commit 51c23d10e7849e5c600aca8635ec0e315ad11a8d
Author: ponzischeme89 <matt@mattcohen.net>
Date:   Sat Apr 18 07:06:50 2026 +1200

    first commit

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..d7ce955
--- /dev/null
+++ b/README.md
@@ -0,0 +1,47 @@
+# Caddy Log Dashboard
+
+A minimal Flask app that reads your Caddy JSON access log and surfaces useful insights.
+
+## Setup
+
+```
+cd C:\path\to\caddy_dashboard
+pip install -r requirements.txt
+```
+
+## Run
+
+```
+python app.py
+```
+
+Then open http://127.0.0.1:5000 in your browser.
+
+The app binds to `127.0.0.1` only, so it's not reachable from the network.
+
+## Configuration
+
+By default the app reads `C:\Caddy\logs\log2.json`. To point it elsewhere, set the `CADDY_LOG` environment variable before starting:
+
+```
+set CADDY_LOG=C:\path\to\other\log.json
+python app.py
+```
+
+## What it shows
+
+- Total requests, 403s, 5xx errors, slow requests, auth events, unique IPs
+- Status distribution (2xx / 3xx / 4xx / 5xx breakdown)
+- 403 trigger classification (which matcher fired: Emby version, iOS client, device ID, native UA, etc.)
+- Per-host traffic with hit counts, bytes transferred, and status mix
+- Top source IPs
+- Emby client versions, client applications, and device names
+- Auth service (auth.mattcohen.net) traffic breakdown
+- Recent 403 blocks with detail
+- Recent 5xx errors
+- Slowest requests (>=2s)
+
+## Notes
+
+- The log is re-read on every page load. For a 7MB log this should be fast enough (a second or two). If it gets much bigger, consider switching to the in-memory cached mode.
+- There's also `/api/raw/<n>` that returns the N most recent parsed entries as JSON, handy for debugging.