; justify-content: center; background: var(--ground); border-radius: 10px; padding: 14px 18px; min-width: 0; }
+.hcaddr .l { display: flex; align-items: center; gap: 8px; font-size: 12px; color: var(--ink-2); }
+.hcaddr .v { margin-top: 4px; font-size: 15px; font-weight: 500; overflow-wrap: anywhere; }
+.hcaddr .v.mono { font-size: 22px; }
+.hcaddr .n { font-family: var(--sans); font-size: 12px; font-weight: 400; color: var(--ink-2); }
+.hcaddr.bad { background: #fdf6f5; box-shadow: inset 0 0 0 1px #e6b3b0; }
+.hcaddr.bad .v { color: var(--bad-ink); }
+.hclist { border: 1px solid var(--line); border-radius: 10px; min-width: 0; }
+.hcrow { display: grid; grid-template-columns: 8px minmax(0, 190px) minmax(0, 1fr); gap: 2px 14px; align-items: baseline; padding: 11px 16px; border-top: 1px solid var(--line-2); }
+.hcrow:first-child { border-top: 0; }
+.hcrow > .dot { align-self: center; }
+.hcrow .l { font-size: 13px; color: var(--ink-2); }
+.hcrow .v { display: flex; flex-wrap: wrap; align-items: baseline; gap: 2px 10px; min-width: 0; }
+.hcrow .s { font-weight: 500; }
+.hcrow .r { font-size: 12px; color: var(--ink-3); overflow-wrap: anywhere; }
+.hcrow .p { grid-column: 2 / -1; font-size: 12.5px; color: var(--bad-ink); overflow-wrap: anywhere; }
+.hcrow.bad { background: #fdf6f5; }
+.hcrow.bad .s { color: var(--bad-ink); }
+@media (max-width: 1000px) { .hcbody { grid-template-columns: minmax(0, 1fr); } }
+@media (max-width: 640px) { .hcrow { grid-template-columns: 8px minmax(0, 1fr); } .hcrow .v { grid-column: 2; } }
+
+/* updates */
+.upvers { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 12px; margin-top: 14px; }
+.upbox { background: var(--ground); border-radius: 10px; padding: 12px 14px; display: flex; flex-direction: column; gap: 2px; min-width: 0; }
+.upbox > span { font-size: 12px; color: var(--ink-2); }
+.upbox strong { font-size: 15px; font-weight: 500; }
+.upbox strong.mono { font-size: 16px; }
+.upbox.new { background: #e8f0fa; box-shadow: inset 0 0 0 1px #bcd2ee; }
+.upbox.new strong { color: #174d8f; }
+.uptodate { display: flex; align-items: center; gap: 10px; margin: 14px 0 0; font-weight: 500; }
+.upnotes { border: 1px solid var(--line); border-radius: 10px; padding: 14px 16px; margin-top: 14px; display: flex; flex-direction: column; gap: 10px; font-size: 13px; }
+.upnotes p { margin: 0; max-width: 80ch; }
+.upnotes ul { margin: 0; padding-left: 18px; display: flex; flex-direction: column; gap: 6px; max-width: 80ch; }
+.upnotes .hd, .upcmd .hd { display: flex; align-items: baseline; gap: 10px; flex-wrap: wrap; }
+.upnotes .hd a { margin-left: auto; }
+.upcmd { display: flex; flex-direction: column; gap: 8px; margin-top: 14px; }
+.uprow { display: flex; justify-content: space-between; align-items: center; gap: 12px; flex-wrap: wrap; margin-top: 16px; padding-top: 14px; border-top: 1px solid var(--line-2); }
+#updates > .notice { margin-top: 14px; }
 
 /* activity */
 .ev { display: flex; gap: 12px; padding: 10px 0; border-bottom: 1px solid var(--line-2); font-size: 13px; }
@@ -206,7 +254,10 @@ fieldset { border: 0; margin: 0; padding: 0; min-width: 0; display: flex; flex-d
 .chart .grp span.up { background: var(--up); }
 .chart .grp span.total { background: var(--down); }
 .chart .grp.on span.total { background: var(--down-strong); }
-.xaxis { display: flex; justify-content: space-between; margin: 8px 0 0 56px; font-size: 11px; color: var(--axis-ink); }
+.xaxis { position: relative; height: 22px; margin-left: 56px; font-size: 11px; color: var(--axis-ink); }
+.xaxis span { position: absolute; top: 0; padding-top: 7px; transform: translateX(-50%); white-space: nowrap; font-variant-numeric: tabular-nums; }
+.xaxis span.edge::before { content: ''; position: absolute; left: 50%; top: 0; height: 4px; border-left: 1px solid var(--axis); }
+@media (max-width: 640px) { .xaxis span.minor { display: none; } }
 .chart.loading { opacity: .5; }
 .chart .plot { position: absolute; left: 56px; right: 0; top: 0; bottom: 1px; }
 .chart .plot svg { width: 100%; height: 100%; display: block; overflow: visible; }
@@ -322,3 +373,36 @@ dialog::backdrop { background: rgba(22, 23, 26, .55); }
 .mfarow .grow { flex: 1; min-width: 0; }
 .dlg .secret { font-size: 15px; letter-spacing: 0.04em; overflow-wrap: anywhere; }
 .dlg .codes { columns: 2; font-size: 15px; line-height: 1.8; }
+
+/* settings groups; the log page */
+.group { margin-top: 20px; display: flex; flex-direction: column; gap: 2px; }
+.group h2 { margin: 0; font-size: 19px; font-weight: 600; }
+.group p { margin: 0; font-size: 13px; color: var(--ink-2); }
+.card h3 { margin: 0; font-size: 16px; font-weight: 600; }
+.saves { font-size: 12px; color: var(--ink-3); }
+pre.log.tall { max-height: calc(100vh - 260px); min-height: 420px; }
+
+/* live */
+.livenow { display: grid; grid-template-columns: repeat(auto-fill, minmax(190px, 1fr)); gap: 12px 24px; margin-top: 14px; }
+.livenow .k { font-size: 13px; color: var(--ink-2); }
+.livenow .v { font-size: 30px; font-weight: 600; letter-spacing: -0.01em; margin-top: 4px; font-variant-numeric: tabular-nums; }
+.livenow .v small { font-size: 16px; color: var(--ink-3); font-weight: 500; margin-left: 6px; }
+.chart .larea { opacity: .15; }
+.chart .larea.down { fill: var(--down); }
+.chart .larea.up { fill: var(--up); }
+.chart .ldown, .chart .lup { fill: none; stroke-width: 1.75; stroke-linejoin: round; stroke-linecap: round; vector-effect: non-scaling-stroke; }
+.chart .ldown { stroke: var(--down); }
+.chart .lup { stroke: var(--up); }
+.chart .plot.live svg { overflow: hidden; }
+.xaxis.lx span:first-child { transform: none; }
+.xaxis.lx span:last-child { transform: translateX(-100%); }
+.spark.wide { width: 96px; }
+.spark .fill { fill: var(--down); opacity: .15; stroke: none; }
+tr.idle td { color: var(--ink-3); }
+tr.idle .spark polyline { stroke: var(--ink-3); }
+tr.idle .spark .fill { fill: var(--ink-3); }
+td .mono, td.num .mono { font-variant-numeric: tabular-nums; }
+.livesub { display: flex; align-items: center; gap: 6px; }
+.dot.pulse { animation: pulse 2s ease-in-out infinite; }
+@keyframes pulse { 50% { opacity: .35; } }
+@media (prefers-reduced-motion: reduce) { .dot.pulse { animation: none; } }

app.js

@@ -47,8 +47,10 @@
     peers: '<circle cx="9" cy="8" r="3.5"/><path d="M2.5 20c.8-3.5 3.4-5.5 6.5-5.5s5.7 2 6.5 5.5"/><path d="M16 4.8a3.5 3.5 0 0 1 0 6.4M18.5 14.8c1.5.8 2.6 2.6 3 5.2"/>',
     server: '<rect x="3" y="4" width="18" height="7" rx="1.5"/><rect x="3" y="13" width="18" height="7" rx="1.5"/><path d="M7 7.5h.01M7 16.5h.01"/>',
     settings: '<path d="M4 6h10M18 6h2M4 12h4M12 12h8M4 18h12"/><circle cx="16" cy="6" r="2"/><circle cx="10" cy="12" r="2"/><circle cx="18" cy="18" r="2"/>',
+    live: '<path d="M3 12h4l3-7 4 14 3-7h4"/>',
     plus: '<path d="M12 5v14M5 12h14"/>',
     key: '<circle cx="8" cy="15" r="4"/><path d="M11 12l9-9M17 6l3 3M14 9l2 2"/>',
+    log: '<rect x="4" y="3" width="16" height="18" rx="2"/><path d="M8 8h8M8 12h8M8 16h5"/>',
     logout: '<path d="M14 4h4a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2h-4"/><path d="M10 16l-4-4 4-4M6 12h10"/>',
   };
 
@@ -257,13 +259,26 @@
     else if (okMsg) toast(okMsg);
   }
 
+  // dialog shows a modal dialog. Extensions such as Bitwarden move elements
+  // around in <body>; a moved dialog stays open but drops out of the top
+  // layer to the bottom of the page, so it is shown as a modal again. That
+  // goes through close(), whose close event arrives after the dialog is open
+  // again and is kept from the listeners added by callers.
   function dialog(build) {
     const d = h('dialog');
     const close = () => d.close();
-    d.addEventListener('close', () => d.remove());
+    const moved = new MutationObserver(() => {
+      if (d.open && d.isConnected && !d.matches(':modal')) { d.close(); d.showModal(); }
+    });
+    d.addEventListener('close', (e) => {
+      if (d.open) { e.stopImmediatePropagation(); return; }
+      moved.disconnect();
+      d.remove();
+    });
     d.append(build(close));
     document.body.append(d);
     d.showModal();
+    moved.observe(document.body, { childList: true, subtree: true });
     return d;
   }
 
@@ -370,8 +385,8 @@
   function pointLabel(t, range) {
     const d = new Date(t * 1000);
     if (range === '24h') {
-      const hrs = Math.round((Date.now() - d.getTime()) / 3600000);
+      const hm = (x) => x.toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' });
-      return hrs <= 0 ? 'This hour' : hrs + ' h ago';
+      return hm(d) + '–' + hm(new Date(d.getTime() + 3600000));
     }
     return d.toLocaleDateString(undefined, { weekday: 'short', day: 'numeric', month: 'short' });
   }
@@ -416,9 +431,35 @@
         h('div', { class: 'gl top' }), h('div', { class: 'gl mid' }), h('div', { class: 'gl base' }),
         h('div', { class: 'yl top' }, fmtBytes(top)), h('div', { class: 'yl mid' }, fmtBytes(top / 2)),
         bars),
-      h('div', { class: 'xaxis' },
+      timeAxis(points.map((p) => p.t), range === '24h' ? 3600 : 86400));
-        h('span', null, pointLabel(points[0].t, range)),
+  }
-        h('span', null, range === '24h' ? 'now' : pointLabel(points[points.length - 1].t, range))));
+
+  // timeAxis labels the bottom of a chart with clock times or dates. Points
+  // are evenly spaced buckets of step seconds. Hourly buckets get the hour
+  // they start at, every 3 hours (6 on narrow screens), with the date at
+  // midnight; daily buckets get the date under the bar, every bar for a
+  // week and every 7th bar, counted back from today, for a month.
+  function timeAxis(ts, step) {
+    const n = ts.length;
+    const ticks = [];
+    if (step < 86400) {
+      for (let i = 0; i < n; i++) {
+        const d = new Date(ts[i] * 1000);
+        if (d.getMinutes() !== 0 || d.getHours() % 3 !== 0 || i === 0) continue;
+        const text = d.getHours() === 0
+          ? d.toLocaleDateString(undefined, { weekday: 'short', day: 'numeric' })
+          : d.toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit' });
+        ticks.push({ at: i / n, text, minor: d.getHours() % 6 !== 0, edge: true });
+      }
+    } else {
+      const every = n > 10 ? 7 : 1;
+      for (let i = n - 1; i >= 0; i -= every) {
+        const d = new Date(ts[i] * 1000);
+        ticks.push({ at: (i + 0.5) / n, text: d.toLocaleDateString(undefined, n > 10 ? { day: 'numeric', month: 'short' } : { weekday: 'short', day: 'numeric' }) });
+      }
+    }
+    return h('div', { class: 'xaxis', 'aria-hidden': 'true' },
+      ticks.map((k) => h('span', { class: (k.minor ? 'minor' : '') + (k.edge ? ' edge' : ''), style: { left: (k.at * 100).toFixed(3) + '%' } }, k.text)));
   }
 
   // latencyChart draws the median as a line over a min–max band, one point
@@ -475,7 +516,7 @@
         h('div', { class: 'gl top' }), h('div', { class: 'gl mid' }), h('div', { class: 'gl base' }),
         h('div', { class: 'yl top' }, fmtMs(top)), h('div', { class: 'yl mid' }, fmtMs(top / 2)),
         wrapEl),
-      h('div', { class: 'xaxis' }, h('span', null, '24 h ago'), h('span', null, '12 h ago'), h('span', null, 'now')));
+      timeAxis(points.map((p) => p.t), 300));
   }
 
   // pairDialog creates an API token and shows it once, with the pairing QR
@@ -515,9 +556,9 @@
 
   // ---------- shell, router ----------
 
-  const NAV = [['#/', 'dashboard', 'Dashboard'], ['#/peers', 'peers', 'Peers'], ['#/server', 'server', 'Server'], ['#/settings', 'settings', 'Settings']];
+  const NAV = [['#/', 'dashboard', 'Dashboard'], ['#/live', 'live', 'Live'], ['#/peers', 'peers', 'Peers'], ['#/server', 'server', 'Server'], ['#/log', 'log', 'Log'], ['#/settings', 'settings', 'Settings']];
   let navLinks = {};
-  let srvBox, peerCount;
+  let srvBox, peerCount, verRow;
 
   function buildShell() {
     srvBox = h('div', { class: 'srv' }, h('span', { class: 'dot' }), h('span', null, 'Loading…'));
@@ -533,13 +574,25 @@
             h('span', { class: 'avatar', 'aria-hidden': 'true' }, me.name.slice(0, 1).toUpperCase()),
             h('span', null, h('strong', null, me.name), h('span', null, 'My account')))),
           h('button', { type: 'button', class: 'signout', 'aria-label': 'Sign out', onClick: logout }, icon('logout'), h('span', { class: 'tip', 'aria-hidden': 'true' }, 'Sign out'))),
-        h('div', { class: 'footrow' },
+        (verRow = h('div', { class: 'footrow' }))));
-          h('span', null, 'v' + me.version.replace(/^v/, '')))));
     main = h('main', { class: 'main', id: 'main' });
     app.replaceChildren(h('div', { class: 'shell' }, nav, main));
+    drawUpdateHint();
     refreshSide();
   }
 
+  // drawUpdateHint shows a newer release next to the version in the sidebar
+  // and as a dot on Settings.
+  function drawUpdateHint() {
+    if (!verRow) return;
+    const v = me.updateAvailable;
+    fill(verRow, h('span', null, 'v' + me.version.replace(/^v/, '')),
+      v ? h('a', { class: 'upd', href: '#/settings#updates' }, v + ' available') : null);
+    const set = navLinks['#/settings'];
+    set.querySelectorAll('.pip, .sr').forEach((e) => e.remove());
+    if (v) set.append(h('span', { class: 'pip', title: 'Update available' }), h('span', { class: 'sr' }, ', update available'));
+  }
+
   async function refreshSide() {
     try {
       const s = await api('GET', '/status');
@@ -565,11 +618,13 @@
 
   const ROUTES = [
     [/^#\/?$/, '#/', viewDashboard],
+    [/^#\/live$/, '#/live', viewLive],
     [/^#\/peers$/, '#/peers', viewPeers],
     [/^#\/peers\/new$/, '#/peers', viewPeerNew],
     [/^#\/peers\/([\w-]+)$/, '#/peers', viewPeer],
     [/^#\/server$/, '#/server', viewServer],
-    [/^#\/settings$/, '#/settings', viewSettings],
+    [/^#\/log$/, '#/log', viewLog],
+    [/^#\/settings(#\w+)?$/, '#/settings', viewSettings],
     [/^#\/account$/, '#/account', viewAccount],
   ];
 
@@ -967,18 +1022,35 @@
 
   // ---------- dashboard ----------
 
+  // RANGES are the time ranges offered above the traffic charts.
+  const RANGES = [['24h', '24 h'], ['7d', '7 days'], ['30d', '30 days']];
+
   async function viewDashboard(wrap) {
+    let range = '24h';
     const draw = async () => {
       const [st, pl, stats, logs] = await Promise.all([
         api('GET', '/status'),
         api('GET', '/peers'),
-        api('GET', '/stats?range=24h'),
+        api('GET', '/stats?range=' + range),
         me.isAdmin ? api('GET', '/logs?audit=1&limit=6').catch(() => null) : null,
       ]);
       const peers = pl.peers;
       const failing = st.checks.filter((c) => !c.ok);
       const ifCheck = st.checks.find((c) => c.name === 'WireGuard interface');
       const top = [...peers].sort((a, b) => (b.stats.down24h + b.stats.up24h) - (a.stats.down24h + a.stats.up24h)).slice(0, 6);
+      // A range switch fetches and redraws only the chart.
+      const traffic = h('div', null, chart(stats.points, range, 'total', true));
+      const pills = h('div', { class: 'pills', role: 'group', 'aria-label': 'Time range' });
+      const drawPills = () => pills.replaceChildren(...RANGES.map(([k, t]) =>
+        h('button', { type: 'button', class: range === k ? 'pill on' : 'pill', 'aria-pressed': String(range === k), onClick: async () => {
+          range = k;
+          drawPills();
+          try {
+            const s = await api('GET', '/stats?range=' + k);
+            if (range === k) traffic.replaceChildren(chart(s.points, k, 'total', true));
+          } catch (x) { toast(x.message, true); }
+        } }, t)));
+      drawPills();
 
       fill(wrap,
         h('div', { class: 'head' },
@@ -992,6 +1064,8 @@
           h('div', null, h('strong', null, 'Needs attention: '), failing.map((c) => c.name + ' (' + c.detail + ')').join(' · ')),
           h('a', { class: 'btn small', href: '#/server' }, 'Health')) : null,
 
+        updateBanner(),
+
         h('div', { class: 'tiles' },
           h('div', { class: 'card tile' }, h('div', { class: 'k' }, 'Peers online'),
             h('div', { class: 'v' }, String(st.peers.online), h('small', null, '/ ' + st.peers.total)),
@@ -1007,8 +1081,8 @@
             h('div', { class: 's' }, 'Service up ' + ago(st.started).replace(' ago', '') + ' · ' + (st.healthy ? 'all checks pass' : failing.length + ' check(s) failing')))),
 
         h('section', { class: 'card', 'aria-labelledby': 'tput' },
-          h('div', { class: 'cardhead' }, h('h2', { id: 'tput' }, 'Traffic, all peers · last 24 hours')),
+          h('div', { class: 'cardhead' }, h('h2', { id: 'tput' }, 'Traffic, all peers'), pills),
-          chart(stats.points, '24h', 'total', true)),
+          traffic),
 
         h('div', { class: 'cols' },
           h('section', { class: 'card flush' },
@@ -1022,7 +1096,7 @@
                 h('td', { class: 'num' }, fmtBytes(p.stats.up24h)))))))
               : h('p', { class: 'empty' }, 'No peers yet. ', h('a', { href: '#/peers/new' }, 'Add the first one'))),
           logs ? h('section', { class: 'card' },
-            h('div', { class: 'cardhead' }, h('h2', null, 'Recent activity'), h('a', { href: '#/settings' }, 'Log')),
+            h('div', { class: 'cardhead' }, h('h2', null, 'Recent activity'), h('a', { href: '#/log' }, 'Log')),
             logs.lines.length
               ? h('div', null, logs.lines.map((l) => h('div', { class: 'ev' }, h('time', { datetime: l.time }, fmtWhen(l.time)), h('span', null, describeAudit(l)))))
               : h('p', { class: 'empty' }, 'No changes yet.')) : null));
@@ -1031,6 +1105,245 @@
     every(30000, () => draw().catch(() => {}));
   }
 
+  // ---------- live ----------
+
+  // fmtRate formats a speed in bits per second, with one decimal from
+  // kbit/s up so the figures keep their shape as they change.
+  function fmtRate(bps) {
+    const u = ['bit/s', 'kbit/s', 'Mbit/s', 'Gbit/s'];
+    let i = 0, v = bps;
+    while (v >= 1000 && i < u.length - 1) { v /= 1000; i++; }
+    return (i === 0 ? String(Math.round(v)) : v.toFixed(1)) + ' ' + u[i];
+  }
+
+  // curvePath draws a smooth line through the points (monotone cubic): it
+  // never dips below zero or rises above a peak between two steps.
+  function curvePath(xy) {
+    const n = xy.length;
+    if (n < 3) return 'M' + xy.map(([x, y]) => x.toFixed(1) + ',' + y.toFixed(2)).join('L');
+    const d = [], m = [];
+    for (let i = 0; i < n - 1; i++) d.push((xy[i + 1][1] - xy[i][1]) / (xy[i + 1][0] - xy[i][0]));
+    m[0] = d[0];
+    m[n - 1] = d[n - 2];
+    for (let i = 1; i < n - 1; i++) m[i] = d[i - 1] * d[i] <= 0 ? 0 : (d[i - 1] + d[i]) / 2;
+    for (let i = 0; i < n - 1; i++) {
+      if (d[i] === 0) { m[i] = m[i + 1] = 0; continue; }
+      const a = m[i] / d[i], b = m[i + 1] / d[i], q = a * a + b * b;
+      if (q > 9) { const t = 3 / Math.sqrt(q); m[i] = t * a * d[i]; m[i + 1] = t * b * d[i]; }
+    }
+    let p = 'M' + xy[0][0].toFixed(1) + ',' + xy[0][1].toFixed(2);
+    for (let i = 0; i < n - 1; i++) {
+      const [x0, y0] = xy[i], [x1, y1] = xy[i + 1], k = (x1 - x0) / 3;
+      p += 'C' + (x0 + k).toFixed(1) + ',' + (y0 + m[i] * k).toFixed(2) + ' ' + (x1 - k).toFixed(1) + ',' + (y1 - m[i + 1] * k).toFixed(2) + ' ' + x1.toFixed(1) + ',' + y1.toFixed(2);
+    }
+    return p;
+  }
+
+  // Below this a peer counts as idle: keepalives and background chatter.
+  const IDLE_BPS = 2000;
+
+  // The figures and the table average the last few steps so they do not
+  // swing with every burst; the charts show each step.
+  const AVG_STEPS = 5;
+
+  const calm = () => window.matchMedia('(prefers-reduced-motion: reduce)').matches;
+
+  // liveChart draws download and upload as lines over light, see-through
+  // areas, so neither looks less important where they overlap. It is
+  // built once and updated in place: each new step enters just beyond the
+  // right edge and the chart slides left by one step over the step's length,
+  // so it moves steadily instead of jumping. Hover shows the values at a
+  // moment.
+  function liveChart() {
+    const W = 1000, H = 100;
+    let pts = [], size = 60, step = 2, off = 0, dx = W / 59, t0 = 0, moving = false;
+    const downArea = svg('path', { class: 'larea down' });
+    const upArea = svg('path', { class: 'larea up' });
+    const down = svg('path', { class: 'ldown' });
+    const up = svg('path', { class: 'lup' });
+    const cursor = svg('line', { class: 'cursor', x1: 0, x2: 0, y1: 0, y2: H, visibility: 'hidden' });
+    const g = svg('g', null, downArea, upArea, down, up, cursor);
+    const plot = svg('svg', { viewBox: '0 0 ' + W + ' ' + H, preserveAspectRatio: 'none', 'aria-hidden': 'true' }, g);
+    const ylTop = h('div', { class: 'yl top' }), ylMid = h('div', { class: 'yl mid' });
+    const at = (p) => new Date(p.t * 1000).toLocaleTimeString(undefined, { hour: '2-digit', minute: '2-digit', second: '2-digit' });
+    const idle = () => {
+      const peak = pts.reduce((m, p) => p.down + p.up > m.down + m.up ? p : m, { down: 0, up: 0 });
+      return peak.t
+        ? ['Peak ', h('strong', null, fmtRate(peak.down + peak.up)), ' at ' + at(peak) + ' · hover the chart to see a moment.']
+        : ['No traffic in the last 2 minutes.'];
+    };
+    const readout = h('div', { class: 'readout' });
+    let hoverT = null;
+    const x = (i) => off + i * dx;
+    const show = (i) => {
+      const p = pts[i];
+      hoverT = p.t;
+      cursor.setAttribute('x1', x(i).toFixed(1)); cursor.setAttribute('x2', x(i).toFixed(1)); cursor.setAttribute('visibility', 'visible');
+      readout.replaceChildren(at(p), ' · Download ', h('strong', null, fmtRate(p.down)), ' · Upload ', h('strong', null, fmtRate(p.up)));
+    };
+    const plotEl = h('div', { class: 'plot live', role: 'img', 'aria-label': 'Speed of all peers over the last 2 minutes',
+      onMousemove: (e) => {
+        if (!pts.length) return;
+        const r = plotEl.getBoundingClientRect();
+        const shift = moving ? Math.min(1, (performance.now() - t0) / (step * 1000)) * dx : 0;
+        const xv = (e.clientX - r.left) / r.width * W + shift;
+        show(Math.max(0, Math.min(pts.length - 1, Math.round((xv - off) / dx))));
+      },
+      onMouseleave: () => { hoverT = null; cursor.setAttribute('visibility', 'hidden'); readout.replaceChildren(...idle()); } }, plot);
+    const el = h('div', null,
+      readout,
+      h('div', { class: 'chart small' },
+        h('div', { class: 'gl top' }), h('div', { class: 'gl mid' }), h('div', { class: 'gl base' }),
+        ylTop, ylMid, plotEl),
+      h('div', { class: 'xaxis lx' }, h('span', { style: { left: '0%' } }, '2 min ago'), h('span', { style: { left: '50%' } }, '1 min ago'), h('span', { style: { left: '100%' } }, 'now')));
+
+    // update draws points; slide is true for a new step arriving live.
+    const update = (points, sz, st, slide) => {
+      pts = points; size = sz; step = st; dx = W / (size - 1);
+      moving = slide && !calm();
+      const n = pts.length;
+      // The newest point sits at the right edge, or one step beyond it
+      // while sliding in.
+      off = W - (n - 1) * dx + (moving ? dx : 0);
+      const top = niceTop(Math.max(0, ...pts.map((p) => Math.max(p.down, p.up))) || 1e6);
+      const line = (k) => curvePath(pts.map((p, i) => [x(i), H - p[k] / top * H]));
+      if (n > 1) {
+        const dl = line('down'), ul = line('up');
+        const base = 'L' + x(n - 1).toFixed(1) + ',' + H + 'L' + x(0).toFixed(1) + ',' + H + 'Z';
+        downArea.setAttribute('d', dl + base);
+        upArea.setAttribute('d', ul + base);
+        down.setAttribute('d', dl);
+        up.setAttribute('d', ul);
+      }
+      // Axis values are round: no ".0".
+      ylTop.textContent = fmtRate(top).replace('.0 ', ' ');
+      ylMid.textContent = fmtRate(top / 2).replace('.0 ', ' ');
+      g.style.transition = 'none';
+      g.style.transform = 'translateX(0)';
+      if (moving) {
+        g.getBoundingClientRect(); // start the slide from 0
+        t0 = performance.now();
+        g.style.transition = 'transform ' + step + 's linear';
+        g.style.transform = 'translateX(' + (-dx).toFixed(2) + 'px)';
+      }
+      const i = hoverT == null ? -1 : pts.findIndex((p) => p.t === hoverT);
+      if (i >= 0) show(i);
+      else { hoverT = null; cursor.setAttribute('visibility', 'hidden'); readout.replaceChildren(...idle()); }
+    };
+    return { el, update };
+  }
+
+  // rateSpark draws a peer's total speed over the same window, scaled to its
+  // own peak.
+  function rateSpark(vals) {
+    const s = svg('svg', { class: 'spark wide', viewBox: '0 0 96 18', preserveAspectRatio: 'none', 'aria-hidden': 'true' });
+    const top = Math.max(...vals, IDLE_BPS * 4);
+    const n = vals.length;
+    if (n < 2) return s;
+    const pts = vals.map((v, i) => (i / (n - 1) * 96).toFixed(1) + ',' + (17 - v / top * 15).toFixed(1));
+    s.append(svg('polygon', { class: 'fill', points: '0,18 ' + pts.join(' ') + ' 96,18' }), svg('polyline', { points: pts.join(' ') }));
+    return s;
+  }
+
+  // viewLive shows the speed of every peer right now. The server streams its
+  // short in-memory history (the last 2 minutes in 2-second steps) and then
+  // each new step as it is sampled.
+  async function viewLive(wrap) {
+    let peers = (await api('GET', '/peers')).peers;
+    let live = { step: 2, size: 60, points: [] };
+    let paused = false, es = null, retry = 0;
+    const down = h('div', { class: 'v' }), up = h('div', { class: 'v' }), active = h('div', { class: 'v' });
+    const totals = h('div', { class: 'livenow' },
+      h('div', null, h('div', { class: 'k' }, h('span', { class: 'key down' }), 'Download'), down),
+      h('div', null, h('div', { class: 'k' }, h('span', { class: 'key up' }), 'Upload'), up),
+      h('div', null, h('div', { class: 'k' }, 'Active peers'), active));
+    const lc = liveChart();
+    const rows = h('div');
+    const pauseBtn = h('button', { type: 'button', class: 'btn', onClick: () => {
+      paused = !paused;
+      pauseBtn.textContent = paused ? 'Resume' : 'Pause';
+      sub.replaceChildren(...subText());
+      if (paused) close(); else open();
+    } }, 'Pause');
+    const subText = () => paused
+      ? ['Paused · the chart keeps the moment you paused']
+      : [h('span', { class: 'dot ok pulse' }), ' Updated every ' + live.step + ' s · figures are ' + AVG_STEPS * live.step + '-second averages'];
+    const sub = h('p', { class: 'sub livesub' }, subText());
+
+    const draw = (slide) => {
+      const pts = live.points;
+      const sumAt = (p) => Object.values(p.peers).reduce((a, [d, u]) => ({ down: a.down + d, up: a.up + u }), { down: 0, up: 0 });
+      const series = pts.map((p) => ({ t: p.t, ...sumAt(p) }));
+      const recent = pts.slice(-AVG_STEPS);
+      const avg = (f) => recent.length ? recent.reduce((a, p) => a + f(p), 0) / recent.length : 0;
+      const last = {};
+      for (const p of peers) last[p.id] = [avg((x) => (x.peers[p.id] || [0, 0])[0]), avg((x) => (x.peers[p.id] || [0, 0])[1])];
+      down.textContent = fmtRate(avg((p) => sumAt(p).down));
+      up.textContent = fmtRate(avg((p) => sumAt(p).up));
+      active.replaceChildren(String(peers.filter((p) => { const r = last[p.id]; return r && r[0] + r[1] >= IDLE_BPS; }).length),
+        h('small', null, '/ ' + peers.filter((p) => p.stats.online).length + ' online'));
+      lc.update(series, live.size, live.step, slide);
+
+      const online = peers.filter((p) => p.stats.online)
+        .map((p) => ({ p, r: last[p.id] || [0, 0], hist: pts.map((x) => { const v = x.peers[p.id]; return v ? v[0] + v[1] : 0; }) }))
+        .sort((a, b) => (b.r[0] + b.r[1]) - (a.r[0] + a.r[1]) || a.p.name.localeCompare(b.p.name));
+      const rate = (v, idle) => idle ? h('span', { class: 'muted' }, '–') : h('span', { class: 'mono' }, fmtRate(v));
+      rows.replaceChildren(
+        online.length ? h('div', { class: 'tbl' }, h('table', { class: 'narrow' },
+          h('thead', null, h('tr', null, h('th', null, 'Peer'), h('th', null, 'Last 2 minutes'), h('th', { class: 'num' }, 'Download'), h('th', { class: 'num' }, 'Upload'), h('th', null, 'Endpoint'))),
+          h('tbody', null, online.map(({ p, r, hist }) => {
+            const idle = r[0] + r[1] < IDLE_BPS;
+            return h('tr', { class: idle ? 'idle' : null },
+              h('td', null, h('a', { href: '#/peers/' + p.id }, p.name), idle ? h('span', { class: 'tag plain' }, 'idle') : null),
+              h('td', null, rateSpark(hist)),
+              h('td', { class: 'num' }, rate(r[0], idle)),
+              h('td', { class: 'num' }, rate(r[1], idle)),
+              h('td', null, h('span', { class: 'mono' }, p.stats.endpoint ? p.stats.endpoint.replace(/:\d+$/, '') : '–'),
+                p.stats.location && p.stats.location.country ? h('span', { class: 'cc', title: fmtLocation(p.stats.location) }, p.stats.location.country) : null));
+          })))) : h('p', { class: 'empty' }, 'No peer is online.'));
+    };
+
+    // The first message of a stream is the whole history; later ones carry
+    // one new step each. One step more than the server keeps is held, so
+    // the chart's left edge stays filled while it slides.
+    function open() {
+      if (es || paused || document.hidden || !wrap.isConnected) return;
+      let first = true;
+      es = new EventSource('/api/v1/live/stream');
+      es.onmessage = (e) => {
+        retry = 0;
+        const m = JSON.parse(e.data);
+        live = { step: m.step, size: m.size, points: first ? m.points : live.points.concat(m.points).slice(-m.size - 1) };
+        draw(!first);
+        first = false;
+      };
+      es.onerror = () => {
+        if (es.readyState !== EventSource.CLOSED) { first = true; return; } // the browser reconnects
+        close();
+        // Refused, e.g. signed out: api() shows the sign-in page on 401.
+        api('GET', '/status').then(() => { if (wrap.isConnected) setTimeout(open, Math.min(30000, 2000 * 2 ** retry++)); }).catch(() => {});
+      };
+    }
+    function close() { if (es) { es.close(); es = null; } }
+    const onVis = () => { if (document.hidden) close(); else open(); };
+    document.addEventListener('visibilitychange', onVis);
+    cleanups.push(() => { close(); document.removeEventListener('visibilitychange', onVis); });
+
+    fill(wrap,
+      h('div', { class: 'head' },
+        h('div', null, h('h1', null, 'Live'), sub),
+        h('div', { class: 'actions' }, pauseBtn)),
+      h('section', { class: 'card', 'aria-labelledby': 'lv' },
+        h('div', { class: 'cardhead' }, h('h2', { id: 'lv' }, 'All peers · right now')),
+        totals, lc.el),
+      h('section', { class: 'card flush', 'aria-labelledby': 'lp' },
+        h('div', { class: 'cardhead' }, h('h2', { id: 'lp' }, 'Peers'), h('span', { class: 'hint' }, 'Busiest first')),
+        rows));
+    draw(false);
+    open();
+    every(15000, async () => { try { peers = (await api('GET', '/peers')).peers; } catch { /* keep last */ } });
+  }
+
   function describeAudit(l) {
     const parts = [l.msg.charAt(0).toUpperCase() + l.msg.slice(1)];
     if (l.peer) parts.push(': ' + l.peer);
@@ -1111,7 +1424,7 @@
         return hit && keep;
       });
       tbody.replaceChildren(...sorted(rows).map((p) => h('tr', null,
-        h('td', null, h('a', { href: '#/peers/' + p.id }, h('strong', null, p.name)), p.note ? h('div', { class: 'note' }, p.note) : null),
+        h('td', null, h('a', { class: 'pname', href: '#/peers/' + p.id }, p.name), p.note ? h('div', { class: 'note' }, p.note) : null),
         h('td', { class: 'mono' }, p.ipv4),
         h('td', null, badge(peerState(p))),
         h('td', { class: 'mono muted' }, p.stats.endpoint || '–',
@@ -1298,7 +1611,7 @@
       sessMore.textContent = allSessions ? 'Show fewer' : 'Show all ' + sessions.length;
     };
     drawSessions();
-    let range = '7d';
+    let range = '24h';
     const st = peerState(p);
     const traffic = h('div');
     const totals = h('div', { class: 'legend-row' });
@@ -1320,7 +1633,7 @@
     };
 
     async function drawTraffic() {
-      pills.replaceChildren(...[['24h', '24 h'], ['7d', '7 days'], ['30d', '30 days']].map(([k, t]) =>
+      pills.replaceChildren(...RANGES.map(([k, t]) =>
         h('button', { type: 'button', class: range === k ? 'pill on' : 'pill', 'aria-pressed': String(range === k), onClick: () => { range = k; drawTraffic(); } }, t)));
       const s = await api('GET', '/peers/' + id + '/stats?range=' + range);
       const down = s.points.reduce((a, x) => a + x.down, 0), up = s.points.reduce((a, x) => a + x.up, 0);
@@ -1497,6 +1810,69 @@
 
   const DNS_PRESETS = [['Quad9', '9.9.9.9, 149.112.112.112']];
 
+  // healthParts turns the server's checks into the Health card: the public
+  // address per IP family (from its uplink and public address checks) and,
+  // beside them, one row per other check with a plain-word status, the raw
+  // setting and, when it fails, what is wrong.
+  function healthParts(checks) {
+    const by = Object.fromEntries(checks.map((c) => [c.name, c]));
+    const addrs = [];
+    for (const fam of ['IPv4', 'IPv6']) {
+      const up = by[fam + ' uplink'], pub = by['Public ' + fam];
+      if (!up) continue;
+      const m = pub && pub.ok ? /^(\S+) \((.+)\)$/.exec(pub.detail) : null;
+      addrs.push({
+        label: 'Public ' + fam + (up.ok ? ' · ' + up.detail : ''),
+        ok: up.ok && (!pub || pub.ok),
+        value: m ? m[1] : (pub ? pub.detail : up.detail),
+        note: m ? m[2] : null,
+        mono: !!(pub && pub.ok),
+      });
+    }
+    const sysctl = (d) => d.replace(/^net\.ipv[46]\.(conf\.)?/, '');
+    const tiles = checks.filter((c) => !/^(IPv[46] uplink|Public IPv[46])$/.test(c.name)).map((c) => {
+      const t = { label: c.name, ok: c.ok, status: c.ok ? 'OK' : 'Problem', raw: null, problem: c.ok ? null : c.detail };
+      switch (c.name) {
+        case 'WireGuard interface': t.status = c.detail; t.problem = null; break;
+        case 'IPv4 forwarding': case 'IPv6 forwarding': t.status = c.ok ? 'On' : 'Off'; t.raw = sysctl(c.detail); t.problem = null; break;
+        case 'IPv6 router announcements': {
+          const [setting, ...why] = c.detail.split(': ');
+          t.label = 'Router announcements';
+          t.status = !c.ok ? 'Ignored' : setting.endsWith('=0') ? 'Not used' : 'Accepted';
+          t.raw = sysctl(setting);
+          t.problem = c.ok || !why.length ? null : why.join(': ');
+          break;
+        }
+        case 'nftables rules':
+          t.status = c.ok ? 'Present' : 'Missing';
+          if (/^table /.test(c.detail)) { t.raw = c.detail.replace(/ (present|missing)$/, ''); t.problem = null; }
+          break;
+        case 'Last apply':
+          if (c.ok) { const iso = c.detail.replace(/^applied /, ''); t.status = ago(iso); t.title = fmtStamp(iso); } else t.status = 'Failed';
+          break;
+        case 'Latency check': t.status = c.ok ? 'Tunnel ping works' : 'Failing'; break;
+      }
+      return t;
+    });
+    return { addrs, tiles, failing: checks.filter((c) => !c.ok).length, total: checks.length };
+  }
+
+  function healthCard(checks) {
+    const hp = healthParts(checks);
+    const dot = (ok) => [h('span', { class: ok ? 'dot ok' : 'dot bad' }), h('span', { class: 'sr' }, ok ? 'OK: ' : 'Problem: ')];
+    return h('section', { class: 'card', 'aria-labelledby': 'hc' },
+      h('div', { class: 'hchead' }, h('h2', { id: 'hc' }, 'Health'),
+        h('span', { class: hp.failing ? 'bad' : null }, hp.failing ? hp.failing + ' of ' + hp.total + ' checks failing' : 'All ' + hp.total + ' checks pass')),
+      h('div', { class: 'hcbody' },
+      hp.addrs.length ? h('div', { class: 'hcaddrs' }, hp.addrs.map((a) => h('div', { class: a.ok ? 'hcaddr' : 'hcaddr bad' },
+        h('div', { class: 'l' }, dot(a.ok), a.label),
+        h('div', { class: a.mono ? 'v mono' : 'v' }, a.value, a.note ? h('span', { class: 'n' }, ' ' + a.note) : null)))) : null,
+      h('div', { class: 'hclist' }, hp.tiles.map((t) => h('div', { class: t.ok ? 'hcrow' : 'hcrow bad', title: t.title || null },
+        dot(t.ok), h('span', { class: 'l' }, t.label),
+        h('span', { class: 'v' }, h('span', { class: 's' }, t.status), t.raw ? h('span', { class: 'r mono' }, t.raw) : null),
+        t.problem ? h('div', { class: 'p' }, t.problem) : null)))));
+  }
+
   async function viewServer(wrap) {
     const [srv, st] = await Promise.all([api('GET', '/server'), api('GET', '/status')]);
     const orig = JSON.parse(JSON.stringify(srv));
@@ -1567,11 +1943,7 @@
     fill(wrap,
       h('div', null, h('h1', null, 'Server'), h('p', { class: 'sub' }, 'WireGuard interface, address plan, client defaults and firewall')),
       result,
-      h('section', { class: 'card', 'aria-labelledby': 'hc' },
+      healthCard(st.checks),
-        h('h2', { id: 'hc' }, 'Health'),
-        h('div', { style: { marginTop: '8px' } }, st.checks.map((c) => h('div', { class: 'chk' },
-          h('span', { class: c.ok ? 'dot ok' : 'dot bad' }), h('span', { class: 'sr' }, c.ok ? 'OK: ' : 'Problem: '),
-          h('b', null, c.name), h('span', { class: c.ok ? 'muted' : null }, c.detail))))),
 
       h('section', { class: 'card', 'aria-labelledby': 'if' },
         h('h2', { id: 'if' }, 'Interface'),
@@ -1621,6 +1993,155 @@
       bar);
   }
 
+  // ---------- log ----------
+
+  async function viewLog(wrap) {
+    const s = await api('GET', '/settings');
+    let level = 'all';
+    const box = h('pre', { class: 'log tall', tabindex: '0', 'aria-label': 'Log lines, newest first' });
+    const pills = h('div', { class: 'pills', role: 'group', 'aria-label': 'Level filter' });
+    let audit = false;
+    const draw = async () => {
+      pills.replaceChildren(...[['all', 'All'], ['info', 'Info'], ['warn', 'Warn'], ['error', 'Error']].map(([k, t]) =>
+        h('button', { type: 'button', class: level === k && !audit ? 'pill on' : 'pill', 'aria-pressed': String(level === k && !audit), onClick: () => { level = k; audit = false; draw(); } }, t)),
+        h('button', { type: 'button', class: audit ? 'pill on' : 'pill', 'aria-pressed': String(audit), onClick: () => { audit = true; draw(); } }, 'Changes only'));
+      try {
+        const r = await api('GET', '/logs?limit=500&level=' + level + (audit ? '&audit=1' : ''));
+        box.textContent = r.lines.length ? r.lines.map(fmtLogLine).join('\n') : 'No entries at this level.';
+      } catch (e) { box.textContent = e.message; }
+    };
+    fill(wrap,
+      h('div', { class: 'head' },
+        h('div', null, h('h1', null, 'Log'), h('p', { class: 'sub' }, h('span', { class: 'mono' }, s.logPath), ' · level ' + s.log.level + ' · rotates at ' + s.log.maxSizeMB + ' MB, keeps ' + s.log.maxFiles + ' files')),
+        h('div', { class: 'actions' },
+          h('a', { class: 'btn', href: '#/settings#logs' }, 'Log settings'),
+          h('a', { class: 'btn', href: '/api/v1/logs/download' }, 'Download log'))),
+      h('section', { class: 'card', 'aria-label': 'Log lines' },
+        h('div', { class: 'cardhead' }, h('span', { class: 'muted' }, 'Newest first · refreshes every 10 s'), pills),
+        h('div', { class: 'section' }, box)));
+    every(10000, draw);
+    await draw();
+  }
+
+  // ---------- updates ----------
+
+  const HIDE_UPDATE = 'GHOSTWIRE.hideUpdate';
+
+  // updateBanner tells the Dashboard about a newer release until it is
+  // hidden for that version.
+  function updateBanner() {
+    const v = me.updateAvailable;
+    let hidden = null;
+    try { hidden = localStorage.getItem(HIDE_UPDATE); } catch { /* storage blocked */ }
+    if (!v || hidden === v) return null;
+    const box = h('div', { class: 'notice new' },
+      h('div', null, h('strong', null, 'GHOSTWIRE ' + v + ' is available. '), 'You\'re on v' + me.version.replace(/^v/, '') + '.'),
+      h('div', { class: 'actions' },
+        h('a', { class: 'btn small', href: '#/settings#updates' }, 'How to update'),
+        h('button', { type: 'button', class: 'btn small ghost', onClick: () => {
+          try { localStorage.setItem(HIDE_UPDATE, v); } catch { /* storage blocked */ }
+          box.remove();
+        } }, 'Hide until the next version')));
+    return box;
+  }
+
+  // mdInline turns **bold** and `code` into elements; everything else stays
+  // text.
+  const mdInline = (text) => text.split(/(\*\*[^*]+\*\*|`[^`]+`)/).filter(Boolean).map((t) =>
+    t.startsWith('**') ? h('strong', null, t.slice(2, -2)) : t.startsWith('`') ? h('code', null, t.slice(1, -1)) : t);
+
+  // releaseSummary picks the opening paragraph and the first bullet list out
+  // of the release notes; the full notes are a link away.
+  function releaseSummary(md) {
+    const lines = md.replace(/\r/g, '').split('\n');
+    const para = [];
+    for (const l of lines) {
+      if (!l.trim()) { if (para.length) break; continue; }
+      if (/^(#|- |\* |```|\|)/.test(l)) break;
+      para.push(l.trim());
+    }
+    const items = [];
+    let started = false;
+    for (const l of lines) {
+      const m = /^[-*] (.+)$/.exec(l);
+      if (m) { started = true; items.push(m[1]); } else if (started && l.trim()) break;
+    }
+    return { summary: para.join(' '), items };
+  }
+
+  function updatesCard(initial) {
+    let st = initial;
+    const card = h('section', { class: 'card', id: 'updates', 'aria-labelledby': 'upd' });
+    const setStatus = (next) => {
+      st = next;
+      me.updateAvailable = st.enabled && st.available ? st.latest.version : undefined;
+      drawUpdateHint();
+      draw();
+    };
+    const checkNow = async (btn) => {
+      if (btn) { btn.disabled = true; btn.textContent = 'Checking…'; }
+      try { setStatus(await api('POST', '/updates/check')); } catch (x) { toast(x.message, true); draw(); }
+    };
+    const save = async (updates) => {
+      try {
+        await api('PATCH', '/settings', { updates });
+        const s = await api('GET', '/settings');
+        if (s.updates.enabled) await checkNow(); else setStatus(s.updates);
+      } catch (x) { toast(x.message, true); draw(); }
+    };
+    const SOURCES = [['gitea', 'Gitea', 'git.redetzke.aero/Redetzke/GHOSTWIRE'], ['github', 'GitHub', 'github.com/danielredetzke/GHOSTWIRE']];
+    const srcName = () => SOURCES.find(([k]) => k === st.source)[1];
+
+    function draw() {
+      const cur = 'v' + st.current.replace(/^v/, '');
+      const rel = st.latest;
+      const notes = rel && st.available ? releaseSummary(rel.notes || '') : null;
+      const cmds = st.available && st.file ? [
+        'curl -fLO ' + st.fileUrl,
+        'curl -fLO ' + st.sumsUrl,
+        'sha256sum -c --ignore-missing SHA256SUMS',
+        'chmod +x ' + st.file,
+        'sudo ./' + st.file + ' update',
+      ].join('\n') : null;
+      fill(card,
+        h('div', { class: 'cardhead' },
+          h('h3', { id: 'upd' }, 'Updates'),
+          st.enabled ? h('span', { class: 'muted' }, st.checked ? 'Last checked ' + ago(st.checked) : 'Not checked yet') : null),
+        h('div', { class: 'upvers' },
+          h('div', { class: 'upbox' }, h('span', null, 'Running'), h('strong', { class: 'mono' }, cur)),
+          rel ? h('div', { class: st.available ? 'upbox new' : 'upbox' }, h('span', null, 'Latest release'), h('strong', { class: 'mono' }, rel.version)) : null,
+          h('div', { class: 'upbox' }, h('span', null, 'This server'), h('strong', null, st.arch ? 'Linux · ' + st.arch : 'No release file for this platform'))),
+        st.enabled && st.error ? h('div', { class: 'notice err', role: 'alert' },
+          h('div', null, 'The last check failed: ' + st.error + '. ' + (st.lastOk ? 'Last worked ' + ago(st.lastOk) + '. ' : '') + 'Try the other source.')) : null,
+        rel && !st.available ? h('p', { class: 'uptodate' }, h('span', { class: 'dot ok' }), 'GHOSTWIRE is up to date.') : null,
+        notes ? h('div', { class: 'upnotes' },
+          h('div', { class: 'hd' }, h('strong', null, 'What\'s new in ' + rel.version),
+            h('span', { class: 'muted' }, 'Released ' + fmtDate(rel.published) + ' · from ' + srcName()),
+            h('a', { href: rel.url, target: '_blank', rel: 'noopener' }, 'Full notes on ' + srcName())),
+          /security/i.test(notes.summary) ? h('p', { class: 'notice' }, 'Includes security fixes.') : null,
+          notes.summary ? h('p', null, mdInline(notes.summary)) : null,
+          notes.items.length ? h('ul', null, notes.items.map((t) => h('li', null, mdInline(t)))) : null) : null,
+        cmds ? h('div', { class: 'upcmd' },
+          h('div', { class: 'hd' }, h('strong', null, 'Update this server'), h('span', { class: 'muted' }, 'Run on the server. VPN connections stay up.')),
+          h('pre', { class: 'code' }, cmds),
+          h('div', null, h('button', { type: 'button', class: 'btn small', onClick: () => copy(cmds) }, 'Copy commands'))) : null,
+        st.available && !st.file ? h('p', null, 'No release file is built for this platform. ', h('a', { href: rel.url, target: '_blank', rel: 'noopener' }, 'See the release')) : null,
+        h('fieldset', { class: 'section' }, h('legend', { class: 'legend' }, 'Release source'),
+          h('div', { class: 'grid' }, SOURCES.map(([k, name, where]) => h('label', { class: 'opt' },
+            h('input', { type: 'radio', name: 'upsrc', value: k, checked: st.source === k, onChange: () => save({ source: k }) }),
+            h('span', null, h('strong', null, name), h('br'), h('span', { class: 'hint mono' }, where))))),
+          h('span', { class: 'hint' }, 'Both carry the same releases and files. The check, the release notes and the download links use the source you pick.')),
+        h('div', { class: 'uprow' },
+          h('label', { class: 'check' },
+            h('input', { type: 'checkbox', checked: st.enabled, onChange: (e) => save({ check: e.target.checked }) }),
+            h('span', null, 'Check for updates once a day', h('br'),
+              h('span', { class: 'hint' }, 'Asks ' + new URL(st.sourceUrl).host + ' for the latest release. Nothing about this server is sent.'))),
+          st.enabled ? h('button', { type: 'button', class: 'btn small', onClick: (e) => checkNow(e.currentTarget) }, 'Check now') : null));
+    }
+    draw();
+    return card;
+  }
+
   // ---------- settings ----------
 
   // ---------- my account ----------
@@ -1728,7 +2249,6 @@
       return;
     }
     const [s, tk, us] = await Promise.all([api('GET', '/settings'), api('GET', '/tokens'), api('GET', '/users')]);
-    let logLevelFilter = 'all';
 
     // users
     const userBody = h('tbody');
@@ -1893,20 +2413,13 @@
       try { await api('DELETE', '/tokens/' + t.id); toast('Revoked ' + t.name); reloadTokens(); } catch (e) { toast(e.message, true); }
     };
 
-    // logs
+    const levelSel = h('select', { id: 'lv' }, [['debug', 'Debug: everything'], ['info', 'Info'], ['warn', 'Warnings and errors'], ['error', 'Errors only']].map(([l, t]) => h('option', { value: l, selected: s.log.level === l }, t)));
-    const logBox = h('pre', { class: 'log', tabindex: '0', 'aria-label': 'Log lines, newest first' });
+    const sessSel = h('select', { id: 'st', onChange: async (e) => {
-    const logPills = h('div', { class: 'pills', role: 'group', 'aria-label': 'Level filter' });
+      try { await api('PATCH', '/settings', { web: { ...s.web, sessionHours: Number(e.target.value) } }); s.web.sessionHours = Number(e.target.value); toast('Session length saved'); } catch (x) { toast(x.message, true); }
-    const drawLogs = async () => {
+    } }, [[1, '1 hour'], [12, '12 hours'], [24, '1 day'], [168, '7 days']].map(([v, t]) => h('option', { value: String(v), selected: s.web.sessionHours === v }, t)));
-      logPills.replaceChildren(...[['all', 'All'], ['info', 'Info'], ['warn', 'Warn'], ['error', 'Error']].map(([k, t]) =>
+    const geoBox = h('input', { type: 'checkbox', id: 'geo', checked: s.stats.geoip !== false, onChange: async (e) => {
-        h('button', { type: 'button', class: logLevelFilter === k ? 'pill on' : 'pill', 'aria-pressed': String(logLevelFilter === k), onClick: () => { logLevelFilter = k; drawLogs(); } }, t)));
+      try { await api('PATCH', '/settings', { stats: { ...s.stats, geoip: e.target.checked } }); toast(e.target.checked ? 'Country lookup on' : 'Country lookup off'); } catch (x) { e.target.checked = !e.target.checked; toast(x.message, true); }
-      try {
+    } });
-        const r = await api('GET', '/logs?limit=200&level=' + logLevelFilter);
-        logBox.textContent = r.lines.length ? r.lines.map(fmtLogLine).join('\n') : 'No entries at this level.';
-      } catch (e) { logBox.textContent = e.message; }
-    };
-    const levelSel = h('select', { id: 'lv', onChange: async (e) => {
-      try { await api('PATCH', '/settings', { log: { ...s.log, level: e.target.value } }); s.log.level = e.target.value; toast('Log level: ' + e.target.value); } catch (x) { toast(x.message, true); }
-    } }, ['debug', 'info', 'warn', 'error'].map((l) => h('option', { value: l, selected: s.log.level === l }, l)));
 
     // sign-in rules
     const requireBox = h('input', { type: 'checkbox', id: 'rq', checked: s.signin.requireMfa, onChange: async (e) => {
@@ -1956,7 +2469,6 @@
     const logFiles = h('input', { id: 'rf', type: 'number', min: '1', max: '100', value: s.log.maxFiles, inputMode: 'numeric' });
     const hourly = presetSelect('rh', s.stats.hourlyHours, [[24, '1 day'], [48, '2 days'], [168, '7 days'], [336, '14 days'], [744, '31 days']], 'hours');
     const daily = presetSelect('rd', s.stats.dailyDays, [[30, '30 days'], [90, '90 days'], [180, '6 months'], [400, '13 months'], [730, '2 years'], [1825, '5 years'], [3660, '10 years']], 'days');
-    const geo = h('input', { type: 'checkbox', checked: s.stats.geoip !== false });
     const geoStatus = s.geo && s.geo.updated ? 'Database from ' + fmtDate(s.geo.updated) + '.' : 'Not downloaded yet.';
     const diskHint = h('span', { class: 'hint' });
     const drawDiskHint = () => {
@@ -1975,14 +2487,45 @@
       if (shrinks && !await confirmDialog({ title: 'Delete older data?', text: 'The new limits are lower: older log files and traffic history beyond them are deleted. This cannot be undone.', ok: 'Save and delete', danger: true })) return;
       try {
         await api('PATCH', '/settings', {
-          log: { ...s.log, maxSizeMB: next.maxSizeMB, maxFiles: next.maxFiles },
+          log: { ...s.log, level: levelSel.value, maxSizeMB: next.maxSizeMB, maxFiles: next.maxFiles },
-          stats: { hourlyHours: next.hourlyHours, dailyDays: next.dailyDays, geoip: geo.checked },
+          stats: { ...s.stats, hourlyHours: next.hourlyHours, dailyDays: next.dailyDays },
         });
-        toast('Retention saved');
+        toast('Logs & history saved');
         render();
       } catch (x) { retErr.textContent = x.message; }
     };
 
+    // copies of config.json that updates leave behind
+    const copies = h('div', { class: 'section' });
+    const drawCopies = async () => {
+      let list;
+      try { list = (await api('GET', '/update-backups')).backups; } catch (x) { fill(copies, h('p', { class: 'err-text' }, x.message)); return; }
+      const remove = async (b) => {
+        if (!await confirmDialog({ title: 'Remove ' + b.name + '?', text: 'This copy of your settings from ' + b.version + ' is deleted from the server. It cannot be restored.', ok: 'Remove', danger: true })) return;
+        try { await api('DELETE', '/update-backups/' + encodeURIComponent(b.name)); toast('Removed ' + b.name); drawCopies(); } catch (x) { toast(x.message, true); }
+      };
+      const removeAll = async () => {
+        const n = list.length;
+        if (!await confirmDialog({ title: n === 1 ? 'Remove the copy?' : 'Remove all ' + n + ' copies?', text: 'They are deleted from the server and cannot be restored. Your current settings are not affected.', ok: 'Remove all', danger: true })) return;
+        try { await api('DELETE', '/update-backups'); toast(n === 1 ? 'Removed 1 copy' : 'Removed ' + n + ' copies'); drawCopies(); } catch (x) { toast(x.message, true); }
+      };
+      const total = list.reduce((t, b) => t + b.size, 0);
+      fill(copies,
+        h('div', { class: 'cardhead' },
+          h('div', null, h('strong', null, 'Copies made by updates'),
+            h('p', { class: 'lead', style: { marginBottom: '0' } }, 'Each update saves the previous config.json next to it. They hold the same secrets as a backup.')),
+          list.length ? h('button', { type: 'button', class: 'btn', onClick: removeAll }, 'Remove all') : null),
+        list.length ? h('div', { class: 'tbl section' }, h('table', { class: 'narrow' },
+          h('thead', null, h('tr', null, h('th', null, 'File'), h('th', null, 'From version'), h('th', null, 'Saved'), h('th', { class: 'num' }, 'Size'), h('th', null, h('span', { class: 'sr' }, 'Actions')))),
+          h('tbody', null, list.map((b, i) => h('tr', null,
+            h('td', null, h('span', { class: 'mono' }, b.name), i === 0 ? h('span', { class: 'tag plain' }, 'Newest') : null),
+            h('td', { class: 'mono' }, b.version),
+            h('td', null, fmtStamp(b.modified)),
+            h('td', { class: 'num' }, fmtBytes(b.size)),
+            h('td', { class: 'num' }, h('button', { type: 'button', class: 'btn small', onClick: () => remove(b) }, 'Remove'))))))) : h('p', { class: 'muted', style: { margin: '12px 0 0' } }, 'No copies from updates.'),
+        list.length ? h('p', { class: 'hint', style: { margin: '8px 0 0' } }, list.length + (list.length === 1 ? ' copy, ' : ' copies, ') + fmtBytes(total) + ' next to config.json. After each update, only the newest 3 are kept.') : null);
+    };
+
     // backup
     const restoreInput = h('input', { type: 'file', accept: 'application/json,.json', hidden: true, onChange: async (e) => {
       const f = e.target.files[0];
@@ -1998,85 +2541,94 @@
       } catch (x) { toast(x.message, true); }
     } });
 
+    const groupHead = (id, title, text) => h('div', { class: 'group', id }, h('h2', null, title), h('p', null, text));
     fill(wrap,
-      h('div', null, h('h1', null, 'Settings'), h('p', { class: 'sub' }, 'Users, web interface, API access for the iOS app, logs, data retention and backups')),
+      h('div', null, h('h1', null, 'Settings'), h('p', { class: 'sub' }, 'Who can sign in, the web interface, logs and history, updates and backups')),
       restartBox,
 
+      groupHead('g-access', 'Access', 'Who can sign in, and how.'),
       h('section', { class: 'card flush', 'aria-labelledby': 'usr' },
         h('div', { class: 'cardhead' },
-          h('div', null, h('h2', { id: 'usr' }, 'Users'), h('p', { class: 'lead', style: { marginBottom: '0' } }, 'Everyone here is an admin. You cannot delete yourself, so one user always remains.')),
+          h('div', null, h('h3', { id: 'usr' }, 'Users'), h('p', { class: 'lead', style: { marginBottom: '0' } }, 'Everyone here is an admin. You cannot delete yourself, so one user always remains.')),
           h('button', { type: 'button', class: 'btn primary', onClick: addUser }, 'Add user')),
         h('div', { class: 'tbl' }, h('table', null,
           h('thead', null, h('tr', null, h('th', null, 'User'), h('th', null, 'Status'), h('th', null, 'Two-step'), h('th', null, 'Last sign-in'), h('th', null, 'App tokens'), h('th', null, 'Created'), h('th', null, h('span', { class: 'sr' }, 'Actions')))),
           userBody))),
 
       h('section', { class: 'card', 'aria-labelledby': 'sgn' },
-        h('h2', { id: 'sgn' }, 'Sign-in'),
+        h('div', { class: 'cardhead' }, h('h3', { id: 'sgn' }, 'Sign-in'), h('span', { class: 'saves' }, 'Saves right away')),
-        h('p', { class: 'lead' }, 'Everyone sets up two-step sign-in under My account: an authenticator app or passkeys, including on a YubiKey. Changes apply immediately.'),
+        h('p', { class: 'lead' }, 'Everyone sets up two-step sign-in under My account: an authenticator app or passkeys, including on a YubiKey.'),
         h('label', { class: 'check' }, requireBox, h('span', null, 'Require two-step sign-in for everyone', h('br'),
-          h('span', { class: 'hint' }, 'Users without it are asked to set it up right after their password. To help someone who lost their phone or key, use Edit → Reset two-step sign-in.')))),
+          h('span', { class: 'hint' }, 'Users without it are asked to set it up right after their password. To help someone who lost their phone or key, use Edit → Reset two-step sign-in.'))),
+        h('div', { class: 'grid section' },
+          h('div', { class: 'field' }, h('label', { htmlFor: 'st' }, 'Stay signed in for'), sessSel, h('span', { class: 'hint' }, 'Applies to new sign-ins')),
+          h('div', { class: 'field' }), h('div', { class: 'field' }))),
 
+      h('section', { class: 'card', 'aria-labelledby': 'api' },
+        h('div', { class: 'cardhead' },
+          h('div', null, h('h3', { id: 'api' }, 'iOS app and API tokens'), h('p', { class: 'lead', style: { marginBottom: '0' } }, 'For the iOS app and scripts. A token appears once when you create it, and only a hash is stored.')),
+          h('button', { type: 'button', class: 'btn primary', onClick: () => pairDialog(reloadTokens) }, 'Pair iOS app')),
+        h('div', { class: 'tbl section' }, h('table', { class: 'narrow' },
+          h('thead', null, h('tr', null, h('th', null, 'Name'), h('th', null, 'Owner'), h('th', null, 'Access'), h('th', null, 'Created'), h('th', null, 'Last used'), h('th', null, h('span', { class: 'sr' }, 'Actions')))),
+          tbody))),
+
+      groupHead('g-web', 'Web interface', 'Where this interface listens and what strangers see.'),
       h('form', { class: 'card', onSubmit: saveWeb, 'aria-labelledby': 'web' },
-        h('h2', { id: 'web' }, 'Web interface'),
+        h('div', { class: 'cardhead' }, h('h3', { id: 'web' }, 'Address and HTTPS'), h('span', { class: 'saves' }, 'Save, then restart')),
-        h('p', { class: 'lead' }, 'Changes take effect after the service restarts.'),
+        h('p', { class: 'lead' }, 'Usually set once during install.'),
         h('div', { class: 'grid' },
           h('div', { class: 'field' }, h('label', { htmlFor: 'la' }, 'Listen address'), h('input', { id: 'la', class: 'mono', value: web.listen, onInput: (e) => { web.listen = e.target.value.trim(); } })),
           h('div', { class: 'field' }, h('label', { htmlFor: 'hl' }, 'HTTP listen address'), h('input', { id: 'hl', class: 'mono', value: web.httpListen, placeholder: 'off', onInput: (e) => { web.httpListen = e.target.value.trim(); } }), h('span', { class: 'hint' }, 'Redirects to HTTPS and answers Let\'s Encrypt http-01 checks. Empty turns it off')),
           h('div', { class: 'field' }, h('label', { htmlFor: 'tls' }, 'HTTPS'), modeSel),
-          h('div', { class: 'field' }, h('label', { htmlFor: 'st' }, 'Session length'), h('select', { id: 'st', onChange: (e) => { web.sessionHours = Number(e.target.value); } },
-            [[1, '1 hour'], [12, '12 hours'], [24, '1 day'], [168, '7 days']].map(([v, t]) => h('option', { value: String(v), selected: web.sessionHours === v }, t)))),
           s.fingerprint ? h('div', { class: 'field' }, h('label', { htmlFor: 'fp' }, 'Certificate fingerprint (SHA-256)'), h('input', { id: 'fp', class: 'mono', value: s.fingerprint, readOnly: true }), h('span', { class: 'hint' }, 'The iOS app pins this when pairing')) : null),
         h('div', { class: 'section' }, fAcme, fFiles),
         webErr,
         h('div', { class: 'formfoot' }, h('button', { type: 'submit', class: 'btn primary' }, 'Save'))),
 
       h('section', { class: 'card', 'aria-labelledby': 'dcy' },
-        h('h2', { id: 'dcy' }, 'Decoy'),
+        h('div', { class: 'cardhead' }, h('h3', { id: 'dcy' }, 'Decoy'), h('span', { class: 'saves' }, 'Saves right away')),
-        h('p', { class: 'lead' }, 'Shows an ordinary web server page instead of this interface. The iOS app and setup links keep working. Changes apply immediately.'),
+        h('p', { class: 'lead' }, 'Shows an ordinary web server page instead of this interface. The iOS app and setup links keep working.'),
         h('label', { class: 'check' }, decoyBox, h('span', null, 'Decoy', h('br'),
           h('span', { class: 'hint' }, 'Hides the web interface. Turn it off again in the iOS app.'))),
         h('div', { class: 'grid section' },
           h('div', { class: 'field' }, h('label', { htmlFor: 'dp' }, 'Decoy page'), decoySel))),
 
-      h('section', { class: 'card', 'aria-labelledby': 'api' },
+      groupHead('logs', 'Logs & history', 'What the server records and for how long. The log itself is on the Log page.'),
-        h('div', { class: 'cardhead' },
-          h('div', null, h('h2', { id: 'api' }, 'API tokens'), h('p', { class: 'lead', style: { marginBottom: '0' } }, 'For the iOS app and scripts. A token appears once when you create it, and only a hash is stored.')),
-          h('button', { type: 'button', class: 'btn primary', onClick: () => pairDialog(reloadTokens) }, 'Pair iOS app')),
-        h('div', { class: 'tbl section' }, h('table', { class: 'narrow' },
-          h('thead', null, h('tr', null, h('th', null, 'Name'), h('th', null, 'Owner'), h('th', null, 'Access'), h('th', null, 'Created'), h('th', null, 'Last used'), h('th', null, h('span', { class: 'sr' }, 'Actions')))),
-          tbody))),
-
-      h('section', { class: 'card', 'aria-labelledby': 'lg' },
-        h('div', { class: 'cardhead' },
-          h('div', null, h('h2', { id: 'lg' }, 'Log'), h('p', { class: 'lead', style: { marginBottom: '0' } }, h('span', { class: 'mono' }, s.logPath), ' · rotates at ' + s.log.maxSizeMB + ' MB, keeps ' + s.log.maxFiles + ' files')),
-          logPills),
-        h('div', { class: 'section' }, logBox),
-        h('div', { class: 'grid section' },
-          h('div', { class: 'field' }, h('label', { htmlFor: 'lv' }, 'Log level'), levelSel),
-          h('div', { class: 'field', style: { justifyContent: 'flex-end' } }, h('a', { class: 'btn', href: '/api/v1/logs/download' }, 'Download log')))),
-
       h('form', { class: 'card', onSubmit: saveRetention, 'aria-labelledby': 'ret' },
-        h('h2', { id: 'ret' }, 'Data retention'),
+        h('div', { class: 'cardhead' }, h('h3', { id: 'ret' }, 'Log and traffic history'), h('span', { class: 'saves' }, 'Save, no restart')),
-        h('p', { class: 'lead' }, 'How much log and traffic history is kept. Changes apply immediately, without a restart.'),
+        h('p', { class: 'lead' }, 'Lower limits delete older data when you save. All-time totals are always kept.'),
         h('div', { class: 'grid' },
+          h('div', { class: 'field' }, h('label', { htmlFor: 'lv' }, 'Log level'), levelSel),
           h('div', { class: 'field' }, h('label', { htmlFor: 'rs' }, 'Log file size (MB)'), logSize, h('span', { class: 'hint' }, 'The log starts a new file at this size. 1–1000')),
-          h('div', { class: 'field' }, h('label', { htmlFor: 'rf' }, 'Old log files kept'), logFiles, diskHint),
+          h('div', { class: 'field' }, h('label', { htmlFor: 'rf' }, 'Old log files kept'), logFiles, diskHint)),
+        h('div', { class: 'grid section' },
           h('div', { class: 'field' }, h('label', { htmlFor: 'rh' }, 'Hourly traffic history'), hourly, h('span', { class: 'hint' }, 'Used by the 24-hour charts')),
-          h('div', { class: 'field' }, h('label', { htmlFor: 'rd' }, 'Daily traffic history'), daily, h('span', { class: 'hint' }, 'Used by the 7- and 30-day charts and the connection history. All-time totals are always kept'))),
+          h('div', { class: 'field' }, h('label', { htmlFor: 'rd' }, 'Daily traffic history'), daily, h('span', { class: 'hint' }, 'Used by the 7- and 30-day charts and the connection history')),
-        h('label', { class: 'check section' }, geo, h('span', null, 'Show country and network of peer addresses', h('br'),
+          h('div', { class: 'field' })),
-          h('span', { class: 'hint' }, 'Downloads the free DB-IP Lite databases (about 20 MB) once a month and looks addresses up on this server only. ' + geoStatus))),
         retErr,
-        h('div', { class: 'formfoot' }, h('button', { type: 'submit', class: 'btn primary' }, 'Save retention'))),
+        h('div', { class: 'formfoot' }, h('a', { class: 'btn', href: '#/log' }, 'Open the log'), h('button', { type: 'submit', class: 'btn primary' }, 'Save'))),
+
+      h('section', { class: 'card', 'aria-labelledby': 'geo-h' },
+        h('div', { class: 'cardhead' }, h('h3', { id: 'geo-h' }, 'Country and network lookup'), h('span', { class: 'saves' }, 'Saves right away')),
+        h('label', { class: 'check' }, geoBox, h('span', null, 'Show country and network of peer addresses', h('br'),
+          h('span', { class: 'hint' }, 'Downloads the free DB-IP Lite databases (about 20 MB) once a month and looks addresses up on this server only. ' + geoStatus)))),
+
+      groupHead('g-upkeep', 'Upkeep', 'New versions and copies of your settings.'),
+      updatesCard(s.updates),
 
       h('section', { class: 'card', 'aria-labelledby': 'bk' },
-        h('h2', { id: 'bk' }, 'Backup & restore'),
+        h('h3', { id: 'bk' }, 'Backup & restore'),
-        h('p', { class: 'lead' }, 'A backup is a copy of config.json with server key, peers, tokens and settings. Keep it safe: it contains the server\'s private key.'),
+        h('p', { class: 'lead' }, 'A backup is a copy of config.json with server key, peers, tokens and settings. Keep it safe: it contains the server\'s private key, preshared keys and authenticator app secrets.'),
         h('div', { class: 'actions' },
           h('a', { class: 'btn', href: '/api/v1/backup' }, 'Download backup'),
           h('button', { type: 'button', class: 'btn', onClick: () => restoreInput.click() }, 'Restore from file…'),
-          restoreInput)));
+          restoreInput),
-    await drawLogs();
+        copies));
+    drawCopies();
+    const jumpTo = location.hash.split('#')[2];
+    if (jumpTo) document.getElementById(jumpTo)?.scrollIntoView();
   }
 
+
   render();
 })();

auth.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/netip"
 	"strings"
 	"sync"
 	"time"
@@ -26,12 +27,23 @@ const (
 	argonKeyLen  = 32
 )
 
+// Every argon2 run takes argonMemory (64 MiB). argonSlots caps how many run
+// at once, so a burst of sign-ins cannot run the server out of memory: two
+// slots are 128 MiB at most.
+var argonSlots = make(chan struct{}, 2)
+
+func argonKey(pw, salt []byte, t, m uint32, p uint8, n uint32) []byte {
+	argonSlots <- struct{}{}
+	defer func() { <-argonSlots }()
+	return argon2.IDKey(pw, salt, t, m, p, n)
+}
+
 func hashPassword(pw string) (string, error) {
 	salt := make([]byte, 16)
 	if _, err := rand.Read(salt); err != nil {
 		return "", err
 	}
-	key := argon2.IDKey([]byte(pw), salt, argonTime, argonMemory, argonThreads, argonKeyLen)
+	key := argonKey([]byte(pw), salt, argonTime, argonMemory, argonThreads, argonKeyLen)
 	b64 := base64.RawStdEncoding
 	return fmt.Sprintf("$argon2id$v=%d$m=%d,t=%d,p=%d$%s$%s",
 		argon2.Version, argonMemory, argonTime, argonThreads, b64.EncodeToString(salt), b64.EncodeToString(key)), nil
@@ -54,7 +66,7 @@ func verifyPassword(encoded, pw string) bool {
 	if err1 != nil || err2 != nil {
 		return false
 	}
-	got := argon2.IDKey([]byte(pw), salt, t, m, p, uint32(len(want)))
+	got := argonKey([]byte(pw), salt, t, m, p, uint32(len(want)))
 	return subtle.ConstantTimeCompare(got, want) == 1
 }
 
@@ -139,14 +151,18 @@ type Auth struct {
 	mu       sync.Mutex
 	sessions map[string]*session
 	used     map[string]tokenUse
-	logins   map[string]tokenUse // last sign-in per user ID
+	logins   map[string]tokenUse   // last sign-in per user ID
-	fails    map[string]*failState
+	fails    map[string]*failState // by lockKey
+	waiting  int                   // sign-ins waiting for or running a password check
 	mfa      mfaState
 }
 
 const (
 	maxFailures = 5
 	lockoutTime = 15 * time.Minute
+	// maxWaiting sign-ins may wait for a password check; more are turned
+	// away until the queue is shorter.
+	maxWaiting = 16
 )
 
 func newAuth(s *Store) *Auth {
@@ -155,23 +171,51 @@ func newAuth(s *Store) *Auth {
 
 func cookieName() string { return appName + "_session" }
 
-var errLocked = errors.New("too many failed attempts, try again later")
+var (
+	errLocked = errors.New("too many failed attempts, try again later")
+	errBusy   = errors.New("too many sign-ins at once, try again in a moment")
+)
+
+// lockKey is what failed sign-ins are counted by: the IPv4 address, or the
+// /64 network of an IPv6 address, since one device can pick any address in
+// its /64.
+func lockKey(ip string) string {
+	a, err := netip.ParseAddr(ip)
+	if err != nil || a.Unmap().Is4() {
+		return ip
+	}
+	p, _ := a.Prefix(64)
+	return p.String()
+}
 
 // Login checks the credentials and returns a new session id, or, for a user
 // with two-step sign-in, a ticket for the second step.
 func (a *Auth) Login(user, pw, ip string) (sessionID, ticket string, err error) {
-	a.mu.Lock()
-	f := a.fails[ip]
-	if f != nil && time.Now().Before(f.until) {
-		a.mu.Unlock()
-		return "", "", errLocked
-	}
-	a.mu.Unlock()
-
 	cfg := a.store.Get()
 	if !cfg.passwordSet() {
 		return "", "", errors.New("no password is set; run: " + appName + " passwd")
 	}
+	// The attempt counts as failed before the password is checked, so
+	// parallel attempts cannot get past the lockout; a right password takes
+	// it back.
+	a.mu.Lock()
+	if a.lockedLocked(ip) {
+		a.mu.Unlock()
+		return "", "", errLocked
+	}
+	if a.waiting >= maxWaiting {
+		a.mu.Unlock()
+		return "", "", errBusy
+	}
+	a.waiting++
+	undo := a.failLocked(ip)
+	a.mu.Unlock()
+	defer func() {
+		a.mu.Lock()
+		a.waiting--
+		a.mu.Unlock()
+	}()
+
 	// An unknown username costs as much time as a wrong password, so the
 	// answer time does not tell which usernames exist.
 	u := cfg.userByName(strings.TrimSpace(user))
@@ -185,21 +229,13 @@ func (a *Auth) Login(user, pw, ip string) (sessionID, ticket string, err error)
 	a.mu.Lock()
 	defer a.mu.Unlock()
 	if !okUser || !okPw {
-		if f == nil {
-			f = &failState{}
-			a.fails[ip] = f
-		}
-		f.count++
-		if f.count >= maxFailures {
-			f.count = 0
-			f.until = time.Now().Add(lockoutTime)
-		}
 		return "", "", errors.New("wrong username or password")
 	}
+	undo()
 	if u.hasMFA() {
 		return "", a.newTicketLocked(u, ip), nil
 	}
-	delete(a.fails, ip)
+	delete(a.fails, lockKey(ip))
 	a.logins[u.ID] = tokenUse{At: time.Now(), IP: ip}
 	return a.newSessionLocked(cfg, u, sessionInfo{Started: time.Now(), IP: ip}), "", nil
 }
@@ -321,9 +357,9 @@ func (a *Auth) sweep() {
 			delete(a.sessions, id)
 		}
 	}
-	for ip, f := range a.fails {
+	for key, f := range a.fails {
 		if now.After(f.until) && f.count == 0 {
-			delete(a.fails, ip)
+			delete(a.fails, key)
 		}
 	}
 	for id, t := range a.mfa.tickets {

config.go

@@ -27,15 +27,24 @@ type Config struct {
 	APITokens []APIToken `json:"apiTokens"`
 	// Admin is the single account of config version 1; applyDefaults moves
 	// it into Users.
-	Admin  *Admin       `json:"admin,omitempty"`
+	Admin   *Admin        `json:"admin,omitempty"`
-	Server Server       `json:"server"`
+	Server  Server        `json:"server"`
-	Peers  []Peer       `json:"peers"`
+	Peers   []Peer        `json:"peers"`
-	Log    LogConfig    `json:"log"`
+	Log     LogConfig     `json:"log"`
-	Stats  StatsConfig  `json:"stats"`
+	Stats   StatsConfig   `json:"stats"`
-	Decoy  DecoyConfig  `json:"decoy"`
+	Decoy   DecoyConfig   `json:"decoy"`
-	SignIn SignInConfig `json:"signin"`
+	SignIn  SignInConfig  `json:"signin"`
+	Updates UpdatesConfig `json:"updates"`
 }
 
+// UpdatesConfig sets the daily check for a newer release.
+type UpdatesConfig struct {
+	Check  *bool  `json:"check,omitempty"` // default on
+	Source string `json:"source"`          // gitea | github, see updateSources
+}
+
+func (c UpdatesConfig) checkEnabled() bool { return c.Check == nil || *c.Check }
+
 // SignInConfig holds the rules for signing in to the web interface.
 type SignInConfig struct {
 	// RequireMFA sends users without two-step sign-in to set it up before
@@ -246,6 +255,9 @@ func (c *Config) applyDefaults() {
 	if c.Decoy.Page == "" {
 		c.Decoy.Page = "nginx"
 	}
+	if c.Updates.Source == "" {
+		c.Updates.Source = "gitea"
+	}
 	if c.APITokens == nil {
 		c.APITokens = []APIToken{}
 	}
@@ -382,6 +394,9 @@ func (c *Config) validate() error {
 	if _, ok := decoyPages[c.Decoy.Page]; !ok {
 		return fmt.Errorf("unknown decoy page %q", c.Decoy.Page)
 	}
+	if _, ok := updateSources[c.Updates.Source]; !ok {
+		return fmt.Errorf("update source must be gitea or github")
+	}
 	switch c.Web.TLS.Mode {
 	case "acme":
 		if c.Web.TLS.Domain == "" {

kernel_other.go

@@ -5,8 +5,10 @@ package main
 import (
 	"fmt"
 	"log/slog"
+	"maps"
 	"math/rand/v2"
 	"net/netip"
+	"slices"
 	"sync"
 	"time"
 )
@@ -17,6 +19,7 @@ import (
 type simKernel struct {
 	mu    sync.Mutex
 	peers map[string]*PeerSample
+	last  time.Time // previous Sample; traffic grows with the time since
 }
 
 func newKernel() (Kernel, error) {
@@ -53,17 +56,23 @@ func (k *simKernel) Apply(c *Config) error {
 func (k *simKernel) Sample(string) ([]PeerSample, error) {
 	k.mu.Lock()
 	defer k.mu.Unlock()
+	now := time.Now()
+	f := 1.0
+	if !k.last.IsZero() {
+		f = now.Sub(k.last).Seconds() / 30
+	}
+	k.last = now
 	var out []PeerSample
-	i := 0
+	for i, key := range slices.Sorted(maps.Keys(k.peers)) {
-	for _, p := range k.peers {
+		p := k.peers[key]
-		// Every third peer stays idle; the others move some data.
+		// Every third peer stays idle; the others move some data, scaled to
+		// the time since the previous sample.
 		if i%3 != 2 {
-			p.TxBytes += rand.Int64N(40 << 20)
+			p.TxBytes += int64(float64(rand.Int64N(40<<20)) * f)
-			p.RxBytes += rand.Int64N(6 << 20)
+			p.RxBytes += int64(float64(rand.Int64N(6<<20)) * f)
-			p.LastHandshake = time.Now().Add(-time.Duration(rand.IntN(90)) * time.Second)
+			p.LastHandshake = now.Add(-time.Duration(rand.IntN(90)) * time.Second)
 		}
 		out = append(out, *p)
-		i++
 	}
 	return out, nil
 }

main.go

@@ -219,18 +219,21 @@ func run(configPath string) error {
 	var stopOnce sync.Once
 	shutdown := func() { stopOnce.Do(func() { close(stop) }) }
 
+	speeds := newSpeeds(store, kernel)
 	auth := newAuth(store)
 	app := &App{
-		store: store, kernel: kernel, recon: recon, stats: stats, auth: auth, tls: webTLS,
+		store: store, kernel: kernel, recon: recon, stats: stats, speeds: speeds, auth: auth, tls: webTLS,
-		logPath: logPath, logw: logw, geo: geo, started: time.Now(), shutdown: shutdown,
+		logPath: logPath, logw: logw, geo: geo, updates: newUpdater(cfg.Updates), started: time.Now(), shutdown: shutdown,
 	}
 
 	var wg sync.WaitGroup
-	wg.Add(4)
+	wg.Add(6)
 	go func() { defer wg.Done(); recon.Run(stop) }()
 	go func() { defer wg.Done(); stats.Run(stop) }()
+	go func() { defer wg.Done(); speeds.Run(stop) }()
 	go func() { defer wg.Done(); stats.RunPings(stop) }()
 	go func() { defer wg.Done(); geo.Run(stop) }()
+	go func() { defer wg.Done(); app.updates.Run(stop) }()
 	go func() {
 		t := time.NewTicker(10 * time.Minute)
 		defer t.Stop()

main_test.go

@@ -14,6 +14,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 )
@@ -77,6 +78,7 @@ func TestValidate(t *testing.T) {
 		"bad dns":         func(c *Config) { c.Peers[0].DNS = []string{"dns.example"} },
 		"bad port":        func(c *Config) { c.Server.ListenPort = 70000 },
 		"unmasked net":    func(c *Config) { c.Server.IPv4 = "10.84.12.5/24" },
+		"update source":   func(c *Config) { c.Updates.Source = "sourceforge" },
 	} {
 		cc := c.clone()
 		mutate(cc)
@@ -312,8 +314,13 @@ func TestAPI(t *testing.T) {
 	secret := tok["token"].(string)
 
 	// Read-only token: GET works, changes are refused, admin endpoints too.
-	bearer := func(method, path string, want int) {
+	bearer := func(method, path string, want int, body ...any) {
-		req, _ := http.NewRequest(method, srv.URL+"/api/v1"+path, nil)
+		var rd io.Reader
+		if len(body) > 0 {
+			b, _ := json.Marshal(body[0])
+			rd = bytes.NewReader(b)
+		}
+		req, _ := http.NewRequest(method, srv.URL+"/api/v1"+path, rd)
 		req.Header.Set("Authorization", "Bearer "+secret)
 		resp, err := http.DefaultClient.Do(req)
 		if err != nil {
@@ -329,11 +336,45 @@ func TestAPI(t *testing.T) {
 	bearer("GET", "/tokens", 403)
 	bearer("GET", "/peers/"+id+"/setup", 403) // the link would set up a device
 
-	// A full-access token manages users and tokens, but not backups.
+	// A full-access token changes settings, but users, passwords, tokens,
+	// the sign-in rules and backups need a signed-in user.
 	secret = call("POST", "/tokens", map[string]string{"name": "full", "scope": "rw"}, 201)["token"].(string)
-	bearer("GET", "/users", 200)
+	uid := call("GET", "/auth/me", nil, 200)["id"].(string)
-	bearer("GET", "/tokens", 200)
+	bearer("PATCH", "/settings", 200, map[string]any{"log": store.Get().Log})
+	bearer("PATCH", "/settings", 403, map[string]any{"signin": map[string]bool{"requireMfa": false}})
+	bearer("GET", "/users", 403)
+	bearer("POST", "/users", 403, map[string]any{"username": "eve", "password": "correct horse battery"})
+	bearer("POST", "/users/"+uid+"/reset-password", 403, map[string]any{"password": "correct horse battery"})
+	bearer("POST", "/users/"+uid+"/reset-mfa", 403)
+	bearer("POST", "/auth/password", 403, map[string]string{"current": "x", "new": "y"})
+	bearer("GET", "/tokens", 403)
+	bearer("POST", "/tokens", 403, map[string]string{"name": "more", "scope": "rw"})
+	bearer("DELETE", "/tokens/"+tok["id"].(string), 403)
 	bearer("GET", "/backup", 403)
+	bearer("GET", "/update-backups", 403)
+	bearer("DELETE", "/update-backups", 403)
+
+	// Config copies made by update: listed newest first, removed one by
+	// one or all at once; nothing else in the folder can be removed.
+	for i, v := range []string{"v0.3.2", "v0.4.0"} {
+		f := filepath.Join(dir, "config.json.bak-"+v)
+		_ = os.WriteFile(f, []byte("{}"), 0o600)
+		_ = os.Chtimes(f, time.Now(), time.Now().Add(time.Duration(i-2)*time.Hour))
+	}
+	list := call("GET", "/update-backups", nil, 200)["backups"].([]any)
+	if len(list) != 2 || list[0].(map[string]any)["version"] != "v0.4.0" {
+		t.Fatalf("update backups: %v", list)
+	}
+	call("DELETE", "/update-backups/config.json", nil, 400)
+	call("DELETE", "/update-backups/stats.json", nil, 400)
+	call("DELETE", "/update-backups/config.json.bak-v9.9.9", nil, 400)
+	call("DELETE", "/update-backups/config.json.bak-v0.3.2", nil, 200)
+	if r := call("DELETE", "/update-backups", nil, 200); r["removed"] != float64(1) {
+		t.Fatalf("remove all: %v", r)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "config.json")); err != nil {
+		t.Fatal("config.json is gone:", err)
+	}
 
 	call("DELETE", "/peers/"+id, nil, 200)
 	if len(store.Get().Peers) != 0 {
@@ -409,6 +450,60 @@ func TestSysctlConf(t *testing.T) {
 	}
 }
 
+func TestLoginLockout(t *testing.T) {
+	store, err := openStore(filepath.Join(t.TempDir(), "config.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	hash, _ := hashPassword("a long test password")
+	_ = store.Update(func(c *Config) error { c.Users[0].PasswordHash = hash; return nil })
+	a := newAuth(store)
+	const right, wrong = "a long test password", "a wrong password"
+
+	// Ten wrong attempts at once from one /64: five are checked, the others
+	// are locked out before any password check.
+	var wg sync.WaitGroup
+	var mu sync.Mutex
+	got := map[string]int{}
+	for i := range 10 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, _, err := a.Login("admin", wrong, fmt.Sprintf("2001:db8::%x", i+1))
+			mu.Lock()
+			got[err.Error()]++
+			mu.Unlock()
+		}()
+	}
+	wg.Wait()
+	if got["wrong username or password"] != 5 || got[errLocked.Error()] != 5 {
+		t.Fatalf("parallel attempts: %v", got)
+	}
+	if _, _, err := a.Login("admin", right, "2001:db8::ffff"); !errors.Is(err, errLocked) {
+		t.Fatalf("same /64: %v, want locked", err)
+	}
+	if _, _, err := a.Login("admin", right, "2001:db8:0:1::1"); err != nil {
+		t.Fatalf("other /64: %v", err)
+	}
+
+	// A right password takes its own attempt back. With two-step sign-in
+	// the earlier failures stay, so wrong codes still lead to the lockout.
+	_ = store.Update(func(c *Config) error { c.Users[0].MFA = &UserMFA{TOTPSecret: newTOTPSecret()}; return nil })
+	ip := "192.0.2.7"
+	for range maxFailures - 1 {
+		_, _, _ = a.Login("admin", wrong, ip)
+	}
+	if _, tk, err := a.Login("admin", right, ip); err != nil || tk == "" {
+		t.Fatalf("5th attempt, right password: ticket %q, %v", tk, err)
+	}
+	if _, _, err := a.Login("admin", wrong, ip); err == nil || errors.Is(err, errLocked) {
+		t.Fatalf("6th attempt: %v, want wrong password", err)
+	}
+	if _, _, err := a.Login("admin", right, ip); !errors.Is(err, errLocked) {
+		t.Fatalf("7th attempt: %v, want locked", err)
+	}
+}
+
 func TestWriteIfChanged(t *testing.T) {
 	p := filepath.Join(t.TempDir(), "x.conf")
 	if ch, err := writeIfChanged(p, "a\n", 0o644); !ch || err != nil {
@@ -914,7 +1009,6 @@ func TestUsers(t *testing.T) {
 	if n := len(admin("GET", "/users", nil, 200)["users"].([]any)); n != 2 {
 		t.Fatalf("users: %d, want 2", n)
 	}
-	admin("PATCH", "/settings", map[string]any{"adminUsername": "x"}, 400)
 }
 
 // TestDecoy checks that the decoy hides the web interface but leaves the API
@@ -1125,6 +1219,17 @@ func TestMFA(t *testing.T) {
 	c3("POST", "/auth/login/recovery", map[string]string{"ticket": ticket, "code": codes[0].(string)}, 401)
 	c3("POST", "/auth/login/recovery", map[string]string{"ticket": ticket, "code": codes[1].(string)}, 200)
 
+	// Session length needs no restart; the listen address does.
+	web := store.Get().Web
+	web.SessionHours = 24
+	if r := adm("PATCH", "/settings", map[string]any{"web": web}, 200); r["restartRequired"] != false || store.Get().Web.SessionHours != 24 {
+		t.Fatalf("session length: %v", r)
+	}
+	web.Listen = "127.0.0.1:9443"
+	if r := adm("PATCH", "/settings", map[string]any{"web": web}, 200); r["restartRequired"] != true {
+		t.Fatalf("listen address: %v", r)
+	}
+
 	// Required for everyone: a user without it can only set it up.
 	adm("PATCH", "/settings", map[string]any{"signin": map[string]bool{"requireMfa": true}}, 200)
 	u := adm("POST", "/users", map[string]any{"username": "eve", "password": "eve's password 1", "mustChangePassword": false}, 201)["user"].(map[string]any)
@@ -1181,3 +1286,56 @@ func TestDropSecurityKeys(t *testing.T) {
 		t.Fatal("security key still in config.json")
 	}
 }
+
+func TestSpeeds(t *testing.T) {
+	dir := t.TempDir()
+	store, err := openStore(filepath.Join(dir, "config.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, _ := newPrivateKey()
+	pub := key.PublicKey().String()
+	if err := store.Update(func(c *Config) error {
+		c.Peers = append(c.Peers, Peer{ID: "p1", Name: "phone", IPv4: serverIPv4(netip.MustParsePrefix(c.Server.IPv4)).Next().String(), PublicKey: pub, Enabled: true})
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	k := &fakeKernel{}
+	sp := newSpeeds(store, k)
+	t0 := time.Unix(1_800_000_000, 0)
+	step := func(sec int, rx, tx int64) {
+		k.samples = []PeerSample{{PublicKey: pub, RxBytes: rx, TxBytes: tx}}
+		sp.sample(t0.Add(time.Duration(sec) * time.Second))
+	}
+	_, ch, cancel := sp.Subscribe()
+	defer cancel()
+	step(0, 1000, 1000)
+	if n := len(sp.Since(0)); n != 0 {
+		t.Fatalf("first sample made %d points, want 0", n)
+	}
+	step(2, 1250, 3000) // +250 up, +2000 down in 2 s
+	step(4, 10, 20)     // counter reset: no speed for this step
+	pts := sp.Since(0)
+	if len(pts) != 2 {
+		t.Fatalf("got %d points, want 2", len(pts))
+	}
+	if got, want := pts[0].Peers["p1"], [2]int64{8000, 1000}; got != want {
+		t.Fatalf("speed = %v, want %v (down, up in bit/s)", got, want)
+	}
+	if got := <-ch; got.T != pts[0].T {
+		t.Fatalf("subscriber got step %d, want %d", got.T, pts[0].T)
+	}
+	if _, ok := pts[1].Peers["p1"]; ok {
+		t.Fatal("a counter reset reported a speed")
+	}
+	if got := sp.Since(pts[0].T); len(got) != 1 || got[0].T != pts[1].T {
+		t.Fatalf("Since returned %v", got)
+	}
+	for i := 0; i < speedPoints+5; i++ {
+		step(6+2*i, 0, 0)
+	}
+	if n := len(sp.Since(0)); n != speedPoints {
+		t.Fatalf("kept %d points, want %d", n, speedPoints)
+	}
+}

mfa.go

@@ -236,23 +236,34 @@ func newMFAState() mfaState {
 
 var errBadTicket = errors.New("the sign-in expired; enter your password again")
 
-// failLocked counts a failed attempt from ip toward the lockout. a.mu must
+// failLocked counts a failed attempt from ip toward the lockout and returns
-// be held.
+// a function that takes it back, for an attempt counted before it was
-func (a *Auth) failLocked(ip string) {
+// checked. a.mu must be held, also when calling undo.
-	f := a.fails[ip]
+func (a *Auth) failLocked(ip string) (undo func()) {
+	key := lockKey(ip)
+	f := a.fails[key]
 	if f == nil {
 		f = &failState{}
-		a.fails[ip] = f
+		a.fails[key] = f
 	}
 	f.count++
-	if f.count >= maxFailures {
+	locked := f.count >= maxFailures
+	if locked {
 		f.count = 0
 		f.until = time.Now().Add(lockoutTime)
 	}
+	return func() {
+		switch {
+		case locked:
+			f.count, f.until = maxFailures-1, time.Time{}
+		case f.count > 0:
+			f.count--
+		}
+	}
 }
 
 func (a *Auth) lockedLocked(ip string) bool {
-	f := a.fails[ip]
+	f := a.fails[lockKey(ip)]
 	return f != nil && time.Now().Before(f.until)
 }
 
@@ -302,7 +313,7 @@ func (a *Auth) finishSignIn(u *User, ip string) string {
 	cfg := a.store.Get()
 	a.mu.Lock()
 	defer a.mu.Unlock()
-	delete(a.fails, ip)
+	delete(a.fails, lockKey(ip))
 	a.logins[u.ID] = tokenUse{At: time.Now(), IP: ip}
 	return a.newSessionLocked(cfg, u, sessionInfo{Started: time.Now(), IP: ip})
 }

setup.go

@@ -589,7 +589,7 @@ func cmdUpdate(args []string) error {
 	if err != nil {
 		return err
 	}
-	backup := configFile + ".bak-" + oldVersion
+	backup := newUpdateBackupPath(configFile, oldVersion, time.Now())
 	step("Backing up config to %s", backup)
 	if err := copyFile(configFile, backup, 0o600, uid, gid); err != nil {
 		return err
@@ -627,6 +627,11 @@ func cmdUpdate(args []string) error {
 		}
 		return fmt.Errorf("update failed, %s %s is running again: %w", appName, oldVersion, err)
 	}
+	if n, err := pruneUpdateBackups(configFile, keepUpdateBackups); err != nil {
+		fmt.Fprintln(os.Stderr, "  Could not remove older config backups:", err)
+	} else if n > 0 {
+		step("Removed %d older config backups, kept the newest %d", n, keepUpdateBackups)
+	}
 	fmt.Printf("\nUpdated %s %s → %s.\n", appName, oldVersion, version)
 	return nil
 }

speed.go

@@ -0,0 +1,134 @@
+package main
+
+import (
+	"log/slog"
+	"sync"
+	"time"
+)
+
+// Speeds keeps the last few minutes of each peer's speed in memory for the
+// Live page. It reads the kernel counters every speedStep, apart from the
+// traffic history in Stats, and never writes to disk.
+
+const (
+	speedStep   = 2 * time.Second
+	speedPoints = 60 // 2 minutes
+)
+
+// SpeedPoint is one step: per peer ID, download and upload in bits per
+// second, from the peer's point of view.
+type SpeedPoint struct {
+	T     int64               `json:"t"`
+	Peers map[string][2]int64 `json:"peers"`
+}
+
+type Speeds struct {
+	store  *Store
+	kernel Kernel
+
+	mu     sync.Mutex
+	last   map[string][2]int64 // raw rx, tx by public key
+	lastAt time.Time
+	points []SpeedPoint
+	subs   map[chan SpeedPoint]struct{}
+	done   chan struct{} // closed when Run returns
+}
+
+func newSpeeds(store *Store, kernel Kernel) *Speeds {
+	return &Speeds{store: store, kernel: kernel, last: map[string][2]int64{}, subs: map[chan SpeedPoint]struct{}{}, done: make(chan struct{})}
+}
+
+// Subscribe returns the current points and a channel that receives each new
+// one; cancel ends the subscription. A subscriber that falls behind misses
+// points rather than holding up the sampler.
+func (s *Speeds) Subscribe() (points []SpeedPoint, ch <-chan SpeedPoint, cancel func()) {
+	c := make(chan SpeedPoint, 4)
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.subs[c] = struct{}{}
+	return append([]SpeedPoint{}, s.points...), c, func() {
+		s.mu.Lock()
+		delete(s.subs, c)
+		s.mu.Unlock()
+	}
+}
+
+// Done is closed when the sampler stops, so streams can end.
+func (s *Speeds) Done() <-chan struct{} { return s.done }
+
+func (s *Speeds) sample(now time.Time) {
+	cfg := s.store.Get()
+	samples, err := s.kernel.Sample(cfg.Server.Interface)
+	if err != nil {
+		slog.Debug("speed sample failed", "err", err)
+		return
+	}
+	idByKey := map[string]string{}
+	for _, p := range cfg.Peers {
+		if p.hasKey() {
+			idByKey[p.PublicKey] = p.ID
+		}
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	secs := now.Sub(s.lastAt).Seconds()
+	first := s.lastAt.IsZero()
+	cur := map[string][2]int64{}
+	pt := SpeedPoint{T: now.Unix(), Peers: map[string][2]int64{}}
+	for _, smp := range samples {
+		cur[smp.PublicKey] = [2]int64{smp.RxBytes, smp.TxBytes}
+		id := idByKey[smp.PublicKey]
+		prev, ok := s.last[smp.PublicKey]
+		if id == "" || !ok || first {
+			continue
+		}
+		dRx, dTx := smp.RxBytes-prev[0], smp.TxBytes-prev[1]
+		if dRx < 0 || dTx < 0 { // counters were reset
+			continue
+		}
+		// Tx is what the server sent: the peer's download.
+		pt.Peers[id] = [2]int64{int64(float64(dTx*8) / secs), int64(float64(dRx*8) / secs)}
+	}
+	s.last, s.lastAt = cur, now
+	if first {
+		return
+	}
+	s.points = append(s.points, pt)
+	if len(s.points) > speedPoints {
+		s.points = s.points[len(s.points)-speedPoints:]
+	}
+	for c := range s.subs {
+		select {
+		case c <- pt:
+		default:
+		}
+	}
+}
+
+// Since returns the points newer than the unix time t, oldest first.
+func (s *Speeds) Since(t int64) []SpeedPoint {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	out := []SpeedPoint{}
+	for _, p := range s.points {
+		if p.T > t {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func (s *Speeds) Run(stop <-chan struct{}) {
+	defer close(s.done)
+	s.sample(time.Now())
+	t := time.NewTicker(speedStep)
+	defer t.Stop()
+	for {
+		select {
+		case <-stop:
+			return
+		case now := <-t.C:
+			s.sample(now)
+		}
+	}
+}

update.go

@@ -0,0 +1,224 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"runtime"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+)
+
+// The update check asks one of the two places releases are published for
+// the latest one. Both carry the same tags and files.
+var updateSources = map[string]struct {
+	Name string // shown in the web interface
+	API  string // latest release, as JSON
+	Repo string // web page of the repository; downloads are under it
+}{
+	"gitea":  {"Gitea", "https://git.redetzke.aero/api/v1/repos/Redetzke/GHOSTWIRE/releases/latest", "https://git.redetzke.aero/Redetzke/GHOSTWIRE"},
+	"github": {"GitHub", "https://api.github.com/repos/danielredetzke/GHOSTWIRE/releases/latest", "https://github.com/danielredetzke/GHOSTWIRE"},
+}
+
+const updateCheckFreq = 24 * time.Hour
+
+// Release is the latest published release as the source reports it.
+type Release struct {
+	Version   string    `json:"version"` // tag, e.g. "v0.4.0"
+	Published time.Time `json:"published"`
+	Notes     string    `json:"notes"` // Markdown
+	URL       string    `json:"url"`   // release page
+}
+
+// UpdateStatus is shown in the settings; Available also reaches the sidebar
+// and the Dashboard through /auth/me.
+type UpdateStatus struct {
+	Enabled   bool       `json:"enabled"`
+	Source    string     `json:"source"`
+	Current   string     `json:"current"`
+	Latest    *Release   `json:"latest"`
+	Available bool       `json:"available"` // Latest is newer than Current
+	Checked   *time.Time `json:"checked"`   // last attempt
+	Error     string     `json:"error,omitempty"`
+	LastOK    *time.Time `json:"lastOk"` // last attempt that worked
+	// Download links for this server's platform; empty when no release
+	// file is built for it.
+	Arch      string `json:"arch"`
+	File      string `json:"file,omitempty"`
+	FileURL   string `json:"fileUrl,omitempty"`
+	SumsURL   string `json:"sumsUrl,omitempty"`
+	SourceURL string `json:"sourceUrl"` // repository page of the source
+}
+
+type Updater struct {
+	enabled atomic.Bool
+	kick    chan struct{}
+	fetch   func(ctx context.Context, url string) (*Release, error) // replaced in tests
+
+	mu      sync.Mutex
+	source  string
+	latest  *Release
+	checked *time.Time
+	lastOK  *time.Time
+	err     string
+}
+
+func newUpdater(c UpdatesConfig) *Updater {
+	u := &Updater{kick: make(chan struct{}, 1), fetch: fetchRelease, source: c.Source}
+	u.enabled.Store(c.checkEnabled())
+	return u
+}
+
+// Set applies the settings. A new source or switching the check on checks
+// at once; switching it off forgets what the last check found.
+func (u *Updater) Set(c UpdatesConfig) {
+	if u == nil {
+		return
+	}
+	on := c.checkEnabled()
+	u.mu.Lock()
+	changed := u.source != c.Source || u.enabled.Load() != on
+	if u.source != c.Source || !on {
+		u.latest, u.checked, u.lastOK, u.err = nil, nil, nil, ""
+	}
+	u.source = c.Source
+	u.enabled.Store(on)
+	u.mu.Unlock()
+	if changed && on {
+		select {
+		case u.kick <- struct{}{}:
+		default:
+		}
+	}
+}
+
+// Run checks once a day while the check is on.
+func (u *Updater) Run(stop <-chan struct{}) {
+	t := time.NewTicker(updateCheckFreq)
+	defer t.Stop()
+	for {
+		if u.enabled.Load() {
+			u.Check(context.Background())
+		}
+		select {
+		case <-stop:
+			return
+		case <-t.C:
+		case <-u.kick:
+		}
+	}
+}
+
+// Check asks the source for the latest release now.
+func (u *Updater) Check(ctx context.Context) {
+	u.mu.Lock()
+	source := u.source
+	u.mu.Unlock()
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	rel, err := u.fetch(ctx, updateSources[source].API)
+	now := time.Now()
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	if u.source != source { // the source changed meanwhile; that check counts
+		return
+	}
+	u.checked = &now
+	if err != nil {
+		u.err = err.Error()
+		slog.Warn("update check failed", "source", source, "err", err)
+		return
+	}
+	u.latest, u.lastOK, u.err = rel, &now, ""
+	if newerVersion(rel.Version, version) {
+		slog.Info("update available", "version", rel.Version, "running", version)
+	}
+}
+
+func (u *Updater) Status() UpdateStatus {
+	if u == nil {
+		return UpdateStatus{Current: version}
+	}
+	u.mu.Lock()
+	defer u.mu.Unlock()
+	src := updateSources[u.source]
+	st := UpdateStatus{
+		Enabled: u.enabled.Load(), Source: u.source, Current: version, Latest: u.latest,
+		Checked: u.checked, Error: u.err, LastOK: u.lastOK, Arch: releaseArch(), SourceURL: src.Repo,
+	}
+	if u.latest != nil {
+		st.Available = newerVersion(u.latest.Version, version)
+		if st.Arch != "" {
+			st.File = fmt.Sprintf("%s-%s-linux-%s", appName, u.latest.Version, st.Arch)
+			base := src.Repo + "/releases/download/" + u.latest.Version + "/"
+			st.FileURL, st.SumsURL = base+st.File, base+"SHA256SUMS"
+		}
+	}
+	return st
+}
+
+// Available returns the newer release's version, or "".
+func (u *Updater) Available() string {
+	if st := u.Status(); st.Enabled && st.Available {
+		return st.Latest.Version
+	}
+	return ""
+}
+
+// releaseArch names this platform the way the release files do, or "" when
+// no file is built for it.
+func releaseArch() string {
+	if runtime.GOOS != "linux" {
+		return ""
+	}
+	switch runtime.GOARCH {
+	case "amd64", "arm64":
+		return runtime.GOARCH
+	case "arm":
+		return "armv7"
+	}
+	return ""
+}
+
+func fetchRelease(ctx context.Context, url string) (*Release, error) {
+	req, _ := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("User-Agent", appName+"/"+strings.TrimPrefix(version, "v"))
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d from %s", resp.StatusCode, req.URL.Host)
+	}
+	// GitHub and Gitea name these fields the same.
+	var r struct {
+		Tag        string    `json:"tag_name"`
+		Body       string    `json:"body"`
+		Published  time.Time `json:"published_at"`
+		URL        string    `json:"html_url"`
+		Draft      bool      `json:"draft"`
+		Prerelease bool      `json:"prerelease"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(&r); err != nil {
+		return nil, fmt.Errorf("unreadable answer from %s: %w", req.URL.Host, err)
+	}
+	if _, ok := compareVersions(r.Tag, r.Tag); r.Draft || r.Prerelease || !ok {
+		return nil, errors.New("the latest release is not a published version")
+	}
+	return &Release{Version: r.Tag, Published: r.Published, Notes: r.Body, URL: r.URL}, nil
+}
+
+// newerVersion reports whether latest is a higher version than running.
+// A running version that is not a version number is never out of date.
+func newerVersion(latest, running string) bool {
+	c, ok := compareVersions(latest, running)
+	return ok && c > 0
+}

update_test.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestNewerVersion(t *testing.T) {
+	for _, tc := range []struct {
+		latest, running string
+		want            bool
+	}{
+		{"v0.4.0", "v0.3.2", true},
+		{"v0.4.0", "0.3.2", true},
+		{"v0.10.0", "v0.9.9", true},
+		{"v1.0.0", "v0.99.0", true},
+		{"v0.4.0", "v0.4.0", false},
+		{"v0.4.0", "v0.4.0-3-gb18d16a", false}, // a build after the release
+		{"v0.3.2", "v0.4.0", false},
+		{"v0.4.0", "dev", false}, // not a version: never out of date
+		{"latest", "v0.3.2", false},
+	} {
+		if got := newerVersion(tc.latest, tc.running); got != tc.want {
+			t.Errorf("newerVersion(%q, %q) = %v, want %v", tc.latest, tc.running, got, tc.want)
+		}
+	}
+}
+
+func TestFetchRelease(t *testing.T) {
+	var body string
+	var status int
+	var ua string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ua = r.Header.Get("User-Agent")
+		w.WriteHeader(status)
+		_, _ = w.Write([]byte(body))
+	}))
+	defer srv.Close()
+
+	status, body = 200, `{"tag_name":"v0.4.0","body":"Fixes.","published_at":"2026-10-05T06:15:28Z","html_url":"https://example.net/r/v0.4.0","draft":false,"prerelease":false}`
+	r, err := fetchRelease(context.Background(), srv.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if r.Version != "v0.4.0" || r.Notes != "Fixes." || r.URL != "https://example.net/r/v0.4.0" || r.Published.IsZero() {
+		t.Fatalf("release = %+v", r)
+	}
+	if !strings.HasPrefix(ua, appName+"/") {
+		t.Errorf("User-Agent = %q", ua)
+	}
+
+	status, body = 200, `{"tag_name":"v0.5.0-rc1","prerelease":true}`
+	if _, err := fetchRelease(context.Background(), srv.URL); err == nil {
+		t.Error("a pre-release was accepted")
+	}
+	status, body = 404, `{}`
+	if _, err := fetchRelease(context.Background(), srv.URL); err == nil || !strings.Contains(err.Error(), "404") {
+		t.Errorf("HTTP 404: err = %v", err)
+	}
+}
+
+func TestUpdater(t *testing.T) {
+	old := version
+	version = "v0.3.2"
+	defer func() { version = old }()
+
+	u := newUpdater(UpdatesConfig{Source: "gitea"})
+	var asked string
+	u.fetch = func(_ context.Context, url string) (*Release, error) {
+		asked = url
+		return &Release{Version: "v0.4.0"}, nil
+	}
+	u.Check(context.Background())
+	if asked != updateSources["gitea"].API {
+		t.Errorf("asked %q", asked)
+	}
+	st := u.Status()
+	if !st.Available || u.Available() != "v0.4.0" || st.Checked == nil || st.LastOK == nil {
+		t.Fatalf("status = %+v", st)
+	}
+	if st.Arch != "" {
+		want := "https://git.redetzke.aero/Redetzke/GHOSTWIRE/releases/download/v0.4.0/GHOSTWIRE-v0.4.0-linux-" + st.Arch
+		if st.FileURL != want || !strings.HasSuffix(st.SumsURL, "/v0.4.0/SHA256SUMS") {
+			t.Errorf("downloads = %q, %q", st.FileURL, st.SumsURL)
+		}
+	}
+
+	// A failed check keeps the last good answer and reports the error.
+	u.fetch = func(context.Context, string) (*Release, error) { return nil, errors.New("no route to host") }
+	u.Check(context.Background())
+	if st := u.Status(); st.Error != "no route to host" || st.Latest == nil {
+		t.Errorf("after a failed check: %+v", st)
+	}
+
+	// Another source forgets what the old one said; switching off hides it.
+	u.Set(UpdatesConfig{Source: "github"})
+	if st := u.Status(); st.Latest != nil || st.Error != "" || st.SourceURL != updateSources["github"].Repo {
+		t.Errorf("after changing the source: %+v", st)
+	}
+	off := false
+	u.fetch = func(context.Context, string) (*Release, error) { return &Release{Version: "v0.4.0"}, nil }
+	u.Check(context.Background())
+	u.Set(UpdatesConfig{Source: "github", Check: &off})
+	if u.Available() != "" || u.Status().Enabled {
+		t.Error("still reports an update with the check off")
+	}
+}

updatebackups.go

@@ -0,0 +1,125 @@
+package main
+
+import (
+	"errors"
+	"io/fs"
+	"net/http"
+	"os"
+	"path/filepath"
+	"regexp"
+	"slices"
+	"strings"
+	"time"
+)
+
+// Each update copies config.json to config.json.bak-<old version> next to
+// it, in case the new version must be rolled back. The copies hold the same
+// secrets as a backup, so the web interface lists them and can remove them,
+// and update keeps only the newest few.
+
+const keepUpdateBackups = 3
+
+type UpdateBackup struct {
+	Name     string    `json:"name"`
+	Version  string    `json:"version"`
+	Modified time.Time `json:"modified"`
+	Size     int64     `json:"size"`
+}
+
+// A copy that would overwrite an older one gets the time appended.
+var backupStampRe = regexp.MustCompile(`-\d{8}-\d{4}$`)
+
+func updateBackupPrefix(configPath string) string { return filepath.Base(configPath) + ".bak-" }
+
+// newUpdateBackupPath names the copy update makes of configPath.
+func newUpdateBackupPath(configPath, version string, now time.Time) string {
+	p := configPath + ".bak-" + version
+	if _, err := os.Lstat(p); err == nil {
+		p += now.Format("-20060102-1504")
+	}
+	return p
+}
+
+// listUpdateBackups returns the copies next to configPath, newest first.
+func listUpdateBackups(configPath string) ([]UpdateBackup, error) {
+	entries, err := os.ReadDir(filepath.Dir(configPath))
+	if err != nil {
+		return nil, err
+	}
+	prefix := updateBackupPrefix(configPath)
+	out := []UpdateBackup{}
+	for _, e := range entries {
+		name := e.Name()
+		if !e.Type().IsRegular() || !strings.HasPrefix(name, prefix) || name == prefix {
+			continue
+		}
+		fi, err := e.Info()
+		if err != nil {
+			continue
+		}
+		out = append(out, UpdateBackup{Name: name, Version: backupStampRe.ReplaceAllString(strings.TrimPrefix(name, prefix), ""),
+			Modified: fi.ModTime(), Size: fi.Size()})
+	}
+	slices.SortFunc(out, func(a, b UpdateBackup) int { return b.Modified.Compare(a.Modified) })
+	return out, nil
+}
+
+// removeUpdateBackup deletes one copy; any other name is refused.
+func removeUpdateBackup(configPath, name string) error {
+	prefix := updateBackupPrefix(configPath)
+	path := filepath.Join(filepath.Dir(configPath), name)
+	fi, err := os.Lstat(path)
+	if !strings.HasPrefix(name, prefix) || name == prefix || strings.ContainsAny(name, `/\`) ||
+		errors.Is(err, fs.ErrNotExist) || (err == nil && !fi.Mode().IsRegular()) {
+		return badRequest("no copy named %q", name)
+	}
+	if err != nil {
+		return err
+	}
+	return os.Remove(path)
+}
+
+// pruneUpdateBackups keeps the newest keep copies and deletes the rest.
+func pruneUpdateBackups(configPath string, keep int) (int, error) {
+	list, err := listUpdateBackups(configPath)
+	if err != nil || len(list) <= keep {
+		return 0, err
+	}
+	n := 0
+	for _, b := range list[keep:] {
+		if err := removeUpdateBackup(configPath, b.Name); err != nil {
+			return n, err
+		}
+		n++
+	}
+	return n, nil
+}
+
+func (a *App) listUpdateBackups(w http.ResponseWriter, r *http.Request) {
+	list, err := listUpdateBackups(a.store.path)
+	if err != nil {
+		writeErr(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"backups": list})
+}
+
+func (a *App) removeUpdateBackup(w http.ResponseWriter, r *http.Request) {
+	name := r.PathValue("name")
+	if err := removeUpdateBackup(a.store.path, name); err != nil {
+		writeErr(w, err)
+		return
+	}
+	a.audit(r, "update backup removed", "file", name)
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+func (a *App) removeUpdateBackups(w http.ResponseWriter, r *http.Request) {
+	n, err := pruneUpdateBackups(a.store.path, 0)
+	if err != nil {
+		writeErr(w, err)
+		return
+	}
+	a.audit(r, "update backups removed", "count", n)
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "removed": n})
+}

updatebackups_test.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestUpdateBackups(t *testing.T) {
+	dir := t.TempDir()
+	cfg := filepath.Join(dir, "config.json")
+	_ = os.WriteFile(cfg, []byte("{}"), 0o600)
+	now := time.Date(2026, 10, 5, 12, 9, 0, 0, time.UTC)
+
+	// A second copy of the same version gets the time appended instead of
+	// overwriting the first.
+	first := newUpdateBackupPath(cfg, "unknown", now)
+	if filepath.Base(first) != "config.json.bak-unknown" {
+		t.Fatalf("first copy: %s", first)
+	}
+	_ = os.WriteFile(first, []byte("{}"), 0o600)
+	second := newUpdateBackupPath(cfg, "unknown", now)
+	if filepath.Base(second) != "config.json.bak-unknown-20261005-1209" {
+		t.Fatalf("second copy: %s", second)
+	}
+	_ = os.WriteFile(second, []byte("{}"), 0o600)
+	for i, v := range []string{"v0.2.0", "v0.3.0", "v0.4.0"} {
+		f := filepath.Join(dir, "config.json.bak-"+v)
+		_ = os.WriteFile(f, []byte("{}"), 0o600)
+		_ = os.Chtimes(f, now, now.Add(time.Duration(i+1)*time.Hour))
+	}
+	_ = os.Chtimes(first, now, now.Add(-2*time.Hour))
+	_ = os.Chtimes(second, now, now.Add(-time.Hour))
+	_ = os.Mkdir(filepath.Join(dir, "config.json.bak-dir"), 0o700) // not a file: ignored
+
+	list, err := listUpdateBackups(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got []string
+	for _, b := range list {
+		got = append(got, b.Version)
+	}
+	if strings.Join(got, " ") != "v0.4.0 v0.3.0 v0.2.0 unknown unknown" {
+		t.Fatalf("versions, newest first: %v", got)
+	}
+
+	for _, bad := range []string{"config.json", "config.json.bak-", "config.json.bak-dir", "../config.json.bak-v0.4.0", "config.json.bak-v0.4.0/x"} {
+		if err := removeUpdateBackup(cfg, bad); err == nil {
+			t.Errorf("removed %q", bad)
+		}
+	}
+
+	if n, err := pruneUpdateBackups(cfg, keepUpdateBackups); err != nil || n != 2 {
+		t.Fatalf("prune: %d, %v", n, err)
+	}
+	if list, _ = listUpdateBackups(cfg); len(list) != 3 || list[2].Version != "v0.2.0" {
+		t.Fatalf("after prune: %v", list)
+	}
+	if _, err := os.Stat(cfg); err != nil {
+		t.Fatal("config.json is gone")
+	}
+}