fungiboletus · Oct 5, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026 · Oct 4, 2026
diff --git a/.dockerignore b/.dockerignore
@@ -12,3 +12,5 @@ compose.test-services.yml
 *.duckdb
 *.sqlite
 *.log
+frontend/node_modules
+frontend/dist
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -87,7 +87,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: '22'
+          node-version: '24'
           cache: 'npm'
           cache-dependency-path: frontend/package-lock.json
 
@@ -393,10 +393,22 @@ jobs:
           cache-from: type=gha,scope=runtime-smoke
           cache-to: type=gha,scope=runtime-smoke,mode=max
 
+      - name: The image refuses to start without authentication
+        if: matrix.name == 'runtime'
+        run: |
+          # No secret and no SENSAPP_AUTH_DISABLED: the image listens on 0.0.0.0, which is not safe open
+          if docker run --rm sensapp-ci:runtime > refusal.log 2>&1; then
+            echo "The image started without authentication"
+            exit 1
+          fi
+          cat refusal.log
+          grep -q SENSAPP_JWT_SECRET refusal.log
+
       - name: Start runtime image against ClickHouse
         if: matrix.name == 'runtime'
         run: >-
           docker run --detach --name sensapp-ci-runtime --network host
+          --env SENSAPP_AUTH_DISABLED=true
           --env SENSAPP_STORAGE_CONNECTION_STRING=clickhouse://default:password@127.0.0.1:8123/sensapp_test
           sensapp-ci:runtime
 

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -41,6 +41,7 @@ arrow-array = "60"
 anyhow = "1.0"
 async-trait = "0.1"
 thiserror = "2.0"
+sha2 = "0.10"
 axum = { version = "0.8", features = ["multipart", "macros"] }
 base64 = "0.22"
 futures = "0.3"
@@ -60,6 +61,7 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 uuid = { version = "1.18", features = ["serde"] }
 fastrand = "2"
+getrandom = "0.3"
 csv-async = "1.3"
 rust_decimal = "1.39"
 geo = "0.32"

diff --git a/Dockerfile b/Dockerfile
@@ -1,3 +1,14 @@
+# The web UI is static files: build them once, on the build platform, whatever the target.
+FROM --platform=$BUILDPLATFORM node:24-slim AS frontend
+
+WORKDIR /frontend
+
+COPY frontend/package.json frontend/package-lock.json ./
+RUN npm ci
+
+COPY frontend/ ./
+RUN npm run build
+
 FROM rust:1.98-slim-bookworm AS chef
 
 ARG DUCKDB_DOWNLOAD_LIB="1"
@@ -77,8 +88,14 @@ COPY --from=builder /app/target/release/sensapp /usr/local/bin/sensapp
 COPY --from=builder /out/lib/ /usr/local/lib/
 RUN ldconfig
 
+# Served under /ui/, see SENSAPP_UI_ENABLED
+COPY --from=frontend /frontend/dist /usr/share/sensapp/ui
+
+# The image listens on every address, so it does not start without authentication: give it
+# SENSAPP_JWT_SECRET (`sensapp generate-secret` makes one), or SENSAPP_AUTH_DISABLED=true.
 ENV SENSAPP_ENDPOINT=0.0.0.0 \
     SENSAPP_PORT=3000 \
+    SENSAPP_UI_DIR=/usr/share/sensapp/ui \
     SENSAPP_STORAGE_CONNECTION_STRING=sqlite:///var/lib/sensapp/sensapp.db \
     RUST_LOG=info
 

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # ![SensApp](./docs/sensapp_logo.png)
 
-SensApp is an open-source sensor data platform developed by SINTEF.
+SensApp is an open-source sensor data platform developed by [SINTEF](https://www.sintef.no/).
 
 It handles time-series data ingestion, storage, and retrieval. From small edge devices to big data digital twins, SensApp *may* be useful.
 
@@ -10,22 +10,23 @@ SensApp is compatible with Prometheus and InfluxDB, but with an alternative arch
 
 Dealing with system statistics for the last 24 hours? InfluxDB or Prometheus are excellent choices. Fetching average bathroom temperatures over the last 10 years grouped by day? SensApp will compute that instantly while InfluxDB or Prometheus will take a little while.
 
-But you don't have to chose, both InfluxDB and Prometheus can replicate their data to SensApp for long-term storage and analysis. So you get the best of both worlds.
+But you don't have to chose, both InfluxDB and Prometheus can replicate their data to SensApp for long-term storage and analysis. So you can get the best of both worlds.
 
-You can also use SensApp as a standalone time-series database.
+You can also use SensApp as a standalone time-series database. It's designed to work from the edge to the big data workloads in the cloud, by relying on different databases.
 
-## Quickstart
+![GUI Screenshot](./docs/screenshot.png)
 
-The quickest way to run SensApp is with SQLite so no external database is required.
+## Quickstart
 
-Start SensApp with SQLite:
+The simplest way to test SensApp is using it with SQLite and no authentication:
 
 ```bash
-SENSAPP_STORAGE_CONNECTION_STRING=sqlite://sensapp.db \
-cargo run
+export SENSAPP_STORAGE_CONNECTION_STRING=sqlite://sensapp.db
+export SENSAPP_AUTH_DISABLED=true
+cargo run --release
 ```
 
-By default, SensApp listens on [http://127.0.0.1:3000](http://127.0.0.1:3000).
+By default, SensApp listens on [http://127.0.0.1:3000](http://127.0.0.1:3000) for both its API and user interface.
 
 Ingest one sample:
 
@@ -59,7 +60,7 @@ async def main():
 asyncio.run(main())
 ```
 
-### Using Containers
+## Software Containers and Kubernetes
 
 ```bash
 docker compose up
@@ -76,6 +77,7 @@ Published releases also provide the chart through GHCR as an OCI package; see th
 ## Features
 
 - **HTTP REST API**
+- **Graphical User Interface**
 - **Prometheus Compatibility**
   - **Prometheus Remote Write**: Prometheus can push data to SensApp.
   - **Prometheus Remote Read**: Prometheus can also read data from SensApp.
@@ -102,7 +104,7 @@ SensApp's architecture is relatively simple as the complex problems are delegate
 
 Most of the complexity lies in the [database schema design](docs/DATAMODEL.md). After that, it's mostly some code glue.
 
-- On the **edge**, SensApp can be deployed as a single lightweight instance with an embedded SQLite database.
+- On the **edge**, SensApp can be deployed as a single instance with a SQLite database.
 - For **medium** deployments, SensApp can be deployed with a PostgreSQL database.
 - For **larger** deployments, many SensApp instances can be deployed behind a load balancer, connected to a ClickHouse database cluster. A message queue and some middleware can be considered to ingest data at scale.
 
@@ -112,11 +114,13 @@ Check the [ARCHITECTURE.md](docs/ARCHITECTURE.md) file for more details.
 
 ## Authentication
 
-SensApp supports **optional JWT authentication**. By default, all endpoints are open. Visit [docs/JWT_AUTH.md](./docs/JWT_AUTH.md) for the authentication documentation.
+SensApp uses JSON Web Tokens (JWT) for its authentication. Visit [docs/JWT_AUTH.md](./docs/JWT_AUTH.md) for the detailed authentication documentation.
+
+While you can start sensapp with authentication disabled, it is recommended to use the authentication feature, in command line or through the web interface. By default, SensApp will print an admin token and a link that you can use to generate more tokens.
 
 ## Built With Rust™️
 
-SensApp is developed using Rust, a language known for its performance, memory safety, and annoying borrow checker. SensApp used to be written in Scala, but the new author prefers Rust.
+SensApp is developed using Rust, a language known for its performance, memory safety, and annoying borrow checker. SensApp used to be written in Scala, but the new authors prefers Rust.
 
 Another reason is from the results from the paper [Energy efficiency across programming languages: how do energy, time, and memory relate?](https://dl.acm.org/doi/10.1145/3136014.3136031), which shows Rust as one of the most energy-efficient programming languages while having memory safety.
 
@@ -136,7 +140,7 @@ The SensApp software is provided "as is," with no warranties, and the creators o
 
 ## You May Not Want to Use It in Production (Yet)
 
-SensApp is currently under development. It is not ready for production.
+SensApp is currently under development. It is getting ready for production.
 
 ## Acknowledgements
 

diff --git a/TODO.md b/TODO.md
@@ -2,7 +2,7 @@
 
 This file tracks the main remaining work for SensApp. Detailed task history lives in `current_tasks/`, `ideas/` and `done/`.
 
-The core is in place: HTTP-only ingestion, DCAT/query/export endpoints, Prometheus and InfluxDB compatibility, health endpoints, Prometheus service metrics, JWT sensor authorization, HTTP resource limits, data lifecycle controls, cross-series aggregation, a Python SDK, Helm chart and container images, and a broad integration test suite run against every backend in CI.
+The core is in place: HTTP-only ingestion, DCAT/query/export endpoints, Prometheus and InfluxDB compatibility, health endpoints, Prometheus service metrics, secure-by-default JWT authentication (sensor authorization, an admin scope, secret rotation, a Credentials tab), HTTP resource limits, data lifecycle controls, cross-series aggregation, a Python SDK, Helm chart and container images, and a broad integration test suite run against every backend in CI.
 
 The next phase is not to add more features. It is to make the existing system solid enough for pre-production, with ClickHouse as the reference backend. The acceptance criteria and sequencing are in [docs/PREPRODUCTION_RELEASE_PLAN.md](docs/PREPRODUCTION_RELEASE_PLAN.md).
 

diff --git a/charts/sensapp/README.md b/charts/sensapp/README.md
@@ -52,3 +52,20 @@ Supported URL forms in the default container image include:
 | ClickHouse HTTPS | `clickhouses://user:password@clickhouse.example.com:8443/sensapp` |
 
 For a quick setup, you can set `storage.connectionString` directly instead of referencing a Secret. Helm stores that value in the release configuration, so use an existing Secret for credentials. External databases own their storage and lifecycle; leave `persistence.enabled=false` for these backends.
+
+## Authentication
+
+SensApp does not run open: the container image listens on every address, so it refuses to start without a secret. By default the chart **makes a random secret on the first install** and keeps it across upgrades (it reads it back from the Secret of the release). Make an admin token, which makes the other tokens in the UI (Credentials tab):
+
+```bash
+kubectl exec deploy/sensapp -- sensapp generate-token me --scope read,admin
+```
+
+| Value | Effect |
+| --- | --- |
+| `auth.jwtSecret` | A secret of your choice (at least 32 characters). Stored in the Secret of the release and in the release values: prefer `existingSecret`. |
+| `auth.existingSecret`, `auth.existingSecretKey` | A Secret of yours holding `SENSAPP_JWT_SECRET`. Takes precedence over `jwtSecret`. |
+| `auth.previousSecrets` | Comma-separated secrets that still verify tokens but never sign: the way to rotate the secret, see [JWT_AUTH.md](../../docs/JWT_AUTH.md#rotating-the-secret-and-revoking-tokens). |
+| `auth.disabled` | Every endpoint is open (`SENSAPP_AUTH_DISABLED`), for a network that authenticates in front of SensApp. Ignored when a secret is given. |
+
+The made secret needs the chart to read the cluster (`lookup`). Tools that only render the chart (`helm template`, Argo CD) cannot, and would make a new secret at each render: for those, set `auth.jwtSecret` or `auth.existingSecret`.
diff --git a/charts/sensapp/templates/NOTES.txt b/charts/sensapp/templates/NOTES.txt
@@ -14,13 +14,22 @@
   echo http://127.0.0.1:3000
 {{- end }}
 
-{{- if .Values.auth.jwtSecret }}
-2. JWT authentication is ENABLED.
-   Generate a token with:
-     sensapp generate-token <subject> --scope readwrite --duration 3600
+{{- if and .Values.auth.disabled (not .Values.auth.jwtSecret) (not .Values.auth.existingSecret) }}
+2. Authentication is DISABLED (auth.disabled): every endpoint is open to whoever can reach it.
+   To require tokens, remove auth.disabled.
+{{- else }}
+2. Authentication is ENABLED: the endpoints need a token.
+{{- if .Values.auth.existingSecret }}
+   The secret is the key {{ .Values.auth.existingSecretKey }} of the Secret {{ .Values.auth.existingSecret }}.
+{{- else if .Values.auth.jwtSecret }}
+   The secret is auth.jwtSecret.
+{{- else }}
+   The chart made the secret, and keeps it across upgrades.
+{{- end }}
+   Make an admin token (it makes the other tokens, in the UI under Credentials or with POST /api/v1/admin/tokens):
+     kubectl exec --namespace {{ .Release.Namespace }} deploy/{{ include "sensapp.fullname" . }} -- sensapp generate-token me --scope read,admin
+   Or a token for a client:
+     kubectl exec --namespace {{ .Release.Namespace }} deploy/{{ include "sensapp.fullname" . }} -- sensapp generate-token <subject> --scope readwrite --duration 86400
    Use it in requests:
      curl -H "Authorization: Bearer <token>" http://<sensapp-url>/metrics
-{{- else }}
-2. JWT authentication is DISABLED. All endpoints are open.
-   To enable, set auth.jwtSecret to a random string (≥ 32 chars).
 {{- end }}
diff --git a/charts/sensapp/templates/_helpers.tpl b/charts/sensapp/templates/_helpers.tpl
@@ -39,3 +39,35 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- default "default" .Values.serviceAccount.name -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+"true" when the chart makes the JWT secret itself: authentication is on, and no secret was given
+(neither `auth.jwtSecret` nor `auth.existingSecret`). Empty otherwise.
+*/}}
+{{- define "sensapp.generateJwtSecret" -}}
+{{- if and (not .Values.auth.disabled) (not .Values.auth.jwtSecret) (not .Values.auth.existingSecret) -}}
+true
+{{- end -}}
+{{- end -}}
+
+{{/*
+The JWT secret the chart makes: the one of the Secret of the release when it exists, so that an
+upgrade keeps it (and the tokens made with it), a new random one on the first install. `helm
+template` and the tools that only render (Argo CD) cannot look the Secret up: they would make
+a new secret at each render, so give `auth.jwtSecret` or `auth.existingSecret` there.
+*/}}
+{{- define "sensapp.jwtSecret" -}}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace (include "sensapp.fullname" .) -}}
+{{- if and $existing $existing.data (hasKey $existing.data "SENSAPP_JWT_SECRET") -}}
+{{- index $existing.data "SENSAPP_JWT_SECRET" | b64dec -}}
+{{- else -}}
+{{- randAlphaNum 48 -}}
+{{- end -}}
+{{- end -}}
+
+{{/* "true" when the Secret of the release holds something */}}
+{{- define "sensapp.hasSecret" -}}
+{{- if or (not .Values.storage.existingSecret) .Values.auth.jwtSecret .Values.auth.previousSecrets .Values.secretEnv (include "sensapp.generateJwtSecret" .) -}}
+true
+{{- end -}}
+{{- end -}}
diff --git a/charts/sensapp/templates/configmap.yaml b/charts/sensapp/templates/configmap.yaml
@@ -6,6 +6,9 @@ metadata:
     {{- include "sensapp.labels" . | nindent 4 }}
 data:
   SENSAPP_PORT: {{ .Values.service.port | quote }}
+  {{- if .Values.auth.disabled }}
+  SENSAPP_AUTH_DISABLED: "true"
+  {{- end }}
   {{- range $key, $value := .Values.env }}
   {{- if ne $key "SENSAPP_PORT" }}
   {{ $key }}: {{ $value | quote }}

diff --git a/charts/sensapp/templates/deployment.yaml b/charts/sensapp/templates/deployment.yaml
@@ -43,14 +43,14 @@ spec:
           envFrom:
             - configMapRef:
                 name: {{ include "sensapp.fullname" . }}
-            {{- if or (not .Values.storage.existingSecret) .Values.auth.jwtSecret .Values.secretEnv }}
+            {{- if include "sensapp.hasSecret" . }}
             - secretRef:
                 name: {{ include "sensapp.fullname" . }}
             {{- end }}
           {{- with .Values.extraEnvFrom }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if or .Values.storage.existingSecret .Values.extraEnv }}
+          {{- if or .Values.storage.existingSecret .Values.auth.existingSecret .Values.extraEnv }}
           env:
             {{- if .Values.storage.existingSecret }}
             - name: SENSAPP_STORAGE_CONNECTION_STRING
@@ -59,6 +59,13 @@ spec:
                   name: {{ .Values.storage.existingSecret | quote }}
                   key: {{ .Values.storage.existingSecretKey | quote }}
             {{- end }}
+            {{- if .Values.auth.existingSecret }}
+            - name: SENSAPP_JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.auth.existingSecret | quote }}
+                  key: {{ .Values.auth.existingSecretKey | quote }}
+            {{- end }}
             {{- with .Values.extraEnv }}
             {{- toYaml . | nindent 12 }}
             {{- end }}

diff --git a/charts/sensapp/templates/secret.yaml b/charts/sensapp/templates/secret.yaml
@@ -1,4 +1,4 @@
-{{- if or (not .Values.storage.existingSecret) .Values.auth.jwtSecret .Values.secretEnv }}
+{{- if include "sensapp.hasSecret" . }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -12,6 +12,11 @@ stringData:
   {{- end }}
   {{- if .Values.auth.jwtSecret }}
   SENSAPP_JWT_SECRET: {{ .Values.auth.jwtSecret | quote }}
+  {{- else if include "sensapp.generateJwtSecret" . }}
+  SENSAPP_JWT_SECRET: {{ include "sensapp.jwtSecret" . | quote }}
+  {{- end }}
+  {{- if .Values.auth.previousSecrets }}
+  SENSAPP_JWT_PREVIOUS_SECRETS: {{ .Values.auth.previousSecrets | quote }}
   {{- end }}
   {{- range $key, $value := .Values.secretEnv }}
   {{ $key }}: {{ $value | quote }}

diff --git a/charts/sensapp/values.yaml b/charts/sensapp/values.yaml
@@ -86,14 +86,27 @@ storage:
   existingSecret: ""
   existingSecretKey: SENSAPP_STORAGE_CONNECTION_STRING
 
-# Optional JWT authentication.
-# When jwtSecret is set, read/write endpoints require a valid Bearer token.
-# Health checks, docs, and prometheus scrape remain open.
-# Use `sensapp generate-token <subject>` to create tokens.
+# Authentication. SensApp does not run open unless told to: the protected endpoints need a JWT
+# signed with a secret. Health checks, docs, the UI files and the Prometheus scrape stay open.
+#
+# By default the chart makes a random secret on the first install and keeps it across upgrades
+# (it is read back from the Secret of the release). Make an admin token with:
+#   kubectl exec deploy/<release name> -- sensapp generate-token me --scope read,admin
+# Tools that only render the chart (Argo CD, `helm template`) cannot read it back and would make a
+# new secret each time: for those, give jwtSecret or existingSecret.
 auth:
-  # Set to a random string of at least 32 characters to enable JWT auth.
-  # Leave empty (or omit) to run without authentication (default).
+  # A secret of at least 32 characters (`sensapp generate-secret` makes one). Stored in the Secret
+  # of the release, and in the release values: prefer existingSecret.
   jwtSecret: ""
+  # A Secret of yours holding the key below. Takes precedence over jwtSecret.
+  existingSecret: ""
+  existingSecretKey: SENSAPP_JWT_SECRET
+  # Secrets that still verify tokens but never sign them, separated by commas: the way to rotate
+  # the secret. Dropping one revokes the tokens it signed.
+  previousSecrets: ""
+  # Run with every endpoint open (SENSAPP_AUTH_DISABLED). For a network that authenticates
+  # in front of SensApp. Ignored when a secret is given.
+  disabled: false
 
 secretEnv: {}
 extraEnv: []

diff --git a/compose.prometheus-roleplay.yml b/compose.prometheus-roleplay.yml
@@ -8,6 +8,8 @@ services:
     container_name: sensapp-roleplay
     environment:
       SENSAPP_ENDPOINT: 0.0.0.0
+      # A demo on a laptop, with clients that send no token
+      SENSAPP_AUTH_DISABLED: "true"
       SENSAPP_PORT: 3017
       SENSAPP_STORAGE_CONNECTION_STRING: duckdb:///workspaces/sensapp/python/roleplay-datascience/roleplay-session.duckdb
       RUST_LOG: info