Deployments, auto deploy, service routes, live logs, metrics and a terminal

Deployments: deploy, restart and git sync now run in the background, one at
a time per app (a newer request replaces a queued one). Each run is recorded
in SQLite with its log, streamed to the UI while it runs, and can be
cancelled. Any earlier deployment can be deployed again, which rolls back to
its commit, or to its saved compose file for compose apps.

Auto deploy: POST /hooks/<app>, verified with the app's secret (Forgejo,
Gitea and GitHub HMAC signatures, or the secret as a token for CI). With a
Forgejo token stored, the panel adds the webhook to the repository itself.
The NixOS module routes /hooks/* past Authelia. Caddy matches the cleaned
path but forwards the original, so the panel refuses dot segments and only
accepts webhook deliveries from that route (tagged with X-Panel-Hook).

Domains: a route can point at a compose service's container port
("web:8080"). The panel picks a free 127.0.0.1 port and panelctl publishes
it through a generated .panel-ports.yaml override, so compose files need no
ports: section. Existing host:port upstreams keep working.

Logs stream live over server-sent events, with service and text filters.
A sampler keeps an hour of CPU and memory per container for the new
Monitoring tab. The Terminal tab opens `podman exec` in a container over a
WebSocket, using xterm.js bundled by the Nix package.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UbWSNkXxZhYf7eqHTyx3Bf

nix/module.nix

@@ -72,6 +72,17 @@ in
       '';
     };
 
+    webhooks = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Let `/hooks/<app>` on the panel's domain through without Authelia, so
+        Forgejo, GitHub or CI can trigger deployments. Every delivery must be
+        signed with (or carry) the app's webhook secret, and the endpoint only
+        answers for apps with auto deploy switched on.
+      '';
+    };
+
     forgejo.enable = lib.mkOption {
       type = lib.types.bool;
       default = config.services.forgejo.enable;
@@ -131,6 +142,10 @@ in
         PANEL_GROUP = cfg.group;
         PANELCTL_PATH = lib.getExe' cfg.package "panelctl";
       }
+      // lib.optionalAttrs (cfg.domain != null) {
+        # Used for the webhook URLs handed to Forgejo / GitHub.
+        PANEL_PUBLIC_URL = "https://${cfg.domain}";
+      }
       // lib.optionalAttrs cfg.forgejo.enable {
         # The API is reached on localhost; clones use the public URLs.
         PANEL_FORGEJO_URL = lib.removeSuffix "/" forgejoServer.ROOT_URL;
@@ -150,14 +165,32 @@ in
 
       virtualHosts = lib.mkIf (cfg.domain != null) {
         ${cfg.domain}.extraConfig =
-          lib.optionalString (cfg.autheliaAddress != null) ''
+          let
+            upstream = "${cfg.listenAddress}:${toString cfg.port}";
+          in
+          lib.optionalString cfg.webhooks ''
+            # Push webhooks authenticate with the app's secret, not a login.
+            # The header tells the panel the request skipped forward_auth, so it
+            # accepts nothing but a webhook delivery from here (Caddy matches the
+            # cleaned path but forwards the original one).
+            handle /hooks/* {
+              reverse_proxy ${upstream} {
+                header_up X-Panel-Hook 1
+              }
+            }
+          ''
+          + ''
+            handle {
+          ''
+          + lib.optionalString (cfg.autheliaAddress != null) ''
             forward_auth ${cfg.autheliaAddress} {
               uri /api/authz/forward-auth
               copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
             }
           ''
           + ''
-            reverse_proxy ${cfg.listenAddress}:${toString cfg.port}
+              reverse_proxy ${upstream}
+            }
           '';
       };
     };

nix/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenvNoCC,
+  fetchurl,
   makeWrapper,
   bash,
   python3,
@@ -37,10 +38,23 @@ let
     util-linux # flock, used to serialise routes file writes
     openssh # cloning repositories over ssh with the panel's deploy key
   ];
+
+  # PyYAML lets the panel suggest services and ports from compose files.
+  python = python3.withPackages (ps: [ ps.pyyaml ]);
+
+  # xterm.js for the web terminal, served by the panel itself (no CDN at runtime).
+  xterm = fetchurl {
+    url = "https://registry.npmjs.org/@xterm/xterm/-/xterm-6.0.0.tgz";
+    hash = "sha512-TQwDdQGtwwDt+2cgKDLn0IRaSxYu1tSUjgKarSDkUM0ZNiSRXFpjxEsvc/Zgc5kq5omJ+V0a8/kIM2WD3sMOYg==";
+  };
+  xtermFit = fetchurl {
+    url = "https://registry.npmjs.org/@xterm/addon-fit/-/addon-fit-0.11.0.tgz";
+    hash = "sha512-jYcgT6xtVYhnhgxh3QgYDnnNMYTcf8ElbxxFzX0IZo+vabQqSPAjC3c1wJrKB5E19VwQei89QCiZZP86DCPF7g==";
+  };
 in
 stdenvNoCC.mkDerivation {
   pname = "reudy-panel";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = lib.fileset.toSource {
     root = ../.;
@@ -63,12 +77,18 @@ stdenvNoCC.mkDerivation {
     install -Dm644 panel-api.py $out/share/panel/panel-api.py
     cp -r frontend $out/share/panel/frontend
 
+    mkdir -p xterm fit $out/share/panel/frontend/vendor
+    tar -xzf ${xterm} -C xterm
+    tar -xzf ${xtermFit} -C fit
+    install -m644 xterm/package/lib/xterm.js xterm/package/css/xterm.css fit/package/lib/addon-fit.js \
+      $out/share/panel/frontend/vendor/
+
     install -Dm755 panelctl.sh $out/bin/panelctl
     patchShebangs --host $out/bin/panelctl
     wrapProgram $out/bin/panelctl \
       --suffix PATH : ${lib.makeBinPath runtimeDeps}
 
-    makeWrapper ${python3.interpreter} $out/bin/panel-api \
+    makeWrapper ${python.interpreter} $out/bin/panel-api \
       --add-flags $out/share/panel/panel-api.py \
       --suffix PATH : ${lib.makeBinPath runtimeDeps} \
       --set-default PANELCTL_PATH $out/bin/panelctl \