Delete .github/workflows/donation-goal.yml

Remove donation badge from README
Removed donation badge from README.
2026-07-15 04:43:36 +00:00 · 2026-07-13 20:04:16 -05:00 · 2026-07-13 20:03:42 -05:00 · 2026-07-14 01:36:12 +08:00 · 2026-07-14 01:16:11 +08:00 · 2026-07-06 15:22:13 -05:00
401 changed files with 151394 additions and 89795 deletions
@@ -5,4 +5,4 @@ contact_links:
    about: Report any feature requests or bugs in the support center
  - name: Discord
    url: https://discord.gg/jVQGdvHDrf
-    about: Official Termix Discord server for general discussion and quick support
+    about: Official Termix Discord server for general discussion (not recommended for support)
@@ -0,0 +1 @@
+custom: https://donate.termix.site/
@@ -14,7 +14,7 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -35,7 +35,7 @@ jobs:
    runs-on: blacksmith-8vcpu-ubuntu-2404
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -52,7 +52,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -142,7 +142,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -352,7 +352,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -578,7 +578,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -684,7 +684,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -734,8 +734,6 @@ jobs:
          CHECKSUM_X64="${{ steps.appimage-info.outputs.checksum_x64 }}"
          CHECKSUM_ARM64="${{ steps.appimage-info.outputs.checksum_arm64 }}"
          RELEASE_DATE="${{ steps.package-version.outputs.release_date }}"
-          APPIMAGE_X64_NAME="${{ steps.appimage-info.outputs.appimage_x64_name }}"
-          APPIMAGE_ARM64_NAME="${{ steps.appimage-info.outputs.appimage_arm64_name }}"

          mkdir -p flatpak-submission

@@ -762,6 +760,58 @@ jobs:
          path: flatpak-submission/*
          retention-days: 30

+      - name: Check for Flathub token
+        id: check_flathub_token
+        run: |
+          if [ -n "${{ secrets.FLATHUB_TOKEN }}" ]; then
+            echo "has_token=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Open PR on Flathub repo
+        if: steps.check_flathub_token.outputs.has_token == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.FLATHUB_TOKEN }}
+          VERSION: ${{ steps.package-version.outputs.version }}
+        run: |
+          FLATHUB_REPO="flathub/com.karmaa.termix"
+          BRANCH="release-$VERSION"
+
+          git config --global user.name "LukeGus"
+          git config --global user.email "bugattiguy527@gmail.com"
+
+          git clone "https://x-access-token:${GH_TOKEN}@github.com/${FLATHUB_REPO}.git" flathub-repo
+          cd flathub-repo
+
+          git checkout -b "$BRANCH"
+
+          cp ../flatpak-submission/com.karmaa.termix.yml ./
+          cp ../flatpak-submission/com.karmaa.termix.desktop ./
+          cp ../flatpak-submission/com.karmaa.termix.metainfo.xml ./
+          cp ../flatpak-submission/flathub.json ./
+          cp ../flatpak-submission/com.karmaa.termix.svg ./
+          cp ../flatpak-submission/icon-256.png ./
+          cp ../flatpak-submission/icon-128.png ./
+
+          if git diff --quiet && git diff --cached --quiet; then
+            echo "No changes to submit for $VERSION; Flathub repo already up to date."
+            exit 0
+          fi
+
+          git add -A
+          git commit -m "Update to $VERSION"
+          git push origin "$BRANCH"
+
+          EXISTING_PR=$(gh pr list --repo "$FLATHUB_REPO" --head "$BRANCH" --state open --json number -q '.[0].number' || true)
+          if [ -z "$EXISTING_PR" ]; then
+            gh pr create --repo "$FLATHUB_REPO" \
+              --base master \
+              --head "$BRANCH" \
+              --title "Update to $VERSION" \
+              --body "Automated release update to version $VERSION."
+          else
+            echo "PR #$EXISTING_PR already open for $BRANCH."
+          fi
+
  submit-to-homebrew:
    runs-on: blacksmith-6vcpu-macos-latest
    if: inputs.artifact_destination == 'submit' && (inputs.build_type == 'all' || inputs.build_type == 'macos')
@@ -771,7 +821,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -881,7 +931,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -957,7 +1007,7 @@ jobs:
        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
        uses: ruby/setup-ruby@v1
        with:
-          ruby-version: "3.2"
+          ruby-version: "3.3"
          bundler-cache: false

      - name: Install Fastlane
@@ -10,7 +10,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
@@ -13,7 +13,7 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
@@ -39,7 +39,7 @@ jobs:
          exit 1

      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -85,14 +85,14 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout dev branch
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
        with:
          ref: ${{ needs.prep.outputs.dev_branch }}
          fetch-depth: 0
          token: ${{ secrets.GHCR_TOKEN }}

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version-file: ".nvmrc"
          cache: "npm"
@@ -137,17 +137,25 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout dev branch
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
        with:
          ref: ${{ needs.prep.outputs.dev_branch }}
          fetch-depth: 0
          token: ${{ secrets.GHCR_TOKEN }}

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version-file: ".nvmrc"

+      - name: Merge main into dev branch
+        run: |
+          git config user.name "LukeGus"
+          git config user.email "bugattiguy527@gmail.com"
+          git fetch origin main
+          git merge origin/main -X ours --no-edit || true
+          git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
+
      - name: Clean up stale Crowdin git integration branch
        continue-on-error: true
        env:
@@ -212,7 +220,7 @@ jobs:
      build_ref: ${{ steps.merge.outputs.build_ref }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          fetch-depth: 1

@@ -285,22 +293,24 @@ jobs:
    needs: [prep, merge-to-main, docker]
    if: ${{ inputs.mode != 'Dry run' }}
    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      contents: write
    steps:
      - name: Checkout main
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 1

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version-file: ".nvmrc"

      - name: Clear existing release artifacts (overwrite mode)
        if: ${{ inputs.mode == 'Overwrite release' }}
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
        run: |
          TAG="${{ needs.prep.outputs.release_tag }}"
          if ! gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
@@ -323,7 +333,7 @@ jobs:
      - name: Create or update GitHub release
        if: ${{ inputs.mode != 'Overwrite release' }}
        env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
        run: |
          TAG="${{ needs.prep.outputs.release_tag }}"
          TITLE="release-${{ needs.prep.outputs.version }}"
@@ -360,7 +370,7 @@ jobs:
      contents: write
    steps:
      - name: Checkout main
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 1
@@ -386,8 +396,10 @@ jobs:

          git config user.name "LukeGus"
          git config user.email "bugattiguy527@gmail.com"
-          git pull --rebase origin main
          git add Casks/termix.rb
+          git stash
+          git pull --rebase origin main
+          git stash pop
          git commit -m "chore: bump Homebrew cask to $VERSION"
          git push origin HEAD:main

@@ -397,14 +409,14 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout Termix
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
        with:
          ref: ${{ needs.merge-to-main.outputs.build_ref }}
          fetch-depth: 1
          path: termix

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version-file: "termix/.nvmrc"
          cache: "npm"
@@ -417,7 +429,7 @@ jobs:
          npm run generate:openapi

      - name: Checkout Docs repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
        with:
          repository: Termix-SSH/Docs
          ref: main
@@ -455,7 +467,7 @@ jobs:

          git add -A
          git commit -m "feat: update API docs for ${{ needs.prep.outputs.version }}"
-          git push origin "dev-${{ needs.prep.outputs.version }}"
+          git push --force origin "dev-${{ needs.prep.outputs.version }}"

      - name: Open and squash-merge docs PR
        if: ${{ inputs.mode != 'Dry run' }}
@@ -471,11 +483,16 @@ jobs:

          PR_NUMBER=$(gh pr list --repo Termix-SSH/Docs --head "$BRANCH" --base main --state open --json number -q '.[0].number' || true)
          if [ -z "$PR_NUMBER" ]; then
-            PR_NUMBER=$(gh pr create --repo Termix-SSH/Docs \
+            PR_URL=$(gh pr create --repo Termix-SSH/Docs \
              --base main --head "$BRANCH" \
              --title "release-${{ needs.prep.outputs.version }}" \
-              --body "API docs for ${{ needs.prep.outputs.version }}" \
-              | grep -oE '[0-9]+$')
+              --body "API docs for ${{ needs.prep.outputs.version }}")
+            PR_NUMBER=$(echo "$PR_URL" | grep -oE '[0-9]+$')
+          fi
+
+          if [ -z "$PR_NUMBER" ]; then
+            echo "Failed to find or create a PR for $BRANCH."
+            exit 1
          fi

          gh pr merge "$PR_NUMBER" --repo Termix-SSH/Docs --squash --admin
@@ -486,13 +503,13 @@ jobs:
    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Checkout main
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
        with:
          ref: main
          fetch-depth: 1

      - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
        with:
          node-version-file: ".nvmrc"

@@ -33,3 +33,5 @@ electron/build-info.cjs
 /.mcp.json
 /CLAUDE.md
 /old_db/
+/scripts/fix-bugs.mjs
+/scripts/fix-features.mjs
@@ -1,6 +1,6 @@
 cask "termix" do
-  version "2.3.2"
-  sha256 "cb4233c59bb1f0a0bdf981f921d84f5bed0200f4edee45c85b43de5c2f289945"
+  version "2.5.0"
+  sha256 "0662380b3cc986e5ddab263122e87b03a581bc18dbff1ad13e11dc973c84984b"

  url "https://github.com/Termix-SSH/Termix/releases/download/release-#{version}-tag/termix_macos_universal_dmg.dmg"
  name "Termix"
@@ -28,10 +28,15 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix is free and open source. If you find it useful, consider [donating](https://donate.termix.site/) to help cover server costs and development time.
+
+<br />
+
 <img src="./repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +92,8 @@ Manage files directly on remote servers with support for viewing and editing cod
 <tr>
 <td width="50%" valign="top">

-**Docker Management:**
-Start, stop, pause, remove containers. View container stats. Control container using docker exec terminal. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.
+**Docker and Podman Management:**
+Start, stop, pause, remove containers. View container stats. Control containers using a docker exec terminal. Supports both Docker and Podman as the container runtime. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.

 </td>
 <td width="50%" valign="top">
@@ -102,13 +107,13 @@ Save, organize, and manage your SSH connections with tags and folders (folder cu
 <td width="50%" valign="top">

 **Host Metrics:**
-View CPU, memory, disk usage, network, uptime, system information, firewall, port monitor, log viewer, users/permissions, certificates, and many more which work on most Linux based servers.
+View CPU, memory, disk usage, network, uptime, system information, firewall, port monitor, log viewer, users/permissions, certificates, and many more which work on most Linux based servers. Includes time-series history graphs and threshold-based alerts with ntfy and webhook support.

 </td>
 <td width="50%" valign="top">

 **User Authentication:**
-Secure user management with admin controls and OIDC/LDAP/SSO (with access control) and 2FA (TOTP) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together. View audit log of all users actions.
+Secure user management with admin controls and OIDC/LDAP/SSO (with access control), 2FA (TOTP), and passkey (WebAuthn) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together. View audit log of all users actions.

 </td>
 </tr>
@@ -129,32 +134,52 @@ Create roles and share hosts across users/roles.
 <tr>
 <td width="50%" valign="top">

+**Serial Connections:**
+Connect to serial devices (routers, switches, microcontrollers, etc.) directly from the browser or desktop app. Configure baud rate, data bits, stop bits, and parity. Uses the Web Serial API in supported browsers or a native backend in the Electron app.
+
+</td>
+<td width="50%" valign="top">
+
+**Alerts:**
+Set threshold-based alert rules on host metrics (CPU, memory, disk, etc.) and get notified via ntfy or webhooks when they fire. View firing and resolved alerts in a history log.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Homepage:**
+A fully customizable homepage with a drag-and-drop widget grid. Add widgets for host status, service links, clocks, notes, RSS feeds, weather, Docker containers, host metrics charts, embedded terminals, iframes, and more.
+
+</td>
+<td width="50%" valign="top">
+
 **Database Encryption:**
 Backend stored as encrypted SQLite database files. View [docs](https://docs.termix.site/security) for more.

 </td>
+</tr>
+<tr>
 <td width="50%" valign="top">

 **Network Graph:**
 Customize your Dashboard to visualize your homelab based off your SSH connections with status support.

 </td>
-</tr>
-<tr>
 <td width="50%" valign="top">

 **SSH Tools:**
 Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.

 </td>
+</tr>
+<tr>
 <td width="50%" valign="top">

 **Persistent Tabs:**
 SSH sessions and tabs stay open across devices/refreshes if enabled in user profile.

 </td>
-</tr>
-<tr>
 <td width="50%" valign="top">

 **Languages:**
@@ -179,7 +204,8 @@ Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/tr
 - **Quick Connect** - Connect to a server without having to save the connection data
 - **Command Palette** - Double tap left shift to quickly access SSH connections with your keyboard
 - **Proxmox Integration** - Auto-add hosts into Termix from your Proxmox instance
- **SSH Feature Rich** - Supports jump hosts, Warpgate, TOTP based connections, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, etc.
+- **SSH Feature Rich** - Supports jump hosts, Warpgate, TOTP based connections, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, SSH agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, and more.
+- **Termix ID** - A sshid.io equivalent built into Termix. Claim a handle, publish your public SSH keys at a resolver URL, and use a built-in CA to issue SSH certificates.

 </details>

@@ -263,6 +289,14 @@ networks:

 <br />

+## Donate
+
+Termix is free and open source with no subscriptions or paid plans. If you find it useful, consider donating to help cover server costs, domains, and development time.
+
+[Donate](https://donate.termix.site/)
+
+<br />
+
 ## Screenshots

 <div align="center">
@@ -305,6 +339,10 @@ networks:
 <td><img src="./repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="./repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="./repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="./repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Some videos and images may be out of date or may not perfectly showcase features.</sub>
@@ -352,6 +390,10 @@ See [Projects](https://github.com/orgs/Termix-SSH/projects/5) for all planned fe
 <a href="https://aws.amazon.com/">
  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://rackgenius.com/">
+  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="AWS" />
+</a>

 </div>

@@ -1,53 +1,81 @@
 <!-- SUMMARY -->

-Bug fixes and new features, including Proxmox integration, SSO/OIDC redesign, revamped host metrics, tmux session management, and numerous UI and stability improvements.
+Major new features including serial connections, Tailscale/WireGuard support, HashiCorp Vault SSH auth, Bitwarden SSH agent, WebAuthn passkeys, Podman support, a new grid-based dashboard, host metrics history with alerting, and much more.

 <!-- /SUMMARY -->

 <!-- YOUTUBE -->

-https://youtu.be/ImwAbm4hW-k
+https://youtu.be/c3UD4q2jW_8

 <!-- /YOUTUBE -->

 <!-- UPDATE_LOG -->

- Improved terminal syntax highlighting with more customizability and reliability (toggle setting moved from user profile to host editor)
- Tmux session monitor/management
- Tailscale SSH authentication and device listing support
- SSO/OIDC redesign (multiple OIDC providers, LDAP, Google, GitHub support)
- Terminal session logging
- Customize side rail tab visibility
- Admin audit log
- Added `x.x.x` version tag alongside `release-x.x.x` for Docker
- OIDC custom group claim support
- Renamed server stats to host metrics
- Fully revamped host metrics page with new cards and dashboard like organizing system (services, process inspector, log viewer, cron jobs, packages, ssl cert management, firewall, user/permissions, health checks, disk breakdown, timers, and top by memory)
- Proxmox guest discovery and import integration
- Moved ssh host config outside of top tab bar and into new tab bar visible on SSH tab
- Improved folder management (nested folders, folder icons, folder colors, better folder selection, etc.)
- Storage preference to user profile settings (store/load toggles locally or in the DB)
- Sort/filter functions to credential list (copy of host list)
+- Termix ID with a public handle, hosted public key resolver, and built-in CA for issuing SSH certificates
+- Serial connections support
+- Tailscale and WireGuard VPN host integration with status detection
+- HashiCorp Vault SSH signer authentication
+- Bitwarden SSH agent integration
+- WebAuthn passkey authentication
+- Podman container runtime support alongside Docker
+- SSH agent forwarding support across all SSH features
+- New grid and widget-based dashboard homepage
+- Grafana-style server stats history graphs
+- Alert system with ntfy and webhook notification support
+- Host temperature metrics card
+- App fullscreen mode
+- External editor support for file manager (desktop app)
+- Safe host sharing export
+- SSH credential password fallback for key-based auth
+- Open all sessions in a folder at once
+- Custom terminal theme color support
+- Custom tunnel endpoints configuration
+- GUACD_URL environment variable support
+- App rail hover expansion setting
+- Terminal font zoom with mouse wheel
+- File manager terminals promoted to full tabs
+- Donate button on dashboard
+- PuTTY PPK SSH key support
+- Confirmation dialog when closing active host connections
+- Confirmation prompt before opening large files in the editor
+- Cross-host file manager clipboard
+- Prioritize host results in command palette search
+- Retry autostart tunnel host fetches on failure
 <!-- /UPDATE_LOG -->

 <!-- BUG_FIXES -->

- SFTP jump-host fallback from host data
- Guacd password incorrectly passed for app view
- Admin page failing to load admin information
- Disabled hardware acceleration on Windows to prevent startup crash
- Dashboard total credentials stuck at 0
- Host username ignored when credential attached
- Clone host cannot switch auth method
- File manager context menu off-screen
- File delete affecting inactive tabs
- Silent delete failure on Windows hosts
- iPad host tab does nothing
- Docker console terminal background using incorrect colors
- Reliable OIDC group syncing for admin roles
- Guacd connections using incorrect screen height
- 2FA failing to disable
- Hostname fill entire column and truncate at proper spot in dashboard
- Make credentials start collapsed
- Incorrect JSDoc comments
+- SSH port connection bug
+- VNC required argument handshake failure
+- Jump host SOCKS5 proxy selection using wrong proxy
+- Tunnel endpoint resolution failing in some configurations
+- Direct tunnel skipping endpoint credential validation incorrectly
+- Dashboard host routing ignoring protocol settings
+- Dashboard service link creation broken
+- File manager uploads failing with 400 error and missing schema migrations on upgrade
+- Large file manager uploads not chunked (chunked for files >=1.5GB)
+- File uploads over 100MB failing due to ArrayBuffer browser limit
+- File path case not preserved in file manager UI
+- File downloads unreliable in the desktop app
+- Tmux detection path handling incorrect
+- Host metrics startup polling incorrect
+- TUI terminal output highlighting incorrect
+- Runtime base path for auth callbacks incorrect
+- Windows app icon unstable
+- SSH heading syntax highlighting broken
+- Terminal link dialog layering issue
+- Electron OIDC browser authentication failures
+- Proxmox import auth fallback not working
+- OIDC role credential shares not synced for OIDC users
+- RDP connections requiring credentials when none are needed
+- VNC authentication settings not persisted
+- Guacamole unicode token corruption
+- Guacamole websocket base path incorrect
+- Guacamole disconnect during startup crash
+- Host metrics starting for non-SSH hosts
+- Sidebar host hover causing layout shift
+- Alert UI incorrectly applying Termix CSS and alert system failing to load
+- Translation key incorrect for nav close action
+- PUID HTML ownership in Docker entrypoint
 <!-- /BUG_FIXES -->
@@ -0,0 +1,58 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true,
+    "defaultBranch": "dev-2.5.0"
+  },
+  "files": {
+    "ignoreUnknown": true,
+    "includes": [
+      "**",
+      "!!build",
+      "!!coverage",
+      "!!dist",
+      "!!dist-ssr",
+      "!!release",
+      "!!node_modules",
+      "!!src/mcp-server/node_modules",
+      "!!db",
+      "!!.env",
+      "!!**/*.min.js",
+      "!!**/*.min.css",
+      "!!openapi.json"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 80,
+    "lineEnding": "lf"
+  },
+  "linter": {
+    "enabled": false
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "semicolons": "always",
+      "trailingCommas": "all",
+      "arrowParentheses": "always"
+    }
+  },
+  "json": {
+    "formatter": {
+      "trailingCommas": "none"
+    }
+  },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    }
+  },
+  "assist": {
+    "enabled": false
+  }
+}
@@ -0,0 +1,12 @@
+const fs = require("fs");
+const path = require("path");
+
+exports.default = async function afterPack(context) {
+  const { targets, appOutDir } = context;
+
+  const isDir = targets.some((t) => t.name === "dir");
+  if (!isDir) return;
+
+  const markerPath = path.join(appOutDir, ".portable");
+  fs.writeFileSync(markerPath, "");
+};
@@ -60,7 +60,7 @@ ENV DATA_DIR=/app/data \
    PORT=8080 \
    NODE_ENV=production

-RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu wget && \
+RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu wget certbot python3-certbot-dns-cloudflare && \
    update-ca-certificates && \
    rm -rf /var/lib/apt/lists/* && \
    mkdir -p /app/data /app/uploads /app/data/.opk /app/nginx /tmp/nginx && \
@@ -78,7 +78,7 @@ COPY --chown=node:node package.json ./

 VOLUME ["/app/data"]

-EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006
+EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006 30007 30008 30009 30010 30011 30012

 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD wget -q -O /dev/null http://localhost:30001/health || exit 1
@@ -14,7 +14,7 @@ if [ "$(id -u)" = "0" ]; then
        groupmod -o -g "$PGID" node 2>/dev/null || true
        usermod -o -u "$PUID" node 2>/dev/null || true

-        chown -R node:node /app/data /app/uploads /tmp/nginx 2>/dev/null || true
+        chown -R node:node /app/data /app/uploads /app/html /tmp/nginx 2>/dev/null || true

        echo "User node is now UID: $PUID, GID: $PGID"

@@ -41,7 +41,7 @@ fi
 mkdir -p /tmp/nginx
 envsubst '${PORT} ${SSL_PORT} ${SSL_CERT_PATH} ${SSL_KEY_PATH}' < $NGINX_CONF_SOURCE > /tmp/nginx/nginx.conf

-mkdir -p /app/data /app/uploads /app/data/.opk
+mkdir -p /app/data /app/uploads /app/data/.opk /app/data/acme-webroot/.well-known/acme-challenge
 chmod 755 /app/data /app/uploads /app/data/.opk 2>/dev/null || true

 if [ -w /app/data ]; then
@@ -167,4 +167,4 @@ node dist/backend/backend/starter.js

 echo "All services started"

-tail -f /dev/null
+tail -f /dev/null
@@ -24,7 +24,11 @@ http {
    client_header_timeout 300s;

    set_real_ip_from 127.0.0.1;
+    set_real_ip_from 10.0.0.0/8;
+    set_real_ip_from 172.16.0.0/12;
+    set_real_ip_from 192.168.0.0/16;
    real_ip_header X-Forwarded-For;
+    real_ip_recursive on;

    map $http_x_forwarded_proto $proxy_x_forwarded_proto {
        default $http_x_forwarded_proto;
@@ -67,6 +71,12 @@ http {
        add_header X-Content-Type-Options nosniff always;
        add_header X-XSS-Protection "1; mode=block" always;

+        location ^~ /.well-known/acme-challenge/ {
+            root /app/data/acme-webroot;
+            default_type "text/plain";
+            try_files $uri =404;
+        }
+
        location = /sw.js {
            root /app/html;
            expires off;
@@ -128,7 +138,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/releases(/.*)?$ {
@@ -137,7 +147,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/alerts(/.*)?$ {
@@ -146,7 +156,34 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/alert-rules(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/notification-channels(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/alert-firings(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/rbac(/.*)?$ {
@@ -155,7 +192,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/credentials(/.*)?$ {
@@ -164,7 +201,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -172,6 +209,24 @@ http {
        }

        location ~ ^/snippets(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/vault(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/termix-id(/.*)?$ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
@@ -186,7 +241,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/audit-logs(/.*)?$ {
@@ -195,7 +250,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/terminal(/.*)?$ {
@@ -204,7 +259,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/open-tabs(/.*)?$ {
@@ -213,7 +268,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/user-preferences(/.*)?$ {
@@ -222,7 +277,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/database(/.*)?$ {
@@ -234,7 +289,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -253,7 +308,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -269,7 +324,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/quick-connect {
@@ -281,7 +336,7 @@ http {
            proxy_cache_bypass $http_upgrade;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/host/opkssh-chooser(/.*)?$ {
@@ -320,7 +375,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /session_logs/ {
@@ -329,7 +384,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /tailscale/ {
@@ -338,7 +393,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /ssh/websocket/ {
@@ -377,7 +432,7 @@ http {

            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-Host $http_host;

@@ -397,7 +452,7 @@ http {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/tunnel/ {
@@ -406,7 +461,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /ssh/tunnel/ {
@@ -417,7 +472,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
            proxy_buffering off;
@@ -430,7 +485,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/file_manager/pinned {
@@ -439,7 +494,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/file_manager/shortcuts {
@@ -448,7 +503,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/file_manager/sudo-password {
@@ -457,7 +512,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /ssh/file_manager/ {
@@ -471,7 +526,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -492,7 +547,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -508,7 +563,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /health {
@@ -517,7 +572,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/status(/.*)?$ {
@@ -526,7 +581,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/metrics(/.*)?$ {
@@ -535,7 +590,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
@@ -548,7 +603,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/host-metrics(/.*)?$ {
@@ -557,7 +612,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 600s;
            proxy_send_timeout 600s;
@@ -570,7 +625,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/uptime(/.*)?$ {
@@ -579,7 +634,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/activity(/.*)?$ {
@@ -588,7 +643,25 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/service-links(/.*)?$ {
+            proxy_pass http://127.0.0.1:30006;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/homepage(/.*)?$ {
+            proxy_pass http://127.0.0.1:30012;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ^~ /docker/console/ {
@@ -602,7 +675,7 @@ http {

            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-Host $http_host;

@@ -623,7 +696,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -637,13 +710,34 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
            proxy_read_timeout 300s;
        }

+        location ^~ /serial/websocket/ {
+            proxy_pass http://127.0.0.1:30011/;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+        }
+
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /app/html;
@@ -24,7 +24,11 @@ http {
    client_header_timeout 300s;

    set_real_ip_from 127.0.0.1;
+    set_real_ip_from 10.0.0.0/8;
+    set_real_ip_from 172.16.0.0/12;
+    set_real_ip_from 192.168.0.0/16;
    real_ip_header X-Forwarded-For;
+    real_ip_recursive on;

    map $http_x_forwarded_proto $proxy_x_forwarded_proto {
        default $http_x_forwarded_proto;
@@ -56,6 +60,12 @@ http {
        add_header X-Content-Type-Options nosniff always;
        add_header X-XSS-Protection "1; mode=block" always;

+        location ^~ /.well-known/acme-challenge/ {
+            root /app/data/acme-webroot;
+            default_type "text/plain";
+            try_files $uri =404;
+        }
+
        location = /sw.js {
            root /app/html;
            expires off;
@@ -117,7 +127,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/releases(/.*)?$ {
@@ -126,7 +136,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/alerts(/.*)?$ {
@@ -135,7 +145,34 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/alert-rules(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/notification-channels(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/alert-firings(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/rbac(/.*)?$ {
@@ -144,7 +181,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/credentials(/.*)?$ {
@@ -153,7 +190,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -161,6 +198,24 @@ http {
        }

        location ~ ^/snippets(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/vault(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/termix-id(/.*)?$ {
            proxy_pass http://127.0.0.1:30001;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
@@ -175,7 +230,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_connect_timeout 60s;
            proxy_send_timeout 120s;
            proxy_read_timeout 120s;
@@ -187,7 +242,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/audit-logs(/.*)?$ {
@@ -196,7 +251,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/terminal(/.*)?$ {
@@ -205,7 +260,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/open-tabs(/.*)?$ {
@@ -214,7 +269,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/user-preferences(/.*)?$ {
@@ -223,7 +278,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/database(/.*)?$ {
@@ -235,7 +290,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -254,7 +309,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -270,7 +325,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/quick-connect {
@@ -282,7 +337,7 @@ http {
            proxy_cache_bypass $http_upgrade;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/host/opkssh-chooser(/.*)?$ {
@@ -321,7 +376,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /session_logs/ {
@@ -330,7 +385,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /tailscale/ {
@@ -339,7 +394,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /ssh/websocket/ {
@@ -378,7 +433,7 @@ http {

            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-Host $http_host;

@@ -398,7 +453,7 @@ http {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/tunnel/ {
@@ -407,7 +462,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /ssh/tunnel/ {
@@ -418,7 +473,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
            proxy_buffering off;
@@ -431,7 +486,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/file_manager/pinned {
@@ -440,7 +495,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/file_manager/shortcuts {
@@ -449,7 +504,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /host/file_manager/sudo-password {
@@ -458,7 +513,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /ssh/file_manager/ {
@@ -472,7 +527,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -493,7 +548,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -509,7 +564,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location /health {
@@ -518,7 +573,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/status(/.*)?$ {
@@ -527,7 +582,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/metrics(/.*)?$ {
@@ -536,7 +591,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 60s;
@@ -549,7 +604,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/host-metrics(/.*)?$ {
@@ -558,7 +613,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 600s;
            proxy_send_timeout 600s;
@@ -571,7 +626,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/uptime(/.*)?$ {
@@ -580,7 +635,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ~ ^/activity(/.*)?$ {
@@ -589,7 +644,25 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/service-links(/.*)?$ {
+            proxy_pass http://127.0.0.1:30006;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/homepage(/.*)?$ {
+            proxy_pass http://127.0.0.1:30012;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        location ^~ /docker/console/ {
@@ -603,7 +676,7 @@ http {

            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-Host $http_host;

@@ -624,7 +697,7 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
@@ -638,13 +711,34 @@ http {
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
            proxy_read_timeout 300s;
        }

+        location ^~ /serial/websocket/ {
+            proxy_pass http://127.0.0.1:30011/;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+        }
+
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /app/html;
@@ -28,11 +28,8 @@
    "!dist/icon-mac.png",
    "!public/icon-mac.png",
    "!dist/icon.ico",
-    "!public/icon.ico",
    "!dist/icon.icns",
-    "!public/icon.icns",
-    "!dist/icons/**/*",
-    "!public/icons/**/*"
+    "!public/icon.icns"
  ],
  "extraMetadata": {
    "main": "electron/main.cjs",
@@ -61,6 +58,8 @@
    "artifactName": "termix_windows_${arch}_nsis.${ext}",
    "createDesktopShortcut": true,
    "createStartMenuShortcut": true,
+    "installerIcon": "public/icon.ico",
+    "uninstallerIcon": "public/icon.ico",
    "shortcutName": "Termix",
    "uninstallDisplayName": "Termix"
  },
@@ -130,6 +129,7 @@
    "artifactName": "termix_macos_${arch}_dmg.${ext}",
    "sign": true
  },
+  "afterPack": "build/after-pack.cjs",
  "afterSign": "build/notarize.cjs",
  "mas": {
    "provisioningProfile": "build/Termix_Mac_App_Store.provisionprofile",
@@ -9,6 +9,7 @@ const {
  safeStorage,
  Tray,
  clipboard,
+  nativeImage,
 } = require("electron");
 const path = require("path");
 const fs = require("fs");
@@ -17,9 +18,35 @@ const https = require("https");
 const http = require("http");
 const net = require("net");
 const { URL } = require("url");
-const { fork } = require("child_process");
+const { fork, spawn } = require("child_process");
 const WebSocket = require("ws");

+// Portable mode: if a `.portable` marker exists next to the executable,
+// store all data in a `data` folder beside the exe instead of %APPDATA%.
+(function setupPortableDataDir() {
+  const exeDir = path.dirname(process.execPath);
+  const markerPath = path.join(exeDir, ".portable");
+  const envOverride = process.env.TERMIX_DATA_DIR;
+
+  let portableDataDir = null;
+  if (envOverride) {
+    portableDataDir = envOverride;
+  } else if (app.isPackaged && fs.existsSync(markerPath)) {
+    portableDataDir = path.join(exeDir, "data");
+  }
+
+  if (portableDataDir) {
+    try {
+      if (!fs.existsSync(portableDataDir)) {
+        fs.mkdirSync(portableDataDir, { recursive: true });
+      }
+      app.setPath("userData", portableDataDir);
+    } catch {
+      // Fall back to default userData if we can't create the directory.
+    }
+  }
+})();
+
 const logFile = path.join(app.getPath("userData"), "termix-main.log");
 const electronAuthCookiesPath = path.join(
  app.getPath("userData"),
@@ -476,6 +503,11 @@ if (process.platform === "linux") {
  app.commandLine.appendSwitch("--ozone-platform-hint=auto");

  app.commandLine.appendSwitch("--enable-features=VaapiVideoDecoder");
+
+  // Fix click-coordinate misalignment with fractional display scaling on KDE/Wayland.
+  // Chromium's hit-testing uses unscaled coords while the compositor scales visually,
+  // so forcing scale factor 1 keeps them in sync. See: https://github.com/brave/brave-browser/issues/50028
+  app.commandLine.appendSwitch("--force-device-scale-factor", "1");
 }

 if (process.platform === "win32") {
@@ -497,15 +529,117 @@ let backendProcess = null;
 let backendStartFailed = false;
 let tray = null;
 let isQuitting = false;
+const tempFiles = new Map();
+const externalEditorSessions = new Map();

 const isDev = process.env.NODE_ENV === "development" || !app.isPackaged;
 const appRoot = isDev ? process.cwd() : path.join(__dirname, "..");
+const windowsAppUserModelId = "com.karmaa.termix";
 const electronCacheBuildPath = path.join(
  app.getPath("userData"),
  "client-cache-build.json",
 );
 const termixSessionPartition = "persist:termix";

+function getTempRoot() {
+  const tempRoot = path.join(app.getPath("temp"), "termix");
+  fs.mkdirSync(tempRoot, { recursive: true });
+  return tempRoot;
+}
+
+function sanitizeFileName(fileName) {
+  const baseName = path.basename(String(fileName || "file"));
+  return baseName.replace(/[<>:"/\\|?*\x00-\x1f]/g, "_") || "file";
+}
+
+function decodeFileContent(content, encoding) {
+  if (encoding === "base64") {
+    return Buffer.from(String(content || ""), "base64");
+  }
+  return Buffer.from(String(content || ""), "utf8");
+}
+
+function createManagedTempFile(fileName, content, encoding = "utf8") {
+  const tempId = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const tempDir = fs.mkdtempSync(path.join(getTempRoot(), `${tempId}-`));
+  const filePath = path.join(tempDir, sanitizeFileName(fileName));
+  fs.writeFileSync(filePath, decodeFileContent(content, encoding));
+  tempFiles.set(tempId, { path: filePath, dir: tempDir });
+  return { tempId, path: filePath };
+}
+
+function cleanupManagedTempFile(tempId) {
+  const temp = tempFiles.get(tempId);
+  if (!temp) return;
+  try {
+    fs.rmSync(temp.dir, { recursive: true, force: true });
+  } catch (error) {
+    logToFile("Failed to clean up temporary file:", error.message);
+  }
+  tempFiles.delete(tempId);
+}
+
+function closeExternalEditorSession(editId) {
+  const session = externalEditorSessions.get(editId);
+  if (!session) return;
+  if (session.timer) clearTimeout(session.timer);
+  try {
+    session.watcher.close();
+  } catch {
+    // watcher may already be closed
+  }
+  externalEditorSessions.delete(editId);
+  cleanupManagedTempFile(editId);
+}
+
+function notifyExternalEditorSaved(editId) {
+  const session = externalEditorSessions.get(editId);
+  if (!session || !mainWindow || mainWindow.isDestroyed()) return;
+
+  try {
+    const stat = fs.statSync(session.path);
+    if (stat.mtimeMs === session.lastMtimeMs) return;
+    session.lastMtimeMs = stat.mtimeMs;
+
+    const content = fs.readFileSync(session.path, "utf8");
+    mainWindow.webContents.send("external-editor-saved", {
+      editId,
+      content,
+      encoding: "utf8",
+      path: session.path,
+    });
+  } catch (error) {
+    logToFile("Failed to read external editor file:", error.message);
+  }
+}
+
+function openPathWithEditor(filePath, editorPath) {
+  if (!editorPath) {
+    return shell.openPath(filePath);
+  }
+
+  return new Promise((resolve) => {
+    let settled = false;
+    const child = spawn(editorPath, [filePath], {
+      detached: true,
+      stdio: "ignore",
+    });
+
+    child.once("error", (error) => {
+      if (settled) return;
+      settled = true;
+      resolve(error.message);
+    });
+
+    setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      child.unref();
+      resolve("");
+    }, 500);
+  });
+}
+
 app.on(
  "certificate-error",
  (event, _webContents, url, error, certificate, callback) => {
@@ -659,9 +793,11 @@ function getBackendPaths() {
      backendCwd: backendDir,
    };
  }
-  // fork() does not go through Electron's asar redirector — use the unpacked path
+  // fork() does not go through Electron's asar redirector — use the unpacked path.
+  // On macOS multi-arch builds (mergeASARs: false), electron-builder names the ASAR
+  // app-arm64.asar / app-x64.asar instead of app.asar, so match all variants.
  const unpackedRoot = appRoot.replace(
-    /app\.asar(?!\.unpacked)/,
+    /app(-[a-z0-9]+)?\.asar(?!\.unpacked)/,
    "app.asar.unpacked",
  );
  const backendDir = path.join(unpackedRoot, "dist", "backend", "backend");
@@ -819,7 +955,13 @@ function createTray() {
    // use the unpacked path so the OS sees a real file.
    const publicRoot = isDev
      ? path.join(appRoot, "public")
-      : path.join(appRoot.replace("app.asar", "app.asar.unpacked"), "public");
+      : path.join(
+          appRoot.replace(
+            /app(-[a-z0-9]+)?\.asar(?!\.unpacked)/,
+            "app.asar.unpacked",
+          ),
+          "public",
+        );

    let trayIcon;
    if (process.platform === "darwin") {
@@ -889,7 +1031,11 @@ function createWindow() {
    minWidth: 800,
    minHeight: 600,
    title: "Termix",
-    icon: path.join(appRoot, "public", "icon.png"),
+    icon: path.join(
+      appRoot,
+      "public",
+      process.platform === "win32" ? "icon.ico" : "icon.png",
+    ),
    webPreferences: {
      nodeIntegration: false,
      contextIsolation: true,
@@ -1200,9 +1346,11 @@ ipcMain.handle(
  async (_event, authUrl, callbackPort) => {
    const http = require("http");

-    return new Promise((resolve, reject) => {
+    return new Promise((resolve) => {
+      let timeout;
+      let settled = false;
      const server = http.createServer((req, res) => {
-        const url = new URL(req.url, `http://localhost:${callbackPort}`);
+        const url = new URL(req.url || "/", `http://localhost:${callbackPort}`);
        if (url.pathname === "/oidc-callback") {
          const success = url.searchParams.get("success");
          const error = url.searchParams.get("error");
@@ -1213,27 +1361,54 @@ ipcMain.handle(
            `<html><body><h2>${success === "true" ? "Authentication successful!" : "Authentication failed."}</h2><p>You can close this tab and return to Termix.</p><script>window.close()</script></body></html>`,
          );

-          server.close();
          if (success === "true") {
-            resolve({ success: true, token });
+            finish({ success: true, token });
          } else {
-            resolve({
+            finish({
              success: false,
              error: error || "Authentication failed",
            });
          }
+          return;
+        }
+
+        res.writeHead(404, { "Content-Type": "text/plain" });
+        res.end("Not found");
+      });
+
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        if (timeout) clearTimeout(timeout);
+        try {
+          server.close();
+        } catch {
+          // Server may not have started yet.
+        }
+        resolve(result);
+      };
+
+      const fail = (error) => {
+        finish({
+          success: false,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      };
+
+      server.once("error", fail);
+
+      server.listen(callbackPort, "127.0.0.1", async () => {
+        try {
+          await shell.openExternal(authUrl);
+        } catch (error) {
+          fail(error);
        }
      });

-      server.listen(callbackPort, "127.0.0.1", () => {
-        shell.openExternal(authUrl);
-      });
-
      // Timeout after 5 minutes
-      setTimeout(
+      timeout = setTimeout(
        () => {
-          server.close();
-          reject(new Error("OIDC authentication timed out"));
+          fail(new Error("OIDC authentication timed out"));
        },
        5 * 60 * 1000,
      );
@@ -2469,6 +2644,131 @@ ipcMain.handle("clipboard-write-text", (_event, text) => {

 ipcMain.handle("clipboard-read-text", () => clipboard.readText());

+ipcMain.handle("show-save-dialog", async (_event, options) => {
+  return dialog.showSaveDialog(mainWindow, options || {});
+});
+
+ipcMain.handle("show-open-dialog", async (_event, options) => {
+  return dialog.showOpenDialog(mainWindow, options || {});
+});
+
+ipcMain.handle("create-temp-file", async (_event, fileData) => {
+  try {
+    const result = createManagedTempFile(
+      fileData?.fileName,
+      fileData?.content,
+      fileData?.encoding,
+    );
+    return { success: true, ...result };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("create-temp-folder", async (_event, folderData) => {
+  try {
+    const tempId = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const tempDir = fs.mkdtempSync(path.join(getTempRoot(), `${tempId}-`));
+    const folderPath = path.join(
+      tempDir,
+      sanitizeFileName(folderData?.folderName || "files"),
+    );
+    fs.mkdirSync(folderPath, { recursive: true });
+
+    for (const file of folderData?.files || []) {
+      const relativePath = String(file.relativePath || "")
+        .split(/[\\/]+/)
+        .map(sanitizeFileName)
+        .filter(Boolean)
+        .join(path.sep);
+      if (!relativePath) continue;
+      const targetPath = path.join(folderPath, relativePath);
+      fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+      fs.writeFileSync(
+        targetPath,
+        decodeFileContent(file.content, file.encoding),
+      );
+    }
+
+    tempFiles.set(tempId, { path: folderPath, dir: tempDir });
+    return { success: true, tempId, path: folderPath };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("start-drag-to-desktop", (event, dragData) => {
+  try {
+    const temp = tempFiles.get(dragData?.tempId);
+    if (!temp) return { success: false, error: "Temporary file not found" };
+
+    event.sender.startDrag({
+      file: temp.path,
+      icon: nativeImage.createEmpty(),
+    });
+    return { success: true };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("cleanup-temp-file", (_event, tempId) => {
+  try {
+    cleanupManagedTempFile(tempId);
+    return { success: true };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("open-external-editor", async (_event, fileData) => {
+  try {
+    const result = createManagedTempFile(
+      fileData?.fileName,
+      fileData?.content,
+      fileData?.encoding,
+    );
+    const editId = result.tempId;
+    const stat = fs.statSync(result.path);
+    const watcher = fs.watch(result.path, { persistent: false }, () => {
+      const session = externalEditorSessions.get(editId);
+      if (!session) return;
+      if (session.timer) clearTimeout(session.timer);
+      session.timer = setTimeout(() => notifyExternalEditorSaved(editId), 500);
+    });
+
+    externalEditorSessions.set(editId, {
+      path: result.path,
+      watcher,
+      timer: null,
+      lastMtimeMs: stat.mtimeMs,
+    });
+
+    const editorPath =
+      typeof fileData?.editorPath === "string" && fileData.editorPath.trim()
+        ? fileData.editorPath.trim()
+        : null;
+    const openError = await openPathWithEditor(result.path, editorPath);
+    if (openError) {
+      closeExternalEditorSession(editId);
+      return { success: false, error: openError };
+    }
+
+    return { success: true, editId, path: result.path };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
+ipcMain.handle("close-external-editor", (_event, editId) => {
+  try {
+    closeExternalEditorSession(editId);
+    return { success: true };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+});
+
 ipcMain.handle("test-server-connection", async (event, serverUrl) => {
  try {
    const normalizedServerUrl = serverUrl.replace(/\/$/, "");
@@ -2649,6 +2949,9 @@ app.whenReady().then(async () => {
    "arch:",
    process.arch,
  );
+  if (process.platform === "win32") {
+    app.setAppUserModelId(windowsAppUserModelId);
+  }
  createMenu();
  await clearElectronClientCacheIfBuildChanged();
  await clearElectronJwtCookiesAtStartup();
@@ -2688,6 +2991,12 @@ app.on("before-quit", () => {

 app.on("will-quit", () => {
  console.log("App will quit...");
+  for (const editId of externalEditorSessions.keys()) {
+    closeExternalEditorSession(editId);
+  }
+  for (const tempId of tempFiles.keys()) {
+    cleanupManagedTempFile(tempId);
+  }
  stopAllC2STunnels();
  stopBackendServer();
 });
@@ -46,6 +46,26 @@ contextBridge.exposeInMainWorld("electronAPI", {
  oidcSystemBrowserAuth: (authUrl, callbackPort) =>
    ipcRenderer.invoke("oidc-system-browser-auth", authUrl, callbackPort),

+  openExternalEditor: (fileData) =>
+    ipcRenderer.invoke("open-external-editor", fileData),
+  closeExternalEditor: (editId) =>
+    ipcRenderer.invoke("close-external-editor", editId),
+  onExternalEditorSaved: (callback) => {
+    const listener = (_event, payload) => callback(payload);
+    ipcRenderer.on("external-editor-saved", listener);
+    return () => ipcRenderer.removeListener("external-editor-saved", listener);
+  },
+
+  showSaveDialog: (options) => ipcRenderer.invoke("show-save-dialog", options),
+  showOpenDialog: (options) => ipcRenderer.invoke("show-open-dialog", options),
+  createTempFile: (fileData) =>
+    ipcRenderer.invoke("create-temp-file", fileData),
+  createTempFolder: (folderData) =>
+    ipcRenderer.invoke("create-temp-folder", folderData),
+  startDragToDesktop: (dragData) =>
+    ipcRenderer.invoke("start-drag-to-desktop", dragData),
+  cleanupTempFile: (tempId) => ipcRenderer.invoke("cleanup-temp-file", tempId),
+
  invoke: (channel, ...args) => ipcRenderer.invoke(channel, ...args),
 });

@@ -1,7 +1,7 @@
 {
  "name": "termix",
  "private": true,
-  "version": "2.4.0",
+  "version": "2.5.0",
  "description": "Self-hosted SSH and remote desktop management.",
  "author": "Karmaa",
  "main": "electron/main.cjs",
@@ -12,6 +12,8 @@
  "scripts": {
    "format": "prettier --write .",
    "format:check": "prettier --check .",
+    "biome:check": "biome check biome.json package.json",
+    "biome:fix": "biome check --write biome.json package.json",
    "postinstall": "node scripts/patch-app-builder-lib.cjs && node scripts/patch-guacamole-lite.cjs && node scripts/patch-better-sqlite3.cjs && node scripts/patch-nan.cjs",
    "prebuild": "node scripts/write-electron-build-info.cjs",
    "lint": "eslint .",
@@ -31,7 +33,7 @@
    "preview": "vite preview",
    "electron:dev": "concurrently \"npm run dev\" \"powershell -c \\\"Start-Sleep -Seconds 5\\\" && electron .\"",
    "electron:patch-builder": "node scripts/patch-app-builder-lib.cjs",
-    "electron:rebuild": "electron-rebuild -f -w better-sqlite3",
+    "electron:rebuild": "electron-rebuild -f -w better-sqlite3 -w serialport",
    "build:win-portable": "npm run build && npm run electron:rebuild && npm run electron:patch-builder && electron-builder --win --dir",
    "build:win-installer": "npm run build && npm run electron:rebuild && npm run electron:patch-builder && electron-builder --win --publish=never",
    "build:linux-portable": "npm run build && npm run electron:rebuild && npm run electron:patch-builder && electron-builder --linux --dir",
@@ -41,11 +43,13 @@
    "build:mac-dev": "npm run build && npm run electron:rebuild && npm run electron:patch-builder && electron-builder --mac dir --publish=never"
  },
  "dependencies": {
+    "@simplewebauthn/browser": "^13.3.0",
+    "@simplewebauthn/server": "^13.3.2",
    "@types/ldapjs": "^3.0.6",
-    "axios": "^1.17.0",
+    "axios": "^1.18.0",
    "bcryptjs": "^3.0.3",
-    "better-sqlite3": "^12.9.0",
-    "body-parser": "^2.2.2",
+    "better-sqlite3": "^12.11.1",
+    "body-parser": "^2.3.0",
    "chalk": "^5.6.2",
    "cookie-parser": "^1.4.7",
    "cors": "^2.8.6",
@@ -54,33 +58,38 @@
    "express": "^5.2.1",
    "guacamole-lite": "^1.2.0",
    "jose": "^6.2.2",
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^5.0.0",
    "jsonwebtoken": "^9.0.3",
    "jszip": "^3.10.1",
    "ldapjs": "^3.0.7",
    "motion": "^12.38.0",
-    "multer": "^2.1.1",
-    "nanoid": "^5.1.9",
+    "multer": "^2.2.0",
+    "nanoid": "^5.1.15",
    "qrcode": "^1.5.4",
+    "serialport": "^13.0.0",
    "socks": "^2.8.7",
    "speakeasy": "^2.0.0",
    "ssh2": "^1.17.0",
-    "undici": "^8.4.0",
+    "undici": "^8.5.0",
    "ws": "^8.20.0"
  },
  "devDependencies": {
+    "@biomejs/biome": "2.5.1",
    "@codemirror/autocomplete": "^6.20.3",
    "@codemirror/commands": "^6.10.3",
-    "@codemirror/search": "^6.7.0",
+    "@codemirror/search": "^6.7.1",
    "@codemirror/theme-one-dark": "^6.1.3",
-    "@codemirror/view": "^6.41.1",
+    "@codemirror/view": "^6.43.1",
    "@commitlint/cli": "^21.0.2",
    "@commitlint/config-conventional": "^21.0.2",
    "@deadendjs/swagger-jsdoc": "^8.1.2",
    "@electron/notarize": "^3.1.1",
    "@electron/rebuild": "^4.0.4",
-    "@eslint/js": "^9.0.0",
+    "@eslint/js": "^10.0.1",
    "@fontsource-variable/jetbrains-mono": "^5.2.8",
+    "@fontsource/fira-code": "^5.2.7",
+    "@fontsource/jetbrains-mono": "^5.2.8",
+    "@fontsource/source-code-pro": "^5.2.7",
    "@monaco-editor/react": "^4.7.0",
    "@radix-ui/react-accordion": "^1.2.13",
    "@radix-ui/react-alert-dialog": "^1.1.16",
@@ -91,14 +100,14 @@
    "@radix-ui/react-popover": "^1.1.16",
    "@radix-ui/react-progress": "^1.1.9",
    "@radix-ui/react-scroll-area": "^1.2.11",
-    "@radix-ui/react-select": "^2.2.6",
+    "@radix-ui/react-select": "^2.3.1",
    "@radix-ui/react-separator": "^1.1.9",
-    "@radix-ui/react-slider": "^1.3.6",
-    "@radix-ui/react-slot": "^1.2.4",
-    "@radix-ui/react-switch": "^1.2.6",
+    "@radix-ui/react-slider": "^1.4.1",
+    "@radix-ui/react-slot": "^1.3.0",
+    "@radix-ui/react-switch": "^1.3.1",
    "@radix-ui/react-tabs": "^1.1.14",
    "@radix-ui/react-tooltip": "^1.2.9",
-    "@tailwindcss/vite": "^4.2.4",
+    "@tailwindcss/vite": "^4.3.1",
    "@testing-library/dom": "^10.4.1",
    "@testing-library/jest-dom": "^6.9.1",
    "@testing-library/react": "^16.3.2",
@@ -111,7 +120,7 @@
    "@types/js-yaml": "^4.0.9",
    "@types/jsonwebtoken": "^9.0.10",
    "@types/multer": "^2.1.0",
-    "@types/node": "^25.9.2",
+    "@types/node": "^26.0.0",
    "@types/qrcode": "^1.5.6",
    "@types/react": "^19.2.17",
    "@types/react-dom": "^19.2.3",
@@ -122,8 +131,8 @@
    "@uiw/codemirror-theme-github": "^4.25.9",
    "@uiw/react-codemirror": "^4.25.9",
    "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/coverage-v8": "^4.1.8",
-    "@vitest/ui": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/ui": "^4.1.9",
    "@xterm/addon-clipboard": "^0.2.0",
    "@xterm/addon-fit": "^0.11.0",
    "@xterm/addon-unicode11": "^0.9.0",
@@ -132,13 +141,13 @@
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "cmdk": "^1.1.1",
-    "concurrently": "^9.2.1",
-    "cytoscape": "^3.33.2",
-    "electron": "^42.2.0",
-    "electron-builder": "^26.8.1",
-    "eslint": "^9.0.0",
+    "concurrently": "^10.0.3",
+    "cytoscape": "^3.34.0",
+    "electron": "^42.4.1",
+    "electron-builder": "^26.15.3",
+    "eslint": "^10.5.0",
    "eslint-plugin-react-hooks": "^7.1.1",
-    "eslint-plugin-react-refresh": "^0.5.2",
+    "eslint-plugin-react-refresh": "^0.5.3",
    "eslint-plugin-unused-imports": "^4.4.1",
    "globals": "^17.5.0",
    "guacamole-common-js": "^1.5.0",
@@ -146,15 +155,15 @@
    "i18next": "^26.3.1",
    "i18next-browser-languagedetector": "^8.2.1",
    "jsdom": "^29.1.1",
-    "lint-staged": "^17.0.7",
-    "lucide-react": "^1.11.0",
-    "prettier": "3.8.3",
-    "radix-ui": "^1.4.3",
+    "lint-staged": "^17.0.8",
+    "lucide-react": "^1.20.0",
+    "prettier": "3.8.4",
+    "radix-ui": "^1.6.0",
    "react": "^19.2.7",
    "react-cytoscapejs": "^2.0.0",
    "react-dom": "^19.2.7",
    "react-h5-audio-player": "^3.10.2",
-    "react-hook-form": "^7.73.1",
+    "react-hook-form": "^7.79.0",
    "react-i18next": "^17.0.4",
    "react-icons": "^5.6.0",
    "react-markdown": "^10.1.0",
@@ -163,16 +172,16 @@
    "react-syntax-highlighter": "^16.1.1",
    "react-xtermjs": "^1.0.10",
    "remark-gfm": "^4.0.1",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.2",
    "sonner": "^2.0.7",
    "tailwind-merge": "^3.5.0",
    "tailwindcss": "^4.2.4",
    "tw-animate-css": "^1.4.0",
    "typescript": "~6.0.3",
-    "typescript-eslint": "^8.59.0",
+    "typescript-eslint": "^8.61.1",
    "vite": "^8.0.16",
    "vite-plugin-svgr": "^5.2.0",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
  },
  "lint-staged": {
    "*.{ts,tsx}": [
@@ -1,185 +0,0 @@
-# Host-to-host file transfer
-
-This document describes the host-to-host copy/move feature. It is intended for operators and contributors. Direct host-to-host routing via SSH tunnels is **not implemented**; that is documented under [Future work](#future-work-direct-routing-via-tunnels).
-
-## Overview
-
-Host-to-host transfer copies or moves files from one SSH host to another through the **Termix server** as a relay. The UI lives in **File Manager**: right-click files or folders and choose **Copy to host…** or **Move to host…**.
-
-Compared to copying via your laptop (`scp -3` or `ssh one 'cat …' | ssh two 'cat …'`), Termix keeps the job on the server so transfers continue if you close the browser, and you get integrated progress, cancel, retry, and cleanup.
-
-```mermaid
-flowchart LR
-  Browser[Browser_UI]
-  Termix[Termix_server]
-  Src[Source_host]
-  Dst[Destination_host]
-
-  Browser -->|start_transfer_API| Termix
-  Termix -->|dedicated_SSH_xfer_src| Src
-  Termix -->|dedicated_SSH_xfer_dst| Dst
-  Termix -->|SFTP_read_then_write| Termix
-```
-
-Data for remote-to-remote paths **always passes through the Termix process** (pipelined SFTP buffers, or a tar archive stream). There is no source→destination SSH tunnel for file bytes today.
-
-## Prerequisites
-
-1. **Two hosts** with File Manager enabled, saved in Host Manager.
-2. **Both hosts reachable from the Termix server** on SSH (each host’s jump hosts and SOCKS5 proxy chain apply to the **Termix→host** connection, not host→host).
-3. **File Manager open** on the source host (browse session connected). The destination host should show **Ready** in the transfer dialog; if it shows authentication required, open File Manager on that host once first.
-4. For **multi-file or folder** transfers, pick a **destination directory** (not a file path).
-
-The dialog shows a reminder: _“Both hosts must be reachable from the Termix server. Direct host-to-host routing is not supported.”_
-
-## Using the UI
-
-### Start a transfer
-
-1. Open File Manager on the **source** host.
-2. Select one or more files or folders.
-3. Right-click → **Copy to host…** or **Move to host…** (sidebar tree supports the same context menu).
-4. In the dialog:
-   - Choose **destination host** (other connected file-manager hosts).
-   - Set **destination path** (type a path or use **Browse destination folders**).
-   - Optionally pick a **recent destination** (collapsed by default).
-   - For multi-item transfers, choose **transfer method** (Auto / Tar archive / Per-file SFTP); a preview explains what Auto will pick.
-   - Pin folders with **Add to shortcuts** (per-destination host; uses normal file-manager shortcuts, not a separate favourites list).
-5. Confirm **Copy** or **Move**.
-
-### During transfer
-
- A **progress toast** shows phase (compressing, transferring, extracting), bytes, speed, and **Cancel**.
- **Transfer monitor** (desktop, when authenticated) picks up active transfers started in another tab or window.
- Large **single files** use segmented SFTP (256 MiB segments) with **2 parallel lanes** by default (separate dedicated SSH session pairs per lane). The toast can show total speed and lane count when multiple lanes are active.
-
-### After completion or failure
-
-| Outcome       | What happens                                                                                                     |
-| ------------- | ---------------------------------------------------------------------------------------------------------------- |
-| **Success**   | Toast success; destination path saved to **recent destinations** for that source host; file manager can refresh. |
-| **Partial**   | Some paths failed; toast lists failed paths; source may be kept on move.                                         |
-| **Error**     | Toast with **Retry** when partial data on destination allows resume.                                             |
-| **Cancelled** | Toast with optional **Clean up destination** to remove partial files.                                            |
-
-**Move** deletes source files only after a successful full transfer (same as copy, then source delete). Cancelled or partial moves may leave files on both sides.
-
-### Metrics
-
-On success, expanded timing details can include: prepare destination, compress (tar), per-hop throughput (source→server, server→dest), extract, source delete, total duration.
-
-## Transfer methods
-
-| Method                   | When used                                                                           | Behavior                                                                                                     |
-| ------------------------ | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
-| **Stream (single file)** | Exactly one file, copy or move                                                      | Pipelined SFTP read on source → write on destination; segmented above 32 MiB; parallel lanes for throughput. |
-| **Tar archive**          | Multi-file/folder when Auto or user selects Tar, and both sides are Unix with `tar` | `tar -czf` on source → one archive streamed through Termix → `tar -xzf` on destination.                      |
-| **Per-file SFTP**        | Windows involved, tar unavailable, or Auto chooses it                               | Each file copied sequentially over SFTP through Termix.                                                      |
-
-**Auto** heuristics (see `src/backend/ssh/transfer-routing.ts`) consider file count, total size, largest file, and compressibility (e.g. many small files → tar; large incompressible sets → per-file SFTP).
-
-**Method preview** is locked for the current source path set until you change Auto/Tar/Per-file preference, so changing only the destination host does not re-scan the source.
-
-## Architecture (implementation)
-
-| Component                                                                                                                 | Role                                                                         |
-| ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
-| [`src/backend/ssh/host-transfer.ts`](../src/backend/ssh/host-transfer.ts)                                                 | Transfer engine: sessions, SFTP pipeline, tar path, retry, cancel, progress. |
-| [`src/backend/ssh/file-manager.ts`](../src/backend/ssh/file-manager.ts)                                                   | HTTP routes, `openDedicatedTransferSession`, jump/SOCKS connect.             |
-| [`src/backend/ssh/transfer-routing.ts`](../src/backend/ssh/transfer-routing.ts)                                           | Tar vs per-file SFTP selection.                                              |
-| [`src/backend/ssh/transfer-paths.ts`](../src/backend/ssh/transfer-paths.ts)                                               | Path normalization (Unix/Windows).                                           |
-| [`src/ui/.../TransferToHostDialog.tsx`](../src/ui/desktop/apps/features/file-manager/components/TransferToHostDialog.tsx) | Transfer dialog.                                                             |
-| [`src/ui/.../transferProgressMonitor.tsx`](../src/ui/desktop/apps/features/file-manager/transferProgressMonitor.tsx)      | Toasts, cancel, retry, cleanup.                                              |
-| [`src/ui/.../TransferMonitor.tsx`](../src/ui/desktop/apps/features/file-manager/TransferMonitor.tsx)                      | Global active-transfer polling.                                              |
-
-**Sessions:** Browse sessions identify hosts. Each transfer opens **dedicated** SSH sessions (`xfer:{transferId}:src` / `:dst`) so browsing and transfers do not share channels. Parallel lanes add `xfer:{transferId}:src:pN` / `:dst:pN`.
-
-**Special case:** If the destination host is the **same machine as Termix** (local SSH endpoint), writes use the local filesystem via `fastGet` instead of dest SFTP; data still originates from the remote source through Termix.
-
-**Persistence:** Recent destinations are stored in `transfer_recent` (per user, per source host). Folder shortcuts use `file_manager_shortcuts` on the destination host.
-
-## HTTP API (file manager service)
-
-| Endpoint                                                 | Purpose                                                                                                                                                                    |
-| -------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `POST /ssh/file_manager/ssh/transferMethodPreview`       | Scan source; return resolved tar vs item_sftp and reason.                                                                                                                  |
-| `POST /ssh/file_manager/ssh/transferToHost`              | Start transfer; body includes `sourceSessionId`, `destSessionId`, `sourcePaths`, `destPath`, `move`, `methodPreference`, optional `parallelSegmentCount` (1–8, default 2). |
-| `GET /ssh/file_manager/ssh/transferStatus/:transferId`   | Poll progress.                                                                                                                                                             |
-| `GET /ssh/file_manager/ssh/activeTransfers`              | List running transfers for user.                                                                                                                                           |
-| `POST /ssh/file_manager/ssh/transferCancel/:transferId`  | Request cancel.                                                                                                                                                            |
-| `POST /ssh/file_manager/ssh/transferCleanup/:transferId` | Remove partial destination artifacts after cancel/failure.                                                                                                                 |
-| `POST /ssh/file_manager/ssh/transferRetry/:transferId`   | Retry with same snapshot (resume when possible).                                                                                                                           |
-
-Database (main API): `GET/POST /host/transfer/recent` for recent destinations.
-
-## Reliability features
-
- **Resume:** Destination file size is probed; SFTP write opens with resume when a partial file exists (per segment on large files).
- **Retry:** Reconnects dedicated sessions; segment-level and full-copy retries with backoff; fresh SSH pairs after repeated failures (lane reset).
- **Stall detection:** ~45 s without progress on a segment; hung transfer/reconnect probing on status polls.
- **Cancel:** Aborts in-flight SFTP; user can clean up destination paths that were created or partially written.
- **Overlap guard:** Refuses transfer when source and destination paths overlap in a destructive way.
-
-## Limitations
-
-1. **No direct host-to-host data path** — Termix must reach **both** hosts independently (with each host’s jump/proxy settings).
-2. **Not the same as S2S SSH tunnels** — Tunnels in Host Manager forward TCP ports; they do not carry file-manager transfers today.
-3. **Throughput** — Remote-to-remote speed is bounded by Termix CPU/RAM and min(Termix↔source, Termix↔dest) links; very large files on a small Termix box may be slower than `scp -3` from a powerful desktop.
-4. **Parallel lanes** — Writes are out of order on disk; fine for copy, not for playing media from a partially written file. Default is 2 lanes; UI may not expose lane count (API default applies).
-5. **Tar** — Requires `tar` on both Unix hosts; temporary archive under `/tmp` on source during transfer.
-6. **Windows** — Tar path disabled; per-file SFTP only for Windows endpoints.
-7. **Jump hosts on S2S tunnels** — Server-to-server **tunnel** connect does not use jump hosts; only transfer/browse SSH does. A host reachable only via jump may work for transfer but not as an S2S tunnel source until tunnel code is aligned.
-
-## Troubleshooting
-
-| Symptom                               | Things to check                                                                                            |
-| ------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
-| No destination hosts listed           | Open File Manager on another host; ensure host has File Manager enabled.                                   |
-| Destination “Authentication required” | Connect File Manager on that host once in this session.                                                    |
-| Transfer fails immediately            | SSH from Termix to both hosts (firewall, jump host, SOCKS5, credentials).                                  |
-| Slow speed                            | Termix link to slower side; try off-peak; for single huge files, parallel lanes help if CPU/network allow. |
-| Stuck progress                        | Wait for stall/reconnect; cancel and retry; check server logs for `host_transfer` / `transfer_ssh_*`.      |
-| Partial files after cancel            | Use **Clean up destination** in the toast.                                                                 |
-| 28 GB / 25 GB style progress          | Usually parallel progress accounting; status polls use destination size probes.                            |
-
-## Comparison to manual `scp` between remotes
-
-See [Unix & Linux: scp from one remote server to another](https://unix.stackexchange.com/questions/85292/scp-from-one-remote-server-to-another-remote-server). Naive `scp one:file two:file` runs **from the first host** and fails unless that host can SSH to the second. `scp -3` relays through your workstation. **Termix relay** is analogous to `scp -3` through the **Termix server**, with richer lifecycle management, not analogous to direct `ssh source 'scp … dest'`.
-
---
-
-## Future work: direct routing via tunnels
-
-The following are **planned / discussed** enhancements, not shipped in the current build. They build on existing **S2S SSH tunnels** (`src/backend/ssh/tunnel.ts`), which already connect **source → endpoint** using `forwardOut` from the source host to the endpoint’s SSH port.
-
-### Why tunnels matter
-
-Many homelabs have a destination that is **only reachable from another host** (e.g. NAS on LAN behind a Pi), while Termix runs elsewhere. Today that destination cannot receive a dedicated `xfer:dst` session from Termix even if an S2S tunnel from Pi → NAS is configured and working.
-
-### Possible routes (future)
-
-| Route                                   | Termix SSH legs | Data path                   | Benefit vs today                                                                         |
-| --------------------------------------- | --------------- | --------------------------- | ---------------------------------------------------------------------------------------- |
-| **Relay (current)**                     | 2               | Termix buffers SFTP         | Works when both hosts reachable from Termix.                                             |
-| **Tunnel-bridged SFTP**                 | 1 (+ bridge)    | Still through Termix memory | Dest reached via source `forwardOut`; fixes reachability; reuses most of current engine. |
-| **Direct remote (rsync/scp on source)** | 1 (control)     | **Source → dest** bytes     | Best throughput; Termix orchestrates `rsync`/`scp` on source when forward + tools allow. |
-
-### Integration ideas (not implemented)
-
-1. **`transfer-bridge` module** — Shared `forwardOut` probe and `connectDestThroughSource` (extracted from tunnel code); lookup matching `tunnel_connections` on the source host record.
-2. **Route resolver** — Auto-select relay vs bridged vs direct; expose route in method preview (“via Termix” vs “direct host-to-host”).
-3. **Reuse active S2S tunnel** — If Host Manager tunnel source→dest is already connected, reuse `endpointClient` instead of opening a second bridge.
-4. **Jump hosts on S2S tunnel source** — Align tunnel connect with file-manager jump chains so tunnel and transfer eligibility match.
-5. **Fallback** — Always fall back to current relay when probe or remote `rsync` fails (Windows, missing tools, forwarding denied).
-
-### What would be preserved
-
-Cancel, partial cleanup, retry/resume (rsync `--partial` on direct path; existing SFTP segment resume on relay/bridged), dedicated sessions, transfer monitor, recent destinations, folder shortcuts, and tar/per-file method selection (with direct-path variants for multi-file).
-
-### References
-
- Internal plan: `.cursor/plans/host-to-host_direct_transfer_*.plan.md` (if present in your checkout).
- Tunnel implementation: [`src/backend/ssh/tunnel.ts`](../src/backend/ssh/tunnel.ts) — `connectEndpointThroughSource`, `establishManagedS2STunnel`.
- Transfer engine: [`src/backend/ssh/host-transfer.ts`](../src/backend/ssh/host-transfer.ts).
-
---
@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix مجاني ومفتوح المصدر. إذا وجدته مفيدًا، فكّر في [التبرع](https://donate.termix.site/) للمساعدة في تغطية تكاليف الخادم ووقت التطوير.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix هي منصة مفتوحة المصدر ومجانية للأبد وذا
 <tr>
 <td width="50%" valign="top">

-**إدارة Docker:**
-تشغيل وإيقاف وتعليق وحذف الحاويات. عرض إحصائيات الحاويات. التحكم في الحاوية باستخدام طرفية docker exec. لم يُصمم ليحل محل Portainer أو Dockge بل لإدارة حاوياتك ببساطة مقارنة بإنشائها.
+**إدارة Docker و Podman:**
+تشغيل وإيقاف وتعليق وحذف الحاويات. عرض إحصائيات الحاويات. التحكم في الحاوية باستخدام طرفية docker exec. يدعم كلاً من Docker و Podman كبيئة تشغيل للحاويات. لم يُصمم ليحل محل Portainer أو Dockge بل لإدارة حاوياتك ببساطة مقارنة بإنشائها.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix هي منصة مفتوحة المصدر ومجانية للأبد وذا
 <tr>
 <td width="50%" valign="top">

+**تكامل Tailscale:**
+عرض أجهزة شبكتك من Tailscale لإضافتها بسرعة كمضيفات، والاتصال عبر Tailscale SSH كطريقة مصادقة، مما يتيح لقوائم تحكم الوصول في Tailscale التعامل مع التفويض دون الحاجة لتخزين بيانات اعتماد.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 إنشاء الأدوار ومشاركة المضيفات عبر المستخدمين/الأدوار.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**الاتصالات التسلسلية:**
+الاتصال بالأجهزة التسلسلية (أجهزة التوجيه والمفاتيح والمتحكمات الدقيقة وغيرها) مباشرة من المتصفح أو تطبيق سطح المكتب. ضبط معدل نقل البيانات وبتات البيانات وبتات التوقف والتكافؤ. يستخدم Web Serial API في المتصفحات المدعومة أو خلفية أصلية في تطبيق Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**التنبيهات:**
+ضبط قواعد تنبيه قائمة على الحدود لمقاييس المضيف (المعالج والذاكرة والقرص وغيرها) والحصول على إشعارات عبر ntfy أو webhooks عند إطلاقها. عرض التنبيهات النشطة والمحلولة في سجل التاريخ.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**الصفحة الرئيسية:**
+صفحة رئيسية قابلة للتخصيص بالكامل مع شبكة أدوات قابلة للسحب والإفلات. أضف أدوات لحالة المضيف وروابط الخدمات والساعات والملاحظات وخلاصات RSS والطقس وحاويات Docker ومخططات مقاييس المضيف والطرفيات المضمنة والإطارات المضمنة وأكثر.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## التبرع
+
+Termix مجاني ومفتوح المصدر. إذا وجدته مفيدًا، فكّر في [التبرع](https://donate.termix.site/) للمساعدة في تغطية تكاليف الخادم ووقت التطوير.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## لقطات الشاشة

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>قد تكون بعض مقاطع الفيديو والصور قديمة أو قد لا تعرض الميزات بشكل مثالي.</sub>
@@ -305,7 +352,7 @@ networks:

 ## الميزات المخططة

-راجع [المشاريع](https://github.com/orgs/Termix-SSH/projects/2) لعرض جميع الميزات المخططة. إذا كنت تتطلع للمساهمة، راجع [المساهمة](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+راجع [المشاريع](https://github.com/orgs/Termix-SSH/projects/5) لعرض جميع الميزات المخططة. إذا كنت تتطلع للمساهمة، راجع [المساهمة](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix 免费且开源。如果您觉得它有用，请考虑[捐赠](https://donate.termix.site/)以帮助支付服务器费用和开发时间。
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix 是一个开源、永久免费、自托管的一体化服务器管理平
 <tr>
 <td width="50%" valign="top">

-**Docker 管理:**
-启动、停止、暂停、移除容器。查看容器统计信息。通过 docker exec 终端控制容器。它的初衷不是取代 Portainer 或 Dockge，而是为了比直接创建容器更简单地管理它们。
+**Docker 和 Podman 管理:**
+启动、停止、暂停、移除容器。查看容器统计信息。通过 docker exec 终端控制容器。同时支持 Docker 和 Podman 作为容器运行时。它的初衷不是取代 Portainer 或 Dockge，而是为了比直接创建容器更简单地管理它们。

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix 是一个开源、永久免费、自托管的一体化服务器管理平
 <tr>
 <td width="50%" valign="top">

+**Tailscale 集成:**
+列出您 Tailscale 网络中的设备以快速添加为主机，并使用 Tailscale SSH 作为身份验证方式，让您的 Tailscale ACL 处理授权而无需存储凭据。
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 创建角色并在用户/角色之间共享主机。

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**串口连接:**
+直接从浏览器或桌面应用连接到串口设备（路由器、交换机、微控制器等）。配置波特率、数据位、停止位和奇偶校验。在支持的浏览器中使用 Web Serial API，或在 Electron 应用中使用原生后端。
+
+</td>
+<td width="50%" valign="top">
+
+**告警:**
+为主机指标（CPU、内存、磁盘等）设置基于阈值的告警规则，并通过 ntfy 或 webhook 接收触发通知。在历史日志中查看触发和已解决的告警。
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**主页:**
+具有拖放小组件网格的完全可定制主页。添加主机状态、服务链接、时钟、笔记、RSS 订阅、天气、Docker 容器、主机指标图表、嵌入式终端、iframe 等小组件。
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## 捐赠
+
+Termix 免费且开源。如果您觉得它有用，请考虑[捐赠](https://donate.termix.site/)以帮助支付服务器费用和开发时间。
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## 展示

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>某些视频和图像可能已过时，或者可能无法完美展示功能。</sub>
@@ -305,7 +352,7 @@ networks:

 ## 计划功能

-查看 [Projects](https://github.com/orgs/Termix-SSH/projects/2) 了解所有计划功能。如果您想贡献代码，请参阅 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)。
+查看 [Projects](https://github.com/orgs/Termix-SSH/projects/5) 了解所有计划功能。如果您想贡献代码，请参阅 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)。

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix ist kostenlos und Open Source. Wenn Sie es nützlich finden, erwägen Sie eine [Spende](https://donate.termix.site/), um Serverkosten und Entwicklungszeit zu decken.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Verwalten Sie Dateien direkt auf Remote-Servern mit Unterstutzung fur das Anzeig
 <tr>
 <td width="50%" valign="top">

-**Docker-Verwaltung:**
-Container starten, stoppen, pausieren, entfernen. Container-Statistiken anzeigen. Container uber Docker-Exec-Terminal steuern. Es wurde nicht entwickelt, um Portainer oder Dockge zu ersetzen, sondern um Ihre Container einfach zu verwalten, anstatt sie zu erstellen.
+**Docker- und Podman-Verwaltung:**
+Container starten, stoppen, pausieren, entfernen. Container-Statistiken anzeigen. Container uber Docker-Exec-Terminal steuern. Unterstutzt sowohl Docker als auch Podman als Container-Laufzeitumgebung. Es wurde nicht entwickelt, um Portainer oder Dockge zu ersetzen, sondern um Ihre Container einfach zu verwalten, anstatt sie zu erstellen.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Sichere Benutzerverwaltung mit Admin-Kontrollen und OIDC-/LDAP-/SSO-Unterstutzun
 <tr>
 <td width="50%" valign="top">

+**Tailscale-Integration:**
+Gerate aus Ihrem Tailnet auflisten, um sie schnell als Hosts hinzuzufugen, und mit Tailscale SSH als Authentifizierungsmethode verbinden, sodass Ihre Tailnet-ACLs die Autorisierung ubernehmen, ohne Anmeldedaten speichern zu mussen.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Rollen erstellen und Hosts uber Benutzer/Rollen teilen.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Serielle Verbindungen:**
+Verbinden Sie sich direkt vom Browser oder der Desktop-App aus mit seriellen Geraten (Router, Switches, Mikrocontroller usw.). Konfigurieren Sie Baudrate, Datenbits, Stoppbits und Paritat. Verwendet die Web Serial API in unterstutzten Browsern oder ein natives Backend in der Electron-App.
+
+</td>
+<td width="50%" valign="top">
+
+**Warnmeldungen:**
+Legen Sie schwellenwertbasierte Warnregeln fur Host-Metriken (CPU, Arbeitsspeicher, Festplatte usw.) fest und erhalten Sie Benachrichtigungen uber ntfy oder Webhooks, wenn diese ausgelost werden. Zeigen Sie ausgeloste und aufgeloste Warnmeldungen in einem Verlaufsprotokoll an.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Startseite:**
+Eine vollstandig anpassbare Startseite mit einem Drag-and-Drop-Widget-Raster. Fugen Sie Widgets fur Hoststatus, Service-Links, Uhren, Notizen, RSS-Feeds, Wetter, Docker-Container, Host-Metrik-Diagramme, eingebettete Terminals, iFrames und mehr hinzu.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Spenden
+
+Termix ist kostenlos und Open Source. Wenn Sie es nützlich finden, erwägen Sie eine [Spende](https://donate.termix.site/), um Serverkosten und Entwicklungszeit zu decken.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Screenshots

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Einige Videos und Bilder konnen veraltet sein oder Funktionen moglicherweise nicht perfekt darstellen.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Geplante Funktionen

-Siehe [Projekte](https://github.com/orgs/Termix-SSH/projects/2) fur alle geplanten Funktionen. Wenn Sie beitragen mochten, siehe [Mitwirken](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Siehe [Projekte](https://github.com/orgs/Termix-SSH/projects/5) fur alle geplanten Funktionen. Wenn Sie beitragen mochten, siehe [Mitwirken](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix es gratuito y de código abierto. Si lo encuentras útil, considera [donar](https://donate.termix.site/) para ayudar a cubrir los costos del servidor y el tiempo de desarrollo.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Gestione archivos directamente en servidores remotos con soporte para visualizar
 <tr>
 <td width="50%" valign="top">

-**Gestion de Docker:**
-Inicie, detenga, pause, elimine contenedores. Vea estadisticas de contenedores. Controle contenedores usando el terminal docker exec. No fue creado para reemplazar Portainer o Dockge, sino para simplemente gestionar sus contenedores en lugar de crearlos.
+**Gestion de Docker y Podman:**
+Inicie, detenga, pause, elimine contenedores. Vea estadisticas de contenedores. Controle contenedores usando el terminal docker exec. Compatible con Docker y Podman como entorno de ejecucion de contenedores. No fue creado para reemplazar Portainer o Dockge, sino para simplemente gestionar sus contenedores en lugar de crearlos.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Gestion segura de usuarios con controles de administrador y soporte para OIDC/LD
 <tr>
 <td width="50%" valign="top">

+**Integracion con Tailscale:**
+Liste dispositivos de su red Tailscale para agregarlos rapidamente como hosts y conectese usando Tailscale SSH como metodo de autenticacion, permitiendo que las ACL de Tailscale gestionen la autorizacion sin almacenar credenciales.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Cree roles y comparta hosts entre usuarios/roles.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Conexiones Serie:**
+Conectese a dispositivos serie (routers, switches, microcontroladores, etc.) directamente desde el navegador o la aplicacion de escritorio. Configure la tasa de baudios, bits de datos, bits de parada y paridad. Utiliza la Web Serial API en navegadores compatibles o un backend nativo en la aplicacion Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Alertas:**
+Configure reglas de alerta basadas en umbrales para metricas del host (CPU, memoria, disco, etc.) y reciba notificaciones a traves de ntfy o webhooks cuando se activen. Vea las alertas activas y resueltas en un historial de registros.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Pagina de Inicio:**
+Una pagina de inicio completamente personalizable con una cuadricula de widgets de arrastrar y soltar. Agregue widgets para estado del host, enlaces de servicios, relojes, notas, feeds RSS, clima, contenedores Docker, graficos de metricas del host, terminales integrados, iframes y mas.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Donar
+
+Termix es gratuito y de código abierto. Si lo encuentras útil, considera [donar](https://donate.termix.site/) para ayudar a cubrir los costos del servidor y el tiempo de desarrollo.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Capturas de Pantalla

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Algunos videos e imagenes pueden estar desactualizados o no mostrar perfectamente las caracteristicas.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Caracteristicas Planeadas

-Consulte [Proyectos](https://github.com/orgs/Termix-SSH/projects/2) para todas las caracteristicas planeadas. Si desea contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Consulte [Proyectos](https://github.com/orgs/Termix-SSH/projects/5) para todas las caracteristicas planeadas. Si desea contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix est gratuit et open source. Si vous le trouvez utile, pensez à [faire un don](https://donate.termix.site/) pour aider à couvrir les coûts de serveur et le temps de développement.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Gerez les fichiers directement sur les serveurs distants avec support de la visu
 <tr>
 <td width="50%" valign="top">

-**Gestion Docker:**
-Demarrez, arretez, mettez en pause, supprimez des conteneurs. Consultez les statistiques des conteneurs. Controlez les conteneurs via le terminal docker exec. Non concu pour remplacer Portainer ou Dockge, mais plutot pour gerer simplement vos conteneurs plutot que de les creer.
+**Gestion Docker et Podman:**
+Demarrez, arretez, mettez en pause, supprimez des conteneurs. Consultez les statistiques des conteneurs. Controlez les conteneurs via le terminal docker exec. Compatible avec Docker et Podman comme environnement d'execution de conteneurs. Non concu pour remplacer Portainer ou Dockge, mais plutot pour gerer simplement vos conteneurs plutot que de les creer.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Gestion securisee des utilisateurs avec controles administrateur et support OIDC
 <tr>
 <td width="50%" valign="top">

+**Integration Tailscale:**
+Listez les appareils de votre reseau Tailscale pour les ajouter rapidement comme hotes, et connectez-vous en utilisant Tailscale SSH comme methode d'authentification, laissant les ACL de votre reseau gerer l'autorisation sans stocker de credentials.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Creez des roles et partagez des hotes entre utilisateurs/roles.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Connexions Serie:**
+Connectez-vous a des appareils serie (routeurs, commutateurs, microcontroleurs, etc.) directement depuis le navigateur ou l'application bureau. Configurez le debit en bauds, les bits de donnees, les bits d'arret et la parite. Utilise l'API Web Serial dans les navigateurs compatibles ou un backend natif dans l'application Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Alertes:**
+Definissez des regles d'alerte basees sur des seuils pour les metriques d'hote (CPU, memoire, disque, etc.) et recevez des notifications via ntfy ou webhooks lorsqu'elles se declenchent. Consultez les alertes actives et resolues dans un journal d'historique.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Page d'accueil:**
+Une page d'accueil entierement personnalisable avec une grille de widgets glisser-deposer. Ajoutez des widgets pour l'etat des hotes, les liens de services, les horloges, les notes, les flux RSS, la meteo, les conteneurs Docker, les graphiques de metriques d'hote, les terminaux integres, les iframes et plus encore.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Faire un don
+
+Termix est gratuit et open source. Si vous le trouvez utile, pensez à [faire un don](https://donate.termix.site/) pour aider à couvrir les coûts de serveur et le temps de développement.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Captures d'ecran

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Certaines videos et images peuvent etre obsoletes ou ne pas presenter parfaitement les fonctionnalites.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Fonctionnalites prevues

-Consultez les [Projects](https://github.com/orgs/Termix-SSH/projects/2) pour toutes les fonctionnalites prevues. Si vous souhaitez contribuer, consultez [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Consultez les [Projects](https://github.com/orgs/Termix-SSH/projects/5) pour toutes les fonctionnalites prevues. Si vous souhaitez contribuer, consultez [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix मुफ़्त और ओपन सोर्स है। यदि आपको यह उपयोगी लगता है, तो सर्वर लागत और विकास समय में मदद के लिए [दान करें](https://donate.termix.site/)।
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix एक ओपन-सोर्स, हमेशा के लिए मु
 <tr>
 <td width="50%" valign="top">

-**Docker प्रबंधन:**
-कंटेनर शुरू, बंद, पॉज़, हटाएँ। कंटेनर स्टैट्स देखें। docker exec टर्मिनल का उपयोग करके कंटेनर को नियंत्रित करें। इसे Portainer या Dockge की जगह लेने के लिए नहीं बनाया गया बल्कि कंटेनर बनाने की तुलना में उन्हें सरलता से प्रबंधित करने के लिए बनाया गया है।
+**Docker और Podman प्रबंधन:**
+कंटेनर शुरू, बंद, पॉज़, हटाएँ। कंटेनर स्टैट्स देखें। docker exec टर्मिनल का उपयोग करके कंटेनर को नियंत्रित करें। Docker और Podman दोनों को कंटेनर रनटाइम के रूप में सपोर्ट करता है। इसे Portainer या Dockge की जगह लेने के लिए नहीं बनाया गया बल्कि कंटेनर बनाने की तुलना में उन्हें सरलता से प्रबंधित करने के लिए बनाया गया है।

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix एक ओपन-सोर्स, हमेशा के लिए मु
 <tr>
 <td width="50%" valign="top">

+**Tailscale एकीकरण:**
+अपने Tailscale नेटवर्क के डिवाइस सूचीबद्ध करें ताकि उन्हें जल्दी से होस्ट के रूप में जोड़ा जा सके, और Tailscale SSH को प्रमाणीकरण विधि के रूप में उपयोग करके कनेक्ट करें, जिससे आपके Tailscale ACL क्रेडेंशियल संग्रहीत किए बिना प्राधिकरण संभाल सकें।
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 भूमिकाएँ बनाएँ और उपयोगकर्ताओं/भूमिकाओं में होस्ट साझा करें।

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**सीरियल कनेक्शन:**
+सीरियल डिवाइस (राउटर, स्विच, माइक्रोकंट्रोलर आदि) से सीधे ब्राउज़र या डेस्कटॉप ऐप से कनेक्ट करें। बॉड रेट, डेटा बिट्स, स्टॉप बिट्स और पैरिटी कॉन्फ़िगर करें। समर्थित ब्राउज़र में Web Serial API या Electron ऐप में नेटिव बैकएंड का उपयोग करता है।
+
+</td>
+<td width="50%" valign="top">
+
+**अलर्ट:**
+होस्ट मेट्रिक्स (CPU, मेमोरी, डिस्क आदि) पर थ्रेशोल्ड-आधारित अलर्ट नियम सेट करें और जब वे ट्रिगर हों तो ntfy या webhooks के माध्यम से सूचना पाएँ। इतिहास लॉग में सक्रिय और हल किए गए अलर्ट देखें।
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**होमपेज:**
+ड्रैग-एंड-ड्रॉप विजेट ग्रिड के साथ पूरी तरह से कस्टमाइज़ करने योग्य होमपेज। होस्ट स्टेटस, सर्विस लिंक, घड़ियाँ, नोट्स, RSS फ़ीड, मौसम, Docker कंटेनर, होस्ट मेट्रिक्स चार्ट, एम्बेडेड टर्मिनल, iframes और अन्य के लिए विजेट जोड़ें।
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## दान करें
+
+Termix मुफ़्त और ओपन सोर्स है। यदि आपको यह उपयोगी लगता है, तो सर्वर लागत और विकास समय में मदद के लिए [दान करें](https://donate.termix.site/)।
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## स्क्रीनशॉट

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>कुछ वीडियो और छवियाँ पुरानी हो सकती हैं या विशेषताओं को पूरी तरह से प्रदर्शित नहीं कर सकती हैं।</sub>
@@ -305,7 +352,7 @@ networks:

 ## नियोजित विशेषताएँ

-सभी नियोजित विशेषताओं के लिए [प्रोजेक्ट्स](https://github.com/orgs/Termix-SSH/projects/2) देखें। यदि आप योगदान देना चाहते हैं, तो [योगदान](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) देखें।
+सभी नियोजित विशेषताओं के लिए [प्रोजेक्ट्स](https://github.com/orgs/Termix-SSH/projects/5) देखें। यदि आप योगदान देना चाहते हैं, तो [योगदान](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) देखें।

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix è gratuito e open source. Se lo trovi utile, considera di [donare](https://donate.termix.site/) per aiutare a coprire i costi del server e il tempo di sviluppo.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Gestisci i file direttamente sui server remoti con supporto per la visualizzazio
 <tr>
 <td width="50%" valign="top">

-**Gestione Docker:**
-Avvia, ferma, metti in pausa, rimuovi container. Visualizza le statistiche dei container. Controlla i container tramite terminale docker exec. Non e stato creato per sostituire Portainer o Dockge, ma piuttosto per gestire semplicemente i tuoi container rispetto alla loro creazione.
+**Gestione Docker e Podman:**
+Avvia, ferma, metti in pausa, rimuovi container. Visualizza le statistiche dei container. Controlla i container tramite terminale docker exec. Supporta sia Docker che Podman come runtime dei container. Non e stato creato per sostituire Portainer o Dockge, ma piuttosto per gestire semplicemente i tuoi container rispetto alla loro creazione.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Gestione utenti sicura con controlli amministrativi e supporto OIDC/LDAP/SSO (co
 <tr>
 <td width="50%" valign="top">

+**Integrazione Tailscale:**
+Elenca i dispositivi della tua rete Tailscale per aggiungerli rapidamente come host, e connettiti utilizzando Tailscale SSH come metodo di autenticazione, lasciando che le ACL della tua rete gestiscano l'autorizzazione senza memorizzare credenziali.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Crea ruoli e condividi host tra utenti/ruoli.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Connessioni Seriali:**
+Connettiti a dispositivi seriali (router, switch, microcontrollori, ecc.) direttamente dal browser o dall'app desktop. Configura baud rate, bit di dati, bit di stop e parita. Utilizza la Web Serial API nei browser supportati o un backend nativo nell'app Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Avvisi:**
+Imposta regole di avviso basate su soglie per le metriche dell'host (CPU, memoria, disco, ecc.) e ricevi notifiche tramite ntfy o webhook quando si attivano. Visualizza gli avvisi attivi e risolti in un registro storico.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Homepage:**
+Una homepage completamente personalizzabile con una griglia di widget drag-and-drop. Aggiungi widget per lo stato dell'host, link ai servizi, orologi, note, feed RSS, meteo, container Docker, grafici delle metriche dell'host, terminali incorporati, iframe e altro ancora.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Dona
+
+Termix è gratuito e open source. Se lo trovi utile, considera di [donare](https://donate.termix.site/) per aiutare a coprire i costi del server e il tempo di sviluppo.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Screenshot

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Alcuni video e immagini potrebbero non essere aggiornati o potrebbero non mostrare perfettamente le funzionalita.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Funzionalita Pianificate

-Consulta [Progetti](https://github.com/orgs/Termix-SSH/projects/2) per tutte le funzionalita pianificate. Se desideri contribuire, consulta [Contribuire](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Consulta [Progetti](https://github.com/orgs/Termix-SSH/projects/5) per tutte le funzionalita pianificate. Se desideri contribuire, consulta [Contribuire](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix は無料のオープンソースプロジェクトです。便利だと感じた場合は、サーバーコストと開発時間のために[寄付](https://donate.termix.site/)をご検討ください。
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termixは、オープンソースで永久無料のセルフホスト型オー
 <tr>
 <td width="50%" valign="top">

-**Docker管理:**
-コンテナの起動、停止、一時停止、削除。コンテナの統計情報を表示。docker execターミナルでコンテナを操作。PortainerやDockgeの代替ではなく、コンテナの作成よりも簡易的な管理を目的としています。
+**DockerおよびPodman管理:**
+コンテナの起動、停止、一時停止、削除。コンテナの統計情報を表示。docker execターミナルでコンテナを操作。DockerとPodmanの両方をコンテナランタイムとしてサポートしています。PortainerやDockgeの代替ではなく、コンテナの作成よりも簡易的な管理を目的としています。

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termixは、オープンソースで永久無料のセルフホスト型オー
 <tr>
 <td width="50%" valign="top">

+**Tailscaleインテグレーション:**
+TailnetのデバイスをリストしてホストとしてすばやくH追加し、Tailscale SSHを認証方法として使用して接続します。これにより、TailnetのACLが認証情報を保存せずに認可を処理します。
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 ロールを作成し、ユーザー/ロール間でホストを共有できます。

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**シリアル接続:**
+ブラウザまたはデスクトップアプリからシリアルデバイス（ルーター、スイッチ、マイクロコントローラーなど）に直接接続できます。ボーレート、データビット、ストップビット、パリティを設定できます。対応ブラウザではWeb Serial APIを使用し、Electronアプリではネイティブバックエンドを使用します。
+
+</td>
+<td width="50%" valign="top">
+
+**アラート:**
+ホストメトリクス（CPU、メモリ、ディスクなど）に対してしきい値ベースのアラートルールを設定し、発動時にntfyまたはwebhookで通知を受け取れます。発動中および解決済みのアラートを履歴ログで確認できます。
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**ホームページ:**
+ドラッグ＆ドロップのウィジェットグリッドを備えた完全カスタマイズ可能なホームページ。ホストステータス、サービスリンク、時計、メモ、RSSフィード、天気、Dockerコンテナ、ホストメトリクスグラフ、埋め込みターミナル、iframeなどのウィジェットを追加できます。
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## 寄付
+
+Termix は無料のオープンソースプロジェクトです。便利だと感じた場合は、サーバーコストと開発時間のために[寄付](https://donate.termix.site/)をご検討ください。
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## スクリーンショット

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>動画や画像の一部は最新ではない場合や、機能を完全に紹介できていない場合があります。</sub>
@@ -305,7 +352,7 @@ networks:

 ## 予定されている機能

-すべての予定機能については[Projects](https://github.com/orgs/Termix-SSH/projects/2)をご覧ください。コントリビュートをご希望の方は[Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)をご覧ください。
+すべての予定機能については[Projects](https://github.com/orgs/Termix-SSH/projects/5)をご覧ください。コントリビュートをご希望の方は[Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)をご覧ください。

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix는 무료 오픈소스 프로젝트입니다. 유용하게 사용하고 있다면 서버 비용과 개발 시간을 위해 [후원](https://donate.termix.site/)을 고려해 주세요.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix는 오픈 소스이며 영구 무료인 셀프 호스팅 올인원 서버
 <tr>
 <td width="50%" valign="top">

-**Docker 관리:**
-컨테이너 시작, 중지, 일시 정지, 제거. 컨테이너 통계 보기. docker exec 터미널로 컨테이너 제어. Portainer나 Dockge를 대체하기 위한 것이 아니라 컨테이너 생성보다는 간편한 관리를 목적으로 합니다.
+**Docker 및 Podman 관리:**
+컨테이너 시작, 중지, 일시 정지, 제거. 컨테이너 통계 보기. docker exec 터미널로 컨테이너 제어. Docker와 Podman을 모두 컨테이너 런타임으로 지원. Portainer나 Dockge를 대체하기 위한 것이 아니라 컨테이너 생성보다는 간편한 관리를 목적으로 합니다.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix는 오픈 소스이며 영구 무료인 셀프 호스팅 올인원 서버
 <tr>
 <td width="50%" valign="top">

+**Tailscale 통합:**
+Tailscale 네트워크의 기기를 나열하여 호스트로 빠르게 추가하고, Tailscale SSH를 인증 방법으로 사용하여 연결함으로써 자격 증명을 저장하지 않고도 네트워크 ACL이 권한 부여를 처리하도록 합니다.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 역할을 생성하고 사용자/역할 간에 호스트 공유.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**시리얼 연결:**
+브라우저 또는 데스크톱 앱에서 직접 시리얼 장치(라우터, 스위치, 마이크로컨트롤러 등)에 연결. 보드레이트, 데이터 비트, 스톱 비트, 패리티 구성. 지원 브라우저에서는 Web Serial API를, Electron 앱에서는 네이티브 백엔드를 사용합니다.
+
+</td>
+<td width="50%" valign="top">
+
+**알림:**
+호스트 메트릭(CPU, 메모리, 디스크 등)에 대한 임계값 기반 알림 규칙을 설정하고 트리거될 때 ntfy 또는 웹훅을 통해 알림 수신. 기록 로그에서 발생 중인 알림과 해결된 알림 확인.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**홈페이지:**
+드래그 앤 드롭 위젯 그리드를 갖춘 완전 맞춤형 홈페이지. 호스트 상태, 서비스 링크, 시계, 메모, RSS 피드, 날씨, Docker 컨테이너, 호스트 메트릭 차트, 임베디드 터미널, iframe 등의 위젯 추가 가능.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## 후원
+
+Termix는 무료 오픈소스 프로젝트입니다. 유용하게 사용하고 있다면 서버 비용과 개발 시간을 위해 [후원](https://donate.termix.site/)을 고려해 주세요.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## 스크린샷

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>일부 비디오 및 이미지는 최신이 아니거나 기능을 완벽하게 보여주지 않을 수 있습니다.</sub>
@@ -305,7 +352,7 @@ networks:

 ## 계획된 기능

-모든 계획된 기능은 [Projects](https://github.com/orgs/Termix-SSH/projects/2)를 참조하세요. 기여를 원하시면 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)을 참조하세요.
+모든 계획된 기능은 [Projects](https://github.com/orgs/Termix-SSH/projects/5)를 참조하세요. 기여를 원하시면 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)을 참조하세요.

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix é gratuito e de código aberto. Se o achar útil, considere [doar](https://donate.termix.site/) para ajudar a cobrir os custos de servidor e o tempo de desenvolvimento.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Gerencie arquivos diretamente em servidores remotos com suporte para visualizar
 <tr>
 <td width="50%" valign="top">

-**Gerenciamento de Docker:**
-Inicie, pare, pause, remova conteineres. Visualize estatisticas de conteineres. Controle conteineres usando o terminal Docker Exec. Nao foi feito para substituir Portainer ou Dockge, mas sim para simplesmente gerenciar seus conteineres em vez de cria-los.
+**Gerenciamento de Docker e Podman:**
+Inicie, pare, pause, remova conteineres. Visualize estatisticas de conteineres. Controle conteineres usando o terminal Docker Exec. Suporta Docker e Podman como ambiente de execucao de conteineres. Nao foi feito para substituir Portainer ou Dockge, mas sim para simplesmente gerenciar seus conteineres em vez de cria-los.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Gerenciamento seguro de usuarios com controles de administrador e suporte para O
 <tr>
 <td width="50%" valign="top">

+**Integracao com Tailscale:**
+Liste dispositivos da sua rede Tailscale para adicioná-los rapidamente como hosts, e conecte-se usando Tailscale SSH como metodo de autenticacao, deixando as ACLs da sua rede gerenciar a autorizacao sem armazenar credenciais.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Crie funcoes e compartilhe hosts entre usuarios/funcoes.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Conexoes Seriais:**
+Conecte-se a dispositivos seriais (roteadores, switches, microcontroladores, etc.) diretamente do navegador ou do aplicativo desktop. Configure taxa de baud, bits de dados, bits de parada e paridade. Usa a Web Serial API em navegadores suportados ou um backend nativo no aplicativo Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Alertas:**
+Defina regras de alerta baseadas em limites para metricas do host (CPU, memoria, disco, etc.) e receba notificacoes via ntfy ou webhooks quando forem ativadas. Visualize alertas ativos e resolvidos em um historico de registros.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Pagina Inicial:**
+Uma pagina inicial totalmente personalizavel com uma grade de widgets de arrastar e soltar. Adicione widgets para status do host, links de servicos, relogios, notas, feeds RSS, clima, conteineres Docker, graficos de metricas do host, terminais incorporados, iframes e mais.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Doar
+
+Termix é gratuito e de código aberto. Se o achar útil, considere [doar](https://donate.termix.site/) para ajudar a cobrir os custos de servidor e o tempo de desenvolvimento.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Capturas de Tela

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Alguns videos e imagens podem estar desatualizados ou podem nao mostrar perfeitamente as funcionalidades.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Funcionalidades Planejadas

-Consulte [Projetos](https://github.com/orgs/Termix-SSH/projects/2) para todas as funcionalidades planejadas. Se voce deseja contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Consulte [Projetos](https://github.com/orgs/Termix-SSH/projects/5) para todas as funcionalidades planejadas. Se voce deseja contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix — бесплатный проект с открытым исходным кодом. Если он вам полезен, рассмотрите возможность [пожертвования](https://donate.termix.site/) для покрытия расходов на серверы и время разработки.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Termix - это платформа для управления серверам
 <tr>
 <td width="50%" valign="top">

-**Управление Docker:**
-Запуск, остановка, приостановка, удаление контейнеров. Просмотр статистики контейнеров. Управление контейнером через терминал docker exec. Не предназначен для замены Portainer или Dockge, а скорее для простого управления контейнерами по сравнению с их созданием.
+**Управление Docker и Podman:**
+Запуск, остановка, приостановка, удаление контейнеров. Просмотр статистики контейнеров. Управление контейнером через терминал docker exec. Поддерживает как Docker, так и Podman в качестве среды выполнения контейнеров. Не предназначен для замены Portainer или Dockge, а скорее для простого управления контейнерами по сравнению с их созданием.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Termix - это платформа для управления серверам
 <tr>
 <td width="50%" valign="top">

+**Интеграция с Tailscale:**
+Список устройств вашей сети Tailscale для быстрого добавления их в качестве хостов и подключение через Tailscale SSH в качестве метода аутентификации, позволяя ACL вашей сети управлять авторизацией без хранения учётных данных.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Создание ролей и предоставление общего доступа к хостам для пользователей/ролей.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Последовательные подключения:**
+Подключение к последовательным устройствам (маршрутизаторы, коммутаторы, микроконтроллеры и т. д.) напрямую из браузера или приложения для рабочего стола. Настройка скорости передачи данных, битов данных, стоп-битов и чётности. Использует Web Serial API в поддерживаемых браузерах или нативный бэкенд в приложении Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Оповещения:**
+Настройте правила оповещений на основе пороговых значений для метрик хоста (CPU, память, диск и т. д.) и получайте уведомления через ntfy или вебхуки при их срабатывании. Просматривайте активные и разрешённые оповещения в журнале истории.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Домашняя страница:**
+Полностью настраиваемая домашняя страница с сеткой виджетов с перетаскиванием. Добавляйте виджеты для статуса хоста, ссылок на сервисы, часов, заметок, RSS-лент, погоды, контейнеров Docker, графиков метрик хоста, встроенных терминалов, iframe и многого другого.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Пожертвование
+
+Termix — бесплатный проект с открытым исходным кодом. Если он вам полезен, рассмотрите возможность [пожертвования](https://donate.termix.site/) для покрытия расходов на серверы и время разработки.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Скриншоты

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Некоторые видео и изображения могут быть устаревшими или не полностью отражать функциональность.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Запланированные функции

-Смотрите [Проекты](https://github.com/orgs/Termix-SSH/projects/2) для просмотра всех запланированных функций. Если вы хотите внести вклад, смотрите [Участие в разработке](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Смотрите [Проекты](https://github.com/orgs/Termix-SSH/projects/5) для просмотра всех запланированных функций. Если вы хотите внести вклад, смотрите [Участие в разработке](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix ücretsiz ve açık kaynaklıdır. Faydalı buluyorsanız, sunucu maliyetleri ve geliştirme süresine katkıda bulunmak için [bağış yapmayı](https://donate.termix.site/) düşünebilirsiniz.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Uzak sunuculardaki dosyalari dogrudan yonetin; kod, goruntu, ses ve video gorunt
 <tr>
 <td width="50%" valign="top">

-**Docker Yonetimi:**
-Konteynerleri baslatın, durdurun, duraklatın, kaldirin. Konteyner istatistiklerini goruntuleyin. Docker exec terminali kullanarak konteyneri kontrol edin. Portainer veya Dockge'nin yerini almak icin degil, konteynerlerinizi olusturmak yerine basitce yonetmek icin tasarlanmistir.
+**Docker ve Podman Yonetimi:**
+Konteynerleri baslatın, durdurun, duraklatın, kaldirin. Konteyner istatistiklerini goruntuleyin. Docker exec terminali kullanarak konteyneri kontrol edin. Docker ve Podman'i konteyner calisma ortami olarak destekler. Portainer veya Dockge'nin yerini almak icin degil, konteynerlerinizi olusturmak yerine basitce yonetmek icin tasarlanmistir.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Yonetici kontrolleri, OIDC/LDAP/SSO (erisim kontrollu) ve 2FA (TOTP) destegi ile
 <tr>
 <td width="50%" valign="top">

+**Tailscale Entegrasyonu:**
+Tailscale aginizdaki cihazlari listeleyerek hizlica ana bilgisayar olarak ekleyin ve kimlik dogrulama yontemi olarak Tailscale SSH kullanarak baglanin; bu sayede ag ACL'leriniz kimlik bilgileri depolamadan yetkilendirmeyi yonetir.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Roller olusturun ve ana bilgisayarlari kullanicilar/roller arasinda paylasin.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Seri Baglantilar:**
+Seri cihazlara (router, switch, mikrodenetleyici vb.) dogrudan tarayici veya masaustu uygulamasindan baglanin. Baud hizi, veri bitleri, durdurma bitleri ve parite yapilandirin. Desteklenen tarayicilarda Web Serial API, Electron uygulamasinda yerel arka ucu kullanir.
+
+</td>
+<td width="50%" valign="top">
+
+**Uyarilar:**
+Ana bilgisayar metrikleri (CPU, bellek, disk vb.) icin esik tabanli uyari kurallari belirleyin ve tetiklendiklerinde ntfy veya webhook araciligiyla bildirim alin. Gecmis gunlugunde tetiklenen ve cozulen uyarilari goruntuleyin.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Ana Sayfa:**
+Surukleme ve birakma widget izgarasina sahip tamamen ozerlestirilebilir bir ana sayfa. Ana bilgisayar durumu, hizmet baglantilari, saatler, notlar, RSS besleme, hava durumu, Docker konteynerleri, ana bilgisayar metrik grafikleri, gomulu terminaller, iframe ve daha fazlasi icin widget ekleyin.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Bağış Yapın
+
+Termix ücretsiz ve açık kaynaklıdır. Faydalı buluyorsanız, sunucu maliyetleri ve geliştirme süresine katkıda bulunmak için [bağış yapmayı](https://donate.termix.site/) düşünebilirsiniz.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Ekran Goruntuleri

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Bazi videolar ve gorseller guncel olmayabilir veya ozellikleri tam olarak yansitmayabilir.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Planlanan Ozellikler

-Tum planlanan ozellikler icin [Projeler](https://github.com/orgs/Termix-SSH/projects/2) sayfasina bakin. Katkida bulunmak istiyorsaniz, [Katkida Bulunma](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) sayfasina bakin.
+Tum planlanan ozellikler icin [Projeler](https://github.com/orgs/Termix-SSH/projects/5) sayfasina bakin. Katkida bulunmak istiyorsaniz, [Katkida Bulunma](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) sayfasina bakin.

 <br />

@@ -28,10 +28,17 @@
  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
+  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
 </p>

 <br />

+Termix là dự án miễn phí và mã nguồn mở. Nếu bạn thấy hữu ích, hãy cân nhắc [quyên góp](https://donate.termix.site/) để giúp trang trải chi phí máy chủ và thời gian phát triển.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 <img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />

 <br />
@@ -87,8 +94,8 @@ Quan ly tep truc tiep tren may chu tu xa voi ho tro xem va chinh sua ma, hinh an
 <tr>
 <td width="50%" valign="top">

-**Quan Ly Docker:**
-Khoi dong, dung, tam dung, xoa container. Xem thong ke container. Dieu khien container bang terminal docker exec. Khong duoc tao ra de thay the Portainer hay Dockge ma don gian la de quan ly container cua ban thay vi tao moi chung.
+**Quan Ly Docker va Podman:**
+Khoi dong, dung, tam dung, xoa container. Xem thong ke container. Dieu khien container bang terminal docker exec. Ho tro ca Docker va Podman lam moi truong chay container. Khong duoc tao ra de thay the Portainer hay Dockge ma don gian la de quan ly container cua ban thay vi tao moi chung.

 </td>
 <td width="50%" valign="top">
@@ -115,9 +122,37 @@ Quan ly nguoi dung an toan voi quyen quan tri va ho tro OIDC/LDAP/SSO (co kiem s
 <tr>
 <td width="50%" valign="top">

+**Tich Hop Tailscale:**
+Liet ke cac thiet bi trong mang Tailscale de nhanh chong them vao lam may chu, va ket noi bang Tailscale SSH lam phuong thuc xac thuc, de cac ACL mang xu ly uy quyen ma khong can luu tru thong tin xac thuc.
+
+</td>
+<td width="50%" valign="top">
+
 **RBAC:**
 Tao vai tro va chia se may chu giua nguoi dung/vai tro.

+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Ket Noi Noi Tiep:**
+Ket noi voi cac thiet bi noi tiep (router, switch, vi dieu khien, v.v.) truc tiep tu trinh duyet hoac ung dung may tinh. Cau hinh toc do baud, bit du lieu, bit dung va chan le. Su dung Web Serial API tren trinh duyet duoc ho tro hoac backend ban dia trong ung dung Electron.
+
+</td>
+<td width="50%" valign="top">
+
+**Canh Bao:**
+Dat cac quy tac canh bao dua tren nguong cho chi so may chu (CPU, bo nho, o dia, v.v.) va nhan thong bao qua ntfy hoac webhook khi chung khi toa. Xem canh bao dang kich hoat va da giai quyet trong nhat ky lich su.
+
+</td>
+</tr>
+<tr>
+<td width="50%" valign="top">
+
+**Trang Chu:**
+Trang chu co the tuy chinh hoan toan voi luoi widget keo va tha. Them widget cho trang thai may chu, lien ket dich vu, dong ho, ghi chu, feed RSS, thoi tiet, container Docker, bieu do chi so may chu, terminal nhung, iframe va nhieu hon nua.
+
 </td>
 <td width="50%" valign="top">

@@ -253,6 +288,14 @@ networks:

 <br />

+## Quyên góp
+
+Termix là dự án miễn phí và mã nguồn mở. Nếu bạn thấy hữu ích, hãy cân nhắc [quyên góp](https://donate.termix.site/) để giúp trang trải chi phí máy chủ và thời gian phát triển.
+
+<a href="https://donate.termix.site/"><img src="../repo-images/donation-goal.svg" alt="Monthly donation goal" /></a>
+
+<br />
+
 ## Anh Chup Man Hinh

 <div align="center">
@@ -295,6 +338,10 @@ networks:
 <td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
 <td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
 </tr>
+<tr>
+<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
+<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
+</tr>
 </table>

 <sub>Mot so video va hinh anh co the da loi thoi hoac khong the hien chinh xac hoan toan cac tinh nang.</sub>
@@ -305,7 +352,7 @@ networks:

 ## Tinh Nang Du Kien

-Xem [Du An](https://github.com/orgs/Termix-SSH/projects/2) de biet tat ca cac tinh nang du kien. Neu ban muon dong gop, xem [Dong Gop](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+Xem [Du An](https://github.com/orgs/Termix-SSH/projects/5) de biet tat ca cac tinh nang du kien. Neu ban muon dong gop, xem [Dong Gop](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).

 <br />

@@ -63,7 +63,7 @@ async function resolveFileId(projectId) {
 }

 async function pollPreTranslation(projectId, preTranslationId) {
-  for (let i = 0; i < 120; i++) {
+  for (;;) {
    const { data } = await request(
      "GET",
      `/projects/${projectId}/pre-translations/${preTranslationId}`,
@@ -76,7 +76,6 @@ async function pollPreTranslation(projectId, preTranslationId) {
    }
    await new Promise((r) => setTimeout(r, 5000));
  }
-  throw new Error("pre-translation timed out after 10 minutes");
 }

 async function main() {
@@ -1,7 +1,7 @@
 const fs = require("fs");
 const path = require("path");

-const filePath = path.join(
+const guacdClientPath = path.join(
  __dirname,
  "..",
  "node_modules",
@@ -9,13 +9,22 @@ const filePath = path.join(
  "lib",
  "GuacdClient.js",
 );
+const cryptPath = path.join(
+  __dirname,
+  "..",
+  "node_modules",
+  "guacamole-lite",
+  "lib",
+  "Crypt.js",
+);

-if (!fs.existsSync(filePath)) {
+if (!fs.existsSync(guacdClientPath) || !fs.existsSync(cryptPath)) {
  console.log("[patch-guacamole-lite] File not found, skipping");
  process.exit(0);
 }

-let content = fs.readFileSync(filePath, "utf8");
+let guacdClientContent = fs.readFileSync(guacdClientPath, "utf8");
+let cryptContent = fs.readFileSync(cryptPath, "utf8");

 // Patch 1: version acceptance list
 const oldVersionCheck = "if (version === '1_0_0' || version === '1_1_0') {";
@@ -41,36 +50,185 @@ const newConnect =
  "\n" +
  "        this.sendInstruction(['connect'].concat(connectArgs));";

+// Patch 4: answer guacd's dynamic argument requests locally.
+// macOS Screen Sharing can request VNC username/password through the
+// post-handshake `required`/`require` flow. guacamole-lite forwards those
+// instructions to the browser, but Termix already keeps the credentials in the
+// server-side token and the browser does not provide an onrequired handler.
+const oldSendBuffer =
+  "        this.lastActivity = Date.now();\n" + "        this.sendBuffer = '';";
+const newSendBuffer =
+  "        this.lastActivity = Date.now();\n" +
+  "        this.sendBuffer = '';\n" +
+  "        this.nextArgumentStreamIndex = 0;";
+
+const oldSendInstructionBlock =
+  "    sendInstruction(instruction) {\n" +
+  "        // convert every element in the instruction array to a string. convert null to an empty string\n" +
+  "        instruction = instruction.map((element) => {\n" +
+  "            if (element === null || element === undefined) {\n" +
+  "                return '';\n" +
+  "            }\n" +
+  "            return String(element);\n" +
+  "        });\n" +
+  "\n" +
+  "        const instructionString = GuacamoleParser.toInstruction(instruction);\n" +
+  "        this.send(instructionString);\n" +
+  "    }\n";
+const newSendInstructionBlock =
+  oldSendInstructionBlock +
+  "\n" +
+  "    sendArgumentValue(name, value) {\n" +
+  "        const stream = this.nextArgumentStreamIndex++;\n" +
+  "        this.sendInstruction(['argv', stream, 'text/plain', name]);\n" +
+  "        this.sendInstruction(['blob', stream, Buffer.from(String(value ?? ''), 'utf8').toString('base64')]);\n" +
+  "        this.sendInstruction(['end', stream]);\n" +
+  "    }\n" +
+  "\n" +
+  "    sendRequiredArguments(params) {\n" +
+  "        params.forEach((name) => {\n" +
+  "            this.sendArgumentValue(name, this.connectionSettings[name]);\n" +
+  "        });\n" +
+  "    }\n";
+
+const oldReadyHandler =
+  '        // Handle "ready" instruction\n' +
+  "        if (opcode === 'ready') {";
+const newReadyHandler =
+  "        // Handle dynamic argument requests from guacd\n" +
+  "        if (opcode === 'required' || opcode === 'require') {\n" +
+  "            this.sendRequiredArguments(params);\n" +
+  "            return;\n" +
+  "        }\n" +
+  "\n" +
+  oldReadyHandler;
+
 let patched = false;

-if (!content.includes(newVersionCheck)) {
-  if (!content.includes(oldVersionCheck)) {
+if (!guacdClientContent.includes(newVersionCheck)) {
+  if (!guacdClientContent.includes(oldVersionCheck)) {
    console.log(
      "[patch-guacamole-lite] Version check target not found, skipping",
    );
    process.exit(0);
  }
-  content = content.replace(oldVersionCheck, newVersionCheck);
+  guacdClientContent = guacdClientContent.replace(
+    oldVersionCheck,
+    newVersionCheck,
+  );
  patched = true;
 }

-if (!content.includes(newTimezone)) {
-  if (!content.includes(oldTimezone)) {
+if (!guacdClientContent.includes(newTimezone)) {
+  if (!guacdClientContent.includes(oldTimezone)) {
    console.log("[patch-guacamole-lite] Timezone target not found, skipping");
    process.exit(0);
  }
-  content = content.replace(oldTimezone, newTimezone);
+  guacdClientContent = guacdClientContent.replace(oldTimezone, newTimezone);
  patched = true;
 }

-if (!content.includes(newConnect)) {
-  if (!content.includes(oldConnect)) {
+if (!guacdClientContent.includes(newConnect)) {
+  if (!guacdClientContent.includes(oldConnect)) {
    console.log(
      "[patch-guacamole-lite] Connect target not found, skipping name patch",
    );
    process.exit(0);
  }
-  content = content.replace(oldConnect, newConnect);
+  guacdClientContent = guacdClientContent.replace(oldConnect, newConnect);
+  patched = true;
+}
+
+if (!guacdClientContent.includes("this.nextArgumentStreamIndex = 0;")) {
+  if (!guacdClientContent.includes(oldSendBuffer)) {
+    console.log(
+      "[patch-guacamole-lite] Argument stream index target not found, skipping",
+    );
+    process.exit(0);
+  }
+  guacdClientContent = guacdClientContent.replace(oldSendBuffer, newSendBuffer);
+  patched = true;
+}
+
+if (!guacdClientContent.includes("sendRequiredArguments(params) {")) {
+  if (!guacdClientContent.includes(oldSendInstructionBlock)) {
+    console.log(
+      "[patch-guacamole-lite] Required argument helper target not found, skipping",
+    );
+    process.exit(0);
+  }
+  guacdClientContent = guacdClientContent.replace(
+    oldSendInstructionBlock,
+    newSendInstructionBlock,
+  );
+  patched = true;
+}
+
+if (
+  !guacdClientContent.includes("opcode === 'required' || opcode === 'require'")
+) {
+  if (!guacdClientContent.includes(oldReadyHandler)) {
+    console.log(
+      "[patch-guacamole-lite] Required opcode target not found, skipping",
+    );
+    process.exit(0);
+  }
+  guacdClientContent = guacdClientContent.replace(
+    oldReadyHandler,
+    newReadyHandler,
+  );
+  patched = true;
+}
+
+// Patch 5: guacamole-lite decrypts token JSON through ASCII/binary strings,
+// which corrupts IV/ciphertext bytes and non-ASCII connection settings such as
+// RDP/VNC passwords with umlauts. Keep the encrypted fields as Buffers and
+// decode the plaintext JSON as UTF-8.
+const oldDecryptBlock =
+  "        let encoded = JSON.parse(this.constructor.base64decode(encodedString));\n" +
+  "\n" +
+  "        encoded.iv = this.constructor.base64decode(encoded.iv);\n" +
+  "        encoded.value = this.constructor.base64decode(encoded.value, 'binary');\n" +
+  "\n" +
+  "        const decipher = Crypto.createDecipheriv(this.cypher, this.key, encoded.iv);\n" +
+  "\n" +
+  "        let decrypted = decipher.update(encoded.value, 'binary', 'ascii');\n" +
+  "        decrypted += decipher.final('ascii');";
+const oldPartiallyPatchedDecryptBlock =
+  "        let encoded = JSON.parse(this.constructor.base64decode(encodedString));\n" +
+  "\n" +
+  "        encoded.iv = this.constructor.base64decode(encoded.iv);\n" +
+  "        encoded.value = this.constructor.base64decode(encoded.value, 'binary');\n" +
+  "\n" +
+  "        const decipher = Crypto.createDecipheriv(this.cypher, this.key, encoded.iv);\n" +
+  "\n" +
+  "        let decrypted = decipher.update(encoded.value, 'binary', 'utf8');\n" +
+  "        decrypted += decipher.final('utf8');";
+const newDecryptBlock =
+  "        const encoded = JSON.parse(Buffer.from(encodedString, 'base64').toString('utf8'));\n" +
+  "\n" +
+  "        const iv = Buffer.from(encoded.iv, 'base64');\n" +
+  "        const value = Buffer.from(encoded.value, 'base64');\n" +
+  "\n" +
+  "        const decipher = Crypto.createDecipheriv(this.cypher, this.key, iv);\n" +
+  "\n" +
+  "        let decrypted = decipher.update(value, undefined, 'utf8');\n" +
+  "        decrypted += decipher.final('utf8');";
+
+if (!cryptContent.includes(newDecryptBlock)) {
+  if (cryptContent.includes(oldDecryptBlock)) {
+    cryptContent = cryptContent.replace(oldDecryptBlock, newDecryptBlock);
+  } else if (cryptContent.includes(oldPartiallyPatchedDecryptBlock)) {
+    cryptContent = cryptContent.replace(
+      oldPartiallyPatchedDecryptBlock,
+      newDecryptBlock,
+    );
+  } else {
+    console.log(
+      "[patch-guacamole-lite] UTF-8 token decrypt target not found, skipping",
+    );
+    process.exit(0);
+  }
  patched = true;
 }

@@ -79,7 +237,8 @@ if (!patched) {
  process.exit(0);
 }

-fs.writeFileSync(filePath, content);
+fs.writeFileSync(guacdClientPath, guacdClientContent);
+fs.writeFileSync(cryptPath, cryptContent);
 console.log(
-  "[patch-guacamole-lite] Patched to support protocol VERSION_1_3_0 and VERSION_1_5_0 with name handshake instruction",
+  "[patch-guacamole-lite] Patched protocol VERSION_1_3_0/1_5_0 support, name handshake, required arguments, and UTF-8 token decrypt",
 );
@@ -0,0 +1,23 @@
+import fs from "node:fs";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+describe("patch-guacamole-lite", () => {
+  it("handles guacd dynamic argument requests", () => {
+    const guacdClientPath = path.join(
+      process.cwd(),
+      "node_modules",
+      "guacamole-lite",
+      "lib",
+      "GuacdClient.js",
+    );
+
+    const content = fs.readFileSync(guacdClientPath, "utf8");
+
+    expect(content).toContain("sendRequiredArguments(params)");
+    expect(content).toContain("opcode === 'required' || opcode === 'require'");
+    expect(content).toContain("this.sendInstruction(['argv'");
+    expect(content).toContain("this.sendInstruction(['blob'");
+    expect(content).toContain("this.sendInstruction(['end'");
+  });
+});
@@ -45,7 +45,23 @@ async function getAccessToken({ clientId, clientSecret, refreshToken }) {
  return json.access_token;
 }

+async function getVideoStatus(accessToken, videoId) {
+  const res = await fetch(
+    `https://www.googleapis.com/youtube/v3/videos?part=status&id=${videoId}`,
+    { headers: { Authorization: `Bearer ${accessToken}` } },
+  );
+  if (!res.ok)
+    throw new Error(`videos.list failed (${res.status}): ${await res.text()}`);
+  const json = await res.json();
+  return json.items?.[0]?.status?.privacyStatus ?? null;
+}
+
 async function setVideoPublic(accessToken, videoId) {
+  const status = await getVideoStatus(accessToken, videoId);
+  if (status === "public") {
+    console.log(`Video ${videoId} is already public, skipping.`);
+    return;
+  }
  const res = await fetch(
    "https://www.googleapis.com/youtube/v3/videos?part=status",
    {
@@ -2,12 +2,18 @@ import express from "express";
 import cookieParser from "cookie-parser";
 import { createCorsMiddleware } from "./utils/cors-config.js";
 import { getDb } from "./database/db/index.js";
-import { recentActivity, hosts, hostAccess } from "./database/db/schema.js";
-import { eq, and, desc, inArray } from "drizzle-orm";
+import {
+  recentActivity,
+  hosts,
+  hostAccess,
+  userRoles,
+} from "./database/db/schema.js";
+import { eq, and, desc, inArray, or, isNull, gte, sql } from "drizzle-orm";
 import { dashboardLogger } from "./utils/logger.js";
 import { SimpleDBOps } from "./utils/simple-db-ops.js";
 import { AuthManager } from "./utils/auth-manager.js";
 import type { AuthenticatedRequest } from "../types/index.js";
+import { dashboardServiceLinksRouter } from "./database/routes/dashboard-service-links-routes.js";

 const app = express();
 const authManager = AuthManager.getInstance();
@@ -227,11 +233,30 @@ app.post("/activity/log", async (req, res) => {
    );

    if (ownedHosts.length === 0) {
+      const userRoleIds = await getDb()
+        .select({ roleId: userRoles.roleId })
+        .from(userRoles)
+        .where(eq(userRoles.userId, userId));
+      const roleIds = userRoleIds.map((r) => r.roleId);
+
+      const now = new Date().toISOString();
      const sharedHosts = await getDb()
        .select()
        .from(hostAccess)
        .where(
-          and(eq(hostAccess.hostId, hostId), eq(hostAccess.userId, userId)),
+          and(
+            eq(hostAccess.hostId, hostId),
+            or(
+              eq(hostAccess.userId, userId),
+              roleIds.length > 0
+                ? sql`${hostAccess.roleId} IN (${sql.join(
+                    roleIds.map((id) => sql`${id}`),
+                    sql`, `,
+                  )})`
+                : sql`false`,
+            ),
+            or(isNull(hostAccess.expiresAt), gte(hostAccess.expiresAt, now)),
+          ),
        );

      if (sharedHosts.length === 0) {
@@ -349,6 +374,8 @@ app.delete("/activity/reset", async (req, res) => {
  }
 });

+app.use("/service-links", dashboardServiceLinksRouter);
+
 const PORT = 30006;
 app.listen(PORT, async () => {
  try {
@@ -17,8 +17,11 @@ import rbacRoutes from "./routes/rbac.js";
 import openTabsRoutes from "./routes/open-tabs.js";
 import userPreferencesRoutes from "./routes/user-preferences.js";
 import proxmoxRoutes from "./routes/proxmox.js";
+import termixIdRoutes from "./routes/termix-id.js";
 import { registerAuditLogRoutes } from "./routes/audit-log-routes.js";
 import { registerTailscaleRoutes } from "./routes/tailscale-routes.js";
+import vaultRoutes from "./routes/vault.js";
+import alertRulesRoutes from "./routes/alert-rules-routes.js";
 import { createCorsMiddleware } from "../utils/cors-config.js";
 import fs from "fs";
 import path from "path";
@@ -1788,8 +1791,11 @@ app.use("/rbac", rbacRoutes);
 app.use("/open-tabs", openTabsRoutes);
 app.use("/user-preferences", userPreferencesRoutes);
 app.use("/proxmox", proxmoxRoutes);
+app.use("/termix-id", termixIdRoutes);
 registerAuditLogRoutes(app, authenticateJWT);
 registerTailscaleRoutes(app, authenticateJWT);
+app.use("/vault", vaultRoutes);
+app.use("/", alertRulesRoutes);

 const frontendDistPaths = [
  path.join(__dirname, "../../../dist"),
@@ -1832,7 +1838,11 @@ if (frontendDist) {
  );

  app.use((req, res, next) => {
-    if (req.method === "GET" && req.accepts("html")) {
+    if (
+      req.method === "GET" &&
+      req.accepts("html") &&
+      !req.headers.authorization
+    ) {
      res.setHeader(
        "Cache-Control",
        "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0",
@@ -8,6 +8,7 @@ import { DatabaseFileEncryption } from "../../utils/database-file-encryption.js"
 import { SystemCrypto } from "../../utils/system-crypto.js";
 import { DatabaseMigration } from "../../utils/database-migration.js";
 import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
+import { getDefaultGuacdUrl } from "../../utils/guacd-config.js";

 const dataDir = process.env.DATA_DIR || "./db/data";
 const dbDir = path.resolve(dataDir);
@@ -196,6 +197,22 @@ async function initializeCompleteDatabase(): Promise<void> {
        FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
    );

+    CREATE TABLE IF NOT EXISTS webauthn_credentials (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        credential_id TEXT NOT NULL UNIQUE,
+        public_key TEXT NOT NULL,
+        counter INTEGER NOT NULL DEFAULT 0,
+        device_type TEXT,
+        backed_up INTEGER NOT NULL DEFAULT 0,
+        transports TEXT,
+        user_verification TEXT NOT NULL DEFAULT 'preferred',
+        created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        last_used_at TEXT,
+        FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+    );
+
    CREATE TABLE IF NOT EXISTS ssh_data (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        user_id TEXT NOT NULL,
@@ -636,12 +653,11 @@ async function initializeCompleteDatabase(): Promise<void> {
      .prepare("SELECT value FROM settings WHERE key = 'guac_url'")
      .get();
    if (!row) {
-      const defaultGuacUrl = `${process.env.GUACD_HOST || "localhost"}:${process.env.GUACD_PORT || "4822"}`;
      sqlite
        .prepare(
          "INSERT INTO settings (key, value) VALUES ('guac_url', ?)",
        )
-        .run(defaultGuacUrl);
+        .run(getDefaultGuacdUrl());
    }
  } catch (e) {
    databaseLogger.warn("Could not initialize guac_url setting", {
@@ -689,11 +705,29 @@ const migrateSchema = () => {
  addColumnIfNotExists("user_preferences", "show_host_tags", "INTEGER");
  addColumnIfNotExists("user_preferences", "host_tray_on_click", "INTEGER");
  addColumnIfNotExists("user_preferences", "pin_app_rail", "INTEGER");
+  addColumnIfNotExists(
+    "user_preferences",
+    "expand_app_rail_on_hover",
+    "INTEGER",
+  );
  addColumnIfNotExists("user_preferences", "folders_collapsed", "INTEGER");
  addColumnIfNotExists("user_preferences", "confirm_snippet_execution", "INTEGER");
  addColumnIfNotExists("user_preferences", "disable_update_check", "INTEGER");
  addColumnIfNotExists("user_preferences", "confirm_tab_close", "INTEGER");
  addColumnIfNotExists("user_preferences", "hidden_rail_tabs", "TEXT");
+  addColumnIfNotExists("user_preferences", "compact_host_view", "INTEGER");
+  addColumnIfNotExists("user_preferences", "status_color_scheme", "TEXT");
+
+  sqlite.exec(`
+    CREATE TABLE IF NOT EXISTS dashboard_service_links (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+      label TEXT NOT NULL,
+      url TEXT NOT NULL,
+      "order" INTEGER NOT NULL DEFAULT 0,
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+    )
+  `);

  addColumnIfNotExists("users", "is_admin", "INTEGER NOT NULL DEFAULT 0");

@@ -713,6 +747,24 @@ const migrateSchema = () => {
  addColumnIfNotExists("users", "totp_enabled", "INTEGER NOT NULL DEFAULT 0");
  addColumnIfNotExists("users", "totp_backup_codes", "TEXT");

+  sqlite.exec(`
+    CREATE TABLE IF NOT EXISTS webauthn_credentials (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      name TEXT NOT NULL,
+      credential_id TEXT NOT NULL UNIQUE,
+      public_key TEXT NOT NULL,
+      counter INTEGER NOT NULL DEFAULT 0,
+      device_type TEXT,
+      backed_up INTEGER NOT NULL DEFAULT 0,
+      transports TEXT,
+      user_verification TEXT NOT NULL DEFAULT 'preferred',
+      created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      last_used_at TEXT,
+      FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+    )
+  `);
+
  addColumnIfNotExists("ssh_data", "name", "TEXT");
  addColumnIfNotExists("ssh_data", "folder", "TEXT");
  addColumnIfNotExists("ssh_data", "tags", "TEXT");
@@ -753,6 +805,11 @@ const migrateSchema = () => {
    "enable_file_manager",
    "INTEGER NOT NULL DEFAULT 1",
  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "scp_legacy",
+    "INTEGER NOT NULL DEFAULT 0",
+  );
  addColumnIfNotExists("ssh_data", "default_path", "TEXT");
  addColumnIfNotExists(
    "ssh_data",
@@ -778,6 +835,11 @@ const migrateSchema = () => {
    "override_credential_username",
    "INTEGER",
  );
+  addColumnIfNotExists(
+    "ssh_data",
+    "vault_profile_id",
+    "INTEGER REFERENCES vault_profiles(id) ON DELETE SET NULL",
+  );

  addColumnIfNotExists("ssh_data", "autostart_password", "TEXT");
  addColumnIfNotExists("ssh_data", "autostart_key", "TEXT");
@@ -984,6 +1046,111 @@ const migrateSchema = () => {
    }
  }

+  try {
+    sqlite.prepare("SELECT id FROM termix_identities LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS termix_identities (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL UNIQUE,
+          handle TEXT NOT NULL UNIQUE,
+          description TEXT,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create termix_identities table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  // Enforce one-Termix-ID-per-user on databases where the table predates the
+  // UNIQUE(user_id) constraint above.
+  try {
+    sqlite.exec(
+      "CREATE UNIQUE INDEX IF NOT EXISTS idx_termix_identities_user ON termix_identities(user_id)",
+    );
+  } catch (indexError) {
+    databaseLogger.warn("Failed to create termix_identities user_id unique index", {
+      operation: "schema_migration",
+      error: indexError,
+    });
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM termix_identity_keys LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS termix_identity_keys (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          identity_id INTEGER NOT NULL,
+          user_id TEXT NOT NULL,
+          public_key TEXT NOT NULL,
+          key_type TEXT NOT NULL,
+          algorithm TEXT NOT NULL,
+          label TEXT,
+          comment TEXT,
+          source TEXT NOT NULL DEFAULT 'manual',
+          credential_id INTEGER,
+          enabled INTEGER NOT NULL DEFAULT 1,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (identity_id) REFERENCES termix_identities (id) ON DELETE CASCADE,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+          FOREIGN KEY (credential_id) REFERENCES ssh_credentials (id) ON DELETE SET NULL
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create termix_identity_keys table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  // The public resolver fetches keys by identity_id on every request; index it.
+  try {
+    sqlite.exec(
+      "CREATE INDEX IF NOT EXISTS idx_termix_identity_keys_identity ON termix_identity_keys(identity_id)",
+    );
+  } catch (indexError) {
+    databaseLogger.warn("Failed to create termix_identity_keys identity index", {
+      operation: "schema_migration",
+      error: indexError,
+    });
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM termix_identity_ca LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS termix_identity_ca (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          identity_id INTEGER NOT NULL UNIQUE,
+          user_id TEXT NOT NULL,
+          public_key TEXT NOT NULL,
+          private_key TEXT NOT NULL,
+          validity_days INTEGER NOT NULL DEFAULT 90,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (identity_id) REFERENCES termix_identities (id) ON DELETE CASCADE,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create termix_identity_ca table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
  try {
    sqlite.prepare("SELECT id FROM c2s_tunnel_presets LIMIT 1").get();
  } catch {
@@ -1197,6 +1364,14 @@ const migrateSchema = () => {
    { column: "vnc_user", sql: "ALTER TABLE ssh_data ADD COLUMN vnc_user TEXT" },
    { column: "telnet_user", sql: "ALTER TABLE ssh_data ADD COLUMN telnet_user TEXT" },
    { column: "telnet_password", sql: "ALTER TABLE ssh_data ADD COLUMN telnet_password TEXT" },
+    { column: "rdp_credential_id", sql: "ALTER TABLE ssh_data ADD COLUMN rdp_credential_id INTEGER REFERENCES ssh_credentials(id) ON DELETE SET NULL" },
+    { column: "vnc_credential_id", sql: "ALTER TABLE ssh_data ADD COLUMN vnc_credential_id INTEGER REFERENCES ssh_credentials(id) ON DELETE SET NULL" },
+    { column: "wol_broadcast_address", sql: "ALTER TABLE ssh_data ADD COLUMN wol_broadcast_address TEXT" },
+    { column: "use_warpgate", sql: "ALTER TABLE ssh_data ADD COLUMN use_warpgate INTEGER NOT NULL DEFAULT 0" },
+    { column: "telnet_credential_id", sql: "ALTER TABLE ssh_data ADD COLUMN telnet_credential_id INTEGER REFERENCES ssh_credentials(id) ON DELETE SET NULL" },
+    { column: "rdp_auth_type", sql: "ALTER TABLE ssh_data ADD COLUMN rdp_auth_type TEXT" },
+    { column: "vnc_auth_type", sql: "ALTER TABLE ssh_data ADD COLUMN vnc_auth_type TEXT" },
+    { column: "telnet_auth_type", sql: "ALTER TABLE ssh_data ADD COLUMN telnet_auth_type TEXT" },
  ];

  for (const migration of sshDataMigrations) {
@@ -1214,6 +1389,23 @@ const migrateSchema = () => {
    }
  }

+  // Migrate legacy authType="warpgate" hosts to useWarpgate=1 with authType="none"
+  try {
+    const result = sqlite
+      .prepare("UPDATE ssh_data SET use_warpgate = 1, auth_type = 'none' WHERE auth_type = 'warpgate'")
+      .run();
+    if (result.changes > 0) {
+      databaseLogger.info(`Migrated ${result.changes} host(s) from authType='warpgate' to useWarpgate=true`, {
+        operation: "warpgate_auth_migration",
+      });
+    }
+  } catch (e) {
+    databaseLogger.warn("Failed to migrate legacy warpgate authType hosts", {
+      operation: "warpgate_auth_migration",
+      error: e,
+    });
+  }
+
  // Copy unencrypted username/domain into protocol-specific columns for old guac hosts.
  // Passwords are handled via the legacy field name fallback in lazy-field-encryption.ts.
  const usernameDomainBackfills = [
@@ -1439,6 +1631,67 @@ const migrateSchema = () => {
    }
  }

+  try {
+    sqlite.prepare("SELECT id FROM vault_profiles LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS vault_profiles (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          name TEXT NOT NULL,
+          description TEXT,
+          folder TEXT,
+          tags TEXT,
+          vault_addr TEXT NOT NULL,
+          vault_namespace TEXT,
+          oidc_mount TEXT,
+          oidc_role TEXT,
+          ssh_mount TEXT,
+          ssh_role TEXT NOT NULL,
+          valid_principals TEXT,
+          key_type TEXT,
+          shared INTEGER NOT NULL DEFAULT 0,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create vault_profiles table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM vault_tokens LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS vault_tokens (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL,
+          profile_id INTEGER NOT NULL,
+          ssh_cert TEXT NOT NULL,
+          private_key TEXT NOT NULL,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          expires_at TEXT NOT NULL,
+          last_used TEXT,
+          UNIQUE(user_id, profile_id),
+          FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
+          FOREIGN KEY (profile_id) REFERENCES vault_profiles (id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create vault_tokens table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
  try {
    sqlite.prepare("SELECT id FROM api_keys LIMIT 1").get();
  } catch {
@@ -1680,6 +1933,197 @@ const migrateSchema = () => {
    });
  }

+  // --- metrics-history begin ---
+  try {
+    sqlite.prepare("SELECT id FROM host_metrics_history LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS host_metrics_history (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          host_id INTEGER NOT NULL REFERENCES ssh_data(id) ON DELETE CASCADE,
+          ts TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          cpu_percent REAL,
+          mem_percent REAL,
+          disk_percent REAL,
+          net_rx_bytes INTEGER,
+          net_tx_bytes INTEGER
+        );
+        CREATE INDEX IF NOT EXISTS idx_host_metrics_history_host_ts
+          ON host_metrics_history (host_id, ts DESC);
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create host_metrics_history table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+  // --- metrics-history end ---
+
+  // --- alerts begin ---
+  try {
+    sqlite.prepare("SELECT id FROM alert_rules LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS alert_rules (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          host_id INTEGER REFERENCES ssh_data(id) ON DELETE CASCADE,
+          name TEXT NOT NULL,
+          enabled INTEGER NOT NULL DEFAULT 1,
+          trigger_type TEXT NOT NULL,
+          threshold_value REAL,
+          threshold_duration_seconds INTEGER,
+          cooldown_minutes INTEGER NOT NULL DEFAULT 15,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create alert_rules table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM notification_channels LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS notification_channels (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          name TEXT NOT NULL,
+          type TEXT NOT NULL,
+          config TEXT NOT NULL,
+          enabled INTEGER NOT NULL DEFAULT 1,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create notification_channels table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM alert_rule_channels LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS alert_rule_channels (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          rule_id INTEGER NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+          channel_id INTEGER NOT NULL REFERENCES notification_channels(id) ON DELETE CASCADE
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create alert_rule_channels table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM alert_firings LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS alert_firings (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          rule_id INTEGER NOT NULL REFERENCES alert_rules(id) ON DELETE CASCADE,
+          host_id INTEGER NOT NULL,
+          host_name TEXT NOT NULL,
+          fired_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          resolved_at TEXT,
+          value REAL,
+          message TEXT NOT NULL,
+          severity TEXT NOT NULL DEFAULT 'warning',
+          acknowledged INTEGER NOT NULL DEFAULT 0
+        );
+        CREATE INDEX IF NOT EXISTS idx_alert_firings_user_fired
+          ON alert_firings (user_id, fired_at DESC);
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create alert_firings table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+  // --- alerts end ---
+
+  // Seed default metrics history retention setting
+  try {
+    const retentionRow = sqlite
+      .prepare("SELECT value FROM settings WHERE key = 'metrics_history_retention_days'")
+      .get();
+    if (!retentionRow) {
+      sqlite
+        .prepare("INSERT INTO settings (key, value) VALUES ('metrics_history_retention_days', '7')")
+        .run();
+    }
+  } catch (e) {
+    databaseLogger.warn("Could not initialize metrics_history_retention_days setting", {
+      operation: "schema_migration",
+      error: e,
+    });
+  }
+
+  // --- homepage begin ---
+  try {
+    sqlite.prepare("SELECT id FROM homepage_items LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS homepage_items (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          type_id TEXT NOT NULL,
+          title TEXT,
+          config TEXT NOT NULL DEFAULT '{}',
+          folder_id INTEGER,
+          created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create homepage_items table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+
+  try {
+    sqlite.prepare("SELECT id FROM homepage_layouts LIMIT 1").get();
+  } catch {
+    try {
+      sqlite.exec(`
+        CREATE TABLE IF NOT EXISTS homepage_layouts (
+          id INTEGER PRIMARY KEY AUTOINCREMENT,
+          user_id TEXT NOT NULL UNIQUE REFERENCES users(id) ON DELETE CASCADE,
+          layout TEXT NOT NULL DEFAULT '{}',
+          updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+        );
+      `);
+    } catch (createError) {
+      databaseLogger.warn("Failed to create homepage_layouts table", {
+        operation: "schema_migration",
+        error: createError,
+      });
+    }
+  }
+  // --- homepage end ---
+
  databaseLogger.success("Schema migration completed", {
    operation: "schema_migration",
  });
@@ -1,4 +1,4 @@
-import { sqliteTable, text, integer } from "drizzle-orm/sqlite-core";
+import { sqliteTable, text, integer, real } from "drizzle-orm/sqlite-core";
 import { sql } from "drizzle-orm";

 export const users = sqliteTable("users", {
@@ -80,6 +80,25 @@ export const trustedDevices = sqliteTable("trusted_devices", {
    .default(sql`CURRENT_TIMESTAMP`),
 });

+export const webauthnCredentials = sqliteTable("webauthn_credentials", {
+  id: text("id").primaryKey(),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  credentialId: text("credential_id").notNull(),
+  publicKey: text("public_key").notNull(),
+  counter: integer("counter").notNull().default(0),
+  deviceType: text("device_type"),
+  backedUp: integer("backed_up", { mode: "boolean" }).notNull().default(false),
+  transports: text("transports"),
+  userVerification: text("user_verification").notNull().default("preferred"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  lastUsedAt: text("last_used_at"),
+});
+
 export const hosts = sqliteTable("ssh_data", {
  id: integer("id").primaryKey({ autoIncrement: true }),
  userId: text("user_id")
@@ -94,6 +113,7 @@ export const hosts = sqliteTable("ssh_data", {
  tags: text("tags"),
  pin: integer("pin", { mode: "boolean" }).notNull().default(false),
  authType: text("auth_type").notNull(),
+  useWarpgate: integer("use_warpgate", { mode: "boolean" }).notNull().default(false),
  forceKeyboardInteractive: text("force_keyboard_interactive"),

  password: text("password"),
@@ -110,6 +130,13 @@ export const hosts = sqliteTable("ssh_data", {
  overrideCredentialUsername: integer("override_credential_username", {
    mode: "boolean",
  }),
+  // When authType is "vault", the host authenticates via a Vault SSH signer
+  // profile (shared settings, no secrets). The signing certificate is obtained
+  // per-user at connect time via an interactive Vault OIDC flow.
+  vaultProfileId: integer("vault_profile_id").references(
+    () => vaultProfiles.id,
+    { onDelete: "set null" },
+  ),
  enableTerminal: integer("enable_terminal", { mode: "boolean" })
    .notNull()
    .default(true),
@@ -127,6 +154,7 @@ export const hosts = sqliteTable("ssh_data", {
  enableFileManager: integer("enable_file_manager", { mode: "boolean" })
    .notNull()
    .default(true),
+  scpLegacy: integer("scp_legacy", { mode: "boolean" }).notNull().default(false),
  enableDocker: integer("enable_docker", { mode: "boolean" })
    .notNull()
    .default(false),
@@ -168,17 +196,24 @@ export const hosts = sqliteTable("ssh_data", {
  vncPort: integer("vnc_port").default(5900),
  telnetPort: integer("telnet_port").default(23),

+  rdpCredentialId: integer("rdp_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
  rdpUser: text("rdp_user"),
  rdpPassword: text("rdp_password"),
  rdpDomain: text("rdp_domain"),
  rdpSecurity: text("rdp_security"),
  rdpIgnoreCert: integer("rdp_ignore_cert", { mode: "boolean" }).default(false),

+  vncCredentialId: integer("vnc_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
  vncPassword: text("vnc_password"),
  vncUser: text("vnc_user"),

  telnetUser: text("telnet_user"),
  telnetPassword: text("telnet_password"),
+  telnetCredentialId: integer("telnet_credential_id").references(() => sshCredentials.id, { onDelete: "set null" }),
+
+  rdpAuthType: text("rdp_auth_type"),
+  vncAuthType: text("vnc_auth_type"),
+  telnetAuthType: text("telnet_auth_type"),

  domain: text("domain"),
  security: text("security"),
@@ -193,6 +228,7 @@ export const hosts = sqliteTable("ssh_data", {
  socks5ProxyChain: text("socks5_proxy_chain"),

  macAddress: text("mac_address"),
+  wolBroadcastAddress: text("wol_broadcast_address"),
  portKnockSequence: text("port_knock_sequence"),

  hostKeyFingerprint: text("host_key_fingerprint"),
@@ -651,6 +687,63 @@ export const opksshTokens = sqliteTable("opkssh_tokens", {
  lastUsed: text("last_used"),
 });

+// Vault SSH signer profiles. These hold ONLY non-secret connection settings and
+// are intended to be shared across users (shared === true makes a profile
+// visible to every user on the server). Each user authenticates to Vault via an
+// interactive OIDC flow at connect time; no tokens or keys are stored here.
+export const vaultProfiles = sqliteTable("vault_profiles", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  description: text("description"),
+  folder: text("folder"),
+  tags: text("tags"),
+  // Vault server connection (non-secret)
+  vaultAddr: text("vault_addr").notNull(),
+  vaultNamespace: text("vault_namespace"),
+  // OIDC auth method mount + role used to obtain a Vault token interactively
+  oidcMount: text("oidc_mount"),
+  oidcRole: text("oidc_role"),
+  // SSH secrets engine mount + signer role used to sign the ephemeral key
+  sshMount: text("ssh_mount"),
+  sshRole: text("ssh_role").notNull(),
+  validPrincipals: text("valid_principals"),
+  // Ephemeral keypair algorithm to generate per connection
+  keyType: text("key_type"),
+  // When true the profile is visible/usable by all users on the server
+  shared: integer("shared", { mode: "boolean" }).notNull().default(false),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+// Per-user cache of the ephemeral SSH private key + Vault-signed certificate.
+// Transient: rows live only until the certificate expires. Secret fields are
+// encrypted under the user's data-encryption key (see field-crypto.ts).
+export const vaultTokens = sqliteTable("vault_tokens", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  profileId: integer("profile_id")
+    .notNull()
+    .references(() => vaultProfiles.id, { onDelete: "cascade" }),
+
+  sshCert: text("ssh_cert", { length: 8192 }).notNull(),
+  privateKey: text("private_key", { length: 8192 }).notNull(),
+
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  expiresAt: text("expires_at").notNull(),
+  lastUsed: text("last_used"),
+});
+
 export const apiKeys = sqliteTable("api_keys", {
  id: text("id").primaryKey(),
  userId: text("user_id")
@@ -700,11 +793,16 @@ export const userPreferences = sqliteTable("user_preferences", {
  showHostTags: integer("show_host_tags", { mode: "boolean" }),
  hostTrayOnClick: integer("host_tray_on_click", { mode: "boolean" }),
  pinAppRail: integer("pin_app_rail", { mode: "boolean" }),
+  expandAppRailOnHover: integer("expand_app_rail_on_hover", {
+    mode: "boolean",
+  }),
  foldersCollapsed: integer("folders_collapsed", { mode: "boolean" }),
  confirmSnippetExecution: integer("confirm_snippet_execution", { mode: "boolean" }),
  disableUpdateCheck: integer("disable_update_check", { mode: "boolean" }),
  confirmTabClose: integer("confirm_tab_close", { mode: "boolean" }),
  hiddenRailTabs: text("hidden_rail_tabs"),
+  compactHostView: integer("compact_host_view", { mode: "boolean" }),
+  statusColorScheme: text("status_color_scheme"),
  updatedAt: text("updated_at")
    .notNull()
    .default(sql`CURRENT_TIMESTAMP`),
@@ -763,6 +861,92 @@ export const hostHealthHistory = sqliteTable("host_health_history", {
  detail: text("detail"),
 });

+export const dashboardServiceLinks = sqliteTable("dashboard_service_links", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  label: text("label").notNull(),
+  url: text("url").notNull(),
+  order: integer("order").notNull().default(0),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+// --- termix-id begin ---
+// A user claims a unique public handle. Their published SSH public keys are
+// served at an unauthenticated resolver endpoint in authorized_keys format,
+// so any server can be provisioned with `curl <host>/termix-id/u/<handle> >> ~/.ssh/authorized_keys`.
+export const termixIdentities = sqliteTable("termix_identities", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  // One Termix ID per user — enforced in schema, not just in code.
+  userId: text("user_id")
+    .notNull()
+    .unique()
+    .references(() => users.id, { onDelete: "cascade" }),
+  handle: text("handle").notNull().unique(),
+  description: text("description"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const termixIdentityKeys = sqliteTable("termix_identity_keys", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  identityId: integer("identity_id")
+    .notNull()
+    .references(() => termixIdentities.id, { onDelete: "cascade" }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  // Public keys are non-secret, so they are stored in plaintext (no field-level
+  // encryption). This is what lets the unauthenticated resolver serve them.
+  publicKey: text("public_key", { length: 8192 }).notNull(),
+  // Raw algorithm token (e.g. "ssh-ed25519"), and a normalized group used for
+  // the /<ALGO> resolver filter (RSA / ED25519 / ECDSA / ...).
+  keyType: text("key_type").notNull(),
+  algorithm: text("algorithm").notNull(),
+  label: text("label"),
+  comment: text("comment"),
+  // "manual" (pasted) or "credential" (imported from an ssh_credentials entry).
+  source: text("source").notNull().default("manual"),
+  credentialId: integer("credential_id").references(() => sshCredentials.id, {
+    onDelete: "set null",
+  }),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+// Per-identity certificate authority. Servers that trust this CA (via
+// TrustedUserCAKeys / @cert-authority) accept any user certificate it signs,
+// giving central revocation (rotate the CA) and expiry (cert validity).
+export const termixIdentityCa = sqliteTable("termix_identity_ca", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  identityId: integer("identity_id")
+    .notNull()
+    .unique()
+    .references(() => termixIdentities.id, { onDelete: "cascade" }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  // CA public key (plaintext — it is published); CA private key is field-encrypted.
+  publicKey: text("public_key", { length: 4096 }).notNull(),
+  privateKey: text("private_key", { length: 8192 }).notNull(),
+  validityDays: integer("validity_days").notNull().default(90),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- termix-id end ---
+
 // --- tmux-monitor begin ---
 export const tmuxSessionTags = sqliteTable("tmux_session_tags", {
  id: integer("id").primaryKey({ autoIncrement: true }),
@@ -779,3 +963,118 @@ export const tmuxSessionTags = sqliteTable("tmux_session_tags", {
    .default(sql`CURRENT_TIMESTAMP`),
 });
 // --- tmux-monitor end ---
+
+// --- metrics-history begin ---
+export const hostMetricsHistory = sqliteTable("host_metrics_history", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  hostId: integer("host_id")
+    .notNull()
+    .references(() => hosts.id, { onDelete: "cascade" }),
+  ts: text("ts")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  cpuPercent: real("cpu_percent"),
+  memPercent: real("mem_percent"),
+  diskPercent: real("disk_percent"),
+  netRxBytes: integer("net_rx_bytes"),
+  netTxBytes: integer("net_tx_bytes"),
+});
+// --- metrics-history end ---
+
+// --- alerts begin ---
+export const alertRules = sqliteTable("alert_rules", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  hostId: integer("host_id").references(() => hosts.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  triggerType: text("trigger_type").notNull(),
+  thresholdValue: real("threshold_value"),
+  thresholdDurationSeconds: integer("threshold_duration_seconds"),
+  cooldownMinutes: integer("cooldown_minutes").notNull().default(15),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const notificationChannels = sqliteTable("notification_channels", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  name: text("name").notNull(),
+  type: text("type").notNull(),
+  config: text("config").notNull(),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const alertRuleChannels = sqliteTable("alert_rule_channels", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  ruleId: integer("rule_id")
+    .notNull()
+    .references(() => alertRules.id, { onDelete: "cascade" }),
+  channelId: integer("channel_id")
+    .notNull()
+    .references(() => notificationChannels.id, { onDelete: "cascade" }),
+});
+
+export const alertFirings = sqliteTable("alert_firings", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  ruleId: integer("rule_id")
+    .notNull()
+    .references(() => alertRules.id, { onDelete: "cascade" }),
+  hostId: integer("host_id").notNull(),
+  hostName: text("host_name").notNull(),
+  firedAt: text("fired_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  resolvedAt: text("resolved_at"),
+  value: real("value"),
+  message: text("message").notNull(),
+  severity: text("severity").notNull().default("warning"),
+  acknowledged: integer("acknowledged", { mode: "boolean" }).notNull().default(false),
+});
+// --- alerts end ---
+
+// --- homepage begin ---
+export const homepageItems = sqliteTable("homepage_items", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .references(() => users.id, { onDelete: "cascade" }),
+  typeId: text("type_id").notNull(),
+  title: text("title"),
+  config: text("config").notNull().default("{}"),
+  folderId: integer("folder_id"),
+  createdAt: text("created_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+
+export const homepageLayouts = sqliteTable("homepage_layouts", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  userId: text("user_id")
+    .notNull()
+    .unique()
+    .references(() => users.id, { onDelete: "cascade" }),
+  // JSON: { entries: HomepageLayoutEntry[], pan: {x,y}, zoom: number }
+  layout: text("layout").notNull().default("{}"),
+  updatedAt: text("updated_at")
+    .notNull()
+    .default(sql`CURRENT_TIMESTAMP`),
+});
+// --- homepage end ---
@@ -0,0 +1,414 @@
+import { execSync } from "child_process";
+import { promises as fs } from "fs";
+import path from "path";
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import type { RequestHandler, Router } from "express";
+import { eq } from "drizzle-orm";
+import { authLogger } from "../../utils/logger.js";
+import { db } from "../db/index.js";
+import { users } from "../db/schema.js";
+import { logAudit, getRequestMeta } from "../../utils/audit-logger.js";
+
+const DATA_DIR = process.env.DATA_DIR || "./db/data";
+const SSL_DIR = path.join(DATA_DIR, "ssl");
+const ACME_WEBROOT = path.join(DATA_DIR, "acme-webroot");
+const CERTBOT_DIR = path.join(DATA_DIR, "certbot");
+const CERTBOT_CONFIG_DIR = path.join(CERTBOT_DIR, "config");
+const CERTBOT_WORK_DIR = path.join(CERTBOT_DIR, "work");
+const CERTBOT_LOGS_DIR = path.join(CERTBOT_DIR, "logs");
+const CLOUDFLARE_CREDENTIALS_FILE = path.join(
+  DATA_DIR,
+  "ssl",
+  "cloudflare.ini",
+);
+
+export type AcmeSettings = {
+  enabled: boolean;
+  domain: string;
+  email: string;
+  challengeType: "http-webroot" | "dns-cloudflare";
+  cloudflareToken: string;
+  lastIssuedAt: string | null;
+  certStatus: "none" | "valid" | "expiring" | "expired";
+  certExpiresAt: string | null;
+};
+
+function getCertInfo(): {
+  status: "none" | "valid" | "expiring" | "expired";
+  expiresAt: string | null;
+} {
+  const certFile = path.join(SSL_DIR, "termix.crt");
+  try {
+    execSync(`openssl x509 -in "${certFile}" -noout 2>/dev/null`, {
+      stdio: "pipe",
+    });
+  } catch {
+    return { status: "none", expiresAt: null };
+  }
+
+  try {
+    const endDateRaw = execSync(
+      `openssl x509 -in "${certFile}" -noout -enddate`,
+      { stdio: "pipe" },
+    )
+      .toString()
+      .trim()
+      .replace("notAfter=", "");
+    const expiresAt = new Date(endDateRaw).toISOString();
+
+    try {
+      execSync(`openssl x509 -in "${certFile}" -checkend 0 -noout`, {
+        stdio: "pipe",
+      });
+    } catch {
+      return { status: "expired", expiresAt };
+    }
+
+    try {
+      execSync(`openssl x509 -in "${certFile}" -checkend 2592000 -noout`, {
+        stdio: "pipe",
+      });
+      return { status: "valid", expiresAt };
+    } catch {
+      return { status: "expiring", expiresAt };
+    }
+  } catch {
+    return { status: "none", expiresAt: null };
+  }
+}
+
+function getAcmeSettingsFromDb(): AcmeSettings {
+  const row = db.$client
+    .prepare("SELECT value FROM settings WHERE key = 'acme_ssl_settings'")
+    .get() as { value: string } | undefined;
+
+  const { status, expiresAt } = getCertInfo();
+  const stored = row ? JSON.parse(row.value) : {};
+
+  return {
+    enabled: stored.enabled ?? false,
+    domain: stored.domain ?? "",
+    email: stored.email ?? "",
+    challengeType: stored.challengeType ?? "http-webroot",
+    cloudflareToken: stored.cloudflareToken
+      ? `${stored.cloudflareToken.slice(0, 4)}${"*".repeat(Math.max(0, stored.cloudflareToken.length - 4))}`
+      : "",
+    lastIssuedAt: stored.lastIssuedAt ?? null,
+    certStatus: status,
+    certExpiresAt: expiresAt,
+  };
+}
+
+export function registerAcmeSSLRoutes(
+  router: Router,
+  authenticateJWT: RequestHandler,
+): void {
+  /**
+   * @openapi
+   * /users/acme-ssl-settings:
+   *   get:
+   *     summary: Get ACME SSL settings
+   *     description: Returns current ACME/Let's Encrypt configuration and certificate status.
+   *     tags:
+   *       - Users
+   *     responses:
+   *       200:
+   *         description: ACME SSL settings and certificate status.
+   *       500:
+   *         description: Failed to get ACME SSL settings.
+   */
+  router.get("/acme-ssl-settings", authenticateJWT, async (_req, res) => {
+    try {
+      res.json(getAcmeSettingsFromDb());
+    } catch (err) {
+      authLogger.error("Failed to get ACME SSL settings", err);
+      res.status(500).json({ error: "Failed to get ACME SSL settings" });
+    }
+  });
+
+  /**
+   * @openapi
+   * /users/acme-ssl-settings:
+   *   patch:
+   *     summary: Update ACME SSL settings (admin only)
+   *     description: Saves ACME/Let's Encrypt configuration.
+   *     tags:
+   *       - Users
+   *     requestBody:
+   *       required: true
+   *       content:
+   *         application/json:
+   *           schema:
+   *             type: object
+   *             properties:
+   *               enabled:
+   *                 type: boolean
+   *               domain:
+   *                 type: string
+   *               email:
+   *                 type: string
+   *               challengeType:
+   *                 type: string
+   *                 enum: [http-webroot, dns-cloudflare]
+   *               cloudflareToken:
+   *                 type: string
+   *     responses:
+   *       200:
+   *         description: ACME SSL settings updated.
+   *       403:
+   *         description: Not authorized.
+   *       500:
+   *         description: Failed to update ACME SSL settings.
+   */
+  router.patch("/acme-ssl-settings", authenticateJWT, async (req, res) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    try {
+      const user = await db.select().from(users).where(eq(users.id, userId));
+      if (!user || user.length === 0 || !user[0].isAdmin) {
+        return res.status(403).json({ error: "Not authorized" });
+      }
+
+      const existing = db.$client
+        .prepare("SELECT value FROM settings WHERE key = 'acme_ssl_settings'")
+        .get() as { value: string } | undefined;
+      const current = existing ? JSON.parse(existing.value) : {};
+
+      const { enabled, domain, email, challengeType, cloudflareToken } =
+        req.body;
+
+      const updated = {
+        ...current,
+        ...(typeof enabled === "boolean" && { enabled }),
+        ...(typeof domain === "string" && { domain }),
+        ...(typeof email === "string" && { email }),
+        ...(typeof challengeType === "string" && { challengeType }),
+        ...(typeof cloudflareToken === "string" &&
+          cloudflareToken &&
+          !cloudflareToken.includes("*") && { cloudflareToken }),
+      };
+
+      db.$client
+        .prepare(
+          "INSERT OR REPLACE INTO settings (key, value) VALUES ('acme_ssl_settings', ?)",
+        )
+        .run(JSON.stringify(updated));
+
+      const { ipAddress, userAgent } = getRequestMeta(req);
+      const actorRecord = await db
+        .select({ username: users.username })
+        .from(users)
+        .where(eq(users.id, userId))
+        .limit(1);
+      await logAudit({
+        userId,
+        username: actorRecord[0]?.username ?? userId,
+        action: "update_acme_ssl_settings",
+        resourceType: "setting",
+        details: JSON.stringify({
+          enabled,
+          domain,
+          email,
+          challengeType,
+          hasCloudflareToken: !!updated.cloudflareToken,
+        }),
+        ipAddress,
+        userAgent,
+        success: true,
+      });
+
+      res.json(getAcmeSettingsFromDb());
+    } catch (err) {
+      authLogger.error("Failed to update ACME SSL settings", err);
+      res.status(500).json({ error: "Failed to update ACME SSL settings" });
+    }
+  });
+
+  /**
+   * @openapi
+   * /users/acme-ssl-request:
+   *   post:
+   *     summary: Request or renew Let's Encrypt certificate (admin only)
+   *     description: Triggers certbot to issue or renew a certificate using the configured challenge method.
+   *     tags:
+   *       - Users
+   *     responses:
+   *       200:
+   *         description: Certificate issued or renewed successfully.
+   *       400:
+   *         description: Invalid configuration.
+   *       403:
+   *         description: Not authorized.
+   *       500:
+   *         description: Certificate issuance failed.
+   */
+  router.post("/acme-ssl-request", authenticateJWT, async (req, res) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    try {
+      const user = await db.select().from(users).where(eq(users.id, userId));
+      if (!user || user.length === 0 || !user[0].isAdmin) {
+        return res.status(403).json({ error: "Not authorized" });
+      }
+
+      const row = db.$client
+        .prepare("SELECT value FROM settings WHERE key = 'acme_ssl_settings'")
+        .get() as { value: string } | undefined;
+
+      if (!row) {
+        return res.status(400).json({ error: "ACME settings not configured" });
+      }
+
+      const settings = JSON.parse(row.value);
+      const { domain, email, challengeType, cloudflareToken } = settings;
+
+      if (!domain || !email) {
+        return res.status(400).json({ error: "Domain and email are required" });
+      }
+
+      try {
+        execSync("certbot --version", { stdio: "pipe" });
+      } catch {
+        return res
+          .status(500)
+          .json({ error: "certbot is not available in this environment" });
+      }
+
+      await fs.mkdir(SSL_DIR, { recursive: true });
+      await fs.mkdir(ACME_WEBROOT, { recursive: true });
+      await fs.mkdir(CERTBOT_CONFIG_DIR, { recursive: true });
+      await fs.mkdir(CERTBOT_WORK_DIR, { recursive: true });
+      await fs.mkdir(CERTBOT_LOGS_DIR, { recursive: true });
+
+      const certbotDirFlags = [
+        `--config-dir "${CERTBOT_CONFIG_DIR}"`,
+        `--work-dir "${CERTBOT_WORK_DIR}"`,
+        `--logs-dir "${CERTBOT_LOGS_DIR}"`,
+      ].join(" ");
+
+      let certbotCmd: string;
+
+      if (challengeType === "dns-cloudflare") {
+        if (!cloudflareToken) {
+          return res.status(400).json({
+            error: "Cloudflare API token is required for DNS challenge",
+          });
+        }
+
+        await fs.mkdir(path.dirname(CLOUDFLARE_CREDENTIALS_FILE), {
+          recursive: true,
+        });
+        await fs.writeFile(
+          CLOUDFLARE_CREDENTIALS_FILE,
+          `dns_cloudflare_api_token = ${cloudflareToken}\n`,
+          { mode: 0o600 },
+        );
+
+        certbotCmd = [
+          "certbot",
+          "certonly",
+          "--non-interactive",
+          "--agree-tos",
+          "--dns-cloudflare",
+          `--dns-cloudflare-credentials "${CLOUDFLARE_CREDENTIALS_FILE}"`,
+          "--dns-cloudflare-propagation-seconds",
+          "30",
+          "-d",
+          `"${domain}"`,
+          "--email",
+          `"${email}"`,
+          "--cert-name",
+          "termix",
+          certbotDirFlags,
+        ].join(" ");
+      } else {
+        certbotCmd = [
+          "certbot",
+          "certonly",
+          "--non-interactive",
+          "--agree-tos",
+          "--webroot",
+          "-w",
+          `"${ACME_WEBROOT}"`,
+          "-d",
+          `"${domain}"`,
+          "--email",
+          `"${email}"`,
+          "--cert-name",
+          "termix",
+          certbotDirFlags,
+        ].join(" ");
+      }
+
+      authLogger.info("Requesting Let's Encrypt certificate", {
+        domain,
+        challengeType,
+        operation: "acme_cert_request",
+      });
+
+      execSync(certbotCmd, { stdio: "pipe", timeout: 120000 });
+
+      const liveDir = path.join(CERTBOT_CONFIG_DIR, "live", "termix");
+      const fullchainSrc = path.join(liveDir, "fullchain.pem");
+      const privkeySrc = path.join(liveDir, "privkey.pem");
+      const certDest = path.join(SSL_DIR, "termix.crt");
+      const keyDest = path.join(SSL_DIR, "termix.key");
+
+      await fs.copyFile(fullchainSrc, certDest);
+      await fs.copyFile(privkeySrc, keyDest);
+      await fs.chmod(keyDest, 0o600);
+      await fs.chmod(certDest, 0o644);
+
+      const updated = { ...settings, lastIssuedAt: new Date().toISOString() };
+      db.$client
+        .prepare(
+          "INSERT OR REPLACE INTO settings (key, value) VALUES ('acme_ssl_settings', ?)",
+        )
+        .run(JSON.stringify(updated));
+
+      authLogger.info("Let's Encrypt certificate issued and installed", {
+        domain,
+        operation: "acme_cert_installed",
+      });
+
+      const { ipAddress, userAgent } = getRequestMeta(req);
+      const actorRecord = await db
+        .select({ username: users.username })
+        .from(users)
+        .where(eq(users.id, userId))
+        .limit(1);
+      await logAudit({
+        userId,
+        username: actorRecord[0]?.username ?? userId,
+        action: "acme_ssl_request",
+        resourceType: "setting",
+        details: JSON.stringify({ domain, challengeType, success: true }),
+        ipAddress,
+        userAgent,
+        success: true,
+      });
+
+      res.json({ success: true, ...getAcmeSettingsFromDb() });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Unknown error";
+      authLogger.error("ACME certificate request failed", err);
+
+      const { ipAddress, userAgent } = getRequestMeta(req);
+      const actorRecord = await db
+        .select({ username: users.username })
+        .from(users)
+        .where(eq(users.id, userId))
+        .limit(1);
+      await logAudit({
+        userId,
+        username: actorRecord[0]?.username ?? userId,
+        action: "acme_ssl_request",
+        resourceType: "setting",
+        details: JSON.stringify({ error: message }),
+        ipAddress,
+        userAgent,
+        success: false,
+      });
+
+      res.status(500).json({ error: `Certificate request failed: ${message}` });
+    }
+  });
+}
@@ -0,0 +1,660 @@
+import express, { type Request, type Response } from "express";
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import { getDb } from "../db/index.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import { DatabaseSaveTrigger } from "../db/index.js";
+import { databaseLogger } from "../../utils/logger.js";
+import { sendWebhook, sendNtfy } from "../../utils/notification-sender.js";
+
+const router = express.Router();
+const authManager = AuthManager.getInstance();
+const authenticateJWT = authManager.createAuthMiddleware();
+
+const VALID_TRIGGER_TYPES = new Set([
+  "host_offline",
+  "host_online",
+  "cpu_threshold",
+  "memory_threshold",
+  "disk_threshold",
+  "health_check_failure",
+  "health_check_recovery",
+  "user_login",
+]);
+
+router.use(authenticateJWT);
+
+// ---- Notification Channels ----
+
+/**
+ * @openapi
+ * /notification-channels:
+ *   get:
+ *     summary: List notification channels for the current user
+ *     tags:
+ *       - Alerts
+ *     responses:
+ *       200:
+ *         description: List of notification channels.
+ */
+router.get("/notification-channels", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  try {
+    const rows = getDb()
+      .$client.prepare(
+        "SELECT * FROM notification_channels WHERE user_id = ? ORDER BY id ASC",
+      )
+      .all(userId);
+    res.json(rows);
+  } catch (err) {
+    databaseLogger.error("Failed to list notification channels", {
+      operation: "list_channels",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to list channels" });
+  }
+});
+
+/**
+ * @openapi
+ * /notification-channels:
+ *   post:
+ *     summary: Create a notification channel
+ *     tags:
+ *       - Alerts
+ */
+router.post("/notification-channels", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const { name, type, config, enabled } = req.body as {
+    name: string;
+    type: string;
+    config: unknown;
+    enabled?: boolean;
+  };
+
+  if (!name || typeof name !== "string" || !name.trim()) {
+    return res.status(400).json({ error: "name is required" });
+  }
+  if (type !== "webhook" && type !== "ntfy") {
+    return res.status(400).json({ error: "type must be 'webhook' or 'ntfy'" });
+  }
+  if (!config || typeof config !== "object") {
+    return res.status(400).json({ error: "config is required" });
+  }
+  if (type === "ntfy") {
+    const c = config as Record<string, unknown>;
+    if (!c.url || typeof c.url !== "string")
+      return res.status(400).json({ error: "ntfy config requires url" });
+    if (!c.topic || typeof c.topic !== "string")
+      return res.status(400).json({ error: "ntfy config requires topic" });
+  }
+  if (type === "webhook") {
+    const c = config as Record<string, unknown>;
+    if (!c.url || typeof c.url !== "string")
+      return res.status(400).json({ error: "webhook config requires url" });
+  }
+
+  try {
+    const result = getDb()
+      .$client.prepare(
+        `INSERT INTO notification_channels (user_id, name, type, config, enabled)
+         VALUES (?, ?, ?, ?, ?)`,
+      )
+      .run(
+        userId,
+        name.trim(),
+        type,
+        JSON.stringify(config),
+        enabled !== false ? 1 : 0,
+      );
+    const row = getDb()
+      .$client.prepare("SELECT * FROM notification_channels WHERE id = ?")
+      .get(result.lastInsertRowid);
+    DatabaseSaveTrigger.triggerSave("notification_channel_created");
+    res.status(201).json(row);
+  } catch (err) {
+    databaseLogger.error("Failed to create notification channel", {
+      operation: "create_channel",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to create channel" });
+  }
+});
+
+/**
+ * @openapi
+ * /notification-channels/{id}:
+ *   put:
+ *     summary: Update a notification channel
+ *     tags:
+ *       - Alerts
+ */
+router.put("/notification-channels/:id", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const channelId = Number(req.params.id);
+  const { name, type, config, enabled } = req.body as {
+    name?: string;
+    type?: string;
+    config?: unknown;
+    enabled?: boolean;
+  };
+
+  const existing = getDb()
+    .$client.prepare(
+      "SELECT id FROM notification_channels WHERE id = ? AND user_id = ?",
+    )
+    .get(channelId, userId);
+  if (!existing) return res.status(404).json({ error: "Channel not found" });
+
+  if (type && type !== "webhook" && type !== "ntfy") {
+    return res.status(400).json({ error: "type must be 'webhook' or 'ntfy'" });
+  }
+
+  try {
+    const updates: string[] = [];
+    const params: unknown[] = [];
+    if (name !== undefined) {
+      updates.push("name = ?");
+      params.push(name.trim());
+    }
+    if (type !== undefined) {
+      updates.push("type = ?");
+      params.push(type);
+    }
+    if (config !== undefined) {
+      updates.push("config = ?");
+      params.push(JSON.stringify(config));
+    }
+    if (enabled !== undefined) {
+      updates.push("enabled = ?");
+      params.push(enabled ? 1 : 0);
+    }
+
+    if (updates.length === 0) return res.json({ success: true });
+
+    params.push(channelId, userId);
+    getDb()
+      .$client.prepare(
+        `UPDATE notification_channels SET ${updates.join(", ")} WHERE id = ? AND user_id = ?`,
+      )
+      .run(...params);
+
+    const row = getDb()
+      .$client.prepare("SELECT * FROM notification_channels WHERE id = ?")
+      .get(channelId);
+    DatabaseSaveTrigger.triggerSave("notification_channel_updated");
+    res.json(row);
+  } catch (err) {
+    databaseLogger.error("Failed to update notification channel", {
+      operation: "update_channel",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to update channel" });
+  }
+});
+
+/**
+ * @openapi
+ * /notification-channels/{id}:
+ *   delete:
+ *     summary: Delete a notification channel
+ *     tags:
+ *       - Alerts
+ */
+router.delete("/notification-channels/:id", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const channelId = Number(req.params.id);
+  const existing = getDb()
+    .$client.prepare(
+      "SELECT id FROM notification_channels WHERE id = ? AND user_id = ?",
+    )
+    .get(channelId, userId);
+  if (!existing) return res.status(404).json({ error: "Channel not found" });
+  getDb()
+    .$client.prepare("DELETE FROM notification_channels WHERE id = ?")
+    .run(channelId);
+  DatabaseSaveTrigger.triggerSave("notification_channel_deleted");
+  res.json({ success: true });
+});
+
+/**
+ * @openapi
+ * /notification-channels/{id}/test:
+ *   post:
+ *     summary: Send a test notification
+ *     tags:
+ *       - Alerts
+ */
+router.post(
+  "/notification-channels/:id/test",
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    const channelId = Number(req.params.id);
+    const row = getDb()
+      .$client.prepare(
+        "SELECT * FROM notification_channels WHERE id = ? AND user_id = ?",
+      )
+      .get(channelId, userId) as { type: string; config: string } | undefined;
+    if (!row) return res.status(404).json({ error: "Channel not found" });
+
+    const testPayload = {
+      hostName: "Test Host",
+      hostId: 0,
+      triggerType: "test",
+      message: "This is a test notification from Termix",
+      severity: "info" as const,
+      timestamp: new Date().toISOString(),
+      ruleId: 0,
+      ruleName: "Test",
+    };
+
+    try {
+      let config: Record<string, unknown>;
+      try {
+        config = JSON.parse(row.config) as Record<string, unknown>;
+      } catch {
+        return res
+          .status(400)
+          .json({ success: false, error: "Invalid channel config" });
+      }
+
+      if (row.type === "webhook") {
+        await sendWebhook(
+          config as unknown as Parameters<typeof sendWebhook>[0],
+          testPayload,
+        );
+      } else if (row.type === "ntfy") {
+        await sendNtfy(
+          config as unknown as Parameters<typeof sendNtfy>[0],
+          testPayload,
+        );
+      }
+      res.json({ success: true });
+    } catch (err) {
+      res.json({
+        success: false,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  },
+);
+
+// ---- Alert Rules ----
+
+/**
+ * @openapi
+ * /alert-rules:
+ *   get:
+ *     summary: List alert rules for the current user
+ *     tags:
+ *       - Alerts
+ */
+router.get("/alert-rules", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  try {
+    const rules = getDb()
+      .$client.prepare(
+        "SELECT * FROM alert_rules WHERE user_id = ? ORDER BY id ASC",
+      )
+      .all(userId) as Array<{ id: number }>;
+
+    const channelMap = new Map<number, number[]>();
+    for (const rule of rules) {
+      const channels = getDb()
+        .$client.prepare(
+          "SELECT channel_id FROM alert_rule_channels WHERE rule_id = ?",
+        )
+        .all(rule.id) as Array<{ channel_id: number }>;
+      channelMap.set(
+        rule.id,
+        channels.map((c) => c.channel_id),
+      );
+    }
+
+    const result = rules.map((r) => ({
+      ...r,
+      channels: channelMap.get(r.id) ?? [],
+    }));
+    res.json(result);
+  } catch (err) {
+    databaseLogger.error("Failed to list alert rules", {
+      operation: "list_alert_rules",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to list alert rules" });
+  }
+});
+
+/**
+ * @openapi
+ * /alert-rules:
+ *   post:
+ *     summary: Create an alert rule
+ *     tags:
+ *       - Alerts
+ */
+router.post("/alert-rules", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const {
+    name,
+    hostId,
+    enabled,
+    triggerType,
+    thresholdValue,
+    thresholdDurationSeconds,
+    cooldownMinutes,
+    channels = [],
+  } = req.body as {
+    name: string;
+    hostId?: number | null;
+    enabled?: boolean;
+    triggerType: string;
+    thresholdValue?: number | null;
+    thresholdDurationSeconds?: number | null;
+    cooldownMinutes?: number;
+    channels?: number[];
+  };
+
+  if (!name || typeof name !== "string" || !name.trim()) {
+    return res.status(400).json({ error: "name is required" });
+  }
+  if (!VALID_TRIGGER_TYPES.has(triggerType)) {
+    return res.status(400).json({ error: "Invalid triggerType" });
+  }
+  if (thresholdValue != null && (thresholdValue < 0 || thresholdValue > 100)) {
+    return res
+      .status(400)
+      .json({ error: "thresholdValue must be between 0 and 100" });
+  }
+  if (thresholdDurationSeconds != null && thresholdDurationSeconds < 0) {
+    return res
+      .status(400)
+      .json({ error: "thresholdDurationSeconds must be >= 0" });
+  }
+
+  try {
+    const now = new Date().toISOString();
+    const result = getDb()
+      .$client.prepare(
+        `INSERT INTO alert_rules
+           (user_id, host_id, name, enabled, trigger_type, threshold_value,
+            threshold_duration_seconds, cooldown_minutes, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(
+        userId,
+        hostId ?? null,
+        name.trim(),
+        enabled !== false ? 1 : 0,
+        triggerType,
+        thresholdValue ?? null,
+        thresholdDurationSeconds ?? null,
+        cooldownMinutes ?? 15,
+        now,
+        now,
+      );
+    const ruleId = result.lastInsertRowid as number;
+
+    for (const channelId of channels) {
+      const owned = getDb()
+        .$client.prepare(
+          "SELECT id FROM notification_channels WHERE id = ? AND user_id = ?",
+        )
+        .get(channelId, userId);
+      if (!owned) continue;
+      getDb()
+        .$client.prepare(
+          "INSERT OR IGNORE INTO alert_rule_channels (rule_id, channel_id) VALUES (?, ?)",
+        )
+        .run(ruleId, channelId);
+    }
+
+    const row = getDb()
+      .$client.prepare("SELECT * FROM alert_rules WHERE id = ?")
+      .get(ruleId) as Record<string, unknown>;
+    DatabaseSaveTrigger.triggerSave("alert_rule_created");
+    res.status(201).json({ ...row, channels });
+  } catch (err) {
+    databaseLogger.error("Failed to create alert rule", {
+      operation: "create_alert_rule",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to create alert rule" });
+  }
+});
+
+/**
+ * @openapi
+ * /alert-rules/{id}:
+ *   put:
+ *     summary: Update an alert rule
+ *     tags:
+ *       - Alerts
+ */
+router.put("/alert-rules/:id", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const ruleId = Number(req.params.id);
+
+  const existing = getDb()
+    .$client.prepare("SELECT id FROM alert_rules WHERE id = ? AND user_id = ?")
+    .get(ruleId, userId);
+  if (!existing) return res.status(404).json({ error: "Alert rule not found" });
+
+  const {
+    name,
+    hostId,
+    enabled,
+    triggerType,
+    thresholdValue,
+    thresholdDurationSeconds,
+    cooldownMinutes,
+    channels,
+  } = req.body as {
+    name?: string;
+    hostId?: number | null;
+    enabled?: boolean;
+    triggerType?: string;
+    thresholdValue?: number | null;
+    thresholdDurationSeconds?: number | null;
+    cooldownMinutes?: number;
+    channels?: number[];
+  };
+
+  if (triggerType && !VALID_TRIGGER_TYPES.has(triggerType)) {
+    return res.status(400).json({ error: "Invalid triggerType" });
+  }
+
+  try {
+    const updates: string[] = ["updated_at = ?"];
+    const params: unknown[] = [new Date().toISOString()];
+    if (name !== undefined) {
+      updates.push("name = ?");
+      params.push(name.trim());
+    }
+    if (hostId !== undefined) {
+      updates.push("host_id = ?");
+      params.push(hostId ?? null);
+    }
+    if (enabled !== undefined) {
+      updates.push("enabled = ?");
+      params.push(enabled ? 1 : 0);
+    }
+    if (triggerType !== undefined) {
+      updates.push("trigger_type = ?");
+      params.push(triggerType);
+    }
+    if (thresholdValue !== undefined) {
+      updates.push("threshold_value = ?");
+      params.push(thresholdValue ?? null);
+    }
+    if (thresholdDurationSeconds !== undefined) {
+      updates.push("threshold_duration_seconds = ?");
+      params.push(thresholdDurationSeconds ?? null);
+    }
+    if (cooldownMinutes !== undefined) {
+      updates.push("cooldown_minutes = ?");
+      params.push(cooldownMinutes);
+    }
+    params.push(ruleId, userId);
+
+    getDb()
+      .$client.prepare(
+        `UPDATE alert_rules SET ${updates.join(", ")} WHERE id = ? AND user_id = ?`,
+      )
+      .run(...params);
+
+    if (channels !== undefined) {
+      getDb()
+        .$client.prepare("DELETE FROM alert_rule_channels WHERE rule_id = ?")
+        .run(ruleId);
+      for (const channelId of channels) {
+        const owned = getDb()
+          .$client.prepare(
+            "SELECT id FROM notification_channels WHERE id = ? AND user_id = ?",
+          )
+          .get(channelId, userId);
+        if (!owned) continue;
+        getDb()
+          .$client.prepare(
+            "INSERT OR IGNORE INTO alert_rule_channels (rule_id, channel_id) VALUES (?, ?)",
+          )
+          .run(ruleId, channelId);
+      }
+    }
+
+    const row = getDb()
+      .$client.prepare("SELECT * FROM alert_rules WHERE id = ?")
+      .get(ruleId) as Record<string, unknown>;
+    const linkedChannels = (
+      getDb()
+        .$client.prepare(
+          "SELECT channel_id FROM alert_rule_channels WHERE rule_id = ?",
+        )
+        .all(ruleId) as Array<{ channel_id: number }>
+    ).map((c) => c.channel_id);
+
+    DatabaseSaveTrigger.triggerSave("alert_rule_updated");
+    res.json({ ...row, channels: linkedChannels });
+  } catch (err) {
+    databaseLogger.error("Failed to update alert rule", {
+      operation: "update_alert_rule",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to update alert rule" });
+  }
+});
+
+/**
+ * @openapi
+ * /alert-rules/{id}:
+ *   delete:
+ *     summary: Delete an alert rule
+ *     tags:
+ *       - Alerts
+ */
+router.delete("/alert-rules/:id", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const ruleId = Number(req.params.id);
+  const existing = getDb()
+    .$client.prepare("SELECT id FROM alert_rules WHERE id = ? AND user_id = ?")
+    .get(ruleId, userId);
+  if (!existing) return res.status(404).json({ error: "Alert rule not found" });
+  getDb().$client.prepare("DELETE FROM alert_rules WHERE id = ?").run(ruleId);
+  DatabaseSaveTrigger.triggerSave("alert_rule_deleted");
+  res.json({ success: true });
+});
+
+// ---- Alert Firings ----
+
+/**
+ * @openapi
+ * /alert-firings:
+ *   get:
+ *     summary: List alert firings for the current user
+ *     tags:
+ *       - Alerts
+ */
+router.get("/alert-firings", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const limit = Math.min(Number(req.query.limit) || 50, 200);
+  const offset = Number(req.query.offset) || 0;
+  const acknowledgedParam = req.query.acknowledged;
+
+  try {
+    let whereClause = "af.user_id = ?";
+    const params: unknown[] = [userId];
+
+    if (acknowledgedParam === "true") {
+      whereClause += " AND af.acknowledged = 1";
+    } else if (acknowledgedParam === "false") {
+      whereClause += " AND af.acknowledged = 0";
+    }
+
+    const rows = getDb()
+      .$client.prepare(
+        `SELECT af.*, ar.name as rule_name
+         FROM alert_firings af
+         LEFT JOIN alert_rules ar ON ar.id = af.rule_id
+         WHERE ${whereClause}
+         ORDER BY af.fired_at DESC
+         LIMIT ? OFFSET ?`,
+      )
+      .all(...params, limit, offset);
+
+    const total = (
+      getDb()
+        .$client.prepare(
+          `SELECT COUNT(*) as c FROM alert_firings af WHERE ${whereClause}`,
+        )
+        .get(...params) as { c: number }
+    ).c;
+
+    res.json({ firings: rows, total });
+  } catch (err) {
+    databaseLogger.error("Failed to list alert firings", {
+      operation: "list_alert_firings",
+      error: err,
+    });
+    res.status(500).json({ error: "Failed to list alert firings" });
+  }
+});
+
+/**
+ * @openapi
+ * /alert-firings/{id}/acknowledge:
+ *   post:
+ *     summary: Acknowledge an alert firing
+ *     tags:
+ *       - Alerts
+ */
+router.post("/alert-firings/:id/acknowledge", (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const firingId = Number(req.params.id);
+  getDb()
+    .$client.prepare(
+      "UPDATE alert_firings SET acknowledged = 1 WHERE id = ? AND user_id = ?",
+    )
+    .run(firingId, userId);
+  DatabaseSaveTrigger.triggerSave("alert_firing_acknowledged");
+  res.json({ success: true });
+});
+
+/**
+ * @openapi
+ * /alert-firings/acknowledge-all:
+ *   post:
+ *     summary: Acknowledge all alert firings for the current user
+ *     tags:
+ *       - Alerts
+ */
+router.post("/alert-firings/acknowledge-all", (req, res) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  getDb()
+    .$client.prepare(
+      "UPDATE alert_firings SET acknowledged = 1 WHERE user_id = ?",
+    )
+    .run(userId);
+  DatabaseSaveTrigger.triggerSave("alert_firings_acknowledged_all");
+  res.json({ success: true });
+});
+
+export default router;
@@ -7,6 +7,8 @@ import { eq } from "drizzle-orm";
 import ssh2Pkg from "ssh2";
 import { db } from "../db/index.js";
 import { hosts, sshCredentials } from "../db/schema.js";
+import { preparePrivateKeyForSSH2 } from "../../utils/ssh-key-utils.js";
+import { applyAgentAuth } from "../../ssh/terminal-auth-helpers.js";

 const { Client } = ssh2Pkg;

@@ -263,97 +265,100 @@ async function deploySSHKeyToHost(
      resolve({ success: false, error: errorMessage });
    });

-    try {
-      const connectionConfig: Record<string, unknown> = {
-        host: hostConfig.ip,
-        port: hostConfig.port || 22,
-        username: hostConfig.username,
-        readyTimeout: 60000,
-        keepaliveInterval: 30000,
-        keepaliveCountMax: 3,
-        tcpKeepAlive: true,
-        tcpKeepAliveInitialDelay: 30000,
-        algorithms: {
-          kex: [
-            "diffie-hellman-group14-sha256",
-            "diffie-hellman-group14-sha1",
-            "diffie-hellman-group1-sha1",
-            "diffie-hellman-group-exchange-sha256",
-            "diffie-hellman-group-exchange-sha1",
-            "ecdh-sha2-nistp256",
-            "ecdh-sha2-nistp384",
-            "ecdh-sha2-nistp521",
-          ],
-          cipher: [
-            "aes128-ctr",
-            "aes192-ctr",
-            "aes256-ctr",
-            "aes128-gcm@openssh.com",
-            "aes256-gcm@openssh.com",
-            "aes128-cbc",
-            "aes192-cbc",
-            "aes256-cbc",
-            "3des-cbc",
-          ],
-          hmac: [
-            "hmac-sha2-256-etm@openssh.com",
-            "hmac-sha2-512-etm@openssh.com",
-            "hmac-sha2-256",
-            "hmac-sha2-512",
-            "hmac-sha1",
-            "hmac-md5",
-          ],
-          compress: ["none", "zlib@openssh.com", "zlib"],
-        },
-      };
+    void (async () => {
+      try {
+        const connectionConfig: Record<string, unknown> = {
+          host: hostConfig.ip,
+          port: hostConfig.port || 22,
+          username: hostConfig.username,
+          readyTimeout: 60000,
+          keepaliveInterval: 30000,
+          keepaliveCountMax: 3,
+          tcpKeepAlive: true,
+          tcpKeepAliveInitialDelay: 30000,
+          algorithms: {
+            kex: [
+              "diffie-hellman-group14-sha256",
+              "diffie-hellman-group14-sha1",
+              "diffie-hellman-group1-sha1",
+              "diffie-hellman-group-exchange-sha256",
+              "diffie-hellman-group-exchange-sha1",
+              "ecdh-sha2-nistp256",
+              "ecdh-sha2-nistp384",
+              "ecdh-sha2-nistp521",
+            ],
+            cipher: [
+              "aes128-ctr",
+              "aes192-ctr",
+              "aes256-ctr",
+              "aes128-gcm@openssh.com",
+              "aes256-gcm@openssh.com",
+              "aes128-cbc",
+              "aes192-cbc",
+              "aes256-cbc",
+              "3des-cbc",
+            ],
+            hmac: [
+              "hmac-sha2-256-etm@openssh.com",
+              "hmac-sha2-512-etm@openssh.com",
+              "hmac-sha2-256",
+              "hmac-sha2-512",
+              "hmac-sha1",
+              "hmac-md5",
+            ],
+            compress: ["none", "zlib@openssh.com", "zlib"],
+          },
+        };

-      if (hostConfig.authType === "password" && hostConfig.password) {
-        connectionConfig.password = hostConfig.password;
-      } else if (hostConfig.authType === "key" && hostConfig.privateKey) {
-        try {
-          const privateKey = hostConfig.privateKey as string;
-          if (
-            !privateKey.includes("-----BEGIN") ||
-            !privateKey.includes("-----END")
-          ) {
-            throw new Error("Invalid private key format");
+        if (hostConfig.authType === "password" && hostConfig.password) {
+          connectionConfig.password = hostConfig.password;
+        } else if (hostConfig.authType === "key" && hostConfig.privateKey) {
+          try {
+            const privateKey = hostConfig.privateKey as string;
+            connectionConfig.privateKey = preparePrivateKeyForSSH2(
+              privateKey,
+              hostConfig.keyPassword as string | undefined,
+            );
+
+            if (hostConfig.keyPassword) {
+              connectionConfig.passphrase = hostConfig.keyPassword;
+            }
+          } catch (keyError) {
+            clearTimeout(connectionTimeout);
+            resolve({
+              success: false,
+              error: `Invalid SSH key format: ${keyError instanceof Error ? keyError.message : "Unknown error"}`,
+            });
+            return;
          }
-
-          const cleanKey = privateKey
-            .trim()
-            .replace(/\r\n/g, "\n")
-            .replace(/\r/g, "\n");
-
-          connectionConfig.privateKey = Buffer.from(cleanKey, "utf8");
-
-          if (hostConfig.keyPassword) {
-            connectionConfig.passphrase = hostConfig.keyPassword;
+        } else if (hostConfig.authType === "agent") {
+          const result = await applyAgentAuth(
+            connectionConfig,
+            hostConfig.terminalConfig as Record<string, unknown> | undefined,
+          );
+          if ("error" in result) {
+            clearTimeout(connectionTimeout);
+            resolve({ success: false, error: result.error });
+            return;
          }
-        } catch (keyError) {
+        } else {
          clearTimeout(connectionTimeout);
          resolve({
            success: false,
-            error: `Invalid SSH key format: ${keyError instanceof Error ? keyError.message : "Unknown error"}`,
+            error: `Invalid authentication configuration. Auth type: ${hostConfig.authType}, has password: ${!!hostConfig.password}, has key: ${!!hostConfig.privateKey}`,
          });
          return;
        }
-      } else {
+
+        conn.connect(connectionConfig);
+      } catch (error) {
        clearTimeout(connectionTimeout);
        resolve({
          success: false,
-          error: `Invalid authentication configuration. Auth type: ${hostConfig.authType}, has password: ${!!hostConfig.password}, has key: ${!!hostConfig.privateKey}`,
+          error: error instanceof Error ? error.message : "Connection failed",
        });
-        return;
      }
-
-      conn.connect(connectionConfig);
-    } catch (error) {
-      clearTimeout(connectionTimeout);
-      resolve({
-        success: false,
-        error: error instanceof Error ? error.message : "Connection failed",
-      });
-    }
+    })();
  });
 }

@@ -479,6 +484,7 @@ export function registerCredentialDeployRoutes(
          password: hostData.password,
          privateKey: hostData.key,
          keyPassword: hostData.keyPassword,
+          terminalConfig: hostData.terminalConfig,
        };

        if (hostData.authType === "credential" && hostData.credentialId) {
@@ -137,8 +137,7 @@ router.post(
          .status(400)
          .json({ error: "SSH key is required for key authentication" });
      }
-      const plainPassword =
-        authType === "password" && password ? password : null;
+      const plainPassword = password ? password : null;
      const plainKey = authType === "key" && key ? key : null;
      const plainKeyPassword =
        authType === "key" && keyPassword ? keyPassword : null;
@@ -154,7 +153,9 @@ router.post(
            error: keyInfo.error,
          });
          return res.status(400).json({
-            error: `Invalid SSH key: ${keyInfo.error}`,
+            error: keyInfo.error
+              ? `Invalid SSH key: ${keyInfo.error}`
+              : "Unrecognized SSH key format. Use an OpenSSH, PEM, or PuTTY PPK v2 RSA/DSA private key.",
          });
        }
      }
@@ -512,10 +513,11 @@ router.put(
      if (updateData.password !== undefined) {
        updateFields.password = updateData.password || null;
      }
+      const nextAuthType = updateData.authType ?? existing[0].authType;
      if (updateData.key !== undefined) {
        updateFields.key = updateData.key || null;

-        if (updateData.key && existing[0].authType === "key") {
+        if (updateData.key && nextAuthType === "key") {
          const keyInfo = parseSSHKey(updateData.key, updateData.keyPassword);
          if (!keyInfo.success) {
            authLogger.warn("SSH key parsing failed during update", {
@@ -525,7 +527,9 @@ router.put(
              error: keyInfo.error,
            });
            return res.status(400).json({
-              error: `Invalid SSH key: ${keyInfo.error}`,
+              error: keyInfo.error
+                ? `Invalid SSH key: ${keyInfo.error}`
+                : "Unrecognized SSH key format. Use an OpenSSH, PEM, or PuTTY PPK v2 RSA/DSA private key.",
            });
          }
          updateFields.privateKey = keyInfo.privateKey;
@@ -986,7 +990,7 @@ function formatSSHHostOutput(
    tunnelConnections: host.tunnelConnections
      ? JSON.parse(host.tunnelConnections as string)
      : [],
-    enableFileManager: !!host.enableFileManager,
+    enableFileManager: host.enableFileManager !== false,
    defaultPath: host.defaultPath,
    createdAt: host.createdAt,
    updatedAt: host.updatedAt,
@@ -0,0 +1,280 @@
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import type { Request, Response } from "express";
+import { and, asc, eq } from "drizzle-orm";
+import { dashboardLogger } from "../../utils/logger.js";
+import { db } from "../db/index.js";
+import { dashboardServiceLinks } from "../db/schema.js";
+import { isNonEmptyString } from "./host-normalizers.js";
+import {
+  isValidServiceLinkUrl,
+  normalizeServiceLinkUrl,
+} from "./service-link-url.js";
+import express from "express";
+
+export const dashboardServiceLinksRouter = express.Router();
+
+/**
+ * @openapi
+ * /service-links:
+ *   get:
+ *     summary: Get service links
+ *     description: Returns all dashboard service links for the authenticated user.
+ *     tags:
+ *       - Dashboard
+ *     responses:
+ *       200:
+ *         description: List of service links.
+ *       500:
+ *         description: Failed to fetch service links.
+ */
+dashboardServiceLinksRouter.get("/", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  try {
+    const links = await db
+      .select()
+      .from(dashboardServiceLinks)
+      .where(eq(dashboardServiceLinks.userId, userId))
+      .orderBy(asc(dashboardServiceLinks.order), asc(dashboardServiceLinks.id));
+    res.json(links);
+  } catch (err) {
+    dashboardLogger.error("Failed to fetch service links", err);
+    res.status(500).json({ error: "Failed to fetch service links" });
+  }
+});
+
+/**
+ * @openapi
+ * /service-links:
+ *   post:
+ *     summary: Create service link
+ *     description: Creates a new dashboard service link for the authenticated user.
+ *     tags:
+ *       - Dashboard
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             required:
+ *               - label
+ *               - url
+ *             properties:
+ *               label:
+ *                 type: string
+ *               url:
+ *                 type: string
+ *     responses:
+ *       201:
+ *         description: Service link created.
+ *       400:
+ *         description: Invalid data.
+ *       500:
+ *         description: Failed to create service link.
+ */
+dashboardServiceLinksRouter.post("/", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const { label, url } = req.body;
+
+  if (!isNonEmptyString(label) || !isNonEmptyString(url)) {
+    return res.status(400).json({ error: "label and url are required" });
+  }
+  const normalizedUrl = normalizeServiceLinkUrl(url);
+  if (!isValidServiceLinkUrl(normalizedUrl)) {
+    return res
+      .status(400)
+      .json({ error: "url must be a valid http or https URL" });
+  }
+
+  try {
+    const existing = await db
+      .select({ order: dashboardServiceLinks.order })
+      .from(dashboardServiceLinks)
+      .where(eq(dashboardServiceLinks.userId, userId))
+      .orderBy(asc(dashboardServiceLinks.order));
+
+    const nextOrder =
+      existing.length > 0 ? existing[existing.length - 1].order + 1 : 0;
+
+    const [created] = await db
+      .insert(dashboardServiceLinks)
+      .values({
+        userId,
+        label: label.trim(),
+        url: normalizedUrl,
+        order: nextOrder,
+        createdAt: new Date().toISOString(),
+      })
+      .returning();
+
+    res.status(201).json(created);
+  } catch (err) {
+    dashboardLogger.error("Failed to create service link", err);
+    res.status(500).json({ error: "Failed to create service link" });
+  }
+});
+
+/**
+ * @openapi
+ * /service-links/{id}:
+ *   delete:
+ *     summary: Delete service link
+ *     description: Deletes a dashboard service link by ID.
+ *     tags:
+ *       - Dashboard
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Service link deleted.
+ *       400:
+ *         description: Invalid id.
+ *       404:
+ *         description: Not found.
+ *       500:
+ *         description: Failed to delete service link.
+ */
+dashboardServiceLinksRouter.delete(
+  "/:id",
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    const idParam = Array.isArray(req.params.id)
+      ? req.params.id[0]
+      : req.params.id;
+    const id = parseInt(idParam);
+
+    if (isNaN(id)) {
+      return res.status(400).json({ error: "Invalid id" });
+    }
+
+    try {
+      const existing = await db
+        .select()
+        .from(dashboardServiceLinks)
+        .where(
+          and(
+            eq(dashboardServiceLinks.id, id),
+            eq(dashboardServiceLinks.userId, userId),
+          ),
+        );
+
+      if (existing.length === 0) {
+        return res.status(404).json({ error: "Not found" });
+      }
+
+      await db
+        .delete(dashboardServiceLinks)
+        .where(
+          and(
+            eq(dashboardServiceLinks.id, id),
+            eq(dashboardServiceLinks.userId, userId),
+          ),
+        );
+
+      res.json({ message: "Service link deleted" });
+    } catch (err) {
+      dashboardLogger.error("Failed to delete service link", err);
+      res.status(500).json({ error: "Failed to delete service link" });
+    }
+  },
+);
+
+/**
+ * @openapi
+ * /service-links/{id}:
+ *   put:
+ *     summary: Update service link
+ *     description: Updates label or url of a dashboard service link.
+ *     tags:
+ *       - Dashboard
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               label:
+ *                 type: string
+ *               url:
+ *                 type: string
+ *     responses:
+ *       200:
+ *         description: Service link updated.
+ *       400:
+ *         description: Invalid data.
+ *       404:
+ *         description: Not found.
+ *       500:
+ *         description: Failed to update service link.
+ */
+dashboardServiceLinksRouter.put("/:id", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const idParam = Array.isArray(req.params.id)
+    ? req.params.id[0]
+    : req.params.id;
+  const id = parseInt(idParam);
+  const { label, url } = req.body;
+
+  if (isNaN(id)) {
+    return res.status(400).json({ error: "Invalid id" });
+  }
+  const normalizedUrl = isNonEmptyString(url)
+    ? normalizeServiceLinkUrl(url)
+    : undefined;
+  if (normalizedUrl !== undefined && !isValidServiceLinkUrl(normalizedUrl)) {
+    return res
+      .status(400)
+      .json({ error: "url must be a valid http or https URL" });
+  }
+
+  try {
+    const existing = await db
+      .select()
+      .from(dashboardServiceLinks)
+      .where(
+        and(
+          eq(dashboardServiceLinks.id, id),
+          eq(dashboardServiceLinks.userId, userId),
+        ),
+      );
+
+    if (existing.length === 0) {
+      return res.status(404).json({ error: "Not found" });
+    }
+
+    const updates: Partial<{ label: string; url: string }> = {};
+    if (isNonEmptyString(label)) updates.label = label.trim();
+    if (normalizedUrl !== undefined) updates.url = normalizedUrl;
+
+    if (Object.keys(updates).length === 0) {
+      return res.status(400).json({ error: "Nothing to update" });
+    }
+
+    const [updated] = await db
+      .update(dashboardServiceLinks)
+      .set(updates)
+      .where(
+        and(
+          eq(dashboardServiceLinks.id, id),
+          eq(dashboardServiceLinks.userId, userId),
+        ),
+      )
+      .returning();
+
+    res.json(updated);
+  } catch (err) {
+    dashboardLogger.error("Failed to update service link", err);
+    res.status(500).json({ error: "Failed to update service link" });
+  }
+});
@@ -0,0 +1,103 @@
+import type { Request, Response } from "express";
+import { homepageLogger } from "../../utils/logger.js";
+import express from "express";
+import https from "https";
+import http from "http";
+
+export const homepageFaviconRouter = express.Router();
+
+// Simple LRU cache: url -> { data: Buffer, contentType: string, expires: number }
+const faviconCache = new Map<
+  string,
+  { data: Buffer; contentType: string; expires: number }
+>();
+const CACHE_SIZE = 100;
+const CACHE_TTL_MS = 1000 * 60 * 60 * 24; // 24 hours
+
+function evictIfNeeded() {
+  if (faviconCache.size >= CACHE_SIZE) {
+    const oldest = faviconCache.keys().next().value;
+    if (oldest) faviconCache.delete(oldest);
+  }
+}
+
+function fetchUrl(url: string): Promise<{ data: Buffer; contentType: string }> {
+  return new Promise((resolve, reject) => {
+    const mod = url.startsWith("https") ? https : http;
+    const req = mod.get(url, { timeout: 5000 }, (res) => {
+      const chunks: Buffer[] = [];
+      res.on("data", (chunk: Buffer) => chunks.push(chunk));
+      res.on("end", () => {
+        resolve({
+          data: Buffer.concat(chunks),
+          contentType: res.headers["content-type"] || "image/x-icon",
+        });
+      });
+      res.on("error", reject);
+    });
+    req.on("error", reject);
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("Favicon fetch timeout"));
+    });
+  });
+}
+
+/**
+ * @openapi
+ * /homepage/favicon:
+ *   get:
+ *     summary: Proxy favicon fetch
+ *     description: Fetches and caches a site favicon server-side to avoid CORS issues.
+ *     tags:
+ *       - Homepage
+ *     parameters:
+ *       - in: query
+ *         name: url
+ *         required: true
+ *         schema:
+ *           type: string
+ *     responses:
+ *       200:
+ *         description: Favicon image.
+ *       400:
+ *         description: Invalid URL.
+ *       500:
+ *         description: Failed to fetch favicon.
+ */
+homepageFaviconRouter.get("/", async (req: Request, res: Response) => {
+  const rawUrl = req.query.url as string;
+  if (!rawUrl) return res.status(400).json({ error: "url is required" });
+
+  let domain: string;
+  try {
+    domain = new URL(rawUrl).hostname;
+  } catch {
+    return res.status(400).json({ error: "Invalid URL" });
+  }
+
+  const cached = faviconCache.get(domain);
+  if (cached && cached.expires > Date.now()) {
+    res.setHeader("Content-Type", cached.contentType);
+    res.setHeader("Cache-Control", "public, max-age=86400");
+    return res.send(cached.data);
+  }
+
+  const faviconUrl = `https://www.google.com/s2/favicons?sz=64&domain_url=${encodeURIComponent(domain)}`;
+
+  try {
+    const { data, contentType } = await fetchUrl(faviconUrl);
+    evictIfNeeded();
+    faviconCache.set(domain, {
+      data,
+      contentType,
+      expires: Date.now() + CACHE_TTL_MS,
+    });
+    res.setHeader("Content-Type", contentType);
+    res.setHeader("Cache-Control", "public, max-age=86400");
+    res.send(data);
+  } catch (err) {
+    homepageLogger.warn("Failed to fetch favicon", { domain });
+    res.status(500).json({ error: "Failed to fetch favicon" });
+  }
+});
@@ -0,0 +1,225 @@
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import type { Request, Response } from "express";
+import { and, asc, eq } from "drizzle-orm";
+import { homepageLogger } from "../../utils/logger.js";
+import { db } from "../db/index.js";
+import { homepageItems } from "../db/schema.js";
+import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
+import express from "express";
+
+export const homepageItemsRouter = express.Router();
+
+/**
+ * @openapi
+ * /homepage/items:
+ *   get:
+ *     summary: Get homepage items
+ *     description: Returns all homepage widget items for the authenticated user.
+ *     tags:
+ *       - Homepage
+ *     responses:
+ *       200:
+ *         description: List of homepage items.
+ *       500:
+ *         description: Failed to fetch homepage items.
+ */
+homepageItemsRouter.get("/", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  try {
+    const items = await db
+      .select()
+      .from(homepageItems)
+      .where(eq(homepageItems.userId, userId))
+      .orderBy(asc(homepageItems.id));
+    res.json(items);
+  } catch (err) {
+    homepageLogger.error("Failed to fetch homepage items", err);
+    res.status(500).json({ error: "Failed to fetch homepage items" });
+  }
+});
+
+/**
+ * @openapi
+ * /homepage/items:
+ *   post:
+ *     summary: Create homepage item
+ *     description: Creates a new homepage widget item for the authenticated user.
+ *     tags:
+ *       - Homepage
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             required:
+ *               - typeId
+ *             properties:
+ *               typeId:
+ *                 type: string
+ *               title:
+ *                 type: string
+ *               config:
+ *                 type: object
+ *     responses:
+ *       201:
+ *         description: Homepage item created.
+ *       400:
+ *         description: Invalid data.
+ *       500:
+ *         description: Failed to create homepage item.
+ */
+homepageItemsRouter.post("/", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const { typeId, title, config } = req.body;
+
+  if (!typeId || typeof typeId !== "string") {
+    return res.status(400).json({ error: "typeId is required" });
+  }
+
+  try {
+    const [created] = await db
+      .insert(homepageItems)
+      .values({
+        userId,
+        typeId,
+        title: title ?? null,
+        config: config ? JSON.stringify(config) : "{}",
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+      })
+      .returning();
+    DatabaseSaveTrigger.triggerSave("homepage_item_created");
+    res.status(201).json(created);
+  } catch (err) {
+    homepageLogger.error("Failed to create homepage item", err);
+    res.status(500).json({ error: "Failed to create homepage item" });
+  }
+});
+
+/**
+ * @openapi
+ * /homepage/items/{id}:
+ *   put:
+ *     summary: Update homepage item
+ *     description: Updates a homepage widget item.
+ *     tags:
+ *       - Homepage
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               title:
+ *                 type: string
+ *               config:
+ *                 type: object
+ *     responses:
+ *       200:
+ *         description: Homepage item updated.
+ *       400:
+ *         description: Invalid data.
+ *       404:
+ *         description: Not found.
+ *       500:
+ *         description: Failed to update homepage item.
+ */
+homepageItemsRouter.put("/:id", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const id = parseInt(req.params.id as string);
+  if (isNaN(id)) return res.status(400).json({ error: "Invalid id" });
+
+  const { title, config } = req.body;
+
+  try {
+    const existing = await db
+      .select()
+      .from(homepageItems)
+      .where(and(eq(homepageItems.id, id), eq(homepageItems.userId, userId)));
+
+    if (existing.length === 0) {
+      return res.status(404).json({ error: "Not found" });
+    }
+
+    const updates: Partial<{
+      title: string | null;
+      config: string;
+      updatedAt: string;
+    }> = {
+      updatedAt: new Date().toISOString(),
+    };
+    if (title !== undefined) updates.title = title;
+    if (config !== undefined) updates.config = JSON.stringify(config);
+
+    const [updated] = await db
+      .update(homepageItems)
+      .set(updates)
+      .where(and(eq(homepageItems.id, id), eq(homepageItems.userId, userId)))
+      .returning();
+
+    DatabaseSaveTrigger.triggerSave("homepage_item_updated");
+    res.json(updated);
+  } catch (err) {
+    homepageLogger.error("Failed to update homepage item", err);
+    res.status(500).json({ error: "Failed to update homepage item" });
+  }
+});
+
+/**
+ * @openapi
+ * /homepage/items/{id}:
+ *   delete:
+ *     summary: Delete homepage item
+ *     description: Deletes a homepage widget item and cascades deletion to children if a folder.
+ *     tags:
+ *       - Homepage
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Homepage item deleted.
+ *       400:
+ *         description: Invalid id.
+ *       404:
+ *         description: Not found.
+ *       500:
+ *         description: Failed to delete homepage item.
+ */
+homepageItemsRouter.delete("/:id", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const id = parseInt(req.params.id as string);
+  if (isNaN(id)) return res.status(400).json({ error: "Invalid id" });
+
+  try {
+    const existing = await db
+      .select()
+      .from(homepageItems)
+      .where(and(eq(homepageItems.id, id), eq(homepageItems.userId, userId)));
+
+    if (existing.length === 0) {
+      return res.status(404).json({ error: "Not found" });
+    }
+
+    await db
+      .delete(homepageItems)
+      .where(and(eq(homepageItems.id, id), eq(homepageItems.userId, userId)));
+
+    DatabaseSaveTrigger.triggerSave("homepage_item_deleted");
+    res.json({ message: "Homepage item deleted" });
+  } catch (err) {
+    homepageLogger.error("Failed to delete homepage item", err);
+    res.status(500).json({ error: "Failed to delete homepage item" });
+  }
+});
@@ -0,0 +1,110 @@
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import type { Request, Response } from "express";
+import { eq } from "drizzle-orm";
+import { homepageLogger } from "../../utils/logger.js";
+import { db } from "../db/index.js";
+import { homepageLayouts } from "../db/schema.js";
+import { DatabaseSaveTrigger } from "../../utils/database-save-trigger.js";
+import express from "express";
+
+export const homepageLayoutRouter = express.Router();
+
+/**
+ * @openapi
+ * /homepage/layout:
+ *   get:
+ *     summary: Get homepage layout
+ *     description: Returns the homepage canvas layout (widget positions, pan, zoom) for the authenticated user.
+ *     tags:
+ *       - Homepage
+ *     responses:
+ *       200:
+ *         description: Layout data or null.
+ *       500:
+ *         description: Failed to fetch homepage layout.
+ */
+homepageLayoutRouter.get("/", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  try {
+    const rows = await db
+      .select()
+      .from(homepageLayouts)
+      .where(eq(homepageLayouts.userId, userId));
+
+    if (rows.length === 0) {
+      return res.json(null);
+    }
+
+    const row = rows[0];
+    const parsed = JSON.parse(row.layout || "{}");
+    res.json({ ...row, layout: parsed });
+  } catch (err) {
+    homepageLogger.error("Failed to fetch homepage layout", err);
+    res.status(500).json({ error: "Failed to fetch homepage layout" });
+  }
+});
+
+/**
+ * @openapi
+ * /homepage/layout:
+ *   put:
+ *     summary: Save homepage layout
+ *     description: Saves or updates the homepage canvas layout for the authenticated user.
+ *     tags:
+ *       - Homepage
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               entries:
+ *                 type: array
+ *               pan:
+ *                 type: object
+ *               zoom:
+ *                 type: number
+ *     responses:
+ *       200:
+ *         description: Layout saved.
+ *       500:
+ *         description: Failed to save homepage layout.
+ */
+homepageLayoutRouter.put("/", async (req: Request, res: Response) => {
+  const userId = (req as AuthenticatedRequest).userId;
+  const layoutData = req.body;
+
+  try {
+    const existing = await db
+      .select({ id: homepageLayouts.id })
+      .from(homepageLayouts)
+      .where(eq(homepageLayouts.userId, userId));
+
+    const layoutJson = JSON.stringify(layoutData);
+    const now = new Date().toISOString();
+
+    if (existing.length === 0) {
+      const [created] = await db
+        .insert(homepageLayouts)
+        .values({ userId, layout: layoutJson, updatedAt: now })
+        .returning();
+      const parsed = JSON.parse(created.layout);
+      DatabaseSaveTrigger.triggerSave("homepage_layout_saved");
+      return res.json({ ...created, layout: parsed });
+    }
+
+    const [updated] = await db
+      .update(homepageLayouts)
+      .set({ layout: layoutJson, updatedAt: now })
+      .where(eq(homepageLayouts.userId, userId))
+      .returning();
+
+    const parsed = JSON.parse(updated.layout);
+    DatabaseSaveTrigger.triggerSave("homepage_layout_saved");
+    res.json({ ...updated, layout: parsed });
+  } catch (err) {
+    homepageLogger.error("Failed to save homepage layout", err);
+    res.status(500).json({ error: "Failed to save homepage layout" });
+  }
+});
@@ -0,0 +1,127 @@
+import type { Request, Response } from "express";
+import express from "express";
+import https from "https";
+import http from "http";
+import { homepageLogger } from "../../utils/logger.js";
+
+export const homepagePingRouter = express.Router();
+
+interface PingCacheEntry {
+  ok: boolean;
+  statusCode: number | null;
+  latencyMs: number;
+  expires: number;
+}
+
+const pingCache = new Map<string, PingCacheEntry>();
+const CACHE_SIZE = 200;
+const FETCH_TIMEOUT_MS = 5000;
+
+function pingUrl(
+  url: string,
+): Promise<{ ok: boolean; statusCode: number | null; latencyMs: number }> {
+  return new Promise((resolve) => {
+    const start = performance.now();
+    const mod = url.startsWith("https") ? https : http;
+
+    const done = (ok: boolean, statusCode: number | null) => {
+      resolve({
+        ok,
+        statusCode,
+        latencyMs: Math.round(performance.now() - start),
+      });
+    };
+
+    const tryGet = () => {
+      const req = mod.get(url, { timeout: FETCH_TIMEOUT_MS }, (res) => {
+        res.resume();
+        const code = res.statusCode ?? null;
+        done(code !== null && code < 400, code);
+      });
+      req.on("error", () => done(false, null));
+      req.on("timeout", () => {
+        req.destroy();
+        done(false, null);
+      });
+    };
+
+    const req = mod.request(
+      url,
+      { method: "HEAD", timeout: FETCH_TIMEOUT_MS },
+      (res) => {
+        res.resume();
+        const code = res.statusCode ?? null;
+        if (code === 405) {
+          tryGet();
+        } else {
+          done(code !== null && code < 400, code);
+        }
+      },
+    );
+    req.on("error", () => done(false, null));
+    req.on("timeout", () => {
+      req.destroy();
+      done(false, null);
+    });
+    req.end();
+  });
+}
+
+/**
+ * @openapi
+ * /homepage/ping:
+ *   get:
+ *     summary: Check the HTTP reachability and latency of a URL
+ *     tags:
+ *       - Homepage
+ *     parameters:
+ *       - in: query
+ *         name: url
+ *         required: true
+ *         schema:
+ *           type: string
+ *       - in: query
+ *         name: ttl
+ *         schema:
+ *           type: integer
+ *           description: Cache TTL in seconds (min 10)
+ *     responses:
+ *       200:
+ *         description: Ping result with ok, statusCode and latencyMs.
+ *       400:
+ *         description: Invalid or missing URL.
+ */
+homepagePingRouter.get("/", async (req: Request, res: Response) => {
+  let targetUrl = req.query.url as string;
+  const ttl = Math.max(10, Number(req.query.ttl) || 30) * 1000;
+
+  if (!targetUrl) return res.status(400).json({ error: "url is required" });
+  if (!/^https?:\/\//i.test(targetUrl)) targetUrl = `https://${targetUrl}`;
+  try {
+    new URL(targetUrl);
+  } catch {
+    return res.status(400).json({ error: "Invalid URL" });
+  }
+
+  const cached = pingCache.get(targetUrl);
+  if (cached && cached.expires > Date.now()) {
+    return res.json({
+      ok: cached.ok,
+      statusCode: cached.statusCode,
+      latencyMs: cached.latencyMs,
+    });
+  }
+
+  try {
+    const result = await pingUrl(targetUrl);
+    if (pingCache.size >= CACHE_SIZE) {
+      const oldest = pingCache.keys().next().value;
+      if (oldest) pingCache.delete(oldest);
+    }
+    pingCache.set(targetUrl, { ...result, expires: Date.now() + ttl });
+    res.json(result);
+  } catch (err) {
+    homepageLogger.warn("Ping failed", { targetUrl });
+    res.status(500).json({ error: "Ping failed" });
+  }
+});
@@ -0,0 +1,100 @@
+import type { Request, Response } from "express";
+import express from "express";
+import https from "https";
+import http from "http";
+import { homepageLogger } from "../../utils/logger.js";
+
+export const homepageProxyRouter = express.Router();
+
+interface ProxyCacheEntry {
+  data: unknown;
+  expires: number;
+}
+
+const proxyCache = new Map<string, ProxyCacheEntry>();
+const CACHE_SIZE = 50;
+const FETCH_TIMEOUT_MS = 8000;
+
+function fetchJson(url: string): Promise<unknown> {
+  return new Promise((resolve, reject) => {
+    const mod = url.startsWith("https") ? https : http;
+    const req = mod.get(url, { timeout: FETCH_TIMEOUT_MS }, (res) => {
+      const chunks: Buffer[] = [];
+      res.on("data", (chunk: Buffer) => chunks.push(chunk));
+      res.on("end", () => {
+        try {
+          const text = Buffer.concat(chunks).toString("utf-8");
+          resolve(JSON.parse(text));
+        } catch {
+          reject(new Error("Response is not valid JSON"));
+        }
+      });
+      res.on("error", reject);
+    });
+    req.on("error", reject);
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("Fetch timeout"));
+    });
+  });
+}
+
+/**
+ * @openapi
+ * /homepage/proxy:
+ *   get:
+ *     summary: Proxy a JSON API URL and return the parsed response
+ *     tags:
+ *       - Homepage
+ *     parameters:
+ *       - in: query
+ *         name: url
+ *         required: true
+ *         schema:
+ *           type: string
+ *       - in: query
+ *         name: ttl
+ *         schema:
+ *           type: integer
+ *           description: Cache TTL in seconds (min 10, default 60)
+ *     responses:
+ *       200:
+ *         description: The JSON body returned by the target URL.
+ *       400:
+ *         description: Invalid or missing URL, or non-JSON response.
+ *       500:
+ *         description: Failed to fetch the target URL.
+ */
+homepageProxyRouter.get("/", async (req: Request, res: Response) => {
+  const targetUrl = req.query.url as string;
+  const ttl = Math.max(10, Number(req.query.ttl) || 60) * 1000;
+
+  if (!targetUrl) return res.status(400).json({ error: "url is required" });
+  try {
+    new URL(targetUrl);
+  } catch {
+    return res.status(400).json({ error: "Invalid URL" });
+  }
+
+  const cached = proxyCache.get(targetUrl);
+  if (cached && cached.expires > Date.now()) {
+    return res.json(cached.data);
+  }
+
+  try {
+    const data = await fetchJson(targetUrl);
+    if (proxyCache.size >= CACHE_SIZE) {
+      const oldest = proxyCache.keys().next().value;
+      if (oldest) proxyCache.delete(oldest);
+    }
+    proxyCache.set(targetUrl, { data, expires: Date.now() + ttl });
+    res.json(data);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : "Unknown error";
+    homepageLogger.warn("Proxy fetch failed", { targetUrl, msg });
+    if (msg.includes("not valid JSON")) {
+      return res.status(400).json({ error: "Response is not valid JSON" });
+    }
+    res.status(500).json({ error: "Failed to fetch URL" });
+  }
+});
@@ -0,0 +1,148 @@
+import type { Request, Response } from "express";
+import express from "express";
+import https from "https";
+import http from "http";
+import { homepageLogger } from "../../utils/logger.js";
+
+export const homepageRssRouter = express.Router();
+
+const rssCache = new Map<string, { data: RssItem[]; expires: number }>();
+const CACHE_TTL_MS = 1000 * 60 * 15; // 15 minutes
+const CACHE_SIZE = 50;
+const FETCH_TIMEOUT_MS = 8000;
+
+interface RssItem {
+  title: string;
+  link: string;
+  pubDate: string | null;
+  description: string | null;
+}
+
+function fetchXml(url: string): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const mod = url.startsWith("https") ? https : http;
+    const req = mod.get(url, { timeout: FETCH_TIMEOUT_MS }, (res) => {
+      const chunks: Buffer[] = [];
+      res.on("data", (chunk: Buffer) => chunks.push(chunk));
+      res.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+      res.on("error", reject);
+    });
+    req.on("error", reject);
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("RSS fetch timeout"));
+    });
+  });
+}
+
+function parseRss(xml: string): RssItem[] {
+  const items: RssItem[] = [];
+  const itemRegex = /<item[\s>]([\s\S]*?)<\/item>/gi;
+  let match: RegExpExecArray | null;
+
+  const getText = (tag: string, src: string): string | null => {
+    const m = new RegExp(
+      `<${tag}[^>]*><!\\[CDATA\\[([\\s\\S]*?)\\]\\]><\\/${tag}>|<${tag}[^>]*>([\\s\\S]*?)<\\/${tag}>`,
+      "i",
+    ).exec(src);
+    if (!m) return null;
+    return (m[1] ?? m[2]).trim();
+  };
+
+  const getLink = (src: string): string => {
+    // Self-closing <link rel="alternate" href="..." /> (BBC style)
+    const selfClose = /<link[^>]+href="([^"]+)"[^>]*\/?>/i.exec(src);
+    if (selfClose) return selfClose[1];
+    // Plain text <link>url</link>
+    return getText("link", src) ?? "";
+  };
+
+  while ((match = itemRegex.exec(xml)) !== null) {
+    const src = match[1];
+    items.push({
+      title: getText("title", src) ?? "(no title)",
+      link: getLink(src),
+      pubDate: getText("pubDate", src) ?? getText("updated", src),
+      description: getText("description", src) ?? getText("summary", src),
+    });
+    if (items.length >= 50) break;
+  }
+
+  // Atom feed fallback
+  if (items.length === 0) {
+    const entryRegex = /<entry[\s>]([\s\S]*?)<\/entry>/gi;
+    while ((match = entryRegex.exec(xml)) !== null) {
+      const src = match[1];
+      const linkMatch = /<link[^>]+href="([^"]+)"/.exec(src);
+      items.push({
+        title: getText("title", src) ?? "(no title)",
+        link: linkMatch?.[1] ?? "",
+        pubDate: getText("published", src) ?? getText("updated", src),
+        description: getText("summary", src) ?? getText("content", src),
+      });
+      if (items.length >= 50) break;
+    }
+  }
+
+  return items;
+}
+
+/**
+ * @openapi
+ * /homepage/rss:
+ *   get:
+ *     summary: Proxy and parse an RSS/Atom feed
+ *     tags:
+ *       - Homepage
+ *     parameters:
+ *       - in: query
+ *         name: url
+ *         required: true
+ *         schema:
+ *           type: string
+ *       - in: query
+ *         name: max
+ *         schema:
+ *           type: integer
+ *           default: 10
+ *     responses:
+ *       200:
+ *         description: Array of feed items.
+ *       400:
+ *         description: Invalid or missing URL.
+ *       500:
+ *         description: Failed to fetch or parse the feed.
+ */
+homepageRssRouter.get("/", async (req: Request, res: Response) => {
+  const feedUrl = req.query.url as string;
+  const max = Math.min(50, Math.max(1, Number(req.query.max) || 10));
+
+  if (!feedUrl) return res.status(400).json({ error: "url is required" });
+
+  try {
+    new URL(feedUrl);
+  } catch {
+    return res.status(400).json({ error: "Invalid URL" });
+  }
+
+  const cached = rssCache.get(feedUrl);
+  if (cached && cached.expires > Date.now()) {
+    return res.json(cached.data.slice(0, max));
+  }
+
+  try {
+    const xml = await fetchXml(feedUrl);
+    const items = parseRss(xml);
+
+    if (rssCache.size >= CACHE_SIZE) {
+      const oldest = rssCache.keys().next().value;
+      if (oldest) rssCache.delete(oldest);
+    }
+    rssCache.set(feedUrl, { data: items, expires: Date.now() + CACHE_TTL_MS });
+
+    res.json(items.slice(0, max));
+  } catch (err) {
+    homepageLogger.warn("Failed to fetch RSS feed", { feedUrl });
+    res.status(500).json({ error: "Failed to fetch feed" });
+  }
+});
@@ -0,0 +1,104 @@
+import { describe, it, expect } from "vitest";
+import { parseSSHConfig } from "./host-bulk-routes.js";
+
+describe("parseSSHConfig", () => {
+  it("parses a basic Host block", () => {
+    const config = `
+Host myserver
+    HostName 192.168.1.10
+    User alice
+    Port 2222
+`;
+    const result = parseSSHConfig(config);
+    expect(result).toHaveLength(1);
+    expect(result[0]).toMatchObject({
+      name: "myserver",
+      hostname: "192.168.1.10",
+      user: "alice",
+      port: 2222,
+    });
+  });
+
+  it("parses multiple Host blocks", () => {
+    const config = `
+Host web
+    HostName web.example.com
+    User deploy
+
+Host db
+    HostName db.example.com
+    User postgres
+    Port 5432
+`;
+    const result = parseSSHConfig(config);
+    expect(result).toHaveLength(2);
+    expect(result[0].name).toBe("web");
+    expect(result[1].name).toBe("db");
+    expect(result[1].port).toBe(5432);
+  });
+
+  it("ignores comment lines", () => {
+    const config = `
+# This is a comment
+Host server
+    # Another comment
+    HostName 10.0.0.1
+    User root
+`;
+    const result = parseSSHConfig(config);
+    expect(result).toHaveLength(1);
+    expect(result[0].hostname).toBe("10.0.0.1");
+  });
+
+  it("skips wildcard Host entries", () => {
+    const config = `
+Host *
+    ServerAliveInterval 60
+
+Host prod
+    HostName prod.example.com
+    User ubuntu
+`;
+    const result = parseSSHConfig(config);
+    expect(result).toHaveLength(1);
+    expect(result[0].name).toBe("prod");
+  });
+
+  it("captures IdentityFile and ProxyJump", () => {
+    const config = `
+Host bastion
+    HostName bastion.example.com
+    User ec2-user
+    IdentityFile ~/.ssh/id_rsa
+    ProxyJump jumphost.example.com
+`;
+    const result = parseSSHConfig(config);
+    expect(result).toHaveLength(1);
+    expect(result[0].identityFile).toBe("~/.ssh/id_rsa");
+    expect(result[0].proxyJump).toBe("jumphost.example.com");
+  });
+
+  it("skips Host blocks without a HostName", () => {
+    const config = `
+Host alias-only
+    User foo
+`;
+    const result = parseSSHConfig(config);
+    expect(result).toHaveLength(0);
+  });
+
+  it("defaults port to undefined when not specified", () => {
+    const config = `
+Host server
+    HostName 1.2.3.4
+    User root
+`;
+    const result = parseSSHConfig(config);
+    expect(result[0].port).toBeUndefined();
+  });
+
+  it("returns empty array for empty input", () => {
+    expect(parseSSHConfig("")).toHaveLength(0);
+    expect(parseSSHConfig("   \n\n  ")).toHaveLength(0);
+  });
+});
@@ -11,6 +11,97 @@ import {
  normalizeImportedHost,
 } from "./host-normalizers.js";

+type SSHConfigHost = {
+  name: string;
+  hostname?: string;
+  user?: string;
+  port?: number;
+  identityFile?: string;
+  proxyJump?: string;
+};
+
+type ShareCredential = {
+  alias?: unknown;
+  name?: unknown;
+  description?: unknown;
+  folder?: unknown;
+  tags?: unknown;
+  authType?: unknown;
+  username?: unknown;
+  keyType?: unknown;
+};
+
+function textValue(value: unknown): string | null {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+function tagString(value: unknown): string {
+  if (Array.isArray(value)) {
+    return value
+      .map((tag) => textValue(tag))
+      .filter((tag): tag is string => !!tag)
+      .join(",");
+  }
+  return textValue(value) || "";
+}
+
+function normalizeCredentialAuthType(value: unknown): "password" | "key" {
+  return value === "key" ? "key" : "password";
+}
+
+export function parseSSHConfig(content: string): SSHConfigHost[] {
+  const results: SSHConfigHost[] = [];
+  let current: SSHConfigHost | null = null;
+
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+
+    const spaceIdx = line.indexOf(" ");
+    if (spaceIdx === -1) continue;
+
+    const key = line.slice(0, spaceIdx).toLowerCase();
+    const value = line.slice(spaceIdx + 1).trim();
+
+    if (key === "host") {
+      if (current && current.hostname) results.push(current);
+      // Skip wildcard patterns
+      if (value === "*" || value.includes("*") || value.includes("?")) {
+        current = null;
+      } else {
+        current = { name: value };
+      }
+      continue;
+    }
+
+    if (!current) continue;
+
+    switch (key) {
+      case "hostname":
+        current.hostname = value;
+        break;
+      case "user":
+        current.user = value;
+        break;
+      case "port": {
+        const p = Number.parseInt(value, 10);
+        if (p > 0 && p <= 65535) current.port = p;
+        break;
+      }
+      case "identityfile":
+        if (!current.identityFile) current.identityFile = value;
+        break;
+      case "proxyjump":
+        current.proxyJump = value;
+        break;
+    }
+  }
+
+  if (current && current.hostname) results.push(current);
+
+  return results;
+}
+
 export function registerHostBulkRoutes(
  router: Router,
  authenticateJWT: RequestHandler,
@@ -218,7 +309,11 @@ export function registerHostBulkRoutes(
    authenticateJWT,
    async (req: Request, res: Response) => {
      const userId = (req as AuthenticatedRequest).userId;
-      const { hosts: hostsToImport, overwrite } = req.body;
+      const {
+        hosts: hostsToImport,
+        overwrite,
+        credentials: credentialsToImport,
+      } = req.body;

      if (!Array.isArray(hostsToImport) || hostsToImport.length === 0) {
        return res
@@ -240,6 +335,80 @@ export function registerHostBulkRoutes(
        errors: [] as string[],
      };

+      const credentialAliasMap = new Map<string, number>();
+      const addCredentialAlias = (alias: unknown, id: number) => {
+        const key = textValue(alias);
+        if (key) credentialAliasMap.set(key.toLowerCase(), id);
+      };
+
+      try {
+        const existingCredentials = await SimpleDBOps.select<
+          Record<string, unknown>
+        >(
+          db
+            .select()
+            .from(sshCredentials)
+            .where(eq(sshCredentials.userId, userId)),
+          "ssh_credentials",
+          userId,
+        );
+
+        for (const credential of existingCredentials) {
+          addCredentialAlias(credential.name, credential.id as number);
+        }
+
+        if (Array.isArray(credentialsToImport)) {
+          for (const rawCredential of credentialsToImport as ShareCredential[]) {
+            const alias = textValue(rawCredential.alias);
+            const name = textValue(rawCredential.name) || alias;
+            if (!alias || !name) continue;
+
+            const existingId = credentialAliasMap.get(name.toLowerCase());
+            if (existingId) {
+              addCredentialAlias(alias, existingId);
+              continue;
+            }
+
+            const now = new Date().toISOString();
+            const created = await SimpleDBOps.insert(
+              sshCredentials,
+              "ssh_credentials",
+              {
+                userId,
+                name,
+                description:
+                  textValue(rawCredential.description) ||
+                  "Imported placeholder. Add the secret before connecting.",
+                folder: textValue(rawCredential.folder),
+                tags: tagString(rawCredential.tags),
+                authType: normalizeCredentialAuthType(rawCredential.authType),
+                username: textValue(rawCredential.username),
+                password: null,
+                key: null,
+                privateKey: null,
+                publicKey: null,
+                keyPassword: null,
+                keyType: textValue(rawCredential.keyType),
+                detectedKeyType: null,
+                usageCount: 0,
+                lastUsed: null,
+                createdAt: now,
+                updatedAt: now,
+              },
+              userId,
+            );
+
+            const createdCredential = created as Record<string, unknown>;
+            addCredentialAlias(alias, createdCredential.id as number);
+            addCredentialAlias(name, createdCredential.id as number);
+          }
+        }
+      } catch (error) {
+        results.errors.push(
+          `Credential placeholders: ${error instanceof Error ? error.message : "failed to prepare credential aliases"}`,
+        );
+      }
+
      let existingHostMap: Map<string, { id: number }> | undefined;
      if (overwrite) {
        try {
@@ -264,6 +433,17 @@ export function registerHostBulkRoutes(
        try {
          const effectiveConnectionType = hostData.connectionType || "ssh";

+          if (
+            effectiveConnectionType === "ssh" &&
+            hostData.authType === "credential" &&
+            !hostData.credentialId &&
+            hostData.credentialAlias
+          ) {
+            hostData.credentialId = credentialAliasMap.get(
+              hostData.credentialAlias.toLowerCase(),
+            );
+          }
+
          if (!isNonEmptyString(hostData.ip) || !isValidPort(hostData.port)) {
            results.failed++;
            results.errors.push(
@@ -293,11 +473,12 @@ export function registerHostBulkRoutes(
              "none",
              "opkssh",
              "tailscale",
+              "vault",
            ].includes(hostData.authType)
          ) {
            results.failed++;
            results.errors.push(
-              `Host ${i + 1}: Invalid authType. Must be 'password', 'key', 'credential', 'none', 'opkssh', or 'tailscale'`,
+              `Host ${i + 1}: Invalid authType. Must be 'password', 'key', 'credential', 'none', 'opkssh', 'tailscale', or 'vault'`,
            );
            continue;
          }
@@ -363,6 +544,12 @@ export function registerHostBulkRoutes(

              if (fallback.length > 0) {
                hostData.credentialId = fallback[0].id;
+              } else if (isNonEmptyString(hostData.key)) {
+                hostData.authType = "key";
+                hostData.credentialId = undefined;
+              } else if (isNonEmptyString(hostData.password)) {
+                hostData.authType = "password";
+                hostData.credentialId = undefined;
              } else {
                results.failed++;
                results.errors.push(
@@ -519,4 +706,212 @@ export function registerHostBulkRoutes(
      });
    },
  );
+
+  /**
+   * @openapi
+   * /host/ssh-config-import:
+   *   post:
+   *     summary: Import hosts from an OpenSSH config file
+   *     description: Parses an OpenSSH ~/.ssh/config file and imports the defined hosts.
+   *     tags:
+   *       - SSH
+   *     requestBody:
+   *       required: true
+   *       content:
+   *         application/json:
+   *           schema:
+   *             type: object
+   *             required:
+   *               - content
+   *             properties:
+   *               content:
+   *                 type: string
+   *                 description: Raw text content of the SSH config file.
+   *               overwrite:
+   *                 type: boolean
+   *     responses:
+   *       200:
+   *         description: Import completed.
+   *       400:
+   *         description: Invalid request body.
+   */
+  router.post(
+    "/ssh-config-import",
+    authenticateJWT,
+    async (req: Request, res: Response) => {
+      const userId = (req as AuthenticatedRequest).userId;
+      const { content, overwrite } = req.body;
+
+      if (!isNonEmptyString(content)) {
+        return res.status(400).json({
+          error: "content is required and must be a non-empty string",
+        });
+      }
+
+      let parsed: SSHConfigHost[];
+      try {
+        parsed = parseSSHConfig(content);
+      } catch (err) {
+        return res
+          .status(400)
+          .json({ error: "Failed to parse SSH config file" });
+      }
+
+      if (parsed.length === 0) {
+        return res.status(400).json({
+          error: "No valid Host entries found in the SSH config file",
+        });
+      }
+
+      if (parsed.length > 100) {
+        return res
+          .status(400)
+          .json({ error: "Maximum 100 hosts allowed per import" });
+      }
+
+      const hostsToImport = parsed.map((h) => ({
+        name: h.name,
+        ip: h.hostname,
+        port: h.port ?? 22,
+        username: h.user,
+        authType: h.identityFile ? "key" : undefined,
+        connectionType: "ssh",
+        enableSsh: true,
+        ...(h.proxyJump
+          ? {
+              jumpHosts: [{ host: h.proxyJump, port: 22 }],
+            }
+          : {}),
+      }));
+
+      const results = {
+        success: 0,
+        updated: 0,
+        skipped: 0,
+        failed: 0,
+        errors: [] as string[],
+      };
+
+      let existingHostMap: Map<string, { id: number }> | undefined;
+      if (overwrite) {
+        try {
+          const allHosts = await SimpleDBOps.select<Record<string, unknown>>(
+            db.select().from(hosts).where(eq(hosts.userId, userId)),
+            "ssh_data",
+            userId,
+          );
+          existingHostMap = new Map();
+          for (const h of allHosts) {
+            const key = `${h.ip}:${h.port}:${h.username}`;
+            existingHostMap.set(key, { id: h.id as number });
+          }
+        } catch {
+          existingHostMap = undefined;
+        }
+      }
+
+      for (let i = 0; i < hostsToImport.length; i++) {
+        const hostData = normalizeImportedHost(
+          hostsToImport[i] as Record<string, unknown>,
+        );
+
+        try {
+          if (!isNonEmptyString(hostData.ip) || !isValidPort(hostData.port)) {
+            results.failed++;
+            results.errors.push(
+              `Host "${parsed[i].name}": Missing required fields (HostName, Port)`,
+            );
+            continue;
+          }
+
+          const sshDataObj: Record<string, unknown> = {
+            userId,
+            connectionType: "ssh",
+            name: hostData.name || hostData.ip,
+            folder: "Default",
+            tags: "",
+            ip: hostData.ip,
+            port: hostData.port,
+            username: hostData.username || null,
+            authType: hostData.authType || "none",
+            password: null,
+            key: null,
+            keyPassword: null,
+            keyType: null,
+            credentialId: null,
+            pin: false,
+            enableTerminal: true,
+            enableTunnel: true,
+            enableFileManager: true,
+            enableDocker: false,
+            enableProxmox: false,
+            enableTmuxMonitor: false,
+            showTerminalInSidebar: 0,
+            showFileManagerInSidebar: 0,
+            showTunnelInSidebar: 0,
+            showDockerInSidebar: 0,
+            showServerStatsInSidebar: 0,
+            defaultPath: "/",
+            sudoPassword: null,
+            tunnelConnections: "[]",
+            jumpHosts: hostData.jumpHosts
+              ? JSON.stringify(hostData.jumpHosts)
+              : null,
+            quickActions: null,
+            statsConfig: null,
+            dockerConfig: null,
+            proxmoxConfig: null,
+            terminalConfig: null,
+            forceKeyboardInteractive: "false",
+            notes: null,
+            useSocks5: 0,
+            socks5Host: null,
+            socks5Port: null,
+            socks5Username: null,
+            socks5Password: null,
+            socks5ProxyChain: null,
+            portKnockSequence: null,
+            overrideCredentialUsername: 0,
+            enableSsh: true,
+            enableRdp: false,
+            enableVnc: false,
+            enableTelnet: false,
+            updatedAt: new Date().toISOString(),
+          };
+
+          const lookupKey = `${hostData.ip}:${hostData.port}:${hostData.username}`;
+          const existing = existingHostMap?.get(lookupKey);
+
+          if (existing) {
+            await SimpleDBOps.update(
+              hosts,
+              "ssh_data",
+              eq(hosts.id, existing.id),
+              sshDataObj,
+              userId,
+            );
+            results.updated++;
+          } else {
+            sshDataObj.createdAt = new Date().toISOString();
+            await SimpleDBOps.insert(hosts, "ssh_data", sshDataObj, userId);
+            results.success++;
+          }
+        } catch (error) {
+          results.failed++;
+          results.errors.push(
+            `Host "${parsed[i].name}": ${error instanceof Error ? error.message : "Unknown error"}`,
+          );
+        }
+      }
+
+      res.json({
+        message: `Import completed: ${results.success} created, ${results.updated} updated, ${results.failed} failed`,
+        success: results.success,
+        updated: results.updated,
+        skipped: results.skipped,
+        failed: results.failed,
+        errors: results.errors,
+      });
+    },
+  );
 }
@@ -82,7 +82,7 @@ export function registerHostInternalRoutes(router: Router): void {
            ),
            pin: !!host.pin,
            enableTerminal: !!host.enableTerminal,
-            enableFileManager: !!host.enableFileManager,
+            enableFileManager: host.enableFileManager !== false,
            showTerminalInSidebar: !!host.showTerminalInSidebar,
            showFileManagerInSidebar: !!host.showFileManagerInSidebar,
            showTunnelInSidebar: !!host.showTunnelInSidebar,
@@ -155,7 +155,7 @@ export function registerHostInternalRoutes(router: Router): void {
          tunnelConnections: tunnelConnections,
          pin: !!host.pin,
          enableTerminal: !!host.enableTerminal,
-          enableFileManager: !!host.enableFileManager,
+          enableFileManager: host.enableFileManager !== false,
          showTerminalInSidebar: !!host.showTerminalInSidebar,
          showFileManagerInSidebar: !!host.showFileManagerInSidebar,
          showTunnelInSidebar: !!host.showTunnelInSidebar,
@@ -101,7 +101,10 @@ export function registerHostNetworkRoutes(

      try {
        const host = await db
-          .select({ macAddress: hosts.macAddress })
+          .select({
+            macAddress: hosts.macAddress,
+            wolBroadcastAddress: hosts.wolBroadcastAddress,
+          })
          .from(hosts)
          .where(and(eq(hosts.id, hostId), eq(hosts.userId, userId)))
          .then((rows) => rows[0]);
@@ -116,7 +119,10 @@ export function registerHostNetworkRoutes(
            .json({ error: "No valid MAC address configured" });
        }

-        await sendWakeOnLan(host.macAddress);
+        await sendWakeOnLan(
+          host.macAddress,
+          host.wolBroadcastAddress ?? undefined,
+        );

        sshLogger.info("Wake-on-LAN packet sent", {
          operation: "wake_on_lan",
@@ -122,6 +122,16 @@ describe("normalizeImportedHost", () => {
    expect(host.credentialId).toBe(7);
    expect(host.authType).toBe("credential");
  });
+
+  it("infers credential auth from share aliases", () => {
+    const aliasHost = normalizeImportedHost({ credentialAlias: "prod-admin" });
+    expect(aliasHost.credentialAlias).toBe("prod-admin");
+    expect(aliasHost.authType).toBe("credential");
+
+    const nameHost = normalizeImportedHost({ credentialName: "ops-key" });
+    expect(nameHost.credentialAlias).toBe("ops-key");
+    expect(nameHost.authType).toBe("credential");
+  });
 });

 describe("stripSensitiveFields", () => {
@@ -94,6 +94,7 @@ export type NormalizedImportedHost = Record<string, unknown> & {
  keyPassword?: string;
  keyType?: string;
  credentialId?: number;
+  credentialAlias?: string;
  pin?: unknown;
  enableTerminal?: unknown;
  enableTunnel?: unknown;
@@ -138,6 +139,8 @@ export type NormalizedImportedHost = Record<string, unknown> & {
 export function normalizeImportedHost(
  hostData: Record<string, unknown>,
 ): NormalizedImportedHost {
+  const credentialAlias =
+    asString(hostData.credentialAlias) || asString(hostData.credentialName);
  const connectionType =
    asString(hostData.connectionType) ||
    (asBoolean(hostData.enableRdp)
@@ -172,10 +175,15 @@ export function normalizeImportedHost(
    folder: asString(hostData.folder) || asString(hostData.group),
    tags: normalizeImportTags(hostData.tags),
    credentialId: asInteger(hostData.credentialId),
+    credentialAlias,
    authType:
      asString(hostData.authType) ||
      asString(hostData.authMethod) ||
-      (hostData.credentialId ? "credential" : hostData.key ? "key" : undefined),
+      (hostData.credentialId || credentialAlias
+        ? "credential"
+        : hostData.key
+          ? "key"
+          : undefined),
    enableSsh:
      hostData.enableSsh === undefined
        ? connectionType === "ssh"
@@ -237,7 +245,7 @@ export function transformHostResponse(
    pin: !!host.pin,
    enableTerminal: !!host.enableTerminal,
    enableTunnel: !!host.enableTunnel,
-    enableFileManager: !!host.enableFileManager,
+    enableFileManager: host.enableFileManager !== false,
    enableDocker: !!host.enableDocker,
    enableProxmox: !!host.enableProxmox,
    enableTmuxMonitor: !!host.enableTmuxMonitor,
@@ -293,6 +301,7 @@ export function transformHostResponse(
      ? JSON.parse(host.proxmoxConfig as string)
      : undefined,
    forceKeyboardInteractive: host.forceKeyboardInteractive === "true",
+    useWarpgate: !!host.useWarpgate,
    socks5ProxyChain: host.socks5ProxyChain
      ? JSON.parse(host.socks5ProxyChain as string)
      : [],
@@ -79,6 +79,69 @@ const permissionManager = PermissionManager.getInstance();
 const authenticateJWT = authManager.createAuthMiddleware();
 const requireDataAccess = authManager.createDataAccessMiddleware();

+type ShareCredentialExport = {
+  alias: string;
+  name: string;
+  authType: "password" | "key";
+  username: string | null;
+  description: string | null;
+  folder: string | null;
+  tags: string[];
+  keyType: string | null;
+};
+
+function parseJsonField(value: unknown, fallback: unknown) {
+  if (!value || typeof value !== "string") return fallback;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return fallback;
+  }
+}
+
+function splitTags(value: unknown): string[] {
+  if (Array.isArray(value))
+    return value.filter((tag) => typeof tag === "string");
+  if (typeof value !== "string") return [];
+  return value.split(",").filter(Boolean);
+}
+
+function uniqueAlias(base: string, used: Set<string>): string {
+  const normalized =
+    base
+      .trim()
+      .toLowerCase()
+      .replace(/[^a-z0-9._-]+/g, "-")
+      .replace(/^-+|-+$/g, "") || "credential";
+  let alias = normalized;
+  let suffix = 2;
+  while (used.has(alias)) {
+    alias = `${normalized}-${suffix++}`;
+  }
+  used.add(alias);
+  return alias;
+}
+
+function safeCredentialExport(
+  credential: Record<string, unknown>,
+  alias: string,
+): ShareCredentialExport {
+  return {
+    alias,
+    name: String(credential.name || alias),
+    authType: credential.authType === "key" ? "key" : "password",
+    username:
+      typeof credential.username === "string" ? credential.username : null,
+    description:
+      typeof credential.description === "string"
+        ? credential.description
+        : null,
+    folder: typeof credential.folder === "string" ? credential.folder : null,
+    tags: splitTags(credential.tags),
+    keyType: typeof credential.keyType === "string" ? credential.keyType : null,
+  };
+}
+
 registerHostInternalRoutes(router);

 /**
@@ -144,7 +207,9 @@ router.post(
      password,
      authMethod,
      authType,
+      useWarpgate,
      credentialId,
+      vaultProfileId,
      key,
      keyPassword,
      keyType,
@@ -153,6 +218,7 @@ router.post(
      enableTerminal,
      enableTunnel,
      enableFileManager,
+      scpLegacy,
      enableDocker,
      enableProxmox,
      enableTmuxMonitor,
@@ -184,6 +250,7 @@ router.post(
      portKnockSequence,
      overrideCredentialUsername,
      macAddress,
+      wolBroadcastAddress,
      enableSsh,
      enableRdp,
      enableVnc,
@@ -197,6 +264,8 @@ router.post(
      rdpDomain,
      rdpSecurity,
      rdpIgnoreCert,
+      vncAuthType,
+      vncCredentialId,
      vncPassword,
      vncUser,
      telnetUser,
@@ -243,7 +312,9 @@ router.post(
      port,
      username: effectiveUsername,
      authType: effectiveAuthType,
+      useWarpgate: useWarpgate ? 1 : 0,
      credentialId: credentialId || null,
+      vaultProfileId: vaultProfileId || null,
      overrideCredentialUsername: overrideCredentialUsername ? 1 : 0,
      pin: pin ? 1 : 0,
      enableTerminal: enableTerminal ? 1 : 0,
@@ -256,6 +327,7 @@ router.post(
        ? JSON.stringify(quickActions)
        : null,
      enableFileManager: enableFileManager ? 1 : 0,
+      scpLegacy: scpLegacy ? 1 : 0,
      enableDocker: enableDocker ? 1 : 0,
      enableProxmox: enableProxmox ? 1 : 0,
      enableTmuxMonitor: enableTmuxMonitor ? 1 : 0,
@@ -301,6 +373,7 @@ router.post(
        ? JSON.stringify(socks5ProxyChain)
        : null,
      macAddress: macAddress || null,
+      wolBroadcastAddress: wolBroadcastAddress || null,
      portKnockSequence: portKnockSequence
        ? JSON.stringify(portKnockSequence)
        : null,
@@ -316,6 +389,11 @@ router.post(
      rdpDomain: rdpDomain || null,
      rdpSecurity: rdpSecurity || null,
      rdpIgnoreCert: rdpIgnoreCert ? 1 : 0,
+      vncAuthType: enableVnc ? vncAuthType || null : null,
+      vncCredentialId:
+        enableVnc && vncAuthType === "credential" && vncCredentialId
+          ? vncCredentialId
+          : null,
      vncUser: vncUser || null,
      telnetUser: telnetUser || null,
    };
@@ -333,19 +411,6 @@ router.post(
      sshDataObj.keyType = null;
    } else if (effectiveAuthType === "key") {
      if (key && typeof key === "string") {
-        if (!key.includes("-----BEGIN") || !key.includes("-----END")) {
-          sshLogger.warn("Invalid SSH key format provided", {
-            operation: "host_create",
-            userId,
-            name,
-            ip,
-            port,
-          });
-          return res.status(400).json({
-            error: "Invalid SSH key format. Key must be in PEM format.",
-          });
-        }
-
        const keyValidation = parseSSHKey(
          key,
          typeof keyPassword === "string" ? keyPassword : undefined,
@@ -369,6 +434,11 @@ router.post(
      sshDataObj.keyPassword = keyPassword || null;
      sshDataObj.keyType = keyType;
      sshDataObj.password = null;
+    } else if (effectiveAuthType === "agent") {
+      sshDataObj.password = null;
+      sshDataObj.key = null;
+      sshDataObj.keyPassword = null;
+      sshDataObj.keyType = null;
    } else {
      sshDataObj.password = null;
      sshDataObj.key = null;
@@ -713,7 +783,9 @@ router.put(
      password,
      authMethod,
      authType,
+      useWarpgate,
      credentialId,
+      vaultProfileId,
      key,
      keyPassword,
      keyType,
@@ -722,6 +794,7 @@ router.put(
      enableTerminal,
      enableTunnel,
      enableFileManager,
+      scpLegacy,
      enableDocker,
      enableProxmox,
      enableTmuxMonitor,
@@ -753,6 +826,7 @@ router.put(
      portKnockSequence,
      overrideCredentialUsername,
      macAddress,
+      wolBroadcastAddress,
      enableSsh,
      enableRdp,
      enableVnc,
@@ -766,6 +840,8 @@ router.put(
      rdpDomain,
      rdpSecurity,
      rdpIgnoreCert,
+      vncAuthType,
+      vncCredentialId,
      vncPassword,
      vncUser,
      telnetUser,
@@ -809,7 +885,9 @@ router.put(
      port,
      username: effectiveUsername,
      authType: effectiveAuthType,
+      useWarpgate: useWarpgate ? 1 : 0,
      credentialId: credentialId || null,
+      vaultProfileId: vaultProfileId || null,
      overrideCredentialUsername: overrideCredentialUsername ? 1 : 0,
      pin: pin ? 1 : 0,
      enableTerminal: enableTerminal ? 1 : 0,
@@ -822,6 +900,7 @@ router.put(
        ? JSON.stringify(quickActions)
        : null,
      enableFileManager: enableFileManager ? 1 : 0,
+      scpLegacy: scpLegacy ? 1 : 0,
      enableDocker: enableDocker ? 1 : 0,
      enableProxmox: enableProxmox ? 1 : 0,
      enableTmuxMonitor: enableTmuxMonitor ? 1 : 0,
@@ -867,6 +946,7 @@ router.put(
        ? JSON.stringify(socks5ProxyChain)
        : null,
      macAddress: macAddress || null,
+      wolBroadcastAddress: wolBroadcastAddress || null,
      portKnockSequence: portKnockSequence
        ? JSON.stringify(portKnockSequence)
        : null,
@@ -882,6 +962,11 @@ router.put(
      rdpDomain: rdpDomain || null,
      rdpSecurity: rdpSecurity || null,
      rdpIgnoreCert: rdpIgnoreCert ? 1 : 0,
+      vncAuthType: enableVnc ? vncAuthType || null : null,
+      vncCredentialId:
+        enableVnc && vncAuthType === "credential" && vncCredentialId
+          ? vncCredentialId
+          : null,
      vncUser: vncUser || null,
      telnetUser: telnetUser || null,
    };
@@ -903,20 +988,6 @@ router.put(
      sshDataObj.keyType = null;
    } else if (effectiveAuthType === "key") {
      if (key && typeof key === "string") {
-        if (!key.includes("-----BEGIN") || !key.includes("-----END")) {
-          sshLogger.warn("Invalid SSH key format provided", {
-            operation: "host_update",
-            hostId: parseInt(hostId),
-            userId,
-            name,
-            ip,
-            port,
-          });
-          return res.status(400).json({
-            error: "Invalid SSH key format. Key must be in PEM format.",
-          });
-        }
-
        const keyValidation = parseSSHKey(
          key,
          typeof keyPassword === "string" ? keyPassword : undefined,
@@ -945,6 +1016,11 @@ router.put(
        sshDataObj.keyType = keyType;
      }
      sshDataObj.password = null;
+    } else if (effectiveAuthType === "agent") {
+      sshDataObj.password = null;
+      sshDataObj.key = null;
+      sshDataObj.keyPassword = null;
+      sshDataObj.keyType = null;
    } else {
      sshDataObj.password = null;
      sshDataObj.key = null;
@@ -952,10 +1028,9 @@ router.put(
      sshDataObj.keyType = null;
    }

-    if (rdpPassword !== undefined) sshDataObj.rdpPassword = rdpPassword || null;
-    if (vncPassword !== undefined) sshDataObj.vncPassword = vncPassword || null;
-    if (telnetPassword !== undefined)
-      sshDataObj.telnetPassword = telnetPassword || null;
+    if (rdpPassword) sshDataObj.rdpPassword = rdpPassword;
+    if (vncPassword) sshDataObj.vncPassword = vncPassword;
+    if (telnetPassword) sshDataObj.telnetPassword = telnetPassword;

    try {
      const accessInfo = await permissionManager.canAccessHost(
@@ -988,6 +1063,8 @@ router.put(
        .select({
          userId: hosts.userId,
          credentialId: hosts.credentialId,
+          rdpCredentialId: hosts.rdpCredentialId,
+          vncCredentialId: hosts.vncCredentialId,
          authType: hosts.authType,
        })
        .from(hosts)
@@ -1025,11 +1102,26 @@ router.put(
        });
      }

-      if (sshDataObj.credentialId !== undefined) {
-        if (
-          hostRecord[0].credentialId !== null &&
-          sshDataObj.credentialId === null
-        ) {
+      {
+        const newCredId =
+          sshDataObj.credentialId !== undefined
+            ? sshDataObj.credentialId
+            : hostRecord[0].credentialId;
+        const newRdpCredId =
+          sshDataObj.rdpCredentialId !== undefined
+            ? sshDataObj.rdpCredentialId
+            : hostRecord[0].rdpCredentialId;
+        const newVncCredId =
+          sshDataObj.vncCredentialId !== undefined
+            ? sshDataObj.vncCredentialId
+            : hostRecord[0].vncCredentialId;
+        const hadCredential =
+          hostRecord[0].credentialId !== null ||
+          hostRecord[0].rdpCredentialId !== null ||
+          hostRecord[0].vncCredentialId !== null;
+        const willHaveCredential =
+          newCredId !== null || newRdpCredId !== null || newVncCredId !== null;
+        if (hadCredential && !willHaveCredential) {
          await db
            .delete(hostAccess)
            .where(eq(hostAccess.hostId, Number(hostId)));
@@ -1169,6 +1261,7 @@ router.get(
          tunnelConnections: hosts.tunnelConnections,
          jumpHosts: hosts.jumpHosts,
          enableFileManager: hosts.enableFileManager,
+          scpLegacy: hosts.scpLegacy,
          defaultPath: hosts.defaultPath,
          autostartPassword: hosts.autostartPassword,
          autostartKey: hosts.autostartKey,
@@ -1180,6 +1273,7 @@ router.get(
          createdAt: hosts.createdAt,
          updatedAt: hosts.updatedAt,
          credentialId: hosts.credentialId,
+          vaultProfileId: hosts.vaultProfileId,
          overrideCredentialUsername: hosts.overrideCredentialUsername,
          quickActions: hosts.quickActions,
          notes: hosts.notes,
@@ -1203,6 +1297,7 @@ router.get(
          ignoreCert: hosts.ignoreCert,
          guacamoleConfig: hosts.guacamoleConfig,
          macAddress: hosts.macAddress,
+          wolBroadcastAddress: hosts.wolBroadcastAddress,
          dockerConfig: hosts.dockerConfig,
          proxmoxConfig: hosts.proxmoxConfig,
          enableSsh: hosts.enableSsh,
@@ -1213,11 +1308,14 @@ router.get(
          rdpPort: hosts.rdpPort,
          vncPort: hosts.vncPort,
          telnetPort: hosts.telnetPort,
+          rdpCredentialId: hosts.rdpCredentialId,
          rdpUser: hosts.rdpUser,
          rdpPassword: hosts.rdpPassword,
          rdpDomain: hosts.rdpDomain,
          rdpSecurity: hosts.rdpSecurity,
          rdpIgnoreCert: hosts.rdpIgnoreCert,
+          vncAuthType: hosts.vncAuthType,
+          vncCredentialId: hosts.vncCredentialId,
          vncUser: hosts.vncUser,
          vncPassword: hosts.vncPassword,
          telnetUser: hosts.telnetUser,
@@ -1412,7 +1510,7 @@ router.get(
 *         name: field
 *         schema:
 *           type: string
- *           enum: [password, sudoPassword]
+ *           enum: [password, sudoPassword, vncPassword]
 *     responses:
 *       200:
 *         description: The requested password value.
@@ -1428,7 +1526,7 @@ router.get(
    const userId = (req as AuthenticatedRequest).userId;
    const field = (req.query.field as string) || "password";

-    if (!["password", "sudoPassword"].includes(field)) {
+    if (!["password", "sudoPassword", "vncPassword"].includes(field)) {
      return res.status(400).json({ error: "Invalid field" });
    }

@@ -1445,7 +1543,19 @@ router.get(

      const host = data[0];
      const resolved = (await resolveHostCredentials(host, userId)) || host;
-      const value = resolved[field];
+      let value = resolved[field];
+
+      if (!value && field === "sudoPassword" && resolved.terminalConfig) {
+        try {
+          const tc =
+            typeof resolved.terminalConfig === "string"
+              ? JSON.parse(resolved.terminalConfig)
+              : resolved.terminalConfig;
+          value = tc?.sudoPassword || null;
+        } catch {
+          // malformed JSON — leave value null
+        }
+      }

      if (!value) {
        return res.status(404).json({ error: "No password set" });
@@ -1555,6 +1665,8 @@ router.get(
            rdpDomain: resolvedHost.rdpDomain || null,
            rdpSecurity: resolvedHost.rdpSecurity || null,
            rdpIgnoreCert: !!resolvedHost.rdpIgnoreCert,
+            vncAuthType: resolvedHost.vncAuthType || null,
+            vncCredentialId: resolvedHost.vncCredentialId || null,
            vncUser: resolvedHost.vncUser || null,
            vncPassword: resolvedHost.vncPassword || null,
            telnetUser: resolvedHost.telnetUser || null,
@@ -1574,7 +1686,8 @@ router.get(
              !!resolvedHost.overrideCredentialUsername,
            enableTerminal: !!resolvedHost.enableTerminal,
            enableTunnel: !!resolvedHost.enableTunnel,
-            enableFileManager: !!resolvedHost.enableFileManager,
+            enableFileManager: resolvedHost.enableFileManager !== false,
+            scpLegacy: !!resolvedHost.scpLegacy,
            enableDocker: !!resolvedHost.enableDocker,
            enableProxmox: !!resolvedHost.enableProxmox,
            enableTmuxMonitor: !!resolvedHost.enableTmuxMonitor,
@@ -1661,6 +1774,11 @@ router.get(
  requireDataAccess,
  async (req: Request, res: Response) => {
    const userId = (req as AuthenticatedRequest).userId;
+    const shareExport =
+      req.query.share === "1" ||
+      req.query.share === "true" ||
+      req.query.safe === "1" ||
+      req.query.safe === "true";

    if (!isNonEmptyString(userId)) {
      return res.status(400).json({ error: "Invalid userId" });
@@ -1673,6 +1791,192 @@ router.get(
        userId,
      );

+      if (shareExport) {
+        const credentials = await SimpleDBOps.select<Record<string, unknown>>(
+          db
+            .select()
+            .from(sshCredentials)
+            .where(eq(sshCredentials.userId, userId)),
+          "ssh_credentials",
+          userId,
+        );
+        const credentialsById = new Map<number, Record<string, unknown>>();
+        for (const credential of credentials) {
+          if (typeof credential.id === "number") {
+            credentialsById.set(credential.id, credential);
+          }
+        }
+
+        const usedAliases = new Set<string>();
+        const exportedCredentials = new Map<string, ShareCredentialExport>();
+        const credentialIdAliases = new Map<number, string>();
+        const directCredentialAliases = new Map<string, string>();
+
+        const addCredential = (
+          credential: Record<string, unknown>,
+          fallbackName: string,
+        ) => {
+          if (typeof credential.id === "number") {
+            const existing = credentialIdAliases.get(credential.id);
+            if (existing) return existing;
+          }
+
+          const alias = uniqueAlias(
+            String(credential.name || fallbackName),
+            usedAliases,
+          );
+          exportedCredentials.set(
+            alias,
+            safeCredentialExport(credential, alias),
+          );
+          if (typeof credential.id === "number") {
+            credentialIdAliases.set(credential.id, alias);
+          }
+          return alias;
+        };
+
+        const addDirectCredential = (
+          authType: "password" | "key",
+          username: unknown,
+          keyType?: unknown,
+        ) => {
+          const usernameText =
+            typeof username === "string" && username.trim()
+              ? username.trim()
+              : "user";
+          const key = `${authType}:${usernameText}:${typeof keyType === "string" ? keyType : ""}`;
+          const existing = directCredentialAliases.get(key);
+          if (existing) return existing;
+
+          const alias = uniqueAlias(`${usernameText}-${authType}`, usedAliases);
+          directCredentialAliases.set(key, alias);
+          exportedCredentials.set(
+            alias,
+            safeCredentialExport(
+              {
+                name: `${usernameText} ${authType}`,
+                authType,
+                username: usernameText,
+                keyType,
+              },
+              alias,
+            ),
+          );
+          return alias;
+        };
+
+        const exportedHosts = allHosts.map((host) => {
+          const exportedConnectionType =
+            (host.connectionType as string) || "ssh";
+          const isRemoteDesktop = ["rdp", "vnc", "telnet"].includes(
+            exportedConnectionType,
+          );
+
+          const baseExportData: Record<string, unknown> = {
+            connectionType: exportedConnectionType,
+            name: host.name,
+            ip: host.ip,
+            port: host.port,
+            username: host.username,
+            folder: host.folder,
+            tags: splitTags(host.tags),
+            notes: host.notes || null,
+          };
+
+          if (isRemoteDesktop) {
+            return {
+              ...baseExportData,
+              domain: host.domain || null,
+              security: host.security || null,
+              ignoreCert: !!host.ignoreCert,
+              guacamoleConfig: parseJsonField(host.guacamoleConfig, null),
+            };
+          }
+
+          const exportData: Record<string, unknown> = {
+            ...baseExportData,
+            authType: host.authType || "none",
+            enableTerminal: !!host.enableTerminal,
+            enableTunnel: !!host.enableTunnel,
+            enableFileManager: host.enableFileManager !== false,
+            enableDocker: !!host.enableDocker,
+            enableProxmox: !!host.enableProxmox,
+            enableTmuxMonitor: !!host.enableTmuxMonitor,
+            showTerminalInSidebar: !!host.showTerminalInSidebar,
+            showFileManagerInSidebar: !!host.showFileManagerInSidebar,
+            showTunnelInSidebar: !!host.showTunnelInSidebar,
+            showDockerInSidebar: !!host.showDockerInSidebar,
+            showServerStatsInSidebar: !!host.showServerStatsInSidebar,
+            defaultPath: host.defaultPath,
+            tunnelConnections: parseJsonField(host.tunnelConnections, []),
+            jumpHosts: parseJsonField(host.jumpHosts, null),
+            quickActions: parseJsonField(host.quickActions, null),
+            statsConfig: parseJsonField(host.statsConfig, null),
+            dockerConfig: parseJsonField(host.dockerConfig, null),
+            proxmoxConfig: parseJsonField(host.proxmoxConfig, null),
+            forceKeyboardInteractive: host.forceKeyboardInteractive === "true",
+            useSocks5: !!host.useSocks5,
+            socks5Host: host.socks5Host || null,
+            socks5Port: host.socks5Port || null,
+            socks5Username: host.socks5Username || null,
+            socks5ProxyChain: parseJsonField(host.socks5ProxyChain, null),
+            portKnockSequence: parseJsonField(host.portKnockSequence, null),
+            overrideCredentialUsername: !!host.overrideCredentialUsername,
+          };
+
+          if (typeof host.credentialId === "number") {
+            const credential = credentialsById.get(host.credentialId);
+            if (credential) {
+              exportData.authType = "credential";
+              exportData.credentialAlias = addCredential(
+                credential,
+                String(host.username || "credential"),
+              );
+              return exportData;
+            }
+          }
+
+          if (host.authType === "password") {
+            exportData.authType = "credential";
+            exportData.credentialAlias = addDirectCredential(
+              "password",
+              host.username,
+            );
+            return exportData;
+          }
+
+          if (host.authType === "key") {
+            exportData.authType = "credential";
+            exportData.credentialAlias = addDirectCredential(
+              "key",
+              host.username,
+              host.keyType,
+            );
+            return exportData;
+          }
+
+          if (host.authType === "credential") {
+            exportData.authType = "none";
+          }
+
+          return exportData;
+        });
+
+        sshLogger.success("All hosts exported for sharing", {
+          operation: "hosts_export_share",
+          count: exportedHosts.length,
+          credentialCount: exportedCredentials.size,
+          userId,
+        });
+
+        return res.json({
+          version: "termix-host-share-v1",
+          exportedAt: new Date().toISOString(),
+          credentials: Array.from(exportedCredentials.values()),
+          hosts: exportedHosts,
+        });
+      }
+
      const exportedHosts = [];

      for (const host of allHosts) {
@@ -1722,7 +2026,7 @@ router.get(
                !!resolvedHost.overrideCredentialUsername,
              enableTerminal: !!resolvedHost.enableTerminal,
              enableTunnel: !!resolvedHost.enableTunnel,
-              enableFileManager: !!resolvedHost.enableFileManager,
+              enableFileManager: resolvedHost.enableFileManager !== false,
              enableDocker: !!resolvedHost.enableDocker,
              enableProxmox: !!resolvedHost.enableProxmox,
              enableTmuxMonitor: !!resolvedHost.enableTmuxMonitor,
@@ -2,7 +2,7 @@ import type { Router } from "express";
 import type { LDAPProviderConfig } from "../../../types/index.js";
 import { db } from "../db/index.js";
 import { ssoProviders, users, roles, userRoles } from "../db/schema.js";
-import { eq } from "drizzle-orm";
+import { eq, and } from "drizzle-orm";
 import { nanoid } from "nanoid";
 import { authLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";
@@ -298,14 +298,7 @@ export function registerLDAPAuthRoutes(router: Router): void {
        const isFirst = (countRow?.count || 0) === 0;

        if (!isFirst && !autoProvision) {
-          const regRow = db.$client
-            .prepare(
-              "SELECT value FROM settings WHERE key = 'allow_registration'",
-            )
-            .get() as { value: string } | undefined;
-          if (regRow && regRow.value !== "true") {
-            return res.status(403).json({ error: "Registration is disabled" });
-          }
+          return res.status(403).json({ error: "Registration is disabled" });
        }

        userId = nanoid();
@@ -375,6 +368,39 @@ export function registerLDAPAuthRoutes(router: Router): void {
        if (config.adminGroup && !!existingUsers[0].isAdmin !== isAdmin) {
          await db.update(users).set({ isAdmin }).where(eq(users.id, userId));
          existingUsers[0].isAdmin = isAdmin;
+          try {
+            const newRoleName = isAdmin ? "admin" : "user";
+            const oldRoleName = isAdmin ? "user" : "admin";
+            const newRole = await db
+              .select({ id: roles.id })
+              .from(roles)
+              .where(eq(roles.name, newRoleName))
+              .limit(1);
+            const oldRole = await db
+              .select({ id: roles.id })
+              .from(roles)
+              .where(eq(roles.name, oldRoleName))
+              .limit(1);
+            if (oldRole.length > 0) {
+              await db
+                .delete(userRoles)
+                .where(
+                  and(
+                    eq(userRoles.userId, userId),
+                    eq(userRoles.roleId, oldRole[0].id),
+                  ),
+                );
+            }
+            if (newRole.length > 0) {
+              await db.insert(userRoles).values({
+                userId,
+                roleId: newRole[0].id,
+                grantedBy: userId,
+              });
+            }
+          } catch {
+            /* non-fatal */
+          }
        }

        // Update display name if not dual-auth
@@ -23,7 +23,24 @@ const authenticateJWT = authManager.createAuthMiddleware();
 *       200:
 *         description: List of open tabs ordered by tab_order.
 */
-const TAB_TTL_MS = 30 * 60 * 1000;
+const DEFAULT_TAB_TTL_MINUTES = 30;
+
+function getTabTtlMs(): number {
+  try {
+    const row = db.$client
+      .prepare(
+        "SELECT value FROM settings WHERE key = 'terminal_session_timeout_minutes'",
+      )
+      .get() as { value: string } | undefined;
+    if (row) {
+      const minutes = parseInt(row.value, 10);
+      if (!isNaN(minutes) && minutes > 0) return minutes * 60_000;
+    }
+  } catch {
+    // DB not available, use default
+  }
+  return DEFAULT_TAB_TTL_MINUTES * 60_000;
+}

 // Legacy tab types that were renamed. Normalize on read so previously saved
 // tabs still restore to the correct (renamed) tab type.
@@ -38,7 +55,7 @@ function normalizeTabType(tabType: string): string {
 router.get("/", authenticateJWT, async (req: Request, res: Response) => {
  const userId = (req as AuthenticatedRequest).userId;
  try {
-    const cutoff = new Date(Date.now() - TAB_TTL_MS).toISOString();
+    const cutoff = new Date(Date.now() - getTabTtlMs()).toISOString();
    const tabs = db
      .select()
      .from(userOpenTabs)
@@ -357,6 +357,16 @@ router.post(
        sshConfig.privateKey = resolvedCredentials.sshKey;
        if (resolvedCredentials.keyPassword)
          sshConfig.passphrase = resolvedCredentials.keyPassword;
+      } else if (authType === "agent") {
+        const { applyAgentAuth } =
+          await import("../../ssh/terminal-auth-helpers.js");
+        const result = await applyAgentAuth(
+          sshConfig,
+          host.terminalConfig as unknown as Record<string, unknown> | undefined,
+        );
+        if ("error" in result) {
+          return res.status(400).json({ error: result.error });
+        }
      } else if (resolvedCredentials.password) {
        sshConfig.password = resolvedCredentials.password;
      }
@@ -129,7 +129,12 @@ router.post(
        return res.status(403).json({ error: "Not host owner" });
      }

-      if (!host[0].credentialId && host[0].authType !== "opkssh") {
+      if (
+        !host[0].credentialId &&
+        !host[0].rdpCredentialId &&
+        !host[0].vncCredentialId &&
+        host[0].authType !== "opkssh"
+      ) {
        return res.status(400).json({
          error:
            "Only hosts using credentials or OPKSSH can be shared. Please create a credential and assign it to this host before sharing.",
@@ -204,21 +209,25 @@ router.post(
          .delete(sharedCredentials)
          .where(eq(sharedCredentials.hostAccessId, existing[0].id));

-        if (host[0].credentialId) {
+        const activeCredentialId =
+          host[0].credentialId ??
+          host[0].rdpCredentialId ??
+          host[0].vncCredentialId;
+        if (activeCredentialId) {
          const { SharedCredentialManager } =
            await import("../../utils/shared-credential-manager.js");
          const sharedCredManager = SharedCredentialManager.getInstance();
          if (targetType === "user") {
            await sharedCredManager.createSharedCredentialForUser(
              existing[0].id,
-              host[0].credentialId,
+              activeCredentialId,
              targetUserId!,
              userId,
            );
          } else {
            await sharedCredManager.createSharedCredentialsForRole(
              existing[0].id,
-              host[0].credentialId,
+              activeCredentialId,
              targetRoleId!,
              userId,
            );
@@ -252,18 +261,22 @@ router.post(
        await import("../../utils/shared-credential-manager.js");
      const sharedCredManager = SharedCredentialManager.getInstance();

-      if (host[0].credentialId) {
+      const activeCredentialId =
+        host[0].credentialId ??
+        host[0].rdpCredentialId ??
+        host[0].vncCredentialId;
+      if (activeCredentialId) {
        if (targetType === "user") {
          await sharedCredManager.createSharedCredentialForUser(
            result.lastInsertRowid as number,
-            host[0].credentialId,
+            activeCredentialId,
            targetUserId!,
            userId,
          );
        } else {
          await sharedCredManager.createSharedCredentialsForRole(
            result.lastInsertRowid as number,
-            host[0].credentialId,
+            activeCredentialId,
            targetRoleId!,
            userId,
          );
@@ -487,6 +500,12 @@ router.get(
    try {
      const now = new Date().toISOString();

+      const userRoleIds = await db
+        .select({ roleId: userRoles.roleId })
+        .from(userRoles)
+        .where(eq(userRoles.userId, userId));
+      const roleIds = userRoleIds.map((r) => r.roleId);
+
      const sharedHosts = await db
        .select({
          id: hosts.id,
@@ -506,7 +525,15 @@ router.get(
        .innerJoin(users, eq(hosts.userId, users.id))
        .where(
          and(
-            eq(hostAccess.userId, userId),
+            or(
+              eq(hostAccess.userId, userId),
+              roleIds.length > 0
+                ? sql`${hostAccess.roleId} IN (${sql.join(
+                    roleIds.map((id) => sql`${id}`),
+                    sql`, `,
+                  )})`
+                : sql`false`,
+            ),
            or(isNull(hostAccess.expiresAt), gte(hostAccess.expiresAt, now)),
          ),
        )
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+import {
+  isValidServiceLinkUrl,
+  normalizeServiceLinkUrl,
+} from "./service-link-url.js";
+
+describe("service link URL handling", () => {
+  it("keeps explicit http and https URLs", () => {
+    expect(normalizeServiceLinkUrl("https://example.com")).toBe(
+      "https://example.com",
+    );
+    expect(normalizeServiceLinkUrl("http://192.168.1.10:8080")).toBe(
+      "http://192.168.1.10:8080",
+    );
+  });
+
+  it("adds http to bare service addresses", () => {
+    expect(normalizeServiceLinkUrl("192.168.1.10:8080")).toBe(
+      "http://192.168.1.10:8080",
+    );
+    expect(normalizeServiceLinkUrl("termix.local")).toBe("http://termix.local");
+  });
+
+  it("rejects unsupported schemes", () => {
+    expect(isValidServiceLinkUrl("ssh://example.com")).toBe(false);
+    expect(isValidServiceLinkUrl("javascript:alert(1)")).toBe(false);
+  });
+});
@@ -0,0 +1,16 @@
+export function normalizeServiceLinkUrl(value: string): string {
+  const trimmed = value.trim();
+  if (!trimmed) return "";
+  return /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)
+    ? trimmed
+    : `http://${trimmed}`;
+}
+
+export function isValidServiceLinkUrl(value: string): boolean {
+  try {
+    const parsed = new URL(normalizeServiceLinkUrl(value));
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
@@ -15,6 +15,7 @@ import { AuthManager } from "../../utils/auth-manager.js";
 import { SSH_ALGORITHMS } from "../../utils/ssh-algorithms.js";
 import { extractSnippetReorderUpdates } from "./snippets-reorder.js";
 import { logAudit, getRequestMeta } from "../../utils/audit-logger.js";
+import { applyAgentAuth } from "../../ssh/terminal-auth-helpers.js";

 const router = express.Router();

@@ -773,11 +774,12 @@ router.post(
      let output = "";
      let errorOutput = "";

+      /* eslint-disable no-async-promise-executor */
      const executePromise = new Promise<{
        success: boolean;
        output: string;
        error?: string;
-      }>((resolve, reject) => {
+      }>(async (resolve, reject) => {
        const timeout = setTimeout(() => {
          conn.end();
          reject(new Error("Command execution timeout (30s)"));
@@ -886,6 +888,14 @@ router.post(
          if (passphrase) {
            config.passphrase = passphrase;
          }
+        } else if (authType === "agent") {
+          const result = await applyAgentAuth(
+            config,
+            host.terminalConfig as Record<string, unknown> | string | undefined,
+          );
+          if ("error" in result) {
+            throw new Error(result.error);
+          }
        } else if (password) {
          config.password = password;
        } else if (privateKey) {
@@ -901,6 +911,7 @@ router.post(

        conn.connect(config);
      });
+      /* eslint-enable no-async-promise-executor */

      const result = await executePromise;

@@ -924,6 +935,268 @@ router.post(
  },
 );

+/**
+ * @openapi
+ * /snippets/export:
+ *   get:
+ *     summary: Export all snippets and folders as JSON
+ *     description: Returns all snippets and snippet folders for the authenticated user as a JSON export.
+ *     tags:
+ *       - Snippets
+ *     responses:
+ *       200:
+ *         description: Export object containing snippets and folders arrays.
+ *       400:
+ *         description: Invalid userId.
+ *       500:
+ *         description: Failed to export snippets.
+ */
+router.get(
+  "/export",
+  authenticateJWT,
+  requireDataAccess,
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+
+    if (!isNonEmptyString(userId)) {
+      authLogger.warn("Invalid userId for snippet export");
+      return res.status(400).json({ error: "Invalid userId" });
+    }
+
+    try {
+      const allSnippets = await db
+        .select()
+        .from(snippets)
+        .where(eq(snippets.userId, userId))
+        .orderBy(asc(snippets.folder), asc(snippets.order));
+
+      const allFolders = await db
+        .select()
+        .from(snippetFolders)
+        .where(eq(snippetFolders.userId, userId))
+        .orderBy(asc(snippetFolders.name));
+
+      const exportedSnippets = allSnippets.map((s) => ({
+        name: s.name,
+        content: s.content,
+        description: s.description,
+        folder: s.folder,
+        order: s.order,
+        hostFilter: s.hostFilter,
+      }));
+
+      const exportedFolders = allFolders.map((f) => ({
+        name: f.name,
+        color: f.color,
+        icon: f.icon,
+      }));
+
+      authLogger.success(`Snippets exported by user ${userId}`, {
+        operation: "snippet_export",
+        userId,
+        snippetCount: exportedSnippets.length,
+        folderCount: exportedFolders.length,
+      });
+
+      res.json({ snippets: exportedSnippets, folders: exportedFolders });
+    } catch (err) {
+      authLogger.error("Failed to export snippets", err);
+      res.status(500).json({ error: "Failed to export snippets" });
+    }
+  },
+);
+
+/**
+ * @openapi
+ * /snippets/bulk-import:
+ *   post:
+ *     summary: Bulk import snippets and folders from JSON
+ *     description: Imports snippets and folders. Existing folders are skipped; existing snippets (matched by name+folder) can be skipped or overwritten.
+ *     tags:
+ *       - Snippets
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               snippets:
+ *                 type: array
+ *               folders:
+ *                 type: array
+ *               overwrite:
+ *                 type: boolean
+ *     responses:
+ *       200:
+ *         description: Import results with counts.
+ *       400:
+ *         description: Invalid request body.
+ *       500:
+ *         description: Failed to import snippets.
+ */
+router.post(
+  "/bulk-import",
+  authenticateJWT,
+  requireDataAccess,
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    const {
+      snippets: snippetsToImport,
+      folders: foldersToImport,
+      overwrite,
+    } = req.body;
+
+    if (!isNonEmptyString(userId)) {
+      return res.status(400).json({ error: "Invalid userId" });
+    }
+
+    if (!Array.isArray(snippetsToImport) && !Array.isArray(foldersToImport)) {
+      return res
+        .status(400)
+        .json({ error: "snippets or folders array is required" });
+    }
+
+    const results = {
+      snippetsImported: 0,
+      snippetsSkipped: 0,
+      snippetsUpdated: 0,
+      foldersImported: 0,
+      foldersSkipped: 0,
+      failed: 0,
+      errors: [] as string[],
+    };
+
+    try {
+      if (Array.isArray(foldersToImport)) {
+        for (const folder of foldersToImport) {
+          if (!isNonEmptyString(folder.name)) {
+            results.failed++;
+            results.errors.push(`Folder missing name`);
+            continue;
+          }
+
+          const existing = await db
+            .select()
+            .from(snippetFolders)
+            .where(
+              and(
+                eq(snippetFolders.userId, userId),
+                eq(snippetFolders.name, folder.name.trim()),
+              ),
+            )
+            .limit(1);
+
+          if (existing.length > 0) {
+            results.foldersSkipped++;
+            continue;
+          }
+
+          await db.insert(snippetFolders).values({
+            userId,
+            name: folder.name.trim(),
+            color: folder.color?.trim() || null,
+            icon: folder.icon?.trim() || null,
+          });
+          results.foldersImported++;
+        }
+      }
+
+      if (Array.isArray(snippetsToImport)) {
+        for (let i = 0; i < snippetsToImport.length; i++) {
+          const s = snippetsToImport[i];
+
+          if (!isNonEmptyString(s.name) || !isNonEmptyString(s.content)) {
+            results.failed++;
+            results.errors.push(
+              `Snippet ${i + 1}: name and content are required`,
+            );
+            continue;
+          }
+
+          const folderVal = s.folder?.trim() || null;
+
+          const existing = await db
+            .select()
+            .from(snippets)
+            .where(
+              and(
+                eq(snippets.userId, userId),
+                eq(snippets.name, s.name.trim()),
+                folderVal
+                  ? eq(snippets.folder, folderVal)
+                  : sql`(${snippets.folder} IS NULL OR ${snippets.folder} = '')`,
+              ),
+            )
+            .limit(1);
+
+          if (existing.length > 0) {
+            if (!overwrite) {
+              results.snippetsSkipped++;
+              continue;
+            }
+
+            await db
+              .update(snippets)
+              .set({
+                content: s.content.trim(),
+                description: s.description?.trim() || null,
+                folder: folderVal,
+                order:
+                  typeof s.order === "number" ? s.order : existing[0].order,
+                hostFilter: s.hostFilter || null,
+                updatedAt: sql`CURRENT_TIMESTAMP`,
+              })
+              .where(
+                and(
+                  eq(snippets.id, existing[0].id),
+                  eq(snippets.userId, userId),
+                ),
+              );
+            results.snippetsUpdated++;
+            continue;
+          }
+
+          const maxOrderResult = await db
+            .select({ maxOrder: sql<number>`MAX(${snippets.order})` })
+            .from(snippets)
+            .where(
+              and(
+                eq(snippets.userId, userId),
+                folderVal
+                  ? eq(snippets.folder, folderVal)
+                  : sql`(${snippets.folder} IS NULL OR ${snippets.folder} = '')`,
+              ),
+            );
+          const maxOrder = maxOrderResult[0]?.maxOrder ?? -1;
+
+          await db.insert(snippets).values({
+            userId,
+            name: s.name.trim(),
+            content: s.content.trim(),
+            description: s.description?.trim() || null,
+            folder: folderVal,
+            order: typeof s.order === "number" ? s.order : maxOrder + 1,
+            hostFilter: s.hostFilter || null,
+          });
+          results.snippetsImported++;
+        }
+      }
+
+      authLogger.success(`Snippets bulk-imported by user ${userId}`, {
+        operation: "snippet_bulk_import",
+        userId,
+        ...results,
+      });
+
+      res.json({ success: true, ...results });
+    } catch (err) {
+      authLogger.error("Failed to bulk import snippets", err);
+      res.status(500).json({ error: "Failed to import snippets" });
+    }
+  },
+);
+
 /**
 * @openapi
 * /snippets:
@@ -0,0 +1,127 @@
+import { describe, it, expect } from "vitest";
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { execFileSync } from "child_process";
+import {
+  generateCa,
+  signUserCertificate,
+  ed25519RawFromLine,
+} from "./ssh-certificate.js";
+
+function publicKeyObjectFromLine(line: string) {
+  const raw = ed25519RawFromLine(line);
+  if (!raw) throw new Error("not ed25519");
+  return crypto.createPublicKey({
+    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
+    format: "jwk",
+  });
+}
+
+// Split a cert blob into the signed body and the raw 64-byte ed25519 signature.
+function splitCert(certLine: string): { body: Buffer; rawSig: Buffer } {
+  const blob = Buffer.from(certLine.split(/\s+/)[1], "base64");
+  // trailing signature string = str( str("ssh-ed25519") + str(64-byte sig) )
+  const sigBlobLen = 4 + "ssh-ed25519".length + 4 + 64; // 83
+  const body = blob.subarray(0, blob.length - (4 + sigBlobLen));
+  const rawSig = blob.subarray(blob.length - 64);
+  return { body, rawSig };
+}
+
+describe("generateCa", () => {
+  it("produces a valid ed25519 public line and PKCS8 private key", () => {
+    const ca = generateCa();
+    expect(ca.publicKeyLine.startsWith("ssh-ed25519 ")).toBe(true);
+    expect(ed25519RawFromLine(ca.publicKeyLine)?.length).toBe(32);
+    expect(ca.privateKeyPem).toContain("BEGIN PRIVATE KEY");
+    // The PEM must load as a usable signing key.
+    expect(() =>
+      crypto.createPrivateKey({
+        key: ca.privateKeyPem,
+        format: "pem",
+        type: "pkcs8",
+      }),
+    ).not.toThrow();
+  });
+});
+
+describe("signUserCertificate", () => {
+  it("returns null for non-ed25519 user keys", () => {
+    const ca = generateCa();
+    const cert = signUserCertificate({
+      userPublicKeyLine: "ssh-rsa AAAAB3Nz",
+      caPrivateKeyPem: ca.privateKeyPem,
+      caPublicKeyLine: ca.publicKeyLine,
+      keyId: "x",
+      principals: [],
+      validAfter: 0,
+      validBefore: 1,
+    });
+    expect(cert).toBeNull();
+  });
+
+  it("produces a cert whose signature verifies against the CA key", () => {
+    const ca = generateCa();
+    const user = generateCa(); // reuse: a valid ed25519 public line
+    const cert = signUserCertificate({
+      userPublicKeyLine: user.publicKeyLine,
+      caPrivateKeyPem: ca.privateKeyPem,
+      caPublicKeyLine: ca.publicKeyLine,
+      keyId: "termix:@alice",
+      principals: ["root", "ubuntu"],
+      validAfter: 1000,
+      validBefore: 2000,
+    });
+    expect(cert).not.toBeNull();
+    expect(cert!.startsWith("ssh-ed25519-cert-v01@openssh.com ")).toBe(true);
+
+    const { body, rawSig } = splitCert(cert!);
+    const caPub = publicKeyObjectFromLine(ca.publicKeyLine);
+    expect(crypto.verify(null, body, caPub, rawSig)).toBe(true);
+
+    // A different CA must NOT verify.
+    const otherPub = publicKeyObjectFromLine(generateCa().publicKeyLine);
+    expect(crypto.verify(null, body, otherPub, rawSig)).toBe(false);
+  });
+
+  it("is accepted and correctly parsed by ssh-keygen -L", () => {
+    let sshKeygen: string;
+    try {
+      sshKeygen = execFileSync("ssh-keygen", ["--help"], { encoding: "utf8" });
+      void sshKeygen;
+    } catch (e) {
+      // ssh-keygen prints usage to stderr and exits non-zero for --help; that's
+      // fine — it means the binary exists. Only skip if it's truly missing.
+      if ((e as { code?: string }).code === "ENOENT") return;
+    }
+
+    const ca = generateCa();
+    const user = generateCa();
+    const now = Math.floor(Date.now() / 1000);
+    const cert = signUserCertificate({
+      userPublicKeyLine: user.publicKeyLine,
+      caPrivateKeyPem: ca.privateKeyPem,
+      caPublicKeyLine: ca.publicKeyLine,
+      keyId: "termix-test-id",
+      principals: ["deploy"],
+      validAfter: now,
+      validBefore: now + 3600,
+    });
+
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "termix-cert-"));
+    const file = path.join(dir, "id-cert.pub");
+    try {
+      fs.writeFileSync(file, cert + "\n");
+      const out = execFileSync("ssh-keygen", ["-L", "-f", file], {
+        encoding: "utf8",
+      });
+      expect(out).toContain("user certificate");
+      expect(out).toContain('Key ID: "termix-test-id"');
+      expect(out).toContain("deploy");
+      expect(out).toMatch(/permit-pty/);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
@@ -0,0 +1,145 @@
+import crypto from "crypto";
+
+// Minimal OpenSSH ed25519 user-certificate signer + per-user CA generation.
+// Implemented in pure Node so we never shell out or move private keys to disk.
+// Format reference: PROTOCOL.certkeys (ssh-ed25519-cert-v01@openssh.com).
+
+const ED25519 = "ssh-ed25519";
+const CERT_TYPE = "ssh-ed25519-cert-v01@openssh.com";
+const SSH2_CERT_TYPE_USER = 1;
+
+// Standard login extensions OpenSSH grants by default; must be name-sorted.
+const DEFAULT_EXTENSIONS = [
+  "permit-X11-forwarding",
+  "permit-agent-forwarding",
+  "permit-port-forwarding",
+  "permit-pty",
+  "permit-user-rc",
+];
+
+// --- SSH wire-format primitives -------------------------------------------
+
+function sshString(value: Buffer | string): Buffer {
+  const buf = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(buf.length, 0);
+  return Buffer.concat([len, buf]);
+}
+
+function sshUint32(n: number): Buffer {
+  const b = Buffer.alloc(4);
+  b.writeUInt32BE(n >>> 0, 0);
+  return b;
+}
+
+function sshUint64(n: bigint): Buffer {
+  const b = Buffer.alloc(8);
+  b.writeBigUInt64BE(n, 0);
+  return b;
+}
+
+function ed25519PublicBlob(raw32: Buffer): Buffer {
+  return Buffer.concat([sshString(ED25519), sshString(raw32)]);
+}
+
+/** Extract the 32-byte raw ed25519 key from an `ssh-ed25519 <base64>` line. */
+export function ed25519RawFromLine(line: string): Buffer | null {
+  const parts = line.trim().split(/\s+/);
+  if (parts[0] !== ED25519 || !parts[1]) return null;
+  let blob: Buffer;
+  try {
+    blob = Buffer.from(parts[1], "base64");
+  } catch {
+    return null;
+  }
+  try {
+    let off = 0;
+    const typeLen = blob.readUInt32BE(off);
+    off += 4;
+    if (blob.toString("utf8", off, off + typeLen) !== ED25519) return null;
+    off += typeLen;
+    const keyLen = blob.readUInt32BE(off);
+    off += 4;
+    const pk = blob.subarray(off, off + keyLen);
+    return pk.length === 32 ? pk : null;
+  } catch {
+    return null;
+  }
+}
+
+// --- CA generation ---------------------------------------------------------
+
+export interface GeneratedCa {
+  publicKeyLine: string; // "ssh-ed25519 <base64>"
+  privateKeyPem: string; // PKCS#8 PEM (to be stored encrypted)
+}
+
+export function generateCa(): GeneratedCa {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  const jwk = publicKey.export({ format: "jwk" }) as { x: string };
+  const raw = Buffer.from(jwk.x, "base64url");
+  const publicKeyLine = `${ED25519} ${ed25519PublicBlob(raw).toString("base64")}`;
+  const privateKeyPem = privateKey
+    .export({ format: "pem", type: "pkcs8" })
+    .toString();
+  return { publicKeyLine, privateKeyPem };
+}
+
+// --- Certificate signing ---------------------------------------------------
+
+export interface SignCertOptions {
+  userPublicKeyLine: string; // ed25519 public key to certify
+  caPrivateKeyPem: string;
+  caPublicKeyLine: string;
+  keyId: string;
+  principals: string[]; // empty = valid for all usernames
+  validAfter: number; // unix seconds
+  validBefore: number; // unix seconds
+  serial?: bigint;
+}
+
+/**
+ * Sign an ed25519 user public key into an OpenSSH user certificate.
+ * Returns the certificate line, or null if the inputs aren't ed25519.
+ */
+export function signUserCertificate(opts: SignCertOptions): string | null {
+  const pk = ed25519RawFromLine(opts.userPublicKeyLine);
+  const caRaw = ed25519RawFromLine(opts.caPublicKeyLine);
+  if (!pk || !caRaw) return null;
+
+  const signatureKey = ed25519PublicBlob(caRaw);
+  const principals = Buffer.concat(opts.principals.map((p) => sshString(p)));
+  const extensions = Buffer.concat(
+    [...DEFAULT_EXTENSIONS]
+      .sort()
+      .map((name) => Buffer.concat([sshString(name), sshString("")])),
+  );
+
+  // Everything up to (not including) the signature — this is what gets signed.
+  const body = Buffer.concat([
+    sshString(CERT_TYPE),
+    sshString(crypto.randomBytes(32)), // nonce
+    sshString(pk),
+    sshUint64(opts.serial ?? 0n),
+    sshUint32(SSH2_CERT_TYPE_USER),
+    sshString(opts.keyId),
+    sshString(principals),
+    sshUint64(BigInt(opts.validAfter)),
+    sshUint64(BigInt(opts.validBefore)),
+    sshString(Buffer.alloc(0)), // critical options (none)
+    sshString(extensions),
+    sshString(Buffer.alloc(0)), // reserved
+    sshString(signatureKey),
+  ]);
+
+  const caKey = crypto.createPrivateKey({
+    key: opts.caPrivateKeyPem,
+    format: "pem",
+    type: "pkcs8",
+  });
+  const rawSig = crypto.sign(null, body, caKey); // ed25519 -> 64 bytes
+  const signature = Buffer.concat([sshString(ED25519), sshString(rawSig)]);
+
+  const cert = Buffer.concat([body, sshString(signature)]);
+  return `${CERT_TYPE} ${cert.toString("base64")} ${opts.keyId}`;
+}
@@ -9,6 +9,7 @@ import { eq, asc } from "drizzle-orm";
 import { authLogger } from "../../utils/logger.js";
 import { AuthManager } from "../../utils/auth-manager.js";
 import type { SSOProviderType } from "../../../types/index.js";
+import { getOIDCConfigFromEnv } from "./user-oidc-utils.js";

 const authManager = AuthManager.getInstance();

@@ -117,6 +118,16 @@ export function registerSSOProviderRoutes(router: Router): void {
        .from(ssoProviders)
        .where(eq(ssoProviders.enabled, true))
        .orderBy(asc(ssoProviders.displayOrder), asc(ssoProviders.id));
+
+      // If no DB providers exist, synthesize one from env vars so SSO login
+      // remains available when configured purely via environment variables.
+      if (providers.length === 0) {
+        const envConfig = getOIDCConfigFromEnv();
+        if (envConfig) {
+          providers.push({ id: 0, name: "SSO", type: "oidc", displayOrder: 0 });
+        }
+      }
+
      res.json(providers);
    } catch (err) {
      authLogger.error("Failed to list SSO providers", err);
@@ -0,0 +1,95 @@
+import { describe, it, expect } from "vitest";
+import {
+  classifyAlgo,
+  parsePublicKey,
+  matchesAlgoFilter,
+  MAX_PUBLIC_KEY_LENGTH,
+} from "./termix-id-keys.js";
+
+// Build a valid OpenSSH public-key line for a given type by encoding a wire
+// blob whose first string field equals the type (what parsePublicKey checks).
+function makeKey(type: string, comment = ""): string {
+  const typeBuf = Buffer.from(type, "utf8");
+  const header = Buffer.alloc(4);
+  header.writeUInt32BE(typeBuf.length, 0);
+  const body = Buffer.alloc(40); // arbitrary trailing key material
+  const blob = Buffer.concat([header, typeBuf, body]).toString("base64");
+  return `${type} ${blob}${comment ? ` ${comment}` : ""}`;
+}
+
+describe("classifyAlgo", () => {
+  it("maps known types to normalized groups", () => {
+    expect(classifyAlgo("ssh-rsa")).toBe("RSA");
+    expect(classifyAlgo("rsa-sha2-512")).toBe("RSA");
+    expect(classifyAlgo("ssh-ed25519")).toBe("ED25519");
+    expect(classifyAlgo("ecdsa-sha2-nistp256")).toBe("ECDSA");
+    expect(classifyAlgo("ssh-dss")).toBe("DSA");
+    expect(classifyAlgo("sk-ssh-ed25519@openssh.com")).toBe("ED25519-SK");
+    expect(classifyAlgo("sk-ecdsa-sha2-nistp256@openssh.com")).toBe("ECDSA-SK");
+  });
+
+  it("falls back by substring for unknown variants", () => {
+    expect(classifyAlgo("ecdsa-sha2-nistp999")).toBe("ECDSA");
+    expect(classifyAlgo("rsa-sha2-256-cert")).toBe("RSA");
+    expect(classifyAlgo("something-weird")).toBe("SOMETHING-WEIRD");
+  });
+});
+
+describe("parsePublicKey", () => {
+  it("parses a valid ed25519 key and extracts the comment", () => {
+    const parsed = parsePublicKey(makeKey("ssh-ed25519", "alice@laptop"));
+    expect(parsed).not.toBeNull();
+    expect(parsed?.type).toBe("ssh-ed25519");
+    expect(parsed?.algorithm).toBe("ED25519");
+    expect(parsed?.comment).toBe("alice@laptop");
+    // Comment is stripped from the normalized (dedupe) form.
+    expect(parsed?.normalized.includes("alice@laptop")).toBe(false);
+  });
+
+  it("parses SK (FIDO) key types", () => {
+    expect(
+      parsePublicKey(makeKey("sk-ssh-ed25519@openssh.com"))?.algorithm,
+    ).toBe("ED25519-SK");
+  });
+
+  it.each([
+    [null],
+    [undefined],
+    [""],
+    ["   "],
+    ["ssh-ed25519"], // missing blob
+    ["ssh-ed25519 not_base64!!"], // bad base64 charset
+    ["ssh-rsa AAAAB3Nz"], // blob whose embedded type != declared type
+  ])("rejects malformed input %p", (input) => {
+    expect(parsePublicKey(input as string)).toBeNull();
+  });
+
+  it("rejects an over-length line (amplification guard)", () => {
+    const valid = makeKey("ssh-ed25519");
+    const padded = valid + " " + "A".repeat(MAX_PUBLIC_KEY_LENGTH);
+    expect(padded.length).toBeGreaterThan(MAX_PUBLIC_KEY_LENGTH);
+    expect(parsePublicKey(padded)).toBeNull();
+  });
+
+  it("rejects a blob whose embedded type does not match the prefix", () => {
+    // Declared ssh-rsa but the wire blob says ssh-ed25519.
+    const blob = makeKey("ssh-ed25519").split(" ")[1];
+    expect(parsePublicKey(`ssh-rsa ${blob}`)).toBeNull();
+  });
+});
+
+describe("matchesAlgoFilter", () => {
+  it("returns all keys when no filter", () => {
+    expect(matchesAlgoFilter("ED25519", null)).toBe(true);
+  });
+
+  it("matches exactly and is case-insensitive", () => {
+    expect(matchesAlgoFilter("ED25519", "ed25519")).toBe(true);
+    expect(matchesAlgoFilter("RSA", "RSA")).toBe(true);
+  });
+
+  it("does NOT let ED25519 match ED25519-SK (the over-match bug)", () => {
+    expect(matchesAlgoFilter("ED25519-SK", "ED25519")).toBe(false);
+    expect(matchesAlgoFilter("ECDSA-SK", "ECDSA")).toBe(false);
+  });
+});
@@ -0,0 +1,89 @@
+// Pure, dependency-free helpers for SSH public-key parsing/classification used
+// by the Termix ID routes. Kept separate so they can be unit-tested in isolation.
+
+// Upper bound on an accepted public-key line. Public keys are tiny (an RSA-4096
+// line is ~720 chars); this caps the value the unauthenticated resolver later
+// streams, preventing a multi-MB blob being stored and amplified.
+export const MAX_PUBLIC_KEY_LENGTH = 8192;
+
+// Normalized algorithm groups, used both for storage and for the `/<ALGO>`
+// resolver filter (mirrors sshid.io's RSA/ED25519/ECDSA suffixes).
+export const ALGO_GROUPS: Record<string, string> = {
+  "ssh-rsa": "RSA",
+  "rsa-sha2-256": "RSA",
+  "rsa-sha2-512": "RSA",
+  "ssh-dss": "DSA",
+  "ssh-ed25519": "ED25519",
+  "sk-ssh-ed25519@openssh.com": "ED25519-SK",
+  "ecdsa-sha2-nistp256": "ECDSA",
+  "ecdsa-sha2-nistp384": "ECDSA",
+  "ecdsa-sha2-nistp521": "ECDSA",
+  "sk-ecdsa-sha2-nistp256@openssh.com": "ECDSA-SK",
+};
+
+export function classifyAlgo(type: string): string {
+  if (ALGO_GROUPS[type]) return ALGO_GROUPS[type];
+  if (type.startsWith("ecdsa-")) return "ECDSA";
+  if (type.includes("ed25519")) return "ED25519";
+  if (type.includes("rsa")) return "RSA";
+  if (type.includes("dss") || type.includes("dsa")) return "DSA";
+  return type.toUpperCase();
+}
+
+export interface ParsedPublicKey {
+  type: string;
+  algorithm: string;
+  comment: string;
+  normalized: string; // "<type> <base64blob>"
+}
+
+/**
+ * Parse and validate a single OpenSSH public key line. Returns null when the
+ * input is not a well-formed public key.
+ */
+export function parsePublicKey(
+  raw: string | null | undefined,
+): ParsedPublicKey | null {
+  if (typeof raw !== "string") return null;
+  if (raw.length > MAX_PUBLIC_KEY_LENGTH) return null;
+  const line = raw.trim().replace(/\s+/g, " ");
+  if (!line) return null;
+
+  const parts = line.split(" ");
+  if (parts.length < 2) return null;
+
+  const [type, blob, ...rest] = parts;
+  if (!/^[A-Za-z0-9@.-]+$/.test(type)) return null;
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(blob)) return null;
+
+  const decoded = Buffer.from(blob, "base64");
+  // The blob is an SSH wire-format string whose first field repeats the type.
+  if (decoded.length < 8) return null;
+  try {
+    const len = decoded.readUInt32BE(0);
+    if (len <= 0 || len > 64 || 4 + len > decoded.length) return null;
+    const embeddedType = decoded.toString("utf8", 4, 4 + len);
+    if (embeddedType !== type) return null;
+  } catch {
+    return null;
+  }
+
+  return {
+    type,
+    algorithm: classifyAlgo(type),
+    comment: rest.join(" "),
+    normalized: `${type} ${blob}`,
+  };
+}
+
+/**
+ * Whether a key's normalized algorithm group matches a `/<ALGO>` resolver
+ * filter. Exact match only — `ED25519` must NOT also return `ED25519-SK`.
+ */
+export function matchesAlgoFilter(
+  algorithm: string,
+  filter: string | null,
+): boolean {
+  if (!filter) return true;
+  return algorithm.toUpperCase() === filter.toUpperCase();
+}
@@ -0,0 +1,147 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const mockSelect = vi.fn();
+const mockUpdate = vi.fn();
+const mockInsert = vi.fn();
+const mockDelete = vi.fn();
+
+vi.mock("../db/index.js", () => ({
+  db: {
+    select: mockSelect,
+    update: mockUpdate,
+    insert: mockInsert,
+    delete: mockDelete,
+  },
+}));
+
+vi.mock("../../utils/logger.js", () => ({
+  apiLogger: { error: vi.fn(), warn: vi.fn(), info: vi.fn(), success: vi.fn() },
+  authLogger: {
+    error: vi.fn(),
+    warn: vi.fn(),
+    info: vi.fn(),
+    success: vi.fn(),
+  },
+}));
+
+vi.mock("../../utils/auth-manager.js", () => ({
+  AuthManager: {
+    getInstance: () => ({
+      createAuthMiddleware:
+        () =>
+        (req: Record<string, unknown>, _res: unknown, next: () => void) => {
+          req.userId = "user-1";
+          next();
+        },
+      createDataAccessMiddleware:
+        () => (_req: unknown, _res: unknown, next: () => void) =>
+          next(),
+    }),
+  },
+}));
+
+vi.mock("../../utils/audit-logger.js", () => ({
+  logAudit: vi.fn(),
+  getRequestMeta: vi.fn(() => ({})),
+}));
+
+vi.mock("../../utils/data-crypto.js", () => ({
+  DataCrypto: { getInstance: () => ({ encrypt: vi.fn(), decrypt: vi.fn() }) },
+}));
+
+vi.mock("../../utils/user-crypto.js", () => ({
+  UserCrypto: { getInstance: () => ({ getUserKey: vi.fn() }) },
+}));
+
+vi.mock("./termix-id-keys.js", () => ({
+  termixIdKeysRouter: { use: vi.fn() },
+  matchesAlgoFilter: vi.fn(() => true),
+}));
+
+vi.mock("../../utils/simple-db-ops.js", () => ({
+  SimpleDBOps: vi.fn().mockImplementation(() => ({
+    findOne: vi.fn(),
+    findAll: vi.fn(),
+    insert: vi.fn(),
+    update: vi.fn(),
+    remove: vi.fn(),
+  })),
+}));
+
+// Chainable Drizzle stub — supports arbitrary method chains and resolves via .then()
+function makeChain(resolveValue: unknown) {
+  const chain: Record<string, unknown> = {};
+  const methods = [
+    "from",
+    "where",
+    "set",
+    "values",
+    "returning",
+    "orderBy",
+    "limit",
+    "and",
+    "eq",
+  ];
+  for (const m of methods) {
+    chain[m] = vi.fn(() => chain);
+  }
+  (chain as unknown as Promise<unknown>).then = (
+    cb: (v: unknown) => unknown,
+    eb?: (e: unknown) => unknown,
+  ) => Promise.resolve(resolveValue).then(cb, eb);
+  (chain as unknown as Promise<unknown>).catch = (
+    cb: (e: unknown) => unknown,
+  ) => Promise.resolve(resolveValue).catch(cb);
+  return chain;
+}
+
+const IDENTITY_ROW = { id: 42, userId: "user-1", handle: "alice" };
+
+describe("GET /termix-id/linked-credentials", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("returns empty list when user has no identity", async () => {
+    // First select (getIdentityForUser) returns nothing; second should not be called
+    mockSelect.mockReturnValueOnce(makeChain([]));
+
+    const { default: router } = await import("./termix-id.js");
+    expect(router).toBeDefined();
+
+    expect(router).toBeDefined();
+  });
+
+  it("returns empty list when identity has no keys", async () => {
+    mockSelect
+      .mockReturnValueOnce(makeChain([IDENTITY_ROW])) // identity lookup
+      .mockReturnValueOnce(makeChain([])); // keys lookup
+
+    const { default: router } = await import("./termix-id.js");
+    expect(router).toBeDefined();
+  });
+
+  it("returns deduplicated credentialIds for enabled keys", async () => {
+    const keys = [
+      { credentialId: 10 },
+      { credentialId: 20 },
+      { credentialId: 10 }, // duplicate
+    ];
+    mockSelect
+      .mockReturnValueOnce(makeChain([IDENTITY_ROW]))
+      .mockReturnValueOnce(makeChain(keys));
+
+    const { default: router } = await import("./termix-id.js");
+    expect(router).toBeDefined();
+  });
+
+  it("excludes keys with null credentialId", async () => {
+    const keys = [{ credentialId: null }, { credentialId: 5 }];
+    mockSelect
+      .mockReturnValueOnce(makeChain([IDENTITY_ROW]))
+      .mockReturnValueOnce(makeChain(keys));
+
+    const { default: router } = await import("./termix-id.js");
+    expect(router).toBeDefined();
+  });
+});
@@ -1,10 +1,13 @@
 import type { AuthenticatedRequest } from "../../../types/index.js";
 import type { RequestHandler, Router } from "express";
-import { eq } from "drizzle-orm";
+import { eq, and } from "drizzle-orm";
 import { authLogger } from "../../utils/logger.js";
 import { db } from "../db/index.js";
-import { users } from "../db/schema.js";
+import { users, roles, userRoles } from "../db/schema.js";
 import { logAudit, getRequestMeta } from "../../utils/audit-logger.js";
+import bcrypt from "bcryptjs";
+import { nanoid } from "nanoid";
+import { AuthManager } from "../../utils/auth-manager.js";

 function isNonEmptyString(val: unknown): val is string {
  return typeof val === "string" && val.trim().length > 0;
@@ -139,6 +142,50 @@ export function registerUserAdminRoutes(
            : eq(users.username, resolvedUsername!),
        );

+      try {
+        const targetId = targetUser[0].id;
+        const adminRole = await db
+          .select({ id: roles.id })
+          .from(roles)
+          .where(eq(roles.name, "admin"))
+          .limit(1);
+        const userRole = await db
+          .select({ id: roles.id })
+          .from(roles)
+          .where(eq(roles.name, "user"))
+          .limit(1);
+        if (adminRole.length > 0) {
+          await db
+            .delete(userRoles)
+            .where(
+              and(
+                eq(userRoles.userId, targetId),
+                eq(userRoles.roleId, adminRole[0].id),
+              ),
+            );
+          await db.insert(userRoles).values({
+            userId: targetId,
+            roleId: adminRole[0].id,
+            grantedBy: userId,
+          });
+        }
+        if (userRole.length > 0) {
+          await db
+            .delete(userRoles)
+            .where(
+              and(
+                eq(userRoles.userId, targetId),
+                eq(userRoles.roleId, userRole[0].id),
+              ),
+            );
+        }
+      } catch (roleError) {
+        authLogger.error("Failed to sync admin role on make-admin", roleError, {
+          operation: "make_admin_role_sync",
+          userId: targetUser[0].id,
+        });
+      }
+
      try {
        const { saveMemoryDatabaseToFile } = await import("../db/index.js");
        await saveMemoryDatabaseToFile();
@@ -277,6 +324,54 @@ export function registerUserAdminRoutes(
            : eq(users.username, resolvedUsername!),
        );

+      try {
+        const targetId = targetUser[0].id;
+        const adminRole = await db
+          .select({ id: roles.id })
+          .from(roles)
+          .where(eq(roles.name, "admin"))
+          .limit(1);
+        const userRole = await db
+          .select({ id: roles.id })
+          .from(roles)
+          .where(eq(roles.name, "user"))
+          .limit(1);
+        if (adminRole.length > 0) {
+          await db
+            .delete(userRoles)
+            .where(
+              and(
+                eq(userRoles.userId, targetId),
+                eq(userRoles.roleId, adminRole[0].id),
+              ),
+            );
+        }
+        if (userRole.length > 0) {
+          await db
+            .delete(userRoles)
+            .where(
+              and(
+                eq(userRoles.userId, targetId),
+                eq(userRoles.roleId, userRole[0].id),
+              ),
+            );
+          await db.insert(userRoles).values({
+            userId: targetId,
+            roleId: userRole[0].id,
+            grantedBy: userId,
+          });
+        }
+      } catch (roleError) {
+        authLogger.error(
+          "Failed to sync user role on remove-admin",
+          roleError,
+          {
+            operation: "remove_admin_role_sync",
+            userId: targetUser[0].id,
+          },
+        );
+      }
+
      try {
        const { saveMemoryDatabaseToFile } = await import("../db/index.js");
        await saveMemoryDatabaseToFile();
@@ -321,4 +416,184 @@ export function registerUserAdminRoutes(
      res.status(500).json({ error: "Failed to remove admin status" });
    }
  });
+
+  /**
+   * @openapi
+   * /users/admin-create:
+   *   post:
+   *     summary: Admin create user
+   *     description: Allows an admin to create a new user regardless of whether public registration is enabled.
+   *     tags:
+   *       - Users
+   *     requestBody:
+   *       required: true
+   *       content:
+   *         application/json:
+   *           schema:
+   *             type: object
+   *             properties:
+   *               username:
+   *                 type: string
+   *               password:
+   *                 type: string
+   *     responses:
+   *       200:
+   *         description: User created successfully.
+   *       400:
+   *         description: Username and password are required.
+   *       403:
+   *         description: Not authorized.
+   *       409:
+   *         description: Username already exists.
+   *       500:
+   *         description: Failed to create user.
+   */
+  router.post("/admin-create", authenticateJWT, async (req, res) => {
+    const adminId = (req as AuthenticatedRequest).userId;
+
+    try {
+      const adminUser = await db
+        .select()
+        .from(users)
+        .where(eq(users.id, adminId));
+      if (!adminUser || adminUser.length === 0 || !adminUser[0].isAdmin) {
+        return res.status(403).json({ error: "Not authorized" });
+      }
+    } catch (err) {
+      authLogger.error("Failed to verify admin status", err);
+      return res.status(500).json({ error: "Failed to verify admin status" });
+    }
+
+    const { username, password } = req.body;
+
+    if (!isNonEmptyString(username) || !isNonEmptyString(password)) {
+      return res
+        .status(400)
+        .json({ error: "Username and password are required" });
+    }
+
+    try {
+      const existing = await db
+        .select()
+        .from(users)
+        .where(eq(users.username, username));
+      if (existing && existing.length > 0) {
+        return res.status(409).json({ error: "Username already exists" });
+      }
+
+      const password_hash = await bcrypt.hash(password, 10);
+      const id = nanoid();
+
+      db.$client.transaction(() => {
+        db.$client
+          .prepare(
+            "INSERT INTO users (id, username, password_hash, is_admin, is_oidc, client_id, client_secret, issuer_url, authorization_url, token_url, identifier_path, name_path, scopes, totp_secret, totp_enabled, totp_backup_codes) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+          )
+          .run(
+            id,
+            username,
+            password_hash,
+            0,
+            0,
+            "",
+            "",
+            "",
+            "",
+            "",
+            "",
+            "",
+            "openid email profile",
+            null,
+            0,
+            null,
+          );
+      })();
+
+      try {
+        const userRole = await db
+          .select({ id: roles.id })
+          .from(roles)
+          .where(eq(roles.name, "user"))
+          .limit(1);
+        if (userRole.length > 0) {
+          await db.insert(userRoles).values({
+            userId: id,
+            roleId: userRole[0].id,
+            grantedBy: adminId,
+          });
+        }
+      } catch (roleError) {
+        authLogger.error(
+          "Failed to assign default role during admin create",
+          roleError,
+          {
+            operation: "admin_create_user_role",
+            userId: id,
+          },
+        );
+      }
+
+      const authManager = AuthManager.getInstance();
+      try {
+        await authManager.registerUser(id, password);
+      } catch (encryptionError) {
+        await db.delete(users).where(eq(users.id, id));
+        authLogger.error(
+          "Failed to setup user encryption during admin create, rolled back",
+          encryptionError,
+          { operation: "admin_create_user_encryption_failed", userId: id },
+        );
+        return res.status(500).json({
+          error: "Failed to setup user security - user creation cancelled",
+        });
+      }
+
+      try {
+        const { saveMemoryDatabaseToFile } = await import("../db/index.js");
+        await saveMemoryDatabaseToFile();
+      } catch (saveError) {
+        authLogger.error(
+          "Failed to persist admin-created user to disk",
+          saveError,
+          {
+            operation: "admin_create_user_save_failed",
+            userId: id,
+          },
+        );
+      }
+
+      authLogger.success("User created by admin", {
+        operation: "admin_create_user_success",
+        adminId,
+        userId: id,
+        username,
+      });
+
+      const { ipAddress, userAgent } = getRequestMeta(req);
+      const adminRecord = await db
+        .select({ username: users.username })
+        .from(users)
+        .where(eq(users.id, adminId))
+        .limit(1);
+      await logAudit({
+        userId: adminId,
+        username: adminRecord[0]?.username ?? adminId,
+        action: "create_user",
+        resourceType: "user",
+        resourceId: id,
+        resourceName: username,
+        ipAddress,
+        userAgent,
+        success: true,
+      });
+
+      res.json({
+        message: "User created",
+        toast: { type: "success", message: `User created: ${username}` },
+      });
+    } catch (err) {
+      authLogger.error("Failed to admin-create user", err);
+      res.status(500).json({ error: "Failed to create user" });
+    }
+  });
 }
@@ -61,6 +61,23 @@ describe("isOIDCUserAllowed", () => {
  it("does not match the email against an identifier-only pattern when email differs", () => {
    expect(isOIDCUserAllowed("alice", "sub-123", "alice@x.com")).toBe(false);
  });
+
+  it("matches *@domain.com wildcard pattern against emails", () => {
+    expect(
+      isOIDCUserAllowed("*@company.com", "sub-1", "john@company.com"),
+    ).toBe(true);
+    expect(
+      isOIDCUserAllowed("*@company.com", "sub-1", "jane@COMPANY.COM"),
+    ).toBe(true);
+    expect(isOIDCUserAllowed("*@company.com", "sub-1", "user@other.com")).toBe(
+      false,
+    );
+  });
+
+  it("matches glob patterns with multiple wildcards", () => {
+    expect(isOIDCUserAllowed("admin*", "admin_user")).toBe(true);
+    expect(isOIDCUserAllowed("admin*", "user_admin")).toBe(false);
+  });
 });

 describe("getOIDCConfigFromEnv", () => {
@@ -4,6 +4,7 @@ import { db } from "../db/index.js";
 import { ssoProviders } from "../db/schema.js";
 import { eq } from "drizzle-orm";
 import { DataCrypto } from "../../utils/data-crypto.js";
+import { Agent } from "undici";

 export type OIDCConfig = {
  client_id: string;
@@ -18,8 +19,14 @@ export type OIDCConfig = {
  allowed_users: string;
  admin_group: string;
  group_claim?: string;
+  ca_cert?: string;
 };

+export function buildFetchOptions(caCert?: string): Record<string, unknown> {
+  if (!caCert || !caCert.trim()) return {};
+  return { dispatcher: new Agent({ connect: { ca: caCert } }) };
+}
+
 export function getOIDCConfigFromEnv(): OIDCConfig | null {
  const client_id = process.env.OIDC_CLIENT_ID;
  const client_secret = process.env.OIDC_CLIENT_SECRET;
@@ -107,6 +114,15 @@ export function isOIDCUserAllowed(
  ];
  for (const pattern of patterns) {
    if (pattern === "*") return true;
+    if (pattern.includes("*")) {
+      const escaped = pattern
+        .toLowerCase()
+        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+        .replace(/\*/g, ".*");
+      const regex = new RegExp(`^${escaped}$`);
+      if (values.some((v) => v && regex.test(v.toLowerCase()))) return true;
+      continue;
+    }
    for (const value of values) {
      if (!value) continue;
      if (pattern.toLowerCase().startsWith("@")) {
@@ -123,7 +139,9 @@ export async function verifyOIDCToken(
  idToken: string,
  issuerUrl: string,
  clientId: string,
+  caCert?: string,
 ): Promise<Record<string, unknown>> {
+  const fetchOptions = buildFetchOptions(caCert);
  const normalizedIssuerUrl = issuerUrl.endsWith("/")
    ? issuerUrl.slice(0, -1)
    : issuerUrl;
@@ -142,7 +160,7 @@ export async function verifyOIDCToken(

  try {
    const discoveryUrl = `${normalizedIssuerUrl}/.well-known/openid-configuration`;
-    const discoveryResponse = await fetch(discoveryUrl);
+    const discoveryResponse = await fetch(discoveryUrl, fetchOptions);
    if (discoveryResponse.ok) {
      const discovery = (await discoveryResponse.json()) as Record<
        string,
@@ -160,7 +178,7 @@ export async function verifyOIDCToken(

  for (const url of jwksUrls) {
    try {
-      const response = await fetch(url);
+      const response = await fetch(url, fetchOptions);
      if (response.ok) {
        const jwksData = (await response.json()) as Record<string, unknown>;
        if (jwksData && jwksData.keys && Array.isArray(jwksData.keys)) {
@@ -214,6 +232,49 @@ export async function verifyOIDCToken(
  return payload;
 }

+const GOOGLE_DEFAULTS = {
+  issuer_url: "https://accounts.google.com",
+  authorization_url: "https://accounts.google.com/o/oauth2/v2/auth",
+  token_url: "https://oauth2.googleapis.com/token",
+  userinfo_url: "https://openidconnect.googleapis.com/v1/userinfo",
+  identifier_path: "sub",
+  name_path: "name",
+  scopes: "openid email profile",
+};
+
+const GITHUB_DEFAULTS = {
+  issuer_url: "https://token.actions.githubusercontent.com",
+  authorization_url: "https://github.com/login/oauth/authorize",
+  token_url: "https://github.com/login/oauth/access_token",
+  userinfo_url: "https://api.github.com/user",
+  identifier_path: "id",
+  name_path: "name",
+  scopes: "read:user user:email",
+};
+
+function applyProviderDefaults(
+  config: OIDCConfig,
+  providerType: string,
+): OIDCConfig {
+  const defaults =
+    providerType === "google"
+      ? GOOGLE_DEFAULTS
+      : providerType === "github"
+        ? GITHUB_DEFAULTS
+        : null;
+  if (!defaults) return config;
+  return {
+    ...config,
+    issuer_url: config.issuer_url || defaults.issuer_url,
+    authorization_url: config.authorization_url || defaults.authorization_url,
+    token_url: config.token_url || defaults.token_url,
+    userinfo_url: config.userinfo_url || defaults.userinfo_url,
+    identifier_path: config.identifier_path || defaults.identifier_path,
+    name_path: config.name_path || defaults.name_path,
+    scopes: config.scopes || defaults.scopes,
+  };
+}
+
 function decryptConfigSecret(
  config: Record<string, unknown>,
 ): Record<string, unknown> {
@@ -280,10 +341,14 @@ export async function loadProviderConfig(
        } else {
          parsed = decryptConfigSecret(parsed);
        }
-        const config = parsed as unknown as OIDCConfig;
+        const providerType = row.type as SSOProviderType;
+        const config = applyProviderDefaults(
+          parsed as unknown as OIDCConfig,
+          providerType,
+        );
        return {
          config,
-          providerType: row.type as SSOProviderType,
+          providerType,
          providerDbId: row.id,
        };
      }
@@ -318,9 +383,13 @@ export async function loadProviderConfig(
        parsed = {};
      }
      parsed = decryptConfigSecret(parsed);
+      const oidcProviderType = oidcRow.type as SSOProviderType;
      return {
-        config: parsed as unknown as OIDCConfig,
-        providerType: oidcRow.type as SSOProviderType,
+        config: applyProviderDefaults(
+          parsed as unknown as OIDCConfig,
+          oidcProviderType,
+        ),
+        providerType: oidcProviderType,
        providerDbId: oidcRow.id,
      };
    }
@@ -18,6 +18,7 @@ import {
  sshCredentialUsage,
  recentActivity,
  snippets,
+  webauthnCredentials,
 } from "../db/schema.js";

 interface UserPasswordResetRoutesDeps {
@@ -63,12 +64,19 @@ export function registerUserPasswordResetRoutes(
   */
  router.post("/initiate-reset", async (req, res) => {
    try {
-      const row = db.$client
-        .prepare(
-          "SELECT value FROM settings WHERE key = 'allow_password_reset'",
-        )
-        .get();
-      if (row && (row as { value: string }).value !== "true") {
+      const envVal = process.env.ALLOW_PASSWORD_RESET;
+      const allowed =
+        envVal !== undefined
+          ? envVal.trim().toLowerCase() === "true"
+          : (() => {
+              const row = db.$client
+                .prepare(
+                  "SELECT value FROM settings WHERE key = 'allow_password_reset'",
+                )
+                .get();
+              return row ? (row as { value: string }).value === "true" : true;
+            })();
+      if (!allowed) {
        return res
          .status(403)
          .json({ error: "Password reset is currently disabled" });
@@ -346,8 +354,7 @@ export function registerUserPasswordResetRoutes(
      }
      const userId = user[0].id;

-      const saltRounds = parseInt(process.env.SALT || "10", 10);
-      const password_hash = await bcrypt.hash(newPassword, saltRounds);
+      const password_hash = await bcrypt.hash(newPassword, 10);

      let userIdFromJwt: string | null = null;
      const cookie = req.cookies?.jwt;
@@ -434,6 +441,9 @@ export function registerUserPasswordResetRoutes(
          await db
            .delete(sshCredentials)
            .where(eq(sshCredentials.userId, userId));
+          await db
+            .delete(webauthnCredentials)
+            .where(eq(webauthnCredentials.userId, userId));

          await authManager.registerUser(userId, newPassword);
          authManager.logoutUser(userId);
@@ -17,17 +17,20 @@ const pickPreferences = (row?: typeof userPreferences.$inferSelect) => ({
  fontSize: row?.fontSize ?? null,
  accentColor: row?.accentColor ?? null,
  language: row?.language ?? null,
-  storageMode: row?.storageMode ?? "local",
+  storageMode: row?.storageMode ?? "cloud",
  commandAutocomplete: row?.commandAutocomplete ?? null,
  commandPaletteEnabled: row?.commandPaletteEnabled ?? null,
  showHostTags: row?.showHostTags ?? null,
  hostTrayOnClick: row?.hostTrayOnClick ?? null,
  pinAppRail: row?.pinAppRail ?? null,
+  expandAppRailOnHover: row?.expandAppRailOnHover ?? null,
  foldersCollapsed: row?.foldersCollapsed ?? null,
  confirmSnippetExecution: row?.confirmSnippetExecution ?? null,
  disableUpdateCheck: row?.disableUpdateCheck ?? null,
  confirmTabClose: row?.confirmTabClose ?? null,
  hiddenRailTabs: row?.hiddenRailTabs ?? null,
+  compactHostView: row?.compactHostView ?? null,
+  statusColorScheme: row?.statusColorScheme ?? null,
 });

 /**
@@ -77,6 +80,9 @@ const pickPreferences = (row?: typeof userPreferences.$inferSelect) => ({
 *                 pinAppRail:
 *                   type: boolean
 *                   nullable: true
+ *                 expandAppRailOnHover:
+ *                   type: boolean
+ *                   nullable: true
 *                 foldersCollapsed:
 *                   type: boolean
 *                   nullable: true
@@ -92,6 +98,12 @@ const pickPreferences = (row?: typeof userPreferences.$inferSelect) => ({
 *                 hiddenRailTabs:
 *                   type: string
 *                   nullable: true
+ *                 compactHostView:
+ *                   type: boolean
+ *                   nullable: true
+ *                 statusColorScheme:
+ *                   type: string
+ *                   nullable: true
 */
 router.get("/", authenticateJWT, (req: Request, res: Response) => {
  const userId = (req as AuthenticatedRequest).userId;
@@ -148,6 +160,8 @@ router.get("/", authenticateJWT, (req: Request, res: Response) => {
 *                 type: boolean
 *               pinAppRail:
 *                 type: boolean
+ *               expandAppRailOnHover:
+ *                 type: boolean
 *               foldersCollapsed:
 *                 type: boolean
 *               confirmSnippetExecution:
@@ -158,6 +172,10 @@ router.get("/", authenticateJWT, (req: Request, res: Response) => {
 *                 type: boolean
 *               hiddenRailTabs:
 *                 type: string
+ *               compactHostView:
+ *                 type: boolean
+ *               statusColorScheme:
+ *                 type: string
 *     responses:
 *       200:
 *         description: Preferences updated successfully.
@@ -176,11 +194,14 @@ router.put("/", authenticateJWT, (req: Request, res: Response) => {
    showHostTags,
    hostTrayOnClick,
    pinAppRail,
+    expandAppRailOnHover,
    foldersCollapsed,
    confirmSnippetExecution,
    disableUpdateCheck,
    confirmTabClose,
    hiddenRailTabs,
+    compactHostView,
+    statusColorScheme,
  } = req.body as {
    reopenTabsOnLogin?: boolean;
    theme?: string | null;
@@ -193,11 +214,14 @@ router.put("/", authenticateJWT, (req: Request, res: Response) => {
    showHostTags?: boolean | null;
    hostTrayOnClick?: boolean | null;
    pinAppRail?: boolean | null;
+    expandAppRailOnHover?: boolean | null;
    foldersCollapsed?: boolean | null;
    confirmSnippetExecution?: boolean | null;
    disableUpdateCheck?: boolean | null;
    confirmTabClose?: boolean | null;
    hiddenRailTabs?: string | null;
+    compactHostView?: boolean | null;
+    statusColorScheme?: string | null;
  };

  const updates: Partial<typeof userPreferences.$inferInsert> = {
@@ -220,6 +244,7 @@ router.put("/", authenticateJWT, (req: Request, res: Response) => {
    language,
    storageMode,
    hiddenRailTabs,
+    statusColorScheme,
  })) {
    if (value !== undefined && value !== null && typeof value !== "string") {
      return res.status(400).json({ error: `${key} must be a string` });
@@ -232,10 +257,12 @@ router.put("/", authenticateJWT, (req: Request, res: Response) => {
    showHostTags,
    hostTrayOnClick,
    pinAppRail,
+    expandAppRailOnHover,
    foldersCollapsed,
    confirmSnippetExecution,
    disableUpdateCheck,
    confirmTabClose,
+    compactHostView,
  };
  for (const [key, value] of Object.entries(boolFields)) {
    if (value !== undefined && value !== null && typeof value !== "boolean") {
@@ -256,6 +283,8 @@ router.put("/", authenticateJWT, (req: Request, res: Response) => {
  if (showHostTags !== undefined) updates.showHostTags = showHostTags;
  if (hostTrayOnClick !== undefined) updates.hostTrayOnClick = hostTrayOnClick;
  if (pinAppRail !== undefined) updates.pinAppRail = pinAppRail;
+  if (expandAppRailOnHover !== undefined)
+    updates.expandAppRailOnHover = expandAppRailOnHover;
  if (foldersCollapsed !== undefined)
    updates.foldersCollapsed = foldersCollapsed;
  if (confirmSnippetExecution !== undefined)
@@ -263,6 +292,9 @@ router.put("/", authenticateJWT, (req: Request, res: Response) => {
  if (disableUpdateCheck !== undefined)
    updates.disableUpdateCheck = disableUpdateCheck;
  if (confirmTabClose !== undefined) updates.confirmTabClose = confirmTabClose;
+  if (compactHostView !== undefined) updates.compactHostView = compactHostView;
+  if (statusColorScheme !== undefined)
+    updates.statusColorScheme = statusColorScheme;

  if (Object.keys(updates).length === 1) {
    return res.status(400).json({ error: "No preferences provided" });
@@ -10,10 +10,28 @@ import {
 import { db } from "../db/index.js";
 import { users } from "../db/schema.js";
 import { logAudit, getRequestMeta } from "../../utils/audit-logger.js";
+import {
+  formatGuacdOptions,
+  resolveGuacdOptions,
+} from "../../utils/guacd-config.js";

-function getDefaultGuacUrl(): string {
-  return `${process.env.GUACD_HOST || "localhost"}:${process.env.GUACD_PORT || "4822"}`;
-}
+export type HostDefaults = {
+  useSocks5?: boolean;
+  socks5Host?: string;
+  socks5Port?: number;
+  socks5Username?: string;
+  socks5Password?: string;
+  credentialId?: number | null;
+  metricsEnabled?: boolean;
+  statusCheckEnabled?: boolean;
+  fontSize?: number;
+  fontFamily?: string;
+  theme?: string;
+  cursorStyle?: string;
+  cursorBlink?: boolean;
+  enableSessionLogging?: boolean;
+  enableCommandHistory?: boolean;
+};

 export function registerUserSettingsRoutes(
  router: Router,
@@ -52,7 +70,7 @@ export function registerUserSettingsRoutes(
        .get() as { value: string } | undefined;
      res.json({
        enabled: enabledRow ? enabledRow.value !== "false" : true,
-        url: urlRow ? urlRow.value : getDefaultGuacUrl(),
+        url: formatGuacdOptions(resolveGuacdOptions(urlRow?.value)),
      });
    } catch (err) {
      authLogger.error("Failed to get guacamole settings", err);
@@ -143,7 +161,7 @@ export function registerUserSettingsRoutes(

      res.json({
        enabled: enabledRow ? enabledRow.value !== "false" : true,
-        url: urlRow ? urlRow.value : getDefaultGuacUrl(),
+        url: formatGuacdOptions(resolveGuacdOptions(urlRow?.value)),
      });
    } catch (err) {
      authLogger.error("Failed to update guacamole settings", err);
@@ -544,4 +562,91 @@ export function registerUserSettingsRoutes(
      }
    },
  );
+
+  /**
+   * @openapi
+   * /users/host-defaults:
+   *   get:
+   *     summary: Get host creation defaults
+   *     description: Returns the global default settings applied when creating a new host.
+   *     tags:
+   *       - Users
+   *     responses:
+   *       200:
+   *         description: Host defaults object.
+   *       500:
+   *         description: Failed to get host defaults.
+   */
+  router.get("/host-defaults", authenticateJWT, async (_req, res) => {
+    try {
+      const row = db.$client
+        .prepare("SELECT value FROM settings WHERE key = 'host_defaults'")
+        .get() as { value: string } | undefined;
+      const defaults: HostDefaults = row ? JSON.parse(row.value) : {};
+      res.json(defaults);
+    } catch (err) {
+      authLogger.error("Failed to get host defaults", err);
+      res.status(500).json({ error: "Failed to get host defaults" });
+    }
+  });
+
+  /**
+   * @openapi
+   * /users/host-defaults:
+   *   patch:
+   *     summary: Update host creation defaults (admin only)
+   *     description: Sets global default settings applied when a new host is created.
+   *     tags:
+   *       - Users
+   *     requestBody:
+   *       required: true
+   *       content:
+   *         application/json:
+   *           schema:
+   *             type: object
+   *     responses:
+   *       200:
+   *         description: Host defaults updated.
+   *       403:
+   *         description: Not authorized.
+   *       500:
+   *         description: Failed to update host defaults.
+   */
+  router.patch("/host-defaults", authenticateJWT, async (req, res) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    try {
+      const user = await db.select().from(users).where(eq(users.id, userId));
+      if (!user || user.length === 0 || !user[0].isAdmin) {
+        return res.status(403).json({ error: "Not authorized" });
+      }
+      const defaults: HostDefaults = req.body;
+      db.$client
+        .prepare(
+          "INSERT OR REPLACE INTO settings (key, value) VALUES ('host_defaults', ?)",
+        )
+        .run(JSON.stringify(defaults));
+
+      const { ipAddress, userAgent } = getRequestMeta(req);
+      const actorRecord = await db
+        .select({ username: users.username })
+        .from(users)
+        .where(eq(users.id, userId))
+        .limit(1);
+      await logAudit({
+        userId,
+        username: actorRecord[0]?.username ?? userId,
+        action: "update_host_defaults",
+        resourceType: "setting",
+        details: JSON.stringify(defaults),
+        ipAddress,
+        userAgent,
+        success: true,
+      });
+
+      res.json(defaults);
+    } catch (err) {
+      authLogger.error("Failed to update host defaults", err);
+      res.status(500).json({ error: "Failed to update host defaults" });
+    }
+  });
 }
@@ -5,6 +5,7 @@ import bcrypt from "bcryptjs";
 import QRCode from "qrcode";
 import speakeasy from "speakeasy";
 import { AuthManager } from "../../utils/auth-manager.js";
+import { FieldCrypto } from "../../utils/field-crypto.js";
 import { LazyFieldEncryption } from "../../utils/lazy-field-encryption.js";
 import { authLogger } from "../../utils/logger.js";
 import { loginRateLimiter } from "../../utils/login-rate-limiter.js";
@@ -28,6 +29,7 @@ type TotpUserRecord = typeof users.$inferSelect;
 export async function verifyTotpReauth(
  userRecord: TotpUserRecord,
  credential: string,
+  userDataKey?: Buffer | null,
 ): Promise<boolean> {
  if (!userRecord.isOidc && userRecord.passwordHash) {
    const passwordMatch = await bcrypt.compare(
@@ -40,22 +42,41 @@ export async function verifyTotpReauth(
  }

  if (userRecord.totpSecret) {
-    const totpMatch = speakeasy.totp.verify({
-      secret: userRecord.totpSecret,
-      encoding: "base32",
-      token: credential,
-      window: 2,
-    });
-    if (totpMatch) {
-      return true;
+    const totpSecret = userDataKey
+      ? LazyFieldEncryption.safeGetFieldValue(
+          userRecord.totpSecret,
+          userDataKey,
+          userRecord.id,
+          "totpSecret",
+        )
+      : userRecord.totpSecret;
+
+    if (totpSecret) {
+      const totpMatch = speakeasy.totp.verify({
+        secret: totpSecret,
+        encoding: "base32",
+        token: credential,
+        window: 2,
+      });
+      if (totpMatch) {
+        return true;
+      }
    }
  }

+  const rawBackupCodes =
+    userDataKey && userRecord.totpBackupCodes
+      ? LazyFieldEncryption.safeGetFieldValue(
+          userRecord.totpBackupCodes,
+          userDataKey,
+          userRecord.id,
+          "totpBackupCodes",
+        )
+      : userRecord.totpBackupCodes;
+
  let backupCodes: unknown = [];
  try {
-    backupCodes = userRecord.totpBackupCodes
-      ? JSON.parse(userRecord.totpBackupCodes)
-      : [];
+    backupCodes = rawBackupCodes ? JSON.parse(rawBackupCodes) : [];
  } catch {
    backupCodes = [];
  }
@@ -63,9 +84,18 @@ export async function verifyTotpReauth(
    const backupIndex = backupCodes.indexOf(credential);
    if (backupIndex !== -1) {
      backupCodes.splice(backupIndex, 1);
+      const updatedJson = JSON.stringify(backupCodes);
+      const storedValue = userDataKey
+        ? FieldCrypto.encryptField(
+            updatedJson,
+            userDataKey,
+            userRecord.id,
+            "totpBackupCodes",
+          )
+        : updatedJson;
      await db
        .update(users)
-        .set({ totpBackupCodes: JSON.stringify(backupCodes) })
+        .set({ totpBackupCodes: storedValue })
        .where(eq(users.id, userRecord.id));
      return true;
    }
@@ -172,6 +202,21 @@ export function registerUserTotpRoutes(
    }

    try {
+      const passwordLoginRow = db.$client
+        .prepare(
+          "SELECT value FROM settings WHERE key = 'allow_password_login'",
+        )
+        .get() as { value: string } | undefined;
+      const passwordLoginAllowed = passwordLoginRow
+        ? passwordLoginRow.value === "true"
+        : true;
+      if (!passwordLoginAllowed) {
+        return res.status(409).json({
+          error:
+            "Cannot enable 2FA while password login is disabled. Enable password login first.",
+        });
+      }
+
      const user = await db.select().from(users).where(eq(users.id, userId));
      if (!user || user.length === 0) {
        return res.status(404).json({ error: "User not found" });
@@ -187,8 +232,18 @@ export function registerUserTotpRoutes(
        return res.status(400).json({ error: "TOTP setup not initiated" });
      }

+      const userDataKey = authManager.getUserDataKey(userId);
+      const totpSecret = userDataKey
+        ? LazyFieldEncryption.safeGetFieldValue(
+            userRecord.totpSecret,
+            userDataKey,
+            userId,
+            "totpSecret",
+          )
+        : userRecord.totpSecret;
+
      const verified = speakeasy.totp.verify({
-        secret: userRecord.totpSecret,
+        secret: totpSecret,
        encoding: "base32",
        token: totp_code,
        window: 2,
@@ -202,11 +257,21 @@ export function registerUserTotpRoutes(
        Math.random().toString(36).substring(2, 10).toUpperCase(),
      );

+      const backupCodesJson = JSON.stringify(backupCodes);
+      const storedBackupCodes = userDataKey
+        ? FieldCrypto.encryptField(
+            backupCodesJson,
+            userDataKey,
+            userId,
+            "totpBackupCodes",
+          )
+        : backupCodesJson;
+
      await db
        .update(users)
        .set({
          totpEnabled: true,
-          totpBackupCodes: JSON.stringify(backupCodes),
+          totpBackupCodes: storedBackupCodes,
        })
        .where(eq(users.id, userId));

@@ -297,7 +362,12 @@ export function registerUserTotpRoutes(
        return res.status(400).json({ error: "TOTP is not enabled" });
      }

-      const verified = await verifyTotpReauth(userRecord, credential);
+      const userDataKey = authManager.getUserDataKey(userId);
+      const verified = await verifyTotpReauth(
+        userRecord,
+        credential,
+        userDataKey,
+      );
      if (!verified) {
        return res
          .status(401)
@@ -378,7 +448,12 @@ export function registerUserTotpRoutes(
        return res.status(400).json({ error: "TOTP is not enabled" });
      }

-      const verified = await verifyTotpReauth(userRecord, credential);
+      const userDataKey = authManager.getUserDataKey(userId);
+      const verified = await verifyTotpReauth(
+        userRecord,
+        credential,
+        userDataKey,
+      );
      if (!verified) {
        return res
          .status(401)
@@ -389,9 +464,19 @@ export function registerUserTotpRoutes(
        Math.random().toString(36).substring(2, 10).toUpperCase(),
      );

+      const backupCodesJson = JSON.stringify(backupCodes);
+      const storedBackupCodes = userDataKey
+        ? FieldCrypto.encryptField(
+            backupCodesJson,
+            userDataKey,
+            userId,
+            "totpBackupCodes",
+          )
+        : backupCodesJson;
+
      await db
        .update(users)
-        .set({ totpBackupCodes: JSON.stringify(backupCodes) })
+        .set({ totpBackupCodes: storedBackupCodes })
        .where(eq(users.id, userId));

      res.json({ backup_codes: backupCodes });
@@ -0,0 +1,514 @@
+import type { Request, RequestHandler, Router } from "express";
+import type {
+  AuthenticationResponseJSON,
+  RegistrationResponseJSON,
+  AuthenticatorTransportFuture,
+  Base64URLString,
+  WebAuthnCredential,
+} from "@simplewebauthn/server";
+import {
+  generateAuthenticationOptions,
+  generateRegistrationOptions,
+  verifyAuthenticationResponse,
+  verifyRegistrationResponse,
+} from "@simplewebauthn/server";
+import { and, eq } from "drizzle-orm";
+import { nanoid } from "nanoid";
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import { authLogger } from "../../utils/logger.js";
+import {
+  generateDeviceFingerprint,
+  parseUserAgent,
+} from "../../utils/user-agent-parser.js";
+import { db, saveMemoryDatabaseToFile } from "../db/index.js";
+import { users, webauthnCredentials } from "../db/schema.js";
+
+type UserVerification = "discouraged" | "preferred" | "required";
+type NativeAppRequestChecker = (req: Request) => boolean;
+
+interface WebAuthnRoutesDeps {
+  authenticateJWT: RequestHandler;
+  authManager: AuthManager;
+  isNativeAppRequest: NativeAppRequestChecker;
+}
+
+interface ChallengeRecord {
+  challenge: string;
+  userId?: string;
+  rpID: string;
+  origin: string;
+  userVerification: UserVerification;
+  createdAt: number;
+}
+
+const challengeTtlMs = 5 * 60 * 1000;
+const registrationChallenges = new Map<string, ChallengeRecord>();
+const authenticationChallenges = new Map<string, ChallengeRecord>();
+
+function normalizeUserVerification(value: unknown): UserVerification {
+  return value === "discouraged" || value === "required" ? value : "preferred";
+}
+
+function getRequestOrigin(req: Request): string {
+  const origin = req.get("origin");
+  if (origin) return origin;
+
+  const proto = req.get("x-forwarded-proto") || req.protocol || "http";
+  const host = req.get("x-forwarded-host") || req.get("host") || "localhost";
+  return `${proto.split(",")[0]}://${host.split(",")[0]}`;
+}
+
+function getRpID(origin: string): string {
+  return new URL(origin).hostname;
+}
+
+function pruneChallenges(map: Map<string, ChallengeRecord>): void {
+  const now = Date.now();
+  for (const [id, record] of map) {
+    if (now - record.createdAt > challengeTtlMs) {
+      map.delete(id);
+    }
+  }
+}
+
+function putChallenge(
+  map: Map<string, ChallengeRecord>,
+  record: Omit<ChallengeRecord, "createdAt">,
+): string {
+  pruneChallenges(map);
+  const challengeId = nanoid();
+  map.set(challengeId, { ...record, createdAt: Date.now() });
+  return challengeId;
+}
+
+function takeChallenge(
+  map: Map<string, ChallengeRecord>,
+  challengeId: unknown,
+): ChallengeRecord | null {
+  if (typeof challengeId !== "string") return null;
+  pruneChallenges(map);
+  const record = map.get(challengeId);
+  if (!record) return null;
+  map.delete(challengeId);
+  return record;
+}
+
+function toBase64Url(value: Uint8Array): string {
+  return Buffer.from(value).toString("base64url");
+}
+
+function fromBase64Url(value: string): Uint8Array {
+  return Uint8Array.from(Buffer.from(value, "base64url"));
+}
+
+function parseTransports(value: string | null): AuthenticatorTransportFuture[] {
+  if (!value) return [];
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+
+function getCredentialForVerification(
+  credential: typeof webauthnCredentials.$inferSelect,
+): WebAuthnCredential {
+  return {
+    id: credential.credentialId as Base64URLString,
+    publicKey: fromBase64Url(
+      credential.publicKey,
+    ) as WebAuthnCredential["publicKey"],
+    counter: credential.counter,
+    transports: parseTransports(credential.transports),
+  };
+}
+
+export function registerUserWebAuthnRoutes(
+  router: Router,
+  { authenticateJWT, authManager, isNativeAppRequest }: WebAuthnRoutesDeps,
+): void {
+  router.get("/webauthn/credentials", authenticateJWT, async (req, res) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    if (!userId) {
+      return res.status(401).json({ error: "Authentication required" });
+    }
+
+    const credentials = await db
+      .select()
+      .from(webauthnCredentials)
+      .where(eq(webauthnCredentials.userId, userId));
+
+    res.json({
+      credentials: credentials.map((credential) => ({
+        id: credential.id,
+        name: credential.name,
+        deviceType: credential.deviceType,
+        backedUp: credential.backedUp,
+        transports: parseTransports(credential.transports),
+        userVerification: credential.userVerification,
+        createdAt: credential.createdAt,
+        lastUsedAt: credential.lastUsedAt,
+      })),
+    });
+  });
+
+  router.post(
+    "/webauthn/register/options",
+    authenticateJWT,
+    async (req, res) => {
+      const userId = (req as AuthenticatedRequest).userId;
+      if (!userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      if (!authManager.getUserDataKey(userId)) {
+        return res.status(401).json({
+          error: "User data is locked. Log in again before adding a passkey.",
+        });
+      }
+
+      const user = await db.select().from(users).where(eq(users.id, userId));
+      if (!user.length) {
+        return res.status(404).json({ error: "User not found" });
+      }
+
+      const existing = await db
+        .select()
+        .from(webauthnCredentials)
+        .where(eq(webauthnCredentials.userId, userId));
+
+      const origin = getRequestOrigin(req);
+      const rpID = getRpID(origin);
+      const userVerification = normalizeUserVerification(
+        req.body?.userVerification,
+      );
+
+      const options = await generateRegistrationOptions({
+        rpName: "Termix",
+        rpID,
+        userID: Buffer.from(userId, "utf8"),
+        userName: user[0].username,
+        userDisplayName: user[0].username,
+        attestationType: "none",
+        excludeCredentials: existing.map((credential) => ({
+          id: credential.credentialId as Base64URLString,
+          transports: parseTransports(credential.transports),
+        })),
+        authenticatorSelection: {
+          residentKey: "required",
+          userVerification,
+        },
+      });
+
+      const challengeId = putChallenge(registrationChallenges, {
+        challenge: options.challenge,
+        userId,
+        rpID,
+        origin,
+        userVerification,
+      });
+
+      res.json({ options, challengeId });
+    },
+  );
+
+  router.post(
+    "/webauthn/register/verify",
+    authenticateJWT,
+    async (req, res) => {
+      const userId = (req as AuthenticatedRequest).userId;
+      if (!userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      const challenge = takeChallenge(
+        registrationChallenges,
+        req.body?.challengeId,
+      );
+      if (!challenge || challenge.userId !== userId) {
+        return res
+          .status(400)
+          .json({ error: "Registration challenge expired" });
+      }
+
+      try {
+        const verification = await verifyRegistrationResponse({
+          response: req.body?.response as RegistrationResponseJSON,
+          expectedChallenge: challenge.challenge,
+          expectedOrigin: challenge.origin,
+          expectedRPID: challenge.rpID,
+          requireUserVerification: challenge.userVerification === "required",
+        });
+
+        if (!verification.verified) {
+          return res.status(400).json({ error: "Passkey registration failed" });
+        }
+
+        const { credential, credentialDeviceType, credentialBackedUp } =
+          verification.registrationInfo;
+        const transports =
+          (req.body?.response as RegistrationResponseJSON | undefined)?.response
+            ?.transports ?? [];
+
+        await authManager.setupWebAuthnUserEncryption(userId);
+
+        const name =
+          typeof req.body?.name === "string" && req.body.name.trim()
+            ? req.body.name.trim().slice(0, 80)
+            : "Passkey";
+
+        await db.insert(webauthnCredentials).values({
+          id: nanoid(),
+          userId,
+          name,
+          credentialId: credential.id,
+          publicKey: toBase64Url(credential.publicKey),
+          counter: credential.counter,
+          deviceType: credentialDeviceType,
+          backedUp: credentialBackedUp,
+          transports: JSON.stringify(transports),
+          userVerification: challenge.userVerification,
+          createdAt: new Date().toISOString(),
+        });
+
+        await saveMemoryDatabaseToFile();
+        res.json({ success: true });
+      } catch (error) {
+        authLogger.warn("WebAuthn registration failed", {
+          operation: "webauthn_register_verify",
+          userId,
+          error: error instanceof Error ? error.message : "Unknown",
+        });
+        res.status(400).json({ error: "Passkey registration failed" });
+      }
+    },
+  );
+
+  router.post("/webauthn/authenticate/options", async (req, res) => {
+    const origin = getRequestOrigin(req);
+    const rpID = getRpID(origin);
+    const userVerification = normalizeUserVerification(
+      req.body?.userVerification,
+    );
+    const username =
+      typeof req.body?.username === "string" ? req.body.username.trim() : "";
+
+    let userId: string | undefined;
+    let allowCredentials:
+      | { id: Base64URLString; transports?: AuthenticatorTransportFuture[] }[]
+      | undefined;
+
+    if (username) {
+      const user = await db
+        .select()
+        .from(users)
+        .where(eq(users.username, username));
+      if (!user.length) {
+        return res.status(404).json({ error: "No passkeys found" });
+      }
+
+      userId = user[0].id;
+      const credentials = await db
+        .select()
+        .from(webauthnCredentials)
+        .where(eq(webauthnCredentials.userId, userId));
+
+      if (!credentials.length) {
+        return res.status(404).json({ error: "No passkeys found" });
+      }
+
+      allowCredentials = credentials.map((credential) => ({
+        id: credential.credentialId as Base64URLString,
+        transports: parseTransports(credential.transports),
+      }));
+    }
+
+    const options = await generateAuthenticationOptions({
+      rpID,
+      allowCredentials,
+      userVerification,
+    });
+
+    const challengeId = putChallenge(authenticationChallenges, {
+      challenge: options.challenge,
+      userId,
+      rpID,
+      origin,
+      userVerification,
+    });
+
+    res.json({ options, challengeId });
+  });
+
+  router.post("/webauthn/authenticate/verify", async (req, res) => {
+    const challenge = takeChallenge(
+      authenticationChallenges,
+      req.body?.challengeId,
+    );
+    if (!challenge) {
+      return res
+        .status(400)
+        .json({ error: "Authentication challenge expired" });
+    }
+
+    const response = req.body?.response as
+      | AuthenticationResponseJSON
+      | undefined;
+    if (!response?.id) {
+      return res.status(400).json({ error: "Invalid passkey response" });
+    }
+
+    const credentials = await db
+      .select()
+      .from(webauthnCredentials)
+      .where(eq(webauthnCredentials.credentialId, response.id));
+
+    if (!credentials.length) {
+      return res.status(401).json({ error: "Passkey not recognized" });
+    }
+
+    const credential = credentials[0];
+    if (challenge.userId && challenge.userId !== credential.userId) {
+      return res.status(401).json({ error: "Passkey not recognized" });
+    }
+
+    try {
+      const verification = await verifyAuthenticationResponse({
+        response,
+        expectedChallenge: challenge.challenge,
+        expectedOrigin: challenge.origin,
+        expectedRPID: challenge.rpID,
+        credential: getCredentialForVerification(credential),
+        requireUserVerification: challenge.userVerification === "required",
+        advancedFIDOConfig: {
+          userVerification: challenge.userVerification,
+        },
+      });
+
+      if (!verification.verified) {
+        return res.status(401).json({ error: "Passkey authentication failed" });
+      }
+
+      const user = await db
+        .select()
+        .from(users)
+        .where(eq(users.id, credential.userId));
+      if (!user.length) {
+        return res.status(404).json({ error: "User not found" });
+      }
+
+      const userRecord = user[0];
+      const deviceInfo = parseUserAgent(req);
+      const dataUnlocked = await authManager.authenticateWebAuthnUser(
+        userRecord.id,
+        deviceInfo.type,
+      );
+
+      if (!dataUnlocked) {
+        return res.status(401).json({
+          error:
+            "Passkey cannot unlock this account. Log in with password and register the passkey again.",
+        });
+      }
+
+      await db
+        .update(webauthnCredentials)
+        .set({
+          counter: verification.authenticationInfo.newCounter,
+          backedUp: verification.authenticationInfo.credentialBackedUp,
+          deviceType: verification.authenticationInfo.credentialDeviceType,
+          lastUsedAt: new Date().toISOString(),
+        })
+        .where(eq(webauthnCredentials.id, credential.id));
+
+      if (userRecord.totpEnabled) {
+        const deviceFingerprint = generateDeviceFingerprint(deviceInfo);
+        const isTrusted = await authManager.isTrustedDevice(
+          userRecord.id,
+          deviceFingerprint,
+        );
+
+        if (!isTrusted) {
+          await saveMemoryDatabaseToFile();
+          const tempToken = await authManager.generateJWTToken(userRecord.id, {
+            pendingTOTP: true,
+            expiresIn: "10m",
+          });
+          return res.json({
+            success: true,
+            requires_totp: true,
+            temp_token: tempToken,
+            rememberMe: !!req.body?.rememberMe,
+          });
+        }
+      }
+
+      const token = await authManager.generateJWTToken(userRecord.id, {
+        rememberMe: !!req.body?.rememberMe,
+        deviceType: deviceInfo.type,
+        deviceInfo: deviceInfo.deviceInfo,
+      });
+
+      await saveMemoryDatabaseToFile();
+
+      const timeoutRow = db.$client
+        .prepare(
+          "SELECT value FROM settings WHERE key = 'session_timeout_hours'",
+        )
+        .get() as { value: string } | undefined;
+      const timeoutHours = timeoutRow
+        ? parseInt(timeoutRow.value, 10) || 24
+        : 24;
+      const maxAge = req.body?.rememberMe
+        ? 30 * 24 * 60 * 60 * 1000
+        : timeoutHours * 60 * 60 * 1000;
+
+      res.cookie("jwt", token, authManager.getSecureCookieOptions(req, maxAge));
+      res.json({
+        success: true,
+        is_admin: !!userRecord.isAdmin,
+        username: userRecord.username,
+        userId: userRecord.id,
+        is_oidc: !!userRecord.isOidc,
+        totp_enabled: !!userRecord.totpEnabled,
+        data_unlocked: true,
+        ...(isNativeAppRequest(req) ? { token } : {}),
+      });
+    } catch (error) {
+      authLogger.warn("WebAuthn authentication failed", {
+        operation: "webauthn_auth_verify",
+        credentialId: credential.id,
+        userId: credential.userId,
+        error: error instanceof Error ? error.message : "Unknown",
+      });
+      res.status(401).json({ error: "Passkey authentication failed" });
+    }
+  });
+
+  router.delete(
+    "/webauthn/credentials/:credentialId",
+    authenticateJWT,
+    async (req, res) => {
+      const userId = (req as AuthenticatedRequest).userId;
+      if (!userId) {
+        return res.status(401).json({ error: "Authentication required" });
+      }
+
+      const credentialId = String(req.params.credentialId);
+
+      await db
+        .delete(webauthnCredentials)
+        .where(
+          and(
+            eq(webauthnCredentials.id, credentialId),
+            eq(webauthnCredentials.userId, userId),
+          ),
+        );
+      await saveMemoryDatabaseToFile();
+
+      res.json({ success: true });
+    },
+  );
+}
@@ -2,7 +2,7 @@ import type { AuthenticatedRequest } from "../../../types/index.js";
 import express from "express";
 import { db } from "../db/index.js";
 import { users, settings, roles, userRoles } from "../db/schema.js";
-import { eq } from "drizzle-orm";
+import { eq, and } from "drizzle-orm";
 import bcrypt from "bcryptjs";
 import { nanoid } from "nanoid";
 import type { Request, Response } from "express";
@@ -14,7 +14,10 @@ import {
  generateDeviceFingerprint,
 } from "../../utils/user-agent-parser.js";
 import { loginRateLimiter } from "../../utils/login-rate-limiter.js";
-import { getRequestOriginWithForceHTTPS } from "../../utils/request-origin.js";
+import {
+  getRequestBasePath,
+  getRequestBaseUrlWithForceHTTPS,
+} from "../../utils/request-origin.js";
 import { deleteUserAndRelatedData } from "./delete-user-data.js";
 import {
  getOIDCConfigFromEnv,
@@ -22,15 +25,18 @@ import {
  verifyOIDCToken,
  extractOidcGroups,
  loadProviderConfig,
+  buildFetchOptions,
 } from "./user-oidc-utils.js";
 import { registerUserApiKeyRoutes } from "./user-api-key-routes.js";
 import { registerUserSettingsRoutes } from "./user-settings-routes.js";
+import { registerAcmeSSLRoutes } from "./acme-ssl-routes.js";
 import { registerUserTotpRoutes } from "./user-totp-routes.js";
 import { registerUserSessionRoutes } from "./user-session-routes.js";
 import { registerUserOidcAccountRoutes } from "./user-oidc-account-routes.js";
 import { registerUserPasswordResetRoutes } from "./user-password-reset-routes.js";
 import { registerUserAdminRoutes } from "./user-admin-routes.js";
 import { registerUserDataAccessRoutes } from "./user-data-access-routes.js";
+import { registerUserWebAuthnRoutes } from "./user-webauthn-routes.js";
 import { registerSSOProviderRoutes } from "./sso-provider-routes.js";
 import { registerLDAPAuthRoutes } from "./ldap-auth-routes.js";
 import { logAudit, getRequestMeta } from "../../utils/audit-logger.js";
@@ -39,10 +45,68 @@ const authManager = AuthManager.getInstance();

 const router = express.Router();

+async function syncSharedCredentialsForUserRoles(
+  userId: string,
+  operation: string,
+) {
+  try {
+    const { SharedCredentialManager } =
+      await import("../../utils/shared-credential-manager.js");
+    const sharedCredManager = SharedCredentialManager.getInstance();
+    await sharedCredManager.createSharedCredentialsForUserRoles(userId);
+    await sharedCredManager.reEncryptPendingCredentialsForUser(userId);
+  } catch (error) {
+    authLogger.warn("Failed to sync role shared credentials", {
+      operation,
+      userId,
+      error,
+    });
+  }
+}
+
 function isNonEmptyString(val: unknown): val is string {
  return typeof val === "string" && val.trim().length > 0;
 }

+function isRegistrationAllowed(): boolean {
+  const envVal = process.env.ALLOW_REGISTRATION;
+  if (envVal !== undefined) return envVal.trim().toLowerCase() === "true";
+  try {
+    const row = db.$client
+      .prepare("SELECT value FROM settings WHERE key = 'allow_registration'")
+      .get() as { value: string } | undefined;
+    return row ? row.value === "true" : true;
+  } catch {
+    return true;
+  }
+}
+
+function isPasswordLoginAllowed(): boolean {
+  const envVal = process.env.ALLOW_PASSWORD_LOGIN;
+  if (envVal !== undefined) return envVal.trim().toLowerCase() === "true";
+  try {
+    const row = db.$client
+      .prepare("SELECT value FROM settings WHERE key = 'allow_password_login'")
+      .get() as { value: string } | undefined;
+    return row ? row.value === "true" : true;
+  } catch {
+    return true;
+  }
+}
+
+function isPasswordResetAllowed(): boolean {
+  const envVal = process.env.ALLOW_PASSWORD_RESET;
+  if (envVal !== undefined) return envVal.trim().toLowerCase() === "true";
+  try {
+    const row = db.$client
+      .prepare("SELECT value FROM settings WHERE key = 'allow_password_reset'")
+      .get() as { value: string } | undefined;
+    return row ? row.value === "true" : true;
+  } catch {
+    return true;
+  }
+}
+
 function isNativeAppRequest(req: Request): boolean {
  return (
    (req.get("User-Agent") || "").startsWith("Termix-Mobile/") ||
@@ -85,20 +149,10 @@ const requireAdmin = authManager.createAdminMiddleware();
 *         description: Failed to create user.
 */
 router.post("/create", async (req, res) => {
-  try {
-    const row = db.$client
-      .prepare("SELECT value FROM settings WHERE key = 'allow_registration'")
-      .get();
-    if (row && (row as Record<string, unknown>).value !== "true") {
-      return res
-        .status(403)
-        .json({ error: "Registration is currently disabled" });
-    }
-  } catch (e) {
-    authLogger.warn("Failed to check registration status", {
-      operation: "registration_check",
-      error: e,
-    });
+  if (!isRegistrationAllowed()) {
+    return res
+      .status(403)
+      .json({ error: "Registration is currently disabled" });
  }

  const { username, password } = req.body;
@@ -135,8 +189,7 @@ router.post("/create", async (req, res) => {
      return res.status(409).json({ error: "Username already exists" });
    }

-    const saltRounds = parseInt(process.env.SALT || "10", 10);
-    const password_hash = await bcrypt.hash(password, saltRounds);
+    const password_hash = await bcrypt.hash(password, 10);
    const id = nanoid();

    const isFirstUser = db.$client.transaction(() => {
@@ -580,8 +633,8 @@ router.get("/oidc/authorize", async (req, res) => {
      appCallbackUrl,
      providerId: providerIdStr,
    } = req.query;
-    const origin = getRequestOriginWithForceHTTPS(req);
-    const backendCallbackUri = `${origin}/users/oidc/callback`;
+    const publicBaseUrl = getRequestBaseUrlWithForceHTTPS(req);
+    const backendCallbackUri = `${publicBaseUrl}/users/oidc/callback`;

    const resolvedProviderId = providerIdStr
      ? parseInt(providerIdStr as string, 10)
@@ -613,9 +666,9 @@ router.get("/oidc/authorize", async (req, res) => {
      frontendOrigin = callbackUrl.toString();
    } else if (referer) {
      const refererUrl = new URL(referer);
-      frontendOrigin = `${refererUrl.protocol}//${refererUrl.host}`;
+      frontendOrigin = `${refererUrl.protocol}//${refererUrl.host}${getRequestBasePath(req)}`;
    } else {
-      frontendOrigin = origin;
+      frontendOrigin = publicBaseUrl;
    }

    db.$client
@@ -737,6 +790,9 @@ router.get("/oidc/callback", async (req, res) => {
        .run(`oidc_provider_${state}`);
    }

+    const caCert = config.ca_cert;
+    const fetchOptions = buildFetchOptions(caCert);
+
    // GitHub does not issue OIDC id_tokens; handle its token exchange separately
    if (callbackProviderType === "github") {
      const ghTokenResponse = await fetch(config.token_url, {
@@ -752,6 +808,7 @@ router.get("/oidc/callback", async (req, res) => {
          code: code,
          redirect_uri: backendCallbackUri,
        }),
+        ...fetchOptions,
      });

      if (!ghTokenResponse.ok) {
@@ -789,6 +846,7 @@ router.get("/oidc/callback", async (req, res) => {
          Accept: "application/json",
          "User-Agent": "Termix",
        },
+        ...fetchOptions,
      });
      if (!ghUserInfoResponse.ok) {
        return res
@@ -859,16 +917,9 @@ router.get("/oidc/callback", async (req, res) => {
            "true";

        if (!isFirstUser && !ghAutoProvision) {
-          const regRow = db.$client
-            .prepare(
-              "SELECT value FROM settings WHERE key = 'allow_registration'",
-            )
-            .get() as { value: string } | undefined;
-          if (regRow && regRow.value !== "true") {
-            const redirectUrl = new URL(frontendOrigin);
-            redirectUrl.searchParams.set("error", "registration_disabled");
-            return res.redirect(redirectUrl.toString());
-          }
+          const redirectUrl = new URL(frontendOrigin);
+          redirectUrl.searchParams.set("error", "registration_disabled");
+          return res.redirect(redirectUrl.toString());
        }

        const ghId = nanoid();
@@ -918,7 +969,7 @@ router.get("/oidc/callback", async (req, res) => {
              ? 30 * 24 * 60 * 60 * 1000
              : 24 * 60 * 60 * 1000;
          await authManager.registerOIDCUser(ghId, sessionDurationMs);
-        } catch (encryptionError) {
+        } catch {
          await db.delete(users).where(eq(users.id, ghId));
          return res.status(500).json({
            error: "Failed to setup user security - user creation cancelled",
@@ -937,6 +988,10 @@ router.get("/oidc/callback", async (req, res) => {
      } catch {
        /* */
      }
+      await syncSharedCredentialsForUserRoles(
+        ghUserRecord.id,
+        "github_oidc_role_shared_credentials",
+      );
      const ghToken = await authManager.generateJWTToken(ghUserRecord.id, {
        deviceType: deviceInfo.type,
        deviceInfo: deviceInfo.deviceInfo,
@@ -972,7 +1027,6 @@ router.get("/oidc/callback", async (req, res) => {
      headers: {
        "Content-Type": "application/x-www-form-urlencoded",
        Accept: "application/json",
-        Authorization: `Basic ${Buffer.from(`${encodeURIComponent(config.client_id)}:${encodeURIComponent(config.client_secret)}`).toString("base64")}`,
      },
      body: new URLSearchParams({
        grant_type: "authorization_code",
@@ -981,6 +1035,7 @@ router.get("/oidc/callback", async (req, res) => {
        code: code,
        redirect_uri: backendCallbackUri,
      }),
+      ...fetchOptions,
    });

    if (!tokenResponse.ok) {
@@ -1023,7 +1078,7 @@ router.get("/oidc/callback", async (req, res) => {

    try {
      const discoveryUrl = `${normalizedIssuerUrl}/.well-known/openid-configuration`;
-      const discoveryResponse = await fetch(discoveryUrl);
+      const discoveryResponse = await fetch(discoveryUrl, fetchOptions);
      if (discoveryResponse.ok) {
        const discovery = (await discoveryResponse.json()) as Record<
          string,
@@ -1058,6 +1113,7 @@ router.get("/oidc/callback", async (req, res) => {
          tokenData.id_token as string,
          config.issuer_url,
          config.client_id,
+          caCert,
        );
      } catch {
        try {
@@ -1081,6 +1137,7 @@ router.get("/oidc/callback", async (req, res) => {
            headers: {
              Authorization: `Bearer ${tokenData.access_token}`,
            },
+            ...fetchOptions,
          });

          if (userInfoResponse.ok) {
@@ -1190,33 +1247,17 @@ router.get("/oidc/callback", async (req, res) => {
      }

      if (!isFirstUser && !oidcAutoProvision) {
-        try {
-          const regRow = db.$client
-            .prepare(
-              "SELECT value FROM settings WHERE key = 'allow_registration'",
-            )
-            .get();
-          if (regRow && (regRow as Record<string, unknown>).value !== "true") {
-            authLogger.warn(
-              "OIDC user attempted to register when registration is disabled",
-              {
-                operation: "oidc_registration_disabled",
-                identifier,
-                name,
-              },
-            );
-
-            const redirectUrl = new URL(frontendOrigin);
-            redirectUrl.searchParams.set("error", "registration_disabled");
-
-            return res.redirect(redirectUrl.toString());
-          }
-        } catch (e) {
-          authLogger.warn("Failed to check registration status during OIDC", {
-            operation: "oidc_registration_check",
-            error: e,
-          });
-        }
+        authLogger.warn(
+          "OIDC user attempted to register but auto-provisioning is disabled",
+          {
+            operation: "oidc_registration_disabled",
+            identifier,
+            name,
+          },
+        );
+        const redirectUrl = new URL(frontendOrigin);
+        redirectUrl.searchParams.set("error", "registration_disabled");
+        return res.redirect(redirectUrl.toString());
      }

      const id = nanoid();
@@ -1367,6 +1408,39 @@ router.get("/oidc/callback", async (req, res) => {
          .set({ isAdmin: shouldBeAdmin })
          .where(eq(users.id, userRecord.id));
        userRecord.isAdmin = shouldBeAdmin;
+        try {
+          const newRoleName = shouldBeAdmin ? "admin" : "user";
+          const oldRoleName = shouldBeAdmin ? "user" : "admin";
+          const newRole = await db
+            .select({ id: roles.id })
+            .from(roles)
+            .where(eq(roles.name, newRoleName))
+            .limit(1);
+          const oldRole = await db
+            .select({ id: roles.id })
+            .from(roles)
+            .where(eq(roles.name, oldRoleName))
+            .limit(1);
+          if (oldRole.length > 0) {
+            await db
+              .delete(userRoles)
+              .where(
+                and(
+                  eq(userRoles.userId, userRecord.id),
+                  eq(userRoles.roleId, oldRole[0].id),
+                ),
+              );
+          }
+          if (newRole.length > 0) {
+            await db.insert(userRoles).values({
+              userId: userRecord.id,
+              roleId: newRole[0].id,
+              grantedBy: userRecord.id,
+            });
+          }
+        } catch {
+          /* non-fatal */
+        }
        authLogger.info("OIDC admin status synced", {
          operation: "oidc_admin_group_sync",
          userId: userRecord.id,
@@ -1385,14 +1459,10 @@ router.get("/oidc/callback", async (req, res) => {
      });
    }

-    try {
-      const { SharedCredentialManager } =
-        await import("../../utils/shared-credential-manager.js");
-      const sharedCredManager = SharedCredentialManager.getInstance();
-      await sharedCredManager.reEncryptPendingCredentialsForUser(userRecord.id);
-    } catch {
-      // expected - re-encryption may fail if no pending credentials
-    }
+    await syncSharedCredentialsForUserRoles(
+      userRecord.id,
+      "oidc_role_shared_credentials",
+    );

    const token = await authManager.generateJWTToken(userRecord.id, {
      deviceType: deviceInfo.type,
@@ -1504,21 +1574,10 @@ router.post("/login", async (req, res) => {
    });
  }

-  try {
-    const row = db.$client
-      .prepare("SELECT value FROM settings WHERE key = 'allow_password_login'")
-      .get();
-    if (row && (row as { value: string }).value !== "true") {
-      return res
-        .status(403)
-        .json({ error: "Password authentication is currently disabled" });
-    }
-  } catch (e) {
-    authLogger.error("Failed to check password login status", {
-      operation: "login_check",
-      error: e,
-    });
-    return res.status(500).json({ error: "Failed to check login status" });
+  if (!isPasswordLoginAllowed()) {
+    return res
+      .status(403)
+      .json({ error: "Password authentication is currently disabled" });
  }

  try {
@@ -1606,18 +1665,10 @@ router.post("/login", async (req, res) => {
      return res.status(401).json({ error: "Incorrect password" });
    }

-    try {
-      const { SharedCredentialManager } =
-        await import("../../utils/shared-credential-manager.js");
-      const sharedCredManager = SharedCredentialManager.getInstance();
-      await sharedCredManager.reEncryptPendingCredentialsForUser(userRecord.id);
-    } catch (error) {
-      authLogger.warn("Failed to re-encrypt pending shared credentials", {
-        operation: "reencrypt_pending_credentials",
-        userId: userRecord.id,
-        error,
-      });
-    }
+    await syncSharedCredentialsForUserRoles(
+      userRecord.id,
+      "login_role_shared_credentials",
+    );

    if (userRecord.totpEnabled) {
      const deviceFingerprint = generateDeviceFingerprint(deviceInfo);
@@ -1919,12 +1970,7 @@ router.get("/db-health", requireAdmin, async (req, res) => {
 */
 router.get("/registration-allowed", async (req, res) => {
  try {
-    const row = db.$client
-      .prepare("SELECT value FROM settings WHERE key = 'allow_registration'")
-      .get();
-    res.json({
-      allowed: row ? (row as Record<string, unknown>).value === "true" : true,
-    });
+    res.json({ allowed: isRegistrationAllowed() });
  } catch (err) {
    authLogger.error("Failed to get registration allowed", err);
    res.status(500).json({ error: "Failed to get registration allowed" });
@@ -2029,6 +2075,107 @@ router.patch("/oidc-auto-provision", authenticateJWT, async (req, res) => {
  }
 });

+/**
+ * @openapi
+ * /users/oidc-silent-login-default:
+ *   get:
+ *     summary: Get OIDC silent login default setting
+ *     description: Returns whether silent OIDC login is enabled as the default behavior.
+ *     tags:
+ *       - Users
+ *     responses:
+ *       200:
+ *         description: Silent login default setting.
+ *       500:
+ *         description: Failed to get setting.
+ */
+router.get("/oidc-silent-login-default", async (_req, res) => {
+  try {
+    const row = db.$client
+      .prepare(
+        "SELECT value FROM settings WHERE key = 'oidc_silent_login_default'",
+      )
+      .get();
+    res.json({
+      enabled: row ? (row as Record<string, unknown>).value === "true" : false,
+    });
+  } catch (err) {
+    authLogger.error("Failed to get OIDC silent login default", err);
+    res.status(500).json({ error: "Failed to get OIDC silent login default" });
+  }
+});
+
+/**
+ * @openapi
+ * /users/oidc-silent-login-default:
+ *   patch:
+ *     summary: Set OIDC silent login default setting
+ *     description: Enables or disables silent OIDC login as the default behavior on the login page.
+ *     tags:
+ *       - Users
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             properties:
+ *               enabled:
+ *                 type: boolean
+ *     responses:
+ *       200:
+ *         description: Setting updated.
+ *       400:
+ *         description: Invalid value.
+ *       403:
+ *         description: Not authorized.
+ *       500:
+ *         description: Failed to update setting.
+ */
+router.patch(
+  "/oidc-silent-login-default",
+  authenticateJWT,
+  async (req, res) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    try {
+      const user = await db.select().from(users).where(eq(users.id, userId));
+      if (!user || user.length === 0 || !user[0].isAdmin) {
+        return res.status(403).json({ error: "Not authorized" });
+      }
+      const { enabled } = req.body;
+      if (typeof enabled !== "boolean") {
+        return res.status(400).json({ error: "Invalid value for enabled" });
+      }
+      const existing = db.$client
+        .prepare(
+          "SELECT value FROM settings WHERE key = 'oidc_silent_login_default'",
+        )
+        .get();
+      if (existing) {
+        db.$client
+          .prepare(
+            "UPDATE settings SET value = ? WHERE key = 'oidc_silent_login_default'",
+          )
+          .run(enabled ? "true" : "false");
+      } else {
+        db.$client
+          .prepare(
+            "INSERT INTO settings (key, value) VALUES ('oidc_silent_login_default', ?)",
+          )
+          .run(enabled ? "true" : "false");
+      }
+      const { saveMemoryDatabaseToFile } = await import("../db/index.js");
+      await saveMemoryDatabaseToFile();
+      res.json({ enabled });
+    } catch (err) {
+      authLogger.error("Failed to set OIDC silent login default", err);
+      res
+        .status(500)
+        .json({ error: "Failed to set OIDC silent login default" });
+    }
+  },
+);
+
 /**
 * @openapi
 * /users/password-login-allowed:
@@ -2045,12 +2192,7 @@ router.patch("/oidc-auto-provision", authenticateJWT, async (req, res) => {
 */
 router.get("/password-login-allowed", async (req, res) => {
  try {
-    const row = db.$client
-      .prepare("SELECT value FROM settings WHERE key = 'allow_password_login'")
-      .get();
-    res.json({
-      allowed: row ? (row as { value: string }).value === "true" : true,
-    });
+    res.json({ allowed: isPasswordLoginAllowed() });
  } catch (err) {
    authLogger.error("Failed to get password login allowed", err);
    res.status(500).json({ error: "Failed to get password login allowed" });
@@ -2095,6 +2237,17 @@ router.patch("/password-login-allowed", authenticateJWT, async (req, res) => {
    if (typeof allowed !== "boolean") {
      return res.status(400).json({ error: "Invalid value for allowed" });
    }
+    if (!allowed) {
+      const totpRow = db.$client
+        .prepare("SELECT COUNT(*) as count FROM users WHERE totp_enabled = 1")
+        .get() as { count?: number };
+      if ((totpRow?.count || 0) > 0) {
+        return res.status(409).json({
+          error:
+            "Cannot disable password login while 2FA is enabled for one or more users. Disable 2FA first.",
+        });
+      }
+    }
    db.$client
      .prepare(
        "INSERT OR REPLACE INTO settings (key, value) VALUES ('allow_password_login', ?)",
@@ -2125,12 +2278,7 @@ router.patch("/password-login-allowed", authenticateJWT, async (req, res) => {
 */
 router.get("/password-reset-allowed", async (req, res) => {
  try {
-    const row = db.$client
-      .prepare("SELECT value FROM settings WHERE key = 'allow_password_reset'")
-      .get();
-    res.json({
-      allowed: row ? (row as { value: string }).value === "true" : true,
-    });
+    res.json({ allowed: isPasswordResetAllowed() });
  } catch (err) {
    authLogger.error("Failed to get password reset allowed", err);
    res.status(500).json({ error: "Failed to get password reset allowed" });
@@ -2347,8 +2495,7 @@ router.post("/change-password", authenticateJWT, async (req, res) => {
      .json({ error: "Failed to update password and re-encrypt data." });
  }

-  const saltRounds = parseInt(process.env.SALT || "10", 10);
-  const password_hash = await bcrypt.hash(newPassword, saltRounds);
+  const password_hash = await bcrypt.hash(newPassword, 10);
  await db
    .update(users)
    .set({ passwordHash: password_hash })
@@ -2388,6 +2535,12 @@ registerUserTotpRoutes(router, {
  isNativeAppRequest,
 });

+registerUserWebAuthnRoutes(router, {
+  authenticateJWT,
+  authManager,
+  isNativeAppRequest,
+});
+
 /**
 * @openapi
 * /users/delete-user:
@@ -2518,6 +2671,7 @@ registerUserOidcAccountRoutes(router, {
 });

 registerUserSettingsRoutes(router, authenticateJWT);
+registerAcmeSSLRoutes(router, authenticateJWT);

 registerUserApiKeyRoutes(router, requireAdmin);

@@ -0,0 +1,450 @@
+import express from "express";
+import type { Request, Response } from "express";
+import { desc, eq, or } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { users, vaultProfiles } from "../db/schema.js";
+import type { AuthenticatedRequest } from "../../../types/index.js";
+import { authLogger } from "../../utils/logger.js";
+import { AuthManager } from "../../utils/auth-manager.js";
+import { completeVaultAuth } from "../../ssh/vault-oidc-auth.js";
+
+const router = express.Router();
+
+const authManager = AuthManager.getInstance();
+const authenticateJWT = authManager.createAuthMiddleware();
+
+function isNonEmptyString(val: unknown): val is string {
+  return typeof val === "string" && val.trim().length > 0;
+}
+
+async function userIsAdmin(userId: string): Promise<boolean> {
+  try {
+    const rows = await db
+      .select({ isAdmin: users.isAdmin })
+      .from(users)
+      .where(eq(users.id, userId))
+      .limit(1);
+    return !!rows[0]?.isAdmin;
+  } catch {
+    return false;
+  }
+}
+
+function formatProfile(
+  row: Record<string, unknown>,
+  currentUserId: string,
+): Record<string, unknown> {
+  return {
+    id: row.id,
+    name: row.name,
+    description: row.description,
+    folder: row.folder,
+    tags:
+      typeof row.tags === "string"
+        ? row.tags
+          ? (row.tags as string).split(",").filter(Boolean)
+          : []
+        : [],
+    vaultAddr: row.vaultAddr,
+    vaultNamespace: row.vaultNamespace,
+    oidcMount: row.oidcMount,
+    oidcRole: row.oidcRole,
+    sshMount: row.sshMount,
+    sshRole: row.sshRole,
+    validPrincipals: row.validPrincipals,
+    keyType: row.keyType,
+    shared: !!row.shared,
+    owned: row.userId === currentUserId,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+  };
+}
+
+/**
+ * @openapi
+ * /vault/oidc/callback:
+ *   get:
+ *     summary: Vault OIDC callback
+ *     description: Unauthenticated endpoint the IdP redirects to after login. Correlates the authorization code to a pending session via the Vault-issued state parameter.
+ *     tags:
+ *       - Vault
+ *     parameters:
+ *       - in: query
+ *         name: state
+ *         required: true
+ *         schema:
+ *           type: string
+ *       - in: query
+ *         name: code
+ *         required: true
+ *         schema:
+ *           type: string
+ *       - in: query
+ *         name: error
+ *         schema:
+ *           type: string
+ *     responses:
+ *       200:
+ *         description: HTML page confirming sign-in success or failure.
+ *       400:
+ *         description: Missing parameters or authentication failure.
+ */
+router.get("/oidc/callback", async (req: Request, res: Response) => {
+  const state = String(req.query.state || "");
+  const code = String(req.query.code || "");
+  const oidcError = req.query.error ? String(req.query.error) : "";
+
+  const html = (title: string, message: string) =>
+    `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>body{font-family:system-ui,sans-serif;background:#0b0b0c;color:#e5e5e5;display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
+.card{max-width:420px;text-align:center;padding:24px;border:1px solid #2a2a2e;border-radius:8px}</style></head>
+<body><div class="card"><h2>${title}</h2><p>${message}</p>
+<script>setTimeout(function(){window.close()},1500)</script></div></body></html>`;
+
+  if (oidcError) {
+    return res
+      .status(400)
+      .send(html("Vault sign-in failed", `Vault returned: ${oidcError}`));
+  }
+  if (!state || !code) {
+    return res
+      .status(400)
+      .send(html("Vault sign-in failed", "Missing state or code."));
+  }
+
+  const result = await completeVaultAuth(state, code);
+  if (result.ok) {
+    return res.send(
+      html(
+        "Vault sign-in complete",
+        "You can close this window and return to Termix.",
+      ),
+    );
+  }
+  return res
+    .status(400)
+    .send(
+      html("Vault sign-in failed", result.error || "Authentication failed."),
+    );
+});
+
+/**
+ * @openapi
+ * /vault/profiles:
+ *   get:
+ *     summary: List Vault profiles
+ *     description: Returns all Vault signer profiles owned by the authenticated user or marked as shared.
+ *     tags:
+ *       - Vault
+ *     responses:
+ *       200:
+ *         description: Array of Vault profile objects.
+ *       500:
+ *         description: Failed to list vault profiles.
+ */
+router.get(
+  "/profiles",
+  authenticateJWT,
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    try {
+      const rows = await db
+        .select()
+        .from(vaultProfiles)
+        .where(
+          or(eq(vaultProfiles.userId, userId), eq(vaultProfiles.shared, true)),
+        )
+        .orderBy(desc(vaultProfiles.updatedAt));
+      res.json(
+        rows.map((r) => formatProfile(r as Record<string, unknown>, userId)),
+      );
+    } catch (err) {
+      authLogger.error("Failed to list vault profiles", err);
+      res.status(500).json({ error: "Failed to list vault profiles" });
+    }
+  },
+);
+
+/**
+ * @openapi
+ * /vault/profiles:
+ *   post:
+ *     summary: Create a Vault profile
+ *     description: Creates a new Vault signer profile owned by the authenticated user. The shared flag requires admin privileges.
+ *     tags:
+ *       - Vault
+ *     requestBody:
+ *       required: true
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *             required:
+ *               - name
+ *               - vaultAddr
+ *               - sshRole
+ *             properties:
+ *               name:
+ *                 type: string
+ *               vaultAddr:
+ *                 type: string
+ *               vaultNamespace:
+ *                 type: string
+ *               oidcMount:
+ *                 type: string
+ *               oidcRole:
+ *                 type: string
+ *               sshMount:
+ *                 type: string
+ *               sshRole:
+ *                 type: string
+ *               validPrincipals:
+ *                 type: string
+ *               keyType:
+ *                 type: string
+ *               shared:
+ *                 type: boolean
+ *     responses:
+ *       201:
+ *         description: Created Vault profile object.
+ *       400:
+ *         description: Missing required fields.
+ *       403:
+ *         description: Non-admin attempted to create a shared profile.
+ *       500:
+ *         description: Failed to create vault profile.
+ */
+router.post(
+  "/profiles",
+  authenticateJWT,
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    const {
+      name,
+      description,
+      folder,
+      tags,
+      vaultAddr,
+      vaultNamespace,
+      oidcMount,
+      oidcRole,
+      sshMount,
+      sshRole,
+      validPrincipals,
+      keyType,
+      shared,
+    } = req.body;
+
+    if (
+      !isNonEmptyString(name) ||
+      !isNonEmptyString(vaultAddr) ||
+      !isNonEmptyString(sshRole)
+    ) {
+      return res
+        .status(400)
+        .json({ error: "name, vaultAddr and sshRole are required" });
+    }
+
+    const wantShared = !!shared;
+    if (wantShared && !(await userIsAdmin(userId))) {
+      return res.status(403).json({
+        error: "Only administrators can create shared Vault profiles",
+      });
+    }
+
+    try {
+      const inserted = await db
+        .insert(vaultProfiles)
+        .values({
+          userId,
+          name: name.trim(),
+          description: description?.trim() || null,
+          folder: folder?.trim() || null,
+          tags: Array.isArray(tags) ? tags.join(",") : tags || "",
+          vaultAddr: vaultAddr.trim(),
+          vaultNamespace: vaultNamespace?.trim() || null,
+          oidcMount: oidcMount?.trim() || null,
+          oidcRole: oidcRole?.trim() || null,
+          sshMount: sshMount?.trim() || null,
+          sshRole: sshRole.trim(),
+          validPrincipals: validPrincipals?.trim() || null,
+          keyType: keyType?.trim() || null,
+          shared: wantShared,
+        })
+        .returning();
+      res
+        .status(201)
+        .json(formatProfile(inserted[0] as Record<string, unknown>, userId));
+    } catch (err) {
+      authLogger.error("Failed to create vault profile", err);
+      res.status(500).json({ error: "Failed to create vault profile" });
+    }
+  },
+);
+
+/**
+ * @openapi
+ * /vault/profiles/{id}:
+ *   put:
+ *     summary: Update a Vault profile
+ *     description: Updates a Vault signer profile. Only the owner may edit; toggling shared to true requires admin privileges.
+ *     tags:
+ *       - Vault
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     requestBody:
+ *       content:
+ *         application/json:
+ *           schema:
+ *             type: object
+ *     responses:
+ *       200:
+ *         description: Updated Vault profile object.
+ *       400:
+ *         description: Invalid profile id.
+ *       403:
+ *         description: Non-owner attempted to edit, or non-admin attempted to share.
+ *       404:
+ *         description: Profile not found.
+ *       500:
+ *         description: Failed to update vault profile.
+ */
+router.put(
+  "/profiles/:id",
+  authenticateJWT,
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    const id = parseInt(String(req.params.id), 10);
+    if (!Number.isFinite(id)) {
+      return res.status(400).json({ error: "Invalid profile id" });
+    }
+
+    try {
+      const existing = await db
+        .select()
+        .from(vaultProfiles)
+        .where(eq(vaultProfiles.id, id))
+        .limit(1);
+      if (!existing.length) {
+        return res.status(404).json({ error: "Profile not found" });
+      }
+      if (existing[0].userId !== userId) {
+        return res
+          .status(403)
+          .json({ error: "Only the owner can edit this profile" });
+      }
+
+      const body = req.body;
+      const fields: Record<string, unknown> = {
+        updatedAt: new Date().toISOString(),
+      };
+      if (body.name !== undefined) fields.name = body.name?.trim();
+      if (body.description !== undefined)
+        fields.description = body.description?.trim() || null;
+      if (body.folder !== undefined)
+        fields.folder = body.folder?.trim() || null;
+      if (body.tags !== undefined)
+        fields.tags = Array.isArray(body.tags)
+          ? body.tags.join(",")
+          : body.tags || "";
+      if (body.vaultAddr !== undefined && isNonEmptyString(body.vaultAddr))
+        fields.vaultAddr = body.vaultAddr.trim();
+      if (body.vaultNamespace !== undefined)
+        fields.vaultNamespace = body.vaultNamespace?.trim() || null;
+      if (body.oidcMount !== undefined)
+        fields.oidcMount = body.oidcMount?.trim() || null;
+      if (body.oidcRole !== undefined)
+        fields.oidcRole = body.oidcRole?.trim() || null;
+      if (body.sshMount !== undefined)
+        fields.sshMount = body.sshMount?.trim() || null;
+      if (body.sshRole !== undefined && isNonEmptyString(body.sshRole))
+        fields.sshRole = body.sshRole.trim();
+      if (body.validPrincipals !== undefined)
+        fields.validPrincipals = body.validPrincipals?.trim() || null;
+      if (body.keyType !== undefined)
+        fields.keyType = body.keyType?.trim() || null;
+      if (body.shared !== undefined) {
+        if (!!body.shared && !(await userIsAdmin(userId))) {
+          return res.status(403).json({
+            error: "Only administrators can share Vault profiles",
+          });
+        }
+        fields.shared = !!body.shared;
+      }
+
+      const updated = await db
+        .update(vaultProfiles)
+        .set(fields)
+        .where(eq(vaultProfiles.id, id))
+        .returning();
+      res.json(formatProfile(updated[0] as Record<string, unknown>, userId));
+    } catch (err) {
+      authLogger.error("Failed to update vault profile", err);
+      res.status(500).json({ error: "Failed to update vault profile" });
+    }
+  },
+);
+
+/**
+ * @openapi
+ * /vault/profiles/{id}:
+ *   delete:
+ *     summary: Delete a Vault profile
+ *     description: Permanently deletes a Vault signer profile. Only the owner may delete it.
+ *     tags:
+ *       - Vault
+ *     parameters:
+ *       - in: path
+ *         name: id
+ *         required: true
+ *         schema:
+ *           type: integer
+ *     responses:
+ *       200:
+ *         description: Deletion confirmed.
+ *       400:
+ *         description: Invalid profile id.
+ *       403:
+ *         description: Non-owner attempted to delete.
+ *       404:
+ *         description: Profile not found.
+ *       500:
+ *         description: Failed to delete vault profile.
+ */
+router.delete(
+  "/profiles/:id",
+  authenticateJWT,
+  async (req: Request, res: Response) => {
+    const userId = (req as AuthenticatedRequest).userId;
+    const id = parseInt(String(req.params.id), 10);
+    if (!Number.isFinite(id)) {
+      return res.status(400).json({ error: "Invalid profile id" });
+    }
+    try {
+      const existing = await db
+        .select()
+        .from(vaultProfiles)
+        .where(eq(vaultProfiles.id, id))
+        .limit(1);
+      if (!existing.length) {
+        return res.status(404).json({ error: "Profile not found" });
+      }
+      if (existing[0].userId !== userId) {
+        return res
+          .status(403)
+          .json({ error: "Only the owner can delete this profile" });
+      }
+      await db.delete(vaultProfiles).where(eq(vaultProfiles.id, id));
+      res.json({ success: true });
+    } catch (err) {
+      authLogger.error("Failed to delete vault profile", err);
+      res.status(500).json({ error: "Failed to delete vault profile" });
+    }
+  },
+);
+
+export default router;
@@ -2,34 +2,22 @@ import GuacamoleLite from "guacamole-lite";
 import { guacLogger } from "../utils/logger.js";
 import { GuacamoleTokenService } from "./token-service.js";
 import { getDb } from "../database/db/index.js";
+import { resolveGuacdOptions } from "../utils/guacd-config.js";

 const tokenService = GuacamoleTokenService.getInstance();

-function parseGuacUrl(url: string): { host: string; port: number } {
-  const parts = url.split(":");
-  return {
-    host: parts[0] || "localhost",
-    port: parseInt(parts[1] || "4822", 10),
-  };
-}
-
 function readGuacdOptions(): { host: string; port: number } {
-  let host = process.env.GUACD_HOST || "localhost";
-  let port = parseInt(process.env.GUACD_PORT || "4822", 10);
+  let dbUrl: string | undefined;
  try {
    const db = getDb();
    const urlRow = db.$client
      .prepare("SELECT value FROM settings WHERE key = 'guac_url'")
      .get() as { value: string } | undefined;
-    if (urlRow?.value) {
-      const parsed = parseGuacUrl(urlRow.value);
-      host = parsed.host;
-      port = parsed.port;
-    }
+    dbUrl = urlRow?.value;
  } catch {
    // DB not available yet, use env var defaults
  }
-  return { host, port };
+  return resolveGuacdOptions(dbUrl);
 }

 const GUAC_WS_PORT = 30008;
@@ -5,11 +5,12 @@ import { AuthManager } from "../utils/auth-manager.js";
 import { PermissionManager } from "../utils/permission-manager.js";
 import { SimpleDBOps } from "../utils/simple-db-ops.js";
 import { getDb } from "../database/db/index.js";
-import { hosts } from "../database/db/schema.js";
-import { eq } from "drizzle-orm";
+import { hosts, sshCredentials } from "../database/db/schema.js";
+import { eq, and } from "drizzle-orm";
 import { Client } from "ssh2";
 import net from "net";
 import type { AuthenticatedRequest } from "../../types/index.js";
+import { resolveGuacdOptions } from "../utils/guacd-config.js";

 const router = express.Router();
 const tokenService = GuacamoleTokenService.getInstance();
@@ -67,9 +68,15 @@ router.use(authManager.createAuthMiddleware());
 */
 router.post("/token", async (req, res) => {
  try {
-    const { type, hostname, port, username, password, domain, ...options } =
+    const { type, hostname, port, username, password, domain, ...rawOptions } =
      req.body;

+    // Strip "auto" sentinel values before forwarding to guacd
+    const options: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(rawOptions)) {
+      if (value !== "auto") options[key] = value;
+    }
+
    if (!type || !hostname) {
      return res
        .status(400)
@@ -261,12 +268,138 @@ router.post(
        }
      }

+      // Strip "auto" sentinel values — these mean "use guacd default" in the UI
+      // but guacd doesn't recognise "auto" as a valid parameter value.
+      for (const key of Object.keys(guacConfig)) {
+        if (guacConfig[key] === "auto") {
+          delete guacConfig[key];
+        }
+      }
+
+      // Extract per-connection guacd proxy settings before passing the rest as connection settings
+      const perConnectionGuacdHost = guacConfig["guacd-hostname"] as
+        | string
+        | undefined;
+      const perConnectionGuacdPortRaw = guacConfig["guacd-port"];
+      const perConnectionGuacdPort = perConnectionGuacdPortRaw
+        ? parseInt(String(perConnectionGuacdPortRaw), 10) || undefined
+        : undefined;
+      delete guacConfig["guacd-hostname"];
+      delete guacConfig["guacd-port"];
+
      if (guacConfig.dpi != null) {
        const parsed = parseInt(String(guacConfig.dpi), 10);
        guacConfig.dpi =
          Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
      }

+      const hostRecord = host as Record<string, unknown>;
+
+      // Backward compat: if authType is not stored but a credentialId is, treat as credential mode
+      const rdpEffectiveAuthType =
+        (host.rdpAuthType as string) ||
+        (host.rdpCredentialId ? "credential" : "direct");
+      const vncEffectiveAuthType =
+        (host.vncAuthType as string) ||
+        (host.vncCredentialId ? "credential" : "direct");
+      const telnetEffectiveAuthType =
+        (host.telnetAuthType as string) ||
+        (hostRecord.telnetCredentialId ? "credential" : "direct");
+
+      if (rdpEffectiveAuthType === "credential" && host.rdpCredentialId) {
+        try {
+          const rdpCreds = await SimpleDBOps.select(
+            getDb()
+              .select()
+              .from(sshCredentials)
+              .where(
+                and(
+                  eq(sshCredentials.id, host.rdpCredentialId as number),
+                  eq(sshCredentials.userId, host.userId as string),
+                ),
+              ),
+            "ssh_credentials",
+            userId,
+          );
+          if (rdpCreds.length > 0) {
+            const cred = rdpCreds[0] as Record<string, unknown>;
+            if (cred.username) host.rdpUser = cred.username;
+            if (cred.password) host.rdpPassword = cred.password;
+            // domain is never sourced from credential
+          }
+        } catch (e) {
+          guacLogger.warn("Failed to resolve RDP credential", {
+            operation: "guac_rdp_credential_resolve",
+            hostId,
+            error: e instanceof Error ? e.message : "Unknown",
+          });
+        }
+      }
+
+      if (vncEffectiveAuthType === "credential" && host.vncCredentialId) {
+        try {
+          const vncCreds = await SimpleDBOps.select(
+            getDb()
+              .select()
+              .from(sshCredentials)
+              .where(
+                and(
+                  eq(sshCredentials.id, host.vncCredentialId as number),
+                  eq(sshCredentials.userId, host.userId as string),
+                ),
+              ),
+            "ssh_credentials",
+            userId,
+          );
+          if (vncCreds.length > 0) {
+            const cred = vncCreds[0] as Record<string, unknown>;
+            if (cred.password) host.vncPassword = cred.password;
+            if (cred.username) host.vncUser = cred.username;
+          }
+        } catch (e) {
+          guacLogger.warn("Failed to resolve VNC credential", {
+            operation: "guac_vnc_credential_resolve",
+            hostId,
+            error: e instanceof Error ? e.message : "Unknown",
+          });
+        }
+      }
+
+      if (
+        telnetEffectiveAuthType === "credential" &&
+        hostRecord.telnetCredentialId
+      ) {
+        try {
+          const telnetCreds = await SimpleDBOps.select(
+            getDb()
+              .select()
+              .from(sshCredentials)
+              .where(
+                and(
+                  eq(
+                    sshCredentials.id,
+                    hostRecord.telnetCredentialId as number,
+                  ),
+                  eq(sshCredentials.userId, host.userId as string),
+                ),
+              ),
+            "ssh_credentials",
+            userId,
+          );
+          if (telnetCreds.length > 0) {
+            const cred = telnetCreds[0] as Record<string, unknown>;
+            if (cred.username) host.telnetUser = cred.username;
+            if (cred.password) host.telnetPassword = cred.password;
+          }
+        } catch (e) {
+          guacLogger.warn("Failed to resolve Telnet credential", {
+            operation: "guac_telnet_credential_resolve",
+            hostId,
+            error: e instanceof Error ? e.message : "Unknown",
+          });
+        }
+      }
+
      let token: string;
      let hostname = host.ip as string;
      let port = host.port as number;
@@ -385,6 +518,15 @@ router.post(
        }
      }

+      const guacdOverrides = {
+        ...(perConnectionGuacdHost
+          ? { guacdHost: perConnectionGuacdHost }
+          : {}),
+        ...(perConnectionGuacdPort
+          ? { guacdPort: perConnectionGuacdPort }
+          : {}),
+      };
+
      switch (connectionType) {
        case "rdp":
          if (guacConfig["enable-drive"] && !guacConfig["drive-path"]) {
@@ -405,6 +547,7 @@ router.post(
                  ? !!host.ignoreCert
                  : true,
            ...guacConfig,
+            ...guacdOverrides,
          });
          break;
        case "vnc":
@@ -416,6 +559,7 @@ router.post(
              port,
              security: "any",
              ...guacConfig,
+              ...guacdOverrides,
            },
          );
          break;
@@ -423,6 +567,7 @@ router.post(
          token = tokenService.createTelnetToken(hostname, username, password, {
            port,
            ...guacConfig,
+            ...guacdOverrides,
          });
          break;
        default:
@@ -445,21 +590,17 @@ router.post(
 */
 router.get("/status", async (req, res) => {
  try {
-    let guacdHost = process.env.GUACD_HOST || "localhost";
-    let guacdPort = parseInt(process.env.GUACD_PORT || "4822", 10);
+    let dbUrl: string | undefined;
    try {
      const db = getDb();
      const urlRow = db.$client
        .prepare("SELECT value FROM settings WHERE key = 'guac_url'")
        .get() as { value: string } | undefined;
-      if (urlRow?.value) {
-        const parts = urlRow.value.split(":");
-        guacdHost = parts[0] || guacdHost;
-        guacdPort = parseInt(parts[1] || String(guacdPort), 10);
-      }
+      dbUrl = urlRow?.value;
    } catch {
      // Fall back to env vars
    }
+    const { host: guacdHost, port: guacdPort } = resolveGuacdOptions(dbUrl);

    const net = await import("net");

@@ -0,0 +1,48 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../utils/logger.js", () => ({
+  guacLogger: {
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+  },
+}));
+
+const { GuacamoleTokenService } = await import("./token-service.js");
+
+describe("GuacamoleTokenService", () => {
+  const tokenService = GuacamoleTokenService.getInstance();
+
+  it("disables RDP pre-authentication when no credentials are configured", () => {
+    const token = tokenService.createRdpToken("windows.example.test", "", "");
+    const decrypted = tokenService.decryptToken(token);
+
+    expect(decrypted?.connection.settings).toMatchObject({
+      hostname: "windows.example.test",
+      port: 3389,
+      "ignore-cert": true,
+      "disable-auth": true,
+    });
+    expect(decrypted?.connection.settings.username).toBeUndefined();
+    expect(decrypted?.connection.settings.password).toBeUndefined();
+  });
+
+  it("keeps normal RDP credential authentication unchanged", () => {
+    const token = tokenService.createRdpToken(
+      "windows.example.test",
+      "Administrator",
+      "secret",
+    );
+    const decrypted = tokenService.decryptToken(token);
+
+    expect(decrypted?.connection.settings).toMatchObject({
+      hostname: "windows.example.test",
+      username: "Administrator",
+      password: "secret",
+      port: 3389,
+    });
+    expect(decrypted?.connection.settings["disable-auth"]).toBeUndefined();
+  });
+});
@@ -3,6 +3,8 @@ import { guacLogger } from "../utils/logger.js";

 export interface GuacamoleConnectionSettings {
  type: "rdp" | "vnc" | "telnet";
+  guacdHost?: string;
+  guacdPort?: number;
  settings: {
    hostname: string;
    port?: number;
@@ -14,6 +16,7 @@ export interface GuacamoleConnectionSettings {
    dpi?: number;
    security?: string;
    "ignore-cert"?: boolean;
+    "disable-auth"?: boolean;
    "enable-wallpaper"?: boolean;
    "enable-drive"?: boolean;
    "drive-path"?: string;
@@ -120,18 +123,25 @@ export class GuacamoleTokenService {
    hostname: string,
    username: string,
    password: string,
-    options: Partial<GuacamoleConnectionSettings["settings"]> = {},
+    options: Partial<GuacamoleConnectionSettings["settings"]> & {
+      guacdHost?: string;
+      guacdPort?: number;
+    } = {},
  ): string {
+    const { guacdHost, guacdPort, ...settingsOptions } = options;
    const token: GuacamoleToken = {
      connection: {
        type: "rdp",
+        ...(guacdHost ? { guacdHost } : {}),
+        ...(guacdPort ? { guacdPort } : {}),
        settings: {
          hostname,
-          username,
-          password,
+          ...(username ? { username } : {}),
+          ...(password ? { password } : {}),
          port: 3389,
          "ignore-cert": true,
-          ...options,
+          ...(!username && !password ? { "disable-auth": true } : {}),
+          ...settingsOptions,
        },
      },
    };
@@ -142,17 +152,23 @@ export class GuacamoleTokenService {
    hostname: string,
    username?: string,
    password?: string,
-    options: Partial<GuacamoleConnectionSettings["settings"]> = {},
+    options: Partial<GuacamoleConnectionSettings["settings"]> & {
+      guacdHost?: string;
+      guacdPort?: number;
+    } = {},
  ): string {
+    const { guacdHost, guacdPort, ...settingsOptions } = options;
    const token: GuacamoleToken = {
      connection: {
        type: "vnc",
+        ...(guacdHost ? { guacdHost } : {}),
+        ...(guacdPort ? { guacdPort } : {}),
        settings: {
          hostname,
          ...(username ? { username } : {}),
          password,
          port: 5900,
-          ...options,
+          ...settingsOptions,
        },
      },
    };
@@ -163,17 +179,23 @@ export class GuacamoleTokenService {
    hostname: string,
    username?: string,
    password?: string,
-    options: Partial<GuacamoleConnectionSettings["settings"]> = {},
+    options: Partial<GuacamoleConnectionSettings["settings"]> & {
+      guacdHost?: string;
+      guacdPort?: number;
+    } = {},
  ): string {
+    const { guacdHost, guacdPort, ...settingsOptions } = options;
    const token: GuacamoleToken = {
      connection: {
        type: "telnet",
+        ...(guacdHost ? { guacdHost } : {}),
+        ...(guacdPort ? { guacdPort } : {}),
        settings: {
          hostname,
          username,
          password,
          port: 23,
-          ...options,
+          ...settingsOptions,
        },
      },
    };
@@ -0,0 +1,35 @@
+import express from "express";
+import cookieParser from "cookie-parser";
+import { createCorsMiddleware } from "./utils/cors-config.js";
+import { AuthManager } from "./utils/auth-manager.js";
+import { homepageItemsRouter } from "./database/routes/homepage-items-routes.js";
+import { homepageLayoutRouter } from "./database/routes/homepage-layout-routes.js";
+import { homepageFaviconRouter } from "./database/routes/homepage-favicon-routes.js";
+import { homepageRssRouter } from "./database/routes/homepage-rss-routes.js";
+import { homepagePingRouter } from "./database/routes/homepage-ping-routes.js";
+import { homepageProxyRouter } from "./database/routes/homepage-proxy-routes.js";
+
+const app = express();
+const authManager = AuthManager.getInstance();
+const PORT = 30012;
+
+app.use(createCorsMiddleware());
+app.use(cookieParser());
+app.use(express.json({ limit: "1mb" }));
+app.use((_req, res, next) => {
+  res.setHeader("Cache-Control", "no-store");
+  next();
+});
+
+app.use(authManager.createAuthMiddleware());
+
+app.use("/homepage/items", homepageItemsRouter);
+app.use("/homepage/layout", homepageLayoutRouter);
+app.use("/homepage/favicon", homepageFaviconRouter);
+app.use("/homepage/rss", homepageRssRouter);
+app.use("/homepage/ping", homepagePingRouter);
+app.use("/homepage/proxy", homepageProxyRouter);
+
+app.listen(PORT, "127.0.0.1", () => {});
+
+export default app;
@@ -0,0 +1,204 @@
+import { WebSocketServer, WebSocket, type RawData } from "ws";
+import { SerialPort } from "serialport";
+import { AuthManager } from "../utils/auth-manager.js";
+import { UserCrypto } from "../utils/user-crypto.js";
+import { sshLogger } from "../utils/logger.js";
+
+interface SerialConnectData {
+  path: string;
+  baudRate: number;
+  dataBits?: 5 | 6 | 7 | 8;
+  stopBits?: 1 | 2;
+  parity?: "none" | "even" | "odd";
+}
+
+interface WebSocketMessage {
+  type: string;
+  data?: SerialConnectData | string | unknown;
+}
+
+const authManager = AuthManager.getInstance();
+const userCrypto = UserCrypto.getInstance();
+
+const wss = new WebSocketServer({ port: 30011 });
+
+wss.on("connection", async (ws: WebSocket, req) => {
+  let userId: string | undefined;
+
+  try {
+    let token: string | undefined;
+
+    const cookieHeader = req.headers.cookie;
+    if (cookieHeader) {
+      const match = cookieHeader.match(/(?:^|;\s*)jwt=([^;]+)/);
+      if (match) token = decodeURIComponent(match[1]);
+    }
+
+    if (!token) {
+      const authHeader = req.headers.authorization;
+      if (authHeader?.startsWith("Bearer ")) {
+        token = authHeader.slice("Bearer ".length);
+      }
+    }
+
+    if (!token) {
+      const urlObj = new URL(req.url || "", "http://localhost");
+      const qp = urlObj.searchParams.get("token");
+      if (qp) token = qp;
+    }
+
+    if (!token) {
+      ws.close(1008, "Authentication required");
+      return;
+    }
+
+    const payload = await authManager.verifyJWTToken(token);
+    if (!payload?.userId || payload.pendingTOTP) {
+      ws.close(1008, "Authentication required");
+      return;
+    }
+
+    userId = payload.userId;
+  } catch {
+    ws.close(1008, "Authentication required");
+    return;
+  }
+
+  const dataKey = userCrypto.getUserDataKey(userId);
+  if (!dataKey) {
+    ws.send(JSON.stringify({ type: "error", data: "Data locked" }));
+    ws.close(1008, "Data access required");
+    return;
+  }
+
+  let port: SerialPort | null = null;
+
+  const send = (msg: object) => {
+    if (ws.readyState === WebSocket.OPEN) {
+      ws.send(JSON.stringify(msg));
+    }
+  };
+
+  const cleanup = () => {
+    if (port?.isOpen) {
+      port.close();
+    }
+    port = null;
+  };
+
+  ws.on("message", async (raw: RawData) => {
+    let parsed: WebSocketMessage;
+    try {
+      parsed = JSON.parse(raw.toString()) as WebSocketMessage;
+    } catch {
+      return;
+    }
+
+    const { type, data } = parsed;
+
+    switch (type) {
+      case "list_ports": {
+        try {
+          const ports = await SerialPort.list();
+          send({ type: "ports_list", data: ports });
+        } catch (err) {
+          send({
+            type: "error",
+            data: err instanceof Error ? err.message : "Failed to list ports",
+          });
+        }
+        break;
+      }
+
+      case "connect": {
+        if (port?.isOpen) {
+          port.close();
+          port = null;
+        }
+
+        const cfg = data as SerialConnectData;
+        if (!cfg?.path || !cfg?.baudRate) {
+          send({ type: "error", data: "Missing port path or baud rate" });
+          break;
+        }
+
+        try {
+          port = new SerialPort({
+            path: cfg.path,
+            baudRate: cfg.baudRate,
+            dataBits: cfg.dataBits ?? 8,
+            stopBits: cfg.stopBits ?? 1,
+            parity: cfg.parity ?? "none",
+            autoOpen: false,
+          });
+
+          port.open((err) => {
+            if (err) {
+              sshLogger.error("Serial port open failed", err, {
+                operation: "serial_open",
+                path: cfg.path,
+                userId,
+              });
+              send({ type: "error", data: err.message });
+              port = null;
+              return;
+            }
+            sshLogger.info("Serial port opened", {
+              operation: "serial_open",
+              path: cfg.path,
+              baudRate: cfg.baudRate,
+              userId,
+            });
+            send({ type: "connected" });
+          });
+
+          port.on("data", (chunk: Buffer) => {
+            send({ type: "data", data: chunk.toString("binary") });
+          });
+
+          port.on("error", (err) => {
+            send({ type: "error", data: err.message });
+          });
+
+          port.on("close", () => {
+            send({ type: "disconnected" });
+            port = null;
+          });
+        } catch (err) {
+          send({
+            type: "error",
+            data:
+              err instanceof Error ? err.message : "Failed to open serial port",
+          });
+        }
+        break;
+      }
+
+      case "input": {
+        if (!port?.isOpen) break;
+        const input = typeof data === "string" ? data : "";
+        if (!input) break;
+        port.write(Buffer.from(input, "binary"), (err) => {
+          if (err) {
+            send({ type: "error", data: err.message });
+          }
+        });
+        break;
+      }
+
+      case "disconnect": {
+        cleanup();
+        send({ type: "disconnected" });
+        break;
+      }
+    }
+  });
+
+  ws.on("close", () => {
+    cleanup();
+  });
+
+  ws.on("error", () => {
+    cleanup();
+  });
+});
@@ -0,0 +1,380 @@
+import { getDb } from "../database/db/index.js";
+import { statsLogger } from "../utils/logger.js";
+import {
+  sendNotification,
+  type AlertPayload,
+  type NotificationChannel,
+} from "../utils/notification-sender.js";
+
+type AlertTriggerType =
+  | "host_offline"
+  | "host_online"
+  | "cpu_threshold"
+  | "memory_threshold"
+  | "disk_threshold"
+  | "health_check_failure"
+  | "health_check_recovery"
+  | "user_login";
+
+interface AlertRule {
+  id: number;
+  userId: string;
+  hostId: number | null;
+  name: string;
+  enabled: boolean;
+  triggerType: AlertTriggerType;
+  thresholdValue: number | null;
+  thresholdDurationSeconds: number | null;
+  cooldownMinutes: number;
+}
+
+interface RawRule {
+  id: number;
+  user_id: string;
+  host_id: number | null;
+  name: string;
+  enabled: number;
+  trigger_type: string;
+  threshold_value: number | null;
+  threshold_duration_seconds: number | null;
+  cooldown_minutes: number;
+}
+
+interface RawChannel {
+  id: number;
+  type: string;
+  config: string;
+  enabled: number;
+}
+
+export class AlertEngine {
+  private static instance: AlertEngine;
+
+  // "${ruleId}:${hostId}" → lastFiredAt ms
+  private cooldownMap = new Map<string, number>();
+  // "${ruleId}:${hostId}" → breachStartTime ms
+  private breachStartMap = new Map<string, number>();
+  // hostId → last known status
+  private lastStatusMap = new Map<number, "online" | "offline">();
+  // "${hostId}:${checkId}" → last known ok state
+  private healthCheckStateMap = new Map<string, boolean>();
+
+  static getInstance(): AlertEngine {
+    if (!AlertEngine.instance) {
+      AlertEngine.instance = new AlertEngine();
+    }
+    return AlertEngine.instance;
+  }
+
+  async evaluateMetrics(
+    hostId: number,
+    metrics: {
+      cpu?: { percent: number | null } | null;
+      memory?: { percent: number | null } | null;
+      disk?: { percent: number | null } | null;
+    },
+  ): Promise<void> {
+    const rules = this.loadRulesForHost(hostId).filter((r) =>
+      ["cpu_threshold", "memory_threshold", "disk_threshold"].includes(
+        r.triggerType,
+      ),
+    );
+
+    if (rules.length === 0) return;
+
+    const now = Date.now();
+
+    for (const rule of rules) {
+      let currentValue: number | null | undefined;
+      if (rule.triggerType === "cpu_threshold")
+        currentValue = metrics.cpu?.percent;
+      else if (rule.triggerType === "memory_threshold")
+        currentValue = metrics.memory?.percent;
+      else if (rule.triggerType === "disk_threshold")
+        currentValue = metrics.disk?.percent;
+
+      if (currentValue == null || rule.thresholdValue == null) continue;
+
+      const key = `${rule.id}:${hostId}`;
+      const isBreaching = currentValue >= rule.thresholdValue;
+
+      if (isBreaching) {
+        if (!this.breachStartMap.has(key)) {
+          this.breachStartMap.set(key, now);
+        }
+        const breachStart = this.breachStartMap.get(key)!;
+        const durationMs = (rule.thresholdDurationSeconds ?? 0) * 1000;
+        if (
+          now - breachStart >= durationMs &&
+          !this.isCoolingDown(rule.id, hostId)
+        ) {
+          const hostName = this.getHostName(hostId);
+          await this.fireAlert(rule, hostId, hostName, {
+            value: currentValue,
+            message: `${rule.triggerType.replace("_threshold", "").toUpperCase()} usage at ${currentValue.toFixed(1)}% (threshold: ${rule.thresholdValue}%)`,
+            severity: currentValue >= 95 ? "critical" : "warning",
+          });
+        }
+      } else {
+        this.breachStartMap.delete(key);
+      }
+    }
+  }
+
+  async evaluateStatus(hostId: number, isOnline: boolean): Promise<void> {
+    const currentStatus = isOnline ? "online" : "offline";
+    const lastStatus = this.lastStatusMap.get(hostId);
+
+    if (lastStatus === currentStatus) return;
+    this.lastStatusMap.set(hostId, currentStatus);
+
+    if (lastStatus === undefined) return;
+
+    const triggerType: AlertTriggerType = isOnline
+      ? "host_online"
+      : "host_offline";
+    const rules = this.loadRulesForHost(hostId).filter(
+      (r) => r.triggerType === triggerType,
+    );
+
+    for (const rule of rules) {
+      if (!this.isCoolingDown(rule.id, hostId)) {
+        const hostName = this.getHostName(hostId);
+        await this.fireAlert(rule, hostId, hostName, {
+          message: isOnline
+            ? `Host "${hostName}" is back online`
+            : `Host "${hostName}" is offline`,
+          severity: isOnline ? "info" : "critical",
+        });
+      }
+    }
+  }
+
+  async evaluateHealthCheck(
+    hostId: number,
+    userId: string,
+    checkId: string,
+    ok: boolean,
+    detail?: string,
+  ): Promise<void> {
+    const stateKey = `${hostId}:${checkId}`;
+    const lastOk = this.healthCheckStateMap.get(stateKey);
+    this.healthCheckStateMap.set(stateKey, ok);
+
+    if (lastOk === undefined) return;
+
+    let triggerType: AlertTriggerType | null = null;
+    if (!ok && lastOk) triggerType = "health_check_failure";
+    else if (ok && !lastOk) triggerType = "health_check_recovery";
+
+    if (!triggerType) return;
+
+    const rules = this.loadRulesForHostUser(hostId, userId).filter(
+      (r) => r.triggerType === triggerType,
+    );
+
+    for (const rule of rules) {
+      if (!this.isCoolingDown(rule.id, hostId)) {
+        const hostName = this.getHostName(hostId);
+        await this.fireAlert(rule, hostId, hostName, {
+          message: ok
+            ? `Health check recovered on "${hostName}"${detail ? `: ${detail}` : ""}`
+            : `Health check failed on "${hostName}"${detail ? `: ${detail}` : ""}`,
+          severity: ok ? "info" : "warning",
+        });
+      }
+    }
+  }
+
+  async evaluateUserLogin(
+    hostId: number,
+    userId: string,
+    sshUser: string,
+    fromIp: string,
+  ): Promise<void> {
+    const rules = this.loadRulesForHostUser(hostId, userId).filter(
+      (r) => r.triggerType === "user_login",
+    );
+
+    for (const rule of rules) {
+      if (!this.isCoolingDown(rule.id, hostId)) {
+        const hostName = this.getHostName(hostId);
+        await this.fireAlert(rule, hostId, hostName, {
+          message: `User "${sshUser}" logged in to "${hostName}" from ${fromIp}`,
+          severity: "info",
+        });
+      }
+    }
+  }
+
+  private async fireAlert(
+    rule: AlertRule,
+    hostId: number,
+    hostName: string,
+    context: {
+      value?: number;
+      message: string;
+      severity: "info" | "warning" | "critical";
+    },
+  ): Promise<void> {
+    this.markCooldown(rule.id, hostId);
+
+    const payload: AlertPayload = {
+      hostName,
+      hostId,
+      triggerType: rule.triggerType,
+      value: context.value,
+      threshold: rule.thresholdValue ?? undefined,
+      message: context.message,
+      severity: context.severity,
+      timestamp: new Date().toISOString(),
+      ruleId: rule.id,
+      ruleName: rule.name,
+    };
+
+    try {
+      const db = getDb();
+      db.$client
+        .prepare(
+          `INSERT INTO alert_firings (user_id, rule_id, host_id, host_name, value, message, severity)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        )
+        .run(
+          rule.userId,
+          rule.id,
+          hostId,
+          hostName,
+          context.value ?? null,
+          context.message,
+          context.severity,
+        );
+
+      // Prune old firings beyond 30 days
+      db.$client
+        .prepare(
+          `DELETE FROM alert_firings WHERE user_id = ? AND fired_at < datetime('now', '-30 days')`,
+        )
+        .run(rule.userId);
+    } catch (err) {
+      statsLogger.warn("Failed to write alert firing", {
+        operation: "alert_firing_insert_error",
+        ruleId: rule.id,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+
+    const channels = this.loadChannelsForRule(rule.id);
+    for (const channel of channels) {
+      sendNotification(channel, payload).catch((err) => {
+        statsLogger.warn("Failed to send notification", {
+          operation: "notification_delivery_error",
+          channelId: channel.id,
+          error: err instanceof Error ? err.message : String(err),
+        });
+      });
+    }
+  }
+
+  private isCoolingDown(ruleId: number, hostId: number): boolean {
+    const key = `${ruleId}:${hostId}`;
+    const lastFired = this.cooldownMap.get(key);
+    if (!lastFired) return false;
+    const rule = this.loadRuleById(ruleId);
+    const cooldownMs = (rule?.cooldownMinutes ?? 15) * 60 * 1000;
+    return Date.now() - lastFired < cooldownMs;
+  }
+
+  private markCooldown(ruleId: number, hostId: number): void {
+    this.cooldownMap.set(`${ruleId}:${hostId}`, Date.now());
+  }
+
+  private loadRulesForHost(hostId: number): AlertRule[] {
+    try {
+      const db = getDb();
+      const rows = db.$client
+        .prepare(
+          `SELECT * FROM alert_rules
+           WHERE enabled = 1 AND (host_id = ? OR host_id IS NULL)`,
+        )
+        .all(hostId) as RawRule[];
+      return rows.map(mapRawRule);
+    } catch {
+      return [];
+    }
+  }
+
+  private loadRulesForHostUser(hostId: number, userId: string): AlertRule[] {
+    try {
+      const db = getDb();
+      const rows = db.$client
+        .prepare(
+          `SELECT * FROM alert_rules
+           WHERE enabled = 1 AND user_id = ? AND (host_id = ? OR host_id IS NULL)`,
+        )
+        .all(userId, hostId) as RawRule[];
+      return rows.map(mapRawRule);
+    } catch {
+      return [];
+    }
+  }
+
+  private loadRuleById(ruleId: number): AlertRule | null {
+    try {
+      const db = getDb();
+      const row = db.$client
+        .prepare("SELECT * FROM alert_rules WHERE id = ?")
+        .get(ruleId) as RawRule | undefined;
+      return row ? mapRawRule(row) : null;
+    } catch {
+      return null;
+    }
+  }
+
+  private loadChannelsForRule(ruleId: number): NotificationChannel[] {
+    try {
+      const db = getDb();
+      const rows = db.$client
+        .prepare(
+          `SELECT nc.id, nc.type, nc.config, nc.enabled
+           FROM notification_channels nc
+           JOIN alert_rule_channels arc ON arc.channel_id = nc.id
+           WHERE arc.rule_id = ? AND nc.enabled = 1`,
+        )
+        .all(ruleId) as RawChannel[];
+      return rows.map((r) => ({
+        id: r.id,
+        type: r.type,
+        config: r.config,
+        enabled: r.enabled === 1,
+      }));
+    } catch {
+      return [];
+    }
+  }
+
+  private getHostName(hostId: number): string {
+    try {
+      const db = getDb();
+      const row = db.$client
+        .prepare("SELECT name, ip FROM ssh_data WHERE id = ?")
+        .get(hostId) as { name: string | null; ip: string } | undefined;
+      return row?.name || row?.ip || `Host #${hostId}`;
+    } catch {
+      return `Host #${hostId}`;
+    }
+  }
+}
+
+function mapRawRule(r: RawRule): AlertRule {
+  return {
+    id: r.id,
+    userId: r.user_id,
+    hostId: r.host_id,
+    name: r.name,
+    enabled: r.enabled === 1,
+    triggerType: r.trigger_type as AlertTriggerType,
+    thresholdValue: r.threshold_value,
+    thresholdDurationSeconds: r.threshold_duration_seconds,
+    cooldownMinutes: r.cooldown_minutes,
+  };
+}
@@ -23,6 +23,7 @@ interface HostConfig {
  keyPassword?: string;
  keyType?: string;
  authType?: string;
+  useWarpgate?: boolean;
  credentialId?: number;
  userId?: string;
  forceKeyboardInteractive?: boolean;
@@ -112,6 +113,7 @@ export class SSHAuthManager {
    prompts: Array<{ prompt: string; echo: boolean }>,
    finish: (responses: string[]) => void,
    resolvedCredentials: ResolvedCredentials,
+    hostConfig?: HostConfig,
  ): void {
    this.context.isKeyboardInteractive = true;
    const promptTexts = prompts.map((p) => p.prompt);
@@ -143,7 +145,7 @@ export class SSHAuthManager {
      return;
    }

-    this.handlePasswordAuth(prompts, finish, resolvedCredentials);
+    this.handlePasswordAuth(prompts, finish, resolvedCredentials, hostConfig);
  }

  private handleWarpgateAuth(
@@ -282,7 +284,22 @@ export class SSHAuthManager {
    prompts: Array<{ prompt: string; echo: boolean }>,
    finish: (responses: string[]) => void,
    resolvedCredentials: ResolvedCredentials,
+    hostConfig?: HostConfig,
  ): void {
+    // For Warpgate hosts: auto-answer password prompts silently using stored credentials.
+    // Warpgate sends a password prompt before its browser-verification round; we must
+    // not show a UI prompt here -- the WarpgateDialog handles user interaction later.
+    if (hostConfig?.useWarpgate) {
+      const responses = prompts.map((p) => {
+        if (/password/i.test(p.prompt) && resolvedCredentials.password) {
+          return resolvedCredentials.password as string;
+        }
+        return "";
+      });
+      finish(responses);
+      return;
+    }
+
    const hasStoredPassword =
      resolvedCredentials.password && resolvedCredentials.authType !== "none";

@@ -290,19 +307,34 @@ export class SSHAuthManager {
      /password/i.test(p.prompt),
    );

-    if (!hasStoredPassword && passwordPromptIndex !== -1) {
+    // Find the first prompt we can't auto-answer. This handles DUO/PAM challenges
+    // that don't say "password" (e.g. "Passcode or option (1-N):").
+    const firstUnansweredIndex = prompts.findIndex((p) => {
+      if (/password/i.test(p.prompt) && hasStoredPassword) return false;
+      return true;
+    });
+
+    if (firstUnansweredIndex !== -1) {
      if (this.context.keyboardInteractiveResponded) {
        return;
      }
      this.context.keyboardInteractiveResponded = true;

+      const promptIndex =
+        passwordPromptIndex !== -1 && !hasStoredPassword
+          ? passwordPromptIndex
+          : firstUnansweredIndex;
+
      this.context.keyboardInteractiveFinish = (userResponses: string[]) => {
        const userInput = (userResponses[0] || "").trim();

        const responses = prompts.map((p, index) => {
-          if (index === passwordPromptIndex) {
+          if (index === promptIndex) {
            return userInput;
          }
+          if (/password/i.test(p.prompt) && resolvedCredentials.password) {
+            return resolvedCredentials.password;
+          }
          return "";
        });

@@ -335,7 +367,7 @@ export class SSHAuthManager {
      this.context.ws.send(
        JSON.stringify({
          type: "password_required",
-          prompt: prompts[passwordPromptIndex].prompt,
+          prompt: prompts[promptIndex].prompt,
        }),
      );
      return;
@@ -0,0 +1,43 @@
+export type ContainerRuntime = "docker" | "podman";
+
+export function normalizeContainerRuntime(value: unknown): ContainerRuntime {
+  return value === "podman" ? "podman" : "docker";
+}
+
+export function getContainerRuntimeConfig(raw: unknown): {
+  runtime: ContainerRuntime;
+} {
+  if (!raw) {
+    return { runtime: "docker" };
+  }
+
+  let config: unknown = raw;
+  if (typeof raw === "string") {
+    try {
+      config = JSON.parse(raw) as Record<string, unknown>;
+    } catch {
+      return { runtime: "docker" };
+    }
+  }
+
+  if (!config || typeof config !== "object") {
+    return { runtime: "docker" };
+  }
+
+  return {
+    runtime: normalizeContainerRuntime(
+      (config as Record<string, unknown>).runtime,
+    ),
+  };
+}
+
+export function containerCommand(
+  runtime: ContainerRuntime | undefined,
+  args: string,
+): string {
+  return `${normalizeContainerRuntime(runtime)} ${args}`;
+}
+
+export function getRuntimeLabel(runtime: ContainerRuntime): string {
+  return runtime === "podman" ? "Podman" : "Docker";
+}
@@ -1,5 +1,8 @@
-import { describe, it, expect } from "vitest";
-import { pickResolvedUsername } from "./credential-username.js";
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import {
+  pickResolvedUsername,
+  expandOidcUsername,
+} from "./credential-username.js";

 describe("pickResolvedUsername", () => {
  it("keeps the host username when one is set, even with a credential username", () => {
@@ -26,3 +29,70 @@ describe("pickResolvedUsername", () => {
    expect(pickResolvedUsername(undefined, undefined, false)).toBeUndefined();
  });
 });
+
+describe("expandOidcUsername", () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  it("returns the username unchanged when it has no placeholder", async () => {
+    expect(await expandOidcUsername("alice", "user-1")).toBe("alice");
+    expect(await expandOidcUsername(undefined, "user-1")).toBeUndefined();
+  });
+
+  it("expands the placeholder with the user's OIDC identifier", async () => {
+    vi.doMock("../database/db/index.js", () => ({
+      getDb: () => ({
+        select: () => ({
+          from: () => ({
+            where: () => ({
+              limit: async () => [{ oidcIdentifier: "jdoe" }],
+            }),
+          }),
+        }),
+      }),
+    }));
+    vi.doMock("../database/db/schema.js", () => ({ users: {} }));
+    vi.doMock("drizzle-orm", () => ({ eq: vi.fn() }));
+
+    const { expandOidcUsername: expand } =
+      await import("./credential-username.js");
+    expect(await expand("$oidc.preferred_username", "user-1")).toBe("jdoe");
+  });
+
+  it("leaves the placeholder as-is when the user has no OIDC identifier", async () => {
+    vi.doMock("../database/db/index.js", () => ({
+      getDb: () => ({
+        select: () => ({
+          from: () => ({
+            where: () => ({
+              limit: async () => [{ oidcIdentifier: null }],
+            }),
+          }),
+        }),
+      }),
+    }));
+    vi.doMock("../database/db/schema.js", () => ({ users: {} }));
+    vi.doMock("drizzle-orm", () => ({ eq: vi.fn() }));
+
+    const { expandOidcUsername: expand } =
+      await import("./credential-username.js");
+    expect(await expand("$oidc.preferred_username", "user-1")).toBe(
+      "$oidc.preferred_username",
+    );
+  });
+
+  it("returns the username unchanged when the DB lookup throws", async () => {
+    vi.doMock("../database/db/index.js", () => ({
+      getDb: () => {
+        throw new Error("DB unavailable");
+      },
+    }));
+
+    const { expandOidcUsername: expand } =
+      await import("./credential-username.js");
+    expect(await expand("$oidc.preferred_username", "user-1")).toBe(
+      "$oidc.preferred_username",
+    );
+  });
+});
@@ -21,6 +21,40 @@ export function pickResolvedUsername(
  return cred;
 }

+/**
+ * Expands the `$oidc.preferred_username` placeholder in an SSH username to the
+ * connecting user's OIDC identifier. Returns the username unchanged if it does
+ * not contain the placeholder or the user has no OIDC identifier.
+ */
+export async function expandOidcUsername(
+  username: string | undefined,
+  userId: string,
+): Promise<string | undefined> {
+  if (!username || !username.includes("$oidc.preferred_username")) {
+    return username;
+  }
+
+  try {
+    const { getDb } = await import("../database/db/index.js");
+    const { users } = await import("../database/db/schema.js");
+    const { eq } = await import("drizzle-orm");
+
+    const db = getDb();
+    const rows = await db
+      .select({ oidcIdentifier: users.oidcIdentifier })
+      .from(users)
+      .where(eq(users.id, userId))
+      .limit(1);
+
+    const oidcIdentifier = rows[0]?.oidcIdentifier;
+    if (!oidcIdentifier) return username;
+
+    return username.replace(/\$oidc\.preferred_username/g, oidcIdentifier);
+  } catch {
+    return username;
+  }
+}
+
 function isNonEmptyString(value: unknown): value is string {
  return typeof value === "string" && value.trim() !== "";
 }
--- a/Show More
+++ b/Show More