Block a user
TLS setup (provided cert or ACME)
CLI client (reads VAULT_URL + VAULT_TOKEN env vars)
Export endpoint (.env + JSON formats)
API key middleware (bearer token → bcrypt verify)
REST API server (net/http or chi router)
Master key loading + validation on startup
Encryption layer (AES-256-GCM, envelope encryption)
SQLite schema (environments, secrets, api_keys, audit_log)
TLS for the dashboard itself
Config hot-reload on SIGHUP
Environment variable substitution in config (${VAR})
JSON API (/api/v1/monitors, /api/v1/monitors/{name}/checks)