From a26fde2fabe826feadbfd65324dd148a24c68cc2 Mon Sep 17 00:00:00 2001 From: SandObserver <260779319+SandObserver@users.noreply.github.com> Date: Thu, 22 Oct 2026 13:32:19 -0400 Subject: [PATCH] Document username and password sign-in for live badges --- src/content/docs/docs/badges.md | 2 ++ src/content/docs/docs/security.md | 2 +- src/content/docs/docs/troubleshooting.md | 3 ++- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/src/content/docs/docs/badges.md b/src/content/docs/docs/badges.md index 75b8b6f..fd4dda6 100644 --- a/src/content/docs/docs/badges.md +++ b/src/content/docs/docs/badges.md @@ -30,6 +30,8 @@ Badge colours are Accent, Success, Warning, Danger and Info. Each is drawn for t A number from any API. Enter the API URL, add a header if the API needs a key, and press Fetch. Stackyard lists every number in the response. Pick one. +If the API asks for a username and password, turn on **Authentication** and enter them under **Sign In**. The password stays on the server. A username and password typed into the URL are not sent. + Tick **Secret** on a header to keep its value on the server. Poll sets how often it reads, in seconds. Every open dashboard shares that reading. ### More than one value diff --git a/src/content/docs/docs/security.md b/src/content/docs/docs/security.md index 6bc1c3f..113b983 100644 --- a/src/content/docs/docs/security.md +++ b/src/content/docs/docs/security.md @@ -41,7 +41,7 @@ Stackyard never adds a name to the list by itself. Open a fresh install by its I Stored secrets are stripped from the config before it reaches the browser. A populated field reports as set without returning its value, in config responses and in exports alike. -A secret is restored only for the request it was stored for. If a save changes where the credential would be sent, by editing a badge URL, its non-secret headers, or a widget field that decides where it goes, the stored value is not restored and Stackyard names what must be re-entered. Matching on an item's id alone would let an imported config point an existing credential somewhere new. These count as such a change too: turning **Allow self-signed certificate** on or off for an app, turning `settings.server.skipTlsVerify` on or off for widgets, changing a widget's type, and changing or removing the port map (`settings.server.portMap`). +A secret is restored only for the request it was stored for. If a save changes where the credential would be sent, by editing a badge URL, its non-secret headers, its sign-in username, or a widget field that decides where it goes, the stored value is not restored and Stackyard names what must be re-entered. Matching on an item's id alone would let an imported config point an existing credential somewhere new. These count as such a change too: turning **Allow self-signed certificate** on or off for an app, turning `settings.server.skipTlsVerify` on or off for widgets, changing a widget's type, and changing or removing the port map (`settings.server.portMap`). Secrets are stored in plain text in `apps.json` on the data volume. Protect that volume with filesystem permissions and backups. diff --git a/src/content/docs/docs/troubleshooting.md b/src/content/docs/docs/troubleshooting.md index 4bddbf8..e5928ec 100644 --- a/src/content/docs/docs/troubleshooting.md +++ b/src/content/docs/docs/troubleshooting.md @@ -99,7 +99,7 @@ Check that the service is reachable and the credential is still valid. ### A credential stopped working after an edit -Changing where or how a credential would be sent clears the stored value. Editing a badge URL, its non-secret headers, or a widget field that decides where the credential goes all count. Display settings such as units, colours and links do not. These count too: turning **Allow self-signed certificate** on or off for an app, and in the config, turning `settings.server.skipTlsVerify` on or off or changing or removing the port map (`settings.server.portMap`). Unticking **Secret** on a header row clears it on the next save. +Changing where or how a credential would be sent clears the stored value. Editing a badge URL, its non-secret headers, its sign-in username, or a widget field that decides where the credential goes all count. Display settings such as units, colours and links do not. These count too: turning **Allow self-signed certificate** on or off for an app, and in the config, turning `settings.server.skipTlsVerify` on or off or changing or removing the port map (`settings.server.portMap`). Unticking **Secret** on a header row clears it on the next save. Stackyard names the items to re-enter. Enter the credential again and save. @@ -268,6 +268,7 @@ Messages shown in the admin, and what each one means. | `Settings unavailable` | The widget's definition could not be loaded. The stored config is kept. | | `N widgets could not be loaded, so they are not listed below.` | Those definitions were refused at startup. The reason is in the container log. | | `Container not found` | The socket proxy answered, but no container matched that name. | +| `Enter the username and password under Sign In. A login in the URL is not sent.` | The Live Activity URL holds a username or password before the host. Stackyard does not send it. Enter them under Authentication, Sign In. | | `This address has no API path. Enter the service's full API URL.` | The Live Activity address names a host only. Badges read a value from an API response, so the address needs the service's API path. | | `Connected, but this address has no API path. Enter the service's full API URL.` | The address answered, but nothing numeric was found in the response. Same cause as above. | | `The address answered with a redirect (HTTP ). Enter the address it points to.` | Redirects are not followed. Use the final address, which is often a login page when the API path is missing. |