# External demo

`index.html` is a stranger's page: one file, no build, no framework, served from a
different origin than Ham Lab. It knows a base URL and a read-only sensor token
(`config.js`, not in git) and nothing else. Each tab is one shaped query POSTed to
`/api/sensors/query?full=1` on an interval; sparklines are seeded from
`/api/sensors/history`; the Fleet tab is one call to `/api/fleet/sensors/query`.

```js
// config.js
window.HAMLAB = { base: 'http://10.0.0.234:8100', token: '<read-only sensor token>' }
```

Anyone who can load the page can read the token. If the page is public, limit the token to
patterns that name nothing you'd mind the world reading — hardware numbers and counts,
not container or service names.

This is an example to read and copy, not something that runs anywhere. It was deployed on
`core` as the `hamlab-demo` stack and linked from the Widgets tab until 2026-09-23, when
both were removed: the Widgets tab shows the same widgets against the machine you are
already signed in to, so a second public copy earned nothing and cost a public token.