chore: add login security to the plugin table

* fix: keep concurrent ssh pool connects from overwriting each other (#1619)

* fix: stop auto-accepting changed jump host keys (#1620)

A jump hop whose key no longer matched the pinned fingerprint was
silently accepted and the pin overwritten. Background status probes
reconnect to jump hosts every cycle, so a MITM on that hop got the
credentials with no user interaction. Changed jump host keys now go
through the same path as any other host: prompt when there is a
terminal socket, otherwise refuse.

* fix(electron): validate external login URL scheme and callback port (#1621)

* fix(plugins): read artifact manifest with the same tar parser as the unpack (#1622)

The consent check read the first manifest.json with a hand-written tar
reader, while the unpack keeps the last one and also follows pax and
long-name headers. An archive with two manifests could pass the check
with one capability list and get granted another. Read the manifest
with node-tar, count only plain files, and refuse archives that hold
more than one manifest.json.

* fix: only trust the server's origin in the desktop login frame (#1624)

The desktop sign-in iframe accepted AUTH_SUCCESS and system browser requests from whatever page it had navigated to, and posted replies (including 2FA temp tokens) to any origin. Messages must now come from the server's origin and replies are posted to it.

The web UI also treated any framing page as the desktop app and posted the JWT to it. It now also requires the Termix-Desktop user agent.

* fix: check trusted proxy login against nginx's peer, not nginx (#1625)

The backend only sees the bundled nginx on loopback, so the allowlist
could only work by trusting 127.0.0.1, which let any client that reached
nginx log in as anyone by sending the identity headers. nginx now passes
its own TCP peer (before real_ip rewriting) in X-Termix-Proxy-Peer, and
loopback connections are judged by that address instead.

* fix: keep foreign keys on during user data import (#1626)

Import credentials before hosts and remap the file's credential ids to
the ones created here, so hosts and protocol logins no longer point at
another server's ids. With rows written in dependency order, the import
no longer turns off SQLite foreign keys on the shared connection. The
uploaded file is now removed on every exit path.

* fix: enforce unique usernames (#1628)

* fix: enforce unique usernames

Registration checked for a taken name, hashed the password, then
inserted, with nothing in the schema enforcing uniqueness. Concurrent
sign-ups could create two accounts with one name, after which login,
password reset, proxy login and admin lookups by username picked
between them arbitrarily.

Add a unique index on users.username for every dialect. Existing
duplicates are renamed (later rows get a -<id> suffix, the oldest keeps
the name) rather than deleted. Registration and admin user creation now
return the same 409 when the insert loses the race.

* fix: avoid username collisions during migration

* fix: don't auto-enable synced plugins signed only by a server-sent key (#1623)

* fix: don't auto-enable synced plugins signed only by a server-sent key

Registry keys a linked server sends still let its plugins load on the desktop, but no longer count as a signer for switching them on or copying their grants. Keys the desktop added itself keep their trust.

* fix: enforce local plugin trust across remote source labels

* fix: require positive local trust for synced plugin keys

* fix(desktop): harden external editor and session cookie IPC (#1627)

* fix(desktop): stop the renderer choosing the external editor binary or reading the session cookie

open-external-editor now launches only the editor saved from a file dialog
and refuses to hand executable file types to the OS opener. The unused
get-session-cookie and wait-session-cookie channels, which returned the
httpOnly jwt, are removed.

* fix: validate setting keys before editor authorization

* fix(sidebar): sort hosts by IP address numerically (#1629)

* fix(desktop): find spawn-helper in universal macOS builds (#1630)

The universal build ships app-arm64.asar and app-x64.asar instead of
app.asar, so node-pty's helper path rewrite never pointed at the
unpacked copy and every local terminal failed with posix_spawnp failed.

* fix(sync): send shared hosts with text columns in their stored form (#1631)

resolveHostById turns forceKeyboardInteractive into a boolean, and the
shared-host export passed it on as is. A desktop could not bind the boolean
into the text column, so every shared host failed to apply.

* fix: drop ssh_data.vault_profile_id so removing the vault plugin keeps hosts writable (#1633)

The vault plugin renames vault_profiles to p_vault_profiles, and SQLite
rewrites ssh_data's foreign key to follow it. Uninstalling the plugin then
dropped p_vault_profiles and left ssh_data pointing at a missing table, so
creating, cloning and deleting hosts failed with "no such table:
main.p_vault_profiles". Postgres and MySQL refused the uninstall instead.

The column was already copied into the vault plugin's host settings by 2.9,
so retire it on every engine. The SQLite boot drop also repairs databases
already in the broken state; MySQL drops the column's foreign key first.

* fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own (#1632)

* fix(sync): let a linked desktop enable mirrored plugins it does not trust on its own

* fix(sync): switch off an untrusted mirrored plugin when the server updates it

* fix: require local consent for mirrored plugin activation

* docs: describe consent fields on the plugin state endpoint

* fix(i18n): keep Indonesian technical terms consistent (#1636)

Use the English terms Indonesian users know for tunnel, snippet, deploy,
file manager, remote desktop, jump host, passphrase, sidebar, toolbar,
endpoint, browser and SSH agent, instead of mixing literal translations
(terowongan, cuplikan, terapkan, bilah sisi, titik akhir, ...) with the
English words. Match the split shortcuts to the split screen menu.

Also fix the user data export description, which said secrets are
encrypted while the English says they are decrypted.

* fix(settings): leave user manage view when switching admin sections (#1649)

The admin panel stays mounted across Settings pages, so an open user
manage view kept replacing every other admin section until Back to users
was clicked. Reset it whenever the selected section changes.

* fix(sync): don't delete a local row when the server can't send its copy (#1650)

* fix(sync): don't delete a local row when the server can't send its copy

A push conflict on a live record whose server row failed to serialize
came back as row: null, deleted: false, and the desktop treated that as
a delete. The server now rejects that op as unavailable, the desktop
never deletes on a conflict without a row, and serialization failures
are logged.

* fix(sync): retry temporarily unavailable records

* fix: smooth host editor jumps to lower sections

* chore: add changelog entries for 26.10.2 fixes

* fix: stop building ssh2 native crypto in the docker image (#1644)

* chore: test that an update keeps a changed auth type (#1601)

* feat: option to hide the sidebar after opening a host (#1652)

* feat: sort the dashboard host status card (Plugin-Host-Metrics#6)

* fix: let the hover side menu overlay content instead of resizing it (Plugin-Remote-Desktop#2)

* fix: say the server is down and keep retrying instead of a database error (#1637)

* fix: show why a client tunnel failed to start (Plugin-Tunnels#2)

* fix(sdk): skip comment-only chunks when splitting migrations

* feat: setting to let the hover side menu push content again

* fix: use the vite proxy for plugin sockets on any dev port

* feat(sdk): let a plugin raise its public route rate limit

* chore: update translations

* chore: add the overview video to the readme

* chore: update the overview video and add a play button to its thumbnail

* feat: plugin builds bundle worker entries and import wasm and fonts as bytes

* feat: plugin packs include LICENSE and NOTICE

* chore: drop guacd from compose files and dev runner

* chore: update remote desktop origin comment for the built-in engine

* fix: show plugin names and descriptions in the UI language (#1658)

* fix: show plugin names and descriptions in the UI language

Read plugin.name and plugin.description from each plugin's own locale
namespace, falling back to the manifest, everywhere core shows a plugin's
name: the Plugins manager, onboarding picker, host editor tabs and
sections, host filters and bulk actions, beta updates, interface presets
and plugin crash/loading notices.

* docs(sdk): document plugin.name and plugin.description locale keys

---------

Co-authored-by: ZacharyZcR <zkl205305@gmail.com>

* fix(hosts): reject or infer a missing authType on host create (#1664)

Creating an SSH host through the API without authType hit the NOT NULL
auth_type column and came back as a 500. The create route now infers the
type from the credential, key or password in the body, falls back to the
host defaults, and otherwise answers 400. A non-string authType is a 400
on create and update.

* chore: changelog for merged plugin name and host auth type PRs

* fix: move macOS split pane navigation to Cmd+Option+Arrow

* fix: pick a free port for the desktop backend when 30001 is taken (#1663)

* feat: build the Windows desktop app for ARM64 (#1615)

* fix(sync): keep the changes cursor within the 32-bit seq column (#1665)

The desktop learned the server's entity types by asking for changes after
Number.MAX_SAFE_INTEGER. sync_records.seq is a 32-bit integer on Postgres,
which rejects that bound value, so every pass needing the probe failed with
22003 out of range.

The server now clamps the cursor to the largest seq the column holds and
answers 400 for a cursor or limit that is not a non-negative integer. The
desktop asks for a one-row page from its saved cursor instead.

* fix(audit): coalesce identical plugin routine audits so they cannot flush the log (#1667)

Successful plugin_as_user and plugin_service_* entries written by a plugin
with the same user, action, resource and details are recorded once per
10 minutes. Failures and every other action are still written each time.

* feat(plugins): publish host.created when a host is added (#1668)

Plugins that keep an inventory of hosts had no way to hear about a new
one short of polling. Core now publishes host.created with the same
{ hostId, userId } payload as host.updated wherever a host row is
created: the host create route, ctx.hosts.create, JSON and SSH config
bulk import, database file import, and sync writing a host it did not
have yet.

* fix: show the login for signed-out full-screen view links and return to them (#1669)

A ?view= link opened without a session spun forever: the gate rendered
the bare view when the session check failed, so the plugin runtime never
started and the view never registered. A regular browser now keeps the
link in sessionStorage, shows the normal login and opens the link again
after any login, including redirect logins. Only same-origin paths with
a view are restored. The desktop app, embedded sign-in frames and guest
views keep their current behavior.

* fix(desktop): apply linked server proxy headers and certificate exception to WebSockets (#1670)

* fix(desktop): send linked server proxy headers on WebSocket upgrades

isLinkedOrigin compared the request origin with the link's http(s)
origin, so the terminal WebSocket (wss://host/...) never matched and its
upgrade went out without the proxy headers and basic auth. Behind a
forward-auth proxy that upgrade was redirected to the login and the
terminal closed with "connection closed unexpectedly". ws and wss now
count as http and https for the comparison, the same mapping the
WebSocket handshake itself uses, with host and port still matched
exactly.

* fix(desktop): allow a linked server's self-signed certificate for its WebSockets

isInvalidCertificateAllowedForUrl compared the URL with a local
getOrigin copy, so wss://host never matched the link's https://host
origin and an allowed self-signed certificate did not cover the
terminal and tunnel sockets. It now uses linkedServer.isLinkedOrigin,
which maps ws and wss the same way as the proxy headers, and the local
copy is removed.

* feat(sdk): let plugins mint a short-lived user session and read a user's locale (#1666)

ctx.auth.issueUserToken(userId, { purpose, ttlSeconds }) gives background
work a session for calling Termix's own API as an existing user. It needs
users:impersonate, defaults to 300s and is capped at 900s, is stored as a
normal session row marked as plugin-issued, and every issue is audited.
Such sessions are refused on routes that change the user's password,
second factors, API keys or linked logins.

ctx.users.getLocale(userId) reads the user's UI language under users:read.

SDK 1.0.11, plugin API 1.3.0.

* chore: changelog for merged sync, audit, event and desktop PRs

* feat: add shell.rightEdge slot so plugin panels can push the page over

* chore: pin bundled plugins to the latest releases

* chore: lint, format, and bump version to 26.10.2

---------

Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>
Co-authored-by: Ferdina Kusumah <19812460+FerdinaKusumah@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zkl205305@gmail.com>
Co-authored-by: Lukas <80832688+0skater0@users.noreply.github.com>

.commitlintrc.json

@@ -1,21 +1,6 @@
 {
   "extends": ["@commitlint/config-conventional"],
   "rules": {
-    "type-enum": [
-      2,
-      "always",
-      [
-        "feat",
-        "fix",
-        "docs",
-        "style",
-        "refactor",
-        "perf",
-        "test",
-        "chore",
-        "revert"
-      ]
-    ],
     "subject-case": [0]
   }
 }

.dockerignore

@@ -5,13 +5,22 @@ yarn-error.log*
 
 dist
 build
-.next
-.nuxt
+coverage
+release
 
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
+# Local data, secrets and editor state
+db
+old_db
+ssl
+uploads
+plugins
+.env
+.env.*
+.mcp.json
+.claude
+CLAUDE.md
+termix-plugin-signing.key
+*.tmxplug.sig
 
 .vscode
 .idea
@@ -29,64 +38,31 @@ Thumbs.db
 
 .git
 .gitignore
+.husky
 
 README.md
 CONTRIBUTING.md
+CHANGELOG.md
 LICENSE
 
-docs/repo-images/
-
-uploads/
-
 electron/
 electron-builder.json
+Casks
+packaging
 
 *.log
 *.tmp
 *.temp
-
 logs
-*.log
-
 pids
 *.pid
 *.seed
 *.pid.lock
 
-coverage
-
 .nyc_output
-
-jspm_packages/
-
 .npm
-
 .eslintcache
-
-.rpt2_cache/
-.rts2_cache_cjs/
-.rts2_cache_es/
-.rts2_cache_umd/
-
-.node_repl_history
-
-*.tgz
-
-.yarn-integrity
-
 .cache
 .parcel-cache
-
-.next
-
-.nuxt
-
-.vuepress/dist
-
-.serverless
-
-.fusebox/
-
-.dynamodb/
-
-.tern-port
+*.tgz
+.node_repl_history

.editorconfig

@@ -1,14 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[*.{js,cjs,mjs,jsx,ts,tsx,json,css,scss,md,yml,yaml}]
-indent_style = space
-indent_size = 2
-
-[*.md]
-trim_trailing_whitespace = false

.gitattributes

@@ -1,22 +1,5 @@
 * text=auto eol=lf
 
-*.js text eol=lf
-*.cjs text eol=lf
-*.mjs text eol=lf
-*.jsx text eol=lf
-*.ts text eol=lf
-*.tsx text eol=lf
-*.json text eol=lf
-*.css text eol=lf
-*.scss text eol=lf
-*.html text eol=lf
-*.md text eol=lf
-*.yaml text eol=lf
-*.yml text eol=lf
-
-*.sh text eol=lf
-*.bash text eol=lf
-
 *.bat text eol=crlf
 *.cmd text eol=crlf
 *.ps1 text eol=crlf
@@ -25,10 +8,10 @@
 *.jpg binary
 *.jpeg binary
 *.gif binary
+*.webp binary
 *.ico binary
-*.svg binary
+*.icns binary
 *.woff binary
 *.woff2 binary
 *.ttf binary
 *.eot binary
-*.icns binary

.github/ISSUE_TEMPLATE/beta_feedback.yml

@@ -0,0 +1,75 @@
+name: Beta feedback
+description: A bug, rough edge or idea from a Termix beta
+labels: [beta]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for testing a beta. Short reports are fine. If you opened this from Termix, the version and setup are already filled in.
+  - type: input
+    id: termix-version
+    attributes:
+      label: Beta version
+      description: Shown in Settings under Updates, or your image tag.
+      placeholder: "e.g. 26.11.0-beta.2"
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: The bug, what felt off, or your idea. Screenshots help a lot.
+    validations:
+      required: true
+  - type: dropdown
+    id: regression
+    attributes:
+      label: Does this happen on the latest stable release?
+      options:
+        - "Not tested on stable"
+        - "Yes, it happens on stable too"
+        - "No, only on this beta"
+        - "Not a bug, just feedback"
+    validations:
+      required: false
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: As few steps as you can.
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: false
+  - type: textarea
+    id: beta-plugins
+    attributes:
+      label: Plugins on a beta
+      description: Filled in by Termix. One plugin and version per line.
+      render: text
+    validations:
+      required: false
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Browser or desktop app, OS, and how the server is installed.
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Errors from the browser console, `docker logs termix`, or the error Termix shows. This is shown as code, so no backticks needed.
+      render: text
+    validations:
+      required: false
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched open issues and this is not a duplicate
+          required: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,107 @@
+name: Bug report
+description: Something in Termix itself is broken
+labels: [bug]
+type: Bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. A maintainer reads every issue, even when there is no reply right away. We usually reply once there is a fix or a workaround.
+
+        If you came from **Report an issue** in Termix, your versions and environment are already filled in below.
+
+        Is it about a plugin (terminal, file manager, Docker, remote desktop and so on)? Report it on that plugin's repo instead. **Report an issue** on the plugin's page in Termix takes you there with your versions filled in.
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Describe the bug. Screenshots help a lot.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: As few steps as you can.
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect?
+      description: What should have happened instead?
+    validations:
+      required: false
+  - type: input
+    id: termix-version
+    attributes:
+      label: Termix version
+      description: Shown in Settings under About, or in your User Profile.
+      placeholder: "e.g. 26.10.0"
+    validations:
+      required: true
+  - type: dropdown
+    id: platform
+    attributes:
+      label: Platform
+      description: Where do you see the problem?
+      options:
+        - "Web browser"
+        - "Desktop app (Windows)"
+        - "Desktop app (macOS)"
+        - "Desktop app (Linux)"
+        - "Mobile app (iOS)"
+        - "Mobile app (Android)"
+        - "Other"
+    validations:
+      required: true
+  - type: dropdown
+    id: install-method
+    attributes:
+      label: Server install
+      description: How is the Termix server installed?
+      options:
+        - "Docker"
+        - "Manual build"
+        - "Proxmox community script"
+        - "Desktop app (built-in server)"
+        - "Not sure"
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Browser and OS, plus anything special about your setup (reverse proxy, database, SSO).
+      placeholder: |
+        Web, Chrome on Windows. Behind nginx, Postgres.
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Errors from the browser console, `docker logs termix`, or the error Termix shows. This is shown as code, so no backticks needed.
+      render: text
+    validations:
+      required: false
+  - type: textarea
+    id: context
+    attributes:
+      label: Anything else?
+      description: Links, config, or anything that might help.
+    validations:
+      required: false
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Before you submit
+      options:
+        - label: I searched open and closed issues and this is not a duplicate
+          required: true
+        - label: I am on the latest version, or I said which version I am on
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,11 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Support Center
-    url: https://github.com/Termix-SSH/Support/issues
-    about: Report any feature requests or bugs in the support center
-  - name: Discord
+  - name: Problem with a plugin?
+    url: https://github.com/Termix-SSH/Termix#plugins
+    about: Each plugin has its own repo. Find it in this list, or use Report an issue on the plugin's page in Termix.
+  - name: Questions and chat
     url: https://discord.gg/jVQGdvHDrf
-    about: Official Termix Discord server for general discussion (not recommended for support)
+    about: Ask the community on Discord. Bugs and ideas belong in issues.
+  - name: Business or priority support
+    url: https://termix.site/contact
+    about: For teams that need a faster response. Contact us to discuss terms.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,41 @@
+name: Feature request
+description: Suggest an idea for Termix itself
+labels: [feature]
+type: Feature
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Is it about a plugin (terminal, file manager, Docker, remote desktop and so on)? Report it on that plugin's repo instead. **Report an issue** on the plugin's page in Termix takes you there with your versions filled in.
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the idea. Explain the problem first, then how you would solve it.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+      description: What are you trying to do, and what gets in the way today?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: What would you like?
+      description: Describe how it should work.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives
+      description: Anything you tried or considered instead.
+    validations:
+      required: false
+  - type: textarea
+    id: context
+    attributes:
+      label: Anything else?
+      description: Screenshots, mockups or links.
+    validations:
+      required: false

.github/dependabot.yml

@@ -1,83 +0,0 @@
-version: 2
-updates:
-  # npm dependencies (single root package.json, no workspaces)
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 15
-    labels:
-      - "dependencies"
-      - "npm"
-    commit-message:
-      prefix: "chore"
-      prefix-development: "chore"
-      include: "scope"
-    groups:
-      dev-patch-updates:
-        dependency-type: "development"
-        update-types:
-          - "patch"
-      dev-minor-updates:
-        dependency-type: "development"
-        update-types:
-          - "minor"
-      prod-patch-updates:
-        dependency-type: "production"
-        update-types:
-          - "patch"
-      prod-minor-updates:
-        dependency-type: "production"
-        update-types:
-          - "minor"
-      # Major bumps grouped so they land as a single reviewable PR instead of
-      # one-per-package noise. These often need manual follow-up (Electron,
-      # React, Vite, Tailwind, Express 5, etc.).
-      major-updates:
-        update-types:
-          - "major"
-
-  # Docker base images (docker/Dockerfile + docker-compose / compose-dev)
-  - package-ecosystem: "docker"
-    directory: "/docker"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    labels:
-      - "dependencies"
-      - "docker"
-    commit-message:
-      prefix: "chore"
-      include: "scope"
-    groups:
-      docker-patch-updates:
-        update-types:
-          - "patch"
-      docker-minor-updates:
-        update-types:
-          - "minor"
-      docker-major-updates:
-        update-types:
-          - "major"
-
-  # GitHub Actions used across the workflows in .github/workflows
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 10
-    labels:
-      - "dependencies"
-      - "github-actions"
-    commit-message:
-      prefix: "ci"
-      include: "scope"
-    groups:
-      github-actions:
-        update-types:
-          - "patch"
-          - "minor"
-          - "major"

.github/funding.yml

@@ -1 +0,0 @@
-custom: https://donate.termix.site/

.github/pull_request_template.md

@@ -1,32 +0,0 @@
-# Overview
-
-_Short summary of what this PR does_
-
-- [ ] Added: ...
-- [ ] Updated: ...
-- [ ] Removed: ...
-- [ ] Fixed: ...
-
-# Changes Made
-
-_Detailed explanation of changes (if needed)_
-
-- ...
-
-# Related Issues
-
-_Link any issues this PR addresses_
-
-- Closes #ISSUE_NUMBER
-- Related to #ISSUE_NUMBER
-
-# Screenshots / Demos
-
-_(Optional: add before/after screenshots, GIFs, or console output)_
-
-# Checklist
-
-- [ ] Code follows project style guidelines
-- [ ] Supports mobile and desktop UI/app (if applicable)
-- [ ] I have read [Contributing.md](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)
-- [ ] This is not a translation request. See [docs](https://docs.termix.site/translations)

.github/workflows/beta-release.yml

@@ -1,179 +0,0 @@
-name: Weekly Beta Release
-
-on:
-  schedule:
-    - cron: "15 6 * * 1"
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: "Build and test but do not push images, upload installers, or publish a release"
-        required: false
-        default: false
-        type: boolean
-
-permissions:
-  contents: write
-
-jobs:
-  prep:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    outputs:
-      dev_branch: ${{ steps.dev.outputs.branch }}
-      beta_version: ${{ steps.dev.outputs.beta_version }}
-      sha: ${{ steps.dev.outputs.sha }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
-
-      - name: Resolve newest dev branch and compute beta version
-        id: dev
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          REFS=$(gh api "repos/${{ github.repository }}/branches" --paginate -q '.[].name')
-          if DEV_BRANCH=$(printf '%s\n' "$REFS" | node scripts/latest-dev-branch.cjs 2>/dev/null); then
-            echo "Newest dev branch: $DEV_BRANCH"
-          else
-            echo "No dev-X.Y.Z branch open; nothing to snapshot for this week's beta."
-            echo "branch=" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          BASE_VERSION=$(node scripts/parse-dev-branch.cjs "$DEV_BRANCH")
-          BETA_VERSION="${BASE_VERSION}-beta.$(date -u +%Y%m%d)"
-          SHA=$(gh api "repos/${{ github.repository }}/branches/$DEV_BRANCH" -q .commit.sha)
-
-          echo "Beta version: $BETA_VERSION"
-          echo "branch=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
-          echo "beta_version=$BETA_VERSION" >> "$GITHUB_OUTPUT"
-          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
-
-  verify:
-    needs: [prep]
-    if: ${{ needs.prep.outputs.dev_branch != '' }}
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    steps:
-      - name: Checkout dev branch
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.prep.outputs.dev_branch }}
-          fetch-depth: 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run ESLint
-        run: npx eslint .
-
-      - name: Run Prettier check
-        run: npx prettier --check .
-
-      - name: Type check
-        run: npx tsc --noEmit
-
-      - name: Run unit tests
-        run: npm run test
-
-      - name: Build
-        run: npm run build
-
-  create-release:
-    needs: [prep, verify]
-    if: ${{ needs.prep.outputs.dev_branch != '' && inputs.dry_run != true }}
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout dev branch
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.prep.outputs.dev_branch }}
-          fetch-depth: 0
-
-      - name: Resolve previous beta commit
-        id: prev
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          PREV_SHA=$(gh release view beta --repo ${{ github.repository }} --json targetCommitish -q .targetCommitish 2>/dev/null || true)
-          if [ -n "$PREV_SHA" ] && git cat-file -e "$PREV_SHA" 2>/dev/null && git merge-base --is-ancestor "$PREV_SHA" "${{ needs.prep.outputs.sha }}"; then
-            echo "sha=$PREV_SHA" >> "$GITHUB_OUTPUT"
-          else
-            echo "sha=" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Generate rolling beta release notes
-        run: |
-          if [ -n "${{ steps.prev.outputs.sha }}" ]; then
-            CHANGES=$(git log --oneline --no-merges "${{ steps.prev.outputs.sha }}..${{ needs.prep.outputs.sha }}" -- . ':!package-lock.json' | sed 's/^/- /')
-          fi
-          if [ -z "$CHANGES" ]; then
-            CHANGES="- No new commits since the last beta (or this is the first beta build)."
-          fi
-
-          cat > BETA_RELEASE_BODY.md << EOF
-          > [!WARNING]
-          > This is an automated weekly beta build, snapshotted from the \`${{ needs.prep.outputs.dev_branch }}\` branch. It is not a stable release: it may contain unfinished features, regressions, or breaking changes, and this tag is overwritten every week. Do not run it in production.
-          >
-          > Found a bug? [Open a Beta Feedback report](https://github.com/Termix-SSH/Support/issues/new?template=beta_feedback.yml) and mention this build: \`${{ needs.prep.outputs.beta_version }}\`.
-
-          **Snapshot of:** \`${{ needs.prep.outputs.dev_branch }}\` @ \`${{ needs.prep.outputs.sha }}\`
-          **Docker image:** \`ghcr.io/lukegus/termix:beta\` / \`docker.io/bugattiguy527/termix:beta\` (rolling), or pin to \`:beta-${{ needs.prep.outputs.beta_version }}\` for this exact build.
-          **Built:** $(date -u +"%Y-%m-%d %H:%M UTC")
-
-          ### Changes since last beta
-
-          $CHANGES
-          EOF
-
-      - name: Create or update rolling beta release
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          TAG="beta"
-          TITLE="Beta (rolling) - ${{ needs.prep.outputs.beta_version }}"
-          if gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
-            gh release edit "$TAG" --repo ${{ github.repository }} \
-              --title "$TITLE" --notes-file BETA_RELEASE_BODY.md \
-              --prerelease --target "${{ needs.prep.outputs.sha }}"
-          else
-            gh release create "$TAG" --repo ${{ github.repository }} \
-              --title "$TITLE" --notes-file BETA_RELEASE_BODY.md \
-              --prerelease --target "${{ needs.prep.outputs.sha }}"
-          fi
-
-  docker:
-    needs: [prep, verify, create-release]
-    if: ${{ always() && needs.prep.outputs.dev_branch != '' && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped') }}
-    uses: ./.github/workflows/docker.yml
-    with:
-      version: ${{ needs.prep.outputs.beta_version }}
-      build_type: Beta
-      dry_run: ${{ inputs.dry_run == true }}
-      source_ref: ${{ needs.prep.outputs.sha }}
-    secrets: inherit
-
-  electron-release:
-    needs: [prep, verify, create-release]
-    if: ${{ always() && needs.prep.outputs.dev_branch != '' && inputs.dry_run != true && needs.create-release.result == 'success' }}
-    uses: ./.github/workflows/electron.yml
-    with:
-      build_type: all
-      artifact_destination: release
-      release_tag: beta
-      version_override: ${{ needs.prep.outputs.beta_version }}
-      source_ref: ${{ needs.prep.outputs.sha }}
-    secrets: inherit

.github/workflows/dependabot-retarget.yml

@@ -1,157 +0,0 @@
-name: Retarget and Merge Dependabot PRs
-
-on:
-  schedule:
-    - cron: "0 6 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  retarget-and-merge:
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 1
-
-      - name: Resolve newest dev branch
-        id: dev
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          REFS=$(gh api "repos/${{ github.repository }}/branches" --paginate -q '.[].name')
-          # The helper exits non-zero when no dev-X.Y.Z branch exists; treat that
-          # as "nothing to do" rather than a workflow failure.
-          if DEV_BRANCH=$(printf '%s\n' "$REFS" | node scripts/latest-dev-branch.cjs 2>/dev/null); then
-            echo "Newest dev branch: $DEV_BRANCH"
-            echo "branch=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
-          else
-            echo "No dev-X.Y.Z branch open; nothing to retarget."
-            echo "branch=" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Retarget and merge Dependabot PRs
-        if: ${{ steps.dev.outputs.branch != '' }}
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-          DEV_BRANCH: ${{ steps.dev.outputs.branch }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -uo pipefail
-
-          CONFLICT_LABEL="dependabot-rebase-requested"
-
-          # Ensure the bookkeeping label exists (no-op if it already does).
-          gh label create "$CONFLICT_LABEL" --repo "$REPO" \
-            --color "D93F0B" --description "Retarget workflow asked Dependabot to rebase a conflicting PR" \
-            2>/dev/null || true
-
-          # True if the PR already carries the conflict label.
-          has_conflict_label() {
-            gh pr view "$1" --repo "$REPO" --json labels \
-              -q '.labels[].name' | grep -qx "$CONFLICT_LABEL"
-          }
-
-          # Wait until GitHub has a definite mergeable verdict for a PR (it
-          # returns UNKNOWN while recomputing after a base change or a push).
-          # Echoes "<mergeable> <mergeStateStatus>".
-          wait_for_verdict() {
-            local pr="$1" mergeable state
-            for _ in $(seq 1 30); do
-              read -r mergeable state < <(gh pr view "$pr" --repo "$REPO" \
-                --json mergeable,mergeStateStatus \
-                -q '.mergeable + " " + .mergeStateStatus')
-              if [ "$mergeable" != "UNKNOWN" ] && [ "$state" != "UNKNOWN" ]; then
-                echo "$mergeable $state"
-                return 0
-              fi
-              sleep 20
-            done
-            echo "$mergeable $state"
-          }
-
-          # Phase 1: retarget every open Dependabot PR from main onto the dev
-          # branch. This kicks off a Dependabot rebase for each.
-          PR_NUMBERS=$(gh pr list --repo "$REPO" \
-            --author "app/dependabot" \
-            --base main \
-            --state open \
-            --json number -q '.[].number')
-
-          # Pick up PRs already sitting on the dev branch from a previous run too.
-          PR_NUMBERS="$PR_NUMBERS $(gh pr list --repo "$REPO" \
-            --author "app/dependabot" \
-            --base "$DEV_BRANCH" \
-            --state open \
-            --json number -q '.[].number')"
-
-          PR_NUMBERS=$(printf '%s\n' $PR_NUMBERS | sort -un)
-
-          if [ -z "$PR_NUMBERS" ]; then
-            echo "No open Dependabot PRs to process."
-            exit 0
-          fi
-
-          for PR in $PR_NUMBERS; do
-            BASE=$(gh pr view "$PR" --repo "$REPO" --json baseRefName -q .baseRefName)
-            if [ "$BASE" != "$DEV_BRANCH" ]; then
-              echo "Retargeting PR #$PR ($BASE -> $DEV_BRANCH)"
-              gh pr edit "$PR" --repo "$REPO" --base "$DEV_BRANCH"
-            fi
-          done
-
-          # Phase 2: merge one at a time. Each merge can make the remaining npm
-          # PRs stale, so re-check immediately before merging and rebase stragglers.
-          for PR in $PR_NUMBERS; do
-            echo "::group::PR #$PR"
-
-            read -r MERGEABLE STATE < <(wait_for_verdict "$PR")
-            echo "  mergeable=$MERGEABLE mergeStateStatus=$STATE"
-
-            # BEHIND = clean but needs the latest base; ask Dependabot to rebase
-            # and skip for now (next run merges it once it is up to date).
-            if [ "$STATE" = "BEHIND" ]; then
-              echo "  PR #$PR is behind $DEV_BRANCH; asking Dependabot to rebase."
-              gh pr comment "$PR" --repo "$REPO" --body "@dependabot rebase"
-              echo "::endgroup::"
-              continue
-            fi
-
-            # DIRTY / CONFLICTING = a real conflict. Try a rebase once (label it so
-            # we can tell next time); if it is STILL conflicting on a later run
-            # despite already being labelled, the rebase failed for good - close it
-            # so Dependabot reopens a fresh PR against the current dev branch.
-            if [ "$MERGEABLE" = "CONFLICTING" ] || [ "$STATE" = "DIRTY" ]; then
-              if has_conflict_label "$PR"; then
-                echo "  PR #$PR still conflicts after a prior rebase request; closing so Dependabot reopens it fresh."
-                gh pr close "$PR" --repo "$REPO" --delete-branch \
-                  --comment "Closing: this PR still conflicts with $DEV_BRANCH after a rebase attempt (its changes are likely already merged). Dependabot will reopen a fresh PR computed against the current $DEV_BRANCH."
-              else
-                echo "  PR #$PR conflicts with $DEV_BRANCH; requesting a rebase and labelling it."
-                gh pr edit "$PR" --repo "$REPO" --add-label "$CONFLICT_LABEL"
-                gh pr comment "$PR" --repo "$REPO" --body "@dependabot rebase"
-              fi
-              echo "::endgroup::"
-              continue
-            fi
-
-            # A clean PR that was previously flagged has recovered - drop the label.
-            if has_conflict_label "$PR"; then
-              gh pr edit "$PR" --repo "$REPO" --remove-label "$CONFLICT_LABEL" || true
-            fi
-
-            echo "  Squash-merging PR #$PR"
-            if gh pr merge "$PR" --repo "$REPO" --squash --admin; then
-              echo "  Merged PR #$PR"
-              # Give GitHub a moment to mark the now-stale siblings BEHIND.
-              sleep 15
-            else
-              echo "  Could not merge PR #$PR now; it will be retried next run."
-            fi
-
-            echo "::endgroup::"
-          done

.github/workflows/docker.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: "Version to build (e.g., 1.8.0)"
+        description: "Version to build (e.g., 26.10.0)"
         required: true
       build_type:
         description: "Build type"
@@ -22,11 +22,11 @@ on:
   workflow_call:
     inputs:
       version:
-        description: "Version to build (e.g., 1.8.0)"
+        description: "Version to build (e.g., 26.10.0)"
         required: true
         type: string
       build_type:
-        description: "Build type (Development or Production)"
+        description: "Build type (Development, Beta or Production)"
         required: true
         type: string
       dry_run:
@@ -43,6 +43,7 @@ on:
 jobs:
   build:
     runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 20
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -51,7 +52,14 @@ jobs:
           fetch-depth: 1
 
       - name: Resolve source revision
-        run: echo "SOURCE_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+        run: |
+          echo "SOURCE_SHA=$(git rev-parse HEAD)" >> "$GITHUB_ENV"
+          echo "BUILD_CREATED=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_ENV"
+
+      # The image reads its version from package.json, so a beta has to say so.
+      - name: Stamp beta version
+        if: ${{ inputs.build_type == 'Beta' }}
+        run: node scripts/sync-version.cjs --version "${{ inputs.version }}"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v4
@@ -59,7 +67,9 @@ jobs:
           platforms: linux/amd64,linux/arm64
 
       - name: Setup Docker Buildx
-        uses: useblacksmith/setup-docker-builder@v1
+        uses: useblacksmith/setup-docker-builder@v2
+        with:
+          cache-key: termix-ssh/termix
 
       - name: Determine tags
         id: tags
@@ -71,25 +81,23 @@ jobs:
           ALL_TAGS=()
 
           if [ "$BUILD_TYPE" = "Production" ]; then
-            TAGS+=("release-$VERSION" "$VERSION" "latest")
-            for tag in "${TAGS[@]}"; do
-              ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
-              ALL_TAGS+=("docker.io/bugattiguy527/termix:$tag")
-            done
+            TAGS+=("$VERSION" "latest")
           elif [ "$BUILD_TYPE" = "Beta" ]; then
-            TAGS+=("beta" "beta-$VERSION")
-            for tag in "${TAGS[@]}"; do
-              ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
-              ALL_TAGS+=("docker.io/bugattiguy527/termix:$tag")
-            done
+            TAGS+=("beta" "$VERSION")
           else
             TAGS+=("dev-$VERSION")
-            for tag in "${TAGS[@]}"; do
-              ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
-            done
           fi
 
+          for tag in "${TAGS[@]}"; do
+            ALL_TAGS+=("ghcr.io/lukegus/termix:$tag")
+            ALL_TAGS+=("ghcr.io/termix-ssh/termix:$tag")
+            if [ "$BUILD_TYPE" != "Development" ]; then
+              ALL_TAGS+=("docker.io/bugattiguy527/termix:$tag")
+            fi
+          done
+
           echo "ALL_TAGS=$(IFS=,; echo "${ALL_TAGS[*]}")" >> $GITHUB_ENV
+          echo "TAGS=${TAGS[*]}" >> $GITHUB_ENV
 
       - name: Login to GHCR
         if: ${{ !inputs.dry_run }}
@@ -97,14 +105,14 @@ jobs:
         with:
           registry: ghcr.io
           username: lukegus
-          password: ${{ secrets.GHCR_TOKEN }}
+          password: ${{ secrets.TERMIX_PAT }}
 
       - name: Login to Docker Hub (prod and beta only)
         if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}
         uses: docker/login-action@v4
         with:
           username: bugattiguy527
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          password: ${{ secrets.DOCKERHUB_BUGATTIGUY527_TOKEN }}
 
       - name: Build and push multi-arch image
         uses: useblacksmith/build-push-action@v2
@@ -119,11 +127,29 @@ jobs:
           labels: |
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
             org.opencontainers.image.revision=${{ env.SOURCE_SHA }}
-            org.opencontainers.image.created=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+            org.opencontainers.image.created=${{ env.BUILD_CREATED }}
           outputs: ${{ inputs.dry_run && 'type=cacheonly' || 'type=registry,compression=zstd' }}
 
+      - name: Login to Docker Hub as termixssh
+        id: termix_hub
+        if: ${{ (inputs.build_type == 'Production' || inputs.build_type == 'Beta') && !inputs.dry_run }}
+        env:
+          TOKEN: ${{ secrets.DOCKERHUB_TERMIXSSH_TOKEN }}
+        run: |
+          if [ -z "$TOKEN" ]; then
+            echo "DOCKERHUB_TERMIXSSH_TOKEN is not set, skipping docker.io/termixssh"
+            exit 0
+          fi
+          echo "$TOKEN" | docker login docker.io --username termixssh --password-stdin
+          echo "ready=true" >> "$GITHUB_OUTPUT"
+
+      - name: Copy image to docker.io/termixssh
+        if: ${{ steps.termix_hub.outputs.ready == 'true' }}
+        run: |
+          for tag in $TAGS; do
+            docker buildx imagetools create --tag "docker.io/termixssh/termix:$tag" "ghcr.io/termix-ssh/termix:$tag"
+          done
+
       - name: Cleanup Docker
         if: always()
         run: |

.github/workflows/electron.yml

@@ -72,14 +72,65 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
 
+      - name: Install Spectre-mitigated MSVC libraries
+        shell: pwsh
+        run: |
+          # node-pty's binding.gyp sets SpectreMitigation, so MSBuild refuses to
+          # build without these. They are not on the runner image by default.
+          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+          $installPath = & $vswhere -latest -products * -property installationPath
+          if (-not $installPath) { throw "Visual Studio installation not found" }
+
+          # Derive the toolset version from the installed MSVC so the component
+          # id keeps matching when the runner image bumps the compiler.
+          $toolsetDir = Get-ChildItem -Path "$installPath\VC\Tools\MSVC" -Directory |
+            Sort-Object Name -Descending | Select-Object -First 1
+          if (-not $toolsetDir) { throw "No MSVC toolset found under $installPath" }
+          $parts = $toolsetDir.Name.Split(".")
+          $shortVer = "$($parts[0]).$($parts[1].Substring(0,2))"
+          Write-Host "MSVC toolset $($toolsetDir.Name) -> component version $shortVer"
+
+          $installer = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vs_installer.exe"
+          $components = @(
+            "Microsoft.VisualStudio.Component.VC.$shortVer.17.14.x86.x64.Spectre",
+            "Microsoft.VisualStudio.Component.VC.Runtimes.x86.x64.Spectre"
+          )
+          $args = @("modify", "--installPath", "`"$installPath`"", "--quiet", "--norestart", "--nocache")
+          foreach ($c in $components) { $args += @("--add", $c) }
+
+          Write-Host "Installing: $($components -join ', ')"
+          $proc = Start-Process -FilePath $installer -ArgumentList $args -Wait -PassThru -NoNewWindow
+          if ($proc.ExitCode -ne 0 -and $proc.ExitCode -ne 3010) {
+            Write-Host "vs_installer exited with $($proc.ExitCode); verifying libraries anyway"
+          }
+
+          $found = Get-ChildItem -Path "$installPath\VC\Tools\MSVC" -Recurse -Filter "*.lib" -ErrorAction SilentlyContinue |
+            Where-Object { $_.FullName -match "\\spectre\\" } | Select-Object -First 1
+          if (-not $found) { throw "Spectre-mitigated libraries still missing after install" }
+          Write-Host "Spectre libs present: $($found.FullName)"
+
       - name: Install dependencies
         run: npm ci
 
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
+      # A beta build has to know it is a beta, or it reports the stable version.
+      - name: Stamp beta version
+        if: inputs.version_override != ''
+        run: node scripts/sync-version.cjs --version "${{ inputs.version_override }}"
+
       - name: Get version
         id: package-version
         run: |
@@ -92,7 +143,12 @@ jobs:
       - name: Build Windows (All Architectures)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm run build && npx electron-builder --win --x64 --ia32
+        run: npm run build && npx electron-builder --win --x64 --ia32 --arm64 --publish never
+
+      # The updater only installs the x64 NSIS build; 32-bit and ARM installs get a link.
+      # The combined multi-arch installer is never uploaded.
+      - name: Fix Windows update files
+        run: node scripts/fix-update-info.cjs --drop ia32 --drop arm64 --drop termix_windows_nsis.exe release/latest.yml release/beta.yml
 
       - name: Upload Windows x64 NSIS Installer
         uses: actions/upload-artifact@v7
@@ -110,6 +166,14 @@ jobs:
           path: release/termix_windows_ia32_nsis.exe
           retention-days: 30
 
+      - name: Upload Windows arm64 NSIS Installer
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/termix_windows_arm64_nsis.exe') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_windows_arm64_nsis
+          path: release/termix_windows_arm64_nsis.exe
+          retention-days: 30
+
       - name: Upload Windows x64 MSI Installer
         uses: actions/upload-artifact@v7
         if: hashFiles('release/termix_windows_x64_msi.msi') != '' && inputs.artifact_destination != 'none'
@@ -126,6 +190,14 @@ jobs:
           path: release/termix_windows_ia32_msi.msi
           retention-days: 30
 
+      - name: Upload Windows arm64 MSI Installer
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/termix_windows_arm64_msi.msi') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_windows_arm64_msi
+          path: release/termix_windows_arm64_msi.msi
+          retention-days: 30
+
       - name: Create Windows x64 Portable zip
         if: hashFiles('release/win-unpacked/*') != ''
         run: |
@@ -136,6 +208,22 @@ jobs:
         run: |
           Compress-Archive -Path "release\win-ia32-unpacked\*" -DestinationPath "termix_windows_ia32_portable.zip"
 
+      - name: Create Windows arm64 Portable zip
+        if: hashFiles('release/win-arm64-unpacked/*') != ''
+        run: |
+          Compress-Archive -Path "release\win-arm64-unpacked\*" -DestinationPath "termix_windows_arm64_portable.zip"
+
+      - name: Upload Windows update files
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/*.yml') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_windows_update_meta
+          path: |
+            release/*.yml
+            release/termix_windows_x64_nsis.exe.blockmap
+            !release/builder-debug.yml
+          retention-days: 30
+
       - name: Upload Windows x64 Portable
         uses: actions/upload-artifact@v7
         if: hashFiles('termix_windows_x64_portable.zip') != '' && inputs.artifact_destination != 'none'
@@ -152,6 +240,14 @@ jobs:
           path: termix_windows_ia32_portable.zip
           retention-days: 30
 
+      - name: Upload Windows arm64 Portable
+        uses: actions/upload-artifact@v7
+        if: hashFiles('termix_windows_arm64_portable.zip') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_windows_arm64_portable
+          path: termix_windows_arm64_portable.zip
+          retention-days: 30
+
   build-linux:
     runs-on: blacksmith-8vcpu-ubuntu-2404
     if: (inputs.build_type == 'all' || inputs.build_type == 'linux' || inputs.build_type == '') && inputs.artifact_destination != 'submit'
@@ -166,7 +262,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -183,16 +279,30 @@ jobs:
           npm install --force @rollup/rollup-linux-arm64-gnu
           npm install --force @rollup/rollup-linux-arm-gnueabihf
 
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
+      # A beta build has to know it is a beta, or it reports the stable version.
+      - name: Stamp beta version
+        if: inputs.version_override != ''
+        run: node scripts/sync-version.cjs --version "${{ inputs.version_override }}"
+
       - name: Build Linux x64
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DEBUG: electron-builder
-        run: npm run build && npx electron-builder --linux --x64
+        run: npm run build && npx electron-builder --linux --x64 --publish never
 
       - name: Build Linux arm64 and armv7l
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npx electron-builder --linux --arm64 --armv7l
+        run: npx electron-builder --linux --arm64 --armv7l --publish never
 
       - name: Rename Linux artifacts for consistency
         run: |
@@ -208,6 +318,19 @@ jobs:
 
           cd ..
 
+          node scripts/fix-update-info.cjs \
+            --rename termix_linux_amd64_deb.deb=termix_linux_x64_deb.deb \
+            --rename termix_linux_x86_64_appimage.AppImage=termix_linux_x64_appimage.AppImage \
+            release/*-linux*.yml
+
+      - name: Upload Linux update files
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/*-linux*.yml') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_linux_update_meta
+          path: release/*-linux*.yml
+          retention-days: 30
+
       - name: Upload Linux x64 AppImage
         uses: actions/upload-artifact@v7
         if: hashFiles('release/termix_linux_x64_appimage.AppImage') != '' && inputs.artifact_destination != 'none'
@@ -318,8 +441,8 @@ jobs:
           convert public/icon.png -resize 128x128 flatpak-build/icon-128.png
 
           cd flatpak-build
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/release-VERSION_PLACEHOLDER-tag/termix_linux_x64_appimage.AppImage|file://$(realpath ../release/termix_linux_x64_appimage.AppImage)|g" com.karmaa.termix.yml
-          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/release-VERSION_PLACEHOLDER-tag/termix_linux_arm64_appimage.AppImage|file://$(realpath ../release/termix_linux_arm64_appimage.AppImage)|g" com.karmaa.termix.yml
+          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_x64_appimage.AppImage|file://$(realpath ../release/termix_linux_x64_appimage.AppImage)|g" com.karmaa.termix.yml
+          sed -i "s|https://github.com/Termix-SSH/Termix/releases/download/vVERSION_PLACEHOLDER/termix_linux_arm64_appimage.AppImage|file://$(realpath ../release/termix_linux_arm64_appimage.AppImage)|g" com.karmaa.termix.yml
           sed -i "s/CHECKSUM_X64_PLACEHOLDER/$CHECKSUM_X64/g" com.karmaa.termix.yml
           sed -i "s/CHECKSUM_ARM64_PLACEHOLDER/$CHECKSUM_ARM64/g" com.karmaa.termix.yml
           sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" com.karmaa.termix.metainfo.xml
@@ -345,7 +468,7 @@ jobs:
         run: |
           VERSION="${{ steps.flatpak-version.outputs.version }}"
           cp packaging/flatpak/com.karmaa.termix.flatpakref release/
-          sed -i "s|VERSION_PLACEHOLDER|release-${VERSION}-tag|g" release/com.karmaa.termix.flatpakref
+          sed -i "s|VERSION_PLACEHOLDER|v${VERSION}|g" release/com.karmaa.termix.flatpakref
 
       - name: Upload Flatpak bundle
         uses: actions/upload-artifact@v7
@@ -380,7 +503,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -390,6 +513,21 @@ jobs:
           npm ci
           npm install --force @rollup/rollup-darwin-arm64
           npm install dmg-license
+          node scripts/install-macos-sharp.cjs
+
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
+      # A beta build has to know it is a beta, or it reports the stable version.
+      - name: Stamp beta version
+        if: inputs.version_override != ''
+        run: node scripts/sync-version.cjs --version "${{ inputs.version_override }}"
 
       - name: Check for Code Signing Certificates
         id: check_certs
@@ -430,17 +568,18 @@ jobs:
 
           security find-identity -v -p codesigning $KEYCHAIN_PATH
 
+      # Betas never go to the App Store, so they skip the MAS package.
       - name: Build macOS App Store Package
-        if: steps.check_certs.outputs.has_certs == 'true'
+        id: mas_build
+        if: steps.check_certs.outputs.has_certs == 'true' && inputs.version_override == ''
         env:
           ELECTRON_BUILDER_ALLOW_UNRESOLVED_DEPENDENCIES: true
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_OPTIONS: --max-old-space-size=4096
         run: |
-          CURRENT_VERSION=$(node -p "require('./package.json').version")
           BUILD_VERSION="${{ github.run_number }}"
 
-          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
+          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION" --publish never
 
       - name: Clean up MAS keychain before DMG build
         if: steps.check_certs.outputs.has_certs == 'true'
@@ -496,17 +635,49 @@ jobs:
           NODE_OPTIONS: --max-old-space-size=4096
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          if [ "${{ steps.check_certs.outputs.has_certs }}" != "true" ]; then
+          if [ "${{ steps.mas_build.outcome }}" != "success" ]; then
             npm run build
           fi
-          npx electron-builder --mac dmg --universal --x64 --arm64 --publish never
+          npx electron-builder --mac dmg zip --universal --x64 --arm64 --publish never
+
+      # The updater picks the x64 or arm64 zip, so the universal one is left out.
+      - name: Fix macOS update files
+        run: node scripts/fix-update-info.cjs --drop universal release/*-mac.yml
+
+      - name: Upload macOS update files
+        uses: actions/upload-artifact@v7
+        if: hashFiles('release/*-mac.yml') != '' && inputs.artifact_destination != 'none'
+        with:
+          name: termix_macos_update_meta
+          path: |
+            release/*-mac.yml
+            release/termix_macos_x64_update.zip
+            release/termix_macos_x64_update.zip.blockmap
+            release/termix_macos_arm64_update.zip
+            release/termix_macos_arm64_update.zip.blockmap
+          retention-days: 30
+
+      - name: Verify macOS sharp packaging
+        run: |
+          artifacts=(release/termix_macos_*_dmg.dmg)
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          if [ -n "$MAS_PKG" ]; then
+            artifacts+=("$MAS_PKG")
+          fi
+          node scripts/verify-macos-sharp.cjs "${artifacts[@]}"
+
+      - name: Locate macOS MAS PKG
+        id: locate_mas_pkg
+        run: |
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          echo "path=$MAS_PKG" >> "$GITHUB_OUTPUT"
 
       - name: Upload macOS MAS PKG
-        if: steps.check_certs.outputs.has_certs == 'true' && hashFiles('release/termix_macos_universal_mas.pkg') != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release' || inputs.artifact_destination == 'submit')
+        if: steps.mas_build.outcome == 'success' && steps.locate_mas_pkg.outputs.path != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release' || inputs.artifact_destination == 'submit')
         uses: actions/upload-artifact@v7
         with:
           name: termix_macos_universal_mas
-          path: release/termix_macos_universal_mas.pkg
+          path: ${{ steps.locate_mas_pkg.outputs.path }}
           retention-days: 30
           if-no-files-found: warn
 
@@ -559,13 +730,13 @@ jobs:
           CHECKSUM=$(shasum -a 256 "$DMG_PATH" | awk '{print $1}')
 
           mkdir -p homebrew-generated
-          cp packaging/Casks/termix.rb homebrew-generated/termix.rb
+          cp Casks/termix.rb homebrew-generated/termix.rb
 
           sed -i '' "s/VERSION_PLACEHOLDER/$VERSION/g" homebrew-generated/termix.rb
           sed -i '' "s/CHECKSUM_PLACEHOLDER/$CHECKSUM/g" homebrew-generated/termix.rb
           sed -i '' "s|version \".*\"|version \"$VERSION\"|g" homebrew-generated/termix.rb
           sed -i '' "s|sha256 \".*\"|sha256 \"$CHECKSUM\"|g" homebrew-generated/termix.rb
-          sed -i '' "s|release-[0-9.]*-tag|release-$VERSION-tag|g" homebrew-generated/termix.rb
+          sed -i '' "s|download/[^/]*/termix_macos|download/v$VERSION/termix_macos|g" homebrew-generated/termix.rb
 
       - name: Upload Homebrew Cask as artifact
         uses: actions/upload-artifact@v7
@@ -581,7 +752,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           VERSION="${{ steps.homebrew-version.outputs.version }}"
-          RELEASE_TAG="release-$VERSION-tag"
+          RELEASE_TAG="v$VERSION"
 
           gh release list --repo ${{ github.repository }} --limit 100 | grep -q "$RELEASE_TAG" || {
             echo "Release $RELEASE_TAG not found"
@@ -620,7 +791,7 @@ jobs:
         run: |
           $VERSION = "${{ steps.package-version.outputs.version }}"
           $MSI_NAME = "termix_windows_x64_msi.msi"
-          $DOWNLOAD_URL = "https://github.com/Termix-SSH/Termix/releases/download/release-$($VERSION)-tag/$($MSI_NAME)"
+          $DOWNLOAD_URL = "https://github.com/Termix-SSH/Termix/releases/download/v$($VERSION)/$($MSI_NAME)"
 
           Write-Host "Downloading from $DOWNLOAD_URL"
           New-Item -ItemType Directory -Force -Path "release_asset"
@@ -643,7 +814,7 @@ jobs:
           $CHECKSUM = "${{ steps.msi-info.outputs.checksum }}"
           $MSI_NAME = "${{ steps.msi-info.outputs.msi_name }}"
 
-          $DOWNLOAD_URL = "https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$MSI_NAME"
+          $DOWNLOAD_URL = "https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$MSI_NAME"
 
           New-Item -ItemType Directory -Force -Path "choco-build"
           Copy-Item -Path "packaging\chocolatey\*" -Destination "choco-build" -Recurse -Force
@@ -669,7 +840,7 @@ jobs:
           choco pack termix-ssh.nuspec
 
           if ($LASTEXITCODE -ne 0) {
-            throw "Chocolatey push failed with exit code $LASTEXITCODE"
+            throw "Chocolatey pack failed with exit code $LASTEXITCODE"
           }
 
       - name: Check for Chocolatey API Key
@@ -702,144 +873,6 @@ jobs:
           path: choco-build/*.nupkg
           retention-days: 30
 
-  submit-to-flatpak:
-    runs-on: blacksmith-8vcpu-ubuntu-2404
-    if: inputs.artifact_destination == 'submit' && (inputs.build_type == 'all' || inputs.build_type == 'linux' || inputs.build_type == '')
-    needs: []
-    permissions:
-      contents: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ inputs.source_ref || github.ref }}
-          fetch-depth: 1
-
-      - name: Get version from package.json
-        id: package-version
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          RELEASE_DATE=$(date +%Y-%m-%d)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "release_date=$RELEASE_DATE" >> $GITHUB_OUTPUT
-
-      - name: Download and prepare AppImage info from public release
-        id: appimage-info
-        run: |
-          VERSION="${{ steps.package-version.outputs.version }}"
-          mkdir -p release_assets
-
-          APPIMAGE_X64_NAME="termix_linux_x64_appimage.AppImage"
-          URL_X64="https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$APPIMAGE_X64_NAME"
-          PATH_X64="release_assets/$APPIMAGE_X64_NAME"
-          echo "Downloading x64 AppImage from $URL_X64"
-          curl -L -o "$PATH_X64" "$URL_X64"
-          chmod +x "$PATH_X64"
-          CHECKSUM_X64=$(sha256sum "$PATH_X64" | awk '{print $1}')
-
-          APPIMAGE_ARM64_NAME="termix_linux_arm64_appimage.AppImage"
-          URL_ARM64="https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$APPIMAGE_ARM64_NAME"
-          PATH_ARM64="release_assets/$APPIMAGE_ARM64_NAME"
-          echo "Downloading arm64 AppImage from $URL_ARM64"
-          curl -L -o "$PATH_ARM64" "$URL_ARM64"
-          chmod +x "$PATH_ARM64"
-          CHECKSUM_ARM64=$(sha256sum "$PATH_ARM64" | awk '{print $1}')
-
-          echo "appimage_x64_name=$APPIMAGE_X64_NAME" >> $GITHUB_OUTPUT
-          echo "checksum_x64=$CHECKSUM_X64" >> $GITHUB_OUTPUT
-          echo "appimage_arm64_name=$APPIMAGE_ARM64_NAME" >> $GITHUB_OUTPUT
-          echo "checksum_arm64=$CHECKSUM_ARM64" >> $GITHUB_OUTPUT
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y imagemagick
-
-      - name: Prepare Flatpak submission files
-        run: |
-          VERSION="${{ steps.package-version.outputs.version }}"
-          CHECKSUM_X64="${{ steps.appimage-info.outputs.checksum_x64 }}"
-          CHECKSUM_ARM64="${{ steps.appimage-info.outputs.checksum_arm64 }}"
-          RELEASE_DATE="${{ steps.package-version.outputs.release_date }}"
-
-          mkdir -p flatpak-submission
-
-          cp packaging/flatpak/com.karmaa.termix.yml flatpak-submission/
-          cp packaging/flatpak/com.karmaa.termix.desktop flatpak-submission/
-          cp packaging/flatpak/com.karmaa.termix.metainfo.xml flatpak-submission/
-          cp packaging/flatpak/flathub.json flatpak-submission/
-
-          cp public/icon.svg flatpak-submission/com.karmaa.termix.svg
-          convert public/icon.png -resize 256x256 flatpak-submission/icon-256.png
-          convert public/icon.png -resize 128x128 flatpak-submission/icon-128.png
-
-          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" flatpak-submission/com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_X64_PLACEHOLDER/$CHECKSUM_X64/g" flatpak-submission/com.karmaa.termix.yml
-          sed -i "s/CHECKSUM_ARM64_PLACEHOLDER/$CHECKSUM_ARM64/g" flatpak-submission/com.karmaa.termix.yml
-
-          sed -i "s/VERSION_PLACEHOLDER/$VERSION/g" flatpak-submission/com.karmaa.termix.metainfo.xml
-          sed -i "s/DATE_PLACEHOLDER/$RELEASE_DATE/g" flatpak-submission/com.karmaa.termix.metainfo.xml
-
-      - name: Upload Flatpak submission as artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: flatpak-submission
-          path: flatpak-submission/*
-          retention-days: 30
-
-      - name: Check for Flathub token
-        id: check_flathub_token
-        run: |
-          if [ -n "${{ secrets.FLATHUB_TOKEN }}" ]; then
-            echo "has_token=true" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Open PR on Flathub repo
-        if: steps.check_flathub_token.outputs.has_token == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.FLATHUB_TOKEN }}
-          VERSION: ${{ steps.package-version.outputs.version }}
-        run: |
-          FLATHUB_REPO="flathub/com.karmaa.termix"
-          BRANCH="release-$VERSION"
-
-          git config --global user.name "LukeGus"
-          git config --global user.email "bugattiguy527@gmail.com"
-
-          git clone "https://x-access-token:${GH_TOKEN}@github.com/${FLATHUB_REPO}.git" flathub-repo
-          cd flathub-repo
-
-          git checkout -b "$BRANCH"
-
-          cp ../flatpak-submission/com.karmaa.termix.yml ./
-          cp ../flatpak-submission/com.karmaa.termix.desktop ./
-          cp ../flatpak-submission/com.karmaa.termix.metainfo.xml ./
-          cp ../flatpak-submission/flathub.json ./
-          cp ../flatpak-submission/com.karmaa.termix.svg ./
-          cp ../flatpak-submission/icon-256.png ./
-          cp ../flatpak-submission/icon-128.png ./
-
-          if git diff --quiet && git diff --cached --quiet; then
-            echo "No changes to submit for $VERSION; Flathub repo already up to date."
-            exit 0
-          fi
-
-          git add -A
-          git commit -m "Update to $VERSION"
-          git push origin "$BRANCH"
-
-          EXISTING_PR=$(gh pr list --repo "$FLATHUB_REPO" --head "$BRANCH" --state open --json number -q '.[0].number' || true)
-          if [ -z "$EXISTING_PR" ]; then
-            gh pr create --repo "$FLATHUB_REPO" \
-              --base master \
-              --head "$BRANCH" \
-              --title "Update to $VERSION" \
-              --body "Automated release update to version $VERSION."
-          else
-            echo "PR #$EXISTING_PR already open for $BRANCH."
-          fi
-
   submit-to-homebrew:
     runs-on: blacksmith-6vcpu-macos-latest
     if: inputs.artifact_destination == 'submit' && (inputs.build_type == 'all' || inputs.build_type == 'macos')
@@ -865,7 +898,7 @@ jobs:
         run: |
           VERSION="${{ steps.package-version.outputs.version }}"
           DMG_NAME="termix_macos_universal_dmg.dmg"
-          URL="https://github.com/Termix-SSH/Termix/releases/download/release-$VERSION-tag/$DMG_NAME"
+          URL="https://github.com/Termix-SSH/Termix/releases/download/v$VERSION/$DMG_NAME"
 
           mkdir -p release_asset
           DOWNLOAD_PATH="release_asset/$DMG_NAME"
@@ -886,6 +919,9 @@ jobs:
           echo "dmg_name=$DMG_NAME" >> $GITHUB_OUTPUT
           echo "checksum=$CHECKSUM" >> $GITHUB_OUTPUT
 
+      - name: Verify macOS sharp packaging
+        run: node scripts/verify-macos-sharp.cjs release_asset/termix_macos_universal_dmg.dmg
+
       - name: Prepare Homebrew submission files
         run: |
           VERSION="${{ steps.package-version.outputs.version }}"
@@ -894,10 +930,10 @@ jobs:
 
           mkdir -p homebrew-submission/Casks/t
 
-          cp packaging/Casks/termix.rb homebrew-submission/Casks/t/termix.rb
+          cp Casks/termix.rb homebrew-submission/Casks/t/termix.rb
 
-          sed -i '' "s/VERSION_PLACEHOLDER/$VERSION/g" homebrew-submission/Casks/t/termix.rb
-          sed -i '' "s/CHECKSUM_PLACEHOLDER/$CHECKSUM/g" homebrew-submission/Casks/t/termix.rb
+          sed -i '' "s|version \".*\"|version \"$VERSION\"|g" homebrew-submission/Casks/t/termix.rb
+          sed -i '' "s|sha256 \".*\"|sha256 \"$CHECKSUM\"|g" homebrew-submission/Casks/t/termix.rb
 
       - name: Verify Cask syntax
         run: |
@@ -935,18 +971,15 @@ jobs:
             echo "RELEASE_TAG=$(gh release list --repo ${{ github.repository }} --limit 1 --json tagName -q '.[0].tagName')" >> $GITHUB_ENV
           fi
 
+      # Update files go up last: the desktop updater treats a release as ready
+      # once its update file is there, so every installer must already be up.
       - name: Upload artifacts to latest release
         run: |
-          cd artifacts
-          for dir in */; do
-            cd "$dir"
-            for file in *;
-            do
-              if [ -f "$file" ]; then
-                gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
-              fi
-            done
-            cd ..
+          find artifacts -type f ! -name '*.yml' -print0 | while IFS= read -r -d '' file; do
+            gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
+          done
+          find artifacts -type f -name '*.yml' -print0 | while IFS= read -r -d '' file; do
+            gh release upload "$RELEASE_TAG" "$file" --repo ${{ github.repository }} --clobber
           done
         env:
           GH_TOKEN: ${{ github.token }}
@@ -966,7 +999,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -976,6 +1009,16 @@ jobs:
           npm ci
           npm install --force @rollup/rollup-darwin-arm64
           npm install dmg-license
+          node scripts/install-macos-sharp.cjs
+
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
 
       - name: Check for Code Signing Certificates
         id: check_certs
@@ -1016,16 +1059,6 @@ jobs:
 
           security find-identity -v -p codesigning $KEYCHAIN_PATH
 
-      - name: Build macOS App Store Package
-        if: steps.check_certs.outputs.has_certs == 'true'
-        env:
-          ELECTRON_BUILDER_ALLOW_UNRESOLVED_DEPENDENCIES: true
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_OPTIONS: --max-old-space-size=4096
-        run: |
-          BUILD_VERSION="${{ github.run_number }}"
-          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
-
       - name: Check for App Store Connect API credentials
         id: check_asc_creds
         run: |
@@ -1044,24 +1077,16 @@ jobs:
         if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
         run: gem install fastlane -N
 
-      - name: Upload and submit to Mac App Store
+      - name: Write App Store Connect API key
         if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
         env:
           APPLE_KEY_ID: ${{ secrets.APPLE_KEY_ID }}
           APPLE_ISSUER_ID: ${{ secrets.APPLE_ISSUER_ID }}
           APPLE_KEY_CONTENT: ${{ secrets.APPLE_KEY_CONTENT }}
         run: |
-          PKG_FILE=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
-          if [ -z "$PKG_FILE" ]; then
-            echo "PKG file not found in release/; aborting."
-            exit 1
-          fi
-
-          VERSION=$(node -p "require('./package.json').version")
-
-          # Write API key JSON that Fastlane deliver expects; the PEM's
-          # newlines must be preserved as literal \n escapes, not stripped,
-          # or spaceship fails to parse the key (invalid curve name).
+          # Write API key JSON that Fastlane expects; the PEM's newlines
+          # must be preserved as literal \n escapes, not stripped, or
+          # spaceship fails to parse the key (invalid curve name).
           mkdir -p /tmp/asc_keys
           KEY_P8_PATH="/tmp/asc_keys/AuthKey_${APPLE_KEY_ID}.p8"
           API_KEY_JSON="/tmp/asc_keys/api_key.json"
@@ -1080,14 +1105,152 @@ jobs:
               }, null, 2) + "\n");
             ' > "$API_KEY_JSON"
 
+      - name: Resolve next build number from App Store Connect
+        id: build_number
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
+        run: |
+          APP_VERSION=$(node -p "require('./package.json').version")
+          OUT_FILE="$RUNNER_TEMP/latest_build_number.txt"
+          LANE_DIR="$RUNNER_TEMP/asc_lane/fastlane"
+          mkdir -p "$LANE_DIR"
+
+          cat > "$LANE_DIR/Fastfile" <<EOF
+          default_platform(:mac)
+
+          lane :fetch_build_number do
+            live_number = app_store_build_number(
+              live: true,
+              platform: "osx",
+              api_key_path: "/tmp/asc_keys/api_key.json",
+              app_identifier: "com.karmaa.termix",
+              initial_build_number: 0,
+            )
+            pending_number = app_store_build_number(
+              live: false,
+              platform: "osx",
+              api_key_path: "/tmp/asc_keys/api_key.json",
+              app_identifier: "com.karmaa.termix",
+              initial_build_number: 0,
+            )
+            number = [live_number, pending_number].max
+            File.write("$OUT_FILE", number.to_s)
+          end
+          EOF
+
+          (cd "$RUNNER_TEMP/asc_lane" && fastlane fetch_build_number) 2>&1 || true
+
+          LATEST=""
+          if [ -f "$OUT_FILE" ]; then
+            LATEST=$(cat "$OUT_FILE" | tr -d '[:space:]')
+          fi
+
+          if ! [[ "$LATEST" =~ ^[0-9]+$ ]]; then
+            echo "Could not resolve latest build number from App Store Connect; falling back to run number."
+            LATEST="${{ github.run_number }}"
+          fi
+          echo "build_version=$((LATEST + 1))" >> "$GITHUB_OUTPUT"
+
+      - name: Build macOS App Store Package
+        if: steps.check_certs.outputs.has_certs == 'true'
+        env:
+          ELECTRON_BUILDER_ALLOW_UNRESOLVED_DEPENDENCIES: true
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_OPTIONS: --max-old-space-size=4096
+        run: |
+          BUILD_VERSION="${{ steps.build_number.outputs.build_version || github.run_number }}"
+          npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION" --publish never
+
+      - name: Verify macOS sharp packaging
+        if: steps.check_certs.outputs.has_certs == 'true'
+        run: |
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          if [ -z "$MAS_PKG" ]; then
+            echo "MAS pkg not found under release/; aborting."
+            exit 1
+          fi
+          node scripts/verify-macos-sharp.cjs "$MAS_PKG"
+
+      - name: Generate App Store release notes
+        id: asc_notes
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
+        run: |
+          META_DIR="$RUNNER_TEMP/asc_metadata"
+          rm -rf "$META_DIR"
+          node scripts/generate-appstore-notes.cjs \
+            --changelog CHANGELOG.md \
+            --out-dir "$META_DIR" \
+            --locales "en-US"
+          echo "metadata_path=$META_DIR" >> "$GITHUB_OUTPUT"
+
+      # Apple won't create a new version while the last one is still in
+      # review. Pull it out so deliver can rename it to this version.
+      - name: Cancel pending App Store review
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
+        run: |
+          LANE_DIR="$RUNNER_TEMP/asc_cancel/fastlane"
+          mkdir -p "$LANE_DIR"
+
+          cat > "$LANE_DIR/Fastfile" <<'EOF'
+          default_platform(:mac)
+
+          lane :cancel_pending_review do
+            Spaceship::ConnectAPI.token = Spaceship::ConnectAPI::Token.from_json_file("/tmp/asc_keys/api_key.json")
+            app = Spaceship::ConnectAPI::App.find("com.karmaa.termix")
+            UI.user_error!("App not found") unless app
+
+            app.get_app_store_versions(filter: { platform: "MAC_OS" }, limit: 5).each do |v|
+              UI.message("Version #{v.version_string}: #{v.app_version_state || v.app_store_state}")
+            end
+
+            active = %w[WAITING_FOR_REVIEW IN_REVIEW UNRESOLVED_ISSUES]
+            canceled = false
+            app.get_review_submissions(filter: { platform: "MAC_OS" }).each do |sub|
+              UI.message("Review submission #{sub.id}: #{sub.state}")
+              next unless active.include?(sub.state)
+              sub.cancel_submission
+              canceled = true
+              UI.important("Canceled review submission #{sub.id}")
+            end
+            next unless canceled
+
+            30.times do
+              busy = app.get_review_submissions(filter: { platform: "MAC_OS" }).any? do |sub|
+                (active + %w[CANCELING]).include?(sub.state)
+              end
+              break unless busy
+              sleep(10)
+            end
+          end
+          EOF
+
+          cd "$RUNNER_TEMP/asc_cancel" && fastlane cancel_pending_review
+
+      - name: Upload and submit to Mac App Store
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'
+        run: |
+          PKG_FILE=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          if [ -z "$PKG_FILE" ]; then
+            echo "PKG file not found in release/; aborting."
+            exit 1
+          fi
+
+          VERSION=$(node -p "require('./package.json').version")
+          API_KEY_JSON="/tmp/asc_keys/api_key.json"
+
           fastlane deliver \
             --pkg "$PKG_FILE" \
             --api_key_path "$API_KEY_JSON" \
             --app_version "$VERSION" \
-            --skip_metadata true \
+            --platform osx \
+            --app_identifier "com.karmaa.termix" \
+            --skip_metadata false \
+            --metadata_path "${{ steps.asc_notes.outputs.metadata_path }}" \
             --skip_screenshots true \
+            --skip_app_version_update false \
             --submit_for_review true \
             --automatic_release true \
+            --precheck_include_in_app_purchases false \
+            --submission_information "{\"export_compliance_uses_encryption\": false}" \
             --force true
 
       - name: Clean up keychains

.github/workflows/openapi.yml

@@ -1,32 +0,0 @@
-name: Generate OpenAPI Specification
-
-on:
-  workflow_dispatch:
-
-jobs:
-  generate-openapi:
-    name: Generate OpenAPI JSON
-    runs-on: blacksmith-2vcpu-ubuntu-2404
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v7
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Generate OpenAPI specification
-        run: npm run generate:openapi
-
-      - name: Upload OpenAPI artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: openapi-spec
-          path: openapi.json
-          retention-days: 90

.github/workflows/pr-check.yml

@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -24,14 +24,97 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Run ESLint
-        run: npx eslint .
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
+      - name: Lint
+        run: npm run lint
 
       - name: Run Prettier check
         run: npx prettier --check .
 
       - name: Type check
-        run: npx tsc --noEmit
+        run: npm run type-check
 
       - name: Build
         run: npm run build
+
+      - name: Run unit tests
+        run: npm run test
+
+  database-dialects:
+    name: Postgres and MySQL
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: termix
+          POSTGRES_PASSWORD: termix
+          POSTGRES_DB: termix_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+      mysql:
+        image: mysql:8
+        env:
+          MYSQL_ROOT_PASSWORD: termix
+          MYSQL_DATABASE: termix_test
+          MYSQL_USER: termix
+          MYSQL_PASSWORD: termix
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd "mysqladmin ping -h 127.0.0.1 -ptermix"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 10
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
+      - name: Verify Postgres
+        run: npm run verify:dialect -- postgres://termix:termix@127.0.0.1:5432/termix_test
+
+      - name: Verify MySQL
+        run: npm run verify:dialect -- mysql://termix:termix@127.0.0.1:3306/termix_test
+
+      - name: Repository tests on Postgres
+        env:
+          TEST_DIALECT: postgres
+          TEST_DATABASE_URL: postgres://termix:termix@127.0.0.1:5432/termix_test
+        run: npx vitest run src/backend/tests/database/repositories --no-file-parallelism
+
+      - name: Repository tests on MySQL
+        env:
+          TEST_DIALECT: mysql
+          TEST_DATABASE_URL: mysql://termix:termix@127.0.0.1:3306/termix_test
+        run: npx vitest run src/backend/tests/database/repositories --no-file-parallelism

.github/workflows/publish-sdk.yml

@@ -0,0 +1,84 @@
+name: Publish SDK
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: "Publish mode"
+        required: true
+        default: Publish
+        type: choice
+        options:
+          - Publish
+          - Dry run
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish @termix-ssh/plugin-sdk
+    runs-on: ubuntu-latest
+
+    env:
+      NODE_OPTIONS: "--max-old-space-size=4096"
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+          cache: npm
+          registry-url: https://registry.npmjs.org
+
+      - name: Update npm
+        run: npm install -g npm@^11.19.0
+
+      - run: npm ci
+
+      - name: Check the version is new
+        run: |
+          VERSION=$(node -p "require('./packages/plugin-sdk/package.json').version")
+          if npm view "@termix-ssh/plugin-sdk@$VERSION" version >/dev/null 2>&1; then
+            echo "@termix-ssh/plugin-sdk@$VERSION is already on npm. Bump packages/plugin-sdk/package.json first."
+            if [ "${{ inputs.mode }}" = "Publish" ]; then
+              exit 1
+            fi
+          fi
+          echo "Publishing @termix-ssh/plugin-sdk@$VERSION"
+
+      - run: npm run build:sdk
+
+      - run: npm run lint
+
+      - run: npm run type-check
+
+      - run: npm run test
+
+      - name: Publish
+        run: |
+          if [ "${{ inputs.mode }}" = "Dry run" ]; then
+            npm publish --workspace @termix-ssh/plugin-sdk --provenance --access public --dry-run
+          else
+            npm publish --workspace @termix-ssh/plugin-sdk --provenance --access public
+          fi
+
+      - name: Tag and release
+        if: ${{ inputs.mode == 'Publish' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION=$(node -p "require('./packages/plugin-sdk/package.json').version")
+          node -e "
+            const fs = require('fs');
+            const { changelogSection } = require('./packages/plugin-sdk/dist/changelog.js');
+            const notes = changelogSection(fs.readFileSync('packages/plugin-sdk/CHANGELOG.md', 'utf8'), process.argv[1]);
+            fs.writeFileSync('sdk-notes.md', notes);
+          " "$VERSION"
+          gh release create "sdk-v$VERSION" \
+            --target "${{ github.sha }}" \
+            --title "Plugin SDK v$VERSION" \
+            --notes-file sdk-notes.md \
+            --latest=false

.github/workflows/release.yml

@@ -1,10 +1,24 @@
 name: Release
 
+# Stable: run by hand from a dev-X.Y.Z branch. Beta: run by hand from a dev
+# branch, or let the Tuesday and Friday schedule snapshot the newest dev
+# branch when it moved since the last beta.
+
 on:
+  schedule:
+    - cron: "0 15 * * 2,5"
   workflow_dispatch:
     inputs:
+      channel:
+        description: "Stable release or beta"
+        required: true
+        default: Stable
+        type: choice
+        options:
+          - Stable
+          - Beta
       mode:
-        description: "Release mode"
+        description: "Release mode (Overwrite release is stable only)"
         required: true
         default: Everything
         type: choice
@@ -17,23 +31,45 @@ on:
 permissions:
   contents: write
 
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
   prep:
     runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
-      version: ${{ steps.info.outputs.version }}
-      release_tag: ${{ steps.info.outputs.release_tag }}
+      channel: ${{ steps.mode.outputs.channel }}
+      mode: ${{ steps.mode.outputs.mode }}
+      skip: ${{ steps.beta.outputs.skip || 'false' }}
+      version: ${{ steps.info.outputs.version || steps.beta.outputs.version }}
+      release_tag: ${{ steps.info.outputs.release_tag || steps.beta.outputs.release_tag }}
       mobile_version: ${{ steps.info.outputs.mobile_version }}
-      dev_branch: ${{ steps.info.outputs.dev_branch }}
+      mobile_tag: ${{ steps.info.outputs.mobile_tag }}
+      dev_branch: ${{ steps.info.outputs.dev_branch || steps.beta.outputs.dev_branch }}
+      sha: ${{ steps.beta.outputs.sha }}
+      prev_ref: ${{ steps.beta.outputs.prev_ref }}
     steps:
+      - name: Resolve channel and mode
+        id: mode
+        run: |
+          CHANNEL="${{ inputs.channel || 'Beta' }}"
+          MODE="${{ inputs.mode || 'Everything' }}"
+          echo "channel=$CHANNEL" >> "$GITHUB_OUTPUT"
+          echo "mode=$MODE" >> "$GITHUB_OUTPUT"
+          if [ "$CHANNEL" = "Beta" ] && [ "$MODE" = "Overwrite release" ]; then
+            echo "Overwrite release is for stable releases only."
+            exit 1
+          fi
+
       - name: Guard branch (release modes)
-        if: ${{ inputs.mode != 'Overwrite release' && !startsWith(github.ref, 'refs/heads/dev-') }}
+        if: ${{ github.event_name == 'workflow_dispatch' && steps.mode.outputs.mode != 'Overwrite release' && !startsWith(github.ref, 'refs/heads/dev-') }}
         run: |
           echo "This mode must be run from a dev branch (got ${{ github.ref }})."
           exit 1
 
       - name: Guard branch (overwrite mode)
-        if: ${{ inputs.mode == 'Overwrite release' && github.ref != 'refs/heads/main' }}
+        if: ${{ steps.mode.outputs.mode == 'Overwrite release' && github.ref != 'refs/heads/main' }}
         run: |
           echo "Overwrite release must be run from main (got ${{ github.ref }})."
           exit 1
@@ -44,16 +80,17 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
 
       - name: Resolve versions
         id: info
+        if: ${{ steps.mode.outputs.channel == 'Stable' }}
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          if [ "${{ inputs.mode }}" = "Overwrite release" ]; then
+          if [ "${{ steps.mode.outputs.mode }}" = "Overwrite release" ]; then
             DEV_BRANCH=""
             VERSION=$(node -p "require('./package.json').version")
           else
@@ -62,37 +99,128 @@ jobs:
           fi
           echo "dev_branch=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "release_tag=release-$VERSION-tag" >> "$GITHUB_OUTPUT"
+          echo "release_tag=v$VERSION" >> "$GITHUB_OUTPUT"
 
           MOBILE_RAW=$(gh release view -R Termix-SSH/Mobile --json tagName -q .tagName)
-          MOBILE_VERSION=$(echo "$MOBILE_RAW" | sed -E 's/^release-//; s/-tag$//')
+          MOBILE_VERSION=$(echo "$MOBILE_RAW" | sed -E 's/^release-//; s/-tag$//; s/^v//')
           if [ -z "$MOBILE_VERSION" ]; then
             echo "Failed to resolve the latest Termix-SSH/Mobile release version."
             exit 1
           fi
           echo "mobile_version=$MOBILE_VERSION" >> "$GITHUB_OUTPUT"
+          echo "mobile_tag=$MOBILE_RAW" >> "$GITHUB_OUTPUT"
 
-      - name: Validate release notes
+      - name: Check CHANGELOG.md has notes for this version
+        if: ${{ steps.mode.outputs.channel == 'Stable' }}
         run: |
           node scripts/generate-release-body.cjs \
             --version "${{ steps.info.outputs.version }}" \
             --mobile-version "${{ steps.info.outputs.mobile_version }}" \
-            --notes RELEASE_NOTES.md > /dev/null
+            --mobile-tag "${{ steps.info.outputs.mobile_tag }}" > /dev/null
 
-  normalize:
+      - name: Resolve beta version
+        id: beta
+        if: ${{ steps.mode.outputs.channel == 'Beta' }}
+        env:
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+        run: |
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            REFS=$(gh api "repos/${{ github.repository }}/branches" --paginate -q '.[].name')
+            if ! DEV_BRANCH=$(printf '%s\n' "$REFS" | node scripts/latest-dev-branch.cjs 2>/dev/null); then
+              echo "No dev-X.Y.Z branch is open, so no beta today."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          else
+            DEV_BRANCH="${GITHUB_REF#refs/heads/}"
+          fi
+
+          BASE=$(node scripts/parse-dev-branch.cjs "$DEV_BRANCH")
+          SHA=$(gh api "repos/${{ github.repository }}/branches/$DEV_BRANCH" -q .commit.sha)
+          TAGS=$(gh api "repos/${{ github.repository }}/git/matching-refs/tags/v$BASE-beta." -q '.[].ref' | sed 's#^refs/tags/##')
+          LATEST=$(printf '%s\n' "$TAGS" | node scripts/beta-version.cjs "$BASE" --latest)
+          VERSION=$(printf '%s\n' "$TAGS" | node scripts/beta-version.cjs "$BASE")
+
+          if [ -n "$LATEST" ]; then
+            LATEST_SHA=$(gh api "repos/${{ github.repository }}/commits/$LATEST" -q .sha)
+            if [ "$LATEST_SHA" = "$SHA" ] && [ "${{ github.event_name }}" = "schedule" ]; then
+              echo "$DEV_BRANCH has not moved since $LATEST, so no beta today."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            PREV="$LATEST"
+          else
+            PREV=$(gh release view --repo ${{ github.repository }} --json tagName -q .tagName 2>/dev/null || true)
+          fi
+
+          echo "Beta $VERSION from $DEV_BRANCH @ $SHA, changes since ${PREV:-nothing}"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "dev_branch=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "release_tag=v$VERSION" >> "$GITHUB_OUTPUT"
+          echo "sha=$SHA" >> "$GITHUB_OUTPUT"
+          echo "prev_ref=$PREV" >> "$GITHUB_OUTPUT"
+
+  # Translates new or changed strings with the Termix LLM server and commits
+  # them to the dev branch, so the beta or stable build includes them. If the
+  # server is down it warns and the release goes on with what is there.
+  translate:
     needs: [prep]
-    if: ${{ inputs.mode != 'Overwrite release' }}
+    if: ${{ needs.prep.outputs.skip != 'true' && needs.prep.outputs.mode != 'Overwrite release' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
+    outputs:
+      sha: ${{ steps.commit.outputs.sha }}
     steps:
       - name: Checkout dev branch
         uses: actions/checkout@v7
         with:
-          ref: ${{ needs.prep.outputs.dev_branch }}
-          fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
+          ref: ${{ needs.prep.outputs.sha || needs.prep.outputs.dev_branch }}
+          fetch-depth: 1
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Translate
+        uses: Termix-SSH/Termix-Registry/translate@main
+        with:
+          source: src/ui/locales/en.json
+          out: src/ui/locales/translated
+          languages: src/ui/locales/languages.json
+          api-key: ${{ secrets.TERMIX_LLM_API_KEY }}
+
+      - name: Commit translations
+        id: commit
+        run: |
+          git add src/ui/locales
+          if git diff --cached --quiet; then
+            echo "No translation changes."
+          elif [ "${{ needs.prep.outputs.mode }}" = "Dry run" ]; then
+            echo "DRY RUN: would commit these translation changes:"
+            git --no-pager diff --cached --stat
+          else
+            git config user.name "LukeGus"
+            git config user.email "bugattiguy527@gmail.com"
+            git commit -m "chore: update translations"
+            git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
+          fi
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+  verify-beta:
+    needs: [prep, translate]
+    if: ${{ needs.prep.outputs.channel == 'Beta' && needs.prep.outputs.skip != 'true' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout beta commit
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}
+          fetch-depth: 1
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "npm"
@@ -100,10 +228,60 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      # Bundled plugins are counted as downloads in the plugin store, so a
+      # build only fetches them when the pins change.
+      - name: Cache bundled plugins
+        uses: actions/cache@v6
+        with:
+          path: node_modules/.cache/termix-bundled-plugins
+          key: bundled-plugins-${{ hashFiles('docker/bundled-plugins.json') }}
+          enableCrossOsArchive: true
+
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Type check
+        run: npm run type-check
+
+      - name: Build
+        run: npm run build
+
+      - name: Run unit tests
+        run: npm run test
+
+  normalize:
+    needs: [prep, translate]
+    if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Overwrite release' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout dev branch
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.prep.outputs.dev_branch }}
+          fetch-depth: 0
+          token: ${{ secrets.TERMIX_PAT }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      # Manifest validation in lint loads the built SDK.
+      - name: Build SDK
+        run: npm run build:sdk
+
       - name: Lint and format
         run: |
-          npm run lint:fix || true
+          npm run lint:fix
           npm run format
+          npm run lint
 
       - name: Run unit tests
         run: npm run test
@@ -121,7 +299,7 @@ jobs:
             exit 0
           fi
 
-          if [ "${{ inputs.mode }}" = "Dry run" ]; then
+          if [ "${{ needs.prep.outputs.mode }}" = "Dry run" ]; then
             echo "DRY RUN: would commit and push the following changes to ${{ needs.prep.outputs.dev_branch }}:"
             git --no-pager diff --stat
             exit 0
@@ -131,9 +309,9 @@ jobs:
           git commit -m "chore: lint, format, and bump version to ${{ needs.prep.outputs.version }}"
           git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
 
-  crowdin:
+  sync-main:
     needs: [prep, normalize]
-    if: ${{ inputs.mode != 'Dry run' && inputs.mode != 'Overwrite release' }}
+    if: ${{ needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Overwrite release' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
       - name: Checkout dev branch
@@ -141,79 +319,29 @@ jobs:
         with:
           ref: ${{ needs.prep.outputs.dev_branch }}
           fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Merge main into dev branch
         run: |
           git config user.name "LukeGus"
           git config user.email "bugattiguy527@gmail.com"
           git fetch origin main
-          git merge origin/main -X ours --no-edit || true
-          git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
-
-      - name: Clean up stale Crowdin git integration branch
-        continue-on-error: true
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          PR_NUMBER=$(gh pr list --repo ${{ github.repository }} --head i18n_translate --state open --json number -q '.[0].number' || true)
-          if [ -n "$PR_NUMBER" ]; then
-            gh pr close "$PR_NUMBER" --repo ${{ github.repository }} --delete-branch || true
+          # -X ours leaves modify/delete conflicts, so settle those to the dev side too
+          if ! git merge origin/main -X ours --no-edit; then
+            git diff --name-only --diff-filter=U | while read -r f; do
+              if git cat-file -e "HEAD:$f" 2>/dev/null; then
+                git checkout --ours -- "$f" && git add -- "$f"
+              else
+                git rm -q -- "$f"
+              fi
+            done
+            git commit --no-edit
           fi
-          git push origin --delete i18n_translate || true
-
-      - name: Upload sources to Crowdin
-        uses: crowdin/github-action@v2
-        with:
-          upload_sources: true
-          upload_translations: false
-          download_translations: false
-          create_pull_request: false
-          push_translations: false
-          token: ${{ secrets.CROWDIN_API_KEY }}
-          project_id: "858252"
-        env:
-          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
-
-      - name: Machine pre-translate untranslated strings
-        env:
-          CROWDIN_API_KEY: ${{ secrets.CROWDIN_API_KEY }}
-        run: node scripts/crowdin-pretranslate.cjs
-
-      - name: Download translations from Crowdin
-        uses: crowdin/github-action@v2
-        with:
-          upload_sources: false
-          upload_translations: false
-          download_translations: true
-          create_pull_request: false
-          push_translations: false
-          token: ${{ secrets.CROWDIN_API_KEY }}
-          project_id: "858252"
-        env:
-          CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
-
-      - name: Commit translations to dev branch
-        run: |
-          git config user.name "LukeGus"
-          git config user.email "bugattiguy527@gmail.com"
-
-          git add src/ui/locales/translated
-          if git diff --cached --quiet; then
-            echo "No translation changes to commit."
-            exit 0
-          fi
-          git commit -m "chore: sync Crowdin translations for ${{ needs.prep.outputs.version }}"
           git push origin HEAD:"${{ needs.prep.outputs.dev_branch }}"
 
   merge-to-main:
-    needs: [prep, normalize, crowdin]
-    if: ${{ always() && needs.prep.result == 'success' && (needs.normalize.result == 'success' || needs.normalize.result == 'skipped') && (needs.crowdin.result == 'success' || needs.crowdin.result == 'skipped') }}
+    needs: [prep, translate, normalize, sync-main]
+    if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.channel == 'Stable' && (needs.translate.result == 'success' || needs.translate.result == 'skipped') && (needs.normalize.result == 'success' || needs.normalize.result == 'skipped') && (needs.sync-main.result == 'success' || needs.sync-main.result == 'skipped') }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     outputs:
       main_sha: ${{ steps.merge.outputs.main_sha }}
@@ -225,7 +353,7 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
 
@@ -235,24 +363,24 @@ jobs:
           node scripts/generate-release-body.cjs \
             --version "${{ needs.prep.outputs.version }}" \
             --mobile-version "${{ needs.prep.outputs.mobile_version }}" \
-            --notes RELEASE_NOTES.md > PR_BODY.md
+            --mobile-tag "${{ needs.prep.outputs.mobile_tag }}" > PR_BODY.md
 
       - name: Open and squash-merge PR to main
         id: merge
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           DEV_BRANCH="${{ needs.prep.outputs.dev_branch }}"
-          TITLE="release-${{ needs.prep.outputs.version }}"
+          TITLE="v${{ needs.prep.outputs.version }}"
 
-          if [ "${{ inputs.mode }}" = "Overwrite release" ]; then
+          if [ "${{ needs.prep.outputs.mode }}" = "Overwrite release" ]; then
             echo "OVERWRITE: no merge; building from main as-is."
             echo "build_ref=main" >> "$GITHUB_OUTPUT"
             echo "main_sha=$(gh api repos/${{ github.repository }}/commits/main -q .sha)" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          if [ "${{ inputs.mode }}" = "Dry run" ]; then
+          if [ "${{ needs.prep.outputs.mode }}" = "Dry run" ]; then
             echo "DRY RUN: would open and squash-merge a PR from $DEV_BRANCH into main."
             echo "DRY RUN: downstream jobs will build from $DEV_BRANCH instead of main."
             echo "build_ref=$DEV_BRANCH" >> "$GITHUB_OUTPUT"
@@ -281,18 +409,19 @@ jobs:
           echo "build_ref=$MAIN_SHA" >> "$GITHUB_OUTPUT"
 
   docker:
-    needs: [prep, merge-to-main]
+    needs: [prep, translate, verify-beta, merge-to-main]
+    if: ${{ always() && needs.prep.result == 'success' && needs.prep.outputs.skip != 'true' && (needs.merge-to-main.result == 'success' || needs.verify-beta.result == 'success') }}
     uses: ./.github/workflows/docker.yml
     with:
       version: ${{ needs.prep.outputs.version }}
-      build_type: Production
-      dry_run: ${{ inputs.mode == 'Dry run' }}
-      source_ref: ${{ needs.merge-to-main.outputs.build_ref }}
+      build_type: ${{ needs.prep.outputs.channel == 'Beta' && 'Beta' || 'Production' }}
+      dry_run: ${{ needs.prep.outputs.mode == 'Dry run' }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
     secrets: inherit
 
   create-release:
     needs: [prep, merge-to-main, docker]
-    if: ${{ inputs.mode != 'Dry run' }}
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.docker.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       contents: write
@@ -304,14 +433,14 @@ jobs:
           fetch-depth: 1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
 
       - name: Clear existing release artifacts (overwrite mode)
-        if: ${{ inputs.mode == 'Overwrite release' }}
+        if: ${{ needs.prep.outputs.mode == 'Overwrite release' }}
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           TAG="${{ needs.prep.outputs.release_tag }}"
           if ! gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
@@ -324,40 +453,91 @@ jobs:
           done
 
       - name: Generate release body
-        if: ${{ inputs.mode != 'Overwrite release' }}
+        if: ${{ needs.prep.outputs.mode != 'Overwrite release' }}
         run: |
           node scripts/generate-release-body.cjs \
             --version "${{ needs.prep.outputs.version }}" \
             --mobile-version "${{ needs.prep.outputs.mobile_version }}" \
-            --notes RELEASE_NOTES.md > RELEASE_BODY.md
+            --mobile-tag "${{ needs.prep.outputs.mobile_tag }}" > RELEASE_BODY.md
 
       - name: Create or update GitHub release
-        if: ${{ inputs.mode != 'Overwrite release' }}
+        if: ${{ needs.prep.outputs.mode != 'Overwrite release' }}
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
           TAG="${{ needs.prep.outputs.release_tag }}"
-          TITLE="release-${{ needs.prep.outputs.version }}"
+          TITLE="Termix v${{ needs.prep.outputs.version }}"
           if gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
             gh release edit "$TAG" --repo ${{ github.repository }} --title "$TITLE" --notes-file RELEASE_BODY.md
           else
             gh release create "$TAG" --repo ${{ github.repository }} --title "$TITLE" --notes-file RELEASE_BODY.md --target "${{ needs.merge-to-main.outputs.main_sha }}"
           fi
 
+  create-beta-release:
+    needs: [prep, translate, docker]
+    if: ${{ always() && needs.prep.outputs.channel == 'Beta' && needs.docker.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout beta commit
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Generate beta release body
+        run: |
+          node scripts/generate-beta-body.cjs \
+            --version "${{ needs.prep.outputs.version }}" \
+            --branch "${{ needs.prep.outputs.dev_branch }}" \
+            --sha "${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}" \
+            --prev "${{ needs.prep.outputs.prev_ref }}" > BETA_BODY.md
+
+      - name: Create beta release
+        env:
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+        run: |
+          VERSION="${{ needs.prep.outputs.version }}"
+          TITLE="Termix v${VERSION%-beta.*} Beta ${VERSION##*-beta.}"
+          TAG="${{ needs.prep.outputs.release_tag }}"
+          if gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
+            gh release edit "$TAG" --repo ${{ github.repository }} \
+              --title "$TITLE" --notes-file BETA_BODY.md --prerelease
+          else
+            gh release create "$TAG" --repo ${{ github.repository }} \
+              --title "$TITLE" --notes-file BETA_BODY.md \
+              --prerelease --target "${{ needs.translate.outputs.sha || needs.prep.outputs.sha }}"
+          fi
+
   electron-release:
-    needs: [prep, merge-to-main, create-release]
-    if: ${{ always() && needs.merge-to-main.result == 'success' && (needs.create-release.result == 'success' || needs.create-release.result == 'skipped') }}
+    needs:
+      [
+        prep,
+        translate,
+        merge-to-main,
+        docker,
+        create-release,
+        create-beta-release,
+      ]
+    if: ${{ always() && needs.prep.outputs.skip != 'true' && needs.docker.result == 'success' && needs.create-release.result != 'failure' && needs.create-beta-release.result != 'failure' }}
     uses: ./.github/workflows/electron.yml
     with:
       build_type: all
-      artifact_destination: ${{ inputs.mode == 'Dry run' && 'file' || 'release' }}
+      artifact_destination: ${{ needs.prep.outputs.mode == 'Dry run' && 'file' || 'release' }}
       release_tag: ${{ needs.prep.outputs.release_tag }}
-      source_ref: ${{ needs.merge-to-main.outputs.build_ref }}
+      version_override: ${{ needs.prep.outputs.channel == 'Beta' && needs.prep.outputs.version || '' }}
+      source_ref: ${{ needs.merge-to-main.outputs.build_ref || needs.translate.outputs.sha || needs.prep.outputs.sha }}
     secrets: inherit
 
   electron-submit:
     needs: [prep, merge-to-main, electron-release]
-    if: ${{ inputs.mode != 'Dry run' && inputs.mode != 'Skip submit' }}
+    if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Skip submit' }}
     uses: ./.github/workflows/electron.yml
     with:
       build_type: all
@@ -367,7 +547,7 @@ jobs:
 
   cask-commit-back:
     needs: [prep, electron-release]
-    if: ${{ inputs.mode != 'Dry run' }}
+    if: ${{ always() && needs.electron-release.result == 'success' && needs.prep.outputs.channel == 'Stable' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     permissions:
       contents: write
@@ -377,7 +557,7 @@ jobs:
         with:
           ref: main
           fetch-depth: 1
-          token: ${{ secrets.GHCR_TOKEN }}
+          token: ${{ secrets.TERMIX_PAT }}
 
       - name: Bump and commit Homebrew cask
         env:
@@ -395,10 +575,10 @@ jobs:
           git fetch origin main
           git checkout -B main origin/main
 
-          sed -i "s|version \".*\"|version \"$VERSION\"|g" packaging/Casks/termix.rb
-          sed -i "s|sha256 \".*\"|sha256 \"$DMG_SHA256\"|g" packaging/Casks/termix.rb
+          sed -i "s|version \".*\"|version \"$VERSION\"|g" Casks/termix.rb
+          sed -i "s|sha256 \".*\"|sha256 \"$DMG_SHA256\"|g" Casks/termix.rb
 
-          git add packaging/Casks/termix.rb
+          git add Casks/termix.rb
           if git diff --cached --quiet; then
             echo "Cask already up to date."
             exit 0
@@ -407,146 +587,88 @@ jobs:
           git commit -m "chore: bump Homebrew cask to $VERSION"
           git push origin HEAD:main
 
-  docs:
-    needs: [prep, merge-to-main]
-    if: ${{ always() && needs.merge-to-main.result == 'success' && inputs.mode != 'Overwrite release' }}
+  prune-betas:
+    needs: [prep, create-release]
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.create-release.result == 'success' && needs.prep.outputs.mode != 'Overwrite release' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - name: Checkout Termix
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.merge-to-main.outputs.build_ref }}
-          fetch-depth: 1
-          path: termix
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: "termix/.nvmrc"
-          cache: "npm"
-          cache-dependency-path: termix/package-lock.json
-
-      - name: Generate OpenAPI spec
-        working-directory: termix
-        run: |
-          npm ci
-          npm run generate:openapi
-
-      - name: Checkout Docs repository
-        uses: actions/checkout@v7
-        with:
-          repository: Termix-SSH/Docs
-          ref: main
-          fetch-depth: 0
-          token: ${{ secrets.GHCR_TOKEN }}
-          path: docs-repo
-
-      - name: Create docs release branch
-        working-directory: docs-repo
-        run: git checkout -B "dev-${{ needs.prep.outputs.version }}"
-
-      - name: Overwrite OpenAPI spec and regenerate API docs
-        working-directory: docs-repo
-        run: |
-          cp ../termix/openapi.json static/openapi.json
-          npm ci
-          npm run docusaurus gen-api-docs termix
-
-      - name: Commit and push docs branch
-        working-directory: docs-repo
-        run: |
-          git config user.name "LukeGus"
-          git config user.email "bugattiguy527@gmail.com"
-
-          if git diff --quiet; then
-            echo "No docs changes to commit."
-            exit 0
-          fi
-
-          if [ "${{ inputs.mode }}" = "Dry run" ]; then
-            echo "DRY RUN: would commit and push the following docs changes to dev-${{ needs.prep.outputs.version }}:"
-            git --no-pager diff --stat
-            exit 0
-          fi
-
-          git add -A
-          git commit -m "feat: update API docs for ${{ needs.prep.outputs.version }}"
-          git push --force origin "dev-${{ needs.prep.outputs.version }}"
-
-      - name: Open and squash-merge docs PR
-        if: ${{ inputs.mode != 'Dry run' }}
-        working-directory: docs-repo
+      - name: Delete this version's beta releases (tags stay)
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
-          BRANCH="dev-${{ needs.prep.outputs.version }}"
-          if ! git ls-remote --exit-code origin "refs/heads/$BRANCH" >/dev/null 2>&1; then
-            echo "No docs branch pushed (nothing changed); skipping PR."
+          PREFIX="v${{ needs.prep.outputs.version }}-beta."
+          gh release list --repo ${{ github.repository }} --limit 200 --json tagName -q '.[].tagName' \
+            | grep -F "$PREFIX" | while read -r TAG; do
+              echo "Deleting release $TAG"
+              gh release delete "$TAG" --repo ${{ github.repository }} --yes || true
+            done
+
+  # The docs site reads the env catalog, API spec and download list from the
+  # newest stable release.
+  # Docs written for this release live on dev-X.Y.Z in the Docs repo. Squash
+  # merge it into main once the release is out. No branch means nothing to do.
+  docs-merge:
+    needs: [prep, electron-release]
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' && needs.prep.outputs.mode != 'Overwrite release' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Merge the docs dev branch into main
+        env:
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+          REPO: Termix-SSH/Docs
+          VERSION: ${{ needs.prep.outputs.version }}
+        run: |
+          BRANCH="dev-$VERSION"
+          if ! gh api "repos/$REPO/branches/$BRANCH" > /dev/null 2>&1; then
+            echo "$REPO has no $BRANCH branch, nothing to merge."
             exit 0
           fi
 
-          PR_NUMBER=$(gh pr list --repo Termix-SSH/Docs --head "$BRANCH" --base main --state open --json number -q '.[0].number' || true)
-          if [ -z "$PR_NUMBER" ]; then
-            PR_URL=$(gh pr create --repo Termix-SSH/Docs \
-              --base main --head "$BRANCH" \
-              --title "release-${{ needs.prep.outputs.version }}" \
-              --body "API docs for ${{ needs.prep.outputs.version }}")
-            PR_NUMBER=$(echo "$PR_URL" | grep -oE '[0-9]+$')
+          AHEAD=$(gh api "repos/$REPO/compare/main...$BRANCH" -q .ahead_by)
+          if [ "$AHEAD" = "0" ]; then
+            echo "$BRANCH has nothing main doesn't, deleting it."
+            gh api -X DELETE "repos/$REPO/git/refs/heads/$BRANCH"
+            exit 0
           fi
 
+          PR_NUMBER=$(gh pr list --repo "$REPO" --head "$BRANCH" --base main --state open --json number -q '.[0].number')
           if [ -z "$PR_NUMBER" ]; then
-            echo "Failed to find or create a PR for $BRANCH."
+            PR_NUMBER=$(gh pr create --repo "$REPO" --base main --head "$BRANCH" \
+              --title "v$VERSION" --body "Docs for Termix v$VERSION." | grep -oE '[0-9]+$')
+          fi
+
+          gh pr merge "$PR_NUMBER" --repo "$REPO" --squash --admin --delete-branch
+
+          STATE=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json state -q .state)
+          if [ "$STATE" != "MERGED" ]; then
+            echo "Docs PR #$PR_NUMBER did not merge (state: $STATE)."
             exit 1
           fi
 
-          gh pr merge "$PR_NUMBER" --repo Termix-SSH/Docs --squash --admin
-
-  publish-youtube:
-    needs: [prep, electron-release]
-    if: ${{ always() && inputs.mode != 'Dry run' && inputs.mode != 'Overwrite release' && needs.electron-release.result == 'success' }}
+  docs-refresh:
+    needs: [prep, electron-release, docs-merge]
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && needs.electron-release.result == 'success' && needs.prep.outputs.mode != 'Dry run' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - name: Checkout main
-        uses: actions/checkout@v7
-        with:
-          ref: main
-          fetch-depth: 1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version-file: ".nvmrc"
-
-      - name: Set release video to public
+      - name: Tell the docs site
         env:
-          YOUTUBE_CLIENT_ID: ${{ secrets.YOUTUBE_CLIENT_ID }}
-          YOUTUBE_CLIENT_SECRET: ${{ secrets.YOUTUBE_CLIENT_SECRET }}
-          YOUTUBE_REFRESH_TOKEN: ${{ secrets.YOUTUBE_REFRESH_TOKEN }}
-        run: node scripts/publish-youtube.cjs
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
+        run: gh api repos/Termix-SSH/Docs/dispatches -f event_type=core-released
 
   cleanup:
-    needs:
-      [
-        prep,
-        merge-to-main,
-        electron-release,
-        cask-commit-back,
-        docs,
-        publish-youtube,
-      ]
-    if: ${{ always() && (inputs.mode == 'Everything' || inputs.mode == 'Skip submit') && needs.merge-to-main.result == 'success' && needs.electron-release.result == 'success' }}
+    needs: [prep, merge-to-main, electron-release, cask-commit-back]
+    if: ${{ always() && needs.prep.outputs.channel == 'Stable' && (needs.prep.outputs.mode == 'Everything' || needs.prep.outputs.mode == 'Skip submit') && needs.merge-to-main.result == 'success' }}
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
       - name: Delete dev branch in Termix
         env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
+          GH_TOKEN: ${{ secrets.TERMIX_PAT }}
         run: |
-          git push https://x-access-token:${{ secrets.GHCR_TOKEN }}@github.com/${{ github.repository }}.git \
+          git push https://x-access-token:${{ secrets.TERMIX_PAT }}@github.com/${{ github.repository }}.git \
             --delete "${{ needs.prep.outputs.dev_branch }}" || true
-
-      - name: Delete dev branch in Docs
-        env:
-          GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
-        run: |
-          git push https://x-access-token:${{ secrets.GHCR_TOKEN }}@github.com/Termix-SSH/Docs.git \
-            --delete "dev-${{ needs.prep.outputs.version }}" || true

.github/workflows/translate.yml

@@ -0,0 +1,53 @@
+name: Translate
+
+on:
+  workflow_dispatch:
+    inputs:
+      retranslate:
+        description: "Translate every string again, not only new or changed ones"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+concurrency:
+  group: translate-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  translate:
+    if: ${{ startsWith(github.ref, 'refs/heads/dev-') }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 1
+          token: ${{ secrets.TERMIX_PAT }}
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Translate
+        uses: Termix-SSH/Termix-Registry/translate@main
+        with:
+          source: src/ui/locales/en.json
+          out: src/ui/locales/translated
+          languages: src/ui/locales/languages.json
+          retranslate: ${{ inputs.retranslate }}
+          api-key: ${{ secrets.TERMIX_LLM_API_KEY }}
+
+      - name: Commit translations
+        run: |
+          git add src/ui/locales
+          if git diff --cached --quiet; then
+            echo "No translation changes."
+            exit 0
+          fi
+          git config user.name "LukeGus"
+          git config user.email "bugattiguy527@gmail.com"
+          git commit -m "chore: update translations"
+          git push origin HEAD:"${GITHUB_REF_NAME}"

.gitignore

@@ -13,9 +13,17 @@ dist-ssr
 coverage
 *.local
 
+# Plugin build output. termix-plugin build writes it, the packaged server
+# gets its copy under dist/plugins.
+*.tmxplug
+*.tmxplug.sig
+termix-plugin-signing.key
+/src/**/*.js
+
 .vscode/
-.idea
+.idea/
 .DS_Store
+Thumbs.db
 *.suo
 *.ntvs*
 *.njsproj
@@ -33,5 +41,7 @@ electron/build-info.cjs
 /.mcp.json
 /CLAUDE.md
 /old_db/
-/scripts/fix-bugs.mjs
-/scripts/fix-features.mjs
+/scripts/auto-fix.mjs
+/scripts/auto-fix-blocklist.json
+/scripts/auto-fix-state.json
+/scripts/auto-fix-report-*.json

.husky/commit-msg

@@ -1 +1 @@
-npx --no -- commitlint --edit $1
+npx --no -- commitlint --edit "$1"

.husky/pre-commit

@@ -1 +1,3 @@
-npx lint-staged
+# The .cmd shims on Windows add their own paths to each command, so keep
+# lint-staged's chunks well under cmd.exe's 8191 character limit.
+npx lint-staged --max-arg-length 4000

.prettierignore

@@ -1,19 +1,13 @@
 build
 coverage
 dist
+node_modules
+package-lock.json
+
 dist-ssr
 release
-
-node_modules
-src/mcp-server/node_modules
-package-lock.json
-pnpm-lock.yaml
-yarn.lock
-
 db
-
-.env
-
 *.min.js
 *.min.css
 openapi.json
+drizzle/

CHANGELOG.md

@@ -0,0 +1,154 @@
+# Changelog
+
+## 26.10.3
+
+### Added
+
+- Choose the layout of the whole app in Settings, Appearance. Admins can also set the default layout and theme for everyone
+- Plugins can add layouts and themes
+- A repair screen shows when the chosen layout cannot load, with ways to update, switch, reset or turn it off. Open it any time with ?safe-layout=1, or for everyone with TERMIX_SAFE_LAYOUT=1
+- Hovering a theme in Settings previews it
+- Restore the bundled copy of a plugin from the repair screen, which also pins the shipped version
+- Switching layouts closes the tabs only the old layout could show, like its Settings tab
+- A chosen layout whose plugin was uninstalled falls back to the default instead of the repair screen
+- Filter plugins by type, like layouts, themes or tabs, from a filter list beside the results
+- Browse shows plugins a page at a time
+- Plugins that need a newer Termix are hidden in Browse, with a toggle to show them
+- Hosts can be managed from a config file through a plugin. Managed hosts are read only for everyone, but pins and order still work
+- A plugin can block adding hosts by hand, so every host comes from one place
+- Plugins can set login rules: sign out after a time without activity, limit how long a session lasts, turn off remember me and require a second factor
+- A user who must have a second factor but has none can sign in only to set one up
+- Admins can redirect HTTP to HTTPS and send HSTS while HTTPS is on. Off by default so reverse proxies keep working
+
+### Changed
+
+- The icon rail, sidebar, tab bar, dock, Dashboard, Manage, Settings and command palette now come from a bundled layout. It can be swapped for another layout but not removed, and a fix to it no longer needs a Termix release
+- Your theme is saved to your account so your other devices use it too, unless you keep settings on this device only
+- The themes besides light and dark now come from a bundled themes plugin. It can be swapped but not removed, and Termix keeps a basic light and dark theme of its own
+- A theme that no longer exists shows as System instead of an unstyled page
+- Installs and updates from a registry check the Termix version a plugin needs, not only its plugin API
+- Host online and offline dots now come from the Host Status plugin. The check interval setting moved to its settings and keeps its value. Without the plugin hosts show no dot
+- Audit log forwarding and the CSV and NDJSON export now come from the Audit Tools plugin. The collector URL and token move to its settings on upgrade. The audit log viewer, retention and the audit log itself stay in Termix
+- Client tunnels on your own computer and opening a host in Windows Remote Desktop moved out of the desktop app into plugins, so fixes to them no longer need a new desktop build
+- The local terminal, the local side of the file manager with its transfers, and opening a file in an external editor moved out of the desktop app into plugins, so fixes to them no longer need a new desktop build
+- The recent activity list and the first run steps for the preset and for theme, accent, font and language now come from bundled plugins. Existing entries and choices are kept, and people who went through those steps are not asked again
+- Branding (app name, tagline and logo) is now saved by the bundled layout plugin. An existing setup keeps its branding, and the sign in screen still reads it from Termix
+- Without the plugin that stores recent activity, the list stays empty and nothing is recorded
+- Importing hosts from a JSON or SSH config file and exporting hosts now come from the Import and Export plugin. Exports are now written to the audit log. Without the plugin there is no import or export
+- Generating and checking SSH keys in the credential editor and deploying a key to a host now come from the Credential Tools plugin. Deploys are now written to the audit log. Without the plugin those buttons are hidden
+
+### Removed
+
+- The desktop app no longer has its own client tunnel and native Remote Desktop code
+
+## 26.10.2
+
+### Added
+
+- Hide sidebar after opening, in Customize Sidebar, closes the host list once you open a host
+- Sort the dashboard's Host Status card by name, IP address or status
+- Windows on ARM builds of the desktop app (installer, MSI and portable)
+- Plugins get an event when a host is added
+- Plugins can start a short-lived session as a user and read the user's language, for tasks that run without a browser
+- Plugins can pin a panel to the right edge of the window that pushes the page over
+
+### Changed
+
+- The Docker Compose files no longer start a guacd container. npm run dev -- --guacd also points remote desktop at the guacd it starts
+- The side menu now opens over the page when it expands on hover, so open sessions like remote desktop are not resized each time. Turn on Push content when it expands in Settings to get the old behavior back
+- On macOS, moving between split panes is now Cmd+Option+Arrow, so Option+Arrow can move the cursor by word in a terminal
+
+### Fixed
+
+- Picking a section lower down in the host editor, like Warpgate, stuttered on the way and sometimes stopped before it got there
+- Sorting hosts by IP address put 10.0.0.210 before 10.0.0.3
+- The local terminal failed to start in the universal macOS build
+- Hosts shared with you never showed up on a linked desktop
+- A linked desktop could never turn on an unsigned plugin the server had enabled
+- Creating, cloning or deleting hosts failed with "no such table: main.p_vault_profiles" after the Vault plugin was removed
+- Opening a user in Settings, Users blocked the other admin sections until you went back to the user list
+- A linked desktop could keep showing the same sync conflicts, or delete a local host, when the server could not send its copy
+- Usernames are now unique
+- Importing user data keeps foreign keys on
+- Trusted proxy login checks the address nginx saw, not nginx itself
+- The desktop login frame only trusts the server's own origin
+- External login URLs and callback ports are checked on the desktop app
+- A changed jump host key is no longer accepted without asking
+- Synced plugins signed only by a key the server sent are no longer turned on by themselves
+- Two connects to the same host at once could overwrite each other's connection
+- Indonesian uses the same technical terms everywhere
+- When the server was down or still starting, the login page said it could not connect to the database and stopped trying. It now says the server is not responding and continues on its own once the server is back
+- nginx answered 404 instead of 502 while the backend was down
+- A client tunnel that could not start always said "Endpoint SSH connection closed" on the desktop app instead of the real reason, like the target refusing the connection
+- The Docker server crashed and restarted every few hours in ssh2's native crypto on Node 24
+- Plugin names and descriptions showed in English in the plugin manager, setup picker and host editor no matter the UI language
+- Creating a host through the API without an auth type failed with a server error. It now picks the type from the credential, key or password, or says auth type is required
+- The desktop app would not start its local server when another program used port 30001. It now picks a free port on its own
+- A linked desktop could never finish syncing with a server on Postgres
+- Routine plugin activity filled the audit log and pushed out real security entries
+- Opening a full-screen view link while signed out showed a spinner forever. It now shows the login and opens the link after
+- A linked desktop behind a proxy that needs extra headers, or with an allowed self-signed certificate, could not open remote terminals or tunnels
+
+## 26.10.1
+
+### Added
+
+- Slovak, Croatian, Slovenian, Lithuanian, Latvian, Estonian and Malay
+- The desktop app can update itself. Pick Automatic, Ask first or Never in Settings, Updates. Store and package manager installs keep updating the way they do now
+- Community plugins. Turn on the community registry in Plugins, Registries to browse and install plugins made by other people, each version reviewed before it is listed
+- Custom plugin registries. Add your own registry by its index URL; its signing key is pinned when you add it
+
+### Changed
+
+- Every language is now fully translated, in Termix and in every plugin, and stays up to date with each release
+- Languages with more than two plural forms, like Russian, Polish and Arabic, now use the right one
+- The Plugins tab shows how many times each plugin was downloaded, in a Downloads column
+- Plugins, Browse hides plugins you already have. Turn on Show installed to see them
+
+### Fixed
+
+- Regional browser languages like `es-MX`, `pt` or `zh-HK` showed English instead of the closest translation
+- Counts like "1 keys" or "Moved 1 host(s)" now use the singular
+- Plugin updates on the desktop app, synced or installed from the Plugins tab, failed to start with "Cannot find package"
+- The desktop app showed plugins that only run on the server as not running and out of date
+- Keep the terminal WebSocket open past nginx's 60s default
+- Plugin download counts now show in the Plugins tab without waiting for the background check
+- Clicking into a saved password, key passphrase or sudo password field and saving without typing erased it, which stopped sudo autofill
+- The desktop app now says when its data is from 2.8 or older and needs 2.9 first, instead of only saying the local server could not start
+- Client tunnels on the desktop app stopped with "Endpoint SSH connection closed" when a reverse proxy dropped their idle connection
+- Typing right after opening a host from the sidebar went to the host search instead of the new session
+- SSH config import failed on files that put a tab or `=` between a keyword and its value
+- App icons and the favicon have rounded corners again
+
+## 26.10.0
+
+### Added
+
+- Plugins. Every feature beyond hosts, credentials and sharing is now its own plugin with its own repo, and you pick which ones you want
+- A Plugins tab to install, update, pin, turn off and remove plugins from the official registry, with release notes and a beta channel per plugin
+- Developer mode to install a plugin from a file, and a plugin SDK on npm to build your own
+- The community plugin registry is open for submissions. Termix can install community plugins in a later update
+- Redesigned UI with a Manage tab for hosts and credentials and a Settings tab with search
+- New full screen onboarding where you choose which plugins to start with
+- Beta channel for Termix itself in Settings > Updates
+- Docs links on every settings page, in the Plugins tab, in plugin settings and in the command palette
+- Plugins can link their own docs and list the environment variables they read, shown on their page in the Plugins tab
+- Report a bug links that open a prefilled issue in the right repo
+- `TRUSTED_PROXIES` to choose which proxies nginx takes client IPs from
+
+### Changed
+
+- Termix now uses calendar versions (year, month, patch), starting with 26.10.0
+- Redesigned host defaults with admin, user and folder levels
+- Simpler host status: online or offline, kept live without a refresh
+- Bug reports and feature requests now go to each repo instead of the Support repo
+
+### Fixed
+
+- A lot of bugs across the app, the desktop app and every plugin
+- Several security issues reported through GitHub advisories
+
+### Removed
+
+- Downgrading to 2.8 is no longer supported. A 2.8 install has to start 2.9 once before upgrading
+- The donation reminder popup

CONTRIBUTING.md

@@ -1,8 +1,10 @@
 # Contributing
 
+Termix is a small core plus plugins. This repo is the core: hosts, credentials, users, sharing, sessions, the app shell and the plugin runtime. Every other feature lives in its own `Plugin-<Name>` repo. If your change is about the terminal, file manager, Docker or any other plugin feature, open it in that plugin's repo instead.
+
 ## Prerequisites
 
-- [Node.js](https://nodejs.org/en/download/) (built with v24)
+- [Node.js](https://nodejs.org/en/download/) 22.12 or newer (built with v24)
 - [NPM](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
 - [Git](https://git-scm.com/downloads)
 
@@ -19,88 +21,55 @@
 
 ## Running the development server
 
-Run the following commands:
-
 ```sh
 npm run dev
-npm run dev:backend
 ```
 
-This will start the backend and the frontend Vite server. You can access Termix by going to `http://localhost:5174/`.
+This builds everything, starts the backend and then the Vite server at `http://localhost:5173/`. Backend changes restart the backend, and plugin changes in `../Plugins` rebuild and reload that plugin. `npm run dev:electron` does the same with the desktop app, and `npm run dev -- --help` lists the other options.
 
-## Contributing
+## Useful commands
 
-1. **Fork the repository**: Click the "Fork" button at the top right of
-   the [repository page](https://github.com/Termix-SSH/Termix).
-2. **Create a new branch**:
+```sh
+npm run test         # run the test suite
+npm run type-check   # type-check the core
+npm run lint         # lint and the other repo checks
+npm run format       # format the code with Prettier
+```
+
+## Making a change
+
+1. Fork the [repo](https://github.com/Termix-SSH/Termix).
+2. Create a branch:
    ```sh
    git checkout -b feature/my-new-feature
    ```
-3. **Make your changes**: Implement your feature, fix, or improvement.
-4. **Commit your changes**:
+3. Make your changes and add or update tests for them.
+4. Commit your changes:
    ```sh
-   git commit -m "Feature request my new feature"
+   git commit -m "feat: add my new feature"
    ```
-5. **Push to your fork**:
+5. Push to your fork:
    ```sh
-   git push origin feature/my-feature-request
+   git push origin feature/my-new-feature
    ```
-6. **Open a pull request**: Go to the original repository and create a PR with a clear description.
+6. Open a pull request against the current `dev-*` branch with a clear description.
 
 ## Guidelines
 
-- Follow the existing code style. Use Tailwind CSS with shadcn components.
-- Use the below color scheme with the respective CSS variable placed in the `className` of a div/component.
-- Place all API routes in the `main-axios.ts` file. Updating the `openapi.json` is unneeded.
-- Include meaningful commit messages.
-- Link related issues when applicable.
-- `MobileApp.tsx` renders when the users screen width is less than 768px, otherwise it loads the usual `DesktopApp.tsx`.
+- Follow the existing code style. The frontend uses React, Tailwind CSS and shadcn components in `src/ui/`.
+- Never hardcode text. Use `t()` and add the English string to `src/ui/locales/en.json`. That's the only locale file you need to update. Other languages are translated automatically, and if an automatic translation is wrong you can fix it in that language's file.
+- Keep the UI flat and square. Avoid rounded corners on panels, cards and dialogs.
+- Use the theme variables (like `var(--bg-base)` and `var(--text-primary)`) instead of fixed colors.
+- There is one component tree for desktop and mobile. Use `src/ui/hooks/use-mobile.ts` for layout changes.
+- Core never names a plugin. If core needs something from a plugin, add a slot, action or component id that the plugin fills.
+- Tests live in `src/backend/tests/` and `src/ui/tests/`, mirroring the source tree. `npm run test` must pass.
+- Every API route gets an OpenAPI JSDoc comment like the routes around it.
+- Use short commit messages that start with `feat:`, `fix:` or `chore:`, and link related issues.
 
-## Color Scheme
+## Building a plugin
 
-### Background Colors
-
-| CSS Variable                  | Color Value | Usage                       | Description                              |
-| ----------------------------- | ----------- | --------------------------- | ---------------------------------------- |
-| `--color-dark-bg`             | `#18181b`   | Main dark background        | Primary dark background color            |
-| `--color-dark-bg-darker`      | `#0e0e10`   | Darker backgrounds          | Darker variant for panels and containers |
-| `--color-dark-bg-darkest`     | `#09090b`   | Darkest backgrounds         | Darkest background (terminal)            |
-| `--color-dark-bg-light`       | `#141416`   | Light dark backgrounds      | Lighter variant of dark background       |
-| `--color-dark-bg-very-light`  | `#101014`   | Very light dark backgrounds | Very light variant of dark background    |
-| `--color-dark-bg-panel`       | `#1b1b1e`   | Panel backgrounds           | Background for panels and cards          |
-| `--color-dark-bg-panel-hover` | `#232327`   | Panel hover states          | Background for panels on hover           |
-
-### Element-Specific Backgrounds
-
-| CSS Variable             | Color Value | Usage              | Description                                   |
-| ------------------------ | ----------- | ------------------ | --------------------------------------------- |
-| `--color-dark-bg-input`  | `#222225`   | Input fields       | Background for input fields and form elements |
-| `--color-dark-bg-button` | `#23232a`   | Button backgrounds | Background for buttons and clickable elements |
-| `--color-dark-bg-active` | `#1d1d1f`   | Active states      | Background for active/selected elements       |
-| `--color-dark-bg-header` | `#131316`   | Header backgrounds | Background for headers and navigation bars    |
-
-### Border Colors
-
-| CSS Variable                 | Color Value | Usage           | Description                              |
-| ---------------------------- | ----------- | --------------- | ---------------------------------------- |
-| `--color-dark-border`        | `#303032`   | Default borders | Standard border color                    |
-| `--color-dark-border-active` | `#2d2d30`   | Active borders  | Border color for active elements         |
-| `--color-dark-border-hover`  | `#434345`   | Hover borders   | Border color on hover states             |
-| `--color-dark-border-light`  | `#5a5a5d`   | Light borders   | Lighter border color for subtle elements |
-| `--color-dark-border-medium` | `#373739`   | Medium borders  | Medium weight border color               |
-| `--color-dark-border-panel`  | `#222224`   | Panel borders   | Border color for panels and cards        |
-
-### Interactive States
-
-| CSS Variable             | Color Value | Usage             | Description                                   |
-| ------------------------ | ----------- | ----------------- | --------------------------------------------- |
-| `--color-dark-hover`     | `#2d2d30`   | Hover states      | Background color for hover effects            |
-| `--color-dark-active`    | `#2a2a2c`   | Active states     | Background color for active elements          |
-| `--color-dark-pressed`   | `#1a1a1c`   | Pressed states    | Background color for pressed/clicked elements |
-| `--color-dark-hover-alt` | `#2a2a2d`   | Alternative hover | Alternative hover state color                 |
+Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). It talks to Termix only through `@termix-ssh/plugin-sdk` and has its own build, test and release setup.
 
 ## Support
 
-If you need help or want to request a feature with Termix, visit the [Issues](https://github.com/Termix-SSH/Support/issues) page, log in, and press `New Issue`.
-Please be as detailed as possible in your issue, preferably written in English. You can also join the [Discord](https://discord.gg/jVQGdvHDrf) server and visit the support
-channel, however, response times may be longer.
+Bugs and ideas for Termix itself go in [this repo](https://github.com/Termix-SSH/Termix/issues/new/choose). Plugin problems go in that plugin's own `Plugin-<Name>` repo. Add as much detail as you can, in English if possible. You can also ask in the [Discord](https://discord.gg/jVQGdvHDrf) server.

Casks/termix.rb

@@ -1,10 +1,10 @@
 cask "termix" do
-  version "2.5.0"
-  sha256 "0662380b3cc986e5ddab263122e87b03a581bc18dbff1ad13e11dc973c84984b"
+  version "26.10.2"
+  sha256 "9df1850b5f75a3c0a1b3876847d46b7b4ff993aa1e50da55f4c88819308ba223"
 
-  url "https://github.com/Termix-SSH/Termix/releases/download/release-#{version}-tag/termix_macos_universal_dmg.dmg"
+  url "https://github.com/Termix-SSH/Termix/releases/download/v#{version}/termix_macos_universal_dmg.dmg"
   name "Termix"
-  desc "Web-based server management platform with SSH terminal, tunneling, and file editing"
+  desc "Self-hosted, plugin-based server management"
   homepage "https://github.com/Termix-SSH/Termix"
 
   livecheck do
@@ -12,6 +12,8 @@ cask "termix" do
     strategy :github_latest
   end
 
+  auto_updates true
+
   app "Termix.app"
 
   zap trash: [

FUNDING.json

@@ -1,7 +0,0 @@
-{
-  "drips": {
-    "ethereum": {
-      "ownedBy": "0x67e0C779119D9BcC2187564A66B80a58767d05d1"
-    }
-  }
-}

LICENSE

@@ -1,13 +1,203 @@
-Copyright 2025 Luke Gustafson
+Copyright 2026 Luke Gustafson
 
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-    http://www.apache.org/licenses/LICENSE-2.0
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

README.md

@@ -4,24 +4,7 @@
 
 <h1>Termix</h1>
 
-<p>Self-hosted SSH management and remote desktop access</p>
-
-<p>
-  English ·
-  <a href="docs/readme/README-CN.md">中文</a> ·
-  <a href="docs/readme/README-JA.md">日本語</a> ·
-  <a href="docs/readme/README-KO.md">한국어</a> ·
-  <a href="docs/readme/README-FR.md">Français</a> ·
-  <a href="docs/readme/README-DE.md">Deutsch</a> ·
-  <a href="docs/readme/README-ES.md">Español</a> ·
-  <a href="docs/readme/README-PT.md">Português</a> ·
-  <a href="docs/readme/README-RU.md">Русский</a> ·
-  <a href="docs/readme/README-AR.md">العربية</a> ·
-  <a href="docs/readme/README-HI.md">हिन्दी</a> ·
-  <a href="docs/readme/README-TR.md">Türkçe</a> ·
-  <a href="docs/readme/README-VI.md">Tiếng Việt</a> ·
-  <a href="docs/readme/README-IT.md">Italiano</a>
-</p>
+<p>Self-hosted, plugin-based server management</p>
 
 <p>
   <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
@@ -35,22 +18,7 @@
   <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
 </p>
 
-<br />
-
-Termix is free and open source. If you find it useful, consider [donating](https://donate.termix.site/) to help cover server costs and development time.
-
-<br />
-
-<img src="./docs/repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="docs/repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Achieved on September 1st, 2025</sub>
-</p>
+<a href="https://www.youtube.com/watch?v=vhtkP-UqV5U"><img src="./.github/readme/overview.jpg" width="720" alt="Watch the Termix overview on YouTube" /></a>
 
 </div>
 
@@ -58,160 +26,83 @@ Termix is free and open source. If you find it useful, consider [donating](https
 
 ## Overview
 
-Termix is an open-source, forever-free, self-hosted all-in-one server management platform. It provides a multi-platform solution for managing your servers and infrastructure through a single, intuitive interface. Termix offers SSH terminal access, remote desktop control (RDP, VNC, Telnet), SSH tunneling capabilities, remote file management, and many other tools. Termix is the perfect free and self-hosted alternative to Termius available for all platforms.
+Termix is a free, open source, self-hosted server management platform built on plugins. The core keeps your hosts, credentials, users, sharing and sessions. Everything else, like the SSH terminal, remote desktop, file manager, Docker and metrics, is a plugin you can turn on, off or remove.
+
+It runs on web, desktop and mobile. Think of it as a free, self-hosted Termius.
 
 <br />
 
-## Features
+## Try the Demo
 
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**SSH Terminal Access:**
-Full-featured terminal with split-screen support (up to 4 panels) with a browser-like tab system. Includes support for customizing the terminal including common terminal themes, fonts, and other components.
-
-</td>
-<td width="50%" valign="top">
-
-**Remote Desktop Access:**
-RDP, VNC, and Telnet support over the browser with complete customization and split screening.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**SSH Tunnel Management:**
-Create and manage server-to-server SSH tunnels with automatic reconnection, health monitoring, and local, remote, or dynamic SOCKS forwarding. Desktop client-to-server tunnel settings are stored locally per desktop install, optional C2S preset snapshots can be saved to the server, renamed, loaded, or deleted when you want to move a local tunnel configuration between clients.
-
-</td>
-<td width="50%" valign="top">
-
-**Remote File Manager:**
-Manage files directly on remote servers with support for viewing and editing code, images, audio, and video. Upload, download, rename, delete, and move files seamlessly with sudo support. Includes support for moving files from server to server.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Docker and Podman Management:**
-Start, stop, pause, remove containers. View container stats. Control containers using a docker exec terminal. Supports both Docker and Podman as the container runtime. It was not made to replace Portainer or Dockge but rather to simply manage your containers compared to creating them.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH Host Manager:**
-Save, organize, and manage your SSH connections with tags and folders (folder customization and nested folder support), and easily save reusable login info while being able to automate the deployment of SSH keys.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Host Metrics:**
-View CPU, memory, disk usage, network, uptime, system information, firewall, port monitor, log viewer, users/permissions, certificates, and many more which work on most Linux based servers. Includes time-series history graphs and threshold-based alerts with ntfy and webhook support.
-
-</td>
-<td width="50%" valign="top">
-
-**User Authentication:**
-Secure user management with admin controls (can edit other users information) and OIDC/LDAP/SSO (with access control), 2FA (TOTP), and passkey (WebAuthn) support. View active user sessions across all platforms and revoke permissions. Link your OIDC/Local accounts together. View audit log of all users actions.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tailscale Integration:**
-List devices from your tailnet to quickly add them as hosts, and connect using Tailscale SSH as an authentication method, letting your tailnet ACLs handle authorization without storing credentials.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Sharing:**
-Create roles and share hosts across users/roles. Supports all auth types and all host protocols.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Serial Connections:**
-Connect to serial devices (routers, switches, microcontrollers, etc.) directly from the browser or desktop app. Configure baud rate, data bits, stop bits, and parity. Uses the Web Serial API in supported browsers or a native backend in the Electron app.
-
-</td>
-<td width="50%" valign="top">
-
-**Alerts:**
-Set threshold-based alert rules on host metrics (CPU, memory, disk, etc.) and get notified via ntfy or webhooks when they fire. View firing and resolved alerts in a history log.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Homepage:**
-A fully customizable homepage with a drag-and-drop widget grid. Add widgets for host status, service links, clocks, notes, RSS feeds, weather, Docker containers, host metrics charts, embedded terminals, iframes, and more.
-
-</td>
-<td width="50%" valign="top">
-
-**Database Encryption:**
-Backend stored as encrypted SQLite database files. View [docs](https://docs.termix.site/security) for more.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Network Graph:**
-Customize your Dashboard to visualize your homelab based off your SSH connections with status support.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH Tools:**
-Create reusable command snippets that execute with a single click. Run one command simultaneously across multiple open terminals.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Persistent Tabs:**
-SSH sessions and tabs stay open across devices/refreshes if enabled in user profile.
-
-</td>
-<td width="50%" valign="top">
-
-**Languages:**
-Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
+Try it at [demo.termix.site](https://demo.termix.site/). Any username and password works.
 
 <br />
 
-<details>
-<summary><b>More features</b></summary>
+## Core
+
+What every install has, with or without plugins:
+
+- Hosts: Save hosts in nested folders with tags and parent hosts, bulk edit, import and export, and use Quick Connect for one-off connections
+- Credentials: Reuse saved passwords and keys across hosts, with host defaults you can set for the server, a user or a folder
+- Sharing and Roles: Share hosts, credentials and folders with users or roles at four levels: connect, view, edit and manage
+- Accounts: Local accounts, sessions you can see and revoke, trusted devices, API keys and an audit log
+- Security: Passwords, keys and other secrets are encrypted per user, and the database can be encrypted on disk
+- Desktop Sync: The desktop app runs on its own and can link to a Termix server to keep an offline copy of your account
+- Interface: Tabs and split screen, a command palette (double tap left shift), rebindable shortcuts, themes, branding and around 30 languages
+- Databases: SQLite by default, with PostgreSQL and MySQL supported too
+
 <br />
 
-- **Dashboard** - View server information at a glance on your dashboard
-- **API Keys** - Create user-scoped API keys with expiration dates to be used for automation/CI
-- **Data Export/Import** - Export and import SSH hosts, credentials, and file manager data
-- **Automatic SSL Setup** - Built-in SSL certificate generation and management with HTTPS redirects
-- **Modern UI** - Clean desktop/mobile-friendly interface built with React, Tailwind CSS, and Shadcn. Choose between many different UI themes including light, dark, Dracula, etc. Use URL routes to open any connection in full-screen.
-- **Command History** - Auto-complete and view previously ran SSH commands
-- **Quick Connect** - Connect to a server without having to save the connection data
-- **Command Palette** - Double tap left shift to quickly access SSH connections with your keyboard
-- **Proxmox Integration** - Auto-add hosts into Termix from your Proxmox instance
-- **SSH Feature Rich** - Supports jump hosts, Warpgate, TOTP based connections, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, SSH agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, and more.
-- **Termix ID** - A sshid.io equivalent built into Termix. Claim a handle, publish your public SSH keys at a resolver URL, and use a built-in CA to issue SSH certificates.
+## Plugins
 
-</details>
+Plugins add everything else. The official ones ship with Termix, and admins can install, update or remove plugins from the Plugins tab. Each plugin has its own repo.
+
+| Plugin                                                                      | What it does                                                                                                                    |
+| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| [ACME Certificates](https://github.com/Termix-SSH/Plugin-ACME-SSL)          | Gets the Termix HTTPS certificate from Let's Encrypt or any ACME provider and renews it for you.                                |
+| [AI Assistant](https://github.com/Termix-SSH/Plugin-AI)                     | An AI assistant that reads your setup and proposes changes for you to approve.                                                  |
+| [Alerts](https://github.com/Termix-SSH/Plugin-Alerts)                       | One inbox for every alert in Termix, with delivery to webhooks, ntfy, Discord and email.                                        |
+| [Audit Tools](https://github.com/Termix-SSH/Plugin-Audit-Tools)             | Send the audit log to your SIEM and export it as CSV or NDJSON.                                                                 |
+| [Automations](https://github.com/Termix-SSH/Plugin-Automations)             | Run steps on your hosts on a schedule or when something happens.                                                                |
+| [Classic Layout](https://github.com/Termix-SSH/Plugin-Classic-Layout)       | The classic Termix layout with an icon rail, sidebar, tab bar and dock.                                                         |
+| [Classic Themes](https://github.com/Termix-SSH/Plugin-Classic-Themes)       | Light, dark and seven more color themes for Termix.                                                                             |
+| [Credential Tools](https://github.com/Termix-SSH/Plugin-Credential-Tools)   | Generate SSH keys, check them and copy a public key to a host.                                                                  |
+| [Docker](https://github.com/Termix-SSH/Plugin-Docker)                       | Manage Docker and Podman containers on your hosts over SSH, with logs, stats and a console.                                     |
+| [File Manager](https://github.com/Termix-SSH/Plugin-File-Manager)           | Browse, edit and move files over SFTP, including straight from one server to another.                                           |
+| [Fleets](https://github.com/Termix-SSH/Plugin-Fleets)                       | Group hosts into fleets and run commands, package actions and file transfers on all of them at once.                            |
+| [HashiCorp Vault](https://github.com/Termix-SSH/Plugin-Vault)               | Connect to hosts with short-lived SSH certificates signed by HashiCorp Vault.                                                   |
+| [Homepage](https://github.com/Termix-SSH/Plugin-Homepage)                   | A drag and drop widget page for your servers and services, plus service links for the dashboard.                                |
+| [Host Metrics](https://github.com/Termix-SSH/Plugin-Host-Metrics)           | Live CPU, memory, disk, network and GPU stats, plus tools to manage your hosts.                                                 |
+| [Host Status](https://github.com/Termix-SSH/Plugin-Host-Status)             | Shows if each host is online with a dot in the host list, checked by connecting to its port.                                    |
+| [Hosts Config](https://github.com/Termix-SSH/Plugin-Hosts-Config)           | Keep hosts, folders and sharing in a YAML or JSON file. Termix loads them as read only hosts and reloads when the file changes. |
+| [Import and Export](https://github.com/Termix-SSH/Plugin-Import-Export)     | Import hosts from a JSON file or an SSH config file and export them to share or back up.                                        |
+| [LDAP](https://github.com/Termix-SSH/Plugin-LDAP)                           | Sign in with your LDAP or Active Directory username and password.                                                               |
+| [Login Security](https://github.com/Termix-SSH/Plugin-Login-Security)       | Sign people out when idle, limit session length, turn off remember me and require a second factor at login.                     |
+| [Network Topology](https://github.com/Termix-SSH/Plugin-Network-Topology)   | Draws your hosts and the links between them as a live, interactive graph.                                                       |
+| [OPKSSH](https://github.com/Termix-SSH/Plugin-OPKSSH)                       | Connect to hosts with short-lived OpenPubkey SSH certificates after signing in with your identity provider.                     |
+| [Passkeys](https://github.com/Termix-SSH/Plugin-WebAuthn)                   | Sign in with a passkey or security key instead of a password.                                                                   |
+| [Proxmox](https://github.com/Termix-SSH/Plugin-Proxmox)                     | Import Proxmox VE guests as hosts, keep them in sync and watch node stats.                                                      |
+| [Remote Desktop](https://github.com/Termix-SSH/Plugin-Remote-Desktop)       | RDP, VNC and Telnet sessions in your browser, with clipboard, file transfer, sharing and recording.                             |
+| [Secret Sources](https://github.com/Termix-SSH/Plugin-Secret-Sources)       | Pull host passwords and keys from 1Password when you connect instead of storing them in Termix.                                 |
+| [Serial](https://github.com/Termix-SSH/Plugin-Serial)                       | Open a serial console to a router, switch or other device plugged into your computer.                                           |
+| [Session Recording](https://github.com/Termix-SSH/Plugin-Session-Recording) | Record terminal and remote desktop sessions and play them back or download them later.                                          |
+| [Session Sharing](https://github.com/Termix-SSH/Plugin-Session-Sharing)     | Share live sessions by link or with another user, and present sessions to a group in meeting rooms.                             |
+| [Single sign-on](https://github.com/Termix-SSH/Plugin-SSO)                  | Sign in with any OpenID Connect provider, GitHub or Google.                                                                     |
+| [Snippets](https://github.com/Termix-SSH/Plugin-Snippets)                   | Save the commands you run often and run them in a terminal or on many hosts in one click.                                       |
+| [SSH Terminal](https://github.com/Termix-SSH/Plugin-SSH-Terminal)           | SSH terminal sessions with tabs, split screen, history, macros and a local terminal in the desktop app.                         |
+| [Step CA](https://github.com/Termix-SSH/Plugin-Step-CA)                     | Connect to hosts with short-lived SSH certificates from a smallstep step-ca server.                                             |
+| [Tailscale](https://github.com/Termix-SSH/Plugin-Tailscale)                 | Add tailnet devices as hosts and connect with Tailscale SSH.                                                                    |
+| [Termix Identity](https://github.com/Termix-SSH/Plugin-Termix-Identity)     | Publish your SSH public keys under a public handle and run your own SSH certificate authority.                                  |
+| [Tmux Monitor](https://github.com/Termix-SSH/Plugin-Tmux-Monitor)           | Browse and control tmux sessions, windows and panes across your hosts.                                                          |
+| [TOTP](https://github.com/Termix-SSH/Plugin-TOTP)                           | Two-factor sign in with a code from an authenticator app, with backup codes.                                                    |
+| [Tunnels](https://github.com/Termix-SSH/Plugin-Tunnels)                     | SSH port forwarding that reconnects on its own, plus client tunnels from the desktop app.                                       |
+| [Usage Statistics](https://github.com/Termix-SSH/Plugin-Telemetry)          | Sends a small anonymous daily report so we can see how Termix is used.                                                          |
+| [Wake-on-LAN](https://github.com/Termix-SSH/Plugin-Wake-On-LAN)             | Wake sleeping machines by sending a Wake-on-LAN packet to their MAC address.                                                    |
+| [Warpgate](https://github.com/Termix-SSH/Plugin-Warpgate)                   | Connect to hosts through a Warpgate SSH bastion.                                                                                |
+| [Web Endpoint](https://github.com/Termix-SSH/Plugin-Web-Endpoint)           | Open a host's web UI inside Termix, directly or over an SSH tunnel.                                                             |
+| [Workspaces](https://github.com/Termix-SSH/Plugin-Workspaces)               | Save your open tabs and split layouts and reopen them in one click.                                                             |
+
+Want to build your own? Start from the [plugin template](https://github.com/Termix-SSH/Termix-Plugin-Template). Plugins you can install are listed in the [registry](https://github.com/Termix-SSH/Termix-Registry). Turn on the community registry in Plugins, Registries to install plugins made by other people, or add your own registry. See [submitting a plugin](https://docs.termix.site/develop/community-registry) and [hosting your own registry](https://docs.termix.site/develop/registries#host-your-own-registry).
 
 <br />
 
@@ -224,27 +115,27 @@ Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/tr
 </tr>
 <tr>
 <td align="center"><b>Web</b></td>
-<td>Any modern browser (Chrome, Safari, Firefox) · PWA support</td>
+<td>Any modern browser (Chrome, Safari, Firefox) | PWA support</td>
 </tr>
 <tr>
 <td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portable · MSI Installer · Chocolatey</td>
+<td>Portable | EXE and MSI Installer | Chocolatey</td>
 </tr>
 <tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Portable · AUR · AppImage · Deb · Flatpak</td>
+<td align="center"><b>Linux</b> <sub>x64/arm64/armv7l</sub></td>
+<td>Portable | AUR | AppImage | Deb | Flatpak</td>
 </tr>
 <tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
+<td align="center"><b>macOS</b> <sub>Universal/x64/arm64, v12.0+</sub></td>
+<td>Apple App Store | DMG | Homebrew</td>
 </tr>
 <tr>
 <td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
+<td>Apple App Store | IPA</td>
 </tr>
 <tr>
 <td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
+<td>Google Play Store | APK</td>
 </tr>
 </table>
 
@@ -252,14 +143,14 @@ Built-in support ~30 languages (managed by [Crowdin](https://docs.termix.site/tr
 
 ## Installation
 
-Visit the [Termix Docs](https://docs.termix.site/install) for full installation instructions across all platforms.
+See the [docs](https://docs.termix.site/install) for install steps on every platform.
 
-Sample Docker Compose file (you can omit `guacd` and the network if you don't plan on using remote desktop features):
+Sample Docker Compose file. Remote desktop (RDP, VNC and Telnet) is built in, so nothing else needs to run next to it:
 
 ```yaml
 services:
   termix:
-    image: ghcr.io/lukegus/termix:latest
+    image: ghcr.io/termix-ssh/termix:latest
     container_name: termix
     restart: unless-stopped
     ports:
@@ -268,34 +159,23 @@ services:
       - termix-data:/app/data
     environment:
       PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
 
 volumes:
   termix-data:
     driver: local
-
-networks:
-  termix-net:
-    driver: bridge
 ```
 
+### Cloud Hosting
+
+If Termix runs on the network it manages, an outage takes it down right when you need it. A VPS keeps it reachable, gives you a static IP and works from anywhere without a VPN or port forward.
+
+[GINERNET](https://docs.termix.site/install/ginernet) sponsors Termix and the docs have a setup guide for their VPS.
+
 <br />
 
 ## Donate
 
-Termix is free and open source with no subscriptions or paid plans. If you find it useful, consider donating to help cover server costs, domains, and development time. Donations also help fund the time to research and learn what's needed to build features like SAML, Kubernetes, and Agent support. Track progress and donate below.
+Termix has no paid plans. Donations cover servers, domains and development time.
 
 [Donate](https://donate.termix.site/)
 
@@ -303,114 +183,60 @@ Termix is free and open source with no subscriptions or paid plans. If you find
 
 ## Sponsors
 
-Interested in a paid placement to support development? Email [mail@termix.site](mailto:mail@termix.site).
+For a paid sponsor spot, email [mail@termix.site](mailto:mail@termix.site).
+
+<!-- SPONSORS:START -->
 
 <div align="center">
 
 <br />
 
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
+</a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://ginernet.com/">
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
+</a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
 </a>
 
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Support
 
-If you need help or want to request a feature with Termix, visit the [Issues](https://github.com/Termix-SSH/Support/issues) page, log in, and press `New Issue`. Please be as detailed as possible in your issue, preferably written in English. You can also join the [Discord](https://discord.gg/jVQGdvHDrf) server and visit the support channel, however, response times may be longer.
+Bugs and ideas for Termix itself (login, hosts, credentials, sharing, sync, the app and desktop app) go in this repo: [report a bug](https://github.com/Termix-SSH/Termix/issues/new?template=bug_report.yml) or [request a feature](https://github.com/Termix-SSH/Termix/issues/new?template=feature_request.yml).
 
-<br />
+Every plugin has its own repo, so a problem with the terminal, file manager, Docker, remote desktop or any other plugin goes in that plugin's repo (see the table above, or use Report an issue on the plugin's page in the app, which fills in your versions for you). Not sure where it goes? Open it here and it will be moved.
 
-## Screenshots
+You need a GitHub account. Add as much detail as you can, in English if possible.
 
-<div align="center">
-
-<br />
-
-[![YouTube](./docs/repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Watch update overviews on YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="./docs/repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="./docs/repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./docs/repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="./docs/repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./docs/repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="./docs/repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./docs/repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="./docs/repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./docs/repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="./docs/repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./docs/repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="./docs/repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./docs/repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="./docs/repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="./docs/repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="./docs/repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Some videos and images may be out of date or may not perfectly showcase features.</sub>
-
-</div>
-
-<br />
-
-## Planned Features
-
-See [Projects](https://github.com/orgs/Termix-SSH/projects/5) for all planned features. If you are looking to contribute, see [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
+For discussions and questions, join the [Discord](https://discord.gg/jVQGdvHDrf) server. Update videos are on [YouTube](https://www.youtube.com/@TermixSSH/videos).
 
 <br />
 
 ## License
 
-Distributed under the Apache License Version 2.0. See `LICENSE` for more information.
+Apache License 2.0. See [LICENSE](LICENSE).

RELEASE_NOTES.md

@@ -1,70 +0,0 @@
-<!-- SUMMARY -->
-
-Revamped RBAC/sharing, session recording & replay, Vault auth for monitors, API key host enrollment, Proxmox guest auto sync, database refactor, plus 30+ bug fixes across terminal, file manager, RDP/VNC, and auth. DO NOT DOWNGRADE FROM THIS VERSION.
-
-<!-- /SUMMARY -->
-
-<!-- YOUTUBE -->
-
-https://youtu.be/c3UD4q2jW_8
-
-<!-- /YOUTUBE -->
-
-<!-- UPDATE_LOG -->
-
-- Revamped RBAC/sharing system (new UI, all auth types and host protocols now supported)
-- Complete admin control over user information (manage all users hosts, credentials, and snippets)
-- Support Vault auth for monitors
-- API key host enrollment endpoint
-- Allow pinned hosts with name sorting
-- Session recording and replay
-- Terminal font size shortcuts (ctrl + / -)
-- Open File Manager to tab right-click menu
-- Proxmox guest auto sync
-- Complete database refactor
-- 30-day donation reminder and new donation milestones that support research: (donate.termix.site)
-- Improve site performance with cache and poll pauses
-- Save quick connect sessions as hosts
-<!-- /UPDATE_LOG -->
-
-<!-- BUG_FIXES -->
-
-- Syntax highlighting artifacts
-- Filter dashboard status hosts
-- Persist dashboard service link changes
-- Snippet text overflow
-- Persist remote desktop credential auth
-- Guard language switching failures
-- Resolve tunnel source credentials
-- Windows file delete command
-- Artifact release checkout ref
-- Command palette escape in fullscreen
-- Alerts and audit log normalization
-- macOS VNC protocol negotiation
-- Port knocking before SSH connect
-- Allow escape to close link confirmation
-- Prevent Electron modifier wheel zoom
-- Credential auth optional password
-- Retry transient terminal DNS lookups
-- OIDC redirect forwarded port handling
-- Preserve recent open tabs on startup
-- Terminal font selection
-- Poor font legibility in multiple places
-- File manager uploads failing
-- Tmux detection for non-POSTIX shells
-- OPKSSH js-yaml ESM import
-- Android Vietnamese IME input
-- Firefox RDP clipboard paste
-- Proxmox discovery over HTTPS
-- External editor actions in file preview
-- Firefox desktop OIDC callback
-- Status checks through jump hosts
-- Restore sudo password auto fill settings
-- Preserve file editor position on save
-- Sync cloud preference storage mode
-- Render RDP sessions at native pixel density
-- Restore database import in embedded desktop mode
-- Command autocomplete dropdown poor contrast
-- Allow clipboard paste in key recording field
-- Fix GitHub/google SSO "not defined" errors
-<!-- /BUG_FIXES -->

SECURITY.md

@@ -1,5 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-Please report any vulnerabilities to [GitHub Security](https://github.com/Termix-SSH/Termix/security/advisories).

biome.json

@@ -1,58 +0,0 @@
-{
-  "$schema": "https://biomejs.dev/schemas/2.5.1/schema.json",
-  "vcs": {
-    "enabled": true,
-    "clientKind": "git",
-    "useIgnoreFile": true,
-    "defaultBranch": "dev-2.5.0"
-  },
-  "files": {
-    "ignoreUnknown": true,
-    "includes": [
-      "**",
-      "!!build",
-      "!!coverage",
-      "!!dist",
-      "!!dist-ssr",
-      "!!release",
-      "!!node_modules",
-      "!!src/mcp-server/node_modules",
-      "!!db",
-      "!!.env",
-      "!!**/*.min.js",
-      "!!**/*.min.css",
-      "!!openapi.json"
-    ]
-  },
-  "formatter": {
-    "enabled": true,
-    "indentStyle": "space",
-    "indentWidth": 2,
-    "lineWidth": 80,
-    "lineEnding": "lf"
-  },
-  "linter": {
-    "enabled": false
-  },
-  "javascript": {
-    "formatter": {
-      "quoteStyle": "double",
-      "semicolons": "always",
-      "trailingCommas": "all",
-      "arrowParentheses": "always"
-    }
-  },
-  "json": {
-    "formatter": {
-      "trailingCommas": "none"
-    }
-  },
-  "css": {
-    "parser": {
-      "tailwindDirectives": true
-    }
-  },
-  "assist": {
-    "enabled": false
-  }
-}

components.json

@@ -5,7 +5,7 @@
   "tsx": true,
   "tailwind": {
     "config": "",
-    "css": "src/index.css",
+    "css": "src/ui/index.css",
     "baseColor": "neutral",
     "cssVariables": true,
     "prefix": ""
@@ -15,7 +15,7 @@
   "aliases": {
     "components": "@/components",
     "utils": "@/lib/utils",
-    "ui": "@/components/ui",
+    "ui": "@/components",
     "lib": "@/lib",
     "hooks": "@/hooks"
   },

crowdin.yml

@@ -1,6 +0,0 @@
-project_id: "858252"
-api_token: "env:CROWDIN_API_TOKEN"
-
-files:
-  - source: /src/ui/locales/en.json
-    translation: /src/ui/locales/translated/%locale_with_underscore%.json

docker/Dockerfile

@@ -1,17 +1,20 @@
 # Stage 1: Install dependencies
-FROM node:26-slim AS deps
+# The builders only produce JS, so they run on the build machine's own arch
+# once instead of under QEMU per target. Rolldown hangs under arm64 emulation.
+FROM --platform=$BUILDPLATFORM node:24-slim AS deps
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
+COPY packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
 COPY .npmrc ./
 COPY vendor ./vendor
 
-COPY scripts/patch-guacamole-lite.cjs ./scripts/
+COPY scripts/patch-ssh2-agent.cjs ./scripts/
 
 RUN npm ci --ignore-scripts && \
-    node scripts/patch-guacamole-lite.cjs && \
+    node scripts/patch-ssh2-agent.cjs && \
     npm cache clean --force
 
 # Stage 2: Build frontend
@@ -23,7 +26,7 @@ COPY . .
 RUN find public/fonts -name "*.ttf" ! -name "*Regular.ttf" ! -name "*Bold.ttf" ! -name "*Italic.ttf" -delete
 
 RUN npm cache clean --force && \
-    NODE_OPTIONS="--max-old-space-size=3072" npm run build
+    TERMIX_RUNTIME_BASE_PATH=true NODE_OPTIONS="--max-old-space-size=3072" npm run build
 
 # Stage 3: Build backend
 FROM deps AS backend-builder
@@ -31,41 +34,81 @@ WORKDIR /app
 
 COPY . .
 
-RUN npm rebuild better-sqlite3
+# Bundled plugin downloads show in the plugin store, so keep them between builds.
+RUN --mount=type=cache,target=/app/node_modules/.cache/termix-bundled-plugins \
+    npm run build:backend
 
-RUN npm run build:backend
+# Stage 4: Download OPKSSH binary for the target platform so the image works offline
+FROM node:24-slim AS opkssh-downloader
+ARG TARGETARCH
+ARG OPKSSH_VERSION=v0.16.0
+ARG OPKSSH_SHA256_AMD64=c018c3e7baf98612b923e742dd87be38650bf61e3b755fb2bc90de177568b1bf
+ARG OPKSSH_SHA256_ARM64=9dd10c2b6ce99cde18e52c054877ca014134b291fd82afe71741c68db4f83d44
+WORKDIR /opkssh
 
-# Stage 4: Production dependencies only
-FROM node:26-slim AS production-deps
+RUN apt-get update && apt-get install -y curl ca-certificates && rm -rf /var/lib/apt/lists/*
+
+RUN case "$TARGETARCH" in \
+      amd64) OPKSSH_ARCH=amd64; OPKSSH_SHA256="$OPKSSH_SHA256_AMD64" ;; \
+      arm64) OPKSSH_ARCH=arm64; OPKSSH_SHA256="$OPKSSH_SHA256_ARM64" ;; \
+      *) echo "Unsupported architecture: $TARGETARCH" && exit 1 ;; \
+    esac && \
+    curl -fSL -o "opkssh-linux-${OPKSSH_ARCH}" \
+      "https://github.com/openpubkey/opkssh/releases/download/${OPKSSH_VERSION}/opkssh-linux-${OPKSSH_ARCH}" && \
+    echo "$OPKSSH_SHA256  opkssh-linux-${OPKSSH_ARCH}" | sha256sum -c - && \
+    chmod 755 "opkssh-linux-${OPKSSH_ARCH}" && \
+    echo -n "$OPKSSH_VERSION" > version.txt
+
+# Stage 5: Production dependencies only
+FROM node:24-slim AS production-deps
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
+# The plugin SDK is a workspace package core imports at runtime, so npm ci
+# has to see it to link it and install its dependencies.
+COPY packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
 COPY .npmrc ./
 COPY vendor ./vendor
 
-COPY scripts/patch-guacamole-lite.cjs ./scripts/
+COPY scripts/patch-ssh2-agent.cjs ./scripts/
 
+# ssh2's native crypto crashes Node 24 when a cipher is freed, so ssh2 uses
+# OpenSSL instead (chacha20-poly1305 is then left out).
 RUN npm ci --omit=dev --ignore-scripts && \
-    node scripts/patch-guacamole-lite.cjs && \
-    npm rebuild better-sqlite3 bcryptjs ssh2 && \
+    node scripts/patch-ssh2-agent.cjs && \
+    rm -rf node_modules/better-sqlite3/prebuilds && \
+    npm run build-release --prefix node_modules/better-sqlite3 && \
+    test -f node_modules/better-sqlite3/build/Release/better_sqlite3.node && \
+    npm rebuild bcryptjs && \
+    rm -rf node_modules/ssh2/lib/protocol/crypto/build && \
     npm cache clean --force
 
-# Stage 5: Final optimized image
-FROM node:26-slim
+# Stage 6: Final optimized image
+FROM node:24-slim
 WORKDIR /app
 
+# The release the opkssh-downloader stage baked in, so the plugin trusts that
+# binary when the build picks a version other than its pinned one.
+ARG OPKSSH_VERSION=v0.16.0
+ARG OPKSSH_SHA256_AMD64=c018c3e7baf98612b923e742dd87be38650bf61e3b755fb2bc90de177568b1bf
+ARG OPKSSH_SHA256_ARM64=9dd10c2b6ce99cde18e52c054877ca014134b291fd82afe71741c68db4f83d44
+
 ENV DATA_DIR=/app/data \
+    OPKSSH_BUNDLED_DIR=/app/opkssh-bundled \
+    OPKSSH_VERSION=$OPKSSH_VERSION \
+    OPKSSH_SHA256_AMD64=$OPKSSH_SHA256_AMD64 \
+    OPKSSH_SHA256_ARM64=$OPKSSH_SHA256_ARM64 \
     PORT=8080 \
     NODE_ENV=production
 
-RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu wget certbot python3-certbot-dns-cloudflare && \
+RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu wget && \
     update-ca-certificates && \
     rm -rf /var/lib/apt/lists/* && \
-    mkdir -p /app/data /app/uploads /app/data/.opk /app/nginx /tmp/nginx && \
+    mkdir -p /app/data /app/uploads /app/nginx /tmp/nginx && \
     chown -R node:node /app /tmp/nginx && \
-    chmod 755 /app/data /app/uploads /app/data/.opk /app/nginx /tmp/nginx
+    chmod 755 /app/data /app/uploads /app/nginx /tmp/nginx
 
 COPY docker/nginx.conf /app/nginx/nginx.conf.template
 COPY docker/nginx-https.conf /app/nginx/nginx-https.conf.template
@@ -74,11 +117,23 @@ COPY --chown=node:node --from=frontend-builder /app/dist /app/html
 
 COPY --chown=node:node --from=production-deps /app/node_modules /app/node_modules
 COPY --chown=node:node --from=backend-builder /app/dist/backend ./dist/backend
+# Plugins pinned in docker/bundled-plugins.json, resolved as dist/plugins by
+# getBundledPluginsDir().
+COPY --chown=node:node --from=backend-builder /app/dist/plugins ./dist/plugins
+# Target of node_modules/@termix-ssh/plugin-sdk, which core and the plugins import.
+COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
+COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/dist ./packages/plugin-sdk/dist
+# Pre-baked OPKSSH binary. The opkssh plugin uses it when its checksum
+# matches, so an offline install never downloads one.
+COPY --chown=node:node --from=opkssh-downloader /opkssh /app/opkssh-bundled
 COPY --chown=node:node package.json ./
+# Schema for Postgres and MySQL. Unused by the default SQLite deployment, which
+# builds its tables at startup instead.
+COPY --chown=node:node drizzle ./drizzle
 
 VOLUME ["/app/data"]
 
-EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006 30007 30008 30009 30010 30011 30012
+EXPOSE ${PORT}
 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
     CMD wget -q -O /dev/null http://localhost:30001/health || exit 1

docker/bundled-plugins.json

@@ -0,0 +1,279 @@
+{
+  "plugins": [
+    {
+      "id": "acme-ssl",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-ACME-SSL/releases/download/v1.0.2/acme-ssl-1.0.2.tmxplug",
+      "sha256": "157d0f96dc42136ff64e618b6904db7862079cd31c1f1cf5f19846b1d127b00f"
+    },
+    {
+      "id": "ai",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-AI/releases/download/v1.1.0/ai-1.1.0.tmxplug",
+      "sha256": "71dda6940d62c9eede7821bbac21e99443fbc08728a47759f215e2416f1d162f"
+    },
+    {
+      "id": "alerts",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Alerts/releases/download/v1.0.2/alerts-1.0.2.tmxplug",
+      "sha256": "50768e77019276343a5d162c85d081659fb89d1cc3733ac45cd0db4436918faa",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "automations",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Automations/releases/download/v1.0.2/automations-1.0.2.tmxplug",
+      "sha256": "674eb04276b4a0c77c794b30647f8680218a78de8d52b73e99ec900cc1b3fdb3"
+    },
+    {
+      "id": "classic-layout",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Classic-Layout/releases/download/v1.0.0/classic-layout-1.0.0.tmxplug",
+      "sha256": "3a51cc9a4c966478f2ebfd58dbbe025ff0ebe8bbdcd3ba73156151e555f62dec",
+      "defaultLook": true
+    },
+    {
+      "id": "classic-themes",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Classic-Themes/releases/download/v1.0.0/classic-themes-1.0.0.tmxplug",
+      "sha256": "17561e569811476ea4e1f7cdf8d9afbe33edf061bd09f6b05699b44968da41ad",
+      "defaultLook": true
+    },
+    {
+      "id": "docker",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Docker/releases/download/v1.0.2/docker-1.0.2.tmxplug",
+      "sha256": "0e1c722682faac6a027fd9b01e6910eb53ce5acb13332c6c8d8868554f3701ab",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "file-manager",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-File-Manager/releases/download/v1.0.3/file-manager-1.0.3.tmxplug",
+      "sha256": "250e9779a6b1caf11721f1ee2baf76655ae6e52d963e894d8db84eb9677cf0b3",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "fleets",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Fleets/releases/download/v1.0.2/fleets-1.0.2.tmxplug",
+      "sha256": "50dab38e1c6c95fdb4d0544ce50cdf84dae84789e64aa34ea9d04fdac3a38c59"
+    },
+    {
+      "id": "homepage",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Homepage/releases/download/v1.0.2/homepage-1.0.2.tmxplug",
+      "sha256": "88cdea8ba8f458fcf124e7ab97e3d419896d8d22ffa9a372af34f1818872975b"
+    },
+    {
+      "id": "host-metrics",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Host-Metrics/releases/download/v1.0.3/host-metrics-1.0.3.tmxplug",
+      "sha256": "8f6022568349fc4318d509781bdb9d5b40973c010a9e27f720eed6baf68b881e",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "ldap",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-LDAP/releases/download/v1.0.2/ldap-1.0.2.tmxplug",
+      "sha256": "9ef269ad281f1c68cea53e0d43ccb7a5d4f949f11b30b22eac3d01047b20eb03"
+    },
+    {
+      "id": "network-topology",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Network-Topology/releases/download/v1.0.2/network-topology-1.0.2.tmxplug",
+      "sha256": "8d32340a0d0f9674b872da5d3d53e90f529b80dfe0d73ab294eed00e565fbb56"
+    },
+    {
+      "id": "opkssh",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-OPKSSH/releases/download/v1.0.2/opkssh-1.0.2.tmxplug",
+      "sha256": "4bb8f1ac5d39bd18ac3d0fe82ddbf2f26ab4c01bd75e6f7a073d65c2e9aef219"
+    },
+    {
+      "id": "proxmox",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Proxmox/releases/download/v1.0.2/proxmox-1.0.2.tmxplug",
+      "sha256": "b92be2644b0c8121732103b922069a6cb3cf00caad4e6549f7a8cb471bda5e4e"
+    },
+    {
+      "id": "remote-desktop",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Remote-Desktop/releases/download/v1.1.0/remote-desktop-1.1.0.tmxplug",
+      "sha256": "6f74f1d26f91a43b2d2203417d744211f366c335d5fff7bed34bfce33874dd01",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "secret-sources",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Secret-Sources/releases/download/v1.0.2/secret-sources-1.0.2.tmxplug",
+      "sha256": "82e2b1e95b0837dd3e5fee277be4eea2d1ce68567b0e204941c48150f415d134"
+    },
+    {
+      "id": "serial",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Serial/releases/download/v1.0.2/serial-1.0.2.tmxplug",
+      "sha256": "6ede7e8726a7312429473f34a46f93ba6657c5b7ebc12bed18f80ec62c211715",
+      "onboarding": {
+        "recommended": "desktop",
+        "consent": false
+      }
+    },
+    {
+      "id": "session-recording",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Recording/releases/download/v1.0.2/session-recording-1.0.2.tmxplug",
+      "sha256": "55ace6897710ce9a63f24e3d736a9e533cac557be0f3d98974956c94cf417d1c"
+    },
+    {
+      "id": "session-sharing",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Session-Sharing/releases/download/v1.0.2/session-sharing-1.0.2.tmxplug",
+      "sha256": "6408e7949a9549ac5ec94b35205729099138e730df1598d50f4bb618d8d90804"
+    },
+    {
+      "id": "snippets",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Snippets/releases/download/v1.0.2/snippets-1.0.2.tmxplug",
+      "sha256": "cc1f5d74cf97f9a9c8f800fccf481c8a000e6fa516bc260ce24a7249d4f4c8e5",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "ssh-terminal",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-SSH-Terminal/releases/download/v1.0.3/ssh-terminal-1.0.3.tmxplug",
+      "sha256": "bc288bd843e37b64bcda7462d175039147b75dc6de8866769e4a938036a9d023",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "sso",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-SSO/releases/download/v1.0.3/sso-1.0.3.tmxplug",
+      "sha256": "87b03c0789d981dbc806162d73dfcc2c624150375277efd2ae40ab9d7657d48e",
+      "onboarding": {
+        "recommended": false,
+        "consent": false,
+        "enabledByEnv": ["OIDC_CLIENT_ID"]
+      }
+    },
+    {
+      "id": "step-ca",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Step-CA/releases/download/v1.0.2/step-ca-1.0.2.tmxplug",
+      "sha256": "685b644fe44c2d3fa007baee16e8ea8a7d5204f039ebc8aa65e8093ad93adf8a"
+    },
+    {
+      "id": "tailscale",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Tailscale/releases/download/v1.0.2/tailscale-1.0.2.tmxplug",
+      "sha256": "5c7b00d6b6b0186d833302e39a9d31b92ea92d4542e9e2dab550b95837a59d97"
+    },
+    {
+      "id": "telemetry",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Telemetry/releases/download/v1.0.2/telemetry-1.0.2.tmxplug",
+      "sha256": "5ffdc58b05cd8b37fd0a207f99d2d3a256164130c950032501c499f869edb9ec",
+      "onboarding": {
+        "recommended": true,
+        "consent": true
+      }
+    },
+    {
+      "id": "termix-identity",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Termix-Identity/releases/download/v1.0.2/termix-identity-1.0.2.tmxplug",
+      "sha256": "ac6c90a48b4f1e9cff6773a5fd267b2bf7319d2fc7e2aa2cd4004cec82f0f927"
+    },
+    {
+      "id": "tmux-monitor",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Tmux-Monitor/releases/download/v1.0.3/tmux-monitor-1.0.3.tmxplug",
+      "sha256": "f152d64f433d3f1de7c3fdf172e752ea7e333909f0fdda77336a6b8dddb9f242"
+    },
+    {
+      "id": "totp",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-TOTP/releases/download/v1.0.2/totp-1.0.2.tmxplug",
+      "sha256": "94a0772660fa8e4dfd9afc15b68d5bc9fe02fe28a1acfd35e65a57c304d460c0",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "tunnels",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Tunnels/releases/download/v1.0.3/tunnels-1.0.3.tmxplug",
+      "sha256": "d0de9e59ccc9e1a0f2817dd1ec9951021f2d7e89304894bb1e8cefd65aebff0b",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "vault",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Vault/releases/download/v1.0.2/vault-1.0.2.tmxplug",
+      "sha256": "48ef402d030912a836489edf0fdfcaf7929cbd67c21f16a2079cb4925134cc28"
+    },
+    {
+      "id": "wake-on-lan",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Wake-On-LAN/releases/download/v1.0.2/wake-on-lan-1.0.2.tmxplug",
+      "sha256": "3e9cf9a133b4dd96ec5f2b9fbf2d6a3ff7e08f8dfbf1e86b8d45de0c2f024f42"
+    },
+    {
+      "id": "warpgate",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Warpgate/releases/download/v1.0.2/warpgate-1.0.2.tmxplug",
+      "sha256": "5c2c1c9aef40dbbf98424d02303f2ee77e6e869334247881e8aa0fcd8c415b47"
+    },
+    {
+      "id": "web-endpoint",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Web-Endpoint/releases/download/v1.0.2/web-endpoint-1.0.2.tmxplug",
+      "sha256": "0326edb1052d1debd083004c2dd1711d21a902cfacb55ce74d1a8856a5122477"
+    },
+    {
+      "id": "webauthn",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-WebAuthn/releases/download/v1.0.2/webauthn-1.0.2.tmxplug",
+      "sha256": "8269f6e407897332648c8526b65383c4db071ea782bf1e58aa7c7c00627f3f4b",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    },
+    {
+      "id": "workspaces",
+      "source": "tmxplug",
+      "url": "https://github.com/Termix-SSH/Plugin-Workspaces/releases/download/v1.0.2/workspaces-1.0.2.tmxplug",
+      "sha256": "97519a01fbb2eb2eecf21d7b9ab9028c740457bcff9fc6b075fb6facbc5ccb6b",
+      "onboarding": {
+        "recommended": true,
+        "consent": false
+      }
+    }
+  ]
+}

docker/compose-dev.yml

@@ -12,19 +12,9 @@ services:
     environment:
       PORT: "8080"
       NODE_ENV: development
-      GUACD_HOST: "guacd-dev"
-      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
-    depends_on:
-      - guacd-dev
-    networks:
-      - termix-dev-net
-
-  guacd-dev:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd-dev
-    restart: unless-stopped
-    volumes:
-      - termix-dev-data:/termix-data
+      # REDIS_URL: "redis://redis:6379"
+      # TERMIX_REDIS_PREFIX: "termix:collab"
+      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
     networks:
       - termix-dev-net
 

docker/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   termix:
-    image: ghcr.io/lukegus/termix:latest
+    image: ghcr.io/termix-ssh/termix:latest
     container_name: termix
     restart: unless-stopped
     ports:
@@ -9,19 +9,27 @@ services:
       - termix-data:/app/data
     environment:
       PORT: "8080"
-      GUACD_HOST: "guacd"
-      GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    volumes:
-      - termix-data:/termix-data
+      # Multi-instance deployments should point every backend at the same
+      # Redis. Without it, collaboration rooms keep their single-instance
+      # in-memory fallback.
+      # REDIS_URL: "redis://redis:6379"
+      # TERMIX_REDIS_PREFIX: "termix:collab"
+      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
+      # Hardened deployments can require keys from environment variables or
+      # Docker secrets mounted through JWT_SECRET_FILE, DATABASE_KEY_FILE,
+      # ENCRYPTION_KEY_FILE and INTERNAL_AUTH_TOKEN_FILE.
+      # TERMIX_REQUIRE_EXTERNAL_SECRETS: "true"
+      # Trusted reverse-proxy authentication is disabled by default. When
+      # enabled, do not expose this container directly to untrusted clients.
+      # TRUSTED_PROXY_AUTH_ENABLED: "true"
+      # List the address your authenticating proxy connects from, as this
+      # container sees it (for a proxy container on termix-net, its IP there).
+      # Keep it narrow: published ports can reach the container from the
+      # Docker gateway, so do not trust whole private ranges.
+      # TRUSTED_PROXY_AUTH_TRUSTED_PROXIES: "172.20.0.10"
+      # TRUSTED_PROXY_AUTH_ROLE_MAP: '{"operators":["user"]}'
+      # TRUSTED_PROXY_AUTH_USERNAME_HEADER: "x-forwarded-username"
+      # TRUSTED_PROXY_AUTH_ROLE_HEADER: "x-forwarded-role"
     networks:
       - termix-net
 

docker/entrypoint.sh

@@ -22,11 +22,38 @@ if [ "$(id -u)" = "0" ]; then
     fi
 fi
 
+DATA_DIR=${DATA_DIR:-/app/data}
+
+RUNTIME_ENABLE_SSL_SET=${ENABLE_SSL+x}
+RUNTIME_ENABLE_SSL=${ENABLE_SSL-}
+RUNTIME_SSL_PORT_SET=${SSL_PORT+x}
+RUNTIME_SSL_PORT=${SSL_PORT-}
+RUNTIME_SSL_CERT_PATH_SET=${SSL_CERT_PATH+x}
+RUNTIME_SSL_CERT_PATH=${SSL_CERT_PATH-}
+RUNTIME_SSL_KEY_PATH_SET=${SSL_KEY_PATH+x}
+RUNTIME_SSL_KEY_PATH=${SSL_KEY_PATH-}
+RUNTIME_SSL_DOMAIN_SET=${SSL_DOMAIN+x}
+RUNTIME_SSL_DOMAIN=${SSL_DOMAIN-}
+
+if [ -f "$DATA_DIR/.env" ]; then
+    echo "Loading persisted SSL settings from $DATA_DIR/.env"
+    set -a
+    . "$DATA_DIR/.env"
+    set +a
+fi
+
+[ "$RUNTIME_ENABLE_SSL_SET" = "x" ] && ENABLE_SSL=$RUNTIME_ENABLE_SSL
+[ "$RUNTIME_SSL_PORT_SET" = "x" ] && SSL_PORT=$RUNTIME_SSL_PORT
+[ "$RUNTIME_SSL_CERT_PATH_SET" = "x" ] && SSL_CERT_PATH=$RUNTIME_SSL_CERT_PATH
+[ "$RUNTIME_SSL_KEY_PATH_SET" = "x" ] && SSL_KEY_PATH=$RUNTIME_SSL_KEY_PATH
+[ "$RUNTIME_SSL_DOMAIN_SET" = "x" ] && SSL_DOMAIN=$RUNTIME_SSL_DOMAIN
+
 export PORT=${PORT:-8080}
 export ENABLE_SSL=${ENABLE_SSL:-false}
 export SSL_PORT=${SSL_PORT:-8443}
 export SSL_CERT_PATH=${SSL_CERT_PATH:-/app/data/ssl/termix.crt}
 export SSL_KEY_PATH=${SSL_KEY_PATH:-/app/data/ssl/termix.key}
+export TERMIX_SSL_TERMINATED_BY_NGINX=true
 
 echo "Configuring web UI to run on port: $PORT"
 
@@ -41,31 +68,40 @@ fi
 mkdir -p /tmp/nginx
 envsubst '${PORT} ${SSL_PORT} ${SSL_CERT_PATH} ${SSL_KEY_PATH}' < $NGINX_CONF_SOURCE > /tmp/nginx/nginx.conf
 
-mkdir -p /app/data /app/uploads /app/data/.opk /app/data/acme-webroot/.well-known/acme-challenge
-chmod 755 /app/data /app/uploads /app/data/.opk 2>/dev/null || true
+# Which proxies may set the client IP through X-Forwarded-For. Unset keeps
+# the private ranges in the template.
+if [ -n "$TRUSTED_PROXIES" ]; then
+    REAL_IP_LINES=""
+    for proxy in $(echo "$TRUSTED_PROXIES" | tr ',' ' '); do
+        case "$proxy" in
+            *[!0-9a-fA-F:./]*) echo "Ignoring invalid TRUSTED_PROXIES entry: $proxy" ;;
+            *) REAL_IP_LINES="${REAL_IP_LINES}    set_real_ip_from ${proxy};\n" ;;
+        esac
+    done
+    echo "Trusting X-Forwarded-For from: $TRUSTED_PROXIES"
+    awk -v lines="$REAL_IP_LINES" '
+        /# BEGIN TRUSTED_PROXIES/ { printf "%s", lines; skip = 1; next }
+        /# END TRUSTED_PROXIES/ { skip = 0; next }
+        !skip
+    ' /tmp/nginx/nginx.conf > /tmp/nginx/nginx.conf.tmp
+    mv /tmp/nginx/nginx.conf.tmp /tmp/nginx/nginx.conf
+fi
+
+if [ "$ENABLE_SSL" = "true" ] && [ "$PORT" = "$SSL_PORT" ]; then
+    echo "HTTP and HTTPS use port $SSL_PORT; disabling the HTTP redirect listener"
+    sed -i '/# BEGIN HTTP_REDIRECT_SERVER/,/# END HTTP_REDIRECT_SERVER/d' /tmp/nginx/nginx.conf
+fi
+
+mkdir -p /app/data /app/uploads
+chmod 755 /app/data /app/uploads 2>/dev/null || true
 
 if [ -w /app/data ]; then
     echo "Data directory is writable"
 else
-    echo "WARNING: Data directory is not writable. OPKSSH may fail."
+    echo "WARNING: Data directory is not writable. Plugins that keep files (OPKSSH, recordings) may fail."
     ls -ld /app/data
 fi
 
-if [ -w /app/data/.opk ]; then
-    echo "OPKSSH directory is writable"
-else
-    echo "WARNING: OPKSSH directory is not writable. OPKSSH authentication will fail."
-    ls -ld /app/data/.opk
-fi
-
-OPKSSH_DIR="${DATA_DIR:-/app/data}/opkssh"
-if [ ! -d "$OPKSSH_DIR" ]; then
-    echo "WARNING: OPKSSH binary directory not found at $OPKSSH_DIR"
-    echo "OPKSSH will be downloaded automatically on first use."
-else
-    echo "OPKSSH binary directory found at $OPKSSH_DIR"
-fi
-
 if [ "$ENABLE_SSL" = "true" ]; then
     echo "Checking SSL certificate configuration..."
     mkdir -p /app/data/ssl
@@ -79,8 +115,16 @@ if [ "$ENABLE_SSL" = "true" ]; then
         if openssl x509 -in /app/data/ssl/termix.crt -checkend 2592000 -noout >/dev/null 2>&1; then
             echo "SSL certificates are valid and will be reused for domain: $DOMAIN"
         else
-            echo "SSL certificate is expired or expiring soon, regenerating..."
-            rm -f /app/data/ssl/termix.crt /app/data/ssl/termix.key
+            SUBJECT=$(openssl x509 -in /app/data/ssl/termix.crt -noout -subject 2>/dev/null | sed 's/^subject=//')
+            ISSUER=$(openssl x509 -in /app/data/ssl/termix.crt -noout -issuer 2>/dev/null | sed 's/^issuer=//')
+            # Only replace our own self-signed certificate. A CA-issued one is
+            # kept until it expires, even when nothing renews it.
+            if [ -n "$SUBJECT" ] && [ "$SUBJECT" = "$ISSUER" ]; then
+                echo "Self-signed SSL certificate is expired or expiring soon, regenerating..."
+                rm -f /app/data/ssl/termix.crt /app/data/ssl/termix.key
+            else
+                echo "WARNING: SSL certificate expires within 30 days and was not issued by Termix. Renew it."
+            fi
         fi
     else
         echo "SSL certificates not found, will generate new ones..."
@@ -140,7 +184,14 @@ if [ -n "$BASE_PATH" ]; then
     echo "Injecting BASE_PATH: $BASE_PATH"
     # Strip trailing slash for use as a path prefix
     CLEAN_BASE_PATH="${BASE_PATH%/}"
-    find /app/html -name "index.html" -exec sed -i "s|window.__TERMIX_BASE_PATH__ = \"\"|window.__TERMIX_BASE_PATH__ = \"$CLEAN_BASE_PATH\"|g" {} \;
+    case "$CLEAN_BASE_PATH" in
+        /*) ;;
+        *) echo "BASE_PATH must start with /" >&2; exit 1 ;;
+    esac
+    case "$CLEAN_BASE_PATH" in
+        *[!A-Za-z0-9_./~-]*) echo "BASE_PATH contains unsupported characters" >&2; exit 1 ;;
+    esac
+    find /app/html -name "index.html" -exec sed -i "s|name=\"termix-base-path\" content=\"\"|name=\"termix-base-path\" content=\"$CLEAN_BASE_PATH\"|g" {} \;
     # Patch sw.js static asset paths with the base path prefix
     find /app/html -name "sw.js" -exec sed -i "s|__TERMIX_SW_BASE_PATH__|$CLEAN_BASE_PATH|g" {} \;
 else
@@ -163,8 +214,4 @@ else
     echo "Warning: package.json not found"
 fi
 
-node dist/backend/backend/starter.js
-
-echo "All services started"
-
-tail -f /dev/null
+exec node dist/backend/backend/starter.js

docker/nginx-https.conf

@@ -11,6 +11,8 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
+    server_tokens off;
+
     access_log /tmp/nginx/access.log;
 
     client_body_temp_path /tmp/nginx/client_body;
@@ -21,12 +23,30 @@ http {
 
     sendfile on;
     keepalive_timeout 65;
+
+    # Static assets only. API responses arrive already gzipped from the node
+    # backend, and gzip_proxied would otherwise have nginx decompress and
+    # recompress them for nothing.
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 2048;
+    gzip_comp_level 5;
+    gzip_types
+        text/plain
+        text/css
+        text/javascript
+        application/javascript
+        application/json
+        application/wasm
+        image/svg+xml;
     client_header_timeout 300s;
 
+    # BEGIN TRUSTED_PROXIES
     set_real_ip_from 127.0.0.1;
     set_real_ip_from 10.0.0.0/8;
     set_real_ip_from 172.16.0.0/12;
     set_real_ip_from 192.168.0.0/16;
+    # END TRUSTED_PROXIES
     real_ip_header X-Forwarded-For;
     real_ip_recursive on;
 
@@ -51,16 +71,30 @@ http {
     ssl_session_cache shared:SSL:10m;
     ssl_session_timeout 10m;
 
+    # BEGIN HTTP_REDIRECT_SERVER
     server {
         listen ${PORT};
         server_name _;
 
-        return 301 https://$host:${SSL_PORT}$request_uri;
+        # ACME http-01 checks arrive on plain HTTP and must not be redirected.
+        location ^~ /.well-known/acme-challenge/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location / {
+            return 301 https://$host:${SSL_PORT}$request_uri;
+        }
     }
+    # END HTTP_REDIRECT_SERVER
 
     server {
         listen ${SSL_PORT} ssl;
         server_name _;
+        client_max_body_size 50m;
 
         absolute_redirect off;
 
@@ -69,17 +103,20 @@ http {
 
         add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
         add_header X-Content-Type-Options nosniff always;
-        add_header X-XSS-Protection "1; mode=block" always;
 
         location ^~ /.well-known/acme-challenge/ {
-            root /app/data/acme-webroot;
-            default_type "text/plain";
-            try_files $uri =404;
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
 
         location = /sw.js {
             root /app/html;
             expires off;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri =404;
         }
@@ -87,31 +124,68 @@ http {
         location = /manifest.json {
             root /app/html;
             expires off;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri =404;
         }
 
-        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        location ^~ /assets/ {
             root /app/html;
             expires 1y;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "public, max-age=31536000, immutable" always;
             try_files $uri =404;
         }
 
+        location ^~ /fonts/ {
+            root /app/html;
+            expires 1y;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=31536000, immutable" always;
+            try_files $uri =404;
+        }
+
+        location ^~ /icons/ {
+            root /app/html;
+            expires 30d;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=2592000" always;
+            try_files $uri =404;
+        }
+
+        location ~* ^/[^/]+\.(js|css|png|jpe?g|gif|ico|svg|webp|woff2?|ttf|eot)$ {
+            root /app/html;
+            expires 30d;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=2592000" always;
+            try_files $uri =404;
+        }
+
+        location ~* \.map$ {
+            access_log off;
+            log_not_found off;
+            return 404;
+        }
+
         location / {
             root /app/html;
             index index.html index.htm;
             expires off;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-0FPou4vGHwupDie6Xais6VntpJ4yaK9E6TyhXLwZe8o='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; connect-src 'self' http: https: ws: wss:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; frame-src http: https:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri $uri/ /index.html;
         }
 
-        location ~* \.map$ {
-            return 404;
-            access_log off;
-            log_not_found off;
-        }
-
         location ~ ^/users/sessions(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -126,6 +200,9 @@ http {
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
+            # The TCP peer before set_real_ip_from rewrites $remote_addr from
+            # X-Forwarded-For; trusted proxy login checks this address.
+            proxy_set_header X-Termix-Proxy-Peer $realip_remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
             proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
@@ -150,42 +227,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/alerts(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-rules(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/notification-channels(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-firings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/rbac(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -208,7 +249,7 @@ http {
             proxy_read_timeout 300s;
         }
 
-        location ~ ^/snippets(/.*)?$ {
+        location ~ ^/ssh-auth(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -217,37 +258,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/vault(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/termix-id(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
-
-        location ~ ^/proxmox(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 120s;
-            proxy_read_timeout 120s;
-        }
-
-        location ~ ^/c2s-tunnel-presets(/.*)?$ {
+        location ~ ^/sync(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -265,7 +276,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/terminal(/.*)?$ {
+        location ~ ^/plugins(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -274,6 +285,66 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
+        # Plugin frontend bundles, stylesheets and locales. Public like
+        # /assets; the backend picks the cache policy from the ?v= query.
+        location ^~ /plugin-assets/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        # Every plugin's HTTP routes. One block, no per-plugin entries: a
+        # plugin serves at /plugin-api/<id>/ on the main backend and never
+        # gets a port or a block of its own. Buffering is off so SSE streams
+        # (AI, Proxmox discovery) reach the browser as they are produced, and
+        # request buffering is off so large uploads stream through.
+        location ^~ /plugin-api/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            client_max_body_size 0;
+        }
+
+        # Every plugin's WebSockets: terminal, Guacamole display, Docker
+        # console. Served at /plugin-ws/<id>/<path> from the same backend.
+        location ^~ /plugin-ws/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+        }
+
         location ~ ^/open-tabs(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -292,26 +363,34 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/database(/.*)?$ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
+        location ~ ^/host-sidebar(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
         }
 
-        location ~ ^/db(/.*)?$ {
+        location ~ ^/credential-sidebar(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/ui-preferences(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/database(/.*)?$ {
             client_max_body_size 5G;
             client_body_timeout 300s;
 
@@ -349,36 +428,16 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/host/opkssh-chooser(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-chooser$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
-        }
-
-        location ~ ^/host/opkssh-callback(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-callback$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+            # A terminal is quiet most of the time - waiting on a prompt, reading
+            # output, running something long. Every console plugin dials this route
+            # (terminal, serial, remote desktop), and nginx's default
+            # proxy_read_timeout of 60s closed the socket about a minute into any
+            # pause, which reaches the user as the SSH server disconnecting. The
+            # plugin WebSocket routes below already ask for 86400s; this is the same
+            # class of socket, so it asks for the same.
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_buffering off;
         }
 
         location /host/ {
@@ -390,193 +449,10 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location /session_logs/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /tailscale/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/websocket/ {
-            proxy_pass http://127.0.0.1:30002/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ^~ /guacamole/websocket/ {
-            proxy_pass http://127.0.0.1:30008/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ~ ^/guacamole(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
-            proxy_cache off;
-        }
-
-        location /host/file_manager/recent {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/pinned {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/shortcuts {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/sudo-password {
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/file_manager/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location /host/file_manager/ssh/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location ~ ^/network-topology(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
+        # File manager routes (recent/pinned/shortcuts, SFTP, transfers) moved
+        # to the file-manager plugin, served under /plugin-api/file-manager/.
+        # Session logs moved to the session-recording plugin, served under
+        # /plugin-api/session-recording/.
 
         location /health {
             proxy_pass http://127.0.0.1:30001;
@@ -587,8 +463,11 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/status(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
+        # Service links and the homepage widget canvas moved to the homepage
+        # plugin, served under /plugin-api/homepage/.
+
+        location /dashboard/ {
+            proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -596,163 +475,13 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 60s;
-            proxy_read_timeout 60s;
-        }
-
-        location ~ ^/(refresh|host-updated)$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/host-metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 600s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/global-settings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/uptime(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/activity(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/service-links(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/homepage(/.*)?$ {
-            proxy_pass http://127.0.0.1:30012;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ^~ /docker/console/ {
-            proxy_pass http://127.0.0.1:30009/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        # --- tmux-monitor begin ---
-        location ~ ^/tmux_monitor(/.*)?$ {
-            proxy_pass http://127.0.0.1:30010;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-        # --- tmux-monitor end ---
-
-        location ~ ^/docker(/.*)?$ {
-            proxy_pass http://127.0.0.1:30007;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-
-        location ^~ /serial/websocket/ {
-            proxy_pass http://127.0.0.1:30011/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-        }
-
         error_page 500 502 503 504 /50x.html;
+        # Only nginx's own errors land here (the backend is down or too slow).
+        # There is no 50x page, so answer directly instead of a 404.
         location = /50x.html {
-            root /app/html;
+            internal;
+            default_type application/json;
+            return 502 '{"error":"The Termix server is not responding"}';
         }
     }
 }

docker/nginx.conf

@@ -11,6 +11,8 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
+    server_tokens off;
+
     access_log /tmp/nginx/access.log;
 
     client_body_temp_path /tmp/nginx/client_body;
@@ -21,12 +23,30 @@ http {
 
     sendfile on;
     keepalive_timeout 65;
+
+    # Static assets only. API responses arrive already gzipped from the node
+    # backend, and gzip_proxied would otherwise have nginx decompress and
+    # recompress them for nothing.
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 2048;
+    gzip_comp_level 5;
+    gzip_types
+        text/plain
+        text/css
+        text/javascript
+        application/javascript
+        application/json
+        application/wasm
+        image/svg+xml;
     client_header_timeout 300s;
 
+    # BEGIN TRUSTED_PROXIES
     set_real_ip_from 127.0.0.1;
     set_real_ip_from 10.0.0.0/8;
     set_real_ip_from 172.16.0.0/12;
     set_real_ip_from 192.168.0.0/16;
+    # END TRUSTED_PROXIES
     real_ip_header X-Forwarded-For;
     real_ip_recursive on;
 
@@ -54,21 +74,24 @@ http {
     server {
         listen ${PORT};
         server_name _;
+        client_max_body_size 50m;
 
         absolute_redirect off;
 
         add_header X-Content-Type-Options nosniff always;
-        add_header X-XSS-Protection "1; mode=block" always;
 
         location ^~ /.well-known/acme-challenge/ {
-            root /app/data/acme-webroot;
-            default_type "text/plain";
-            try_files $uri =404;
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
 
         location = /sw.js {
             root /app/html;
             expires off;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri =404;
         }
@@ -76,31 +99,62 @@ http {
         location = /manifest.json {
             root /app/html;
             expires off;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri =404;
         }
 
-        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        location ^~ /assets/ {
             root /app/html;
             expires 1y;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "public, max-age=31536000, immutable" always;
             try_files $uri =404;
         }
 
+        location ^~ /fonts/ {
+            root /app/html;
+            expires 1y;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=31536000, immutable" always;
+            try_files $uri =404;
+        }
+
+        location ^~ /icons/ {
+            root /app/html;
+            expires 30d;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=2592000" always;
+            try_files $uri =404;
+        }
+
+        location ~* ^/[^/]+\.(js|css|png|jpe?g|gif|ico|svg|webp|woff2?|ttf|eot)$ {
+            root /app/html;
+            expires 30d;
+            add_header X-Content-Type-Options nosniff always;
+            add_header Cache-Control "public, max-age=2592000" always;
+            try_files $uri =404;
+        }
+
+        location ~* \.map$ {
+            access_log off;
+            log_not_found off;
+            return 404;
+        }
+
         location / {
             root /app/html;
             index index.html index.htm;
             expires off;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-0FPou4vGHwupDie6Xais6VntpJ4yaK9E6TyhXLwZe8o='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; connect-src 'self' http: https: ws: wss:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; frame-src http: https:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+            add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri $uri/ /index.html;
         }
 
-        location ~* \.map$ {
-            return 404;
-            access_log off;
-            log_not_found off;
-        }
-
         location ~ ^/users/sessions(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -115,6 +169,9 @@ http {
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
+            # The TCP peer before set_real_ip_from rewrites $remote_addr from
+            # X-Forwarded-For; trusted proxy login checks this address.
+            proxy_set_header X-Termix-Proxy-Peer $realip_remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
             proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
@@ -139,42 +196,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/alerts(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-rules(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/notification-channels(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-firings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/rbac(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -197,7 +218,7 @@ http {
             proxy_read_timeout 300s;
         }
 
-        location ~ ^/snippets(/.*)?$ {
+        location ~ ^/ssh-auth(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -206,37 +227,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/vault(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/termix-id(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
-
-        location ~ ^/proxmox(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 120s;
-            proxy_read_timeout 120s;
-        }
-
-        location ~ ^/c2s-tunnel-presets(/.*)?$ {
+        location ~ ^/sync(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -254,7 +245,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/terminal(/.*)?$ {
+        location ~ ^/plugins(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -263,6 +254,66 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
+        # Plugin frontend bundles, stylesheets and locales. Public like
+        # /assets; the backend picks the cache policy from the ?v= query.
+        location ^~ /plugin-assets/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        # Every plugin's HTTP routes. One block, no per-plugin entries: a
+        # plugin serves at /plugin-api/<id>/ on the main backend and never
+        # gets a port or a block of its own. Buffering is off so SSE streams
+        # (AI, Proxmox discovery) reach the browser as they are produced, and
+        # request buffering is off so large uploads stream through.
+        location ^~ /plugin-api/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            client_max_body_size 0;
+        }
+
+        # Every plugin's WebSockets: terminal, Guacamole display, Docker
+        # console. Served at /plugin-ws/<id>/<path> from the same backend.
+        location ^~ /plugin-ws/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+        }
+
         location ~ ^/open-tabs(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -281,26 +332,34 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/database(/.*)?$ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
+        location ~ ^/host-sidebar(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
         }
 
-        location ~ ^/db(/.*)?$ {
+        location ~ ^/credential-sidebar(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/ui-preferences(/.*)?$ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ~ ^/database(/.*)?$ {
             client_max_body_size 5G;
             client_body_timeout 300s;
 
@@ -338,36 +397,16 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/host/opkssh-chooser(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-chooser$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
-        }
-
-        location ~ ^/host/opkssh-callback(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-callback$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
+            # A terminal is quiet most of the time - waiting on a prompt, reading
+            # output, running something long. Every console plugin dials this route
+            # (terminal, serial, remote desktop), and nginx's default
+            # proxy_read_timeout of 60s closed the socket about a minute into any
+            # pause, which reaches the user as the SSH server disconnecting. The
+            # plugin WebSocket routes below already ask for 86400s; this is the same
+            # class of socket, so it asks for the same.
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_buffering off;
         }
 
         location /host/ {
@@ -379,193 +418,10 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location /session_logs/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /tailscale/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/websocket/ {
-            proxy_pass http://127.0.0.1:30002/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ^~ /guacamole/websocket/ {
-            proxy_pass http://127.0.0.1:30008/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ~ ^/guacamole(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
-            proxy_cache off;
-        }
-
-        location /host/file_manager/recent {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/pinned {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/shortcuts {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/sudo-password {
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/file_manager/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location /host/file_manager/ssh/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location ~ ^/network-topology(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
+        # File manager routes (recent/pinned/shortcuts, SFTP, transfers) moved
+        # to the file-manager plugin, served under /plugin-api/file-manager/.
+        # Session logs moved to the session-recording plugin, served under
+        # /plugin-api/session-recording/.
 
         location /health {
             proxy_pass http://127.0.0.1:30001;
@@ -576,8 +432,11 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/status(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
+        # Service links and the homepage widget canvas moved to the homepage
+        # plugin, served under /plugin-api/homepage/.
+
+        location /dashboard/ {
+            proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -585,163 +444,13 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 60s;
-            proxy_read_timeout 60s;
-        }
-
-        location ~ ^/(refresh|host-updated)$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/host-metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 600s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/global-settings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/uptime(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/activity(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/service-links(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/homepage(/.*)?$ {
-            proxy_pass http://127.0.0.1:30012;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ^~ /docker/console/ {
-            proxy_pass http://127.0.0.1:30009/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        # --- tmux-monitor begin ---
-        location ~ ^/tmux_monitor(/.*)?$ {
-            proxy_pass http://127.0.0.1:30010;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-        # --- tmux-monitor end ---
-
-        location ~ ^/docker(/.*)?$ {
-            proxy_pass http://127.0.0.1:30007;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-
-        location ^~ /serial/websocket/ {
-            proxy_pass http://127.0.0.1:30011/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-        }
-
         error_page 500 502 503 504 /50x.html;
+        # Only nginx's own errors land here (the backend is down or too slow).
+        # There is no 50x page, so answer directly instead of a 404.
         location = /50x.html {
-            root /app/html;
+            internal;
+            default_type application/json;
+            return 502 '{"error":"The Termix server is not responding"}';
         }
     }
 }

docs/readme/README-AR.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>إدارة SSH ذاتية الاستضافة والوصول إلى سطح المكتب البعيد</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  العربية ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix مجاني ومفتوح المصدر. إذا وجدته مفيدًا، فكّر في [التبرع](https://donate.termix.site/) للمساعدة في تغطية تكاليف الخادم ووقت التطوير.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>تم تحقيقه في 1 سبتمبر 2025</sub>
-</p>
-
-</div>
-
-<br />
-
-## نظرة عامة
-
-Termix هي منصة مفتوحة المصدر ومجانية للأبد وذاتية الاستضافة لإدارة الخوادم بشكل شامل. توفر حلاً متعدد المنصات لإدارة خوادمك وبنيتك التحتية من خلال واجهة واحدة وسهلة الاستخدام. يوفر Termix الوصول إلى طرفية SSH، والتحكم في سطح المكتب البعيد (RDP، VNC، Telnet)، وقدرات إنشاء أنفاق SSH، وإدارة ملفات SSH عن بُعد، والعديد من الأدوات الأخرى. يُعد Termix البديل المثالي المجاني وذاتي الاستضافة لـ Termius المتاح لجميع المنصات.
-
-<br />
-
-## الميزات
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**الوصول إلى طرفية SSH:**
-طرفية كاملة الميزات مع دعم تقسيم الشاشة (حتى 4 لوحات) مع نظام علامات تبويب شبيه بالمتصفح. يتضمن دعم تخصيص الطرفية بما في ذلك سمات الطرفية الشائعة والخطوط والمكونات الأخرى.
-
-</td>
-<td width="50%" valign="top">
-
-**الوصول إلى سطح المكتب البعيد:**
-دعم RDP و VNC و Telnet عبر المتصفح مع تخصيص كامل وتقسيم الشاشة.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**إدارة أنفاق SSH:**
-إنشاء وإدارة أنفاق SSH بين الخوادم مع إعادة الاتصال التلقائي ومراقبة الحالة وإعادة التوجيه المحلي أو البعيد أو SOCKS الديناميكي. يتم تخزين إعدادات نفق العميل-المكتبي إلى السيرفر محلياً لكل تثبيت مكتبي، ويمكن حفظ لقطات C2S الاختيارية على الخادم وإعادة تسميتها وتحميلها أو حذفها عندما تريد نقل تكوين النفق المحلي بين العملاء.
-
-</td>
-<td width="50%" valign="top">
-
-**مدير الملفات عن بُعد:**
-إدارة الملفات مباشرة على الخوادم البعيدة مع دعم عرض وتحرير الكود والصور والصوت والفيديو. رفع وتنزيل وإعادة تسمية وحذف ونقل الملفات بسلاسة مع دعم sudo. يتضمن دعم نقل الملفات من خادم إلى آخر.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**إدارة Docker و Podman:**
-تشغيل وإيقاف وتعليق وحذف الحاويات. عرض إحصائيات الحاويات. التحكم في الحاوية باستخدام طرفية docker exec. يدعم كلاً من Docker و Podman كبيئة تشغيل للحاويات. لم يُصمم ليحل محل Portainer أو Dockge بل لإدارة حاوياتك ببساطة مقارنة بإنشائها.
-
-</td>
-<td width="50%" valign="top">
-
-**مدير مضيفات SSH:**
-حفظ وتنظيم وإدارة اتصالات SSH الخاصة بك باستخدام العلامات والمجلدات (مع دعم تخصيص المجلدات والمجلدات المتداخلة)، وحفظ بيانات تسجيل الدخول القابلة لإعادة الاستخدام بسهولة مع إمكانية أتمتة نشر مفاتيح SSH.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**مقاييس المضيف:**
-عرض استخدام المعالج والذاكرة والقرص والشبكة ووقت التشغيل ومعلومات النظام وجدار الحماية ومراقب المنافذ وعارض السجلات والمستخدمين/الصلاحيات والشهادات وغيرها الكثير، تعمل على معظم الخوادم المبنية على Linux. يتضمن رسوم بيانية تاريخية زمنية السلسلة وتنبيهات قائمة على الحدود مع دعم ntfy والـ webhook.
-
-</td>
-<td width="50%" valign="top">
-
-**مصادقة المستخدمين:**
-إدارة آمنة للمستخدمين مع ضوابط إدارية (يمكن تعديل معلومات المستخدمين الآخرين) ودعم OIDC/LDAP/SSO (مع التحكم في الوصول) و 2FA (TOTP) ودعم مفاتيح المرور (WebAuthn). عرض جلسات المستخدمين النشطة عبر جميع المنصات وإلغاء الصلاحيات. ربط حسابات OIDC/المحلية معاً. عرض سجل تدقيق لجميع إجراءات المستخدمين.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**تكامل Tailscale:**
-عرض أجهزة شبكتك من Tailscale لإضافتها بسرعة كمضيفات، والاتصال عبر Tailscale SSH كطريقة مصادقة، مما يتيح لقوائم تحكم الوصول في Tailscale التعامل مع التفويض دون الحاجة لتخزين بيانات اعتماد.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/المشاركة:**
-إنشاء الأدوار ومشاركة المضيفات عبر المستخدمين/الأدوار. يدعم جميع أنواع المصادقة وجميع بروتوكولات المضيف.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**الاتصالات التسلسلية:**
-الاتصال بالأجهزة التسلسلية (أجهزة التوجيه والمفاتيح والمتحكمات الدقيقة وغيرها) مباشرة من المتصفح أو تطبيق سطح المكتب. ضبط معدل نقل البيانات وبتات البيانات وبتات التوقف والتكافؤ. يستخدم Web Serial API في المتصفحات المدعومة أو خلفية أصلية في تطبيق Electron.
-
-</td>
-<td width="50%" valign="top">
-
-**التنبيهات:**
-ضبط قواعد تنبيه قائمة على الحدود لمقاييس المضيف (المعالج والذاكرة والقرص وغيرها) والحصول على إشعارات عبر ntfy أو webhooks عند إطلاقها. عرض التنبيهات النشطة والمحلولة في سجل التاريخ.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**الصفحة الرئيسية:**
-صفحة رئيسية قابلة للتخصيص بالكامل مع شبكة أدوات قابلة للسحب والإفلات. أضف أدوات لحالة المضيف وروابط الخدمات والساعات والملاحظات وخلاصات RSS والطقس وحاويات Docker ومخططات مقاييس المضيف والطرفيات المضمنة والإطارات المضمنة وأكثر.
-
-</td>
-<td width="50%" valign="top">
-
-**تشفير قاعدة البيانات:**
-يُخزَّن الخادم الخلفي كملفات قاعدة بيانات SQLite مشفرة. اطلع على [الوثائق](https://docs.termix.site/security) لمزيد من المعلومات.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**الرسم البياني للشبكة:**
-تخصيص لوحة التحكم لتصور مختبرك المنزلي بناءً على اتصالات SSH مع دعم الحالة.
-
-</td>
-<td width="50%" valign="top">
-
-**أدوات SSH:**
-إنشاء مقتطفات أوامر قابلة لإعادة الاستخدام تُنفَّذ بنقرة واحدة. تشغيل أمر واحد في وقت واحد عبر عدة طرفيات مفتوحة.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**علامات التبويب الدائمة:**
-تبقى جلسات SSH وعلامات التبويب مفتوحة عبر الأجهزة/التحديثات إذا تم تفعيلها في ملف تعريف المستخدم.
-
-</td>
-<td width="50%" valign="top">
-
-**اللغات:**
-دعم مدمج لحوالي 30 لغة (تُدار بواسطة [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>المزيد من الميزات</b></summary>
-<br />
-
-- **لوحة التحكم** - عرض معلومات الخادم بنظرة واحدة على لوحة التحكم
-- **مفاتيح API** - إنشاء مفاتيح API محددة النطاق للمستخدم مع تواريخ انتهاء صلاحية للاستخدام في الأتمتة/CI
-- **تصدير/استيراد البيانات** - تصدير واستيراد مضيفات SSH وبيانات الاعتماد وبيانات مدير الملفات
-- **إعداد SSL تلقائي** - إنشاء وإدارة شهادات SSL مدمجة مع إعادة التوجيه إلى HTTPS
-- **واجهة مستخدم حديثة** - واجهة نظيفة متوافقة مع سطح المكتب والهاتف المحمول مبنية بـ React و Tailwind CSS و Shadcn. الاختيار بين العديد من سمات واجهة المستخدم بما في ذلك الفاتح والداكن و Dracula وغيرها. استخدام مسارات URL لفتح أي اتصال في وضع ملء الشاشة.
-- **سجل الأوامر** - الإكمال التلقائي وعرض أوامر SSH التي تم تنفيذها سابقاً
-- **الاتصال السريع** - الاتصال بخادم دون الحاجة إلى حفظ بيانات الاتصال
-- **لوحة الأوامر** - اضغط مرتين على Shift الأيسر للوصول السريع إلى اتصالات SSH باستخدام لوحة المفاتيح
-- **تكامل Proxmox** - إضافة المضيفات تلقائياً إلى Termix من نسخة Proxmox الخاصة بك
-- **ميزات SSH الغنية** - دعم مضيفات القفز، Warpgate، الاتصالات المبنية على TOTP، SOCKS5، التحقق من مفتاح المضيف، الملء التلقائي لكلمة المرور، [OPKSSH](https://github.com/openpubkey/opkssh)، tmux، port knocking، تسجيل الطرفية، إعادة توجيه وكيل SSH، وكيل Bitwarden SSH، توقيع SSH عبر HashiCorp Vault، وغيرها.
-- **Termix ID** - مكافئ لـ sshid.io مدمج في Termix. احصل على اسم مستخدم، انشر مفاتيح SSH العامة الخاصة بك على رابط محلل (resolver URL)، واستخدم هيئة إصدار شهادات (CA) مدمجة لإصدار شهادات SSH.
-
-</details>
-
-<br />
-
-## دعم المنصات
-
-<table align="center">
-<tr>
-<th align="center">المنصة</th>
-<th align="center">التوزيع</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>أي متصفح حديث (Chrome، Safari، Firefox) · دعم PWA</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>نسخة محمولة · مثبت MSI · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>نسخة محمولة · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## التثبيت
-
-قم بزيارة [وثائق](https://docs.termix.site/install) Termix للحصول على تعليمات التثبيت الكاملة عبر جميع المنصات.
-
-نموذج ملف Docker Compose (يمكنك حذف `guacd` والشبكة إذا كنت لا تخطط لاستخدام ميزات سطح المكتب البعيد):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## التبرع
-
-Termix مجاني ومفتوح المصدر بدون اشتراكات أو خطط مدفوعة. إذا وجدته مفيدًا، فكّر في التبرع للمساعدة في تغطية تكاليف الخادم والنطاقات ووقت التطوير. تساعد التبرعات أيضاً في تمويل الوقت اللازم للبحث وتعلم ما هو مطلوب لبناء ميزات مثل SAML و Kubernetes ودعم الوكلاء (Agent). تابع التقدم وتبرع أدناه.
-
-[تبرع](https://donate.termix.site/)
-
-<br />
-
-## الرعاة
-
-هل تريد إعلاناً مدفوعاً لدعم التطوير؟ راسلنا عبر البريد الإلكتروني [mail@termix.site](mailto:mail@termix.site).
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## الدعم
-
-إذا كنت بحاجة إلى مساعدة أو ترغب في طلب ميزة لـ Termix، قم بزيارة صفحة [المشكلات](https://github.com/Termix-SSH/Support/issues)، وسجل الدخول، واضغط على `New Issue`. يرجى أن تكون مفصلاً قدر الإمكان في مشكلتك، ويُفضَّل كتابتها باللغة الإنجليزية. يمكنك أيضاً الانضمام إلى خادم [Discord](https://discord.gg/jVQGdvHDrf) وزيارة قناة الدعم، ومع ذلك قد تكون أوقات الاستجابة أطول.
-
-<br />
-
-## لقطات الشاشة
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>شاهد نظرة عامة على التحديثات على YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>قد تكون بعض مقاطع الفيديو والصور قديمة أو قد لا تعرض الميزات بشكل مثالي.</sub>
-
-</div>
-
-<br />
-
-## الميزات المخططة
-
-راجع [المشاريع](https://github.com/orgs/Termix-SSH/projects/5) لعرض جميع الميزات المخططة. إذا كنت تتطلع للمساهمة، راجع [المساهمة](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
-## الترخيص
-
-موزع بموجب رخصة Apache License الإصدار 2.0. راجع ملف `LICENSE` لمزيد من المعلومات.

docs/readme/README-CN.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>自托管 SSH 管理与远程桌面访问平台</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  中文 ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix 免费且开源。如果您觉得它有用，请考虑[捐赠](https://donate.termix.site/)以帮助支付服务器费用和开发时间。
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>获得于 2025年9月1日</sub>
-</p>
-
-</div>
-
-<br />
-
-## 概览
-
-Termix 是一个开源、永久免费、自托管的一体化服务器管理平台。它提供了一个多平台解决方案，通过一个直观的界面管理你的服务器和基础设施。Termix 提供 SSH 终端访问、远程桌面控制（RDP、VNC、Telnet）、SSH 隧道功能、远程文件管理以及许多其他工具。Termix 是适用于所有平台的完美免费自托管 Termius 替代品。
-
-<br />
-
-## 功能
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**SSH 终端访问:**
-功能齐全的终端，支持分屏（最多 4 个面板），并配有类似浏览器的标签系统。包括对自定义终端的支持，如常用的终端主题、字体和其他组件。
-
-</td>
-<td width="50%" valign="top">
-
-**远程桌面访问:**
-通过浏览器支持 RDP、VNC 和 Telnet，具有完整的自定义和分屏功能。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**SSH 隧道管理:**
-创建和管理具有自动重连和健康监测功能的服务器间 SSH 隧道，支持本地、远程或动态 SOCKS 转发。桌面客户端到服务器的隧道设置按桌面安装本地存储，可选的 C2S 预设快照可保存到服务器、重命名、加载或删除，以便在客户端之间迁移本地隧道配置。
-
-</td>
-<td width="50%" valign="top">
-
-**远程文件管理器:**
-直接在远程服务器上管理文件，支持查看和编辑代码、图像、音频和视频。支持通过 sudo 无缝上传、下载、重命名、删除和移动文件。包括支持在服务器之间移动文件。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Docker 和 Podman 管理:**
-启动、停止、暂停、移除容器。查看容器统计信息。通过 docker exec 终端控制容器。同时支持 Docker 和 Podman 作为容器运行时。它的初衷不是取代 Portainer 或 Dockge，而是为了比直接创建容器更简单地管理它们。
-
-</td>
-<td width="50%" valign="top">
-
-**SSH 主机管理器:**
-通过标签和文件夹（支持文件夹自定义和嵌套文件夹）保存、组织和管理您的 SSH 连接，轻松保存可重用的登录信息，并能自动化部署 SSH 密钥。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**主机指标:**
-在大多数基于 Linux 的服务器上查看 CPU、内存、磁盘使用情况、网络、运行时间、系统信息、防火墙、端口监控、日志查看器、用户/权限、证书等更多信息。包括时间序列历史图表和支持 ntfy 与 webhook 的阈值告警。
-
-</td>
-<td width="50%" valign="top">
-
-**用户认证:**
-安全的用户管理，具有管理员控制（可编辑其他用户信息）和 OIDC/LDAP/SSO（带访问控制）、2FA (TOTP) 以及通行密钥（WebAuthn）支持。查看所有平台上的活动用户会话并撤销权限。将您的 OIDC/本地账户链接在一起。查看所有用户操作的审计日志。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tailscale 集成:**
-列出您 Tailscale 网络中的设备以快速添加为主机，并使用 Tailscale SSH 作为身份验证方式，让您的 Tailscale ACL 处理授权而无需存储凭据。
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/共享:**
-创建角色并在用户/角色之间共享主机。支持所有认证类型和所有主机协议。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**串口连接:**
-直接从浏览器或桌面应用连接到串口设备（路由器、交换机、微控制器等）。配置波特率、数据位、停止位和奇偶校验。在支持的浏览器中使用 Web Serial API，或在 Electron 应用中使用原生后端。
-
-</td>
-<td width="50%" valign="top">
-
-**告警:**
-为主机指标（CPU、内存、磁盘等）设置基于阈值的告警规则，并通过 ntfy 或 webhook 接收触发通知。在历史日志中查看触发和已解决的告警。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**主页:**
-具有拖放小组件网格的完全可定制主页。添加主机状态、服务链接、时钟、笔记、RSS 订阅、天气、Docker 容器、主机指标图表、嵌入式终端、iframe 等小组件。
-
-</td>
-<td width="50%" valign="top">
-
-**数据库加密:**
-后端存储为加密的 SQLite 数据库文件。查看[文档](https://docs.termix.site/security)了解更多。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**网络图:**
-自定义您的仪表板，根据您的 SSH 连接可视化您的家庭实验室，并支持状态监测。
-
-</td>
-<td width="50%" valign="top">
-
-**SSH 工具:**
-创建可重用的命令片段，只需点击一下即可执行。在多个打开的终端中同时运行一个命令。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**持久标签页:**
-如果在用户个人资料中启用，SSH 会话和标签页将在设备/刷新后保持打开状态。
-
-</td>
-<td width="50%" valign="top">
-
-**语言:**
-内置支持约 30 种语言（由 [Crowdin](https://docs.termix.site/translations) 管理）。
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>更多功能</b></summary>
-<br />
-
-- **仪表板** - 在仪表板上一目了然地查看服务器信息
-- **API 密钥** - 创建带有到期日期的用户范围 API 密钥，用于自动化/CI
-- **数据导出/导入** - 导出和导入 SSH 主机、凭据和文件管理器数据
-- **自动 SSL 设置** - 内置 SSL 证书生成和管理，支持 HTTPS 重定向
-- **现代 UI** - 使用 React、Tailwind CSS 和 Shadcn 构建的整洁的桌面/移动友好界面。有多种 UI 主题可选，包括浅色、深色、Dracula 等。使用 URL 路由全屏打开任何连接。
-- **命令历史** - 自动完成并查看之前运行过的 SSH 命令
-- **快速连接** - 无需保存连接数据即可连接到服务器
-- **命令面板** - 双击左 Shift 键即可通过键盘快速访问 SSH 连接
-- **Proxmox 集成** - 从您的 Proxmox 实例自动将主机添加到 Termix
-- **丰富的 SSH 功能** - 支持跳转主机、Warpgate、基于 TOTP 的连接、SOCKS5、主机密钥验证、密码自动填充、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、端口敲击、终端日志记录、SSH 代理转发、Bitwarden SSH 代理、HashiCorp Vault SSH 签名等
-- **Termix ID** - 内置于 Termix 中的 sshid.io 等效功能。认领一个用户名，在解析 URL 上发布您的公开 SSH 密钥，并使用内置 CA 签发 SSH 证书。
-
-</details>
-
-<br />
-
-## 平台支持
-
-<table align="center">
-<tr>
-<th align="center">平台</th>
-<th align="center">发行版</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>任何现代浏览器（Chrome、Safari、Firefox）· PWA 支持</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>便携版 · MSI 安装程序 · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>便携版 · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## 安装
-
-访问 [Termix 文档](https://docs.termix.site/install) 了解有关如何在所有平台上安装 Termix 的完整说明。
-
-示例 Docker Compose 文件（如果您不打算使用远程桌面功能，可以省略 `guacd` 和网络部分）：
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## 捐赠
-
-Termix 免费且开源，没有订阅或付费方案。如果您觉得它有用，请考虑捐赠以帮助支付服务器费用、域名和开发时间。捐赠还有助于资助研究和学习构建 SAML、Kubernetes 和 Agent 支持等功能所需的时间。在下方追踪进度并进行捐赠。
-
-[捐赠](https://donate.termix.site/)
-
-<br />
-
-## 赞助商
-
-有意通过付费展示位置支持开发吗？请发送邮件至 [mail@termix.site](mailto:mail@termix.site)。
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## 支持
-
-如果您需要 Termix 的帮助或想要请求功能，请访问 [Issues](https://github.com/Termix-SSH/Support/issues) 页面，登录并点击 `New Issue`。请尽可能详细地描述您的问题，建议使用英语。您也可以加入 [Discord](https://discord.gg/jVQGdvHDrf) 服务器并访问支持频道，但响应时间可能较长。
-
-<br />
-
-## 展示
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>在 YouTube 上观看更新概览</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>某些视频和图像可能已过时，或者可能无法完美展示功能。</sub>
-
-</div>
-
-<br />
-
-## 计划功能
-
-查看 [Projects](https://github.com/orgs/Termix-SSH/projects/5) 了解所有计划功能。如果您想贡献代码，请参阅 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)。
-
-<br />
-
-## 许可证
-
-根据 Apache License Version 2.0 发布。更多信息请参见 `LICENSE`。

docs/readme/README-DE.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>Selbst gehostete SSH-Verwaltung und Remote-Desktop-Zugriff</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  Deutsch ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix ist kostenlos und Open Source. Wenn Sie es nützlich finden, erwägen Sie eine [Spende](https://donate.termix.site/), um Serverkosten und Entwicklungszeit zu decken.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Erreicht am 1. September 2025</sub>
-</p>
-
-</div>
-
-<br />
-
-## Uberblick
-
-Termix ist eine quelloffene, dauerhaft kostenlose, selbst gehostete All-in-One-Serververwaltungsplattform. Sie bietet eine plattformubergreifende Losung zur Verwaltung Ihrer Server und Infrastruktur uber eine einzige, intuitive Oberflache. Termix bietet SSH-Terminalzugriff, Remote-Desktop-Steuerung (RDP, VNC, Telnet), SSH-Tunneling-Funktionen, Remote-Dateiverwaltung und viele weitere Werkzeuge. Termix ist die perfekte kostenlose und selbst gehostete Alternative zu Termius, verfugbar fur alle Plattformen.
-
-<br />
-
-## Funktionen
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**SSH-Terminalzugriff:**
-Voll ausgestattetes Terminal mit Split-Screen-Unterstutzung (bis zu 4 Panels) mit einem browserahnlichen Tab-System. Enthalt Unterstutzung fur die Anpassung des Terminals einschliesslich gangiger Terminal-Themes, Schriftarten und anderer Komponenten.
-
-</td>
-<td width="50%" valign="top">
-
-**Remote-Desktop-Zugriff:**
-RDP-, VNC- und Telnet-Unterstutzung uber den Browser mit vollstandiger Anpassung und Split-Screen.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**SSH-Tunnelverwaltung:**
-Erstellen und verwalten Sie Server-zu-Server-SSH-Tunnel mit automatischer Wiederverbindung, Gesundheitsuberwachung sowie lokaler, entfernter oder dynamischer SOCKS-Weiterleitung. Desktop-Client-zu-Server-Tunneleinstellungen werden lokal pro Desktop-Installation gespeichert, optionale C2S-Preset-Snapshots konnen auf dem Server gespeichert, umbenannt, geladen oder geloscht werden, wenn Sie eine lokale Tunnelkonfiguration zwischen Clients ubertragen mochten.
-
-</td>
-<td width="50%" valign="top">
-
-**Remote-Dateimanager:**
-Verwalten Sie Dateien direkt auf Remote-Servern mit Unterstutzung fur das Anzeigen und Bearbeiten von Code, Bildern, Audio und Video. Laden Sie Dateien hoch, herunter, benennen Sie sie um, loschen oder verschieben Sie sie nahtlos mit Sudo-Unterstutzung. Enthalt Unterstutzung fur das Verschieben von Dateien von Server zu Server.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Docker- und Podman-Verwaltung:**
-Container starten, stoppen, pausieren, entfernen. Container-Statistiken anzeigen. Container uber Docker-Exec-Terminal steuern. Unterstutzt sowohl Docker als auch Podman als Container-Laufzeitumgebung. Es wurde nicht entwickelt, um Portainer oder Dockge zu ersetzen, sondern um Ihre Container einfach zu verwalten, anstatt sie zu erstellen.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH-Host-Manager:**
-Speichern, organisieren und verwalten Sie Ihre SSH-Verbindungen mit Tags und Ordnern (Ordneranpassung und verschachtelte Ordner werden unterstutzt) und speichern Sie einfach wiederverwendbare Anmeldeinformationen mit der Moglichkeit, die Bereitstellung von SSH-Schlusseln zu automatisieren.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Host-Metriken:**
-CPU-, Arbeitsspeicher- und Festplattenauslastung, Netzwerk, Betriebszeit, Systeminformationen, Firewall, Port-Monitor, Log-Viewer, Benutzer/Berechtigungen, Zertifikate und vieles mehr anzeigen, was auf den meisten Linux-basierten Servern funktioniert. Enthalt Zeitreihen-Verlaufsdiagramme und schwellenwertbasierte Warnmeldungen mit ntfy- und Webhook-Unterstutzung.
-
-</td>
-<td width="50%" valign="top">
-
-**Benutzerauthentifizierung:**
-Sichere Benutzerverwaltung mit Admin-Kontrollen (kann Informationen anderer Benutzer bearbeiten) und OIDC-/LDAP-/SSO-Unterstutzung (mit Zugriffskontrolle), 2FA (TOTP) und Passkey (WebAuthn)-Unterstutzung. Aktive Benutzersitzungen uber alle Plattformen anzeigen und Berechtigungen widerrufen. OIDC-/Lokale Konten miteinander verknupfen. Audit-Protokoll aller Benutzeraktionen anzeigen.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tailscale-Integration:**
-Gerate aus Ihrem Tailnet auflisten, um sie schnell als Hosts hinzuzufugen, und mit Tailscale SSH als Authentifizierungsmethode verbinden, sodass Ihre Tailnet-ACLs die Autorisierung ubernehmen, ohne Anmeldedaten speichern zu mussen.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Freigabe:**
-Erstellen Sie Rollen und teilen Sie Hosts uber Benutzer/Rollen hinweg. Unterstutzt alle Authentifizierungstypen und alle Host-Protokolle.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Serielle Verbindungen:**
-Verbinden Sie sich direkt vom Browser oder der Desktop-App aus mit seriellen Geraten (Router, Switches, Mikrocontroller usw.). Konfigurieren Sie Baudrate, Datenbits, Stoppbits und Paritat. Verwendet die Web Serial API in unterstutzten Browsern oder ein natives Backend in der Electron-App.
-
-</td>
-<td width="50%" valign="top">
-
-**Warnmeldungen:**
-Legen Sie schwellenwertbasierte Warnregeln fur Host-Metriken (CPU, Arbeitsspeicher, Festplatte usw.) fest und erhalten Sie Benachrichtigungen uber ntfy oder Webhooks, wenn diese ausgelost werden. Zeigen Sie ausgeloste und aufgeloste Warnmeldungen in einem Verlaufsprotokoll an.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Startseite:**
-Eine vollstandig anpassbare Startseite mit einem Drag-and-Drop-Widget-Raster. Fugen Sie Widgets fur Hoststatus, Service-Links, Uhren, Notizen, RSS-Feeds, Wetter, Docker-Container, Host-Metrik-Diagramme, eingebettete Terminals, iFrames und mehr hinzu.
-
-</td>
-<td width="50%" valign="top">
-
-**Datenbankverschlusselung:**
-Backend gespeichert als verschlusselte SQLite-Datenbankdateien. Weitere Informationen in der [Dokumentation](https://docs.termix.site/security).
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Netzwerkgraph:**
-Passen Sie Ihr Dashboard an, um Ihr Homelab basierend auf Ihren SSH-Verbindungen mit Statusunterstutzung zu visualisieren.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH-Werkzeuge:**
-Erstellen Sie wiederverwendbare Befehlsvorlagen, die mit einem einzigen Klick ausgefuhrt werden. Fuhren Sie einen Befehl gleichzeitig in mehreren geoffneten Terminals aus.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Persistente Tabs:**
-SSH-Sitzungen und Tabs bleiben uber Gerate/Aktualisierungen hinweg offen, wenn im Benutzerprofil aktiviert.
-
-</td>
-<td width="50%" valign="top">
-
-**Sprachen:**
-Integrierte Unterstutzung fur ca. 30 Sprachen (verwaltet uber [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>Weitere Funktionen</b></summary>
-<br />
-
-- **Dashboard** - Serverinformationen auf einen Blick auf Ihrem Dashboard anzeigen
-- **API-Schlussel** - Erstellen Sie benutzerbezogene API-Schlussel mit Ablaufdaten zur Verwendung fur Automatisierung/CI
-- **Datenexport/-import** - SSH-Hosts, Anmeldeinformationen und Dateimanager-Daten exportieren und importieren
-- **Automatische SSL-Einrichtung** - Integrierte SSL-Zertifikatsgenerierung und -verwaltung mit HTTPS-Weiterleitungen
-- **Moderne Benutzeroberflache** - Saubere desktop-/mobilfreundliche Oberflache, erstellt mit React, Tailwind CSS und Shadcn. Wahlen Sie zwischen vielen verschiedenen UI-Themes einschliesslich Hell, Dunkel, Dracula usw. Verwenden Sie URL-Routen, um jede Verbindung im Vollbildmodus zu offnen.
-- **Befehlsverlauf** - Autovervollstandigung und Anzeige zuvor ausgefuhrter SSH-Befehle
-- **Schnellverbindung** - Verbinden Sie sich mit einem Server, ohne die Verbindungsdaten speichern zu mussen
-- **Befehlspalette** - Doppeltippen Sie die linke Umschalttaste, um schnell auf SSH-Verbindungen mit Ihrer Tastatur zuzugreifen
-- **Proxmox-Integration** - Automatisches Hinzufugen von Hosts zu Termix aus Ihrer Proxmox-Instanz
-- **SSH-Funktionsreich** - Unterstutzt Jump-Hosts, Warpgate, TOTP-basierte Verbindungen, SOCKS5, Host-Key-Verifizierung, automatisches Ausfullen von Passwortern, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, Port Knocking, Terminal-Protokollierung, SSH-Agent-Forwarding, Bitwarden SSH-Agent, HashiCorp Vault SSH-Signierung und mehr.
-- **Termix ID** - Ein sshid.io-Aquivalent, integriert in Termix. Beanspruchen Sie einen Handle, veroffentlichen Sie Ihre offentlichen SSH-Schlussel unter einer Resolver-URL und nutzen Sie eine integrierte CA zur Ausstellung von SSH-Zertifikaten.
-
-</details>
-
-<br />
-
-## Plattformunterstutzung
-
-<table align="center">
-<tr>
-<th align="center">Plattform</th>
-<th align="center">Distribution</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>Jeder moderne Browser (Chrome, Safari, Firefox) · PWA-Unterstutzung</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portabel · MSI-Installationsprogramm · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Portabel · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## Installation
-
-Besuchen Sie die [Termix-Dokumentation](https://docs.termix.site/install) fur vollstandige Installationsanleitungen fur alle Plattformen.
-
-Beispiel einer Docker-Compose-Datei (Sie konnen `guacd` und das Netzwerk weglassen, wenn Sie keine Remote-Desktop-Funktionen nutzen mochten):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## Spenden
-
-Termix ist kostenlos und Open Source, ohne Abonnements oder kostenpflichtige Plane. Wenn Sie es nutzlich finden, erwagen Sie eine Spende, um Serverkosten, Domains und Entwicklungszeit zu decken. Spenden helfen auch dabei, die Zeit zu finanzieren, die benotigt wird, um zu erforschen und zu lernen, was fur Funktionen wie SAML-, Kubernetes- und Agent-Unterstutzung erforderlich ist. Verfolgen Sie den Fortschritt und spenden Sie unten.
-
-[Spenden](https://donate.termix.site/)
-
-<br />
-
-## Sponsoren
-
-Interessiert an einer bezahlten Platzierung zur Unterstutzung der Entwicklung? Schreiben Sie eine E-Mail an [mail@termix.site](mailto:mail@termix.site).
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## Support
-
-Wenn Sie Hilfe benotigen oder eine Funktion fur Termix anfragen mochten, besuchen Sie die [Issues](https://github.com/Termix-SSH/Support/issues)-Seite, melden Sie sich an und klicken Sie auf `New Issue`. Bitte beschreiben Sie Ihr Anliegen so detailliert wie moglich, vorzugsweise auf Englisch. Sie konnen auch dem [Discord](https://discord.gg/jVQGdvHDrf)-Server beitreten und den Support-Kanal besuchen, allerdings konnen die Antwortzeiten dort langer sein.
-
-<br />
-
-## Screenshots
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Update-Ubersichten auf YouTube ansehen</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Einige Videos und Bilder konnen veraltet sein oder Funktionen moglicherweise nicht perfekt darstellen.</sub>
-
-</div>
-
-<br />
-
-## Geplante Funktionen
-
-Siehe [Projekte](https://github.com/orgs/Termix-SSH/projects/5) fur alle geplanten Funktionen. Wenn Sie beitragen mochten, siehe [Mitwirken](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
-## Lizenz
-
-Verteilt unter der Apache License Version 2.0. Siehe `LICENSE` fur weitere Informationen.

docs/readme/README-ES.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>Gestión SSH autoalojada y acceso a escritorio remoto</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  Español ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix es gratuito y de código abierto. Si lo encuentras útil, considera [donar](https://donate.termix.site/) para ayudar a cubrir los costos del servidor y el tiempo de desarrollo.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Logrado el 1 de septiembre de 2025</sub>
-</p>
-
-</div>
-
-<br />
-
-## Descripcion General
-
-Termix es una plataforma de gestion de servidores todo en uno, de codigo abierto, siempre gratuita y autoalojada. Proporciona una solucion multiplataforma para gestionar sus servidores e infraestructura a traves de una interfaz unica e intuitiva. Termix ofrece acceso a terminal SSH, control de escritorio remoto (RDP, VNC, Telnet), capacidades de tuneles SSH, gestion remota de archivos y muchas otras herramientas. Termix es la alternativa perfecta, gratuita y autoalojada a Termius, disponible para todas las plataformas.
-
-<br />
-
-## Caracteristicas
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**Acceso a Terminal SSH:**
-Terminal completo con soporte de pantalla dividida (hasta 4 paneles) con un sistema de pestanas similar al navegador. Incluye soporte para personalizar el terminal incluyendo temas comunes de terminal, fuentes y otros componentes.
-
-</td>
-<td width="50%" valign="top">
-
-**Acceso a Escritorio Remoto:**
-Soporte RDP, VNC y Telnet a traves del navegador con personalizacion completa y pantalla dividida.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Gestion de Tuneles SSH:**
-Cree y gestione tuneles SSH de servidor a servidor con reconexion automatica, monitoreo de estado y reenvio local, remoto o dinamico SOCKS. La configuracion de tuneles de cliente de escritorio a servidor se almacena localmente por instalacion de escritorio, los snapshots de presets C2S opcionales pueden guardarse en el servidor, renombrarse, cargarse o eliminarse cuando desee mover una configuracion de tunel local entre clientes.
-
-</td>
-<td width="50%" valign="top">
-
-**Gestor Remoto de Archivos:**
-Gestione archivos directamente en servidores remotos con soporte para visualizar y editar codigo, imagenes, audio y video. Suba, descargue, renombre, elimine y mueva archivos sin problemas con soporte sudo. Incluye soporte para mover archivos de servidor a servidor.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Gestion de Docker y Podman:**
-Inicie, detenga, pause, elimine contenedores. Vea estadisticas de contenedores. Controle contenedores usando el terminal docker exec. Compatible con Docker y Podman como entorno de ejecucion de contenedores. No fue creado para reemplazar Portainer o Dockge, sino para simplemente gestionar sus contenedores en lugar de crearlos.
-
-</td>
-<td width="50%" valign="top">
-
-**Gestor de Hosts SSH:**
-Guarde, organice y gestione sus conexiones SSH con etiquetas y carpetas (con personalizacion de carpetas y soporte de carpetas anidadas), y guarde facilmente informacion de inicio de sesion reutilizable con la capacidad de automatizar el despliegue de claves SSH.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Metricas del Host:**
-Vea el uso de CPU, memoria y disco, red, tiempo de actividad, informacion del sistema, firewall, monitor de puertos, visor de registros, usuarios/permisos, certificados y muchos mas, que funcionan en la mayoria de los servidores basados en Linux. Incluye graficos de historial de series temporales y alertas basadas en umbrales con soporte para ntfy y webhooks.
-
-</td>
-<td width="50%" valign="top">
-
-**Autenticacion de Usuarios:**
-Gestion segura de usuarios con controles de administrador (puede editar la informacion de otros usuarios) y soporte para OIDC/LDAP/SSO (con control de acceso), 2FA (TOTP) y soporte para passkeys (WebAuthn). Vea sesiones activas de usuarios en todas las plataformas y revoque permisos. Vincule sus cuentas OIDC/Locales entre si. Vea el registro de auditoria de las acciones de todos los usuarios.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Integracion con Tailscale:**
-Liste dispositivos de su red Tailscale para agregarlos rapidamente como hosts y conectese usando Tailscale SSH como metodo de autenticacion, permitiendo que las ACL de Tailscale gestionen la autorizacion sin almacenar credenciales.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Compartir:**
-Cree roles y comparta hosts entre usuarios/roles. Compatible con todos los tipos de autenticacion y todos los protocolos de host.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Conexiones Serie:**
-Conectese a dispositivos serie (routers, switches, microcontroladores, etc.) directamente desde el navegador o la aplicacion de escritorio. Configure la tasa de baudios, bits de datos, bits de parada y paridad. Utiliza la Web Serial API en navegadores compatibles o un backend nativo en la aplicacion Electron.
-
-</td>
-<td width="50%" valign="top">
-
-**Alertas:**
-Configure reglas de alerta basadas en umbrales para metricas del host (CPU, memoria, disco, etc.) y reciba notificaciones a traves de ntfy o webhooks cuando se activen. Vea las alertas activas y resueltas en un historial de registros.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Pagina de Inicio:**
-Una pagina de inicio completamente personalizable con una cuadricula de widgets de arrastrar y soltar. Agregue widgets para estado del host, enlaces de servicios, relojes, notas, feeds RSS, clima, contenedores Docker, graficos de metricas del host, terminales integrados, iframes y mas.
-
-</td>
-<td width="50%" valign="top">
-
-**Cifrado de Base de Datos:**
-Backend almacenado como archivos de base de datos SQLite cifrados. Consulte la [documentacion](https://docs.termix.site/security) para mas informacion.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Grafico de Red:**
-Personalice su Dashboard para visualizar su homelab basado en sus conexiones SSH con soporte de estado.
-
-</td>
-<td width="50%" valign="top">
-
-**Herramientas SSH:**
-Cree fragmentos de comandos reutilizables que se ejecutan con un solo clic. Ejecute un comando simultaneamente en multiples terminales abiertos.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Pestanas Persistentes:**
-Las sesiones SSH y pestanas permanecen abiertas entre dispositivos/actualizaciones si esta habilitado en el perfil de usuario.
-
-</td>
-<td width="50%" valign="top">
-
-**Idiomas:**
-Soporte integrado para aproximadamente 30 idiomas (gestionado por [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>Mas caracteristicas</b></summary>
-<br />
-
-- **Dashboard** - Vea la informacion del servidor de un vistazo en su dashboard
-- **Claves API** - Cree claves API con ambito de usuario y fechas de vencimiento para usar en automatizacion/CI
-- **Exportacion/Importacion de Datos** - Exporte e importe hosts SSH, credenciales y datos del gestor de archivos
-- **Configuracion Automatica de SSL** - Generacion y gestion integrada de certificados SSL con redirecciones HTTPS
-- **Interfaz Moderna** - Interfaz limpia compatible con escritorio/movil construida con React, Tailwind CSS y Shadcn. Elija entre muchos temas de UI diferentes, incluyendo claro, oscuro, Dracula, etc. Use rutas URL para abrir cualquier conexion en pantalla completa.
-- **Historial de Comandos** - Autocompletado y visualizacion de comandos SSH ejecutados anteriormente
-- **Conexion Rapida** - Conectese a un servidor sin necesidad de guardar los datos de conexion
-- **Paleta de Comandos** - Pulse dos veces la tecla Shift izquierda para acceder rapidamente a las conexiones SSH con su teclado
-- **Integracion con Proxmox** - Agregue automaticamente hosts a Termix desde su instancia de Proxmox
-- **SSH Rico en Funciones** - Soporta jump hosts, Warpgate, conexiones basadas en TOTP, SOCKS5, verificacion de clave de host, autocompletado de contrasenas, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro de terminal, reenvio de agente SSH, agente SSH de Bitwarden, firma SSH con HashiCorp Vault y mas.
-- **Termix ID** - Un equivalente a sshid.io integrado en Termix. Reclame un identificador, publique sus claves publicas SSH en una URL de resolucion y use una CA integrada para emitir certificados SSH.
-
-</details>
-
-<br />
-
-## Soporte de Plataformas
-
-<table align="center">
-<tr>
-<th align="center">Plataforma</th>
-<th align="center">Distribucion</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>Cualquier navegador moderno (Chrome, Safari, Firefox) · Soporte PWA</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portable · Instalador MSI · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Portable · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## Instalacion
-
-Visite la [documentacion de Termix](https://docs.termix.site/install) para obtener instrucciones completas de instalacion en todas las plataformas.
-
-Archivo de ejemplo de Docker Compose (puede omitir `guacd` y la red si no planea usar las funciones de escritorio remoto):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## Donar
-
-Termix es gratuito y de codigo abierto, sin suscripciones ni planes de pago. Si lo encuentra util, considere donar para ayudar a cubrir los costos del servidor, los dominios y el tiempo de desarrollo. Las donaciones tambien ayudan a financiar el tiempo necesario para investigar y aprender lo que se necesita para construir funciones como soporte para SAML, Kubernetes y Agent. Siga el progreso y done a continuacion.
-
-[Donar](https://donate.termix.site/)
-
-<br />
-
-## Patrocinadores
-
-Interesado en un espacio patrocinado de pago para apoyar el desarrollo? Escriba a [mail@termix.site](mailto:mail@termix.site).
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## Soporte
-
-Si necesita ayuda o desea solicitar una funcion para Termix, visite la pagina de [Issues](https://github.com/Termix-SSH/Support/issues), inicie sesion y pulse `New Issue`. Por favor, sea lo mas detallado posible en su reporte, preferiblemente escrito en ingles. Tambien puede unirse al servidor de [Discord](https://discord.gg/jVQGdvHDrf) y visitar el canal de soporte, sin embargo, los tiempos de respuesta pueden ser mas largos.
-
-<br />
-
-## Capturas de Pantalla
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Ver resúmenes de actualizaciones en YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Algunos videos e imagenes pueden estar desactualizados o no mostrar perfectamente las caracteristicas.</sub>
-
-</div>
-
-<br />
-
-## Caracteristicas Planeadas
-
-Consulte [Proyectos](https://github.com/orgs/Termix-SSH/projects/5) para todas las caracteristicas planeadas. Si desea contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
-## Licencia
-
-Distribuido bajo la Licencia Apache Version 2.0. Consulte `LICENSE` para mas informacion.

docs/readme/README-FR.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>Gestion SSH auto-hebergee et acces bureau a distance</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  Français ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix est gratuit et open source. Si vous le trouvez utile, pensez à [faire un don](https://donate.termix.site/) pour aider à couvrir les coûts de serveur et le temps de développement.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Obtenu le 1er septembre 2025</sub>
-</p>
-
-</div>
-
-<br />
-
-## Presentation
-
-Termix est une plateforme de gestion de serveurs tout-en-un, open source, a jamais gratuite et auto-hebergee. Elle fournit une solution multiplateforme pour gerer vos serveurs et votre infrastructure a travers une interface unique et intuitive. Termix offre un acces terminal SSH, le controle de bureau a distance (RDP, VNC, Telnet), des capacites de tunneling SSH, la gestion de fichiers SSH a distance et de nombreux autres outils. Termix est l'alternative parfaite, gratuite et auto-hebergee a Termius, disponible sur toutes les plateformes.
-
-<br />
-
-## Fonctionnalites
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**Acces terminal SSH:**
-Terminal complet avec support d'ecran partage (jusqu'a 4 panneaux) et un systeme d'onglets inspire des navigateurs. Inclut la personnalisation du terminal avec des themes courants, des polices et d'autres composants.
-
-</td>
-<td width="50%" valign="top">
-
-**Acces Bureau a Distance:**
-Support RDP, VNC et Telnet via navigateur avec personnalisation complete et ecran partage.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Gestion des tunnels SSH:**
-Creez et gerez des tunnels SSH de serveur a serveur avec reconnexion automatique, surveillance de l'etat et transfert local, distant ou SOCKS dynamique. Les parametres de tunnel client-bureau-vers-serveur sont stockes localement par installation bureau ; des instantanes de prereglages C2S optionnels peuvent etre sauvegardes sur le serveur, renommes, charges ou supprimes pour deplacer une configuration de tunnel locale entre clients.
-
-</td>
-<td width="50%" valign="top">
-
-**Gestionnaire de fichiers distant:**
-Gerez les fichiers directement sur les serveurs distants avec support de la visualisation et de l'edition de code, images, audio et video. Televersez, telechargez, renommez, supprimez et deplacez des fichiers de maniere fluide avec support sudo. Inclut la prise en charge du deplacement de fichiers de serveur a serveur.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Gestion Docker et Podman:**
-Demarrez, arretez, mettez en pause, supprimez des conteneurs. Consultez les statistiques des conteneurs. Controlez les conteneurs via le terminal docker exec. Compatible avec Docker et Podman comme environnement d'execution de conteneurs. Non concu pour remplacer Portainer ou Dockge, mais plutot pour gerer simplement vos conteneurs plutot que de les creer.
-
-</td>
-<td width="50%" valign="top">
-
-**Gestionnaire d'hotes SSH:**
-Enregistrez, organisez et gerez vos connexions SSH avec des tags et des dossiers (personnalisation des dossiers et prise en charge des dossiers imbriques), et sauvegardez facilement les informations de connexion reutilisables tout en automatisant le deploiement des cles SSH.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Metriques d'hote:**
-Visualisez l'utilisation du CPU, de la memoire, du disque, le reseau, le temps de fonctionnement, les informations systeme, le pare-feu, le moniteur de ports, le visualiseur de journaux, les utilisateurs/permissions, les certificats et bien plus encore sur la plupart des serveurs Linux. Inclut des graphiques d'historique en serie temporelle et des alertes basees sur des seuils avec support ntfy et webhook.
-
-</td>
-<td width="50%" valign="top">
-
-**Authentification des utilisateurs:**
-Gestion securisee des utilisateurs avec controles administrateur (peut modifier les informations des autres utilisateurs) et support OIDC/LDAP/SSO (avec controle d'acces), 2FA (TOTP), et support des passkeys (WebAuthn). Visualisez les sessions utilisateur actives sur toutes les plateformes et revoquez les permissions. Liez vos comptes OIDC/locaux ensemble. Consultez le journal d'audit des actions de tous les utilisateurs.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Integration Tailscale:**
-Listez les appareils de votre reseau Tailscale pour les ajouter rapidement comme hotes, et connectez-vous en utilisant Tailscale SSH comme methode d'authentification, laissant les ACL de votre reseau gerer l'autorisation sans stocker de credentials.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Partage:**
-Creez des roles et partagez des hotes entre utilisateurs/roles. Prend en charge tous les types d'authentification et tous les protocoles d'hote.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Connexions Serie:**
-Connectez-vous a des appareils serie (routeurs, commutateurs, microcontroleurs, etc.) directement depuis le navigateur ou l'application bureau. Configurez le debit en bauds, les bits de donnees, les bits d'arret et la parite. Utilise l'API Web Serial dans les navigateurs compatibles ou un backend natif dans l'application Electron.
-
-</td>
-<td width="50%" valign="top">
-
-**Alertes:**
-Definissez des regles d'alerte basees sur des seuils pour les metriques d'hote (CPU, memoire, disque, etc.) et recevez des notifications via ntfy ou webhooks lorsqu'elles se declenchent. Consultez les alertes actives et resolues dans un journal d'historique.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Page d'accueil:**
-Une page d'accueil entierement personnalisable avec une grille de widgets glisser-deposer. Ajoutez des widgets pour l'etat des hotes, les liens de services, les horloges, les notes, les flux RSS, la meteo, les conteneurs Docker, les graphiques de metriques d'hote, les terminaux integres, les iframes et plus encore.
-
-</td>
-<td width="50%" valign="top">
-
-**Chiffrement de la base de donnees:**
-Le backend est stocke sous forme de fichiers de base de donnees SQLite chiffres. Consultez la [documentation](https://docs.termix.site/security) pour plus de details.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Graphe reseau:**
-Personnalisez votre tableau de bord pour visualiser votre homelab base sur vos connexions SSH avec support des statuts.
-
-</td>
-<td width="50%" valign="top">
-
-**Outils SSH:**
-Creez des extraits de commandes reutilisables executables en un seul clic. Executez une commande simultanement sur plusieurs terminaux ouverts.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Onglets Persistants:**
-Les sessions SSH et les onglets restent ouverts sur tous les appareils/actualisations si active dans le profil utilisateur.
-
-</td>
-<td width="50%" valign="top">
-
-**Langues:**
-Support integre d'environ 30 langues (gere par [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>Plus de fonctionnalites</b></summary>
-<br />
-
-- **Tableau de bord** - Consultez les informations de vos serveurs en un coup d'oeil depuis votre tableau de bord
-- **Cles API** - Creez des cles API a portee utilisateur avec des dates d'expiration pour une utilisation en automatisation/CI
-- **Export/Import de donnees** - Exportez et importez les hotes SSH, les identifiants et les donnees du gestionnaire de fichiers
-- **Configuration SSL automatique** - Generation et gestion integrees de certificats SSL avec redirections HTTPS
-- **Interface moderne** - Interface epuree compatible desktop/mobile construite avec React, Tailwind CSS et Shadcn. Choisissez parmi de nombreux themes d'interface utilisateur, notamment clair, sombre, Dracula, etc. Utilisez les routes URL pour ouvrir n'importe quelle connexion en plein ecran.
-- **Historique des commandes** - Auto-completion et consultation des commandes SSH precedemment executees
-- **Connexion rapide** - Connectez-vous a un serveur sans avoir a sauvegarder les donnees de connexion
-- **Palette de commandes** - Appuyez deux fois sur Shift gauche pour acceder rapidement aux connexions SSH avec votre clavier
-- **Integration Proxmox** - Ajoutez automatiquement des hotes dans Termix depuis votre instance Proxmox
-- **SSH riche en fonctionnalites** - Support des hotes de rebond, Warpgate, connexions basees sur TOTP, SOCKS5, verification des cles d'hote, remplissage automatique des mots de passe, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, journalisation du terminal, transfert d'agent SSH, agent SSH Bitwarden, signature SSH HashiCorp Vault, et plus encore.
-- **Termix ID** - Un equivalent de sshid.io integre a Termix. Reservez un identifiant, publiez vos cles SSH publiques a une URL de resolution, et utilisez une autorite de certification integree pour emettre des certificats SSH.
-
-</details>
-
-<br />
-
-## Support des plateformes
-
-<table align="center">
-<tr>
-<th align="center">Plateforme</th>
-<th align="center">Distribution</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>Tout navigateur moderne (Chrome, Safari, Firefox) · Support PWA</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portable · MSI Installateur · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Portable · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## Installation
-
-Visitez la [documentation](https://docs.termix.site/install) de Termix pour des instructions d'installation completes sur toutes les plateformes.
-
-Voici un exemple de fichier Docker Compose (vous pouvez omettre guacd et le reseau si vous ne prevoyez pas d'utiliser les fonctionnalites de bureau a distance) :
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## Faire un don
-
-Termix est gratuit et open source, sans abonnement ni plan payant. Si vous le trouvez utile, pensez a faire un don pour aider a couvrir les couts de serveur, les domaines et le temps de developpement. Les dons contribuent egalement a financer le temps necessaire pour rechercher et apprendre ce qui est requis pour construire des fonctionnalites comme SAML, Kubernetes et le support des agents. Suivez la progression et faites un don ci-dessous.
-
-[Faire un don](https://donate.termix.site/)
-
-<br />
-
-## Sponsors
-
-Interesse par un placement payant pour soutenir le developpement ? Envoyez un email a [mail@termix.site](mailto:mail@termix.site).
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## Support
-
-Si vous avez besoin d'aide ou souhaitez demander une fonctionnalite pour Termix, visitez la page [Issues](https://github.com/Termix-SSH/Support/issues), connectez-vous et appuyez sur `New Issue`. Veuillez etre aussi detaille que possible dans votre issue, de preference redigee en anglais. Vous pouvez egalement rejoindre le serveur [Discord](https://discord.gg/jVQGdvHDrf) et visiter le canal de support, cependant les temps de reponse peuvent etre plus longs.
-
-<br />
-
-## Captures d'ecran
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Regarder les aperçus des mises a jour sur YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Certaines videos et images peuvent etre obsoletes ou ne pas presenter parfaitement les fonctionnalites.</sub>
-
-</div>
-
-<br />
-
-## Fonctionnalites prevues
-
-Consultez les [Projects](https://github.com/orgs/Termix-SSH/projects/5) pour toutes les fonctionnalites prevues. Si vous souhaitez contribuer, consultez [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
-## Licence
-
-Distribue sous la licence Apache Version 2.0. Consultez `LICENSE` pour plus d'informations.

docs/readme/README-HI.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>स्व-होस्टेड SSH प्रबंधन और रिमोट डेस्कटॉप एक्सेस</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  हिन्दी ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix मुफ़्त और ओपन सोर्स है। यदि आपको यह उपयोगी लगता है, तो सर्वर लागत और विकास समय में मदद के लिए [दान करें](https://donate.termix.site/)।
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>1 सितंबर, 2025 को प्राप्त</sub>
-</p>
-
-</div>
-
-<br />
-
-## अवलोकन
-
-Termix एक ओपन-सोर्स, हमेशा के लिए मुफ़्त, सेल्फ-होस्टेड ऑल-इन-वन सर्वर प्रबंधन प्लेटफ़ॉर्म है। यह एक एकल, सहज इंटरफ़ेस के माध्यम से आपके सर्वर और बुनियादी ढाँचे के प्रबंधन के लिए एक मल्टी-प्लेटफ़ॉर्म समाधान प्रदान करता है। Termix SSH टर्मिनल एक्सेस, रिमोट डेस्कटॉप कंट्रोल (RDP, VNC, Telnet), SSH टनलिंग क्षमताएँ, रिमोट फ़ाइल प्रबंधन, और कई अन्य उपकरण प्रदान करता है। Termix सभी प्लेटफ़ॉर्म पर उपलब्ध Termius का सही मुफ़्त और सेल्फ-होस्टेड विकल्प है।
-
-<br />
-
-## विशेषताएँ
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**SSH टर्मिनल एक्सेस:**
-ब्राउज़र जैसी टैब प्रणाली के साथ स्प्लिट-स्क्रीन सपोर्ट (4 पैनल तक) वाला पूर्ण-विशेषता वाला टर्मिनल। इसमें लोकप्रिय टर्मिनल थीम, फ़ॉन्ट और अन्य कंपोनेंट सहित टर्मिनल को कस्टमाइज़ करने का सपोर्ट शामिल है।
-
-</td>
-<td width="50%" valign="top">
-
-**रिमोट डेस्कटॉप एक्सेस:**
-ब्राउज़र पर RDP, VNC और Telnet सपोर्ट, पूर्ण कस्टमाइज़ेशन और स्प्लिट स्क्रीन के साथ।
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**SSH टनल प्रबंधन:**
-ऑटोमैटिक रीकनेक्शन, हेल्थ मॉनिटरिंग और लोकल, रिमोट या डायनेमिक SOCKS फॉरवर्डिंग के साथ सर्वर-टु-सर्वर SSH टनल बनाएँ और प्रबंधित करें। डेस्कटॉप क्लाइंट-टु-सर्वर टनल सेटिंग्स प्रत्येक डेस्कटॉप इंस्टॉल में स्थानीय रूप से संग्रहीत होती हैं; वैकल्पिक C2S प्रीसेट स्नैपशॉट सर्वर पर सेव किए जा सकते हैं, तथा जब आप किसी लोकल टनल कॉन्फ़िगरेशन को क्लाइंट के बीच स्थानांतरित करना चाहें तो उन्हें रीनेम, लोड या डिलीट किया जा सकता है।
-
-</td>
-<td width="50%" valign="top">
-
-**रिमोट फ़ाइल मैनेजर:**
-कोड, इमेज, ऑडियो और वीडियो देखने और संपादित करने के सपोर्ट के साथ रिमोट सर्वर पर सीधे फ़ाइलें प्रबंधित करें। sudo सपोर्ट के साथ फ़ाइलें अपलोड, डाउनलोड, रीनेम, डिलीट और मूव करें। इसमें फ़ाइलों को एक सर्वर से दूसरे सर्वर में स्थानांतरित करने का सपोर्ट भी शामिल है।
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Docker और Podman प्रबंधन:**
-कंटेनर शुरू, बंद, पॉज़, हटाएँ। कंटेनर स्टैट्स देखें। docker exec टर्मिनल का उपयोग करके कंटेनर को नियंत्रित करें। Docker और Podman दोनों को कंटेनर रनटाइम के रूप में सपोर्ट करता है। इसे Portainer या Dockge की जगह लेने के लिए नहीं बनाया गया बल्कि कंटेनर बनाने की तुलना में उन्हें सरलता से प्रबंधित करने के लिए बनाया गया है।
-
-</td>
-<td width="50%" valign="top">
-
-**SSH होस्ट मैनेजर:**
-टैग और फ़ोल्डर (फ़ोल्डर कस्टमाइज़ेशन और नेस्टेड फ़ोल्डर सपोर्ट के साथ) के साथ अपने SSH कनेक्शन सहेजें, व्यवस्थित करें और प्रबंधित करें, और SSH कुंजियों की तैनाती को स्वचालित करने की क्षमता के साथ पुन: उपयोग योग्य लॉगिन जानकारी आसानी से सहेजें।
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**होस्ट मेट्रिक्स:**
-अधिकांश Linux आधारित सर्वर पर CPU, मेमोरी, डिस्क उपयोग, नेटवर्क, अपटाइम, सिस्टम जानकारी, फ़ायरवॉल, पोर्ट मॉनिटर, लॉग व्यूअर, उपयोगकर्ता/अनुमतियाँ, सर्टिफ़िकेट और भी बहुत कुछ देखें। इसमें टाइम-सीरीज़ हिस्ट्री ग्राफ़ और ntfy व webhook सपोर्ट के साथ थ्रेशोल्ड-आधारित अलर्ट शामिल हैं।
-
-</td>
-<td width="50%" valign="top">
-
-**उपयोगकर्ता प्रमाणीकरण:**
-व्यवस्थापक नियंत्रण (अन्य उपयोगकर्ताओं की जानकारी संपादित कर सकते हैं) और OIDC/LDAP/SSO (एक्सेस कंट्रोल के साथ), 2FA (TOTP), और पासकी (WebAuthn) सपोर्ट के साथ सुरक्षित उपयोगकर्ता प्रबंधन। सभी प्लेटफ़ॉर्म पर सक्रिय उपयोगकर्ता सत्र देखें और अनुमतियाँ रद्द करें। अपने OIDC/स्थानीय खातों को एक साथ जोड़ें। सभी उपयोगकर्ताओं की कार्रवाइयों का ऑडिट लॉग देखें।
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tailscale एकीकरण:**
-अपने Tailscale नेटवर्क के डिवाइस सूचीबद्ध करें ताकि उन्हें जल्दी से होस्ट के रूप में जोड़ा जा सके, और Tailscale SSH को प्रमाणीकरण विधि के रूप में उपयोग करके कनेक्ट करें, जिससे आपके Tailscale ACL क्रेडेंशियल संग्रहीत किए बिना प्राधिकरण संभाल सकें।
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/शेयरिंग:**
-भूमिकाएँ बनाएँ और उपयोगकर्ताओं/भूमिकाओं में होस्ट साझा करें। सभी प्रमाणीकरण प्रकारों और सभी होस्ट प्रोटोकॉल का सपोर्ट करता है।
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**सीरियल कनेक्शन:**
-सीरियल डिवाइस (राउटर, स्विच, माइक्रोकंट्रोलर आदि) से सीधे ब्राउज़र या डेस्कटॉप ऐप से कनेक्ट करें। बॉड रेट, डेटा बिट्स, स्टॉप बिट्स और पैरिटी कॉन्फ़िगर करें। समर्थित ब्राउज़र में Web Serial API या Electron ऐप में नेटिव बैकएंड का उपयोग करता है।
-
-</td>
-<td width="50%" valign="top">
-
-**अलर्ट:**
-होस्ट मेट्रिक्स (CPU, मेमोरी, डिस्क आदि) पर थ्रेशोल्ड-आधारित अलर्ट नियम सेट करें और जब वे ट्रिगर हों तो ntfy या webhooks के माध्यम से सूचना पाएँ। इतिहास लॉग में सक्रिय और हल किए गए अलर्ट देखें।
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**होमपेज:**
-ड्रैग-एंड-ड्रॉप विजेट ग्रिड के साथ पूरी तरह से कस्टमाइज़ करने योग्य होमपेज। होस्ट स्टेटस, सर्विस लिंक, घड़ियाँ, नोट्स, RSS फ़ीड, मौसम, Docker कंटेनर, होस्ट मेट्रिक्स चार्ट, एम्बेडेड टर्मिनल, iframes और अन्य के लिए विजेट जोड़ें।
-
-</td>
-<td width="50%" valign="top">
-
-**डेटाबेस एन्क्रिप्शन:**
-बैकएंड एन्क्रिप्टेड SQLite डेटाबेस फ़ाइलों के रूप में संग्रहीत। अधिक जानकारी के लिए [डॉक्स](https://docs.termix.site/security) देखें।
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**नेटवर्क ग्राफ़:**
-स्थिति सपोर्ट के साथ अपने SSH कनेक्शन के आधार पर अपने होमलैब को विज़ुअलाइज़ करने के लिए अपना डैशबोर्ड कस्टमाइज़ करें।
-
-</td>
-<td width="50%" valign="top">
-
-**SSH टूल्स:**
-एक क्लिक से निष्पादित होने वाले पुन: उपयोग योग्य कमांड स्निपेट बनाएँ। एक साथ कई खुले टर्मिनलों में एक कमांड चलाएँ।
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**परसिस्टेंट टैब:**
-उपयोगकर्ता प्रोफ़ाइल में सक्षम होने पर SSH सेशन और टैब डिवाइस/रीफ्रेश के पार खुले रहते हैं।
-
-</td>
-<td width="50%" valign="top">
-
-**भाषाएँ:**
-लगभग 30 भाषाओं का बिल्ट-इन सपोर्ट ([Crowdin](https://docs.termix.site/translations) द्वारा प्रबंधित)।
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>अधिक विशेषताएँ</b></summary>
-<br />
-
-- **डैशबोर्ड** - अपने डैशबोर्ड पर एक नज़र में सर्वर की जानकारी देखें
-- **API कुंजियाँ** - ऑटोमेशन/CI के लिए उपयोग हेतु समाप्ति तिथियों के साथ उपयोगकर्ता-स्कोप्ड API कुंजियाँ बनाएँ
-- **डेटा एक्सपोर्ट/इम्पोर्ट** - SSH होस्ट, क्रेडेंशियल और फ़ाइल मैनेजर डेटा एक्सपोर्ट और इम्पोर्ट करें
-- **स्वचालित SSL सेटअप** - HTTPS रीडायरेक्ट के साथ बिल्ट-इन SSL सर्टिफ़िकेट जनरेशन और प्रबंधन
-- **आधुनिक UI** - React, Tailwind CSS, और Shadcn से बना साफ़ डेस्कटॉप/मोबाइल-फ़्रेंडली इंटरफ़ेस। लाइट, डार्क, ड्रैकुला आदि सहित कई अलग-अलग UI थीम के बीच चुनें। किसी भी कनेक्शन को फ़ुल-स्क्रीन में खोलने के लिए URL रूट का उपयोग करें।
-- **कमांड इतिहास** - पहले चलाए गए SSH कमांड का ऑटो-कम्प्लीट और दृश्य
-- **क्विक कनेक्ट** - कनेक्शन डेटा सहेजे बिना सर्वर से कनेक्ट करें
-- **कमांड पैलेट** - अपने कीबोर्ड से SSH कनेक्शन तक त्वरित पहुँच के लिए बाएँ Shift को दो बार टैप करें
-- **Proxmox एकीकरण** - अपने Proxmox इंस्टेंस से Termix में होस्ट स्वचालित रूप से जोड़ें
-- **SSH सुविधाओं से भरपूर** - जम्प होस्ट, Warpgate, TOTP आधारित कनेक्शन, SOCKS5, होस्ट की वेरिफ़िकेशन, पासवर्ड ऑटोफ़िल, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, पोर्ट नॉकिंग, टर्मिनल लॉगिंग, SSH एजेंट फ़ॉरवर्डिंग, Bitwarden SSH एजेंट, HashiCorp Vault SSH सिग्निंग, और अन्य का सपोर्ट।
-- **Termix ID** - Termix में बिल्ट-इन sshid.io के समकक्ष। एक हैंडल क्लेम करें, अपनी सार्वजनिक SSH कुंजियों को एक रिज़ॉल्वर URL पर प्रकाशित करें, और SSH सर्टिफ़िकेट जारी करने के लिए बिल्ट-इन CA का उपयोग करें।
-
-</details>
-
-<br />
-
-## प्लेटफ़ॉर्म सपोर्ट
-
-<table align="center">
-<tr>
-<th align="center">प्लेटफ़ॉर्म</th>
-<th align="center">वितरण</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>कोई भी आधुनिक ब्राउज़र (Chrome, Safari, Firefox) · PWA सपोर्ट</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>पोर्टेबल · MSI इंस्टॉलर · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>पोर्टेबल · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## इंस्टॉलेशन
-
-सभी प्लेटफ़ॉर्म पर पूर्ण इंस्टॉलेशन निर्देशों के लिए Termix [डॉक्स](https://docs.termix.site/install) पर जाएँ।
-
-नमूना Docker Compose फ़ाइल (यदि आप रिमोट डेस्कटॉप सुविधाओं का उपयोग करने की योजना नहीं बना रहे हैं तो आप `guacd` और नेटवर्क को हटा सकते हैं):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## दान करें
-
-Termix मुफ़्त और ओपन सोर्स है, बिना किसी सब्सक्रिप्शन या पेड प्लान के। यदि आपको यह उपयोगी लगता है, तो सर्वर लागत, डोमेन और विकास समय को कवर करने में मदद के लिए दान करने पर विचार करें। दान SAML, Kubernetes, और Agent सपोर्ट जैसी सुविधाओं के निर्माण के लिए आवश्यक शोध और सीखने में लगने वाले समय को वित्त पोषित करने में भी मदद करते हैं। नीचे प्रगति देखें और दान करें।
-
-[दान करें](https://donate.termix.site/)
-
-<br />
-
-## प्रायोजक
-
-विकास को समर्थन देने के लिए पेड प्लेसमेंट में रुचि है? [mail@termix.site](mailto:mail@termix.site) पर ईमेल करें।
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## सहायता
-
-यदि आपको सहायता चाहिए या Termix के लिए किसी विशेषता का अनुरोध करना चाहते हैं, तो [इश्यूज़](https://github.com/Termix-SSH/Support/issues) पेज पर जाएँ, लॉग इन करें, और `New Issue` दबाएँ। कृपया अपने इश्यू में यथासंभव विस्तृत विवरण दें, अधिमानतः अंग्रेज़ी में लिखें। आप [Discord](https://discord.gg/jVQGdvHDrf) सर्वर में भी शामिल हो सकते हैं और सहायता चैनल पर जा सकते हैं, हालाँकि, प्रतिक्रिया समय अधिक हो सकता है।
-
-<br />
-
-## स्क्रीनशॉट
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>YouTube पर अपडेट की समीक्षाएँ देखें</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>कुछ वीडियो और छवियाँ पुरानी हो सकती हैं या विशेषताओं को पूरी तरह से प्रदर्शित नहीं कर सकती हैं।</sub>
-
-</div>
-
-<br />
-
-## नियोजित विशेषताएँ
-
-सभी नियोजित विशेषताओं के लिए [प्रोजेक्ट्स](https://github.com/orgs/Termix-SSH/projects/5) देखें। यदि आप योगदान देना चाहते हैं, तो [योगदान](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) देखें।
-
-<br />
-
-## लाइसेंस
-
-Apache License Version 2.0 के तहत वितरित। अधिक जानकारी के लिए `LICENSE` देखें।

docs/readme/README-IT.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>Gestione SSH self-hosted e accesso al desktop remoto</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  Italiano
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donazioni di questo mese" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donazioni%20di%20questo%20mese&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix è gratuito e open source. Se lo trovi utile, considera di [donare](https://donate.termix.site/) per aiutare a coprire i costi del server e il tempo di sviluppo.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Ottenuto il 1 settembre 2025</sub>
-</p>
-
-</div>
-
-<br />
-
-## Panoramica
-
-Termix è una piattaforma di gestione server tutto-in-uno, open-source, per sempre gratuita e self-hosted. Fornisce una soluzione multipiattaforma per gestire i tuoi server e la tua infrastruttura attraverso un'unica interfaccia intuitiva. Termix offre accesso al terminale SSH, controllo remoto del desktop (RDP, VNC, Telnet), funzionalità di tunneling SSH, gestione remota dei file e molti altri strumenti. Termix è la perfetta alternativa gratuita e self-hosted a Termius, disponibile per tutte le piattaforme.
-
-<br />
-
-## Funzionalità
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**Accesso Terminale SSH:**
-Terminale completo con supporto schermo diviso (fino a 4 pannelli) con un sistema di schede in stile browser. Include il supporto per la personalizzazione del terminale, inclusi temi, font e altri componenti comuni.
-
-</td>
-<td width="50%" valign="top">
-
-**Accesso Desktop Remoto:**
-Supporto RDP, VNC e Telnet tramite browser con personalizzazione completa e schermo diviso.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Gestione Tunnel SSH:**
-Crea e gestisci tunnel SSH da server a server con riconnessione automatica, monitoraggio dello stato e inoltro locale, remoto o SOCKS dinamico. Le impostazioni del tunnel da client desktop a server sono archiviate localmente per ogni installazione desktop; gli snapshot di preset C2S opzionali possono essere salvati sul server, rinominati, caricati o eliminati per spostare una configurazione di tunnel locale tra i client.
-
-</td>
-<td width="50%" valign="top">
-
-**Gestore File Remoto:**
-Gestisci i file direttamente sui server remoti con supporto per la visualizzazione e la modifica di codice, immagini, audio e video. Carica, scarica, rinomina, elimina e sposta file senza problemi con supporto sudo. Include il supporto per spostare file da server a server.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Gestione Docker e Podman:**
-Avvia, ferma, metti in pausa, rimuovi container. Visualizza le statistiche dei container. Controlla i container tramite terminale docker exec. Supporta sia Docker che Podman come runtime dei container. Non è stato creato per sostituire Portainer o Dockge, ma piuttosto per gestire semplicemente i tuoi container rispetto alla loro creazione.
-
-</td>
-<td width="50%" valign="top">
-
-**Gestore Host SSH:**
-Salva, organizza e gestisci le tue connessioni SSH con tag e cartelle (con personalizzazione delle cartelle e supporto per cartelle annidate), salva facilmente le informazioni di accesso riutilizzabili e automatizza il deployment delle chiavi SSH.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Metriche Host:**
-Visualizza CPU, memoria, utilizzo del disco, rete, uptime, informazioni di sistema, firewall, monitoraggio porte, visualizzatore di log, utenti/permessi, certificati e molto altro, funzionanti sulla maggior parte dei server basati su Linux. Include grafici storici delle serie temporali e avvisi basati su soglie con supporto ntfy e webhook.
-
-</td>
-<td width="50%" valign="top">
-
-**Autenticazione Utente:**
-Gestione utenti sicura con controlli amministrativi (può modificare le informazioni di altri utenti) e OIDC/LDAP/SSO (con controllo degli accessi), 2FA (TOTP) e supporto passkey (WebAuthn). Visualizza le sessioni utente attive su tutte le piattaforme e revoca i permessi. Collega i tuoi account OIDC/Locali tra loro. Visualizza il log di controllo delle azioni di tutti gli utenti.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Integrazione Tailscale:**
-Elenca i dispositivi della tua rete Tailscale per aggiungerli rapidamente come host, e connettiti utilizzando Tailscale SSH come metodo di autenticazione, lasciando che le ACL della tua rete gestiscano l'autorizzazione senza memorizzare credenziali.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Condivisione:**
-Crea ruoli e condividi host tra utenti/ruoli. Supporta tutti i tipi di autenticazione e tutti i protocolli host.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Connessioni Seriali:**
-Connettiti a dispositivi seriali (router, switch, microcontrollori, ecc.) direttamente dal browser o dall'app desktop. Configura baud rate, bit di dati, bit di stop e parità. Utilizza la Web Serial API nei browser supportati o un backend nativo nell'app Electron.
-
-</td>
-<td width="50%" valign="top">
-
-**Avvisi:**
-Imposta regole di avviso basate su soglie per le metriche dell'host (CPU, memoria, disco, ecc.) e ricevi notifiche tramite ntfy o webhook quando si attivano. Visualizza gli avvisi attivi e risolti in un registro storico.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Homepage:**
-Una homepage completamente personalizzabile con una griglia di widget drag-and-drop. Aggiungi widget per lo stato dell'host, link ai servizi, orologi, note, feed RSS, meteo, container Docker, grafici delle metriche dell'host, terminali incorporati, iframe e altro ancora.
-
-</td>
-<td width="50%" valign="top">
-
-**Crittografia Database:**
-Il backend è archiviato come file di database SQLite crittografati. Consulta la [documentazione](https://docs.termix.site/security) per maggiori informazioni.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Grafico di Rete:**
-Personalizza la tua Dashboard per visualizzare il tuo homelab basato sulle connessioni SSH con supporto dello stato.
-
-</td>
-<td width="50%" valign="top">
-
-**Strumenti SSH:**
-Crea snippet di comandi riutilizzabili che si eseguono con un singolo clic. Esegui un comando simultaneamente su più terminali aperti.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Schede Persistenti:**
-Le sessioni SSH e le schede rimangono aperte tra dispositivi/aggiornamenti se abilitato nel profilo utente.
-
-</td>
-<td width="50%" valign="top">
-
-**Lingue:**
-Supporto integrato per circa 30 lingue (gestito da [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>Altre funzionalità</b></summary>
-<br />
-
-- **Dashboard** - Visualizza le informazioni del server a colpo d'occhio sulla tua dashboard
-- **Chiavi API** - Crea chiavi API con ambito utente e date di scadenza da utilizzare per automazione/CI
-- **Esportazione/Importazione Dati** - Esporta e importa host SSH, credenziali e dati del gestore file
-- **Configurazione SSL Automatica** - Generazione e gestione integrata dei certificati SSL con reindirizzamenti HTTPS
-- **Interfaccia Moderna** - Interfaccia pulita e responsive per desktop/mobile costruita con React, Tailwind CSS e Shadcn. Scegli tra molti temi UI diversi, inclusi chiaro, scuro, Dracula, ecc. Usa i percorsi URL per aprire qualsiasi connessione a schermo intero.
-- **Cronologia Comandi** - Autocompletamento e visualizzazione dei comandi SSH eseguiti in precedenza
-- **Connessione Rapida** - Connettiti a un server senza dover salvare i dati di connessione
-- **Palette Comandi** - Premi due volte shift sinistro per accedere rapidamente alle connessioni SSH con la tastiera
-- **Integrazione Proxmox** - Aggiungi automaticamente host a Termix dalla tua istanza Proxmox
-- **SSH Ricco di Funzionalità** - Supporta jump host, Warpgate, connessioni basate su TOTP, SOCKS5, verifica chiave host, compilazione automatica password, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registrazione terminale, SSH agent forwarding, Bitwarden SSH agent, firma SSH HashiCorp Vault e altro ancora
-- **Termix ID** - L'equivalente di sshid.io integrato in Termix. Rivendica un handle, pubblica le tue chiavi SSH pubbliche su un URL resolver e utilizza una CA integrata per emettere certificati SSH
-
-</details>
-
-<br />
-
-## Supporto Piattaforme
-
-<table align="center">
-<tr>
-<th align="center">Piattaforma</th>
-<th align="center">Distribuzione</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>Qualsiasi browser moderno (Chrome, Safari, Firefox) · Supporto PWA</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portable · Installer MSI · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Portable · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## Installazione
-
-Visita la [Documentazione Termix](https://docs.termix.site/install) per le istruzioni complete di installazione su tutte le piattaforme.
-
-File Docker Compose di esempio (puoi omettere `guacd` e la rete se non prevedi di utilizzare le funzioni di desktop remoto):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## Dona
-
-Termix è gratuito e open source, senza abbonamenti o piani a pagamento. Se lo trovi utile, considera di donare per aiutare a coprire i costi del server, i domini e il tempo di sviluppo. Le donazioni aiutano anche a finanziare il tempo necessario per ricercare e imparare ciò che serve per costruire funzionalità come SAML, Kubernetes e supporto Agent. Segui i progressi e dona qui sotto.
-
-[Dona](https://donate.termix.site/)
-
-<br />
-
-## Sponsor
-
-Interessato a un posizionamento a pagamento per supportare lo sviluppo? Scrivi a [mail@termix.site](mailto:mail@termix.site).
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## Supporto
-
-Se hai bisogno di aiuto o vuoi richiedere una funzionalità per Termix, visita la pagina [Issues](https://github.com/Termix-SSH/Support/issues), accedi e premi `New Issue`. Per favore, sii il più dettagliato possibile nella tua segnalazione, preferibilmente scritta in inglese. Puoi anche unirti al server [Discord](https://discord.gg/jVQGdvHDrf) e visitare il canale di supporto, tuttavia i tempi di risposta potrebbero essere più lunghi.
-
-<br />
-
-## Screenshot
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Guarda le panoramiche degli aggiornamenti su YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Alcuni video e immagini potrebbero non essere aggiornati o potrebbero non mostrare perfettamente le funzionalità.</sub>
-
-</div>
-
-<br />
-
-## Funzionalità Pianificate
-
-Consulta [Projects](https://github.com/orgs/Termix-SSH/projects/5) per tutte le funzionalità pianificate. Se desideri contribuire, consulta [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
-## Licenza
-
-Distribuito sotto la Licenza Apache Versione 2.0. Consulta `LICENSE` per maggiori informazioni.

docs/readme/README-JA.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>セルフホスト型 SSH 管理とリモートデスクトップアクセス</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  日本語 ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix は無料のオープンソースプロジェクトです。便利だと感じた場合は、サーバーコストと開発時間のために[寄付](https://donate.termix.site/)をご検討ください。
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>2025年9月1日に達成</sub>
-</p>
-
-</div>
-
-<br />
-
-## 概要
-
-Termixは、オープンソースで永久無料のセルフホスト型オールインワンサーバー管理プラットフォームです。単一の直感的なインターフェースを通じて、サーバーとインフラストラクチャを管理するマルチプラットフォームソリューションを提供します。Termixは、SSHターミナルアクセス、リモートデスクトップ制御（RDP、VNC、Telnet）、SSHトンネリング機能、リモートファイル管理、およびその他多くのツールを提供します。Termixは、すべてのプラットフォームで利用可能なTermiusの完全無料でセルフホスト可能な代替ソリューションです。
-
-<br />
-
-## 機能
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**SSHターミナルアクセス:**
-ブラウザ風タブシステムによる分割画面対応（最大4パネル）のフル機能ターミナル。一般的なターミナルテーマ、フォント、その他のコンポーネントを含むターミナルカスタマイズに対応しています。
-
-</td>
-<td width="50%" valign="top">
-
-**リモートデスクトップアクセス:**
-ブラウザ上でRDP、VNC、Telnetをサポート、完全なカスタマイズと分割画面に対応しています。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**SSHトンネル管理:**
-自動再接続とヘルスモニタリング、ローカル・リモート・ダイナミックSOCKSフォワーディングを備えたサーバー間SSHトンネルの作成・管理が可能です。デスクトップクライアント対サーバーのトンネル設定はデスクトップインストールごとにローカルに保存され、オプションのC2Sプリセットスナップショットをサーバーに保存・名前変更・読み込み・削除してクライアント間でローカルトンネル設定を移動できます。
-
-</td>
-<td width="50%" valign="top">
-
-**リモートファイルマネージャー:**
-コード、画像、音声、動画の表示・編集に対応し、リモートサーバー上のファイルを直接管理できます。sudo対応でファイルのアップロード、ダウンロード、名前変更、削除、移動をシームレスに実行できます。サーバー間でのファイル移動にも対応しています。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**DockerおよびPodman管理:**
-コンテナの起動、停止、一時停止、削除。コンテナの統計情報を表示。docker execターミナルでコンテナを操作。DockerとPodmanの両方をコンテナランタイムとしてサポートしています。PortainerやDockgeの代替ではなく、コンテナの作成よりも簡易的な管理を目的としています。
-
-</td>
-<td width="50%" valign="top">
-
-**SSHホストマネージャー:**
-タグやフォルダ（フォルダのカスタマイズとネストフォルダ対応）でSSH接続を保存、整理、管理し、再利用可能なログイン情報を簡単に保存しながらSSHキーのデプロイを自動化できます。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**ホストメトリクス:**
-ほとんどのLinuxベースのサーバーで、CPU、メモリ、ディスク使用量、ネットワーク、アップタイム、システム情報、ファイアウォール、ポートモニター、ログビューア、ユーザー/権限、証明書など、さらに多くの情報を表示できます。時系列の履歴グラフと、ntfyおよびwebhookに対応したしきい値ベースのアラートを含みます。
-
-</td>
-<td width="50%" valign="top">
-
-**ユーザー認証:**
-管理者コントロール（他のユーザー情報を編集可能）とOIDC/LDAP/SSO（アクセス制御付き）、2FA（TOTP）、パスキー（WebAuthn）対応による安全なユーザー管理。すべてのプラットフォームでアクティブなユーザーセッションを表示し、権限を取り消し可能。OIDC/ローカルアカウントの連携が可能です。すべてのユーザー操作の監査ログを表示できます。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tailscaleインテグレーション:**
-Tailnetのデバイスをリストしてホストとしてすばやく追加し、Tailscale SSHを認証方法として使用して接続します。これにより、TailnetのACLが認証情報を保存せずに認可を処理します。
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/共有:**
-ロールを作成し、ユーザー/ロール間でホストを共有できます。すべての認証タイプとすべてのホストプロトコルに対応しています。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**シリアル接続:**
-ブラウザまたはデスクトップアプリからシリアルデバイス（ルーター、スイッチ、マイクロコントローラーなど）に直接接続できます。ボーレート、データビット、ストップビット、パリティを設定できます。対応ブラウザではWeb Serial APIを使用し、Electronアプリではネイティブバックエンドを使用します。
-
-</td>
-<td width="50%" valign="top">
-
-**アラート:**
-ホストメトリクス（CPU、メモリ、ディスクなど）に対してしきい値ベースのアラートルールを設定し、発動時にntfyまたはwebhookで通知を受け取れます。発動中および解決済みのアラートを履歴ログで確認できます。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**ホームページ:**
-ドラッグ＆ドロップのウィジェットグリッドを備えた完全カスタマイズ可能なホームページ。ホストステータス、サービスリンク、時計、メモ、RSSフィード、天気、Dockerコンテナ、ホストメトリクスグラフ、埋め込みターミナル、iframeなどのウィジェットを追加できます。
-
-</td>
-<td width="50%" valign="top">
-
-**データベース暗号化:**
-バックエンドは暗号化されたSQLiteデータベースファイルとして保存されます。詳細は[ドキュメント](https://docs.termix.site/security)をご覧ください。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**ネットワークグラフ:**
-ダッシュボードをカスタマイズして、SSH接続に基づくホームラボのネットワークをステータス表示付きで可視化できます。
-
-</td>
-<td width="50%" valign="top">
-
-**SSHツール:**
-ワンクリックで実行できる再利用可能なコマンドスニペットの作成。複数の開いているターミナルに対して同時にコマンドを実行できます。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**永続タブ:**
-ユーザープロフィールで有効にすると、SSHセッションとタブがデバイス/更新をまたいで開いたまま保持されます。
-
-</td>
-<td width="50%" valign="top">
-
-**多言語対応:**
-約30言語の組み込みサポート（[Crowdin](https://docs.termix.site/translations)で管理されています）。
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>その他の機能</b></summary>
-<br />
-
-- **ダッシュボード** - ダッシュボードでサーバー情報を一目で確認できます
-- **APIキー** - 自動化/CI用に有効期限付きのユーザースコープAPIキーを作成できます
-- **データのエクスポート/インポート** - SSHホスト、認証情報、ファイルマネージャーデータのエクスポートとインポートが可能です
-- **自動SSL設定** - HTTPSリダイレクト付きの組み込みSSL証明書生成・管理が可能です
-- **モダンUI** - React、Tailwind CSS、Shadcnで構築された、デスクトップ/モバイル対応のクリーンなインターフェース。ライト、ダーク、Draculaなど、多くの異なるUIテーマから選択可能。URLルートで任意の接続をフルスクリーンで開くことができます。
-- **コマンド履歴** - 過去に実行したSSHコマンドの自動補完と表示が可能です
-- **クイック接続** - 接続データを保存せずにサーバーに接続できます
-- **コマンドパレット** - 左Shiftキーを2回押すことで、キーボードからSSH接続に素早くアクセスできます
-- **Proxmox統合** - Proxmoxインスタンスからホストを自動的にTermixに追加できます
-- **SSH機能充実** - ジャンプホスト、Warpgate、TOTPベースの接続、SOCKS5、ホストキー検証、パスワード自動入力、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、ポート敲き（port knocking）、ターミナルログ記録、SSHエージェントフォワーディング、Bitwarden SSHエージェント、HashiCorp Vault SSH署名などに対応しています
-- **Termix ID** - Termixに組み込まれたsshid.io相当の機能です。ハンドルを取得し、リゾルバーURLで公開SSHキーを公開し、組み込みCAを使用してSSH証明書を発行できます。
-
-</details>
-
-<br />
-
-## プラットフォーム対応
-
-<table align="center">
-<tr>
-<th align="center">プラットフォーム</th>
-<th align="center">配布形式</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>あらゆる最新ブラウザ（Chrome、Safari、Firefox）· PWA対応</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>ポータブル版 · MSIインストーラー · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>ポータブル版 · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## インストール
-
-すべてのプラットフォームへのTermixのインストール方法については、[Termixドキュメント](https://docs.termix.site/install)をご覧ください。
-
-サンプルDocker Composeファイル（リモートデスクトップ機能を使用する予定がない場合は、`guacd`とネットワークの設定を省略できます）：
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## 寄付
-
-Termixは無料のオープンソースプロジェクトであり、サブスクリプションや有料プランはありません。便利だと感じた場合は、サーバーコスト、ドメイン、開発時間を賄うための寄付をご検討ください。寄付は、SAML、Kubernetes、Agentサポートなどの機能を構築するために必要な調査と学習の時間を確保することにも役立ちます。以下で進捗を確認し、寄付できます。
-
-[寄付する](https://donate.termix.site/)
-
-<br />
-
-## スポンサー
-
-開発を支援するための有料掲載にご興味がありますか？[mail@termix.site](mailto:mail@termix.site)までメールをお送りください。
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## サポート
-
-Termixに関するヘルプや機能リクエストが必要な場合は、[Issues](https://github.com/Termix-SSH/Support/issues)ページにアクセスし、ログインして`New Issue`を押してください。Issueはできるだけ詳細に記述し、英語での記述が望ましいです。また、[Discord](https://discord.gg/jVQGdvHDrf)サーバーに参加してサポートチャンネルを利用することもできますが、応答時間が長くなる場合があります。
-
-<br />
-
-## スクリーンショット
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>YouTubeでアップデートの概要を視聴する</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>動画や画像の一部は最新ではない場合や、機能を完全に紹介できていない場合があります。</sub>
-
-</div>
-
-<br />
-
-## 予定されている機能
-
-すべての予定機能については[Projects](https://github.com/orgs/Termix-SSH/projects/5)をご覧ください。コントリビュートをご希望の方は[Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)をご覧ください。
-
-<br />
-
-## ライセンス
-
-Apache License Version 2.0のもとで配布されています。詳細は`LICENSE`をご覧ください。

docs/readme/README-KO.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>셀프 호스팅 SSH 관리 및 원격 데스크톱 액세스</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  한국어 ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix는 무료 오픈소스 프로젝트입니다. 유용하게 사용하고 있다면 서버 비용과 개발 시간을 위해 [후원](https://donate.termix.site/)을 고려해 주세요.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>2025년 9월 1일 달성</sub>
-</p>
-
-</div>
-
-<br />
-
-## 개요
-
-Termix는 오픈 소스이며 영구 무료인 셀프 호스팅 올인원 서버 관리 플랫폼입니다. 단일 직관적인 인터페이스를 통해 서버와 인프라를 관리할 수 있는 멀티 플랫폼 솔루션을 제공합니다. Termix는 SSH 터미널 접속, 원격 데스크톱 제어(RDP, VNC, Telnet), SSH 터널링 기능, 원격 SSH 파일 관리 및 기타 다양한 도구를 제공합니다. Termix는 모든 플랫폼에서 사용 가능한 Termius의 완벽한 무료 셀프 호스팅 대안입니다.
-
-<br />
-
-## 기능
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**SSH 터미널 접속:**
-브라우저 스타일 탭 시스템과 분할 화면 지원(최대 4개 패널)을 갖춘 완전한 기능의 터미널. 일반 터미널 테마, 글꼴 및 기타 구성 요소를 포함한 터미널 사용자 정의 지원.
-
-</td>
-<td width="50%" valign="top">
-
-**원격 데스크톱 접속:**
-완전한 사용자 정의와 분할 화면을 지원하는 브라우저 기반 RDP, VNC, Telnet 지원.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**SSH 터널 관리:**
-자동 재연결, 상태 모니터링, 로컬·원격·동적 SOCKS 포워딩을 지원하는 서버 간 SSH 터널 생성 및 관리. 데스크톱 클라이언트-서버 터널 설정은 데스크톱 설치별로 로컬에 저장되며, 선택적 C2S 사전 설정 스냅샷을 서버에 저장·이름 변경·불러오기·삭제하여 클라이언트 간 로컬 터널 구성을 이동할 수 있습니다.
-
-</td>
-<td width="50%" valign="top">
-
-**원격 파일 관리자:**
-코드, 이미지, 오디오, 비디오의 보기 및 편집을 지원하여 원격 서버에서 파일을 직접 관리. sudo 지원으로 파일 업로드, 다운로드, 이름 변경, 삭제, 이동을 원활하게 수행. 서버 간 파일 이동도 지원합니다.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Docker 및 Podman 관리:**
-컨테이너 시작, 중지, 일시 정지, 제거. 컨테이너 통계 보기. docker exec 터미널로 컨테이너 제어. Docker와 Podman을 모두 컨테이너 런타임으로 지원. Portainer나 Dockge를 대체하기 위한 것이 아니라 컨테이너 생성보다는 간편한 관리를 목적으로 합니다.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH 호스트 관리자:**
-태그와 폴더(폴더 사용자 지정 및 중첩 폴더 지원)로 SSH 연결을 저장, 정리, 관리하고, 재사용 가능한 로그인 정보를 쉽게 저장하면서 SSH 키 배포를 자동화.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**호스트 메트릭:**
-대부분의 Linux 기반 서버에서 CPU, 메모리, 디스크 사용량, 네트워크, 업타임, 시스템 정보, 방화벽, 포트 모니터, 로그 뷰어, 사용자/권한, 인증서 등 다양한 정보를 표시. 시계열 히스토리 그래프와 ntfy 및 웹훅을 지원하는 임계값 기반 알림을 포함합니다.
-
-</td>
-<td width="50%" valign="top">
-
-**사용자 인증:**
-관리자 제어(다른 사용자 정보 편집 가능)와 OIDC/LDAP/SSO(액세스 제어 포함), 2FA(TOTP), 패스키(WebAuthn) 지원을 통한 안전한 사용자 관리. 모든 플랫폼에서 활성 사용자 세션을 보고 권한을 취소 가능. OIDC/로컬 계정 연동. 모든 사용자 작업의 감사 로그 조회.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tailscale 통합:**
-Tailscale 네트워크의 기기를 나열하여 호스트로 빠르게 추가하고, Tailscale SSH를 인증 방법으로 사용하여 연결함으로써 자격 증명을 저장하지 않고도 네트워크 ACL이 권한 부여를 처리하도록 합니다.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/공유:**
-역할을 생성하고 사용자/역할 간에 호스트를 공유합니다. 모든 인증 유형과 모든 호스트 프로토콜을 지원합니다.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**시리얼 연결:**
-브라우저 또는 데스크톱 앱에서 직접 시리얼 장치(라우터, 스위치, 마이크로컨트롤러 등)에 연결. 보드레이트, 데이터 비트, 스톱 비트, 패리티 구성. 지원 브라우저에서는 Web Serial API를, Electron 앱에서는 네이티브 백엔드를 사용합니다.
-
-</td>
-<td width="50%" valign="top">
-
-**알림:**
-호스트 메트릭(CPU, 메모리, 디스크 등)에 대한 임계값 기반 알림 규칙을 설정하고 트리거될 때 ntfy 또는 웹훅을 통해 알림 수신. 기록 로그에서 발생 중인 알림과 해결된 알림 확인.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**홈페이지:**
-드래그 앤 드롭 위젯 그리드를 갖춘 완전 맞춤형 홈페이지. 호스트 상태, 서비스 링크, 시계, 메모, RSS 피드, 날씨, Docker 컨테이너, 호스트 메트릭 차트, 임베디드 터미널, iframe 등의 위젯 추가 가능.
-
-</td>
-<td width="50%" valign="top">
-
-**데이터베이스 암호화:**
-백엔드가 암호화된 SQLite 데이터베이스 파일로 저장됨. 자세한 내용은 [문서](https://docs.termix.site/security)를 참조하세요.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**네트워크 그래프:**
-대시보드를 사용자 정의하여 SSH 연결 기반의 홈랩 네트워크를 상태 표시와 함께 시각화.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH 도구:**
-한 번의 클릭으로 실행 가능한 재사용 가능 명령어 스니펫 생성. 여러 열린 터미널에서 동시에 하나의 명령어 실행.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**지속 탭:**
-사용자 프로필에서 활성화된 경우 SSH 세션 및 탭이 기기/새로 고침 간에 열린 상태 유지.
-
-</td>
-<td width="50%" valign="top">
-
-**다국어 지원:**
-약 30개 언어 내장 지원([Crowdin](https://docs.termix.site/translations)으로 관리).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>더 많은 기능</b></summary>
-<br />
-
-- **대시보드** - 대시보드에서 서버 정보를 한눈에 확인
-- **API 키** - 자동화/CI에 사용할 만료일이 있는 사용자 범위 API 키 생성
-- **데이터 내보내기/가져오기** - SSH 호스트, 자격 증명, 파일 관리자 데이터의 내보내기 및 가져오기
-- **자동 SSL 설정** - HTTPS 리디렉션을 포함한 내장 SSL 인증서 생성 및 관리
-- **모던 UI** - React, Tailwind CSS, Shadcn으로 구축된 깔끔한 데스크톱/모바일 친화적 인터페이스. 라이트, 다크, 드라큘라 등 다양한 UI 테마 선택 가능. URL 라우트를 사용하여 모든 연결을 전체 화면으로 열기 가능.
-- **명령어 기록** - 이전에 실행한 SSH 명령어의 자동 완성 및 조회
-- **빠른 연결** - 연결 데이터를 저장하지 않고 서버에 접속
-- **명령어 팔레트** - 왼쪽 Shift 키를 두 번 눌러 키보드로 SSH 연결에 빠르게 접근
-- **Proxmox 통합** - Proxmox 인스턴스에서 Termix로 호스트를 자동 추가
-- **풍부한 SSH 기능** - 점프 호스트, Warpgate, TOTP 기반 연결, SOCKS5, 호스트 키 검증, 비밀번호 자동 입력, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, 포트 노킹, 터미널 로깅, SSH 에이전트 포워딩, Bitwarden SSH 에이전트, HashiCorp Vault SSH 서명 등 지원.
-- **Termix ID** - Termix에 내장된 sshid.io와 동등한 기능. 핸들을 등록하고, 리졸버 URL에 공개 SSH 키를 게시하며, 내장 CA를 사용하여 SSH 인증서를 발급할 수 있습니다.
-
-</details>
-
-<br />
-
-## 플랫폼 지원
-
-<table align="center">
-<tr>
-<th align="center">플랫폼</th>
-<th align="center">배포판</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>모든 최신 브라우저(Chrome, Safari, Firefox) · PWA 지원</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>포터블 · MSI 설치 프로그램 · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>포터블 · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## 설치
-
-모든 플랫폼에 Termix를 설치하는 방법에 대한 자세한 내용은 Termix [문서](https://docs.termix.site/install)를 방문하세요.
-
-다음은 Docker Compose 파일 예시입니다(원격 데스크톱 기능을 사용할 계획이 없다면 guacd와 네트워크를 생략할 수 있습니다):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## 후원
-
-Termix는 구독이나 유료 요금제가 없는 무료 오픈소스 프로젝트입니다. 유용하게 사용하고 있다면 서버 비용, 도메인, 개발 시간을 위해 후원을 고려해 주세요. 후원은 SAML, Kubernetes, 에이전트 지원과 같은 기능을 구축하는 데 필요한 사항을 연구하고 학습하는 시간에도 사용됩니다. 아래에서 진행 상황을 확인하고 후원할 수 있습니다.
-
-[후원하기](https://donate.termix.site/)
-
-<br />
-
-## 스폰서
-
-개발 지원을 위한 유료 광고에 관심이 있으신가요? [mail@termix.site](mailto:mail@termix.site)로 이메일을 보내주세요.
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## 지원
-
-Termix에 대한 도움이 필요하거나 기능을 요청하려면 [Issues](https://github.com/Termix-SSH/Support/issues) 페이지를 방문하여 로그인하고 `New Issue`를 누르세요. 이슈는 가능한 한 상세하게 작성하고, 영어로 작성하는 것이 좋습니다. [Discord](https://discord.gg/jVQGdvHDrf) 서버에 참여하여 지원 채널을 이용할 수도 있지만, 응답 시간이 더 길 수 있습니다.
-
-<br />
-
-## 스크린샷
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>YouTube에서 업데이트 개요 시청하기</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>일부 비디오 및 이미지는 최신이 아니거나 기능을 완벽하게 보여주지 않을 수 있습니다.</sub>
-
-</div>
-
-<br />
-
-## 계획된 기능
-
-모든 계획된 기능은 [Projects](https://github.com/orgs/Termix-SSH/projects/5)를 참조하세요. 기여를 원하시면 [Contributing](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md)을 참조하세요.
-
-<br />
-
-## 라이선스
-
-Apache License Version 2.0에 따라 배포됩니다. 자세한 내용은 `LICENSE`를 참조하세요.

docs/readme/README-PT.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>Gerenciamento SSH auto-hospedado e acesso a area de trabalho remota</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  Português ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix é gratuito e de código aberto. Se o achar útil, considere [doar](https://donate.termix.site/) para ajudar a cobrir os custos de servidor e o tempo de desenvolvimento.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Conquistado em 1 de setembro de 2025</sub>
-</p>
-
-</div>
-
-<br />
-
-## Visao Geral
-
-Termix e uma plataforma de gerenciamento de servidores tudo-em-um, de codigo aberto, sempre gratuita e auto-hospedada. Ela fornece uma solucao multiplataforma para gerenciar seus servidores e infraestrutura atraves de uma interface unica e intuitiva. Termix oferece acesso a terminal SSH, controle de desktop remoto (RDP, VNC, Telnet), capacidades de tunelamento SSH, gerenciamento remoto de arquivos SSH e muitas outras ferramentas. Termix e a alternativa perfeita, gratuita e auto-hospedada ao Termius, disponivel para todas as plataformas.
-
-<br />
-
-## Funcionalidades
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**Acesso ao Terminal SSH:**
-Terminal completo com suporte a tela dividida (ate 4 paineis) com um sistema de abas similar ao navegador. Inclui suporte para personalizacao do terminal incluindo temas comuns de terminal, fontes e outros componentes.
-
-</td>
-<td width="50%" valign="top">
-
-**Acesso a Area de Trabalho Remota:**
-Suporte a RDP, VNC e Telnet pelo navegador com personalizacao completa e tela dividida.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Gerenciamento de Tuneis SSH:**
-Crie e gerencie tuneis SSH de servidor para servidor com reconexao automatica, monitoramento de saude e encaminhamento local, remoto ou SOCKS dinamico. As configuracoes de tunel de cliente desktop para servidor sao armazenadas localmente por instalacao de desktop, snapshots de predefinicoes C2S opcionais podem ser salvos no servidor, renomeados, carregados ou excluidos quando voce quiser mover uma configuracao de tunel local entre clientes.
-
-</td>
-<td width="50%" valign="top">
-
-**Gerenciador Remoto de Arquivos:**
-Gerencie arquivos diretamente em servidores remotos com suporte para visualizar e editar codigo, imagens, audio e video. Faca upload, download, renomeie, exclua e mova arquivos facilmente com suporte sudo. Inclui suporte para mover arquivos de servidor para servidor.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Gerenciamento de Docker e Podman:**
-Inicie, pare, pause, remova conteineres. Visualize estatisticas de conteineres. Controle conteineres usando o terminal Docker Exec. Suporta Docker e Podman como ambiente de execucao de conteineres. Nao foi feito para substituir Portainer ou Dockge, mas sim para simplesmente gerenciar seus conteineres em vez de cria-los.
-
-</td>
-<td width="50%" valign="top">
-
-**Gerenciador de Hosts SSH:**
-Salve, organize e gerencie suas conexoes SSH com tags e pastas (com personalizacao de pastas e suporte a pastas aninhadas), e salve facilmente informacoes de login reutilizaveis com a capacidade de automatizar a implantacao de chaves SSH.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Metricas do Host:**
-Visualize o uso de CPU, memoria e disco, rede, tempo de atividade, informacoes do sistema, firewall, monitor de portas, visualizador de logs, usuarios/permissoes, certificados e muito mais na maioria dos servidores baseados em Linux. Inclui graficos de historico em serie temporal e alertas baseados em limites com suporte a ntfy e webhook.
-
-</td>
-<td width="50%" valign="top">
-
-**Autenticacao de Usuarios:**
-Gerenciamento seguro de usuarios com controles de administrador (podem editar informacoes de outros usuarios) e suporte para OIDC/LDAP/SSO (com controle de acesso), 2FA (TOTP) e passkey (WebAuthn). Visualize sessoes ativas de usuarios em todas as plataformas e revogue permissoes. Vincule suas contas OIDC/Locais entre si. Visualize o log de auditoria de todas as acoes dos usuarios.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Integracao com Tailscale:**
-Liste dispositivos da sua rede Tailscale para adicioná-los rapidamente como hosts, e conecte-se usando Tailscale SSH como metodo de autenticacao, deixando as ACLs da sua rede gerenciar a autorizacao sem armazenar credenciais.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Compartilhamento:**
-Crie funcoes e compartilhe hosts entre usuarios/funcoes. Suporta todos os tipos de autenticacao e todos os protocolos de host.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Conexoes Seriais:**
-Conecte-se a dispositivos seriais (roteadores, switches, microcontroladores, etc.) diretamente do navegador ou do aplicativo desktop. Configure taxa de baud, bits de dados, bits de parada e paridade. Usa a Web Serial API em navegadores suportados ou um backend nativo no aplicativo Electron.
-
-</td>
-<td width="50%" valign="top">
-
-**Alertas:**
-Defina regras de alerta baseadas em limites para metricas do host (CPU, memoria, disco, etc.) e receba notificacoes via ntfy ou webhooks quando forem ativadas. Visualize alertas ativos e resolvidos em um historico de registros.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Pagina Inicial:**
-Uma pagina inicial totalmente personalizavel com uma grade de widgets de arrastar e soltar. Adicione widgets para status do host, links de servicos, relogios, notas, feeds RSS, clima, conteineres Docker, graficos de metricas do host, terminais incorporados, iframes e mais.
-
-</td>
-<td width="50%" valign="top">
-
-**Criptografia de Banco de Dados:**
-Backend armazenado como arquivos de banco de dados SQLite criptografados. Consulte a [documentacao](https://docs.termix.site/security) para mais informacoes.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Grafico de Rede:**
-Personalize seu Dashboard para visualizar seu homelab baseado nas suas conexoes SSH com suporte de status.
-
-</td>
-<td width="50%" valign="top">
-
-**Ferramentas SSH:**
-Crie trechos de comandos reutilizaveis que sao executados com um unico clique. Execute um comando simultaneamente em multiplos terminais abertos.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Abas Persistentes:**
-Sessoes SSH e abas permanecem abertas entre dispositivos/atualizacoes se habilitado no perfil do usuario.
-
-</td>
-<td width="50%" valign="top">
-
-**Idiomas:**
-Suporte integrado para aproximadamente 30 idiomas (gerenciado pelo [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>Mais funcionalidades</b></summary>
-<br />
-
-- **Dashboard** - Visualize informacoes do servidor de relance no seu dashboard
-- **Chaves de API** - Crie chaves de API com escopo de usuario e datas de expiracao para uso em automacao/CI
-- **Exportacao/Importacao de Dados** - Exporte e importe hosts SSH, credenciais e dados do gerenciador de arquivos
-- **Configuracao Automatica de SSL** - Geracao e gerenciamento integrado de certificados SSL com redirecionamentos HTTPS
-- **Interface Moderna** - Interface limpa compativel com desktop/mobile construida com React, Tailwind CSS e Shadcn. Escolha entre muitos temas de interface diferentes, incluindo claro, escuro, Dracula, etc. Use rotas de URL para abrir qualquer conexao em tela cheia.
-- **Historico de Comandos** - Autocompletar e visualizar comandos SSH executados anteriormente
-- **Conexao Rapida** - Conecte-se a um servidor sem precisar salvar os dados de conexao
-- **Paleta de Comandos** - Pressione duas vezes a tecla Shift esquerda para acessar rapidamente as conexoes SSH com seu teclado
-- **Integracao com Proxmox** - Adicione automaticamente hosts ao Termix a partir da sua instancia Proxmox
-- **SSH Rico em Funcionalidades** - Suporta jump hosts, Warpgate, conexoes baseadas em TOTP, SOCKS5, verificacao de chave do host, preenchimento automatico de senhas, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro de terminal, encaminhamento de agente SSH, agente SSH do Bitwarden, assinatura SSH do HashiCorp Vault, e mais.
-- **Termix ID** - Um equivalente ao sshid.io integrado ao Termix. Reivindique um identificador, publique suas chaves SSH publicas em uma URL de resolucao e use uma CA integrada para emitir certificados SSH.
-
-</details>
-
-<br />
-
-## Suporte a Plataformas
-
-<table align="center">
-<tr>
-<th align="center">Plataforma</th>
-<th align="center">Distribuicao</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>Qualquer navegador moderno (Chrome, Safari, Firefox) · Suporte PWA</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portatil · Instalador MSI · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Portatil · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## Instalacao
-
-Visite a [documentacao](https://docs.termix.site/install) do Termix para instrucoes completas de instalacao em todas as plataformas.
-
-Arquivo Docker Compose de exemplo (voce pode omitir o `guacd` e a rede se nao planeja usar recursos de area de trabalho remota):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## Doar
-
-Termix e gratuito e de codigo aberto, sem assinaturas ou planos pagos. Se o achar util, considere doar para ajudar a cobrir custos de servidor, dominios e tempo de desenvolvimento. As doacoes tambem ajudam a financiar o tempo de pesquisa e aprendizado necessario para construir funcionalidades como suporte a SAML, Kubernetes e Agent. Acompanhe o progresso e doe abaixo.
-
-[Doar](https://donate.termix.site/)
-
-<br />
-
-## Patrocinadores
-
-Interessado em um espaco pago para apoiar o desenvolvimento? Envie um email para [mail@termix.site](mailto:mail@termix.site).
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## Suporte
-
-Se voce precisa de ajuda ou deseja solicitar uma funcionalidade para o Termix, visite a pagina de [Issues](https://github.com/Termix-SSH/Support/issues), faca login e clique em `New Issue`. Por favor, seja o mais detalhado possivel no seu relato, preferencialmente escrito em ingles. Voce tambem pode entrar no servidor do [Discord](https://discord.gg/jVQGdvHDrf) e visitar o canal de suporte, porem, os tempos de resposta podem ser mais longos.
-
-<br />
-
-## Capturas de Tela
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Assista resumos de atualizacoes no YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Alguns videos e imagens podem estar desatualizados ou podem nao mostrar perfeitamente as funcionalidades.</sub>
-
-</div>
-
-<br />
-
-## Funcionalidades Planejadas
-
-Consulte [Projetos](https://github.com/orgs/Termix-SSH/projects/5) para todas as funcionalidades planejadas. Se voce deseja contribuir, consulte [Contribuir](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
-## Licenca
-
-Distribuido sob a Licenca Apache Versao 2.0. Consulte `LICENSE` para mais informacoes.

docs/readme/README-RU.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>Самостоятельно размещаемое управление SSH и доступ к удалённому рабочему столу</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  Русский ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix — бесплатный проект с открытым исходным кодом. Если он вам полезен, рассмотрите возможность [пожертвования](https://donate.termix.site/) для покрытия расходов на серверы и время разработки.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Достигнуто 1 сентября 2025 года</sub>
-</p>
-
-</div>
-
-<br />
-
-## Обзор
-
-Termix - это платформа для управления серверами с открытым исходным кодом, навсегда бесплатная и размещаемая на собственном сервере. Она предоставляет мультиплатформенное решение для управления вашими серверами и инфраструктурой через единый интуитивно понятный интерфейс. Termix предлагает доступ к SSH-терминалу, управление удаленным рабочим столом (RDP, VNC, Telnet), возможности SSH-туннелирования, удаленное управление файлами SSH и множество других инструментов. Termix - это идеальная бесплатная альтернатива Termius с возможностью размещения на собственном сервере, доступная для всех платформ.
-
-<br />
-
-## Возможности
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**Доступ к SSH-терминалу:**
-Полнофункциональный терминал с поддержкой разделения экрана (до 4 панелей) и системой вкладок, как в браузере. Включает поддержку настройки терминала, включая популярные темы, шрифты и другие компоненты.
-
-</td>
-<td width="50%" valign="top">
-
-**Доступ к удалённому рабочему столу:**
-Поддержка RDP, VNC и Telnet через браузер с полной настройкой и разделением экрана.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Управление SSH-туннелями:**
-Создание и управление межсерверными SSH-туннелями с автоматическим переподключением, мониторингом состояния и локальной, удалённой или динамической SOCKS-переадресацией. Настройки туннелей «десктопный клиент - сервер» хранятся локально для каждой установки; опциональные снимки C2S-пресетов можно сохранять на сервере, переименовывать, загружать или удалять, когда вы хотите перенести локальную конфигурацию туннеля между клиентами.
-
-</td>
-<td width="50%" valign="top">
-
-**Удалённый файловый менеджер:**
-Управление файлами непосредственно на удалённых серверах с поддержкой просмотра и редактирования кода, изображений, аудио и видео. Загрузка, скачивание, переименование, удаление и перемещение файлов с поддержкой sudo. Включает поддержку перемещения файлов с сервера на сервер.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Управление Docker и Podman:**
-Запуск, остановка, приостановка, удаление контейнеров. Просмотр статистики контейнеров. Управление контейнером через терминал docker exec. Поддерживает как Docker, так и Podman в качестве среды выполнения контейнеров. Не предназначен для замены Portainer или Dockge, а скорее для простого управления контейнерами по сравнению с их созданием.
-
-</td>
-<td width="50%" valign="top">
-
-**Менеджер SSH-хостов:**
-Сохранение, организация и управление SSH-подключениями с помощью тегов и папок (с настройкой папок и поддержкой вложенных папок), с возможностью сохранения данных для повторного входа и автоматизации развёртывания SSH-ключей.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Метрики хоста:**
-Просмотр использования CPU, памяти и диска, сети, времени работы, информации о системе, файрвола, монитора портов, просмотрщика логов, пользователей/прав доступа, сертификатов и многого другого на большинстве серверов на базе Linux. Включает графики истории временных рядов и оповещения на основе пороговых значений с поддержкой ntfy и вебхуков.
-
-</td>
-<td width="50%" valign="top">
-
-**Аутентификация пользователей:**
-Безопасное управление пользователями с административным контролем (может редактировать информацию других пользователей) и поддержкой OIDC/LDAP/SSO (с контролем доступа), 2FA (TOTP) и поддержкой ключей доступа (WebAuthn). Просмотр активных сессий пользователей на всех платформах и отзыв прав доступа. Связывание аккаунтов OIDC/локальных аккаунтов. Просмотр журнала аудита действий всех пользователей.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Интеграция с Tailscale:**
-Список устройств вашей сети Tailscale для быстрого добавления их в качестве хостов и подключение через Tailscale SSH в качестве метода аутентификации, позволяя ACL вашей сети управлять авторизацией без хранения учётных данных.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Общий доступ:**
-Создание ролей и предоставление общего доступа к хостам для пользователей/ролей. Поддерживает все типы аутентификации и все протоколы хостов.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Последовательные подключения:**
-Подключение к последовательным устройствам (маршрутизаторы, коммутаторы, микроконтроллеры и т. д.) напрямую из браузера или приложения для рабочего стола. Настройка скорости передачи данных, битов данных, стоп-битов и чётности. Использует Web Serial API в поддерживаемых браузерах или нативный бэкенд в приложении Electron.
-
-</td>
-<td width="50%" valign="top">
-
-**Оповещения:**
-Настройте правила оповещений на основе пороговых значений для метрик хоста (CPU, память, диск и т. д.) и получайте уведомления через ntfy или вебхуки при их срабатывании. Просматривайте активные и разрешённые оповещения в журнале истории.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Домашняя страница:**
-Полностью настраиваемая домашняя страница с сеткой виджетов с перетаскиванием. Добавляйте виджеты для статуса хоста, ссылок на сервисы, часов, заметок, RSS-лент, погоды, контейнеров Docker, графиков метрик хоста, встроенных терминалов, iframe и многого другого.
-
-</td>
-<td width="50%" valign="top">
-
-**Шифрование базы данных:**
-Бэкенд хранится в виде зашифрованных файлов базы данных SQLite. Подробнее в [документации](https://docs.termix.site/security).
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Сетевой граф:**
-Настройте панель управления для визуализации вашей домашней лаборатории на основе SSH-подключений с поддержкой статусов.
-
-</td>
-<td width="50%" valign="top">
-
-**Инструменты SSH:**
-Создание переиспользуемых фрагментов команд, выполняемых одним нажатием. Запуск одной команды одновременно в нескольких открытых терминалах.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Постоянные вкладки:**
-SSH-сессии и вкладки остаются открытыми на всех устройствах/при обновлении страницы, если включено в профиле пользователя.
-
-</td>
-<td width="50%" valign="top">
-
-**Языки:**
-Встроенная поддержка около 30 языков (управляется через [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>Больше возможностей</b></summary>
-<br />
-
-- **Панель управления** - Просмотр информации о сервере на панели управления одним взглядом
-- **API-ключи** - Создание API-ключей с областью видимости пользователя и сроками действия для использования в автоматизации/CI
-- **Экспорт/импорт данных** - Экспорт и импорт SSH-хостов, учётных данных и данных файлового менеджера
-- **Автоматическая настройка SSL** - Встроенная генерация и управление SSL-сертификатами с перенаправлением на HTTPS
-- **Современный интерфейс** - Чистый интерфейс для десктопа и мобильных устройств, построенный на React, Tailwind CSS и Shadcn. Выбор между множеством различных тем интерфейса, включая светлую, тёмную, Dracula и т. д. Использование URL-маршрутов для открытия любого подключения в полноэкранном режиме.
-- **История команд** - Автодополнение и просмотр ранее выполненных SSH-команд
-- **Быстрое подключение** - Подключение к серверу без необходимости сохранения данных подключения
-- **Командная палитра** - Двойное нажатие левого Shift для быстрого доступа к SSH-подключениям с клавиатуры
-- **Интеграция с Proxmox** - Автоматическое добавление хостов в Termix из вашего экземпляра Proxmox
-- **Богатый функционал SSH** - Поддержка jump-хостов, Warpgate, подключений на основе TOTP, SOCKS5, верификации ключей хоста, автозаполнения паролей, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, логирования терминала, переадресации SSH-агента, SSH-агента Bitwarden, подписи SSH через HashiCorp Vault и многого другого.
-- **Termix ID** - Аналог sshid.io, встроенный в Termix. Зарегистрируйте имя пользователя, опубликуйте свои публичные SSH-ключи по URL резолвера и используйте встроенный ЦС для выдачи SSH-сертификатов.
-
-</details>
-
-<br />
-
-## Поддержка платформ
-
-<table align="center">
-<tr>
-<th align="center">Платформа</th>
-<th align="center">Дистрибутив</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>Любой современный браузер (Chrome, Safari, Firefox) · Поддержка PWA</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Портативная версия · Установщик MSI · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Портативная версия · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## Установка
-
-Посетите [документацию](https://docs.termix.site/install) Termix для получения полных инструкций по установке на всех платформах.
-
-Пример файла Docker Compose (вы можете опустить `guacd` и сеть, если не планируете использовать функции удаленного рабочего стола):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## Пожертвование
-
-Termix бесплатен и имеет открытый исходный код, без подписок или платных тарифов. Если он вам полезен, рассмотрите возможность пожертвования, чтобы помочь покрыть расходы на серверы, домены и время разработки. Пожертвования также помогают финансировать время на исследование и изучение того, что необходимо для создания таких функций, как поддержка SAML, Kubernetes и Agent. Отслеживайте прогресс и делайте пожертвования ниже.
-
-[Пожертвовать](https://donate.termix.site/)
-
-<br />
-
-## Спонсоры
-
-Заинтересованы в платном размещении для поддержки разработки? Напишите на [mail@termix.site](mailto:mail@termix.site).
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## Поддержка
-
-Если вам нужна помощь или вы хотите запросить новую функцию для Termix, посетите страницу [Проблемы](https://github.com/Termix-SSH/Support/issues), войдите в систему и нажмите `New Issue`. Пожалуйста, опишите вашу проблему как можно подробнее, предпочтительно на английском языке. Вы также можете присоединиться к серверу [Discord](https://discord.gg/jVQGdvHDrf) и обратиться в канал поддержки, однако время ответа может быть дольше.
-
-<br />
-
-## Скриншоты
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Смотрите обзоры обновлений на YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Некоторые видео и изображения могут быть устаревшими или не полностью отражать функциональность.</sub>
-
-</div>
-
-<br />
-
-## Запланированные функции
-
-Смотрите [Проекты](https://github.com/orgs/Termix-SSH/projects/5) для просмотра всех запланированных функций. Если вы хотите внести вклад, смотрите [Участие в разработке](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
-## Лицензия
-
-Распространяется по лицензии Apache License Version 2.0. Подробнее см. в файле `LICENSE`.

docs/readme/README-TR.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>Kendi sunucunuzda barindirilan SSH yonetimi ve uzak masaustu erisimi</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  Türkçe ·
-  <a href="README-VI.md">Tiếng Việt</a> ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix ücretsiz ve açık kaynaklıdır. Faydalı buluyorsanız, sunucu maliyetleri ve geliştirme süresine katkıda bulunmak için [bağış yapmayı](https://donate.termix.site/) düşünebilirsiniz.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>1 Eylül 2025'te kazanildi</sub>
-</p>
-
-</div>
-
-<br />
-
-## Genel Bakis
-
-Termix, acik kaynakli, sonsuza kadar ucretsiz, kendi sunucunuzda barindirabileceginez hepsi bir arada sunucu yonetim platformudur. Sunucularinizi ve altyapinizi tek bir sezgisel arayuz uzerinden yonetmek icin cok platformlu bir cozum sunar. Termix, SSH terminal erisimi, uzak masaustu kontrolu (RDP, VNC, Telnet), SSH tunelleme yetenekleri, uzak dosya yonetimi ve daha bircok arac saglar. Termix, tum platformlarda kullanilabilen Termius'un mukemmel ucretsiz ve kendi barindirmali alternatifidir.
-
-<br />
-
-## Ozellikler
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**SSH Terminal Erisimi:**
-Tarayici benzeri sekme sistemiyle bolunmus ekran destegine sahip (4 panele kadar) tam ozellikli terminal. Yaygin terminal temalari, yazi tipleri ve diger bilesenleri iceren terminal ozellestirme destegi.
-
-</td>
-<td width="50%" valign="top">
-
-**Uzak Masaustu Erisimi:**
-Tam ozellestirme ve bolunmus ekran ile tarayici uzerinden RDP, VNC ve Telnet destegi.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**SSH Tunel Yonetimi:**
-Otomatik yeniden baglanti, saglik izleme ve yerel, uzak veya dinamik SOCKS yonlendirme ile sunucular arasi SSH tunelleri olusturun ve yonetin. Masaustu istemci-sunucu tunel ayarlari her masaustu kurulumu icin yerel olarak depolanir; istege bagli C2S hazir ayar anlik goruntuleri, yerel bir tunel yapilandirmasini istemciler arasinda tasimak istediginizde sunucuya kaydedilebilir, yeniden adlandirilabilir, yuklenebilir veya silinebilir.
-
-</td>
-<td width="50%" valign="top">
-
-**Uzak Dosya Yoneticisi:**
-Uzak sunuculardaki dosyalari dogrudan yonetin; kod, goruntu, ses ve video goruntuleme ve duzenleme destegi ile. Sudo destegi ile dosyalari sorunsuzca yukleyin, indirin, yeniden adlandirin, silin ve tasiyin. Dosyalari sunucudan sunucuya tasima destegini de icerir.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Docker ve Podman Yonetimi:**
-Konteynerleri baslatın, durdurun, duraklatın, kaldirin. Konteyner istatistiklerini goruntuleyin. Docker exec terminali kullanarak konteyneri kontrol edin. Docker ve Podman'i konteyner calisma ortami olarak destekler. Portainer veya Dockge'nin yerini almak icin degil, konteynerlerinizi olusturmak yerine basitce yonetmek icin tasarlanmistir.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH Ana Bilgisayar Yoneticisi:**
-SSH baglantilarinizi etiketler ve klasorlerle (klasor ozellestirme ve ic ice klasor destegi ile) kaydedin, duzenleyin ve yonetin; yeniden kullanilabilir giris bilgilerini kolayca kaydedin ve SSH anahtarlarinin dagitimini otomatiklestirin.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Ana Bilgisayar Metrikleri:**
-Cogu Linux tabanli sunucularda calisan CPU, bellek, disk kullanimi, ag, calisma suresi, sistem bilgisi, guvenlik duvari, port izleme, gunluk goruntuleyici, kullanicilar/izinler, sertifikalar ve daha fazlasini goruntuleyin. Zaman serisi gecmis grafiklerini ve ntfy ile webhook destekli esik tabanli uyarilari icerir.
-
-</td>
-<td width="50%" valign="top">
-
-**Kullanici Kimlik Dogrulama:**
-Yonetici kontrolleri (diger kullanicilarin bilgilerini duzenleyebilir), OIDC/LDAP/SSO (erisim kontrollu), 2FA (TOTP) ve passkey (WebAuthn) destegi ile guvenli kullanici yonetimi. Tum platformlardaki aktif kullanici oturumlarini goruntuleyin ve izinleri iptal edin. OIDC/Yerel hesaplarinizi birbirine baglayin. Tum kullanicilarin islemlerinin denetim gunlugunu goruntuleyin.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tailscale Entegrasyonu:**
-Tailscale aginizdaki cihazlari listeleyerek hizlica ana bilgisayar olarak ekleyin ve kimlik dogrulama yontemi olarak Tailscale SSH kullanarak baglanin; bu sayede ag ACL'leriniz kimlik bilgileri depolamadan yetkilendirmeyi yonetir.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Paylasim:**
-Roller olusturun ve ana bilgisayarlari kullanicilar/roller arasinda paylasin. Tum kimlik dogrulama turlerini ve tum ana bilgisayar protokollerini destekler.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Seri Baglantilar:**
-Seri cihazlara (router, switch, mikrodenetleyici vb.) dogrudan tarayici veya masaustu uygulamasindan baglanin. Baud hizi, veri bitleri, durdurma bitleri ve parite yapilandirin. Desteklenen tarayicilarda Web Serial API, Electron uygulamasinda yerel arka ucu kullanir.
-
-</td>
-<td width="50%" valign="top">
-
-**Uyarilar:**
-Ana bilgisayar metrikleri (CPU, bellek, disk vb.) icin esik tabanli uyari kurallari belirleyin ve tetiklendiklerinde ntfy veya webhook araciligiyla bildirim alin. Gecmis gunlugunde tetiklenen ve cozulen uyarilari goruntuleyin.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Ana Sayfa:**
-Surukleme ve birakma widget izgarasina sahip tamamen ozellestirilebilir bir ana sayfa. Ana bilgisayar durumu, hizmet baglantilari, saatler, notlar, RSS besleme, hava durumu, Docker konteynerleri, ana bilgisayar metrik grafikleri, gomulu terminaller, iframe ve daha fazlasi icin widget ekleyin.
-
-</td>
-<td width="50%" valign="top">
-
-**Veritabani Sifreleme:**
-Arka uc, sifrelenmis SQLite veritabani dosyalari olarak depolanir. Daha fazla bilgi icin [belgelere](https://docs.termix.site/security) bakin.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Ag Grafigi:**
-Kontrol panelinizi, SSH baglantilariniza dayali olarak ev laboratuvarinizi durum destegi ile gorselletirmek icin ozellestirin.
-
-</td>
-<td width="50%" valign="top">
-
-**SSH Araclari:**
-Tek tiklamayla calistirilan yeniden kullanilabilir komut parcaciklari olusturun. Birden fazla acik terminalde ayni anda tek bir komut calistirin.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Kalici Sekmeler:**
-Kullanici profilinde etkinlestirilmisse SSH oturumlari ve sekmeler cihazlar/yenilemeler arasinda acik kalir.
-
-</td>
-<td width="50%" valign="top">
-
-**Diller:**
-Yaklasik 30 dil icin yerlesik destek ([Crowdin](https://docs.termix.site/translations) tarafindan yonetilir).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>Daha fazla ozellik</b></summary>
-<br />
-
-- **Kontrol Paneli** - Kontrol panelinizde sunucu bilgilerini bir bakista goruntuleyin
-- **API Anahtarlari** - Otomasyon/CI icin kullanilmak uzere son kullanma tarihleriyle kullanici kapsamli API anahtarlari olusturun
-- **Veri Disa/Ice Aktarma** - SSH ana bilgisayarlarini, kimlik bilgilerini ve dosya yoneticisi verilerini disa ve ice aktarin
-- **Otomatik SSL Kurulumu** - HTTPS yonlendirmeleriyle yerlesik SSL sertifika olusturma ve yonetimi
-- **Modern Arayuz** - React, Tailwind CSS ve Shadcn ile olusturulmus temiz masaustu/mobil uyumlu arayuz. Isik, karanlik, Dracula vb. dahil olmak uzere bircok farkli UI temasi arasından secim yapin. Herhangi bir baglantıyı tam ekranda acmak icin URL yollarini kullanin.
-- **Komut Gecmisi** - Daha once calistirilan SSH komutlarini otomatik tamamlayin ve goruntuleyin
-- **Hizli Baglanti** - Baglanti verilerini kaydetmeden bir sunucuya baglanin
-- **Komut Paleti** - Sol shift tusuna iki kez basarak SSH baglantilariniza klavyenizle hizlica erisin
-- **Proxmox Entegrasyonu** - Proxmox ornekinizden Termix'e otomatik olarak ana bilgisayar ekleyin
-- **SSH Zengin Ozellikler** - Atlama ana bilgisayarlari, Warpgate, TOTP tabanli baglantilar, SOCKS5, ana bilgisayar anahtar dogrulama, otomatik sifre doldurma, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal gunlukleme, SSH agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH imzalama ve dahasini destekler.
-- **Termix ID** - Termix'e entegre edilmis bir sshid.io esdegeri. Bir kullanici adi edinin, genel SSH anahtarlarinizi bir cozumleyici URL'sinde yayinlayin ve SSH sertifikalari vermek icin yerlesik bir CA kullanin.
-
-</details>
-
-<br />
-
-## Platform Destegi
-
-<table align="center">
-<tr>
-<th align="center">Platform</th>
-<th align="center">Dagitim</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>Herhangi bir modern tarayici (Chrome, Safari, Firefox) · PWA destegi</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Tasınabilir · MSI Yukleyici · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Tasınabilir · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## Kurulum
-
-Termix'i tum platformlara nasil kuracaginiz hakkinda daha fazla bilgi icin Termix [Belgelerine](https://docs.termix.site/install) bakin.
-
-Ornek bir Docker Compose dosyasi (uzak masaustu ozelliklerini kullanmayi planlamiyorsaniz `guacd` ve agi cikarabilirsiniz):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## Bağış Yapın
-
-Termix ücretsiz ve açık kaynaklıdır, abonelik veya ücretli plan yoktur. Faydalı buluyorsaniz, sunucu maliyetleri, alan adlari ve gelistirme suresine katkida bulunmak icin bagis yapmayi dusunebilirsiniz. Bagislar ayrica SAML, Kubernetes ve Agent destegi gibi ozellikleri gelistirmek icin gereken arastirma ve ogrenme suresini finanse etmeye yardimci olur. Ilerlemeyi takip edin ve asagidan bagis yapin.
-
-[Bağış Yapın](https://donate.termix.site/)
-
-<br />
-
-## Sponsorlar
-
-Gelistirmeyi desteklemek icin ucretli bir yerlesim ile ilgileniyor musunuz? [mail@termix.site](mailto:mail@termix.site) adresine e-posta gonderin.
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## Destek
-
-Termix ile ilgili yardima ihtiyaciniz varsa veya bir ozellik talep etmek istiyorsaniz, [Sorunlar](https://github.com/Termix-SSH/Support/issues) sayfasini ziyaret edin, giris yapin ve `New Issue` butonuna basin. Lutfen sorununuzu mumkun oldugunca ayrintili yazin, tercihen Ingilizce olarak. Ayrica [Discord](https://discord.gg/jVQGdvHDrf) sunucusuna katilabilir ve destek kanalini ziyaret edebilirsiniz, ancak yanit sureleri daha uzun olabilir.
-
-<br />
-
-## Ekran Goruntuleri
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>YouTube'da guncelleme ozetlerini izleyin</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Bazi videolar ve gorseller guncel olmayabilir veya ozellikleri tam olarak yansitmayabilir.</sub>
-
-</div>
-
-<br />
-
-## Planlanan Ozellikler
-
-Tum planlanan ozellikler icin [Projeler](https://github.com/orgs/Termix-SSH/projects/5) sayfasina bakin. Katkida bulunmak istiyorsaniz, [Katkida Bulunma](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md) sayfasina bakin.
-
-<br />
-
-## Lisans
-
-Apache Lisansi Surumu 2.0 altinda dagitilmaktadir. Daha fazla bilgi icin `LICENSE` dosyasina bakin.

docs/readme/README-VI.md

@@ -1,416 +0,0 @@
-<div align="center">
-
-<img src="../public/icon.svg" width="120" height="120" alt="Termix Logo" />
-
-<h1>Termix</h1>
-
-<p>Quan ly SSH tu luu tru va truy cap may tinh tu xa</p>
-
-<p>
-  <a href="../README.md">English</a> ·
-  <a href="README-CN.md">中文</a> ·
-  <a href="README-JA.md">日本語</a> ·
-  <a href="README-KO.md">한국어</a> ·
-  <a href="README-FR.md">Français</a> ·
-  <a href="README-DE.md">Deutsch</a> ·
-  <a href="README-ES.md">Español</a> ·
-  <a href="README-PT.md">Português</a> ·
-  <a href="README-RU.md">Русский</a> ·
-  <a href="README-AR.md">العربية</a> ·
-  <a href="README-HI.md">हिन्दी</a> ·
-  <a href="README-TR.md">Türkçe</a> ·
-  Tiếng Việt ·
-  <a href="README-IT.md">Italiano</a>
-</p>
-
-<p>
-  <img src="https://img.shields.io/github/stars/Termix-SSH/Termix?style=flat&label=Stars&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/forks/Termix-SSH/Termix?style=flat&label=Forks&color=F39044&labelColor=1a1a1a" />
-  <img src="https://img.shields.io/github/v/release/Termix-SSH/Termix?style=flat&label=Release&color=F39044&labelColor=1a1a1a&v=1" />
-  <a href="https://discord.gg/jVQGdvHDrf"><img alt="Discord" src="https://img.shields.io/discord/1347374268253470720?color=F39044&labelColor=1a1a1a" /></a>
-  <a href="https://donate.termix.site/"><img alt="Donate" src="https://img.shields.io/badge/Donate-Support%20Termix-F39044?style=flat&labelColor=1a1a1a" /></a>
-</p>
-
-<p>
-  <a href="https://donate.termix.site/"><img alt="Donations this month" src="https://img.shields.io/badge/dynamic/json?style=for-the-badge&label=Donations%20this%20month&query=%24.fiatTotal&prefix=%24&url=https%3A%2F%2Ftermix.site%2Fdonation-snapshot.json&color=F39044&labelColor=1a1a1a" /></a>
-</p>
-
-<br />
-
-Termix là dự án miễn phí và mã nguồn mở. Nếu bạn thấy hữu ích, hãy cân nhắc [quyên góp](https://donate.termix.site/) để giúp trang trải chi phí máy chủ và thời gian phát triển.
-
-<br />
-
-<img src="../repo-images/Termix Header.png" alt="Termix Banner" width="900" />
-
-<br />
-<br />
-
-<p>
-  <img src="../repo-images/Repo of the Day.png" alt="Repo of the Day Achievement" width="280" />
-  <br />
-  <sub>Dat duoc vao ngay 1 thang 9 nam 2025</sub>
-</p>
-
-</div>
-
-<br />
-
-## Tong Quan
-
-Termix la nen tang quan ly may chu tat ca trong mot, ma nguon mo, mien phi vinh vien, tu luu tru. No cung cap giai phap da nen tang de quan ly may chu va co so ha tang cua ban thong qua mot giao dien truc quan duy nhat. Termix cung cap quyen truy cap terminal SSH, dieu khien may tinh tu xa (RDP, VNC, Telnet), kha nang tao duong ham SSH, quan ly tep tu xa va nhieu cong cu khac. Termix la giai phap thay the mien phi va tu luu tru hoan hao cho Termius, kha dung tren tat ca cac nen tang.
-
-<br />
-
-## Tinh Nang
-
-<table>
-<tr>
-<td width="50%" valign="top">
-
-**Truy Cap Terminal SSH:**
-Terminal day du tinh nang voi ho tro chia man hinh (len den 4 bang) voi he thong tab kieu trinh duyet. Bao gom ho tro tuy chinh terminal bao gom cac chu de terminal pho bien, phong chu va cac thanh phan khac.
-
-</td>
-<td width="50%" valign="top">
-
-**Truy Cap Man Hinh Tu Xa:**
-Ho tro RDP, VNC va Telnet qua trinh duyet voi day du tuy chinh va chia man hinh.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Quan Ly Duong Ham SSH:**
-Tao va quan ly duong ham SSH giua cac may chu voi tu dong ket noi lai, giam sat suc khoe va chuyen tiep cuc bo, tu xa hoac SOCKS dong. Cai dat duong ham tu may khach desktop den may chu duoc luu tru cuc bo cho moi ban cai dat desktop; cac snapshot C2S preset tuy chon co the duoc luu tren may chu, doi ten, tai hoac xoa khi ban muon di chuyen mot cau hinh duong ham cuc bo giua cac may khach.
-
-</td>
-<td width="50%" valign="top">
-
-**Trinh Quan Ly Tep Tu Xa:**
-Quan ly tep truc tiep tren may chu tu xa voi ho tro xem va chinh sua ma, hinh anh, am thanh va video. Tai len, tai xuong, doi ten, xoa va di chuyen tep lien mach voi ho tro sudo. Bao gom ho tro di chuyen tep tu may chu nay sang may chu khac.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Quan Ly Docker va Podman:**
-Khoi dong, dung, tam dung, xoa container. Xem thong ke container. Dieu khien container bang terminal docker exec. Ho tro ca Docker va Podman lam moi truong chay container. Khong duoc tao ra de thay the Portainer hay Dockge ma don gian la de quan ly container cua ban thay vi tao moi chung.
-
-</td>
-<td width="50%" valign="top">
-
-**Trinh Quan Ly May Chu SSH:**
-Luu, sap xep va quan ly cac ket noi SSH cua ban voi the va thu muc (ho tro tuy chinh thu muc va thu muc long nhau), de dang luu thong tin dang nhap co the tai su dung dong thoi co the tu dong hoa viec trien khai khoa SSH.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Chi So May Chu:**
-Xem muc su dung CPU, bo nho, o dia, mang, thoi gian hoat dong, thong tin he thong, tuong lua, giam sat cong, trinh xem nhat ky, nguoi dung/quyen, chung chi va nhieu hon nua tren hau het cac may chu chay Linux. Bao gom bieu do lich su theo chuoi thoi gian va canh bao dua tren nguong voi ho tro ntfy va webhook.
-
-</td>
-<td width="50%" valign="top">
-
-**Xac Thuc Nguoi Dung:**
-Quan ly nguoi dung an toan voi quyen quan tri (co the chinh sua thong tin cua nguoi dung khac) va ho tro OIDC/LDAP/SSO (co kiem soat truy cap), 2FA (TOTP) va passkey (WebAuthn). Xem phien hoat dong cua nguoi dung tren tat ca cac nen tang va thu hoi quyen. Lien ket tai khoan OIDC/Noi bo cua ban voi nhau. Xem nhat ky kiem toan cac hanh dong cua tat ca nguoi dung.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tich Hop Tailscale:**
-Liet ke cac thiet bi trong mang Tailscale de nhanh chong them vao lam may chu, va ket noi bang Tailscale SSH lam phuong thuc xac thuc, de cac ACL mang xu ly uy quyen ma khong can luu tru thong tin xac thuc.
-
-</td>
-<td width="50%" valign="top">
-
-**RBAC/Chia Se:**
-Tao vai tro va chia se may chu giua nguoi dung/vai tro. Ho tro tat ca cac loai xac thuc va tat ca cac giao thuc may chu.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Ket Noi Noi Tiep:**
-Ket noi voi cac thiet bi noi tiep (router, switch, vi dieu khien, v.v.) truc tiep tu trinh duyet hoac ung dung may tinh. Cau hinh toc do baud, bit du lieu, bit dung va chan le. Su dung Web Serial API tren trinh duyet duoc ho tro hoac backend ban dia trong ung dung Electron.
-
-</td>
-<td width="50%" valign="top">
-
-**Canh Bao:**
-Dat cac quy tac canh bao dua tren nguong cho chi so may chu (CPU, bo nho, o dia, v.v.) va nhan thong bao qua ntfy hoac webhook khi chung kich hoat. Xem canh bao dang kich hoat va da giai quyet trong nhat ky lich su.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Trang Chu:**
-Trang chu co the tuy chinh hoan toan voi luoi widget keo va tha. Them widget cho trang thai may chu, lien ket dich vu, dong ho, ghi chu, feed RSS, thoi tiet, container Docker, bieu do chi so may chu, terminal nhung, iframe va nhieu hon nua.
-
-</td>
-<td width="50%" valign="top">
-
-**Ma Hoa Co So Du Lieu:**
-Backend duoc luu tru duoi dang tep co so du lieu SQLite duoc ma hoa. Xem [tai lieu](https://docs.termix.site/security) de biet them.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Bieu Do Mang:**
-Tuy chinh Bang Dieu Khien de truc quan hoa homelab cua ban dua tren cac ket noi SSH voi ho tro trang thai.
-
-</td>
-<td width="50%" valign="top">
-
-**Cong Cu SSH:**
-Tao doan lenh co the tai su dung, thuc thi chi voi mot cu nhap chuot. Chay mot lenh dong thoi tren nhieu terminal dang mo.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Tab Lien Tuc:**
-Cac phien SSH va tab van mo tren cac thiet bi/lan lam moi neu duoc bat trong ho so nguoi dung.
-
-</td>
-<td width="50%" valign="top">
-
-**Ngon Ngu:**
-Ho tro tich hop khoang 30 ngon ngu (duoc quan ly boi [Crowdin](https://docs.termix.site/translations)).
-
-</td>
-</tr>
-</table>
-
-<br />
-
-<details>
-<summary><b>Them tinh nang</b></summary>
-<br />
-
-- **Bang Dieu Khien** - Xem thong tin may chu trong nháy mat tren bang dieu khien cua ban
-- **Khoa API** - Tao khoa API theo pham vi nguoi dung voi ngay het han de su dung cho tu dong hoa/CI
-- **Xuat/Nhap Du Lieu** - Xuat va nhap may chu SSH, thong tin xac thuc va du lieu trinh quan ly tep
-- **Thiet Lap SSL Tu Dong** - Tao va quan ly chung chi SSL tich hop voi chuyen huong HTTPS
-- **Giao Dien Hien Dai** - Giao dien sach se, than thien voi may tinh/di dong duoc xay dung bang React, Tailwind CSS va Shadcn. Chon giua nhieu chu de UI khac nhau bao gom sang, toi, Dracula, v.v. Su dung duong dan URL de mo bat ky ket noi nao o che do toan man hinh.
-- **Lich Su Lenh** - Tu dong hoan thanh va xem cac lenh SSH da chay truoc do
-- **Ket Noi Nhanh** - Ket noi den may chu ma khong can luu du lieu ket noi
-- **Bang Lenh** - Nhan dup phim shift trai de truy cap nhanh cac ket noi SSH bang ban phim
-- **Tich Hop Proxmox** - Tu dong them may chu vao Termix tu instance Proxmox cua ban
-- **SSH Giau Tinh Nang** - Ho tro jump host, Warpgate, ket noi dua tren TOTP, SOCKS5, xac minh khoa may chu, tu dong dien mat khau, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, ghi nhat ky terminal, chuyen tiep SSH agent, Bitwarden SSH agent, ky SSH bang HashiCorp Vault va nhieu hon nua.
-- **Termix ID** - Mot tuong duong cua sshid.io duoc tich hop san trong Termix. Dang ky mot ten dinh danh, cong bo khoa SSH cong khai cua ban tai mot URL phan giai va su dung CA tich hop san de cap chung chi SSH.
-
-</details>
-
-<br />
-
-## Ho Tro Nen Tang
-
-<table align="center">
-<tr>
-<th align="center">Nen tang</th>
-<th align="center">Phan phoi</th>
-</tr>
-<tr>
-<td align="center"><b>Web</b></td>
-<td>Bat ky trinh duyet hien dai nao (Chrome, Safari, Firefox) · Ho tro PWA</td>
-</tr>
-<tr>
-<td align="center"><b>Windows</b> <sub>x64/ia32</sub></td>
-<td>Portable · MSI Installer · Chocolatey</td>
-</tr>
-<tr>
-<td align="center"><b>Linux</b> <sub>x64/ia32</sub></td>
-<td>Portable · AUR · AppImage · Deb · Flatpak</td>
-</tr>
-<tr>
-<td align="center"><b>macOS</b> <sub>x64/ia32, v12.0+</sub></td>
-<td>Apple App Store · DMG · Homebrew</td>
-</tr>
-<tr>
-<td align="center"><b>iOS/iPadOS</b> <sub>v15.1+</sub></td>
-<td>Apple App Store · IPA</td>
-</tr>
-<tr>
-<td align="center"><b>Android</b> <sub>v7.0+</sub></td>
-<td>Google Play Store · APK</td>
-</tr>
-</table>
-
-<br />
-
-## Cai Dat
-
-Truy cap [Tai Lieu](https://docs.termix.site/install) Termix de biet them thong tin ve cach cai dat Termix tren tat ca cac nen tang.
-
-Tep Docker Compose mau (ban co the bo qua `guacd` va mang neu khong co y dinh su dung cac tinh nang dieu khien may tinh tu xa):
-
-```yaml
-services:
-  termix:
-    image: ghcr.io/lukegus/termix:latest
-    container_name: termix
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    volumes:
-      - termix-data:/app/data
-    environment:
-      PORT: "8080"
-    depends_on:
-      - guacd
-    networks:
-      - termix-net
-
-  guacd:
-    image: guacamole/guacd:1.6.0
-    container_name: guacd
-    restart: unless-stopped
-    ports:
-      - "4822:4822"
-    networks:
-      - termix-net
-
-volumes:
-  termix-data:
-    driver: local
-
-networks:
-  termix-net:
-    driver: bridge
-```
-
-<br />
-
-## Quyên góp
-
-Termix là dự án miễn phí và mã nguồn mở, không có gói đăng ký hay trả phí. Nếu bạn thấy hữu ích, hãy cân nhắc quyên góp để giúp trang trải chi phí máy chủ, tên miền và thời gian phát triển. Các khoản quyên góp cũng giúp tài trợ thời gian nghiên cứu và tìm hiểu những gì cần thiết để xây dựng các tính năng như SAML, Kubernetes và hỗ trợ Agent. Theo dõi tiến độ và quyên góp bên dưới.
-
-[Quyên góp](https://donate.termix.site/)
-
-<br />
-
-## Nha Tai Tro
-
-Ban quan tam den viec dat quang cao tra phi de ho tro phat trien? Gui email toi [mail@termix.site](mailto:mail@termix.site).
-
-<div align="center">
-
-<br />
-
-<a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://tailscale.com/">
-  <img src="https://drive.google.com/uc?export=view&id=1lIxkJuX6M23bW-2FElhT0rQieTrzaVSL" height="40" alt="Tailscale" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
-</a>
-&nbsp;&nbsp;&nbsp;
-<a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
-</a>
-
-</div>
-
-<br />
-
-## Ho Tro
-
-Neu ban can tro giup hoac muon yeu cau tinh nang voi Termix, hay truy cap trang [Van De](https://github.com/Termix-SSH/Support/issues), dang nhap va nhan `New Issue`. Vui long mo ta van de cang chi tiet cang tot, uu tien viet bang tieng Anh. Ban cung co the tham gia may chu [Discord](https://discord.gg/jVQGdvHDrf) va truy cap kenh ho tro, tuy nhien thoi gian phan hoi co the lau hon.
-
-<br />
-
-## Anh Chup Man Hinh
-
-<div align="center">
-
-<br />
-
-[![YouTube](../repo-images/YouTube.png)](https://www.youtube.com/@TermixSSH/videos)
-
-<sub>Xem tong quan cap nhat tren YouTube</sub>
-
-<br />
-<br />
-
-<table>
-<tr>
-<td><img src="../repo-images/Image 1.png" alt="Termix Screenshot 1" width="400" /></td>
-<td><img src="../repo-images/Image 2.png" alt="Termix Screenshot 2" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 3.png" alt="Termix Screenshot 3" width="400" /></td>
-<td><img src="../repo-images/Image 4.png" alt="Termix Screenshot 4" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 5.png" alt="Termix Screenshot 5" width="400" /></td>
-<td><img src="../repo-images/Image 6.png" alt="Termix Screenshot 6" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 7.png" alt="Termix Screenshot 7" width="400" /></td>
-<td><img src="../repo-images/Image 8.png" alt="Termix Screenshot 8" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 9.png" alt="Termix Screenshot 9" width="400" /></td>
-<td><img src="../repo-images/Image 10.png" alt="Termix Screenshot 10" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 11.png" alt="Termix Screenshot 11" width="400" /></td>
-<td><img src="../repo-images/Image 12.png" alt="Termix Screenshot 12" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 13.png" alt="Termix Screenshot 13" width="400" /></td>
-<td><img src="../repo-images/Image 14.png" alt="Termix Screenshot 14" width="400" /></td>
-</tr>
-<tr>
-<td><img src="../repo-images/Image 15.png" alt="Termix Screenshot 15" width="400" /></td>
-<td><img src="../repo-images/Image 16.png" alt="Termix Screenshot 16" width="400" /></td>
-</tr>
-</table>
-
-<sub>Mot so video va hinh anh co the da loi thoi hoac khong the hien chinh xac hoan toan cac tinh nang.</sub>
-
-</div>
-
-<br />
-
-## Tinh Nang Du Kien
-
-Xem [Du An](https://github.com/orgs/Termix-SSH/projects/5) de biet tat ca cac tinh nang du kien. Neu ban muon dong gop, xem [Dong Gop](https://github.com/Termix-SSH/Termix/blob/main/CONTRIBUTING.md).
-
-<br />
-
-## Giay Phep
-
-Duoc phan phoi theo Giay Phep Apache Phien Ban 2.0. Xem `LICENSE` de biet them thong tin.

drizzle.config.mysql.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "mysql",
+  schema: "./src/backend/database/db/schema.mysql.ts",
+  out: "./drizzle/mysql",
+});

drizzle.config.pg.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "postgresql",
+  schema: "./src/backend/database/db/schema.pg.ts",
+  out: "./drizzle/postgres",
+});

drizzle.config.sqlite.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  dialect: "sqlite",
+  schema: "./src/backend/database/db/schema.ts",
+  out: "./drizzle/sqlite",
+});

drizzle/mysql/0000_clean_pretty_boy.sql

@@ -0,0 +1,890 @@
+CREATE TABLE `alert_firings` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`rule_id` int NOT NULL,
+	`host_id` int NOT NULL,
+	`host_name` text NOT NULL,
+	`fired_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`resolved_at` text,
+	`value` double,
+	`message` text NOT NULL,
+	`severity` text NOT NULL DEFAULT ('warning'),
+	`acknowledged` boolean NOT NULL DEFAULT false,
+	CONSTRAINT `alert_firings_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `alert_rule_channels` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`rule_id` int NOT NULL,
+	`channel_id` int NOT NULL,
+	CONSTRAINT `alert_rule_channels_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `alert_rules` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int,
+	`name` varchar(255) NOT NULL,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`trigger_type` text NOT NULL,
+	`threshold_value` double,
+	`threshold_duration_seconds` int,
+	`cooldown_minutes` int NOT NULL DEFAULT 15,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `alert_rules_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `api_keys` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`token_hash` text NOT NULL,
+	`token_prefix` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text,
+	`last_used_at` text,
+	`is_active` boolean NOT NULL DEFAULT true,
+	CONSTRAINT `api_keys_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `audit_logs` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255),
+	`username` text NOT NULL,
+	`action` text NOT NULL,
+	`resource_type` text NOT NULL,
+	`resource_id` text,
+	`resource_name` text,
+	`details` text,
+	`ip_address` text,
+	`user_agent` text,
+	`success` boolean NOT NULL,
+	`error_message` text,
+	`timestamp` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `audit_logs_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `c2s_tunnel_presets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`config` text NOT NULL,
+	`platform` text,
+	`computer_name` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `c2s_tunnel_presets_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `command_history` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`command` text NOT NULL,
+	`executed_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `command_history_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `dashboard_service_links` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`label` text NOT NULL,
+	`url` text NOT NULL,
+	`order` int NOT NULL DEFAULT 0,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `dashboard_service_links_id` PRIMARY KEY(`id`),
+	CONSTRAINT `dashboard_service_links_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `dismissed_alerts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`alert_id` text NOT NULL,
+	`dismissed_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `dismissed_alerts_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `file_manager_pinned` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`path` text NOT NULL,
+	`pinned_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `file_manager_pinned_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `file_manager_recent` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`path` text NOT NULL,
+	`last_opened` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `file_manager_recent_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `file_manager_shortcuts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`path` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `file_manager_shortcuts_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `homepage_items` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`type_id` text NOT NULL,
+	`title` text,
+	`config` text NOT NULL DEFAULT ('{}'),
+	`folder_id` int,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `homepage_items_id` PRIMARY KEY(`id`),
+	CONSTRAINT `homepage_items_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `homepage_layouts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`layout` text NOT NULL DEFAULT ('{}'),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `homepage_layouts_id` PRIMARY KEY(`id`),
+	CONSTRAINT `homepage_layouts_user_id_unique` UNIQUE(`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('connect'),
+	`expires_at` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`last_accessed_at` text,
+	`access_count` int NOT NULL DEFAULT 0,
+	CONSTRAINT `host_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_health_checks` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`checks` text NOT NULL,
+	`interval_seconds` int NOT NULL DEFAULT 300,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `host_health_checks_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_host_health_checks_user_host` UNIQUE(`user_id`,`host_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_health_history` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`check_id` text NOT NULL,
+	`ts` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`ok` boolean NOT NULL,
+	`latency_ms` int,
+	`detail` text,
+	CONSTRAINT `host_health_history_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_metrics_history` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`ts` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`cpu_percent` double,
+	`mem_percent` double,
+	`disk_percent` double,
+	`net_rx_bytes` int,
+	`net_tx_bytes` int,
+	CONSTRAINT `host_metrics_history_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `host_metrics_preferences` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`layout` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `host_metrics_preferences_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_host_metrics_prefs_user_host` UNIQUE(`user_id`,`host_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ssh_data` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`connection_type` text NOT NULL DEFAULT ('ssh'),
+	`name` varchar(255),
+	`ip` text NOT NULL,
+	`port` int NOT NULL,
+	`username` text NOT NULL,
+	`folder` text,
+	`tags` text,
+	`pin` boolean NOT NULL DEFAULT false,
+	`auth_type` text NOT NULL,
+	`use_warpgate` boolean NOT NULL DEFAULT false,
+	`share_ssh_auth` boolean NOT NULL DEFAULT false,
+	`force_keyboard_interactive` text,
+	`password` text,
+	`key` text,
+	`key_password` text,
+	`key_type` text,
+	`sudo_password` text,
+	`autostart_password` text,
+	`autostart_key` text,
+	`autostart_key_password` text,
+	`credential_id` int,
+	`override_credential_username` boolean,
+	`vault_profile_id` int,
+	`enable_terminal` boolean NOT NULL DEFAULT true,
+	`enable_session_logging` boolean NOT NULL DEFAULT true,
+	`allow_session_sharing` boolean NOT NULL DEFAULT true,
+	`enable_command_history` boolean NOT NULL DEFAULT true,
+	`enable_tunnel` boolean NOT NULL DEFAULT true,
+	`tunnel_connections` text,
+	`jump_hosts` text,
+	`enable_file_manager` boolean NOT NULL DEFAULT true,
+	`scp_legacy` boolean NOT NULL DEFAULT false,
+	`enable_docker` boolean NOT NULL DEFAULT false,
+	`enable_tmux_monitor` boolean NOT NULL DEFAULT false,
+	`show_terminal_in_sidebar` boolean NOT NULL DEFAULT true,
+	`show_file_manager_in_sidebar` boolean NOT NULL DEFAULT false,
+	`show_tunnel_in_sidebar` boolean NOT NULL DEFAULT false,
+	`show_docker_in_sidebar` boolean NOT NULL DEFAULT false,
+	`show_server_stats_in_sidebar` boolean NOT NULL DEFAULT false,
+	`default_path` text,
+	`stats_config` text,
+	`docker_config` text,
+	`enable_proxmox` boolean NOT NULL DEFAULT false,
+	`proxmox_config` text,
+	`terminal_config` text,
+	`quick_actions` text,
+	`notes` text,
+	`enable_ssh` boolean NOT NULL DEFAULT true,
+	`enable_rdp` boolean NOT NULL DEFAULT false,
+	`enable_vnc` boolean NOT NULL DEFAULT false,
+	`enable_telnet` boolean NOT NULL DEFAULT false,
+	`ssh_port` int DEFAULT 22,
+	`rdp_port` int DEFAULT 3389,
+	`vnc_port` int DEFAULT 5900,
+	`telnet_port` int DEFAULT 23,
+	`rdp_credential_id` int,
+	`rdp_user` text,
+	`rdp_password` text,
+	`rdp_domain` text,
+	`rdp_security` text,
+	`rdp_ignore_cert` boolean DEFAULT false,
+	`vnc_credential_id` int,
+	`vnc_password` text,
+	`vnc_user` text,
+	`telnet_user` text,
+	`telnet_password` text,
+	`telnet_credential_id` int,
+	`rdp_auth_type` text,
+	`vnc_auth_type` text,
+	`telnet_auth_type` text,
+	`domain` text,
+	`security` text,
+	`ignore_cert` boolean DEFAULT false,
+	`guacamole_config` text,
+	`use_socks5` boolean,
+	`socks5_host` text,
+	`socks5_port` int,
+	`socks5_username` text,
+	`socks5_password` text,
+	`socks5_proxy_chain` text,
+	`connection_origin` text,
+	`mac_address` text,
+	`wol_broadcast_address` text,
+	`port_knock_sequence` text,
+	`host_key_fingerprint` text,
+	`host_key_type` text,
+	`host_key_algorithm` text DEFAULT ('sha256'),
+	`host_key_first_seen` text,
+	`host_key_last_verified` text,
+	`host_key_changed_count` int DEFAULT 0,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ssh_data_id` PRIMARY KEY(`id`),
+	CONSTRAINT `ssh_data_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `network_topology` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`topology` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `network_topology_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `notification_channels` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`type` text NOT NULL,
+	`config` text NOT NULL,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `notification_channels_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `opkssh_tokens` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`ssh_cert` text NOT NULL,
+	`private_key` text NOT NULL,
+	`email` text,
+	`sub` text,
+	`issuer` text,
+	`audience` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`last_used` text,
+	CONSTRAINT `opkssh_tokens_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_opkssh_tokens_user_host` UNIQUE(`user_id`,`host_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `recent_activity` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`type` text NOT NULL,
+	`host_id` int NOT NULL,
+	`host_name` text,
+	`timestamp` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `recent_activity_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `roles` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`display_name` text NOT NULL,
+	`description` text,
+	`is_system` boolean NOT NULL DEFAULT false,
+	`permissions` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `roles_id` PRIMARY KEY(`id`),
+	CONSTRAINT `roles_name_unique` UNIQUE(`name`)
+);
+--> statement-breakpoint
+CREATE TABLE `session_recordings` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255),
+	`username` text,
+	`access_id` int,
+	`started_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`ended_at` text,
+	`duration` int,
+	`commands` text,
+	`dangerous_actions` text,
+	`recording_path` text,
+	`protocol` varchar(255) NOT NULL DEFAULT 'ssh',
+	`format` text NOT NULL DEFAULT ('text'),
+	`terminated_by_owner` boolean DEFAULT false,
+	`termination_reason` text,
+	CONSTRAINT `session_recordings_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `session_share_participants` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`share_id` varchar(255) NOT NULL,
+	`user_id` varchar(255),
+	`guest_label` text,
+	`joined_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`left_at` text,
+	CONSTRAINT `session_share_participants_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `session_shares` (
+	`id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`protocol` varchar(255) NOT NULL,
+	`session_id` text NOT NULL,
+	`tab_instance_id` text,
+	`share_type` text NOT NULL,
+	`target_user_id` varchar(255),
+	`link_token` varchar(255),
+	`permission_level` text NOT NULL DEFAULT ('read-only'),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`revoked_at` text,
+	`last_joined_at` text,
+	`join_count` int NOT NULL DEFAULT 0,
+	CONSTRAINT `session_shares_id` PRIMARY KEY(`id`),
+	CONSTRAINT `session_shares_link_token_unique` UNIQUE(`link_token`)
+);
+--> statement-breakpoint
+CREATE TABLE `sessions` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`jwt_token` text NOT NULL,
+	`device_type` text NOT NULL,
+	`device_info` text NOT NULL,
+	`oidc_sub` text,
+	`oidc_sid` text,
+	`sso_provider_id` int,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`last_active_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `sessions_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `settings` (
+	`key` varchar(255) NOT NULL,
+	`value` text NOT NULL,
+	CONSTRAINT `settings_key` PRIMARY KEY(`key`)
+);
+--> statement-breakpoint
+CREATE TABLE `shared_host_auth_overrides` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`protocol` varchar(255) NOT NULL DEFAULT 'ssh',
+	`credential_id` int NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `shared_host_auth_overrides_id` PRIMARY KEY(`id`),
+	CONSTRAINT `shared_host_auth_overrides_host_user_protocol_unique` UNIQUE(`host_id`,`user_id`,`protocol`)
+);
+--> statement-breakpoint
+CREATE TABLE `shared_host_secrets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_access_id` int NOT NULL,
+	`target_user_id` varchar(255) NOT NULL,
+	`protocol` varchar(255) NOT NULL DEFAULT 'ssh',
+	`source_type` text NOT NULL DEFAULT ('credential'),
+	`original_credential_id` int,
+	`encrypted_username` text,
+	`encrypted_auth_type` text,
+	`encrypted_password` text,
+	`encrypted_key` text,
+	`encrypted_key_password` text,
+	`encrypted_key_type` text,
+	`encrypted_domain` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `shared_host_secrets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_shared_host_secrets_scope` UNIQUE(`host_access_id`,`target_user_id`,`protocol`)
+);
+--> statement-breakpoint
+CREATE TABLE `snippet_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`snippet_id` int NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('view'),
+	`expires_at` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `snippet_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `snippet_folders` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`color` text,
+	`icon` text,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `snippet_folders_id` PRIMARY KEY(`id`),
+	CONSTRAINT `snippet_folders_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `snippets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`content` text NOT NULL,
+	`description` text,
+	`folder` text,
+	`order` int NOT NULL DEFAULT 0,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`host_filter` text,
+	CONSTRAINT `snippets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `snippets_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ssh_credential_usage` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_id` int NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`used_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ssh_credential_usage_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ssh_credentials` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`folder` text,
+	`tags` text,
+	`auth_type` text NOT NULL,
+	`username` text,
+	`password` text,
+	`key` text,
+	`private_key` text,
+	`public_key` text,
+	`key_password` text,
+	`key_type` text,
+	`detected_key_type` text,
+	`cert_public_key` text,
+	`usage_count` int NOT NULL DEFAULT 0,
+	`last_used` text,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ssh_credentials_id` PRIMARY KEY(`id`),
+	CONSTRAINT `ssh_credentials_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ssh_folders` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`color` text,
+	`icon` text,
+	`credential_id` int,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ssh_folders_id` PRIMARY KEY(`id`),
+	CONSTRAINT `ssh_folders_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `sso_providers` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`type` text NOT NULL,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`display_order` int NOT NULL DEFAULT 0,
+	`config` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `sso_providers_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `sync_tombstones` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`entity_type` text NOT NULL,
+	`sync_id` varchar(255) NOT NULL,
+	`deleted_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `sync_tombstones_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `termix_identities` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`handle` varchar(255) NOT NULL,
+	`description` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `termix_identities_id` PRIMARY KEY(`id`),
+	CONSTRAINT `termix_identities_user_id_unique` UNIQUE(`user_id`),
+	CONSTRAINT `termix_identities_handle_unique` UNIQUE(`handle`)
+);
+--> statement-breakpoint
+CREATE TABLE `termix_identity_ca` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`identity_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`public_key` text NOT NULL,
+	`private_key` text NOT NULL,
+	`validity_days` int NOT NULL DEFAULT 90,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `termix_identity_ca_id` PRIMARY KEY(`id`),
+	CONSTRAINT `termix_identity_ca_identity_id_unique` UNIQUE(`identity_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `termix_identity_keys` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`identity_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`public_key` text NOT NULL,
+	`key_type` text NOT NULL,
+	`algorithm` text NOT NULL,
+	`label` text,
+	`comment` text,
+	`source` text NOT NULL DEFAULT ('manual'),
+	`credential_id` int,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `termix_identity_keys_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `tmux_session_tags` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`session_name` text NOT NULL,
+	`tag` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `tmux_session_tags_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `transfer_recent` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`source_host_id` int NOT NULL,
+	`dest_host_id` int NOT NULL,
+	`dest_path` text NOT NULL,
+	`dest_path_label` text NOT NULL,
+	`last_used` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `transfer_recent_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `trusted_devices` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`device_fingerprint` text NOT NULL,
+	`device_type` text NOT NULL,
+	`device_info` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`last_used_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `trusted_devices_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `user_open_tabs` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`tab_type` text NOT NULL,
+	`host_id` int,
+	`label` text NOT NULL,
+	`tab_order` int NOT NULL DEFAULT 0,
+	`backend_session_id` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_open_tabs_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `user_preferences` (
+	`user_id` varchar(255) NOT NULL,
+	`reopen_tabs_on_login` boolean NOT NULL DEFAULT false,
+	`theme` text,
+	`font_size` text,
+	`accent_color` text,
+	`language` text,
+	`storage_mode` text,
+	`command_autocomplete` boolean,
+	`command_palette_enabled` boolean,
+	`show_host_tags` boolean,
+	`host_tray_on_click` boolean,
+	`pin_app_rail` boolean,
+	`expand_app_rail_on_hover` boolean,
+	`folders_collapsed` boolean,
+	`confirm_snippet_execution` boolean,
+	`disable_update_check` boolean,
+	`confirm_tab_close` boolean,
+	`hidden_rail_tabs` text,
+	`compact_host_view` boolean,
+	`status_color_scheme` text,
+	`custom_themes` text,
+	`custom_keybindings` text,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_preferences_user_id` PRIMARY KEY(`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `user_roles` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`role_id` int NOT NULL,
+	`granted_by` varchar(255),
+	`granted_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_roles_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_user_roles_user_role` UNIQUE(`user_id`,`role_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `users` (
+	`id` varchar(255) NOT NULL,
+	`username` text NOT NULL,
+	`password_hash` text NOT NULL,
+	`is_admin` boolean NOT NULL DEFAULT false,
+	`is_oidc` boolean NOT NULL DEFAULT false,
+	`oidc_identifier` text,
+	`sso_provider_id` int,
+	`client_id` text,
+	`client_secret` text,
+	`issuer_url` text,
+	`authorization_url` text,
+	`token_url` text,
+	`identifier_path` text,
+	`name_path` text,
+	`scopes` text DEFAULT ('openid email profile'),
+	`totp_secret` text,
+	`totp_enabled` boolean NOT NULL DEFAULT false,
+	`totp_backup_codes` text,
+	`registered_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`donation_modal_dismissed` boolean NOT NULL DEFAULT false,
+	CONSTRAINT `users_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `vault_profiles` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`folder` text,
+	`tags` text,
+	`vault_addr` text NOT NULL,
+	`vault_namespace` text,
+	`oidc_mount` text,
+	`oidc_role` text,
+	`ssh_mount` text,
+	`ssh_role` text NOT NULL,
+	`valid_principals` text,
+	`key_type` text,
+	`shared` boolean NOT NULL DEFAULT false,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `vault_profiles_id` PRIMARY KEY(`id`),
+	CONSTRAINT `vault_profiles_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `vault_tokens` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`profile_id` int NOT NULL,
+	`ssh_cert` text NOT NULL,
+	`private_key` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`expires_at` text NOT NULL,
+	`last_used` text,
+	CONSTRAINT `vault_tokens_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_vault_tokens_user_profile` UNIQUE(`user_id`,`profile_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `webauthn_credentials` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`credential_id` text NOT NULL,
+	`public_key` text NOT NULL,
+	`counter` int NOT NULL DEFAULT 0,
+	`device_type` text,
+	`backed_up` boolean NOT NULL DEFAULT false,
+	`transports` text,
+	`user_verification` text NOT NULL DEFAULT ('preferred'),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`last_used_at` text,
+	CONSTRAINT `webauthn_credentials_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `alert_firings` ADD CONSTRAINT `alert_firings_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_firings` ADD CONSTRAINT `alert_firings_rule_id_alert_rules_id_fk` FOREIGN KEY (`rule_id`) REFERENCES `alert_rules`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_rule_channels` ADD CONSTRAINT `alert_rule_channels_rule_id_alert_rules_id_fk` FOREIGN KEY (`rule_id`) REFERENCES `alert_rules`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_rule_channels` ADD CONSTRAINT `alert_rule_channels_channel_id_notification_channels_id_fk` FOREIGN KEY (`channel_id`) REFERENCES `notification_channels`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_rules` ADD CONSTRAINT `alert_rules_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `alert_rules` ADD CONSTRAINT `alert_rules_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `api_keys` ADD CONSTRAINT `api_keys_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `audit_logs` ADD CONSTRAINT `audit_logs_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `c2s_tunnel_presets` ADD CONSTRAINT `c2s_tunnel_presets_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `command_history` ADD CONSTRAINT `command_history_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `command_history` ADD CONSTRAINT `command_history_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `dashboard_service_links` ADD CONSTRAINT `dashboard_service_links_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `dismissed_alerts` ADD CONSTRAINT `dismissed_alerts_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_pinned` ADD CONSTRAINT `file_manager_pinned_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_pinned` ADD CONSTRAINT `file_manager_pinned_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_recent` ADD CONSTRAINT `file_manager_recent_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_recent` ADD CONSTRAINT `file_manager_recent_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_shortcuts` ADD CONSTRAINT `file_manager_shortcuts_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `file_manager_shortcuts` ADD CONSTRAINT `file_manager_shortcuts_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `homepage_items` ADD CONSTRAINT `homepage_items_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `homepage_layouts` ADD CONSTRAINT `homepage_layouts_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_access` ADD CONSTRAINT `host_access_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_access` ADD CONSTRAINT `host_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_access` ADD CONSTRAINT `host_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_access` ADD CONSTRAINT `host_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_health_checks` ADD CONSTRAINT `host_health_checks_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_health_checks` ADD CONSTRAINT `host_health_checks_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_health_history` ADD CONSTRAINT `host_health_history_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_health_history` ADD CONSTRAINT `host_health_history_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_metrics_history` ADD CONSTRAINT `host_metrics_history_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_metrics_preferences` ADD CONSTRAINT `host_metrics_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_metrics_preferences` ADD CONSTRAINT `host_metrics_preferences_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_vault_profile_id_vault_profiles_id_fk` FOREIGN KEY (`vault_profile_id`) REFERENCES `vault_profiles`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_rdp_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`rdp_credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_vnc_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`vnc_credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_telnet_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`telnet_credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `network_topology` ADD CONSTRAINT `network_topology_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `notification_channels` ADD CONSTRAINT `notification_channels_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `opkssh_tokens` ADD CONSTRAINT `opkssh_tokens_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `opkssh_tokens` ADD CONSTRAINT `opkssh_tokens_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `recent_activity` ADD CONSTRAINT `recent_activity_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `recent_activity` ADD CONSTRAINT `recent_activity_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_recordings` ADD CONSTRAINT `session_recordings_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_recordings` ADD CONSTRAINT `session_recordings_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_recordings` ADD CONSTRAINT `session_recordings_access_id_host_access_id_fk` FOREIGN KEY (`access_id`) REFERENCES `host_access`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_share_participants` ADD CONSTRAINT `session_share_participants_share_id_session_shares_id_fk` FOREIGN KEY (`share_id`) REFERENCES `session_shares`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_share_participants` ADD CONSTRAINT `session_share_participants_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_shares` ADD CONSTRAINT `session_shares_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_shares` ADD CONSTRAINT `session_shares_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `session_shares` ADD CONSTRAINT `session_shares_target_user_id_users_id_fk` FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `sessions` ADD CONSTRAINT `sessions_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` ADD CONSTRAINT `shared_host_auth_overrides_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` ADD CONSTRAINT `shared_host_auth_overrides_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` ADD CONSTRAINT `shared_host_auth_overrides_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` ADD CONSTRAINT `shared_host_secrets_host_access_id_host_access_id_fk` FOREIGN KEY (`host_access_id`) REFERENCES `host_access`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` ADD CONSTRAINT `shared_host_secrets_target_user_id_users_id_fk` FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` ADD CONSTRAINT `shared_host_secrets_original_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`original_credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_access` ADD CONSTRAINT `snippet_access_snippet_id_snippets_id_fk` FOREIGN KEY (`snippet_id`) REFERENCES `snippets`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_access` ADD CONSTRAINT `snippet_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_access` ADD CONSTRAINT `snippet_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_access` ADD CONSTRAINT `snippet_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippet_folders` ADD CONSTRAINT `snippet_folders_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `snippets` ADD CONSTRAINT `snippets_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_credential_usage` ADD CONSTRAINT `ssh_credential_usage_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_credential_usage` ADD CONSTRAINT `ssh_credential_usage_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_credential_usage` ADD CONSTRAINT `ssh_credential_usage_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_credentials` ADD CONSTRAINT `ssh_credentials_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_folders` ADD CONSTRAINT `ssh_folders_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ssh_folders` ADD CONSTRAINT `ssh_folders_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `sync_tombstones` ADD CONSTRAINT `sync_tombstones_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identities` ADD CONSTRAINT `termix_identities_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_ca` ADD CONSTRAINT `termix_identity_ca_identity_id_termix_identities_id_fk` FOREIGN KEY (`identity_id`) REFERENCES `termix_identities`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_ca` ADD CONSTRAINT `termix_identity_ca_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` ADD CONSTRAINT `termix_identity_keys_identity_id_termix_identities_id_fk` FOREIGN KEY (`identity_id`) REFERENCES `termix_identities`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` ADD CONSTRAINT `termix_identity_keys_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` ADD CONSTRAINT `termix_identity_keys_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `tmux_session_tags` ADD CONSTRAINT `tmux_session_tags_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `tmux_session_tags` ADD CONSTRAINT `tmux_session_tags_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `transfer_recent` ADD CONSTRAINT `transfer_recent_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `transfer_recent` ADD CONSTRAINT `transfer_recent_source_host_id_ssh_data_id_fk` FOREIGN KEY (`source_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `transfer_recent` ADD CONSTRAINT `transfer_recent_dest_host_id_ssh_data_id_fk` FOREIGN KEY (`dest_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `trusted_devices` ADD CONSTRAINT `trusted_devices_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_open_tabs` ADD CONSTRAINT `user_open_tabs_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_open_tabs` ADD CONSTRAINT `user_open_tabs_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD CONSTRAINT `user_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_roles` ADD CONSTRAINT `user_roles_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_roles` ADD CONSTRAINT `user_roles_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_roles` ADD CONSTRAINT `user_roles_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `vault_profiles` ADD CONSTRAINT `vault_profiles_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `vault_tokens` ADD CONSTRAINT `vault_tokens_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `vault_tokens` ADD CONSTRAINT `vault_tokens_profile_id_vault_profiles_id_fk` FOREIGN KEY (`profile_id`) REFERENCES `vault_profiles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `webauthn_credentials` ADD CONSTRAINT `webauthn_credentials_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0001_puzzling_aqueduct.sql

@@ -0,0 +1,10 @@
+CREATE TABLE `host_sidebar_preferences` (
+	`user_id` varchar(255) NOT NULL,
+	`data` text NOT NULL,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `host_sidebar_preferences_user_id` PRIMARY KEY(`user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `sort_order` int;--> statement-breakpoint
+ALTER TABLE `ssh_folders` ADD `sort_order` int;--> statement-breakpoint
+ALTER TABLE `host_sidebar_preferences` ADD CONSTRAINT `host_sidebar_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0002_bumpy_korg.sql

@@ -0,0 +1,10 @@
+CREATE TABLE `credential_sidebar_preferences` (
+	`user_id` varchar(255) NOT NULL,
+	`data` text NOT NULL,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `credential_sidebar_preferences_user_id` PRIMARY KEY(`user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_credentials` ADD `pin` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_credentials` ADD `sort_order` int;--> statement-breakpoint
+ALTER TABLE `credential_sidebar_preferences` ADD CONSTRAINT `credential_sidebar_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0003_dry_human_robot.sql

@@ -0,0 +1 @@
+ALTER TABLE `snippets` ADD `is_note` boolean DEFAULT false NOT NULL;

drizzle/mysql/0004_fancy_spencer_smythe.sql

@@ -0,0 +1,28 @@
+CREATE TABLE `proxmox_node_history` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`ts` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`cpu_percent` double,
+	`mem_percent` double,
+	`disk_percent` double,
+	`net_rx_bytes` int,
+	`net_tx_bytes` int,
+	CONSTRAINT `proxmox_node_history_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `proxmox_stats_preferences` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`host_id` int NOT NULL,
+	`layout` text NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `proxmox_stats_preferences_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_proxmox_stats_prefs_user_host` UNIQUE(`user_id`,`host_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `enable_proxmox_stats` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `proxmox_stats_config` text;--> statement-breakpoint
+ALTER TABLE `proxmox_node_history` ADD CONSTRAINT `proxmox_node_history_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `proxmox_stats_preferences` ADD CONSTRAINT `proxmox_stats_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `proxmox_stats_preferences` ADD CONSTRAINT `proxmox_stats_preferences_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0005_tearful_mindworm.sql

@@ -0,0 +1 @@
+ALTER TABLE `ssh_data` ADD `enable_terminal_toolbar` boolean DEFAULT true NOT NULL;

drizzle/mysql/0006_last_fantastic_four.sql

@@ -0,0 +1,45 @@
+CREATE TABLE `fleet_inventory` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`os_pretty_name` text,
+	`kernel` text,
+	`architecture` text,
+	`hostname` text,
+	`uptime_seconds` int,
+	`ip` text,
+	`package_manager` text,
+	`collected_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `fleet_inventory_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_fleet_inventory_host` UNIQUE(`host_id`,`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `fleet_members` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`fleet_id` int NOT NULL,
+	`host_id` int NOT NULL,
+	`added_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `fleet_members_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_fleet_members_fleet_host` UNIQUE(`fleet_id`,`host_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `fleets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`color` text,
+	`icon` text,
+	`tag_rules` text,
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `fleets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `fleets_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `fleet_inventory` ADD CONSTRAINT `fleet_inventory_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `fleet_inventory` ADD CONSTRAINT `fleet_inventory_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `fleet_members` ADD CONSTRAINT `fleet_members_fleet_id_fleets_id_fk` FOREIGN KEY (`fleet_id`) REFERENCES `fleets`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `fleet_members` ADD CONSTRAINT `fleet_members_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `fleets` ADD CONSTRAINT `fleets_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0007_aspiring_turbo.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `parent_host_id` int;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD CONSTRAINT `ssh_data_parent_host_id_ssh_data_id_fk` FOREIGN KEY (`parent_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE set null ON UPDATE no action;

drizzle/mysql/0008_lame_nighthawk.sql

@@ -0,0 +1,18 @@
+CREATE TABLE `user_workspaces` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`color` text,
+	`icon` text,
+	`kind` text NOT NULL DEFAULT ('manual'),
+	`is_default` boolean NOT NULL DEFAULT false,
+	`payload` text NOT NULL DEFAULT ('{}'),
+	`sync_id` varchar(255),
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`last_used_at` text,
+	CONSTRAINT `user_workspaces_id` PRIMARY KEY(`id`),
+	CONSTRAINT `user_workspaces_sync_id_unique` UNIQUE(`sync_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `user_workspaces` ADD CONSTRAINT `user_workspaces_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0009_tan_skaar.sql

@@ -0,0 +1,26 @@
+ALTER TABLE `api_keys` MODIFY COLUMN `expires_at` varchar(255);--> statement-breakpoint
+ALTER TABLE `audit_logs` MODIFY COLUMN `action` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `audit_logs` MODIFY COLUMN `resource_type` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `audit_logs` MODIFY COLUMN `timestamp` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_access` MODIFY COLUMN `expires_at` varchar(255);--> statement-breakpoint
+ALTER TABLE `opkssh_tokens` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `recent_activity` MODIFY COLUMN `timestamp` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `session_shares` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `sessions` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `snippet_access` MODIFY COLUMN `expires_at` varchar(255);--> statement-breakpoint
+ALTER TABLE `trusted_devices` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `vault_tokens` MODIFY COLUMN `expires_at` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `webauthn_credentials` MODIFY COLUMN `credential_id` varchar(255) NOT NULL;--> statement-breakpoint
+CREATE INDEX `idx_audit_logs_timestamp` ON `audit_logs` (`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_audit_logs_user_ts` ON `audit_logs` (`user_id`,`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_audit_logs_action_ts` ON `audit_logs` (`action`,`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_audit_logs_resource_ts` ON `audit_logs` (`resource_type`,`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_host_access_user_id` ON `host_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_host_access_role_id` ON `host_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_host_access_host_id` ON `host_access` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_host_access_expires_at` ON `host_access` (`expires_at`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_data_user_id` ON `ssh_data` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_data_parent_host` ON `ssh_data` (`parent_host_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_data_credential` ON `ssh_data` (`credential_id`);--> statement-breakpoint
+CREATE INDEX `idx_sessions_user_id` ON `sessions` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_sessions_expires_at` ON `sessions` (`expires_at`);

drizzle/mysql/0010_small_infant_terrible.sql

@@ -0,0 +1,8 @@
+CREATE TABLE `ui_preferences` (
+	`user_id` varchar(255) NOT NULL,
+	`data` text NOT NULL,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ui_preferences_user_id` PRIMARY KEY(`user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ui_preferences` ADD CONSTRAINT `ui_preferences_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0011_easy_the_order.sql

@@ -0,0 +1,32 @@
+ALTER TABLE `alert_firings` MODIFY COLUMN `fired_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `session_recordings` MODIFY COLUMN `started_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `session_shares` MODIFY COLUMN `session_id` varchar(255) NOT NULL;--> statement-breakpoint
+CREATE INDEX `idx_alert_firings_rule` ON `alert_firings` (`rule_id`,`fired_at`);--> statement-breakpoint
+CREATE INDEX `idx_alert_firings_host` ON `alert_firings` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_api_keys_user_id` ON `api_keys` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_command_history_user_host` ON `command_history` (`user_id`,`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_dismissed_alerts_user_id` ON `dismissed_alerts` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_file_manager_pinned_user` ON `file_manager_pinned` (`user_id`,`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_file_manager_recent_user` ON `file_manager_recent` (`user_id`,`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_file_manager_shortcuts_user` ON `file_manager_shortcuts` (`user_id`,`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_fleet_inventory_user` ON `fleet_inventory` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_fleet_members_host` ON `fleet_members` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_homepage_items_user_id` ON `homepage_items` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_recent_activity_user_ts` ON `recent_activity` (`user_id`,`timestamp`);--> statement-breakpoint
+CREATE INDEX `idx_session_recordings_user_started` ON `session_recordings` (`user_id`,`started_at`);--> statement-breakpoint
+CREATE INDEX `idx_session_recordings_host` ON `session_recordings` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_session_shares_session_id` ON `session_shares` (`session_id`);--> statement-breakpoint
+CREATE INDEX `idx_session_shares_host_id` ON `session_shares` (`host_id`);--> statement-breakpoint
+CREATE INDEX `idx_snippet_access_user_id` ON `snippet_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_snippet_access_snippet_id` ON `snippet_access` (`snippet_id`);--> statement-breakpoint
+CREATE INDEX `idx_snippet_access_role_id` ON `snippet_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_snippets_user_id` ON `snippets` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_credential_usage_credential` ON `ssh_credential_usage` (`credential_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_credential_usage_user` ON `ssh_credential_usage` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_credentials_user_id` ON `ssh_credentials` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_ssh_folders_user_id` ON `ssh_folders` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_transfer_recent_user` ON `transfer_recent` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_trusted_devices_user_id` ON `trusted_devices` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_user_open_tabs_user_id` ON `user_open_tabs` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_user_roles_role_id` ON `user_roles` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_user_workspaces_user_id` ON `user_workspaces` (`user_id`);

drizzle/mysql/0012_outgoing_ultron.sql

@@ -0,0 +1,224 @@
+CREATE TABLE `ai_conversations` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`title` text,
+	`provider_id` int,
+	`model` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ai_conversations_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ai_messages` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`conversation_id` int NOT NULL,
+	`role` text NOT NULL,
+	`content` text NOT NULL DEFAULT (''),
+	`tool_calls` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ai_messages_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ai_proposals` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`conversation_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`kind` text NOT NULL,
+	`summary` text,
+	`payload` text NOT NULL DEFAULT ('{}'),
+	`status` varchar(255) NOT NULL DEFAULT 'pending',
+	`applied_at` text,
+	`result_summary` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ai_proposals_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `ai_providers` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`provider_type` text NOT NULL,
+	`label` varchar(255) NOT NULL,
+	`base_url` text,
+	`api_key` text,
+	`api_key_prefix` text,
+	`default_model` text,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `ai_providers_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_ai_providers_user_label` UNIQUE(`user_id`,`label`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_channels` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`automation_id` int NOT NULL,
+	`channel_id` int NOT NULL,
+	CONSTRAINT `automation_channels_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_automation_channels_pair` UNIQUE(`automation_id`,`channel_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_run_steps` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`run_id` int NOT NULL,
+	`step_index` int NOT NULL,
+	`step_id` text NOT NULL,
+	`step_type` text NOT NULL,
+	`status` varchar(255) NOT NULL,
+	`started_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`finished_at` text,
+	`output` text,
+	`error` text,
+	`truncated` boolean NOT NULL DEFAULT false,
+	CONSTRAINT `automation_run_steps_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_runs` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`automation_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`trigger_type` text NOT NULL,
+	`trigger_context` text,
+	`status` varchar(255) NOT NULL,
+	`started_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`finished_at` text,
+	`duration_ms` int,
+	`error` text,
+	`dry_run` boolean NOT NULL DEFAULT false,
+	`parent_run_id` int,
+	CONSTRAINT `automation_runs_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_schedules` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`automation_id` int NOT NULL,
+	`cron` text,
+	`interval_seconds` int,
+	`timezone` text,
+	`next_due_at` varchar(255),
+	`last_tick_at` text,
+	CONSTRAINT `automation_schedules_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_automation_schedules_automation` UNIQUE(`automation_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `automation_trigger_state` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`automation_id` int NOT NULL,
+	`state_key` varchar(255) NOT NULL,
+	`breach_started_at` text,
+	`last_fired_at` text,
+	`last_value` double,
+	`last_observed_state` text,
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `automation_trigger_state_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_automation_trigger_state_key` UNIQUE(`automation_id`,`state_key`)
+);
+--> statement-breakpoint
+CREATE TABLE `automations` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`description` text,
+	`enabled` boolean NOT NULL DEFAULT true,
+	`definition` text NOT NULL,
+	`definition_version` int NOT NULL DEFAULT 1,
+	`concurrency_policy` text NOT NULL DEFAULT ('skip'),
+	`max_run_seconds` int NOT NULL DEFAULT 300,
+	`dry_run` boolean NOT NULL DEFAULT false,
+	`last_run_at` text,
+	`last_run_status` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `automations_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `alert_rules` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `alert_rules` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `api_keys` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `c2s_tunnel_presets` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `c2s_tunnel_presets` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `credential_sidebar_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `dashboard_service_links` MODIFY COLUMN `label` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `dashboard_service_links` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `dashboard_service_links` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `file_manager_shortcuts` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `fleets` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `fleets` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `homepage_items` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `homepage_items` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `homepage_layouts` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_access` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_health_checks` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_health_checks` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_metrics_preferences` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_metrics_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_sidebar_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `network_topology` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `network_topology` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `notification_channels` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `opkssh_tokens` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `proxmox_stats_preferences` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `proxmox_stats_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `roles` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `roles` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `session_shares` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `sessions` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippet_access` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippet_folders` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippet_folders` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippets` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `snippets` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_folders` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_folders` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `sso_providers` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `sso_providers` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identities` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identities` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identity_ca` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identity_ca` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` MODIFY COLUMN `label` varchar(255);--> statement-breakpoint
+ALTER TABLE `termix_identity_keys` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `tmux_session_tags` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `trusted_devices` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ui_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `label` varchar(255) NOT NULL;--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_preferences` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_workspaces` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_workspaces` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `vault_profiles` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `vault_profiles` MODIFY COLUMN `updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `vault_tokens` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `webauthn_credentials` MODIFY COLUMN `created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD `ai_assistant_enabled` boolean;--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD `ai_read_only_commands` boolean;--> statement-breakpoint
+ALTER TABLE `ai_conversations` ADD CONSTRAINT `ai_conversations_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ai_messages` ADD CONSTRAINT `ai_messages_conversation_id_ai_conversations_id_fk` FOREIGN KEY (`conversation_id`) REFERENCES `ai_conversations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ai_proposals` ADD CONSTRAINT `ai_proposals_conversation_id_ai_conversations_id_fk` FOREIGN KEY (`conversation_id`) REFERENCES `ai_conversations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ai_proposals` ADD CONSTRAINT `ai_proposals_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `ai_providers` ADD CONSTRAINT `ai_providers_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_channels` ADD CONSTRAINT `automation_channels_automation_id_automations_id_fk` FOREIGN KEY (`automation_id`) REFERENCES `automations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_channels` ADD CONSTRAINT `automation_channels_channel_id_notification_channels_id_fk` FOREIGN KEY (`channel_id`) REFERENCES `notification_channels`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_run_steps` ADD CONSTRAINT `automation_run_steps_run_id_automation_runs_id_fk` FOREIGN KEY (`run_id`) REFERENCES `automation_runs`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_runs` ADD CONSTRAINT `automation_runs_automation_id_automations_id_fk` FOREIGN KEY (`automation_id`) REFERENCES `automations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_runs` ADD CONSTRAINT `automation_runs_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_schedules` ADD CONSTRAINT `automation_schedules_automation_id_automations_id_fk` FOREIGN KEY (`automation_id`) REFERENCES `automations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automation_trigger_state` ADD CONSTRAINT `automation_trigger_state_automation_id_automations_id_fk` FOREIGN KEY (`automation_id`) REFERENCES `automations`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `automations` ADD CONSTRAINT `automations_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_ai_conversations_user` ON `ai_conversations` (`user_id`,`updated_at`);--> statement-breakpoint
+CREATE INDEX `idx_ai_messages_conversation` ON `ai_messages` (`conversation_id`,`created_at`);--> statement-breakpoint
+CREATE INDEX `idx_ai_proposals_user` ON `ai_proposals` (`user_id`,`status`);--> statement-breakpoint
+CREATE INDEX `idx_ai_proposals_conversation` ON `ai_proposals` (`conversation_id`);--> statement-breakpoint
+CREATE INDEX `idx_automation_run_steps_run` ON `automation_run_steps` (`run_id`,`step_index`);--> statement-breakpoint
+CREATE INDEX `idx_automation_runs_automation` ON `automation_runs` (`automation_id`,`started_at`);--> statement-breakpoint
+CREATE INDEX `idx_automation_runs_user` ON `automation_runs` (`user_id`,`started_at`);--> statement-breakpoint
+CREATE INDEX `idx_automation_schedules_due` ON `automation_schedules` (`next_due_at`);--> statement-breakpoint
+CREATE INDEX `idx_automations_user` ON `automations` (`user_id`,`enabled`);

drizzle/mysql/0013_third_wraith.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `user_preferences` ADD `terminal_defaults` text;--> statement-breakpoint
+ALTER TABLE `user_preferences` ADD `rdp_defaults` text;

drizzle/mysql/0014_bitter_nextwave.sql

@@ -0,0 +1 @@
+ALTER TABLE `user_preferences` ADD `terminal_macros` text;

drizzle/mysql/0015_red_cobalt_man.sql

@@ -0,0 +1,34 @@
+CREATE TABLE `collab_room_members` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`room_id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`room_role` text NOT NULL DEFAULT ('member'),
+	`added_by` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `collab_room_members_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_collab_room_members_room_user` UNIQUE(`room_id`,`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `collab_rooms` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`persistent` boolean NOT NULL DEFAULT false,
+	`presenter_user_id` varchar(255),
+	`stage_protocol` text,
+	`stage_host_id` int,
+	`stage_share_id` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`ended_at` text,
+	CONSTRAINT `collab_rooms_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_room_id_collab_rooms_id_fk` FOREIGN KEY (`room_id`) REFERENCES `collab_rooms`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_added_by_users_id_fk` FOREIGN KEY (`added_by`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_presenter_user_id_users_id_fk` FOREIGN KEY (`presenter_user_id`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_stage_host_id_ssh_data_id_fk` FOREIGN KEY (`stage_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_stage_share_id_session_shares_id_fk` FOREIGN KEY (`stage_share_id`) REFERENCES `session_shares`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_collab_room_members_user` ON `collab_room_members` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_collab_rooms_owner` ON `collab_rooms` (`owner_user_id`);

drizzle/mysql/0016_unusual_tyrannus.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `collab_rooms` ADD `guest_link_token` varchar(255);--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `idx_collab_rooms_guest_token` UNIQUE(`guest_link_token`);

drizzle/mysql/0017_spicy_proteus.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `secret_sources` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`kind` text NOT NULL DEFAULT ('onepassword-connect'),
+	`base_url` text NOT NULL,
+	`token` text NOT NULL,
+	`shared` boolean NOT NULL DEFAULT false,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `secret_sources_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `secret_sources` ADD CONSTRAINT `secret_sources_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_secret_sources_user` ON `secret_sources` (`user_id`);

drizzle/mysql/0018_fancy_barracuda.sql

@@ -0,0 +1,42 @@
+CREATE TABLE `credential_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_id` int NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('use'),
+	`expires_at` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `credential_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `shared_credential_secrets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_access_id` int NOT NULL,
+	`target_user_id` varchar(255) NOT NULL,
+	`credential_id` int NOT NULL,
+	`encrypted_username` text,
+	`auth_type` text NOT NULL DEFAULT ('password'),
+	`encrypted_password` text,
+	`encrypted_key` text,
+	`encrypted_key_password` text,
+	`key_type` text,
+	`public_key` text,
+	`cert_public_key` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `shared_credential_secrets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_shared_credential_secrets_scope` UNIQUE(`credential_access_id`,`target_user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_cred_secrets_access_id_fk` FOREIGN KEY (`credential_access_id`) REFERENCES `credential_access`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_credential_secrets_target_user_id_users_id_fk` FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_credential_secrets_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_credential_access_user_id` ON `credential_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_role_id` ON `credential_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_credential_id` ON `credential_access` (`credential_id`);--> statement-breakpoint
+CREATE INDEX `idx_shared_credential_secrets_target` ON `shared_credential_secrets` (`target_user_id`,`credential_id`);

drizzle/mysql/0019_certain_archangel.sql

@@ -0,0 +1,22 @@
+CREATE TABLE `folder_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`folder` varchar(255) NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('connect'),
+	`expires_at` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `folder_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `snippets` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `vault_profiles` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_folder_access_owner_folder` ON `folder_access` (`owner_user_id`,`folder`);

drizzle/mysql/0020_wise_green_goblin.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `enable_web_ui` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `web_ui_config` text;

drizzle/mysql/0021_thick_galactus.sql

@@ -0,0 +1 @@
+ALTER TABLE `ssh_data` ADD `enable_ai_assistant` boolean DEFAULT false NOT NULL;