docs: v2.0.0 changelog, configuration for auth/boards, announcement refresh

- CHANGELOG 2.0.0 entry covering all Phase 5 waves
- configuration.md: transports, per-monitor alert rules, auth, boards,
  appearance/language, PWA
- announcement.md: updated for shipped features and opt-in auth
- AGENTS.md: "no auth" line was stale
- ROADMAP: tick shipped M1–M3 planning checkboxes

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/announcement.md

@@ -1,11 +1,11 @@
-# v1.0.0 launch post — draft
+# v2.0.0 launch post — draft
 
 For r/selfhosted, HN Show, and similar. Edit freely before posting.
 
 ---
 
 **Title:** Dash — a self-hosted homelab dashboard with monitoring built in.
-Single Go binary, no YAML, no auth.
+Single Go binary, no YAML, optional auth.
 
 **Body:**
 
@@ -19,13 +19,17 @@ What it does:
   upload. Imports your existing Homepage (`services.yml`), Homarr, or Dashy
   config in one click.
 - **Monitors** — HTTP/TCP/ping/DNS/keyword/JSON-path checks plus push monitors
-  for cron jobs. Webhook alerts (Slack/Discord/ntfy). Uptime history.
+  for cron jobs. Uptime graphs, per-monitor alert rules, and notifications via
+  webhook, Slack, Discord, Telegram, Gotify, ntfy, or SMTP.
 - **Domains** — WHOIS/RDAP, DNS, TLS certificate expiry, provider detection.
   Inspired by Domain Locker, minus the paid APIs.
-- **Systems** — a ~4 MB static agent pushes CPU/mem/disk/net/temps/Docker
-  container states. Inspired by Beszel, push-JSON instead of SSH.
+- **Systems** — a ~4 MB static agent pushes CPU/mem/disk/net/temps, per-
+  container stats, and SMART/ZFS/GPU when present. Inspired by Beszel,
+  push-JSON instead of SSH.
 - **Ops** — incidents, maintenance windows, public status pages, SVG badges,
   Prometheus `/api/metrics`.
+- **Extras** — multiple boards, iframe/JSON-path widgets, CT-log subdomain
+  discovery, EN/CZ locales, installable PWA, custom CSS/wallpaper.
 
 Deployment is one container:
 
@@ -33,8 +37,9 @@ Deployment is one container:
 docker run -d -v ./data:/data -p 3000:3000 ghcr.io/dvorinka/dash:latest
 ```
 
-SQLite inside, no database to babysit, no accounts. Deliberately no auth —
-it expects a trusted LAN or your own proxy in front.
+SQLite inside, no database to babysit. Auth is opt-in: local
+username/password with bcrypt + session cookies, off by default; public
+status pages stay open either way.
 
 Stack: Go + Gin + SQLite (single static binary serving an embedded React UI).
 MIT licensed.
@@ -53,5 +58,5 @@ Show HN: Dash – self-hosted homelab dashboard with monitoring, one Go binary
 
 Dash combines a service board, uptime monitors, domain/SSL watching, system
 metrics via a tiny push agent, and public status pages. Single container or
-single binary, SQLite storage, no YAML, no auth (LAN-trust model). MIT.
+single binary, SQLite storage, no YAML. Optional local auth. MIT.
 https://github.com/Dvorinka/Dash

docs/configuration.md

@@ -21,12 +21,16 @@ snapshot; `/api/import/csv` bulk-loads monitors and domains from CSV.
 
 ## Notifications
 
-**Settings → Notifications** holds one generic webhook URL
-(`notify_webhook`). On monitor up/down transitions and domain events, Dash
-POSTs a JSON payload with `event`, `name`, `text`, `content`, `message`, and
-`at` fields — shaped so Slack, Discord, and ntfy all render it sensibly.
-**Test** sends a `test` event. Delivery is async and non-fatal; failures are
-logged.
+**Settings → Notifications** configures any number of transports — generic
+webhook, Slack, Discord, Telegram, Gotify, ntfy, and SMTP — each stored as a
+`notify_<name>` settings object. Monitor up/down transitions and domain
+events fan out to every configured transport; the payload carries `event`,
+`name`, `text`, `content`, `message`, and `at` fields. **Test** sends a `test`
+event. Delivery is async and non-fatal; failures are logged.
+
+Per-monitor alert rules (consecutive failures before down, latency-warn ms,
+mute) live on each monitor; domains get a cert-days threshold and mute.
+Maintenance windows still take precedence.
 
 ## Monitors
 
@@ -47,6 +51,27 @@ Bearer-token push ingest at `POST /api/systems/ingest`. A system is marked
 offline when no sample arrives within a few intervals. Stats are pruned during
 the hourly sweep.
 
+## Auth
+
+Off by default — existing installs see no gate. **Settings → Authentication →
+Enable** flips to a first-user setup screen (username/email + password,
+bcrypt). Sessions are SQLite-backed 7-day HttpOnly cookies with rotation;
+login is rate-limited per IP. Disable only works from an authenticated
+session. Public status pages, badges, `/api/metrics`, `/api/push/*`, and
+agent ingest stay open under auth.
+
+## Boards
+
+The header switcher manages multiple boards — each gets a slug and a
+`/b/:slug` route with its own sections/items. Monitors, domains, systems, and
+status pages stay global. Exports carry all boards.
+
+## Appearance & language
+
+Theme (dark/light), accent color, wallpaper URL, and custom CSS in Settings;
+the language picker switches the UI between English and Czech. A PWA manifest
+and service worker make the app installable.
+
 ## Operations
 
 - **Incidents** — open/ack/resolve/close, with per-incident update timeline.