Refresh vendored REPO_POLICIES.md

PASSIVE checkpoints may not fully checkpoint when writers are active.
TRUNCATE mode blocks writers briefly but ensures complete checkpointing,
keeping the WAL small for consistent read performance under heavy load.

Dockerfile

@@ -39,9 +39,9 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 # Create non-root user
 RUN useradd -r -u 1000 -m routewatch
 
-# Create state directory
-RUN mkdir -p /var/lib/routewatch && chown routewatch:routewatch /var/lib/routewatch
+RUN mkdir -p /var/lib/berlin.sneak.app.routewatch && chown routewatch:routewatch /var/lib/berlin.sneak.app.routewatch
 
+RUN mkdir /app
 WORKDIR /app
 
 # Copy binary and source archive from builder
@@ -51,16 +51,15 @@ COPY --from=builder /routewatch-source.tar.zst /app/source/routewatch-source.tar
 # Set ownership
 RUN chown -R routewatch:routewatch /app
 
-USER routewatch
-
-# Default state directory
-ENV ROUTEWATCH_STATE_DIR=/var/lib/routewatch
+ENV XDG_DATA_HOME=/var/lib
 
 # Expose HTTP port
 EXPOSE 8080
 
+COPY ./entrypoint.sh /entrypoint.sh
+
 # Health check using the health endpoint
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD curl -sf http://localhost:8080/.well-known/healthcheck.json || exit 1
 
-ENTRYPOINT ["/app/routewatch"]
+ENTRYPOINT ["/bin/bash", "/entrypoint.sh" ]

Makefile

@@ -1,21 +1,50 @@
 export DEBUG = routewatch
 
-.PHONY: test fmt lint build clean run asupdate
+# Git revision for version embedding
+GIT_REVISION := $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")
+GIT_REVISION_SHORT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+VERSION_PKG := git.eeqj.de/sneak/routewatch/internal/version
+LDFLAGS := -X $(VERSION_PKG).GitRevision=$(GIT_REVISION) -X $(VERSION_PKG).GitRevisionShort=$(GIT_REVISION_SHORT)
+
+.PHONY: bootstrap setup check test lint fmt fmt-check docker hooks build clean run asupdate
 
 all: test
 
-test: lint
-	go test -v ./...
+# Install all development dependencies.
+bootstrap:
+	@script/bootstrap
+
+# Prepare a fresh clone: bootstrap plus pre-commit hook.
+setup:
+	@script/setup
+
+# Combined pre-commit/CI gate: tests, lint, format check.
+check:
+	@script/check
+
+test:
+	@script/test
 
 fmt:
-	go fmt ./...
+	@script/fmt
+
+# Check if code is formatted (read-only).
+fmt-check:
+	@script/fmt-check
 
 lint:
-	go vet ./...
-	golangci-lint run
+	@script/lint
+
+# Build Docker image.
+docker:
+	@script/docker
+
+# Install pre-commit hook.
+hooks:
+	@script/install-precommit
 
 build:
-	CGO_ENABLED=1 go build -o bin/routewatch cmd/routewatch/main.go
+	CGO_ENABLED=1 go build -ldflags "$(LDFLAGS)" -o bin/routewatch cmd/routewatch/main.go
 
 clean:
 	rm -rf bin/

README.md

@@ -2,6 +2,7 @@
 
 RouteWatch is a real-time BGP routing table monitor that streams BGP UPDATE messages from the RIPE RIS Live service, maintains a live routing table in SQLite, and provides HTTP APIs for querying routing information.
 
+
 ## Features
 
 - Real-time streaming of BGP updates from RIPE RIS Live
@@ -188,6 +189,35 @@ make lint
 make
 ```
 
+## Entrypoints
+
+This repository adheres to the
+[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+standard: normalized scripts in `script/` are the entrypoints for the
+development workflow, and the Makefile targets are thin shims that call
+them. We provide:
+
+- `script/bootstrap` — install all development dependencies (go,
+  golangci-lint, Go module download)
+- `script/setup` — make a fresh clone ready for development: runs
+  `script/bootstrap`, then `script/install-precommit`
+- `script/projectname` — print the project name (used for the Docker
+  image tag)
+- `script/test` — run the test suite
+  (`go test -timeout 30s -race -cover ./...`, verbose rerun on failure)
+- `script/lint` — run `go vet ./...` and `golangci-lint run`
+- `script/fmt` — format all code (writes)
+- `script/fmt-check` — check formatting (read-only)
+- `script/check` — run `script/test`, `script/lint`, and
+  `script/fmt-check`
+- `script/docker` — build the Docker image tagged via
+  `script/projectname`
+- `script/cibuild` — CI entrypoint: `docker build .`
+- `script/precommit` — pre-commit gate: `go mod tidy` + `go fmt` (must
+  not change files), then `script/check`
+- `script/install-precommit` — install the git pre-commit hook that
+  runs `script/precommit`
+
 ## License
 
 See LICENSE file.

REPO_POLICIES.md

@@ -0,0 +1,408 @@
+---
+title: Repository Policies
+last_modified: 2026-07-06
+---
+
+This document covers repository structure, tooling, and workflow standards. Code
+style conventions are in separate documents:
+
+- [Code Styleguide](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE.md)
+  (general, bash, Docker)
+- [Go](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_GO.md)
+- [JavaScript](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_JS.md)
+- [Python](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_PYTHON.md)
+- [Go HTTP Server Conventions](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/GO_HTTP_SERVER_CONVENTIONS.md)
+
+---
+
+- Cross-project documentation (such as this file) must include
+  `last_modified: YYYY-MM-DD` in the YAML front matter so it can be kept in sync
+  with the authoritative source as policies evolve.
+
+- **ALL external references must be pinned by cryptographic hash.** This
+  includes Docker base images, Go modules, npm packages, GitHub Actions, and
+  anything else fetched from a remote source. Version tags (`@v4`, `@latest`,
+  `:3.21`, etc.) are server-mutable and therefore remote code execution
+  vulnerabilities. The ONLY acceptable way to reference an external dependency
+  is by its content hash (Docker `@sha256:...`, Go module hash in `go.sum`, npm
+  integrity hash in lockfile, GitHub Actions `@<commit-sha>`). No exceptions.
+  This also means never `curl | bash` to install tools like pyenv, nvm, rustup,
+  etc. Instead, download a specific release archive from GitHub, verify its hash
+  (hardcoded in the Dockerfile or script), and only then install. Unverified
+  install scripts are arbitrary remote code execution. This is the single most
+  important rule in this document. Double-check every external reference in
+  every file before committing. There are zero exceptions to this rule.
+
+- Every repo with software must have a root `Makefile` with these targets:
+  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
+  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
+  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
+  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
+
+- Repos follow the
+  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+  pattern: the implementation of each Makefile target lives in an executable
+  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
+  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
+  `script/docker`), and the Makefile targets are thin shims that call them. The
+  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
+  minimal containers (e.g. alpine images have no bash); locate the repo root
+  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
+  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
+  for development after a fresh clone: runs `bootstrap`, then
+  `install-precommit`, plus any repo-specific initialization), `test`, and
+  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
+  assumes nothing is present: base tools come from nix, apt, brew, or apk
+  (detected in that order; apt runs noninteractive). For node it uses the
+  installed node if present; otherwise it installs a PINNED node version via
+  nvm, first installing nvm itself if missing — from a hash-verified GitHub
+  release archive (never `curl | sh`), with bash installed as an explicit
+  prerequisite since nvm requires bash. yarn is then pinned via
+  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
+  always exact versions. `script/cibuild` runs the CI build: it changes to the
+  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
+  scripts are our own extensions to the standard: `script/check` runs
+  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
+  what the git pre-commit hook runs, and it calls `script/check`;
+  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
+  target shims to it); and `script/projectname` (literally that filename) simply
+  outputs the project's name. Scripts that need the name call
+  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
+  so those scripts stay byte-identical across all repos. Repo-type-specific
+  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
+  `script/precommit`, not in the hook itself. Model scripts are at
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
+  must document the provided scripts in an **Entrypoints** section (see the
+  README requirements below).
+
+- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
+  instead of invoking the underlying tools directly. The Makefile is the single
+  source of truth for how these operations are run.
+
+- The Makefile is authoritative documentation for how the repo is used. Beyond
+  the required targets above, it should have targets for every common operation:
+  running a local development server (`make run`, `make dev`), re-initializing
+  or migrating the database (`make db-reset`, `make migrate`), building
+  artifacts (`make build`), generating code, seeding data, or anything else a
+  developer would do regularly. If someone checks out the repo and types
+  `make<tab>`, they should see every meaningful operation available. A new
+  contributor should be able to understand the entire development workflow by
+  reading the Makefile.
+
+- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
+  as a build step so the build fails if the branch is not green. For non-server
+  repos, the Dockerfile should bring up a development environment and run
+  `make check`. For server repos, `make check` should run as an early build
+  stage before the final image is assembled. Dockerfiles install development
+  prerequisites by running `script/bootstrap` rather than duplicating installs
+  inline; COPY `script/` and the dependency manifests (`package.json` +
+  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
+  layer stays cached until dependencies change.
+
+- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
+  repos use a multistage build where linting runs in an independent stage based
+  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
+  `make fmt-check` and `make lint` before the full build begins. The build stage
+  then declares an explicit dependency on the lint stage via
+  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
+  linting before proceeding to compilation and tests. This ensures lint failures
+  surface in seconds rather than minutes, without blocking on dependency
+  download or compilation in the build stage.
+
+    The standard pattern for a Go repo Dockerfile is:
+
+    ```dockerfile
+    # Lint stage — fast feedback on formatting and lint issues
+    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
+    FROM golangci/golangci-lint@sha256:... AS lint
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
+    RUN make fmt-check
+    RUN make lint
+
+    # Build stage
+    # golang:1.x-alpine, YYYY-MM-DD
+    FROM golang@sha256:... AS builder
+    WORKDIR /src
+
+    # Force BuildKit to run the lint stage before proceeding
+    COPY --from=lint /src/go.sum /dev/null
+
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
+    RUN make test
+
+    ARG VERSION=dev
+    RUN CGO_ENABLED=0 go build -trimpath \
+        -ldflags="-s -w -X main.Version=${VERSION}" \
+        -o /app ./cmd/app/
+
+    # Runtime stage
+    FROM alpine@sha256:...
+    COPY --from=builder /app /usr/local/bin/app
+    ENTRYPOINT ["app"]
+    ```
+
+    Key points:
+    - The lint stage uses the `golangci/golangci-lint` image directly (it
+      includes both Go and the linter), so there is no need to install the
+      linter separately.
+    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
+      a stage dependency. BuildKit runs stages in parallel by default; without
+      this line, the build stage would not wait for lint to finish and a lint
+      failure might not fail the overall build.
+    - If the project uses `//go:embed` directives that reference build artifacts
+      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      create placeholder files so the embed directives resolve. Example:
+      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
+      The lint stage should not depend on the actual build output — it exists to
+      fail fast.
+    - If the project requires CGO or system libraries for linting (e.g.
+      `vips-dev`), install them in the lint stage with `apk add`.
+    - The build stage runs `make test` after compilation setup. Tests run in the
+      build stage, not the lint stage, because they may require compiled
+      artifacts or heavier dependencies.
+
+- Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
+  runs `script/cibuild` (which runs `docker build .`) on push. Since the
+  Dockerfile already runs `make check`, a successful build implies all checks
+  pass.
+
+- Use platform-standard formatters: `black` for Python, `prettier` for
+  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
+  two exceptions: four-space indents (except Go), and `proseWrap: always` for
+  Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
+  HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
+
+- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
+  testing is not possible in the repo, `script/precommit` may skip `script/test`
+  and run only `script/lint` and `script/fmt-check`. The hook is installed by
+  `script/install-precommit`; the Makefile must provide a `make hooks` target
+  that shims to it.
+
+- All repos with software must have tests that run via the platform-standard
+  test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
+  tests exist yet, add the most minimal test possible — e.g. importing the
+  module under test to verify it compiles/parses. There is no excuse for
+  `make test` to be a no-op.
+
+- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
+  Makefile.
+
+- **`make test` should use the conditional verbose rerun pattern.** Run tests
+  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
+  show full output. This keeps CI logs and `docker build` output clean on
+  success (just package/suite summaries) while providing full diagnostic detail
+  on failure (every test case, every assertion). The general shell pattern:
+
+    ```makefile
+    test:
+    	@<test-command> || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  <test-command-with-v>; exit 1; }
+    ```
+
+    Go example:
+
+    ```makefile
+    test:
+    	@go test -timeout 30s -race -cover ./... || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  go test -timeout 30s -race -v ./...; exit 1; }
+    ```
+
+    Python example:
+
+    ```makefile
+    test:
+    	@python -m pytest || \
+    		{ echo "--- Rerunning with -v for details ---"; \
+    		  python -m pytest -v; exit 1; }
+    ```
+
+    The `exit 1` ensures the target always fails after a rerun — the first run
+    already proved the tests are broken, so the build must not pass even if a
+    flaky test happens to succeed on the second attempt. The rerun exists solely
+    for diagnostic output.
+
+- Docker builds must complete in under 5 minutes.
+
+- `make check` must not modify any files in the repo. Tests may use temporary
+  directories.
+
+- `main` must always pass `make check`, no exceptions.
+
+- Never commit secrets. `.env` files, credentials, API keys, and private keys
+  must be in `.gitignore`. No exceptions.
+
+- `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
+  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
+  Fetch the standard `.gitignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
+  a new repo.
+
+- **No build artifacts in version control.** Code-derived data (compiled
+  bundles, minified output, generated assets) must never be committed to the
+  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
+  should generate these at build time. Notable exception: Go protobuf generated
+  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
+  downloads code but does not execute code generation.
+
+- Never use `git add -A` or `git add .`. Always stage files explicitly by name.
+
+- Never force-push to `main`.
+
+- Make all changes on a feature branch. You can do whatever you want on a
+  feature branch.
+
+- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
+  manually by the user. Fetch from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
+
+- When pinning images or packages by hash, add a comment above the reference
+  with the version and date (YYYY-MM-DD).
+
+- Use `yarn`, not `npm`.
+
+- Write all dates as YYYY-MM-DD (ISO 8601).
+
+- Simple projects should be configured with environment variables.
+
+- Dockerized web services listen on port 8080 by default, overridable with
+  `PORT`.
+
+- **HTTP/web services must be hardened for production internet exposure before
+  tagging 1.0.** This means full compliance with security best practices
+  including, without limitation, all of the following:
+    - **Security headers** on every response:
+        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
+          and `includeSubDomains`.
+        - `Content-Security-Policy` (CSP) with a restrictive default policy
+          (`default-src 'self'` as a baseline, tightened per-resource as
+          needed). Never use `unsafe-inline` or `unsafe-eval` unless
+          unavoidable, and document the reason.
+        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
+          Prefer the `frame-ancestors` CSP directive as the primary control.
+        - `X-Content-Type-Options: nosniff`.
+        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
+        - `Permissions-Policy` restricting access to browser features the
+          application does not use (camera, microphone, geolocation, etc.).
+    - **Request and response limits:**
+        - Maximum request body size enforced on all endpoints (e.g. Go
+          `http.MaxBytesReader`). Choose a sane default per-route; never accept
+          unbounded input.
+        - Maximum response body size where applicable (e.g. paginated APIs).
+        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
+          against slowloris attacks.
+        - `WriteTimeout` on the `http.Server`.
+        - `IdleTimeout` on the `http.Server`.
+        - Per-handler execution time limits via `context.WithTimeout` or
+          chi/stdlib `middleware.Timeout`.
+    - **Authentication and session security:**
+        - Rate limiting on password-based authentication endpoints. API keys are
+          high-entropy and not susceptible to brute force, so they are exempt.
+        - CSRF tokens on all state-mutating HTML forms. API endpoints
+          authenticated via `Authorization` header (Bearer token, API key) are
+          exempt because the browser does not attach these automatically.
+        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
+          MD5, or SHA.
+        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
+          `Strict`) attributes.
+    - **Reverse proxy awareness:**
+        - True client IP detection when behind a reverse proxy
+          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
+          forwarded headers only from a configured set of trusted proxy
+          addresses — never trust `X-Forwarded-For` unconditionally.
+    - **CORS:**
+        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
+          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
+          only for public, unauthenticated read-only APIs.
+    - **Error handling:**
+        - Internal errors must never leak stack traces, SQL queries, file paths,
+          or other implementation details to the client. Return generic error
+          messages in production; detailed errors only when `DEBUG` is enabled.
+    - **TLS:**
+        - Services never terminate TLS directly. They are always deployed behind
+          a TLS-terminating reverse proxy. The service itself listens on plain
+          HTTP. However, HSTS headers and `Secure` cookie flags must still be
+          set by the application so that the browser enforces HTTPS end-to-end.
+
+    This list is non-exhaustive. Apply defense-in-depth: if a standard security
+    hardening measure exists for HTTP services and is not listed here, it is
+    still expected. When in doubt, harden.
+
+- `README.md` is the primary documentation. Required sections:
+    - **Description**: First line must include the project name, purpose,
+      category (web server, SPA, CLI tool, etc.), license, and author. Example:
+      "µPaaS is an MIT-licensed Go web application by @sneak that receives
+      git-frontend webhooks and deploys applications via Docker in realtime."
+    - **Getting Started**: Copy-pasteable install/usage code block.
+    - **Entrypoints**: Opens by stating that the repo adheres to the
+      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
+      standard (with that link), then documents each provided `script/`
+      entrypoint and its purpose.
+    - **Rationale**: Why does this exist?
+    - **Design**: How is the program structured?
+    - **TODO**: Update meticulously, even between commits. When planning, put
+      the todo list in the README so a new agent can pick up where the last one
+      left off.
+    - **License**: MIT, GPL, or WTFPL. Ask the user for new projects. Include a
+      `LICENSE` file in the repo root and a License section in the README.
+    - **Author**: [@sneak](https://sneak.berlin).
+
+- First commit of a new repo should contain only `README.md`.
+
+- Go module root: `sneak.berlin/go/<name>`. Always run `go mod tidy` before
+  committing.
+
+- Use SemVer.
+
+- Database migrations live in `internal/db/migrations/` and must be embedded in
+  the binary.
+    - `000_migration.sql` — contains ONLY the creation of the migrations
+      tracking table itself. Nothing else.
+    - `001_schema.sql` — the full application schema.
+    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
+      There is no installed base to migrate. Edit `001_schema.sql` directly.
+    - **Post-1.0.0:** add new numbered migration files for each schema change.
+      Never edit existing migrations after release.
+
+- All repos should have an `.editorconfig` enforcing the project's indentation
+  settings.
+
+- Avoid putting files in the repo root unless necessary. Root should contain
+  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
+  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
+  language-specific config). Everything else goes in a subdirectory. Canonical
+  subdirectory names:
+    - `bin/` — executable scripts and tools
+    - `cmd/` — Go command entrypoints
+    - `configs/` — configuration templates and examples
+    - `deploy/` — deployment manifests (k8s, compose, terraform)
+    - `docs/` — documentation and markdown (README.md stays in root)
+    - `internal/` — Go internal packages
+    - `internal/db/migrations/` — database migrations
+    - `pkg/` — Go library packages
+    - `share/` — systemd units, data files
+    - `static/` — static assets (images, fonts, etc.)
+    - `web/` — web frontend source
+
+- When setting up a new repo, files from the `prompts` repo may be used as
+  templates. Fetch them from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/<path>`.
+
+- New repos must contain at minimum:
+    - `README.md`, `.git`, `.gitignore`, `.editorconfig`
+    - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
+    - `Makefile`
+    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
+      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
+      `install-precommit`)
+    - `Dockerfile`, `.dockerignore`
+    - `.gitea/workflows/check.yml`
+    - Go: `go.mod`, `go.sum`, `.golangci.yml`
+    - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
+    - Python: `pyproject.toml`

TODO.md

@@ -0,0 +1,48 @@
+# Workflow
+
+* branch (from `main`)
+* do the work in Next Step
+* move Next Step to the top of Completed Steps
+* move the top item of Future Steps into Next Step
+* commit (`TODO.md` changes in the same commit as the work)
+* merge to `main` if the branch is not protected, otherwise open a PR
+* push
+
+# Status
+
+pre-1.0. No git tags. Runs in production-style Docker deployment, but
+the policy compliance branch (repo-policies-compliance, make check
+passing, clean tree) is unmerged to main and the CI workflow is missing.
+
+# Next Step
+
+Merge repo-policies-compliance into main (3 commits: policy files and
+.gitignore, Makefile targets fmt-check/check/docker/hooks, gofmt pass),
+then add .gitea/workflows/check.yml as a small follow-up commit so CI
+runs make check on main.
+
+# Completed Steps
+
+- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
+  Makefile shims, README Entrypoints section
+- 2026-02-22: repo policy compliance: required policy files, .gitignore
+  update, Makefile fmt-check/check/docker/hooks targets, gofmt pass
+  (repo-policies-compliance, unmerged)
+- 2026-01-01: WAL checkpointing: periodic (5s), on startup with logging,
+  TRUNCATE mode; fixed slow queries
+- 2025-12-31: status page: navbar, home page with search, oldest/newest
+  route timestamps, NULL handling in WHOIS stats; container runs as
+  routewatch user with proper state dir
+- 2025-12-30: structured HTTP request logging, increased timeouts,
+  CIDR prefix URL routing fixes, status page metrics and footer
+- 2025-12-29: Dockerfile multi-stage build with source archive; SQLite
+  incremental vacuum for non-blocking space reclamation
+- 2025-07-27: initial RouteWatch BGP stream monitor
+
+# Future Steps
+
+- Verify main is green after the merge: make check locally and the new
+  CI workflow passing
+- Review stale remote branches fix-min-time-calculation and
+  optimize-sqlite-settings: land or delete
+- Clean up the tmp/ directory at the repo root: gitignore or remove

entrypoint.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+
+cd /var/lib/berlin.sneak.app.routewatch
+chown -R routewatch:routewatch .
+chmod 700 .
+
+exec runuser -u routewatch -- /app/routewatch

internal/database/database.go

@@ -106,14 +106,13 @@ func New(cfg *config.Config, logger *logger.Logger) (*Database, error) {
 func (d *Database) Initialize() error {
 	// Set SQLite pragmas for performance
 	pragmas := []string{
-		"PRAGMA journal_mode=WAL",         // Write-Ahead Logging
-		"PRAGMA synchronous=OFF",          // Don't wait for disk writes
-		"PRAGMA cache_size=-3145728",      // 3GB cache (upper limit for 2.4GB DB)
-		"PRAGMA temp_store=MEMORY",        // Use memory for temp tables
-		"PRAGMA wal_checkpoint(TRUNCATE)", // Checkpoint and truncate WAL now
-		"PRAGMA busy_timeout=5000",        // 5 second busy timeout
-		"PRAGMA analysis_limit=0",         // Disable automatic ANALYZE
-		"PRAGMA auto_vacuum=INCREMENTAL",  // Enable incremental vacuum
+		"PRAGMA journal_mode=WAL",        // Write-Ahead Logging
+		"PRAGMA synchronous=OFF",         // Don't wait for disk writes
+		"PRAGMA cache_size=-3145728",     // 3GB cache (upper limit for 2.4GB DB)
+		"PRAGMA temp_store=MEMORY",       // Use memory for temp tables
+		"PRAGMA busy_timeout=5000",       // 5 second busy timeout
+		"PRAGMA analysis_limit=0",        // Disable automatic ANALYZE
+		"PRAGMA auto_vacuum=INCREMENTAL", // Enable incremental vacuum
 	}
 
 	for _, pragma := range pragmas {
@@ -122,7 +121,20 @@ func (d *Database) Initialize() error {
 		}
 	}
 
-	err := d.exec(dbSchema)
+	// Run WAL checkpoint on startup to consolidate any existing WAL
+	var walPages, checkpointedPages, movedPages int
+	err := d.db.QueryRow("PRAGMA wal_checkpoint(TRUNCATE)").Scan(&walPages, &checkpointedPages, &movedPages)
+	if err != nil {
+		d.logger.Warn("Failed to checkpoint WAL on startup", "error", err)
+	} else {
+		d.logger.Info("WAL checkpoint on startup",
+			"wal_pages", walPages,
+			"checkpointed", checkpointedPages,
+			"moved", movedPages,
+		)
+	}
+
+	err = d.exec(dbSchema)
 	if err != nil {
 		return err
 	}
@@ -946,6 +958,23 @@ func (d *Database) GetStatsContext(ctx context.Context) (Stats, error) {
 	}
 	stats.LiveRoutes = v4Count + v6Count
 
+	// Get oldest and newest route timestamps
+	routeTimestampQuery := `
+		SELECT MIN(last_updated), MAX(last_updated) FROM (
+			SELECT last_updated FROM live_routes_v4
+			UNION ALL
+			SELECT last_updated FROM live_routes_v6
+		)
+	`
+	var oldestRoute, newestRoute *time.Time
+	err = d.db.QueryRowContext(ctx, routeTimestampQuery).Scan(&oldestRoute, &newestRoute)
+	if err != nil {
+		d.logger.Warn("Failed to get route timestamps", "error", err)
+	} else {
+		stats.OldestRoute = oldestRoute
+		stats.NewestRoute = newestRoute
+	}
+
 	// Get prefix distribution
 	stats.IPv4PrefixDistribution, stats.IPv6PrefixDistribution, err = d.GetPrefixDistributionContext(ctx)
 	if err != nil {
@@ -1669,9 +1698,9 @@ func (d *Database) GetWHOISStats(ctx context.Context, staleThreshold time.Durati
 	query := `
 		SELECT
 			COUNT(*) as total,
-			SUM(CASE WHEN whois_updated_at IS NULL THEN 1 ELSE 0 END) as never_fetched,
-			SUM(CASE WHEN whois_updated_at IS NOT NULL AND whois_updated_at < ? THEN 1 ELSE 0 END) as stale,
-			SUM(CASE WHEN whois_updated_at IS NOT NULL AND whois_updated_at >= ? THEN 1 ELSE 0 END) as fresh
+			COALESCE(SUM(CASE WHEN whois_updated_at IS NULL THEN 1 ELSE 0 END), 0) as never_fetched,
+			COALESCE(SUM(CASE WHEN whois_updated_at IS NOT NULL AND whois_updated_at < ? THEN 1 ELSE 0 END), 0) as stale,
+			COALESCE(SUM(CASE WHEN whois_updated_at IS NOT NULL AND whois_updated_at >= ? THEN 1 ELSE 0 END), 0) as fresh
 		FROM asns
 	`
 
@@ -1969,3 +1998,26 @@ func (d *Database) Analyze(ctx context.Context) error {
 
 	return nil
 }
+
+// Checkpoint runs a WAL checkpoint to transfer data from the WAL to the main database.
+// Uses TRUNCATE mode which blocks writers briefly but ensures complete checkpoint,
+// keeping the WAL small for fast read performance.
+func (d *Database) Checkpoint(ctx context.Context) error {
+	_, err := d.db.ExecContext(ctx, "PRAGMA wal_checkpoint(TRUNCATE)")
+	if err != nil {
+		return fmt.Errorf("failed to checkpoint WAL: %w", err)
+	}
+
+	return nil
+}
+
+// Ping checks if the database connection is alive with a lightweight query.
+func (d *Database) Ping(ctx context.Context) error {
+	var result int
+	err := d.db.QueryRowContext(ctx, "SELECT 1").Scan(&result)
+	if err != nil {
+		return fmt.Errorf("database ping failed: %w", err)
+	}
+
+	return nil
+}

internal/database/interface.go

@@ -18,6 +18,8 @@ type Stats struct {
 	Peers                  int
 	FileSizeBytes          int64
 	LiveRoutes             int
+	OldestRoute            *time.Time
+	NewestRoute            *time.Time
 	IPv4PrefixDistribution []PrefixDistribution
 	IPv6PrefixDistribution []PrefixDistribution
 }
@@ -85,6 +87,8 @@ type Store interface {
 	// Maintenance operations
 	Vacuum(ctx context.Context) error
 	Analyze(ctx context.Context) error
+	Checkpoint(ctx context.Context) error
+	Ping(ctx context.Context) error
 }
 
 // Ensure Database implements Store

internal/metrics/metrics.go

@@ -30,6 +30,14 @@ type Tracker struct {
 	// Route update metrics
 	ipv4UpdateRate metrics.Meter
 	ipv6UpdateRate metrics.Meter
+
+	// Announcement/withdrawal metrics
+	announcementCounter metrics.Counter
+	withdrawalCounter   metrics.Counter
+	churnRate           metrics.Meter // combined announcements + withdrawals per second
+
+	// BGP peer tracking
+	bgpPeerCount atomic.Int32
 }
 
 // New creates a new metrics tracker
@@ -37,15 +45,18 @@ func New() *Tracker {
 	registry := metrics.NewRegistry()
 
 	return &Tracker{
-		registry:        registry,
-		messageCounter:  metrics.NewCounter(),
-		byteCounter:     metrics.NewCounter(),
-		messageRate:     metrics.NewMeter(),
-		byteRate:        metrics.NewMeter(),
-		wireByteCounter: metrics.NewCounter(),
-		wireByteRate:    metrics.NewMeter(),
-		ipv4UpdateRate:  metrics.NewMeter(),
-		ipv6UpdateRate:  metrics.NewMeter(),
+		registry:            registry,
+		messageCounter:      metrics.NewCounter(),
+		byteCounter:         metrics.NewCounter(),
+		messageRate:         metrics.NewMeter(),
+		byteRate:            metrics.NewMeter(),
+		wireByteCounter:     metrics.NewCounter(),
+		wireByteRate:        metrics.NewMeter(),
+		ipv4UpdateRate:      metrics.NewMeter(),
+		ipv6UpdateRate:      metrics.NewMeter(),
+		announcementCounter: metrics.NewCounter(),
+		withdrawalCounter:   metrics.NewCounter(),
+		churnRate:           metrics.NewMeter(),
 	}
 }
 
@@ -134,6 +145,56 @@ func (t *Tracker) RecordIPv6Update() {
 	t.ipv6UpdateRate.Mark(1)
 }
 
+// RecordAnnouncement records a route announcement
+func (t *Tracker) RecordAnnouncement() {
+	t.announcementCounter.Inc(1)
+	t.churnRate.Mark(1)
+}
+
+// RecordWithdrawal records a route withdrawal
+func (t *Tracker) RecordWithdrawal() {
+	t.withdrawalCounter.Inc(1)
+	t.churnRate.Mark(1)
+}
+
+// SetBGPPeerCount updates the current BGP peer count
+func (t *Tracker) SetBGPPeerCount(count int) {
+	// BGP peer count is always small (< 1000), so int32 is safe
+	if count > 0 && count < 1<<31 {
+		t.bgpPeerCount.Store(int32(count)) //nolint:gosec // count is validated
+	}
+}
+
+// GetBGPPeerCount returns the current BGP peer count
+func (t *Tracker) GetBGPPeerCount() int {
+	return int(t.bgpPeerCount.Load())
+}
+
+// GetAnnouncementCount returns the total announcement count
+func (t *Tracker) GetAnnouncementCount() uint64 {
+	count := t.announcementCounter.Count()
+	if count < 0 {
+		return 0
+	}
+
+	return uint64(count)
+}
+
+// GetWithdrawalCount returns the total withdrawal count
+func (t *Tracker) GetWithdrawalCount() uint64 {
+	count := t.withdrawalCounter.Count()
+	if count < 0 {
+		return 0
+	}
+
+	return uint64(count)
+}
+
+// GetChurnRate returns the route churn rate per second
+func (t *Tracker) GetChurnRate() float64 {
+	return t.churnRate.Rate1()
+}
+
 // GetRouteMetrics returns current route update metrics
 func (t *Tracker) GetRouteMetrics() RouteMetrics {
 	return RouteMetrics{

internal/routewatch/app_integration_test.go

@@ -415,6 +415,16 @@ func (m *mockStore) Analyze(ctx context.Context) error {
 	return nil
 }
 
+// Checkpoint mock implementation
+func (m *mockStore) Checkpoint(ctx context.Context) error {
+	return nil
+}
+
+// Ping mock implementation
+func (m *mockStore) Ping(ctx context.Context) error {
+	return nil
+}
+
 func TestRouteWatchLiveFeed(t *testing.T) {
 
 	// Create mock database

internal/routewatch/asnfetcher.go

@@ -36,7 +36,6 @@ const (
 	statsWindow = time.Hour
 )
 
-
 // ASNFetcher handles background WHOIS lookups for ASNs.
 type ASNFetcher struct {
 	db             database.Store
@@ -55,9 +54,9 @@ type ASNFetcher struct {
 	consecutiveFails int
 
 	// hourly stats tracking
-	statsMu        sync.Mutex
-	successTimes   []time.Time
-	errorTimes     []time.Time
+	statsMu      sync.Mutex
+	successTimes []time.Time
+	errorTimes   []time.Time
 }
 
 // NewASNFetcher creates a new ASN fetcher.

internal/routewatch/dbmaintainer.go

@@ -12,6 +12,11 @@ import (
 
 // Database maintenance configuration constants.
 const (
+	// checkpointInterval is how often to run WAL checkpoint.
+	// Frequent checkpoints keep the WAL small, improving read performance.
+	// Under heavy write load, we need aggressive checkpointing.
+	checkpointInterval = 5 * time.Second
+
 	// vacuumInterval is how often to run incremental vacuum.
 	// Since incremental vacuum only frees ~1000 pages (~4MB) per run,
 	// we run it frequently to keep up with deletions.
@@ -20,6 +25,9 @@ const (
 	// analyzeInterval is how often to run ANALYZE.
 	analyzeInterval = 1 * time.Hour
 
+	// checkpointTimeout is the max time for WAL checkpoint.
+	checkpointTimeout = 10 * time.Second
+
 	// vacuumTimeout is the max time for incremental vacuum (should be quick).
 	vacuumTimeout = 30 * time.Second
 
@@ -35,13 +43,16 @@ type DBMaintainer struct {
 	wg     sync.WaitGroup
 
 	// Stats tracking
-	statsMu          sync.Mutex
-	lastVacuum       time.Time
-	lastAnalyze      time.Time
-	vacuumCount      int
-	analyzeCount     int
-	lastVacuumError  error
-	lastAnalyzeError error
+	statsMu             sync.Mutex
+	lastCheckpoint      time.Time
+	lastVacuum          time.Time
+	lastAnalyze         time.Time
+	checkpointCount     int
+	vacuumCount         int
+	analyzeCount        int
+	lastCheckpointError error
+	lastVacuumError     error
+	lastAnalyzeError    error
 }
 
 // NewDBMaintainer creates a new database maintainer.
@@ -58,6 +69,7 @@ func (m *DBMaintainer) Start() {
 	m.wg.Add(1)
 	go m.run()
 	m.logger.Info("Database maintainer started",
+		"checkpoint_interval", checkpointInterval,
 		"vacuum_interval", vacuumInterval,
 		"analyze_interval", analyzeInterval,
 	)
@@ -75,8 +87,10 @@ func (m *DBMaintainer) run() {
 	defer m.wg.Done()
 
 	// Use different timers for each task
+	checkpointTimer := time.NewTimer(checkpointInterval)
 	vacuumTimer := time.NewTimer(vacuumInterval)
 	analyzeTimer := time.NewTimer(analyzeInterval)
+	defer checkpointTimer.Stop()
 	defer vacuumTimer.Stop()
 	defer analyzeTimer.Stop()
 
@@ -85,6 +99,10 @@ func (m *DBMaintainer) run() {
 		case <-m.stopCh:
 			return
 
+		case <-checkpointTimer.C:
+			m.runCheckpoint()
+			checkpointTimer.Reset(checkpointInterval)
+
 		case <-vacuumTimer.C:
 			m.runVacuum()
 			vacuumTimer.Reset(vacuumInterval)
@@ -96,6 +114,30 @@ func (m *DBMaintainer) run() {
 	}
 }
 
+// runCheckpoint performs a WAL checkpoint to keep the WAL file small.
+func (m *DBMaintainer) runCheckpoint() {
+	ctx, cancel := context.WithTimeout(context.Background(), checkpointTimeout)
+	defer cancel()
+
+	startTime := time.Now()
+
+	err := m.db.Checkpoint(ctx)
+
+	m.statsMu.Lock()
+	m.lastCheckpoint = time.Now()
+	m.lastCheckpointError = err
+	if err == nil {
+		m.checkpointCount++
+	}
+	m.statsMu.Unlock()
+
+	if err != nil {
+		m.logger.Error("WAL checkpoint failed", "error", err, "duration", time.Since(startTime))
+	} else {
+		m.logger.Debug("WAL checkpoint completed", "duration", time.Since(startTime))
+	}
+}
+
 // runVacuum performs an incremental vacuum operation on the database.
 func (m *DBMaintainer) runVacuum() {
 	ctx, cancel := context.WithTimeout(context.Background(), vacuumTimeout)

internal/routewatch/prefixhandler.go

@@ -113,6 +113,10 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 				timestamp:   timestamp,
 				path:        msg.Path,
 			})
+			// Record announcement in metrics
+			if h.metrics != nil {
+				h.metrics.RecordAnnouncement()
+			}
 		}
 	}
 
@@ -126,6 +130,10 @@ func (h *PrefixHandler) HandleMessage(msg *ristypes.RISMessage) {
 			timestamp:   timestamp,
 			path:        msg.Path,
 		})
+		// Record withdrawal in metrics
+		if h.metrics != nil {
+			h.metrics.RecordWithdrawal()
+		}
 	}
 
 	// Check if we need to flush

internal/server/handlers.go

@@ -7,7 +7,6 @@ import (
 	"errors"
 	"net"
 	"net/http"
-	"net/url"
 	"runtime"
 	"sort"
 	"strconv"
@@ -38,6 +37,7 @@ type HealthCheckResponse struct {
 
 // handleHealthCheck returns a handler that performs health checks.
 // Returns 200 if healthy, 503 if any check fails.
+// Uses lightweight checks to avoid timeout issues under load.
 func (s *Server) handleHealthCheck() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx, cancel := context.WithTimeout(r.Context(), healthCheckTimeout)
@@ -46,13 +46,11 @@ func (s *Server) handleHealthCheck() http.HandlerFunc {
 		checks := make(map[string]string)
 		healthy := true
 
-		// Check database connectivity
-		dbStats, err := s.db.GetStatsContext(ctx)
+		// Check database connectivity with lightweight ping
+		err := s.db.Ping(ctx)
 		if err != nil {
 			checks["database"] = "error: " + err.Error()
 			healthy = false
-		} else if dbStats.ASNs == 0 && dbStats.Prefixes == 0 {
-			checks["database"] = "warning: empty database"
 		} else {
 			checks["database"] = "ok"
 		}
@@ -88,10 +86,16 @@ func (s *Server) handleHealthCheck() http.HandlerFunc {
 	}
 }
 
-// handleRoot returns a handler that redirects to /status.
-func (s *Server) handleRoot() http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		http.Redirect(w, r, "/status", http.StatusSeeOther)
+// handleIndex returns a handler that serves the home page.
+func (s *Server) handleIndex() http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+
+		tmpl := templates.IndexTemplate()
+		if err := tmpl.Execute(w, nil); err != nil {
+			s.logger.Error("Failed to render index template", "error", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
 	}
 }
 
@@ -159,6 +163,8 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 		LiveRoutes             int                           `json:"live_routes"`
 		IPv4Routes             int                           `json:"ipv4_routes"`
 		IPv6Routes             int                           `json:"ipv6_routes"`
+		OldestRoute            *time.Time                    `json:"oldest_route,omitempty"`
+		NewestRoute            *time.Time                    `json:"newest_route,omitempty"`
 		IPv4UpdatesPerSec      float64                       `json:"ipv4_updates_per_sec"`
 		IPv6UpdatesPerSec      float64                       `json:"ipv6_updates_per_sec"`
 		IPv4PrefixDistribution []database.PrefixDistribution `json:"ipv4_prefix_distribution"`
@@ -253,6 +259,8 @@ func (s *Server) handleStatusJSON() http.HandlerFunc {
 			LiveRoutes:             dbStats.LiveRoutes,
 			IPv4Routes:             ipv4Routes,
 			IPv6Routes:             ipv6Routes,
+			OldestRoute:            dbStats.OldestRoute,
+			NewestRoute:            dbStats.NewestRoute,
 			IPv4UpdatesPerSec:      routeMetrics.IPv4UpdatesPerSec,
 			IPv6UpdatesPerSec:      routeMetrics.IPv6UpdatesPerSec,
 			IPv4PrefixDistribution: dbStats.IPv4PrefixDistribution,
@@ -320,6 +328,23 @@ func (s *Server) handleStats() http.HandlerFunc {
 		MaxProcessTimeMs   float64 `json:"max_process_time_ms"`
 	}
 
+	// GCStats represents garbage collection statistics
+	type GCStats struct {
+		NumGC          uint32  `json:"num_gc"`
+		TotalPauseMs   uint64  `json:"total_pause_ms"`
+		LastPauseMs    float64 `json:"last_pause_ms"`
+		HeapAllocBytes uint64  `json:"heap_alloc_bytes"`
+		HeapSysBytes   uint64  `json:"heap_sys_bytes"`
+	}
+
+	// StreamStats represents stream statistics including announcements/withdrawals
+	type StreamStats struct {
+		Announcements    uint64  `json:"announcements"`
+		Withdrawals      uint64  `json:"withdrawals"`
+		RouteChurnPerSec float64 `json:"route_churn_per_sec"`
+		BGPPeerCount     int     `json:"bgp_peer_count"`
+	}
+
 	// StatsResponse represents the API statistics response
 	type StatsResponse struct {
 		Uptime                 string                        `json:"uptime"`
@@ -335,6 +360,8 @@ func (s *Server) handleStats() http.HandlerFunc {
 		GoVersion              string                        `json:"go_version"`
 		Goroutines             int                           `json:"goroutines"`
 		MemoryUsage            string                        `json:"memory_usage"`
+		GC                     GCStats                       `json:"gc"`
+		Stream                 StreamStats                   `json:"stream"`
 		ASNs                   int                           `json:"asns"`
 		Prefixes               int                           `json:"prefixes"`
 		IPv4Prefixes           int                           `json:"ipv4_prefixes"`
@@ -345,6 +372,8 @@ func (s *Server) handleStats() http.HandlerFunc {
 		LiveRoutes             int                           `json:"live_routes"`
 		IPv4Routes             int                           `json:"ipv4_routes"`
 		IPv6Routes             int                           `json:"ipv6_routes"`
+		OldestRoute            *time.Time                    `json:"oldest_route,omitempty"`
+		NewestRoute            *time.Time                    `json:"newest_route,omitempty"`
 		IPv4UpdatesPerSec      float64                       `json:"ipv4_updates_per_sec"`
 		IPv6UpdatesPerSec      float64                       `json:"ipv6_updates_per_sec"`
 		HandlerStats           []HandlerStatsInfo            `json:"handler_stats"`
@@ -450,20 +479,52 @@ func (s *Server) handleStats() http.HandlerFunc {
 			connectionDuration = time.Since(metrics.ConnectedSince).Truncate(time.Second).String()
 		}
 
+		// Get announcement/withdrawal stats from metrics tracker
+		metricsTracker := s.streamer.GetMetricsTracker()
+		announcements := metricsTracker.GetAnnouncementCount()
+		withdrawals := metricsTracker.GetWithdrawalCount()
+		churnRate := metricsTracker.GetChurnRate()
+		bgpPeerCount := metricsTracker.GetBGPPeerCount()
+
+		// Calculate last GC pause
+		const (
+			nanosecondsPerMillisecond = 1e6
+			gcPauseHistorySize        = 256 // Size of runtime.MemStats.PauseNs circular buffer
+		)
+		var lastPauseMs float64
+		if memStats.NumGC > 0 {
+			// PauseNs is a circular buffer, get the most recent pause
+			lastPauseIdx := (memStats.NumGC + gcPauseHistorySize - 1) % gcPauseHistorySize
+			lastPauseMs = float64(memStats.PauseNs[lastPauseIdx]) / nanosecondsPerMillisecond
+		}
+
 		stats := StatsResponse{
-			Uptime:                 uptime,
-			TotalMessages:          metrics.TotalMessages,
-			TotalBytes:             metrics.TotalBytes,
-			TotalWireBytes:         metrics.TotalWireBytes,
-			MessagesPerSec:         metrics.MessagesPerSec,
-			MbitsPerSec:            metrics.BitsPerSec / bitsPerMegabit,
-			WireMbitsPerSec:        metrics.WireBitsPerSec / bitsPerMegabit,
-			Connected:              metrics.Connected,
-			ConnectionDuration:     connectionDuration,
-			ReconnectCount:         metrics.ReconnectCount,
-			GoVersion:              runtime.Version(),
-			Goroutines:             runtime.NumGoroutine(),
-			MemoryUsage:            humanize.Bytes(memStats.Alloc),
+			Uptime:             uptime,
+			TotalMessages:      metrics.TotalMessages,
+			TotalBytes:         metrics.TotalBytes,
+			TotalWireBytes:     metrics.TotalWireBytes,
+			MessagesPerSec:     metrics.MessagesPerSec,
+			MbitsPerSec:        metrics.BitsPerSec / bitsPerMegabit,
+			WireMbitsPerSec:    metrics.WireBitsPerSec / bitsPerMegabit,
+			Connected:          metrics.Connected,
+			ConnectionDuration: connectionDuration,
+			ReconnectCount:     metrics.ReconnectCount,
+			GoVersion:          runtime.Version(),
+			Goroutines:         runtime.NumGoroutine(),
+			MemoryUsage:        humanize.Bytes(memStats.Alloc),
+			GC: GCStats{
+				NumGC:          memStats.NumGC,
+				TotalPauseMs:   memStats.PauseTotalNs / uint64(nanosecondsPerMillisecond),
+				LastPauseMs:    lastPauseMs,
+				HeapAllocBytes: memStats.HeapAlloc,
+				HeapSysBytes:   memStats.HeapSys,
+			},
+			Stream: StreamStats{
+				Announcements:    announcements,
+				Withdrawals:      withdrawals,
+				RouteChurnPerSec: churnRate,
+				BGPPeerCount:     bgpPeerCount,
+			},
 			ASNs:                   dbStats.ASNs,
 			Prefixes:               dbStats.Prefixes,
 			IPv4Prefixes:           dbStats.IPv4Prefixes,
@@ -474,6 +535,8 @@ func (s *Server) handleStats() http.HandlerFunc {
 			LiveRoutes:             dbStats.LiveRoutes,
 			IPv4Routes:             ipv4Routes,
 			IPv6Routes:             ipv6Routes,
+			OldestRoute:            dbStats.OldestRoute,
+			NewestRoute:            dbStats.NewestRoute,
 			IPv4UpdatesPerSec:      routeMetrics.IPv4UpdatesPerSec,
 			IPv6UpdatesPerSec:      routeMetrics.IPv6UpdatesPerSec,
 			HandlerStats:           handlerStatsInfo,
@@ -685,20 +748,18 @@ func (s *Server) handleASDetailJSON() http.HandlerFunc {
 // handlePrefixDetailJSON returns prefix details as JSON
 func (s *Server) handlePrefixDetailJSON() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		// Get prefix and length from URL params
 		prefixParam := chi.URLParam(r, "prefix")
-		if prefixParam == "" {
-			writeJSONError(w, http.StatusBadRequest, "Prefix parameter is required")
+		lenParam := chi.URLParam(r, "len")
+
+		if prefixParam == "" || lenParam == "" {
+			writeJSONError(w, http.StatusBadRequest, "Prefix and length parameters are required")
 
 			return
 		}
 
-		// URL decode the prefix parameter
-		prefix, err := url.QueryUnescape(prefixParam)
-		if err != nil {
-			writeJSONError(w, http.StatusBadRequest, "Invalid prefix parameter")
-
-			return
-		}
+		// Combine prefix and length into CIDR notation
+		prefix := prefixParam + "/" + lenParam
 
 		routes, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
 		if err != nil {
@@ -851,20 +912,18 @@ func (s *Server) handleASDetail() http.HandlerFunc {
 // handlePrefixDetail returns a handler that serves the prefix detail HTML page
 func (s *Server) handlePrefixDetail() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		// Get prefix and length from URL params
 		prefixParam := chi.URLParam(r, "prefix")
-		if prefixParam == "" {
-			http.Error(w, "Prefix parameter is required", http.StatusBadRequest)
+		lenParam := chi.URLParam(r, "len")
+
+		if prefixParam == "" || lenParam == "" {
+			http.Error(w, "Prefix and length parameters are required", http.StatusBadRequest)
 
 			return
 		}
 
-		// URL decode the prefix parameter
-		prefix, err := url.QueryUnescape(prefixParam)
-		if err != nil {
-			http.Error(w, "Invalid prefix parameter", http.StatusBadRequest)
-
-			return
-		}
+		// Combine prefix and length into CIDR notation
+		prefix := prefixParam + "/" + lenParam
 
 		routes, err := s.db.GetPrefixDetailsContext(r.Context(), prefix)
 		if err != nil {

internal/server/middleware.go

@@ -168,7 +168,7 @@ func (tw *timeoutWriter) markWritten() {
 // The timeout parameter specifies the maximum duration allowed for request processing.
 // The returned middleware handles panics from the wrapped handler by re-panicking
 // after cleanup, and prevents concurrent writes to the response after timeout occurs.
-func TimeoutMiddleware(timeout time.Duration) func(http.Handler) http.Handler {
+func TimeoutMiddleware(timeout time.Duration, logger *slog.Logger) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			startTime := time.Now()
@@ -204,6 +204,14 @@ func TimeoutMiddleware(timeout time.Duration) func(http.Handler) http.Handler {
 				tw.markWritten() // Prevent the handler from writing after timeout
 				execTime := time.Since(startTime)
 
+				// Log the timeout as a warning
+				logger.Warn("Request timeout",
+					"method", r.Method,
+					"path", r.URL.Path,
+					"duration_ms", execTime.Milliseconds(),
+					"remote_addr", r.RemoteAddr,
+				)
+
 				// Write directly to the underlying writer since we've marked tw as written
 				// This is safe because markWritten() prevents the handler from writing
 				tw.mu.Lock()
@@ -350,10 +358,16 @@ func RequestLoggerMiddleware(logger *slog.Logger) func(http.Handler) http.Handle
 			// Log request completion
 			duration := time.Since(start)
 			logLevel := slog.LevelInfo
+
+			// Slow query threshold (1 second)
+			const slowQueryThreshold = 1 * time.Second
+
 			if sw.statusCode >= http.StatusInternalServerError {
 				logLevel = slog.LevelError
 			} else if sw.statusCode >= http.StatusBadRequest {
 				logLevel = slog.LevelWarn
+			} else if duration >= slowQueryThreshold {
+				logLevel = slog.LevelWarn
 			}
 
 			logger.Log(r.Context(), logLevel, "HTTP request completed",
@@ -362,6 +376,7 @@ func RequestLoggerMiddleware(logger *slog.Logger) func(http.Handler) http.Handle
 				"status", sw.statusCode,
 				"duration_ms", duration.Milliseconds(),
 				"remote_addr", r.RemoteAddr,
+				"slow", duration >= slowQueryThreshold,
 			)
 		})
 	}

internal/server/routes.go

@@ -17,18 +17,18 @@ func (s *Server) setupRoutes() {
 	r.Use(RequestLoggerMiddleware(s.logger.Logger)) // Structured request logging
 	r.Use(middleware.Recoverer)
 	const requestTimeout = 30 * time.Second // Increased from 8s for slow queries
-	r.Use(TimeoutMiddleware(requestTimeout))
+	r.Use(TimeoutMiddleware(requestTimeout, s.logger.Logger))
 	r.Use(JSONResponseMiddleware)
 
 	// Routes
-	r.Get("/", s.handleRoot())
+	r.Get("/", s.handleIndex())
 	r.Get("/status", s.handleStatusHTML())
 	r.Get("/status.json", JSONValidationMiddleware(s.handleStatusJSON()).ServeHTTP)
 	r.Get("/.well-known/healthcheck.json", JSONValidationMiddleware(s.handleHealthCheck()).ServeHTTP)
 
 	// AS and prefix detail pages
 	r.Get("/as/{asn}", s.handleASDetail())
-	r.Get("/prefix/{prefix}", s.handlePrefixDetail())
+	r.Get("/prefix/{prefix}/{len}", s.handlePrefixDetail())
 	r.Get("/prefixlength/{length}", s.handlePrefixLength())
 	r.Get("/prefixlength6/{length}", s.handlePrefixLength6())
 
@@ -45,7 +45,7 @@ func (s *Server) setupRoutes() {
 		r.Get("/stats", s.handleStats())
 		r.Get("/ip/{ip}", s.handleIPLookup())
 		r.Get("/as/{asn}", s.handleASDetailJSON())
-		r.Get("/prefix/{prefix}", s.handlePrefixDetailJSON())
+		r.Get("/prefix/{prefix}/{len}", s.handlePrefixDetailJSON())
 	})
 
 	s.router = r

internal/streamer/streamer.go

@@ -112,8 +112,10 @@ type Streamer struct {
 	cancel       context.CancelFunc
 	running      bool
 	metrics      *metrics.Tracker
-	totalDropped uint64     // Total dropped messages across all handlers
-	random       *rand.Rand // Random number generator for backpressure drops
+	totalDropped uint64          // Total dropped messages across all handlers
+	random       *rand.Rand      // Random number generator for backpressure drops
+	bgpPeers     map[string]bool // Track active BGP peers by peer IP
+	bgpPeersMu   sync.RWMutex    // Protects bgpPeers map
 }
 
 // New creates a new Streamer instance configured to connect to the RIS Live API.
@@ -132,7 +134,8 @@ func New(logger *logger.Logger, metrics *metrics.Tracker) *Streamer {
 		handlers: make([]*handlerInfo, 0),
 		metrics:  metrics,
 		//nolint:gosec // Non-cryptographic randomness is fine for backpressure
-		random: rand.New(rand.NewSource(time.Now().UnixNano())),
+		random:   rand.New(rand.NewSource(time.Now().UnixNano())),
+		bgpPeers: make(map[string]bool),
 	}
 }
 
@@ -608,18 +611,32 @@ func (s *Streamer) stream(ctx context.Context) error {
 			// BGP keepalive messages - silently process
 			continue
 		case "OPEN":
-			// BGP open messages
+			// BGP open messages - track peer as active
+			s.bgpPeersMu.Lock()
+			s.bgpPeers[msg.Peer] = true
+			peerCount := len(s.bgpPeers)
+			s.bgpPeersMu.Unlock()
+			s.metrics.SetBGPPeerCount(peerCount)
+
 			s.logger.Info("BGP session opened",
 				"peer", msg.Peer,
 				"peer_asn", msg.PeerASN,
+				"total_peers", peerCount,
 			)
 
 			continue
 		case "NOTIFICATION":
-			// BGP notification messages (errors)
+			// BGP notification messages (session closed)
+			s.bgpPeersMu.Lock()
+			delete(s.bgpPeers, msg.Peer)
+			peerCount := len(s.bgpPeers)
+			s.bgpPeersMu.Unlock()
+			s.metrics.SetBGPPeerCount(peerCount)
+
 			s.logger.Warn("BGP notification",
 				"peer", msg.Peer,
 				"peer_asn", msg.PeerASN,
+				"total_peers", peerCount,
 			)
 
 			continue

internal/templates/as_detail.html

@@ -5,13 +5,76 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>AS{{.ASN.ASN}} - {{.ASN.Handle}} - RouteWatch</title>
     <style>
+        * {
+            box-sizing: border-box;
+        }
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
             margin: 0;
-            padding: 20px;
+            padding: 0;
             background: #f5f5f5;
             color: #333;
         }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
+            padding: 20px;
+        }
         .container {
             max-width: 1200px;
             margin: 0 auto;
@@ -133,8 +196,20 @@
     </style>
 </head>
 <body>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/">Home</a>
+            <a href="/status">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
     <div class="container">
-        <a href="/status" class="nav-link">← Back to Status</a>
         
         <h1>AS{{.ASN.ASN}}{{if .ASN.Handle}} - {{.ASN.Handle}}{{end}}</h1>
         {{if .ASN.Description}}
@@ -182,7 +257,7 @@
                 <tbody>
                     {{range .IPv4Prefixes}}
                     <tr>
-                        <td><a href="/prefix/{{.Prefix | urlEncode}}" class="prefix-link">{{.Prefix}}</a></td>
+                        <td><a href="{{.Prefix | prefixURL}}" class="prefix-link">{{.Prefix}}</a></td>
                         <td>/{{.MaskLength}}</td>
                         <td>{{.LastUpdated.Format "2006-01-02 15:04:05"}}</td>
                         <td class="age">{{.LastUpdated | timeSince}}</td>
@@ -211,7 +286,7 @@
                 <tbody>
                     {{range .IPv6Prefixes}}
                     <tr>
-                        <td><a href="/prefix/{{.Prefix | urlEncode}}" class="prefix-link">{{.Prefix}}</a></td>
+                        <td><a href="{{.Prefix | prefixURL}}" class="prefix-link">{{.Prefix}}</a></td>
                         <td>/{{.MaskLength}}</td>
                         <td>{{.LastUpdated.Format "2006-01-02 15:04:05"}}</td>
                         <td class="age">{{.LastUpdated | timeSince}}</td>
@@ -266,5 +341,6 @@
         </div>
         {{end}}
     </div>
+    </main>
 </body>
 </html>

internal/templates/index.html

@@ -0,0 +1,447 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>RouteWatch - BGP Route Monitor</title>
+    <style>
+        * {
+            box-sizing: border-box;
+        }
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            margin: 0;
+            padding: 0;
+            background: #f5f5f5;
+            color: #333;
+        }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
+            max-width: 1200px;
+            margin: 0 auto;
+            padding: 30px 20px;
+        }
+
+        /* Stats overview */
+        .stats-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+            gap: 20px;
+            margin-bottom: 40px;
+        }
+        .stat-card {
+            background: white;
+            padding: 24px;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+            text-align: center;
+        }
+        .stat-value {
+            font-size: 32px;
+            font-weight: bold;
+            color: #2c3e50;
+            margin-bottom: 8px;
+        }
+        .stat-label {
+            font-size: 14px;
+            color: #7f8c8d;
+            text-transform: uppercase;
+            letter-spacing: 0.5px;
+        }
+        .stat-card.connected .stat-value {
+            color: #27ae60;
+        }
+        .stat-card.disconnected .stat-value {
+            color: #e74c3c;
+        }
+
+        /* Search section */
+        .search-section {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(350px, 1fr));
+            gap: 24px;
+            margin-bottom: 40px;
+        }
+        .search-card {
+            background: white;
+            padding: 24px;
+            border-radius: 8px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .search-card h2 {
+            margin: 0 0 16px 0;
+            font-size: 18px;
+            color: #2c3e50;
+        }
+        .search-input-group {
+            display: flex;
+            gap: 10px;
+        }
+        .search-input-group input {
+            flex: 1;
+            padding: 12px 16px;
+            border: 1px solid #ddd;
+            border-radius: 6px;
+            font-size: 14px;
+            outline: none;
+            transition: border-color 0.2s;
+        }
+        .search-input-group input:focus {
+            border-color: #3498db;
+        }
+        .search-input-group button {
+            padding: 12px 24px;
+            background: #3498db;
+            color: white;
+            border: none;
+            border-radius: 6px;
+            font-size: 14px;
+            cursor: pointer;
+            transition: background-color 0.2s;
+        }
+        .search-input-group button:hover {
+            background: #2980b9;
+        }
+        .search-input-group button:disabled {
+            background: #bdc3c7;
+            cursor: not-allowed;
+        }
+        .search-hint {
+            font-size: 12px;
+            color: #95a5a6;
+            margin-top: 8px;
+        }
+
+        /* IP Lookup result */
+        .ip-result {
+            margin-top: 16px;
+            display: none;
+        }
+        .ip-result.visible {
+            display: block;
+        }
+        .ip-result-header {
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            margin-bottom: 8px;
+        }
+        .ip-result-header h3 {
+            margin: 0;
+            font-size: 14px;
+            color: #2c3e50;
+        }
+        .ip-result-header button {
+            background: none;
+            border: none;
+            color: #e74c3c;
+            cursor: pointer;
+            font-size: 12px;
+        }
+        .ip-result pre {
+            background: #2c3e50;
+            color: #ecf0f1;
+            padding: 16px;
+            border-radius: 6px;
+            overflow-x: auto;
+            font-size: 12px;
+            line-height: 1.5;
+            margin: 0;
+            max-height: 400px;
+            overflow-y: auto;
+        }
+        .ip-result .error {
+            background: #fee;
+            color: #c00;
+            padding: 12px;
+            border-radius: 6px;
+            font-size: 14px;
+        }
+        .ip-result .loading {
+            color: #7f8c8d;
+            font-style: italic;
+        }
+
+        /* Footer */
+        .footer {
+            margin-top: 40px;
+            padding: 20px;
+            background: white;
+            border-radius: 8px;
+            box-shadow: 0 -2px 10px rgba(0,0,0,0.05);
+            text-align: center;
+            color: #7f8c8d;
+            font-size: 14px;
+        }
+        .footer a {
+            color: #3498db;
+            text-decoration: none;
+        }
+        .footer a:hover {
+            text-decoration: underline;
+        }
+        .footer .separator {
+            margin: 0 10px;
+            color: #ddd;
+        }
+    </style>
+</head>
+<body>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/" class="active">Home</a>
+            <a href="/status">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
+        <div class="stats-grid">
+            <div class="stat-card" id="status-card">
+                <div class="stat-value" id="stat-status">-</div>
+                <div class="stat-label">Status</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-routes">-</div>
+                <div class="stat-label">Live Routes</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-asns">-</div>
+                <div class="stat-label">Autonomous Systems</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-prefixes">-</div>
+                <div class="stat-label">Prefixes</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-peers">-</div>
+                <div class="stat-label">BGP Peers</div>
+            </div>
+            <div class="stat-card">
+                <div class="stat-value" id="stat-updates">-</div>
+                <div class="stat-label">Updates/sec</div>
+            </div>
+        </div>
+
+        <div class="search-section">
+            <div class="search-card">
+                <h2>AS Number Lookup</h2>
+                <form id="asn-form" class="search-input-group">
+                    <input type="text" id="asn-input" placeholder="e.g., 15169 or AS15169" autocomplete="off">
+                    <button type="submit">Lookup</button>
+                </form>
+                <p class="search-hint">Enter an AS number to view its announced prefixes and peers</p>
+            </div>
+
+            <div class="search-card">
+                <h2>AS Name Search</h2>
+                <form id="asname-form" class="search-input-group">
+                    <input type="text" id="asname-input" placeholder="e.g., Google, Cloudflare" autocomplete="off">
+                    <button type="submit">Search</button>
+                </form>
+                <p class="search-hint">Search for autonomous systems by organization name</p>
+                <div id="asname-results"></div>
+            </div>
+
+            <div class="search-card">
+                <h2>IP Address Lookup</h2>
+                <form id="ip-form" class="search-input-group">
+                    <input type="text" id="ip-input" placeholder="e.g., 8.8.8.8 or 2001:4860:4860::8888" autocomplete="off">
+                    <button type="submit">Lookup</button>
+                </form>
+                <p class="search-hint">Get routing information for any IP address</p>
+                <div id="ip-result" class="ip-result">
+                    <div class="ip-result-header">
+                        <h3>Result</h3>
+                        <button type="button" id="ip-result-close">Clear</button>
+                    </div>
+                    <pre id="ip-result-content"></pre>
+                </div>
+            </div>
+        </div>
+    </main>
+
+    <footer class="footer">
+        <span><a href="{{appRepoURL}}">{{appName}}</a> by <a href="{{appAuthorURL}}">{{appAuthor}}</a></span>
+        <span class="separator">|</span>
+        <span>{{appLicense}}</span>
+        <span class="separator">|</span>
+        <span><a href="{{appGitCommitURL}}">{{appGitRevision}}</a></span>
+    </footer>
+
+    <script>
+        function formatNumber(num) {
+            if (num >= 1000000) {
+                return (num / 1000000).toFixed(1) + 'M';
+            } else if (num >= 1000) {
+                return (num / 1000).toFixed(1) + 'K';
+            }
+            return num.toLocaleString();
+        }
+
+        // Fetch and display stats
+        function updateStats() {
+            fetch('/api/v1/stats')
+                .then(response => response.json())
+                .then(response => {
+                    if (response.status !== 'ok') return;
+                    const data = response.data;
+
+                    const statusCard = document.getElementById('status-card');
+                    const statusEl = document.getElementById('stat-status');
+                    statusEl.textContent = data.connected ? 'Connected' : 'Disconnected';
+                    statusCard.className = 'stat-card ' + (data.connected ? 'connected' : 'disconnected');
+
+                    document.getElementById('stat-routes').textContent = formatNumber(data.live_routes);
+                    document.getElementById('stat-asns').textContent = formatNumber(data.asns);
+                    document.getElementById('stat-prefixes').textContent = formatNumber(data.prefixes);
+
+                    if (data.stream) {
+                        document.getElementById('stat-peers').textContent = formatNumber(data.stream.bgp_peer_count);
+                    }
+
+                    const totalUpdates = data.ipv4_updates_per_sec + data.ipv6_updates_per_sec;
+                    document.getElementById('stat-updates').textContent = totalUpdates.toFixed(1);
+                })
+                .catch(() => {
+                    document.getElementById('stat-status').textContent = 'Error';
+                    document.getElementById('status-card').className = 'stat-card disconnected';
+                });
+        }
+
+        // ASN lookup
+        document.getElementById('asn-form').addEventListener('submit', function(e) {
+            e.preventDefault();
+            let asn = document.getElementById('asn-input').value.trim();
+            // Remove 'AS' prefix if present
+            asn = asn.replace(/^AS/i, '');
+            if (asn && /^\d+$/.test(asn)) {
+                window.location.href = '/as/' + asn;
+            }
+        });
+
+        // AS name search
+        document.getElementById('asname-form').addEventListener('submit', function(e) {
+            e.preventDefault();
+            const query = document.getElementById('asname-input').value.trim();
+            if (!query) return;
+
+            const resultsDiv = document.getElementById('asname-results');
+            resultsDiv.innerHTML = '<p class="loading" style="color: #7f8c8d; margin-top: 12px;">Searching...</p>';
+
+            // Use a simple client-side search against the asinfo data
+            // For now, redirect to AS page if it looks like an ASN
+            if (/^\d+$/.test(query)) {
+                window.location.href = '/as/' + query;
+                return;
+            }
+
+            // Show a message that server-side search is coming
+            resultsDiv.innerHTML = '<p style="color: #7f8c8d; margin-top: 12px; font-size: 13px;">AS name search coming soon. For now, try an AS number.</p>';
+        });
+
+        // IP lookup
+        document.getElementById('ip-form').addEventListener('submit', function(e) {
+            e.preventDefault();
+            const ip = document.getElementById('ip-input').value.trim();
+            if (!ip) return;
+
+            const resultDiv = document.getElementById('ip-result');
+            const contentEl = document.getElementById('ip-result-content');
+
+            resultDiv.classList.add('visible');
+            contentEl.className = '';
+            contentEl.textContent = 'Loading...';
+            contentEl.classList.add('loading');
+
+            fetch('/ip/' + encodeURIComponent(ip))
+                .then(response => response.json())
+                .then(response => {
+                    contentEl.classList.remove('loading');
+                    if (response.status === 'error') {
+                        contentEl.className = 'error';
+                        contentEl.textContent = 'Error: ' + response.error.msg;
+                    } else {
+                        contentEl.className = '';
+                        contentEl.textContent = JSON.stringify(response.data, null, 2);
+                    }
+                })
+                .catch(error => {
+                    contentEl.classList.remove('loading');
+                    contentEl.className = 'error';
+                    contentEl.textContent = 'Error: ' + error.message;
+                });
+        });
+
+        // Close IP result
+        document.getElementById('ip-result-close').addEventListener('click', function() {
+            document.getElementById('ip-result').classList.remove('visible');
+            document.getElementById('ip-input').value = '';
+        });
+
+        // Initial load and refresh stats every 5 seconds
+        updateStats();
+        setInterval(updateStats, 5000);
+    </script>
+</body>
+</html>

internal/templates/prefix_detail.html

@@ -5,13 +5,76 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>{{.Prefix}} - RouteWatch</title>
     <style>
+        * {
+            box-sizing: border-box;
+        }
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
             margin: 0;
-            padding: 20px;
+            padding: 0;
             background: #f5f5f5;
             color: #333;
         }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
+            padding: 20px;
+        }
         .container {
             width: 90%;
             max-width: 1600px;
@@ -180,9 +243,20 @@
     </style>
 </head>
 <body>
-    <div class="container">
-        <a href="/status" class="nav-link">← Back to Status</a>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/">Home</a>
+            <a href="/status">Status</a>
+        </div>
+    </nav>
 
+    <main class="main-content">
+    <div class="container">
         <h1>{{.Prefix}}</h1>
         <p class="subtitle">IPv{{.IPVersion}} Prefix{{if .MaskLength}} • /{{.MaskLength}}{{end}}</p>
         
@@ -255,5 +329,6 @@
         </div>
         {{end}}
     </div>
+    </main>
 </body>
 </html>

internal/templates/prefix_length.html

@@ -5,12 +5,76 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Prefixes with /{{ .MaskLength }} - RouteWatch</title>
     <style>
+        * {
+            box-sizing: border-box;
+        }
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            margin: 0;
+            padding: 0;
+            background: #f5f5f5;
+        }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
             max-width: 1200px;
             margin: 0 auto;
             padding: 20px;
-            background: #f5f5f5;
         }
         h1 {
             color: #333;
@@ -78,7 +142,19 @@
     </style>
 </head>
 <body>
-    <a href="/status" class="back-link">← Back to Status</a>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/">Home</a>
+            <a href="/status">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
     <h1>IPv{{ .IPVersion }} Prefixes with /{{ .MaskLength }}</h1>
     <p class="subtitle">Showing {{ .Count }} randomly selected prefixes</p>
     
@@ -93,7 +169,7 @@
         <tbody>
             {{ range .Prefixes }}
             <tr>
-                <td><a href="/prefix/{{ .Prefix | urlEncode }}" class="prefix-link">{{ .Prefix }}</a></td>
+                <td><a href="{{ .Prefix | prefixURL }}" class="prefix-link">{{ .Prefix }}</a></td>
                 <td class="age">{{ .Age }}</td>
                 <td>
                     <a href="/as/{{ .OriginASN }}" class="as-link">
@@ -104,5 +180,6 @@
             {{ end }}
         </tbody>
     </table>
+    </main>
 </body>
 </html>

internal/templates/status.html

@@ -5,12 +5,76 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>RouteWatch Status</title>
     <style>
+        * {
+            box-sizing: border-box;
+        }
         body {
             font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            margin: 0;
+            padding: 0;
+            background: #f5f5f5;
+        }
+
+        /* Navbar styles */
+        .navbar {
+            background: #2c3e50;
+            padding: 0 20px;
+            display: flex;
+            align-items: center;
+            justify-content: space-between;
+            height: 56px;
+            box-shadow: 0 2px 4px rgba(0,0,0,0.1);
+        }
+        .navbar-brand {
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            font-size: 18px;
+            font-weight: 600;
+        }
+        .navbar-brand a {
+            color: white;
+            text-decoration: none;
+        }
+        .navbar-brand a:hover {
+            color: #ecf0f1;
+        }
+        .navbar-brand .by {
+            font-weight: normal;
+            color: #95a5a6;
+            font-size: 14px;
+        }
+        .navbar-brand .author {
+            color: #3498db;
+            font-weight: normal;
+        }
+        .navbar-brand .author:hover {
+            text-decoration: underline;
+        }
+        .navbar-links {
+            display: flex;
+            gap: 20px;
+        }
+        .navbar-links a {
+            color: #ecf0f1;
+            text-decoration: none;
+            font-size: 14px;
+            padding: 8px 12px;
+            border-radius: 4px;
+            transition: background-color 0.2s;
+        }
+        .navbar-links a:hover {
+            background: rgba(255,255,255,0.1);
+        }
+        .navbar-links a.active {
+            background: rgba(255,255,255,0.15);
+        }
+
+        /* Main content */
+        .main-content {
             max-width: 1200px;
             margin: 0 auto;
             padding: 20px;
-            background: #f5f5f5;
         }
         h1 {
             color: #333;
@@ -72,10 +136,43 @@
             border-radius: 4px;
             margin-top: 20px;
         }
+        .footer {
+            margin-top: 40px;
+            padding: 20px;
+            background: white;
+            border-radius: 8px;
+            box-shadow: 0 -2px 10px rgba(0,0,0,0.1);
+            text-align: center;
+            color: #666;
+            font-size: 14px;
+        }
+        .footer a {
+            color: #0066cc;
+            text-decoration: none;
+        }
+        .footer a:hover {
+            text-decoration: underline;
+        }
+        .footer .separator {
+            margin: 0 10px;
+            color: #ccc;
+        }
     </style>
 </head>
 <body>
-    <h1>RouteWatch Status</h1>
+    <nav class="navbar">
+        <div class="navbar-brand">
+            <a href="/">routewatch</a>
+            <span class="by">by</span>
+            <a href="https://sneak.berlin" class="author">@sneak</a>
+        </div>
+        <div class="navbar-links">
+            <a href="/">Home</a>
+            <a href="/status" class="active">Status</a>
+        </div>
+    </nav>
+
+    <main class="main-content">
     <div id="error" class="error" style="display: none;"></div>
     <div class="status-grid">
         <div class="status-card">
@@ -112,6 +209,10 @@
                 <span class="metric-label">Reconnections</span>
                 <span class="metric-value" id="reconnect_count">-</span>
             </div>
+            <div class="metric">
+                <span class="metric-label">BGP Peers</span>
+                <span class="metric-value" id="bgp_peer_count">-</span>
+            </div>
             <div class="metric">
                 <span class="metric-label">Total Messages</span>
                 <span class="metric-value" id="total_messages">-</span>
@@ -120,6 +221,18 @@
                 <span class="metric-label">Messages/sec</span>
                 <span class="metric-value" id="messages_per_sec">-</span>
             </div>
+            <div class="metric">
+                <span class="metric-label">Announcements</span>
+                <span class="metric-value" id="announcements">-</span>
+            </div>
+            <div class="metric">
+                <span class="metric-label">Withdrawals</span>
+                <span class="metric-value" id="withdrawals">-</span>
+            </div>
+            <div class="metric">
+                <span class="metric-label">Route Churn/sec</span>
+                <span class="metric-value" id="route_churn_per_sec">-</span>
+            </div>
             <div class="metric">
                 <span class="metric-label">Total Data</span>
                 <span class="metric-value" id="total_wire_bytes">-</span>
@@ -130,6 +243,30 @@
             </div>
         </div>
 
+        <div class="status-card">
+            <h2>GC Statistics</h2>
+            <div class="metric">
+                <span class="metric-label">GC Runs</span>
+                <span class="metric-value" id="gc_num">-</span>
+            </div>
+            <div class="metric">
+                <span class="metric-label">Total Pause</span>
+                <span class="metric-value" id="gc_total_pause">-</span>
+            </div>
+            <div class="metric">
+                <span class="metric-label">Last Pause</span>
+                <span class="metric-value" id="gc_last_pause">-</span>
+            </div>
+            <div class="metric">
+                <span class="metric-label">Heap Alloc</span>
+                <span class="metric-value" id="gc_heap_alloc">-</span>
+            </div>
+            <div class="metric">
+                <span class="metric-label">Heap Sys</span>
+                <span class="metric-value" id="gc_heap_sys">-</span>
+            </div>
+        </div>
+        
         <div class="status-card">
             <h2>Database Statistics</h2>
             <div class="metric">
@@ -184,6 +321,14 @@
                 <span class="metric-label">IPv6 Updates/sec</span>
                 <span class="metric-value" id="ipv6_updates_per_sec">-</span>
             </div>
+            <div class="metric">
+                <span class="metric-label">Oldest Route</span>
+                <span class="metric-value" id="oldest_route">-</span>
+            </div>
+            <div class="metric">
+                <span class="metric-label">Newest Route</span>
+                <span class="metric-value" id="newest_route">-</span>
+            </div>
         </div>
 
         <div class="status-card">
@@ -264,6 +409,22 @@
             }
         }
 
+        function formatRelativeTime(isoString) {
+            if (!isoString) return '-';
+            const date = new Date(isoString);
+            const now = new Date();
+            const diffMs = now - date;
+            const diffSec = Math.floor(diffMs / 1000);
+            const diffMin = Math.floor(diffSec / 60);
+            const diffHour = Math.floor(diffMin / 60);
+            const diffDay = Math.floor(diffHour / 24);
+
+            if (diffSec < 60) return diffSec + 's ago';
+            if (diffMin < 60) return diffMin + 'm ago';
+            if (diffHour < 24) return diffHour + 'h ' + (diffMin % 60) + 'm ago';
+            return diffDay + 'd ' + (diffHour % 24) + 'h ago';
+        }
+
         function updatePrefixDistribution(elementId, distribution) {
             const container = document.getElementById(elementId);
             container.innerHTML = '';
@@ -344,10 +505,19 @@
             document.getElementById('memory_usage').textContent = '-';
             document.getElementById('connection_duration').textContent = '-';
             document.getElementById('reconnect_count').textContent = '-';
+            document.getElementById('bgp_peer_count').textContent = '-';
             document.getElementById('total_messages').textContent = '-';
             document.getElementById('messages_per_sec').textContent = '-';
+            document.getElementById('announcements').textContent = '-';
+            document.getElementById('withdrawals').textContent = '-';
+            document.getElementById('route_churn_per_sec').textContent = '-';
             document.getElementById('total_wire_bytes').textContent = '-';
             document.getElementById('wire_mbits_per_sec').textContent = '-';
+            document.getElementById('gc_num').textContent = '-';
+            document.getElementById('gc_total_pause').textContent = '-';
+            document.getElementById('gc_last_pause').textContent = '-';
+            document.getElementById('gc_heap_alloc').textContent = '-';
+            document.getElementById('gc_heap_sys').textContent = '-';
             document.getElementById('asns').textContent = '-';
             document.getElementById('prefixes').textContent = '-';
             document.getElementById('ipv4_prefixes').textContent = '-';
@@ -360,6 +530,8 @@
             document.getElementById('ipv6_routes').textContent = '-';
             document.getElementById('ipv4_updates_per_sec').textContent = '-';
             document.getElementById('ipv6_updates_per_sec').textContent = '-';
+            document.getElementById('oldest_route').textContent = '-';
+            document.getElementById('newest_route').textContent = '-';
             document.getElementById('whois_fresh').textContent = '-';
             document.getElementById('whois_stale').textContent = '-';
             document.getElementById('whois_never').textContent = '-';
@@ -420,6 +592,25 @@
                     document.getElementById('ipv6_routes').textContent = formatNumber(data.ipv6_routes);
                     document.getElementById('ipv4_updates_per_sec').textContent = data.ipv4_updates_per_sec.toFixed(1);
                     document.getElementById('ipv6_updates_per_sec').textContent = data.ipv6_updates_per_sec.toFixed(1);
+                    document.getElementById('oldest_route').textContent = formatRelativeTime(data.oldest_route);
+                    document.getElementById('newest_route').textContent = formatRelativeTime(data.newest_route);
+
+                    // Update stream stats
+                    if (data.stream) {
+                        document.getElementById('bgp_peer_count').textContent = formatNumber(data.stream.bgp_peer_count);
+                        document.getElementById('announcements').textContent = formatNumber(data.stream.announcements);
+                        document.getElementById('withdrawals').textContent = formatNumber(data.stream.withdrawals);
+                        document.getElementById('route_churn_per_sec').textContent = data.stream.route_churn_per_sec.toFixed(1);
+                    }
+
+                    // Update GC stats
+                    if (data.gc) {
+                        document.getElementById('gc_num').textContent = formatNumber(data.gc.num_gc);
+                        document.getElementById('gc_total_pause').textContent = data.gc.total_pause_ms + ' ms';
+                        document.getElementById('gc_last_pause').textContent = data.gc.last_pause_ms.toFixed(3) + ' ms';
+                        document.getElementById('gc_heap_alloc').textContent = formatBytes(data.gc.heap_alloc_bytes);
+                        document.getElementById('gc_heap_sys').textContent = formatBytes(data.gc.heap_sys_bytes);
+                    }
 
                     // Update WHOIS stats
                     if (data.whois_stats) {
@@ -455,5 +646,14 @@
         updateStatus();
         setInterval(updateStatus, 2000);
     </script>
+    </main>
+
+    <footer class="footer">
+        <span><a href="{{appRepoURL}}">{{appName}}</a> by <a href="{{appAuthorURL}}">{{appAuthor}}</a></span>
+        <span class="separator">|</span>
+        <span>{{appLicense}}</span>
+        <span class="separator">|</span>
+        <span><a href="{{appGitCommitURL}}">{{appGitRevision}}</a></span>
+    </footer>
 </body>
 </html>

internal/templates/templates.go

@@ -5,10 +5,16 @@ import (
 	_ "embed"
 	"html/template"
 	"net/url"
+	"strings"
 	"sync"
 	"time"
+
+	"git.eeqj.de/sneak/routewatch/internal/version"
 )
 
+//go:embed index.html
+var indexHTML string
+
 //go:embed status.html
 var statusHTML string
 
@@ -23,6 +29,8 @@ var prefixLengthHTML string
 
 // Templates contains all parsed templates
 type Templates struct {
+	// Index is the template for the home page
+	Index *template.Template
 	// Status is the template for the main status page
 	Status *template.Template
 	// ASDetail is the template for displaying AS (Autonomous System) details
@@ -41,8 +49,9 @@ var (
 )
 
 const (
-	hoursPerDay  = 24
-	daysPerMonth = 30
+	hoursPerDay   = 24
+	daysPerMonth  = 30
+	cidrPartCount = 2 // A CIDR has two parts: prefix and length
 )
 
 // timeSince returns a human-readable duration since the given time
@@ -78,6 +87,20 @@ func timeSince(t time.Time) string {
 	return t.Format("2006-01-02")
 }
 
+// prefixURL generates a URL path for a prefix in CIDR notation.
+// Takes a prefix like "192.168.1.0/24" and returns "/prefix/192.168.1.0/24"
+// with the prefix part URL-encoded to handle IPv6 colons.
+func prefixURL(cidr string) string {
+	// Split CIDR into prefix and length
+	parts := strings.SplitN(cidr, "/", cidrPartCount)
+	if len(parts) != cidrPartCount {
+		// Fallback if no slash found
+		return "/prefix/" + url.PathEscape(cidr) + "/0"
+	}
+
+	return "/prefix/" + url.PathEscape(parts[0]) + "/" + parts[1]
+}
+
 // initTemplates parses all embedded templates
 func initTemplates() {
 	var err error
@@ -86,12 +109,26 @@ func initTemplates() {
 
 	// Create common template functions
 	funcs := template.FuncMap{
-		"timeSince": timeSince,
-		"urlEncode": url.QueryEscape,
+		"timeSince":       timeSince,
+		"urlEncode":       url.QueryEscape,
+		"prefixURL":       prefixURL,
+		"appName":         func() string { return version.Name },
+		"appAuthor":       func() string { return version.Author },
+		"appAuthorURL":    func() string { return version.AuthorURL },
+		"appLicense":      func() string { return version.License },
+		"appRepoURL":      func() string { return version.RepoURL },
+		"appGitRevision":  func() string { return version.GitRevisionShort },
+		"appGitCommitURL": func() string { return version.CommitURL() },
+	}
+
+	// Parse index template
+	defaultTemplates.Index, err = template.New("index").Funcs(funcs).Parse(indexHTML)
+	if err != nil {
+		panic("failed to parse index template: " + err.Error())
 	}
 
 	// Parse status template
-	defaultTemplates.Status, err = template.New("status").Parse(statusHTML)
+	defaultTemplates.Status, err = template.New("status").Funcs(funcs).Parse(statusHTML)
 	if err != nil {
 		panic("failed to parse status template: " + err.Error())
 	}
@@ -122,6 +159,11 @@ func Get() *Templates {
 	return defaultTemplates
 }
 
+// IndexTemplate returns the parsed index template
+func IndexTemplate() *template.Template {
+	return Get().Index
+}
+
 // StatusTemplate returns the parsed status template
 func StatusTemplate() *template.Template {
 	return Get().Status

internal/version/version.go

@@ -0,0 +1,34 @@
+// Package version provides build version information
+package version
+
+// Build-time variables set via ldflags
+//
+//nolint:gochecknoglobals // These must be variables to allow ldflags injection at build time
+var (
+	// GitRevision is the git commit hash
+	GitRevision = "unknown"
+	// GitRevisionShort is the short git commit hash (7 chars)
+	GitRevisionShort = "unknown"
+)
+
+const (
+	// Name is the program name
+	Name = "routewatch"
+	// Author is the program author
+	Author = "@sneak"
+	// AuthorURL is the author's website
+	AuthorURL = "https://sneak.berlin"
+	// License is the program license
+	License = "WTFPL"
+	// RepoURL is the git repository URL
+	RepoURL = "https://git.eeqj.de/sneak/routewatch"
+)
+
+// CommitURL returns the URL to view the current commit
+func CommitURL() string {
+	if GitRevision == "unknown" {
+		return RepoURL
+	}
+
+	return RepoURL + "/commit/" + GitRevision
+}

script/bootstrap

@@ -0,0 +1,73 @@
+#!/bin/sh
+# script/bootstrap: install all dependencies needed to build and develop
+# this repo. Idempotent: every install is guarded by a check so already
+# installed tools are skipped. Base tooling comes from nix, apt, brew,
+# or apk (detected in that order); assumes NOTHING is present (not git,
+# make, or go).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+PKGMGR=""
+SUDO=""
+
+detect_pkgmgr() {
+    [ -n "$PKGMGR" ] && return 0
+    if command -v nix-env >/dev/null 2>&1; then
+        PKGMGR="nix"
+    elif command -v apt-get >/dev/null 2>&1; then
+        PKGMGR="apt"
+    elif command -v brew >/dev/null 2>&1; then
+        PKGMGR="brew"
+    elif command -v apk >/dev/null 2>&1; then
+        PKGMGR="apk"
+    else
+        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
+        exit 1
+    fi
+    if [ "$PKGMGR" = "apt" ]; then
+        export DEBIAN_FRONTEND=noninteractive
+        if [ "$(id -u)" != "0" ]; then
+            SUDO="sudo"
+        fi
+    fi
+}
+
+# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
+pkg_install() {
+    detect_pkgmgr
+    case "$PKGMGR" in
+        nix) nix-env -iA "nixpkgs.$1" ;;
+        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
+        brew) brew install "$3" ;;
+        apk) apk add --no-cache "$4" ;;
+    esac
+}
+
+missing() {
+    ! command -v "$1" >/dev/null 2>&1
+}
+
+main() {
+    cd "$ROOT"
+
+    # Base tooling (every repo)
+    if missing git; then pkg_install git git git git; fi
+    if missing make; then pkg_install gnumake make make make; fi
+
+    # Go toolchain
+    if missing go; then pkg_install go golang go go; fi
+
+    # golangci-lint: packaged in nix, brew, and apk. There is no apt
+    # package; on apt systems install it manually from a hash-verified
+    # GitHub release archive (never curl | sh).
+    if missing golangci-lint; then
+        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
+    fi
+
+    go mod download
+
+    echo "bootstrap complete"
+}
+
+main "$@"

script/check

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/check: run all checks (test, lint, fmt-check). Our own
+# extension to scripts-to-rule-them-all. Must not modify any files.
+# Generic: usually needs no adaptation.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/test"
+    "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/fmt-check"
+}
+
+main "$@"

script/cibuild

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/cibuild: run the CI build. The Dockerfile runs script/check
+# (via make check), so a successful build implies all checks pass.
+# Generic: needs no adaptation. The Gitea workflow runs this on push.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build .
+}
+
+main "$@"

script/docker

@@ -0,0 +1,15 @@
+#!/bin/sh
+# script/docker: build the Docker image tagged with the project name.
+# Identical in all repos; the tag comes from script/projectname.
+# Generic: needs no adaptation.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build -t "$("$SCRIPT_DIR/projectname")" .
+}
+
+main "$@"

script/fmt

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/fmt: format all files (writes).
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go fmt ./...
+}
+
+main "$@"

script/fmt-check

@@ -0,0 +1,18 @@
+#!/bin/sh
+# script/fmt-check: check formatting (read-only). Same scope as
+# script/fmt, but fails instead of writing.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    unformatted="$(gofmt -l .)"
+    if [ -n "$unformatted" ]; then
+        echo "Files not formatted:" >&2
+        echo "$unformatted" >&2
+        exit 1
+    fi
+}
+
+main "$@"

script/install-precommit

@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/install-precommit: install the git pre-commit hook that runs
+# script/precommit. Our own extension to scripts-to-rule-them-all.
+# Generic: needs no adaptation.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    hook=".git/hooks/pre-commit"
+    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
+    chmod +x .git/hooks/pre-commit
+    echo "pre-commit hook installed: runs script/precommit"
+}
+
+main "$@"

script/lint

@@ -0,0 +1,13 @@
+#!/bin/sh
+# script/lint: run the linters.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go vet ./...
+    golangci-lint run
+}
+
+main "$@"

script/precommit

@@ -0,0 +1,21 @@
+#!/bin/sh
+# script/precommit: run by the git pre-commit hook; fails the commit if
+# checks fail. Our own extension to scripts-to-rule-them-all. Go repo
+# extras: go mod tidy and go fmt must leave the tree unchanged.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go mod tidy
+    go fmt ./...
+    git diff --exit-code -- go.mod go.sum || {
+        echo "go mod tidy changed files; please stage and retry"
+        exit 1
+    }
+    "$SCRIPT_DIR/check"
+}
+
+main "$@"

script/projectname

@@ -0,0 +1,12 @@
+#!/bin/sh
+# script/projectname: output the name of this project. Our own
+# extension to scripts-to-rule-them-all. Other scripts that need the
+# name (e.g. script/docker) call this, so they can stay identical
+# across all repos.
+set -eu
+
+main() {
+    echo "routewatch"
+}
+
+main "$@"

script/setup

@@ -0,0 +1,14 @@
+#!/bin/sh
+# script/setup: set up the repo for development after a fresh clone:
+# installs dependencies (script/bootstrap) and the git pre-commit hook.
+# Add any repo-specific initialization (db init, .env template) here.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+
+main() {
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/install-precommit"
+}
+
+main "$@"

script/test

@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/test: run the test suite. On failure, rerun verbosely so the
+# failing tests are visible in the output.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go test -timeout 30s -race -cover ./... || {
+        echo "--- Rerunning with -v for details ---"
+        go test -timeout 30s -race -v ./...
+        exit 1
+    }
+}
+
+main "$@"