Prep v1.1.0 release: version string, gitignore secrets, docs

- Add VERSION = "1.1.0" to server.py; print at startup, expose via public
  GET /api/config, and show it in the admin header (so deployed == released
  is verifiable at a glance).
- Ignore config.json in .gitignore — it holds the admin password hash and
  session secret; fresh installs use config.json.example.
- README/CLAUDE.md: document the in-app pixel editor (now with shape tools,
  select/move, reference overlay, custom/recent palettes), the receiver health
  dashboard, 9 sprite types, and the asset cache-busting convention.
- Bump admin asset cache-bust to ?v=20260609d.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -3,7 +3,6 @@ __pycache__
 *.pyc
 *.pyo
 config.json
-data/
 screenshots/
 .claude/
 CLAUDE.md

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,29 +0,0 @@
----
-name: Bug report
-about: Report something that isn't working
-title: "[Bug] "
-labels: bug
----
-
-**Describe the bug**
-A clear description of what's wrong.
-
-**To reproduce**
-Steps to reproduce the behavior:
-1. …
-2. …
-
-**Expected behavior**
-What you expected to happen.
-
-**Screenshots / logs**
-If applicable, add screenshots or server log output.
-
-**Environment**
-- ADS-Bit version (admin header or `GET /api/config`):
-- Install method: [ ] bare metal  [ ] Docker  [ ] Podman
-- OS / Python version:
-- Receiver / feed (e.g. dump1090, readsb) and how it's reached:
-
-**Additional context**
-Anything else that might help.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,18 +0,0 @@
----
-name: Feature request
-about: Suggest an idea or improvement
-title: "[Feature] "
-labels: enhancement
----
-
-**What problem does this solve?**
-A clear description of the need or pain point.
-
-**Proposed solution**
-What you'd like to happen.
-
-**Alternatives considered**
-Any other approaches you thought about.
-
-**Additional context**
-Mockups, examples, or references.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,19 +0,0 @@
-## Summary
-
-<!-- What does this PR change, and why? -->
-
-## Related issues
-
-<!-- e.g. Closes #123 -->
-
-## How was this tested?
-
-<!-- Commands run, manual steps, screenshots. For Docker changes, note that
-     `docker build` succeeds. -->
-
-## Checklist
-
-- [ ] Server starts and the change works locally (`python3 server.py`)
-- [ ] If admin assets changed, bumped the `?v=` cache-bust token in `admin/admin.html`
-- [ ] If behavior/version changed, updated `VERSION` and `CHANGELOG.md`
-- [ ] No secrets or local config committed (`config.json` stays ignored)

.github/dependabot.yml

@@ -1,17 +0,0 @@
-version: 2
-updates:
-  # Keep GitHub Actions pinned versions current.
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
-    commit-message:
-      prefix: "ci"
-
-  # Keep Python dependencies current.
-  - package-ecosystem: pip
-    directory: "/"
-    schedule:
-      interval: weekly
-    commit-message:
-      prefix: "deps"

.github/workflows/ci.yml

@@ -1,30 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  python:
-    name: Python checks
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.11"
-      - name: Install dependencies
-        run: pip install -r requirements.txt
-      - name: Byte-compile server
-        run: python -m compileall -q server.py
-      - name: Validate example config is valid JSON
-        run: python -c "import json; json.load(open('config.json.example'))"
-
-  docker:
-    name: Docker build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Build image
-        run: docker build -t ads-bit:ci .

.github/workflows/codeql.yml

@@ -1,35 +0,0 @@
-name: CodeQL
-
-# Static security analysis (free for public repositories). Scans the Python
-# backend and the vanilla-JS frontend on pushes, PRs, and weekly.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    - cron: "23 5 * * 1"
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      contents: read
-      actions: read
-    strategy:
-      fail-fast: false
-      matrix:
-        language: [python, javascript]
-    steps:
-      - uses: actions/checkout@v4
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-      - name: Analyze
-        uses: github/codeql-action/analyze@v3
-        with:
-          category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -1,59 +0,0 @@
-name: Release
-
-# Build and publish a multi-arch image to GitHub Container Registry (GHCR)
-# whenever a version tag is pushed (e.g. v1.1.2). Lets users run a prebuilt
-# image — including on Raspberry Pi (arm64) — without building locally.
-
-on:
-  push:
-    tags: ["v*"]
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Image tag to publish (e.g. 1.1.2); leave blank for just :latest"
-        required: false
-        default: ""
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  image:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Compute lowercase image name
-        id: img
-        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
-
-      - uses: docker/setup-qemu-action@v3
-      - uses: docker/setup-buildx-action@v3
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker metadata (tags & labels)
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ steps.img.outputs.name }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
-            type=raw,value=latest
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -15,7 +15,6 @@ __pycache__/
 
 # Claude Code
 .claude/
-CLAUDE.md
 
 # Gitea token
 .gitea-token
@@ -27,6 +26,3 @@ Thumbs.db
 # Local config — contains the admin password hash and session secret.
 # Fresh installs start from config.json.example (see CONFIG.md).
 config.json
-
-# Docker config volume (holds the live config.json with secrets)
-data/

CHANGELOG.md

@@ -1,61 +0,0 @@
-# Changelog
-
-All notable changes to this project are documented here. The format is based
-on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
-[Semantic Versioning](https://semver.org/).
-
-## [1.1.2] - 2026-06-10
-
-First release with a published container image and security tooling. No
-application behavior changes from 1.1.1.
-
-### Added
-- Prebuilt multi-arch (amd64 + arm64) container image published to GitHub
-  Container Registry: `ghcr.io/allennpit/ads-bit`.
-- CodeQL code-scanning workflow (Python + JavaScript) and Dependabot updates
-  for GitHub Actions and pip.
-- `workflow_dispatch` trigger on the release workflow for manual image builds.
-
-## [1.1.1] - 2026-06-10
-
-### Added
-- `/health` endpoint (status, version, receiver/flight counts) plus a Docker
-  `HEALTHCHECK`.
-- `ADSBIT_CONFIG` environment variable to override the config file path.
-
-### Changed
-- Docker first-run now works with no manual steps: `config.json` is auto-seeded
-  from `config.json.example` by `docker-entrypoint.sh` and persisted on a
-  `./data` directory mount (removing the single-file bind-mount footgun).
-- Network auto-scan skips subnets larger than `/20` (e.g. a Docker bridge
-  `172.17.0.0/16`) so discovery no longer stalls startup on Docker hosts.
-- `SIGTERM`/`SIGINT` (`docker stop`, `systemctl stop`) shut down cleanly
-  without a stack trace.
-
-## [1.1.0] - 2026-06-09
-
-### Added
-- In-app pixel editor for sprites (admin → Sprites → EDIT): pencil, eraser,
-  color picker, fill bucket, line/rectangle/ellipse shapes, rectangular
-  select with move/cut/copy/paste, reference-image overlay, brush size &
-  opacity, custom + recent palettes, zoom/pan, grid, undo/redo.
-- Receiver health dashboard: live per-receiver status (receiving / no data /
-  unreachable), connection testing, a select → save → apply flow, selectable
-  scan results, and a per-interface scan selector.
-- Version surfaced at startup, via `GET /api/config`, and in the admin header.
-
-### Fixed
-- Server crash when restarting receiver connections: cancelled receiver tasks
-  no longer tear down the main event loop.
-
-## [1.0] - 2026-01
-
-### Added
-- Initial release: retro SNES-style side-view ADS-B flight tracker with custom
-  pixel-art sprites, directional backgrounds, weather, sun/moon, admin panel,
-  first-run setup wizard, and Docker/Podman support.
-
-[1.1.2]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.2
-[1.1.1]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.1
-[1.1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.0
-[1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.0

CLAUDE.md

@@ -0,0 +1,151 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+ADS-Bit is a retro SNES-style side-view flight tracker that displays ADS-B aircraft data with custom pixel art sprites.
+
+## Running the Server
+
+```bash
+# Start the server (port configured in config.json, default 2001)
+python3 server.py
+
+# Or use the startup script
+./start.sh
+```
+
+Access at http://localhost:{web_port} (configured in config.json)
+
+## Architecture
+
+### Components
+
+- **server.py** - Python WebSocket server using aiohttp
+  - Reads configuration from config.json
+  - Auto-scans for ADS-B receivers or connects to configured IPs
+  - Parses SBS/BaseStation format messages from receivers (port 30003)
+  - Polls dump1090 JSON API (`/dump1090/data/aircraft.json`) every 5s for ADS-B emitter categories
+  - Broadcasts flight data (including emitter category) to WebSocket clients every 1 second
+  - Cleans up flights not seen in 60 seconds
+  - Serves static files, admin panel, setup wizard, and APIs
+  - Authentication via bcrypt password hashing and session cookies
+
+- **config.json** - Configuration file for receiver and location settings
+  - See CONFIG.md for full documentation
+
+- **ads-bit.js** - JavaScript rendering engine (Canvas-based)
+  - Handles WebSocket connection and flight data updates
+  - Renders 10 FPS retro-style canvas animation
+  - Layer order (bottom to top): sky gradient → clouds → sun → moon → directional background → grid → aircraft → labels
+  - Directional backgrounds include horizon, so low sun/moon is realistically occluded
+  - Aircraft sprites flip horizontally when heading west (track 90°-270°)
+  - View direction rotates between N/E/S/W (arrow keys or A/D), changing the background
+
+- **index.html** - Main HTML interface with embedded styles
+
+- **admin/** - Admin panel (login + tabbed settings UI)
+  - Theme management: rename display names, upload per-direction background PNGs, create new themes
+  - Display names stored in `config.json` `theme_names` map (folder name -> display name)
+  - Receivers tab: live per-receiver health (via `GET /api/admin/receiver-status` and `POST /api/admin/test-receivers`), a select → SAVE & APPLY → auto-test flow, selectable scan results, and a per-interface scan selector
+  - Version (from `server.py` `VERSION`) is surfaced via public `GET /api/config` and shown in the admin header
+  - **pixel-editor.js** - In-app Canvas2D pixel editor (Sprites tab "EDIT" button)
+    - Edits sprites at native 500x333; tools: pencil, eraser, color picker, fill bucket, pan, line, rectangle, ellipse (outline/filled), rectangular select
+    - Select & move: marquee + floating layer, drag/arrow-nudge, Ctrl+C/X/V clipboard, Delete, Enter/Esc commit
+    - Zoom/pan, undo/redo (snapshot-per-stroke), grid overlay, brush size & opacity, retro + custom (localStorage) + recent palettes, adjustable reference-image overlay
+    - Exports a 500x333 PNG via `srcCanvas.toBlob` and POSTs to the existing `/api/admin/sprites/{type}` upload endpoint (no new server route)
+    - Keyboard: B/E/I/F/L/R/O/M tools, Space=pan, +/-/0 zoom, Ctrl+Z/Y undo/redo, Ctrl+C/X/V, arrows nudge, G grid, Esc close
+  - **Asset cache-busting:** `admin.html` references `admin.css`/`admin.js`/`pixel-editor.js` with a `?v=YYYYMMDD[x]` query — bump it whenever those files change so browsers reload them
+
+- **setup/** - First-run setup wizard (multi-step configuration)
+
+### Sprite Assets
+
+All PNG sprites face right (eastward) and are flipped in-canvas for westbound aircraft:
+- 9 aircraft types: smallProp, regionalJet, narrowBody, wideBody, heavy, helicopter, balloon, glider, uav
+- Directional backgrounds: north.png, south.png, east.png, west.png (1536x1024, shown based on view direction)
+- Celestial: sun.png, moon_6_phases.png (2x3 sprite sheet)
+- Weather: happycloud.png (clear), raincloud.png (rain/snow)
+
+### Aircraft Type Detection Logic
+
+Two-tier system: real ADS-B emitter categories when available, heuristic fallback otherwise.
+
+#### Tier 1: ADS-B Emitter Category (from dump1090 JSON API)
+
+The server polls `http://{receiver_ip}/dump1090/data/aircraft.json` every 5 seconds. The SBS/BaseStation protocol (port 30003) does **not** include emitter category, but the dump1090/readsb JSON API exposes the raw ADS-B transponder category field. When available, this is authoritative and always preferred over heuristics.
+
+Mapping from DO-260B emitter categories to sprite types:
+| ADS-B Category | Description | Sprite |
+|---|---|---|
+| A1 | Light (< 15,500 lbs) | smallProp |
+| A2 | Small (15,500 - 75,000 lbs) | regionalJet |
+| A3 | Large (75,000 - 300,000 lbs) | narrowBody |
+| A4 | High vortex large (B757) | narrowBody |
+| A5 | Heavy (> 300,000 lbs) | wideBody or heavy (by altitude/speed) |
+| A6 | High performance (> 5g, > 400 kts) | narrowBody |
+| A7 | Rotorcraft | helicopter |
+| B1 | Glider / sailplane | glider |
+| B2 | Lighter-than-air | balloon |
+| B4 | Skydiver drop plane | smallProp |
+| B6 | UAV | uav |
+
+Once an emitter category is received for an aircraft, it is locked in and heuristic re-evaluation is skipped.
+
+#### Tier 2: Heuristic Fallback (when no emitter category available)
+
+Priority order when ADS-B category is not available (some transponders don't broadcast it):
+1. **Helicopter callsigns**: known operator prefixes (LFE, MED, CHP, PHI, ERA, BHS) or keywords (LIFE, MERCY, COPTER, etc.)
+2. **Heavy/Wide body callsigns**: major airline ICAO prefixes (CPA, UAE, ETH, QTR, SIA, AAL, DAL, UAL, FDX, UPS, etc.) + altitude/speed thresholds
+3. **Altitude/speed extremes**: altitude > 42000 ft or speed > 550 kts = heavy; > 40000 ft or > 500 kts = wideBody
+4. **N-number (US GA registration)**: pattern `N` + digit + 2-4 alphanumerics = smallProp (or narrowBody if above 25000 ft)
+5. **Regional airline callsigns**: SKW, RPA, ASH, PDT, CHQ, ENY, JIA, CPZ
+6. **Speed/altitude heuristics**: speed < 60 + alt < 5000 = helicopter; alt < 18000 + speed < 300 = smallProp or regionalJet
+7. **Altitude-only**: < 10000 ft = smallProp, < 25000 ft = regionalJet, higher = narrowBody
+8. **Default**: narrowBody (re-evaluated when better data arrives)
+
+Important: `speed=0` or `altitude=0` means data not yet received, not actual zero. The system re-categorizes when better data arrives (speed > 0 and callsign present).
+
+### View Direction Controls
+
+The viewer can rotate between cardinal directions (N/E/S/W), showing aircraft in a 90° field of view:
+- **Keyboard**: Left/Right arrow keys or A/D keys
+- **UI**: Arrow buttons on the interface
+- Each direction displays a unique background image (north.png, east.png, south.png, west.png)
+- Sun and moon positions are calculated based on actual azimuth and only appear when in the current field of view
+
+### External APIs
+
+- **Open-Meteo**: Weather and sunrise/sunset data (updates every 10 minutes)
+- **ADS-B Receivers**: SBS/BaseStation protocol on port 30003 (flight data)
+- **dump1090 JSON API**: `http://{receiver}/dump1090/data/aircraft.json` on port 80 (emitter categories, polled every 5s)
+
+## Dependencies
+
+Python packages required:
+- aiohttp (web server and WebSocket)
+- netifaces (network interface scanning)
+- bcrypt (password hashing)
+
+No package.json - frontend is vanilla JavaScript with no build step.
+
+## Key Code Patterns
+
+- Canvas version parameter on assets (`?v=36`) for cache busting
+- Aircraft direction: `const isFacingLeft = flight.track > 90 && flight.track < 270`
+- Moon phases use sprite sheet cropping with 2x3 grid (3 columns, 2 rows)
+- Flight data stored in global `flights` dict keyed by ICAO hex code
+
+## Debugging
+
+```bash
+# Check for running server instances
+ps aux | grep server.py
+
+# Kill all instances
+pkill -9 -f server.py
+
+# Test receiver connectivity (replace with your receiver IP)
+nc -zv <receiver_ip> 30003
+```

CONTRIBUTING.md

@@ -1,59 +0,0 @@
-# Contributing to ADS-Bit
-
-Thanks for your interest in improving ADS-Bit! Contributions of all kinds —
-bug reports, features, sprites, themes, docs — are welcome.
-
-## Development setup
-
-ADS-Bit is a Python (aiohttp) backend with a vanilla-JavaScript frontend.
-There is **no build step** for the frontend.
-
-```bash
-git clone <your-fork-url>
-cd ADS-Bit
-pip install -r requirements.txt      # Python 3.9–3.11 recommended (see note below)
-cp config.json.example config.json   # optional; the setup wizard runs otherwise
-python3 server.py                     # serves on http://localhost:2001
-```
-
-Or with Docker (no local Python needed):
-
-```bash
-docker compose up -d
-```
-
-> **Python version note:** the `netifaces` dependency can be hard to build on
-> Python 3.12+. Use Python 3.9–3.11, or just use the Docker image (Python 3.11).
-
-## Project layout
-
-- `server.py` — aiohttp server: receiver connections, flight state, APIs, auth.
-- `ads-bit.js` / `index.html` — Canvas-based retro viewer.
-- `admin/` — admin panel, including the in-browser `pixel-editor.js`.
-- `setup/` — first-run setup wizard.
-- `images/`, `backgrounds/` — sprite and theme assets.
-
-## Conventions
-
-- **Frontend assets are cache-busted** via a `?v=YYYYMMDD[x]` query in
-  `admin/admin.html`. If you change `admin.css`, `admin.js`, or
-  `pixel-editor.js`, bump that token so browsers reload them.
-- The `VERSION` constant in `server.py` is the single source of truth; bump it
-  for releases and add a `CHANGELOG.md` entry.
-- Keep the retro aesthetic (Press Start 2P, blue/gold palette) for UI work.
-- Match the style of surrounding code; no frontend framework or build tooling.
-
-## Submitting changes
-
-1. Fork and create a topic branch (`feature/…`, `fix/…`, `chore/…`).
-2. Make focused commits with clear messages.
-3. Verify locally: the server starts, the page loads, and your change works.
-   For Docker changes, confirm `docker build` succeeds.
-4. Open a pull request describing what changed and how you tested it.
-
-CI will byte-compile the server, validate `config.json.example`, and build the
-Docker image on every PR.
-
-## Reporting bugs / requesting features
-
-Use the issue templates. For security issues, see [SECURITY.md](SECURITY.md).

Dockerfile

@@ -13,16 +13,9 @@ RUN pip install --no-cache-dir -r requirements.txt && \
     rm -rf /var/lib/apt/lists/*
 
 COPY . .
-RUN chmod +x /app/docker-entrypoint.sh
 
 EXPOSE 2001
 
-# Persist config on a mounted volume by default (see docker-compose.yml).
+ENV PYTHONUNBUFFERED=1
-ENV PYTHONUNBUFFERED=1 \
-    ADSBIT_CONFIG=/app/data/config.json
 
-# Liveness probe against the unauthenticated /health endpoint.
+CMD ["python3", "server.py"]
-HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
-    CMD python3 -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:2001/health',timeout=4).status==200 else 1)" || exit 1
-
-ENTRYPOINT ["/app/docker-entrypoint.sh"]

README.md

@@ -1,9 +1,5 @@
 # ADS-Bit
 
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Release](https://img.shields.io/github/v/release/AllenNPIT/ADS-Bit)](https://github.com/AllenNPIT/ADS-Bit/releases)
-[![CI](https://github.com/AllenNPIT/ADS-Bit/actions/workflows/ci.yml/badge.svg)](https://github.com/AllenNPIT/ADS-Bit/actions/workflows/ci.yml)
-
 A retro SNES-style side-view flight tracker that displays ADS-B aircraft data with custom pixel art sprites.
 
 ![ADS-Bit Screenshot](screenshots/screenshot.png)
@@ -45,33 +41,17 @@ On first run, visit http://localhost:2001 and the setup wizard will guide you th
 
 - [Docker](https://docs.docker.com/get-docker/) with Compose V2, **or** [Podman](https://podman.io/) with `podman-compose`
 
-### Run the prebuilt image (no clone needed)
+### First Run
-
-Once a release is published, a multi-arch image (amd64 + arm64, e.g. Raspberry Pi)
-is available from GitHub Container Registry:
 
 ```bash
-docker run -d --name ads-bit --network host --restart unless-stopped \
+# Create a config file (the setup wizard runs if you skip this)
-  -e ADSBIT_CONFIG=/app/data/config.json \
+cp config.json.example config.json
-  -v "$PWD/data:/app/data" \
-  ghcr.io/allennpit/ads-bit:latest
-```
 
-Then open http://localhost:2001 and complete the setup wizard.
+# Build and start
-
-### Build from source
-
-```bash
-# Build and start — no config step needed
 docker compose up -d
 ```
 
-A config file is created automatically in `data/` on first run, then the
+The web UI is available at http://localhost:2001.
-browser **setup wizard** walks you through receiver, location, and password
-setup. The web UI is available at http://localhost:2001.
-
-A `/health` endpoint (used by the container healthcheck) reports status,
-version, and receiver/flight counts: `curl http://localhost:2001/health`.
 
 ### Useful Commands
 
@@ -102,15 +82,15 @@ The following paths are bind-mounted from the repo directory and persist across
 
 | Path | Contents |
 |------|----------|
-| `data/` | Server configuration and credentials (`config.json`, auto-seeded) |
+| `config.json` | Server configuration and credentials |
 | `images/` | Aircraft and UI sprites (including uploads) |
 | `backgrounds/` | Theme background images (including custom themes) |
 
-Host networking (`network_mode: host`) is used so the server can auto-scan your LAN for ADS-B receivers. Auto-scan skips oversized subnets (larger than /20, e.g. a Docker bridge `172.17.0.0/16`); if your receiver lives on such a network, set it explicitly via the admin Receivers tab.
+Host networking (`network_mode: host`) is used so the server can auto-scan your LAN for ADS-B receivers.
 
 ## Requirements
 
-- Python 3.9–3.11 (3.12+ may require build tools for `netifaces`; the Docker image uses 3.11)
+- Python 3.8+
 - ADS-B receiver providing SBS/BaseStation format on port 30003 (dump1090, readsb, etc.)
 - Modern web browser with Canvas support
 
@@ -124,8 +104,8 @@ ADS-Bit uses a first-run setup wizard to configure your installation. You can al
   "receiver_port": 30003,
   "location": {
     "name": "My Location",
-    "lat": 36.2788,
+    "lat": 0.0,
-    "lon": -115.2283
+    "lon": 0.0
   },
   "web_port": 2001,
   "theme": "desert"

SECURITY.md

@@ -1,35 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-| Version | Supported |
-|---------|-----------|
-| 1.1.x   | ✅        |
-| < 1.1   | ❌        |
-
-## Reporting a Vulnerability
-
-Please **do not** open a public issue for security vulnerabilities.
-
-Instead, use GitHub's private vulnerability reporting:
-**Security → Report a vulnerability** on the repository.
-
-Include as much detail as you can:
-- Affected version (see the version in the admin header or `GET /api/config`)
-- Steps to reproduce / proof of concept
-- Impact and any suggested remediation
-
-You can expect an acknowledgement within a few days. Please allow reasonable
-time for a fix before any public disclosure.
-
-## Security Notes for Operators
-
-ADS-Bit is intended for trusted LANs, not direct exposure to the public
-internet. If you must expose it:
-
-- Set a strong admin password (changed from the setup default).
-- Put it behind HTTPS via a reverse proxy or tunnel (e.g. Caddy, nginx,
-  Tailscale). The built-in server speaks plain HTTP.
-- Never commit your `config.json` — it contains the admin password hash and
-  session secret. It is git-ignored by default; fresh installs start from
-  `config.json.example`.

docker-compose.yml

@@ -6,11 +6,9 @@ services:
     restart: unless-stopped
     environment:
       - PYTHONUNBUFFERED=1
-      - ADSBIT_CONFIG=/app/data/config.json
     volumes:
-      # Config persists here; auto-seeded from config.json.example on first run
+      # Persist config (copy config.json.example to config.json before first run)
-      # (a directory mount, so a fresh `docker compose up` just works).
+      - ./config.json:/app/config.json
-      - ./data:/app/data
       # Persist custom sprite uploads
       - ./images:/app/images
       # Persist custom theme backgrounds

docker-entrypoint.sh

@@ -1,16 +0,0 @@
-#!/bin/sh
-# Seed a config file on first run so `docker compose up` works on a fresh
-# clone with no manual steps. The config lives on a mounted data volume so it
-# persists across container rebuilds.
-set -e
-
-: "${ADSBIT_CONFIG:=/app/config.json}"
-CONFIG_DIR=$(dirname "$ADSBIT_CONFIG")
-mkdir -p "$CONFIG_DIR"
-
-if [ ! -f "$ADSBIT_CONFIG" ]; then
-    echo "[entrypoint] No config at $ADSBIT_CONFIG — seeding from config.json.example"
-    cp /app/config.json.example "$ADSBIT_CONFIG"
-fi
-
-exec python3 server.py

server.py

@@ -17,16 +17,10 @@ from aiohttp import web, ClientSession, ClientTimeout
 import netifaces
 import bcrypt
 
-VERSION = "1.1.2"
+VERSION = "1.1.0"
 
 WEB_DIR = Path(__file__).parent
-# Config path is overridable (handy for containers persisting config on a
+CONFIG_FILE = WEB_DIR / "config.json"
-# named volume); defaults to config.json next to this script for bare-metal.
-CONFIG_FILE = Path(os.environ.get("ADSBIT_CONFIG") or (WEB_DIR / "config.json"))
-
-# Smallest subnet prefix (largest network) we'll auto-scan: /20 = 4094 hosts.
-# Anything bigger (e.g. a docker /16) is skipped to keep scans fast and safe.
-MIN_SCAN_PREFIX = 20
 
 # Track server start time
 SERVER_START_TIME = time.time()
@@ -420,15 +414,6 @@ async def scan_for_receivers():
                 if ip and netmask and not ip.startswith('127.'):
                     try:
                         network = ipaddress.IPv4Network(f"{ip}/{netmask}", strict=False)
-                        # Skip subnets too large to scan quickly (e.g. a docker
-                        # bridge /16 = 65k hosts). Without this, AUTO discovery
-                        # hammers the network and stalls startup on any host with
-                        # Docker or a large/16. Use MANUAL or a custom subnet for
-                        # receivers that live on such networks.
-                        if network.prefixlen < MIN_SCAN_PREFIX:
-                            print(f"Skipping {network} on {iface}: too large "
-                                  f"({network.num_addresses} hosts) for auto-scan")
-                            continue
                         found.extend(await _scan_subnet(network, port))
                     except ValueError as e:
                         print(f"Invalid network {ip}/{netmask}: {e}")
@@ -999,10 +984,9 @@ async def handle_admin_scan_receivers(request):
             return web.json_response(
                 {"error": f"Invalid subnet: {subnet}"}, status=400)
 
-        if network.prefixlen < MIN_SCAN_PREFIX:
+        if network.prefixlen < 20:
             return web.json_response(
-                {"error": f"Subnet too large (max /{MIN_SCAN_PREFIX} = "
+                {"error": "Subnet too large (max /20 = 4096 hosts)"}, status=400)
-                          f"{2 ** (32 - MIN_SCAN_PREFIX) - 2} hosts)"}, status=400)
 
         port = config['receiver_port']
         found = await _scan_subnet(network, port)
@@ -1188,17 +1172,6 @@ async def handle_http(request):
     return web.Response(status=404, text="Not Found")
 
 
-async def handle_health(request):
-    """GET /health - liveness/readiness probe (no auth, no secrets)."""
-    return web.json_response({
-        "status": "ok",
-        "version": VERSION,
-        "receivers": len(receivers),
-        "flights": len(flights),
-        "uptime_seconds": int(time.time() - SERVER_START_TIME),
-    })
-
-
 # ---------------------------------------------------------------------------
 # Application setup
 # ---------------------------------------------------------------------------
@@ -1211,7 +1184,6 @@ async def start_http_server():
     app.router.add_get('/ws', websocket_handler)
 
     # Public API
-    app.router.add_get('/health', handle_health)
     app.router.add_get('/api/receiver-location', handle_receiver_location)
     app.router.add_get('/api/config', handle_config)
 
@@ -1310,11 +1282,4 @@ async def main():
 
 
 if __name__ == "__main__":
-    # Make SIGTERM (docker stop, systemctl stop) raise KeyboardInterrupt like
+    asyncio.run(main())
-    # SIGINT does, so shutdown is clean and quiet instead of a stack trace.
-    import signal
-    signal.signal(signal.SIGTERM, signal.default_int_handler)
-    try:
-        asyncio.run(main())
-    except (KeyboardInterrupt, SystemExit):
-        print("ADS-Bit server shutting down.")