Features

For each feature’s prerequisites and disabled-action explanations, see Feature requirements.

First confirm that the gateway carries traffic. Replace the example subscription and node with working ones, then from a real LAN client test direct and proxied TCP, UDP and DNS. honk-core is running, the dae0 link or a reachable API does not prove that traffic flows.

This page covers the standard edition; for doona lite, see doona lite.

Check every feature

The example configuration sets the options used by the features below. Replace the placeholder subscription and node, then verify each feature.

In automatic recording modes, flow requests, log streams and DNS log reads activate their own recorders, each with an independent 60-second grace period. Connections, Routing log and Rules request flows while open. A recorder that is allowed but idle is normal.

If a feature is still missing

• honk was not restarted after native_api changed. A reload does not apply these fields.
• config_write: true is absent. A native_api field written directly under experimental stops honk with “unknown experimental setting”.
• Neither password_auth: true nor secret is set, and anonymous loopback is not enabled. With enabled: true, honk then refuses to start. allow_anonymous_loopback: true with a loopback listen admits read requests without a token. Configuration writes and protected settings changes still require credentials. Use it for local development only.
• The file contains a secret or text equal to one, so doona shows it read-only.
• honk is an early feat/native-api build, so the Geodata card has no source settings. Install the build from the doona release; see honk version.
• In token mode, the state database did not open, so Geodata has no configurable source or schedule controls. The files table remains, and manual updates can still work with configured URLs and update capability; see State database problems.
• Only when honk runs with --store db, which this guide does not use: a revision honk could not record blocks writes until the next successful activation.

After sign-in

For interface guides and task procedures, see the documentation index.

Every configuration-source write goes through the engine. doona sends the hash it read the source at (If-Match); a file changed on disk answers 412 and nothing is written. The engine validates the whole source set before saving and reloading, and a failed reload keeps the previous generation active. Dry-run validation never writes, and redacted text is never written back. Runtime settings and group selection are separate endpoints with their own checks.

Pages and the resources they need

Every page remains in navigation. A page is marked unavailable only when every resource listed for it in registry.ts is unavailable; Configuration is also available when the backend offers export, import or revisions. Opening an unavailable page shows a notice. Ctrl K (⌘ K on macOS) searches pages and live data as well as settings fields and actions, persistent global settings, configuration sections and feature entry points; selecting a result opens and focuses its control, without executing the action. See the search example.

Widgets

Activity's dashboard and the floating panel share a widget gallery. Both offer Outbound failures, Node availability, DNS latency and Subscription quota. Subscription quota is not in the default layout. It lists each subscription's expiry and quota meter, or its usage when the provider reports no allowance. Source health also meters usage when a provider reports an allowance.

Memory defaults to a chart. Select Sparkline for a value tile like Download and Upload; dashboard widths range from one fifth of a row to full width. The panel's medium Memory widget shows resident memory and cgroup usage against its limit; its chart starts at the large size.

The memory meter reads cgroup used. It shows no meter for a zero or absent limit and distinguishes an unreported limit from one reported as unset. The Key-value list also names OOM kills when any have occurred. A byte fraction with a shared unit writes it once, such as 70／268 MB.

• Chart cards at least two thirds of a row wide show each series' peak and average beside the chart. This includes Auto-width traffic cards and value tiles. Wide key-value metric cards show the same statistics beside their readings.
• Wide list widgets with at least four rows use two columns. Long names wrap instead of being cut off. Notices grow with their contents rather than a row-count setting.
• Donuts from two thirds of dashboard width draw larger rings and narrower legends. From half width, node latency puts its lowest and highest values on the legend line. A stacked waffle chart is centred above its legend.
• Narrow donut legends keep names with their values and shares; large panel donuts show every entry without scrolling. Small panel notices take the whole row, and small node latency uses names and values instead of a cramped plot. Narrow area charts omit overlapping time labels.
• Cumulative traffic, DNS answer and network splits offer widths up to half a row. The group switch goes up to two thirds and does not repeat its title. The two splits show every category, with no row-count setting. Saved sizes no longer offered use the nearest available size.
• Panel key-value metric widgets do not offer a large size identical to medium. A waiting sparkline draws its baseline until its second sample; the speed legend keeps its height as rates change.

See the tour for panel movement, pinning, docking and editor scrolling.

Theme gallery

Light themes use white text on notice badges and warning and information toasts, including yellow notices.

The Glass section has four palettes: Liquid Glass, Glass, Frosted and Tinted. Liquid Glass refracts only in Chromium browsers; Firefox and Safari draw it as Glass.

Settings > Appearance shows the palette boxes and, with a Glass palette selected, the wallpaper, readability veil and blur controls. A custom wallpaper also appears behind the sign-in page.

Settings stored in the browser

localStorage holds this origin's preferences, layouts and connection profiles, including the Token, and the password sign-in session token. The session is shared by every tab and lasts until you sign out, honk answers 401 or its profile is deleted; closing a tab does not end it. sessionStorage keeps only per-tab state, such as each section's last page. honk stores the backend configuration and manages password sessions; it limits a session to 12 hours and forgets sessions when it restarts. Clearing browser data loses the saved profiles, preferences and session token, not honk's configuration.

In token mode, requests send the saved Token in Authorization; a pairing link may carry it in the URL fragment, removed on load. For storage keys, see storage.ts.

The saved theme and language are applied before the first paint, so a reload does not flash the default look.

Settings > Appearance places Date format and Time format next to Language. Date format defaults to Automatic (browser region), independent of the interface language. Day/Month/Year, Month/Day/Year and Year-Month-Day override the browser's order.

Time format defaults to 24-hour. 12-hour uses the interface language's AM/PM words; Automatic (browser region) follows the regional clock. It applies to every page time, including chart axes and the log heatmap, and works with each date format. The choices are saved in this browser.

Over HTTPS or on localhost a service worker precaches the application shell and caches fonts and icons, so the pages open offline and the site can be installed as an app. API responses are never cached. See SECURITY.md for reporting a vulnerability.

Sign-in does not download the other pages before authentication. Installing an update does not download files the page already has.