feat: initial release of Hora, a tiny self-hosted uptime monitor

A small Rust workspace that probes HTTP/TCP services, stores history in
SQLite, alerts on outages and TLS-certificate expiry, and serves a
server-rendered status page plus a JSON API (with a generated OpenAPI doc).

Highlights:
- Pluggable notifications (Notifier trait; Telegram built in), with a body
  snippet on failures and anti-flapping consecutive-failure thresholds.
- Live config reload (file-watch + SIGHUP) with zero downtime; per-monitor
  retention and pruning.
- Per-IP API rate limiting, strict security headers, redacted secrets.
- Lock-free single-flight summary cache; parallel per-monitor queries.
- Static musl binary in a ~25 MB Alpine image; CI + GHCR via GitHub Actions.

Crates: hora-notify, hora-core, hora-web, hora.

Author: uplg

.dockerignore

@@ -0,0 +1,8 @@
+/target
+/.git
+/.github
+*.db
+*.db-shm
+*.db-wal
+config.toml
+README.md

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - uses: Swatinem/rust-cache@v2
+      - name: Install build dependencies (aws-lc-rs)
+        run: sudo apt-get update && sudo apt-get install -y cmake clang libclang-dev
+      - name: Format
+        run: cargo fmt --all -- --check
+      - name: Clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: Test
+        run: cargo test --workspace
+
+  deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: EmbarkStudios/cargo-deny-action@v2

.github/workflows/docker.yml

@@ -0,0 +1,49 @@
+name: Docker
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: docker/setup-qemu-action@v3
+
+      - uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/hora
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=sha
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -0,0 +1,7 @@
+/target
+
+# Local runtime config and database
+/config.toml
+*.db
+*.db-shm
+*.db-wal

CHANGELOG.md

@@ -0,0 +1,41 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-06-07
+
+Initial release.
+
+### Added
+
+- **Monitors** — HTTP and TCP probes with per-monitor interval, timeout, expected
+  status, a "degraded if slower than" threshold, and custom request headers.
+- **Status page** — server-rendered (no JS framework) compact, responsive grid:
+  daily uptime bars, an inline SVG 24h latency chart, auto-refresh, Cal Sans
+  branding and an SVG favicon.
+- **JSON API** — `GET /api/summary` and `GET /api/monitors/{id}/latency`, plus a
+  generated OpenAPI 3.1 document at `/api/openapi.json` (`utoipa`).
+- **TLS certificate expiry monitoring** with advance warnings.
+- **Notifications** — a pluggable `Notifier` trait with a built-in Telegram
+  channel; alerts fire only after _N_ consecutive failures (anti-flapping),
+  include a snippet of the failing response body, and a recovery message.
+- **Storage** — SQLite (sqlx) with per-monitor retention and automatic pruning.
+- **Live configuration reload** — file-watch and `SIGHUP`: monitors, thresholds,
+  retention and notification channels are reconciled in place, with no downtime
+  for unchanged monitors.
+- **API hardening** — per-IP rate limiting (`x-ratelimit-*` / `retry-after`
+  headers), strict Content-Security-Policy, `X-Content-Type-Options` and
+  `Referrer-Policy`.
+- **Performance** — a lock-free, single-flight summary cache (busted on config
+  reload) and concurrent per-monitor queries keep responses fast under load.
+- **Packaging** — a static musl binary in a ~25 MB Alpine image (multi-arch
+  amd64/arm64), with GitHub Actions for CI (fmt, clippy, tests, cargo-deny) and
+  publishing to GHCR.
+
+[Unreleased]: https://github.com/uplg/hora/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/uplg/hora/releases/tag/v0.1.0