mirror of
https://github.com/tugcantopaloglu/openclaw-dashboard.git
synced 2026-08-14 00:47:52 +00:00
docs: v3.0.0 release notes
This commit is contained in:
Tugcan Topaloglu
+126
-101
@@ -1,112 +1,137 @@
|
||||
# OpenClaw Dashboard v3.0.0 - Release Notes
|
||||
|
||||
## 🎨 UI & Theming
|
||||
|
||||
### 🌙 Dark/Light Theme Toggle
|
||||
- One-click toggle button (top-right, next to notification bell)
|
||||
- Comprehensive CSS overrides for all cards, inputs, sidebar, modals
|
||||
- Persistent preference via localStorage
|
||||
- Light theme with clean white cards, subtle shadows, and adjusted text colors
|
||||
|
||||
### 📱 Crash Counter Labels
|
||||
- Crash widget now clearly labeled with "💥 Crashes" header
|
||||
- "today" and "7-day" labels next to values for clarity
|
||||
|
||||
### 📋 Memory Files Collapse
|
||||
- Overview memory files limited to 5 items by default
|
||||
- "Show all (X files) ↓" button expands the full list
|
||||
|
||||
## 🛡️ Security & System
|
||||
|
||||
### 🛡️ System Security Dashboard
|
||||
- New "Sys Security" page in sidebar
|
||||
- 5 panels: UFW rules, open ports, fail2ban status, SSH login logs, OpenClaw audit
|
||||
- **Re-authentication required** — password + TOTP before access
|
||||
- All command outputs HTML-escaped to prevent XSS
|
||||
|
||||
### ⚙️ Config Editor
|
||||
- Edit `openclaw.json` directly from the dashboard
|
||||
- Client-side JSON validation before save
|
||||
- Automatic `.bak.timestamp` backup before overwriting
|
||||
- Gateway restart after save with confirmation dialog
|
||||
- **Re-authentication required**
|
||||
|
||||
### 🔒 Re-authentication Gate
|
||||
- Security, Sys Security, and Config Editor pages require password + TOTP re-verification
|
||||
- One verification per browser session
|
||||
- Uses existing `verifyPassword()` and `verifyTOTP()` functions
|
||||
- Failed attempts logged to audit trail
|
||||
|
||||
## 🐳 Docker Management
|
||||
- New "Docker" page in sidebar
|
||||
- Container list with status indicators (🟢/🔴), image, ports
|
||||
- Start/Stop/Restart buttons per container with confirmation
|
||||
- Image list with repository, tag, and size
|
||||
- `docker system df` overview
|
||||
- Prune stopped containers and unused images
|
||||
- Container ID validation: only `[a-zA-Z0-9_.-]` accepted (injection protection)
|
||||
- Whitelisted actions only: `start`, `stop`, `restart`, `prune-containers`, `prune-images`
|
||||
|
||||
## 🔔 Notification Center
|
||||
- Bell icon opens dropdown panel with recent audit log events
|
||||
- Event types: login, logout, reauth, config changes, docker actions, security views
|
||||
- Icons per event type for quick scanning
|
||||
- Unread badge counter with 30-second polling
|
||||
- Click outside to dismiss panel
|
||||
- Last-seen timestamp persisted in localStorage
|
||||
|
||||
## 📊 System Monitoring
|
||||
|
||||
### Temperature & Disk Sparklines
|
||||
- TEMP and DISK gauges now have mini history graphs (like CPU and RAM)
|
||||
- Health history saves `temp` and `disk` values every 5 minutes
|
||||
- 24-hour data retention (288 snapshots)
|
||||
|
||||
## 🔧 Infrastructure
|
||||
|
||||
### Claude CLI Usage Scraper
|
||||
- `scripts/scrape-claude-usage.sh` and `scripts/parse-claude-usage.py` included in repo
|
||||
- Uses persistent tmux session for fast scraping
|
||||
- Lock file prevents concurrent runs
|
||||
- Fixed: `/usage` command typed fully instead of `/u` + autocomplete (Claude CLI v2.1.69 change)
|
||||
|
||||
### install.sh Updates
|
||||
- Removed token-based auth references (dashboard uses username/password now)
|
||||
- Added `jq` and `tmux` dependency checks
|
||||
- Copies scraper scripts to workspace during install
|
||||
- Updated first-time setup instructions
|
||||
|
||||
### Documentation
|
||||
- README updated with all new features and API endpoints
|
||||
- Optional dependencies table added
|
||||
- "No External Dependencies" updated to "Minimal Dependencies"
|
||||
- 10 new API endpoints documented
|
||||
|
||||
## 🆕 New API Endpoints
|
||||
|
||||
| Endpoint | Method | Description |
|
||||
|----------|--------|-------------|
|
||||
| `/api/reauth` | POST | Re-authenticate for sensitive pages |
|
||||
| `/api/openclaw-config` | GET | Read OpenClaw configuration |
|
||||
| `/api/openclaw-config` | PUT | Save config with backup + restart |
|
||||
| `/api/sys-security` | GET | UFW, ports, fail2ban, SSH logs |
|
||||
| `/api/docker` | GET | Containers, images, system usage |
|
||||
| `/api/docker/action` | POST | Container/image actions |
|
||||
| `/api/services` | GET | List systemd services |
|
||||
| `/api/services/action` | POST | Start/stop/restart services |
|
||||
| `/api/notifications` | GET | Audit log events |
|
||||
|
||||
## ⬆️ Upgrade from v2.x
|
||||
|
||||
1. Pull latest: `git pull origin main`
|
||||
2. Install optional dependencies: `sudo apt install jq tmux`
|
||||
3. Restart service: `systemctl restart agent-dashboard`
|
||||
4. New pages appear automatically in sidebar
|
||||
5. Clear browser cache if theme toggle doesn't appear (`Ctrl+Shift+R`)
|
||||
|
||||
---
|
||||
|
||||
*Previous versions:*
|
||||
- *[v2.0.0 — Authentication & Security Hardening](#v200)*
|
||||
- *[v1.0.0 — Initial Public Release](#v100)*
|
||||
|
||||
---
|
||||
|
||||
# OpenClaw Dashboard v2.0.0 - Release Notes
|
||||
|
||||
## 🔐 Authentication & Security Hardening
|
||||
|
||||
Major security release — the dashboard now requires authentication and includes enterprise-grade security features.
|
||||
|
||||
**Repository:** https://github.com/tugcantopaloglu/openclaw-dashboard
|
||||
### 🆕 New Features
|
||||
|
||||
- 🔑 Username/Password Authentication with PBKDF2 hashing
|
||||
- 🛡️ Multi-Factor Authentication (TOTP)
|
||||
- 🔒 Password Recovery via recovery token
|
||||
- 🌐 HTTPS Enforcement for non-localhost connections
|
||||
- Security headers (HSTS, CSP, X-Frame-Options, etc.)
|
||||
- Rate limiting (5 soft / 20 hard lockout)
|
||||
- Audit logging with auto-rotation
|
||||
|
||||
See git history for full v2.0.0 details.
|
||||
|
||||
---
|
||||
|
||||
## 🆕 New Features
|
||||
|
||||
### 🔑 Username/Password Authentication
|
||||
- First visit shows a registration screen to create your account
|
||||
- Passwords hashed with PBKDF2 (100,000 iterations, SHA-512, random salt)
|
||||
- Server-side session tokens — passwords never stored in browser
|
||||
- "Remember me" option: 3-hour persistent session vs browser-session only
|
||||
- Credentials stored in `data/credentials.json`
|
||||
|
||||
### 🛡️ Multi-Factor Authentication (TOTP)
|
||||
- Optional MFA with any TOTP app (Google Authenticator, Authy, etc.)
|
||||
- QR code scanning for easy setup
|
||||
- 6-digit codes with ±1 window tolerance for clock drift
|
||||
- TOTP verification required before MFA is activated
|
||||
- Enable/disable from the Security page in dashboard
|
||||
|
||||
### 🔒 Password Recovery
|
||||
- "Forgot password?" flow using recovery token (`DASHBOARD_TOKEN` env var)
|
||||
- Change password from Security page (invalidates other sessions)
|
||||
- Complete account reset via SSH if needed
|
||||
|
||||
### 🌐 HTTPS Enforcement
|
||||
- HTTP blocked for non-localhost connections
|
||||
- Localhost access allowed for local development
|
||||
- `DASHBOARD_ALLOW_HTTP=true` env var to override
|
||||
- Works seamlessly with Tailscale HTTPS proxy
|
||||
|
||||
## 🛡️ Security Hardening
|
||||
|
||||
### Critical Fixes
|
||||
- **Timing-safe token comparison** — `crypto.timingSafeEqual` prevents timing attacks
|
||||
- **IP spoofing protection** — only `req.socket.remoteAddress` used (no X-Forwarded-For trust)
|
||||
- **No token leakage** — login response doesn't expose sensitive data
|
||||
|
||||
### Security Headers (all responses)
|
||||
- `Strict-Transport-Security: max-age=31536000; includeSubDomains`
|
||||
- `Content-Security-Policy` with explicit directives
|
||||
- `X-Frame-Options: DENY`
|
||||
- `X-Content-Type-Options: nosniff`
|
||||
- `X-XSS-Protection: 1; mode=block`
|
||||
- `Referrer-Policy: strict-origin-when-cross-origin`
|
||||
|
||||
### Rate Limiting
|
||||
- Unified rate limiter for login attempts only
|
||||
- 5 failed attempts → 15-minute soft lockout
|
||||
- 20 failed attempts → 15-minute hard lockout
|
||||
- Lockout calculated from last failed attempt
|
||||
|
||||
### Other
|
||||
- **CORS** — same-origin only, no wildcard
|
||||
- **OPTIONS preflight** handling (204 response)
|
||||
- **Audit logging** — all auth events and destructive actions logged to `data/audit.log` (auto-rotates at 10MB)
|
||||
- **Atomic log rotation** — uses tmp file + rename
|
||||
- **Scoped tmux kill** — only kills claude-persistent session, not all tmux
|
||||
- **CSP documented** — `unsafe-inline` explained as necessary for single-file architecture
|
||||
|
||||
## 🔧 Infrastructure
|
||||
|
||||
### Reverse Proxy Support
|
||||
- Automatic API base path detection for subpath deployments (e.g., `/dashboard`)
|
||||
- Works with Tailscale serve, nginx, and other reverse proxies
|
||||
|
||||
### Environment Variables
|
||||
|
||||
| Variable | Default | Description |
|
||||
|----------|---------|-------------|
|
||||
| `DASHBOARD_PORT` | `7000` | Server port |
|
||||
| `DASHBOARD_TOKEN` | Auto-generated | Recovery token for password reset |
|
||||
| `WORKSPACE_DIR` | `~/clawd` | OpenClaw workspace path |
|
||||
| `OPENCLAW_DIR` | `~/.openclaw` | OpenClaw config directory |
|
||||
| `DASHBOARD_ALLOW_HTTP` | `false` | Allow HTTP from non-local IPs |
|
||||
|
||||
### install.sh Updates
|
||||
- Token setup during installation (custom or auto-generated)
|
||||
- Token saved to systemd service environment
|
||||
- Displays login instructions after install
|
||||
|
||||
## 📝 Documentation
|
||||
- Comprehensive README with MFA guide, password recovery, and troubleshooting
|
||||
- Security features documented in detail
|
||||
- API reference for authenticated vs unauthenticated endpoints
|
||||
|
||||
## ⬆️ Upgrade from v1.x
|
||||
|
||||
1. Pull latest: `git pull origin main`
|
||||
2. Restart service: `systemctl restart agent-dashboard`
|
||||
3. First visit will show registration screen — create your account
|
||||
4. (Optional) Enable MFA from Security page
|
||||
5. Share recovery token with yourself (check `journalctl -u agent-dashboard`)
|
||||
|
||||
**Breaking changes:**
|
||||
- Authentication is now required for all API endpoints
|
||||
- Old bookmarks to dashboard will show login screen
|
||||
- `DASHBOARD_TOKEN` env var is now used as recovery key (not login token)
|
||||
|
||||
---
|
||||
|
||||
*Previous: [v1.0.0 — Initial Public Release](#v100)*
|
||||
|
||||
# OpenClaw Dashboard v1.0.0
|
||||
|
||||
Initial public release with session management, cost analysis, live feed, memory viewer, system health monitoring, and more. See git history for details.
|
||||
Initial public release with session management, cost analysis, live feed, memory viewer, system health monitoring, and more.
|
||||
|
||||
Reference in New Issue
Block a user