Maintenant

SNI support for certificate checks, plus fixes for empty webhook payloads and the REST logs endpoint, and clearer Docker-socket security guidance.

New features

Certificates - SNI server name

Certificate monitors gain an optional server_name field. When set, it is sent as SNI during the TLS handshake and the certificate is validated against it instead of the hostname ? so you can check which cert a reverse proxy would serve for a given vhost (keepalived/failover setups). Several monitors can target the same host:port with different SNIs. (#34)

Bug fixes

• Webhook payloads were empty. Webhook subscriptions dispatched every event as a near-empty synthetic alert (entity_id:"", id:"", zero timestamps), and the HMAC signature didn't match the body. Deliveries now carry the real event as {type, timestamp, data}, signed correctly. (#35)
• REST logs endpoint always failed. GET /api/v1/containers/{id}/logs returned RUNTIME_UNAVAILABLE even with a healthy runtime (the log fetcher was never wired). This is the fallback the UI uses when SSE streaming hiccups.
• Wrong previous_state on reconcile. State changes detected after a restart emitted previous_state equal to the new state; the real prior state is now reported.

Security & docs

• Docker socket proxy is now the recommended setup. A :ro socket mount is not a security boundary ? the flag protects the file, not the API. maintenant's Docker usage is fully read-only and honours DOCKER_HOST, so it runs behind a docker-socket-proxy that rejects writes with 403. The security guide, reference compose, and DOCKER_HOST env var are documented.
• Bind-address guidance. Clarified why 0.0.0.0 is required inside containers, that the published port is what actually exposes it (and triggers maintenant's own "port exposed" finding), and how to acknowledge it. (#32)

Upgrade notes

• Automatic DB migration (migration 25 + a one-time cert_monitors rebuild) adds the SNI column and identity. No manual steps; back up the .db first as usual.
• Webhook consumers: the delivery body changed from {event, alert:{?}} to {type, timestamp, data:{?}} ? matches what the "Send test payload" button already sent. Verify the HMAC over the raw body.

No API breaking changes beyond the webhook body shape. Rebuild the image to upgrade.