The panel's code moved to git.reudy.net/reudy-net/panel, which provides a
package and a NixOS module. This config now pulls it in as the `panel`
flake input and only sets services.reudy-panel options, so panel updates
are `nix flake update panel` instead of edits in this repo.
The input uses ssh because the reudy-net org is not visible anonymously.
The generated service, directories, Caddy vhost, routes import and reload
units are unchanged apart from store paths.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
Renames every domain in the config: Caddy virtual hosts (auth, hello,
nextcloud, git, panel), the ACME contact email, Authelia's session cookie
domain / portal URL / default redirect and TOTP issuer, Nextcloud's
hostName and overwritehost, and Forgejo's DOMAIN (ROOT_URL and ssh clone
URLs follow from it; the panel picks them up via panel.nix). Panel docs and
examples updated too, and a README paragraph that had run together is
split again.
Requires DNS for auth/hello/nextcloud/git/panel.reudy.net (or a
*.reudy.net wildcard) pointing at the server before deploying.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
Forgejo:
- panel.nix passes the local Forgejo's public, API and ssh URLs (derived
from forgejo.nix) to panel-api.
- Settings dialog: connect a Forgejo access token (verified against
/api/v1/user, stored 0600 in state/panel/forgejo-token).
- New-app dialog gets a Forgejo repository picker with search and a branch
dropdown; private repos are cloned over https with the stored token, or
over ssh with the deploy key when no token is connected. The app name and
domain are filled in from the repository name.
- Commit and compare links in the Source tab point at Forgejo; cards show
the provider ("Forgejo · main").
Git over ssh:
- ssh:// and git@host:owner/repo URLs are accepted; the panel generates an
ed25519 deploy key in state/panel/ssh and uses it for clone/fetch
(BatchMode, accept-new host keys). openssh added to the service path.
- Credential redaction only applies to http(s) URLs, so ssh usernames are
kept; git errors now report the meaningful line instead of git's advice.
Environment variables:
- Stored per app in state/env/<app>.env (0600), outside the repo and stack.
- panelctl passes them to every compose command via env(1), so ${VAR}
interpolation works; by default deploy/restart also generate a compose
override listing the keys under every service's environment (values are
read from compose's environment, never quoted into YAML).
- Environment tab (and a section in the new-app dialog) with .env paste
import, hidden values, validation of names (reserved podman/compose vars
rejected), hints for ${VAR}s the compose file uses but aren't set, and
Save / Save & deploy. Removing an app deletes its variables.
The API still accepts the old source_type "github" / github_* fields.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
Web UI (panel/frontend/index.html) rewritten:
- Cards update in place from a single /status poll instead of being rebuilt
on every action, so open tabs, unsaved compose/route edits, logs and the
file browser position survive refreshes. Polling speeds up while an
operation runs and pauses in background tabs; a header indicator shows
when the panel last synced and detects an expired Authelia session.
- New-app dialog (starter / compose / git), suggested port and domain,
proper confirm dialogs (the old "OK = keep volumes" remove prompt is gone),
toasts, an activity drawer with operation output, overflow menu, search,
status filters, keyboard shortcuts, deep links, dark mode and mobile layout.
- Tabs: overview (containers + routes), compose editor (dirty tracking,
Ctrl+S), logs with follow, validated routes editor, file browser with
drag-and-drop upload, backups, and a git source tab (deployed commit,
check for updates, sync & deploy).
API (panel/panel-api.py):
- ThreadingHTTPServer so a long deploy no longer blocks every other request.
- Per-app operation lock; concurrent writes to a busy app return 409.
- GET /status: all apps, routes and container status in one request
(statuses gathered in parallel); status reports running/partial/stopped.
- Git sync is fetch + hard reset instead of pull-or-reclone, keeps the stored
token, reports before/after commits; GET /apps/<name>/repo[?fetch=1].
- Any http(s) git host (e.g. Forgejo), default branch detection, git
timeouts, no credential prompts, tokens redacted from errors, and manifest
values validated before being written into the bash-sourced manifest.
panelctl:
- flock around routes.caddy rewrites (util-linux added to the service path).
- deploy returns compose output so failures are visible in the UI.
- inspect-volumes no longer fails for apps without named podman volumes,
which broke the file browser.
Docs: README/API.md updated; fixed outdated panelctl init examples.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf
