jd/meshberth
Watch
1
0
Fork
You've already forked meshberth
 0
Code Issues Pull requests Projects Releases 1 Packages 2 Wiki Activity Actions
1 release 1 tag
  • v1.0.0 3d939b5457

    v1.0.0
    All checks were successful
    build / release (push) Successful in 10m5s
    Details
    Stable

    jd released this 2026-07-13 17:38:41 +00:00 | 1 commits to main since this release

    First public release.

    Added

    • First-run setup wizard: detects whether ZeroTier is installed, starts the
      service (elevated), and grants MeshBerth read access to the node by
      bootstrapping a user-readable copy of the auth token — mostly automated,
      with at most one elevated prompt per step. MeshBerth manages the ZeroTier
      service but never installs ZeroTier itself.
    • Dashboard: node ID, online status, and version, plus service start / stop /
      restart controls.
    • Networks: list joined networks, join by 16-digit network ID, leave (with
      confirmation), and per-network detail (assigned addresses, managed routes,
      DNS, type, device, MAC, MTU) with the four client-side toggles
      (allowManaged, allowGlobal, allowDefault, allowDNS); click-to-copy
      network IDs.
    • Optimistic UI updates on Networks: the client-side toggles and leave settle
      from the backend's immediate response instead of waiting for the next poll tick.
    • Advanced page for node connectivity settings (primary/secondary/tertiary
      ports, port mapping, TCP fallback relay, force TCP relay), applied via an
      elevated, merge-safe local.conf edit and service restart.
    • Looking Glass: an aggregated IPv4/IPv6 route table across all joined
      networks, with sortable columns and an instant keyword filter.
    • Peers view: reachable nodes with role (planet/moon/leaf), latency, and
      direct/relayed paths.
    • Moons: list, orbit, and deorbit external ZeroTier roots from a dedicated
      Moons page, via the local /moon API (no elevation) — for extra
      coverage/resilience or a self-hosted backend.
    • Help page: a plain-language glossary of ZeroTier terms (VL1/VL2, planet,
      moon, root, controller, leaf, managed addresses) plus a note that classic
      ZeroTier One (VL1/VL2) provides no forward secrecy, recommending end-to-end
      encryption inside the tunnel for sensitive traffic.
    • About page: version, license, and a plain-language summary of what
      MeshBerth talks to (and doesn't).
    • Light/dark theming that follows the system by default, with a manual
      override in Settings.
    • Instant keyword filtering on the Networks, Peers, and Looking Glass lists.
    • Sortable columns on the Peers list (Node, Role, Latency, Best path) — click a
      header to sort, click again to reverse, matching the Looking Glass table.
    • Settings: adaptive refresh intervals (faster while the window is visible,
      slower when minimized to the tray), persisted locally.
    • System tray showing connection state with per-network quick disconnect;
      closing the window minimizes to the tray and keeps the app running. The tray
      icon is status-aware — its color reflects node state (online / degraded when
      relayed / offline).
    • Startup behavior: start on login, start hidden, and show a tray icon — three
      independent Settings toggles, all off by default. Enabling "Start on login"
      for the first time also enables the other two so it behaves like a proper
      background app; MeshBerth never starts hidden without a reachable tray.
    • Desktop notifications for node up/down, network join/leave, removal from a
      network by its controller, and relay changes — a master
      switch plus per-event toggles in Settings, all on by default, with
      startup-baseline suppression and per-event rate limiting.
    • Desktop notifications for a network's client-setting changes (managed
      addresses, global routes, default route, DNS) and for assigned
      IP-address changes (v4/v6) — each a per-event toggle in Settings.
    • Connection-state banners for service-down and authentication failures, with
      one-click recovery actions; last-known-good data is shown with a staleness
      indicator rather than blanking the UI.
    • Linux packaging: AppImage, deb, and rpm bundles.
    • Containerized build environment (ci/Containerfile) that doubles as the CI
      job image, so the developer host needs no toolchain installed.
    • Documentation suite under doc/ (architecture, build, first-run setup,
      configuration, troubleshooting, features, tech stack, ZeroTier service API,
      theming, contributing, dependency policy).

    Changed

    • Rebuilt the interface with a distinctive visual identity (the "Harbor"
      design).
    • Enforced code documentation and linting across the codebase, gated in CI:
      #![warn(missing_docs)] on the Rust crate (all public items documented) and
      ESLint (TypeScript / Svelte / JSDoc) alongside svelte-check. Coding standards
      are documented in doc/DEV-GUIDELINES.md.

    Fixed

    • Desktop notifications now reliably display. The notifier reuses a single
      session D-Bus connection — a fresh per-notification connection was dropped the
      instant Notify returned, so GNOME withdrew each notification before showing
      it — passes an embedded icon and a desktop-entry hint, and keys a setting's
      enable and disable separately so opposite toggles no longer rate-limit each
      other.
    • Peers with duplicate path endpoints could fail to expand; each peer row now
      expands independently of its paths' contents.
    • An empty secondary-port field on the Advanced page is now treated as 0
      ("auto"), not null — it no longer silently blocks Apply.
    • Applying node connectivity settings now reports success from the apply
      itself; the best-effort refresh immediately after (which can race the
      service restart and briefly fail) no longer surfaces as an apply error.
    • Long lists (Networks, Peers, Looking Glass) no longer clip against the
      bottom edge of the window on scroll — a trailing spacer and fade soften the
      edge instead.

    Security

    • Elevated local.conf writes now stage the merged file in a private, 0700
      directory ($XDG_RUNTIME_DIR, falling back to a meshberth subdirectory of
      the cache dir) under a random, O_EXCL name before the elevated copy, and
      remove it afterward — closing a TOCTOU window where another local user
      could pre-plant or symlink-swap a predictably-named staged file while the
      elevation prompt is pending.
    • Responses from the local ZeroTier API are now capped at 512 KiB (checked
      against Content-Length and while streaming) so a hostile process squatting
      on the ZeroTier port can't OOM the poller with an oversized or unbounded
      body.
    • Enabled a strict webview Content-Security-Policy (default-src 'self',
      scoped connect-src/img-src/style-src/script-src) instead of running
      with CSP disabled.
    • Refuse to send the ZeroTier access token when a non-root process holds
      127.0.0.1:9993 — closes a token-disclosure window if the service is
      stopped and a local user squats the port.
    • Pinned all Rust and npm dependencies to exact versions and added a
      cargo-deny supply-chain gate (advisories, license allow-list,
      crates.io-only sources, banned wildcards); tightened CI workflow
      permissions to least privilege.
    Downloads