Re-add viewer screenshot (receiver IP and location masked)

Re-added after history scrub. This capture shows neither the receiver
IP nor the location name (status bar reads "CONNECTED" / "ADS-Bit").

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.dockerignore

@@ -3,6 +3,7 @@ __pycache__
 *.pyc
 *.pyo
 config.json
+data/
 screenshots/
 .claude/
 CLAUDE.md

.github/FUNDING.yml

@@ -0,0 +1 @@
+buy_me_a_coffee: adsbit

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,29 @@
+---
+name: Bug report
+about: Report something that isn't working
+title: "[Bug] "
+labels: bug
+---
+
+**Describe the bug**
+A clear description of what's wrong.
+
+**To reproduce**
+Steps to reproduce the behavior:
+1. …
+2. …
+
+**Expected behavior**
+What you expected to happen.
+
+**Screenshots / logs**
+If applicable, add screenshots or server log output.
+
+**Environment**
+- ADS-Bit version (admin header or `GET /api/config`):
+- Install method: [ ] bare metal  [ ] Docker  [ ] Podman
+- OS / Python version:
+- Receiver / feed (e.g. dump1090, readsb) and how it's reached:
+
+**Additional context**
+Anything else that might help.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Suggest an idea or improvement
+title: "[Feature] "
+labels: enhancement
+---
+
+**What problem does this solve?**
+A clear description of the need or pain point.
+
+**Proposed solution**
+What you'd like to happen.
+
+**Alternatives considered**
+Any other approaches you thought about.
+
+**Additional context**
+Mockups, examples, or references.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## Summary
+
+<!-- What does this PR change, and why? -->
+
+## Related issues
+
+<!-- e.g. Closes #123 -->
+
+## How was this tested?
+
+<!-- Commands run, manual steps, screenshots. For Docker changes, note that
+     `docker build` succeeds. -->
+
+## Checklist
+
+- [ ] Server starts and the change works locally (`python3 server.py`)
+- [ ] If admin assets changed, bumped the `?v=` cache-bust token in `admin/admin.html`
+- [ ] If behavior/version changed, updated `VERSION` and `CHANGELOG.md`
+- [ ] No secrets or local config committed (`config.json` stays ignored)

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  # Keep GitHub Actions pinned versions current.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
+
+  # Keep Python dependencies current.
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"

.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  python:
+    name: Python checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+      - name: Byte-compile server
+        run: python -m compileall -q server.py
+      - name: Validate example config is valid JSON
+        run: python -c "import json; json.load(open('config.json.example'))"
+
+  docker:
+    name: Docker build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image
+        run: docker build -t ads-bit:ci .

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+# Static security analysis (free for public repositories). Scans the Python
+# backend and the vanilla-JS frontend on pushes, PRs, and weekly.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 5 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -0,0 +1,59 @@
+name: Release
+
+# Build and publish a multi-arch image to GitHub Container Registry (GHCR)
+# whenever a version tag is pushed (e.g. v1.1.2). Lets users run a prebuilt
+# image — including on Raspberry Pi (arm64) — without building locally.
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image tag to publish (e.g. 1.1.2); leave blank for just :latest"
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute lowercase image name
+        id: img
+        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker metadata (tags & labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ steps.img.outputs.name }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
+            type=raw,value=latest
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -15,13 +15,19 @@ __pycache__/
 
 # Claude Code
 .claude/
+CLAUDE.md
 
-# Gitea token
-.gitea-token
+# Local secrets / tokens
+*.token
+.git-credentials
 
 # OS
 .DS_Store
 Thumbs.db
 
-# Local config (uncomment if you want to ignore local changes)
-# config.json
+# Local config — contains the admin password hash and session secret.
+# Fresh installs start from config.json.example (see CONFIG.md).
+config.json
+
+# Docker config volume (holds the live config.json with secrets)
+data/

.pre-commit-config.yaml

@@ -0,0 +1,14 @@
+# Pre-commit hooks for ADS-Bit.
+#
+# Setup (once):
+#   pip install pre-commit
+#   pre-commit install
+#
+# Thereafter gitleaks scans every commit for secrets (tokens, keys,
+# password hashes) before they can reach gitea or the public GitHub mirror.
+# Run manually across the whole tree with:  pre-commit run --all-files
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.4
+    hooks:
+      - id: gitleaks

CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is based
+on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
+[Semantic Versioning](https://semver.org/).
+
+## [1.1.2] - 2026-06-10
+
+First release with a published container image and security tooling. No
+application behavior changes from 1.1.1.
+
+### Added
+- Prebuilt multi-arch (amd64 + arm64) container image published to GitHub
+  Container Registry: `ghcr.io/allennpit/ads-bit`.
+- CodeQL code-scanning workflow (Python + JavaScript) and Dependabot updates
+  for GitHub Actions and pip.
+- `workflow_dispatch` trigger on the release workflow for manual image builds.
+
+## [1.1.1] - 2026-06-10
+
+### Added
+- `/health` endpoint (status, version, receiver/flight counts) plus a Docker
+  `HEALTHCHECK`.
+- `ADSBIT_CONFIG` environment variable to override the config file path.
+
+### Changed
+- Docker first-run now works with no manual steps: `config.json` is auto-seeded
+  from `config.json.example` by `docker-entrypoint.sh` and persisted on a
+  `./data` directory mount (removing the single-file bind-mount footgun).
+- Network auto-scan skips subnets larger than `/20` (e.g. a Docker bridge
+  `172.17.0.0/16`) so discovery no longer stalls startup on Docker hosts.
+- `SIGTERM`/`SIGINT` (`docker stop`, `systemctl stop`) shut down cleanly
+  without a stack trace.
+
+## [1.1.0] - 2026-06-09
+
+### Added
+- In-app pixel editor for sprites (admin → Sprites → EDIT): pencil, eraser,
+  color picker, fill bucket, line/rectangle/ellipse shapes, rectangular
+  select with move/cut/copy/paste, reference-image overlay, brush size &
+  opacity, custom + recent palettes, zoom/pan, grid, undo/redo.
+- Receiver health dashboard: live per-receiver status (receiving / no data /
+  unreachable), connection testing, a select → save → apply flow, selectable
+  scan results, and a per-interface scan selector.
+- Version surfaced at startup, via `GET /api/config`, and in the admin header.
+
+### Fixed
+- Server crash when restarting receiver connections: cancelled receiver tasks
+  no longer tear down the main event loop.
+
+## [1.0] - 2026-01
+
+### Added
+- Initial release: retro SNES-style side-view ADS-B flight tracker with custom
+  pixel-art sprites, directional backgrounds, weather, sun/moon, admin panel,
+  first-run setup wizard, and Docker/Podman support.
+
+[1.1.2]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.2
+[1.1.1]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.1
+[1.1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.0
+[1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.0

CLAUDE.md

@@ -1,142 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-ADS-Bit is a retro SNES-style side-view flight tracker that displays ADS-B aircraft data with custom pixel art sprites.
-
-## Running the Server
-
-```bash
-# Start the server (port configured in config.json, default 2001)
-python3 server.py
-
-# Or use the startup script
-./start.sh
-```
-
-Access at http://localhost:{web_port} (configured in config.json)
-
-## Architecture
-
-### Components
-
-- **server.py** - Python WebSocket server using aiohttp
-  - Reads configuration from config.json
-  - Auto-scans for ADS-B receivers or connects to configured IPs
-  - Parses SBS/BaseStation format messages from receivers (port 30003)
-  - Polls dump1090 JSON API (`/dump1090/data/aircraft.json`) every 5s for ADS-B emitter categories
-  - Broadcasts flight data (including emitter category) to WebSocket clients every 1 second
-  - Cleans up flights not seen in 60 seconds
-  - Serves static files, admin panel, setup wizard, and APIs
-  - Authentication via bcrypt password hashing and session cookies
-
-- **config.json** - Configuration file for receiver and location settings
-  - See CONFIG.md for full documentation
-
-- **ads-bit.js** - JavaScript rendering engine (Canvas-based)
-  - Handles WebSocket connection and flight data updates
-  - Renders 10 FPS retro-style canvas animation
-  - Layer order (bottom to top): sky gradient → clouds → sun → moon → directional background → grid → aircraft → labels
-  - Directional backgrounds include horizon, so low sun/moon is realistically occluded
-  - Aircraft sprites flip horizontally when heading west (track 90°-270°)
-  - View direction rotates between N/E/S/W (arrow keys or A/D), changing the background
-
-- **index.html** - Main HTML interface with embedded styles
-
-- **admin/** - Admin panel (login + tabbed settings UI)
-  - Theme management: rename display names, upload per-direction background PNGs, create new themes
-  - Display names stored in `config.json` `theme_names` map (folder name -> display name)
-
-- **setup/** - First-run setup wizard (multi-step configuration)
-
-### Sprite Assets
-
-All PNG sprites face right (eastward) and are flipped in-canvas for westbound aircraft:
-- 9 aircraft types: smallProp, regionalJet, narrowBody, wideBody, heavy, helicopter, balloon, glider, uav
-- Directional backgrounds: north.png, south.png, east.png, west.png (1536x1024, shown based on view direction)
-- Celestial: sun.png, moon_6_phases.png (2x3 sprite sheet)
-- Weather: happycloud.png (clear), raincloud.png (rain/snow)
-
-### Aircraft Type Detection Logic
-
-Two-tier system: real ADS-B emitter categories when available, heuristic fallback otherwise.
-
-#### Tier 1: ADS-B Emitter Category (from dump1090 JSON API)
-
-The server polls `http://{receiver_ip}/dump1090/data/aircraft.json` every 5 seconds. The SBS/BaseStation protocol (port 30003) does **not** include emitter category, but the dump1090/readsb JSON API exposes the raw ADS-B transponder category field. When available, this is authoritative and always preferred over heuristics.
-
-Mapping from DO-260B emitter categories to sprite types:
-| ADS-B Category | Description | Sprite |
-|---|---|---|
-| A1 | Light (< 15,500 lbs) | smallProp |
-| A2 | Small (15,500 - 75,000 lbs) | regionalJet |
-| A3 | Large (75,000 - 300,000 lbs) | narrowBody |
-| A4 | High vortex large (B757) | narrowBody |
-| A5 | Heavy (> 300,000 lbs) | wideBody or heavy (by altitude/speed) |
-| A6 | High performance (> 5g, > 400 kts) | narrowBody |
-| A7 | Rotorcraft | helicopter |
-| B1 | Glider / sailplane | glider |
-| B2 | Lighter-than-air | balloon |
-| B4 | Skydiver drop plane | smallProp |
-| B6 | UAV | uav |
-
-Once an emitter category is received for an aircraft, it is locked in and heuristic re-evaluation is skipped.
-
-#### Tier 2: Heuristic Fallback (when no emitter category available)
-
-Priority order when ADS-B category is not available (some transponders don't broadcast it):
-1. **Helicopter callsigns**: known operator prefixes (LFE, MED, CHP, PHI, ERA, BHS) or keywords (LIFE, MERCY, COPTER, etc.)
-2. **Heavy/Wide body callsigns**: major airline ICAO prefixes (CPA, UAE, ETH, QTR, SIA, AAL, DAL, UAL, FDX, UPS, etc.) + altitude/speed thresholds
-3. **Altitude/speed extremes**: altitude > 42000 ft or speed > 550 kts = heavy; > 40000 ft or > 500 kts = wideBody
-4. **N-number (US GA registration)**: pattern `N` + digit + 2-4 alphanumerics = smallProp (or narrowBody if above 25000 ft)
-5. **Regional airline callsigns**: SKW, RPA, ASH, PDT, CHQ, ENY, JIA, CPZ
-6. **Speed/altitude heuristics**: speed < 60 + alt < 5000 = helicopter; alt < 18000 + speed < 300 = smallProp or regionalJet
-7. **Altitude-only**: < 10000 ft = smallProp, < 25000 ft = regionalJet, higher = narrowBody
-8. **Default**: narrowBody (re-evaluated when better data arrives)
-
-Important: `speed=0` or `altitude=0` means data not yet received, not actual zero. The system re-categorizes when better data arrives (speed > 0 and callsign present).
-
-### View Direction Controls
-
-The viewer can rotate between cardinal directions (N/E/S/W), showing aircraft in a 90° field of view:
-- **Keyboard**: Left/Right arrow keys or A/D keys
-- **UI**: Arrow buttons on the interface
-- Each direction displays a unique background image (north.png, east.png, south.png, west.png)
-- Sun and moon positions are calculated based on actual azimuth and only appear when in the current field of view
-
-### External APIs
-
-- **Open-Meteo**: Weather and sunrise/sunset data (updates every 10 minutes)
-- **ADS-B Receivers**: SBS/BaseStation protocol on port 30003 (flight data)
-- **dump1090 JSON API**: `http://{receiver}/dump1090/data/aircraft.json` on port 80 (emitter categories, polled every 5s)
-
-## Dependencies
-
-Python packages required:
-- aiohttp (web server and WebSocket)
-- netifaces (network interface scanning)
-- bcrypt (password hashing)
-
-No package.json - frontend is vanilla JavaScript with no build step.
-
-## Key Code Patterns
-
-- Canvas version parameter on assets (`?v=36`) for cache busting
-- Aircraft direction: `const isFacingLeft = flight.track > 90 && flight.track < 270`
-- Moon phases use sprite sheet cropping with 2x3 grid (3 columns, 2 rows)
-- Flight data stored in global `flights` dict keyed by ICAO hex code
-
-## Debugging
-
-```bash
-# Check for running server instances
-ps aux | grep server.py
-
-# Kill all instances
-pkill -9 -f server.py
-
-# Test receiver connectivity (replace with your receiver IP)
-nc -zv <receiver_ip> 30003
-```

CONTRIBUTING.md

@@ -0,0 +1,59 @@
+# Contributing to ADS-Bit
+
+Thanks for your interest in improving ADS-Bit! Contributions of all kinds —
+bug reports, features, sprites, themes, docs — are welcome.
+
+## Development setup
+
+ADS-Bit is a Python (aiohttp) backend with a vanilla-JavaScript frontend.
+There is **no build step** for the frontend.
+
+```bash
+git clone <your-fork-url>
+cd ADS-Bit
+pip install -r requirements.txt      # Python 3.9–3.11 recommended (see note below)
+cp config.json.example config.json   # optional; the setup wizard runs otherwise
+python3 server.py                     # serves on http://localhost:2001
+```
+
+Or with Docker (no local Python needed):
+
+```bash
+docker compose up -d
+```
+
+> **Python version note:** the `netifaces` dependency can be hard to build on
+> Python 3.12+. Use Python 3.9–3.11, or just use the Docker image (Python 3.11).
+
+## Project layout
+
+- `server.py` — aiohttp server: receiver connections, flight state, APIs, auth.
+- `ads-bit.js` / `index.html` — Canvas-based retro viewer.
+- `admin/` — admin panel, including the in-browser `pixel-editor.js`.
+- `setup/` — first-run setup wizard.
+- `images/`, `backgrounds/` — sprite and theme assets.
+
+## Conventions
+
+- **Frontend assets are cache-busted** via a `?v=YYYYMMDD[x]` query in
+  `admin/admin.html`. If you change `admin.css`, `admin.js`, or
+  `pixel-editor.js`, bump that token so browsers reload them.
+- The `VERSION` constant in `server.py` is the single source of truth; bump it
+  for releases and add a `CHANGELOG.md` entry.
+- Keep the retro aesthetic (Press Start 2P, blue/gold palette) for UI work.
+- Match the style of surrounding code; no frontend framework or build tooling.
+
+## Submitting changes
+
+1. Fork and create a topic branch (`feature/…`, `fix/…`, `chore/…`).
+2. Make focused commits with clear messages.
+3. Verify locally: the server starts, the page loads, and your change works.
+   For Docker changes, confirm `docker build` succeeds.
+4. Open a pull request describing what changed and how you tested it.
+
+CI will byte-compile the server, validate `config.json.example`, and build the
+Docker image on every PR.
+
+## Reporting bugs / requesting features
+
+Use the issue templates. For security issues, see [SECURITY.md](SECURITY.md).

Dockerfile

@@ -13,9 +13,16 @@ RUN pip install --no-cache-dir -r requirements.txt && \
     rm -rf /var/lib/apt/lists/*
 
 COPY . .
+RUN chmod +x /app/docker-entrypoint.sh
 
 EXPOSE 2001
 
-ENV PYTHONUNBUFFERED=1
+# Persist config on a mounted volume by default (see docker-compose.yml).
+ENV PYTHONUNBUFFERED=1 \
+    ADSBIT_CONFIG=/app/data/config.json
 
-CMD ["python3", "server.py"]
+# Liveness probe against the unauthenticated /health endpoint.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
+    CMD python3 -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:2001/health',timeout=4).status==200 else 1)" || exit 1
+
+ENTRYPOINT ["/app/docker-entrypoint.sh"]

README.md

@@ -1,27 +1,45 @@
 # ADS-Bit
 
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Release](https://img.shields.io/github/v/release/AllenNPIT/ADS-Bit)](https://github.com/AllenNPIT/ADS-Bit/releases)
+[![CI](https://github.com/AllenNPIT/ADS-Bit/actions/workflows/ci.yml/badge.svg)](https://github.com/AllenNPIT/ADS-Bit/actions/workflows/ci.yml)
+
 A retro SNES-style side-view flight tracker that displays ADS-B aircraft data with custom pixel art sprites.
 
-![ADS-Bit Screenshot](screenshots/screenshot.png)
+## Screenshots
+
+### Live viewer
+
+Real-time ADS-B traffic rendered as pixel-art sprites over a directional background — here the East view, with a desert skyline on the horizon. Aircraft are labelled with callsign, altitude, and distance, and listed in the sidebar sorted by range.
+
+![Live viewer with aircraft in view](screenshots/viewer.png)
+
+### In-app pixel editor
+
+Draw and edit aircraft sprites directly in the browser: pencil, eraser, line/rectangle/ellipse shapes, fill bucket, select & move, zoom/pan, undo/redo, custom palettes, and an adjustable reference overlay. Saving uploads the sprite back to the running tracker — no external tools needed.
+
+![In-browser pixel sprite editor](screenshots/pixel-editor.png)
 
 ## Features
 
 - Real-time aircraft tracking via ADS-B receivers
-- Custom pixel art sprites for 6 aircraft types (small prop, regional jet, narrow body, wide body, heavy, helicopter)
+- Custom pixel art sprites for 9 aircraft types (small prop, regional jet, narrow body, wide body, heavy, helicopter, balloon, glider, UAV)
 - Animated sun and moon with accurate astronomical positions
 - Dynamic sky colors based on time of day
 - Weather visualization with cloud sprites
 - Directional view (N/E/S/W) with themed backgrounds
-- Auto-discovery of ADS-B receivers on your network
+- Auto-discovery of ADS-B receivers on your network, with per-interface scanning
 - Canvas-based 10 FPS retro rendering
 - Admin panel with password authentication
+- **In-app pixel editor** — draw and edit sprites in the browser (pencil, shapes, fill, select & move, reference overlay, custom palettes)
+- **Receiver health dashboard** — live per-receiver status (receiving / no data / unreachable), connection testing, and select → save → apply flow
 - First-run setup wizard
 
 ## Quick Start
 
 ```bash
 # Clone the repository
-git clone https://gitea.chops.one/allen/ADS-Bit.git
+git clone https://github.com/AllenNPIT/ADS-Bit.git
 cd ADS-Bit
 
 # Install dependencies
@@ -39,17 +57,33 @@ On first run, visit http://localhost:2001 and the setup wizard will guide you th
 
 - [Docker](https://docs.docker.com/get-docker/) with Compose V2, **or** [Podman](https://podman.io/) with `podman-compose`
 
-### First Run
+### Run the prebuilt image (no clone needed)
+
+Once a release is published, a multi-arch image (amd64 + arm64, e.g. Raspberry Pi)
+is available from GitHub Container Registry:
 
 ```bash
-# Create a config file (the setup wizard runs if you skip this)
-cp config.json.example config.json
+docker run -d --name ads-bit --network host --restart unless-stopped \
+  -e ADSBIT_CONFIG=/app/data/config.json \
+  -v "$PWD/data:/app/data" \
+  ghcr.io/allennpit/ads-bit:latest
+```
 
-# Build and start
+Then open http://localhost:2001 and complete the setup wizard.
+
+### Build from source
+
+```bash
+# Build and start — no config step needed
 docker compose up -d
 ```
 
-The web UI is available at http://localhost:2001.
+A config file is created automatically in `data/` on first run, then the
+browser **setup wizard** walks you through receiver, location, and password
+setup. The web UI is available at http://localhost:2001.
+
+A `/health` endpoint (used by the container healthcheck) reports status,
+version, and receiver/flight counts: `curl http://localhost:2001/health`.
 
 ### Useful Commands
 
@@ -80,15 +114,15 @@ The following paths are bind-mounted from the repo directory and persist across
 
 | Path | Contents |
 |------|----------|
-| `config.json` | Server configuration and credentials |
+| `data/` | Server configuration and credentials (`config.json`, auto-seeded) |
 | `images/` | Aircraft and UI sprites (including uploads) |
 | `backgrounds/` | Theme background images (including custom themes) |
 
-Host networking (`network_mode: host`) is used so the server can auto-scan your LAN for ADS-B receivers.
+Host networking (`network_mode: host`) is used so the server can auto-scan your LAN for ADS-B receivers. Auto-scan skips oversized subnets (larger than /20, e.g. a Docker bridge `172.17.0.0/16`); if your receiver lives on such a network, set it explicitly via the admin Receivers tab.
 
 ## Requirements
 
-- Python 3.8+
+- Python 3.9–3.11 (3.12+ may require build tools for `netifaces`; the Docker image uses 3.11)
 - ADS-B receiver providing SBS/BaseStation format on port 30003 (dump1090, readsb, etc.)
 - Modern web browser with Canvas support
 

SECURITY.md

@@ -0,0 +1,35 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 1.1.x   | ✅        |
+| < 1.1   | ❌        |
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security vulnerabilities.
+
+Instead, use GitHub's private vulnerability reporting:
+**Security → Report a vulnerability** on the repository.
+
+Include as much detail as you can:
+- Affected version (see the version in the admin header or `GET /api/config`)
+- Steps to reproduce / proof of concept
+- Impact and any suggested remediation
+
+You can expect an acknowledgement within a few days. Please allow reasonable
+time for a fix before any public disclosure.
+
+## Security Notes for Operators
+
+ADS-Bit is intended for trusted LANs, not direct exposure to the public
+internet. If you must expose it:
+
+- Set a strong admin password (changed from the setup default).
+- Put it behind HTTPS via a reverse proxy or tunnel (e.g. Caddy, nginx,
+  Tailscale). The built-in server speaks plain HTTP.
+- Never commit your `config.json` — it contains the admin password hash and
+  session secret. It is git-ignored by default; fresh installs start from
+  `config.json.example`.

admin/admin.css

@@ -169,6 +169,15 @@ textarea {
     margin: 0;
 }
 
+.admin-version {
+    font-family: 'Courier New', monospace;
+    font-size: 11px;
+    color: #54fc54;
+    text-shadow: none;
+    margin-left: 6px;
+    vertical-align: middle;
+}
+
 .header-actions {
     display: flex;
     gap: 8px;
@@ -592,6 +601,384 @@ textarea {
     font-size: 11px;
 }
 
+/* ===================================================================
+   Receivers tab — status indicators & selectable scan results
+   =================================================================== */
+.rx-section-label {
+    font-family: 'Press Start 2P', monospace;
+    font-size: 10px;
+    color: #fcd444;
+    margin: 22px 0 12px;
+    padding-bottom: 6px;
+    border-bottom: 1px solid rgba(92, 148, 252, 0.3);
+}
+
+.rx-summary {
+    font-family: 'Courier New', monospace;
+    font-size: 12px;
+    color: #b4d4ec;
+}
+
+#receiver-status-list {
+    display: flex;
+    flex-direction: column;
+    gap: 8px;
+    margin-bottom: 12px;
+}
+
+.rx-status-item {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    background: rgba(0, 0, 0, 0.3);
+    border: 1px solid rgba(92, 148, 252, 0.4);
+    border-radius: 6px;
+    padding: 8px 12px;
+    font-size: 13px;
+    flex-wrap: wrap;
+}
+
+.rx-dot {
+    width: 12px;
+    height: 12px;
+    border-radius: 50%;
+    flex-shrink: 0;
+    box-shadow: 0 0 6px currentColor;
+}
+.rx-dot.green  { background: #54fc54; color: #54fc54; }
+.rx-dot.yellow { background: #fcd444; color: #fcd444; }
+.rx-dot.red    { background: #fc5454; color: #fc5454; }
+.rx-dot.gray   { background: #888;    color: #888; box-shadow: none; }
+
+.rx-ip {
+    font-family: 'Courier New', monospace;
+    font-weight: bold;
+    color: #fcfcfc;
+    min-width: 110px;
+}
+
+.rx-label {
+    font-family: 'Press Start 2P', monospace;
+    font-size: 8px;
+}
+.rx-green  { color: #54fc54; }
+.rx-yellow { color: #fcd444; }
+.rx-red    { color: #fc5454; }
+.rx-gray   { color: #888; }
+
+.rx-detail {
+    color: #b4d4ec;
+    font-size: 11px;
+    margin-left: auto;
+}
+
+.rx-scan-item {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 6px 4px;
+    cursor: pointer;
+    border-bottom: 1px solid rgba(92, 148, 252, 0.2);
+}
+
+.rx-scan-item input[type="checkbox"] {
+    width: 16px;
+    height: 16px;
+    accent-color: #fcd444;
+    cursor: pointer;
+}
+
+.rx-scan-ip {
+    font-family: 'Courier New', monospace;
+    font-weight: bold;
+    color: #fcfcfc;
+}
+
+/* ===================================================================
+   Pixel Editor
+   =================================================================== */
+.pe-overlay {
+    position: fixed;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.85);
+    z-index: 2000;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 20px;
+}
+
+body.pe-open { overflow: hidden; }
+
+.pe-modal {
+    background: linear-gradient(180deg, #2c3e50 0%, #1a252f 100%);
+    border: 3px solid #fcd444;
+    border-radius: 12px;
+    width: 100%;
+    max-width: 1100px;
+    height: 100%;
+    max-height: 760px;
+    display: flex;
+    flex-direction: column;
+    box-shadow: 0 8px 40px rgba(0, 0, 0, 0.6);
+    overflow: hidden;
+}
+
+.pe-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: 12px 16px;
+    background: rgba(0, 0, 0, 0.3);
+    border-bottom: 2px solid #5c94fc;
+    flex-wrap: wrap;
+    gap: 8px;
+}
+
+.pe-header .retro-title {
+    font-size: 13px;
+    margin: 0;
+}
+
+.pe-header-actions {
+    display: flex;
+    gap: 6px;
+    flex-wrap: wrap;
+}
+
+.pe-body {
+    flex: 1;
+    display: grid;
+    grid-template-columns: auto 1fr auto;
+    grid-template-rows: 1fr;
+    min-height: 0;
+}
+
+/* Toolbar (left column) */
+.pe-toolbar {
+    display: flex;
+    flex-direction: column;
+    gap: 14px;
+    padding: 14px 10px;
+    background: rgba(0, 0, 0, 0.25);
+    border-right: 2px solid #5c94fc;
+    overflow-y: auto;
+}
+
+.pe-tool-group {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+    padding-bottom: 12px;
+    border-bottom: 1px solid rgba(92, 148, 252, 0.25);
+}
+
+.pe-tool-group:last-child { border-bottom: none; padding-bottom: 0; }
+
+.pe-tool, .pe-icon-btn {
+    width: 44px;
+    height: 44px;
+    font-size: 20px;
+    line-height: 1;
+    border: 2px solid #5c94fc;
+    border-radius: 6px;
+    background: rgba(92, 148, 252, 0.15);
+    color: #fcfcfc;
+    cursor: pointer;
+    transition: all 0.12s;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+}
+
+.pe-tool:hover, .pe-icon-btn:hover:not(:disabled) {
+    background: rgba(92, 148, 252, 0.4);
+}
+
+.pe-tool.active {
+    background: rgba(252, 212, 68, 0.3);
+    border-color: #fcd444;
+    color: #fcd444;
+}
+
+.pe-icon-btn:disabled {
+    opacity: 0.35;
+    cursor: not-allowed;
+}
+
+.pe-tool-label {
+    font-family: 'Press Start 2P', monospace;
+    font-size: 8px;
+    color: #b4d4ec;
+    text-align: center;
+}
+
+.pe-check {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    font-family: 'Press Start 2P', monospace;
+    font-size: 8px;
+    color: #b4d4ec;
+    cursor: pointer;
+}
+
+.pe-check input { width: 16px; height: 16px; accent-color: #fcd444; cursor: pointer; }
+
+.pe-brush-group { align-items: center; }
+.pe-brush-group input[type="range"] { width: 44px; accent-color: #fcd444; }
+
+/* Canvas area (center column) */
+.pe-canvas-wrap {
+    position: relative;
+    min-width: 0;
+    background: #14202b;
+    overflow: hidden;
+}
+
+#pe-view {
+    display: block;
+    width: 100%;
+    height: 100%;
+    touch-action: none;
+}
+
+/* Sidebar (right column) */
+.pe-sidebar {
+    width: 150px;
+    padding: 14px 12px;
+    background: rgba(0, 0, 0, 0.25);
+    border-left: 2px solid #5c94fc;
+    display: flex;
+    flex-direction: column;
+    gap: 14px;
+    overflow-y: auto;
+}
+
+.pe-color-current {
+    display: flex;
+    flex-direction: column;
+    gap: 8px;
+    align-items: center;
+}
+
+.pe-swatch-large {
+    width: 100%;
+    height: 48px;
+    border: 2px solid #fcfcfc;
+    border-radius: 6px;
+    background: #5c94fc;
+}
+
+#pe-color-input {
+    width: 100%;
+    height: 32px;
+    padding: 2px;
+    border: 2px solid #5c94fc;
+    border-radius: 6px;
+    background: rgba(0, 0, 0, 0.5);
+    cursor: pointer;
+}
+
+.pe-palette {
+    display: grid;
+    grid-template-columns: repeat(4, 1fr);
+    gap: 4px;
+}
+
+.pe-swatch {
+    aspect-ratio: 1;
+    border: 1px solid rgba(255, 255, 255, 0.3);
+    border-radius: 3px;
+    cursor: pointer;
+    padding: 0;
+    transition: transform 0.1s;
+}
+
+.pe-swatch:hover {
+    transform: scale(1.12);
+    border-color: #fcd444;
+}
+
+.pe-readout {
+    margin-top: auto;
+    font-family: 'Press Start 2P', monospace;
+    font-size: 8px;
+    color: #b4d4ec;
+    line-height: 2.2;
+}
+
+.pe-readout span { color: #54fc54; }
+
+/* Sidebar: opacity, palettes, reference */
+.pe-opacity-group {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+}
+.pe-opacity-group input[type="range"] { width: 100%; accent-color: #fcd444; }
+
+.pe-subhead {
+    font-family: 'Press Start 2P', monospace;
+    font-size: 7px;
+    color: #b4d4ec;
+    margin-top: 4px;
+    letter-spacing: 1px;
+}
+
+.pe-mini-btn {
+    font-family: 'Press Start 2P', monospace;
+    font-size: 7px;
+    padding: 6px 4px;
+    border: 2px solid #5c94fc;
+    border-radius: 5px;
+    background: rgba(92, 148, 252, 0.15);
+    color: #fcfcfc;
+    cursor: pointer;
+    transition: all 0.12s;
+    text-align: center;
+}
+.pe-mini-btn:hover { background: rgba(92, 148, 252, 0.4); }
+
+#pe-custom-palette:empty::after,
+#pe-recent-palette:empty::after {
+    content: '—';
+    color: #555;
+    font-size: 11px;
+}
+
+.pe-ref-controls {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+}
+.pe-ref-row { display: flex; gap: 6px; }
+.pe-ref-row .pe-mini-btn { flex: 1; }
+.pe-ref-load { display: inline-block; }
+.pe-ref-controls input[type="range"] { width: 100%; accent-color: #fcd444; }
+
+/* Sprite card EDIT button uses primary accent */
+.sprite-edit-btn { border-color: #fcd444; color: #fcd444; }
+.sprite-edit-btn:hover { background: rgba(252, 212, 68, 0.3); }
+
+@media (max-width: 768px) {
+    .pe-modal { max-height: none; border-radius: 0; }
+    .pe-body { grid-template-columns: auto 1fr; }
+    .pe-sidebar {
+        grid-column: 1 / -1;
+        grid-row: 2;
+        width: auto;
+        flex-direction: row;
+        flex-wrap: wrap;
+        align-items: center;
+        border-left: none;
+        border-top: 2px solid #5c94fc;
+    }
+    .pe-body { grid-template-rows: 1fr auto; }
+    .pe-palette { flex: 1; }
+    .pe-readout { margin-top: 0; }
+}
+
 /* Mobile */
 @media (max-width: 768px) {
     .admin-header {

admin/admin.html

@@ -7,7 +7,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Press+Start+2P&display=swap" rel="stylesheet">
-    <link rel="stylesheet" href="/admin/admin.css">
+    <link rel="stylesheet" href="/admin/admin.css?v=20260609d">
 </head>
 <body>
     <!-- Login Screen -->
@@ -27,7 +27,7 @@
     <!-- Admin Panel -->
     <div id="admin-panel" class="hidden">
         <header class="admin-header">
-            <h1 class="retro-title">ADS-Bit Admin</h1>
+            <h1 class="retro-title">ADS-Bit Admin <span id="admin-version" class="admin-version"></span></h1>
             <div class="header-actions">
                 <a href="/" class="btn btn-small">VIEWER</a>
                 <button id="logout-btn" class="btn btn-small btn-danger">LOGOUT</button>
@@ -76,37 +76,69 @@
             <!-- Receivers Tab -->
             <section id="tab-receivers" class="tab-pane hidden">
                 <h2>Receiver Configuration</h2>
-                <div id="network-info-box" class="info-box">
-                    <h3>Host Network</h3>
-                    <div id="network-info">Loading...</div>
+
+                <!-- Live status of the receivers the app is currently using -->
+                <div id="receiver-status-box" class="info-box">
+                    <h3>Active Receivers <span id="receiver-status-summary" class="rx-summary"></span></h3>
+                    <div id="receiver-status-list">Loading...</div>
+                    <div class="button-row">
+                        <button id="test-receivers-btn" class="btn">TEST CONNECTIONS</button>
+                        <button id="restart-receivers-btn" class="btn">RESTART CONNECTIONS</button>
+                    </div>
+                    <p class="hint">🟢 receiving data &nbsp; 🟡 connected, no data yet &nbsp; 🔴 unreachable</p>
                 </div>
+
+                <!-- Step 1: choose how receivers are selected -->
+                <div class="rx-section-label">1. Select Receivers</div>
                 <div class="form-group">
                     <label>Discovery Mode</label>
                     <select id="receiver-mode">
-                        <option value="AUTO">AUTO (scan network)</option>
-                        <option value="MANUAL">MANUAL (specify IPs)</option>
+                        <option value="AUTO">AUTO (use all receivers found on the network)</option>
+                        <option value="MANUAL">MANUAL (use only the IPs I specify)</option>
                     </select>
                 </div>
                 <div id="manual-ips-group" class="form-group hidden">
                     <label>Receiver IPs (one per line)</label>
                     <textarea id="receiver-ips-input" rows="4" placeholder="192.168.1.100&#10;192.168.1.101"></textarea>
+                    <span class="hint">The app connects to every IP listed here.</span>
                 </div>
                 <div class="form-group">
                     <label>Receiver Port</label>
                     <input type="number" id="receiver-port" value="30003" min="1" max="65535">
                 </div>
+
+                <!-- Step 2: save + apply -->
+                <div class="rx-section-label">2. Save &amp; Apply</div>
+                <div class="button-row">
+                    <button id="save-receivers-btn" class="btn btn-primary">SAVE &amp; APPLY</button>
+                </div>
+                <p class="hint">Saves your selection, reconnects immediately, then re-tests the receivers below.</p>
+
+                <!-- Find receivers on the network -->
+                <div class="rx-section-label">Find Receivers on Network</div>
                 <div class="form-group">
-                    <label>Custom Subnet (optional)</label>
-                    <input type="text" id="scan-subnet" placeholder="e.g. 10.0.0.0/24 (leave empty to scan all local subnets)">
+                    <label>Interface / Subnet to Scan</label>
+                    <select id="scan-interface"></select>
+                    <span class="hint">Pick a network interface to scan, or scan all local subnets.</span>
+                </div>
+                <div class="form-group">
+                    <label>Custom Subnet (optional override)</label>
+                    <input type="text" id="scan-subnet" placeholder="e.g. 10.0.0.0/24 — overrides the selection above">
                 </div>
                 <div class="button-row">
                     <button id="scan-receivers-btn" class="btn">SCAN NOW</button>
-                    <button id="restart-receivers-btn" class="btn">RESTART CONNECTIONS</button>
-                    <button id="save-receivers-btn" class="btn btn-primary">SAVE</button>
                 </div>
                 <div id="scan-results" class="info-box hidden">
                     <h3>Scan Results</h3>
                     <div id="scan-results-list"></div>
+                    <div class="button-row" id="scan-use-row" style="display:none">
+                        <button id="use-selected-btn" class="btn btn-primary">USE SELECTED RECEIVERS</button>
+                    </div>
+                </div>
+
+                <div id="network-info-box" class="info-box">
+                    <h3>Host Network</h3>
+                    <div id="network-info">Loading...</div>
                 </div>
             </section>
 
@@ -265,6 +297,7 @@
         <div id="toast" class="toast hidden"></div>
     </div>
 
-    <script src="/admin/admin.js"></script>
+    <script src="/admin/pixel-editor.js?v=20260609d"></script>
+    <script src="/admin/admin.js?v=20260609d"></script>
 </body>
 </html>

admin/admin.js

@@ -28,10 +28,22 @@
         loadConfig();
         loadThemes();
         loadNetworkInfo();
+        loadVersion();
         refreshStatus();
         statusInterval = setInterval(refreshStatus, 5000);
     }
 
+    async function loadVersion() {
+        try {
+            const res = await fetch('/api/config');
+            if (!res.ok) return;
+            const data = await res.json();
+            if (data.version) {
+                document.getElementById('admin-version').textContent = 'v' + data.version;
+            }
+        } catch (e) { /* ignore */ }
+    }
+
     document.getElementById('login-form').addEventListener('submit', async (e) => {
         e.preventDefault();
         const pw = document.getElementById('login-password').value;
@@ -78,6 +90,12 @@
                 themesManagerLoaded = true;
                 loadThemeManager();
             }
+            // Live receiver health polling only while the Receivers tab is open
+            if (tab.dataset.tab === 'receivers') {
+                startReceiverStatusPolling();
+            } else {
+                stopReceiverStatusPolling();
+            }
         });
     });
 
@@ -191,11 +209,44 @@
             });
             html += '</table>';
             el.innerHTML = html;
+
+            populateScanInterfaces(ifaces);
         } catch (e) {
             el.textContent = 'Error loading network info';
         }
     }
 
+    // Build the "Interface / Subnet to Scan" dropdown from the host interfaces.
+    // Subnets larger than /20 (>4094 hosts) are disabled — the server rejects
+    // them anyway, and scanning e.g. a docker /16 is impractically slow.
+    const MAX_SCAN_HOSTS = 4094;
+    function populateScanInterfaces(ifaces) {
+        const sel = document.getElementById('scan-interface');
+        if (!sel) return;
+        sel.innerHTML = '';
+
+        const allOpt = document.createElement('option');
+        allOpt.value = '';
+        allOpt.textContent = 'All local subnets (slower)';
+        sel.appendChild(allOpt);
+
+        let firstScannable = null;
+        ifaces.forEach(i => {
+            const prefix = parseInt((i.network.split('/')[1]) || '0', 10);
+            const hosts = Math.max(0, Math.pow(2, 32 - prefix) - 2);
+            const opt = document.createElement('option');
+            opt.value = i.network;
+            const tooBig = hosts > MAX_SCAN_HOSTS;
+            opt.textContent = `${i.name} — ${i.network} (${hosts} hosts)` + (tooBig ? ' — too large' : '');
+            opt.disabled = tooBig;
+            sel.appendChild(opt);
+            if (!tooBig && firstScannable === null) firstScannable = i.network;
+        });
+
+        // Default to the first reasonably-sized interface for a fast scan.
+        if (firstScannable !== null) sel.value = firstScannable;
+    }
+
     // ------- Receivers -------
     function toggleManualIps(mode) {
         document.getElementById('manual-ips-group').classList.toggle('hidden', mode === 'AUTO');
@@ -210,7 +261,10 @@
         btn.textContent = 'SCANNING...';
         btn.disabled = true;
         try {
-            const subnet = (document.getElementById('scan-subnet').value || '').trim();
+            // Custom subnet text overrides the interface dropdown selection.
+            const custom = (document.getElementById('scan-subnet').value || '').trim();
+            const iface = document.getElementById('scan-interface').value || '';
+            const subnet = custom || iface;
             const fetchOpts = { method: 'POST' };
             if (subnet) {
                 fetchOpts.headers = { 'Content-Type': 'application/json' };
@@ -218,16 +272,7 @@
             }
             const res = await fetch('/api/admin/scan-receivers', fetchOpts);
             const data = await res.json();
-            const box = document.getElementById('scan-results');
-            const list = document.getElementById('scan-results-list');
-            box.classList.remove('hidden');
-            if (data.error) {
-                list.textContent = data.error;
-            } else if (data.receivers && data.receivers.length) {
-                list.textContent = data.receivers.join(', ');
-            } else {
-                list.textContent = 'No receivers found on network';
-            }
+            renderScanResults(data);
         } catch (e) {
             toast('Scan failed', true);
         }
@@ -235,17 +280,77 @@
         btn.disabled = false;
     });
 
+    // Render scan results as a selectable checklist.
+    function renderScanResults(data) {
+        const box = document.getElementById('scan-results');
+        const list = document.getElementById('scan-results-list');
+        const useRow = document.getElementById('scan-use-row');
+        box.classList.remove('hidden');
+        list.innerHTML = '';
+
+        if (data.error) {
+            list.textContent = data.error;
+            useRow.style.display = 'none';
+            return;
+        }
+        const found = data.receivers || [];
+        if (!found.length) {
+            list.textContent = 'No receivers found on network';
+            useRow.style.display = 'none';
+            return;
+        }
+
+        // Pre-check IPs already in the manual list.
+        const current = new Set(document.getElementById('receiver-ips-input').value
+            .split('\n').map(s => s.trim()).filter(Boolean));
+
+        found.forEach(ip => {
+            const row = document.createElement('label');
+            row.className = 'rx-scan-item';
+            row.innerHTML = `
+                <input type="checkbox" value="${ip}" ${current.has(ip) ? 'checked' : ''}>
+                <span class="rx-scan-ip">${ip}</span>`;
+            list.appendChild(row);
+        });
+        useRow.style.display = '';
+    }
+
+    // "USE SELECTED" -> switch to MANUAL, populate IPs, save & apply.
+    document.getElementById('use-selected-btn').addEventListener('click', async () => {
+        const checked = Array.from(
+            document.querySelectorAll('#scan-results-list input[type="checkbox"]:checked')
+        ).map(cb => cb.value);
+        if (!checked.length) { toast('Select at least one receiver', true); return; }
+
+        document.getElementById('receiver-mode').value = 'MANUAL';
+        toggleManualIps('MANUAL');
+        document.getElementById('receiver-ips-input').value = checked.join('\n');
+        await saveAndApplyReceivers();
+    });
+
     document.getElementById('restart-receivers-btn').addEventListener('click', async () => {
+        const btn = document.getElementById('restart-receivers-btn');
+        const orig = btn.textContent;
+        btn.textContent = 'RESTARTING…';
+        btn.disabled = true;
         try {
             const res = await fetch('/api/admin/restart-receivers', { method: 'POST' });
-            if (res.ok) toast('Receivers restarted');
+            if (res.ok) { toast('Receivers restarted'); await testReceivers(); }
             else toast('Failed to restart', true);
         } catch (e) {
             toast('Error restarting receivers', true);
         }
+        btn.textContent = orig;
+        btn.disabled = false;
     });
 
-    document.getElementById('save-receivers-btn').addEventListener('click', async () => {
+    document.getElementById('save-receivers-btn').addEventListener('click', saveAndApplyReceivers);
+
+    // Save the receiver selection, reconnect, then re-test — the full
+    // select -> save -> verify loop in one action.
+    async function saveAndApplyReceivers() {
+        const btn = document.getElementById('save-receivers-btn');
+        const orig = btn.textContent;
         const mode = document.getElementById('receiver-mode').value;
         const port = parseInt(document.getElementById('receiver-port').value) || 30003;
         const body = { receiver_port: port };
@@ -255,11 +360,122 @@
         } else {
             const ips = document.getElementById('receiver-ips-input').value
                 .split('\n').map(s => s.trim()).filter(Boolean);
-            body.receivers = ips.length ? ips : 'AUTO';
+            if (!ips.length) { toast('Enter at least one receiver IP', true); return; }
+            body.receivers = ips;
         }
 
-        await saveConfig(body);
-    });
+        btn.textContent = 'APPLYING…';
+        btn.disabled = true;
+        try {
+            const saved = await saveConfig(body, true);
+            if (saved) {
+                // Apply immediately so the active list reflects the new selection.
+                await fetch('/api/admin/restart-receivers', { method: 'POST' });
+                await testReceivers();
+                toast('Saved & applied — testing connections');
+            }
+        } catch (e) {
+            toast('Failed to apply', true);
+        }
+        btn.textContent = orig;
+        btn.disabled = false;
+    }
+
+    // ------- Receiver status / health -------
+    let receiverStatusInterval = null;
+
+    function startReceiverStatusPolling() {
+        loadReceiverStatus();
+        if (!receiverStatusInterval) {
+            receiverStatusInterval = setInterval(loadReceiverStatus, 4000);
+        }
+    }
+
+    function stopReceiverStatusPolling() {
+        if (receiverStatusInterval) {
+            clearInterval(receiverStatusInterval);
+            receiverStatusInterval = null;
+        }
+    }
+
+    async function loadReceiverStatus() {
+        const list = document.getElementById('receiver-status-list');
+        try {
+            const res = await fetch('/api/admin/receiver-status');
+            if (!res.ok) {
+                // 404 here almost always means the server is running an older
+                // build without this endpoint — tell the user instead of
+                // leaving a silent "Loading…".
+                if (res.status === 404) {
+                    list.innerHTML = '<span class="no-sprite">Status endpoint not found — ' +
+                        'restart the server to load the latest build.</span>';
+                }
+                return;
+            }
+            const data = await res.json();
+            renderReceiverStatus(data.receivers || [], data.configured);
+        } catch (e) {
+            // Only replace the initial placeholder; don't clobber good data on
+            // a transient poll failure.
+            if (/Loading/.test(list.textContent)) {
+                list.innerHTML = '<span class="no-sprite">Could not reach server.</span>';
+            }
+        }
+    }
+
+    document.getElementById('test-receivers-btn').addEventListener('click', testReceivers);
+
+    async function testReceivers() {
+        const btn = document.getElementById('test-receivers-btn');
+        const orig = btn.textContent;
+        btn.textContent = 'TESTING…';
+        btn.disabled = true;
+        try {
+            const res = await fetch('/api/admin/test-receivers', { method: 'POST' });
+            if (res.ok) {
+                const data = await res.json();
+                renderReceiverStatus(data.receivers || [], undefined, true);
+            } else {
+                toast('Test failed', true);
+            }
+        } catch (e) {
+            toast('Test error', true);
+        }
+        btn.textContent = orig;
+        btn.disabled = false;
+    }
+
+    function renderReceiverStatus(statuses, configured, tested) {
+        const list = document.getElementById('receiver-status-list');
+        const summary = document.getElementById('receiver-status-summary');
+
+        if (configured !== undefined) {
+            const modeLabel = (configured === 'AUTO') ? 'AUTO' : 'MANUAL';
+            summary.textContent = `(${statuses.length} • ${modeLabel})`;
+        }
+
+        if (!statuses.length) {
+            list.innerHTML = '<span class="no-sprite">No receivers configured. ' +
+                'Use AUTO mode or add IPs below, then SAVE &amp; APPLY.</span>';
+            return;
+        }
+
+        list.innerHTML = '';
+        statuses.forEach(s => {
+            const row = document.createElement('div');
+            row.className = 'rx-status-item';
+            const detail = s.last_msg_age != null
+                ? `${s.msg_count} msgs · last ${s.last_msg_age}s ago`
+                : (s.state === 'down' ? (tested ? 'no response on port' : 'not connected')
+                                      : 'waiting for data…');
+            row.innerHTML = `
+                <span class="rx-dot ${s.color}"></span>
+                <span class="rx-ip">${s.ip}</span>
+                <span class="rx-label rx-${s.color}">${s.label}</span>
+                <span class="rx-detail">${detail}</span>`;
+            list.appendChild(row);
+        });
+    }
 
     // ------- Location -------
     document.getElementById('browser-location-btn').addEventListener('click', () => {
@@ -522,6 +738,7 @@
                     <div class="sprite-categories">${sprite.categories || ''}</div>
                     <div class="sprite-preview">${imgHtml}</div>
                     <div class="sprite-btn-row">
+                        <button class="sprite-upload-label sprite-edit-btn" data-type="${sprite.type}">EDIT</button>
                         <label class="sprite-upload-label">
                             UPLOAD
                             <input type="file" class="sprite-upload-input" accept=".png,image/png" data-type="${sprite.type}">
@@ -530,6 +747,15 @@
                     </div>
                 `;
 
+                const editBtn = card.querySelector('.sprite-edit-btn');
+                editBtn.addEventListener('click', () => {
+                    if (window.PixelEditor) {
+                        window.PixelEditor.open(sprite.type, { onSave: loadSprites });
+                    } else {
+                        toast('Pixel editor not loaded', true);
+                    }
+                });
+
                 const fileInput = card.querySelector('.sprite-upload-input');
                 fileInput.addEventListener('change', async (e) => {
                     const file = e.target.files[0];
@@ -570,7 +796,7 @@
     }
 
     // ------- Helpers -------
-    async function saveConfig(body) {
+    async function saveConfig(body, silent) {
         try {
             const res = await fetch('/api/admin/config', {
                 method: 'PUT',
@@ -578,13 +804,16 @@
                 body: JSON.stringify(body)
             });
             if (res.ok) {
-                toast('Settings saved');
+                if (!silent) toast('Settings saved');
+                return true;
             } else {
                 const data = await res.json();
                 toast(data.error || 'Save failed', true);
+                return false;
             }
         } catch (e) {
             toast('Connection error', true);
+            return false;
         }
     }
 

docker-compose.yml

@@ -6,9 +6,11 @@ services:
     restart: unless-stopped
     environment:
       - PYTHONUNBUFFERED=1
+      - ADSBIT_CONFIG=/app/data/config.json
     volumes:
-      # Persist config (copy config.json.example to config.json before first run)
-      - ./config.json:/app/config.json
+      # Config persists here; auto-seeded from config.json.example on first run
+      # (a directory mount, so a fresh `docker compose up` just works).
+      - ./data:/app/data
       # Persist custom sprite uploads
       - ./images:/app/images
       # Persist custom theme backgrounds

docker-entrypoint.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Seed a config file on first run so `docker compose up` works on a fresh
+# clone with no manual steps. The config lives on a mounted data volume so it
+# persists across container rebuilds.
+set -e
+
+: "${ADSBIT_CONFIG:=/app/config.json}"
+CONFIG_DIR=$(dirname "$ADSBIT_CONFIG")
+mkdir -p "$CONFIG_DIR"
+
+if [ ! -f "$ADSBIT_CONFIG" ]; then
+    echo "[entrypoint] No config at $ADSBIT_CONFIG — seeding from config.json.example"
+    cp /app/config.json.example "$ADSBIT_CONFIG"
+fi
+
+exec python3 server.py

server.py

@@ -17,8 +17,16 @@ from aiohttp import web, ClientSession, ClientTimeout
 import netifaces
 import bcrypt
 
+VERSION = "1.1.2"
+
 WEB_DIR = Path(__file__).parent
-CONFIG_FILE = WEB_DIR / "config.json"
+# Config path is overridable (handy for containers persisting config on a
+# named volume); defaults to config.json next to this script for bare-metal.
+CONFIG_FILE = Path(os.environ.get("ADSBIT_CONFIG") or (WEB_DIR / "config.json"))
+
+# Smallest subnet prefix (largest network) we'll auto-scan: /20 = 4094 hosts.
+# Anything bigger (e.g. a docker /16) is skipped to keep scans fast and safe.
+MIN_SCAN_PREFIX = 20
 
 # Track server start time
 SERVER_START_TIME = time.time()
@@ -170,6 +178,69 @@ receivers: List[str] = []
 receiver_tasks: List[asyncio.Task] = []
 emitter_categories: Dict[str, str] = {}  # ICAO hex -> ADS-B emitter category (A1, A3, A7, etc.)
 
+# Live per-receiver connection health, keyed by IP. Each entry:
+#   {"state": "connecting"|"connected"|"down", "last_msg": ts|None,
+#    "msg_count": int, "connected_since": ts|None, "error": str}
+receiver_status: Dict[str, dict] = {}
+
+# A receiver is considered "receiving" if it produced a message this recently.
+RECEIVER_DATA_FRESH_SECONDS = 30
+
+
+def reset_receiver_status(ips):
+    """Replace the tracked receiver set, marking each as connecting."""
+    global receiver_status
+    receiver_status = {
+        ip: {"state": "connecting", "last_msg": None,
+             "msg_count": 0, "connected_since": None, "error": ""}
+        for ip in ips
+    }
+
+
+def describe_receiver(ip, reachable=None):
+    """Build a display-friendly status object for one receiver.
+
+    state -> (label, color):
+      down/missing       -> DOWN (red)
+      connecting         -> CONNECTING (gray)
+      connected + data   -> RECEIVING (green)
+      connected, no data -> NO DATA (yellow)  (socket up; maybe no aircraft in range)
+    reachable: optional active port-probe result that overrides a stale state.
+    """
+    st = receiver_status.get(ip)
+    now = time.time()
+    if st is None:
+        state, last_age, msg_count = "down", None, 0
+    else:
+        state = st["state"]
+        last_age = (now - st["last_msg"]) if st["last_msg"] else None
+        msg_count = st["msg_count"]
+
+    # An active probe result is authoritative about reachability.
+    if reachable is False:
+        state = "down"
+    elif reachable is True and state == "down":
+        state = "connected"
+
+    if state == "down":
+        label, color = "DOWN", "red"
+    elif state == "connecting":
+        label, color = "CONNECTING", "gray"
+    elif last_age is not None and last_age <= RECEIVER_DATA_FRESH_SECONDS:
+        label, color = "RECEIVING", "green"
+    else:
+        label, color = "NO DATA", "yellow"
+
+    return {
+        "ip": ip,
+        "state": state,
+        "label": label,
+        "color": color,
+        "msg_count": msg_count,
+        "last_msg_age": round(last_age, 1) if last_age is not None else None,
+        "reachable": reachable,
+    }
+
 
 @dataclass
 class SBSMessage:
@@ -246,10 +317,17 @@ async def connect_to_receiver(host: str, port: int = 30003):
     """Connect to an SBS receiver and process messages"""
     reconnect_delay = config['tuning']['receiver_reconnect_seconds']
     print(f"Connecting to receiver at {host}:{port}...")
+    # Ensure a status entry exists even if this task started outside a reset.
+    receiver_status.setdefault(host, {"state": "connecting", "last_msg": None,
+                                       "msg_count": 0, "connected_since": None, "error": ""})
     while True:
         try:
+            receiver_status[host]["state"] = "connecting"
             reader, writer = await asyncio.open_connection(host, port)
             print(f"Connected to {host}:{port}")
+            receiver_status[host]["state"] = "connected"
+            receiver_status[host]["connected_since"] = time.time()
+            receiver_status[host]["error"] = ""
 
             while True:
                 line = await reader.readline()
@@ -259,6 +337,8 @@ async def connect_to_receiver(host: str, port: int = 30003):
                 line = line.decode('utf-8', errors='ignore')
                 msg = parse_sbs_message(line)
                 if msg and msg.icao:
+                    receiver_status[host]["last_msg"] = time.time()
+                    receiver_status[host]["msg_count"] += 1
                     if msg.icao not in flights:
                         flights[msg.icao] = {
                             'icao': msg.icao,
@@ -295,10 +375,14 @@ async def connect_to_receiver(host: str, port: int = 30003):
                     flight['ground'] = msg.ground
                     flight['last_seen'] = time.time()
 
+            # readline returned empty -> peer closed the connection.
+            receiver_status[host]["state"] = "down"
             writer.close()
             await writer.wait_closed()
         except Exception as e:
             print(f"Receiver {host}:{port} error: {e}")
+            receiver_status[host]["state"] = "down"
+            receiver_status[host]["error"] = str(e)
             await asyncio.sleep(reconnect_delay)
 
 
@@ -336,6 +420,15 @@ async def scan_for_receivers():
                 if ip and netmask and not ip.startswith('127.'):
                     try:
                         network = ipaddress.IPv4Network(f"{ip}/{netmask}", strict=False)
+                        # Skip subnets too large to scan quickly (e.g. a docker
+                        # bridge /16 = 65k hosts). Without this, AUTO discovery
+                        # hammers the network and stalls startup on any host with
+                        # Docker or a large/16. Use MANUAL or a custom subnet for
+                        # receivers that live on such networks.
+                        if network.prefixlen < MIN_SCAN_PREFIX:
+                            print(f"Skipping {network} on {iface}: too large "
+                                  f"({network.num_addresses} hosts) for auto-scan")
+                            continue
                         found.extend(await _scan_subnet(network, port))
                     except ValueError as e:
                         print(f"Invalid network {ip}/{netmask}: {e}")
@@ -473,6 +566,7 @@ async def handle_receiver_location(request):
 async def handle_config(request):
     """Return client-relevant configuration (public, no secrets)."""
     return web.json_response({
+        "version": VERSION,
         "theme": config.get("theme", "desert"),
         "location": config["location"],
         "receivers": receivers,
@@ -905,9 +999,10 @@ async def handle_admin_scan_receivers(request):
             return web.json_response(
                 {"error": f"Invalid subnet: {subnet}"}, status=400)
 
-        if network.prefixlen < 20:
+        if network.prefixlen < MIN_SCAN_PREFIX:
             return web.json_response(
-                {"error": "Subnet too large (max /20 = 4096 hosts)"}, status=400)
+                {"error": f"Subnet too large (max /{MIN_SCAN_PREFIX} = "
+                          f"{2 ** (32 - MIN_SCAN_PREFIX) - 2} hosts)"}, status=400)
 
         port = config['receiver_port']
         found = await _scan_subnet(network, port)
@@ -992,10 +1087,15 @@ async def restart_receiver_connections():
     """Cancel existing receiver tasks and start new ones."""
     global receivers, receiver_tasks
 
-    # Cancel old tasks
-    for task in receiver_tasks:
-        task.cancel()
+    # Cancel old tasks and let them unwind cleanly. Awaiting the cancelled
+    # tasks here (with return_exceptions) absorbs their CancelledError so it
+    # can never propagate into the main event loop.
+    old_tasks = list(receiver_tasks)
     receiver_tasks.clear()
+    for task in old_tasks:
+        task.cancel()
+    if old_tasks:
+        await asyncio.gather(*old_tasks, return_exceptions=True)
 
     # Determine receivers
     receiver_config = config["receivers"]
@@ -1015,6 +1115,9 @@ async def restart_receiver_connections():
         print(f"Error determining receivers: {e}")
         receivers = []
 
+    # Reset health tracking to the new receiver set.
+    reset_receiver_status(receivers)
+
     # Start new tasks
     for r in receivers:
         task = asyncio.create_task(connect_to_receiver(r, receiver_port))
@@ -1030,6 +1133,28 @@ async def handle_admin_restart_receivers(request):
     return web.json_response({"ok": True, "receivers": receivers})
 
 
+@require_auth
+async def handle_admin_receiver_status(request):
+    """GET /api/admin/receiver-status - Live health of configured receivers."""
+    statuses = [describe_receiver(ip) for ip in receivers]
+    return web.json_response({
+        "receivers": statuses,
+        "configured": config["receivers"],   # "AUTO" or a list of IPs
+        "count": len(receivers),
+    })
+
+
+@require_auth
+async def handle_admin_test_receivers(request):
+    """POST /api/admin/test-receivers - Actively probe each configured receiver
+    and report reachability combined with live data-flow state."""
+    port = config["receiver_port"]
+    probes = await asyncio.gather(*[test_port(ip, port) for ip in receivers])
+    statuses = [describe_receiver(ip, reachable=reachable)
+                for ip, reachable in zip(receivers, probes)]
+    return web.json_response({"receivers": statuses, "count": len(receivers)})
+
+
 # ---------------------------------------------------------------------------
 # Static file serving with setup redirect
 # ---------------------------------------------------------------------------
@@ -1063,6 +1188,17 @@ async def handle_http(request):
     return web.Response(status=404, text="Not Found")
 
 
+async def handle_health(request):
+    """GET /health - liveness/readiness probe (no auth, no secrets)."""
+    return web.json_response({
+        "status": "ok",
+        "version": VERSION,
+        "receivers": len(receivers),
+        "flights": len(flights),
+        "uptime_seconds": int(time.time() - SERVER_START_TIME),
+    })
+
+
 # ---------------------------------------------------------------------------
 # Application setup
 # ---------------------------------------------------------------------------
@@ -1075,6 +1211,7 @@ async def start_http_server():
     app.router.add_get('/ws', websocket_handler)
 
     # Public API
+    app.router.add_get('/health', handle_health)
     app.router.add_get('/api/receiver-location', handle_receiver_location)
     app.router.add_get('/api/config', handle_config)
 
@@ -1103,6 +1240,8 @@ async def start_http_server():
     app.router.add_get('/api/admin/network-info', handle_admin_network_info)
     app.router.add_post('/api/admin/scan-receivers', handle_admin_scan_receivers)
     app.router.add_post('/api/admin/restart-receivers', handle_admin_restart_receivers)
+    app.router.add_get('/api/admin/receiver-status', handle_admin_receiver_status)
+    app.router.add_post('/api/admin/test-receivers', handle_admin_test_receivers)
     app.router.add_get('/api/admin/sprites', handle_admin_sprites)
     app.router.add_post('/api/admin/sprites/{type}', handle_admin_sprite_upload)
 
@@ -1123,7 +1262,7 @@ async def main():
     """Main entry point"""
     global receivers, receiver_tasks
 
-    print("ADS-Bit Server Starting...")
+    print(f"ADS-Bit Server v{VERSION} Starting...")
 
     load_config()
 
@@ -1148,6 +1287,8 @@ async def main():
     else:
         print(f"Using {len(receivers)} receiver(s)")
 
+    reset_receiver_status(receivers)
+
     # Start all tasks
     tasks = [
         start_http_server(),
@@ -1156,14 +1297,24 @@ async def main():
         poll_aircraft_json(),
     ]
 
-    # Connect to all receivers
+    # Connect to all receivers. These run as independent background tasks and
+    # are deliberately NOT awaited in the gather below: restarting receivers
+    # cancels them, and a cancelled task inside the main gather would tear down
+    # the whole server. They still run as long as the event loop is alive.
     for receiver in receivers:
         task = asyncio.ensure_future(connect_to_receiver(receiver, receiver_port))
         receiver_tasks.append(task)
-        tasks.append(task)
 
+    # Only the core services keep the server alive.
     await asyncio.gather(*tasks)
 
 
 if __name__ == "__main__":
-    asyncio.run(main())
+    # Make SIGTERM (docker stop, systemctl stop) raise KeyboardInterrupt like
+    # SIGINT does, so shutdown is clean and quiet instead of a stack trace.
+    import signal
+    signal.signal(signal.SIGTERM, signal.default_int_handler)
+    try:
+        asyncio.run(main())
+    except (KeyboardInterrupt, SystemExit):
+        print("ADS-Bit server shutting down.")