# Monlet Web

Dashboard for Monlet. Monitoring pages are read-only; agent admission and blacklist controls can mutate server state.

## Stack

- Next.js 16 (App Router)
- React 19
- TypeScript
- Tailwind CSS v4
- Typed API client generated from `api/openapi.yaml`

## Commands

```sh
cd web
npm_config_cache=../.cache/npm npm install
npm_config_cache=../.cache/npm npm run dev
```

Build / lint / typecheck / smoke:

```sh
npm_config_cache=../.cache/npm npm run build
npm_config_cache=../.cache/npm npm run lint
npm_config_cache=../.cache/npm npm run typecheck
npm_config_cache=../.cache/npm npm run smoke
```

Do not install Node packages globally. Project dependencies live in `web/node_modules`; npm cache lives under repository `.cache/npm`.

## Environment

| Var | Default | Purpose |
|---|---|---|
| `MONLET_API_BASE_URL` | `http://127.0.0.1:8000` | Server base URL (server-side fetch) |
| `MONLET_API_TOKEN` | _(none)_ | Bearer token sent to server |
| `MONLET_WEB_TIME_ZONE` | `UTC` | IANA timezone used to render timestamps |
| `MONLET_WEB_AUTH_USERNAME` | _(none)_ | Optional Basic Auth username for the web UI |
| `MONLET_WEB_AUTH_PASSWORD` | _(none)_ | Optional Basic Auth password for the web UI |
| `MONLET_WEB_TRUST_PROXY_AUTH` | `false` | Trust `X-Forwarded-User` from an upstream auth proxy |

The API token never reaches the browser — all server calls happen in Server Components / route handlers. Agent admission actions are blocked unless Basic Auth is configured or trusted proxy auth is enabled.

## Pages

- `/` — redirects to `/agents`
- `/agents` — agent list
- `/agents/blacklist` — blocked agent keys
- `/agents/[id]` — agent detail
- `/checks` — current check states
- `/incidents` — incident list
- `/events` — events query
- `/outbox` — notification outbox

## API client

Types are generated from `../api/openapi.yaml` into `src/lib/api-types.ts` via `npm run gen:api`.