Web Dashboard

A local, optional browser UI for scanning history, drift timelines, severity distribution, environment comparison and alert management.

pip install "cfgdrift[web]"
cfgdrift serve                    # http://127.0.0.1:8080

Views

View	What it shows
Overview	Summary cards + daemon health / error rate
Timeline	Searchable / filterable / paginated drift history (v0.9.0)
Severity distribution	Pie chart; clicking a segment filters the timeline
Environment comparison	Compare baselines side by side, constraints included
Constraints	Active constraint list, enable/disable user rules, recent violations (v0.7.0)
Alerting	Alert rules, recent events, silence / ack (v0.10.0)
Self-Healing Audit	`remediation_log` records, 30 days / 5000 rows pruned (v0.12.0)

Report export

The report view has an "Export HTML" button that produces a single-file offline HTML report (GET /api/reports/{scan_id}/html), the same artifact the CLI produces via cfgdrift report --html out.html.

Rollback buttons (v0.13.0)

The report view renders a hint block under each drift row with three buttons: 预览回滚 (preview rollback), 执行回滚 (apply rollback), 复制命令 (copy command). Without a remediate.yaml, apply is disabled with a readable error and the button degrades to copying the rollback command; dry-run preview always works.

Access auth (v0.17.0, G9)

The dashboard supports an optional Bearer-token gate for shared / team deployments. When a token is configured, every /api/* route (including the write operations: remediation apply, ignore-rule changes, alert tests/retries, constraint candidate promotion) requires Authorization: Bearer <token>; static files (the login page) stay open so the SPA can load. Without a token the service is fully anonymous and byte-identical to v0.16.0 (zero-noise default).

cfgdrift web token                   # generate a URL-safe token (43 chars, one line)
cfgdrift serve --token <TOKEN>    # enable auth on startup
CFGDRIFT_WEB_TOKEN=<TOKEN> cfgdrift serve   # or via env (CLI --token wins)

Missing / wrong / bare (no Bearer prefix) credentials → 401 + WWW-Authenticate: Bearer, with zero side effects on write routes; a valid token gets the exact v0.16.0 response.
Front-end: any /api/* 401 opens a login overlay; success is persisted in localStorage (cfgdrift_web_token) and the current view is re-rendered. When auth is not enabled the front-end never shows the overlay and sends no probe requests.
Binding to a non-loopback host (e.g. 0.0.0.0) without a token prints a security warning to stderr at startup (hint only — the service still starts). The token itself is never echoed.

More details in README.en.md — Features at a Glance and the v0.13.0 [hint] section.