Current Answer: Native Arbitrary HTML or JavaScript Widgets Are Not a Published ZimaOS Feature
The 2026 proposal asked for widgets that could render weather, Pomodoro timers, Pi-hole controls, memos, AI chat and custom endpoint responses. Current ZimaOS publishes built-in system cards and an OpenAPI for integrations, but it does not document a native feature where users paste arbitrary HTML, CSS or JavaScript into the home dashboard. That means the request remains a product-extension idea, while API-driven external dashboards are already practical today.
Use ZimaOS OpenAPI for Data Instead of Scraping the Dashboard
Current ZimaOS exposes programmatic interfaces for storage, users and system services. A custom dashboard can call those APIs and render its own cards without depending on private frontend routes. The ZimaOS OpenAPI is the stable integration surface.
Homarr Is the Fastest Route to a Custom Dashboard
If the goal is visual composition rather than native integration, Homarr already provides drag-and-drop widgets, integrations, icons and authentication. The Homarr Docker install gives the current deployment path. The ZimaOS app requirements helps size the extra service.
Why Arbitrary JavaScript Inside the Admin UI Is High Risk
A widget that can execute unrestricted JavaScript inside the authenticated NAS dashboard would share a highly privileged origin. A malicious or buggy widget could read data, trigger actions or capture session information. If native widgets are introduced, a safer design would need sandboxing, permission scopes and a controlled widget API.
OWASP's cross-site scripting risks explains the core browser security problem.
Prefer Read-Only Widgets for Monitoring
CPU usage, storage capacity, temperatures, uptime and service health are easier to expose safely than write actions. A “disable Pi-hole” or “restart container” button needs stronger authentication, auditability and confirmation because a dashboard click can change infrastructure state.
Poll Efficiently Instead of Every Few Seconds
Frequent polling creates constant background requests on a low-power server. For storage, temperatures and service health, 30–60 seconds is often enough. Weather may need only several minutes. Use event-driven updates where possible rather than polling everything at the same interval.
Keep Secrets on the Server Side
If a widget needs an API token for weather, Pi-hole, AI or another service, do not embed it into browser JavaScript. Use a backend proxy or server-side integration that keeps credentials outside the client bundle. The ZimaOS HTTPS proxying is useful when services need browser access.
Use a Separate Dashboard When You Want Maximum Freedom
A standalone dashboard container gives complete control over layout and integrations without modifying ZimaOS itself. It also survives ZimaOS frontend redesigns more cleanly. Link back to the native admin dashboard for privileged tasks rather than cloning every system control into a custom layer.
What a Safe Native Widget System Would Need
A strong implementation would define widget manifests, requested permissions, isolated rendering, rate limits, version compatibility, server-side secrets and a clear difference between read-only and mutating widgets. The best part of the original request is the need for a first-class extension surface, not unrestricted code execution.
Version Your Custom Dashboard Separately From ZimaOS
Keep widget code, API adapters and configuration in source control. When ZimaOS changes an API version or authentication flow, you can update the integration deliberately instead of losing a hand-edited script inside a container. A small compatibility layer also lets the same dashboard talk to multiple ZimaOS devices without duplicating code.
FAQ
Can I add custom widgets directly to ZimaOS?
Current public material does not document arbitrary user-defined HTML/JavaScript widgets as a built-in feature.
Can I build a ZimaOS dashboard with OpenAPI?
Yes. External dashboards can use supported ZimaOS APIs and render their own widgets.
Should widgets store API keys in JavaScript?
No. Keep service credentials on the server side.
Is Homarr a good alternative?
Yes when the goal is a customizable dashboard rather than modifying the native ZimaOS UI.
Why not allow arbitrary JavaScript?
The dashboard is an authenticated admin surface, so unrestricted scripts would create major XSS and privilege risks.
