- JavaScript 44%
- Rust 42.8%
- Shell 9.4%
- Awk 1.5%
- Dockerfile 1.5%
- Other 0.8%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
| .cargo | ||
| .forgejo/workflows | ||
| .githooks | ||
| docs | ||
| examples | ||
| scripts | ||
| src | ||
| tests | ||
| web/static/js | ||
| .dockerignore | ||
| .gitignore | ||
| .updatarr.yaml | ||
| AGENTS.md | ||
| build.rs | ||
| Cargo.lock | ||
| Cargo.toml | ||
| CLAUDE.md | ||
| cliff.toml | ||
| config.example.yaml | ||
| deny.toml | ||
| docker-compose.yml | ||
| Dockerfile | ||
| GEMINI.md | ||
| Justfile | ||
| README.md | ||
| rust-toolchain.toml | ||
| RUST_REBUILD.md | ||
Linkus
Rust dashboard for self-hosted services behind Envoy/Authelia. Linkus reads trusted proxy identity headers and filters services, widgets and alerts by user or group on both pages and APIs.
Copy config.example.yaml to config/config.yaml. CONFIG_PATH selects an authoritative file; otherwise Linkus searches /app/config/config.yaml, /config/config.yaml, config/config.yaml, then config.yaml. Restart after changes. Configuration is read-only; probe results live in memory and warm again after restart. The existing YAML schema remains supported, including testHeader for isolated development only.
Services support links and HTTP checks with custom headers, separate check URLs, status and latency. Widgets include a 12/24-hour clock, SABnzbd queue and Sonarr/Radarr calendar with partial-provider warnings. Alerts support ICMP/TCP fallback, JSONPath and text checks. Requests to internal services retain the existing self-signed TLS policy and do not follow redirects. All credentials and backend addresses stay server-side.
The dashboard uses published wuast-ui shell, icons, assets and components. Categories persist in the URL. Sequential snapshot polling supports Web Locks/BroadcastChannel coordination within one identity, revision deduplication, stale data, hidden-tab cancellation and reconnection.
just setup
just run
just gate
just docker-build
# or build and run the scratch image with a read-only configuration mount:
docker compose up -d --build
The pinned Rust toolchain and CI tools come from rust-template. just gate runs format, strict Clippy, real Rust behavior/integration tests, programmatic browser flows, advisories and unused-dependency checks. Linkus uses YAML and in-memory probe results; it has no PostgreSQL or Redis integration and starts no database/cache test services. just coverage measures the same scenarios separately during development and prints missing lines; HTML is explicit via just coverage html. CI stores no reports or screenshots.
Listen address defaults to 0.0.0.0:3000; override HOST/PORT. SHUTDOWN_TIMEOUT_SECS defaults to 10. LOG_LEVEL controls structured Common telemetry. Native -version/--version, -health/--health and --help remain available. Configuration can be checked without contacting upstreams:
cargo run --locked --example validate_config -- config/config.yaml
Endpoints: /, /api/dashboard/snapshot, /api/status?name=…, /api/alerts/status?name=…, /api/plugins/{plugin}/{service}, and legacy GET/HEAD /api/health. Common adds /healthz, /ready, /metrics and /api/v1/status. Missing, unknown and forbidden resources retain relevant HTTP status classes; API failures use Common RFC 9457 Problem Details. Dynamic pages/APIs are never cached. Read APIs never trigger upstream queries.
Readiness waits for every configured probe's first attempt; an unhealthy monitored service is domain data and does not make Linkus itself unavailable. Critical workers are supervised, jobs run serially without catch-up, and cancellation drains/joins workers and HTTP before closing connections. The container is scratch, nonroot, supports a read-only root filesystem, and includes CA roots and Europe/Berlin timezone data.
The proxy must strip client-supplied trusted identity headers and prevent direct public access to Linkus. Remote-User, Remote-Name, Remote-Groups, Remote-Email drive application visibility. Internal X-User-* headers have no effect. testHeader explicitly enables X-Test-* overrides; keep it out of production.
Migration evidence: inventory, report. Production deployment follows the existing GitOps flow and is separate from source migration.
Release images retain the existing Harbor location: harbor.wuastbude.de/linkus/linkus. CI publishes a candidate, signs and verifies the image and its SBOM, then promotes its verified digest to version tags and latest. The template provides the build workflow; its own registry namespace is not the Linkus image identity.
The dashboard uses the full viewport with the shared edge padding. Status badges group at the left with space before the category selector; the plugin column is wider. Calendar panels show three full poster cards with remaining events reachable by scrolling; dates use local calendar days (Heute, in 3 Tagen). Download remaining times retain seconds as -HH:MM:SS; unavailable estimates remain explicit.
Lokale Build-Ausgaben aufräumen
Pushes über just push [Git-Argumente...] ausführen, beispielsweise just push origin main. Erst nach erfolgreichem tatsächlichem Push leert Cargo das repo-eigene target/, einschließlich Coverage-/Browser-Ausgaben. Fehler und Dry-Runs erhalten es; just clean räumt separat auf. Globale Cargo-/Rustup-/Docker-Caches und Anwendungsdaten bleiben erhalten. Der nächste lokale Build erzeugt seine Ausgaben neu; notwendige kompakte Nachweise vorher dokumentieren. Direkte git push-Aufrufe und IDE-Pushes lösen die Bereinigung nicht aus; Git hat keinen lokalen Post-Push-Hook.