release-2.9.0 (#1532)

* fix(macos): skip single-instance lock in Mac App Store builds (#1454)

fix(macos): skip single-instance lock in Mac App Store builds

* Fix/backend optional sharp (#1455)

Fix/backend optional sharp

* feat: issue #1218 (#1218)

https://github.com/Termix-SSH/Support/issues/1218

* feat: Add option to use saved global custom theme under Connection Defaults (#1209)

https://github.com/Termix-SSH/Support/issues/1209

* feat: Add Fleet Sharing functionality to the UI (#1228)

https://github.com/Termix-SSH/Support/issues/1228

* feat: Add a list view to the Docker management page (#1237)

https://github.com/Termix-SSH/Support/issues/1237

* feat: issue #1264 (#1264)

https://github.com/Termix-SSH/Support/issues/1264

* feat: 2FA With FortiToken (#1288)

https://github.com/Termix-SSH/Support/issues/1288

* feat: Allow to disable showing paths to folders (#1274)

https://github.com/Termix-SSH/Support/issues/1274

* feat: Sync Network Graph between Desktop and Remote Server (#1245)

https://github.com/Termix-SSH/Support/issues/1245

* feat: Version Number on offline servers (#1291)

https://github.com/Termix-SSH/Support/issues/1291

* feat: Support OrbStack Docker socket path on macOS / Fix "Docker is not installed" on mac... (#1302)

https://github.com/Termix-SSH/Support/issues/1302

* feat: Sidebar host click should focus existing tab instead of opening a new connection (#1289)

https://github.com/Termix-SSH/Support/issues/1289

* fix: Search in side bar shows overlapping hosts when grouped by tags (#1303)

https://github.com/Termix-SSH/Support/issues/1303

* fix: I can't send a file on its own. (#1304)

https://github.com/Termix-SSH/Support/issues/1304

* fix: sudo password not autofilling (#1248)

https://github.com/Termix-SSH/Support/issues/1248

* fix: node-MainThread (#1300)

https://github.com/Termix-SSH/Support/issues/1300

* fix: Tunnel authentication with shared credentials (#1295)

https://github.com/Termix-SSH/Support/issues/1295

* fix: host key updates not syncing, metrics 404 race on first connect

Host key writes never bumped updatedAt so sync never picked them up.
Also retry the first metrics fetch briefly instead of failing right away.

* chore: increment ver

* feat: add category and icon fields to plugin manifest schema

* ci(deps): bump the github-actions group with 2 updates (#1458)

Bumps the github-actions group with 2 updates: [crowdin/github-action](https://github.com/crowdin/github-action) and [actions/github-script](https://github.com/actions/github-script).


Updates `crowdin/github-action` from 2 to 3
- [Release notes](https://github.com/crowdin/github-action/releases)
- [Commits](https://github.com/crowdin/github-action/compare/v2...v3)

Updates `actions/github-script` from 7 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v7...v9)

---
updated-dependencies:
- dependency-name: crowdin/github-action
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-dev): bump the dev-patch-updates group with 13 updates (#1459)

Bumps the dev-patch-updates group with 13 updates:

| Package | From | To |
| --- | --- | --- |
| [@codemirror/commands](https://github.com/codemirror/commands) | `6.11.0` | `6.11.1` |
| [@codemirror/search](https://github.com/codemirror/search) | `6.7.1` | `6.7.2` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.9` | `6.43.12` |
| [@testing-library/dom](https://github.com/testing-library/dom-testing-library) | `10.4.1` | `10.4.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.5` | `14.6.7` |
| [@types/ssh2](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/ssh2) | `1.15.5` | `1.15.6` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` |
| [cytoscape](https://github.com/cytoscape/cytoscape.js) | `3.34.1` | `3.34.3` |
| [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.4` | `0.5.7` |
| [i18next](https://github.com/i18next/i18next) | `26.4.0` | `26.4.2` |
| [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.8` |
| [react-i18next](https://github.com/i18next/react-i18next) | `17.0.12` | `17.0.14` |


Updates `@codemirror/commands` from 6.11.0 to 6.11.1
- [Changelog](https://github.com/codemirror/commands/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/commands/commits)

Updates `@codemirror/search` from 6.7.1 to 6.7.2
- [Changelog](https://github.com/codemirror/search/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/search/commits)

Updates `@codemirror/view` from 6.43.9 to 6.43.12
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `@testing-library/dom` from 10.4.1 to 10.4.2
- [Release notes](https://github.com/testing-library/dom-testing-library/releases)
- [Changelog](https://github.com/testing-library/dom-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/dom-testing-library/compare/v10.4.1...v10.4.2)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/react-testing-library/compare/v16.3.2...v16.3.3)

Updates `@testing-library/user-event` from 14.6.5 to 14.6.7
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/user-event/compare/v14.6.5...v14.6.7)

Updates `@types/ssh2` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/ssh2)

Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `cytoscape` from 3.34.1 to 3.34.3
- [Release notes](https://github.com/cytoscape/cytoscape.js/releases)
- [Commits](https://github.com/cytoscape/cytoscape.js/compare/v3.34.1...v3.34.3)

Updates `eslint-plugin-react-refresh` from 0.5.4 to 0.5.7
- [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases)
- [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md)
- [Commits](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/compare/v0.5.4...v0.5.7)

Updates `i18next` from 26.4.0 to 26.4.2
- [Release notes](https://github.com/i18next/i18next/releases)
- [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/i18next/compare/v26.4.0...v26.4.2)

Updates `prettier` from 3.9.6 to 3.9.8
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](https://github.com/prettier/prettier/compare/3.9.6...3.9.8)

Updates `react-i18next` from 17.0.12 to 17.0.14
- [Changelog](https://github.com/i18next/react-i18next/blob/master/CHANGELOG.md)
- [Commits](https://github.com/i18next/react-i18next/compare/v17.0.12...v17.0.14)

---
updated-dependencies:
- dependency-name: "@codemirror/commands"
  dependency-version: 6.11.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@codemirror/search"
  dependency-version: 6.7.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@testing-library/dom"
  dependency-version: 10.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@types/ssh2"
  dependency-version: 1.15.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: cytoscape
  dependency-version: 3.34.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: eslint-plugin-react-refresh
  dependency-version: 0.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: i18next
  dependency-version: 26.4.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: prettier
  dependency-version: 3.9.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
- dependency-name: react-i18next
  dependency-version: 17.0.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps): bump the prod-patch-updates group with 6 updates (#1461)

Bumps the prod-patch-updates group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.10` | `3.14.13` |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [socks](https://github.com/JoshGlazebrook/socks) | `2.8.9` | `2.8.10` |
| [undici](https://github.com/nodejs/undici) | `8.10.0` | `8.10.2` |


Updates `@tanstack/react-virtual` from 3.14.10 to 3.14.13
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.13/packages/react-virtual)

Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2)

Updates `jose` from 6.2.9 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](https://github.com/panva/jose/compare/v6.2.9...v6.2.12)

Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](https://github.com/Stuk/jszip/compare/v3.10.1...v3.10.2)

Updates `socks` from 2.8.9 to 2.8.10
- [Release notes](https://github.com/JoshGlazebrook/socks/releases)
- [Commits](https://github.com/JoshGlazebrook/socks/compare/2.8.9...2.8.10)

Updates `undici` from 8.10.0 to 8.10.2
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v8.10.0...v8.10.2)

---
updated-dependencies:
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: jszip
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: socks
  dependency-version: 2.8.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
- dependency-name: undici
  dependency-version: 8.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat: add plugin worker protocol, bootstrap and plugin_storage table

Worker-side ctx proxy plus the message envelope it talks over, and the
per-plugin key/value table behind ctx.storage with migrations for all
three dialects. Rows cascade with the plugin so uninstalling leaves
nothing behind.

* feat: add allowlisted host view for plugins

An allowlist rather than a list of fields to strip. A blocklist rots:
the moment a new secret-bearing column lands on SSHHost it starts
leaking silently. With an allowlist a new field stays invisible to
plugins until someone adds it here on purpose.

* feat: add plugin loader with manifest validation and crash restart

Validates an unpacked plugin, spawns a worker_threads worker and manages
activate/deactivate/crash-restart with backoff, disabling after three
tries.

The crash counter clears only after a plugin stays up past a stability
window, not on activation. Clearing it on activation let a plugin that
activates cleanly and then dies restart forever, because every attempt
looked like the first.

loader.ts documents what the worker boundary does and does not buy you.
Node's permission model is process-wide, not per-worker, so it cannot be
enabled for plugin workers alone and is not claimed here.

* feat: route internal events through a shared plugin event bus

Formalises three ad-hoc publish paths that already existed:
automation-events.ts, metrics/automation-bridge.ts and the
hostSessionStatus singleton, now the host.session.status topic.

Both invariants the old code relied on are preserved. Publishing stays
fire-and-forget, so a failing subscriber cannot disturb a metrics poll or
a host delete. The automations engine subscribes to the bus at scheduler
start instead of being imported ad hoc, which keeps the edge
one-directional: automations may import repositories, hosts modules must
not import automations.

* feat: add plugin ctx broker with permission gate and audit

Every ctx call a plugin makes is checked against its granted
capabilities, performed by the main thread, then audited. A capability
must be both declared in the manifest and granted in the database, so
widening a plugin's reach always needs a new manifest the user can see,
never just a database row.

Audit attribution is set by the broker, not the plugin. The plugin
supplies only the details, so it cannot forge the actor.

fix: stop plugin workers seeing plaintext credentials in error messages

A failing ctx.ssh.connect handed the worker the raw error from deep in
the SSH stack, which embeds the connect config. The worker received, in
full:

  Authentication failed for root using password <SECRET>

where <SECRET> was the host's real plaintext password. Any plugin with
ssh.exec could read it by catching the error, defeating the whole point
of the handle-based ssh API.

Errors crossing the boundary are now sanitised. Only PluginFacingError
and PluginPermissionError, both authored here, reach a plugin verbatim;
anything else becomes a generic message and the real one goes to the
log. This uses a marker class rather than matching on message text,
because matching would start leaking again the moment an upstream error
happened to contain a familiar phrase.

Covered by credential-isolation.test.ts, which plants a sentinel in
every secret-bearing field and asserts it appears in no message the
worker ever receives.

* feat: dispatch plugin HTTP routes and wire the runtime into startup

ctx.http.route now registers a real router on the /plugin-api/:pluginId
dispatcher, replacing its stub 404. A plugin never touches the Express
req/res: it gets a plain summary and returns a plain object, so sockets
and session cookies stay on this side of the boundary. Authorization and
cookie headers are not forwarded.

Plugins load last in the start-up sequence, after the server is fully
wired, and are terminated before the database on shutdown so none can
outlive it. A plugin that fails to load cannot stop the backend.

fix: correct the nginx plugin-api location regex

The pattern was ^/plugin-api/(/.*)?$, which needs a double slash and so
never matched /plugin-api/<id>/<route>. Every other block in the file
uses ^/prefix(/.*)?$. Left alone, plugin routes would work in dev and
404 only behind Docker.

* fix: update stale SFTP transfer test for single file destination paths

The test still asserted transferToHost was called with the destination
directory "/srv". Commit 7727fa09 (#1304) deliberately changed a single
file transfer to send the full destination path including the filename,
so the correct expectation is "/srv/remote-1.txt". The code was right
and the test was left behind.

* feat: ship the ssh terminal as a first-party in-process plugin

Adds a hardcoded process:transport-owner tier so the terminal can own its
WebSocket server and ssh2 clients, which cannot cross the worker boundary.

* feat: ship docker as a first-party in-process plugin

Moves docker backend and frontend into plugins/docker/, alongside
ssh-terminal. Adds a host editor tab seam, a dashboard card registry,
and a build step to compile plugin backends into dist.

* feat: ship host metrics as a first-party in-process plugin

* fix: harden plugin auth and add per-request identity for ctx calls

Require auth on /plugin-api, gate plugin enable/grant/revoke routes
behind admin.plugins.manage, and thread the calling user through
worker ctx.hosts/ctx.ssh calls instead of always using the install
owner. Also adds the plugin permissions grant/revoke UI.

* feat: ship the AI assistant as a first-party in-process plugin

Moves src/backend/ai and its routes into plugins/ai, mounted through a
small /ai dispatcher instead of its own port. Moves the ai-enabled and
ai-private-endpoints settings routes out of user-settings-routes.ts
into the plugin too, so it has no leftover core dependents.

* fix: remove compiled plugin JS left behind in plugins/ after build

copy-bundled-plugins.cjs compiled and rewrote plugin backend TS in
place, copied it to dist/plugins, but never deleted the .js it had
just emitted next to the .ts sources. Those files shadowed the real
source for vitest/tsx and had import paths rewritten for the dist
layout, so tests failed with "Cannot find module" once a local build
had run. Affects docker, host-metrics and ai, not just this one.

* feat: add a permission-gated backend service registry for plugins

* feat: add a permission-gated UI action registry and action slots for plugins

Moves the terminal toolbar's hardwired AI button into a slot the ssh-terminal
plugin offers and the ai plugin fills, gated on ai.services.use.

* feat: add cross-plugin secret references gated by the provider's RBAC permission

* feat: move proxmox discovery/import/sync into a first-party plugin

* feat: move remote desktop (RDP/VNC/Telnet) into a first-party plugin

Relocates guacamole backend/frontend source and tests into
plugins/remote-desktop, following the ssh-terminal/docker pattern.

* feat: wire remote-desktop plugin into core and rename i18n keys

Repoints core consumers (dispatcher, collab, session-sharing, tab
utils) at the plugin, adds isTabTypeAvailable gating for rdp/vnc/
telnet, widens hostCapability to accept an array, and renames the
guacamole i18n namespace to remoteDesktop.

* feat: move fleets into a first-party plugin

* feat: move automations into a first-party plugin

* feat: remove legacy alert rules, superseded by automations

Alert rules already auto-migrate into automations on boot and the old
engine stands down after. Deletes the rule/firing tables, routes, UI,
and AI tools; keeps notification channels since automations still use
them. Also fixes automations' notify step, which still called the
deleted repository.

* feat: move network topology into a first-party plugin

* feat: move tailscale device discovery and settings into a plugin

Adds plugins/tailscale/ with a devices sidebar tab, admin settings
section, and re-auth dialog. Host Metrics tailscale manager card and
SSH re-auth banner parsing stay in core.

* feat: move workspaces into a first-party plugin

* feat: move web endpoint into a first-party plugin

* feat: collapse plugin runtime to one tier behind a plugin SDK

* feat: make each plugin an npm workspace built by a termix-plugin CLI

* feat: give plugins their own tables, migrations and sync entities

* feat: serve plugin http and websockets from one mount instead of ports

* feat: namespace plugin permissions and keep them valid when a plugin is off

* feat: give plugins their own settings and one settings screen

* feat: load plugin frontends at runtime and remove plugin ids from the shell

* fix: mock the ai status fetch in its activate test

* feat: add auth extension points and one ssh connect pipeline

* feat: rebuild workspaces as the reference plugin

* fix: gate second factors after SSO/LDAP behind an admin setting

* feat: convert network-topology to a full plugin (B1)

* feat: move snippets backend and tables into a plugin (B2)

* feat: point core frontend snippets pickers at the plugin (B2)

* feat: add the snippets plugin (B2)

* feat: wire ai, automations, fleets and ssh-terminal to snippets (B2)

* feat: finish the tailscale plugin, including SSH auth (B3)

* feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)

* chore: update proxmox and host-metrics locale files for B5

* chore: regenerate drizzle migration journals for B5

* feat: add ctx.hosts create/update to the SDK, host-metrics drops proxmox

* feat: move proxmox node stats and collectors into the proxmox plugin

* feat: drop proxmox host columns, use plugin settings instead

* feat: finish the fleets plugin, add ctx.hosts and host-commands SDK (B4)

* feat: convert file manager into a plugin

* feat: convert ssh tunnels into a plugin

* feat: finish the web-endpoint plugin, add ctx.desktop (B8)

* feat: move the terminal fully into the ssh-terminal plugin (B9)

* feat: convert tmux monitoring into a plugin (B10)

* feat: convert serial console into the serial plugin

* feat: move session sharing and collab rooms into a plugin (B12)

* feat: turn session recording into a plugin (B13)

* feat: finish the remote-desktop plugin (B14)

* feat: finish the host-metrics plugin, move host status into core (B16)

* feat: finish the docker plugin (B15)

* feat: finish the automations plugin (B17)

* feat: finish the ai plugin (B18)

* feat: finish the homepage plugin, move service links and canvas out of core (B19)

* feat: convert wake-on-lan into a plugin (B20)

* feat: convert secret-sources into a plugin (B20)

* feat: move totp and passkeys into plugins (C1)

* feat: move sso and ldap logins into plugins (C2)

* feat: move opkssh and warpgate into plugins (C3)

* feat: move step-ca into a plugin (C4)

* feat: move vault ssh signing into a plugin (C5)

* feat: move termix identity into a plugin (C6)

* feat: move acme certificate automation into a plugin (C7)

* fix: finish 2.9.0 plugin moves and get every check green

* chore: lock the plugin boundary and remove 2.9.0 leftovers

* fix: harden the plugin runtime after the 2.9.0 security review

* feat: add plugin packing, signing, pinned trust and tmxplug bundling

* test: prove 2.8 to 2.9.0 upgrade is lossless and fix what it caught

* fix: give bundled plugin backends a real require for CJS deps

* feat: improve UI loading time and jitter

* feat: show credential sharing inline in the sidebar like host sharing

* feat: tailscale add host and copy ip, fix outbound fetch hang and plugin ESM warning

* feat: unify alerts into one plugin, channels, rules and inbox

* feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling

* fix: set blacksmith builder cache-key to stop broken gha cache fallback

* fix: link plugin-sdk workspace before npm ci in docker deps stage

* fix: link every plugin workspace before npm ci in docker deps stage

* fix(host-metrics): exclude image and firmware filesystems (#1469)

* fix(host-metrics): exclude image and firmware filesystems

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(hosts): normalize imported jump host references (#1470)

* fix(hosts): normalize imported jump host references

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(ci): build plugin SDK and repair MySQL settings migration (#1471)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(file-manager): keep inline rename consistent (#1476)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(file-manager): keep inline rename consistent

* fix(dashboard): reuse translated host status labels (#1475)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(dashboard): reuse translated host status labels

* docs(api): clarify local and remote version fields (#1474)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* docs(api): clarify local and remote version fields

* fix(file-manager): preserve selected backgrounds on hover (#1473)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(file-manager): preserve selection feedback on hover

* test(ui): await dialog focus cleanup before teardown

* fix(file-manager): restore Ctrl/Cmd+F file search (#1472)

* fix(ci): build plugin SDK before dependent checks

* fix(mysql): keep plugin settings scope indexes within limits

* test(mysql): refresh reviewed plugin upgrade SQL

* fix(file-manager): focus file search with Ctrl or Cmd F

* fix: keep rounded-full circular in production builds

* fix(file-manager): cancel uploads and stop remote writes (#1477)

* fix(file-manager): cancel uploads and stop remote writes

* test(css): exercise the configured PostCSS plugin chain

* fix(file-manager): apply compact density to directory tree (#1478)

* fix(file-manager): apply compact density to directory tree

* test(css): exercise the configured PostCSS plugin chain

* fix(file-manager): preserve font sizes in compact mode (#1480)

* fix(file-manager): preserve font sizes in compact mode

* test(css): exercise the configured PostCSS plugin chain

* fix(file-manager): prioritize file names in narrow lists (#1483)

* fix(file-manager): prioritize file names in narrow lists

* test(css): exercise the configured PostCSS plugin chain

* test(identity): preserve full Ed25519 public keys in fixtures

* test(remote-desktop): always mutate ciphertext in tamper test

* fix(remote-desktop): probe the saved host guacd endpoint (#1481)

* fix(remote-desktop): probe the saved host guacd endpoint

* test(css): exercise the configured PostCSS plugin chain

* test(identity): preserve full Ed25519 public keys in fixtures

* fix(homepage): check allowlisted private service reachability (#1479)

* fix(homepage): check allowlisted private service reachability

* test(css): exercise the configured PostCSS plugin chain

* fix(remote-desktop): stop unsolicited clipboard read prompts (#1482)

* fix(remote-desktop): read clipboard only on explicit paste

* test(css): exercise the configured PostCSS plugin chain

* test(identity): preserve full Ed25519 public keys in fixtures

* test(remote-desktop): always mutate ciphertext in tamper test

* chore: simplify plugin readmes, changelogs and manifest descriptions

* fix: keep plugins loaded after signing in from the login screen

* fix(file-manager): accept OS file drops over existing rows (#1484)

* fix(file-manager): accept OS file drops over existing rows

* test(file-manager): target the file label in drop tests

* test(css): exercise the configured PostCSS plugin chain

* test(identity): preserve full Ed25519 public keys in fixtures

* test(remote-desktop): always mutate ciphertext in tamper test

* fix(file-manager): pipeline SFTP download reads (#1485)

* feat: add plugin sdk build to beta release

* fix: make link-store secret check immune to random base64 matches

* fix(ldap): preserve the directory-provided bind DN (#1486)

* fix: compute beta changes across dev branches and move the beta tag

* chore: untrack plugin sdk ARCHITECTURE.md

* chore: remove references to plugin sdk ARCHITECTURE.md

* feat: merge host editor terminal tabs into one owned by ssh-terminal

* feat: add descriptions to plugin host enable toggles

* fix(file-manager): show download progress in file viewers (#1487)

* fix(electron): signal backend readiness over IPC (#1488)

* fix(split-screen): allow layout creation without randomUUID (#1490)

* fix(split-screen): allow layout creation without randomUUID

* test(credentials): avoid flaky Ed25519 key generation

* fix(sidebar): remeasure visible rows after density changes (#1489)

* fix(sidebar): remeasure visible rows after density changes

* test(credentials): avoid flaky Ed25519 key generation

* feat(split-screen): redesign split screen with free-form panes and pane picker

* feat(sidebar): add host click behavior setting, default to always opening a new tab

* feat(snippets): redesign panel to match the host list

* fix(session-recording): stop session logs panel from refetching in a loop

* feat(snippets): bring back sharing, target hosts and drag reorder

* feat(ssh-terminal): add toolbar position, start state, display and fade host settings

* feat(ssh-terminal): add host setting to turn off password prompt auto-fill

* fix(ai): stop streams getting cut off and keep tool steps across messages

* feat: improve quick connect system using plugin api

* fix: proxmox guest sync, startup snippet sync, drop dead cloudflare ssh transport

* feat: move terminal settings, look and ssh tools into ssh-terminal plugin

* feat: move snippets, keybinding actions and macros out of core into plugins

* feat: store rdp, vnc and telnet logins in a generic per-protocol table

* feat: type the plugin host record, move plugin strings out of core and add lint checks

* feat: replace core homepage widget registry with generic extension points

* feat: plugins only see their own host settings in the browser

* feat: harden plugin api for separate repos, signed updates and generic external login

* fix: keep plugin css below core utilities and version plugin assets by their css

* fix: load and save plugin host settings in the editor and tighten settings row spacing

* feat: redesign user host defaults system

* fix(remote-desktop): release held keys on focus loss (#1498)

* fix(session-sharing): replace local presentation after takeover (#1500)

* fix(file-manager): refresh disk usage with directory listing (#1503)

* fix(ssh-terminal): preserve input order during local echo reconciliation (#1505)

* feat(remote-desktop): expose display zoom controls for RDP (#1514)

* fix(file-manager): restore text selection and copying in Markdown previews (#1518)

* fix(sidebar): keep compact host addresses visible (#1524)

* fix(hosts): preserve plugin settings when reopening the editor (#1499)

* fix(ssh-terminal): close owner sockets when presentations unmount (#1501)

* fix(session-sharing): synchronize shared SSH terminal dimensions (#1502)

* fix(session-sharing): show participant presence in member terminals (#1504)

* fix(ai): sync provider configuration and keys across linked devices (#1506)

* feat(ssh-terminal): add a duplicate tab action (#1510)

* feat(file-manager): allow disabling move-to-trash confirmation (#1511)

* feat(file-manager): default to the remote login directory (#1512)

* feat(homepage): synchronize canvas layouts across devices (#1515)

* fix(shortcuts): prevent accidental double-Shift palette activation (#1519)

* feat(tmux-monitor): add a unified multi-host view (#1520)

* fix(electron): allow explicit quit with active connections (#1522)

* feat: reconnect all disconnected terminal tabs (#1523)

* fix(hosts): preserve recording and sharing settings in the dev editor (#1509)

* fix(database): preserve RDP domain during startup backfill (#1497)

* feat(sidebar): add keyboard type-ahead search for hosts (#1516)

* feat(automations): add per-host maintenance mode and recurring schedules (#1521)

* feat(tmux): add a per-host mouse toggle and preserve remote configuration (#1513)

* fix(session-sharing): use the linked server for desktop meetings and links (#1507)

* fix(tunnels): support TOTP for client tunnels and jump hosts (#1508)

* fix: type errors and lint failures from merged plugin prs

* feat(installer): make the Windows desktop shortcut optional (#1517)

* fix: ship the plugin sdk and serialport in desktop builds

* fix: prefer ipv4 when resolving ssh host names (#1365)

* fix: readable terminal selection with the light theme (#1319)

* fix: build desktop session share links on the linked server (#1350)

* fix: show meeting guests to members and hide the roster from guests (#1353)

* fix: reliable file manager saves with sudo prompt and no base64 guessing (#1335)

* fix: show disk usage for the mount being browsed (#1347)

* fix: load the linux tray icon reliably and log tray failures (#1332)

* fix: cover the gnome close path in the desktop quit test (#1332)

* fix: prompt for jump host TOTP in terminal, file manager and metrics (#1312)

* feat: optional auto reconnect for dropped ssh sessions (#1321)

* feat: tighter compact host rows with inline tags (#1325)

* feat: bring back the alert feed homepage widget

* feat: pick target terminals for snippets again

* feat: share button on connection tabs again

* feat: recent servers list when linking the desktop app

* feat: list the fixed app shortcuts in keyboard shortcuts

* fix: translate hardcoded toasts and drop em dashes from ui text

* fix: translate leftover hardcoded ui text

* fix: toolbar files button opens at the shell directory again

* fix: show the remote desktop note under connection origin again

* chore: openapi docs for host metrics manager routes

* chore: openapi docs for undocumented routes and fix two broken doc blocks

* fix: declare terminal.listSessions use for snippet targets

* revert: drop the alert feed widget, the notification center replaces it

* feat: restore the alert feed homepage widget

* fix: quick connect fills the host address from plugin auth editors like tailscale

* fix: docker container logs use the base background color

* chore: fix dependabot alerts and apply safe npm upgrades

* fix: proxmox stats tab reads its switch from plugin host settings

* fix: count plugin ssh logins toward host status and stop showing reachable as a warning

* fix: hide the built-in source pill in the host editor

* fix: host status shows online when the port answers and only warns on a failed login

* fix: drop the top border on the split layout menu

* fix: host defaults tabs sit where the host editor puts them and skip plugins with nothing to default

* fix: remote desktop auth method labels and notes for vnc and telnet

* fix: add description to the web endpoint enable switch

* fix: crowdin sync and pretranslate for plugin locales, run plugin tests on release

* feat: move telemetry out of core into a usage statistics plugin

* fix: recent activity card no longer cuts off host names early

* fix: remove duplicate top border on split screen menu

* fix: redesign session log player controls, fix tooltip overlap and drop dot separators

* fix: file manager and sftp text showing raw i18n keys

* fix: onboarding rerunning for existing users after upgrading

* fix: fleet detail buttons overflowing the sidebar

* fix: session log player scrolling off screen horizontally

* fix: network graph lag when adding hosts and on every render

* fix: maintenance index name, shared host read only view and badge polling

* fix: meeting tabs, workspace tab merging, rail panels as tabs and general ui lag

* chore: update release notes

* fix: remote desktop tabs reconnecting on every tab switch

* fix: build plugin sdk before linting in release workflow

* chore: lint, format, and bump version to 2.9.0

* chore: skip crowdin pre-translate in release for now

* chore: sync Crowdin translations for 2.9.0

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Koi <38512047+datlt4@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ZacharyZcR <zacharyzcr1984@gmail.com>

.github/workflows/beta-release.yml

@@ -75,17 +75,24 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
       - name: Run ESLint
         run: npx eslint .
 
       - name: Type check
         run: npm run type-check
 
+      # Before the tests: the plugin boot tests load the built bundles.
+      - name: Build
+        run: npm run build
+
       - name: Run unit tests
         run: npm run test
 
-      - name: Build
-        run: npm run build
+      - name: Run plugin tests
+        run: npm run test:plugins
 
   create-release:
     needs: [prep, verify]
@@ -105,20 +112,40 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GHCR_TOKEN }}
         run: |
+          SHA="${{ needs.prep.outputs.sha }}"
           PREV_SHA=$(gh release view beta --repo ${{ github.repository }} --json targetCommitish -q .targetCommitish 2>/dev/null || true)
-          if [ -n "$PREV_SHA" ] && git cat-file -e "$PREV_SHA" 2>/dev/null && git merge-base --is-ancestor "$PREV_SHA" "${{ needs.prep.outputs.sha }}"; then
-            echo "sha=$PREV_SHA" >> "$GITHUB_OUTPUT"
-          else
-            echo "sha=" >> "$GITHUB_OUTPUT"
+          if [ -z "$PREV_SHA" ] || ! git cat-file -e "$PREV_SHA^{commit}" 2>/dev/null; then
+            PREV_SHA=$(git rev-parse -q --verify "refs/tags/beta^{commit}" || true)
           fi
+          # The last beta may come from an older dev branch, so diff from where the two meet.
+          if [ -n "$PREV_SHA" ] && ! git merge-base --is-ancestor "$PREV_SHA" "$SHA"; then
+            PREV_SHA=$(git merge-base "$PREV_SHA" "$SHA" || true)
+          fi
+          echo "Previous beta commit: ${PREV_SHA:-none}"
+          echo "sha=$PREV_SHA" >> "$GITHUB_OUTPUT"
 
       - name: Generate rolling beta release notes
         run: |
-          if [ -n "${{ steps.prev.outputs.sha }}" ]; then
-            CHANGES=$(git log --oneline --no-merges "${{ steps.prev.outputs.sha }}..${{ needs.prep.outputs.sha }}" -- . ':!package-lock.json' | sed 's/^/- /')
-          fi
-          if [ -z "$CHANGES" ]; then
-            CHANGES="- No new commits since the last beta."
+          PREV="${{ steps.prev.outputs.sha }}"
+          SHA="${{ needs.prep.outputs.sha }}"
+          MAX=150
+          if [ -z "$PREV" ]; then
+            CHANGES="- Could not find the previous beta commit."
+          else
+            LOG=$(git log --oneline --no-merges "$PREV..$SHA" -- . ':!package-lock.json')
+            COUNT=$(printf '%s' "$LOG" | grep -c . || true)
+            if [ "$COUNT" -eq 0 ]; then
+              CHANGES="- No new commits since the last beta."
+            else
+              CHANGES=$(printf '%s\n' "$LOG" | head -n "$MAX" | sed 's/^/- /')
+              if [ "$COUNT" -gt "$MAX" ]; then
+                CHANGES="$CHANGES
+          - ...and $((COUNT - MAX)) more"
+              fi
+              CHANGES="$CHANGES
+
+          [Full diff](https://github.com/${{ github.repository }}/compare/$PREV...$SHA)"
+            fi
           fi
 
           cat > BETA_RELEASE_BODY.md << EOF
@@ -143,6 +170,9 @@ jobs:
           TAG="beta"
           TITLE="Beta (rolling) - ${{ needs.prep.outputs.beta_version }}"
           if gh release view "$TAG" --repo ${{ github.repository }} >/dev/null 2>&1; then
+            # --target only applies to a new tag, so move the existing one by hand.
+            gh api -X PATCH "repos/${{ github.repository }}/git/refs/tags/$TAG" \
+              -f sha="${{ needs.prep.outputs.sha }}" -F force=true >/dev/null
             gh release edit "$TAG" --repo ${{ github.repository }} \
               --title "$TITLE" --notes-file BETA_RELEASE_BODY.md \
               --prerelease --target "${{ needs.prep.outputs.sha }}"

.github/workflows/crowdin-sync.yml

@@ -39,7 +39,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Upload sources to Crowdin
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@v3
         with:
           upload_sources: true
           upload_translations: false
@@ -51,13 +51,13 @@ jobs:
         env:
           CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
 
-      - name: Machine pre-translate untranslated strings
+      - name: Pre-translate untranslated strings
         env:
           CROWDIN_API_KEY: ${{ secrets.CROWDIN_API_KEY }}
         run: node scripts/crowdin-pretranslate.cjs
 
       - name: Download translations from Crowdin
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@v3
         with:
           upload_sources: false
           upload_translations: false
@@ -74,7 +74,7 @@ jobs:
           git config user.name "LukeGus"
           git config user.email "bugattiguy527@gmail.com"
 
-          git add src/ui/locales/translated
+          git add src/ui/locales/translated plugins/*/locales/translated
           if git diff --cached --quiet; then
             echo "No translation changes to commit."
             exit 0

.github/workflows/docker.yml

@@ -61,6 +61,8 @@ jobs:
 
       - name: Setup Docker Buildx
         uses: useblacksmith/setup-docker-builder@v2
+        with:
+          cache-key: termix-ssh/termix
 
       - name: Determine tags
         id: tags
@@ -121,8 +123,6 @@ jobs:
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
             org.opencontainers.image.revision=${{ env.SOURCE_SHA }}
             org.opencontainers.image.created=${{ github.run_id }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
           outputs: ${{ inputs.dry_run && 'type=cacheonly' || 'type=registry,compression=zstd' }}
 
       - name: Cleanup Docker

.github/workflows/electron.yml

@@ -427,6 +427,7 @@ jobs:
           npm ci
           npm install --force @rollup/rollup-darwin-arm64
           npm install dmg-license
+          node scripts/install-macos-sharp.cjs
 
       - name: Check for Code Signing Certificates
         id: check_certs
@@ -538,12 +539,27 @@ jobs:
           fi
           npx electron-builder --mac dmg --universal --x64 --arm64 --publish never
 
+      - name: Verify macOS sharp packaging
+        run: |
+          artifacts=(release/termix_macos_*_dmg.dmg)
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          if [ -n "$MAS_PKG" ]; then
+            artifacts+=("$MAS_PKG")
+          fi
+          node scripts/verify-macos-sharp.cjs "${artifacts[@]}"
+
+      - name: Locate macOS MAS PKG
+        id: locate_mas_pkg
+        run: |
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          echo "path=$MAS_PKG" >> "$GITHUB_OUTPUT"
+
       - name: Upload macOS MAS PKG
-        if: steps.check_certs.outputs.has_certs == 'true' && hashFiles('release/termix_macos_universal_mas.pkg') != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release' || inputs.artifact_destination == 'submit')
+        if: steps.check_certs.outputs.has_certs == 'true' && steps.locate_mas_pkg.outputs.path != '' && (inputs.artifact_destination == 'file' || inputs.artifact_destination == 'release' || inputs.artifact_destination == 'submit')
         uses: actions/upload-artifact@v7
         with:
           name: termix_macos_universal_mas
-          path: release/termix_macos_universal_mas.pkg
+          path: ${{ steps.locate_mas_pkg.outputs.path }}
           retention-days: 30
           if-no-files-found: warn
 
@@ -923,6 +939,9 @@ jobs:
           echo "dmg_name=$DMG_NAME" >> $GITHUB_OUTPUT
           echo "checksum=$CHECKSUM" >> $GITHUB_OUTPUT
 
+      - name: Verify macOS sharp packaging
+        run: node scripts/verify-macos-sharp.cjs release_asset/termix_macos_universal_dmg.dmg
+
       - name: Prepare Homebrew submission files
         run: |
           VERSION="${{ steps.package-version.outputs.version }}"
@@ -1013,6 +1032,7 @@ jobs:
           npm ci
           npm install --force @rollup/rollup-darwin-arm64
           npm install dmg-license
+          node scripts/install-macos-sharp.cjs
 
       - name: Check for Code Signing Certificates
         id: check_certs
@@ -1154,6 +1174,16 @@ jobs:
           BUILD_VERSION="${{ steps.build_number.outputs.build_version || github.run_number }}"
           npm run build && npx electron-builder --mac mas --universal --config.buildVersion="$BUILD_VERSION"
 
+      - name: Verify macOS sharp packaging
+        if: steps.check_certs.outputs.has_certs == 'true'
+        run: |
+          MAS_PKG=$(find release -name "termix_macos_universal_mas.pkg" -type f | head -n 1)
+          if [ -z "$MAS_PKG" ]; then
+            echo "MAS pkg not found under release/; aborting."
+            exit 1
+          fi
+          node scripts/verify-macos-sharp.cjs "$MAS_PKG"
+
       - name: Generate App Store release notes
         id: asc_notes
         if: steps.check_certs.outputs.has_certs == 'true' && steps.check_asc_creds.outputs.has_credentials == 'true'

.github/workflows/helm.yml

@@ -5,13 +5,11 @@ on:
     paths:
       - "charts/**"
       - ".github/workflows/helm.yml"
-      - "deploy/**"
   push:
     branches: [main]
     paths:
       - "charts/**"
       - ".github/workflows/helm.yml"
-      - "deploy/**"
   workflow_dispatch:
     inputs:
       publish:

.github/workflows/pr-check.yml

@@ -24,6 +24,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
       - name: Lint
         # npm run lint, not npx eslint — the script also checks that the
         # generated dialect schemas match schema.ts, which eslint cannot see.
@@ -38,6 +41,12 @@ jobs:
       - name: Build
         run: npm run build
 
+      - name: Run unit tests
+        run: npm run test
+
+      - name: Run plugin tests
+        run: npm run test:plugins
+
   database-dialects:
     name: Postgres and MySQL
     runs-on: blacksmith-2vcpu-ubuntu-2404
@@ -88,6 +97,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Build plugin SDK
+        run: npm run build:sdk
+
       # Each run applies the migrations to an empty database first, so a
       # migration that does not apply cleanly fails the build.
       - name: Verify Postgres

.github/workflows/redirect-issues.yml

@@ -0,0 +1,23 @@
+name: Redirect issues
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  issues: write
+
+jobs:
+  close:
+    if: github.event.issue.author_association != 'OWNER' && github.event.issue.author_association != 'COLLABORATOR'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const n = context.issue.number;
+            await github.rest.issues.createComment({
+              ...context.repo, issue_number: n,
+              body: "Do not create issues here. Use the dedicated support repo and issue template system: https://github.com/Termix-SSH/Support"
+            });
+            await github.rest.issues.update({ ...context.repo, issue_number: n, state: "closed", state_reason: "not_planned" });
+            await github.rest.issues.lock({ ...context.repo, issue_number: n, lock_reason: "off-topic" });

.github/workflows/release.yml

@@ -100,14 +100,26 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      # Manifest validation in lint loads the built SDK.
+      - name: Build SDK
+        run: npm run build:sdk
+
       - name: Lint and format
         run: |
-          npm run lint:fix || true
+          npm run lint:fix
           npm run format
+          npm run lint
+
+      # The plugin boot tests load the built bundles.
+      - name: Build plugins
+        run: npm run build:plugins
 
       - name: Run unit tests
         run: npm run test
 
+      - name: Run plugin tests
+        run: npm run test:plugins
+
       - name: Sync version
         run: node scripts/sync-version.cjs --version "${{ needs.prep.outputs.version }}"
 
@@ -168,7 +180,7 @@ jobs:
           git push origin --delete i18n_translate || true
 
       - name: Upload sources to Crowdin
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@v3
         with:
           upload_sources: true
           upload_translations: false
@@ -180,13 +192,15 @@ jobs:
         env:
           CROWDIN_API_TOKEN: ${{ secrets.CROWDIN_API_KEY }}
 
-      - name: Machine pre-translate untranslated strings
+      # Off until the machine translation credits are topped up.
+      - name: Pre-translate untranslated strings
+        if: false
         env:
           CROWDIN_API_KEY: ${{ secrets.CROWDIN_API_KEY }}
         run: node scripts/crowdin-pretranslate.cjs
 
       - name: Download translations from Crowdin
-        uses: crowdin/github-action@v2
+        uses: crowdin/github-action@v3
         with:
           upload_sources: false
           upload_translations: false
@@ -203,7 +217,7 @@ jobs:
           git config user.name "LukeGus"
           git config user.email "bugattiguy527@gmail.com"
 
-          git add src/ui/locales/translated
+          git add src/ui/locales/translated plugins/*/locales/translated
           if git diff --cached --quiet; then
             echo "No translation changes to commit."
             exit 0
@@ -549,6 +563,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Delete dev branch in Termix
         env:

.gitignore

@@ -13,6 +13,14 @@ dist-ssr
 coverage
 *.local
 
+# Plugin build output. termix-plugin build writes it, the packaged server
+# gets its copy under dist/plugins.
+/plugins/*/dist/
+*.tmxplug
+*.tmxplug.sig
+termix-plugin-signing.key
+/src/**/*.js
+
 .vscode/*
 !.vscode/settings.json
 .idea

.gitlab-ci.yml

@@ -1,2 +0,0 @@
-include:
-  - local: deploy/gitlab/.gitlab-ci.yml

.husky/pre-commit

@@ -1 +1,3 @@
-npx lint-staged
+# The .cmd shims on Windows add their own paths to each command, so keep
+# lint-staged's chunks well under cmd.exe's 8191 character limit.
+npx lint-staged --max-arg-length 4000

Casks/termix.rb

@@ -1,6 +1,6 @@
 cask "termix" do
-  version "2.7.0"
-  sha256 "8cdae5cf5ce2786e35a1a676dec51974cfca318a5595bc743981a4c373515059"
+  version "2.8.0"
+  sha256 "e4030d648055650c682a451038814d4463230d2673457c2e337105458f84ce3d"
 
   url "https://github.com/Termix-SSH/Termix/releases/download/release-#{version}-tag/termix_macos_universal_dmg.dmg"
   name "Termix"

README.md

@@ -89,7 +89,7 @@ Local, remote, and dynamic SOCKS forwarding with auto reconnect and health check
 <td width="50%" valign="top">
 
 **File Manager:**
-Browse, edit, upload, download, rename, move, and delete files over SFTP, with sudo support. View and edit code, images, audio, and video. Copy files straight from one server to another, with the fastest route picked for you and transfers checked for integrity.
+Browse, edit, upload, download, rename, move, and delete files over SFTP, with sudo support. View and edit code, images, audio, and video. Copy files straight from one server to another in a dedicated transfer tab, with the fastest route picked for you and transfers checked for integrity. The desktop app also has a side-by-side local and remote view.
 
 </td>
 </tr>
@@ -111,7 +111,7 @@ Save and organize hosts with tags and nested folders you can name and color. Reu
 <td width="50%" valign="top">
 
 **Host Metrics:**
-CPU, memory, disk, network, temperature, uptime, processes, ports, logins, and system info on most Linux servers, with history graphs. Manager cards let you handle services, cron jobs, packages, users, firewall rules, WireGuard, Tailscale, SSL certs, logs, and health checks without leaving Termix.
+CPU, memory, disk, network, temperature, NVIDIA GPU, uptime, processes, ports, logins, and system info on most Linux servers, with history graphs. Manager cards let you handle services, cron jobs, packages, users, firewall rules, WireGuard, Tailscale, SSL certs, logs, and health checks without leaving Termix.
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Save a set of tabs with their split layout and reopen the whole thing in one cli
 </td>
 <td width="50%" valign="top">
 
-**Guided Setup:**
-A short setup walks you through picking an interface preset, your theme, the features you want, and your first host. Simple mode hides what you do not use, and you can rerun setup or switch presets any time.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop Standalone and Sync:**
-The desktop app runs on its own with a local backend and database, no server needed. You can also connect it to a Termix server for two-way sync of hosts, credentials, snippets, and more, and choose whether connections start locally or through the server.
-
-</td>
-<td width="50%" valign="top">
-
 **Command Line Interface:**
 A `termix` CLI for your shell and your scripts. Open terminals, run a command on one host or a whole fleet, move files over SFTP, and manage hosts, snippets, and credentials. Install with `npm install -g @termix-cli/cli` or grab a standalone binary. See the [CLI docs](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ A `termix` CLI for your shell and your scripts. Open terminals, run a command on
 <td width="50%" valign="top">
 
 **Security:**
-Passwords, keys, and other secrets are encrypted per user, and the database files themselves can be encrypted on disk. See the [docs](https://docs.termix.site/security) for how it works.
+Passwords, keys, and other secrets are encrypted per user, and the database files themselves can be encrypted on disk. See the [docs](https://docs.termix.site/features/authentication/security/) for how it works.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Around 30 languages built in, managed through [Crowdin](https://docs.termix.site
 - **Keyboard Shortcuts** - Move between tabs, close tabs, and more, all rebindable
 - **Wake-on-LAN** - Wake a machine from Termix or from an automation step
 - **Trusted Proxy Auth** - Let a reverse proxy handle sign-in and pass the user through
-- **SSH Feature Rich** - Jump hosts, Warpgate, TOTP prompts, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, and more
+- **White Label** - Admins can rebrand the instance with their own name, logo, and colors
+- **Web Endpoints** - Open a host's own web UI, like a router admin page, embedded inside Termix instead of a separate tab
+- **Collaboration Rooms** - Persistent rooms where a group can jump between sessions together, with a presenter stage and invites
+- **SSH Feature Rich** - Jump hosts, Warpgate, TOTP prompts, SOCKS5, host key verification, password autofill, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal logging, agent forwarding, Bitwarden SSH agent, HashiCorp Vault SSH signing, Step CA, 1Password Connect, and more
 - **Termix ID** - A built-in take on sshid.io. Claim a handle, publish your public keys at a resolver URL, and issue SSH certificates from the built-in CA
+- **Command History Autosuggestions** - Inline suggestions in the terminal as you type, based on your command history
+- **Desktop Standalone and Sync** - The desktop app runs on its own with a local backend and database, and can optionally sync with a Termix server
 
 </details>
 
@@ -376,9 +367,9 @@ You can run the Termix server on a VPS instead of inside your own network. If Te
 
 ## Telemetry
 
-Termix sends a small anonymous ping once a day so I can see how many instances are running and which features get used. It contains a random instance ID, how many users and hosts you have, the app version, and which features (terminal, file manager, tunnels, docker, etc.) were used in the last 24 hours. It never contains usernames, hostnames, IP addresses, credentials, or anything else that identifies you or your servers.
+Termix sends a small anonymous report once a day so I can see how many instances are running and which features get used. It contains a random instance ID, the app version, and how many users and hosts you have. It can also include your platform (OS, architecture, Node.js version, database type, and whether you run Docker, the desktop app or a plain server), how often each kind of tab was opened and how many SSH logins happened, and which built-in features are running. It never contains usernames, hostnames, IP addresses, credentials, or anything else that identifies you or your servers.
 
-It is on by default. Turn it off in Admin Settings under General, or set `ENABLE_TELEMETRY=false` before you ever start Termix.
+It is on by default. Turn it off, or choose what it includes, in Admin Settings under Usage Statistics, where you can also preview the exact report. Each user can leave out their own feature usage in their profile. Setting `ENABLE_TELEMETRY=false` turns it off and locks the switch.
 
 <br />
 
@@ -394,43 +385,52 @@ Termix is free and open source with no subscriptions or paid plans. If you find
 
 Interested in a paid placement to support development? Email [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Support

RELEASE_NOTES.md

@@ -1,6 +1,6 @@
 <!-- SUMMARY -->
 
-Credential cloning, a WSL local terminal, Helm and GitOps deployment, an editable file manager path bar, download progress bars, and a large batch of connection, sync, and remote desktop fixes.
+A new plugin system powering every feature, a dedicated sync page with more control over what syncs, one inbox for all alerts, a redesigned split screen, admin, user and folder host defaults, host maintenance mode, and a large batch of file manager, terminal, and remote desktop fixes.
 
 <!-- /SUMMARY -->
 
@@ -12,49 +12,90 @@ https://youtu.be/lngaePO96tM
 
 <!-- UPDATE_LOG -->
 
-- Added the ability to clone an existing credential
-- Added a WSL option for the local terminal
-- Added Helm charts and a GitOps deployment setup
-- Added an editable path bar to the file manager
-- Added a progress bar for file downloads in the file manager
-- Added an identity file option so agent authentication stops after the right key
-- Added an environment variable to turn on silent OIDC login
-- Added editable model settings for AI providers
-- Improved tmux monitor performance when aggregating sessions
-- Improved Linux packaging with standard icon sizes
+- Rebuilt Termix around a plugin system, with features like the terminal, file manager, tunnels, Docker, Proxmox, remote desktop, metrics, automations, AI and every login method now shipped as signed plugins on a shared SDK
+- Moved desktop sync to its own page in the sidebar, with options to choose what syncs, keep single hosts or folders on the device only, and resolve conflicts
+- Added a recent servers list when linking the desktop app
+- Combined all alerts into one inbox with popups, Termix announcements and a new email channel
+- Redesigned split screen with free-form panes and a pane picker
+- Redesigned host defaults so they can be set at the admin, user or folder level and are inherited by hosts unless overridden
+- Added per-host maintenance mode and recurring schedules to automations
+- Added optional auto reconnect for dropped SSH sessions and a button to reconnect all disconnected terminal tabs
+- Added a duplicate tab action and a reconnect session keybinding
+- Added a host click setting to either focus an existing tab or always open a new one
+- Added keyboard type-ahead search to the host list
+- Added tighter compact host rows with inline tags
+- Added an option to show tab numbers
+- Added an option to hide folder paths above nested folders
+- Added a list of the fixed app shortcuts to the keyboard shortcuts screen
+- Added terminal toolbar position, start state and fade settings per host
+- Added a host setting to turn off password prompt auto-fill
+- Added the option to apply a saved custom theme in connection defaults
+- Added FortiToken push 2FA support for SSH
+- Added a unified multi-host tmux monitor view and a per-host tmux mouse toggle
+- Added fleet sharing
+- Added a list view to Docker management and support for the OrbStack Docker socket on macOS
+- Added network graph sync between the desktop app and the server
+- Added homepage canvas layout sync across devices
+- Added RDP display zoom controls
+- Added an option to skip the move to trash confirmation in the file manager
+- Made the file manager open in the remote login directory by default
+- Added add host and copy IP actions for Tailscale devices
+- Added inline credential sharing in the sidebar, matching host sharing
+- Made the Windows desktop shortcut optional in the installer
+- Redesigned the snippets panel to match the host list
+- Redesigned the session log player controls
+- Host status now shows online once the port answers and only warns when a login fails
+- Faster SFTP downloads
+- Faster UI loading with less jitter and lag across tabs, the dashboard and the network graph
 
 <!-- /UPDATE_LOG -->
 
 <!-- BUG_FIXES -->
 
-- Passkey sign in not showing up on the login screen
-- Connections through jump hosts failing
-- Jump hosts and remote desktop hosts not resolving after a sync
-- Malformed websocket messages crashing the server
-- Encrypted file manager keys not prompting for a passphrase
-- SSH agent forwarding not working with the in-memory agent
-- Two factor prompts rejecting codes longer than six digits
-- OIDC lockout with no way to recover from environment settings
-- Tailscale requests failing on some setups
-- Terminal clipboard shortcuts not working on non-QWERTY layouts
-- Rapid mobile terminal input being sent one keystroke at a time
-- HTTPS not being able to share the configured port
-- Portable imports failing on remote databases
-- Host status not showing when metrics collection is off
-- Proxmox guest credential usernames being wrong
-- File drops not working for RDP in the browser
-- Duplicate Docker HTTPS listener on startup
-- Remote sync server probe ignoring the certificate setting
-- Runtime SSL settings not being preserved
-- Automation notifications missing host details
-- Connection screens crashing outside the connection log provider
-- better-sqlite3 failing in Docker on some platforms
-- Host action rows shifting at large font sizes
-- Sidebar height jumping when hosts or credentials have tags
-- Gaps between host rows in the sidebar list
-- Rounded corners on the host list search bar
-- Image storage settings text wrapping to one word per line
-- Unclear wording on the click-to-expand host setting
-- Dragging a folder into the file manager failing to upload
+- TOTP not being prompted for jump hosts in the terminal, file manager, metrics and client tunnels
+- SSH host names resolving to IPv6 when IPv4 was available
+- Host key updates not syncing between devices
+- Host metrics returning 404 on the first connect
+- Host metrics using too much CPU on the backend
+- Host metrics showing image and firmware filesystems
+- Sudo password not auto-filling
+- Tunnels failing with shared credentials
+- Imported jump host references breaking
+- Hard to read terminal selection with the light theme
+- Terminal input arriving out of order with local echo on
+- Terminal image uploads failing when the image library was unavailable
+- File manager saves failing or corrupting files, with no sudo prompt on protected files
+- Sending a single file between servers failing
+- Disk usage showing the wrong mount or not refreshing with the directory
+- File uploads not cancelling and continuing to write on the server
+- Ctrl/Cmd+F file search not working in the file manager
+- File drops from the OS not working over existing rows
+- No download progress in file viewers
+- Text in Markdown previews not being selectable
+- Inline rename, compact mode and narrow list layout issues in the file manager
+- Remote desktop not using the host's saved guacd endpoint
+- Remote desktop asking for clipboard access unprompted
+- Remote desktop keys staying held after switching windows
+- Session share links on desktop pointing at the local app instead of the server
+- Shared terminal sizes and participant presence not syncing in session sharing
+- Meeting guests not being shown to members, and guests seeing the full roster
+- Session sharing not handing over cleanly after a takeover
+- AI responses getting cut off mid stream
+- AI provider settings not syncing to linked devices
+- Proxmox guest sync and startup snippet sync not working
+- LDAP logins losing the bind DN from the directory
+- Homepage service checks failing for allowed private addresses
+- Sidebar search showing overlapping hosts when grouped by tags
+- Sidebar rows not resizing after changing density, and compact rows hiding host addresses
+- Split screen layouts failing to create over plain HTTP
+- Double Shift opening the command palette by accident
+- Fleet detail buttons overflowing the sidebar
+- Recent activity cutting off host names too early
+- Docker container logs using the wrong background color
+- Version number missing on desktop when the server was offline
+- Desktop app not starting reliably, not quitting with active connections, and the Linux tray icon failing to load
+- Mac App Store builds being blocked by the single instance lock
+- Untranslated text in toasts and other parts of the UI
+- Several dependency security advisories
 
 <!-- /BUG_FIXES -->

SECURITY.md

@@ -3,3 +3,21 @@
 ## Reporting a Vulnerability
 
 Please report any vulnerabilities to [GitHub Security](https://github.com/Termix-SSH/Termix/security/advisories).
+
+## External secret storage
+
+By default, a single-container installation generates its keys in the Termix
+data directory for ease of recovery. Production deployments that keep backups
+or database files outside a trusted encrypted volume should set
+`TERMIX_REQUIRE_EXTERNAL_SECRETS=true` and provide all four keys through a
+secret manager:
+
+- `JWT_SECRET` (at least 64 characters)
+- `DATABASE_KEY` (64 hexadecimal characters)
+- `ENCRYPTION_KEY` (64 hexadecimal characters)
+- `INTERNAL_AUTH_TOKEN` (at least 32 characters)
+
+Each value can instead be mounted as a Docker or Kubernetes secret and supplied
+with its corresponding `_FILE` variable, such as `ENCRYPTION_KEY_FILE`.
+Hardened mode fails closed instead of writing a replacement key beside the
+encrypted database.

charts/termix/values.yaml

@@ -75,6 +75,7 @@ env:
   PORT: "8080"
   DATA_DIR: /app/data
   NODE_ENV: production
+  TERMIX_REQUIRE_EXTERNAL_SECRETS: "false"
   GUACD_RECORDING_PATH: /termix-data/session_recordings/guacamole
   GUACD_RECORDING_BACKEND_PATH: /app/data/session_recordings/guacamole
 
@@ -86,6 +87,9 @@ secrets:
   name: ""
   data:
     JWT_SECRET: ""
+    DATABASE_KEY: ""
+    ENCRYPTION_KEY: ""
+    INTERNAL_AUTH_TOKEN: ""
     DATABASE_URL: ""
     GUACAMOLE_ENCRYPTION_KEY: ""
 

crowdin.yml

@@ -1,6 +1,11 @@
 project_id: "858252"
 api_token: "env:CROWDIN_API_TOKEN"
+preserve_hierarchy: true
 
 files:
+  # Core has always lived at /en.json in Crowdin; moving it would orphan its translations.
   - source: /src/ui/locales/en.json
+    dest: /en.json
     translation: /src/ui/locales/translated/%locale_with_underscore%.json
+  - source: /plugins/*/locales/en.json
+    translation: /%original_path%/translated/%locale_with_underscore%.json

deploy/argocd/application-traefik.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: termix-traefik
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/Termix-SSH/Termix.git
-    targetRevision: main
-    path: charts/termix
-    helm:
-      releaseName: termix
-      valueFiles:
-        - values-traefik.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: termix
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - PruneLast=true

deploy/argocd/application.yaml

@@ -1,25 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: termix
-  namespace: argocd
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/Termix-SSH/Termix.git
-    targetRevision: main
-    path: charts/termix
-    helm:
-      releaseName: termix
-      valueFiles:
-        - values-gitops-example.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: termix
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-      - PruneLast=true

deploy/gitlab/.gitlab-ci.yml

@@ -1,70 +0,0 @@
-stages:
-  - test
-  - build
-  - package
-  - deploy
-
-variables:
-  DOCKER_TLS_CERTDIR: "/certs"
-  IMAGE_TAG: "$CI_COMMIT_SHORT_SHA"
-  HELM_EXPERIMENTAL_OCI: "1"
-
-helm-lint:
-  image:
-    name: alpine/helm:3.15.4
-    entrypoint: [""]
-  stage: test
-  script:
-    - helm lint charts/termix
-    - helm template termix charts/termix --values charts/termix/values-gitops-example.yaml >/tmp/termix.yaml
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH
-
-docker-build-push:
-  image: docker:27
-  stage: build
-  services:
-    - docker:27-dind
-  before_script:
-    - echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
-  script:
-    - docker build -f docker/Dockerfile -t "$CI_REGISTRY_IMAGE:$IMAGE_TAG" -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG" .
-    - docker push "$CI_REGISTRY_IMAGE:$IMAGE_TAG"
-    - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG"
-  rules:
-    - if: $CI_COMMIT_BRANCH
-
-helm-package-push:
-  image:
-    name: alpine/helm:3.15.4
-    entrypoint: [""]
-  stage: package
-  before_script:
-    - echo "$CI_REGISTRY_PASSWORD" | helm registry login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
-  script:
-    - helm dependency update charts/termix
-    - helm package charts/termix --destination .helm-packages
-    - helm push .helm-packages/termix-*.tgz "oci://$CI_REGISTRY_IMAGE/charts"
-  artifacts:
-    paths:
-      - .helm-packages/
-  rules:
-    - if: $CI_COMMIT_TAG
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-
-deploy:
-  image:
-    name: alpine/helm:3.15.4
-    entrypoint: [""]
-  stage: deploy
-  environment:
-    name: production
-  before_script:
-    - echo "$KUBE_CONFIG" | base64 -d > kubeconfig
-    - chmod 600 kubeconfig
-  script:
-    - helm upgrade --install termix charts/termix --namespace termix --create-namespace --kubeconfig kubeconfig --set image.repository="$CI_REGISTRY_IMAGE" --set image.tag="$IMAGE_TAG" --values charts/termix/values-gitops-example.yaml --atomic --timeout 10m
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      when: manual

docker/Dockerfile

@@ -1,17 +1,28 @@
+# Stage 0: every plugin's package.json and manifest.json and nothing else.
+# npm ci needs each workspace package.json in place or it silently skips it,
+# and a glob COPY flattens paths, so the tree is trimmed here instead. The
+# deps layer below stays cached until one of these files changes.
+FROM node:26-slim AS workspace-manifests
+WORKDIR /src
+COPY plugins ./plugins
+RUN find plugins -mindepth 2 -maxdepth 2 ! -name package.json ! -name manifest.json -exec rm -rf {} +
+
 # Stage 1: Install dependencies
-FROM node:24-slim AS deps
+FROM node:26-slim AS deps
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
+COPY packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
+COPY --from=workspace-manifests /src/plugins ./plugins
 COPY .npmrc ./
 COPY vendor ./vendor
 
-COPY scripts/patch-guacamole-lite.cjs ./scripts/
+COPY scripts/patch-ssh2-agent.cjs ./scripts/
 
 RUN npm ci --ignore-scripts && \
-    node scripts/patch-guacamole-lite.cjs && \
+    node scripts/patch-ssh2-agent.cjs && \
     npm cache clean --force
 
 # Stage 2: Build frontend
@@ -38,37 +49,49 @@ RUN rm -rf node_modules/better-sqlite3/prebuilds && \
 RUN npm run build:backend
 
 # Stage 4: Download OPKSSH binary for the target platform so the image works offline
-FROM node:24-slim AS opkssh-downloader
+FROM node:26-slim AS opkssh-downloader
 ARG TARGETARCH
 ARG OPKSSH_VERSION=v0.16.0
+ARG OPKSSH_SHA256_AMD64=c018c3e7baf98612b923e742dd87be38650bf61e3b755fb2bc90de177568b1bf
+ARG OPKSSH_SHA256_ARM64=9dd10c2b6ce99cde18e52c054877ca014134b291fd82afe71741c68db4f83d44
 WORKDIR /opkssh
 
 RUN apt-get update && apt-get install -y curl ca-certificates && rm -rf /var/lib/apt/lists/*
 
 RUN case "$TARGETARCH" in \
-      amd64) OPKSSH_ARCH=amd64 ;; \
-      arm64) OPKSSH_ARCH=arm64 ;; \
+      amd64) OPKSSH_ARCH=amd64; OPKSSH_SHA256="$OPKSSH_SHA256_AMD64" ;; \
+      arm64) OPKSSH_ARCH=arm64; OPKSSH_SHA256="$OPKSSH_SHA256_ARM64" ;; \
       *) echo "Unsupported architecture: $TARGETARCH" && exit 1 ;; \
     esac && \
     curl -fSL -o "opkssh-linux-${OPKSSH_ARCH}" \
       "https://github.com/openpubkey/opkssh/releases/download/${OPKSSH_VERSION}/opkssh-linux-${OPKSSH_ARCH}" && \
+    echo "$OPKSSH_SHA256  opkssh-linux-${OPKSSH_ARCH}" | sha256sum -c - && \
     chmod 755 "opkssh-linux-${OPKSSH_ARCH}" && \
     echo -n "$OPKSSH_VERSION" > version.txt
 
 # Stage 5: Production dependencies only
-FROM node:24-slim AS production-deps
+FROM node:26-slim AS production-deps
 WORKDIR /app
 
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
 COPY package*.json ./
+# The plugin SDK is a workspace package core imports at runtime, so npm ci
+# has to see it to link it and install its dependencies.
+COPY packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
 COPY .npmrc ./
 COPY vendor ./vendor
 
-COPY scripts/patch-guacamole-lite.cjs ./scripts/
+COPY scripts/patch-ssh2-agent.cjs scripts/install-native-plugin-deps.cjs ./scripts/
+# Plugin manifests only, for their nativeDependencies. Outside plugins/ so npm
+# ci does not treat them as workspaces: everything else a plugin uses is
+# already inside its bundle.
+COPY --from=workspace-manifests /src/plugins ./plugin-manifests
 
 RUN npm ci --omit=dev --ignore-scripts && \
-    node scripts/patch-guacamole-lite.cjs && \
+    node scripts/install-native-plugin-deps.cjs plugin-manifests && \
+    rm -rf plugin-manifests && \
+    node scripts/patch-ssh2-agent.cjs && \
     rm -rf node_modules/better-sqlite3/prebuilds && \
     npm run build-release --prefix node_modules/better-sqlite3 && \
     test -f node_modules/better-sqlite3/build/Release/better_sqlite3.node && \
@@ -76,20 +99,29 @@ RUN npm ci --omit=dev --ignore-scripts && \
     npm cache clean --force
 
 # Stage 6: Final optimized image
-FROM node:24-slim
+FROM node:26-slim
 WORKDIR /app
 
-ENV DATA_DIR=/app/data \
-    PORT=8080 \
-    NODE_ENV=production \
-    POSTHOG_API_KEY=phc_xM8UznirsFxUkGE68gH4jzeqevf4kh76wGw7Ci7hH2dd
+# The release the opkssh-downloader stage baked in, so the plugin trusts that
+# binary when the build picks a version other than its pinned one.
+ARG OPKSSH_VERSION=v0.16.0
+ARG OPKSSH_SHA256_AMD64=c018c3e7baf98612b923e742dd87be38650bf61e3b755fb2bc90de177568b1bf
+ARG OPKSSH_SHA256_ARM64=9dd10c2b6ce99cde18e52c054877ca014134b291fd82afe71741c68db4f83d44
 
-RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu wget certbot python3-certbot-dns-cloudflare && \
+ENV DATA_DIR=/app/data \
+    OPKSSH_BUNDLED_DIR=/app/opkssh-bundled \
+    OPKSSH_VERSION=$OPKSSH_VERSION \
+    OPKSSH_SHA256_AMD64=$OPKSSH_SHA256_AMD64 \
+    OPKSSH_SHA256_ARM64=$OPKSSH_SHA256_ARM64 \
+    PORT=8080 \
+    NODE_ENV=production
+
+RUN apt-get update && apt-get install -y nginx gettext-base openssl ca-certificates gosu wget && \
     update-ca-certificates && \
     rm -rf /var/lib/apt/lists/* && \
-    mkdir -p /app/data /app/uploads /app/data/.opk /app/nginx /tmp/nginx && \
+    mkdir -p /app/data /app/uploads /app/nginx /tmp/nginx && \
     chown -R node:node /app /tmp/nginx && \
-    chmod 755 /app/data /app/uploads /app/data/.opk /app/nginx /tmp/nginx
+    chmod 755 /app/data /app/uploads /app/nginx /tmp/nginx
 
 COPY docker/nginx.conf /app/nginx/nginx.conf.template
 COPY docker/nginx-https.conf /app/nginx/nginx-https.conf.template
@@ -98,6 +130,14 @@ COPY --chown=node:node --from=frontend-builder /app/dist /app/html
 
 COPY --chown=node:node --from=production-deps /app/node_modules /app/node_modules
 COPY --chown=node:node --from=backend-builder /app/dist/backend ./dist/backend
+# Bundled first-party plugins, resolved as dist/plugins by
+# getBundledPluginsDir().
+COPY --chown=node:node --from=backend-builder /app/dist/plugins ./dist/plugins
+# Target of node_modules/@termix/plugin-sdk, which core and the plugins import.
+COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/package.json ./packages/plugin-sdk/package.json
+COPY --chown=node:node --from=backend-builder /app/packages/plugin-sdk/dist ./packages/plugin-sdk/dist
+# Pre-baked OPKSSH binary. The opkssh plugin uses it when its checksum
+# matches, so an offline install never downloads one.
 COPY --chown=node:node --from=opkssh-downloader /opkssh /app/opkssh-bundled
 COPY --chown=node:node package.json ./
 # Schema for Postgres and MySQL. Unused by the default SQLite deployment, which
@@ -106,7 +146,7 @@ COPY --chown=node:node drizzle ./drizzle
 
 VOLUME ["/app/data"]
 
-EXPOSE ${PORT} 30001 30002 30003 30004 30005 30006 30007 30008 30009 30010 30011 30012
+EXPOSE ${PORT}
 
 HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
     CMD wget -q -O /dev/null http://localhost:30001/health || exit 1

docker/bundled-plugins.json

@@ -0,0 +1,140 @@
+{
+  "plugins": [
+    {
+      "id": "acme-ssl",
+      "source": "workspace"
+    },
+    {
+      "id": "ai",
+      "source": "workspace"
+    },
+    {
+      "id": "alerts",
+      "source": "workspace"
+    },
+    {
+      "id": "automations",
+      "source": "workspace"
+    },
+    {
+      "id": "docker",
+      "source": "workspace"
+    },
+    {
+      "id": "file-manager",
+      "source": "workspace"
+    },
+    {
+      "id": "fleets",
+      "source": "workspace"
+    },
+    {
+      "id": "homepage",
+      "source": "workspace"
+    },
+    {
+      "id": "host-metrics",
+      "source": "workspace"
+    },
+    {
+      "id": "ldap",
+      "source": "workspace"
+    },
+    {
+      "id": "network-topology",
+      "source": "workspace"
+    },
+    {
+      "id": "opkssh",
+      "source": "workspace"
+    },
+    {
+      "id": "proxmox",
+      "source": "workspace"
+    },
+    {
+      "id": "remote-desktop",
+      "source": "workspace"
+    },
+    {
+      "id": "secret-sources",
+      "source": "workspace"
+    },
+    {
+      "id": "serial",
+      "source": "workspace"
+    },
+    {
+      "id": "session-recording",
+      "source": "workspace"
+    },
+    {
+      "id": "session-sharing",
+      "source": "workspace"
+    },
+    {
+      "id": "snippets",
+      "source": "workspace"
+    },
+    {
+      "id": "ssh-terminal",
+      "source": "workspace"
+    },
+    {
+      "id": "sso",
+      "source": "workspace"
+    },
+    {
+      "id": "step-ca",
+      "source": "workspace"
+    },
+    {
+      "id": "tailscale",
+      "source": "workspace"
+    },
+    {
+      "id": "telemetry",
+      "source": "workspace"
+    },
+    {
+      "id": "termix-identity",
+      "source": "workspace"
+    },
+    {
+      "id": "tmux-monitor",
+      "source": "workspace"
+    },
+    {
+      "id": "totp",
+      "source": "workspace"
+    },
+    {
+      "id": "tunnels",
+      "source": "workspace"
+    },
+    {
+      "id": "vault",
+      "source": "workspace"
+    },
+    {
+      "id": "wake-on-lan",
+      "source": "workspace"
+    },
+    {
+      "id": "warpgate",
+      "source": "workspace"
+    },
+    {
+      "id": "web-endpoint",
+      "source": "workspace"
+    },
+    {
+      "id": "webauthn",
+      "source": "workspace"
+    },
+    {
+      "id": "workspaces",
+      "source": "workspace"
+    }
+  ]
+}

docker/compose-dev.yml

@@ -15,6 +15,10 @@ services:
       GUACD_HOST: "guacd-dev"
       GUACD_TUNNEL_HOST: "termix-dev"
       GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
+      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
+      # REDIS_URL: "redis://redis:6379"
+      # TERMIX_REDIS_PREFIX: "termix:collab"
+      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
     depends_on:
       - guacd-dev
     networks:

docker/docker-compose.yml

@@ -12,6 +12,19 @@ services:
       GUACD_HOST: "guacd"
       GUACD_TUNNEL_HOST: "termix"
       GUACD_RECORDING_PATH: "/termix-data/session_recordings/guacamole"
+      # Where guacd stores files for RDP drive redirection (one folder per
+      # user is created underneath). Must be writable by guacd's user.
+      GUACD_DRIVE_PATH: "/termix-data/rdp-drive"
+      # Multi-instance deployments should point every backend at the same
+      # Redis. Without it, collaboration rooms keep their single-instance
+      # in-memory fallback.
+      # REDIS_URL: "redis://redis:6379"
+      # TERMIX_REDIS_PREFIX: "termix:collab"
+      # TERMIX_STEP_CA_REDIS_PREFIX: "termix:step-ca"
+      # Hardened deployments can require keys from environment variables or
+      # Docker secrets mounted through JWT_SECRET_FILE, DATABASE_KEY_FILE,
+      # ENCRYPTION_KEY_FILE and INTERNAL_AUTH_TOKEN_FILE.
+      # TERMIX_REQUIRE_EXTERNAL_SECRETS: "true"
       # Trusted reverse-proxy authentication is disabled by default. When
       # enabled, do not expose this container directly to untrusted clients.
       # TRUSTED_PROXY_AUTH_ENABLED: "true"

docker/entrypoint.sh

@@ -73,31 +73,16 @@ if [ "$ENABLE_SSL" = "true" ] && [ "$PORT" = "$SSL_PORT" ]; then
     sed -i '/# BEGIN HTTP_REDIRECT_SERVER/,/# END HTTP_REDIRECT_SERVER/d' /tmp/nginx/nginx.conf
 fi
 
-mkdir -p /app/data /app/uploads /app/data/.opk /app/data/acme-webroot/.well-known/acme-challenge
-chmod 755 /app/data /app/uploads /app/data/.opk 2>/dev/null || true
+mkdir -p /app/data /app/uploads
+chmod 755 /app/data /app/uploads 2>/dev/null || true
 
 if [ -w /app/data ]; then
     echo "Data directory is writable"
 else
-    echo "WARNING: Data directory is not writable. OPKSSH may fail."
+    echo "WARNING: Data directory is not writable. Plugins that keep files (OPKSSH, recordings) may fail."
     ls -ld /app/data
 fi
 
-if [ -w /app/data/.opk ]; then
-    echo "OPKSSH directory is writable"
-else
-    echo "WARNING: OPKSSH directory is not writable. OPKSSH authentication will fail."
-    ls -ld /app/data/.opk
-fi
-
-OPKSSH_DIR="${DATA_DIR:-/app/data}/opkssh"
-if [ ! -d "$OPKSSH_DIR" ]; then
-    echo "OPKSSH binary directory not found at $OPKSSH_DIR"
-    echo "OPKSSH will be installed from the bundled copy on first use (falls back to downloading if unavailable)."
-else
-    echo "OPKSSH binary directory found at $OPKSSH_DIR"
-fi
-
 if [ "$ENABLE_SSL" = "true" ]; then
     echo "Checking SSL certificate configuration..."
     mkdir -p /app/data/ssl
@@ -111,8 +96,16 @@ if [ "$ENABLE_SSL" = "true" ]; then
         if openssl x509 -in /app/data/ssl/termix.crt -checkend 2592000 -noout >/dev/null 2>&1; then
             echo "SSL certificates are valid and will be reused for domain: $DOMAIN"
         else
-            echo "SSL certificate is expired or expiring soon, regenerating..."
-            rm -f /app/data/ssl/termix.crt /app/data/ssl/termix.key
+            SUBJECT=$(openssl x509 -in /app/data/ssl/termix.crt -noout -subject 2>/dev/null | sed 's/^subject=//')
+            ISSUER=$(openssl x509 -in /app/data/ssl/termix.crt -noout -issuer 2>/dev/null | sed 's/^issuer=//')
+            # Only replace our own self-signed certificate. A CA-issued one is
+            # kept until it expires, even when nothing renews it.
+            if [ -n "$SUBJECT" ] && [ "$SUBJECT" = "$ISSUER" ]; then
+                echo "Self-signed SSL certificate is expired or expiring soon, regenerating..."
+                rm -f /app/data/ssl/termix.crt /app/data/ssl/termix.key
+            else
+                echo "WARNING: SSL certificate expires within 30 days and was not issued by Termix. Renew it."
+            fi
         fi
     else
         echo "SSL certificates not found, will generate new ones..."
@@ -172,7 +165,14 @@ if [ -n "$BASE_PATH" ]; then
     echo "Injecting BASE_PATH: $BASE_PATH"
     # Strip trailing slash for use as a path prefix
     CLEAN_BASE_PATH="${BASE_PATH%/}"
-    find /app/html -name "index.html" -exec sed -i "s|window.__TERMIX_BASE_PATH__ = \"\"|window.__TERMIX_BASE_PATH__ = \"$CLEAN_BASE_PATH\"|g" {} \;
+    case "$CLEAN_BASE_PATH" in
+        /*) ;;
+        *) echo "BASE_PATH must start with /" >&2; exit 1 ;;
+    esac
+    case "$CLEAN_BASE_PATH" in
+        *[!A-Za-z0-9_./~-]*) echo "BASE_PATH contains unsupported characters" >&2; exit 1 ;;
+    esac
+    find /app/html -name "index.html" -exec sed -i "s|name=\"termix-base-path\" content=\"\"|name=\"termix-base-path\" content=\"$CLEAN_BASE_PATH\"|g" {} \;
     # Patch sw.js static asset paths with the base path prefix
     find /app/html -name "sw.js" -exec sed -i "s|__TERMIX_SW_BASE_PATH__|$CLEAN_BASE_PATH|g" {} \;
 else

docker/nginx-https.conf

@@ -74,7 +74,18 @@ http {
         listen ${PORT};
         server_name _;
 
-        return 301 https://$host:${SSL_PORT}$request_uri;
+        # ACME http-01 checks arrive on plain HTTP and must not be redirected.
+        location ^~ /.well-known/acme-challenge/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        }
+
+        location / {
+            return 301 https://$host:${SSL_PORT}$request_uri;
+        }
     }
     # END HTTP_REDIRECT_SERVER
 
@@ -92,9 +103,11 @@ http {
         add_header X-Content-Type-Options nosniff always;
 
         location ^~ /.well-known/acme-challenge/ {
-            root /app/data/acme-webroot;
-            default_type "text/plain";
-            try_files $uri =404;
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
 
         location = /sw.js {
@@ -161,6 +174,10 @@ http {
             root /app/html;
             index index.html index.htm;
             expires off;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-gQLhWUEDVfLtBiv83VAckuSAVmhxOpOHbNpFbODgPN0='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; connect-src 'self' http: https: ws: wss:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; frame-src http: https:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
             add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
             add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
@@ -205,66 +222,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/alerts(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/ai(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            # The chat endpoint streams server-sent events; buffering would
-            # hold tokens back until the whole reply finished.
-            proxy_read_timeout 600s;
-            proxy_buffering off;
-            proxy_cache off;
-        }
-
-        location ~ ^/automations(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-rules(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/notification-channels(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-firings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/rbac(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -287,31 +244,7 @@ http {
             proxy_read_timeout 300s;
         }
 
-        location ~ ^/snippets(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/fleets(/.*)?$ {
-            client_max_body_size 200m;
-
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/vault(/.*)?$ {
+        location ~ ^/ssh-auth(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -329,36 +262,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/termix-id(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
-
-        location ~ ^/proxmox(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 120s;
-            proxy_read_timeout 120s;
-        }
-
-        location ~ ^/c2s-tunnel-presets(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/audit-logs(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -368,7 +271,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/terminal(/.*)?$ {
+        location ~ ^/plugins(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -377,6 +280,93 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
+        # Plugin frontend bundles, stylesheets and locales. Public like
+        # /assets; the backend picks the cache policy from the ?v= query.
+        location ^~ /plugin-assets/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        # 2.8 URLs that something outside Termix still calls: the Vault OIDC
+        # callback, the Termix ID resolver and automation webhooks. The
+        # backend redirects each to the plugin that serves it now (see
+        # contributes.http in each plugin's manifest). New plugins never add
+        # a block here.
+        location = /vault/oidc/callback {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ^~ /termix-id/u/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ^~ /automations/webhook/ {
+            rewrite ^/automations/webhook/(.*)$ /plugin-api/automations/webhook/$1 last;
+        }
+
+        # Every plugin's HTTP routes. One block, no per-plugin entries: a
+        # plugin serves at /plugin-api/<id>/ on the main backend and never
+        # gets a port or a block of its own. Buffering is off so SSE streams
+        # (AI, Proxmox discovery) reach the browser as they are produced, and
+        # request buffering is off so large uploads stream through.
+        location ^~ /plugin-api/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            client_max_body_size 0;
+        }
+
+        # Every plugin's WebSockets: terminal, Guacamole display, Docker
+        # console. Served at /plugin-ws/<id>/<path> from the same backend.
+        location ^~ /plugin-ws/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+        }
+
         location ~ ^/open-tabs(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -386,15 +376,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/workspaces(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/user-preferences(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -450,25 +431,6 @@ http {
             proxy_buffering off;
         }
 
-        location ~ ^/db(/.*)?$ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
         location ~ ^/encryption(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -490,40 +452,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/host/opkssh-chooser(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-chooser$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-            add_header X-Content-Type-Options nosniff always;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
-        }
-
-        location ~ ^/host/opkssh-callback(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-callback$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-            add_header X-Content-Type-Options nosniff always;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
-        }
-
         location /host/ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -533,206 +461,10 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location /session_logs/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /tailscale/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/websocket/ {
-            proxy_pass http://127.0.0.1:30002/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ^~ /guacamole/websocket/ {
-            proxy_pass http://127.0.0.1:30008/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ~ ^/guacamole(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/session-sharing(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
-            proxy_cache off;
-        }
-
-        location /host/file_manager/recent {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/pinned {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/shortcuts {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/sudo-password {
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/file_manager/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-            add_header X-Content-Type-Options nosniff always;
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location /host/file_manager/ssh/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
-            add_header X-Content-Type-Options nosniff always;
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location ~ ^/network-topology(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
+        # File manager routes (recent/pinned/shortcuts, SFTP, transfers) moved
+        # to the file-manager plugin, served under /plugin-api/file-manager/.
+        # Session logs moved to the session-recording plugin, served under
+        # /plugin-api/session-recording/.
 
         location /health {
             proxy_pass http://127.0.0.1:30001;
@@ -743,8 +475,11 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/status(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
+        # Service links and the homepage widget canvas moved to the homepage
+        # plugin, served under /plugin-api/homepage/.
+
+        location /dashboard/ {
+            proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -752,173 +487,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 60s;
-            proxy_read_timeout 60s;
-        }
-
-        location ~ ^/(refresh|host-updated)$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/host-metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 600s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/proxmox-stats(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 600s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/global-settings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/uptime(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/activity(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/service-links(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/homepage(/.*)?$ {
-            proxy_pass http://127.0.0.1:30012;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ^~ /docker/console/ {
-            proxy_pass http://127.0.0.1:30009/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        # --- tmux-monitor begin ---
-        location ~ ^/tmux_monitor(/.*)?$ {
-            proxy_pass http://127.0.0.1:30010;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-        # --- tmux-monitor end ---
-
-        location ~ ^/docker(/.*)?$ {
-            proxy_pass http://127.0.0.1:30007;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-
-        location ^~ /serial/websocket/ {
-            proxy_pass http://127.0.0.1:30011/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-        }
-
         error_page 500 502 503 504 /50x.html;
         location = /50x.html {
             root /app/html;

docker/nginx.conf

@@ -79,9 +79,11 @@ http {
         add_header X-Content-Type-Options nosniff always;
 
         location ^~ /.well-known/acme-challenge/ {
-            root /app/data/acme-webroot;
-            default_type "text/plain";
-            try_files $uri =404;
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         }
 
         location = /sw.js {
@@ -142,6 +144,10 @@ http {
             root /app/html;
             index index.html index.htm;
             expires off;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval' 'sha256-gQLhWUEDVfLtBiv83VAckuSAVmhxOpOHbNpFbODgPN0='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; connect-src 'self' http: https: ws: wss:; media-src 'self' data: blob: http: https:; worker-src 'self' blob:; frame-src http: https:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+            add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+            add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
             add_header X-Content-Type-Options nosniff always;
             add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
             try_files $uri $uri/ /index.html;
@@ -185,66 +191,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/alerts(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/ai(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            # The chat endpoint streams server-sent events; buffering would
-            # hold tokens back until the whole reply finished.
-            proxy_read_timeout 600s;
-            proxy_buffering off;
-            proxy_cache off;
-        }
-
-        location ~ ^/automations(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-rules(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/notification-channels(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/alert-firings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/rbac(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -267,31 +213,7 @@ http {
             proxy_read_timeout 300s;
         }
 
-        location ~ ^/snippets(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/fleets(/.*)?$ {
-            client_max_body_size 200m;
-
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/vault(/.*)?$ {
+        location ~ ^/ssh-auth(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -309,36 +231,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/termix-id(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
-
-        location ~ ^/proxmox(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 120s;
-            proxy_read_timeout 120s;
-        }
-
-        location ~ ^/c2s-tunnel-presets(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/audit-logs(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -348,7 +240,7 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/terminal(/.*)?$ {
+        location ~ ^/plugins(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
@@ -357,6 +249,93 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
+        # Plugin frontend bundles, stylesheets and locales. Public like
+        # /assets; the backend picks the cache policy from the ?v= query.
+        location ^~ /plugin-assets/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        # 2.8 URLs that something outside Termix still calls: the Vault OIDC
+        # callback, the Termix ID resolver and automation webhooks. The
+        # backend redirects each to the plugin that serves it now (see
+        # contributes.http in each plugin's manifest). New plugins never add
+        # a block here.
+        location = /vault/oidc/callback {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+        }
+
+        location ^~ /termix-id/u/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+
+        location ^~ /automations/webhook/ {
+            rewrite ^/automations/webhook/(.*)$ /plugin-api/automations/webhook/$1 last;
+        }
+
+        # Every plugin's HTTP routes. One block, no per-plugin entries: a
+        # plugin serves at /plugin-api/<id>/ on the main backend and never
+        # gets a port or a block of its own. Buffering is off so SSE streams
+        # (AI, Proxmox discovery) reach the browser as they are produced, and
+        # request buffering is off so large uploads stream through.
+        location ^~ /plugin-api/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            client_max_body_size 0;
+        }
+
+        # Every plugin's WebSockets: terminal, Guacamole display, Docker
+        # console. Served at /plugin-ws/<id>/<path> from the same backend.
+        location ^~ /plugin-ws/ {
+            proxy_pass http://127.0.0.1:30001;
+            proxy_http_version 1.1;
+
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+            proxy_set_header Host $http_host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
+            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
+            proxy_cache_bypass $http_upgrade;
+
+            proxy_read_timeout 86400s;
+            proxy_send_timeout 86400s;
+            proxy_connect_timeout 10s;
+
+            proxy_buffering off;
+            proxy_request_buffering off;
+
+            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
+        }
+
         location ~ ^/open-tabs(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -366,15 +345,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/workspaces(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
         location ~ ^/user-preferences(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -430,25 +400,6 @@ http {
             proxy_buffering off;
         }
 
-        location ~ ^/db(/.*)?$ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
         location ~ ^/encryption(/.*)?$ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -470,38 +421,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/host/opkssh-chooser(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-chooser$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header X-Content-Type-Options nosniff always;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
-        }
-
-        location ~ ^/host/opkssh-callback(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001/host/opkssh-callback$1$is_args$args;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_cache_bypass 1;
-            proxy_no_cache 1;
-            add_header X-Content-Type-Options nosniff always;
-            add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0" always;
-        }
-
         location /host/ {
             proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
@@ -511,204 +430,10 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location /session_logs/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /tailscale/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/websocket/ {
-            proxy_pass http://127.0.0.1:30002/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ^~ /guacamole/websocket/ {
-            proxy_pass http://127.0.0.1:30008/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        location ~ ^/guacamole(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/session-sharing(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/tunnel/ {
-            proxy_pass http://127.0.0.1:30003;
-            proxy_http_version 1.1;
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_buffering off;
-            proxy_cache off;
-        }
-
-        location /host/file_manager/recent {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/pinned {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/shortcuts {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /host/file_manager/sudo-password {
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location /ssh/file_manager/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header X-Content-Type-Options nosniff always;
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location /host/file_manager/ssh/ {
-            client_max_body_size 5G;
-            client_body_timeout 300s;
-
-            add_header X-Content-Type-Options nosniff always;
-            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
-
-            proxy_pass http://127.0.0.1:30004;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-
-            proxy_request_buffering off;
-            proxy_buffering off;
-        }
-
-        location ~ ^/network-topology(/.*)?$ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
+        # File manager routes (recent/pinned/shortcuts, SFTP, transfers) moved
+        # to the file-manager plugin, served under /plugin-api/file-manager/.
+        # Session logs moved to the session-recording plugin, served under
+        # /plugin-api/session-recording/.
 
         location /health {
             proxy_pass http://127.0.0.1:30001;
@@ -719,8 +444,11 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/status(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
+        # Service links and the homepage widget canvas moved to the homepage
+        # plugin, served under /plugin-api/homepage/.
+
+        location /dashboard/ {
+            proxy_pass http://127.0.0.1:30001;
             proxy_http_version 1.1;
             proxy_set_header Host $http_host;
             proxy_set_header X-Real-IP $remote_addr;
@@ -728,173 +456,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        location ~ ^/metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 60s;
-            proxy_read_timeout 60s;
-        }
-
-        location ~ ^/(refresh|host-updated)$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/host-metrics(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 600s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/proxmox-stats(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 600s;
-            proxy_send_timeout 600s;
-            proxy_read_timeout 600s;
-        }
-
-        location ~ ^/global-settings(/.*)?$ {
-            proxy_pass http://127.0.0.1:30005;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/uptime(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/activity(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/service-links(/.*)?$ {
-            proxy_pass http://127.0.0.1:30006;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ~ ^/homepage(/.*)?$ {
-            proxy_pass http://127.0.0.1:30012;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ^~ /docker/console/ {
-            proxy_pass http://127.0.0.1:30009/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-            proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
-            proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-
-            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
-        }
-
-        # --- tmux-monitor begin ---
-        location ~ ^/tmux_monitor(/.*)?$ {
-            proxy_pass http://127.0.0.1:30010;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-        # --- tmux-monitor end ---
-
-        location ~ ^/docker(/.*)?$ {
-            proxy_pass http://127.0.0.1:30007;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_connect_timeout 60s;
-            proxy_send_timeout 300s;
-            proxy_read_timeout 300s;
-        }
-
-        location ^~ /serial/websocket/ {
-            proxy_pass http://127.0.0.1:30011/;
-            proxy_http_version 1.1;
-
-            proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
-            proxy_set_header Host $http_host;
-            proxy_cache_bypass $http_upgrade;
-
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            proxy_connect_timeout 10s;
-
-            proxy_buffering off;
-            proxy_request_buffering off;
-        }
-
         error_page 500 502 503 504 /50x.html;
         location = /50x.html {
             root /app/html;

docs/readme/README-AR.md

@@ -237,7 +237,7 @@ RDP وVNC وTelnet داخل المتصفح، في علامات تبويب وشا
 <td width="50%" valign="top">
 
 **الأمان:**
-تُشفَّر كلمات المرور والمفاتيح والأسرار الأخرى لكل مستخدم على حدة، ويمكن تشفير ملفات قاعدة البيانات نفسها على القرص. راجع [الوثائق](https://docs.termix.site/security) لمعرفة آلية العمل.
+تُشفَّر كلمات المرور والمفاتيح والأسرار الأخرى لكل مستخدم على حدة، ويمكن تشفير ملفات قاعدة البيانات نفسها على القرص. راجع [الوثائق](https://docs.termix.site/features/authentication/security/) لمعرفة آلية العمل.
 
 </td>
 <td width="50%" valign="top">
@@ -372,9 +372,9 @@ termix ssh 1
 
 ## بيانات الاستخدام
 
-يرسل Termix إشارة صغيرة مجهولة مرة واحدة يوميًا، لأعرف عدد النسخ العاملة والميزات المستخدمة فعلًا. تحتوي على معرّف عشوائي للنسخة، وعدد المستخدمين والمضيفات لديك، وإصدار التطبيق، والميزات التي استُخدمت خلال آخر 24 ساعة (الطرفية ومدير الملفات والأنفاق وdocker وغيرها). ولا تحتوي أبدًا على أسماء مستخدمين أو أسماء مضيفات أو عناوين IP أو بيانات دخول أو أي شيء يعرّف بك أو بخوادمك.
+يرسل Termix تقريرًا صغيرًا مجهول الهوية مرة واحدة يوميًا حتى أعرف عدد النسخ العاملة والميزات المستخدمة. يحتوي على معرّف عشوائي للنسخة، وإصدار التطبيق، وعدد المستخدمين والأجهزة لديك. ويمكن أن يتضمن أيضًا منصتك (نظام التشغيل، والمعمارية، وإصدار Node.js، ونوع قاعدة البيانات، وهل تستخدم Docker أو تطبيق سطح المكتب أو خادمًا عاديًا)، وعدد مرات فتح كل نوع من التبويبات وعدد عمليات تسجيل الدخول عبر SSH، والميزات المدمجة التي تعمل. لا يحتوي أبدًا على أسماء المستخدمين أو أسماء الأجهزة أو عناوين IP أو بيانات الدخول أو أي شيء آخر يعرّف بك أو بخوادمك.
 
-وهي مفعّلة افتراضيًا. يمكنك إيقافها من إعدادات المسؤول ضمن قسم عام، أو ضبط `ENABLE_TELEMETRY=false` قبل تشغيل Termix أصلًا.
+وهي مفعّلة افتراضيًا. يمكنك إيقافها أو اختيار ما تتضمنه من إعدادات المسؤول ضمن قسم Usage Statistics، وهناك يمكنك أيضًا معاينة التقرير كما سيُرسل تمامًا. ويمكن لكل مستخدم استبعاد استخدامه الشخصي للميزات من ملفه الشخصي. ضبط `ENABLE_TELEMETRY=false` يوقفها ويقفل المفتاح.
 
 <br />
 
@@ -390,43 +390,52 @@ Termix مجاني ومفتوح المصدر، بلا اشتراكات ولا خ
 
 هل تهتم بمساحة إعلانية مدفوعة لدعم التطوير؟ راسلنا على [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## الدعم

docs/readme/README-CN.md

@@ -89,7 +89,7 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 <td width="50%" valign="top">
 
 **文件管理器:**
-通过 SFTP 浏览、编辑、上传、下载、重命名、移动和删除文件，支持 sudo。可以查看和编辑代码、图片、音频和视频。文件可以直接从一台服务器复制到另一台，系统会自动选择最快的路径并校验传输完整性。
+通过 SFTP 浏览、编辑、上传、下载、重命名、移动和删除文件，支持 sudo。可以查看和编辑代码、图片、音频和视频。在专属的传输标签页里把文件直接从一台服务器复制到另一台，系统会自动选择最快的路径并校验传输完整性。桌面端还提供本地和远程并排显示的视图。
 
 </td>
 </tr>
@@ -111,7 +111,7 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 <td width="50%" valign="top">
 
 **主机指标:**
-在大多数 Linux 服务器上查看 CPU、内存、磁盘、网络、温度、运行时间、进程、端口、登录记录和系统信息，并附带历史曲线图。管理卡片让你无需离开 Termix 就能处理服务、定时任务、软件包、用户、防火墙规则、WireGuard、Tailscale、SSL 证书、日志和健康检查。
+在大多数 Linux 服务器上查看 CPU、内存、磁盘、网络、温度、NVIDIA GPU、运行时间、进程、端口、登录记录和系统信息，并附带历史曲线图。管理卡片让你无需离开 Termix 就能处理服务、定时任务、软件包、用户、防火墙规则、WireGuard、Tailscale、SSL 证书、日志和健康检查。
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 </td>
 <td width="50%" valign="top">
 
-**引导设置:**
-一个简短的引导流程会带你选择界面预设、主题、需要的功能，以及第一台主机。简洁模式会隐藏你用不到的东西，你随时可以重新运行引导或切换预设。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**桌面独立运行与同步:**
-桌面应用可以完全独立运行，自带本地后端和数据库，不需要服务器。你也可以把它连到 Termix 服务器，双向同步主机、凭据、代码片段等内容，并选择连接是在本地发起还是通过服务器发起。
-
-</td>
-<td width="50%" valign="top">
-
 **命令行工具:**
 `termix` 命令行工具，可用于你的终端和脚本。打开终端、在单台主机或整个机群上执行命令、通过 SFTP 传输文件，以及管理主机、代码片段和凭据。用 `npm install -g @termix-cli/cli` 安装，或者直接下载独立的可执行文件。详见 [CLI 文档](https://docs.termix.site/cli)。
 
@@ -237,7 +223,7 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 <td width="50%" valign="top">
 
 **安全:**
-密码、密钥和其他机密按用户加密，数据库文件本身也可以在磁盘上加密。具体原理请查看[文档](https://docs.termix.site/security)。
+密码、密钥和其他机密按用户加密，数据库文件本身也可以在磁盘上加密。具体原理请查看[文档](https://docs.termix.site/features/authentication/security/)。
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 - **键盘快捷键** - 在标签页之间切换、关闭标签页等，全部可以重新绑定
 - **网络唤醒** - 从 Termix 或自动化步骤中唤醒一台机器
 - **受信任代理认证** - 由反向代理完成登录，并把用户信息传递进来
-- **丰富的 SSH 功能** - 跳板机、Warpgate、TOTP 验证、SOCKS5、主机密钥验证、密码自动填充、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、端口敲门、终端日志、代理转发、Bitwarden SSH 代理、HashiCorp Vault SSH 签名等等
+- **白标定制** - 管理员可以用自己的名称、图标和配色为实例重新品牌化
+- **Web 端点** - 在 Termix 内嵌打开主机自己的网页界面，比如路由器的管理页面，而不是另开一个标签页
+- **协作房间** - 持久化的房间，一群人可以一起在会话之间跳转，有主持人舞台和邀请功能
+- **丰富的 SSH 功能** - 跳板机、Warpgate、TOTP 验证、SOCKS5、主机密钥验证、密码自动填充、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、端口敲门、终端日志、代理转发、Bitwarden SSH 代理、HashiCorp Vault SSH 签名、Step CA、1Password Connect 等等
 - **Termix ID** - 内置的 sshid.io 式功能。认领一个用户名，在解析地址上发布你的公钥，并用内置 CA 签发 SSH 证书
+- **命令历史自动建议** - 在终端中输入时，根据你的命令历史给出行内建议
+- **桌面独立运行与同步** - 桌面应用自带本地后端和数据库可以独立运行，也可以选择和 Termix 服务器同步
 
 </details>
 
@@ -313,6 +304,9 @@ Termix 是一个免费、开源、自托管的服务器管理平台。它把 SSH
 
 访问 [Termix 文档](https://docs.termix.site/install) 查看所有平台的完整安装说明。
 
+要部署到 Kubernetes？Helm chart 在 `charts/termix` 目录下，涵盖 Ingress、Traefik、Argo CD、GitHub Actions 和 GitLab CI 的完整搭建说明见
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes)。
+
 Docker Compose 示例（如果你不打算使用远程桌面功能，可以省略 `guacd` 和相关网络配置）：
 
 ```yaml
@@ -352,7 +346,7 @@ networks:
 
 ### 命令行工具
 
-Termix 还提供命令行工具，你可以在终端里管理服务器，也可以把 Termix 用在自己的脚本中。
+Termix 还提供命令行工具，让你可以在终端里管理服务器，也可以把 Termix 用在自己的脚本中。
 
 ```bash
 npm install -g @termix-cli/cli
@@ -372,9 +366,9 @@ termix ssh 1
 
 ## 遥测
 
-Termix 每天会发送一次匿名的小型统计信息，让我了解有多少实例在运行、哪些功能被用到。内容包括一个随机的实例 ID、你有多少用户和主机、应用版本，以及过去 24 小时内使用了哪些功能（终端、文件管理器、隧道、Docker 等）。它绝不包含用户名、主机名、IP 地址、凭据，或任何能识别你和你服务器的信息。
+Termix 每天会发送一次匿名的小型报告，让我知道有多少实例在运行、哪些功能被使用。报告包含一个随机的实例 ID、应用版本，以及你的用户数和主机数。它还可以包含你的平台信息（操作系统、架构、Node.js 版本、数据库类型，以及你是用 Docker、桌面应用还是普通服务器运行）、每种标签页被打开的次数和 SSH 登录次数，以及正在运行的内置功能。它绝不会包含用户名、主机名、IP 地址、凭据或任何能识别你或你的服务器的信息。
 
-该功能默认开启。你可以在管理设置的“通用”中关闭它，或者在启动 Termix 之前设置 `ENABLE_TELEMETRY=false`。
+该功能默认开启。你可以在管理设置的"Usage Statistics"中关闭它或选择要包含的内容，还可以在那里预览将要发送的完整报告。每个用户都可以在个人资料中排除自己的功能使用数据。设置 `ENABLE_TELEMETRY=false` 会关闭它并锁定开关。
 
 <br />
 
@@ -390,43 +384,52 @@ Termix 免费且开源，没有订阅也没有付费方案。如果你觉得它
 
 有意通过付费展示位支持开发吗？请发邮件到 [mail@termix.site](mailto:mail@termix.site)。
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## 支持
@@ -498,3 +501,4 @@ Termix 免费且开源，没有订阅也没有付费方案。如果你觉得它
 ## 许可证
 
 基于 Apache License 2.0 发布。详见 `LICENSE`。
+</content>

docs/readme/README-DE.md

@@ -111,7 +111,7 @@ Hosts mit Tags und verschachtelten Ordnern ordnen, die du benennen und einfärbe
 <td width="50%" valign="top">
 
 **Host-Metriken:**
-CPU, Speicher, Festplatte, Netzwerk, Temperatur, Laufzeit, Prozesse, Ports, Anmeldungen und Systeminfos auf den meisten Linux-Servern, mit Verlaufsgrafiken. Über Verwaltungskarten kümmerst du dich um Dienste, Cronjobs, Pakete, Benutzer, Firewallregeln, WireGuard, Tailscale, SSL-Zertifikate, Logs und Statusprüfungen, ohne Termix zu verlassen.
+CPU, Speicher, Festplatte, Netzwerk, Temperatur, NVIDIA-GPU, Laufzeit, Prozesse, Ports, Anmeldungen und Systeminfos auf den meisten Linux-Servern, mit Verlaufsgrafiken. Über Verwaltungskarten kümmerst du dich um Dienste, Cronjobs, Pakete, Benutzer, Firewallregeln, WireGuard, Tailscale, SSL-Zertifikate, Logs und Statusprüfungen, ohne Termix zu verlassen.
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Speichere eine Reihe von Tabs samt Aufteilung und öffne alles mit einem Klick w
 </td>
 <td width="50%" valign="top">
 
-**Geführte Einrichtung:**
-Eine kurze Einrichtung führt dich durch die Wahl einer Oberflächenvorlage, deines Themas, der gewünschten Funktionen und deines ersten Hosts. Der einfache Modus blendet aus, was du nicht nutzt, und du kannst die Einrichtung jederzeit erneut starten oder die Vorlage wechseln.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop eigenständig und Synchronisierung:**
-Die Desktop-App läuft eigenständig mit lokalem Backend und eigener Datenbank, ganz ohne Server. Du kannst sie auch mit einem Termix-Server verbinden, um Hosts, Zugangsdaten, Snippets und mehr in beide Richtungen abzugleichen, und wählen, ob Verbindungen lokal oder über den Server aufgebaut werden.
-
-</td>
-<td width="50%" valign="top">
-
 **Kommandozeile:**
 Ein `termix`-CLI für deine Shell und deine Skripte. Terminals öffnen, einen Befehl auf einem Host oder einer ganzen Flotte ausführen, Dateien per SFTP verschieben und Hosts, Snippets und Zugangsdaten verwalten. Installiere es mit `npm install -g @termix-cli/cli` oder nimm eine eigenständige Binärdatei. Siehe die [CLI-Dokumentation](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ Ein `termix`-CLI für deine Shell und deine Skripte. Terminals öffnen, einen Be
 <td width="50%" valign="top">
 
 **Sicherheit:**
-Passwörter, Schlüssel und andere Geheimnisse werden pro Benutzer verschlüsselt, und die Datenbankdateien selbst lassen sich auf der Festplatte verschlüsseln. Wie das funktioniert, steht in der [Dokumentation](https://docs.termix.site/security).
+Passwörter, Schlüssel und andere Geheimnisse werden pro Benutzer verschlüsselt, und die Datenbankdateien selbst lassen sich auf der Festplatte verschlüsseln. Wie das funktioniert, steht in der [Dokumentation](https://docs.termix.site/features/authentication/security/).
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Rund 30 Sprachen sind eingebaut, verwaltet über [Crowdin](https://docs.termix.s
 - **Tastenkürzel** - Zwischen Tabs wechseln, Tabs schließen und mehr, alles neu belegbar
 - **Wake-on-LAN** - Einen Rechner aus Termix heraus oder aus einem Automatisierungsschritt aufwecken
 - **Vertrauenswürdiger Proxy** - Einen Reverse Proxy die Anmeldung erledigen und den Benutzer durchreichen lassen
-- **Viele SSH-Funktionen** - Sprunghosts, Warpgate, TOTP-Abfragen, SOCKS5, Prüfung von Hostschlüsseln, automatisches Ausfüllen von Passwörtern, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, Port Knocking, Terminalprotokolle, Agent-Weiterleitung, Bitwarden SSH-Agent, SSH-Signierung über HashiCorp Vault und mehr
+- **White Label** - Administratoren können die Instanz mit eigenem Namen, Logo und Farben versehen
+- **Web-Endpunkte** - Öffne die eigene Weboberfläche eines Hosts, etwa die Verwaltungsseite eines Routers, eingebettet in Termix statt in einem eigenen Tab
+- **Kollaborationsräume** - Feste Räume, in denen eine Gruppe gemeinsam zwischen Sitzungen wechselt, mit Präsentationsbühne und Einladungen
+- **Viele SSH-Funktionen** - Sprunghosts, Warpgate, TOTP-Abfragen, SOCKS5, Prüfung von Hostschlüsseln, automatisches Ausfüllen von Passwörtern, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, Port Knocking, Terminalprotokolle, Agent-Weiterleitung, Bitwarden SSH-Agent, SSH-Signierung über HashiCorp Vault, Step CA, 1Password Connect und mehr
 - **Termix ID** - Eine eingebaute Variante von sshid.io. Sichere dir einen Namen, veröffentliche deine öffentlichen Schlüssel unter einer Resolver-URL und stelle SSH-Zertifikate über die eingebaute CA aus
+- **Autovervollständigung im Befehlsverlauf** - Vorschläge direkt im Terminal beim Tippen, basierend auf deinem Befehlsverlauf
+- **Desktop eigenständig und Synchronisierung** - Die Desktop-App läuft eigenständig mit lokalem Backend und eigener Datenbank und kann sich optional mit einem Termix-Server synchronisieren
 
 </details>
 
@@ -313,6 +304,10 @@ Rund 30 Sprachen sind eingebaut, verwaltet über [Crowdin](https://docs.termix.s
 
 In der [Termix-Dokumentation](https://docs.termix.site/install) findest du die vollständigen Installationsanleitungen für alle Plattformen.
 
+Willst du auf Kubernetes bereitstellen? Das Helm-Chart liegt in `charts/termix`, und die Einrichtung
+für Ingress, Traefik, Argo CD, GitHub Actions und GitLab CI steht unter
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes).
+
 Beispiel für eine Docker-Compose-Datei (`guacd` und das Netzwerk kannst du weglassen, wenn du keinen Remotedesktop brauchst):
 
 ```yaml
@@ -372,9 +367,9 @@ Du kannst den Termix-Server auf einem VPS laufen lassen statt im eigenen Netz. L
 
 ## Telemetrie
 
-Termix schickt einmal am Tag ein kleines anonymes Signal, damit ich sehen kann, wie viele Instanzen laufen und welche Funktionen genutzt werden. Enthalten sind eine zufällige Instanz-ID, wie viele Benutzer und Hosts du hast, die App-Version und welche Funktionen (Terminal, Dateimanager, Tunnel, Docker usw.) in den letzten 24 Stunden benutzt wurden. Niemals enthalten sind Benutzernamen, Hostnamen, IP-Adressen, Zugangsdaten oder irgendetwas anderes, das dich oder deine Server identifiziert.
+Termix schickt einmal am Tag einen kleinen anonymen Bericht, damit ich sehe, wie viele Instanzen laufen und welche Funktionen genutzt werden. Er enthält eine zufällige Instanz-ID, die App-Version und wie viele Benutzer und Hosts du hast. Er kann außerdem deine Plattform enthalten (Betriebssystem, Architektur, Node.js-Version, Datenbanktyp und ob du Docker, die Desktop-App oder einen normalen Server nutzt), wie oft jede Art von Tab geöffnet wurde und wie viele SSH-Logins es gab, sowie welche eingebauten Funktionen laufen. Er enthält nie Benutzernamen, Hostnamen, IP-Adressen, Zugangsdaten oder sonst etwas, das dich oder deine Server erkennbar macht.
 
-Es ist standardmäßig an. Schalte es in den Administrationseinstellungen unter Allgemein aus oder setze `ENABLE_TELEMETRY=false`, bevor du Termix überhaupt startest.
+Es ist standardmäßig an. Schalte es in den Administrationseinstellungen unter Usage Statistics aus oder wähle dort, was gesendet wird. Dort kannst du dir auch den genauen Bericht vorab ansehen. Jeder Benutzer kann seine eigene Funktionsnutzung in seinem Profil ausschließen. `ENABLE_TELEMETRY=false` schaltet es aus und sperrt den Schalter.
 
 <br />
 
@@ -390,43 +385,52 @@ Termix ist kostenlos und quelloffen, ohne Abo und ohne Bezahlmodell. Wenn es dir
 
 Interesse an einer bezahlten Platzierung zur Unterstützung der Entwicklung? Schreib an [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Support

docs/readme/README-ES.md

@@ -111,7 +111,7 @@ Guarda y organiza hosts con etiquetas y carpetas anidadas que puedes nombrar y c
 <td width="50%" valign="top">
 
 **Métricas de host:**
-CPU, memoria, disco, red, temperatura, tiempo encendido, procesos, puertos, inicios de sesión e información del sistema en la mayoría de servidores Linux, con gráficas de histórico. Las tarjetas de gestión te dejan manejar servicios, tareas cron, paquetes, usuarios, reglas del cortafuegos, WireGuard, Tailscale, certificados SSL, registros y comprobaciones de estado sin salir de Termix.
+CPU, memoria, disco, red, temperatura, GPU NVIDIA, tiempo encendido, procesos, puertos, inicios de sesión e información del sistema en la mayoría de servidores Linux, con gráficas de histórico. Las tarjetas de gestión te dejan manejar servicios, tareas cron, paquetes, usuarios, reglas del cortafuegos, WireGuard, Tailscale, certificados SSL, registros y comprobaciones de estado sin salir de Termix.
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Guarda un conjunto de pestañas con su distribución dividida y reábrelo entero
 </td>
 <td width="50%" valign="top">
 
-**Configuración guiada:**
-Una configuración corta te lleva por elegir un preajuste de interfaz, tu tema, las funciones que quieres y tu primer host. El modo sencillo esconde lo que no usas, y puedes repetir la configuración o cambiar de preajuste cuando quieras.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Escritorio independiente y sincronización:**
-La aplicación de escritorio funciona sola, con su backend y su base de datos locales, sin necesidad de servidor. También puedes conectarla a un servidor Termix para sincronizar en ambos sentidos hosts, credenciales, fragmentos y más, y decidir si las conexiones salen de tu equipo o pasan por el servidor.
-
-</td>
-<td width="50%" valign="top">
-
 **Línea de comandos:**
 Un CLI `termix` para tu shell y tus scripts. Abre terminales, ejecuta un comando en un host o en una flota entera, mueve archivos por SFTP y gestiona hosts, fragmentos y credenciales. Instálalo con `npm install -g @termix-cli/cli` o coge un binario independiente. Consulta la [documentación del CLI](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ Un CLI `termix` para tu shell y tus scripts. Abre terminales, ejecuta un comando
 <td width="50%" valign="top">
 
 **Seguridad:**
-Las contraseñas, las claves y otros secretos se cifran por usuario, y los propios archivos de la base de datos se pueden cifrar en disco. Mira la [documentación](https://docs.termix.site/security) para saber cómo funciona.
+Las contraseñas, las claves y otros secretos se cifran por usuario, y los propios archivos de la base de datos se pueden cifrar en disco. Mira la [documentación](https://docs.termix.site/features/authentication/security/) para saber cómo funciona.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Unos 30 idiomas incluidos, gestionados a través de [Crowdin](https://docs.termi
 - **Atajos de teclado** - Moverte entre pestañas, cerrarlas y más, todo reasignable
 - **Wake-on-LAN** - Enciende una máquina desde Termix o desde un paso de automatización
 - **Proxy de confianza** - Deja que un proxy inverso gestione el acceso y pase al usuario
-- **SSH muy completo** - Hosts de salto, Warpgate, peticiones TOTP, SOCKS5, verificación de claves de host, autorrelleno de contraseñas, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro del terminal, reenvío de agente, agente SSH de Bitwarden, firma SSH con HashiCorp Vault y más
+- **Marca blanca** - Los administradores pueden personalizar la instancia con su propio nombre, logo y colores
+- **Puntos de acceso web** - Abre la propia interfaz web de un host, como la página de administración de un router, integrada dentro de Termix en lugar de en una pestaña aparte
+- **Salas de colaboración** - Salas persistentes donde un grupo salta entre sesiones junto, con un escenario para presentador e invitaciones
+- **SSH muy completo** - Hosts de salto, Warpgate, peticiones TOTP, SOCKS5, verificación de claves de host, autorrelleno de contraseñas, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro del terminal, reenvío de agente, agente SSH de Bitwarden, firma SSH con HashiCorp Vault, Step CA, 1Password Connect y más
 - **Termix ID** - Una versión integrada de sshid.io. Reserva un identificador, publica tus claves públicas en una URL de resolución y emite certificados SSH desde la CA integrada
+- **Autosugerencias del historial de comandos** - Sugerencias en línea en el terminal mientras escribes, basadas en tu historial de comandos
+- **Escritorio independiente y sincronización** - La aplicación de escritorio funciona sola, con su propio backend y base de datos locales, y puede sincronizarse opcionalmente con un servidor Termix
 
 </details>
 
@@ -313,6 +304,10 @@ Unos 30 idiomas incluidos, gestionados a través de [Crowdin](https://docs.termi
 
 Visita la [documentación de Termix](https://docs.termix.site/install) para ver las instrucciones completas de instalación en todas las plataformas.
 
+¿Vas a desplegar en Kubernetes? El chart de Helm está en `charts/termix`, y las instrucciones
+de configuración para Ingress, Traefik, Argo CD, GitHub Actions y GitLab CI están en
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes).
+
 Ejemplo de archivo Docker Compose (puedes quitar `guacd` y la red si no piensas usar el escritorio remoto):
 
 ```yaml
@@ -372,9 +367,9 @@ Puedes ejecutar el servidor de Termix en un VPS en lugar de dentro de tu propia
 
 ## Telemetría
 
-Termix envía una vez al día un pequeño aviso anónimo para que pueda ver cuántas instancias hay funcionando y qué funciones se usan. Contiene un identificador de instancia aleatorio, cuántos usuarios y hosts tienes, la versión de la aplicación y qué funciones (terminal, gestor de archivos, túneles, docker, etc.) se han usado en las últimas 24 horas. Nunca contiene nombres de usuario, nombres de host, direcciones IP, credenciales ni nada que te identifique a ti o a tus servidores.
+Termix envía una vez al día un pequeño informe anónimo para que pueda ver cuántas instancias hay funcionando y qué funciones se usan. Incluye un ID de instancia aleatorio, la versión de la app y cuántos usuarios y hosts tienes. También puede incluir tu plataforma (sistema operativo, arquitectura, versión de Node.js, tipo de base de datos y si usas Docker, la app de escritorio o un servidor normal), cuántas veces se abrió cada tipo de pestaña y cuántos inicios de sesión SSH hubo, y qué funciones integradas están activas. Nunca incluye nombres de usuario, nombres de host, direcciones IP, credenciales ni nada que te identifique a ti o a tus servidores.
 
-Viene activado. Puedes desactivarlo en los ajustes de administración, en General, o poner `ENABLE_TELEMETRY=false` antes incluso de arrancar Termix.
+Viene activado. Puedes desactivarlo o elegir qué incluye en los ajustes de administración, en Usage Statistics, donde también puedes ver el informe exacto antes de enviarlo. Cada usuario puede excluir su propio uso de funciones desde su perfil. Poner `ENABLE_TELEMETRY=false` lo desactiva y bloquea el interruptor.
 
 <br />
 
@@ -390,43 +385,52 @@ Termix es gratuito y de código abierto, sin suscripciones ni planes de pago. Si
 
 ¿Te interesa un espacio de pago para apoyar el desarrollo? Escribe a [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Soporte

docs/readme/README-FR.md

@@ -111,7 +111,7 @@ Rangez vos hôtes avec des étiquettes et des dossiers imbriqués que vous pouve
 <td width="50%" valign="top">
 
 **Métriques des hôtes:**
-CPU, mémoire, disque, réseau, température, temps de fonctionnement, processus, ports, connexions et informations système sur la plupart des serveurs Linux, avec des graphiques d'historique. Les cartes de gestion vous permettent de gérer les services, les tâches cron, les paquets, les utilisateurs, les règles de pare-feu, WireGuard, Tailscale, les certificats SSL, les journaux et les vérifications d'état sans quitter Termix.
+CPU, mémoire, disque, réseau, température, GPU NVIDIA, temps de fonctionnement, processus, ports, connexions et informations système sur la plupart des serveurs Linux, avec des graphiques d'historique. Les cartes de gestion vous permettent de gérer les services, les tâches cron, les paquets, les utilisateurs, les règles de pare-feu, WireGuard, Tailscale, les certificats SSL, les journaux et les vérifications d'état sans quitter Termix.
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Enregistrez un ensemble d'onglets avec leur disposition en écran divisé et rou
 </td>
 <td width="50%" valign="top">
 
-**Configuration guidée:**
-Une courte configuration vous aide à choisir un préréglage d'interface, votre thème, les fonctionnalités que vous voulez et votre premier hôte. Le mode simple masque ce que vous n'utilisez pas, et vous pouvez relancer la configuration ou changer de préréglage quand vous voulez.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Application de bureau autonome et synchronisation:**
-L'application de bureau fonctionne toute seule, avec son propre backend et sa base de données, sans serveur. Vous pouvez aussi la relier à un serveur Termix pour synchroniser dans les deux sens les hôtes, les identifiants, les extraits et le reste, et choisir si les connexions partent de votre machine ou passent par le serveur.
-
-</td>
-<td width="50%" valign="top">
-
 **Ligne de commande:**
 Un CLI `termix` pour votre shell et vos scripts. Ouvrez des terminaux, lancez une commande sur un hôte ou une flotte entière, déplacez des fichiers en SFTP et gérez hôtes, extraits et identifiants. Installez-le avec `npm install -g @termix-cli/cli` ou récupérez un binaire autonome. Voir la [documentation du CLI](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ Un CLI `termix` pour votre shell et vos scripts. Ouvrez des terminaux, lancez un
 <td width="50%" valign="top">
 
 **Sécurité:**
-Les mots de passe, les clés et les autres secrets sont chiffrés par utilisateur, et les fichiers de base de données eux-mêmes peuvent être chiffrés sur le disque. Voir la [documentation](https://docs.termix.site/security) pour le détail.
+Les mots de passe, les clés et les autres secrets sont chiffrés par utilisateur, et les fichiers de base de données eux-mêmes peuvent être chiffrés sur le disque. Voir la [documentation](https://docs.termix.site/features/authentication/security/) pour le détail.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Une trentaine de langues intégrées, gérées via [Crowdin](https://docs.termix
 - **Raccourcis clavier** - Naviguer entre les onglets, les fermer et plus encore, tout est reconfigurable
 - **Wake-on-LAN** - Réveillez une machine depuis Termix ou depuis une étape d'automatisation
 - **Authentification par proxy de confiance** - Laissez un reverse proxy gérer la connexion et transmettre l'utilisateur
-- **SSH complet** - Hôtes de rebond, Warpgate, demandes TOTP, SOCKS5, vérification des clés d'hôte, remplissage automatique des mots de passe, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, journalisation du terminal, transfert d'agent, agent SSH Bitwarden, signature SSH HashiCorp Vault et plus encore
+- **Marque blanche** - Les administrateurs peuvent personnaliser l'instance avec leur propre nom, logo et couleurs
+- **Points d'accès web** - Ouvrez l'interface web d'un hôte, comme la page d'administration d'un routeur, directement dans Termix plutôt que dans un onglet séparé
+- **Salles de collaboration** - Des salles persistantes où un groupe peut passer d'une session à l'autre ensemble, avec une scène pour le présentateur et des invitations
+- **SSH complet** - Hôtes de rebond, Warpgate, demandes TOTP, SOCKS5, vérification des clés d'hôte, remplissage automatique des mots de passe, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, journalisation du terminal, transfert d'agent, agent SSH Bitwarden, signature SSH HashiCorp Vault, Step CA, 1Password Connect et plus encore
 - **Termix ID** - Une version intégrée de sshid.io. Réservez un identifiant, publiez vos clés publiques sur une URL de résolution et émettez des certificats SSH depuis l'autorité intégrée
+- **Suggestions automatiques d'historique de commandes** - Des suggestions en ligne dans le terminal pendant que vous tapez, basées sur votre historique de commandes
+- **Application de bureau autonome et synchronisation** - L'application de bureau fonctionne toute seule, avec son propre backend et sa base de données, et peut en option se synchroniser avec un serveur Termix
 
 </details>
 
@@ -313,6 +304,8 @@ Une trentaine de langues intégrées, gérées via [Crowdin](https://docs.termix
 
 Consultez la [documentation Termix](https://docs.termix.site/install) pour les instructions d'installation complètes sur toutes les plateformes.
 
+Vous déployez sur Kubernetes ? Le chart Helm se trouve dans `charts/termix`, et les instructions de configuration couvrant Ingress, Traefik, Argo CD, GitHub Actions et GitLab CI sont sur [docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes).
+
 Exemple de fichier Docker Compose (vous pouvez retirer `guacd` et le réseau si vous ne comptez pas utiliser le bureau à distance) :
 
 ```yaml
@@ -372,9 +365,9 @@ Vous pouvez faire tourner le serveur Termix sur un VPS plutôt que dans votre pr
 
 ## Télémétrie
 
-Termix envoie une fois par jour un petit signal anonyme, pour que je puisse voir combien d'instances tournent et quelles fonctionnalités servent vraiment. Il contient un identifiant d'instance aléatoire, le nombre d'utilisateurs et d'hôtes, la version de l'application et les fonctionnalités utilisées ces dernières 24 heures (terminal, gestionnaire de fichiers, tunnels, docker, etc.). Il ne contient jamais de noms d'utilisateur, de noms d'hôtes, d'adresses IP, d'identifiants ni quoi que ce soit qui puisse vous identifier, vous ou vos serveurs.
+Termix envoie une fois par jour un petit rapport anonyme, pour que je puisse voir combien d'instances tournent et quelles fonctionnalités sont utilisées. Il contient un identifiant d'instance aléatoire, la version de l'application et le nombre d'utilisateurs et d'hôtes. Il peut aussi inclure votre plateforme (système, architecture, version de Node.js, type de base de données, et si vous utilisez Docker, l'application de bureau ou un simple serveur), combien de fois chaque type d'onglet a été ouvert et combien de connexions SSH ont eu lieu, ainsi que les fonctionnalités intégrées actives. Il ne contient jamais de noms d'utilisateur, de noms d'hôte, d'adresses IP, d'identifiants ni quoi que ce soit qui permette de vous identifier, vous ou vos serveurs.
 
-C'est activé par défaut. Désactivez-le dans les paramètres d'administration, section Général, ou définissez `ENABLE_TELEMETRY=false` avant même de démarrer Termix.
+C'est activé par défaut. Désactivez-le ou choisissez ce qu'il contient dans les paramètres d'administration, section Usage Statistics, où vous pouvez aussi voir le rapport exact avant l'envoi. Chaque utilisateur peut exclure sa propre utilisation dans son profil. Définir `ENABLE_TELEMETRY=false` le désactive et verrouille l'interrupteur.
 
 <br />
 
@@ -390,43 +383,52 @@ Termix est gratuit et open source, sans abonnement ni offre payante. S'il vous e
 
 Intéressé par un emplacement payant pour soutenir le développement ? Écrivez à [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Support

docs/readme/README-HI.md

@@ -237,7 +237,7 @@ CPU, मेमोरी और डिस्क जैसी होस्ट म
 <td width="50%" valign="top">
 
 **सुरक्षा:**
-पासवर्ड, कुंजियाँ और बाकी गोपनीय जानकारी हर उपयोगकर्ता के लिए अलग से एन्क्रिप्ट होती है, और डेटाबेस फ़ाइलें भी डिस्क पर एन्क्रिप्ट की जा सकती हैं। यह कैसे काम करता है, यह [दस्तावेज़](https://docs.termix.site/security) में देखें।
+पासवर्ड, कुंजियाँ और बाकी गोपनीय जानकारी हर उपयोगकर्ता के लिए अलग से एन्क्रिप्ट होती है, और डेटाबेस फ़ाइलें भी डिस्क पर एन्क्रिप्ट की जा सकती हैं। यह कैसे काम करता है, यह [दस्तावेज़](https://docs.termix.site/features/authentication/security/) में देखें।
 
 </td>
 <td width="50%" valign="top">
@@ -372,9 +372,9 @@ termix ssh 1
 
 ## टेलीमेट्री
 
-Termix दिन में एक बार एक छोटा सा गुमनाम संकेत भेजता है, ताकि मुझे पता चले कि कितने इंस्टेंस चल रहे हैं और कौन सी सुविधाएँ सच में इस्तेमाल होती हैं। इसमें एक बेतरतीब इंस्टेंस आईडी, आपके पास कितने उपयोगकर्ता और होस्ट हैं, ऐप का संस्करण, और पिछले 24 घंटे में इस्तेमाल हुई सुविधाएँ (टर्मिनल, फ़ाइल मैनेजर, टनल, docker आदि) होती हैं। इसमें कभी भी उपयोगकर्ता नाम, होस्ट नाम, IP पते, क्रेडेंशियल या ऐसी कोई चीज़ नहीं होती जो आपकी या आपके सर्वर की पहचान बताए।
+Termix दिन में एक बार एक छोटी गुमनाम रिपोर्ट भेजता है ताकि मैं देख सकूं कि कितने इंस्टेंस चल रहे हैं और कौन से फ़ीचर इस्तेमाल हो रहे हैं। इसमें एक रैंडम इंस्टेंस ID, ऐप का वर्शन, और आपके यूज़र्स और होस्ट्स की संख्या होती है। इसमें आपका प्लेटफ़ॉर्म (OS, आर्किटेक्चर, Node.js वर्शन, डेटाबेस का प्रकार, और आप Docker, डेस्कटॉप ऐप या सामान्य सर्वर इस्तेमाल करते हैं), हर तरह का टैब कितनी बार खोला गया और कितने SSH लॉगिन हुए, और कौन से बिल्ट-इन फ़ीचर चल रहे हैं, यह भी हो सकता है। इसमें कभी भी यूज़रनेम, होस्टनेम, IP पते, क्रेडेंशियल या ऐसी कोई चीज़ नहीं होती जिससे आपकी या आपके सर्वर की पहचान हो।
 
-यह डिफ़ॉल्ट रूप से चालू रहता है। इसे एडमिन सेटिंग्स में सामान्य के अंतर्गत बंद करें, या Termix शुरू करने से पहले ही `ENABLE_TELEMETRY=false` सेट कर दें।
+यह डिफ़ॉल्ट रूप से चालू रहता है। इसे एडमिन सेटिंग्स में Usage Statistics के अंतर्गत बंद करें या चुनें कि इसमें क्या शामिल हो, और वहीं भेजी जाने वाली रिपोर्ट पहले से देख भी सकते हैं। हर यूज़र अपनी प्रोफ़ाइल में अपना फ़ीचर इस्तेमाल हटा सकता है। `ENABLE_TELEMETRY=false` सेट करने से यह बंद हो जाता है और स्विच लॉक हो जाता है।
 
 <br />
 
@@ -390,43 +390,52 @@ Termix मुफ़्त और ओपन सोर्स है, न कोई
 
 विकास में सहयोग के लिए पेड प्लेसमेंट में रुचि है? [mail@termix.site](mailto:mail@termix.site) पर ईमेल करें।
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## सहायता

docs/readme/README-IT.md

@@ -83,13 +83,13 @@ RDP, VNC e Telnet nel browser, in schede e schermo diviso come qualsiasi altra s
 <td width="50%" valign="top">
 
 **Tunnel SSH:**
-Inoltro locale, remoto e SOCKS dinamico, con riconnessione automatica e controlli di stato. I tunnel da client a server dell'app desktop restano su quella macchina, e puoi salvare delle preimpostazioni sul server per portare una configurazione su un altro computer.
+Inoltro locale, remoto e SOCKS dinamico, con riconnessione automatica e controlli di stato. I tunnel da client a server dell'app desktop restano su quella macchina, e puoi salvare delle preimpostazioni sul server per portare una configurazione su un altro client.
 
 </td>
 <td width="50%" valign="top">
 
 **Gestore file:**
-Sfoglia, modifica, carica, scarica, rinomina, sposta ed elimina file via SFTP, anche con sudo. Guarda e modifica codice, immagini, audio e video. Copia i file direttamente da un server all'altro: il percorso più veloce viene scelto per te e i trasferimenti vengono verificati.
+Sfoglia, modifica, carica, scarica, rinomina, sposta ed elimina file via SFTP, anche con sudo. Guarda e modifica codice, immagini, audio e video. Copia i file direttamente da un server all'altro in una scheda dedicata di trasferimento, con il percorso più veloce scelto per te e i trasferimenti controllati per integrità. L'app desktop ha anche una vista affiancata di locale e remoto.
 
 </td>
 </tr>
@@ -111,7 +111,7 @@ Salva e organizza gli host con etichette e cartelle annidate a cui puoi dare nom
 <td width="50%" valign="top">
 
 **Metriche host:**
-CPU, memoria, disco, rete, temperatura, tempo di accensione, processi, porte, accessi e informazioni di sistema sulla maggior parte dei server Linux, con grafici storici. Le schede di gestione ti fanno seguire servizi, cron, pacchetti, utenti, regole del firewall, WireGuard, Tailscale, certificati SSL, log e controlli di stato senza uscire da Termix.
+CPU, memoria, disco, rete, temperatura, GPU NVIDIA, tempo di accensione, processi, porte, accessi e informazioni di sistema sulla maggior parte dei server Linux, con grafici storici. Le schede di gestione ti fanno seguire servizi, cron, pacchetti, utenti, regole del firewall, WireGuard, Tailscale, certificati SSL, log e controlli di stato senza uscire da Termix.
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Salva un insieme di schede con la loro disposizione divisa e riapri tutto con un
 </td>
 <td width="50%" valign="top">
 
-**Configurazione guidata:**
-Una breve configurazione ti accompagna nella scelta di una preimpostazione dell'interfaccia, del tema, delle funzionalità che vuoi e del primo host. La modalità semplice nasconde quello che non usi, e puoi rifare la configurazione o cambiare preimpostazione quando vuoi.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop autonomo e sincronizzazione:**
-L'app desktop funziona da sola, con backend e database locali, senza bisogno di un server. Puoi anche collegarla a un server Termix per sincronizzare nei due sensi host, credenziali, frammenti e altro, e scegliere se le connessioni partono dal tuo computer o passano dal server.
-
-</td>
-<td width="50%" valign="top">
-
 **Riga di comando:**
 Una CLI `termix` per la tua shell e i tuoi script. Apri terminali, esegui un comando su un host o su un'intera flotta, sposta file via SFTP e gestisci host, frammenti e credenziali. Installala con `npm install -g @termix-cli/cli` oppure prendi un binario autonomo. Vedi la [documentazione della CLI](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ Una CLI `termix` per la tua shell e i tuoi script. Apri terminali, esegui un com
 <td width="50%" valign="top">
 
 **Sicurezza:**
-Password, chiavi e altri segreti sono cifrati per ogni utente, e gli stessi file del database possono essere cifrati su disco. Guarda la [documentazione](https://docs.termix.site/security) per capire come funziona.
+Password, chiavi e altri segreti sono cifrati per ogni utente, e gli stessi file del database possono essere cifrati su disco. Guarda la [documentazione](https://docs.termix.site/features/authentication/security/) per capire come funziona.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Circa 30 lingue incluse, gestite tramite [Crowdin](https://docs.termix.site/tran
 - **Scorciatoie da tastiera** - Spostarsi tra le schede, chiuderle e altro, tutto riassegnabile
 - **Wake-on-LAN** - Accendi una macchina da Termix o da un passaggio di un'automazione
 - **Autenticazione tramite proxy fidato** - Lascia che un reverse proxy gestisca l'accesso e passi l'utente
-- **SSH molto completo** - Host di salto, Warpgate, richieste TOTP, SOCKS5, verifica delle chiavi host, riempimento automatico della password, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, log del terminale, inoltro dell'agente, agente SSH di Bitwarden, firma SSH con HashiCorp Vault e altro
+- **White label** - Gli amministratori possono rimarchiare l'istanza con nome, logo e colori propri
+- **Endpoint web** - Apri l'interfaccia web di un host, come la pagina di amministrazione di un router, incorporata dentro Termix invece che in una scheda separata
+- **Stanze di collaborazione** - Stanze persistenti dove un gruppo può passare insieme da una sessione all'altra, con un palco per il presentatore e inviti
+- **SSH molto completo** - Host di salto, Warpgate, richieste TOTP, SOCKS5, verifica delle chiavi host, riempimento automatico della password, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, log del terminale, inoltro dell'agente, agente SSH di Bitwarden, firma SSH con HashiCorp Vault, Step CA, 1Password Connect e altro
 - **Termix ID** - Una versione integrata di sshid.io. Prendi un identificativo, pubblica le tue chiavi pubbliche su un URL di risoluzione ed emetti certificati SSH dalla CA integrata
+- **Suggerimenti automatici nella cronologia comandi** - Suggerimenti in linea nel terminale mentre scrivi, basati sulla tua cronologia comandi
+- **Desktop autonomo e sincronizzazione** - L'app desktop funziona da sola, con backend e database locali, e può facoltativamente sincronizzarsi con un server Termix
 
 </details>
 
@@ -313,6 +304,10 @@ Circa 30 lingue incluse, gestite tramite [Crowdin](https://docs.termix.site/tran
 
 Vai alla [documentazione di Termix](https://docs.termix.site/install) per le istruzioni complete di installazione su tutte le piattaforme.
 
+Vuoi installare su Kubernetes? Il chart Helm è in `charts/termix`, e le istruzioni di configurazione
+per Ingress, Traefik, Argo CD, GitHub Actions e GitLab CI sono su
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes).
+
 Esempio di file Docker Compose (puoi togliere `guacd` e la rete se non pensi di usare il desktop remoto):
 
 ```yaml
@@ -364,7 +359,7 @@ Può aprire terminali, eseguire un comando su un host o su un'intera flotta, spo
 
 ### Hosting in cloud
 
-Puoi far girare il server Termix su un VPS invece che dentro la tua rete. Se Termix gira sulla rete che gestisce, un guasto se lo porta via proprio quando ti servirebbe per sistemare le cose. Fuori resta raggiungibile, ti dà un IP fisso e ci entri da ovunque senza VPN né porte aperte.
+Puoi far girare il server Termix su un VPS invece che dentro la tua rete. Se Termix gira sulla rete che gestisce, un guasto se lo porta via proprio quando ti servirebbe per sistemare le cose. Farlo girare altrove lo mantiene raggiungibile, ti dà un IP fisso e ti permette di entrare da ovunque senza VPN né porte aperte.
 
 [GINERNET](https://docs.termix.site/install/ginernet) sponsorizza Termix, e nella documentazione c'è una guida passo passo per il rilascio sulla loro piattaforma VPS.
 
@@ -372,9 +367,9 @@ Puoi far girare il server Termix su un VPS invece che dentro la tua rete. Se Ter
 
 ## Telemetria
 
-Termix invia una volta al giorno un piccolo segnale anonimo, così posso vedere quante istanze sono attive e quali funzionalità vengono usate davvero. Contiene un ID istanza casuale, quanti utenti e host hai, la versione dell'app e quali funzionalità (terminale, gestore file, tunnel, docker, ecc.) sono state usate nelle ultime 24 ore. Non contiene mai nomi utente, nomi host, indirizzi IP, credenziali o qualsiasi altra cosa che identifichi te o i tuoi server.
+Termix invia una volta al giorno un piccolo report anonimo, così posso vedere quante istanze sono attive e quali funzioni vengono usate. Contiene un ID di istanza casuale, la versione dell'app e quanti utenti e host hai. Può includere anche la tua piattaforma (sistema operativo, architettura, versione di Node.js, tipo di database e se usi Docker, l'app desktop o un server normale), quante volte è stato aperto ogni tipo di scheda e quanti login SSH ci sono stati, e quali funzioni integrate sono attive. Non contiene mai nomi utente, nomi host, indirizzi IP, credenziali o altro che identifichi te o i tuoi server.
 
-È attivo di base. Puoi spegnerlo nelle impostazioni di amministrazione, sezione Generale, oppure impostare `ENABLE_TELEMETRY=false` prima ancora di avviare Termix.
+È attivo di base. Puoi spegnerlo o scegliere cosa include nelle impostazioni di amministrazione, sezione Usage Statistics, dove puoi anche vedere il report esatto prima dell'invio. Ogni utente può escludere il proprio uso delle funzioni dal suo profilo. Impostare `ENABLE_TELEMETRY=false` lo spegne e blocca l'interruttore.
 
 <br />
 
@@ -390,43 +385,52 @@ Termix è gratuito e open source, senza abbonamenti né piani a pagamento. Se ti
 
 Ti interessa uno spazio a pagamento per sostenere lo sviluppo? Scrivi a [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Supporto
@@ -498,3 +502,5 @@ Tutte le funzionalità pianificate sono su [Projects](https://github.com/orgs/Te
 ## Licenza
 
 Distribuito con licenza Apache versione 2.0. Vedi `LICENSE` per maggiori informazioni.
+</content>
+</invoke>

docs/readme/README-JA.md

@@ -89,7 +89,7 @@ RDP、VNC、Telnet をブラウザから利用でき、他のセッションと
 <td width="50%" valign="top">
 
 **ファイルマネージャー:**
-SFTP でファイルの閲覧、編集、アップロード、ダウンロード、名前変更、移動、削除ができ、sudo にも対応しています。コード、画像、音声、動画を表示・編集できます。サーバー間で直接ファイルをコピーでき、最速の経路が自動で選ばれ、転送の整合性も検証されます。
+SFTP でファイルの閲覧、編集、アップロード、ダウンロード、名前変更、移動、削除ができ、sudo にも対応しています。コード、画像、音声、動画を表示・編集できます。専用の転送タブでサーバー間から直接ファイルをコピーでき、最速の経路が自動で選ばれ、転送の整合性も検証されます。デスクトップ版にはローカルとリモートを並べて表示する画面もあります。
 
 </td>
 </tr>
@@ -111,7 +111,7 @@ SFTP でファイルの閲覧、編集、アップロード、ダウンロード
 <td width="50%" valign="top">
 
 **ホストメトリクス:**
-たいていの Linux サーバーで CPU、メモリ、ディスク、ネットワーク、温度、稼働時間、プロセス、ポート、ログイン、システム情報を履歴グラフ付きで確認できます。マネージャーカードを使えば、サービス、cron、パッケージ、ユーザー、ファイアウォール、WireGuard、Tailscale、SSL 証明書、ログ、ヘルスチェックを Termix から離れずに扱えます。
+たいていの Linux サーバーで CPU、メモリ、ディスク、ネットワーク、温度、NVIDIA GPU、稼働時間、プロセス、ポート、ログイン、システム情報を履歴グラフ付きで確認できます。マネージャーカードを使えば、サービス、cron、パッケージ、ユーザー、ファイアウォール、WireGuard、Tailscale、SSL 証明書、ログ、ヘルスチェックを Termix から離れずに扱えます。
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Proxmox のインスタンスからそのままホストを取り込めます。
 </td>
 <td width="50%" valign="top">
 
-**ガイド付きセットアップ:**
-短いセットアップが、画面のプリセット、テーマ、使いたい機能、最初のホストの選択を案内します。シンプルモードは使わないものを隠してくれます。セットアップはいつでもやり直せますし、プリセットも切り替えられます。
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**デスクトップ単体利用と同期:**
-デスクトップアプリはローカルのバックエンドとデータベースを持ち、サーバーなしで単体で動きます。Termix サーバーにつなげば、ホスト、認証情報、スニペットなどを双方向で同期でき、接続をローカルから始めるかサーバー経由にするかも選べます。
-
-</td>
-<td width="50%" valign="top">
-
 **コマンドラインツール:**
 シェルやスクリプトから使える `termix` CLI です。ターミナルを開き、ホスト 1 台またはフリート全体でコマンドを実行し、SFTP でファイルを移動し、ホストやスニペット、認証情報を管理できます。`npm install -g @termix-cli/cli` で入れるか、単体のバイナリを使ってください。詳しくは [CLI ドキュメント](https://docs.termix.site/cli)をご覧ください。
 
@@ -237,7 +223,7 @@ Proxmox のインスタンスからそのままホストを取り込めます。
 <td width="50%" valign="top">
 
 **セキュリティ:**
-パスワードや鍵などの秘密情報はユーザーごとに暗号化され、データベースのファイル自体もディスク上で暗号化できます。仕組みは[ドキュメント](https://docs.termix.site/security)をご覧ください。
+パスワードや鍵などの秘密情報はユーザーごとに暗号化され、データベースのファイル自体もディスク上で暗号化できます。仕組みは[ドキュメント](https://docs.termix.site/features/authentication/security/)をご覧ください。
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Proxmox のインスタンスからそのままホストを取り込めます。
 - **キーボードショートカット** - タブの移動や閉じる操作など、すべて割り当て変更可能
 - **Wake-on-LAN** - Termix からでも自動化のステップからでもマシンを起動
 - **信頼済みプロキシ認証** - リバースプロキシにサインインを任せ、ユーザー情報を引き継ぎ
-- **充実した SSH 機能** - 踏み台ホスト、Warpgate、TOTP の入力、SOCKS5、ホスト鍵の検証、パスワードの自動入力、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、ポートノッキング、ターミナルのログ、エージェント転送、Bitwarden SSH エージェント、HashiCorp Vault の SSH 署名など
+- **ホワイトラベル** - 管理者が自分の名前、ロゴ、配色でインスタンスをブランド変更できます
+- **Web エンドポイント** - ルーターの管理画面のようなホスト自身の Web UI を、別タブではなく Termix の中に埋め込んで開けます
+- **コラボレーションルーム** - グループでセッションを行き来できる常設ルーム。プレゼンターの表示や招待機能もあります
+- **充実した SSH 機能** - 踏み台ホスト、Warpgate、TOTP の入力、SOCKS5、ホスト鍵の検証、パスワードの自動入力、[OPKSSH](https://github.com/openpubkey/opkssh)、tmux、ポートノッキング、ターミナルのログ、エージェント転送、Bitwarden SSH エージェント、HashiCorp Vault の SSH 署名、Step CA、1Password Connect など
 - **Termix ID** - sshid.io のような仕組みを内蔵。ハンドルを取得し、公開鍵をリゾルバー URL で公開し、内蔵 CA から SSH 証明書を発行できます
+- **コマンド履歴の自動候補** - ターミナルに入力すると、コマンド履歴をもとにしたインライン候補が表示されます
+- **デスクトップ単体利用と同期** - デスクトップアプリはローカルのバックエンドとデータベースを持ち単体でも動き、Termix サーバーと同期することもできます
 
 </details>
 
@@ -313,6 +304,10 @@ Proxmox のインスタンスからそのままホストを取り込めます。
 
 すべてのプラットフォーム向けの詳しいインストール手順は [Termix ドキュメント](https://docs.termix.site/install)をご覧ください。
 
+Kubernetes にデプロイしますか？Helm chart は `charts/termix` にあり、
+Ingress、Traefik、Argo CD、GitHub Actions、GitLab CI を扱うセットアップ手順は
+[docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes) にあります。
+
 Docker Compose の例です（リモートデスクトップ機能を使わないなら `guacd` とネットワークの部分は省略できます）:
 
 ```yaml
@@ -372,9 +367,9 @@ Termix のサーバーは自分のネットワーク内ではなく、VPS で動
 
 ## テレメトリー
 
-Termix は 1 日 1 回、匿名の小さなデータを送ります。どれくらいのインスタンスが動いていて、どの機能が使われているかを把握するためのものです。含まれるのはランダムなインスタンス ID、ユーザーとホストの数、アプリのバージョン、直近 24 時間に使われた機能（ターミナル、ファイルマネージャー、トンネル、Docker など）だけです。ユーザー名、ホスト名、IP アドレス、認証情報など、あなたやサーバーを特定できるものは一切含まれません。
+Termix は 1 日に 1 回、小さな匿名レポートを送信します。これで、どれだけのインスタンスが動いていて、どの機能が使われているかを把握しています。内容はランダムなインスタンス ID、アプリのバージョン、ユーザー数とホスト数です。さらに、プラットフォーム（OS、アーキテクチャ、Node.js のバージョン、データベースの種類、Docker・デスクトップアプリ・通常のサーバーのどれで動いているか）、各種タブが開かれた回数と SSH ログイン数、動作中の組み込み機能を含めることもできます。ユーザー名、ホスト名、IP アドレス、認証情報など、あなたやサーバーを特定できる情報は一切含みません。
 
-初期状態では有効です。管理設定の「一般」から止められますし、Termix を起動する前に `ENABLE_TELEMETRY=false` を設定しておくこともできます。
+初期状態では有効です。管理設定の「Usage Statistics」から止めたり、含める内容を選んだりでき、送信されるレポートをそのまま事前に確認することもできます。各ユーザーはプロフィールで自分の機能利用データを除外できます。`ENABLE_TELEMETRY=false` を設定すると無効になり、スイッチもロックされます。
 
 <br />
 
@@ -390,43 +385,52 @@ Termix は無料でオープンソースで、サブスクリプションも有
 
 有料掲載で開発を支援することにご興味がありますか。[mail@termix.site](mailto:mail@termix.site) までご連絡ください。
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## サポート
@@ -498,3 +502,4 @@ Termix は無料でオープンソースで、サブスクリプションも有
 ## ライセンス
 
 Apache License 2.0 のもとで配布しています。詳しくは `LICENSE` をご覧ください。
+</content>

docs/readme/README-KO.md

@@ -111,7 +111,7 @@ SFTP로 파일을 살펴보고 편집하고 올리고 내려받고 이름을 바
 <td width="50%" valign="top">
 
 **호스트 지표:**
-대부분의 리눅스 서버에서 CPU, 메모리, 디스크, 네트워크, 온도, 가동 시간, 프로세스, 포트, 로그인, 시스템 정보를 기록 그래프와 함께 볼 수 있습니다. 관리 카드로 서비스와 cron 작업, 패키지, 사용자, 방화벽 규칙, WireGuard, Tailscale, SSL 인증서, 로그, 상태 확인을 Termix 안에서 처리할 수 있습니다.
+대부분의 리눅스 서버에서 CPU, 메모리, 디스크, 네트워크, 온도, NVIDIA GPU, 가동 시간, 프로세스, 포트, 로그인, 시스템 정보를 기록 그래프와 함께 볼 수 있습니다. 관리 카드로 서비스와 cron 작업, 패키지, 사용자, 방화벽 규칙, WireGuard, Tailscale, SSL 인증서, 로그, 상태 확인을 Termix 안에서 처리할 수 있습니다.
 
 </td>
 <td width="50%" valign="top">
@@ -214,20 +214,6 @@ Proxmox 인스턴스에서 호스트를 바로 가져오고, 노드와 게스트
 </td>
 <td width="50%" valign="top">
 
-**설치 안내:**
-짧은 설정 과정이 화면 프리셋과 테마, 쓰고 싶은 기능, 첫 호스트를 고르도록 안내합니다. 간단 모드는 쓰지 않는 것을 숨겨 주고, 설정은 언제든 다시 하거나 프리셋을 바꿀 수 있습니다.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**데스크톱 단독 실행과 동기화:**
-데스크톱 앱은 자체 백엔드와 데이터베이스로 서버 없이 혼자 돌아갑니다. Termix 서버에 연결하면 호스트와 자격 증명, 스니펫 등을 양방향으로 동기화할 수 있고, 연결을 로컬에서 시작할지 서버를 거칠지도 고를 수 있습니다.
-
-</td>
-<td width="50%" valign="top">
-
 **명령줄 도구:**
 셸과 스크립트에서 쓰는 `termix` CLI입니다. 터미널을 열고, 호스트 하나나 플릿 전체에서 명령을 실행하고, SFTP로 파일을 옮기고, 호스트와 스니펫, 자격 증명을 관리할 수 있습니다. `npm install -g @termix-cli/cli`로 설치하거나 단독 실행 파일을 받으면 됩니다. [CLI 문서](https://docs.termix.site/cli)를 참고하세요.
 
@@ -237,7 +223,7 @@ Proxmox 인스턴스에서 호스트를 바로 가져오고, 노드와 게스트
 <td width="50%" valign="top">
 
 **보안:**
-비밀번호와 키를 비롯한 비밀 정보는 사용자별로 암호화되고, 데이터베이스 파일 자체도 디스크에서 암호화할 수 있습니다. 어떻게 동작하는지는 [문서](https://docs.termix.site/security)에서 볼 수 있습니다.
+비밀번호와 키를 비롯한 비밀 정보는 사용자별로 암호화되고, 데이터베이스 파일 자체도 디스크에서 암호화할 수 있습니다. 어떻게 동작하는지는 [문서](https://docs.termix.site/features/authentication/security/)에서 볼 수 있습니다.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Proxmox 인스턴스에서 호스트를 바로 가져오고, 노드와 게스트
 - **키보드 단축키** - 탭 이동과 닫기 등, 모두 다시 지정할 수 있습니다
 - **Wake-on-LAN** - Termix에서도, 자동화 단계에서도 컴퓨터를 켜기
 - **신뢰할 수 있는 프록시 인증** - 리버스 프록시가 로그인을 처리하고 사용자 정보를 넘겨주기
-- **풍부한 SSH 기능** - 점프 호스트, Warpgate, TOTP 입력, SOCKS5, 호스트 키 확인, 비밀번호 자동 입력, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, 포트 노킹, 터미널 로그, 에이전트 포워딩, Bitwarden SSH 에이전트, HashiCorp Vault SSH 서명 등
+- **화이트 라벨** - 관리자가 인스턴스를 자기 이름과 로고, 색으로 다시 꾸밀 수 있습니다
+- **웹 엔드포인트** - 라우터 관리 페이지 같은 호스트의 웹 UI를 별도 탭이 아니라 Termix 안에 그대로 띄우기
+- **협업 룸** - 발표자 화면과 초대 기능을 갖춘, 여러 명이 함께 세션을 오가는 상시 룸
+- **풍부한 SSH 기능** - 점프 호스트, Warpgate, TOTP 입력, SOCKS5, 호스트 키 확인, 비밀번호 자동 입력, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, 포트 노킹, 터미널 로그, 에이전트 포워딩, Bitwarden SSH 에이전트, HashiCorp Vault SSH 서명, Step CA, 1Password Connect 등
 - **Termix ID** - sshid.io 같은 기능을 내장했습니다. 핸들을 등록하고 리졸버 URL에 공개 키를 올리고 내장 CA에서 SSH 인증서를 발급할 수 있습니다
+- **명령 기록 자동 완성** - 입력하는 동안 명령 기록을 바탕으로 터미널에 인라인 제안을 보여줍니다
+- **데스크톱 단독 실행과 동기화** - 데스크톱 앱은 자체 백엔드와 데이터베이스로 서버 없이 혼자 돌아가며, Termix 서버와 선택적으로 동기화할 수 있습니다
 
 </details>
 
@@ -313,6 +304,8 @@ Proxmox 인스턴스에서 호스트를 바로 가져오고, 노드와 게스트
 
 모든 플랫폼의 자세한 설치 방법은 [Termix 문서](https://docs.termix.site/install)를 참고하세요.
 
+쿠버네티스에 배포하시나요? Helm 차트는 `charts/termix`에 있고, Ingress와 Traefik, Argo CD, GitHub Actions, GitLab CI를 다루는 설정 안내는 [docs.termix.site/install/server/kubernetes](https://docs.termix.site/install/server/kubernetes)에 있습니다.
+
 Docker Compose 예시입니다(원격 데스크톱 기능을 쓰지 않는다면 `guacd`와 네트워크 부분은 빼도 됩니다):
 
 ```yaml
@@ -372,9 +365,9 @@ Termix 서버는 집 안 네트워크가 아니라 VPS에서 돌릴 수도 있
 
 ## 텔레메트리
 
-Termix는 하루에 한 번 익명의 작은 데이터를 보냅니다. 인스턴스가 얼마나 돌아가는지, 어떤 기능이 쓰이는지 파악하기 위한 것입니다. 여기에는 무작위 인스턴스 ID, 사용자와 호스트 수, 앱 버전, 최근 24시간 동안 쓴 기능(터미널, 파일 관리자, 터널, Docker 등)만 들어갑니다. 사용자 이름과 호스트 이름, IP 주소, 자격 증명처럼 나나 내 서버를 알아볼 수 있는 것은 전혀 담기지 않습니다.
+Termix는 하루에 한 번 작은 익명 보고서를 보내서 몇 개의 인스턴스가 실행 중이고 어떤 기능이 쓰이는지 알 수 있게 합니다. 보고서에는 무작위 인스턴스 ID, 앱 버전, 사용자 수와 호스트 수가 들어 있습니다. 또한 플랫폼 정보(OS, 아키텍처, Node.js 버전, 데이터베이스 종류, Docker·데스크톱 앱·일반 서버 중 무엇으로 실행하는지), 탭 종류별로 열린 횟수와 SSH 로그인 수, 실행 중인 내장 기능도 포함될 수 있습니다. 사용자 이름, 호스트 이름, IP 주소, 자격 증명 등 당신이나 서버를 식별할 수 있는 정보는 절대 포함되지 않습니다.
 
-기본으로 켜져 있습니다. 관리 설정의 일반에서 끄거나, Termix를 시작하기 전에 `ENABLE_TELEMETRY=false`를 지정하면 됩니다.
+기본으로 켜져 있습니다. 관리 설정의 Usage Statistics에서 끄거나 포함할 내용을 고를 수 있고, 보낼 보고서를 미리 그대로 볼 수도 있습니다. 각 사용자는 자신의 프로필에서 본인의 기능 사용 기록을 뺄 수 있습니다. `ENABLE_TELEMETRY=false`를 지정하면 꺼지고 스위치가 잠깁니다.
 
 <br />
 
@@ -390,43 +383,52 @@ Termix는 무료 오픈 소스이고 구독이나 유료 요금제가 없습니
 
 유료 게재로 개발을 지원하고 싶으신가요? [mail@termix.site](mailto:mail@termix.site)로 메일을 보내 주세요.
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## 지원

docs/readme/README-PT.md

@@ -214,20 +214,6 @@ Salva um conjunto de abas com a divisão da tela e reabre tudo com um clique. O
 </td>
 <td width="50%" valign="top">
 
-**Configuração guiada:**
-Uma configuração curta te leva por escolher uma predefinição de interface, o tema, as funcionalidades que queres e o teu primeiro host. O modo simples esconde o que não usas, e dá para refazer a configuração ou trocar de predefinição quando quiseres.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Desktop independente e sincronização:**
-O aplicativo de desktop roda sozinho, com backend e banco de dados locais, sem servidor. Também dá para ligar num servidor Termix e sincronizar nos dois sentidos hosts, credenciais, trechos e mais, e escolher se as conexões saem da tua máquina ou passam pelo servidor.
-
-</td>
-<td width="50%" valign="top">
-
 **Linha de comando:**
 Um CLI `termix` para o teu shell e os teus scripts. Abre terminais, roda um comando num host ou numa frota inteira, move arquivos por SFTP e gerencia hosts, trechos e credenciais. Instala com `npm install -g @termix-cli/cli` ou pega um binário independente. Vê a [documentação do CLI](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ Um CLI `termix` para o teu shell e os teus scripts. Abre terminais, roda um coma
 <td width="50%" valign="top">
 
 **Segurança:**
-Senhas, chaves e outros segredos são criptografados por usuário, e os próprios arquivos do banco de dados podem ser criptografados em disco. Vê a [documentação](https://docs.termix.site/security) para entender como funciona.
+Senhas, chaves e outros segredos são criptografados por usuário, e os próprios arquivos do banco de dados podem ser criptografados em disco. Vê a [documentação](https://docs.termix.site/features/authentication/security/) para entender como funciona.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Cerca de 30 idiomas incluídos, gerenciados pelo [Crowdin](https://docs.termix.s
 - **Atalhos de teclado** - Trocar de aba, fechar abas e mais, tudo remapeável
 - **Wake-on-LAN** - Liga uma máquina pelo Termix ou por um passo de automação
 - **Autenticação por proxy confiável** - Deixa um proxy reverso cuidar do login e repassar o usuário
-- **SSH bem completo** - Hosts de salto, Warpgate, pedidos de TOTP, SOCKS5, verificação de chave de host, preenchimento automático de senha, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro do terminal, encaminhamento de agente, agente SSH do Bitwarden, assinatura SSH com HashiCorp Vault e mais
+- **Marca própria** - Os administradores podem rebatizar a instância com nome, logo e cores próprios
+- **Endpoints web** - Abre a interface web do próprio host, como a página de administração de um roteador, embutida no Termix em vez de numa aba separada
+- **Salas de colaboração** - Salas persistentes onde um grupo pode passar de uma sessão para outra junto, com um palco de apresentação e convites
+- **SSH bem completo** - Hosts de salto, Warpgate, pedidos de TOTP, SOCKS5, verificação de chave de host, preenchimento automático de senha, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, registro do terminal, encaminhamento de agente, agente SSH do Bitwarden, assinatura SSH com HashiCorp Vault, Step CA, 1Password Connect e mais
 - **Termix ID** - Uma versão embutida do sshid.io. Registra um identificador, publica as tuas chaves públicas numa URL de resolução e emite certificados SSH pela CA embutida
+- **Sugestões automáticas de histórico de comandos** - Sugestões dentro do terminal enquanto tu digitas, baseadas no teu histórico de comandos
+- **Desktop independente e sincronização** - O aplicativo de desktop roda sozinho, com backend e banco de dados locais, e pode opcionalmente sincronizar com um servidor Termix
 
 </details>
 
@@ -372,9 +363,9 @@ A [GINERNET](https://docs.termix.site/install/ginernet) patrocina o Termix, e a
 
 ## Telemetria
 
-O Termix manda uma vez por dia um pequeno sinal anônimo, para eu saber quantas instâncias estão rodando e quais funcionalidades são usadas. Ele contém um ID de instância aleatório, quantos usuários e hosts tu tens, a versão do aplicativo e quais funcionalidades (terminal, gerenciador de arquivos, túneis, docker, etc.) foram usadas nas últimas 24 horas. Nunca contém nomes de usuário, nomes de host, endereços IP, credenciais ou qualquer coisa que identifique ti ou os teus servidores.
+O Termix envia uma vez por dia um pequeno relatório anónimo, para eu ver quantas instâncias estão a correr e que funcionalidades são usadas. Contém um ID de instância aleatório, a versão da app e quantos utilizadores e hosts tens. Também pode incluir a tua plataforma (sistema operativo, arquitetura, versão do Node.js, tipo de base de dados e se usas Docker, a app de desktop ou um servidor normal), quantas vezes cada tipo de separador foi aberto e quantos logins SSH houve, e que funcionalidades integradas estão ativas. Nunca contém nomes de utilizador, nomes de host, endereços IP, credenciais ou qualquer outra coisa que te identifique a ti ou aos teus servidores.
 
-Vem ligado por padrão. Podes desligar nas configurações de administração, em Geral, ou definir `ENABLE_TELEMETRY=false` antes mesmo de iniciar o Termix.
+Vem ligado por padrão. Podes desligar ou escolher o que inclui nas configurações de administração, em Usage Statistics, onde também podes ver o relatório exato antes de ser enviado. Cada utilizador pode excluir o seu próprio uso de funcionalidades no perfil. Definir `ENABLE_TELEMETRY=false` desliga-o e bloqueia o interruptor.
 
 <br />
 
@@ -390,43 +381,52 @@ O Termix é gratuito e de código aberto, sem assinaturas nem planos pagos. Se e
 
 Tens interesse num espaço pago para apoiar o desenvolvimento? Escreve para [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Suporte

docs/readme/README-RU.md

@@ -214,20 +214,6 @@ RDP, VNC и Telnet прямо в браузере, во вкладках и с
 </td>
 <td width="50%" valign="top">
 
-**Пошаговая настройка:**
-Короткая настройка поможет выбрать шаблон интерфейса, тему, нужные возможности и первый хост. Простой режим скрывает то, чем вы не пользуетесь, а настройку можно пройти заново или сменить шаблон в любой момент.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Автономный клиент и синхронизация:**
-Настольное приложение работает само по себе, со своим бэкендом и базой данных, без сервера. Его можно подключить к серверу Termix, чтобы в обе стороны синхронизировать хосты, учётные данные, сниппеты и остальное, и выбрать, откуда идут подключения: с вашего компьютера или через сервер.
-
-</td>
-<td width="50%" valign="top">
-
 **Командная строка:**
 CLI `termix` для вашей оболочки и ваших скриптов. Открывайте терминалы, выполняйте команду на одном хосте или на целом флоте, перемещайте файлы по SFTP и управляйте хостами, сниппетами и учётными данными. Установите через `npm install -g @termix-cli/cli` или возьмите отдельный исполняемый файл. Смотрите [документацию CLI](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ CLI `termix` для вашей оболочки и ваших скриптов.
 <td width="50%" valign="top">
 
 **Безопасность:**
-Пароли, ключи и другие секреты шифруются для каждого пользователя, а сами файлы базы данных можно зашифровать на диске. Как это устроено, описано в [документации](https://docs.termix.site/security).
+Пароли, ключи и другие секреты шифруются для каждого пользователя, а сами файлы базы данных можно зашифровать на диске. Как это устроено, описано в [документации](https://docs.termix.site/features/authentication/security/).
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ CLI `termix` для вашей оболочки и ваших скриптов.
 - **Сочетания клавиш** - Переход между вкладками, их закрытие и другое, всё можно переназначить
 - **Wake-on-LAN** - Разбудите машину из Termix или из шага автоматизации
 - **Доверенный прокси** - Пусть обратный прокси возьмёт вход на себя и передаст пользователя
-- **Богатые возможности SSH** - Промежуточные хосты, Warpgate, запросы TOTP, SOCKS5, проверка ключей хоста, автозаполнение паролей, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, журналы терминала, проброс агента, SSH-агент Bitwarden, подпись SSH через HashiCorp Vault и другое
+- **Собственный бренд** - Администраторы могут переоформить установку под своё имя, логотип и цвета
+- **Веб-эндпоинты** - Открывайте собственный веб-интерфейс хоста, например админку роутера, прямо внутри Termix вместо отдельной вкладки
+- **Комнаты для совместной работы** - Постоянные комнаты, где группа может вместе переключаться между сессиями, с режимом докладчика и приглашениями
+- **Богатые возможности SSH** - Промежуточные хосты, Warpgate, запросы TOTP, SOCKS5, проверка ключей хоста, автозаполнение паролей, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, журналы терминала, проброс агента, SSH-агент Bitwarden, подпись SSH через HashiCorp Vault, Step CA, 1Password Connect и другое
 - **Termix ID** - Встроенный аналог sshid.io. Займите имя, опубликуйте открытые ключи по адресу распознавателя и выпускайте SSH-сертификаты через встроенный центр сертификации
+- **Автоподсказки истории команд** - Подсказки прямо в терминале по мере ввода, на основе истории ваших команд
+- **Автономный клиент и синхронизация** - Настольное приложение работает само по себе, со своим бэкендом и локальной базой данных, и может по желанию синхронизироваться с сервером Termix
 
 </details>
 
@@ -372,9 +363,9 @@ termix ssh 1
 
 ## Телеметрия
 
-Termix раз в сутки отправляет небольшой анонимный сигнал, чтобы я понимал, сколько установок работает и какими возможностями действительно пользуются. В нём есть случайный идентификатор установки, число пользователей и хостов, версия приложения и то, какие возможности (терминал, файловый менеджер, туннели, docker и прочее) использовались за последние 24 часа. В нём никогда нет имён пользователей, имён хостов, IP-адресов, учётных данных и ничего другого, что указывало бы на вас или ваши серверы.
+Раз в день Termix отправляет небольшой анонимный отчёт, чтобы я видел, сколько установок работает и какими функциями пользуются. В нём есть случайный ID установки, версия приложения и количество пользователей и хостов. Он также может включать вашу платформу (ОС, архитектуру, версию Node.js, тип базы данных и то, как запущен Termix: в Docker, как настольное приложение или как обычный сервер), сколько раз открывались вкладки каждого типа и сколько было входов по SSH, а также какие встроенные функции работают. В нём никогда нет имён пользователей, имён хостов, IP-адресов, учётных данных или чего-либо ещё, что может указать на вас или ваши серверы.
 
-По умолчанию он включён. Выключить можно в настройках администратора в разделе «Общие» или задать `ENABLE_TELEMETRY=false` ещё до первого запуска Termix.
+По умолчанию он включён. Выключить его или выбрать, что в него входит, можно в настройках администратора в разделе Usage Statistics, там же можно заранее посмотреть точный отчёт. Каждый пользователь может исключить своё использование функций в своём профиле. `ENABLE_TELEMETRY=false` выключает его и блокирует переключатель.
 
 <br />
 
@@ -390,43 +381,52 @@ Termix бесплатен и открыт, без подписок и платн
 
 Интересует платное размещение в поддержку разработки? Напишите на [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Поддержка

docs/readme/README-TR.md

@@ -214,21 +214,7 @@ Bir sekme grubunu bölünmüş düzeniyle birlikte kaydedin ve hepsini tek tıkl
 </td>
 <td width="50%" valign="top">
 
-**Rehberli kurulum:**
-Kısa bir kurulum, arayüz ön ayarını, temanızı, istediğiniz özellikleri ve ilk sunucunuzu seçmenizde size yol gösterir. Basit kip kullanmadığınız şeyleri gizler; kurulumu istediğiniz zaman yeniden çalıştırabilir veya ön ayarı değiştirebilirsiniz.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Bağımsız masaüstü ve eşitleme:**
-Masaüstü uygulaması kendi arka ucu ve veritabanıyla tek başına, sunucusuz çalışır. İsterseniz bir Termix sunucusuna bağlayıp sunucuları, kimlik bilgilerini, parçacıkları ve fazlasını iki yönlü eşitleyebilir, bağlantıların kendi makinenizden mi yoksa sunucu üzerinden mi kurulacağını seçebilirsiniz.
-
-</td>
-<td width="50%" valign="top">
-
-**Komut satırı:**
+**Komut satırı arayüzü:**
 Kabuğunuz ve betikleriniz için bir `termix` CLI'ı. Terminal açın, tek bir sunucuda veya tüm filoda komut çalıştırın, SFTP ile dosya taşıyın ve sunucuları, parçacıkları ve kimlik bilgilerini yönetin. `npm install -g @termix-cli/cli` ile kurun ya da bağımsız bir çalıştırılabilir dosya edinin. [CLI belgelerine](https://docs.termix.site/cli) bakın.
 
 </td>
@@ -237,7 +223,7 @@ Kabuğunuz ve betikleriniz için bir `termix` CLI'ı. Terminal açın, tek bir s
 <td width="50%" valign="top">
 
 **Güvenlik:**
-Parolalar, anahtarlar ve diğer gizli bilgiler kullanıcı bazında şifrelenir, veritabanı dosyalarının kendisi de diskte şifrelenebilir. Nasıl çalıştığı için [belgelere](https://docs.termix.site/security) bakın.
+Parolalar, anahtarlar ve diğer gizli bilgiler kullanıcı bazında şifrelenir, veritabanı dosyalarının kendisi de diskte şifrelenebilir. Nasıl çalıştığı için [belgelere](https://docs.termix.site/features/authentication/security/) bakın.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Yaklaşık 30 dil yerleşik olarak gelir, [Crowdin](https://docs.termix.site/tra
 - **Klavye kısayolları** - Sekmeler arasında geçiş, sekme kapatma ve dahası, hepsi yeniden atanabilir
 - **Wake-on-LAN** - Bir makineyi Termix'ten ya da bir otomasyon adımından uyandırın
 - **Güvenilir vekil doğrulaması** - Girişi ters vekil sunucu halletsin ve kullanıcıyı aktarsın
-- **Zengin SSH desteği** - Atlama sunucuları, Warpgate, TOTP istekleri, SOCKS5, sunucu anahtarı doğrulama, parola otomatik doldurma, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal günlüğü, aracı yönlendirme, Bitwarden SSH aracısı, HashiCorp Vault ile SSH imzalama ve dahası
+- **Beyaz etiket** - Yöneticiler kurulumu kendi adı, logosu ve renkleriyle yeniden markalayabilir
+- **Web uç noktaları** - Bir sunucunun kendi web arayüzünü, örneğin bir yönlendirici yönetim sayfasını, ayrı bir sekme yerine Termix içine gömülü açın
+- **İşbirliği odaları** - Bir grubun oturumlar arasında birlikte geçiş yapabildiği kalıcı odalar; sunum kürsüsü ve davetlerle
+- **Zengin SSH desteği** - Atlama sunucuları, Warpgate, TOTP istekleri, SOCKS5, sunucu anahtarı doğrulama, parola otomatik doldurma, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, terminal günlüğü, aracı yönlendirme, Bitwarden SSH aracısı, HashiCorp Vault ile SSH imzalama, Step CA, 1Password Connect ve dahası
 - **Termix ID** - sshid.io'nun yerleşik hali. Bir kullanıcı adı alın, açık anahtarlarınızı bir çözümleyici adresinde yayımlayın ve yerleşik CA ile SSH sertifikaları çıkarın
+- **Komut geçmişi önerileri** - Yazarken komut geçmişinize dayalı satır içi öneriler
+- **Bağımsız masaüstü ve eşitleme** - Masaüstü uygulaması kendi arka ucu ve veritabanıyla tek başına çalışır, isteğe bağlı olarak bir Termix sunucusuyla eşitlenebilir
 
 </details>
 
@@ -372,9 +363,9 @@ Termix sunucusunu kendi ağınız yerine bir VPS üzerinde de çalıştırabilir
 
 ## Telemetri
 
-Termix günde bir kez küçük ve anonim bir sinyal gönderir; böylece kaç kurulumun çalıştığını ve hangi özelliklerin kullanıldığını görebiliyorum. İçinde rastgele bir kurulum kimliği, kaç kullanıcı ve sunucunuz olduğu, uygulama sürümü ve son 24 saatte hangi özelliklerin (terminal, dosya yöneticisi, tüneller, docker vb.) kullanıldığı yer alır. İçinde asla kullanıcı adları, sunucu adları, IP adresleri, kimlik bilgileri ya da sizi veya sunucularınızı tanımlayan başka bir şey bulunmaz.
+Termix, kaç kurulumun çalıştığını ve hangi özelliklerin kullanıldığını görebilmem için günde bir kez küçük ve anonim bir rapor gönderir. Raporda rastgele bir kurulum kimliği, uygulama sürümü ve kaç kullanıcı ile sunucunuz olduğu bulunur. Ayrıca platformunuzu (işletim sistemi, mimari, Node.js sürümü, veritabanı türü ve Docker, masaüstü uygulaması ya da normal bir sunucu kullanıp kullanmadığınız), her sekme türünün kaç kez açıldığını ve kaç SSH girişi yapıldığını, hangi yerleşik özelliklerin çalıştığını da içerebilir. Kullanıcı adları, sunucu adları, IP adresleri, kimlik bilgileri ya da sizi veya sunucularınızı tanıtacak hiçbir şey asla gönderilmez.
 
-Varsayılan olarak açıktır. Yönetici ayarlarında Genel bölümünden kapatabilir ya da Termix'i hiç başlatmadan önce `ENABLE_TELEMETRY=false` tanımlayabilirsiniz.
+Varsayılan olarak açıktır. Yönetici ayarlarında Usage Statistics bölümünden kapatabilir veya neleri içereceğini seçebilir, gönderilecek raporu olduğu gibi önizleyebilirsiniz. Her kullanıcı kendi özellik kullanımını profilinden hariç tutabilir. `ENABLE_TELEMETRY=false` tanımlamak onu kapatır ve anahtarı kilitler.
 
 <br />
 
@@ -390,43 +381,52 @@ Termix ücretsiz ve açık kaynaklıdır; abonelik ya da ücretli plan yoktur.
 
 Geliştirmeyi desteklemek için ücretli bir yerleşim ilginizi çeker mi? [mail@termix.site](mailto:mail@termix.site) adresine yazın.
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Destek

docs/readme/README-VI.md

@@ -214,20 +214,6 @@ Lưu một bộ thẻ cùng cách chia màn hình rồi mở lại toàn bộ ch
 </td>
 <td width="50%" valign="top">
 
-**Cài đặt có hướng dẫn:**
-Một phần cài đặt ngắn sẽ hướng bạn chọn kiểu giao diện, chủ đề, những tính năng bạn muốn và máy chủ đầu tiên. Chế độ đơn giản ẩn bớt những gì bạn không dùng, và bạn có thể chạy lại phần cài đặt hoặc đổi kiểu bất cứ lúc nào.
-
-</td>
-</tr>
-<tr>
-<td width="50%" valign="top">
-
-**Ứng dụng máy tính độc lập và đồng bộ:**
-Ứng dụng máy tính chạy độc lập với backend và cơ sở dữ liệu riêng, không cần máy chủ. Bạn cũng có thể nối nó với một máy chủ Termix để đồng bộ hai chiều máy chủ, thông tin đăng nhập, đoạn lệnh và nhiều thứ khác, và chọn kết nối xuất phát từ máy của bạn hay đi qua máy chủ.
-
-</td>
-<td width="50%" valign="top">
-
 **Dòng lệnh:**
 Công cụ `termix` cho shell và các script của bạn. Mở terminal, chạy một lệnh trên một máy chủ hoặc cả một nhóm, chuyển tệp qua SFTP, và quản lý máy chủ, đoạn lệnh và thông tin đăng nhập. Cài bằng `npm install -g @termix-cli/cli` hoặc tải bản chạy độc lập. Xem [tài liệu CLI](https://docs.termix.site/cli).
 
@@ -237,7 +223,7 @@ Công cụ `termix` cho shell và các script của bạn. Mở terminal, chạy
 <td width="50%" valign="top">
 
 **Bảo mật:**
-Mật khẩu, khoá và các thông tin bí mật khác được mã hoá theo từng người dùng, và bản thân các tệp cơ sở dữ liệu cũng có thể mã hoá trên ổ đĩa. Xem [tài liệu](https://docs.termix.site/security) để biết cách hoạt động.
+Mật khẩu, khoá và các thông tin bí mật khác được mã hoá theo từng người dùng, và bản thân các tệp cơ sở dữ liệu cũng có thể mã hoá trên ổ đĩa. Xem [tài liệu](https://docs.termix.site/features/authentication/security/) để biết cách hoạt động.
 
 </td>
 <td width="50%" valign="top">
@@ -267,8 +253,13 @@ Có sẵn khoảng 30 ngôn ngữ, quản lý qua [Crowdin](https://docs.termix.
 - **Phím tắt** - Chuyển giữa các thẻ, đóng thẻ và nhiều thao tác khác, đều gán lại được
 - **Wake-on-LAN** - Đánh thức một máy từ Termix hoặc từ một bước tự động hoá
 - **Xác thực qua proxy tin cậy** - Để reverse proxy lo phần đăng nhập rồi chuyển thông tin người dùng vào
-- **SSH nhiều tính năng** - Máy chủ trung gian, Warpgate, hỏi mã TOTP, SOCKS5, kiểm tra khoá máy chủ, tự điền mật khẩu, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, ghi nhật ký terminal, chuyển tiếp agent, SSH agent của Bitwarden, ký SSH bằng HashiCorp Vault và nhiều thứ khác
+- **Nhãn trắng** - Quản trị viên có thể đổi thương hiệu hệ thống với tên, logo và màu sắc riêng
+- **Điểm cuối web** - Mở giao diện web riêng của một máy chủ, chẳng hạn trang quản trị router, ngay trong Termix thay vì mở một thẻ riêng
+- **Phòng cộng tác** - Phòng lâu dài để cả nhóm cùng chuyển qua lại giữa các phiên, có sân khấu người trình bày và lời mời
+- **SSH nhiều tính năng** - Máy chủ trung gian, Warpgate, hỏi mã TOTP, SOCKS5, kiểm tra khoá máy chủ, tự điền mật khẩu, [OPKSSH](https://github.com/openpubkey/opkssh), tmux, port knocking, ghi nhật ký terminal, chuyển tiếp agent, SSH agent của Bitwarden, ký SSH bằng HashiCorp Vault, Step CA, 1Password Connect và nhiều thứ khác
 - **Termix ID** - Bản dựng sẵn theo kiểu sshid.io. Đăng ký một tên, công bố khoá công khai của bạn tại một địa chỉ phân giải, và cấp chứng chỉ SSH từ CA tích hợp
+- **Gợi ý lịch sử lệnh** - Gợi ý ngay trong terminal khi bạn gõ, dựa trên lịch sử lệnh của bạn
+- **Ứng dụng máy tính độc lập và đồng bộ** - Ứng dụng máy tính chạy độc lập với backend và cơ sở dữ liệu riêng, có thể đồng bộ tuỳ chọn với một máy chủ Termix
 
 </details>
 
@@ -372,9 +363,9 @@ Bạn có thể chạy máy chủ Termix trên VPS thay vì trong mạng của m
 
 ## Dữ liệu sử dụng
 
-Termix gửi một tín hiệu nhỏ ẩn danh mỗi ngày một lần, để tôi biết có bao nhiêu bản đang chạy và tính năng nào thực sự được dùng. Nó gồm một mã bản cài ngẫu nhiên, số người dùng và máy chủ bạn có, phiên bản ứng dụng, và những tính năng (terminal, trình quản lý tệp, tunnel, docker, v.v.) đã dùng trong 24 giờ qua. Nó không bao giờ chứa tên người dùng, tên máy chủ, địa chỉ IP, thông tin đăng nhập hay bất cứ thứ gì nhận dạng bạn hoặc máy chủ của bạn.
+Mỗi ngày một lần, Termix gửi một báo cáo ẩn danh nhỏ để tôi biết có bao nhiêu bản cài đặt đang chạy và tính năng nào được dùng. Báo cáo gồm một ID ngẫu nhiên của bản cài đặt, phiên bản ứng dụng, và số người dùng cùng số máy chủ của bạn. Nó cũng có thể gồm nền tảng của bạn (hệ điều hành, kiến trúc, phiên bản Node.js, loại cơ sở dữ liệu, và bạn chạy bằng Docker, ứng dụng máy tính hay máy chủ thường), số lần mỗi loại tab được mở và số lần đăng nhập SSH, cùng các tính năng tích hợp đang chạy. Nó không bao giờ chứa tên người dùng, tên máy chủ, địa chỉ IP, thông tin đăng nhập hay bất cứ thứ gì có thể nhận ra bạn hoặc máy chủ của bạn.
 
-Mặc định là bật. Bạn tắt nó trong phần Cài đặt quản trị, mục Chung, hoặc đặt `ENABLE_TELEMETRY=false` trước cả khi khởi động Termix.
+Mặc định là bật. Bạn có thể tắt hoặc chọn nội dung gửi đi trong phần Cài đặt quản trị, mục Usage Statistics, và xem trước chính xác báo cáo sẽ được gửi. Mỗi người dùng có thể loại phần sử dụng tính năng của riêng mình trong hồ sơ. Đặt `ENABLE_TELEMETRY=false` sẽ tắt nó và khóa công tắc.
 
 <br />
 
@@ -390,43 +381,52 @@ Termix miễn phí và mã nguồn mở, không có gói thuê bao hay bản tr
 
 Bạn muốn đặt quảng cáo trả phí để ủng hộ việc phát triển? Gửi thư tới [mail@termix.site](mailto:mail@termix.site).
 
+<!-- SPONSORS:START -->
+
 <div align="center">
 
 <br />
 
 <a href="https://www.digitalocean.com/">
-  <img src="https://opensource.nyc3.cdn.digitaloceanspaces.com/attribution/assets/SVG/DO_Logo_horizontal_blue.svg" height="40" alt="DigitalOcean" />
+  <img src="https://termix.site/img/sponsors/digitalocean.svg" height="40" alt="DigitalOcean" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://crowdin.com/">
-  <img src="https://support.crowdin.com/assets/logos/core-logo/svg/crowdin-core-logo-cDark.svg" height="40" alt="Crowdin" />
+  <img src="https://termix.site/img/sponsors/crowdin.svg" height="40" alt="Crowdin" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.blacksmith.sh/">
-  <img src="https://cdn.prod.website-files.com/681bfb0c9a4601bc6e288ec4/683ca9e2c5186757092611b8_e8cb22127df4da0811c4120a523722d2_logo-backsmith-wordmark-light.svg" height="40" alt="Blacksmith" />
+  <img src="https://termix.site/img/sponsors/blacksmith.svg" height="40" alt="Blacksmith" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://www.cloudflare.com/">
-  <img src="https://sirv.sirv.com/website/screenshots/cloudflare/cloudflare-logo.png?w=300" height="40" alt="Cloudflare" />
+  <img src="https://termix.site/img/sponsors/cloudflare.png" height="40" alt="Cloudflare" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://akamai.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/8/8b/Akamai_logo.svg" height="40" alt="Akamai" />
+  <img src="https://termix.site/img/sponsors/akamai.svg" height="40" alt="Akamai" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://aws.amazon.com/">
-  <img src="https://upload.wikimedia.org/wikipedia/commons/thumb/9/93/Amazon_Web_Services_Logo.svg/960px-Amazon_Web_Services_Logo.svg.png" height="40" alt="AWS" />
+  <img src="https://termix.site/img/sponsors/aws.png" height="40" alt="AWS" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://rackgenius.com/">
-  <img src="https://rackgenius.com/rackgenius-logo.png" height="40" alt="Rack Genius" />
+  <img src="https://termix.site/img/sponsors/rackgenius.png" height="40" alt="Rack Genius" />
 </a>
 &nbsp;&nbsp;&nbsp;
 <a href="https://ginernet.com/">
-  <img src="https://ginernet.com/img/logo-web.png" height="40" alt="Ginernet" />
+  <img src="https://termix.site/img/sponsors/ginernet.png" height="40" alt="Ginernet" />
 </a>
+&nbsp;&nbsp;&nbsp;
+<a href="https://www.hetzner.com/?mtm_campaign=termix&mtm_medium=referral&mtm_content=sponsoring_link">
+  <img src="https://termix.site/img/sponsors/hetzner.png" height="40" alt="Hetzner" />
+</a>
+
 </div>
 
+<!-- SPONSORS:END -->
+
 <br />
 
 ## Hỗ trợ

drizzle/mysql/0015_red_cobalt_man.sql

@@ -0,0 +1,34 @@
+CREATE TABLE `collab_room_members` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`room_id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`room_role` text NOT NULL DEFAULT ('member'),
+	`added_by` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `collab_room_members_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_collab_room_members_room_user` UNIQUE(`room_id`,`user_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `collab_rooms` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`persistent` boolean NOT NULL DEFAULT false,
+	`presenter_user_id` varchar(255),
+	`stage_protocol` text,
+	`stage_host_id` int,
+	`stage_share_id` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`ended_at` text,
+	CONSTRAINT `collab_rooms_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_room_id_collab_rooms_id_fk` FOREIGN KEY (`room_id`) REFERENCES `collab_rooms`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_room_members` ADD CONSTRAINT `collab_room_members_added_by_users_id_fk` FOREIGN KEY (`added_by`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_presenter_user_id_users_id_fk` FOREIGN KEY (`presenter_user_id`) REFERENCES `users`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_stage_host_id_ssh_data_id_fk` FOREIGN KEY (`stage_host_id`) REFERENCES `ssh_data`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `collab_rooms_stage_share_id_session_shares_id_fk` FOREIGN KEY (`stage_share_id`) REFERENCES `session_shares`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_collab_room_members_user` ON `collab_room_members` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_collab_rooms_owner` ON `collab_rooms` (`owner_user_id`);

drizzle/mysql/0016_unusual_tyrannus.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `collab_rooms` ADD `guest_link_token` varchar(255);--> statement-breakpoint
+ALTER TABLE `collab_rooms` ADD CONSTRAINT `idx_collab_rooms_guest_token` UNIQUE(`guest_link_token`);

drizzle/mysql/0017_spicy_proteus.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `secret_sources` (
+	`id` varchar(255) NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`kind` text NOT NULL DEFAULT ('onepassword-connect'),
+	`base_url` text NOT NULL,
+	`token` text NOT NULL,
+	`shared` boolean NOT NULL DEFAULT false,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `secret_sources_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `secret_sources` ADD CONSTRAINT `secret_sources_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_secret_sources_user` ON `secret_sources` (`user_id`);

drizzle/mysql/0018_fancy_barracuda.sql

@@ -0,0 +1,42 @@
+CREATE TABLE `credential_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_id` int NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('use'),
+	`expires_at` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `credential_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `shared_credential_secrets` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`credential_access_id` int NOT NULL,
+	`target_user_id` varchar(255) NOT NULL,
+	`credential_id` int NOT NULL,
+	`encrypted_username` text,
+	`auth_type` text NOT NULL DEFAULT ('password'),
+	`encrypted_password` text,
+	`encrypted_key` text,
+	`encrypted_key_password` text,
+	`key_type` text,
+	`public_key` text,
+	`cert_public_key` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `shared_credential_secrets_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_shared_credential_secrets_scope` UNIQUE(`credential_access_id`,`target_user_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `credential_access` ADD CONSTRAINT `credential_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_cred_secrets_access_id_fk` FOREIGN KEY (`credential_access_id`) REFERENCES `credential_access`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_credential_secrets_target_user_id_users_id_fk` FOREIGN KEY (`target_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` ADD CONSTRAINT `shared_credential_secrets_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_credential_access_user_id` ON `credential_access` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_role_id` ON `credential_access` (`role_id`);--> statement-breakpoint
+CREATE INDEX `idx_credential_access_credential_id` ON `credential_access` (`credential_id`);--> statement-breakpoint
+CREATE INDEX `idx_shared_credential_secrets_target` ON `shared_credential_secrets` (`target_user_id`,`credential_id`);

drizzle/mysql/0019_certain_archangel.sql

@@ -0,0 +1,22 @@
+CREATE TABLE `folder_access` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`owner_user_id` varchar(255) NOT NULL,
+	`folder` varchar(255) NOT NULL,
+	`user_id` varchar(255),
+	`role_id` int,
+	`granted_by` varchar(255) NOT NULL,
+	`permission_level` text NOT NULL DEFAULT ('connect'),
+	`expires_at` varchar(255),
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `folder_access_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `snippets` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `vault_profiles` MODIFY COLUMN `folder` varchar(255);--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_owner_user_id_users_id_fk` FOREIGN KEY (`owner_user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_role_id_roles_id_fk` FOREIGN KEY (`role_id`) REFERENCES `roles`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `folder_access` ADD CONSTRAINT `folder_access_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_folder_access_owner_folder` ON `folder_access` (`owner_user_id`,`folder`);

drizzle/mysql/0020_wise_green_goblin.sql

@@ -0,0 +1,2 @@
+ALTER TABLE `ssh_data` ADD `enable_web_ui` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `web_ui_config` text;

drizzle/mysql/0021_thick_galactus.sql

@@ -0,0 +1 @@
+ALTER TABLE `ssh_data` ADD `enable_ai_assistant` boolean DEFAULT false NOT NULL;

drizzle/mysql/0022_secret_blacklash.sql

@@ -0,0 +1,51 @@
+CREATE TABLE `plugin_install_counts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`registry_id` varchar(255) NOT NULL,
+	`count` int NOT NULL DEFAULT 0,
+	`source` text NOT NULL DEFAULT ('aggregate-telemetry'),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_install_counts_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_install_counts_plugin_registry` UNIQUE(`plugin_id`,`registry_id`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugin_permission_grants` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`capability` varchar(255) NOT NULL,
+	`granted_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`granted_by` varchar(255) NOT NULL,
+	CONSTRAINT `plugin_permission_grants_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_permission_grants_plugin_capability` UNIQUE(`plugin_id`,`capability`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugin_registries` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`url` text NOT NULL,
+	`kind` text NOT NULL DEFAULT ('community'),
+	`enabled` boolean NOT NULL DEFAULT true,
+	`signing_key` text,
+	`last_checked_at` text,
+	`last_index_hash` text,
+	CONSTRAINT `plugin_registries_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `plugins` (
+	`id` varchar(255) NOT NULL,
+	`name` varchar(255) NOT NULL,
+	`version` text NOT NULL,
+	`tier` text NOT NULL DEFAULT ('available'),
+	`source` text NOT NULL DEFAULT ('community'),
+	`registry_id` varchar(255),
+	`state` text NOT NULL DEFAULT ('disabled'),
+	`installed_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`auto_update` boolean NOT NULL DEFAULT false,
+	`manifest_json` text NOT NULL,
+	CONSTRAINT `plugins_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_permission_grants` ADD CONSTRAINT `plugin_permission_grants_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `plugin_permission_grants` ADD CONSTRAINT `plugin_permission_grants_granted_by_users_id_fk` FOREIGN KEY (`granted_by`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_plugins_registry_id` ON `plugins` (`registry_id`);

drizzle/mysql/0023_even_beast.sql

@@ -0,0 +1 @@
+ALTER TABLE `user_preferences` ADD `show_pin_app_rail_button` boolean;

drizzle/mysql/0024_thin_colleen_wing.sql

@@ -0,0 +1,11 @@
+CREATE TABLE `plugin_storage` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`key` varchar(255) NOT NULL,
+	`value` text NOT NULL,
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_storage_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_storage_plugin_key` UNIQUE(`plugin_id`,`key`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_storage` ADD CONSTRAINT `plugin_storage_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0025_wet_master_mold.sql

@@ -0,0 +1,3 @@
+DROP TABLE `alert_firings`;--> statement-breakpoint
+DROP TABLE `alert_rule_channels`;--> statement-breakpoint
+DROP TABLE `alert_rules`;

drizzle/mysql/0026_empty_black_bird.sql

@@ -0,0 +1,3 @@
+ALTER TABLE `plugin_permission_grants` MODIFY COLUMN `granted_by` varchar(255);--> statement-breakpoint
+ALTER TABLE `plugin_permission_grants` ADD `source` text DEFAULT ('admin') NOT NULL;--> statement-breakpoint
+ALTER TABLE `plugins` ADD `last_error` text;

drizzle/mysql/0027_watery_multiple_man.sql

@@ -0,0 +1,11 @@
+CREATE TABLE `plugin_migrations` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`migration_id` varchar(255) NOT NULL,
+	`checksum` text NOT NULL,
+	`applied_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_migrations_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_migrations_plugin_migration` UNIQUE(`plugin_id`,`migration_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_migrations` ADD CONSTRAINT `plugin_migrations_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;

drizzle/mysql/0028_fair_tusk.sql

@@ -0,0 +1,17 @@
+CREATE TABLE `rbac_applied_defaults` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`role_name` varchar(255) NOT NULL,
+	`permission` varchar(255) NOT NULL,
+	`applied_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `rbac_applied_defaults_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_rbac_applied_defaults_role_permission` UNIQUE(`role_name`,`permission`)
+);
+--> statement-breakpoint
+CREATE TABLE `rbac_known_permissions` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`permission` varchar(255) NOT NULL,
+	`plugin_id` varchar(255),
+	`first_seen_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `rbac_known_permissions_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_rbac_known_permissions_permission` UNIQUE(`permission`)
+);

drizzle/mysql/0029_open_captain_america.sql

@@ -0,0 +1,15 @@
+CREATE TABLE `plugin_settings` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`scope` enum('admin','user','host','secret') NOT NULL,
+	`scope_id` varchar(255),
+	`key` varchar(255) NOT NULL,
+	`value` text,
+	`encrypted` boolean NOT NULL DEFAULT false,
+	`updated_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `plugin_settings_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_plugin_settings_scope_key` UNIQUE(`plugin_id`,`scope`,`scope_id`,`key`)
+);
+--> statement-breakpoint
+ALTER TABLE `plugin_settings` ADD CONSTRAINT `plugin_settings_plugin_id_plugins_id_fk` FOREIGN KEY (`plugin_id`) REFERENCES `plugins`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_plugin_settings_plugin_scope` ON `plugin_settings` (`plugin_id`,`scope`);

drizzle/mysql/0030_sweet_warlock.sql

@@ -0,0 +1,24 @@
+CREATE TABLE `user_external_identities` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`provider_id` varchar(255) NOT NULL,
+	`subject` varchar(255) NOT NULL,
+	`email` text,
+	`created_at` varchar(255) NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_external_identities_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_user_external_identities_provider_subject` UNIQUE(`provider_id`,`subject`)
+);
+--> statement-breakpoint
+CREATE TABLE `user_second_factors` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`plugin_id` varchar(255) NOT NULL,
+	`factor_id` varchar(255) NOT NULL,
+	`enrolled_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `user_second_factors_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_user_second_factors_user_factor` UNIQUE(`user_id`,`plugin_id`,`factor_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `user_external_identities` ADD CONSTRAINT `user_external_identities_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `user_second_factors` ADD CONSTRAINT `user_second_factors_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_user_external_identities_user` ON `user_external_identities` (`user_id`);

drizzle/mysql/0031_nebulous_diamondback.sql

@@ -0,0 +1,5 @@
+-- user_workspaces moved to the workspaces plugin, whose first migration renames it
+-- to p_workspaces_workspaces. Dropping it here would lose every saved workspace,
+-- so this only stops drizzle tracking it. SELECT 1 because MySQL rejects an
+-- empty query.
+SELECT 1;

drizzle/mysql/0032_lethal_marrow.sql

@@ -0,0 +1,4 @@
+-- network_topology moved to the network-topology plugin, which adopts (renames)
+-- this table in its own migration before this drizzle migration would run.
+-- No DROP here: it would delete every row before the plugin's rename applies.
+SELECT 1;

drizzle/mysql/0033_clear_anthem.sql

@@ -0,0 +1,4 @@
+-- snippets, snippet_folders and snippet_access moved to the snippets plugin
+-- (p_snippets_*), adopted by rename rather than dropped. A real DROP TABLE
+-- here would run before the plugin's adoption migration and delete every row.
+SELECT 1;

drizzle/mysql/0034_green_vector.sql

@@ -0,0 +1,2 @@
+-- dropped, see plugin adoption (fleets plugin, migrations/mysql/0001_adopt_fleets.sql)
+SELECT 1;

drizzle/mysql/0035_clumsy_leech.sql

@@ -0,0 +1,6 @@
+-- proxmox_node_history and proxmox_stats_preferences moved to the proxmox
+-- plugin (p_proxmox_*), adopted by rename rather than dropped. The four
+-- ssh_data proxmox columns are copied into the plugin's host settings after
+-- plugins load, which is after this migration, so a real DROP COLUMN here
+-- would delete the data first. The columns stay in place, unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0036_dear_vapor.sql

@@ -0,0 +1,5 @@
+-- file_manager_pinned, file_manager_recent, file_manager_shortcuts and
+-- transfer_recent are adopted (renamed, not dropped) by the file-manager
+-- plugin's own migration, which runs at plugin activation, after core's
+-- drizzle migrations. A DROP TABLE here would run first and delete the data.
+SELECT 1;

drizzle/mysql/0037_foamy_norman_osborn.sql

@@ -0,0 +1,5 @@
+-- c2s_tunnel_presets moved to the tunnels plugin, whose first migration renames
+-- it to p_tunnels_presets. Dropping it here would lose every saved preset, so
+-- this only stops drizzle tracking it. SELECT 1 because MySQL rejects an
+-- empty query.
+SELECT 1;

drizzle/mysql/0038_quiet_karnak.sql

@@ -0,0 +1,5 @@
+-- command_history moved to the ssh-terminal plugin, whose first migration
+-- renames it to p_ssh_terminal_command_history. Dropping it here would lose
+-- every saved command, so this only stops drizzle tracking it. SELECT 1
+-- because MySQL rejects an empty query.
+SELECT 1;

drizzle/mysql/0039_condemned_shiva.sql

@@ -0,0 +1,5 @@
+-- tmux_session_tags moved to the tmux-monitor plugin, whose first migration
+-- renames it to p_tmux_monitor_session_tags. Dropping it here would lose
+-- every saved tag, so this only stops drizzle tracking it. SELECT 1 because
+-- MySQL rejects an empty query.
+SELECT 1;

drizzle/mysql/0040_misty_skin.sql

@@ -0,0 +1,6 @@
+-- session_shares, session_share_participants, collab_rooms and
+-- collab_room_members moved to the session-sharing plugin, whose first
+-- migration renames them. Dropping them here would lose every share and
+-- room, so this only stops drizzle tracking them. SELECT 1 because MySQL
+-- rejects an empty query.
+SELECT 1;

drizzle/mysql/0041_wonderful_cargill.sql

@@ -0,0 +1,5 @@
+-- session_recordings moved to the session-recording plugin, whose first
+-- migration renames it. Dropping it here would lose every recording, so
+-- this only stops drizzle tracking it. SELECT 1 because MySQL rejects an
+-- empty query.
+SELECT 1;

drizzle/mysql/0042_colorful_bill_hollister.sql

@@ -0,0 +1,7 @@
+-- The remote desktop host options (enable_rdp, enable_vnc, enable_telnet,
+-- the three ports, rdp_security, rdp_ignore_cert, security, ignore_cert,
+-- guacamole_config) and user_preferences.rdp_defaults moved to the
+-- remote-desktop plugin's settings. The copy runs after plugins load, which
+-- is after this migration, so a real DROP COLUMN here would delete the data
+-- first. The columns stay in place, unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0043_unusual_lucky_pierre.sql

@@ -0,0 +1,9 @@
+-- host_metrics_preferences, host_health_checks, host_health_history and
+-- host_metrics_history moved to the host-metrics plugin, which adopts them by
+-- rename in its own first migration. That runs after this one, so a real
+-- DROP TABLE here would delete every row first.
+SELECT 1;--> statement-breakpoint
+-- Status checks are core: the per-host switch and interval, copied out of
+-- stats_config at boot by host-status-config-migration.ts.
+ALTER TABLE `ssh_data` ADD `status_check_enabled` boolean DEFAULT true NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `status_check_interval` int;

drizzle/mysql/0044_jittery_thunderball.sql

@@ -0,0 +1,6 @@
+-- ssh_data.stats_config split: its status half moved to status_check_enabled
+-- and status_check_interval, its metrics half to the host-metrics plugin's
+-- host settings. Both copies run at boot, after this migration, so a real
+-- DROP COLUMN here would delete the data first. The column stays in place,
+-- unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0045_flowery_the_hood.sql

@@ -0,0 +1,5 @@
+-- ssh_data.enable_docker and docker_config moved to the docker plugin's host
+-- settings. The copy runs at boot, after this migration, so a real DROP
+-- COLUMN here would delete the data first. The columns stay in place,
+-- unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0046_rich_logan.sql

@@ -0,0 +1,4 @@
+-- The automation tables moved to the automations plugin, which renames them
+-- into its own namespace at activation. That runs after this migration, so a
+-- real DROP TABLE here would delete every automation first.
+SELECT 1;

drizzle/mysql/0047_red_silver_sable.sql

@@ -0,0 +1,8 @@
+-- The ai tables moved to the ai plugin, which renames them into its own
+-- namespace at activation, and ssh_data.enable_ai_assistant and the two
+-- user_preferences ai columns moved to its settings. Both run after this
+-- migration, so a real DROP here would delete the data first. The columns
+-- stay in place, unused, until 3.0.0. The timestamp and label type changes
+-- drizzle-kit also wrote are generator drift (see FINISH-LIST.md), not a
+-- change to the database, and are left out on purpose.
+SELECT 1;

drizzle/mysql/0048_hard_demogoblin.sql

@@ -0,0 +1,6 @@
+-- dashboard_service_links, homepage_items and homepage_layouts moved to the
+-- homepage plugin, which adopts them by rename at activation (see
+-- plugins/homepage/migrations/mysql/0001_adopt_homepage_tables.sql).
+-- Dropping them here would delete every row before the plugin's migration
+-- ever runs, since this runs at boot before the plugins table exists.
+SELECT 1;

drizzle/mysql/0049_quiet_blacklash.sql

@@ -0,0 +1,4 @@
+-- mac_address and wol_broadcast_address move to the wake-on-lan plugin's
+-- host settings at boot, after this migration runs. Dropping them here would
+-- delete the data before the copy has a chance to run.
+SELECT 1;

drizzle/mysql/0050_optimal_speedball.sql

@@ -0,0 +1,4 @@
+-- secret_sources moves to the secret-sources plugin's adopted table at
+-- activation, after this migration runs. Dropping it here would delete the
+-- data before the plugin has a chance to rename it.
+SELECT 1;

drizzle/mysql/0051_icy_hercules.sql

@@ -0,0 +1,4 @@
+-- webauthn_credentials moves to the webauthn plugin's adopted table at
+-- activation, and the users TOTP columns are read by the TOTP boot migration
+-- after this runs. Dropping either here would lose the data first.
+SELECT 1;

drizzle/mysql/0052_illegal_gladiator.sql

@@ -0,0 +1,4 @@
+-- sso_providers moves to the sso plugin's adopted table at activation, and
+-- its LDAP rows are copied into the ldap plugin by a boot migration after
+-- this runs. Dropping it here would lose the data first.
+SELECT 1;

drizzle/mysql/0053_magical_groot.sql

@@ -0,0 +1,5 @@
+-- opkssh_tokens moves to the opkssh plugin's adopted table at activation,
+-- and ssh_data.use_warpgate is copied into the warpgate plugin's host
+-- settings by a boot migration after this runs. Dropping either here would
+-- lose the data first.
+SELECT 1;

drizzle/mysql/0054_wakeful_misty_knight.sql

@@ -0,0 +1,5 @@
+-- vault_profiles and vault_tokens move to the vault plugin's adopted tables
+-- at activation, and ssh_data.vault_profile_id is copied into the vault
+-- plugin's host settings by a boot migration after this runs. Dropping any
+-- of them here would lose the data first.
+SELECT 1;

drizzle/mysql/0055_icy_patch.sql

@@ -0,0 +1,4 @@
+-- termix_identities, termix_identity_keys and termix_identity_ca move to the
+-- termix-identity plugin's adopted tables at activation. Dropping them here
+-- would lose the data first.
+SELECT 1;

drizzle/mysql/0056_supreme_toad_men.sql

@@ -0,0 +1,52 @@
+-- The dialect generator now decides varchar or text per table. Columns that
+-- were varchar(255) only because the same name was a key in another table
+-- become text, and the timestamps and labels B18's regeneration left as
+-- varchar(255) on real databases follow. varchar to text keeps every value.
+ALTER TABLE `api_keys` MODIFY COLUMN `name` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `api_keys` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `api_keys` MODIFY COLUMN `expires_at` text;--> statement-breakpoint
+ALTER TABLE `credential_access` MODIFY COLUMN `expires_at` text;--> statement-breakpoint
+ALTER TABLE `credential_access` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `credential_sidebar_preferences` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `folder_access` MODIFY COLUMN `expires_at` text;--> statement-breakpoint
+ALTER TABLE `folder_access` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_access` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `host_sidebar_preferences` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `name` text;--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `folder` text;--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_data` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `notification_channels` MODIFY COLUMN `name` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `notification_channels` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `plugin_install_counts` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `plugin_registries` MODIFY COLUMN `name` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `plugin_settings` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `plugin_storage` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `plugins` MODIFY COLUMN `name` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `plugins` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `rbac_known_permissions` MODIFY COLUMN `plugin_id` text;--> statement-breakpoint
+ALTER TABLE `roles` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `roles` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `sessions` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_credential_secrets` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_auth_overrides` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `name` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `folder` text;--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_credentials` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_folders` MODIFY COLUMN `name` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_folders` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `ssh_folders` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `sync_tombstones` MODIFY COLUMN `sync_id` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `trusted_devices` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `trusted_devices` MODIFY COLUMN `expires_at` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `ui_preferences` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_external_identities` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `label` text NOT NULL;--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_open_tabs` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);--> statement-breakpoint
+ALTER TABLE `user_preferences` MODIFY COLUMN `updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP);

drizzle/mysql/0057_serious_shatterstar.sql

@@ -0,0 +1,6 @@
+-- The file manager, tunnels, web endpoint, terminal, tmux monitor, session
+-- sharing and session recording host columns, and the dead show_*_in_sidebar
+-- columns, moved to their plugins' host settings. The copies run after
+-- plugins load, which is after this migration, so a real DROP COLUMN here
+-- would delete the data first. The columns stay in place, unused, until 3.0.0.
+SELECT 1;

drizzle/mysql/0058_boring_avengers.sql

@@ -0,0 +1,6 @@
+-- dismissed_alerts and notification_channels moved to the alerts plugin. It
+-- renames the first into its own namespace and copies the second at
+-- activation, both after this migration, so a real DROP TABLE here would
+-- delete them first. notification_channels stays in place, unused, until
+-- 3.0.0.
+SELECT 1;

drizzle/mysql/0059_military_purple_man.sql

@@ -0,0 +1,59 @@
+CREATE TABLE `sync_conflicts` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`entity_type` text NOT NULL,
+	`sync_id` text NOT NULL,
+	`local_row` text NOT NULL,
+	`server_revision` int NOT NULL,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `sync_conflicts_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `sync_link` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`server_url` text NOT NULL,
+	`server_name` text,
+	`server_version` text,
+	`session_token` text,
+	`custom_headers` text,
+	`basic_auth` text,
+	`allow_invalid_certificate` boolean NOT NULL DEFAULT false,
+	`remote_user_id` text,
+	`remote_username` text,
+	`account` text,
+	`scope` text,
+	`known_types` text,
+	`cursor` int NOT NULL DEFAULT 0,
+	`status` text NOT NULL DEFAULT ('idle'),
+	`last_error` text,
+	`linked_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`last_sync_at` text,
+	CONSTRAINT `sync_link_id` PRIMARY KEY(`id`)
+);
+--> statement-breakpoint
+CREATE TABLE `sync_records` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`entity_type` varchar(255) NOT NULL,
+	`sync_id` varchar(255) NOT NULL,
+	`revision` int NOT NULL DEFAULT 0,
+	`seq` int NOT NULL DEFAULT 0,
+	`hash` text,
+	`deleted` boolean NOT NULL DEFAULT false,
+	`error` text,
+	`error_hash` text,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `sync_records_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_sync_records_user_entity_sync` UNIQUE(`user_id`,`entity_type`,`sync_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `local_only` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `shared_source` text;--> statement-breakpoint
+ALTER TABLE `ssh_credentials` ADD `shared_source` text;--> statement-breakpoint
+ALTER TABLE `ssh_folders` ADD `local_only` boolean DEFAULT false NOT NULL;--> statement-breakpoint
+ALTER TABLE `sync_conflicts` ADD CONSTRAINT `sync_conflicts_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `sync_link` ADD CONSTRAINT `sync_link_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `sync_records` ADD CONSTRAINT `sync_records_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_sync_conflicts_user` ON `sync_conflicts` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_sync_records_user_seq` ON `sync_records` (`user_id`,`seq`);

drizzle/mysql/0060_mean_gorgon.sql

@@ -0,0 +1 @@
+DROP TABLE `sync_tombstones`;

drizzle/mysql/0061_plugin_settings_scope_enum.sql

@@ -0,0 +1 @@
+ALTER TABLE `plugin_settings` MODIFY COLUMN `scope` enum('admin','user','host','secret') NOT NULL;

drizzle/mysql/0062_smooth_speed.sql

@@ -0,0 +1 @@
+ALTER TABLE `ssh_data` ADD `ssh_options` text;

drizzle/mysql/0063_needy_radioactive_man.sql

@@ -0,0 +1,26 @@
+-- The RDP, VNC and Telnet logins moved out of ssh_data into host_protocol_auth.
+-- A boot migration copies them after this runs, so the old ssh_data columns
+-- and their foreign keys stay in place, unused, until 3.0.0.
+CREATE TABLE `host_protocol_auth` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`host_id` int NOT NULL,
+	`user_id` varchar(255) NOT NULL,
+	`protocol` varchar(255) NOT NULL,
+	`auth_type` text NOT NULL DEFAULT ('direct'),
+	`credential_id` int,
+	`username` text,
+	`password` text,
+	`fields` text,
+	`secret_fields` text,
+	`created_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `host_protocol_auth_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_host_protocol_auth_host_protocol` UNIQUE(`host_id`,`protocol`)
+);
+--> statement-breakpoint
+ALTER TABLE `shared_host_secrets` ADD `encrypted_fields` text;--> statement-breakpoint
+ALTER TABLE `host_protocol_auth` ADD CONSTRAINT `host_protocol_auth_host_id_ssh_data_id_fk` FOREIGN KEY (`host_id`) REFERENCES `ssh_data`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_protocol_auth` ADD CONSTRAINT `host_protocol_auth_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_protocol_auth` ADD CONSTRAINT `host_protocol_auth_credential_id_ssh_credentials_id_fk` FOREIGN KEY (`credential_id`) REFERENCES `ssh_credentials`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_host_protocol_auth_user` ON `host_protocol_auth` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_host_protocol_auth_credential` ON `host_protocol_auth` (`credential_id`);

drizzle/mysql/0064_flippant_killer_shrike.sql

@@ -0,0 +1,5 @@
+-- ssh_data.autostart_password, autostart_key and autostart_key_password held
+-- copies of a host's login for 2.8's autostart endpoint, which nothing has read
+-- since. They leave the schema but stay in place, unused, until 3.0.0, so no
+-- install loses what it stored.
+SELECT 1;

drizzle/mysql/0065_ambiguous_agent_zero.sql

@@ -0,0 +1,20 @@
+CREATE TABLE `host_defaults` (
+	`id` int AUTO_INCREMENT NOT NULL,
+	`level` enum('admin','user','folder') NOT NULL,
+	`scope_key` varchar(255) NOT NULL,
+	`user_id` varchar(255),
+	`folder_id` int,
+	`namespace` varchar(255) NOT NULL,
+	`key` varchar(255) NOT NULL,
+	`value` text,
+	`updated_by` text,
+	`updated_at` text NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+	CONSTRAINT `host_defaults_id` PRIMARY KEY(`id`),
+	CONSTRAINT `idx_host_defaults_scope_key` UNIQUE(`scope_key`,`namespace`,`key`)
+);
+--> statement-breakpoint
+ALTER TABLE `ssh_data` ADD `default_overrides` text;--> statement-breakpoint
+ALTER TABLE `host_defaults` ADD CONSTRAINT `host_defaults_user_id_users_id_fk` FOREIGN KEY (`user_id`) REFERENCES `users`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `host_defaults` ADD CONSTRAINT `host_defaults_folder_id_ssh_folders_id_fk` FOREIGN KEY (`folder_id`) REFERENCES `ssh_folders`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `idx_host_defaults_user` ON `host_defaults` (`user_id`);--> statement-breakpoint
+CREATE INDEX `idx_host_defaults_folder` ON `host_defaults` (`folder_id`);