Re-add viewer screenshot (receiver IP and location masked)

Re-added after history scrub. This capture shows neither the receiver
IP nor the location name (status bar reads "CONNECTED" / "ADS-Bit").

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -3,6 +3,7 @@ __pycache__
 *.pyc
 *.pyo
 config.json
+data/
 screenshots/
 .claude/
 CLAUDE.md

.github/FUNDING.yml

@@ -0,0 +1 @@
+buy_me_a_coffee: adsbit

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,29 @@
+---
+name: Bug report
+about: Report something that isn't working
+title: "[Bug] "
+labels: bug
+---
+
+**Describe the bug**
+A clear description of what's wrong.
+
+**To reproduce**
+Steps to reproduce the behavior:
+1. …
+2. …
+
+**Expected behavior**
+What you expected to happen.
+
+**Screenshots / logs**
+If applicable, add screenshots or server log output.
+
+**Environment**
+- ADS-Bit version (admin header or `GET /api/config`):
+- Install method: [ ] bare metal  [ ] Docker  [ ] Podman
+- OS / Python version:
+- Receiver / feed (e.g. dump1090, readsb) and how it's reached:
+
+**Additional context**
+Anything else that might help.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Suggest an idea or improvement
+title: "[Feature] "
+labels: enhancement
+---
+
+**What problem does this solve?**
+A clear description of the need or pain point.
+
+**Proposed solution**
+What you'd like to happen.
+
+**Alternatives considered**
+Any other approaches you thought about.
+
+**Additional context**
+Mockups, examples, or references.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## Summary
+
+<!-- What does this PR change, and why? -->
+
+## Related issues
+
+<!-- e.g. Closes #123 -->
+
+## How was this tested?
+
+<!-- Commands run, manual steps, screenshots. For Docker changes, note that
+     `docker build` succeeds. -->
+
+## Checklist
+
+- [ ] Server starts and the change works locally (`python3 server.py`)
+- [ ] If admin assets changed, bumped the `?v=` cache-bust token in `admin/admin.html`
+- [ ] If behavior/version changed, updated `VERSION` and `CHANGELOG.md`
+- [ ] No secrets or local config committed (`config.json` stays ignored)

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  # Keep GitHub Actions pinned versions current.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
+
+  # Keep Python dependencies current.
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"

.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  python:
+    name: Python checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+      - name: Byte-compile server
+        run: python -m compileall -q server.py
+      - name: Validate example config is valid JSON
+        run: python -c "import json; json.load(open('config.json.example'))"
+
+  docker:
+    name: Docker build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image
+        run: docker build -t ads-bit:ci .

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+# Static security analysis (free for public repositories). Scans the Python
+# backend and the vanilla-JS frontend on pushes, PRs, and weekly.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 5 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+# Build and publish a multi-arch image to GitHub Container Registry (GHCR)
+# whenever a version tag is pushed (e.g. v1.1.2). Lets users run a prebuilt
+# image — including on Raspberry Pi (arm64) — without building locally.
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image tag to publish (e.g. 1.1.2); leave blank for just :latest"
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute lowercase image name
+        id: img
+        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker metadata (tags & labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ steps.img.outputs.name }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
+            type=raw,value=latest
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -15,13 +15,19 @@ __pycache__/
 
 # Claude Code
 .claude/
+CLAUDE.md
 
-# Gitea token
-.gitea-token
+# Local secrets / tokens
+*.token
+.git-credentials
 
 # OS
 .DS_Store
 Thumbs.db
 
-# Local config (uncomment if you want to ignore local changes)
-# config.json
+# Local config — contains the admin password hash and session secret.
+# Fresh installs start from config.json.example (see CONFIG.md).
+config.json
+
+# Docker config volume (holds the live config.json with secrets)
+data/

.pre-commit-config.yaml

@@ -0,0 +1,14 @@
+# Pre-commit hooks for ADS-Bit.
+#
+# Setup (once):
+#   pip install pre-commit
+#   pre-commit install
+#
+# Thereafter gitleaks scans every commit for secrets (tokens, keys,
+# password hashes) before they can reach gitea or the public GitHub mirror.
+# Run manually across the whole tree with:  pre-commit run --all-files
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.4
+    hooks:
+      - id: gitleaks

CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is based
+on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
+[Semantic Versioning](https://semver.org/).
+
+## [1.1.2] - 2026-06-10
+
+First release with a published container image and security tooling. No
+application behavior changes from 1.1.1.
+
+### Added
+- Prebuilt multi-arch (amd64 + arm64) container image published to GitHub
+  Container Registry: `ghcr.io/allennpit/ads-bit`.
+- CodeQL code-scanning workflow (Python + JavaScript) and Dependabot updates
+  for GitHub Actions and pip.
+- `workflow_dispatch` trigger on the release workflow for manual image builds.
+
+## [1.1.1] - 2026-06-10
+
+### Added
+- `/health` endpoint (status, version, receiver/flight counts) plus a Docker
+  `HEALTHCHECK`.
+- `ADSBIT_CONFIG` environment variable to override the config file path.
+
+### Changed
+- Docker first-run now works with no manual steps: `config.json` is auto-seeded
+  from `config.json.example` by `docker-entrypoint.sh` and persisted on a
+  `./data` directory mount (removing the single-file bind-mount footgun).
+- Network auto-scan skips subnets larger than `/20` (e.g. a Docker bridge
+  `172.17.0.0/16`) so discovery no longer stalls startup on Docker hosts.
+- `SIGTERM`/`SIGINT` (`docker stop`, `systemctl stop`) shut down cleanly
+  without a stack trace.
+
+## [1.1.0] - 2026-06-09
+
+### Added
+- In-app pixel editor for sprites (admin → Sprites → EDIT): pencil, eraser,
+  color picker, fill bucket, line/rectangle/ellipse shapes, rectangular
+  select with move/cut/copy/paste, reference-image overlay, brush size &
+  opacity, custom + recent palettes, zoom/pan, grid, undo/redo.
+- Receiver health dashboard: live per-receiver status (receiving / no data /
+  unreachable), connection testing, a select → save → apply flow, selectable
+  scan results, and a per-interface scan selector.
+- Version surfaced at startup, via `GET /api/config`, and in the admin header.
+
+### Fixed
+- Server crash when restarting receiver connections: cancelled receiver tasks
+  no longer tear down the main event loop.
+
+## [1.0] - 2026-01
+
+### Added
+- Initial release: retro SNES-style side-view ADS-B flight tracker with custom
+  pixel-art sprites, directional backgrounds, weather, sun/moon, admin panel,
+  first-run setup wizard, and Docker/Podman support.
+
+[1.1.2]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.2
+[1.1.1]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.1
+[1.1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.0
+[1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.0

CLAUDE.md

@@ -1,147 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-ADS-Bit is a retro SNES-style side-view flight tracker that displays ADS-B aircraft data with custom pixel art sprites.
-
-## Running the Server
-
-```bash
-# Start the server (port configured in config.json, default 2001)
-python3 server.py
-
-# Or use the startup script
-./start.sh
-```
-
-Access at http://localhost:{web_port} (configured in config.json)
-
-## Architecture
-
-### Components
-
-- **server.py** - Python WebSocket server using aiohttp
-  - Reads configuration from config.json
-  - Auto-scans for ADS-B receivers or connects to configured IPs
-  - Parses SBS/BaseStation format messages from receivers (port 30003)
-  - Polls dump1090 JSON API (`/dump1090/data/aircraft.json`) every 5s for ADS-B emitter categories
-  - Broadcasts flight data (including emitter category) to WebSocket clients every 1 second
-  - Cleans up flights not seen in 60 seconds
-  - Serves static files, admin panel, setup wizard, and APIs
-  - Authentication via bcrypt password hashing and session cookies
-
-- **config.json** - Configuration file for receiver and location settings
-  - See CONFIG.md for full documentation
-
-- **ads-bit.js** - JavaScript rendering engine (Canvas-based)
-  - Handles WebSocket connection and flight data updates
-  - Renders 10 FPS retro-style canvas animation
-  - Layer order (bottom to top): sky gradient → clouds → sun → moon → directional background → grid → aircraft → labels
-  - Directional backgrounds include horizon, so low sun/moon is realistically occluded
-  - Aircraft sprites flip horizontally when heading west (track 90°-270°)
-  - View direction rotates between N/E/S/W (arrow keys or A/D), changing the background
-
-- **index.html** - Main HTML interface with embedded styles
-
-- **admin/** - Admin panel (login + tabbed settings UI)
-  - Theme management: rename display names, upload per-direction background PNGs, create new themes
-  - Display names stored in `config.json` `theme_names` map (folder name -> display name)
-  - **pixel-editor.js** - In-app Canvas2D pixel editor (Sprites tab "EDIT" button)
-    - Edits sprites at native 500x333; tools: pencil, eraser, color picker, fill bucket, pan
-    - Zoom/pan, undo/redo (snapshot-per-stroke), grid overlay, retro palette + native color input
-    - Exports a 500x333 PNG via `srcCanvas.toBlob` and POSTs to the existing `/api/admin/sprites/{type}` upload endpoint (no new server route)
-    - Keyboard: B/E/I/F tools, Space=pan, +/-/0 zoom, Ctrl+Z/Y undo/redo, G grid, Esc close
-
-- **setup/** - First-run setup wizard (multi-step configuration)
-
-### Sprite Assets
-
-All PNG sprites face right (eastward) and are flipped in-canvas for westbound aircraft:
-- 9 aircraft types: smallProp, regionalJet, narrowBody, wideBody, heavy, helicopter, balloon, glider, uav
-- Directional backgrounds: north.png, south.png, east.png, west.png (1536x1024, shown based on view direction)
-- Celestial: sun.png, moon_6_phases.png (2x3 sprite sheet)
-- Weather: happycloud.png (clear), raincloud.png (rain/snow)
-
-### Aircraft Type Detection Logic
-
-Two-tier system: real ADS-B emitter categories when available, heuristic fallback otherwise.
-
-#### Tier 1: ADS-B Emitter Category (from dump1090 JSON API)
-
-The server polls `http://{receiver_ip}/dump1090/data/aircraft.json` every 5 seconds. The SBS/BaseStation protocol (port 30003) does **not** include emitter category, but the dump1090/readsb JSON API exposes the raw ADS-B transponder category field. When available, this is authoritative and always preferred over heuristics.
-
-Mapping from DO-260B emitter categories to sprite types:
-| ADS-B Category | Description | Sprite |
-|---|---|---|
-| A1 | Light (< 15,500 lbs) | smallProp |
-| A2 | Small (15,500 - 75,000 lbs) | regionalJet |
-| A3 | Large (75,000 - 300,000 lbs) | narrowBody |
-| A4 | High vortex large (B757) | narrowBody |
-| A5 | Heavy (> 300,000 lbs) | wideBody or heavy (by altitude/speed) |
-| A6 | High performance (> 5g, > 400 kts) | narrowBody |
-| A7 | Rotorcraft | helicopter |
-| B1 | Glider / sailplane | glider |
-| B2 | Lighter-than-air | balloon |
-| B4 | Skydiver drop plane | smallProp |
-| B6 | UAV | uav |
-
-Once an emitter category is received for an aircraft, it is locked in and heuristic re-evaluation is skipped.
-
-#### Tier 2: Heuristic Fallback (when no emitter category available)
-
-Priority order when ADS-B category is not available (some transponders don't broadcast it):
-1. **Helicopter callsigns**: known operator prefixes (LFE, MED, CHP, PHI, ERA, BHS) or keywords (LIFE, MERCY, COPTER, etc.)
-2. **Heavy/Wide body callsigns**: major airline ICAO prefixes (CPA, UAE, ETH, QTR, SIA, AAL, DAL, UAL, FDX, UPS, etc.) + altitude/speed thresholds
-3. **Altitude/speed extremes**: altitude > 42000 ft or speed > 550 kts = heavy; > 40000 ft or > 500 kts = wideBody
-4. **N-number (US GA registration)**: pattern `N` + digit + 2-4 alphanumerics = smallProp (or narrowBody if above 25000 ft)
-5. **Regional airline callsigns**: SKW, RPA, ASH, PDT, CHQ, ENY, JIA, CPZ
-6. **Speed/altitude heuristics**: speed < 60 + alt < 5000 = helicopter; alt < 18000 + speed < 300 = smallProp or regionalJet
-7. **Altitude-only**: < 10000 ft = smallProp, < 25000 ft = regionalJet, higher = narrowBody
-8. **Default**: narrowBody (re-evaluated when better data arrives)
-
-Important: `speed=0` or `altitude=0` means data not yet received, not actual zero. The system re-categorizes when better data arrives (speed > 0 and callsign present).
-
-### View Direction Controls
-
-The viewer can rotate between cardinal directions (N/E/S/W), showing aircraft in a 90° field of view:
-- **Keyboard**: Left/Right arrow keys or A/D keys
-- **UI**: Arrow buttons on the interface
-- Each direction displays a unique background image (north.png, east.png, south.png, west.png)
-- Sun and moon positions are calculated based on actual azimuth and only appear when in the current field of view
-
-### External APIs
-
-- **Open-Meteo**: Weather and sunrise/sunset data (updates every 10 minutes)
-- **ADS-B Receivers**: SBS/BaseStation protocol on port 30003 (flight data)
-- **dump1090 JSON API**: `http://{receiver}/dump1090/data/aircraft.json` on port 80 (emitter categories, polled every 5s)
-
-## Dependencies
-
-Python packages required:
-- aiohttp (web server and WebSocket)
-- netifaces (network interface scanning)
-- bcrypt (password hashing)
-
-No package.json - frontend is vanilla JavaScript with no build step.
-
-## Key Code Patterns
-
-- Canvas version parameter on assets (`?v=36`) for cache busting
-- Aircraft direction: `const isFacingLeft = flight.track > 90 && flight.track < 270`
-- Moon phases use sprite sheet cropping with 2x3 grid (3 columns, 2 rows)
-- Flight data stored in global `flights` dict keyed by ICAO hex code
-
-## Debugging
-
-```bash
-# Check for running server instances
-ps aux | grep server.py
-
-# Kill all instances
-pkill -9 -f server.py
-
-# Test receiver connectivity (replace with your receiver IP)
-nc -zv <receiver_ip> 30003
-```

CONTRIBUTING.md

@@ -0,0 +1,59 @@
+# Contributing to ADS-Bit
+
+Thanks for your interest in improving ADS-Bit! Contributions of all kinds —
+bug reports, features, sprites, themes, docs — are welcome.
+
+## Development setup
+
+ADS-Bit is a Python (aiohttp) backend with a vanilla-JavaScript frontend.
+There is **no build step** for the frontend.
+
+```bash
+git clone <your-fork-url>
+cd ADS-Bit
+pip install -r requirements.txt      # Python 3.9–3.11 recommended (see note below)
+cp config.json.example config.json   # optional; the setup wizard runs otherwise
+python3 server.py                     # serves on http://localhost:2001
+```
+
+Or with Docker (no local Python needed):
+
+```bash
+docker compose up -d
+```
+
+> **Python version note:** the `netifaces` dependency can be hard to build on
+> Python 3.12+. Use Python 3.9–3.11, or just use the Docker image (Python 3.11).
+
+## Project layout
+
+- `server.py` — aiohttp server: receiver connections, flight state, APIs, auth.
+- `ads-bit.js` / `index.html` — Canvas-based retro viewer.
+- `admin/` — admin panel, including the in-browser `pixel-editor.js`.
+- `setup/` — first-run setup wizard.
+- `images/`, `backgrounds/` — sprite and theme assets.
+
+## Conventions
+
+- **Frontend assets are cache-busted** via a `?v=YYYYMMDD[x]` query in
+  `admin/admin.html`. If you change `admin.css`, `admin.js`, or
+  `pixel-editor.js`, bump that token so browsers reload them.
+- The `VERSION` constant in `server.py` is the single source of truth; bump it
+  for releases and add a `CHANGELOG.md` entry.
+- Keep the retro aesthetic (Press Start 2P, blue/gold palette) for UI work.
+- Match the style of surrounding code; no frontend framework or build tooling.
+
+## Submitting changes
+
+1. Fork and create a topic branch (`feature/…`, `fix/…`, `chore/…`).
+2. Make focused commits with clear messages.
+3. Verify locally: the server starts, the page loads, and your change works.
+   For Docker changes, confirm `docker build` succeeds.
+4. Open a pull request describing what changed and how you tested it.
+
+CI will byte-compile the server, validate `config.json.example`, and build the
+Docker image on every PR.
+
+## Reporting bugs / requesting features
+
+Use the issue templates. For security issues, see [SECURITY.md](SECURITY.md).

Dockerfile

@@ -13,9 +13,16 @@ RUN pip install --no-cache-dir -r requirements.txt && \
     rm -rf /var/lib/apt/lists/*
 
 COPY . .
+RUN chmod +x /app/docker-entrypoint.sh
 
 EXPOSE 2001
 
-ENV PYTHONUNBUFFERED=1
+# Persist config on a mounted volume by default (see docker-compose.yml).
+ENV PYTHONUNBUFFERED=1 \
+    ADSBIT_CONFIG=/app/data/config.json
 
-CMD ["python3", "server.py"]
+# Liveness probe against the unauthenticated /health endpoint.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD python3 -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:2001/health',timeout=4).status==200 else 1)" || exit 1
+
+ENTRYPOINT ["/app/docker-entrypoint.sh"]

README.md

@@ -1,27 +1,45 @@
 # ADS-Bit
 
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Release](https://img.shields.io/github/v/release/AllenNPIT/ADS-Bit)](https://github.com/AllenNPIT/ADS-Bit/releases)
+[![CI](https://github.com/AllenNPIT/ADS-Bit/actions/workflows/ci.yml/badge.svg)](https://github.com/AllenNPIT/ADS-Bit/actions/workflows/ci.yml)
+
 A retro SNES-style side-view flight tracker that displays ADS-B aircraft data with custom pixel art sprites.
 
-![ADS-Bit Screenshot](screenshots/screenshot.png)
+## Screenshots
+
+### Live viewer
+
+Real-time ADS-B traffic rendered as pixel-art sprites over a directional background — here the East view, with a desert skyline on the horizon. Aircraft are labelled with callsign, altitude, and distance, and listed in the sidebar sorted by range.
+
+![Live viewer with aircraft in view](screenshots/viewer.png)
+
+### In-app pixel editor
+
+Draw and edit aircraft sprites directly in the browser: pencil, eraser, line/rectangle/ellipse shapes, fill bucket, select & move, zoom/pan, undo/redo, custom palettes, and an adjustable reference overlay. Saving uploads the sprite back to the running tracker — no external tools needed.
+
+![In-browser pixel sprite editor](screenshots/pixel-editor.png)
 
 ## Features
 
 - Real-time aircraft tracking via ADS-B receivers
-- Custom pixel art sprites for 6 aircraft types (small prop, regional jet, narrow body, wide body, heavy, helicopter)
+- Custom pixel art sprites for 9 aircraft types (small prop, regional jet, narrow body, wide body, heavy, helicopter, balloon, glider, UAV)
 - Animated sun and moon with accurate astronomical positions
 - Dynamic sky colors based on time of day
 - Weather visualization with cloud sprites
 - Directional view (N/E/S/W) with themed backgrounds
-- Auto-discovery of ADS-B receivers on your network
+- Auto-discovery of ADS-B receivers on your network, with per-interface scanning
 - Canvas-based 10 FPS retro rendering
 - Admin panel with password authentication
+- **In-app pixel editor** — draw and edit sprites in the browser (pencil, shapes, fill, select & move, reference overlay, custom palettes)
+- **Receiver health dashboard** — live per-receiver status (receiving / no data / unreachable), connection testing, and select → save → apply flow
 - First-run setup wizard
 
 ## Quick Start
 
 ```bash
 # Clone the repository
-git clone https://gitea.chops.one/allen/ADS-Bit.git
+git clone https://github.com/AllenNPIT/ADS-Bit.git
 cd ADS-Bit
 
 # Install dependencies
@@ -39,17 +57,33 @@ On first run, visit http://localhost:2001 and the setup wizard will guide you th
 
 - [Docker](https://docs.docker.com/get-docker/) with Compose V2, **or** [Podman](https://podman.io/) with `podman-compose`
 
-### First Run
+### Run the prebuilt image (no clone needed)
+
+Once a release is published, a multi-arch image (amd64 + arm64, e.g. Raspberry Pi)
+is available from GitHub Container Registry:
 
 ```bash
-# Create a config file (the setup wizard runs if you skip this)
-cp config.json.example config.json
+docker run -d --name ads-bit --network host --restart unless-stopped \
+  -e ADSBIT_CONFIG=/app/data/config.json \
+  -v "$PWD/data:/app/data" \
+  ghcr.io/allennpit/ads-bit:latest
+```
 
-# Build and start
+Then open http://localhost:2001 and complete the setup wizard.
+
+### Build from source
+
+```bash
+# Build and start — no config step needed
 docker compose up -d
 ```
 
-The web UI is available at http://localhost:2001.
+A config file is created automatically in `data/` on first run, then the
+browser **setup wizard** walks you through receiver, location, and password
+setup. The web UI is available at http://localhost:2001.
+
+A `/health` endpoint (used by the container healthcheck) reports status,
+version, and receiver/flight counts: `curl http://localhost:2001/health`.
 
 ### Useful Commands
 
@@ -80,15 +114,15 @@ The following paths are bind-mounted from the repo directory and persist across
 
 | Path | Contents |
 |------|----------|
-| `config.json` | Server configuration and credentials |
+| `data/` | Server configuration and credentials (`config.json`, auto-seeded) |
 | `images/` | Aircraft and UI sprites (including uploads) |
 | `backgrounds/` | Theme background images (including custom themes) |
 
-Host networking (`network_mode: host`) is used so the server can auto-scan your LAN for ADS-B receivers.
+Host networking (`network_mode: host`) is used so the server can auto-scan your LAN for ADS-B receivers. Auto-scan skips oversized subnets (larger than /20, e.g. a Docker bridge `172.17.0.0/16`); if your receiver lives on such a network, set it explicitly via the admin Receivers tab.
 
 ## Requirements
 
-- Python 3.8+
+- Python 3.9–3.11 (3.12+ may require build tools for `netifaces`; the Docker image uses 3.11)
 - ADS-B receiver providing SBS/BaseStation format on port 30003 (dump1090, readsb, etc.)
 - Modern web browser with Canvas support
 
@@ -102,8 +136,8 @@ ADS-Bit uses a first-run setup wizard to configure your installation. You can al
   "receiver_port": 30003,
   "location": {
     "name": "My Location",
-    "lat": 36.2788,
-    "lon": -115.2283
+    "lat": 0.0,
+    "lon": 0.0
   },
   "web_port": 2001,
   "theme": "desert"

SECURITY.md

@@ -0,0 +1,35 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 1.1.x   | ✅        |
+| < 1.1   | ❌        |
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security vulnerabilities.
+
+Instead, use GitHub's private vulnerability reporting:
+**Security → Report a vulnerability** on the repository.
+
+Include as much detail as you can:
+- Affected version (see the version in the admin header or `GET /api/config`)
+- Steps to reproduce / proof of concept
+- Impact and any suggested remediation
+
+You can expect an acknowledgement within a few days. Please allow reasonable
+time for a fix before any public disclosure.
+
+## Security Notes for Operators
+
+ADS-Bit is intended for trusted LANs, not direct exposure to the public
+internet. If you must expose it:
+
+- Set a strong admin password (changed from the setup default).
+- Put it behind HTTPS via a reverse proxy or tunnel (e.g. Caddy, nginx,
+  Tailscale). The built-in server speaks plain HTTP.
+- Never commit your `config.json` — it contains the admin password hash and
+  session secret. It is git-ignored by default; fresh installs start from
+  `config.json.example`.

admin/admin.css

@@ -169,6 +169,15 @@ textarea {
     margin: 0;
 }
 
+.admin-version {
+    font-family: 'Courier New', monospace;
+    font-size: 11px;
+    color: #54fc54;
+    text-shadow: none;
+    margin-left: 6px;
+    vertical-align: middle;
+}
+
 .header-actions {
     display: flex;
     gap: 8px;
@@ -901,6 +910,53 @@ body.pe-open { overflow: hidden; }
 
 .pe-readout span { color: #54fc54; }
 
+/* Sidebar: opacity, palettes, reference */
+.pe-opacity-group {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+}
+.pe-opacity-group input[type="range"] { width: 100%; accent-color: #fcd444; }
+
+.pe-subhead {
+    font-family: 'Press Start 2P', monospace;
+    font-size: 7px;
+    color: #b4d4ec;
+    margin-top: 4px;
+    letter-spacing: 1px;
+}
+
+.pe-mini-btn {
+    font-family: 'Press Start 2P', monospace;
+    font-size: 7px;
+    padding: 6px 4px;
+    border: 2px solid #5c94fc;
+    border-radius: 5px;
+    background: rgba(92, 148, 252, 0.15);
+    color: #fcfcfc;
+    cursor: pointer;
+    transition: all 0.12s;
+    text-align: center;
+}
+.pe-mini-btn:hover { background: rgba(92, 148, 252, 0.4); }
+
+#pe-custom-palette:empty::after,
+#pe-recent-palette:empty::after {
+    content: '—';
+    color: #555;
+    font-size: 11px;
+}
+
+.pe-ref-controls {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+}
+.pe-ref-row { display: flex; gap: 6px; }
+.pe-ref-row .pe-mini-btn { flex: 1; }
+.pe-ref-load { display: inline-block; }
+.pe-ref-controls input[type="range"] { width: 100%; accent-color: #fcd444; }
+
 /* Sprite card EDIT button uses primary accent */
 .sprite-edit-btn { border-color: #fcd444; color: #fcd444; }
 .sprite-edit-btn:hover { background: rgba(252, 212, 68, 0.3); }

admin/admin.html

@@ -7,7 +7,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Press+Start+2P&display=swap" rel="stylesheet">
-    <link rel="stylesheet" href="/admin/admin.css?v=20260609b">
+    <link rel="stylesheet" href="/admin/admin.css?v=20260609d">
 </head>
 <body>
     <!-- Login Screen -->
@@ -27,7 +27,7 @@
     <!-- Admin Panel -->
     <div id="admin-panel" class="hidden">
         <header class="admin-header">
-            <h1 class="retro-title">ADS-Bit Admin</h1>
+            <h1 class="retro-title">ADS-Bit Admin <span id="admin-version" class="admin-version"></span></h1>
             <div class="header-actions">
                 <a href="/" class="btn btn-small">VIEWER</a>
                 <button id="logout-btn" class="btn btn-small btn-danger">LOGOUT</button>
@@ -297,7 +297,7 @@
         <div id="toast" class="toast hidden"></div>
     </div>
 
-    <script src="/admin/pixel-editor.js?v=20260609b"></script>
-    <script src="/admin/admin.js?v=20260609b"></script>
+    <script src="/admin/pixel-editor.js?v=20260609d"></script>
+    <script src="/admin/admin.js?v=20260609d"></script>
 </body>
 </html>

admin/admin.js

@@ -28,10 +28,22 @@
         loadConfig();
         loadThemes();
         loadNetworkInfo();
+        loadVersion();
         refreshStatus();
         statusInterval = setInterval(refreshStatus, 5000);
     }
 
+    async function loadVersion() {
+        try {
+            const res = await fetch('/api/config');
+            if (!res.ok) return;
+            const data = await res.json();
+            if (data.version) {
+                document.getElementById('admin-version').textContent = 'v' + data.version;
+            }
+        } catch (e) { /* ignore */ }
+    }
+
     document.getElementById('login-form').addEventListener('submit', async (e) => {
         e.preventDefault();
         const pw = document.getElementById('login-password').value;

admin/pixel-editor.js

@@ -4,10 +4,13 @@
 // is POSTed to the existing /api/admin/sprites/{type} endpoint.
 //
 // Public API:
-//   PixelEditor.open(spriteType, { existingUrl, onSave })
+//   PixelEditor.open(spriteType, { onSave })
 //
-// Tools: pencil, eraser, color picker, fill bucket, pan.
-// Features: zoom/pan, undo/redo, grid overlay, load existing, export PNG.
+// Tools:    pencil, eraser, color picker, fill bucket, pan,
+//           line, rectangle, ellipse (outline/filled), rectangular select.
+// Features: zoom/pan, undo/redo, grid overlay, brush size & opacity,
+//           custom + recent color palettes, reference-image overlay,
+//           selection move/cut/copy/paste/delete, load existing, export PNG.
 (function () {
     'use strict';
 
@@ -20,6 +23,8 @@
     const MAX_ZOOM = 40;
     const HISTORY_LIMIT = 40;       // max undo snapshots (~666 KB each)
     const GRID_MIN_ZOOM = 6;        // only show pixel grid when zoomed in enough
+    const RECENT_LIMIT = 10;
+    const CUSTOM_KEY = 'pe-custom-palette';
 
     // ----- Retro palette (SNES-style white/blue/red leaning) -----
     const PALETTE = [
@@ -29,6 +34,8 @@
         '#54fc54', '#2c942c', '#a4e4a4', '#fc54fc', '#9438a8', '#54fcdc',
     ];
 
+    const SHAPE_TOOLS = ['line', 'rect', 'ellipse'];
+
     // ----- Module state -----
     let root = null;            // overlay element
     let els = {};               // cached DOM references
@@ -40,7 +47,9 @@
 
     let tool = 'pencil';
     let brushSize = 1;
+    let brushOpacity = 1;       // 0..1, applies to color tools (not eraser)
     let color = '#5c94fc';
+    let shapeFill = false;
     let zoom = 1;
     let panX = 0, panY = 0;
     let showGrid = true;
@@ -49,11 +58,29 @@
     let saveCallback = null;
 
     // Pointer interaction state
-    let drawing = false;        // a draw stroke is in progress
-    let panning = false;        // a pan drag is in progress
+    let drawing = false;        // pencil/eraser stroke in progress
+    let drawingShape = false;   // line/rect/ellipse drag in progress
+    let panning = false;        // pan drag in progress
     let spaceDown = false;      // hold space to temporarily pan
     let lastDraw = null;        // last source pixel during a stroke {x,y}
-    let panStart = null;        // {x,y,panX,panY} at pan start
+    let panStart = null;        // {cx,cy,panX,panY} at pan start
+    let shapeStart = null;      // {x,y} where a shape drag began
+    let shapeSnapshot = null;   // ImageData captured at shape drag start
+
+    // Selection / move / clipboard
+    let selection = null;       // {x,y,w,h} committed selection (source px)
+    let selDrag = null;         // {mode:'new'|'move', sx,sy, ox,oy}
+    let floating = null;        // {canvas,x,y,w,h} lifted/pasted pixels
+    let clipboard = null;       // <canvas> of copied pixels
+
+    // Color palettes
+    let recentColors = [];
+    let customPalette = [];
+
+    // Reference overlay
+    let refImage = null;
+    let refOpacity = 0.5;
+    let refVisible = true;
 
     // Undo/redo
     let history = [];
@@ -86,6 +113,15 @@
                             <button class="pe-tool" data-tool="eraser" title="Eraser (E)">⌫</button>
                             <button class="pe-tool" data-tool="picker" title="Color picker (I)">⊙</button>
                             <button class="pe-tool" data-tool="fill" title="Fill bucket (F)">▣</button>
+                        </div>
+                        <div class="pe-tool-group">
+                            <button class="pe-tool" data-tool="line" title="Line (L)">╱</button>
+                            <button class="pe-tool" data-tool="rect" title="Rectangle (R)">▭</button>
+                            <button class="pe-tool" data-tool="ellipse" title="Ellipse (O)">◯</button>
+                            <label class="pe-check" title="Fill shapes"><input type="checkbox" id="pe-fill"> FILL</label>
+                        </div>
+                        <div class="pe-tool-group">
+                            <button class="pe-tool" data-tool="select" title="Select & move (M)">⬚</button>
                             <button class="pe-tool" data-tool="pan" title="Pan (hold Space)">✥</button>
                         </div>
                         <div class="pe-tool-group">
@@ -114,11 +150,31 @@
                             <div class="pe-swatch-large" id="pe-current-swatch"></div>
                             <input type="color" id="pe-color-input" value="#5c94fc">
                         </div>
+                        <div class="pe-opacity-group">
+                            <span class="pe-tool-label">OPACITY <span id="pe-opacity-val">100%</span></span>
+                            <input type="range" id="pe-opacity" min="10" max="100" value="100">
+                        </div>
                         <div class="pe-palette" id="pe-palette"></div>
+                        <button class="pe-mini-btn" id="pe-add-swatch" title="Save current color to your custom palette">+ SAVE COLOR</button>
+                        <div class="pe-subhead" id="pe-custom-head">CUSTOM</div>
+                        <div class="pe-palette" id="pe-custom-palette"></div>
+                        <div class="pe-subhead">RECENT</div>
+                        <div class="pe-palette" id="pe-recent-palette"></div>
+                        <div class="pe-subhead">REFERENCE</div>
+                        <div class="pe-ref-controls">
+                            <div class="pe-ref-row">
+                                <label class="pe-mini-btn pe-ref-load">LOAD
+                                    <input type="file" id="pe-ref-file" accept="image/*" hidden>
+                                </label>
+                                <button class="pe-mini-btn" id="pe-ref-clear">CLEAR</button>
+                            </div>
+                            <label class="pe-check"><input type="checkbox" id="pe-ref-show" checked> SHOW</label>
+                            <input type="range" id="pe-ref-opacity" min="5" max="100" value="50" title="Reference opacity">
+                        </div>
                         <div class="pe-readout">
                             <div>POS <span id="pe-pos">--, --</span></div>
                             <div>ZOOM <span id="pe-zoom-val">100%</span></div>
-                            <div>SIZE 500×333</div>
+                            <div>SEL <span id="pe-sel">none</span></div>
                         </div>
                     </div>
                 </div>
@@ -130,15 +186,24 @@
         els.title = root.querySelector('#pe-title');
         els.wrap = root.querySelector('#pe-canvas-wrap');
         els.palette = root.querySelector('#pe-palette');
+        els.customPalette = root.querySelector('#pe-custom-palette');
+        els.recentPalette = root.querySelector('#pe-recent-palette');
         els.currentSwatch = root.querySelector('#pe-current-swatch');
         els.colorInput = root.querySelector('#pe-color-input');
         els.pos = root.querySelector('#pe-pos');
         els.zoomVal = root.querySelector('#pe-zoom-val');
+        els.selVal = root.querySelector('#pe-sel');
         els.brush = root.querySelector('#pe-brush');
         els.brushVal = root.querySelector('#pe-brush-val');
+        els.fill = root.querySelector('#pe-fill');
+        els.opacity = root.querySelector('#pe-opacity');
+        els.opacityVal = root.querySelector('#pe-opacity-val');
         els.grid = root.querySelector('#pe-grid');
         els.undo = root.querySelector('#pe-undo');
         els.redo = root.querySelector('#pe-redo');
+        els.refFile = root.querySelector('#pe-ref-file');
+        els.refShow = root.querySelector('#pe-ref-show');
+        els.refOpacity = root.querySelector('#pe-ref-opacity');
 
         viewCanvas = root.querySelector('#pe-view');
         viewCtx = viewCanvas.getContext('2d');
@@ -149,32 +214,49 @@
         srcCanvas.height = SPRITE_H;
         srcCtx = srcCanvas.getContext('2d', { willReadFrequently: true });
 
-        buildPalette();
+        buildPalette(els.palette, PALETTE, false);
         wireEvents();
     }
 
-    function buildPalette() {
-        els.palette.innerHTML = '';
-        PALETTE.forEach(c => {
+    // Build a row of color swatches. `removable` enables right-click removal
+    // (used by the custom palette).
+    function buildPalette(container, colors, removable) {
+        container.innerHTML = '';
+        colors.forEach(c => {
             const sw = document.createElement('button');
             sw.className = 'pe-swatch';
             sw.style.background = c;
-            sw.title = c;
+            sw.title = removable ? `${c} (right-click to remove)` : c;
             sw.addEventListener('click', () => setColor(c));
-            els.palette.appendChild(sw);
+            if (removable) {
+                sw.addEventListener('contextmenu', (e) => {
+                    e.preventDefault();
+                    customPalette = customPalette.filter(x => x !== c);
+                    saveCustomPalette();
+                    buildCustomPalette();
+                });
+            }
+            container.appendChild(sw);
         });
     }
 
+    function buildCustomPalette() {
+        buildPalette(els.customPalette, customPalette, true);
+        root.querySelector('#pe-custom-head').style.opacity = customPalette.length ? '1' : '0.5';
+    }
+
+    function buildRecentPalette() {
+        buildPalette(els.recentPalette, recentColors, false);
+    }
+
     // ===================================================================
     // Event wiring
     // ===================================================================
     function wireEvents() {
-        // Tool buttons
         root.querySelectorAll('.pe-tool').forEach(btn => {
             btn.addEventListener('click', () => setTool(btn.dataset.tool));
         });
 
-        // Header actions
         root.querySelector('#pe-close').addEventListener('click', () => {
             if (confirmDiscard()) close();
         });
@@ -182,24 +264,39 @@
         root.querySelector('#pe-load').addEventListener('click', () => loadExisting(true));
         root.querySelector('#pe-clear').addEventListener('click', clearCanvas);
 
-        // Zoom controls
         root.querySelector('#pe-zoom-in').addEventListener('click', () => zoomAt(1.25, centerPoint()));
         root.querySelector('#pe-zoom-out').addEventListener('click', () => zoomAt(0.8, centerPoint()));
         root.querySelector('#pe-zoom-fit').addEventListener('click', fitToScreen);
 
-        // Undo/redo
         els.undo.addEventListener('click', undo);
         els.redo.addEventListener('click', redo);
 
-        // Grid + brush
         els.grid.addEventListener('change', () => { showGrid = els.grid.checked; render(); });
         els.brush.addEventListener('input', () => {
             brushSize = parseInt(els.brush.value, 10);
             els.brushVal.textContent = brushSize;
         });
+        els.fill.addEventListener('change', () => { shapeFill = els.fill.checked; });
+        els.opacity.addEventListener('input', () => {
+            brushOpacity = parseInt(els.opacity.value, 10) / 100;
+            els.opacityVal.textContent = els.opacity.value + '%';
+        });
 
-        // Color input
         els.colorInput.addEventListener('input', () => setColor(els.colorInput.value));
+        root.querySelector('#pe-add-swatch').addEventListener('click', addCurrentColorToPalette);
+
+        // Reference overlay
+        els.refFile.addEventListener('change', (e) => {
+            const f = e.target.files[0];
+            if (f) loadRefFromFile(f);
+            e.target.value = '';
+        });
+        root.querySelector('#pe-ref-clear').addEventListener('click', clearRef);
+        els.refShow.addEventListener('change', () => { refVisible = els.refShow.checked; render(); });
+        els.refOpacity.addEventListener('input', () => {
+            refOpacity = parseInt(els.refOpacity.value, 10) / 100;
+            render();
+        });
 
         // Canvas pointer events
         viewCanvas.addEventListener('pointerdown', onPointerDown);
@@ -209,11 +306,9 @@
         viewCanvas.addEventListener('wheel', onWheel, { passive: false });
         viewCanvas.addEventListener('contextmenu', e => e.preventDefault());
 
-        // Keyboard shortcuts (only active while editor is open)
         document.addEventListener('keydown', onKeyDown);
         document.addEventListener('keyup', onKeyUp);
 
-        // Keep the view sized to its container
         window.addEventListener('resize', () => { if (isOpen()) { resizeView(); render(); } });
     }
 
@@ -227,16 +322,28 @@
         saveCallback = opts.onSave || null;
         els.title.textContent = 'PIXEL EDITOR — ' + type;
 
-        // Reset state
+        // Reset transient state
         zoom = 1; panX = 0; panY = 0;
         history = []; historyIndex = -1;
+        selection = null; selDrag = null; floating = null;
+        drawing = drawingShape = false; shapeSnapshot = null;
+        refImage = null; refVisible = true;
+        recentColors = [];
+        brushOpacity = 1;
+        shapeFill = false;
+        els.opacity.value = 100; els.opacityVal.textContent = '100%';
+        els.fill.checked = false;
+        els.refShow.checked = true;
+        loadCustomPalette();
+        buildCustomPalette();
+        buildRecentPalette();
         setTool('pencil');
+        updateSelReadout();
         srcCtx.clearRect(0, 0, SPRITE_W, SPRITE_H);
 
         root.classList.remove('hidden');
         document.body.classList.add('pe-open');
 
-        // Load existing sprite (if any), then size + draw.
         loadExisting(false, () => {
             resizeView();
             fitToScreen();
@@ -255,8 +362,7 @@
     }
 
     function confirmDiscard() {
-        // Only warn if there is edit history beyond the baseline.
-        if (historyIndex > 0) {
+        if (historyIndex > 0 || floating) {
             return window.confirm('Discard unsaved changes and close the editor?');
         }
         return true;
@@ -270,7 +376,6 @@
         const img = new Image();
         img.onload = () => {
             srcCtx.clearRect(0, 0, SPRITE_W, SPRITE_H);
-            // Draw centered/stretched into the 500x333 buffer.
             srcCtx.imageSmoothingEnabled = false;
             srcCtx.drawImage(img, 0, 0, SPRITE_W, SPRITE_H);
             if (recordHistory) { pushHistory(); toast('Loaded current sprite'); }
@@ -278,7 +383,6 @@
             if (done) done();
         };
         img.onerror = () => {
-            // No existing sprite — start from a blank transparent canvas.
             if (recordHistory) { pushHistory(); toast('No existing sprite — blank canvas', true); }
             render();
             if (done) done();
@@ -287,6 +391,7 @@
     }
 
     function clearCanvas() {
+        floating = null; selection = null; updateSelReadout();
         srcCtx.clearRect(0, 0, SPRITE_W, SPRITE_H);
         pushHistory();
         render();
@@ -296,6 +401,10 @@
     // Tool / color selection
     // ===================================================================
     function setTool(t) {
+        if (t !== tool) {
+            stampFloating();           // commit any lifted pixels before switching
+            if (t !== 'select') { selection = null; updateSelReadout(); }
+        }
         tool = t;
         root.querySelectorAll('.pe-tool').forEach(b => {
             b.classList.toggle('active', b.dataset.tool === t);
@@ -311,13 +420,69 @@
         }
     }
 
+    function recordColor(c) {
+        c = c.toLowerCase();
+        recentColors = recentColors.filter(x => x !== c);
+        recentColors.unshift(c);
+        if (recentColors.length > RECENT_LIMIT) recentColors.length = RECENT_LIMIT;
+        buildRecentPalette();
+    }
+
+    function addCurrentColorToPalette() {
+        const c = color.toLowerCase();
+        if (!customPalette.includes(c)) {
+            customPalette.push(c);
+            saveCustomPalette();
+            buildCustomPalette();
+            toast('Color saved to palette');
+        }
+    }
+
+    function loadCustomPalette() {
+        try { customPalette = JSON.parse(localStorage.getItem(CUSTOM_KEY) || '[]'); }
+        catch (e) { customPalette = []; }
+    }
+    function saveCustomPalette() {
+        try { localStorage.setItem(CUSTOM_KEY, JSON.stringify(customPalette)); } catch (e) { /* ignore */ }
+    }
+
     function updateCursor() {
         let cur = 'crosshair';
         if (tool === 'pan' || spaceDown) cur = panning ? 'grabbing' : 'grab';
         else if (tool === 'picker') cur = 'cell';
+        else if (tool === 'select') cur = 'crosshair';
         viewCanvas.style.cursor = cur;
     }
 
+    function updateSelReadout() {
+        if (floating) els.selVal.textContent = `${floating.w}×${floating.h} (moving)`;
+        else if (selection) els.selVal.textContent = `${selection.w}×${selection.h}`;
+        else els.selVal.textContent = 'none';
+    }
+
+    // ===================================================================
+    // Reference overlay
+    // ===================================================================
+    function loadRefFromFile(file) {
+        const url = URL.createObjectURL(file);
+        const img = new Image();
+        img.onload = () => {
+            refImage = img;
+            refVisible = true;
+            els.refShow.checked = true;
+            render();
+            URL.revokeObjectURL(url);
+            toast('Reference loaded');
+        };
+        img.onerror = () => { toast('Could not load reference image', true); URL.revokeObjectURL(url); };
+        img.src = url;
+    }
+
+    function clearRef() {
+        refImage = null;
+        render();
+    }
+
     // ===================================================================
     // Coordinate mapping
     // ===================================================================
@@ -336,6 +501,9 @@
         return { cx: viewCanvas.width / 2, cy: viewCanvas.height / 2 };
     }
 
+    function isShapeTool(t) { return SHAPE_TOOLS.indexOf(t) !== -1; }
+    function pointInRect(p, r) { return r && p.x >= r.x && p.x < r.x + r.w && p.y >= r.y && p.y < r.y + r.h; }
+
     // ===================================================================
     // Pointer handlers
     // ===================================================================
@@ -352,14 +520,26 @@
             return;
         }
 
-        if (tool === 'picker') {
-            pickColor(p.x, p.y);
-            return;
-        }
+        if (tool === 'picker') { pickColor(p.x, p.y); return; }
+
+        if (tool === 'select') { onSelectDown(p); return; }
+
+        // All remaining tools draw onto the canvas — commit any floating first.
+        stampFloating();
 
         if (tool === 'fill') {
             floodFill(p.x, p.y);
             pushHistory();
+            recordColor(color);
+            render();
+            return;
+        }
+
+        if (isShapeTool(tool)) {
+            shapeStart = { x: p.x, y: p.y };
+            shapeSnapshot = srcCtx.getImageData(0, 0, SPRITE_W, SPRITE_H);
+            drawingShape = true;
+            rasterShape(tool, p.x, p.y, p.x, p.y);
             render();
             return;
         }
@@ -372,13 +552,30 @@
         render();
     }
 
+    function onSelectDown(p) {
+        if (floating) {
+            if (pointInRect(p, floating)) {
+                selDrag = { mode: 'move', sx: p.x, sy: p.y, ox: floating.x, oy: floating.y };
+                return;
+            }
+            stampFloating();    // clicked outside → drop it in place
+        }
+        if (selection && pointInRect(p, selection)) {
+            liftSelection();    // begin moving the committed selection
+            selDrag = { mode: 'move', sx: p.x, sy: p.y, ox: floating.x, oy: floating.y };
+            return;
+        }
+        // Begin a new selection rectangle.
+        selDrag = { mode: 'new', sx: p.x, sy: p.y };
+        selection = { x: p.x, y: p.y, w: 1, h: 1 };
+        updateSelReadout();
+        render();
+    }
+
     function onPointerMove(e) {
         const p = eventToSource(e);
-        if (p.x >= 0 && p.x < SPRITE_W && p.y >= 0 && p.y < SPRITE_H) {
-            els.pos.textContent = `${p.x}, ${p.y}`;
-        } else {
-            els.pos.textContent = '--, --';
-        }
+        els.pos.textContent = (p.x >= 0 && p.x < SPRITE_W && p.y >= 0 && p.y < SPRITE_H)
+            ? `${p.x}, ${p.y}` : '--, --';
 
         if (panning && panStart) {
             panX = panStart.panX + (e.clientX - panStart.cx);
@@ -387,8 +584,31 @@
             return;
         }
 
+        if (selDrag) {
+            if (selDrag.mode === 'new') {
+                const x0 = clamp(selDrag.sx, 0, SPRITE_W - 1), y0 = clamp(selDrag.sy, 0, SPRITE_H - 1);
+                const x1 = clamp(p.x, 0, SPRITE_W - 1), y1 = clamp(p.y, 0, SPRITE_H - 1);
+                selection = {
+                    x: Math.min(x0, x1), y: Math.min(y0, y1),
+                    w: Math.abs(x1 - x0) + 1, h: Math.abs(y1 - y0) + 1
+                };
+            } else if (floating) {
+                floating.x = selDrag.ox + (p.x - selDrag.sx);
+                floating.y = selDrag.oy + (p.y - selDrag.sy);
+            }
+            updateSelReadout();
+            render();
+            return;
+        }
+
+        if (drawingShape) {
+            srcCtx.putImageData(shapeSnapshot, 0, 0);
+            rasterShape(tool, shapeStart.x, shapeStart.y, p.x, p.y);
+            render();
+            return;
+        }
+
         if (drawing && (tool === 'pencil' || tool === 'eraser')) {
-            // Interpolate from the last point so fast strokes have no gaps.
             if (lastDraw) lineApply(lastDraw.x, lastDraw.y, p.x, p.y);
             else applyBrush(p.x, p.y);
             lastDraw = { x: p.x, y: p.y };
@@ -397,10 +617,25 @@
     }
 
     function onPointerUp() {
+        if (selDrag) {
+            if (selDrag.mode === 'new' && selection && (selection.w < 1 || selection.h < 1)) {
+                selection = null;
+            }
+            selDrag = null;
+            updateSelReadout();
+            render();
+        }
+        if (drawingShape) {
+            drawingShape = false;
+            shapeSnapshot = null;
+            pushHistory();
+            recordColor(color);
+        }
         if (drawing) {
             drawing = false;
             lastDraw = null;
-            pushHistory();          // one undo step per completed stroke
+            pushHistory();
+            if (tool !== 'eraser') recordColor(color);
         }
         if (panning) {
             panning = false;
@@ -412,8 +647,7 @@
     function onWheel(e) {
         e.preventDefault();
         const rect = viewCanvas.getBoundingClientRect();
-        const focus = { cx: e.clientX - rect.left, cy: e.clientY - rect.top };
-        zoomAt(e.deltaY < 0 ? 1.15 : 0.87, focus);
+        zoomAt(e.deltaY < 0 ? 1.15 : 0.87, { cx: e.clientX - rect.left, cy: e.clientY - rect.top });
     }
 
     // ===================================================================
@@ -425,12 +659,14 @@
         if (tool === 'eraser') {
             srcCtx.clearRect(x0, y0, brushSize, brushSize);
         } else {
+            srcCtx.globalAlpha = brushOpacity;
             srcCtx.fillStyle = color;
             srcCtx.fillRect(x0, y0, brushSize, brushSize);
+            srcCtx.globalAlpha = 1;
         }
     }
 
-    // Bresenham line between two source pixels, stamping the brush along it.
+    // Bresenham line, stamping the brush along it.
     function lineApply(x0, y0, x1, y1) {
         const dx = Math.abs(x1 - x0), dy = Math.abs(y1 - y0);
         const sx = x0 < x1 ? 1 : -1, sy = y0 < y1 ? 1 : -1;
@@ -444,6 +680,66 @@
         }
     }
 
+    // ----- Shape rasterizers (commit into srcCtx) -----
+    function rasterShape(t, x0, y0, x1, y1) {
+        if (t === 'line') lineApply(x0, y0, x1, y1);
+        else if (t === 'rect') rasterRect(x0, y0, x1, y1, shapeFill);
+        else if (t === 'ellipse') rasterEllipse(x0, y0, x1, y1, shapeFill);
+    }
+
+    function rasterRect(x0, y0, x1, y1, fill) {
+        const left = Math.min(x0, x1), right = Math.max(x0, x1);
+        const top = Math.min(y0, y1), bottom = Math.max(y0, y1);
+        if (fill) {
+            srcCtx.globalAlpha = brushOpacity;
+            srcCtx.fillStyle = color;
+            srcCtx.fillRect(left, top, right - left + 1, bottom - top + 1);
+            srcCtx.globalAlpha = 1;
+        } else {
+            lineApply(left, top, right, top);
+            lineApply(left, bottom, right, bottom);
+            lineApply(left, top, left, bottom);
+            lineApply(right, top, right, bottom);
+        }
+    }
+
+    function rasterEllipse(x0, y0, x1, y1, fill) {
+        const left = Math.min(x0, x1), right = Math.max(x0, x1);
+        const top = Math.min(y0, y1), bottom = Math.max(y0, y1);
+        const a = (right - left) / 2, b = (bottom - top) / 2;
+        const cx = (left + right) / 2, cy = (top + bottom) / 2;
+        if (a < 0.5 || b < 0.5) { lineApply(left, top, right, bottom); return; }
+
+        if (fill) {
+            srcCtx.globalAlpha = brushOpacity;
+            srcCtx.fillStyle = color;
+            for (let y = top; y <= bottom; y++) {
+                const ny = (y - cy) / b;
+                if (Math.abs(ny) > 1) continue;
+                const dx = a * Math.sqrt(1 - ny * ny);
+                const xl = Math.round(cx - dx), xr = Math.round(cx + dx);
+                srcCtx.fillRect(xl, y, xr - xl + 1, 1);
+            }
+            srcCtx.globalAlpha = 1;
+        } else {
+            // Scan rows then columns so the 1px outline has no gaps.
+            for (let y = top; y <= bottom; y++) {
+                const ny = (y - cy) / b;
+                if (Math.abs(ny) > 1) continue;
+                const dx = a * Math.sqrt(1 - ny * ny);
+                applyBrush(Math.round(cx - dx), y);
+                applyBrush(Math.round(cx + dx), y);
+            }
+            for (let x = left; x <= right; x++) {
+                const nx = (x - cx) / a;
+                if (Math.abs(nx) > 1) continue;
+                const dy = b * Math.sqrt(1 - nx * nx);
+                applyBrush(x, Math.round(cy - dy));
+                applyBrush(x, Math.round(cy + dy));
+            }
+        }
+    }
+
     function pickColor(x, y) {
         if (x < 0 || x >= SPRITE_W || y < 0 || y >= SPRITE_H) return;
         const d = srcCtx.getImageData(x, y, 1, 1).data;
@@ -462,7 +758,6 @@
         const fill = hexToRgb(color);
         const fillA = 255;
 
-        // No-op if the target already equals the fill color.
         if (target[0] === fill.r && target[1] === fill.g &&
             target[2] === fill.b && target[3] === fillA) return;
 
@@ -482,13 +777,104 @@
         srcCtx.putImageData(img, 0, 0);
     }
 
+    // ===================================================================
+    // Selection / move / clipboard
+    // ===================================================================
+    function clampSelection() {
+        if (!selection) return;
+        const x = clamp(selection.x, 0, SPRITE_W - 1);
+        const y = clamp(selection.y, 0, SPRITE_H - 1);
+        selection = {
+            x, y,
+            w: clamp(selection.w, 1, SPRITE_W - x),
+            h: clamp(selection.h, 1, SPRITE_H - y),
+        };
+    }
+
+    // Lift the selected pixels off the canvas into a floating layer.
+    function liftSelection() {
+        clampSelection();
+        const { x, y, w, h } = selection;
+        const c = document.createElement('canvas');
+        c.width = w; c.height = h;
+        c.getContext('2d').drawImage(srcCanvas, x, y, w, h, 0, 0, w, h);
+        srcCtx.clearRect(x, y, w, h);
+        floating = { canvas: c, x, y, w, h };
+        selection = null;
+        updateSelReadout();
+    }
+
+    // Composite the floating layer back onto the canvas and record history.
+    function stampFloating() {
+        if (!floating) return;
+        srcCtx.drawImage(floating.canvas, floating.x, floating.y);
+        floating = null;
+        updateSelReadout();
+        pushHistory();
+        render();
+    }
+
+    function copySelection() {
+        if (!selection) { toast('Nothing selected', true); return; }
+        clampSelection();
+        const { x, y, w, h } = selection;
+        const c = document.createElement('canvas');
+        c.width = w; c.height = h;
+        c.getContext('2d').drawImage(srcCanvas, x, y, w, h, 0, 0, w, h);
+        clipboard = c;
+        toast(`Copied ${w}×${h}`);
+    }
+
+    function cutSelection() {
+        if (!selection) { toast('Nothing selected', true); return; }
+        copySelection();
+        const { x, y, w, h } = selection;
+        srcCtx.clearRect(x, y, w, h);
+        selection = null;
+        updateSelReadout();
+        pushHistory();
+        render();
+    }
+
+    function pasteClipboard() {
+        if (!clipboard) { toast('Clipboard empty', true); return; }
+        stampFloating();
+        const c = document.createElement('canvas');
+        c.width = clipboard.width; c.height = clipboard.height;
+        c.getContext('2d').drawImage(clipboard, 0, 0);
+        const x = selection ? selection.x : 0;
+        const y = selection ? selection.y : 0;
+        floating = { canvas: c, x, y, w: c.width, h: c.height };
+        setTool('select');
+        updateSelReadout();
+        render();
+        toast('Pasted — drag to position, Enter to place');
+    }
+
+    function deleteSelection() {
+        if (floating) { floating = null; updateSelReadout(); pushHistory(); render(); return; }
+        if (!selection) return;
+        clampSelection();
+        const { x, y, w, h } = selection;
+        srcCtx.clearRect(x, y, w, h);
+        pushHistory();
+        render();
+    }
+
+    function nudgeFloating(dx, dy) {
+        if (!floating && selection) liftSelection();
+        if (floating) {
+            floating.x += dx; floating.y += dy;
+            render();
+        }
+    }
+
     // ===================================================================
     // Zoom / pan
     // ===================================================================
     function zoomAt(factor, focus) {
         const newZoom = clamp(zoom * factor, MIN_ZOOM, MAX_ZOOM);
         if (newZoom === zoom) return;
-        // Keep the source pixel under the focus point stationary.
         const sxBefore = (focus.cx - panX) / zoom;
         const syBefore = (focus.cy - panY) / zoom;
         zoom = newZoom;
@@ -521,13 +907,27 @@
 
         const dw = SPRITE_W * zoom, dh = SPRITE_H * zoom;
 
-        // Transparency checkerboard behind the artboard.
         drawCheckerboard(panX, panY, dw, dh);
 
-        // The sprite itself, nearest-neighbour scaled.
+        // Reference overlay sits under the sprite so you can trace over it.
+        if (refImage && refVisible) {
+            viewCtx.globalAlpha = refOpacity;
+            viewCtx.imageSmoothingEnabled = false;
+            viewCtx.drawImage(refImage, panX, panY, dw, dh);
+            viewCtx.globalAlpha = 1;
+        }
+
         viewCtx.imageSmoothingEnabled = false;
         viewCtx.drawImage(srcCanvas, panX, panY, dw, dh);
 
+        // Floating (moved/pasted) pixels render above the sprite.
+        if (floating) {
+            viewCtx.imageSmoothingEnabled = false;
+            viewCtx.drawImage(floating.canvas,
+                panX + floating.x * zoom, panY + floating.y * zoom,
+                floating.w * zoom, floating.h * zoom);
+        }
+
         // Artboard border.
         viewCtx.strokeStyle = '#5c94fc';
         viewCtx.lineWidth = 1;
@@ -535,12 +935,23 @@
 
         if (showGrid && zoom >= GRID_MIN_ZOOM) drawGrid(dw, dh);
 
+        if (selection) drawMarquee(selection, '#fcd444');
+        if (floating) drawMarquee(floating, '#54fc54');
+
         els.zoomVal.textContent = Math.round(zoom * 100) + '%';
     }
 
+    function drawMarquee(r, stroke) {
+        viewCtx.save();
+        viewCtx.setLineDash([4, 3]);
+        viewCtx.strokeStyle = stroke;
+        viewCtx.lineWidth = 1;
+        viewCtx.strokeRect(panX + r.x * zoom + 0.5, panY + r.y * zoom + 0.5, r.w * zoom, r.h * zoom);
+        viewCtx.restore();
+    }
+
     function drawCheckerboard(ox, oy, dw, dh) {
         const tile = 8;
-        // Clip to artboard so the checker stays inside the sprite bounds.
         viewCtx.save();
         viewCtx.beginPath();
         viewCtx.rect(ox, oy, dw, dh);
@@ -578,35 +989,39 @@
     // Undo / redo
     // ===================================================================
     function pushHistory() {
-        // Drop any redo tail.
         if (historyIndex < history.length - 1) {
             history = history.slice(0, historyIndex + 1);
         }
         history.push(srcCtx.getImageData(0, 0, SPRITE_W, SPRITE_H));
-        // Cap memory use.
         if (history.length > HISTORY_LIMIT) history.shift();
         historyIndex = history.length - 1;
         updateHistoryButtons();
     }
 
-    function undo() {
-        if (historyIndex <= 0) return;
-        historyIndex--;
-        srcCtx.putImageData(history[historyIndex], 0, 0);
+    function restore(index) {
+        // Pending floating/selection are invalidated by an undo/redo.
+        floating = null; selection = null; selDrag = null;
+        updateSelReadout();
+        srcCtx.putImageData(history[index], 0, 0);
         render();
         updateHistoryButtons();
     }
 
+    function undo() {
+        stampFloating();
+        if (historyIndex <= 0) return;
+        historyIndex--;
+        restore(historyIndex);
+    }
+
     function redo() {
         if (historyIndex >= history.length - 1) return;
         historyIndex++;
-        srcCtx.putImageData(history[historyIndex], 0, 0);
-        render();
-        updateHistoryButtons();
+        restore(historyIndex);
     }
 
     function updateHistoryButtons() {
-        els.undo.disabled = historyIndex <= 0;
+        els.undo.disabled = historyIndex <= 0 && !floating;
         els.redo.disabled = historyIndex >= history.length - 1;
     }
 
@@ -615,6 +1030,7 @@
     // ===================================================================
     function save() {
         if (!spriteType) return;
+        stampFloating();    // bake any floating pixels before exporting
         const saveBtn = root.querySelector('#pe-save');
         saveBtn.disabled = true;
         saveBtn.textContent = 'SAVING…';
@@ -627,12 +1043,9 @@
             const fd = new FormData();
             fd.append('file', blob, `${spriteType}.png`);
             try {
-                const res = await fetch(`/api/admin/sprites/${spriteType}`, {
-                    method: 'POST', body: fd,
-                });
+                const res = await fetch(`/api/admin/sprites/${spriteType}`, { method: 'POST', body: fd });
                 if (res.ok) {
                     toast(`${spriteType} sprite saved`);
-                    // Treat the saved state as the new baseline.
                     history = [srcCtx.getImageData(0, 0, SPRITE_W, SPRITE_H)];
                     historyIndex = 0;
                     updateHistoryButtons();
@@ -653,28 +1066,47 @@
     // ===================================================================
     function onKeyDown(e) {
         if (!isOpen()) return;
-        // Don't hijack typing in inputs.
+        // Don't hijack typing in text/number inputs.
         if (e.target.tagName === 'INPUT' && e.target.type !== 'checkbox' && e.target.type !== 'range') {
             if (e.key === 'Escape') e.target.blur();
             return;
         }
 
         const ctrl = e.ctrlKey || e.metaKey;
-        if (ctrl && e.key.toLowerCase() === 'z' && !e.shiftKey) { e.preventDefault(); undo(); return; }
-        if (ctrl && (e.key.toLowerCase() === 'y' || (e.key.toLowerCase() === 'z' && e.shiftKey))) {
-            e.preventDefault(); redo(); return;
+        if (ctrl) {
+            const k = e.key.toLowerCase();
+            if (k === 'z' && !e.shiftKey) { e.preventDefault(); undo(); return; }
+            if (k === 'y' || (k === 'z' && e.shiftKey)) { e.preventDefault(); redo(); return; }
+            if (k === 'c') { e.preventDefault(); copySelection(); return; }
+            if (k === 'x') { e.preventDefault(); cutSelection(); return; }
+            if (k === 'v') { e.preventDefault(); pasteClipboard(); return; }
+            return;
         }
 
         switch (e.key) {
-            case 'Escape': if (confirmDiscard()) close(); break;
+            case 'Escape':
+                if (floating) { stampFloating(); }
+                else if (selection) { selection = null; updateSelReadout(); render(); }
+                else if (confirmDiscard()) close();
+                break;
+            case 'Enter': if (floating) stampFloating(); break;
+            case 'Delete': case 'Backspace': e.preventDefault(); deleteSelection(); break;
             case 'b': case 'B': setTool('pencil'); break;
             case 'e': case 'E': setTool('eraser'); break;
             case 'i': case 'I': setTool('picker'); break;
             case 'f': case 'F': setTool('fill'); break;
+            case 'l': case 'L': setTool('line'); break;
+            case 'r': case 'R': setTool('rect'); break;
+            case 'o': case 'O': setTool('ellipse'); break;
+            case 'm': case 'M': setTool('select'); break;
             case 'g': case 'G': els.grid.checked = !els.grid.checked; showGrid = els.grid.checked; render(); break;
             case '+': case '=': zoomAt(1.25, centerPoint()); break;
             case '-': case '_': zoomAt(0.8, centerPoint()); break;
             case '0': fitToScreen(); break;
+            case 'ArrowLeft': if (selOrFloat()) { e.preventDefault(); nudgeFloating(-1, 0); } break;
+            case 'ArrowRight': if (selOrFloat()) { e.preventDefault(); nudgeFloating(1, 0); } break;
+            case 'ArrowUp': if (selOrFloat()) { e.preventDefault(); nudgeFloating(0, -1); } break;
+            case 'ArrowDown': if (selOrFloat()) { e.preventDefault(); nudgeFloating(0, 1); } break;
             case ' ':
                 if (!spaceDown) { spaceDown = true; updateCursor(); }
                 e.preventDefault();
@@ -682,6 +1114,8 @@
         }
     }
 
+    function selOrFloat() { return tool === 'select' && (selection || floating); }
+
     function onKeyUp(e) {
         if (!isOpen()) return;
         if (e.key === ' ') { spaceDown = false; updateCursor(); }
@@ -703,10 +1137,9 @@
         return '#' + [r, g, b].map(v => v.toString(16).padStart(2, '0')).join('');
     }
 
-    // Reuse the admin toast if present, else fall back to a console message.
     function toast(msg, isError) {
         const el = document.getElementById('toast');
-        if (!el) { return; }
+        if (!el) return;
         el.textContent = msg;
         el.classList.remove('hidden', 'error');
         if (isError) el.classList.add('error');

docker-compose.yml

@@ -6,9 +6,11 @@ services:
     restart: unless-stopped
     environment:
       - PYTHONUNBUFFERED=1
+      - ADSBIT_CONFIG=/app/data/config.json
     volumes:
-      # Persist config (copy config.json.example to config.json before first run)
-      - ./config.json:/app/config.json
+      # Config persists here; auto-seeded from config.json.example on first run
+      # (a directory mount, so a fresh `docker compose up` just works).
+      - ./data:/app/data
       # Persist custom sprite uploads
       - ./images:/app/images
       # Persist custom theme backgrounds

docker-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Seed a config file on first run so `docker compose up` works on a fresh
+# clone with no manual steps. The config lives on a mounted data volume so it
+# persists across container rebuilds.
+set -e
+
+: "${ADSBIT_CONFIG:=/app/config.json}"
+CONFIG_DIR=$(dirname "$ADSBIT_CONFIG")
+mkdir -p "$CONFIG_DIR"
+
+if [ ! -f "$ADSBIT_CONFIG" ]; then
+    echo "[entrypoint] No config at $ADSBIT_CONFIG — seeding from config.json.example"
+    cp /app/config.json.example "$ADSBIT_CONFIG"
+fi
+
+exec python3 server.py

server.py

@@ -17,8 +17,16 @@ from aiohttp import web, ClientSession, ClientTimeout
 import netifaces
 import bcrypt
 
+VERSION = "1.1.2"
+
 WEB_DIR = Path(__file__).parent
-CONFIG_FILE = WEB_DIR / "config.json"
+# Config path is overridable (handy for containers persisting config on a
+# named volume); defaults to config.json next to this script for bare-metal.
+CONFIG_FILE = Path(os.environ.get("ADSBIT_CONFIG") or (WEB_DIR / "config.json"))
+
+# Smallest subnet prefix (largest network) we'll auto-scan: /20 = 4094 hosts.
+# Anything bigger (e.g. a docker /16) is skipped to keep scans fast and safe.
+MIN_SCAN_PREFIX = 20
 
 # Track server start time
 SERVER_START_TIME = time.time()
@@ -412,6 +420,15 @@ async def scan_for_receivers():
                 if ip and netmask and not ip.startswith('127.'):
                     try:
                         network = ipaddress.IPv4Network(f"{ip}/{netmask}", strict=False)
+                        # Skip subnets too large to scan quickly (e.g. a docker
+                        # bridge /16 = 65k hosts). Without this, AUTO discovery
+                        # hammers the network and stalls startup on any host with
+                        # Docker or a large/16. Use MANUAL or a custom subnet for
+                        # receivers that live on such networks.
+                        if network.prefixlen < MIN_SCAN_PREFIX:
+                            print(f"Skipping {network} on {iface}: too large "
+                                  f"({network.num_addresses} hosts) for auto-scan")
+                            continue
                         found.extend(await _scan_subnet(network, port))
                     except ValueError as e:
                         print(f"Invalid network {ip}/{netmask}: {e}")
@@ -549,6 +566,7 @@ async def handle_receiver_location(request):
 async def handle_config(request):
     """Return client-relevant configuration (public, no secrets)."""
     return web.json_response({
+        "version": VERSION,
         "theme": config.get("theme", "desert"),
         "location": config["location"],
         "receivers": receivers,
@@ -981,9 +999,10 @@ async def handle_admin_scan_receivers(request):
             return web.json_response(
                 {"error": f"Invalid subnet: {subnet}"}, status=400)
 
-        if network.prefixlen < 20:
+        if network.prefixlen < MIN_SCAN_PREFIX:
             return web.json_response(
-                {"error": "Subnet too large (max /20 = 4096 hosts)"}, status=400)
+                {"error": f"Subnet too large (max /{MIN_SCAN_PREFIX} = "
+                          f"{2 ** (32 - MIN_SCAN_PREFIX) - 2} hosts)"}, status=400)
 
         port = config['receiver_port']
         found = await _scan_subnet(network, port)
@@ -1169,6 +1188,17 @@ async def handle_http(request):
     return web.Response(status=404, text="Not Found")
 
 
+async def handle_health(request):
+    """GET /health - liveness/readiness probe (no auth, no secrets)."""
+    return web.json_response({
+        "status": "ok",
+        "version": VERSION,
+        "receivers": len(receivers),
+        "flights": len(flights),
+        "uptime_seconds": int(time.time() - SERVER_START_TIME),
+    })
+
+
 # ---------------------------------------------------------------------------
 # Application setup
 # ---------------------------------------------------------------------------
@@ -1181,6 +1211,7 @@ async def start_http_server():
     app.router.add_get('/ws', websocket_handler)
 
     # Public API
+    app.router.add_get('/health', handle_health)
     app.router.add_get('/api/receiver-location', handle_receiver_location)
     app.router.add_get('/api/config', handle_config)
 
@@ -1231,7 +1262,7 @@ async def main():
     """Main entry point"""
     global receivers, receiver_tasks
 
-    print("ADS-Bit Server Starting...")
+    print(f"ADS-Bit Server v{VERSION} Starting...")
 
     load_config()
 
@@ -1279,4 +1310,11 @@ async def main():
 
 
 if __name__ == "__main__":
-    asyncio.run(main())
+    # Make SIGTERM (docker stop, systemctl stop) raise KeyboardInterrupt like
+    # SIGINT does, so shutdown is clean and quiet instead of a stack trace.
+    import signal
+    signal.signal(signal.SIGTERM, signal.default_int_handler)
+    try:
+        asyncio.run(main())
+    except (KeyboardInterrupt, SystemExit):
+        print("ADS-Bit server shutting down.")