[cameronrye]

The website pages for Phase 3b (service hardening, secure defaults, config files and deployment): the deployment guide, the security, WebSocket API and Home Assistant pages, the CLI commands page, the installation page and the home page, rewritten for 0.3.0.

Draft until 0.3.0 is released. Merge right after the 0.3.0 release commit, as 0.2.1's website update did. The site is published from main on every push, and these pages describe what 0.2.1 doesn't have: aranet.service running as a dynamic user, /var/lib/aranet/server.toml, the Host and Origin checks, the refused unauthenticated network bind and the unprivileged Docker setup.

What is in it

Two commits on top of main, which now has all of Phase 3b (#12 and #11). Both touch only files under website/.

• 0b18314, the pages: seven files (service/deployment.mdx, service/security.mdx, service/websocket-api.mdx, service/home-assistant.mdx, cli/commands.mdx, installation.mdx and index.mdx).
• b51d112, the corrections from the final review of Phase 3b, in four of those pages:
  • The sample server.toml no longer turns retention on. Its three [storage.retention] lines are commented out. Copied as it was, the sample deleted every reading older than 90 days, and cached history older than 365 days, at the first start.
  • aranet server is not "the same service". The released aranet CLI runs the API, the dashboard, the WebSocket, /metrics, webhooks, InfluxDB export, mDNS and retention. MQTT (and so Home Assistant discovery), the Prometheus push gateway and desktop notifications need aranet-service built with --features full, or the Docker image. The Home Assistant page names the build and has a new troubleshooting section, "Nothing is published".
  • Retention applies to everything in the database, including readings the CLI, TUI and GUI stored there.
  • The GUI and config.toml. The commands page no longer says the GUI changes only the keys it touches. The GUI saves its own settings, never changes service_url or service_api_key, can overwrite other [gui] edits made while it runs, and leaves a file that doesn't parse untouched.
  • System service. The upgrade steps from a 0.2.x root service are for one time and end with an eighth step. The page also covers the restart after a re-install, a config outside /var/lib/aranet, the --database refusal, /etc/default/aranet, and removing a LaunchDaemon that 0.2.x installed on macOS. The unit file comes from a clone of the repository.
  • Docker. What the /run/dbus mount grants; an image built from an edited docker/server.toml contains its secrets; the writable config copy is owner-only after the first write; a second --config stops the container; stop_grace_period: 30s in the sample compose file.
  • Sinks. Webhook and InfluxDB requests do not follow redirects, and InfluxDB drops a batch that was answered with one.
  • Host check. "This machine's name" is the first label of its host name.

Checks

• The site builds locally (Node 24): 19 page(s) built. The ten expected section anchors are present.
• The search for stale 0.2.x wording prints nothing for these pages.
• Each sentence that b51d112 adds was checked against the code of the Phase 3b branch's final head, whose tree is what main now has.
• No workflow builds the site for a pull request: deploy-site.yml (Node 22) runs only on pushes to main and when started by hand.

Known open points in the pages

None of these blocks this pull request. Each is easier to fix here than after the pages are live.

• RUST_LOG=aranet_service=info is still shown as the log-level setting in three places: the Environment Variables block, the systemd drop-in recipe and the sample compose file. That directive has no effect, because aranet_service has a default directive.
• "Arguments after the image name replace the default run command and still read /app/server.toml" is too strong: docker run <image> run --config /other.toml reads the other file.
• "The service can read a config outside /var/lib/aranet" repeats the installer. The install does not check that the dynamic user can read the file.
• The Windows schtasks command has never been run.
• The mDNS section gives dns-sd -B _aranet._tcp local. for macOS. That browse has not been seen working on macOS yet: it is a release gate listed in Service hardening, secure defaults, config files and deployment (Phase 3b) #11. If that gate fails, this section changes with the changelog.

Merging

The branch already sits on main. If main moves before the release, rebase it; nothing else on main touches these pages except Phase 3a's website pull request (#8, docs/phase3a-website), which merges at the same time. Its edits to cli/commands.mdx do not overlap this one's.