Release notes

0.8.4Passkeys that sign in, updates that roll back

LatestReleased 30 October 2026 · On GitHub

Passkey sign-in works again behind the dashboard's own proxy, and the backend stops reporting unhealthy. An update now installs exactly the release it offered and goes back to the previous version if it fails. Sign-in, audit records and job controls are tighter, pages say when they could not read something, and Next.js and Go are on current patch releases.

Security

• Copies of .env are kept in check and removed on uninstall
  • Port changes now keep the newest five .env.jd-port-previous-* copies, and a wiping uninstall removes them all.
• Repeated wrong two-factor codes lock the second factor for 15 minutes
  • Recovery codes count too. A correct code is refused while it lasts, and an administrator's reset clears it.
• Forms that ask for your password share one attempt budget
  • This covers changing your password, turning two-factor off and registering a passkey. Wrong attempts on one form can briefly delay the others.
• New recovery codes ask for your password
  • An open session is no longer enough, as with turning two-factor off.
• Stopping a job takes the capability that started it
  • A limited account can still stop database dumps, base backups and package index refreshes. The job console hides Stop on the others.
• Audit fields have a size limit, and failed sign-ins always count
  • Usernames, targets and paths are capped in the audit log and the process log. Sign-in failures arriving together are each counted.
• A password typed on a saved domain stays out of browser storage
  • It is held in memory until you save, so a reload clears it. The rest of the draft is kept.

Added

• A failed update goes back to the previous version
  • The images it replaces are kept under a :previous tag. If the build or health check fails, they are restored and the checkout returns to where it was, without discarding local edits. This applies from the update after this one.
• Missing and broken pages have a way back
  • An unknown address inside the dashboard keeps the sidebar, and errors outside it get their own page instead of the browser's default.
• Browser tabs are named after the page
  • A tab reads like Files · Just Dashboard, so several open tabs can be told apart.

Changed

• An update installs exactly the release it offered
  • It uses the release's tag when there is one and checks the changelog before changing anything. A branch that has moved past the offered version is refused until you check again.
• Next.js, Go and other dependencies are on current patch releases
  • Next.js 16.4.3, Go 1.26.10 and updated x/net, with overrides for DOMPurify, lodash-es and nanoid.
• Installs need fewer leftovers and containers run with less
  • A fresh install removes the first password from .env once the dashboard answers. Logs rotate, the proxy has a health check, and the frontend and proxy drop capabilities they do not need. The first start on this release recreates all three containers.

Fixed

• Passkey sign-in works in Chromium browsers behind the proxy
  • The proxy's Permissions-Policy forbade using a passkey, though not enrolling one. If a page's policy still forbids it, the page now says so.
• The backend no longer reports unhealthy after working with host files
  • The main thread could stay in the host's mount namespace, so Docker's health check looked for the binary in the wrong filesystem.
• Timeouts stop host commands
  • A cancelled command run through nsenter could keep running and hold its request open. It now stops at its deadline.
• The dashboard's own ports stay put across lifecycle runs
  • A helper container that could not see the backend's process took its port for someone else's and moved it. A port that has already moved stays where it is.
• The installer checks the full password rule up front
  • A password the backend would refuse no longer leaves a half-finished install, and a kept .env without JD_SITE no longer ends the script silently.
• Documented ACME and ingress settings reach the backend
  • JD_ACME_DIRECTORY, JD_ACME_CA_ROOT and JD_INGRESS_CONTAINER were ignored when set in .env. If you set one, it now takes effect.
• Failed reads no longer look like nothing there
  • Passkeys, Promote and Docker cleanup show the error with a retry. The archive confirmation names what it could not read and waits for its reads to finish.
• Coming back to a hidden tab refreshes it right away
  • Polled pages used to wait for their next timer, which browsers slow down in the background.
• Sizes under one byte no longer read undefined
  • Very quiet network rates showed as 512.0 undefined.
• A release can no longer be skipped by a failed first run
  • The release workflow now publishes any version main carries that has no release yet.

0.8.3A map that unused volumes cannot bury

Released 30 October 2026 · On GitHub

On a server with many unused Docker volumes, the Map's Everything else section grew into a column hundreds of boxes tall. The Map now leaves those volumes to the Volumes page. The Git page can also bring a checkout back in line with its remote in one step, and switching to a branch far behind its remote now brings it up to date.

Added

• Match origin cleans up a checkout in one step
  • The Branches tab fetches, shows what would change, then updates every branch, deletes the ones origin no longer has and ends on the default branch. A branch with commits origin lacks is kept unless you tick it, and uncommitted work goes into a stash.

Fixed

• Unused volumes no longer fill the Map's Everything else section
  • A volume that nothing mounts and nothing backs up is no longer drawn on the Map. A volume with a backup or one in use is still drawn, and the Volumes page still lists every volume.
• Switching to a branch behind its remote brings it up to date
  • A local branch behind its remote now offers Switch and update, and a remote branch keeps its Check out button when a local copy exists.

0.8.2Staging, canaries and warm rollbacks, and a map of the whole server

Released 30 October 2026 · On GitHub

Deployments gain what hosted platforms put between a commit and production: a staging environment and one exact image promoted from a pull request's preview through staging to production, release tasks rehearsed on a restored copy of the database, recorded traffic replayed and a canary tried before the cutover, and the previous release kept warm and switched back to on its own when the new one does worse. Domains get redirects, sign-in, maintenance pages, edge rules, rate limits, wildcard certificates, DNS records and Cloudflare Tunnel; releases can run as replicas, sleep when idle or live only on the tailnet; variables can come from six secret stores; output, requests and traces ship to the tools you already run, and every image is scanned for known vulnerabilities. Deploy keys, the jd command line and an OpenAPI description with generated Go and TypeScript clients open it all to pipelines, and the catalogue grows by a hundred templates and keeps your own. Beside deployments: a Map of the whole server, host alerts, passkeys, SFTP and rclone backups that another server can import, and a session cookie that no longer reaches the apps the dashboard publishes on its own name.

Security

• The dashboard's session cookie no longer reaches the apps it publishes on its own name
  • Browsers send a cookie to every port of a host name, so a browser signed in to the dashboard on its tailnet name sent the session to every preview and tailnet app served on that name, a pull request's own code included. The cookie is now __Host-jd_session, and every tailnet address goes through a front that takes the dashboard's cookies out of the request before it reaches the app. Upgrading signs nobody out: the old cookie is swapped for the new one on the next request.
• A deploy key never reads a variable's value and reaches nothing outside deployments
  • It lists variable names, never values, and generated values are not returned to it; reveals, saved registry and Git credentials, pull request merges and comments, and the removals that take a typed phrase stay a signed-in person's. A deploy key cannot point a variable at a saved credential, a database or a secret store, and a narrowed key reaches only routes about its own deployments.
• The audit log names the API key behind every request made with one
  • Every request made with any API key records the key as well as its account, the audit page shows it beside the actor, and a deploy key refused at the gate is recorded too.
• An MCP key is offered the whole deployment API as tools only when its owner turns them on
  • Every route a deploy key may call can now be an MCP tool, 100 beside the 13 written by hand, held to the key's grant, its owner's role and the deployments it is narrowed to, and run through the dashboard's own routes and audit as a deploy key's request would be. Offer every deployment route as a tool, in Databases → MCP server, is ticked for a new key and off for every key made before this release, which keeps exactly the tools it had; an MCP key's deployments can now be narrowed as a deploy key's are.
• Scan every release's image for known vulnerabilities, and rebuild it on a newer base
  • Each release's image and the bases it was pinned on are scanned with Trivy after the build and daily while the release is live, and the project overview's Vulnerabilities panel lists the findings that have a fix beside Rebuild, which builds again on the base's current digest. A host alert fires when a live release has a fixable finding at or above the environment's floor, High unless set in Build settings, and a newer base exists. The vulnerability database is downloaded by the dashboard from mirror.gcr.io, or ghcr.io, about once a day.
• The image scanner runs with no network and never sees the Docker socket
  • Trivy runs as a one-shot container as nobody, with no network, no capabilities, a read-only root and limits on memory, processors and processes, reading only the image archive it is handed. The dashboard downloads and checks the database itself, so the scanner has nothing to reach.
• The last way in cannot be closed from System users
  • Deleting, disabling, locking, removing the last key, changing the shell or taking away sudo is refused when nobody else could sign in over SSH and become root. Accounts a package made are read-only until editing is turned on for them, a login shell has to be one the host lists, and a new person's account has to be given a way in or be said to need none.

Added

• Add a staging environment and promote its exact image into production
  • Staging is a second, long-lived environment of a deployment with its own branch, domain, variables, volumes and database links, built and deployed exactly as production is. Promote to production runs a staging release's image, with nothing rebuilt, under production's own configuration, variables, release tasks, readiness checks and cutover, and production's history says which staging release each promotion came from. One switch makes production take only promotions, so new code reaches it only as an image staging already ran.
• Promote a pull request preview's exact image into staging
  • A preview whose live commit carries the pull request's current approval can be promoted into staging, never straight into production, and runs there with staging's own plan and variables, never the preview's. With staging's promotion to production, the image that was reviewed in the preview is the image production runs.
• Rehearse a release's tasks against a restored copy of the database before they touch production
  • With rehearsal on in Build settings, the linked database is restored from its point-in-time archive or newest backup dump into a throwaway copy, the release tasks run there with the same image, variables and timeout, and the run reports how long each took and which locks it held. A task that fails against the copy stops the release before production is touched, and a promotion rehearses production's tasks the same way. It is off by default, because it holds a second copy of the database for as long as it runs.
• Replay recorded requests against a new release before traffic moves to it
  • Traffic replay sends the last distinct GET and HEAD requests your domains answered to the candidate's own address, before anything is routed to it, and compares its answers and p95 with the live release's. Requests whose answer depended on who asked, that carry a credential in their query or that scanners sent are left out. It is set beside the release strategy in Runtime settings and is off by default.
• Try a canary release on a share of the live route before its cutover
  • The Canary strategy sends between 1 and 50 percent of the live route's requests to the candidate for the window you choose, records the two releases' answers apart and judges the candidate by the rule the warm rollback uses. One that does worse is removed with the live release untouched; one that does not is promoted at the end of the window when Promote on its own is set, or by Promote now. The run page shows the countdown, both releases side by side, and Abort.
• Keep the previous release warm after a cutover, and switch traffic back to it on its own
  • After a blue/green cutover the release it replaced is paused rather than removed, for ten minutes by default, while the new release's 5xx share and p95 are compared with the old one's from the ingress's own request record. If either crosses its line over enough requests, traffic goes back to the warm container in seconds, with no build or cold start, and the rollback is recorded with its measured reason and told to your notification channels. It is on by default for blue/green releases and is turned off per environment under Runtime settings → After a release goes live; while a window is open the project overview offers Roll back instantly and Keep release.
• Keep each visitor on the release that first answered them
  • With skew protection on, a cookie keeps a visitor on the release that served their page for as long as that release is kept warm, so a page loaded before a cutover never asks the new release for scripts, styles or data it does not have. A cookie naming a release that is gone is ignored and replaced.
• Bring a linked database back as it was when an older release went live, into a copy beside production
  • Each release now records, for every database it links, the moment in the point-in-time archive or the backup it can be brought back to, shown as a data point on the release's row. Restore data as of this release restores each linked PostgreSQL, MySQL or MariaDB database from that point into a side copy to compare with or restore from; production's data is never touched.
• Preview a pull request of a Compose stack, with every service isolated
  • Pull request previews of Compose releases were refused. Each service of a preview now gets the preview's own network, fresh volumes and no published ports, the public service is reached only through the preview's route, and anything that cannot be isolated, such as a host path mounted into a service, is left out and named in the run transcript.
• Give a pull request's preview its own branch of a linked database
  • Settings → Databases → Previews can give each preview a copy of a linked database restored from its newest backup, with chosen columns masked in their own shape before anything reads them. The branch sits on the preview's own network with a generated password, production's database is never reachable from it, a fork's preview never gets one, and it is removed with the preview.
• Redirect a deployment's domains, set response headers and allow only listed addresses
  • A domain can send its visitors to another of the deployment's hostnames with the path and query kept, the way an old www. name is kept for links, with the status code you choose. Settings → Domains → Access and headers sets headers on every answer and limits the route to listed addresses and ranges, refused with 403 before any password prompt, on nginx and on the Docker Caddy ingress alike.
• Require sign-in through Authelia, Authentik or oauth2-proxy before a deployment's domains answer
  • Every request is checked with the forward-auth server first: the application is told who signed in as Remote-User and Remote-Email, a visitor who is not signed in is sent to the sign-in page, and the request is refused while the auth server is down. The gate can cover production and previews or previews only, and a rollback restores the sign-in its release had.
• Switch a deployment's domains to a maintenance page at once, and give them their own error pages
  • The maintenance switch on Settings → Domains answers every visitor with the maintenance page and a 503 immediately, without a deployment or a reload, except the addresses you let past, and no release, rollback or cutover turns it on or off. Custom 404, 502, 503 and 504 pages replace the proxy's, and optionally the application's own, edited in the editor Proxy sites use. A route written before this release needs one deployment before its maintenance can be switched.
• Decide requests at the proxy with ordered edge rules
  • Settings → Domains → Edge rules blocks, answers with a status, lets through or redirects requests by path, method, user agent and client address, the first matching rule deciding, before the application sees them, and each rule counts what it decided in the last day. The rules are part of the release, so a rollback restores them; matching by country stays with Network → Protection, since neither proxy carries a location database.
• Limit each client address's request rate, and refuse the addresses CrowdSec has banned
  • On nginx the limit answers 429 with Retry-After, counting the visitor rather than a proxy in front once JD_TRUSTED_PROXIES names it. The Docker Caddy ingress has no rate-limit module, so its page offers Apply on the host instead and says what that is: a host-wide limit on new connections at the network gateway. With CrowdSec on, the route refuses every address its local engine has banned, read again each minute, firewall bouncer or not.
• Send HSTS from a deployment's HTTPS domains
  • Access and headers can send Strict-Transport-Security with the age, subdomains and preload you choose, held to the rules a Proxy site's HSTS is held to, on the HTTPS domains only; preflight says which served domains receive it. It replaces the application's own header and is off until chosen.
• Issue a deployment's wildcard certificate over DNS-01 during the run, on nginx and Caddy hosts
  • A plan serving a wildcard name such as *.example.com stopped at the certificate step until the certificate was issued by hand. The run now reuses a certificate that already covers the name, a preview under a wildcard included, and otherwise proves the wildcard over DNS-01 with the credentials saved under Proxy → Certificates; the Docker Caddy ingress serves it from a copy. Without credentials that answer for the zone, preflight and the Domains sheet say what to save and where.
• Create a deployment domain's DNS record from its settings
  • Open the DNS record, in a domain's menu, shows what the name should hold beside what its zone holds and creates or corrects the A, AAAA or CNAME record through the DNS credentials the Certificates page already keeps: Cloudflare, Route 53, DigitalOcean, Google Cloud DNS, Linode, OVH, Gandi or RFC 2136. A record this dashboard did not write is replaced only after you press Replace the record, and no record is ever deleted.
• Serve deployment domains through Cloudflare Tunnel, with no port open on this server
  • Proxy → Tunnel connects one tunnel, from a pasted token or created with the Cloudflare API token already saved for certificates, and runs cloudflared beside the ingress with no published port. A domain switched to the tunnel skips the certificate and public-address checks and gets its ingress rule and CNAME when the release goes live, never replacing someone else's record. The page shows cloudflared's own state, and a Tunnel down host alert says when it loses Cloudflare's edge.
• Publish an environment only on the tailnet, and admit only the Tailscale logins and tags it lists
  • A tailnet-only environment gets an address on this server's tailnet the way previews do, with no public domain, certificate or routable address. With a list of logins and tags, each visitor's Tailscale identity is checked before the application answers, without a sign-in server.
• Run a stateless release as up to eight replicas behind one route
  • Runtime settings → Releases runs 1 to 8 containers of the same release on this server, without Swarm or Kubernetes, and both proxies spread requests across them. The replicas are one release for readiness, cutover, the warm window and rollback, and a plan only one container can hold, with a fixed host port, a writable mount or a Compose build, is refused with the reason.
• Let an idle environment sleep, and wake it on the first request
  • With Sleep when idle on in Runtime settings, the live container is stopped after a quiet spell, 15 minutes unless set, and the route keeps answering: the first visitor's request is held while the container starts and then answered as usual. It never sleeps while a run is queued, a warm window is open or the request record cannot be read; the overview shows Asleep with Wake now, and every sleep and wake is audited.
• Choose the user a release container runs as, a read-only root, ulimits and kernel parameters
  • Runtime settings → Inside the container sets the user, a read-only root filesystem with writable temporary paths, ulimits such as nofile and memlock, and the network and IPC kernel parameters Docker allows per container. A bad value is refused with the field it is about, and a Compose plan keeps these in its own file.
• Give a release container NVIDIA GPUs
  • Container access passes every GPU, a number of them or chosen devices to the release, and preflight warns when the server has no NVIDIA container runtime.
• Suggest each deployment's memory and CPU limits, and forecast when a disk fills
  • A Right-size card on the project overview suggests limits from the container history the server already records, beside the p95, peak, OOM kills and throttling it rests on, and Apply suggested limits saves them. Metrics gains a Capacity forecast with the days until each mount is full and the apps growing fastest.
• Deploy the Minecraft templates as game servers
  • Both Minecraft templates deploy instead of showing as not available: their settings file is written before the first start, so Server settings edits now survive restarts, and they publish UDP where the game needs it, on loopback until you choose every interface. The game pages say what stands between a player and the server, with an Allow button that adds the firewall rule, and the console is RCON.
• Define variables once for the server or a project, and read them by reference
  • Deployments → Shared variables holds values any project reads as ${{server.NAME}}, and a project's Settings → Variables holds values its environments read as ${{project.NAME}}. A shared value is read at each run, so a change reaches a release on its next deploy, and each list says which variables read it and which of them are not live yet.
• Read deployment variables from HashiCorp Vault, OpenBao, Infisical and Doppler
  • A connection saved once under Deployments → Secret stores lets a variable hold a reference such as ${{store.vault-prod/apps/web#DATABASE_URL}}, read at every run, or pinned to a version with @4. The variable becomes secret, and its row shows the store and where the key is, never the value.
• Read deployment variables from AWS Secrets Manager and Azure Key Vault
  • A reference reads a whole secret, one field of a JSON secret with #KEY, or a version or staging label with @, as in ${{store.aws/prod/db#DATABASE_URL}}. AWS signs in with an access key and Azure with an application's client secret, and Test names the first secret the identity can read.
• Deploy a template as a stack: the application with the database, cache or worker it needs
  • A template can now be a multi-service Compose stack. Only its public service is reached through the domain; its databases and queues sit on a private network with nothing published and no route out, and the passwords they share are generated here.
• Choose from a hundred more one-click templates
  • The catalogue grows from 62 templates to 162, 56 of them stacks, among them WordPress, Ghost, Nextcloud, n8n, Plausible, Gitea, Forgejo, Mattermost, authentik, Keycloak, LibreChat, LiteLLM, Flowise, Paperless-ngx, Excalidraw, Pocket ID, Garage and GitLab. Every one was started on real Docker and answered its own checks before it was offered, and an application whose first account would be the same for everybody is not offered.
• Keep your own templates beside the built-in ones
  • Deployments → Templates makes a template from a pasted Compose file or imports one as JSON, and Settings → General → Save as template… makes one from a deployment that runs published images, with its secrets turned into inputs and any password written in a file generated instead. An added template is held to every rule a built-in is held to and deploys through the same path, and each deployment keeps its own copy, so editing or removing the template changes only the next one.
• Build a repository with Railpack when no recipe or Dockerfile does
  • Railpack 0.43.0, pinned by digest, is a build method beside the fifteen recipes: detection offers it beside a recipe and chooses it where nothing else builds, and its plan is built through the same BuildKit path, so previews, promotion, rollback and the image scan treat the release as any other. Its planner reads the checkout read-only, with no capabilities, and the run page shows what Railpack decided. Railpack chooses its own base images by tag rather than by digest, and preflight says so.
• Make deploy keys: API keys a pipeline can deploy with
  • Account → API keys → New key → Deploy key, made by an administrator in the browser, does on the deployments what used to need a browser session: create and commit drafts, change configuration, source, Git policy and triggers, set variables, deploy, promote, roll back, switch back to the warm release and switch maintenance. A key can be narrowed to chosen deployments, and a narrowed key can create deployments that become its own.
• Deploy from a terminal or CI with jd, the dashboard's command line
  • jd login, deploy --wait (its exit code is the run's result), logs --follow, rollback, vars set, config set and the rest work with a deploy key, and every read takes --json. install.sh puts jd in /usr/local/bin and the dashboard keeps that copy current after updates; another machine downloads it from the dashboard or builds it from the repository.
• Let an AI client list, deploy, roll back and read the runs of deployments over MCP
  • An MCP key has a deployment grant of None, Read or Deploy in Databases → MCP server. Read lists deployments, runs, run logs and releases, and Deploy can also deploy and roll back production; every existing key reaches no deployment until it is given a grant.
• Describe the deployment API as OpenAPI 3.1
  • Every deployment route is described from the router and the handlers' own types, served at /api/v1/deploy/openapi.json and openapi.yaml, printed by jd openapi and committed to the repository, and tests fail when it drifts from the code. It carries the shapes of requests and answers, never a value from this server.
• Call the deployment API from Go and TypeScript clients generated from its description
  • sdk/go, a Go module of its own, and sdk/typescript, a client over fetch, have one typed method per operation with its requests, answers and the API's whole error envelope, and need nothing beyond each language's standard library. They are generated from the OpenAPI description, and a test fails until they are regenerated after a route changes.
• Report releases to GitLab, Gitea and Forgejo, and keep a comment on their merge and pull requests
  • A run on a GitLab, Gitea or Forgejo source posts pending, then success or failure, on the exact commit, and a preview keeps one comment on its merge or pull request from Building to Ready, Failed or Removed, as GitHub already had. The source's own token or a saved provider token for the host is used, and Settings says where the last status went or why the host refused it.
• Ship deployments' output and requests to OpenTelemetry, Loki or any JSON-lines endpoint
  • Deployments → Log drains copies every line a deployment's containers write and every request the ingress served, as they happen, in OTLP, Loki's push format or JSON lines, compressed and with each line's level read from the line itself. Each drain says what it shipped and when or, in amber, the destination's own answer and how much is waiting.
• Trace each request from the ingress into the application with OpenTelemetry
  • The ingress sends every routed request a W3C traceparent, continuing the client's trace when it brought one, and records the ids beside the request, so the application's own spans join the request at the edge; an OpenTelemetry log drain can send each request as a span too. A route is traced from its next deploy, and a Caddy ingress older than 2.8 stays untraced.
• Keep deployments' crashes and OOM kills past a restart, and scrape deployments with Prometheus
  • A deployment's container events are stored for at least 30 days instead of being lost when the dashboard restarts, and the project overview shows its availability over a day, a week and a month. /api/v1/metrics/deployments serves runs, releases, containers, restarts, OOM kills, request errors and latency to a key limited to reading metrics.
• Ask the assistant why a deployment run failed
  • Under a failed or rolled-back run, Ask why it failed sends the run's record, with secret values masked and variables by name only, to the provider an administrator set up for the assistant, and shows the likely cause, the transcript lines that show it and what to try. Nothing leaves the server until someone presses, nothing in the answer is applied, and the answer is kept with the run.
• Diagnose a deployment with the assistant, which reads only with your leave and runs nothing
  • Diagnose on the project overview asks the assistant about an environment and the server under it. Each read it wants, from run transcripts and container logs to lifecycle events, host alerts and firewall rules, waits for your Allow and runs with your role, masked, and what it proposes is a card whose press is the page's own audited request.
• See the whole server on the Map, one diagram per system
  • Server → Map finds each system the server runs, this dashboard, every deployment, Compose stack, PM2 app and wired service among them, and draws it left to right the way a request travels: tailnet, domains and certificates, the application and its containers, databases and volumes, backups. Every line comes from a link the server records, never a guess from a name; a database several systems share is drawn in each with where else it is, and names stay readable however far out you zoom. The map changes nothing on the server, and each box opens its own page.
• Alert on the server's CPU, memory and disks, containers going down and failed backups
  • Monitoring → Alerts holds rules for host CPU and memory over a window, each mount's space or inodes, each container and each backup job, told to the channels the deployments use once when a rule starts firing and once when it recovers. A container counts as down when it crashes, is killed for memory, loops on restart or turns unhealthy, never when someone stopped it.
• Send notifications to ntfy, Gotify, Pushover, Mattermost and Microsoft Teams
  • Deployments → Notifications offers ten kinds of channel for deploy runs and every alert, each field checked as it is typed. The push services raise priority only for bad news: a failed run or an alert firing.
• Back up to SFTP servers, and to Google Drive, OneDrive, Dropbox, WebDAV and the other services rclone speaks
  • An SFTP destination takes a password, a private key or both, pins the server's host key the first time and refuses another key before any credential is sent. An rclone destination takes the remote's section as rclone config show prints it, and one that could write to this server's own disk or run a program is refused; both are encrypted by default, like S3 and B2.
• Import a destination's backups on a fresh server and restore them there
  • Every archive now has a manifest beside it naming the server, job and run that wrote it; for an encrypted archive, the paths and database names in it are sealed to the archive's key. Backups → Import… lists what a destination holds that this server did not write, grouped by server and job, and imports one archive or a job's whole history after checking each against its digest, with Import key… bringing in the key exported on the old server. An imported job is a record that never runs, schedules or prunes, a restore of its run in place first makes what is missing, a Docker volume with its labels or a directory, and archives taken before this release have no manifest to import them by.
• Sign in with a passkey in place of the password
  • Account → Security registers passkeys after asking for the password and, with an authenticator, a fresh code, and the sign-in page offers Sign in with a passkey and the browser's own autofill. A passkey replaces the password, never the second factor, so an account with an authenticator still gives its code, and a password reset from the terminal removes the account's passkeys.
• Link this dashboard to a just-dashboard.com account, outbound only, at a scope you choose here
  • Settings → Connect, a question in install.sh or scripts/manage.sh link asks for a code you approve on the site; the server then sends a signed heartbeat and polls for commands, and nothing on it listens. Observe shows the site health, version and counts, Operate also lets it start, stop and restart containers and stacks and run backups, and Maintain also update and restart the dashboard; the dashboard's own containers are refused at every scope, and every command is audited. Nothing is linked until someone links it, JD_ACCOUNT_LINK=false removes the feature, and the page draws the link live with what the last heartbeat sent.
• Install nginx and certbot from the Proxy overview, and the modules nginx is missing
  • On a server without nginx the overview opens on Install nginx and certbot, with the exact command beside it, streams the install and redraws as the engine view. A module a host package provides gets Install in the modules list, and every install shares one console, so two never race for the package manager.
• Paste files, screenshots and text from your computer into the Files page
  • Ctrl or Cmd+V uploads files copied in Explorer or Finder into the open folder through the usual upload review, a copied picture as a Pasted image named with the time, and copied text as a text file. Copying in the dashboard puts the selected paths on your clipboard, one per line.
• Count this server in the public install numbers, if an administrator says yes
  • An administrator is asked once on the Overview, and nothing is sent until somebody says yes. A yes sends one report a day: the version and whether anybody signed in today and this week, with no ID and no hostname. Settings → Configuration prints the report exactly as it is sent and has the off switch, and JD_USAGE_PING=false means nobody is asked and nothing is ever sent.
• Set, generate and remove an account's password, and disable an account outright
  • Passwords go to chpasswd over stdin and a generated one is shown once. A password can be required to change at the next sign-in, given an expiry and rules for its age, and a faillock lockout can be cleared. Disabling expires the account, which stops keys as well, where a password lock does not.
• Grant and take away sudo from an account's page
  • With a password, without one, or for named commands. A grant is its own file in /etc/sudoers.d, checked by visudo before it can take effect and taken back if the whole configuration stops parsing, because one bad line stops sudo for everyone. Rules in other files, cloud-init's included, can be removed from the account they name.
• Manage SSH keys properly
  • Import a person's public keys from GitHub, generate a pair and download the private half once, label a key, limit it by address, command or expiry date, copy it to another account, and see when each was last used and whether it is too weak to keep.
• Manage groups, an account's identity and its limits
  • Create, rename and delete groups and choose their members, each saying what it grants. Rename an account, which takes its private group, crontab and sudo rule along, change its full name, shell, home, main group and number, and cap its CPU, memory, processes and, where the filesystem has quotas on, its disk.
• Open a terminal as any account
  • An administrator can open a shell as a chosen account, root included, and every window opened from it stays that account.
• See what an account is doing and has done
  • Its sessions, which can be ended, its busiest processes, cron jobs and disk use, with its sign-ins, refused attempts and sudo commands as the host recorded them.
• Be told when the host's accounts change
  • A new host alert, Accounts changed, reports a new account, SSH key or sudo rule that reaches root, and root signing in, whether or not the dashboard made the change.
• Set the rules new accounts start under, and start from a template
  • Password age and length, the default shell and days of inactivity are edited in the host's own files with everything else in them left alone. Accounts can start from a built-in template or one of your own, and several can be locked, disabled, re-enabled or moved between groups at once.

Changed

• Say when a release goes live without a readiness check, and propose one for services
  • Preflight now warns when nothing checks a release before traffic moves to it, and the run page says the release went live unverified, with a link to the health-check settings. A new service or image deployment with a known port is offered the image's own health check, an HTTP check on a path detection found, or a TCP check on the port; plans without a check keep deploying as before.
• The proxy pages draw a deployment's route with its project's name and icon
  • A deployment is reached at its container's network address, so the overview's routes, route map and traffic band drew a bare address under a cube.
• The Proxy overview says each thing once, and its alerts have a page of their own
  • The header is one bar with the engine's version and state, Refresh and an Alerts link with the firing count; facts that are the expected answer move into tooltips, and an empty block is a card that says what is missing and offers the fix. Proxy → Alerts replaces the sheet and is drawn the way Notifications is.
• A clean nginx configuration test answers with a toast
  • Test config opened a full-height panel just to say Valid. A pass is now a toast with Show output, and a warning or failure still opens the panel.
• The Git workspace strip folds into two full rows on a narrow screen
  • Below a set width it shows the name, account and menu on one row and the branch beside Fetch, Pull and Push on the next, instead of wrapping wherever it ran out of space.
• An install checkout cloned with sudo is handed to the owner of its directory
  • A checkout cloned with sudo into a home directory belonged to root, so its owner's git refused it for dubious ownership and git worktree add failed. At start the dashboard gives it to the account that owns the directory, leaving other accounts' files and files only root may read, such as .env, as they are, and signs that account in to GitHub with the dashboard's own login when it has none.
• Found on this server lists only what there is to take
  • Servers and the files an application keeps are listed; other programs' state, backups and copies, data directories with no server and ignored items sit behind one Set aside fold, and ignore marks for things that are gone are one line with Forget them. Every row has the same two lines.
• Add a site takes the Overview's eighth shortcut
  • It counts the sites served and opens a blank site on Proxy → Sites, for administrators who keep Proxy in their sidebar.
• The dashboard draws itself with the new brand logo
  • The wordmark, the start-up splash and the browser icons use the new mark, and the dashboard's own stack, containers, sockets and routes show it where they showed Docker's or Caddy's.
• Deleting an account says what it would leave behind and lets you choose
  • It counts the home, the files the account owns elsewhere, its running processes, cron jobs and sudo rules first. The home can be kept, archived or deleted, and the account's files handed to another; its sudo rules, crontab and limits go with it, so they cannot land on whoever is next given that name or number. Deleting a home with no archive now takes the account's name typed.

Fixed

• A deployment domain with HTTPS off is served over plain HTTP, as its switch says
  • One HTTPS domain turned TLS on for the whole route, so a domain marked HTTP only was redirected to an HTTPS it had no certificate for, and the run asked for a certificate covering it. Each domain is now served on its own scheme, and the certificate covers only the HTTPS names.
• The Caddy ingress serves a renewed certificate as soon as certbot renews it
  • A certbot or imported certificate reused on a Docker Caddy host was served from a copy made when the release went live, so after a renewal Caddy kept serving the old one until the next deploy, past its expiry if none came. Each copy now records where it came from, and a renewal refreshes every route served from it.
• A deployment on the Docker Caddy ingress can serve more than one hostname over HTTPS
  • The ingress refused a TLS deployment with a second hostname; each name now gets its own certificate from Caddy.
• A deployment's HTTP-01 certificate is ordered from the ACME directory you configured
  • The path a host nginx deployment takes ignored JD_ACME_DIRECTORY and ordered from Let's Encrypt, and a private authority refused it for want of a contact. It now orders from the configured directory through the Certificates page's certbot, as the DNS-01 path and Caddy already did.
• A deployment run's certificate order waits for the Certificates page's certbot, and the page's for a run's
  • Two certbots at once failed whichever started second with Another instance of Certbot is already running. Each now waits its turn and says in its transcript what it is waiting for, and a run that waited reuses a certificate the page's job has just issued.
• Deployment routes from the tenth environment on no longer fail nginx's configuration test
  • A route's variable names passed nginx's default length from environment 10 on, and from shorter lengths for long Proxy site and stream names, which failed nginx -t and every other site's reload with it. Names that would be too long are now shortened with a hash, and files that already load keep theirs.
• Remove the routes, domains and certificates a deleted deployment left behind
  • A Caddy route whose deployment was deleted or archived kept serving its domain and renewing its certificate, with no way to remove it. Proxy → Sites now offers Remove route for a deployment route with no live owner, and the certificate only that route served goes with it.
• Saving a deployment check that nothing runs is refused
  • DNS, TLS and backup-freshness checks could be saved through the API but never ran, so a required one stopped every deploy. They are now refused when a configuration is saved, each with what to use instead, and plans saved before keep deploying as they did.
• Deploy a Compose stack, on an empty Projects page, opens the Docker tab
  • It opened whichever tab was used last in the session, since the source strip has no Compose tab.
• The Files page opens every path on the host, not only those the backend's container mirrors
  • Paths outside /home, /opt, /srv, /root, /etc, /var/log and Docker's volumes came back not found, or showed the container image's own files. Every Files operation now runs in the host's own view of its disks, held to the same path checks as before.
• New files and folders made on the Files page belong to the owner of the folder they are made in
  • The backend runs as root, so a folder created or uploaded into a checkout belonged to root, and the Git page's pull, which runs as the checkout's owner, could not replace it. Entries made in another account's folder now belong to that account, as the same action in its shell would make them.
• The Git page offers to give back a root-owned folder before a pull, even one holding only untracked files
  • The Git page's check looked only at folders holding tracked files, so a root-owned folder of untracked copies made Discard and pull fail with Permission denied. It now offers to give such folders to the checkout's owner and pull.
• The Files list's header stays opaque when rows scroll under it
  • Rows drew straight through the Name, Size, Modified and Owner header as the list scrolled.
• MongoDB 8 starts on Linux 6.19 to 7.0.13
  • MongoDB 8 refuses to start on these kernels, so its container restarted for ever. A new server is started with the glibc setting that lets it run, the Databases page offers a one-click fix to a server made before, and MongoDB 7.0 and 6.0, and kernels from 7.0.14 on, need nothing.
• Upgrading packages that restart Docker no longer leaves dpkg interrupted
  • Package commands ran inside the backend's container, so an upgrade of docker-ce restarted Docker, killed the dpkg configuring it, and left every later apt command refusing to run. Installs, upgrades and removals now run as host systemd units that a restarted backend reconnects to, an interrupted dpkg is finished first, and a command waits for unattended-upgrades to let go of the lock instead of failing.
• Closing a terminal window no longer crashes its reader or leaves its shell running
  • A window closed while its output was being announced could crash the loop reading it, and a lost hangup let the shell outlive the window. The close and the announcement are now ordered, and the window waits for the shell to exit.
• The version check says how often it really runs
  • Configuration and the README said four times a day. It runs every two hours, and at most every five minutes while pages are being opened.
• System users no longer says a password was unlocked when nothing changed
  • An account with no password behind its lock, which is every account this page created and the login on most cloud images, has nothing to unlock. usermod said so on stderr, changed nothing and exited 0, so the page reported success. It now says there is no password to unlock and offers to set one.
• System users tells you who can really sign in
  • Each account now says whether SSH would let it in by password and by key, and what stands in the way, read from the shadow file, its keys and sshd's own configuration for that account. Root is always listed: it was hidden as a system account, so a host where root signs in with a password read as having no way in at all. Who can become root comes from the sudoers files rather than from group names, so cloud-init's passwordless rule shows and a sudo group member with no password to type does not read as root.

0.8.1A streamed Mac that connects once and lines up

Released 19 October 2026 · On GitHub

0.8 made a streamed Mac reconnect up to three times, come out stretched, and leave the pointer off where it was drawn. A stream now stays at one size for the whole session, Sunshine's black padding is cut off at the frame's edges instead of avoided by asking again, and the pointer lands where the screen is drawn.

Fixed

• A streamed Mac connects once, unstretched, with the pointer where it is drawn
  • 0.8 read the screen's shape off Sunshine's black padding and loaded the stream again at that shape. Sunshine kept the first session's capture for the overlapping new one, so the picture came out stretched, the stretched padding read as yet another shape, and the pointer met the Mac's own only at the centre. The stream is now asked for at the quality's 16:9 size and never loaded again for a new shape; the picture is drawn past the frame's edges by the padding, so the frame still takes the computer's shape and fills the content area. The shape is read for the whole session, and shapes remembered from 0.8's stretched streams are not reused.

0.8Drawings edited together, and an Overview that opens onto everything

Released 19 October 2026 · On GitHub

Excalidraw becomes the Workspace's one board: a drawing is edited together live, keeps its images and the shape library on the server, and can hold live cards of your hosts, projects and databases, YouTube, Vimeo and Figma embeds, and diagrams written from a description. The Overview opens on shortcuts to every part of the dashboard, with the open shells, the drawings edited last, the databases and every backup job. A project is drawn by its website's icon wherever the dashboard names it, the web terminal finds what ssh finds, and a reinstall that lost its master key repairs its saved database connections instead of adding a second copy of each. Stickyboard and the schema comparison page are gone.

Added

• Edit a drawing together with everyone who has it open
  • Everyone with a drawing open joins its live room, a relay that keeps nothing: changes, pointers and names reach the others as they are made. Once an editor has joined, its saves merge with the stored drawing element by element instead of being refused because another editor saved first, and an element someone deleted stays deleted.
• Keep a drawing's images and the shape library on the server
  • Images are stored apart from the drawing and sent once, as soon as they are placed; an older drawing's embedded images move out on its next save. The shape library is kept on the server, one per install, and packs from libraries.excalidraw.com are downloaded by the server, since the page's security policy keeps the browser from fetching them.
• Put live cards of hosts, projects and databases in a drawing, embed YouTube, Vimeo and Figma, and describe a diagram to have it drawn
  • A server card reads its host, project or database as it is now, each time the drawing is open. Describe a diagram writes Mermaid through the SQL assistant's provider and places it on the canvas, and the menu and the empty canvas are the dashboard's own.
• Open the Overview on shortcuts to everything the dashboard does
  • Terminal, Excalidraw, Files, Remote Desktop, Databases and Backups were nowhere on the landing page, or one figure each. It now opens on shortcuts that count what each adds to, pairs the open shells with the drawings edited last and the databases with every backup job, and each row opens the thing it names; a shell opens the terminal on that session.
• Draw a project by its website's icon wherever the dashboard names it
  • A database's reader, a site's application, a port's owner, a backup's source and job, the Overview's activity, the logs' request records, the command palette and a drawing's card picker drew a deployment as a cloud or its container's image. They now show the project's icon, and keep the old mark where a project has none.
• Show a database a deployment variable reaches by its address
  • A project whose DATABASE_URL was written out as this server's address and the port its database publishes had no link to that database, so Settings → Databases & backups said none was linked. The page now matches the project's variables against the databases on the server and draws each one it names as a card reached by address.

Changed

• The web terminal logs in through the account's own shell, so it finds what ssh finds
  • A bash account keeps ~/.local/bin in ~/.profile, which the terminal's zsh never read, so commands such as claude were not found in the dashboard while ssh ran them. The login now runs the account's own shell first, and the bundled zsh adds ~/bin and ~/.local/bin when they exist.
• A remote desktop session takes the whole content area, and a stream keeps the computer's screen shape
  • A 16:10 Mac was letterboxed twice, by Sunshine and again by the bridge. The stream is now asked for in the computer's own shape, read once and remembered per computer, and drawn in a frame of that shape.
• Seed data says what it inserts before it inserts anything
  • The panel opens with a notice that it inserts made-up test rows, keeps the rows already there and inserts nothing before the review, named with the connection's environment label and amber where that is production. Each table says what it references and its row count now and after, and each column head fits on two lines.
• Server parameters are readable and say which ones can be changed, and Extensions shows each project's own mark
  • Extensions are grouped under category glyphs with the real logos of the projects behind them.
• Metrics draws its network interfaces on the page's own ground, two to a row, the way it draws disks
• A person with no picture is drawn as a silhouette on a solid colour
• The database import page is centred with its step bar sized to the panel, and the results find strip matches the buttons beside it
• The SQL assistant no longer shows a privacy note under the composer at all times

Fixed

• Database connections sealed under another master key are repaired instead of saved again beside the broken one
  • A reinstall that kept the data directory but not the .env left every saved connection unreadable, and connecting its server again added a second connection beside the red one. A connection made from a server the dashboard found is now resealed in place from that server's own credentials, whenever it is signed in to and by a background pass, and the installer asks for the earlier key when it finds the data without one.
• Discard on a deployment's settings works when the saved Git credential is a GitHub App credential
  • The credential picker does not list GitHub App credentials, so restoring one made the form dirty again however often Discard was pressed. A select no longer reports an empty choice when its value is one its items do not hold yet.
• The Overview's Backups figure no longer hides a failed job behind another job that succeeded after it
  • It read the newest run on the server, so a failed nightly job vanished under an hourly one; every job is now ordered and counted by its own last run.

Removed

• Stickyboard
  • Excalidraw is the Workspace's board. Stickyboard's pages, routes and place in the sidebar, command palette and Overview are gone; the boards made with it in 0.7.2 to 0.7.5 stay in the dashboard's database through the update.
• The database schema comparison page
  • Schema → Compare, added in 0.7.5, and the backend that wrote its migrations are gone.

0.7.5Remote Desktop, and databases you can run end to end

Released 18 October 2026 · On GitHub

Remote Desktop opens your own Windows PCs, Macs and Linux desktops in a browser tab over Tailscale, with no one at the computer, and can stream a screen as video from Sunshine. Databases becomes the place to run them: an assistant beside the SQL editor and an MCP server for your AI clients, point-in-time recovery, TLS, PgBouncer, major-version upgrades, row-level security, schema comparison, measured plans with index trials, seed data, and imports kept current until you cut over. Automatic attention panels and settings recommendations are gone; the tools, updates and safety checks they sat beside remain.

Security

• Keep passwords and other values out of PostgreSQL's statement list
  • Databases → Performance → Statements and the busiest statements on Home showed PostgreSQL's CREATE ROLE and ALTER ROLE with the password in clear, and SET, COMMENT, DEFAULT and DO statements with their values, to any account that may read. Every value in PostgreSQL's statement text is now replaced with a placeholder before it leaves the server, a password or a setting written without quotes included, and the $1 markers the server writes stay, so a statement's plan is still asked for with values put back in. A role created or changed from Access is no longer kept in pg_stat_statements at all when the connection signs in as a superuser.
• A SELECT that runs other SQL or outlives its rollback is no longer a read
  • PostgreSQL's query_to_xml, cursor_to_xml and table_to_xml families, ts_stat, crosstab, connectby and every dblink function run text they are handed as SQL, which can spell a function's name in pieces that no reading of the statement sees. Advisory locks, statistics resets, replication and WAL functions, MySQL and MariaDB named locks and := assignments, sequence values on every engine, and Oracle's DBMS_XMLGEN, DBMS_SQL, UTL_HTTP and similar packages act past the read-only transaction a read runs in. All of these now ask for the destructive capability and a confirmation in the query editor, and are refused on a protected connection.
• Oracle and SQL Server statement lists no longer show what comments said or the literals after one
  • Oracle keeps a statement's text with its line breaks turned into spaces, so a -- comment hid everything after it from the literal masker and the rest of the statement was shown as it was run. Comments are now dropped from the text of Oracle and SQL Server statements, optimizer hints are kept with their literals replaced, and SQL Server's nested comments are read the way it reads them.

Added

• Open your own PCs, Macs and Linux desktops in a browser tab, unattended, over Tailscale
  • Workspace → Remote Desktop draws this browser, this server and each computer you add, with whether its Remote Desktop, Screen Sharing or VNC answers, and offers the tailnet's Windows, Mac and Linux devices not added yet. Control opens a session through guacd with the clipboard both ways, file upload, the key combinations a browser keeps, and a Mac's own account asked for on the page. Stream plays the screen as video from Sunshine on the computer, up to 120 fps, over WebRTC on the tailnet. A session stays connected while you use other pages, and its column says where its round trip goes. The computers are reached over the tailnet, so nothing is opened to the internet.
• Limit the memory and processors a database's container may use
  • A new database can be limited when it is created, with sizes filled in for its engine and held to this server's memory and processors. Settings → Resources changes the limits of a container the dashboard may change, in place and without a restart, beside its peak in the last hour and the engine's own buffer (shared_buffers, innodb_buffer_pool_size, maxmemory and their kind), saying what a limit under that buffer does. Lifting a limit replaces the container after asking, keeping its data. Every change is audited, and a replacement made by the dashboard keeps the limits.
• Recover a PostgreSQL server to any moment, not only to its last dump
  • Databases → Backups can archive the write-ahead log of a PostgreSQL server the dashboard runs with WAL-G, into a directory, S3 or Backblaze B2 — or a backup job's destination — encrypted to a key only a recovery opens, beside base backups on a schedule and as many days kept as asked. The page shows the moments it can go back to, how archiving is going and WAL-G's own words when it fails. A recovery to the latest moment, a moment to the second or a named restore point starts a new server beside the old one, which is never touched; keep both, or switch the copy in for the server, and archiving carries on into an archive of its own.
• Switch a database to TLS with a certificate from the dashboard's own authority
  • Databases → Settings → Network turns TLS on for a PostgreSQL, MySQL, MariaDB, MongoDB, Redis or Valkey server the dashboard started, or off again. The first time, the dashboard makes a certificate authority and seals its key with the master key; each server gets a one-year certificate naming loopback, its db-N.jd.internal name and the address it is published on. TLS can be allowed beside plain text or required, except on Redis and Valkey, where the port then speaks TLS only. The dashboard's own connection verifies the certificate, the CA certificate downloads from the same section with a connection string and command for another machine, and certificates are renewed a month before they end, with an audit entry, by asking the running server to read the new one. The container is restarted only if the server cannot, and the renewal checks the certificate the server presents before it records it. Turning TLS on, off or to required recreates the container; if the server does not come up with it, it is put back as it was. Applications linked to the database keep the connection string they had while TLS is allowed, and are given one that encrypts without checking the certificate once it is required.
• Create, edit and drop functions, procedures and triggers from the schema browser
  • Databases → Schema opens a function, procedure or trigger with Edit and Drop, and the schema offers New function, New procedure and New trigger (a table's Triggers reading has its own). The form has the fields the engine has a word for, the body in the editor and the exact statement under it, sent as one statement, so a MySQL BEGIN … END block, an Oracle PL/SQL block or a SQLite trigger needs no delimiter. PostgreSQL, MySQL, MariaDB, SQL Server and Oracle take all three; SQLite takes triggers. An edit uses CREATE OR REPLACE or CREATE OR ALTER where the engine has one and otherwise drops and creates in one transaction, or puts the old definition back if the new one is refused; Oracle's result is checked for compile errors. A program whose text holds something the form cannot state is shown with the reason and left to the Query tab. Writing one asks for the destructive capability, as the Query tab does for the same CREATE.
• Compare two database schemas and write the SQL that makes one like the other
  • A new Compare page under Schema lists what differs between this connection's schema and another schema of the same engine, side by side: tables with their columns, keys, indexes, constraints and foreign keys, views, sequences, enum types, and functions and procedures as text. The migration is ordered so tables exist before the keys that point at them and a key is dropped before its table, destructive steps are marked, and what the engine cannot change in place is said so in a comment. It is text to copy, save or open in Query and is never run by the dashboard. PostgreSQL, MySQL and MariaDB, SQL Server and SQLite.
• Fill tables with believable mock rows from the Generate page
  • Seed data, beside the code generators, plans rows for every table or the ones chosen: each column filled by what its name and type say it holds (names, emails, addresses, prices, dates in the past or ahead), an enum's labels or a CHECK's list or bounds, and a column the server numbers or computes left to it. Tables are written parents first so every foreign key points at a row that is there, a table that points at itself points at its own earlier rows, and unique columns stay unique when the seed is run again. A tab per table shows its first rows and lets each column's generator be changed; the rows shown are the rows written, by the seed number both carry. Writing shows the statements first and runs as one transaction; a row the table refuses is left out and counted with its reason. Addresses, domains and telephone numbers are the ones reserved for examples and fiction. The preview is open to every role and on a protected connection; writing needs a role that may change data and is refused on a protected one. PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle and ClickHouse, which has no transaction and writes each table on its own.
• Keep each database's statement statistics over time
  • Databases → Performance → Statement history lists what each statement cost over the last hour, six hours, day or week, with its time drawn across the window, and orders the list by its share of the time, calls, mean time, p95, rows or rows examined. A statement opens on charts of its time, calls, time per call and rows. The dashboard reads the statement list every five minutes, including while the page is closed, and keeps what each statement added for seven days. ClickHouse and MySQL 8 give p50, p95 and p99 from their own run times; PostgreSQL, MariaDB, SQL Server and Oracle keep no distribution, and the page says what each figure is made from. Only a statement's shape is kept, as the Statements view shows it, never one execution of it.
• Edit a PostgreSQL table's row-level security and try it as a role
  • Databases → Schema → a table has a Row security reading. Turn security on or off, hold the owner to it, and add, change and drop policies from templates (owner only, owner by a setting, tenant isolation, read-only for a role), each with the statement shown before it runs. Try it as a role runs one SELECT as that role with the settings its policies read, in a transaction that is rolled back.
• Grant EXECUTE on functions and privileges on single columns
  • Databases → Access → an account's PostgreSQL grants list Functions and Columns beside Tables. Press EXECUTE on one function or on every function of a schema, and the ones made later, or SELECT, INSERT, UPDATE and REFERENCES on chosen columns of a table.
• Bring a database over from another server, keeping it current until you cut over
  • A database's new Import page takes the source's connection string, says what stands in the way, and brings the database into a new one on that server. On PostgreSQL it uses logical replication: the structure is copied, the dashboard publishes the tables on the source (or gives you the statement to run yourself), subscribes the target, and shows each table's copy and how far behind the target is. The cutover waits for zero lag, sets the sequences to the source's positions and takes the subscription and its slot away. Every other engine that can restore under another name reads a dump from the source and loads it as it is read. The source's password is sealed for as long as a replication needs it and is never shown again.
• Copy a database to another saved connection of the same engine
  • The Backups page's Copy database dialog can now send the copy to another server saved here. SQL databases go from one to the other as they are read, without being written to this server's disk; MongoDB and Redis stage the dump in a directory of their own and remove it.
• Let AI clients reach the databases you choose through an MCP server
  • Databases → MCP server makes keys for Claude Code, Cursor, VS Code or any client that speaks the Model Context Protocol over Streamable HTTP, and writes each client's configuration. A key opens the MCP endpoint and nothing else, and reaches only the databases it was given, each to read or to change. Its tools list the databases, read their tables and structure, sample rows, explain a statement and run read-only queries inside the engine's read-only scope; where the key may change a database it runs one statement at a time, held to what its owner may run in the SQL editor. Protected databases are never reachable, results are bounded, and every call is in the audit log as the shape of its statement without its values. A key's databases can be changed without making a new one.
• Run PgBouncer in front of a PostgreSQL database from its Pooling settings
  • A one-click connection pooler in its own container on a private network with the database, published on this server only until the database is opened to anywhere under Network, which moves the pooler with it. Choose transaction or session pooling, the pool size and the client limit, and authenticate through a userlist kept in step with the connection's password or through auth_query. Connect shows the pooled string beside the direct one, a deployment variable can hold the pooled reference ${{database.ID.pooled}}, and the page reads the pools and statistics. The pooler starts, stops and is removed with its database.
• Enable, update and disable PostgreSQL extensions with their options, and load the ones that need it at start
  • Databases → Settings → Extensions lists extensions by what they are for, with what the server's image does not ship and which have a newer version, searchable and filtered by category. Enabling one chooses its version, its schema and CASCADE for what it needs; an update goes to the server's default or another version it ships; disabling lists what depends on the extension before CASCADE can drop it too. Each shows its statement before it runs. An extension such as pg_cron, pg_stat_statements, TimescaleDB or auto_explain, which works only once the server loads its library at start, is enabled in one dialog: the library is added to shared_preload_libraries with every library already there kept, the server is restarted when you say so, then the extension is created.
• Count a new PostgreSQL server's statements from its first start, and turn the statistics on for one that never loaded them
  • Every PostgreSQL template, pgvector, PostGIS and TimescaleDB among them, now starts with pg_stat_statements loaded and the extension created in its new database, so Performance ranks statements at once; TimescaleDB keeps its own library beside it, and the list stays one the Parameters page can change. Logging the plan of every statement slower than a second (auto_explain) is a choice when the database is created. On a server that never loaded the module, Turn on statement statistics adds it to the libraries the server loads at start, keeping the ones it has, then asks before restarting the server and creates the extension once it answers again; where the dashboard cannot restart the server, it says where that happens instead.
• Keep a database to a list of allowed addresses, or publish it on one address of the server
  • A database's Network settings offer four answers: this server only, one of the server's tailnet, VPN or local-network addresses, a list of allowed addresses, or anywhere. The list takes IPv4 and IPv6 addresses and networks, and the server's own gateway table refuses every other address before Docker forwards the connection, which a firewall rule alone cannot do for a published port. The firewall gets a rule for each listed address, the change is shown with the exact rules before it runs, the picture draws who may connect and who is refused, and every change is in the audit log.
• Tell your notification channels when a database stops answering, fills its disk, runs out of connections, falls behind or misses a backup
  • A database's new Alerts page holds rules for that database or for every database: the server not answering, the disk its data is on, its connections against its limit, replication lag, and a backup job that failed or has not succeeded by its time. Each rule has its line, how long it must hold, a cooldown and whether its recovery is told, and reaches the webhook, Discord, Slack, Telegram and e-mail channels the deployments already use, with a test from the rule's menu. Rules are judged on the activity recorder's thirty-second reading and the backup runs, a reading must fall a margin under the line before it recovers, and the page lists what was told lately.
• Run stored procedures, triggers and PL/SQL blocks from the query editor
  • The editor and the server now end a statement where its engine does: MySQL and MariaDB scripts with DELIMITER, or a procedure as SHOW CREATE prints it; SQLite triggers; SQL Server batches separated by GO, with GO 3 running a batch three times; Oracle PL/SQL blocks, procedures and packages ended by a / line; and PostgreSQL functions with BEGIN ATOMIC bodies. Running the statement under the cursor sends the whole body, the strip says which lines it covers and warns when a block runs on to the end of the text, Format leaves separators and bodies as written, and an Oracle procedure that does not compile fails with the compiler's errors. A statement with a body is never treated as a read, so a protected connection refuses it.
• Claim a stream's idle pending entries in one step
  • Databases → Keys → a stream's consumer groups hands everything pending longer than a number of minutes to one consumer, a hundred entries a press, on servers with XAUTOCLAIM. A single entry's claim and a hash field's expiry now go through their own routes rather than the console's.
• Encrypt backup archives, with a key you can export
  • A backup job can seal its archives with age before they are written to disk, S3 or Backblaze B2, and a new job that writes to a bucket does unless told otherwise. One backup key, sealed with the master key, opens them: restores, database restores, recovery checks and downloads decrypt them on the way, and archives taken before keep restoring as they were. Backups → Backup key exports the key behind a confirmation, recorded in the audit log, so an archive also opens with the age command where the dashboard is not.
• Try an index on a PostgreSQL plan from the Explain view, and list SQL Server's missing indexes on request
  • What if? on a plan proposes indexes for the columns it filters, joins and sorts on, skipping any an existing index already leads with. It then tries one with HypoPG, planning the statement again beside the plan without it, so the cost before and after sits side by side. Nothing is created: the real CREATE INDEX CONCURRENTLY is offered only on a click, shown before it runs. A server without the hypopg extension says so. On SQL Server, Missing indexes lists what the optimizer has wished for, with the CREATE INDEX each implies. Both are tools the reader presses for; the Advisor's automatic findings stay removed.
• Upgrade a PostgreSQL server to a newer major release, and revert it
  • Databases → Settings → Version checks a newer release of a server Databases started before anything changes, then copies its roles, databases, extensions and parameters into a new server beside it, counts every table, and puts the new server in its place under the same name, port and password, so connections and deployments keep working. The old server is kept, stopped, until the upgrade is finished or reverted, and an upgrade that fails, or a dashboard that stops in the middle of one, puts the old server back.
• Scrape database metrics with Prometheus
  • Databases → Metrics export gives the address of a Prometheus endpoint that serves the recorded activity of every database, one set of series per connection labelled with its driver, name and id, with a scrape config to copy. It answers only to an API key, and a key can be made there that is limited to reading these metrics and nothing else.
• Start PostgreSQL 18 by default, and a full PostgreSQL built on the server with seven extensions
  • New PostgreSQL, pgvector, PostGIS and TimescaleDB servers start on 18, which keeps its data in the volume where the image expects it. PostgreSQL full is the official image with pgvector, PostGIS, pg_cron, pg_partman, pgaudit, hypopg and pg_repack from the PostgreSQL project's own packages: its image is built on the server the first time, with the build's output shown, and pg_cron and pgaudit are loaded at start. TimescaleDB is pinned to 2.30.2, and MySQL 9.7, MariaDB 12.3 and ClickHouse 26.8 are offered.
• Show where a measured query plan spent its time and which steps the planner misjudged
  • Databases → Query → Plan draws each measured step's own time beside the time of everything under it, against the whole statement's, and can list the steps slowest first. A step whose rows came out ten times more or fewer than planned says so under its name, as "est 12 · actual 48,210 (×4,000)". Oracle's, ClickHouse's and an older MySQL's printed plans are drawn as the same tree.
• Ask an assistant in the SQL editor to write a statement, explain an error or a plan, or draft a row-level security policy
  • It is off until an administrator chooses who answers: Claude with an Anthropic API key, or an OpenAI-compatible server such as a model on this machine; the key is sealed with the master key and checked before it is saved. The assistant is told the structure of the schema — names, types, keys and references — and sees rows only in a result attached to a question. What it writes opens in a tab or at the cursor and runs only with your own Run, and reading more tables waits for your Allow. It is refused on protected connections, and every question is audited with its connection, who asked and the tokens it cost.

Changed

• Show updates in a compact notice and a dedicated installation dialog
  • The update notice compares the installed and available versions, opens the installation progress in its own dialog, and leaves the complete patch notes on the Version page.
• Start the first-run question with the stable purposes and mark the experimental one
  • Ship apps (Deployments, Proxy & TLS), Run databases (Databases, Backups), Work on the server (the Workspace tools), Manage containers (Docker) and Secure the server (Security) are chosen to begin with; Route the network (Network) is marked Experimental, working but still being tested. Every section belongs to one purpose only, so each choice adds something, and Packages, System users and the audit log stay in every answer. Account → Workspace shows the same purposes beside the sidebar itself, with a switch on every section it can hide.
• Redraw the account pages without tiles, as pictures of what is signed in
  • Profile wires every session and your own API keys into your face, with what guards it, and shows the three roles as a ladder lit up to yours. Sessions draws each session through the network it came in on to the server. API keys draws each key, as the product that holds it, through its role into the API, with chips for keys used this week, never used or about to expire. Every picture is drawn at the size of the one on Configuration, with a label over each name and the address under it. Users opens on the accounts and how many a password alone opens, straight over the accounts themselves. Security opens on what a sign-in passes, with an amber line past a missing second factor.
• Count backups and certificates on one bar instead of a track under every row
  • Databases → Backups shows how many databases were backed up today, this week, over a week ago or never on one bar, over a single line per database with the age of its newest dump. Proxy → Sites → Certificates counts valid, due for renewal and expired the same way, over a line per site with its days left.
• Draw the Databases pictures like the Configuration stack
  • The control center's picture of what the databases feed and the map use full-size marks, a wide lane for the wires, lanes centred on each other and state dots on the marks, without the dotted background. Databases nothing reads are listed as links under the picture.
• Draw every wiring picture without the dotted background
  • The pictures on Configuration, Proxy, Docker, Databases, Backups, Network, Security, Remote desktop, Account and Deployments stand on the page's own background. The database diagram and Stickyboard keep their grid settings.
• Keep database activity for 7, 14, 30 or 90 days
  • Databases → Metrics export chooses how long the recorded activity is kept, with the space each window takes. Readings older than a week are thinned to the last of every five minutes so a long window stays small, and the activity charts offer the longer ranges. Choosing a shorter window deletes the history outside it.
• Say how long each database release is maintained
  • Add a database says beside each release when its support ends, and keeps the releases already past it, such as MySQL 8.0 and MariaDB 10.6, behind Older versions. A database's Home and General settings say the same beside its version. Databases already running on any release keep working.

Fixed

• Keep an Oracle import going past more than a few refused rows
  • An import into Oracle that was told to skip bad rows lost its connection when its first several rows were refused (ORA-03138), and imported nothing. Each refused row's statement is now prepared again before the next row.
• Count a backup job's run as a database's last backup
  • The Databases cards, table and Backups band, and the last dump a database's delete confirmation names, take the later of its newest dump and the newest successful backup job run that dumped it, so a database a nightly job protects is no longer shown as never backed up or a week old.
• Show a deployment as the reader of the database it reaches through a published port
  • Databases → What they feed and the map now recognise a deployment whose connection string names this server's own address with the database's published port, and draw a deployment's release as its project. The dashboard's own PostgreSQL sessions are no longer drawn as this server reading every database.
• Stop offering browser profiles and temporary files as databases found on the server
  • SQLite files inside browser or browser-automation profiles and temporary directories are counted under Kept by other programs. Found servers are listed in the order they can be connected, and a file row shows the folder it is in.
• Open the Databases page without waiting for the server to be re-scanned
  • The fleet reading answers from the last inventory of the machine and refreshes it in the background, and returning to the page draws the last reading at once while the new one loads.
• Describe the Redis backup as what it is
  • A Redis dump is the dashboard's own gzipped JSON Lines of each key's DUMP payload, which only the dashboard restores. The backup job form and the documentation no longer call it a snapshot or an RDB file.
• Keep the dashboard's own database from being corrupted by another program reading it
  • Reading the dashboard's database file outside SQLite, as the Databases page's file scan did with its first bytes, released the locks SQLite held on it. A sqlite3 shell or another program that opened the database afterwards could then delete its write-ahead log while the dashboard was still writing through it, leaving a table unreadable, and Deployments → Credentials answered Internal error. The dashboard now holds a lock no other read can release for as long as its database is open, and the scan no longer reads the dashboard's own database.

Removed

• Remove automatic attention panels, issue badges and settings recommendations
  • Docker, databases, security, deployments, proxy, networking, backups and PM2 keep their operational readings and controls without proactive advice panels. The database Advisor page and recommendation comparisons in SSH, kernel protection and nginx settings are removed.
• Retire advisory detectors and their API endpoints
  • Docker diagnosis/anomalies, security posture, database Advisor, optional project checks, certificate hygiene and proxy finding snoozes are removed. Network attention collection no longer runs in the background. Existing database migration entries and historical records remain compatible with upgrades.

0.7.4A shorter first sign-in

Released 12 October 2026 · On GitHub

The question a new account is asked after its first sign-in is one screen now, and its answer is the next. Pick what the server is for from big cards, press Continue, and the server appears wired to each purpose you chose, with one button to the dashboard. Choosing sections one by one has moved out of the first sign-in to Account → Workspace, where it always was.

Changed

• The first-run question is two screens instead of three
  • The purposes are big cards with nothing beside them. Continue saves your sidebar and shows your server in the middle of the screen, each purpose you chose drawn around it, with Go to dashboard under it. The screen of fifteen section switches is gone from the first sign-in; Account → Workspace still has it.
• Account → Workspace draws the sidebar preview without a label

0.7.3A first sign-in that fits the sidebar to what you use

Released 12 October 2026 · On GitHub

Every new account is now asked, once, what it will use the server for, and its sidebar, Overview and search keep only those sections. A hidden section is out of the sidebar, never out of reach: links from other pages still open it, search still finds it, and the role still decides what the account may do. Account → Workspace changes the answer or asks the question again, and accounts that existed before this release keep every section.

Added

• New accounts are asked what the server is for after their first sign-in
  • Shipping apps, running databases, containers, the network, security or working on the box, each drawn as the products it means: any number of them, with what the server already runs chosen in advance and the server drawn wired to each one picked. The answer becomes the sections themselves beside a preview of the sidebar they draw, and Finish saves it to the account, so it follows the person to every browser. Show me everything hides nothing.
• Account → Workspace chooses which sections the sidebar shows
  • The same sections and preview after the fact, and Ask me again goes back to the question. Overview, Monitoring and Settings are always shown, and a section the role cannot open is not offered.

Changed

• A hidden section stays one link or one search away
  • A link into a hidden section, such as a deployment's domain opening its proxy site, still opens it; the sidebar shows the section while you are in it and offers to keep it. Search lists hidden pages as soon as you type, and the Overview leaves out a hidden section's tiles and the reads behind them.
• Sign-in is redrawn, and fits a phone
  • One card, with the server and the products it runs drawn beside the form on colour instead of a grid. The steps it shows are the ones your account actually has, Forgot it? gives the command that resets a password on the server, and a password you are asked to change signs you straight back in.
• The first-run question fits a phone
  • Purposes are rows rather than tiles, each step's button stays at the foot of the screen, and the last screen puts the count and Open the dashboard on one line instead of a row of its own.

Fixed

• A password set from the server is not asked for again at sign-in
  • scripts/reset-password.sh and scripts/create-user.sh set the password the account signs in with. They marked it temporary, so the dashboard demanded a new one the moment you signed in with it.

0.7.2Stickyboard, an uninstaller, and findings that lead to their fix

Released 12 October 2026 · On GitHub

Stickyboard adds endless boards of sticky notes that link, group into sections and autosave, beside Excalidraw's drawings. Configuration can now uninstall the dashboard, keeping its deployments and data for a reinstall or wiping them. Findings across Docker, Databases, Deployments, Network and Proxy keep only what needs attention and each action opens the control that fixes it. A pull blocked by local changes or root-owned folders offers the ways past it, log panes share one filter row and time window, and the dashboard spends far less work in idle and hidden tabs.

Added

• Stickyboard: endless boards of sticky notes that link, group into sections and autosave
  • A new Workspace page lists every board as a picture of itself and creates boards blank or from a Kanban, retrospective or mind-map template. Notes take Markdown with tickable tasks, nine colours, sizes and typefaces, links are dragged between notes with labels and arrows, and sections carry their notes, with undo, find, clipboard and keyboard shortcuts. Each save is checked by the server and guarded by a revision.
• Uninstall the dashboard from its Configuration page
  • The Danger zone asks one question: keep the deployments, data, backups and key for a reinstall, or wipe the deployments and the dashboard's data, and the backups only when asked and after the server's name is typed. The stack is taken down by a sibling container that writes its transcript to /var/log/just-dashboard-uninstall.log, and a kept install is restored by install.sh on a fresh clone.
• A blocked pull offers the ways past it
  • When local changes or folders owned by another account stop a pull, Git shows what is in the way and offers to stash, discard or give the folders back, each as one step that pulls afterwards. A self-update hands back to the checkout's owner whatever it wrote as root, so the next pull is not blocked by it.

Changed

• Findings keep what needs attention and lead to the control that fixes it
  • Attention lists on Docker, Databases, Deployments, Network, Proxy and Security keep critical and warning findings, show the problem and its consequence before the evidence, and name each action by where it goes. Routine advice stays in the settings or reports it belongs to, and certificate, backup and MongoDB cache wording says only what is known.
• Every log pane has one filter row and one time window
  • Search, Live or a typed span, levels, fields and quick views share one row, and a pane's commands sit after its views as icons. Request Insights counts distinct visitors apart from bots and scripts, and Network DNS, VPN and Interfaces, a deployment's output and a site's upstream gain the logs that belong to them.
• Databases, Boards and Proxy open on what they hold
  • The Databases control center opens on the server's databases as one line, a band of storage, sessions and backups, and cards in each database's hue. Boards is named after Excalidraw, with /boards redirecting to /excalidraw, and its cards are previews of each drawing. The proxy overview counts the Docker Caddy ingress's requests, so Traffic and Live traffic are no longer empty on a host where it holds ports 80 and 443.
• Notable moments group into incidents that pin the charts
  • Metrics gathers notable moments into incidents that pin the charts to their window, with zoom as its own action, and the scanners notice ranks the addresses and the paths they tried, with Block in a column of its own.
• The dashboard does less work while idle, and builds its images one at a time
  • The network-change banner, live metrics, RecentJobs and reconnecting sockets stop spending requests and renders in idle or hidden tabs, sign-in hashes use far less memory, and an idle job queue no longer takes the database's write lock. install.sh, the updater and Settings' rebuild build one service at a time, so the frontend's and backend's compile peaks no longer add up.

Fixed

• A live preview offers Visit at its own address
  • A preview run was compared with production's live release, so every live preview read as superseded with no address. It now reads its own live release and address, and the run header names its PR environment.