From cfc91e0a424163869c64d30e55d55a53f18a3dbf Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 14:08:32 +0200 Subject: refactor(node): JSON-only control API, Node page absorbs the admin dashboard Remove the node daemon's server-rendered admin UI (GET / and /audit, the _render_* helpers and inline templates) and the `meshbay-node ui` CLI verb. The loopback control API stays; it is now JSON only, ruff-clean, and 453 lines (was 1074). Also drop three never-wired endpoints (/api/config, /api/chat/history, /ws/chat, plus broadcast_chat) and the pointless 18000/tcp firewall profiles. The desktop client's Node page (static/node-page.js) takes over what the dashboard showed, reorganised into six tabs (Overview, Groups, Roster, Peers, Audit, Settings): - Overview: version, node id, QUIC port, hub, index-cache maintenance - Roster: node-wide view with unpin - Peers and Audit: auto-load on open, no Load button - Audit: real usernames and group names (resolved from the roster and node.toml), Previous/Next pagination newest-first, Export CSV of every matching row - Settings: node settings, STUN, ICE, denylist, then Unlink from hub Backend: audit.get_entries gains `offset`; /api/audit and /api/peers resolve ids to names via a new _display_names helper; CSP tightened to default-src 'none' now that no HTML is served. draft-v6 sections 2.11 and 2.12 corrected -- the Node page uses the loopback API, not MNP. One capability is intentionally dropped: browser-based admin on a headless server. The CLI covers every operation there. See docs/refactor-node-ui.md. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01MQCaZnde4Bjjdu84dhSuF5 --- packaging/build/build-node.sh | 11 ++++------- packaging/deb/meshbay-node/DEBIAN/control | 3 ++- packaging/firewall/firewalld/meshbay-node.xml | 6 ------ packaging/firewall/ufw/meshbay | 5 ----- packaging/rpm/meshbay-node.spec | 4 ++-- 5 files changed, 8 insertions(+), 21 deletions(-) delete mode 100644 packaging/firewall/firewalld/meshbay-node.xml (limited to 'packaging') diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh index d8a5af4..9ad4968 100755 --- a/packaging/build/build-node.sh +++ b/packaging/build/build-node.sh @@ -75,13 +75,10 @@ cp "$REPO/packaging/systemd/meshbay-node.service" \ cp "$REPO/packaging/systemd/meshbay-node-user.service" \ "$ROOT/usr/lib/systemd/user/meshbay-node.service" -# --- Firewall profiles ---------------------------------------------------- -# firewalld (Fedora) -mkdir -p "$ROOT/usr/lib/firewalld/services" -cp "$REPO/packaging/firewall/firewalld/meshbay-node.xml" \ - "$ROOT/usr/lib/firewalld/services/" - -# UFW (Ubuntu/Debian) +# --- Firewall profile --------------------------------------------------------- +# UFW (Ubuntu/Debian) — carries the "MeshBay Cast" LAN-casting profile only. +# The node's own admin surface is a loopback API (127.0.0.1, token-gated) and +# is never firewall-exposed, so it ships no profile. mkdir -p "$ROOT/etc/ufw/applications.d" cp "$REPO/packaging/firewall/ufw/meshbay" \ "$ROOT/etc/ufw/applications.d/" diff --git a/packaging/deb/meshbay-node/DEBIAN/control b/packaging/deb/meshbay-node/DEBIAN/control index 0c9d73d..76b2005 100644 --- a/packaging/deb/meshbay-node/DEBIAN/control +++ b/packaging/deb/meshbay-node/DEBIAN/control @@ -10,7 +10,8 @@ Recommends: ffmpeg Description: MeshBay Node — local file host, streaming server, and group daemon MeshBay Node indexes local directories and serves encrypted files to authenticated group members over WebRTC. Includes video streaming (fMP4 - remux via ffmpeg), group chat, and a local admin UI on localhost:18000. + remux via ffmpeg), group chat, and a token-gated loopback control API + on 127.0.0.1:18000 for the CLI and the desktop client. . Installs node code into the shared venv at /opt/meshbay-common/venv/. Ships a default TMDB API token for the Videos app. diff --git a/packaging/firewall/firewalld/meshbay-node.xml b/packaging/firewall/firewalld/meshbay-node.xml deleted file mode 100644 index 3443b54..0000000 --- a/packaging/firewall/firewalld/meshbay-node.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - MeshBay Node - MeshBay Node local administration interface (localhost only by default). - - diff --git a/packaging/firewall/ufw/meshbay b/packaging/firewall/ufw/meshbay index 5a610a5..732e5d8 100644 --- a/packaging/firewall/ufw/meshbay +++ b/packaging/firewall/ufw/meshbay @@ -2,8 +2,3 @@ title=MeshBay Chromecast relay description=HTTP relay for casting decrypted video to LAN devices ports=19550:19553/tcp|5353/udp - -[MeshBay Node] -title=MeshBay Node admin UI -description=Local administration interface (localhost only by default) -ports=18000/tcp diff --git a/packaging/rpm/meshbay-node.spec b/packaging/rpm/meshbay-node.spec index 20d69bc..2bebb26 100644 --- a/packaging/rpm/meshbay-node.spec +++ b/packaging/rpm/meshbay-node.spec @@ -14,7 +14,8 @@ Recommends: ffmpeg %description MeshBay Node indexes local directories and serves encrypted files to authenticated group members over WebRTC. Includes video streaming (fMP4 -remux via ffmpeg), group chat, and a local admin UI on localhost:18000. +remux via ffmpeg), group chat, and a token-gated loopback control API +on 127.0.0.1:18000 for the CLI and the desktop client. Installs node code into the shared venv at /opt/meshbay-common/venv/. Ships a default TMDB API token for the Videos app. @@ -41,7 +42,6 @@ fi /usr/bin/meshbay-node %{_unitdir}/meshbay-node@.service %{_userunitdir}/meshbay-node.service -/usr/lib/firewalld/services/meshbay-node.xml /etc/ufw/applications.d/meshbay %changelog -- cgit v1.2.3