console.git/statuspage, branch master

Document abbreviate_rule's nat/rdr blind spot and ddclient's log gap

2026-07-01T10:11:15Z

From a fresh-agent review of AGENTS.md against two hypothetical tasks: - abbreviate_rule() in pf.sh has only ever been developed/tested against filter-rule (-sr) syntax, despite also running on -sn (nat/rdr) output. It degrades safely (unshortened passthrough) but a new nat/rdr rule shape isn't guaranteed to compress as tightly - noted both in the code comment and in AGENTS.md's compression writeup so this doesn't need rediscovering. - ddclient logging isn't enabled on the box, so "is the last DNS update actually succeeding" can't be built by tailing a log that doesn't exist - it'd need the cache file or a public-IP comparison instead. Recorded in AGENTS.md's topology section since ddclient.sh currently only checks the process is running, not update success. Co-Authored-By: Claude Sonnet 5

Fix clock offset extraction dropping positive values

2026-07-01T09:35:27Z

ntpq's "rv 0 offset" prefixes non-negative offsets with an explicit "+" (e.g. "offset=+0.030208"), which wasn't in the sed capture class ([-0-9.]). Since the capture group is starred, the regex still "matched" with an empty capture instead of failing outright, silently producing "no response" for every positive/zero offset while negative ones (which do use "-", already in the class) worked fine. Confirmed against the real box: earlier renders with negative drift worked, then it started showing "no response" once the drift crossed zero. Co-Authored-By: Claude Sonnet 5

Distinguish pf state-tracking modes with bracketed letter tags

2026-07-01T09:22:17Z

Previously "keep state" and "modulate state" both collapsed to the same generic "[state]" tag, losing a real distinction: modulate state hardens TCP ISN generation and synproxy state (not handled at all before) proxies the handshake against spoofed SYN floods - neither is just "some tracking is happening." Now [N]/[K]/[M]/[S] map to no/keep/ modulate/synproxy state respectively, documented in a comment since the mapping isn't self-evident without pf.conf familiarity. Considered thematic unicode symbols from the font's supported blocks (Mathematical Operators, Geometric Shapes) instead, but a bracketed letter is unambiguous without a legend - a clever but obscure glyph isn't actually more compact once you factor in "what does this mean." Co-Authored-By: Claude Sonnet 5

Sort pf rules by interface, iconify from/to, drop redundant nat prefix

2026-07-01T09:01:39Z

Filter rules now sort by (interface, in-before-out) rather than pfctl's raw eval order, which just reflects pf.conf's authoring order and reads as arbitrarily interleaved (an "out" rule sandwiched between unrelated "in" rules for the same interface). Display-only reorder - pf's actual evaluation order and quick/first-match semantics on the box are untouched, only the informational listing is re-sorted. Generalized the "from X to Y" abbreviation beyond the from-any-to-any- port special case, and replaced pfctl's own "->" (nat rewrite target) with the unicode arrow for consistency with the in/out arrows already in use. Also dropped the "nat: " prefix, which was redundant with the rule text already starting with "nat". Applied the same "->" -> "→" consistency swap to jails.sh's http child-row label. Co-Authored-By: Claude Sonnet 5

Abbreviate pf rule text so rows fit the column without wrapping

2026-07-01T08:46:33Z

pfctl's verbose syntax (flags S/SA, quick, from any to any port = X, proto tcp/udp/icmp) was overflowing the .section column width and wrapping mid-rule. abbreviate_rule() in pf.sh strips the near- universal boilerplate tokens on this ruleset and swaps in/out for arrows - cuts each rule to roughly 35-45% of its original length. Deliberately not a real pf syntax parser: it's a handful of targeted sed substitutions, so a rule shape it doesn't recognize just passes through unshortened rather than mangling. Only uses the Arrows block (confirmed shipped in the scientifica font) - avoided Dingbats (checkmark/X) since that block isn't included in this font. Co-Authored-By: Claude Sonnet 5

Add scientifica bitmap font and wire it into the status page

2026-07-01T08:46:11Z

Bundle scientifica.ttf/Bold/Italic in statuspage/fonts/ (dropped the .bdf/.otb variants - those are X11/console bitmap formats, browsers can't load them via @font-face). Mark font extensions as binary in .gitattributes so git never attempts CRLF conversion on them. render.sh now symlinks fonts/ into the Caddy-served output directory on every run (idempotent) since Caddy serves /usr/local/www/status, not this checkout - the font file has to physically exist next to index.html for the browser to fetch it. Also: fixed bad kerning/cramped line spacing from an earlier attempt at applying the font's recommended Terminal.app settings (which don't translate 1:1 to CSS), and added a hanging indent (.label class, text-indent + padding-left) so long wrapped label text - notably pf.sh's rule listing - aligns under the label instead of the status square when it wraps to a second line. Co-Authored-By: Claude Sonnet 5

Say "never scrubbed" instead of "unknown" for pools with no scan history

2026-07-01T08:12:46Z

Confirmed against the real box: a pool that's never had a scrub or resilver has no `scan:` line in `zpool status` output at all - it's not omitted due to a parsing bug, there's just nothing to report yet. "unknown" wrongly implied a parse failure. Co-Authored-By: Claude Sonnet 5

Fix uptime to include hours/minutes, add a purple/gold theme

2026-07-01T08:08:29Z

hw.sh's uptime was parsed from `uptime`'s text output, which cut off at the first comma - dropping the H:MM part entirely. It also never actually rolled over to months/years for long uptimes (FreeBSD's uptime just keeps growing the day count). Replaced with a direct `sysctl kern.boottime` computation for a fully deterministic "Nd Hh Mm" format. Caught a real bug along the way: the first attempt at the sed extraction grabbed `usec` instead of `sec`, since "usec" contains "sec" as a substring and the pattern wasn't anchored tightly enough. render.sh's palette now uses purple/lavender for headings and borders and a gold accent (title underline, value-column text), taking cues from reference character art. The green/yellow/red/gray status squares are untouched - they carry semantic meaning the color scheme shouldn't interfere with. Co-Authored-By: Claude Sonnet 5

Lay sections out in a multi-column flow instead of one long column

2026-07-01T07:58:34Z

pf.sh's rule listing made the page noticeably taller without using any of the available width. Wrap each section in a .section block and the whole set in a .cols container using CSS multi-column layout (column-width: 380px) - sections flow left-to-right/top-to-bottom across however many columns fit the window, each staying intact (break-inside: avoid) rather than splitting a table mid-page. Co-Authored-By: Claude Sonnet 5

Make the zpool check per-pool with capacity, scrub, and error status

2026-07-01T07:55:53Z

Replace the single "all pools are healthy" summary line with one row per pool (name, health, capacity) plus a scrub/errors row parsed from `zpool status `. A pool that's never been scrubbed but has no data errors still reports ok - lack of scrub history isn't itself a failure, only actual reported errors are. Co-Authored-By: Claude Sonnet 5