Roadmap and release notes

Unreleased (after 0.2.0)#

• The agent authenticates web users. Passwords are verified by the root agent, which issues signed session tokens; the web process can no longer assert a user, role or client address (security audit SEC-32). The accounts file becomes root-only (0600): after upgrading, run pebble bootstrap (or chmod 600 the file) so the web user loses read access to the hashes. Restarting the agent signs everyone out.
• Fixes from the 2026-10-19 security audit (audits/): toolchain pinned to Go 1.26.9, sign-in and session hardening, agent and web resource limits, blocklist self-protection, per-device control fixes, safer file handling and scripts.

0.2.0#

• VPN provider exits: a WireGuard interface with role: egress (ProtonVPN, Mullvad, …) carries nothing until devices are assigned to it. Assigned devices leave only through it (route-to, NAT to the tunnel address), with a kill switch on the WAN and the tunnel's DNS servers handed out by DHCP. See wireguard.md.
• Per-device Internet access: dhcp.reservations[].egress is empty (WAN), a VPN exit, or none (no Internet; the LAN, router and WireGuard sites still work). Evaluated before firewall.rules.
• Devices page: an Internet via column and control (WAN, VPN exit or Blocked) for reserved devices, live upload/download rates, and a live connection view per device (GET /v1/connections).
• pebble firewall explain lists per-device Internet access.

Not yet verified on FreeBSD: route-to through a wg(4) interface, and the pfctl -vss output format the live view parses.

0.1.1#

Pebble gains an optional management layer. Existing configurations are unchanged: every new setting is optional, schema version 1 still applies, and with monitoring and management.web absent Pebble behaves exactly as 0.1 (no resident process).

• Flight recorder (monitoring.enabled): bounded event journal, log and state-change detection, traffic history, pebble events, pebble explain outage. See flight-recorder.md.
• Health checks with evidence and actions, shared by pebble diagnose, the web overview and pebble top; pebble route explain.
• Privileged agent (pebble agent, rc.d/pebble_agent): fixed operations on a Unix socket, peer-credential checks, no command execution.
• Web interface (management.web.enabled, rc.d/pebble_web): runs as the unprivileged pebble user; review-then-apply for every change, with the router's own rollback protection. See web.md.
• Terminal dashboard: pebble top.
• Firewall: rules can be disabled without deleting them (enabled: false); rule lint warnings (duplicate, shadowed, WAN exposure, inter-site, pass from a list); the web management rule is generated from management.web.allow_from.
• DNS feeds can be disabled (enabled: false).
• Bootstrap creates the pebble user and installs the new rc.d scripts.
• The ruleset fingerprint table is required before forwarding is enabled at boot, so forwarding cannot start under a ruleset that is not Pebble's.
• Fixed: a session from the router to itself (for example an SSH tunnel to a loopback web listener) is no longer reported as locked out by a plan.
• build-blocklist.sh: downloads, sanitises and merges the blocklists it lists into one de-duplicated blocklist.txt.

Upgrading from 0.1: install the new binary, run pebble bootstrap (adds the user and rc.d scripts), then enable the new sections if you want them and pebble apply.

Phases#

Still to do before a release#

• Run scripts/test-freebsd.sh (now including the agent, web interface and recorder) on a disposable FreeBSD 15.1 VM, then on a FUTRO; fix whatever it finds. Nothing in this release has run on FreeBSD yet.
• Measure memory, CPU and latency on the target hardware (benchmarks has macOS figures only).
• Accessibility review with a screen reader (labels, landmarks, focus order and non-colour status markers are in place but have not been audited).
• An external security review of the agent and web interface.
• Browser upload of a backup archive; today backups use pebble backup.