* feat(api): expand REST coverage for full dashboard automation
Closes#6435.
Boards could only be created empty through the API. The single endpoint for
adding a widget took no geometry, so the size came from the widget default and
the position was always the next free cell. Everything else a setup needs was
reachable from the interface only.
Board composition
- POST /api/boards/items accepts an optional placement: width, height, xOffset,
yOffset and sectionId, or a layouts array for per breakpoint control. Without
it the previous automatic placement is unchanged.
- Adds read, update and delete for items, CRUD for sections, read and replace
for layouts, and GET /api/boards/{id} for the whole board.
- GET /api/boards/{id}/export and POST /api/boards/import make a board
reproducible from version control. onConflict decides what happens when the
name is taken, so a pipeline can be re-run.
- Board access is manageable through GET/PUT /api/boards/{id}/permissions.
Remaining services
- Search engines, integrations, groups, api keys and server settings are
exposed over OpenAPI and registered as MCP tools.
- GET /api/config/export and POST /api/config/import cover the configuration of
a whole instance. Ids are kept so references inside opaque widget options stay
intact, and entities are matched by natural key when the id is unknown, which
is what makes a document from another instance applicable.
- The backup endpoints accept an ApiKey header, so a recovery job no longer
needs a browser session.
Headless bootstrap
- homarr api-keys create prints a key without opening the web interface, which
together with the existing recreate-admin removes the last manual step.
Notes
- No database migration, the schema already stores position and size.
- Grid coordinates and sizes in a document are bounded, and the placement scan
no longer walks every column, so a large grid cannot occupy the server.
- Imports collect their statements first and apply them in one transaction, so a
rejected document never leaves a board half written.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix: harden dashboard automation APIs
* fix: validate global home board settings
* fix: validate merged import settings
* docs(api): describe the bounded placement scan accurately
The comment still described the earlier version that walked every row up to the
last occupied one. Both axes now iterate the edges of the occupied areas, so the
cost follows the amount of content rather than the dimensions of the grid.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* fix(api): keep the search engine type narrow and record the new MCP tools
The `.output()` added to `searchEngine.getPaginated` widened `type` back to a
string through the plain select schema, which broke the management page that
switches on it. It now reuses the narrowed union the detail endpoint already has.
`mcp.spec` pins the reviewed tool inventory; the 33 tools this branch exposes are
added to it. The configuration round trip asserted the first layout of an item,
which is the mobile one half of the time and holds the same item clamped, so it
addresses the base layout by id instead.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* feat(api): complete Homarr automation endpoints
* refactor(api): consolidate preferences and task docs
* refactor(api): narrow REST to dashboard automation
* refactor(api): expose existing dashboard controls only
* fix(docs): drop removed API key CLI path
---------
Co-authored-by: rfdrew <20803599+rfdrew@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Thomas Camlong <thomas@ajnart.fr>
Co-authored-by: ajnart <thomas@ajnart.dev>
* feat(analytics): migrate from Umami to PostHog server-side analytics
Replace @umami/node with posthog-node for all server-side telemetry.
Add singleton PostHog client, feature tracking POC, DAU heartbeat,
and tRPC analytics router. Cron job is now locked (no manual trigger,
no custom interval). Update consent copy to explain what we collect
and why.
* style: auto-fix lint and format
* refactor(analytics): simplify + add client-side posthog-js init
- Inline constants.ts and track.ts into client.ts (single source)
- Remove dead exports (shutdownPostHogAsync, getPostHogClient)
- Flatten all DB queries into one Promise.all (no waterfall)
- Derive integration/widget totals from group-by (drop redundant counts)
- Add posthog-js with dynamic import, gated on enableGeneral
- Move Analytics component to body, pass consent from server settings
* style: auto-fix lint and format
* feat(cron): add hidden flag to cron jobs, hide analytics from task panel
The analytics job runs silently in the background — users don't need
to see or interact with it. Hidden jobs are filtered out of getAllAsync
so they never appear in the management UI.
* refactor(analytics): simplify to single toggle, always collect all data
Remove granular enableWidgetData/enableIntegrationData/enableUserData
toggles. Analytics is now a single on/off switch. When enabled, all
anonymous usage data is collected in one flat Promise.all call.
Side effect: existing users with enableGeneral=true who had granular
flags off will now send all data. This is by design — the granular
controls added complexity without meaningful privacy benefit since
the data is already anonymous counts.
* style: auto-fix lint and format
* fix(boards): add permissions to board summary schema to fix manage page crash
The getAllBoards query fetches userPermissions and groupPermissions
from the DB, but boardSummarySchema (the output validator) did not
include them. tRPC stripped the fields, causing a TypeError when
getBoardPermissionsAsync called .some() on undefined.
* fix(backup): cast Buffer to Uint8Array for NextResponse body
Node 24 narrowed the BodyInit type, making Buffer incompatible.
Wrapping in Uint8Array satisfies the type constraint.
* fix(lint): remove forbidden non-null assertions across backup and board code
Replace non-null assertions with safe guards, optional chaining, and
for-of iteration so oxlint passes in CI. Also remove unused Collapse import.
* fix(deps): update dependency zod to ^4.3.5
* fix: omit can not be used with refine
* fix: convert intersection to object due to trpc-openapi issue
* fix: remove omit after refine
---------
Co-authored-by: homarr-renovate[bot] <158783068+homarr-renovate[bot]@users.noreply.github.com>
Co-authored-by: Meier Lukas <meierschlumpf@gmail.com>
Nam NguyenandThomas
Meier Lukas
homarr-renovate[bot]
Manuel
