-
v1.10.0
StableSome checks failedCI / Check, test and build (push) Has been cancelledDocker Release / build-and-push (push) Successful in 4m20sRelease / Build & Release (push) Successful in 4m44sRelease / Trigger retention prune (push) Successful in 3sRelease / Rebuild the website (push) Successful in 3sk4wit0 released this
2026-11-03 03:55:07 +01:00 | 2 commits to main since this releaseDocker, Proxmox and the status page, rebuilt; sign-in brought up to date
1.10 gives Docker, Proxmox and Monitoring a page each, built on one shell and read the same way; makes sign-in stronger and lets the administrator decide what each account may use. Nothing needs doing on upgrade: your sessions, boards, widgets and hosts carry over, and what an account could reach before it still can.
Added
- A Docker page, with an overview of every host (what is running, what needs attention, CPU and memory against the real size of the host, what Docker holds on disk), an inventory of all the containers, and a side panel for each one: how it is set up, its health, its log, which can follow live. A container can have an icon and a bookmark of its own. Details and logs on an agent host need Lastboard Agent v1.3.0 or later.
- Proxmox tasks and system log: a node's and a machine's recent tasks with each task's log, and the node's system log, in the rebuilt Proxmox page (overview, machines, storage, tasks, system log, side panel).
- A status page rebuilt on the same shell: an overview with four indicators, a chart and an attention list, services as cards or a list, and an outages tab by service, each opening a side panel with its outages, checks and latency chart. Outages read in words and minutes.
- The three tiles share one look: a line of totals under the name, a row per item with its icon, name and readings, and a foot with the count and a link to the page. CPU, memory and disk (CPU and memory for Docker) can be turned on and off one by one, and the link can be hidden. A click on a row opens that item's side panel over the board; See all opens the page.
- Sign-in with an authenticator app (two steps, with recovery codes), with a passkey, and through an auth proxy in front of Lastboard for accounts that already exist.
- Active sessions: each account sees where it is signed in, closes one or all the others, and signing out ends the session everywhere.
- Permissions per account: when creating or editing an account the administrator chooses a profile (View only, Standard, Homelab) or each permission, and a label that replaces the role. The interface leaves out what an account may not use, and the server checks every request.
- Docker hosts belong to the account, set up once in Preferences, as Proxmox hypervisors do; each widget chooses among them. The first start moves the hosts that widgets had set up, tokens included.
- A Podman guide: Lastboard and the agent run on Podman, rootless, with Quadlet files.
- Proxmox: choose, rename and arrange the machines on the tile; each machine says what its own disk holds, where Proxmox says so; an uptime reads in days, months, then years.
- Back walks through a page's tabs and side panel before it leaves it. The three pages say how old their data is under the header.
Changed
- The Docker, Proxmox and Monitoring pages answer fast, however much there is: a host that does not answer is given six seconds and no more and the others draw as they answer; a service's history is read folded, so opening one costs a few kilobytes; the status page answers in tens of milliseconds, not seconds; Docker's CPU and memory are read at once, not at the daemon's pace. The pages pause their own refresh while the browser asks to save data and never start a round on top of one in progress.
- The tiles only read: starting, stopping and restarting is done in the item's panel, and the Docker tile no longer links a container's name to its service; the panel's Open service does, from the bookmark, or from a
lastboard.urlorhomepage.hreflabel, or the first published port. - A bookmark has one "runs on" field with a None / Proxmox / Docker switch and the list for the chosen one.
- Updated Go to 1.27.3, Bun to 1.4.4 and SQLite to 1.61.0, with the tooling of the build.
Security
- A credential no longer follows a redirect to another server. A write without
Sec-Fetch-Siteis refused when itsOriginnames another host. - A backup from a newer version, or without an administrator, is refused before anything changes.
- A read-only mount of the Docker socket does not limit what Docker can be told: the guides now say so, and recommend the agent for a Docker on another machine.
Fixed
- Proxmox: "See all" opens the page without leaving the board, and a chosen machine icon shows at once and can be removed.
- Nothing is asked about permissions before the account is known.
Downloads
-
v1.9.4 Stable
2026-10-15 12:35:41 +02:00 | 148 commits to main since this releaseAdded
- Docker and Monitoring: the containers and services in a widget can be arranged by hand. Each one has a grip in the widget's settings, dragged with the mouse or a finger or moved with the arrow keys. Docker keeps the order of each host apart, and a Monitoring list left fully ticked still takes the services you add later, shown after the ones you arranged.
- Docker: a Show new containers automatically switch. Turned off, a container that appears later stays hidden until you tick it, so a widget that shows only a few no longer has to hide every new one.
- The installer says which version is installed and which it is about to install, stops with "nothing to do" when you already have the latest, and takes
--reinstallto install it again to repair it.
Changed
- Every widget now shows its name as a pill on the tile's border, the way a section does, and a widget with no name shows no pill. The name is the first field of each widget's settings. Docker, Monitoring, Proxmox and the API widget no longer spend a row of the tile on a heading; Proxmox keeps a slim strip with the node and its meters.
- A Docker, Monitoring or Proxmox widget that had no title of its own keeps the name it showed, written once into its title in the language of the account that owns it. After that it is an ordinary title: change it or clear it. Restoring a backup taken by an earlier version does the same for the widgets it brings back.
- The name on a widget, and on a bookmark that shows its name as a pill, now answers the pointer the way a section's does: the border takes the accent softly when the tile is hovered, and only hovering the name itself lifts it further. It used to light up fully in the accent colour.
Fixed
- Docker: a container you had hidden came back, and lost its name and address, every time it was updated. What is set on a container is now kept under its host and name instead of its ID, which changes whenever the container is recreated. Settings saved before this are read as they were until the widget's settings are saved again; a container updated before that has to be hidden once more.
- Proxmox: only starting a machine and shutting it down gracefully are relayed, as the interface and the documentation say.
- The uninstall command in the documentation did not work when the installer had been piped from
curl; it now shows the form that does, and the signing guide says the installer verifies the release signature.
Downloads
-
v1.9.3 Stable
2026-10-14 21:20:12 +02:00 | 170 commits to main since this releaseA security and stability release
1.9.3 is about making what is already there harder to abuse and harder to break. It adds no features. It closes weak points in sign-in, sessions, updates, backups and the connections Lastboard makes, and fixes the ways data or settings could end up half-saved. Nothing needs doing on upgrade: your sessions, boards and settings carry over.
Security
- Sign-in attempts are counted reliably: a burst of wrong passwords that arrive at the same moment used to count as one, so the lockout never came. Changing your password, deleting an account and resetting the instance now stop after too many wrong passwords too, per account, so a stolen session cookie cannot be used to guess the password.
- A session belongs to the account, not to its name. A cookie left over from a deleted account can no longer sign in to a new account that reuses the name, and a stale session no longer sends the login page into a redirect loop. Cookies issued by earlier versions keep working until their owner signs out.
- Passwords are hashed at most two at a time, so a flood of sign-in attempts can no longer exhaust the memory of a small server. Passwords can now be up to 256 characters instead of 72 bytes.
- Connections to cloud metadata services are refused when they are made, so a redirect or a hostname that resolves there cannot reach them. A container id is escaped in the Docker path, and the Gotify token travels in a header instead of the address.
- Updates are verified more strictly: each download is checked against the line of the signed
checksums.txtthat names it, so one platform's archive cannot stand in for another's, a download over the size limit is refused instead of cut short, and each update works in a directory of its own with only one allowed to run at a time. - Restoring a backup ends every session without touching the signing secret, so a session opened afterwards survives a restart. After a restore, sign in again.
- Answers from a Docker host and from the release server are read up to a size limit. The dashboard background must be an image address, and an avatar or accent chosen at setup follows the same rules as one chosen later.
- The administration panel never changes the administrator's own password (that goes through the profile, which asks for the current one), and an unknown account or a taken name gets a clear answer. The browser no longer allows connections to a time-zone service it does not use.
Fixed
- A backup fails with an error instead of silently leaving out a row it cannot read. It keeps the order a phone shows bookmarks in, and restore errors are translated.
- Deleting a board is a single change that also sweeps its unused icons. A new board always goes after the last one, reordering with a partial list keeps every position distinct, and the first board of an account is created once even when several requests arrive together.
- Saving the monitoring settings is all or nothing, and a failure is reported instead of answering "saved". A preference that fails to save is rolled back everywhere, so the next save does not carry it. The dashboard background is kept when a request does not mention it.
- Deleting a bookmark no longer deletes the icons chosen for Proxmox machines, and storing icons locally no longer undoes an edit made while they were downloading. Credentials typed into a widget before a page reload are moved to the secret store when it is saved.
- Renaming yourself works with the default avatar. Saving a clock keeps its time zone. Board names (50) and project names (64) are counted in characters, so non-Latin names get the full length.
- With the server unreachable and nothing cached, the board is empty instead of showing a tile that is not yours.
- The "Check for updates" button asks the release server again instead of repeating the last answer, the release lookup gives up after fifteen seconds, and only the administrator asks for updates, once per page load.
- The background status check no longer reads every bookmark every fifteen seconds.
Changed
- Several Proxmox hosts are read at the same time instead of one after another, and Docker and Proxmox connections are reused instead of piling up.
- Widgets and pages that poll the server stop while the browser tab is hidden and resume when it is shown.
- The interface holds one HTML escaper and one place that reads API answers and errors, and styles and code nothing used were removed.
-
v1.9.2 Stable
2026-10-12 11:42:49 +02:00 | 230 commits to main since this releaseA new logo
Changed
- A new logo: a viewfinder around the board, with a red dot as the signal. It is the one in the browser tab, the installed app icon, the login and setup pages, the top bar and About.
-
v1.9.1 Stable
2026-10-12 09:55:06 +02:00 | 240 commits to main since this releaseDocker installs are told about new releases
Fixed
- A Docker install is told about a newer release, and every administrator's load checks
-
v1.9.0 Stable
2026-10-11 20:01:33 +02:00 | 245 commits to main since this releaseServers beyond this one, secrets kept apart, and accounts of their own
Added
- A host's agent token is kept in the widget's secret store
- A widget can wear a title on its border, the way a section does
- Monitoring and Proxmox belong to each account, not to the server
- Read another server's health from Glances, Netdata or a JSON endpoint
- Rename and delete live in the manager, beside the drag handle
- The API widget keeps its credentials in the secret store
- The Server Health widget can show another server through Glances, Netdata or JSON
- The Server Health widget refreshes every 5, 10, 30 or 60 seconds
- What a widget keeps secret is stored apart from its content
Fixed
- Editing an imported bookmark keeps its icon
Changed
- Go 1.27.2 and x/net 0.60.0, and the vulnerability scan stops a release before it is tagged
- Update the toolchain and dependencies
-
v1.8.4 Stable
2026-10-05 16:27:51 +02:00 | 261 commits to main since this releaseSecrets you can tell are saved but never see
Fixed
- The alert token shows as dots and is never sent back
- The Proxmox token secret is shown as dots, with nothing to reveal
- The side panel's close button sits on the header's centre line
-
v1.8.3 Stable
2026-10-04 23:11:50 +02:00 | 269 commits to main since this releaseA steadier checklist, a working side panel and Ctrl+K everywhere
Added
- Ctrl+K and Cmd+K reach the search box on the status and Proxmox pages
- The note and the markdown tile wear a thicker accent border while open for writing
Fixed
- A checklist box keeps the caret behind it, and every row sits the same distance apart
- The side panel's chart fits its card and its tooltips show
-
v1.8.2 Stable
2026-10-02 09:40:59 +02:00 | 277 commits to main since this releaseNotes that stay current, a Ctrl+K search shortcut and steadier status dots
Added
- Ctrl+K and Cmd+K put the cursor in the search box
- Icons become real logos on import, travel inside the export, and the format is detected
- The settings show which release each agent host runs
Fixed
- A dot that is already green stays green while it is checked again
- Attribute gopkg.in/yaml.v3 and drop x/exp, with a test that asks the linker
- Container names stay visible when the widget is narrow
- Importing a file builds the dashboard instead of failing on an empty one
- Nothing under /api/ may be kept by a cache
- Reach an agent behind HTTPS, and say so when it refuses the token
- Read Homepage nested groups and real-world files, and say what is left out
- Speedtest Tracker, Prowlarr and Nextcloud presets are no longer beta
- The agent token no longer travels in the request URL
- The native export keeps the groups of a board
- The note follows the board, and saving over someone else's edit asks first
-
v1.8.1 Stable
2026-09-30 20:03:44 +02:00 | 296 commits to main since this releaseA backup only you can open
Added
- Protect a backup with a password: set it when you download, and it is asked for when you restore
- The backup now carries the Proxmox hosts with their tokens, and the monitoring settings with the notification token, so a restore no longer leaves them to be typed again
- Passwords are hashed with Argon2id; an account from an earlier version moves over the next time it signs in, with nothing to reset
Fixed
- A click in the empty space inside a dialog no longer closes it and throws away what was typed
- Shrinking a section moves out the items that no longer fit, instead of squeezing them below its edge
- Under Podman, the in-place update is no longer offered inside the container