- Remove the animated neon edge-glow entirely (HTML element + CSS) — it
couldn't be made to follow the border reliably on iOS Safari.
- Add PFW_MCMS_URL: the web server prefills the login "Host URL" field with
it (injected as the input's value in the served index; still editable).
Documented in env.example + web README.
- Remove the "Accept self-signed TLS certificate" option: the checkbox is
gone and both backends now always use rejectUnauthorized:true — MCMS must
present a valid certificate. Dropped the acceptSelfSigned plumbing from the
renderer and both login handlers.
Docs: CLAUDE.md (drop edge-glow section, update login note) + web README.
Verified: node --check; no stale refs (in-self-signed / acceptSelfSigned /
edge-glow / beamspin); served index carries value="…" only when
PFW_MCMS_URL is set, and no self-signed checkbox.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds web/deploy/install.sh — full LXC setup in one command. It derives the
repo path from its own location (clone anywhere; /opt/ponfw recommended),
installs git/node/npm if missing (checks Node >= 18), creates the ponfw
service user, runs npm install --omit=dev, writes /etc/pon-fleet-web.env on
first run, and installs+enables the systemd unit with WorkingDirectory set to
the checkout. Idempotent; warns if cloned under /home (ProtectHome blocks it).
README + CLAUDE.md §16 updated to lead with install.sh and clarify the clone
location.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Caching (reduce MCMS API load with multiple operators):
- web/cache.js: in-memory TTL cache with single-flight, keyed by MCMS host.
Concurrent identical bulk reads collapse into ONE upstream fetch; everyone
on the same MCMS shares the snapshot.
- Wired into the bulk reads only (ONU/OLT config+state lists, controllers,
firmware). Per-ONU read-modify-write and the FEC pre-flight stay live.
- Writes (delete / per-ONU + bulk upgrade / flood change / firmware upload)
invalidate the affected datasets for that host, so changes show on the
next load instead of waiting out the TTL.
- PFW_CACHE_TTL_SECONDS (default 60, 0 disables). Authenticated
_cacheStats / _cacheClear endpoints for ops.
Deploy (Debian 13 LXC, clone-to-run) in web/deploy/:
- pon-fleet-web.service (runs as unprivileged ponfw, hardened, repo
read-only, no disk writes), pon-fleet-web.env.example, update.sh
(git pull + npm install --omit=dev + restart; uses install not ci since
package-lock.json is gitignored).
- README: full LXC setup, Nginx Proxy Manager proxy-host + access-list
notes. Streams already send X-Accel-Buffering: no so NPM/nginx don't
buffer the NDJSON progress.
Verified: node --check; cache unit-tested (single-flight, TTL hit/expiry,
fresh, invalidate, key isolation, disable — 9/9); server boots and reports
the cache TTL; _cacheStats gated to logged-in sessions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
New web/ subfolder: a Node http server that serves the SAME tooling as the
Electron app to any browser, with per-session MCMS credentials so several
operators can use it at once behind a TLS reverse proxy. Mobile-responsive.
Not a fork — it reuses the core and the UI:
- serves renderer/app.js + app.css verbatim and rewrites index.html on the
fly (mobile viewport + browser window.api shim + responsive overlay)
- web/public/api-web.js: a drop-in window.api over fetch + NDJSON streaming;
Electron file dialogs -> <input type=file>, CSV-to-Downloads -> Blob
- web/server.js: per-session McmsClient (cookie pfw_sid), idle expiry,
routes mirroring the IPC handlers, NDJSON for the 6 streaming ops
- pure Node http, no new deps (borrows ../node_modules tough-cookie)
Shared improvements (benefit both apps):
- src/dashboard.js: extracted, pure dashboard aggregation (main.js now uses
it); adds abnormal-Tx detection alongside abnormal-Rx
- renderer: dashboard health stats are now clickable — abnormal Rx / Tx /
lasers-off pop a list of the offending devices (like the iOS app), via a
new showListModal
Docs: web/README.md (run + reverse-proxy + security), CLAUDE.md §16.
Verified: node --check all; started the server and confirmed transformed
index, shared-asset serving, 401 auth gate, login (per-session client), and
NDJSON wiring; rendered login + dashboard drilldown + mobile over HTTP.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
