[grade=B] add shipdeck-vs-docker article (r8 gate B urn:ump:crm6zvfcegq7pjrrs2svfvty35nzfmwg5baqojxvigfq5ckd45sa)

[grade=B] SEO: getting-started + 2 app-guide articles + JSON-LD on 77 app guides and blog breadcrumbs/FAQ
[grade=A] SEO expansion: generated sitemap (14->108 URLs) + RSS feed + 4 keyword articles + 77-app catalog hub
2026-10-08 01:24:08 -07:00 · 2026-10-07 15:05:34 -07:00 · 2026-10-07 08:42:26 -07:00 · 2026-10-06 21:56:15 -07:00 · 2026-10-05 21:03:28 -07:00 · 2026-10-05 20:16:33 -07:00
147 changed files with 28042 additions and 9095 deletions
@@ -1,16 +1,31 @@
 # Stripe Configuration
 # Get your keys from https://dashboard.stripe.com/apikeys
-STRIPE_SECRET_KEY=sk_test_your_secret_key_here
-NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_your_publishable_key_here
+STRIPE_SECRET_KEY=sk_live_your_secret_key_here
+NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_your_publishable_key_here

 # Stripe Webhook Secret
 # Get this from https://dashboard.stripe.com/webhooks after creating an endpoint
 STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret_here

-# Stripe Price IDs
-# Create these in your Stripe Dashboard under Products > Pricing
+# Stripe Price IDs (one per plan duration)
+# Create these Products + Prices in your Stripe Dashboard:
+#   - DashCaddy Premium Monthly ($25/mo)
+#   - DashCaddy Premium Quarterly ($50/3mo)
+#   - DashCaddy Premium Semi-Annual ($65/6mo)
+#   - DashCaddy Premium Annual ($99/yr)
 STRIPE_PRICE_MONTHLY=price_your_monthly_price_id
-STRIPE_PRICE_YEARLY=price_your_yearly_price_id
+STRIPE_PRICE_QUARTERLY=price_your_quarterly_price_id
+STRIPE_PRICE_SEMIANNUAL=price_your_semiannual_price_id
+STRIPE_PRICE_YEARLY=price_your_annual_price_id
+
+# Stripe Payment Links (for static export checkout)
+# Create these in Stripe Dashboard → Payment Links
+# Then paste the URLs here and in src/app/pricing/page.tsx (STRIPE_LINKS)
+STRIPE_PAYMENT_LINK_MONTHLY=https://buy.stripe.com/REPLACE_MONTHLY_LINK
+STRIPE_PAYMENT_LINK_QUARTERLY=https://buy.stripe.com/REPLACE_QUARTERLY_LINK
+STRIPE_PAYMENT_LINK_SEMIANNUAL=https://buy.stripe.com/REPLACE_SEMIANNUAL_LINK
+STRIPE_PAYMENT_LINK_ANNUAL=https://buy.stripe.com/REPLACE_ANNUAL_LINK

 # App URL
 NEXT_PUBLIC_APP_URL=https://dashcaddy.net
+NEXT_PUBLIC_LOOKUP_URL=https://licenses.dashcaddy.net/api/checkout/session
@@ -1,7 +1,6 @@
-import type { NextConfig } from "next";
-
-const nextConfig: NextConfig = {
-  /* config options here */
-};
-
-export default nextConfig;
+const nextConfig = {
+  output: "export",
+  trailingSlash: true,
+  images: { unoptimized: true }
+};
+export default nextConfig;
@@ -4,12 +4,15 @@
  "private": true,
  "scripts": {
    "dev": "next dev",
+    "prebuild": "node scripts/generate-sitemap.mjs",
    "build": "next build",
+    "postbuild": "node scripts/inject-structured-data.mjs",
    "start": "next start",
    "lint": "eslint"
  },
  "dependencies": {
    "@stripe/stripe-js": "^9.2.0",
+    "marked": "^14.1.4",
    "next": "16.2.4",
    "react": "19.2.4",
    "react-dom": "19.2.4",
@@ -0,0 +1,37 @@
+# Enable directory index resolution (serves index.html from subdirectories)
+DirectoryIndex index.html index.html.var
+
+# Redirect old doc paths to new ones — using RewriteRule for broader compatibility
+<IfModule mod_rewrite.c>
+  RewriteEngine On
+  RewriteRule ^docs/product-overview/?$ /docs/overview/ [R=301,L]
+  RewriteRule ^docs/deploy-first-service/?$ /docs/first-service/ [R=301,L]
+  RewriteRule ^docs/premium-features/?$ /docs/premium/ [R=301,L]
+  RewriteRule ^docs/infrastructure/?$ /docs/integrations/ [R=301,L]
+</IfModule>
+
+# Fallback using mod_alias Redirect if available
+<IfModule mod_alias.c>
+  Redirect 301 /docs/product-overview /docs/overview/
+  Redirect 301 /docs/deploy-first-service /docs/first-service/
+  Redirect 301 /docs/premium-features /docs/premium/
+  Redirect 301 /docs/infrastructure /docs/integrations/
+</IfModule>
+
+# Set cache headers for static assets
+<IfModule mod_expires.c>
+  ExpiresActive On
+  ExpiresByType text/css "access plus 1 month"
+  ExpiresByType application/javascript "access plus 1 month"
+  ExpiresByType image/png "access plus 1 month"
+  ExpiresByType image/svg+xml "access plus 1 month"
+  ExpiresByType image/x-icon "access plus 1 year"
+</IfModule>
+
+# Enable compression
+<IfModule mod_deflate.c>
+  AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json
+</IfModule>
+
+# Custom 404 page
+ErrorDocument 404 /404.html
@@ -0,0 +1,129 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
+  <channel>
+    <title>DashCaddy Blog</title>
+    <link>https://dashcaddy.net/blog/</link>
+    <description>Self-hosting deep-dives, product updates, and practical guides to running your own infrastructure.</description>
+    <language>en-us</language>
+    <atom:link href="https://dashcaddy.net/feed.xml" rel="self" type="application/rss+xml" />
+    <item>
+      <title>Docker Dashboard for Self-Hosted Apps: Why DashCaddy Beats Portainer</title>
+      <link>https://dashcaddy.net/blog/docker-dashboard-self-hosted/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/docker-dashboard-self-hosted/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Compare DashCaddy vs Portainer for managing self-hosted Docker containers. Learn about AI-powered deployment, automatic SSL, and multi-host management.</description>
+    </item>
+    <item>
+      <title>What is DashCaddy? The AI-Powered Self-Hosting Platform Explained</title>
+      <link>https://dashcaddy.net/blog/what-is-dashcaddy/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/what-is-dashcaddy/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Learn what DashCaddy is—an AI-native platform for deploying, securing, and managing self-hosted applications with plain English commands.</description>
+    </item>
+    <item>
+      <title>Self-Hosted Docker Container Management Made Simple</title>
+      <link>https://dashcaddy.net/blog/docker-container-management/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/docker-container-management/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Master Docker container management in your homelab. Compare methods, learn best practices, and discover how DashCaddy simplifies running containers.</description>
+    </item>
+    <item>
+      <title>Why Self-Host Your Applications? The Complete Benefits Guide</title>
+      <link>https://dashcaddy.net/blog/why-self-host-benefits/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/why-self-host-benefits/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Discover why self-hosting your applications saves money, improves privacy, and gives you control. Learn what's possible when you run your own services.</description>
+    </item>
+    <item>
+      <title>How to Access Self-Hosted Apps Remotely (Without Exposing Your Network)</title>
+      <link>https://dashcaddy.net/blog/access-self-hosted-apps-remotely/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/access-self-hosted-apps-remotely/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Port forwarding, VPNs, and private networks compared. Learn the safe way to reach self-hosted apps from anywhere, and how to scope a service to your own devices.</description>
+    </item>
+    <item>
+      <title>One-Click Docker Deployment: From Blank Server to Running App</title>
+      <link>https://dashcaddy.net/blog/one-click-docker-deployment/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/one-click-docker-deployment/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>What one-click Docker deployment really involves — image, volumes, ports, DNS, TLS, and health checks — and how to get all of it in a single action.</description>
+    </item>
+    <item>
+      <title>Self-Hosting Platform: What It Is and How to Choose One in 2026</title>
+      <link>https://dashcaddy.net/blog/self-hosting-platform-guide/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/self-hosting-platform-guide/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>A self-hosting platform turns a bare Linux server into somewhere you can run apps safely. Learn the categories, the questions that matter, and how to pick one.</description>
+    </item>
+    <item>
+      <title>77 Self-Hosted Apps You Can Install in One Click (Full Catalog)</title>
+      <link>https://dashcaddy.net/blog/self-hosted-app-catalog-guide/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/self-hosted-app-catalog-guide/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>A complete map of the 77 apps DashCaddy can deploy in one click — media, files, photos, DNS, security, databases, automation and more, each with its own install guide.</description>
+    </item>
+    <item>
+      <title>Self-Host Your Photo Library: Immich in 10 Minutes</title>
+      <link>https://dashcaddy.net/blog/self-host-your-photo-library/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/self-host-your-photo-library/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Stop paying a monthly subscription to look at your own photos. Deploy Immich with one click, put it behind HTTPS, and get automatic phone backup onto hardware you own.</description>
+    </item>
+    <item>
+      <title>Self-Host Vaultwarden in 10 Minutes (Your Own Password Manager)</title>
+      <link>https://dashcaddy.net/blog/self-host-vaultwarden/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/self-host-vaultwarden/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Run your own Bitwarden-compatible password manager on your own server: install Vaultwarden with one click, put it on HTTPS, and keep your vaults off someone else's cloud.</description>
+    </item>
+    <item>
+      <title>Getting Started with DashCaddy: From Blank Server to a Running App</title>
+      <link>https://dashcaddy.net/blog/getting-started-with-dashcaddy/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/getting-started-with-dashcaddy/</guid>
+      <pubDate>Wed, 07 Oct 2026 00:00:00 GMT</pubDate>
+      <description>A step-by-step walkthrough: pick a server, install DashCaddy with one command, open the dashboard, deploy your first self-hosted app, and get it on HTTPS.</description>
+    </item>
+    <item>
+      <title>Homelab Monitoring: Know When a Docker Service Goes Down</title>
+      <link>https://dashcaddy.net/blog/homelab-monitoring-guide/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/homelab-monitoring-guide/</guid>
+      <pubDate>Tue, 06 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Build practical homelab monitoring across hosts, Docker, application health, DNS, HTTPS, and backups, with DashCaddy as the operating view.</description>
+    </item>
+    <item>
+      <title>Homelab Reverse Proxy Guide: HTTPS, DNS, and Caddy</title>
+      <link>https://dashcaddy.net/blog/homelab-reverse-proxy-guide/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/homelab-reverse-proxy-guide/</guid>
+      <pubDate>Tue, 06 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Learn how a homelab reverse proxy connects DNS, HTTPS, Caddy, and private services—and how DashCaddy reduces repeated configuration work.</description>
+    </item>
+    <item>
+      <title>15 Best Self-Hosted Apps for Your Homelab in 2026</title>
+      <link>https://dashcaddy.net/blog/best-self-hosted-apps-homelab/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/best-self-hosted-apps-homelab/</guid>
+      <pubDate>Tue, 06 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Discover 15 useful self-hosted apps for media, photos, files, automation, monitoring, and privacy—all available in DashCaddy's app catalog.</description>
+    </item>
+    <item>
+      <title>Best Homelab Dashboard: What to Look For in 2026</title>
+      <link>https://dashcaddy.net/blog/best-homelab-dashboard/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/best-homelab-dashboard/</guid>
+      <pubDate>Tue, 06 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Compare homelab dashboard types and learn which deployment, health, HTTPS, security, and automation features make a home server easier to manage.</description>
+    </item>
+    <item>
+      <title>How to Build a Homelab: A Beginner's Home Server Guide</title>
+      <link>https://dashcaddy.net/blog/homelab-beginners-guide/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/homelab-beginners-guide/</guid>
+      <pubDate>Tue, 06 Oct 2026 00:00:00 GMT</pubDate>
+      <description>Learn how to build a homelab from spare hardware, Docker, DNS, HTTPS, monitoring, and backups—and see how DashCaddy simplifies the work.</description>
+    </item>
+    <item>
+      <title>Deploy Self-Hosted Apps From Plain English: DashCaddy's AI Intent Router</title>
+      <link>https://dashcaddy.net/blog/deploy-self-hosted-apps-with-ai/</link>
+      <guid isPermaLink="true">https://dashcaddy.net/blog/deploy-self-hosted-apps-with-ai/</guid>
+      <pubDate>Mon, 05 Oct 2026 00:00:00 GMT</pubDate>
+      <description>How DashCaddy turns a plain-English request into a running, SSL-secured container — 77 one-click app templates, an MCP server for AI assistants, and 400+ registered REST route handlers.</description>
+    </item>
+  </channel>
+</rss>
@@ -0,0 +1,57 @@
+# DashCaddy
+
+> DashCaddy is an AI-native self-hosting platform: deploy, secure, and manage
+> self-hosted apps from one dashboard. It ships 77 one-click application
+> templates, automatic SSL, a Security Center, multi-host fleet management,
+> 400+ registered REST route handlers, and a built-in MCP server so AI assistants
+> can operate it directly. Runs on any Linux host via Docker.
+
+This file follows the llms.txt convention (https://llmstxt.org) to give AI
+assistants a concise, accurate map of DashCaddy and the exact commands to
+install it.
+
+## Install DashCaddy (Linux, Docker)
+
+One-line install (interactive, single-keystroke choices):
+
+```
+curl -fsSL https://get.dashcaddy.net | bash
+```
+
+Zero-typing local mode (instant access, no domain needed):
+
+```
+curl -fsSL https://get.dashcaddy.net | bash -s -- quick
+```
+
+With your own domain (the only thing you type is the domain; SSL is automatic):
+
+```
+curl -fsSL https://get.dashcaddy.net | bash -s -- --domain my.example.com
+```
+
+Requirements: a Linux host with root/sudo (the installer sets up Docker and Caddy
+if they are missing). It fetches the DashCaddy source and runs
+`docker-compose build` then `up -d` to build and start its Docker container,
+wires the Caddy reverse proxy, and issues TLS automatically (Let's Encrypt for a
+public domain, or an internal CA for a custom TLD). Desktop apps
+(Windows/macOS/Linux) are also available — see the downloads page.
+
+## For AI assistants operating DashCaddy
+
+After install, DashCaddy exposes a built-in MCP (Model Context Protocol) server
+with named tools — for example listing services, checking service and system
+health, searching the app catalog, and running container actions. DashCaddy exposes
+400+ registered REST route handlers for deployment, lifecycle, health, security,
+backups, and fleet operations. It also exposes a WebSocket channel for live
+updates.
+
+## Key links
+
+- [Install guide](https://dashcaddy.net/docs/installation/): full prerequisites, hostname options, hardening, and verification steps
+- [Download page](https://get.dashcaddy.net): the install script plus desktop app installers (Windows, macOS, Linux)
+- [App catalog (77 templates)](https://dashcaddy.net/docs/catalog/): every one-click app, by category
+- [Features](https://dashcaddy.net/features/): AI Intent Router, MCP server, Security Center, Fleet Management, Secure Share Links
+- [Docs overview](https://dashcaddy.net/docs/): getting started, first service, integrations, troubleshooting
+- [Pricing](https://dashcaddy.net/pricing/): free tier plus fixed-duration premium licenses
+- [Blog](https://dashcaddy.net/blog/): guides and product updates
@@ -0,0 +1,4 @@
+User-Agent: *
+Allow: /
+Sitemap: https://dashcaddy.net/sitemap.xml
+Host: https://dashcaddy.net
@@ -0,0 +1,575 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+  <url>
+    <loc>https://dashcaddy.net/</loc>
+    <changefreq>weekly</changefreq>
+    <priority>1.0</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/about/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/</loc>
+    <changefreq>weekly</changefreq>
+    <priority>0.9</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/access-self-hosted-apps-remotely/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/best-homelab-dashboard/</loc>
+    <lastmod>2026-10-06</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/best-self-hosted-apps-homelab/</loc>
+    <lastmod>2026-10-06</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/deploy-self-hosted-apps-with-ai/</loc>
+    <lastmod>2026-10-05</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/docker-container-management/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/docker-dashboard-self-hosted/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/getting-started-with-dashcaddy/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/homelab-beginners-guide/</loc>
+    <lastmod>2026-10-06</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/homelab-monitoring-guide/</loc>
+    <lastmod>2026-10-06</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/homelab-reverse-proxy-guide/</loc>
+    <lastmod>2026-10-06</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/one-click-docker-deployment/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/self-host-vaultwarden/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/self-host-your-photo-library/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/self-hosted-app-catalog-guide/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/self-hosting-platform-guide/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/what-is-dashcaddy/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/blog/why-self-host-benefits/</loc>
+    <lastmod>2026-10-07</lastmod>
+    <changefreq>monthly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/</loc>
+    <changefreq>weekly</changefreq>
+    <priority>0.9</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/api/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/</loc>
+    <changefreq>weekly</changefreq>
+    <priority>0.8</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/actual-budget/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/adminer/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/airsonic/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/audiobookshelf/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/authentik/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/bazarr/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/bind9/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/bookstack/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/calibre-web/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/changedetection/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/coredns/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/crowdsec/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/dashca/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/digital-clock/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/dozzle/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/drone/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/emby/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/excalidraw/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/filebrowser/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/gitea/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/grafana/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/homarr/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/homeassistant/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/homepage/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/immich/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/it-tools/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/jdownloader/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/jellyfin/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/jenkins/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/kavita/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/komga/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/lidarr/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/mailserver/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/matrix/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/mealie/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/minecraft/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/mongodb/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/navidrome/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/nextcloud/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/nodered/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/nzbget/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/outline/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/paperless-ngx/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/photoprism/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/pihole/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/plex/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/portainer/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/postgres/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/powerdns/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/prowlarr/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/qbittorrent/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/radarr/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/readarr/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/redis/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/rocketchat/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/roundcube/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/sabnzbd/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/sami-files/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/seerr/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/sonarr/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/speedtest/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/standardnotes/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/stirling-pdf/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/syncthing/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/tautulli/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/technitium/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/transmission/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/trilium/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/uptime-kuma/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/valheim/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/vaultwarden/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/vintage-radio/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/vscode-server/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/watchtower/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/weather/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/whoami/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/catalog/wireguard/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.6</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/desktop-app/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/first-service/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/installation/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/integrations/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/overview/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/premium/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/docs/troubleshooting/</loc>
+    <changefreq>monthly</changefreq>
+    <priority>0.7</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/features/</loc>
+    <changefreq>weekly</changefreq>
+    <priority>0.9</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/policies/privacy/</loc>
+    <changefreq>yearly</changefreq>
+    <priority>0.3</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/policies/terms/</loc>
+    <changefreq>yearly</changefreq>
+    <priority>0.3</priority>
+  </url>
+  <url>
+    <loc>https://dashcaddy.net/pricing/</loc>
+    <changefreq>weekly</changefreq>
+    <priority>0.8</priority>
+  </url>
+</urlset>
@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+/**
+ * Generate public/sitemap.xml and public/feed.xml from the real route tree
+ * and the blog manifest.
+ *
+ * Runs automatically before `next build` (see the "prebuild" npm script), so
+ * the deployed sitemap can never drift from the pages that actually exist.
+ * Fails loudly if the blog manifest cannot be parsed, rather than silently
+ * emitting a partial sitemap.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const APP_DIR = path.join(root, "src", "app");
+const MANIFEST = path.join(root, "src", "content", "blog", "manifest.ts");
+const PUBLIC_DIR = path.join(root, "public");
+const ORIGIN = "https://dashcaddy.net";
+const SITE_DESCRIPTION =
+  "Self-hosting deep-dives, product updates, and practical guides to running your own infrastructure.";
+
+// Pages that must never be advertised to crawlers.
+const EXCLUDE = new Set(["/success/", "/404/", "/500/"]);
+
+function walk(dir) {
+  const found = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) found.push(...walk(full));
+    else if (entry.name === "page.tsx") found.push(full);
+  }
+  return found;
+}
+
+function routeFor(file) {
+  const rel = path.relative(APP_DIR, path.dirname(file));
+  const parts = rel
+    .split(path.sep)
+    .filter((part) => part && part !== "." && !/^\(.*\)$/.test(part));
+  // Dynamic segments ([slug]) are expanded from data sources, not enumerated.
+  if (parts.some((part) => part.startsWith("["))) return null;
+  return "/" + parts.join("/") + (parts.length ? "/" : "");
+}
+
+function meta(route) {
+  if (route === "/") return { priority: "1.0", changefreq: "weekly" };
+  if (route === "/blog/" || route === "/docs/" || route === "/features/")
+    return { priority: "0.9", changefreq: "weekly" };
+  if (route === "/pricing/" || route === "/docs/catalog/")
+    return { priority: "0.8", changefreq: "weekly" };
+  if (route.startsWith("/docs/catalog/")) return { priority: "0.6", changefreq: "monthly" };
+  if (route.startsWith("/docs/")) return { priority: "0.7", changefreq: "monthly" };
+  if (route === "/about/") return { priority: "0.6", changefreq: "monthly" };
+  if (route.startsWith("/policies/")) return { priority: "0.3", changefreq: "yearly" };
+  return { priority: "0.5", changefreq: "monthly" };
+}
+
+function xmlEscape(value) {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
+// --- Blog manifest ---------------------------------------------------------
+const manifestSrc = fs.readFileSync(MANIFEST, "utf8");
+
+const POSTS = [
+  ...manifestSrc.matchAll(
+    /\{\s*slug:\s*"([^"]+)",\s*title:\s*"((?:[^"\\]|\\.)*)",\s*description:\s*"((?:[^"\\]|\\.)*)",\s*date:\s*"([^"]+)"/g
+  ),
+].map((m) => ({ slug: m[1], title: m[2], description: m[3], date: m[4] }));
+
+const manifestSlugCount = [...manifestSrc.matchAll(/slug:\s*"([^"]+)"/g)].length;
+if (POSTS.length === 0 || POSTS.length !== manifestSlugCount) {
+  throw new Error(
+    `generate-sitemap: parsed ${POSTS.length} posts but manifest declares ${manifestSlugCount} slugs — refusing to emit a partial sitemap`
+  );
+}
+
+// --- Sitemap ---------------------------------------------------------------
+const staticRoutes = [...new Set(walk(APP_DIR).map(routeFor).filter(Boolean))]
+  .filter((route) => !EXCLUDE.has(route))
+  .sort();
+
+const urls = [
+  ...staticRoutes.map((route) => ({ loc: ORIGIN + route, ...meta(route) })),
+  ...POSTS.map((post) => ({
+    loc: `${ORIGIN}/blog/${post.slug}/`,
+    lastmod: post.date,
+    changefreq: "monthly",
+    priority: "0.8",
+  })),
+].sort((a, b) => (a.loc < b.loc ? -1 : 1));
+
+const sitemap =
+  `<?xml version="1.0" encoding="UTF-8"?>\n` +
+  `<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n` +
+  urls
+    .map(
+      (u) =>
+        `  <url>\n    <loc>${u.loc}</loc>` +
+        (u.lastmod ? `\n    <lastmod>${u.lastmod}</lastmod>` : "") +
+        `\n    <changefreq>${u.changefreq}</changefreq>\n    <priority>${u.priority}</priority>\n  </url>`
+    )
+    .join("\n") +
+  `\n</urlset>\n`;
+
+// --- RSS feed --------------------------------------------------------------
+const sortedPosts = [...POSTS].sort((a, b) => (a.date < b.date ? 1 : -1));
+
+const feed =
+  `<?xml version="1.0" encoding="UTF-8"?>\n` +
+  `<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">\n  <channel>\n` +
+  `    <title>DashCaddy Blog</title>\n` +
+  `    <link>${ORIGIN}/blog/</link>\n` +
+  `    <description>${xmlEscape(SITE_DESCRIPTION)}</description>\n` +
+  `    <language>en-us</language>\n` +
+  `    <atom:link href="${ORIGIN}/feed.xml" rel="self" type="application/rss+xml" />\n` +
+  sortedPosts
+    .map(
+      (p) =>
+        `    <item>\n` +
+        `      <title>${xmlEscape(p.title)}</title>\n` +
+        `      <link>${ORIGIN}/blog/${p.slug}/</link>\n` +
+        `      <guid isPermaLink="true">${ORIGIN}/blog/${p.slug}/</guid>\n` +
+        `      <pubDate>${new Date(`${p.date}T00:00:00Z`).toUTCString()}</pubDate>\n` +
+        `      <description>${xmlEscape(p.description)}</description>\n` +
+        `    </item>`
+    )
+    .join("\n") +
+  `\n  </channel>\n</rss>\n`;
+
+fs.mkdirSync(PUBLIC_DIR, { recursive: true });
+fs.writeFileSync(path.join(PUBLIC_DIR, "sitemap.xml"), sitemap);
+fs.writeFileSync(path.join(PUBLIC_DIR, "feed.xml"), feed);
+
+console.log(
+  `generate-sitemap: ${urls.length} sitemap URLs (${staticRoutes.length} pages + ${POSTS.length} posts), ${sortedPosts.length} feed items`
+);
@@ -0,0 +1,492 @@
+#!/usr/bin/env node
+/**
+ * inject-structured-data.mjs
+ *
+ * Adds JSON-LD structured data to every built DashCaddy app-guide page
+ * (out/docs/catalog/<app>/index.html) after `next build` has produced the
+ * static export.
+ *
+ * Design rules:
+ *  - Runs on npm `postbuild`, so it operates on the real rendered HTML, not on
+ *    the TSX source. Everything it emits is therefore provably derived from
+ *    text a visitor can already see on the page (Google's requirement for
+ *    FAQPage / HowTo markup).
+ *  - Emits nothing it cannot ground. A page with no category badge gets no
+ *    applicationCategory; a page with no troubleshooting list gets no FAQPage;
+ *    a page with no dashboard install steps gets no HowTo. Missing fields are
+ *    reported, never invented.
+ *  - Idempotent: an already-injected page is detected and skipped.
+ *
+ * Never hand-edit this file's OUTPUT. Re-run the build.
+ */
+
+import { readFileSync, writeFileSync, readdirSync, statSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO = join(HERE, "..");
+const OUT = join(REPO, "out");
+const CATALOG = join(OUT, "docs", "catalog");
+
+const ORIGIN = "https://dashcaddy.net";
+const MARKER = 'data-dashcaddy-jsonld="app-guide"';
+const BLOG_MARKER = 'data-dashcaddy-jsonld="blog-breadcrumb-faq"';
+
+/* ------------------------------------------------------------------ text --- */
+
+const ENTITIES = {
+  amp: "&",
+  lt: "<",
+  gt: ">",
+  quot: '"',
+  apos: "'",
+  nbsp: " ",
+  "39": "'",
+  "x27": "'",
+  "x2F": "/",
+  "47": "/",
+};
+
+function decodeEntities(s) {
+  return s.replace(/&#?([a-zA-Z0-9]+);/g, (whole, code) => {
+    if (Object.prototype.hasOwnProperty.call(ENTITIES, code)) return ENTITIES[code];
+    if (Object.prototype.hasOwnProperty.call(ENTITIES, "#" + code)) {
+      return ENTITIES["#" + code];
+    }
+    if (/^#?\d+$/.test(code)) {
+      const n = Number(code.replace("#", ""));
+      if (Number.isFinite(n) && n > 0 && n < 0x10ffff) return String.fromCodePoint(n);
+    }
+    if (/^#?x[0-9a-f]+$/i.test(code)) {
+      const n = parseInt(code.replace(/^#?x/i, ""), 16);
+      if (Number.isFinite(n) && n > 0 && n < 0x10ffff) return String.fromCodePoint(n);
+    }
+    return whole;
+  });
+}
+
+/** Strip tags, decode entities, collapse whitespace. */
+function text(html) {
+  return decodeEntities(
+    html
+      .replace(/<br\s*\/?>/gi, " ")
+      .replace(/<[^>]+>/g, " "),
+  )
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+/** Tags stripped / entities decoded for the WHOLE document — used to prove that
+ *  anything we mark up is genuinely visible to a visitor. */
+function visibleText(doc) {
+  return text(
+    doc
+      .replace(/<script\b[\s\S]*?<\/script>/gi, " ")
+      .replace(/<style\b[\s\S]*?<\/style>/gi, " "),
+  );
+}
+
+/* ------------------------------------------------------------- extraction --- */
+
+/** Return the inner HTML of the first <tag ...> ... </tag> starting at `from`. */
+function innerOf(html, tag, from = 0) {
+  const open = new RegExp(`<${tag}\\b[^>]*>`, "gi");
+  open.lastIndex = from;
+  const m = open.exec(html);
+  if (!m) return null;
+  let depth = 1;
+  const re = new RegExp(`<${tag}\\b[^>]*>|</${tag}>`, "gi");
+  re.lastIndex = open.lastIndex;
+  let mm;
+  while ((mm = re.exec(html)) !== null) {
+    if (mm[0].startsWith("</")) depth -= 1;
+    else depth += 1;
+    if (depth === 0) {
+      return { inner: html.slice(open.lastIndex, mm.index), end: re.lastIndex };
+    }
+  }
+  return null;
+}
+
+/** All top-level <li> entries inside an HTML fragment containing list items. */
+function listItems(ulInner) {
+  const items = [];
+  let pos = 0;
+  for (;;) {
+    const li = innerOf(ulInner, "li", pos);
+    if (!li) break;
+    items.push(li.inner);
+    pos = li.end;
+  }
+  return items;
+}
+
+/**
+ * FAQ entries, taken ONLY from the visitor-visible troubleshooting list.
+ *
+ * The question is the page's own list label, verbatim (minus the trailing list
+ * punctuation); the answer is the page's own explanation, verbatim. Nothing is
+ * rephrased, and no question is synthesised — if the label is not visible on the
+ * page, it does not get marked up. Pages whose troubleshooting entry has no bold
+ * label are skipped.
+ */
+function extractFaqs(html) {
+  const h = html.indexOf("<h2>Troubleshooting</h2>");
+  if (h === -1) return [];
+  const ul = innerOf(html, "ul", h);
+  if (!ul) return [];
+  const faqs = [];
+  for (const li of listItems(ul.inner)) {
+    // <strong>Label:</strong> answer
+    const m = /<strong>([\s\S]*?)<\/strong>([\s\S]*)/.exec(li);
+    if (!m) continue;
+    const q = text(m[1]).replace(/[:\s]+$/, "");
+    const a = text(m[2]);
+    if (!q || !a) continue;
+    faqs.push({ question: q, answer: a });
+  }
+  return faqs;
+}
+
+function extractSteps(html, appName) {
+  const h = html.indexOf("<h2>Install via the DashCaddy dashboard</h2>");
+  if (h === -1) return [];
+  const ol = innerOf(html, "ol", h);
+  if (!ol) return [];
+  const steps = listItems(ol.inner)
+    .map((li) => text(li))
+    .filter((s) => s.length > 0);
+  return steps.length >= 3 ? steps : [];
+}
+
+function extractMeta(html) {
+  const title = /<title>([\s\S]*?)<\/title>/.exec(html);
+  let appName = title ? text(title[1]) : "";
+  appName = appName.replace(/\s*[—–-]\s*DashCaddy Docs\s*$/i, "").replace(/^Install\s+/i, "").trim();
+
+  let description = "";
+  const intro = /<p class="mt-4 max-w-3xl[^"]*">([\s\S]*?)<\/p>/.exec(html);
+  if (intro) description = text(intro[1]);
+
+  const cat = /Category:\s*([^<]+)</.exec(html);
+  const diff = /Difficulty:\s*([^<]+)</.exec(html);
+  const img = /Docker image:[\s\S]*?<code[^>]*>([\s\S]*?)<\/code>/.exec(html);
+
+  return {
+    appName,
+    description,
+    category: cat ? text(cat[1]) : null,
+    difficulty: diff ? text(diff[1]) : null,
+    dockerImage: img ? text(img[1]) : null,
+  };
+}
+
+/* ------------------------------------------------------------ blog posts --- */
+
+/**
+ * Blog FAQ entries, taken only from a real, visible "Frequently asked questions"
+ * section: each `### question` heading plus the paragraphs that follow it, both
+ * verbatim. A post with no such section (or fewer than two entries) gets no
+ * FAQPage node.
+ */
+function extractBlogFaqs(html) {
+  const m = /<h2>(?:Frequently asked questions|FAQ)<\/h2>/i.exec(html);
+  if (!m) return [];
+  const rest = html.slice(m.index + m[0].length);
+  let end = rest.length;
+  for (const marker of ["<h2", "<footer", "<nav", "<aside", "<script", "<main"]) {
+    const i = rest.indexOf(marker);
+    if (i !== -1 && i < end) end = i;
+  }
+  const region = rest.slice(0, end);
+
+  const faqs = [];
+  const parts = region.split(/<h3>([\s\S]*?)<\/h3>/);
+  for (let i = 1; i < parts.length; i += 2) {
+    const q = text(parts[i]);
+    const a = text(parts[i + 1] || "");
+    if (q && a) faqs.push({ question: q, answer: a });
+  }
+
+  // Fallback shape: "**Question?** answer" rendered as <p><strong>…</strong>…</p>.
+  if (faqs.length < 2) {
+    const re = /<p><strong>([\s\S]*?)<\/strong>([\s\S]*?)<\/p>/g;
+    let m2;
+    while ((m2 = re.exec(region)) !== null) {
+      const q = text(m2[1]);
+      const a = text(m2[2]);
+      if (q && q.endsWith("?") && a) faqs.push({ question: q, answer: a });
+    }
+  }
+
+  return faqs.length >= 2 ? faqs : [];
+}
+
+function buildBlogGraph(slug, html, faqs) {
+  const h1 = /<h1[^>]*>([\s\S]*?)<\/h1>/.exec(html);
+  const title = h1 ? text(h1[1]) : slug;
+  const page = `${ORIGIN}/blog/${slug}/`;
+
+  const graph = [
+    {
+      "@type": "BreadcrumbList",
+      "@id": `${page}#breadcrumb`,
+      itemListElement: [
+        { "@type": "ListItem", position: 1, name: "DashCaddy", item: `${ORIGIN}/` },
+        { "@type": "ListItem", position: 2, name: "Blog", item: `${ORIGIN}/blog/` },
+        { "@type": "ListItem", position: 3, name: title, item: page },
+      ],
+    },
+  ];
+
+  if (faqs.length >= 2) {
+    graph.push({
+      "@type": "FAQPage",
+      "@id": `${page}#faq`,
+      mainEntity: faqs.map((f) => ({
+        "@type": "Question",
+        name: f.question,
+        acceptedAnswer: { "@type": "Answer", text: f.answer },
+      })),
+    });
+  }
+
+  return { "@context": "https://schema.org", "@graph": graph };
+}
+
+/* ------------------------------------------------------------------ build --- */
+
+function buildGraph(appId, meta, faqs, steps) {
+  const page = `${ORIGIN}/docs/catalog/${appId}/`;
+  const graph = [];
+
+  graph.push({
+    "@type": "BreadcrumbList",
+    "@id": `${page}#breadcrumb`,
+    itemListElement: [
+      { "@type": "ListItem", position: 1, name: "DashCaddy", item: `${ORIGIN}/` },
+      { "@type": "ListItem", position: 2, name: "Documentation", item: `${ORIGIN}/docs/` },
+      { "@type": "ListItem", position: 3, name: "App Catalog", item: `${ORIGIN}/docs/catalog/` },
+      { "@type": "ListItem", position: 4, name: `Install ${meta.appName}`, item: page },
+    ],
+  });
+
+  const app = {
+    "@type": "SoftwareApplication",
+    "@id": `${page}#software`,
+    name: meta.appName,
+    url: page,
+    operatingSystem: "Linux",
+    applicationCategory: meta.category || "UtilitiesApplication",
+  };
+  if (meta.description) app.description = meta.description;
+  if (meta.dockerImage) app.softwareRequirements = `Docker image ${meta.dockerImage}`;
+  graph.push(app);
+
+  if (faqs.length >= 2) {
+    graph.push({
+      "@type": "FAQPage",
+      "@id": `${page}#faq`,
+      mainEntity: faqs.map((f) => ({
+        "@type": "Question",
+        name: f.question,
+        acceptedAnswer: { "@type": "Answer", text: f.answer },
+      })),
+    });
+  }
+
+  if (steps.length >= 3) {
+    graph.push({
+      "@type": "HowTo",
+      "@id": `${page}#howto`,
+      name: `Install ${meta.appName} with DashCaddy`,
+      description: `Deploy ${meta.appName} on a DashCaddy host from the dashboard.`,
+      step: steps.map((s, i) => ({
+        "@type": "HowToStep",
+        position: i + 1,
+        name: `Step ${i + 1}`,
+        text: s,
+      })),
+    });
+  }
+
+  return { "@context": "https://schema.org", "@graph": graph };
+}
+
+/* ------------------------------------------------------------------- main --- */
+
+function main() {
+  if (!statSync(OUT, { throwIfNoEntry: false })) {
+    console.error("inject-structured-data: out/ not found — run next build first");
+    process.exit(1);
+  }
+
+  const appIds = readdirSync(CATALOG).filter((d) => {
+    try {
+      return statSync(join(CATALOG, d)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+
+  if (appIds.length < 50) {
+    console.error(`inject-structured-data: only ${appIds.length} app dirs found; refusing`);
+    process.exit(1);
+  }
+
+  const report = { pages: 0, injected: 0, skipped: 0, faq: 0, howto: 0, image: 0, missing: [], ungrounded: 0 };
+
+  for (const appId of appIds) {
+    const file = join(CATALOG, appId, "index.html");
+    if (!statSync(file, { throwIfNoEntry: false })) {
+      report.missing.push(`${appId}: no index.html`);
+      continue;
+    }
+    report.pages += 1;
+    let html = readFileSync(file, "utf8");
+
+    if (html.includes(MARKER)) {
+      report.skipped += 1;
+      continue;
+    }
+
+    const meta = extractMeta(html);
+    const vis = visibleText(html);
+    const faqs = extractFaqs(html).filter((f) => {
+      if (vis.includes(f.question) && vis.includes(f.answer)) return true;
+      report.ungrounded += 1;
+      return false;
+    });
+    const steps = extractSteps(html, meta.appName).filter((s) => {
+      if (vis.includes(s)) return true;
+      report.ungrounded += 1;
+      return false;
+    });
+
+    if (!meta.appName) {
+      report.missing.push(`${appId}: no app name`);
+      continue;
+    }
+    const gaps = [];
+    if (!meta.category) gaps.push("category");
+    if (!meta.difficulty) gaps.push("difficulty");
+    if (!meta.dockerImage) gaps.push("dockerImage");
+    if (gaps.length) report.missing.push(`${appId}: ${gaps.join(",")}`);
+    if (faqs.length >= 2) report.faq += 1;
+    if (steps.length >= 3) report.howto += 1;
+    if (meta.dockerImage) report.image += 1;
+
+    const json = JSON.stringify(buildGraph(appId, meta, faqs, steps))
+      .replace(/</g, "\\u003c")
+      .replace(/>/g, "\\u003e")
+      .replace(/&/g, "\\u0026");
+
+    const block =
+      `<script type="application/ld+json" ${MARKER}>${json}</script>\n`;
+
+    if (!html.includes("</head>")) {
+      report.missing.push(`${appId}: no </head>`);
+      continue;
+    }
+    html = html.replace("</head>", `${block}</head>`);
+    writeFileSync(file, html);
+    report.injected += 1;
+  }
+
+  console.log("inject-structured-data: app guide pages");
+  console.log(`  pages_seen=${report.pages}`);
+  console.log(`  pages_injected=${report.injected}`);
+  console.log(`  pages_skipped_already=${report.skipped}`);
+  console.log(`  pages_with_faqpage=${report.faq}`);
+  console.log(`  pages_with_howto=${report.howto}`);
+  console.log(`  pages_with_docker_image=${report.image}`);
+  console.log(`  pages_with_gaps=${report.missing.length}`);
+  console.log(`  ungrounded_strings_dropped=${report.ungrounded}`);
+  for (const m of report.missing) console.log(`    gap: ${m}`);
+
+  if (report.injected + report.skipped !== report.pages) {
+    console.error("inject-structured-data: not every page was injected or skipped");
+    process.exit(1);
+  }
+
+  injectBlogPosts();
+}
+
+/* ------------------------------------------------------------- blog pass --- */
+
+function injectBlogPosts() {
+  const blogDir = join(OUT, "blog");
+  if (!statSync(blogDir, { throwIfNoEntry: false })) {
+    console.log("inject-structured-data: no out/blog dir — skipping blog pass");
+    return;
+  }
+
+  const slugs = readdirSync(blogDir).filter((d) => {
+    try {
+      return statSync(join(blogDir, d)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+
+  let seen = 0;
+  let injected = 0;
+  let skipped = 0;
+  let withFaq = 0;
+  let questions = 0;
+  let ungrounded = 0;
+  const gaps = [];
+
+  for (const slug of slugs) {
+    const file = join(blogDir, slug, "index.html");
+    if (!statSync(file, { throwIfNoEntry: false })) {
+      gaps.push(`${slug}: no index.html`);
+      continue;
+    }
+    seen += 1;
+    let html = readFileSync(file, "utf8");
+    if (html.includes(BLOG_MARKER)) {
+      skipped += 1;
+      continue;
+    }
+
+    const vis = visibleText(html);
+    const faqs = extractBlogFaqs(html).filter((f) => {
+      if (vis.includes(f.question) && vis.includes(f.answer)) return true;
+      ungrounded += 1;
+      return false;
+    });
+    if (faqs.length >= 2) {
+      withFaq += 1;
+      questions += faqs.length;
+    } else {
+      gaps.push(`${slug}: no visible FAQ section`);
+    }
+
+    const json = JSON.stringify(buildBlogGraph(slug, html, faqs))
+      .replace(/</g, "\\u003c")
+      .replace(/>/g, "\\u003e")
+      .replace(/&/g, "\\u0026");
+    const block = `<script type="application/ld+json" ${BLOG_MARKER}>${json}</script>\n`;
+
+    if (!html.includes("</head>")) {
+      gaps.push(`${slug}: no </head>`);
+      continue;
+    }
+    writeFileSync(file, html.replace("</head>", `${block}</head>`));
+    injected += 1;
+  }
+
+  console.log("inject-structured-data: blog posts");
+  console.log(`  posts_seen=${seen}`);
+  console.log(`  posts_injected=${injected}`);
+  console.log(`  posts_skipped_already=${skipped}`);
+  console.log(`  posts_with_faqpage=${withFaq}`);
+  console.log(`  faq_questions=${questions}`);
+  console.log(`  ungrounded_strings_dropped=${ungrounded}`);
+  console.log(`  notes=${gaps.length}`);
+  for (const g of gaps) console.log(`    note: ${g}`);
+}
+
+main();
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Regenerate the /docs/catalog tree from the current
+# /opt/dashcaddy/dashcaddy-api/src/docker/app-templates.js.
+#
+# Run this whenever templates are added/changed. Outputs 78 static pages
+# under src/app/docs/catalog/ (1 index + 77 per-template).
+#
+# Idempotent — overwrites in place.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+node /tmp/generate-template-docs.js
+echo "Verifying build..."
+npx --no-install next build 2>&1 | tail -3
+echo "Done. Review with: git diff --stat src/app/docs/catalog/"
@@ -1,197 +1,223 @@
-import Navbar from "@/components/Navbar";
-import Footer from "@/components/Footer";
-import Link from "next/link";
-
-export default function AboutPage() {
-  return (
-    <>
-      <Navbar />
-      <main className="flex-1">
-        {/* Hero */}
-        <section className="relative pt-32 pb-20 px-4">
-          <div className="absolute inset-0 hero-glow pointer-events-none" />
-          <div className="max-w-4xl mx-auto text-center relative z-10">
-            <h1 className="text-4xl md:text-5xl font-bold text-white mb-6">
-              Built for the{" "}
-              <span className="gradient-text">Self-Hosting Community</span>
-            </h1>
-            <p className="text-xl text-surface-300 max-w-2xl mx-auto">
-              DashCaddy was born from the frustration of managing dozens of
-              Docker containers, SSL certificates, and DNS records by hand. We
-              built the tool we wished existed.
-            </p>
-          </div>
-        </section>
-
-        {/* Story */}
-        <section className="py-20 px-4">
-          <div className="max-w-3xl mx-auto">
-            <h2 className="text-2xl font-bold text-white mb-6">Our Story</h2>
-            <div className="space-y-4 text-surface-300 leading-relaxed">
-              <p>
-                Self-hosting is powerful. You own your data, you control your
-                infrastructure, and you&apos;re not at the mercy of SaaS
-                providers who can change their terms, raise prices, or shut down
-                overnight. But let&apos;s be honest &mdash; it can also be a
-                pain.
-              </p>
-              <p>
-                Every new service means editing Caddyfiles, creating DNS
-                records, configuring SSL certificates, writing Docker Compose
-                files, and hoping everything plays nicely together. Multiply that
-                by 20, 30, or 50 services, and you&apos;ve got a full-time
-                operations job on your hands.
-              </p>
-              <p>
-                DashCaddy was built to solve this. One click to deploy an app.
-                SSL, DNS, and reverse proxy configuration happen automatically.
-                A beautiful dashboard to monitor everything. And when something
-                goes wrong, you know about it immediately &mdash; not when a
-                family member texts you that Plex is down.
-              </p>
-              <p>
-                We believe self-hosting should be accessible to everyone, not
-                just people who enjoy writing YAML at 2 AM. DashCaddy makes it
-                beautiful and effortless.
-              </p>
-            </div>
-          </div>
-        </section>
-
-        {/* Values */}
-        <section className="py-20 px-4 border-t border-surface-800">
-          <div className="max-w-5xl mx-auto">
-            <h2 className="text-2xl font-bold text-white mb-12 text-center">
-              What We Believe In
-            </h2>
-            <div className="grid md:grid-cols-3 gap-8">
-              {[
-                {
-                  icon: "🔓",
-                  title: "Open Core",
-                  description:
-                    "The core of DashCaddy is free and always will be. Premium features fund development, but the essentials are open to everyone.",
-                },
-                {
-                  icon: "🏠",
-                  title: "Your Data, Your Server",
-                  description:
-                    "DashCaddy runs entirely on your hardware. No cloud dependency, no telemetry, no phoning home. Your data never leaves your network.",
-                },
-                {
-                  icon: "🛠️",
-                  title: "Built to Last",
-                  description:
-                    "We use proven technologies — Caddy, Docker, Node.js. No bleeding-edge frameworks that break every six months. Stable, reliable, boring (in the best way).",
-                },
-              ].map((value) => (
-                <div
-                  key={value.title}
-                  className="glass-card rounded-xl p-8 text-center"
-                >
-                  <div className="text-4xl mb-4">{value.icon}</div>
-                  <h3 className="text-lg font-semibold text-white mb-3">
-                    {value.title}
-                  </h3>
-                  <p className="text-surface-400">{value.description}</p>
-                </div>
-              ))}
-            </div>
-          </div>
-        </section>
-
-        {/* Tech Stack */}
-        <section className="py-20 px-4 border-t border-surface-800">
-          <div className="max-w-5xl mx-auto">
-            <h2 className="text-2xl font-bold text-white mb-12 text-center">
-              Built With
-            </h2>
-            <div className="grid grid-cols-2 md:grid-cols-4 gap-6">
-              {[
-                {
-                  name: "Caddy",
-                  role: "Reverse Proxy & SSL",
-                  icon: "🔒",
-                },
-                {
-                  name: "Docker",
-                  role: "Container Runtime",
-                  icon: "🐳",
-                },
-                {
-                  name: "Node.js",
-                  role: "API Backend",
-                  icon: "🟢",
-                },
-                {
-                  name: "Technitium",
-                  role: "DNS Server",
-                  icon: "🌐",
-                },
-              ].map((tech) => (
-                <div
-                  key={tech.name}
-                  className="glass-card rounded-xl p-6 text-center hover:border-brand-500/30 transition-colors"
-                >
-                  <div className="text-3xl mb-3">{tech.icon}</div>
-                  <div className="font-semibold text-white">{tech.name}</div>
-                  <div className="text-sm text-surface-400">{tech.role}</div>
-                </div>
-              ))}
-            </div>
-          </div>
-        </section>
-
-        {/* Contact / Support */}
-        <section className="py-20 px-4 border-t border-surface-800">
-          <div className="max-w-3xl mx-auto text-center">
-            <h2 className="text-2xl font-bold text-white mb-6">Get In Touch</h2>
-            <p className="text-surface-300 mb-8">
-              Have questions, feedback, or want to contribute? We&apos;d love to
-              hear from you.
-            </p>
-            <div className="flex flex-col sm:flex-row gap-4 justify-center">
-              <a
-                href="mailto:support@dashcaddy.net"
-                className="px-6 py-3 rounded-lg bg-brand-600 hover:bg-brand-500 text-white font-medium transition-colors"
-              >
-                Email Us
-              </a>
-              <a
-                href="#"
-                className="px-6 py-3 rounded-lg border border-surface-700 hover:border-surface-500 text-surface-300 font-medium transition-colors"
-              >
-                Join Discord
-              </a>
-              <a
-                href="#"
-                className="px-6 py-3 rounded-lg border border-surface-700 hover:border-surface-500 text-surface-300 font-medium transition-colors"
-              >
-                GitHub
-              </a>
-            </div>
-          </div>
-        </section>
-
-        {/* CTA */}
-        <section className="py-20 px-4 border-t border-surface-800">
-          <div className="max-w-3xl mx-auto text-center">
-            <h2 className="text-3xl font-bold text-white mb-4">
-              Ready to simplify your homelab?
-            </h2>
-            <p className="text-surface-300 mb-8">
-              Start with the free tier. Upgrade when you&apos;re ready.
-            </p>
-            <Link
-              href="/pricing"
-              className="inline-block px-8 py-4 rounded-lg bg-brand-600 hover:bg-brand-500 text-white font-semibold text-lg transition-colors"
-            >
-              View Pricing
-            </Link>
-          </div>
-        </section>
-      </main>
-      <Footer />
-    </>
-  );
-}
+import Navbar from "@/components/Navbar";
+import Footer from "@/components/Footer";
+import Link from "next/link";
+
+export default function AboutPage() {
+  return (
+    <>
+      <Navbar />
+      <main className="flex-1">
+        {/* Hero */}
+        <section className="relative pt-32 pb-20 px-4">
+          <div className="absolute inset-0 hero-glow pointer-events-none" />
+          <div className="max-w-4xl mx-auto text-center relative z-10">
+            <h1 className="text-4xl md:text-5xl font-bold text-white mb-6">
+              Built for the{" "}
+              <span className="gradient-text">Self-Hosting Community</span>
+            </h1>
+            <p className="text-xl text-surface-300 max-w-2xl mx-auto">
+              DashCaddy was born from the frustration of managing dozens of
+              Docker containers, SSL certificates, and DNS records by hand. We
+              built the tool we wished existed — and then made it AI-powered.
+            </p>
+          </div>
+        </section>
+
+        {/* Founder Story */}
+        <section className="py-20 px-4">
+          <div className="max-w-3xl mx-auto">
+            <h2 className="text-2xl font-bold text-white mb-6">
+              The Story Behind DashCaddy
+            </h2>
+            <div className="space-y-4 text-surface-300 leading-relaxed">
+              <p>
+                I&apos;m Sami Ahmed, the creator of DashCaddy. I built it because
+                I wanted a simpler, more organized way to manage the applications
+                and services running on my own network.
+              </p>
+              <p>
+                The project&apos;s roots go back to 2024. What began as a personal
+                dashboard gradually developed into a broader idea: adding an
+                application should also take care of the configuration needed to
+                make it accessible.
+              </p>
+              <p>
+                Working with my own infrastructure shaped that vision. Managing
+                reverse proxies, certificates, DNS records, and individual
+                services showed me how much repetitive work self-hosting can
+                involve. Choosing Caddy helped establish the foundation for the
+                project that became DashCaddy.
+              </p>
+              <p>
+                Since then, DashCaddy has grown beyond a service directory into a
+                platform for deploying applications, managing connectivity,
+                monitoring services, and bringing everyday administration into
+                one interface.
+              </p>
+              <p>
+                AI-assisted development has been part of that journey from the
+                beginning. I started with ChatGPT and Claude, later incorporating
+                coding agents such as Hermes into my workflow. I direct the
+                project&apos;s design and development, using these tools to help
+                implement ideas, investigate issues, and improve the software.
+              </p>
+              <p>
+                DashCaddy continues to evolve through practical experience and
+                ongoing refinement. Its purpose remains the same: make
+                self-hosting easier to understand and manage, while keeping
+                people in control of their own servers.
+              </p>
+              <p>
+                DashCaddy&apos;s mission is to make homelabbing more accessible.
+                Whether you&apos;re setting up your first home server or managing
+                an established network, the goal is to simplify the work of
+                deploying and maintaining your applications&mdash;so you can spend
+                more time using what you build, while keeping control of your own
+                infrastructure.
+              </p>
+            </div>
+          </div>
+        </section>
+
+        {/* Values */}
+        <section className="py-20 px-4 border-t border-surface-800">
+          <div className="max-w-5xl mx-auto">
+            <h2 className="text-2xl font-bold text-white mb-12 text-center">
+              What We Believe In
+            </h2>
+            <div className="grid md:grid-cols-3 gap-8">
+              {[
+                {
+                  icon: "🔒",
+                  title: "Proprietary & Polished",
+                  description:
+                    "DashCaddy is proprietary software built with care. The core platform is free to use, with Premium features for advanced orchestration.",
+                },
+                {
+                  icon: "🏠",
+                  title: "Your Data, Your Server",
+                  description:
+                    "DashCaddy runs entirely on your hardware. No cloud dependency, no telemetry, no phoning home. Your data never leaves your network.",
+                },
+                {
+                  icon: "🤖",
+                  title: "AI-Native",
+                  description:
+                    "From the AI Intent Router to MCP server integration, DashCaddy is built for the AI era. Control your homelab with natural language or let AI assistants manage it for you.",
+                },
+              ].map((value) => (
+                <div
+                  key={value.title}
+                  className="glass-card rounded-xl p-8 text-center"
+                >
+                  <div className="text-4xl mb-4">{value.icon}</div>
+                  <h3 className="text-lg font-semibold text-white mb-3">
+                    {value.title}
+                  </h3>
+                  <p className="text-surface-400">{value.description}</p>
+                </div>
+              ))}
+            </div>
+          </div>
+        </section>
+
+        {/* Tech Stack */}
+        <section className="py-20 px-4 border-t border-surface-800">
+          <div className="max-w-5xl mx-auto">
+            <h2 className="text-2xl font-bold text-white mb-12 text-center">
+              Built With
+            </h2>
+            <div className="grid grid-cols-2 md:grid-cols-4 gap-6">
+              {[
+                { name: "Caddy", role: "Reverse Proxy & SSL", icon: "🔒" },
+                { name: "Docker", role: "Container Runtime", icon: "🐳" },
+                { name: "Node.js", role: "API Backend", icon: "🟢" },
+                { name: "Technitium", role: "DNS Server", icon: "🌐" },
+                { name: "Express", role: "REST API + WebSocket", icon: "⚡" },
+                { name: "MCP", role: "AI Protocol Layer", icon: "🤖" },
+                { name: "Stripe", role: "Payment Processing", icon: "💳" },
+                { name: "Jest", role: "Testing (3,000+ tests)", icon: "✅" },
+              ].map((tech) => (
+                <div
+                  key={tech.name}
+                  className="glass-card rounded-xl p-6 text-center hover:border-brand-500/30 transition-colors"
+                >
+                  <div className="text-3xl mb-3">{tech.icon}</div>
+                  <div className="font-semibold text-white">{tech.name}</div>
+                  <div className="text-sm text-surface-400">{tech.role}</div>
+                </div>
+              ))}
+            </div>
+          </div>
+        </section>
+
+        {/* Stats */}
+        <section className="py-20 px-4 border-t border-surface-800">
+          <div className="max-w-4xl mx-auto">
+            <h2 className="text-2xl font-bold text-white mb-12 text-center">
+              By the Numbers
+            </h2>
+            <div className="grid grid-cols-2 md:grid-cols-4 gap-8">
+              {[
+                { value: "77", label: "App Templates" },
+                { value: "3,000+", label: "Test Cases" },
+                { value: "400+", label: "API Endpoints" },
+                { value: "31", label: "Languages" },
+              ].map((stat) => (
+                <div key={stat.label} className="text-center">
+                  <div className="text-4xl font-bold text-brand-400 mb-2">
+                    {stat.value}
+                  </div>
+                  <p className="text-sm text-surface-400">{stat.label}</p>
+                </div>
+              ))}
+            </div>
+          </div>
+        </section>
+
+        {/* Contact / Support */}
+        <section className="py-20 px-4 border-t border-surface-800">
+          <div className="max-w-3xl mx-auto text-center">
+            <h2 className="text-2xl font-bold text-white mb-6">Get In Touch</h2>
+            <p className="text-surface-300 mb-8">
+              Have questions or feedback? We&apos;d love to hear from you.
+            </p>
+            <div className="flex flex-col sm:flex-row gap-4 justify-center">
+              <a
+                href="mailto:support@dashcaddy.net"
+                className="px-6 py-3 rounded-lg bg-brand-600 hover:bg-brand-500 text-white font-medium transition-colors"
+              >
+                Email Us
+              </a>
+              <Link
+                href="/docs"
+                className="px-6 py-3 rounded-lg border border-surface-700 hover:border-surface-500 text-surface-300 font-medium transition-colors"
+              >
+                Read the Docs
+              </Link>
+            </div>
+          </div>
+        </section>
+
+        {/* CTA */}
+        <section className="py-20 px-4 border-t border-surface-800">
+          <div className="max-w-3xl mx-auto text-center">
+            <h2 className="text-3xl font-bold text-white mb-4">
+              Ready to simplify your homelab?
+            </h2>
+            <p className="text-surface-300 mb-8">
+              Install DashCaddy and start deploying services today. Free forever.
+            </p>
+            <Link
+              href="/pricing"
+              className="inline-block px-8 py-4 rounded-lg bg-brand-600 hover:bg-brand-500 text-white font-semibold text-lg transition-colors"
+            >
+              View Pricing
+            </Link>
+          </div>
+        </section>
+      </main>
+      <Footer />
+    </>
+  );
+}
@@ -1,74 +1,5 @@
-import { NextRequest, NextResponse } from "next/server";
-import Stripe from "stripe";
-
-const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
-  apiVersion: "2026-03-25.dahlia",
-});
-
-const PRICE_IDS: Record<string, string | undefined> = {
-  monthly: process.env.STRIPE_PRICE_MONTHLY,
-  yearly: process.env.STRIPE_PRICE_YEARLY,
-};
-
-export async function POST(request: NextRequest) {
-  try {
-    const body = await request.json();
-    const { plan, email } = body;
-
-    if (!plan || !PRICE_IDS[plan]) {
-      return NextResponse.json(
-        { error: "Invalid plan. Choose 'monthly' or 'yearly'." },
-        { status: 400 }
-      );
-    }
-
-    const priceId = PRICE_IDS[plan];
-    if (!priceId) {
-      return NextResponse.json(
-        { error: "Price not configured. Please contact support." },
-        { status: 500 }
-      );
-    }
-
-    const appUrl = process.env.NEXT_PUBLIC_APP_URL || "https://dashcaddy.net";
-
-    const sessionParams: Stripe.Checkout.SessionCreateParams = {
-      mode: "subscription",
-      payment_method_types: ["card"],
-      line_items: [
-        {
-          price: priceId,
-          quantity: 1,
-        },
-      ],
-      success_url: `${appUrl}/success?session_id={CHECKOUT_SESSION_ID}`,
-      cancel_url: `${appUrl}/pricing`,
-      allow_promotion_codes: true,
-      billing_address_collection: "required",
-      subscription_data: {
-        trial_period_days: 14,
-        metadata: {
-          plan,
-          source: "dashcaddy-website",
-        },
-      },
-      metadata: {
-        plan,
-      },
-    };
-
-    // Pre-fill email if provided
-    if (email) {
-      sessionParams.customer_email = email;
-    }
-
-    const session = await stripe.checkout.sessions.create(sessionParams);
-
-    return NextResponse.json({ url: session.url });
-  } catch (error) {
-    console.error("Stripe checkout error:", error);
-    const message =
-      error instanceof Error ? error.message : "Internal server error";
-    return NextResponse.json({ error: message }, { status: 500 });
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+
+export async function POST(request: NextRequest) {
+  return NextResponse.json({ error: 'Checkout disabled for static export' }, { status: 503 });
+}
@@ -0,0 +1,5 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+export async function POST(request: NextRequest) {
+  return NextResponse.json({ error: 'Webhooks disabled for static export' }, { status: 503 });
+}
@@ -1,99 +1,4 @@
-import { NextRequest, NextResponse } from "next/server";
-import Stripe from "stripe";
-
-const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
-  apiVersion: "2026-03-25.dahlia",
-});
-
-const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET!;
-
-export async function POST(request: NextRequest) {
-  const body = await request.text();
-  const signature = request.headers.get("stripe-signature");
-
-  if (!signature) {
-    return NextResponse.json(
-      { error: "Missing stripe-signature header" },
-      { status: 400 }
-    );
-  }
-
-  let event: Stripe.Event;
-
-  try {
-    event = stripe.webhooks.constructEvent(body, signature, webhookSecret);
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Unknown error";
-    console.error(`Webhook signature verification failed: ${message}`);
-    return NextResponse.json({ error: message }, { status: 400 });
-  }
-
-  try {
-    switch (event.type) {
-      case "checkout.session.completed": {
-        const session = event.data.object as Stripe.Checkout.Session;
-        console.log("Checkout completed:", {
-          sessionId: session.id,
-          customerEmail: session.customer_email,
-          plan: session.metadata?.plan,
-          subscriptionId: session.subscription,
-        });
-
-        // TODO: Generate and deliver license key to customer
-        // This is where you'd:
-        // 1. Generate a DC-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX license code
-        // 2. Store it in your database
-        // 3. Email it to the customer
-        // 4. Associate it with the Stripe subscription ID
-
-        break;
-      }
-
-      case "customer.subscription.updated": {
-        const subscription = event.data.object as Stripe.Subscription;
-        console.log("Subscription updated:", {
-          subscriptionId: subscription.id,
-          status: subscription.status,
-        });
-
-        // TODO: Update license expiration based on subscription status
-        break;
-      }
-
-      case "customer.subscription.deleted": {
-        const subscription = event.data.object as Stripe.Subscription;
-        console.log("Subscription cancelled:", {
-          subscriptionId: subscription.id,
-          status: subscription.status,
-        });
-
-        // TODO: Deactivate/expire the license key
-        // The DashCaddy instance will gracefully downgrade to free tier
-        break;
-      }
-
-      case "invoice.payment_failed": {
-        const invoice = event.data.object as Stripe.Invoice;
-        console.log("Payment failed:", {
-          invoiceId: invoice.id,
-          customerEmail: invoice.customer_email,
-        });
-
-        // TODO: Notify customer about failed payment
-        // Consider a grace period before deactivating license
-        break;
-      }
-
-      default:
-        console.log(`Unhandled event type: ${event.type}`);
-    }
-
-    return NextResponse.json({ received: true });
-  } catch (error) {
-    console.error("Webhook handler error:", error);
-    return NextResponse.json(
-      { error: "Webhook handler failed" },
-      { status: 500 }
-    );
-  }
-}
+import { NextRequest, NextResponse } from 'next/server';
+export async function POST(request: NextRequest) {
+  return NextResponse.json({ error: 'disabled' }, { status: 503 });
+}
@@ -0,0 +1,170 @@
+import fs from "fs";
+import path from "path";
+import Link from "next/link";
+import { notFound } from "next/navigation";
+import { marked } from "marked";
+import Navbar from "@/components/Navbar";
+import Footer from "@/components/Footer";
+import { POSTS } from "@/content/blog/manifest";
+
+export const dynamicParams = false;
+
+const BLOG_DIR = path.join(process.cwd(), "src", "content", "blog");
+
+export function generateStaticParams() {
+  // Fail the build loudly if a manifest entry has no matching markdown file —
+  // prevents a future publisher from registering a post it never wrote.
+  for (const p of POSTS) {
+    if (!fs.existsSync(path.join(BLOG_DIR, `${p.slug}.md`))) {
+      throw new Error(
+        `blog: manifest slug "${p.slug}" has no src/content/blog/${p.slug}.md`
+      );
+    }
+  }
+  // Reverse guard: reject orphaned markdown files not represented in POSTS, so a
+  // stray/forgotten draft can't silently ship without an index entry.
+  const slugs = new Set(POSTS.map((p) => p.slug));
+  for (const f of fs.readdirSync(BLOG_DIR)) {
+    if (f.endsWith(".md") && !slugs.has(f.replace(/\.md$/, ""))) {
+      throw new Error(
+        `blog: orphaned src/content/blog/${f} has no POSTS manifest entry`
+      );
+    }
+  }
+  return POSTS.map((p) => ({ slug: p.slug }));
+}
+
+function getPost(slug: string) {
+  return POSTS.find((p) => p.slug === slug) ?? null;
+}
+
+function stripFrontmatter(markdown: string): string {
+  return markdown.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "");
+}
+
+function readBody(slug: string): string | null {
+  const file = path.join(BLOG_DIR, `${slug}.md`);
+  if (!fs.existsSync(file)) return null;
+  return stripFrontmatter(fs.readFileSync(file, "utf8"));
+}
+
+function formatDate(iso: string): string {
+  return new Date(iso + "T00:00:00Z").toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+    timeZone: "UTC",
+  });
+}
+
+export async function generateMetadata({
+  params,
+}: {
+  params: Promise<{ slug: string }>;
+}) {
+  const { slug } = await params;
+  const post = getPost(slug);
+  if (!post) return { title: "Post not found — DashCaddy Blog" };
+  return {
+    title: `${post.title} — DashCaddy Blog`,
+    description: post.description,
+    alternates: {
+      canonical: `https://dashcaddy.net/blog/${post.slug}/`,
+      types: { "application/rss+xml": "https://dashcaddy.net/feed.xml" },
+    },
+    keywords: post.tags,
+    authors: [{ name: post.author }],
+    openGraph: {
+      title: post.title,
+      description: post.description,
+      type: "article",
+      url: `https://dashcaddy.net/blog/${post.slug}/`,
+      publishedTime: `${post.date}T00:00:00Z`,
+      authors: [post.author],
+      tags: post.tags,
+    },
+    twitter: {
+      card: "summary_large_image",
+      title: post.title,
+      description: post.description,
+    },
+  };
+}
+
+export default async function BlogPostPage({
+  params,
+}: {
+  params: Promise<{ slug: string }>;
+}) {
+  const { slug } = await params;
+  const post = getPost(slug);
+  const body = post ? readBody(slug) : null;
+  if (!post || body === null) notFound();
+
+  const html = marked.parse(body, { async: false }) as string;
+  const canonical = `https://dashcaddy.net/blog/${post.slug}/`;
+  const jsonLd = {
+    "@context": "https://schema.org",
+    "@type": "BlogPosting",
+    headline: post.title,
+    description: post.description,
+    datePublished: `${post.date}T00:00:00Z`,
+    dateModified: `${post.date}T00:00:00Z`,
+    author: { "@type": "Person", name: post.author },
+    publisher: { "@type": "Organization", name: "DashCaddy" },
+    mainEntityOfPage: { "@type": "WebPage", "@id": canonical },
+    url: canonical,
+    keywords: post.tags.join(", "),
+  };
+
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <script
+        type="application/ld+json"
+        dangerouslySetInnerHTML={{
+          __html: JSON.stringify(jsonLd).replace(/</g, "\\u003c"),
+        }}
+      />
+      <Navbar />
+
+      <article className="relative py-16 sm:py-20">
+        <div className="mx-auto max-w-3xl px-4 sm:px-6 lg:px-8">
+          <Link
+            href="/blog"
+            className="mb-8 inline-block text-sm text-brand-400 hover:text-brand-300"
+          >
+            ← All posts
+          </Link>
+
+          <header className="mb-10 border-b border-surface-800 pb-8">
+            <div className="mb-3 flex flex-wrap items-center gap-3 text-sm text-surface-400">
+              <time dateTime={post.date}>{formatDate(post.date)}</time>
+              <span aria-hidden>·</span>
+              <span>{post.readingMinutes} min read</span>
+              <span aria-hidden>·</span>
+              <span>{post.author}</span>
+            </div>
+            <h1 className="text-3xl font-bold sm:text-4xl">{post.title}</h1>
+            <div className="mt-4 flex flex-wrap gap-2">
+              {post.tags.map((tag) => (
+                <span
+                  key={tag}
+                  className="rounded-full bg-surface-800 px-3 py-1 text-xs font-medium text-surface-300"
+                >
+                  {tag}
+                </span>
+              ))}
+            </div>
+          </header>
+
+          <div
+            className="blog-prose"
+            dangerouslySetInnerHTML={{ __html: html }}
+          />
+        </div>
+      </article>
+
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,85 @@
+import Link from "next/link";
+import Navbar from "@/components/Navbar";
+import Footer from "@/components/Footer";
+import { POSTS } from "@/content/blog/manifest";
+
+export const metadata = {
+  title: "Blog — DashCaddy",
+  description:
+    "Guides, product updates, and self-hosting deep-dives from the DashCaddy team: AI-powered deployment, the MCP server, security, and fleet management.",
+  alternates: { canonical: "https://dashcaddy.net/blog/" },
+};
+
+function formatDate(iso: string): string {
+  return new Date(iso + "T00:00:00Z").toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+    timeZone: "UTC",
+  });
+}
+
+export default function BlogIndexPage() {
+  const posts = [...POSTS].sort((a, b) => (a.date < b.date ? 1 : -1));
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+
+      <section className="relative py-16 sm:py-20 lg:py-24">
+        <div className="absolute inset-0 -z-10">
+          <div className="absolute left-1/2 top-1/2 h-96 w-96 -translate-x-1/2 -translate-y-1/2 animate-pulse rounded-full bg-brand-500/20 opacity-30 blur-3xl" />
+        </div>
+        <div className="mx-auto max-w-4xl px-4 text-center sm:px-6 lg:px-8">
+          <h1 className="mb-6 text-4xl font-bold sm:text-5xl">
+            The DashCaddy <span className="text-brand-400">Blog</span>
+          </h1>
+          <p className="mx-auto max-w-2xl text-xl text-surface-300">
+            Self-hosting deep-dives, product updates, and practical guides to
+            running your own infrastructure.
+          </p>
+        </div>
+      </section>
+
+      <section className="relative pb-20">
+        <div className="mx-auto max-w-4xl px-4 sm:px-6 lg:px-8">
+          {posts.length === 0 ? (
+            <p className="text-center text-surface-400">No posts yet — check back soon.</p>
+          ) : (
+            <ul className="space-y-6">
+              {posts.map((post) => (
+                <li key={post.slug}>
+                  <Link
+                    href={`/blog/${post.slug}`}
+                    className="glass-card block rounded-xl p-6 transition-colors hover:border-brand-500/30"
+                  >
+                    <div className="mb-2 flex flex-wrap items-center gap-3 text-xs text-surface-400">
+                      <time dateTime={post.date}>{formatDate(post.date)}</time>
+                      <span aria-hidden>·</span>
+                      <span>{post.readingMinutes} min read</span>
+                    </div>
+                    <h2 className="mb-2 text-2xl font-semibold text-white">
+                      {post.title}
+                    </h2>
+                    <p className="mb-4 text-surface-300">{post.description}</p>
+                    <div className="flex flex-wrap gap-2">
+                      {post.tags.map((tag) => (
+                        <span
+                          key={tag}
+                          className="rounded-full bg-surface-800 px-3 py-1 text-xs font-medium text-surface-300"
+                        >
+                          {tag}
+                        </span>
+                      ))}
+                    </div>
+                  </Link>
+                </li>
+              ))}
+            </ul>
+          )}
+        </div>
+      </section>
+
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,344 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export default function DocsApiPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="API and Automation"
+        intro="DashCaddy is more than a dashboard — it exposes a real API and automation surface so you can drive deployments, DNS, proxy, certificates, monitoring, and operations programmatically or through AI."
+      >
+        <p>
+          Every action available in the DashCaddy UI is also available through a programmatic surface: a versioned REST
+          API, a JavaScript automation layer, an AI Intent Router for natural-language commands, an MCP Server for AI assistant
+          integration, a WebSocket channel for real-time events, a Prometheus endpoint for metrics, and a plugin system
+          for extending the platform. This guide covers each surface with concrete examples.
+        </p>
+        <p>
+          Whether you are wiring DashCaddy into a CI/CD pipeline, building a custom dashboard, or letting an AI assistant
+          manage your infrastructure, the automation layer is designed to be the primary interface — the web UI is just
+          one consumer of it.
+        </p>
+
+        <h2>REST API</h2>
+        <p>
+          All platform operations are available under <code>/api/v1/</code>. The API covers service management, app
+          deployment, DNS automation, Caddy reverse-proxy integration, certificate workflows, health and status
+          reporting, user and admin operations, backup/restore, and more. The repository ships with an OpenAPI definition
+          so the public contract can mature into a full reference.
+        </p>
+        <p>
+          Requests and responses are JSON. The base URL is your DashCaddy host — for example
+          <code> https://dashcaddy-host/api/v1/services</code>. All endpoints require authentication (see below) and
+          return structured error codes rather than opaque messages.
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`# List all services
+curl -H "Authorization: Bearer ***" \\
+  https://dashcaddy-host/api/v1/services
+
+# Deploy from a template
+curl -X POST -H "Authorization: Bearer ***" \\
+  -H "Content-Type: application/json" \\
+  -d '{"template":"jellyfin","name":"media","hostname":"media.lab"}' \\
+  https://dashcaddy-host/api/v1/services
+
+# Restart a service
+curl -X POST -H "Authorization: Bearer ***" \\
+  https://dashcaddy-host/api/v1/services/media/restart`}</code></pre>
+
+        <h2>Authentication</h2>
+        <p>
+          DashCaddy supports two authentication methods, chosen by how you access the API:
+        </p>
+        <h3>Session cookie (browser)</h3>
+        <p>
+          The web dashboard authenticates with a session cookie set after login (email magic link or username/password
+          with optional TOTP 2FA). API calls made from the browser carry the cookie automatically. This is the right
+          method for in-dashboard automation and userscripts.
+        </p>
+        <h3>API key (Bearer token)</h3>
+        <p>
+          For server-to-server automation, scripts, and integrations, use an API key. Generate keys from
+          <strong> Settings → API Keys</strong>. Keys are bearer tokens — pass them in the <code>Authorization</code>
+          header on every request:
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`Authorization: Bearer dc_live_xxxxxxxxxxxxxxxxxxxx`}</code></pre>
+        <blockquote className="border-l-4 border-brand-500/50 bg-brand-500/5 p-4 rounded-r-lg">
+          <p className="text-surface-300">
+            <strong className="text-brand-400">Security:</strong> API keys grant the same permissions as the user who
+            created them, scoped by RBAC role. Store keys in a secret manager — never commit them to source control.
+            Rotate keys immediately if one is leaked.
+          </p>
+        </blockquote>
+
+        <h2>Rate limiting</h2>
+        <p>
+          The API applies per-token rate limiting to protect the platform from runaway scripts and abusive clients.
+          Limits are generous for normal operation: interactive dashboard usage will never hit them. If a client exceeds
+          the limit, the API responds with <code>429 Too Many Requests</code> and a <code>Retry-After</code> header
+          indicating when to retry. Back off and retry — do not hammer the endpoint.
+        </p>
+        <p>
+          For high-volume automation (e.g. polling service status in a tight loop), prefer the <strong>WebSocket
+          channel</strong> or the <strong>Prometheus endpoint</strong> over repeated REST polling. Both are designed for
+          frequent reads and do not count against the REST rate limit.
+        </p>
+
+                <h2>JavaScript automation</h2>
+        <p>
+          For programmatic automation, use the REST API directly with <code>fetch</code> or any HTTP client. The API is
+          JSON-based, uses Bearer token authentication, and returns structured error codes. Here is a minimal helper
+          you can drop into any Node.js, Bun, or browser project:
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{['class DashCaddy {', '',
+'  constructor(opts) {', '',
+'    this.baseUrl = opts.baseUrl;', '',
+'    this.token = opts.token;', '',
+'  }', '',
+'', '',
+'  async request(path, options) {', '',
+'    options = options || {};', '',
+'    var url = this.baseUrl + "/api/v1" + path;', '',
+'    var res = await fetch(url, {', '',
+'      method: options.method || "GET",', '',
+'      body: options.body,', '',
+'      headers: {', '',
+'        "Content-Type": "application/json",', '',
+'        "Authorization": "Bearer " + this.token', '',
+'      }', '',
+'    });', '',
+'    var body = await res.json();', '',
+'    if (!res.ok) throw { code: body.error, status: res.status };', '',
+'    return body;', '',
+'  }', '',
+'', '',
+'  // List services', '',
+'  services() { return this.request("/services"); }', '',
+'', '',
+'  // Deploy from template', '',
+'  deploy(template, name, hostname) {', '',
+'    return this.request("/services", {', '',
+'      method: "POST",', '',
+'      body: JSON.stringify({ template, name, hostname })', '',
+'    });', '',
+'  }', '',
+'', '',
+'  // Restart a service', '',
+'  restart(id) {', '',
+'    return this.request("/services/" + id + "/restart", { method: "POST" });', '',
+'  }', '',
+'}'].join('\n')}</code></pre>
+        <p>
+          Every request returns a structured JSON response or throws an error object carrying the error
+          code, HTTP status, and message — so your automation can branch on specific failure conditions.
+        </p>
+
+
+
+
+
+        <h2>AI Intent Router</h2>
+        <p>
+          The <strong>AI Intent Router</strong> accepts natural-language commands and translates them into real
+          infrastructure actions through the same API. This turns ad-hoc operator requests (&ldquo;restart the media
+          server&rdquo;, &ldquo;is postgres up?&rdquo;, &ldquo;deploy redis&rdquo;) into reproducible, logged operations
+          — no need to remember endpoint paths or parameter names.
+        </p>
+        <p>
+          The router parses intent, maps it to the correct API call, executes it, and returns both a human-readable
+          summary and the raw API result. Every intent execution is recorded in the audit log just like a manual action.
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`# Natural-language operation
+POST /api/v1/ai/intent
+{
+  "message": "Restart the media server and check its health"
+}
+
+# Response
+{
+  "summary": "Restarted 'media' and confirmed health: healthy",
+  "actions": [
+    { "method": "POST", "path": "/api/v1/services/media/restart", "status": 200 },
+    { "method": "GET",  "path": "/api/v1/services/media/health",  "status": 200 }
+  ]
+}`}</code></pre>
+        <p>
+          Example intents: &ldquo;deploy the postgres template as <code>db</code> on <code>db.lab</code>&rdquo;,
+          &ldquo;list all unhealthy services&rdquo;, &ldquo;rotate the TLS cert for <code>wiki.lab</code>&rdquo;,
+          &ldquo;create a DNS record for <code>api.lab</code> pointing at 10.0.0.5&rdquo;.
+        </p>
+
+        <h2>MCP Server</h2>
+        <p>
+          The built-in <strong>MCP (Model Context Protocol) Server</strong> exposes DashCaddy operations as tools that
+          AI assistants and external automation can call directly. Connect your assistant to the MCP endpoint and it can
+          list services, deploy templates, manage DNS, inspect health, and trigger operations — all through the standard
+          MCP tool interface, with full audit logging.
+        </p>
+        <p>
+          To connect Claude Desktop, GPT, or another MCP-compatible assistant, add the DashCaddy MCP server to your
+          client&apos;s MCP configuration:
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`{
+  "mcpServers": {
+    "dashcaddy": {
+      "url": "https://dashcaddy-host/mcp",
+      "headers": {
+        "Authorization": "Bearer dc_live_xxxxxxxxxxxxxxxxxxxx"
+      }
+    }
+  }
+}`}</code></pre>
+        <p>
+          Once connected, the assistant discovers DashCaddy&apos;s tools automatically and can invoke them in response to
+          your requests — &ldquo;ask DashCaddy which services are down&rdquo;, &ldquo;have DashCaddy deploy Grafana&rdquo;,
+          etc. This is the most natural way to operate infrastructure through conversation.
+        </p>
+
+        <h2>WebSocket real-time events</h2>
+        <p>
+          The dashboard subscribes to a <strong>WebSocket channel</strong> for live updates: service health changes,
+          container starts and stops, deployment progress, DNS changes, and fleet events arrive in real time without
+          polling. You can consume the same channel in your own dashboards, chatops bots, or automation.
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`const ws = new WebSocket('wss://dashcaddy-host/api/v1/events', {
+  headers: { Authorization: 'Bearer ' + process.env.DC_TOKEN },
+});
+
+ws.on('message', (data) => {
+  const event = JSON.parse(data);
+  console.log(event.type, event.payload);
+});`}</code></pre>
+        <p>
+          Common event types you will see on the channel:
+        </p>
+        <table>
+          <thead>
+            <tr>
+              <th>Event type</th>
+              <th>Emitted when</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr><td><code>service.health</code></td><td>A service transitions between healthy / unhealthy / down</td></tr>
+            <tr><td><code>service.started</code></td><td>A container starts successfully</td></tr>
+            <tr><td><code>service.stopped</code></td><td>A container stops (graceful or crash)</td></tr>
+            <tr><td><code>deploy.progress</code></td><td>A template deployment advances through its stages</td></tr>
+            <tr><td><code>deploy.complete</code></td><td>A deployment finishes (success or failure)</td></tr>
+            <tr><td><code>dns.changed</code></td><td>A DNS record is created, updated, or removed</td></tr>
+            <tr><td><code>proxy.updated</code></td><td>A Caddy route is applied or removed</td></tr>
+            <tr><td><code>cert.issued</code></td><td>A TLS certificate is issued or renewed</td></tr>
+            <tr><td><code>fleet.host</code></td><td>A fleet host changes state (Premium)</td></tr>
+            <tr><td><code>audit.event</code></td><td>A user or API action is logged for audit</td></tr>
+          </tbody>
+        </table>
+
+        <h2>Prometheus metrics endpoint</h2>
+        <p>
+          DashCaddy exposes a Prometheus-format metrics endpoint at <code>/metrics</code> for service health, container
+          status, request counts, certificate expiry, and system indicators. Scrape it with Prometheus and visualize in
+          Grafana. See <a href="/docs/integrations">Integrations</a> for a full scrape config.
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`# Scrape config (prometheus.yml)
+scrape_configs:
+  - job_name: 'dashcaddy'
+    metrics_path: /metrics
+    static_configs:
+      - targets: ['dashcaddy-host:3000']
+
+# Sample exported metrics
+dashcaddy_service_health{service="media"} 1
+dashcaddy_container_running{container="db"} 1
+dashcaddy_http_requests_total{service="wiki",code="200"} 48213
+dashcaddy_cert_expiry_days{domain="media.lab"} 87`}</code></pre>
+
+        <h2>Health and readiness probes</h2>
+        <p>
+          Two lightweight probes let orchestrators and load balancers check DashCaddy itself:
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`# Liveness — is the process up?
+GET /healthz
+
+# Readiness — can it serve (Docker, Caddy, DNS connected)?
+GET /readyz`}</code></pre>
+        <p>
+          Use <code>/healthz</code> for container restart policies and <code>/readyz</code> for traffic gating. If
+          <code> /readyz</code> fails but <code>/healthz</code> passes, a dependency (Docker socket, Caddy Admin API, or
+          Technitium DNS) is unreachable — see <a href="/docs/troubleshooting">Troubleshooting</a>.
+        </p>
+
+        <h2>Plugin &amp; extension system</h2>
+        <p>
+          DashCaddy includes a <strong>plugin/extension system</strong> with hooks into the deployment, DNS, proxy, and
+          monitoring pipelines. Write extensions to react to service lifecycle events, inject custom Caddy directives,
+          emit additional metrics, or integrate third-party tools — without forking the core.
+        </p>
+        <p>
+          Plugins register for lifecycle hooks (e.g. <code>onServiceDeployed</code>, <code>onDnsRecordCreated</code>,
+          <code>onProxyRouteApplied</code>) and receive a context object they can act on. A plugin can modify the
+          generated Caddyfile before it is applied, push a notification when a service goes unhealthy, or export custom
+          metrics alongside the built-in ones. Plugins are loaded at startup and run in the same process.
+        </p>
+
+        <h2>Structured error codes</h2>
+        <p>
+          The API returns <strong>80 structured error codes</strong> across <strong>12 modules</strong> rather
+          than opaque messages, so your automation can branch on specific failure conditions — DNS token invalid, Caddy
+          unreachable, license expired, rate limited — instead of parsing strings. Every error response includes the
+          machine-readable code, the HTTP status, and a human-readable message.
+        </p>
+        <table>
+          <thead>
+            <tr>
+              <th>Module</th>
+              <th>Example error codes</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr><td>auth</td><td><code>AUTH_INVALID_TOKEN</code>, <code>AUTH_PERMISSION_DENIED</code>, <code>AUTH_2FA_REQUIRED</code></td></tr>
+            <tr><td>service</td><td><code>SERVICE_NOT_FOUND</code>, <code>SERVICE_ALREADY_EXISTS</code>, <code>SERVICE_UNHEALTHY</code></td></tr>
+            <tr><td>deploy</td><td><code>DEPLOY_TEMPLATE_INVALID</code>, <code>DEPLOY_PORT_CONFLICT</code>, <code>DEPLOY_FAILED</code></td></tr>
+            <tr><td>dns</td><td><code>DNS_TOKEN_INVALID</code>, <code>DNS_ZONE_NOT_FOUND</code>, <code>DNS_RECORD_EXISTS</code></td></tr>
+            <tr><td>proxy</td><td><code>PROXY_CADDY_UNREACHABLE</code>, <code>PROXY_CONFIG_INVALID</code>, <code>PROXY_UPSTREAM_TIMEOUT</code></td></tr>
+            <tr><td>cert</td><td><code>CERT_ISSUANCE_FAILED</code>, <code>CERT_EXPIRED</code>, <code>CERT_NOT_TRUSTED</code></td></tr>
+            <tr><td>license</td><td><code>LICENSE_EXPIRED</code>, <code>LICENSE_INVALID</code>, <code>LICENSE_MACHINE_LIMIT</code></td></tr>
+            <tr><td>user</td><td><code>USER_NOT_FOUND</code>, <code>USER_ALREADY_EXISTS</code>, <code>USER_INVITE_EXPIRED</code></td></tr>
+            <tr><td>backup</td><td><code>BACKUP_FAILED</code>, <code>BACKUP_CORRUPT</code>, <code>RESTORE_CONFLICT</code></td></tr>
+            <tr><td>recipe</td><td><code>RECIPE_INVALID</code>, <code>RECIPE_COMPONENT_FAILED</code> (Premium)</td></tr>
+            <tr><td>swarm</td><td><code>SWARM_NOT_INITIALIZED</code>, <code>SWARM_NODE_UNREACHABLE</code> (Premium)</td></tr>
+            <tr><td>fleet</td><td><code>FLEET_HOST_OFFLINE</code>, <code>FLEET_DEPLOY_PLAN_FAILED</code> (Premium)</td></tr>
+          </tbody>
+        </table>
+        <p>
+          Handle errors by code in your automation:
+        </p>
+        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`try {
+  await dc.services.deploy({ template: 'postgres', name: 'db', hostname: 'db.lab' });
+} catch (err) {
+  if (err.code === 'DEPLOY_PORT_CONFLICT') {
+    // pick a different port and retry
+  } else if (err.code === 'LICENSE_EXPIRED') {
+    // alert ops to renew
+  } else {
+    throw err; // unknown — surface to the operator
+  }
+}`}</code></pre>
+
+        <h2>Why automation matters</h2>
+        <p>
+          DashCaddy can execute the full infrastructure chain around a service, not just report its state after the fact.
+          Between the REST API, the AI Intent Router, MCP, WebSockets, Prometheus, and the plugin system, you
+          have every surface you need to make DashCaddy a first-class citizen of your automation stack. Start with a
+          simple <code>curl</code> call, and add AI and event-driven flows as your needs grow.
+        </p>
+        <p>
+          For the infrastructure that backs all of this, see <a href="/docs/integrations">Integrations</a>. When things go
+          wrong, the <a href="/docs/troubleshooting">Troubleshooting</a> guide walks each layer with commands and fixes.
+        </p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Actual Budget — DashCaddy Docs',
+  description: 'Install and configure Actual Budget via DashCaddy. Privacy-focused budgeting app with envelope budgeting',
+};
+
+export default function actualBudgetDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Actual Budget"
+        intro="Privacy-focused budgeting app with envelope budgeting"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">actualbudget/actual-server:latest</code></span>
+</div>
+
+<h2>What is Actual Budget?</h2>
+<p>Privacy-focused budgeting app with envelope budgeting</p>
+<p>Actual Budget ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Actual Budget, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Actual Budget</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>budget</code>), host port (default: <code>5006</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "actual-budget",
+    "config": &#123;
+      "subdomain": "budget",
+      "port": 5006
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Actual Budget on my home host and expose it at budget.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull actualbudget/actual-server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Create your first budget in the web interface</li>
+  <li>Import transactions from your bank (OFX, QFX, CSV)</li>
+  <li>Set up envelope categories for spending control</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/actual-budget/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull actualbudget/actual-server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Actual Budget:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>actual-budget</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,129 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Adminer — DashCaddy Docs',
+  description: 'Install and configure Adminer via DashCaddy. Lightweight database management in single PHP file',
+};
+
+export default function adminerDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Adminer"
+        intro="Lightweight database management in single PHP file"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Database</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">adminer:latest</code></span>
+</div>
+
+<h2>What is Adminer?</h2>
+<p>Lightweight database management in single PHP file</p>
+<p>Adminer ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Adminer, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Adminer</strong> from the Database category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>adminer</code>), host port (default: <code>8087</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "adminer",
+    "config": &#123;
+      "subdomain": "adminer",
+      "port": 8087
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Adminer on my home host and expose it at adminer.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull adminer:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Connect to your database servers</li>
+  <li>Supports MySQL, PostgreSQL, SQLite, etc.</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/adminer:/var/www/html</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>ADMINER_DEFAULT_SERVER</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull adminer:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Adminer:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>adminer</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,134 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Airsonic Advanced — DashCaddy Docs',
+  description: 'Install and configure Airsonic Advanced via DashCaddy. Free web-based media streamer',
+};
+
+export default function airsonicDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Airsonic Advanced"
+        intro="Free web-based media streamer"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/airsonic-advanced:latest</code></span>
+</div>
+
+<h2>What is Airsonic Advanced?</h2>
+<p>Free web-based media streamer</p>
+<p>Airsonic Advanced ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Airsonic Advanced, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Airsonic Advanced</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>airsonic</code>), host port (default: <code>4040</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "airsonic",
+    "config": &#123;
+      "subdomain": "airsonic",
+      "port": 4040
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Airsonic Advanced on my home host and expose it at airsonic.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/airsonic-advanced:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Default login: admin/admin</li>
+  <li>Configure media folders</li>
+  <li>Set up transcoding</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/airsonic/config:/config</code></li>
+<li><code>/music:/music</code></li>
+<li><code>/podcasts:/podcasts</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/airsonic-advanced:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Airsonic Advanced:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>airsonic</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,138 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Audiobookshelf — DashCaddy Docs',
+  description: 'Install and configure Audiobookshelf via DashCaddy. Self-hosted audiobook and podcast server',
+};
+
+export default function audiobookshelfDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Audiobookshelf"
+        intro="Self-hosted audiobook and podcast server"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/advplyr/audiobookshelf:latest</code></span>
+</div>
+
+<h2>What is Audiobookshelf?</h2>
+<p>Self-hosted audiobook and podcast server</p>
+<p>Audiobookshelf ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Audiobookshelf, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>A host path containing your media. Default suggestion: <code>/media/audiobooks</code>. The deploy form / API payload <code>config.mediaPath</code> must be readable by the container UID (usually <code>1000</code>).</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Audiobookshelf</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>audiobooks</code>), host port (default: <code>13378</code>), and the media library path.</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "audiobookshelf",
+    "config": &#123;
+      "subdomain": "audiobooks",
+      "port": 13378,
+      "mediaPath": "/media/audiobooks"
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Audiobookshelf on my home host and expose it at audiobooks.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/advplyr/audiobookshelf:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Create your account on first access</li>
+  <li>Add your audiobook library folders</li>
+  <li>Download the mobile app for offline listening</li>
+</ol>
+<h2>Media library path notes</h2>
+<p>The media mount path you pass as <code>mediaPath</code> in the deploy payload is mounted as <code>/audiobooks</code> inside the container. Bind a host directory containing your media library (movies, TV shows, music, etc.).</p>
+<ul>
+  <li><strong>UID/GID:</strong> Audiobookshelf runs as a non-root user. If you see permission errors in the dashboard Logs tab, run <code>chown -R 1000:1000 /media/audiobooks</code> on the host.</li>
+  <li><strong>Multi-library:</strong> bind the parent folder and let Audiobookshelf discover subfolders.</li>
+</ul>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/audiobookshelf/config:/config</code></li>
+<li><code>/opt/audiobookshelf/metadata:/metadata</code></li>
+<li><code>MEDIA_PATH:/audiobooks</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/advplyr/audiobookshelf:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Audiobookshelf:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>Library shows empty:</strong> confirm <code>mediaPath</code> is readable by the container UID and that the directory contains the file extensions Audiobookshelf indexes.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>audiobookshelf</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Authentik — DashCaddy Docs',
+  description: 'Install and configure Authentik via DashCaddy. Identity provider and single sign-on platform',
+};
+
+export default function authentikDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Authentik"
+        intro="Identity provider and single sign-on platform"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Security</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Difficulty: Advanced</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/goauthentik/server:latest</code></span>
+</div>
+
+<h2>What is Authentik?</h2>
+<p>Identity provider and single sign-on platform</p>
+<p>Authentik ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Authentik, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Authentik</strong> from the Security category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>auth</code>), host port (default: <code>9010</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/-/health/live/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "authentik",
+    "config": &#123;
+      "subdomain": "auth",
+      "port": 9010
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Authentik on my home host and expose it at auth.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/goauthentik/server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Requires a PostgreSQL database and Redis instance</li>
+  <li>Consider deploying via the Dev Environment recipe for full stack</li>
+  <li>Set up flows for authentication, enrollment, and recovery</li>
+  <li>Configure OAuth2/OIDC providers for SSO with other apps</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/authentik/media:/media</code></li>
+<li><code>/opt/authentik/templates:/templates</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>AUTHENTIK_SECRET_KEY</code></li>
+  <li><code>AUTHENTIK_ERROR_REPORTING__ENABLED</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/goauthentik/server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Authentik:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/-/health/live/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>authentik</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,134 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Bazarr — DashCaddy Docs',
+  description: 'Install and configure Bazarr via DashCaddy. Automatic subtitle downloader for Sonarr and Radarr',
+};
+
+export default function bazarrDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Bazarr"
+        intro="Automatic subtitle downloader for Sonarr and Radarr"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/bazarr:latest</code></span>
+</div>
+
+<h2>What is Bazarr?</h2>
+<p>Automatic subtitle downloader for Sonarr and Radarr</p>
+<p>Bazarr ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Bazarr, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Bazarr</strong> from the Media Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>bazarr</code>), host port (default: <code>6767</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "bazarr",
+    "config": &#123;
+      "subdomain": "bazarr",
+      "port": 6767
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Bazarr on my home host and expose it at bazarr.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/bazarr:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Connect to Sonarr and Radarr</li>
+  <li>Configure subtitle providers</li>
+  <li>Set language preferences</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/bazarr/config:/config</code></li>
+<li><code>/movies:/movies</code></li>
+<li><code>/tv:/tv</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/bazarr:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Bazarr:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>bazarr</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,135 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install BIND9 DNS Server — DashCaddy Docs',
+  description: 'Install and configure BIND9 DNS Server via DashCaddy. Industry-standard DNS server - powerful and flexible',
+};
+
+export default function bind9DocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install BIND9 DNS Server"
+        intro="Industry-standard DNS server - powerful and flexible"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: DNS</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Difficulty: Advanced</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ubuntu/bind9:latest</code></span>
+</div>
+
+<h2>What is BIND9 DNS Server?</h2>
+<p>Industry-standard DNS server - powerful and flexible</p>
+<p>BIND9 DNS Server ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using BIND9 DNS Server, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>BIND9 DNS Server</strong> from the DNS category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>dns2</code>), host port (default: <code>953</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>tcp://localhost:53</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "bind9",
+    "config": &#123;
+      "subdomain": "dns2",
+      "port": 953
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy BIND9 DNS Server on my home host and expose it at dns2.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ubuntu/bind9:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure zone files in /opt/bind9/config/</li>
+  <li>Create named.conf.local for your .sami zone</li>
+  <li>Add zone file: /opt/bind9/records/db.sami</li>
+  <li>Restart container to apply changes</li>
+  <li>Test with: dig @localhost sami</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/bind9/config:/etc/bind</code></li>
+<li><code>/opt/bind9/cache:/var/cache/bind</code></li>
+<li><code>/opt/bind9/records:/var/lib/bind</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>BIND9_USER</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ubuntu/bind9:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with BIND9 DNS Server:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>tcp://localhost:53</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>bind9</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,136 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install BookStack — DashCaddy Docs',
+  description: 'Install and configure BookStack via DashCaddy. Simple wiki and documentation platform',
+};
+
+export default function bookstackDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install BookStack"
+        intro="Simple wiki and documentation platform"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/bookstack:latest</code></span>
+</div>
+
+<h2>What is BookStack?</h2>
+<p>Simple wiki and documentation platform</p>
+<p>BookStack ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using BookStack, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>BookStack</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>wiki</code>), host port (default: <code>8091</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "bookstack",
+    "config": &#123;
+      "subdomain": "wiki",
+      "port": 8091
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy BookStack on my home host and expose it at wiki.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/bookstack:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Requires MariaDB/MySQL database</li>
+  <li>Default login: admin@admin.com / password</li>
+  <li>Change default credentials</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/bookstack/config:/config</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>APP_URL</code></li>
+  <li><code>DB_HOST</code></li>
+  <li><code>DB_DATABASE</code></li>
+  <li><code>DB_USERNAME</code></li>
+  <li><code>DB_PASSWORD</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/bookstack:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with BookStack:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>bookstack</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,141 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Calibre-Web — DashCaddy Docs',
+  description: 'Install and configure Calibre-Web via DashCaddy. Web-based ebook manager and reader',
+};
+
+export default function calibreWebDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Calibre-Web"
+        intro="Web-based ebook manager and reader"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">lscr.io/linuxserver/calibre-web:latest</code></span>
+</div>
+
+<h2>What is Calibre-Web?</h2>
+<p>Web-based ebook manager and reader</p>
+<p>Calibre-Web ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Calibre-Web, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>A host path containing your media. Default suggestion: <code>/media/books</code>. The deploy form / API payload <code>config.mediaPath</code> must be readable by the container UID (usually <code>1000</code>).</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Calibre-Web</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>books</code>), host port (default: <code>8083</code>), and the media library path.</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "calibre-web",
+    "config": &#123;
+      "subdomain": "books",
+      "port": 8083,
+      "mediaPath": "/media/books"
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Calibre-Web on my home host and expose it at books.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull lscr.io/linuxserver/calibre-web:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Default login: admin / admin123</li>
+  <li>Point to your Calibre database location on first setup</li>
+  <li>Supports EPUB, PDF, MOBI, and more formats</li>
+</ol>
+<h2>Media library path notes</h2>
+<p>The media mount path you pass as <code>mediaPath</code> in the deploy payload is mounted as <code>/books</code> inside the container. Bind a host directory containing your media library (movies, TV shows, music, etc.).</p>
+<ul>
+  <li><strong>UID/GID:</strong> Calibre-Web runs as a non-root user. If you see permission errors in the dashboard Logs tab, run <code>chown -R 1000:1000 /media/books</code> on the host.</li>
+  <li><strong>Multi-library:</strong> bind the parent folder and let Calibre-Web discover subfolders.</li>
+</ul>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/calibre-web/config:/config</code></li>
+<li><code>MEDIA_PATH:/books</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull lscr.io/linuxserver/calibre-web:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Calibre-Web:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>Library shows empty:</strong> confirm <code>mediaPath</code> is readable by the container UID and that the directory contains the file extensions Calibre-Web indexes.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>calibre-web</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Change Detection — DashCaddy Docs',
+  description: 'Install and configure Change Detection via DashCaddy. Monitor websites for changes',
+};
+
+export default function changedetectionDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Change Detection"
+        intro="Monitor websites for changes"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Utilities</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/dgtlmoon/changedetection.io:latest</code></span>
+</div>
+
+<h2>What is Change Detection?</h2>
+<p>Monitor websites for changes</p>
+<p>Change Detection ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Change Detection, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Change Detection</strong> from the Utilities category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>watch</code>), host port (default: <code>5001</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "changedetection",
+    "config": &#123;
+      "subdomain": "watch",
+      "port": 5001
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Change Detection on my home host and expose it at watch.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/dgtlmoon/changedetection.io:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Add URLs to monitor</li>
+  <li>Configure check frequency</li>
+  <li>Set up notifications</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/changedetection/data:/datastore</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/dgtlmoon/changedetection.io:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Change Detection:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>changedetection</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,130 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install CoreDNS — DashCaddy Docs',
+  description: 'Install and configure CoreDNS via DashCaddy. Cloud-native DNS server - lightweight and flexible',
+};
+
+export default function corednsDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install CoreDNS"
+        intro="Cloud-native DNS server - lightweight and flexible"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: DNS</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">coredns/coredns:latest</code></span>
+</div>
+
+<h2>What is CoreDNS?</h2>
+<p>Cloud-native DNS server - lightweight and flexible</p>
+<p>CoreDNS ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using CoreDNS, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>CoreDNS</strong> from the DNS category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>dns4</code>), host port (default: <code>53</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>tcp://localhost:53</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "coredns",
+    "config": &#123;
+      "subdomain": "dns4",
+      "port": 53
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy CoreDNS on my home host and expose it at dns4.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull coredns/coredns:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Create Corefile in /opt/coredns/config/</li>
+  <li>Define .sami zone with file plugin</li>
+  <li>Create zone file with your records</li>
+  <li>Restart container to load config</li>
+  <li>Test with: dig @localhost test.sami</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/coredns/config:/etc/coredns</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull coredns/coredns:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with CoreDNS:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>tcp://localhost:53</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>coredns</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,130 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install CrowdSec — DashCaddy Docs',
+  description: 'Install and configure CrowdSec via DashCaddy. Collaborative intrusion prevention system',
+};
+
+export default function crowdsecDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install CrowdSec"
+        intro="Collaborative intrusion prevention system"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Security</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">crowdsecurity/crowdsec:latest</code></span>
+</div>
+
+<h2>What is CrowdSec?</h2>
+<p>Collaborative intrusion prevention system</p>
+<p>CrowdSec ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using CrowdSec, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>CrowdSec</strong> from the Security category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>crowdsec</code>), host port (default: <code>8091</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/health</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "crowdsec",
+    "config": &#123;
+      "subdomain": "crowdsec",
+      "port": 8091
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy CrowdSec on my home host and expose it at crowdsec.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull crowdsecurity/crowdsec:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Register at app.crowdsec.net for community threat intelligence</li>
+  <li>Install bouncers on your reverse proxy for active blocking</li>
+  <li>CrowdSec analyzes logs and shares threat data with the community</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/crowdsec/config:/etc/crowdsec</code></li>
+<li><code>/opt/crowdsec/data:/var/lib/crowdsec/data</code></li>
+<li><code>/var/log:/var/log:ro</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull crowdsecurity/crowdsec:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with CrowdSec:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/health</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>crowdsec</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,129 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install DashCA — DashCaddy Docs',
+  description: 'Install and configure DashCA via DashCaddy. One-click root CA certificate installer for your network',
+};
+
+export default function dashcaDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install DashCA"
+        intro="One-click root CA certificate installer for your network"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Security</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">N/A</code></span>
+</div>
+
+<h2>What is DashCA?</h2>
+<p>One-click root CA certificate installer for your network</p>
+<p>DashCA ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using DashCA, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>DashCA</strong> from the Security category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>ca</code>), host port (default: <code>32400</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/healthz</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "dashca",
+    "config": &#123;
+      "subdomain": "ca",
+      "port": 32400
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy DashCA on my home host and expose it at ca.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull N/A</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>New devices: visit http://ca.sami (HTTP, no certificate needed)</li>
+  <li>Click the 'Install Certificate' button for your platform</li>
+  <li>Follow platform-specific instructions</li>
+  <li>Verify all *.sami domains now show secure connections</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull N/A</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with DashCA:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/healthz</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>dashca</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,127 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Digital Clock — DashCaddy Docs',
+  description: 'Install and configure Digital Clock via DashCaddy. Live digital clock with time, date, and day of week',
+};
+
+export default function digitalClockDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Digital Clock"
+        intro="Live digital clock with time, date, and day of week"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Utilities</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">N/A</code></span>
+</div>
+
+<h2>What is Digital Clock?</h2>
+<p>Live digital clock with time, date, and day of week</p>
+<p>Digital Clock ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Digital Clock, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Digital Clock</strong> from the Utilities category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>digital-clock</code>), host port (default: <code>32400</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/healthz</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "digital-clock",
+    "config": &#123;
+      "subdomain": "digital-clock",
+      "port": 32400
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Digital Clock on my home host and expose it at digital-clock.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull N/A</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Clock appears in the top bar to the right of the weather widget</li>
+  <li>No configuration needed — runs automatically</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull N/A</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Digital Clock:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/healthz</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>digital-clock</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Dozzle — DashCaddy Docs',
+  description: 'Install and configure Dozzle via DashCaddy. Real-time Docker container log viewer',
+};
+
+export default function dozzleDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Dozzle"
+        intro="Real-time Docker container log viewer"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Monitoring</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">amir20/dozzle:latest</code></span>
+</div>
+
+<h2>What is Dozzle?</h2>
+<p>Real-time Docker container log viewer</p>
+<p>Dozzle ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Dozzle, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Dozzle</strong> from the Monitoring category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>logs</code>), host port (default: <code>8088</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "dozzle",
+    "config": &#123;
+      "subdomain": "logs",
+      "port": 8088
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Dozzle on my home host and expose it at logs.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull amir20/dozzle:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>View real-time logs from all running containers</li>
+  <li>Filter and search across container logs</li>
+  <li>No configuration needed - auto-discovers containers</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/var/run/docker.sock:/var/run/docker.sock:ro</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull amir20/dozzle:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Dozzle:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>dozzle</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Drone CI — DashCaddy Docs',
+  description: 'Install and configure Drone CI via DashCaddy. Container-native continuous delivery platform',
+};
+
+export default function droneDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Drone CI"
+        intro="Container-native continuous delivery platform"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Development</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">drone/drone:latest</code></span>
+</div>
+
+<h2>What is Drone CI?</h2>
+<p>Container-native continuous delivery platform</p>
+<p>Drone CI ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Drone CI, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Drone CI</strong> from the Development category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>drone</code>), host port (default: <code>8090</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "drone",
+    "config": &#123;
+      "subdomain": "drone",
+      "port": 8090
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Drone CI on my home host and expose it at drone.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull drone/drone:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure Git provider integration</li>
+  <li>Set up shared secret</li>
+  <li>Deploy Drone runners</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/drone/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>DRONE_GITEA_SERVER</code></li>
+  <li><code>DRONE_RPC_SECRET</code></li>
+  <li><code>DRONE_SERVER_HOST</code></li>
+  <li><code>DRONE_SERVER_PROTO</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull drone/drone:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Drone CI:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>drone</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,142 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Emby — DashCaddy Docs',
+  description: 'Install and configure Emby via DashCaddy. Personal media server with apps for all devices',
+};
+
+export default function embyDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Emby"
+        intro="Personal media server with apps for all devices"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">emby/embyserver:latest</code></span>
+</div>
+
+<h2>What is Emby?</h2>
+<p>Personal media server with apps for all devices</p>
+<p>Emby ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Emby, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>A host path containing your media. Default suggestion: <code>/media</code>. The deploy form / API payload <code>config.mediaPath</code> must be readable by the container UID (usually <code>1000</code>).</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Emby</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>emby</code>), host port (default: <code>8096</code>), and the media library path.</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/emby/web/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "emby",
+    "config": &#123;
+      "subdomain": "emby",
+      "port": 8096,
+      "mediaPath": "/media"
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Emby on my home host and expose it at emby.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull emby/embyserver:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Complete the initial setup wizard at the web interface</li>
+  <li>Add your media libraries (Movies, TV Shows, Music)</li>
+  <li>Configure user accounts and permissions</li>
+  <li>Install Emby apps on your devices for remote access</li>
+</ol>
+<h2>Media library path notes</h2>
+<p>The media mount path you pass as <code>mediaPath</code> in the deploy payload is mounted as <code>/media</code> inside the container. Bind a host directory containing your media library (movies, TV shows, music, etc.).</p>
+<ul>
+  <li><strong>UID/GID:</strong> Emby runs as a non-root user. If you see permission errors in the dashboard Logs tab, run <code>chown -R 1000:1000 /media</code> on the host.</li>
+  <li><strong>Multi-library:</strong> bind the parent folder and let Emby discover subfolders.</li>
+</ul>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/emby/config:/config</code></li>
+<li><code>/opt/emby/cache:/cache</code></li>
+<li><code>MEDIA_PATH:/media</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>UID</code></li>
+  <li><code>GID</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull emby/embyserver:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Emby:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>Library shows empty:</strong> confirm <code>mediaPath</code> is readable by the container UID and that the directory contains the file extensions Emby indexes.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/emby/web/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>emby</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Excalidraw — DashCaddy Docs',
+  description: 'Install and configure Excalidraw via DashCaddy. Collaborative virtual whiteboard for sketching and diagrams',
+};
+
+export default function excalidrawDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Excalidraw"
+        intro="Collaborative virtual whiteboard for sketching and diagrams"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">excalidraw/excalidraw:latest</code></span>
+</div>
+
+<h2>What is Excalidraw?</h2>
+<p>Collaborative virtual whiteboard for sketching and diagrams</p>
+<p>Excalidraw ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Excalidraw, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Excalidraw</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>draw</code>), host port (default: <code>8086</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "excalidraw",
+    "config": &#123;
+      "subdomain": "draw",
+      "port": 8086
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Excalidraw on my home host and expose it at draw.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull excalidraw/excalidraw:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Start drawing immediately - no account needed</li>
+  <li>Share drawings via link for real-time collaboration</li>
+  <li>Export as PNG, SVG, or Excalidraw file</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/excalidraw/data:/var/lib/excalidraw</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull excalidraw/excalidraw:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Excalidraw:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>excalidraw</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,129 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install FileBrowser — DashCaddy Docs',
+  description: 'Install and configure FileBrowser via DashCaddy. Web-based file manager with sharing capabilities',
+};
+
+export default function filebrowserDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install FileBrowser"
+        intro="Web-based file manager with sharing capabilities"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Files</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">filebrowser/filebrowser:latest</code></span>
+</div>
+
+<h2>What is FileBrowser?</h2>
+<p>Web-based file manager with sharing capabilities</p>
+<p>FileBrowser ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using FileBrowser, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>FileBrowser</strong> from the Files category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>files</code>), host port (default: <code>8085</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "filebrowser",
+    "config": &#123;
+      "subdomain": "files",
+      "port": 8085
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy FileBrowser on my home host and expose it at files.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull filebrowser/filebrowser:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Default login: admin/admin</li>
+  <li>Change default password immediately</li>
+  <li>Configure user permissions and shares</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/filebrowser/data:/srv</code></li>
+<li><code>/opt/filebrowser/database:/database</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull filebrowser/filebrowser:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with FileBrowser:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>filebrowser</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Gitea — DashCaddy Docs',
+  description: 'Install and configure Gitea via DashCaddy. Lightweight self-hosted Git service',
+};
+
+export default function giteaDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Gitea"
+        intro="Lightweight self-hosted Git service"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Development</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">gitea/gitea:latest</code></span>
+</div>
+
+<h2>What is Gitea?</h2>
+<p>Lightweight self-hosted Git service</p>
+<p>Gitea ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Gitea, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Gitea</strong> from the Development category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>gitea</code>), host port (default: <code>3005</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "gitea",
+    "config": &#123;
+      "subdomain": "gitea",
+      "port": 3005
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Gitea on my home host and expose it at gitea.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull gitea/gitea:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Complete initial setup wizard</li>
+  <li>Create admin account</li>
+  <li>Configure SSH access</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/gitea/data:/data</code></li>
+<li><code>/etc/timezone:/etc/timezone:ro</code></li>
+<li><code>/etc/localtime:/etc/localtime:ro</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>USER_UID</code></li>
+  <li><code>USER_GID</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull gitea/gitea:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Gitea:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>gitea</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,130 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Grafana — DashCaddy Docs',
+  description: 'Install and configure Grafana via DashCaddy. Analytics and interactive visualization platform',
+};
+
+export default function grafanaDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Grafana"
+        intro="Analytics and interactive visualization platform"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Monitoring</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Difficulty: Advanced</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">grafana/grafana:latest</code></span>
+</div>
+
+<h2>What is Grafana?</h2>
+<p>Analytics and interactive visualization platform</p>
+<p>Grafana ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Grafana, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Grafana</strong> from the Monitoring category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>grafana</code>), host port (default: <code>3000</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/health</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "grafana",
+    "config": &#123;
+      "subdomain": "grafana",
+      "port": 3000
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Grafana on my home host and expose it at grafana.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull grafana/grafana:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Open the deployed URL (returned in the response as <code>url</code>, or visible in the dashboard).</li>
+  <li>Complete the upstream Grafana setup wizard (admin account, library paths, EULA).</li>
+  <li>Restore from a backup if one exists: <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with the backup ID from <code>GET /api/v1/backups/history</code>.</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/grafana/data:/var/lib/grafana</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>GF_SECURITY_ADMIN_PASSWORD</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull grafana/grafana:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Grafana:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/health</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>grafana</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,130 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Homarr — DashCaddy Docs',
+  description: 'Install and configure Homarr via DashCaddy. Sleek dashboard for all your services',
+};
+
+export default function homarrDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Homarr"
+        intro="Sleek dashboard for all your services"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Utilities</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/ajnart/homarr:latest</code></span>
+</div>
+
+<h2>What is Homarr?</h2>
+<p>Sleek dashboard for all your services</p>
+<p>Homarr ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Homarr, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Homarr</strong> from the Utilities category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>homarr</code>), host port (default: <code>7575</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "homarr",
+    "config": &#123;
+      "subdomain": "homarr",
+      "port": 7575
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Homarr on my home host and expose it at homarr.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/ajnart/homarr:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Add your services via UI</li>
+  <li>Configure integrations</li>
+  <li>Customize layout and appearance</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/homarr/configs:/app/data/configs</code></li>
+<li><code>/opt/homarr/icons:/app/public/icons</code></li>
+<li><code>/var/run/docker.sock:/var/run/docker.sock:ro</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/ajnart/homarr:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Homarr:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>homarr</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,131 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Home Assistant — DashCaddy Docs',
+  description: 'Install and configure Home Assistant via DashCaddy. Open source home automation platform',
+};
+
+export default function homeassistantDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Home Assistant"
+        intro="Open source home automation platform"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Home Automation</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">homeassistant/home-assistant:stable</code></span>
+</div>
+
+<h2>What is Home Assistant?</h2>
+<p>Open source home automation platform</p>
+<p>Home Assistant ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Home Assistant, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Home Assistant</strong> from the Home Automation category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>home</code>), host port (default: <code>8123</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "homeassistant",
+    "config": &#123;
+      "subdomain": "home",
+      "port": 8123
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Home Assistant on my home host and expose it at home.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull homeassistant/home-assistant:stable</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Complete onboarding wizard</li>
+  <li>Add integrations for your smart devices</li>
+  <li>Create automations and dashboards</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/homeassistant/config:/config</code></li>
+<li><code>/etc/localtime:/etc/localtime:ro</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull homeassistant/home-assistant:stable</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Home Assistant:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>homeassistant</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,129 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Homepage — DashCaddy Docs',
+  description: 'Install and configure Homepage via DashCaddy. Highly customizable application dashboard',
+};
+
+export default function homepageDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Homepage"
+        intro="Highly customizable application dashboard"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Utilities</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/gethomepage/homepage:latest</code></span>
+</div>
+
+<h2>What is Homepage?</h2>
+<p>Highly customizable application dashboard</p>
+<p>Homepage ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Homepage, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Homepage</strong> from the Utilities category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>dashboard</code>), host port (default: <code>3008</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "homepage",
+    "config": &#123;
+      "subdomain": "dashboard",
+      "port": 3008
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Homepage on my home host and expose it at dashboard.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/gethomepage/homepage:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Edit config files to add services</li>
+  <li>Configure widgets</li>
+  <li>Customize appearance</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/homepage/config:/app/config</code></li>
+<li><code>/var/run/docker.sock:/var/run/docker.sock:ro</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/gethomepage/homepage:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Homepage:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>homepage</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,135 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Immich — DashCaddy Docs',
+  description: 'Install and configure Immich via DashCaddy. Self-hosted Google Photos alternative',
+};
+
+export default function immichDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Immich"
+        intro="Self-hosted Google Photos alternative"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Photos</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/immich-app/immich-server:latest</code></span>
+</div>
+
+<h2>What is Immich?</h2>
+<p>Self-hosted Google Photos alternative</p>
+<p>Immich ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Immich, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Immich</strong> from the Photos category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>photos</code>), host port (default: <code>2283</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/server-info/ping</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "immich",
+    "config": &#123;
+      "subdomain": "photos",
+      "port": 2283
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Immich on my home host and expose it at photos.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/immich-app/immich-server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Requires PostgreSQL and Redis</li>
+  <li>Install mobile apps for backup</li>
+  <li>Configure machine learning for face detection</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/immich/upload:/usr/src/app/upload</code></li>
+<li><code>/opt/immich/library:/usr/src/app/library</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>DB_HOSTNAME</code></li>
+  <li><code>DB_USERNAME</code></li>
+  <li><code>DB_PASSWORD</code></li>
+  <li><code>DB_DATABASE_NAME</code></li>
+  <li><code>REDIS_HOSTNAME</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/immich-app/immich-server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Immich:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/server-info/ping</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>immich</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install IT Tools — DashCaddy Docs',
+  description: 'Install and configure IT Tools via DashCaddy. Collection of handy developer and IT tools in one place',
+};
+
+export default function itToolsDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install IT Tools"
+        intro="Collection of handy developer and IT tools in one place"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Utilities</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">corentinth/it-tools:latest</code></span>
+</div>
+
+<h2>What is IT Tools?</h2>
+<p>Collection of handy developer and IT tools in one place</p>
+<p>IT Tools ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using IT Tools, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>IT Tools</strong> from the Utilities category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>tools</code>), host port (default: <code>8087</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "it-tools",
+    "config": &#123;
+      "subdomain": "tools",
+      "port": 8087
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy IT Tools on my home host and expose it at tools.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull corentinth/it-tools:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Access the web interface for instant tools access</li>
+  <li>Includes: hash generators, UUID, JWT decoder, base64, regex tester, and 70+ more</li>
+  <li>No configuration needed</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/it-tools/config:/config</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull corentinth/it-tools:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with IT Tools:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>it-tools</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,129 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install JDownloader 2 — DashCaddy Docs',
+  description: 'Install and configure JDownloader 2 via DashCaddy. Download manager for file hosting sites',
+};
+
+export default function jdownloaderDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install JDownloader 2"
+        intro="Download manager for file hosting sites"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Downloads</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">jlesage/jdownloader-2:latest</code></span>
+</div>
+
+<h2>What is JDownloader 2?</h2>
+<p>Download manager for file hosting sites</p>
+<p>JDownloader 2 ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using JDownloader 2, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>JDownloader 2</strong> from the Downloads category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>jdownloader</code>), host port (default: <code>5800</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "jdownloader",
+    "config": &#123;
+      "subdomain": "jdownloader",
+      "port": 5800
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy JDownloader 2 on my home host and expose it at jdownloader.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull jlesage/jdownloader-2:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Access web interface to configure</li>
+  <li>Link to MyJDownloader account</li>
+  <li>Configure download paths</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/jdownloader/config:/config</code></li>
+<li><code>/downloads:/output</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull jlesage/jdownloader-2:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with JDownloader 2:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>jdownloader</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,140 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Jellyfin — DashCaddy Docs',
+  description: 'Install and configure Jellyfin via DashCaddy. Free software media system - alternative to Plex',
+};
+
+export default function jellyfinDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Jellyfin"
+        intro="Free software media system - alternative to Plex"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">jellyfin/jellyfin:latest</code></span>
+</div>
+
+<h2>What is Jellyfin?</h2>
+<p>Free software media system - alternative to Plex</p>
+<p>Jellyfin ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Jellyfin, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>A host path containing your media. Default suggestion: <code>/media</code>. The deploy form / API payload <code>config.mediaPath</code> must be readable by the container UID (usually <code>1000</code>).</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Jellyfin</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>jellyfin</code>), host port (default: <code>8096</code>), and the media library path.</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/health</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "jellyfin",
+    "config": &#123;
+      "subdomain": "jellyfin",
+      "port": 8096,
+      "mediaPath": "/media"
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Jellyfin on my home host and expose it at jellyfin.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull jellyfin/jellyfin:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Complete the initial setup wizard</li>
+  <li>Add your media libraries</li>
+  <li>Configure user accounts and permissions</li>
+</ol>
+<h2>Media library path notes</h2>
+<p>The media mount path you pass as <code>mediaPath</code> in the deploy payload is mounted as <code>/media</code> inside the container. Bind a host directory containing your media library (movies, TV shows, music, etc.).</p>
+<ul>
+  <li><strong>UID/GID:</strong> Jellyfin runs as a non-root user. If you see permission errors in the dashboard Logs tab, run <code>chown -R 1000:1000 /media</code> on the host.</li>
+  <li><strong>Multi-library:</strong> bind the parent folder and let Jellyfin discover subfolders.</li>
+</ul>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/jellyfin/config:/config</code></li>
+<li><code>/opt/jellyfin/cache:/cache</code></li>
+<li><code>MEDIA_PATH:/media</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>JELLYFIN_PublishedServerUrl</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull jellyfin/jellyfin:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Jellyfin:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>Library shows empty:</strong> confirm <code>mediaPath</code> is readable by the container UID and that the directory contains the file extensions Jellyfin indexes.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/health</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>jellyfin</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Jenkins — DashCaddy Docs',
+  description: 'Install and configure Jenkins via DashCaddy. Automation server for CI/CD pipelines',
+};
+
+export default function jenkinsDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Jenkins"
+        intro="Automation server for CI/CD pipelines"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Development</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Difficulty: Advanced</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">jenkins/jenkins:lts</code></span>
+</div>
+
+<h2>What is Jenkins?</h2>
+<p>Automation server for CI/CD pipelines</p>
+<p>Jenkins ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Jenkins, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Jenkins</strong> from the Development category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>jenkins</code>), host port (default: <code>8089</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/login</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "jenkins",
+    "config": &#123;
+      "subdomain": "jenkins",
+      "port": 8089
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Jenkins on my home host and expose it at jenkins.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull jenkins/jenkins:lts</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Get initial admin password from logs</li>
+  <li>Install suggested plugins</li>
+  <li>Create admin user</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/jenkins/data:/var/jenkins_home</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull jenkins/jenkins:lts</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Jenkins:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/login</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>jenkins</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,137 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Kavita — DashCaddy Docs',
+  description: 'Install and configure Kavita via DashCaddy. Digital reading platform for manga, comics, and books',
+};
+
+export default function kavitaDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Kavita"
+        intro="Digital reading platform for manga, comics, and books"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">jvmilazz0/kavita:latest</code></span>
+</div>
+
+<h2>What is Kavita?</h2>
+<p>Digital reading platform for manga, comics, and books</p>
+<p>Kavita ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Kavita, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>A host path containing your media. Default suggestion: <code>/media/reading</code>. The deploy form / API payload <code>config.mediaPath</code> must be readable by the container UID (usually <code>1000</code>).</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Kavita</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>kavita</code>), host port (default: <code>5004</code>), and the media library path.</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "kavita",
+    "config": &#123;
+      "subdomain": "kavita",
+      "port": 5004,
+      "mediaPath": "/media/reading"
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Kavita on my home host and expose it at kavita.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull jvmilazz0/kavita:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Create admin account on first access</li>
+  <li>Add library folders for manga, comics, or books</li>
+  <li>Supports EPUB, PDF, CBZ, CBR formats</li>
+</ol>
+<h2>Media library path notes</h2>
+<p>The media mount path you pass as <code>mediaPath</code> in the deploy payload is mounted as <code>/data</code> inside the container. Bind a host directory containing your media library (movies, TV shows, music, etc.).</p>
+<ul>
+  <li><strong>UID/GID:</strong> Kavita runs as a non-root user. If you see permission errors in the dashboard Logs tab, run <code>chown -R 1000:1000 /media/reading</code> on the host.</li>
+  <li><strong>Multi-library:</strong> bind the parent folder and let Kavita discover subfolders.</li>
+</ul>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/kavita/config:/kavita/config</code></li>
+<li><code>MEDIA_PATH:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull jvmilazz0/kavita:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Kavita:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>Library shows empty:</strong> confirm <code>mediaPath</code> is readable by the container UID and that the directory contains the file extensions Kavita indexes.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>kavita</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,139 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Komga — DashCaddy Docs',
+  description: 'Install and configure Komga via DashCaddy. Comic and manga media server with web reader',
+};
+
+export default function komgaDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Komga"
+        intro="Comic and manga media server with web reader"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">gotson/komga:latest</code></span>
+</div>
+
+<h2>What is Komga?</h2>
+<p>Comic and manga media server with web reader</p>
+<p>Komga ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Komga, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>A host path containing your media. Default suggestion: <code>/media/comics</code>. The deploy form / API payload <code>config.mediaPath</code> must be readable by the container UID (usually <code>1000</code>).</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Komga</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>komga</code>), host port (default: <code>25600</code>), and the media library path.</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "komga",
+    "config": &#123;
+      "subdomain": "komga",
+      "port": 25600,
+      "mediaPath": "/media/comics"
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Komga on my home host and expose it at komga.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull gotson/komga:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Create admin account on first access</li>
+  <li>Add your comic libraries (CBZ, CBR, PDF supported)</li>
+  <li>Use OPDS for third-party reader apps</li>
+</ol>
+<h2>Media library path notes</h2>
+<p>The media mount path you pass as <code>mediaPath</code> in the deploy payload is mounted as <code>/data</code> inside the container. Bind a host directory containing your media library (movies, TV shows, music, etc.).</p>
+<ul>
+  <li><strong>UID/GID:</strong> Komga runs as a non-root user. If you see permission errors in the dashboard Logs tab, run <code>chown -R 1000:1000 /media/comics</code> on the host.</li>
+  <li><strong>Multi-library:</strong> bind the parent folder and let Komga discover subfolders.</li>
+</ul>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/komga/config:/config</code></li>
+<li><code>MEDIA_PATH:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull gotson/komga:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Komga:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>Library shows empty:</strong> confirm <code>mediaPath</code> is readable by the container UID and that the directory contains the file extensions Komga indexes.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>komga</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,134 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Lidarr — DashCaddy Docs',
+  description: 'Install and configure Lidarr via DashCaddy. Music collection manager for Usenet and BitTorrent',
+};
+
+export default function lidarrDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Lidarr"
+        intro="Music collection manager for Usenet and BitTorrent"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/lidarr:latest</code></span>
+</div>
+
+<h2>What is Lidarr?</h2>
+<p>Music collection manager for Usenet and BitTorrent</p>
+<p>Lidarr ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Lidarr, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Lidarr</strong> from the Media Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>lidarr</code>), host port (default: <code>8686</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/v1/system/status</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "lidarr",
+    "config": &#123;
+      "subdomain": "lidarr",
+      "port": 8686
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Lidarr on my home host and expose it at lidarr.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/lidarr:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure download clients</li>
+  <li>Add indexers</li>
+  <li>Set up root folders for music</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/lidarr/config:/config</code></li>
+<li><code>/downloads:/downloads</code></li>
+<li><code>/music:/music</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/lidarr:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Lidarr:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/v1/system/status</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>lidarr</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,137 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Docker Mailserver — DashCaddy Docs',
+  description: 'Install and configure Docker Mailserver via DashCaddy. Full-featured email server with SMTP, IMAP, spam filtering',
+};
+
+export default function mailserverDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Docker Mailserver"
+        intro="Full-featured email server with SMTP, IMAP, spam filtering"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Communication</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Difficulty: Advanced</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">mailserver/docker-mailserver:latest</code></span>
+</div>
+
+<h2>What is Docker Mailserver?</h2>
+<p>Full-featured email server with SMTP, IMAP, spam filtering</p>
+<p>Docker Mailserver ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Docker Mailserver, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Docker Mailserver</strong> from the Communication category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>mail</code>), host port (default: <code>25</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "mailserver",
+    "config": &#123;
+      "subdomain": "mail",
+      "port": 25
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Docker Mailserver on my home host and expose it at mail.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull mailserver/docker-mailserver:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure DNS records (MX, SPF, DKIM, DMARC)</li>
+  <li>Create email accounts using setup.sh</li>
+  <li>Set up SSL certificates for secure connections</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/mailserver/data:/var/mail</code></li>
+<li><code>/opt/mailserver/state:/var/mail-state</code></li>
+<li><code>/opt/mailserver/logs:/var/log/mail</code></li>
+<li><code>/opt/mailserver/config:/tmp/docker-mailserver</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>ENABLE_SPAMASSASSIN</code></li>
+  <li><code>ENABLE_CLAMAV</code></li>
+  <li><code>ENABLE_FAIL2BAN</code></li>
+  <li><code>ONE_DIR</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull mailserver/docker-mailserver:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Docker Mailserver:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>mailserver</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,131 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Matrix Synapse — DashCaddy Docs',
+  description: 'Install and configure Matrix Synapse via DashCaddy. Decentralized, secure messaging and collaboration',
+};
+
+export default function matrixDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Matrix Synapse"
+        intro="Decentralized, secure messaging and collaboration"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Communication</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Difficulty: Advanced</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">matrixdotorg/synapse:latest</code></span>
+</div>
+
+<h2>What is Matrix Synapse?</h2>
+<p>Decentralized, secure messaging and collaboration</p>
+<p>Matrix Synapse ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Matrix Synapse, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Matrix Synapse</strong> from the Communication category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>matrix</code>), host port (default: <code>8008</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/_matrix/client/versions</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "matrix",
+    "config": &#123;
+      "subdomain": "matrix",
+      "port": 8008
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Matrix Synapse on my home host and expose it at matrix.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull matrixdotorg/synapse:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Generate initial config with --generate</li>
+  <li>Configure homeserver.yaml</li>
+  <li>Set up federation if needed</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/matrix/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>SYNAPSE_SERVER_NAME</code></li>
+  <li><code>SYNAPSE_REPORT_STATS</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull matrixdotorg/synapse:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Matrix Synapse:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/_matrix/client/versions</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>matrix</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Mealie — DashCaddy Docs',
+  description: 'Install and configure Mealie via DashCaddy. Recipe manager and meal planner with grocery lists',
+};
+
+export default function mealieDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Mealie"
+        intro="Recipe manager and meal planner with grocery lists"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/mealie-recipes/mealie:latest</code></span>
+</div>
+
+<h2>What is Mealie?</h2>
+<p>Recipe manager and meal planner with grocery lists</p>
+<p>Mealie ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Mealie, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Mealie</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>mealie</code>), host port (default: <code>9925</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "mealie",
+    "config": &#123;
+      "subdomain": "mealie",
+      "port": 9925
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Mealie on my home host and expose it at mealie.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/mealie-recipes/mealie:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Default login: changeme@example.com / MyPassword</li>
+  <li>Import recipes from URLs or add them manually</li>
+  <li>Create meal plans and generate shopping lists</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/mealie/data:/app/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>ALLOW_SIGNUP</code></li>
+  <li><code>MAX_WORKERS</code></li>
+  <li><code>WEB_CONCURRENCY</code></li>
+  <li><code>BASE_URL</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/mealie-recipes/mealie:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Mealie:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>mealie</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,136 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Minecraft Server — DashCaddy Docs',
+  description: 'Install and configure Minecraft Server via DashCaddy. Minecraft Java Edition dedicated server',
+};
+
+export default function minecraftDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Minecraft Server"
+        intro="Minecraft Java Edition dedicated server"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Gaming</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">itzg/minecraft-server:latest</code></span>
+</div>
+
+<h2>What is Minecraft Server?</h2>
+<p>Minecraft Java Edition dedicated server</p>
+<p>Minecraft Server ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Minecraft Server, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Minecraft Server</strong> from the Gaming category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>mc</code>), host port (default: <code>25565</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>tcp://localhost:25565</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "minecraft",
+    "config": &#123;
+      "subdomain": "mc",
+      "port": 25565
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Minecraft Server on my home host and expose it at mc.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull itzg/minecraft-server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Server accepts the Minecraft EULA automatically</li>
+  <li>Connect with your Minecraft client to the server IP:port</li>
+  <li>Configure server.properties in the data volume for customization</li>
+  <li>Supports Vanilla, Paper, Forge, Fabric via TYPE environment variable</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/minecraft/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>EULA</code></li>
+  <li><code>TYPE</code></li>
+  <li><code>VERSION</code></li>
+  <li><code>MEMORY</code></li>
+  <li><code>MAX_PLAYERS</code></li>
+  <li><code>MOTD</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull itzg/minecraft-server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Minecraft Server:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>tcp://localhost:25565</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>minecraft</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,131 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install MongoDB — DashCaddy Docs',
+  description: 'Install and configure MongoDB via DashCaddy. Document-oriented NoSQL database',
+};
+
+export default function mongodbDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install MongoDB"
+        intro="Document-oriented NoSQL database"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Database</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">mongo:latest</code></span>
+</div>
+
+<h2>What is MongoDB?</h2>
+<p>Document-oriented NoSQL database</p>
+<p>MongoDB ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using MongoDB, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>MongoDB</strong> from the Database category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>mongo</code>), host port (default: <code>27017</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "mongodb",
+    "config": &#123;
+      "subdomain": "mongo",
+      "port": 27017
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy MongoDB on my home host and expose it at mongo.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull mongo:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Change default admin password</li>
+  <li>Create application databases and users</li>
+  <li>Configure replica set if needed</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/mongodb/data:/data/db</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>MONGO_INITDB_ROOT_USERNAME</code></li>
+  <li><code>MONGO_INITDB_ROOT_PASSWORD</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull mongo:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with MongoDB:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>mongodb</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Navidrome — DashCaddy Docs',
+  description: 'Install and configure Navidrome via DashCaddy. Modern music server and streamer',
+};
+
+export default function navidromeDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Navidrome"
+        intro="Modern music server and streamer"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">deluan/navidrome:latest</code></span>
+</div>
+
+<h2>What is Navidrome?</h2>
+<p>Modern music server and streamer</p>
+<p>Navidrome ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Navidrome, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Navidrome</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>music</code>), host port (default: <code>4533</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "navidrome",
+    "config": &#123;
+      "subdomain": "music",
+      "port": 4533
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Navidrome on my home host and expose it at music.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull deluan/navidrome:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Point to your music library</li>
+  <li>Create user accounts</li>
+  <li>Install Subsonic-compatible apps</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/navidrome/data:/data</code></li>
+<li><code>/music:/music:ro</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>ND_SCANSCHEDULE</code></li>
+  <li><code>ND_LOGLEVEL</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull deluan/navidrome:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Navidrome:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>navidrome</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Nextcloud — DashCaddy Docs',
+  description: 'Install and configure Nextcloud via DashCaddy. Self-hosted productivity platform and file sync',
+};
+
+export default function nextcloudDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Nextcloud"
+        intro="Self-hosted productivity platform and file sync"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">nextcloud:latest</code></span>
+</div>
+
+<h2>What is Nextcloud?</h2>
+<p>Self-hosted productivity platform and file sync</p>
+<p>Nextcloud ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Nextcloud, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Nextcloud</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>cloud</code>), host port (default: <code>8080</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/status.php</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "nextcloud",
+    "config": &#123;
+      "subdomain": "cloud",
+      "port": 8080
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Nextcloud on my home host and expose it at cloud.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull nextcloud:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Change the default admin password</li>
+  <li>Configure trusted domains</li>
+  <li>Install recommended apps</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/nextcloud/html:/var/www/html</code></li>
+<li><code>/opt/nextcloud/data:/var/www/html/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>NEXTCLOUD_ADMIN_USER</code></li>
+  <li><code>NEXTCLOUD_ADMIN_PASSWORD</code></li>
+  <li><code>NEXTCLOUD_TRUSTED_DOMAINS</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull nextcloud:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Nextcloud:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/status.php</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>nextcloud</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,130 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Node-RED — DashCaddy Docs',
+  description: 'Install and configure Node-RED via DashCaddy. Flow-based programming for IoT and automation',
+};
+
+export default function noderedDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Node-RED"
+        intro="Flow-based programming for IoT and automation"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Home Automation</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">nodered/node-red:latest</code></span>
+</div>
+
+<h2>What is Node-RED?</h2>
+<p>Flow-based programming for IoT and automation</p>
+<p>Node-RED ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Node-RED, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Node-RED</strong> from the Home Automation category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>nodered</code>), host port (default: <code>1880</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "nodered",
+    "config": &#123;
+      "subdomain": "nodered",
+      "port": 1880
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Node-RED on my home host and expose it at nodered.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull nodered/node-red:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Install additional nodes from palette</li>
+  <li>Create flows for automation</li>
+  <li>Connect to Home Assistant or MQTT</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/nodered/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull nodered/node-red:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Node-RED:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>nodered</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install NZBGet — DashCaddy Docs',
+  description: 'Install and configure NZBGet via DashCaddy. Efficient Usenet downloader',
+};
+
+export default function nzbgetDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install NZBGet"
+        intro="Efficient Usenet downloader"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Downloads</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/nzbget:latest</code></span>
+</div>
+
+<h2>What is NZBGet?</h2>
+<p>Efficient Usenet downloader</p>
+<p>NZBGet ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using NZBGet, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>NZBGet</strong> from the Downloads category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>nzbget</code>), host port (default: <code>6789</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "nzbget",
+    "config": &#123;
+      "subdomain": "nzbget",
+      "port": 6789
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy NZBGet on my home host and expose it at nzbget.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/nzbget:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Default login: nzbget/tegbzn6789</li>
+  <li>Configure news servers</li>
+  <li>Set up categories and paths</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/nzbget/config:/config</code></li>
+<li><code>/downloads:/downloads</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/nzbget:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with NZBGet:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>nzbget</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Outline — DashCaddy Docs',
+  description: 'Install and configure Outline via DashCaddy. Modern team knowledge base and wiki',
+};
+
+export default function outlineDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Outline"
+        intro="Modern team knowledge base and wiki"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Difficulty: Advanced</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">outlinewiki/outline:latest</code></span>
+</div>
+
+<h2>What is Outline?</h2>
+<p>Modern team knowledge base and wiki</p>
+<p>Outline ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Outline, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Outline</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>outline</code>), host port (default: <code>3006</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "outline",
+    "config": &#123;
+      "subdomain": "outline",
+      "port": 3006
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Outline on my home host and expose it at outline.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull outlinewiki/outline:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Requires PostgreSQL and Redis</li>
+  <li>Configure OAuth provider</li>
+  <li>Set up S3-compatible storage</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/outline/data:/var/lib/outline/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>URL</code></li>
+  <li><code>SECRET_KEY</code></li>
+  <li><code>DATABASE_URL</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull outlinewiki/outline:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Outline:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>outline</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,638 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'App Catalog — DashCaddy Docs',
+  description: 'Browse all 77 one-click installable apps supported by DashCaddy, organized by category with install instructions for each.',
+};
+
+export default function DocsCatalogPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="App Catalog"
+        intro="DashCaddy ships with 77 pre-configured application templates. Every template can be deployed from the dashboard, called via the REST API, or invoked through the MCP server. This page is the index — click any app for its dedicated install guide with prerequisites, the exact API payload shape, and post-install verification steps."
+      >
+        <div className="mb-8 rounded-xl border border-brand-500/30 bg-brand-500/5 p-5">
+          <p className="text-sm text-surface-200">
+            <strong className="text-brand-400">77 apps</strong> across <strong>17 categories</strong>. The canonical source is <code>dashcaddy-api/src/docker/app-templates.js</code>; regenerate these pages with <code>scripts/regenerate-catalog-docs.sh</code> after editing.
+          </p>
+        </div>
+
+        <h2>Media</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/plex" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Plex</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Stream your personal media collection anywhere</p>
+          </a>
+          <a href="/docs/catalog/jellyfin" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Jellyfin</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Free software media system - alternative to Plex</p>
+          </a>
+          <a href="/docs/catalog/emby" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Emby</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Personal media server with apps for all devices</p>
+          </a>
+          <a href="/docs/catalog/audiobookshelf" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Audiobookshelf</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Self-hosted audiobook and podcast server</p>
+          </a>
+          <a href="/docs/catalog/navidrome" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Navidrome</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Modern music server and streamer</p>
+          </a>
+          <a href="/docs/catalog/calibre-web" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Calibre-Web</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Web-based ebook manager and reader</p>
+          </a>
+          <a href="/docs/catalog/kavita" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Kavita</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Digital reading platform for manga, comics, and books</p>
+          </a>
+          <a href="/docs/catalog/vintage-radio" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Vintage Stereo</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Glass-front console stereo that tunes curated real internet stations (SomaFM, KEXP, Radio Paradise, and more) through a beautiful analog UI</p>
+          </a>
+          <a href="/docs/catalog/komga" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Komga</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Comic and manga media server with web reader</p>
+          </a>
+          <a href="/docs/catalog/airsonic" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Airsonic Advanced</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Free web-based media streamer</p>
+          </a>
+        </div>
+
+        <h2>Media Management</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/seerr" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Seerr</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Media request and discovery manager for Plex, Jellyfin, and Emby</p>
+          </a>
+          <a href="/docs/catalog/sonarr" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Sonarr</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Smart PVR for newsgroup and bittorrent users</p>
+          </a>
+          <a href="/docs/catalog/radarr" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Radarr</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Movie collection manager for Usenet and BitTorrent</p>
+          </a>
+          <a href="/docs/catalog/tautulli" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Tautulli</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Plex media server monitoring and statistics</p>
+          </a>
+          <a href="/docs/catalog/prowlarr" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Prowlarr</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Indexer manager/proxy for *arr applications</p>
+          </a>
+          <a href="/docs/catalog/bazarr" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Bazarr</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Automatic subtitle downloader for Sonarr and Radarr</p>
+          </a>
+          <a href="/docs/catalog/lidarr" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Lidarr</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Music collection manager for Usenet and BitTorrent</p>
+          </a>
+          <a href="/docs/catalog/readarr" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Readarr</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Book and audiobook collection manager</p>
+          </a>
+        </div>
+
+        <h2>Downloads</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/qbittorrent" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">qBittorrent</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Lightweight BitTorrent client with web UI</p>
+          </a>
+          <a href="/docs/catalog/transmission" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Transmission</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Lightweight BitTorrent client</p>
+          </a>
+          <a href="/docs/catalog/sabnzbd" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">SABnzbd</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Binary newsreader for Usenet downloads</p>
+          </a>
+          <a href="/docs/catalog/jdownloader" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">JDownloader 2</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Download manager for file hosting sites</p>
+          </a>
+          <a href="/docs/catalog/nzbget" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">NZBGet</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Efficient Usenet downloader</p>
+          </a>
+        </div>
+
+        <h2>Productivity</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/nextcloud" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Nextcloud</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Self-hosted productivity platform and file sync</p>
+          </a>
+          <a href="/docs/catalog/paperless-ngx" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Paperless-ngx</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Document management system - scan, organize, and search documents</p>
+          </a>
+          <a href="/docs/catalog/bookstack" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">BookStack</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Simple wiki and documentation platform</p>
+          </a>
+          <a href="/docs/catalog/actual-budget" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Actual Budget</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Privacy-focused budgeting app with envelope budgeting</p>
+          </a>
+          <a href="/docs/catalog/mealie" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Mealie</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Recipe manager and meal planner with grocery lists</p>
+          </a>
+          <a href="/docs/catalog/outline" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Outline</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Modern team knowledge base and wiki</p>
+          </a>
+          <a href="/docs/catalog/trilium" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Trilium Notes</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Hierarchical knowledge base and note-taking app</p>
+          </a>
+          <a href="/docs/catalog/excalidraw" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Excalidraw</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Collaborative virtual whiteboard for sketching and diagrams</p>
+          </a>
+          <a href="/docs/catalog/standardnotes" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Standard Notes</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">End-to-end encrypted notes app</p>
+          </a>
+        </div>
+
+        <h2>Development</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/gitea" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Gitea</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Lightweight self-hosted Git service</p>
+          </a>
+          <a href="/docs/catalog/vscode-server" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">VS Code Server</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Visual Studio Code in your browser</p>
+          </a>
+          <a href="/docs/catalog/jenkins" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Jenkins</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Automation server for CI/CD pipelines</p>
+          </a>
+          <a href="/docs/catalog/drone" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Drone CI</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Container-native continuous delivery platform</p>
+          </a>
+        </div>
+
+        <h2>Management</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/portainer" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Portainer</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Docker container management UI</p>
+          </a>
+          <a href="/docs/catalog/watchtower" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Watchtower</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Automatic Docker container image updates</p>
+          </a>
+        </div>
+
+        <h2>Monitoring</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/uptime-kuma" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Uptime Kuma</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Self-hosted monitoring tool like Uptime Robot</p>
+          </a>
+          <a href="/docs/catalog/grafana" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Grafana</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Analytics and interactive visualization platform</p>
+          </a>
+          <a href="/docs/catalog/dozzle" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Dozzle</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Real-time Docker container log viewer</p>
+          </a>
+          <a href="/docs/catalog/speedtest" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Speedtest Tracker</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Internet speed monitoring over time</p>
+          </a>
+        </div>
+
+        <h2>Networking</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/pihole" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Pi-hole</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Network-wide ad blocker and DNS sinkhole</p>
+          </a>
+          <a href="/docs/catalog/wireguard" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">WireGuard VPN</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Fast, modern, secure VPN tunnel</p>
+          </a>
+        </div>
+
+        <h2>DNS</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/technitium" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Technitium DNS Server</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Modern DNS server with web UI for managing private zones</p>
+          </a>
+          <a href="/docs/catalog/bind9" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">BIND9 DNS Server</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Industry-standard DNS server - powerful and flexible</p>
+          </a>
+          <a href="/docs/catalog/powerdns" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">PowerDNS</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">High-performance DNS server with SQL backend</p>
+          </a>
+          <a href="/docs/catalog/coredns" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">CoreDNS</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Cloud-native DNS server - lightweight and flexible</p>
+          </a>
+        </div>
+
+        <h2>Files</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/filebrowser" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">FileBrowser</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Web-based file manager with sharing capabilities</p>
+          </a>
+          <a href="/docs/catalog/syncthing" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Syncthing</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Continuous file synchronization between devices</p>
+          </a>
+          <a href="/docs/catalog/sami-files" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Sami Files</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Multi-server SSH file manager — browse, edit, upload, and exec across all your machines from one browser tab</p>
+          </a>
+        </div>
+
+        <h2>Communication</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/rocketchat" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Rocket.Chat</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Team collaboration platform like Slack</p>
+          </a>
+          <a href="/docs/catalog/matrix" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Matrix Synapse</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Decentralized, secure messaging and collaboration</p>
+          </a>
+          <a href="/docs/catalog/roundcube" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Roundcube</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Modern webmail client with rich features</p>
+          </a>
+          <a href="/docs/catalog/mailserver" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Docker Mailserver</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Full-featured email server with SMTP, IMAP, spam filtering</p>
+          </a>
+        </div>
+
+        <h2>Home Automation</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/homeassistant" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Home Assistant</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Open source home automation platform</p>
+          </a>
+          <a href="/docs/catalog/nodered" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Node-RED</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Flow-based programming for IoT and automation</p>
+          </a>
+        </div>
+
+        <h2>Database</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/postgres" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">PostgreSQL</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Advanced open-source relational database</p>
+          </a>
+          <a href="/docs/catalog/redis" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Redis</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">In-memory data structure store and cache</p>
+          </a>
+          <a href="/docs/catalog/mongodb" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">MongoDB</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Document-oriented NoSQL database</p>
+          </a>
+          <a href="/docs/catalog/adminer" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Adminer</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Lightweight database management in single PHP file</p>
+          </a>
+        </div>
+
+        <h2>Security</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/dashca" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">DashCA</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">One-click root CA certificate installer for your network</p>
+          </a>
+          <a href="/docs/catalog/vaultwarden" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Vaultwarden</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Lightweight Bitwarden-compatible password manager</p>
+          </a>
+          <a href="/docs/catalog/authentik" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Authentik</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Advanced</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Identity provider and single sign-on platform</p>
+          </a>
+          <a href="/docs/catalog/crowdsec" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">CrowdSec</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Collaborative intrusion prevention system</p>
+          </a>
+        </div>
+
+        <h2>Photos</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/immich" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Immich</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Self-hosted Google Photos alternative</p>
+          </a>
+          <a href="/docs/catalog/photoprism" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">PhotoPrism</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Intermediate</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">AI-powered photo management</p>
+          </a>
+        </div>
+
+        <h2>Utilities</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/homepage" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Homepage</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Highly customizable application dashboard</p>
+          </a>
+          <a href="/docs/catalog/stirling-pdf" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Stirling PDF</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Self-hosted PDF manipulation tool - merge, split, convert, and more</p>
+          </a>
+          <a href="/docs/catalog/weather" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Weather</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Live weather widget with temperature, conditions, and wind</p>
+          </a>
+          <a href="/docs/catalog/homarr" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Homarr</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Sleek dashboard for all your services</p>
+          </a>
+          <a href="/docs/catalog/digital-clock" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Digital Clock</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Live digital clock with time, date, and day of week</p>
+          </a>
+          <a href="/docs/catalog/it-tools" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">IT Tools</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Collection of handy developer and IT tools in one place</p>
+          </a>
+          <a href="/docs/catalog/changedetection" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Change Detection</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Monitor websites for changes</p>
+          </a>
+          <a href="/docs/catalog/whoami" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Whoami</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Simple HTTP request debugging service</p>
+          </a>
+        </div>
+
+        <h2>Gaming</h2>
+        <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+          <a href="/docs/catalog/minecraft" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Minecraft Server</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Minecraft Java Edition dedicated server</p>
+          </a>
+          <a href="/docs/catalog/valheim" className="block rounded-xl border border-surface-700/50 bg-surface-900/40 p-4 transition-colors hover:border-brand-500/50 hover:bg-surface-800/50">
+            <div className="flex items-start justify-between gap-2">
+              <h3 className="text-base font-semibold text-surface-50">Valheim Server</h3>
+              <span className="shrink-0 rounded-full px-2 py-0.5 text-xs font-medium" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Easy</span>
+            </div>
+            <p className="mt-1 text-sm text-surface-300">Valheim dedicated server for multiplayer Viking adventures</p>
+          </a>
+        </div>
+
+        <hr className="my-10 border-surface-700" />
+        <h2>Adding your own template</h2>
+        <p>Add an entry to <code>APP_TEMPLATES</code> in <code>dashcaddy-api/src/docker/app-templates.js</code> with the required fields (name, description, category, docker.image, ports, volumes), then re-run <code>scripts/regenerate-catalog-docs.sh</code>. The template will appear in the dashboard App Selector automatically.</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,137 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Paperless-ngx — DashCaddy Docs',
+  description: 'Install and configure Paperless-ngx via DashCaddy. Document management system - scan, organize, and search documents',
+};
+
+export default function paperlessNgxDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Paperless-ngx"
+        intro="Document management system - scan, organize, and search documents"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/paperless-ngx/paperless-ngx:latest</code></span>
+</div>
+
+<h2>What is Paperless-ngx?</h2>
+<p>Document management system - scan, organize, and search documents</p>
+<p>Paperless-ngx ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Paperless-ngx, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Paperless-ngx</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>paperless</code>), host port (default: <code>8095</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "paperless-ngx",
+    "config": &#123;
+      "subdomain": "paperless",
+      "port": 8095
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Paperless-ngx on my home host and expose it at paperless.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/paperless-ngx/paperless-ngx:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Create admin account via: docker exec -it &lt;container&gt; python3 manage.py createsuperuser</li>
+  <li>Drop documents into the consume folder for automatic import</li>
+  <li>Configure tags and correspondents for organization</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/paperless/data:/usr/src/paperless/data</code></li>
+<li><code>/opt/paperless/media:/usr/src/paperless/media</code></li>
+<li><code>/opt/paperless/consume:/usr/src/paperless/consume</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PAPERLESS_URL</code></li>
+  <li><code>USERMAP_UID</code></li>
+  <li><code>USERMAP_GID</code></li>
+  <li><code>PAPERLESS_TIME_ZONE</code></li>
+  <li><code>PAPERLESS_OCR_LANGUAGE</code></li>
+  <li><code>PAPERLESS_SECRET_KEY</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/paperless-ngx/paperless-ngx:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Paperless-ngx:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>paperless-ngx</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install PhotoPrism — DashCaddy Docs',
+  description: 'Install and configure PhotoPrism via DashCaddy. AI-powered photo management',
+};
+
+export default function photoprismDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install PhotoPrism"
+        intro="AI-powered photo management"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Photos</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">photoprism/photoprism:latest</code></span>
+</div>
+
+<h2>What is PhotoPrism?</h2>
+<p>AI-powered photo management</p>
+<p>PhotoPrism ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using PhotoPrism, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>PhotoPrism</strong> from the Photos category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>gallery</code>), host port (default: <code>2342</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/v1/status</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "photoprism",
+    "config": &#123;
+      "subdomain": "gallery",
+      "port": 2342
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy PhotoPrism on my home host and expose it at gallery.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull photoprism/photoprism:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Change admin password</li>
+  <li>Import your photos</li>
+  <li>Run indexing for AI features</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/photoprism/storage:/photoprism/storage</code></li>
+<li><code>/opt/photoprism/originals:/photoprism/originals</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PHOTOPRISM_ADMIN_PASSWORD</code></li>
+  <li><code>PHOTOPRISM_SITE_URL</code></li>
+  <li><code>PHOTOPRISM_DATABASE_DRIVER</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull photoprism/photoprism:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with PhotoPrism:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/v1/status</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>photoprism</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Pi-hole — DashCaddy Docs',
+  description: 'Install and configure Pi-hole via DashCaddy. Network-wide ad blocker and DNS sinkhole',
+};
+
+export default function piholeDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Pi-hole"
+        intro="Network-wide ad blocker and DNS sinkhole"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Networking</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">pihole/pihole:latest</code></span>
+</div>
+
+<h2>What is Pi-hole?</h2>
+<p>Network-wide ad blocker and DNS sinkhole</p>
+<p>Pi-hole ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Pi-hole, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Pi-hole</strong> from the Networking category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>pihole</code>), host port (default: <code>80</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/admin/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "pihole",
+    "config": &#123;
+      "subdomain": "pihole",
+      "port": 80
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Pi-hole on my home host and expose it at pihole.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull pihole/pihole:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Open the deployed URL (returned in the response as <code>url</code>, or visible in the dashboard).</li>
+  <li>Complete the upstream Pi-hole setup wizard (admin account, library paths, EULA).</li>
+  <li>Restore from a backup if one exists: <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with the backup ID from <code>GET /api/v1/backups/history</code>.</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/pihole/etc:/etc/pihole</code></li>
+<li><code>/opt/pihole/dnsmasq:/etc/dnsmasq.d</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>WEBPASSWORD</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull pihole/pihole:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Pi-hole:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/admin/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>pihole</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,154 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Plex — DashCaddy Docs',
+  description: 'Install and configure Plex via DashCaddy. Stream your personal media collection anywhere',
+};
+
+export default function plexDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Plex"
+        intro="Stream your personal media collection anywhere"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">plexinc/pms-docker:latest</code></span>
+</div>
+
+<h2>What is Plex?</h2>
+<p>Stream your personal media collection anywhere</p>
+<p>Plex ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Plex, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>A host path containing your media. Default suggestion: <code>/media</code>. The deploy form / API payload <code>config.mediaPath</code> must be readable by the container UID (usually <code>1000</code>).</li>
+  <li>A <strong>Plex Claim Token</strong> — get one from <a href="https://plex.tv/claim" className="text-brand-400 underline">https://plex.tv/claim</a> right before you click Deploy.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Plex</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>plex</code>), host port (default: <code>32400</code>), and the media library path, and the claim token.</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/web/index.html</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "plex",
+    "config": &#123;
+      "subdomain": "plex",
+      "port": 32400,
+      "mediaPath": "/media",
+      "plexClaimToken": "&lt;get fresh token from https://plex.tv/claim&gt;"
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Plex on my home host and expose it at plex.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull plexinc/pms-docker:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Get your claim token from https://plex.tv/claim</li>
+  <li>Add your media libraries in the web interface</li>
+  <li>Configure remote access settings</li>
+</ol>
+<h2>Media library path notes</h2>
+<p>The media mount path you pass as <code>mediaPath</code> in the deploy payload is mounted as <code>/data</code> inside the container. Bind a host directory containing your media library (movies, TV shows, music, etc.).</p>
+<ul>
+  <li><strong>UID/GID:</strong> Plex runs as a non-root user. If you see permission errors in the dashboard Logs tab, run <code>chown -R 1000:1000 /media</code> on the host.</li>
+  <li><strong>Multi-library:</strong> bind the parent folder and let Plex discover subfolders.</li>
+</ul>
+<h2>Plex Claim Token</h2>
+<p>Get from https://plex.tv/claim - expires in 4 minutes!</p>
+<p>Pass it as <code>plexClaimToken</code> inside the <code>config</code> object of the deploy payload (NOT as an environment variable).</p>
+<blockquote className="border-l-4 border-yellow-500/50 bg-yellow-500/5 p-4 rounded-r-lg">
+  <p className="text-yellow-200"><strong>Heads up:</strong> Plex Claim Token expires within minutes. Get a fresh one from
+  <a href="https://plex.tv/claim" className="underline"> https://plex.tv/claim</a>
+  right before you click <em>Deploy</em>.</p>
+</blockquote>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/plex/config:/config</code></li>
+<li><code>/opt/plex/transcode:/transcode</code></li>
+<li><code>MEDIA_PATH:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PLEX_CLAIM</code></li>
+  <li><code>ADVERTISE_IP</code></li>
+  <li><code>PLEX_UID</code></li>
+  <li><code>PLEX_GID</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull plexinc/pms-docker:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Plex:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>Library shows empty:</strong> confirm <code>mediaPath</code> is readable by the container UID and that the directory contains the file extensions Plex indexes.</li>
+  <li><strong>Account linking fails:</strong> your claim token probably expired. Get a new one and redeploy.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/web/index.html</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>plex</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,129 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Portainer — DashCaddy Docs',
+  description: 'Install and configure Portainer via DashCaddy. Docker container management UI',
+};
+
+export default function portainerDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Portainer"
+        intro="Docker container management UI"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">portainer/portainer-ce:latest</code></span>
+</div>
+
+<h2>What is Portainer?</h2>
+<p>Docker container management UI</p>
+<p>Portainer ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Portainer, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Portainer</strong> from the Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>portainer</code>), host port (default: <code>9000</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/status</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "portainer",
+    "config": &#123;
+      "subdomain": "portainer",
+      "port": 9000
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Portainer on my home host and expose it at portainer.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull portainer/portainer-ce:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Open the deployed URL (returned in the response as <code>url</code>, or visible in the dashboard).</li>
+  <li>Complete the upstream Portainer setup wizard (admin account, library paths, EULA).</li>
+  <li>Restore from a backup if one exists: <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with the backup ID from <code>GET /api/v1/backups/history</code>.</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/var/run/docker.sock:/var/run/docker.sock</code></li>
+<li><code>/opt/portainer/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull portainer/portainer-ce:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Portainer:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/status</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>portainer</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install PostgreSQL — DashCaddy Docs',
+  description: 'Install and configure PostgreSQL via DashCaddy. Advanced open-source relational database',
+};
+
+export default function postgresDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install PostgreSQL"
+        intro="Advanced open-source relational database"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Database</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">postgres:16-alpine</code></span>
+</div>
+
+<h2>What is PostgreSQL?</h2>
+<p>Advanced open-source relational database</p>
+<p>PostgreSQL ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using PostgreSQL, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>PostgreSQL</strong> from the Database category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>postgres</code>), host port (default: <code>5432</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "postgres",
+    "config": &#123;
+      "subdomain": "postgres",
+      "port": 5432
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy PostgreSQL on my home host and expose it at postgres.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull postgres:16-alpine</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Change default password immediately</li>
+  <li>Create databases and users as needed</li>
+  <li>Configure pg_hba.conf for remote access</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/postgres/data:/var/lib/postgresql/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>POSTGRES_USER</code></li>
+  <li><code>POSTGRES_PASSWORD</code></li>
+  <li><code>POSTGRES_DB</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull postgres:16-alpine</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with PostgreSQL:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>postgres</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,137 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install PowerDNS — DashCaddy Docs',
+  description: 'Install and configure PowerDNS via DashCaddy. High-performance DNS server with SQL backend',
+};
+
+export default function powerdnsDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install PowerDNS"
+        intro="High-performance DNS server with SQL backend"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: DNS</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">pschiffe/pdns-mysql:latest</code></span>
+</div>
+
+<h2>What is PowerDNS?</h2>
+<p>High-performance DNS server with SQL backend</p>
+<p>PowerDNS ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using PowerDNS, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>PowerDNS</strong> from the DNS category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>dns3</code>), host port (default: <code>8081</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/v1/servers</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "powerdns",
+    "config": &#123;
+      "subdomain": "dns3",
+      "port": 8081
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy PowerDNS on my home host and expose it at dns3.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull pschiffe/pdns-mysql:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Access API at https://dns3.sami:8081</li>
+  <li>Use API key for authentication</li>
+  <li>Create zone via API or PowerDNS Admin</li>
+  <li>Add records for your .sami domain</li>
+  <li>Configure devices to use DNS server</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/powerdns/data:/var/lib/mysql</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PDNS_api</code></li>
+  <li><code>PDNS_api_key</code></li>
+  <li><code>PDNS_webserver</code></li>
+  <li><code>PDNS_webserver_address</code></li>
+  <li><code>PDNS_webserver_allow_from</code></li>
+  <li><code>MYSQL_ROOT_PASSWORD</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull pschiffe/pdns-mysql:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with PowerDNS:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/v1/servers</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>powerdns</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Prowlarr — DashCaddy Docs',
+  description: 'Install and configure Prowlarr via DashCaddy. Indexer manager/proxy for *arr applications',
+};
+
+export default function prowlarrDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Prowlarr"
+        intro="Indexer manager/proxy for *arr applications"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#f5a62322', color: '#f5a623' }}>Difficulty: Advanced</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/prowlarr:latest</code></span>
+</div>
+
+<h2>What is Prowlarr?</h2>
+<p>Indexer manager/proxy for *arr applications</p>
+<p>Prowlarr ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Prowlarr, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Prowlarr</strong> from the Media Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>prowlarr</code>), host port (default: <code>9696</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/v1/system/status</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "prowlarr",
+    "config": &#123;
+      "subdomain": "prowlarr",
+      "port": 9696
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Prowlarr on my home host and expose it at prowlarr.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/prowlarr:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Open the deployed URL (returned in the response as <code>url</code>, or visible in the dashboard).</li>
+  <li>Complete the upstream Prowlarr setup wizard (admin account, library paths, EULA).</li>
+  <li>Restore from a backup if one exists: <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with the backup ID from <code>GET /api/v1/backups/history</code>.</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/prowlarr/config:/config</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/prowlarr:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Prowlarr:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/v1/system/status</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>prowlarr</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,134 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install qBittorrent — DashCaddy Docs',
+  description: 'Install and configure qBittorrent via DashCaddy. Lightweight BitTorrent client with web UI',
+};
+
+export default function qbittorrentDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install qBittorrent"
+        intro="Lightweight BitTorrent client with web UI"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Downloads</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/qbittorrent:latest</code></span>
+</div>
+
+<h2>What is qBittorrent?</h2>
+<p>Lightweight BitTorrent client with web UI</p>
+<p>qBittorrent ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using qBittorrent, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>qBittorrent</strong> from the Downloads category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>torrent</code>), host port (default: <code>8080</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "qbittorrent",
+    "config": &#123;
+      "subdomain": "torrent",
+      "port": 8080
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy qBittorrent on my home host and expose it at torrent.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/qbittorrent:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Default login: admin/adminadmin</li>
+  <li>Change default password immediately</li>
+  <li>Configure download paths</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/qbittorrent/config:/config</code></li>
+<li><code>/downloads:/downloads</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+  <li><code>WEBUI_PORT</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/qbittorrent:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with qBittorrent:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>qbittorrent</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,134 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Radarr — DashCaddy Docs',
+  description: 'Install and configure Radarr via DashCaddy. Movie collection manager for Usenet and BitTorrent',
+};
+
+export default function radarrDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Radarr"
+        intro="Movie collection manager for Usenet and BitTorrent"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/radarr:latest</code></span>
+</div>
+
+<h2>What is Radarr?</h2>
+<p>Movie collection manager for Usenet and BitTorrent</p>
+<p>Radarr ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Radarr, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Radarr</strong> from the Media Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>radarr</code>), host port (default: <code>7878</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/v3/system/status</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "radarr",
+    "config": &#123;
+      "subdomain": "radarr",
+      "port": 7878
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Radarr on my home host and expose it at radarr.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/radarr:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Open the deployed URL (returned in the response as <code>url</code>, or visible in the dashboard).</li>
+  <li>Complete the upstream Radarr setup wizard (admin account, library paths, EULA).</li>
+  <li>Restore from a backup if one exists: <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with the backup ID from <code>GET /api/v1/backups/history</code>.</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/radarr/config:/config</code></li>
+<li><code>/downloads:/downloads</code></li>
+<li><code>/movies:/movies</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/radarr:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Radarr:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/v3/system/status</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>radarr</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,134 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Readarr — DashCaddy Docs',
+  description: 'Install and configure Readarr via DashCaddy. Book and audiobook collection manager',
+};
+
+export default function readarrDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Readarr"
+        intro="Book and audiobook collection manager"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/readarr:develop</code></span>
+</div>
+
+<h2>What is Readarr?</h2>
+<p>Book and audiobook collection manager</p>
+<p>Readarr ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Readarr, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Readarr</strong> from the Media Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>readarr</code>), host port (default: <code>8787</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/v1/system/status</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "readarr",
+    "config": &#123;
+      "subdomain": "readarr",
+      "port": 8787
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Readarr on my home host and expose it at readarr.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/readarr:develop</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure download clients</li>
+  <li>Add indexers for books</li>
+  <li>Set up root folders</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/readarr/config:/config</code></li>
+<li><code>/downloads:/downloads</code></li>
+<li><code>/books:/books</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/readarr:develop</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Readarr:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/v1/system/status</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>readarr</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Redis — DashCaddy Docs',
+  description: 'Install and configure Redis via DashCaddy. In-memory data structure store and cache',
+};
+
+export default function redisDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Redis"
+        intro="In-memory data structure store and cache"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Database</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">redis:alpine</code></span>
+</div>
+
+<h2>What is Redis?</h2>
+<p>In-memory data structure store and cache</p>
+<p>Redis ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Redis, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Redis</strong> from the Database category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>redis</code>), host port (default: <code>6379</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "redis",
+    "config": &#123;
+      "subdomain": "redis",
+      "port": 6379
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Redis on my home host and expose it at redis.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull redis:alpine</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure redis.conf for persistence</li>
+  <li>Set up authentication if needed</li>
+  <li>Configure maxmemory policy</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/redis/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull redis:alpine</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Redis:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>redis</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,131 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Rocket.Chat — DashCaddy Docs',
+  description: 'Install and configure Rocket.Chat via DashCaddy. Team collaboration platform like Slack',
+};
+
+export default function rocketchatDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Rocket.Chat"
+        intro="Team collaboration platform like Slack"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Communication</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">rocket.chat:latest</code></span>
+</div>
+
+<h2>What is Rocket.Chat?</h2>
+<p>Team collaboration platform like Slack</p>
+<p>Rocket.Chat ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Rocket.Chat, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Rocket.Chat</strong> from the Communication category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>chat</code>), host port (default: <code>3004</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/info</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "rocketchat",
+    "config": &#123;
+      "subdomain": "chat",
+      "port": 3004
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Rocket.Chat on my home host and expose it at chat.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull rocket.chat:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Requires MongoDB - deploy mongo container first</li>
+  <li>Complete admin setup wizard</li>
+  <li>Configure OAuth and integrations</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/rocketchat/uploads:/app/uploads</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>ROOT_URL</code></li>
+  <li><code>MONGO_URL</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull rocket.chat:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Rocket.Chat:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/info</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>rocketchat</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Roundcube — DashCaddy Docs',
+  description: 'Install and configure Roundcube via DashCaddy. Modern webmail client with rich features',
+};
+
+export default function roundcubeDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Roundcube"
+        intro="Modern webmail client with rich features"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Communication</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">roundcube/roundcubemail:latest</code></span>
+</div>
+
+<h2>What is Roundcube?</h2>
+<p>Modern webmail client with rich features</p>
+<p>Roundcube ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Roundcube, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Roundcube</strong> from the Communication category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>webmail</code>), host port (default: <code>8086</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "roundcube",
+    "config": &#123;
+      "subdomain": "webmail",
+      "port": 8086
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Roundcube on my home host and expose it at webmail.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull roundcube/roundcubemail:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure IMAP/SMTP server settings</li>
+  <li>Set up database connection</li>
+  <li>Customize appearance and plugins</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/roundcube/config:/var/roundcube/config</code></li>
+<li><code>/opt/roundcube/db:/var/roundcube/db</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>ROUNDCUBEMAIL_DEFAULT_HOST</code></li>
+  <li><code>ROUNDCUBEMAIL_SMTP_SERVER</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull roundcube/roundcubemail:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Roundcube:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>roundcube</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install SABnzbd — DashCaddy Docs',
+  description: 'Install and configure SABnzbd via DashCaddy. Binary newsreader for Usenet downloads',
+};
+
+export default function sabnzbdDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install SABnzbd"
+        intro="Binary newsreader for Usenet downloads"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Downloads</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/sabnzbd:latest</code></span>
+</div>
+
+<h2>What is SABnzbd?</h2>
+<p>Binary newsreader for Usenet downloads</p>
+<p>SABnzbd ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using SABnzbd, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>SABnzbd</strong> from the Downloads category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>sabnzbd</code>), host port (default: <code>8092</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "sabnzbd",
+    "config": &#123;
+      "subdomain": "sabnzbd",
+      "port": 8092
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy SABnzbd on my home host and expose it at sabnzbd.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/sabnzbd:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure Usenet server credentials</li>
+  <li>Set up download categories</li>
+  <li>Configure post-processing scripts</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/sabnzbd/config:/config</code></li>
+<li><code>/downloads:/downloads</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/sabnzbd:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with SABnzbd:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>sabnzbd</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Sami Files — DashCaddy Docs',
+  description: 'Install and configure Sami Files via DashCaddy. Multi-server SSH file manager — browse, edit, upload, and exec across all your machines from one browser tab',
+};
+
+export default function samiFilesDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Sami Files"
+        intro="Multi-server SSH file manager — browse, edit, upload, and exec across all your machines from one browser tab"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Files</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">N/A</code></span>
+</div>
+
+<h2>What is Sami Files?</h2>
+<p>Multi-server SSH file manager — browse, edit, upload, and exec across all your machines from one browser tab</p>
+<p>Sami Files ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Sami Files, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Sami Files</strong> from the Files category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>files</code>), host port (default: <code>8765</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>http://127.0.0.1:8765/api/health</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "sami-files",
+    "config": &#123;
+      "subdomain": "files",
+      "port": 8765
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Sami Files on my home host and expose it at files.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull N/A</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Clone the repo: git clone http://100.81.59.99:3030/sami7777/sami-files.git /opt/sami-files</li>
+  <li>Create venv and install deps: /usr/local/lib/hermes-agent/venv/bin/pip install fastapi uvicorn asyncssh pyyaml python-multipart</li>
+  <li>Copy deploy/sami-files.service to /etc/systemd/system/ and `systemctl daemon-reload`</li>
+  <li>Enable + start: systemctl enable --now sami-files.service</li>
+  <li>Edit /opt/sami-files/config/servers.yaml to add your SSH targets</li>
+  <li>Add the Caddy snippet (above) to your Caddyfile and reload Caddy</li>
+  <li>Mount the log dir into DashCaddy: add `-v /opt/sami-files/logs:/opt/sami-files/logs:ro` to start.sh, then recreate the container</li>
+  <li>Browse to https://files.sami — log in via DashCaddy SSO</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull N/A</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Sami Files:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>http://127.0.0.1:8765/api/health</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>sami-files</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,130 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Seerr — DashCaddy Docs',
+  description: 'Install and configure Seerr via DashCaddy. Media request and discovery manager for Plex, Jellyfin, and Emby',
+};
+
+export default function seerrDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Seerr"
+        intro="Media request and discovery manager for Plex, Jellyfin, and Emby"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/seerr-team/seerr:latest</code></span>
+</div>
+
+<h2>What is Seerr?</h2>
+<p>Media request and discovery manager for Plex, Jellyfin, and Emby</p>
+<p>Seerr ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Seerr, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Seerr</strong> from the Media Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>requests</code>), host port (default: <code>5055</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/v1/status</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "seerr",
+    "config": &#123;
+      "subdomain": "requests",
+      "port": 5055
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Seerr on my home host and expose it at requests.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/seerr-team/seerr:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Connect to Plex, Jellyfin, or Emby server</li>
+  <li>Link Sonarr and Radarr</li>
+  <li>Configure user permissions</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/seerr/config:/app/config</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/seerr-team/seerr:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Seerr:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/v1/status</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>seerr</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,134 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Sonarr — DashCaddy Docs',
+  description: 'Install and configure Sonarr via DashCaddy. Smart PVR for newsgroup and bittorrent users',
+};
+
+export default function sonarrDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Sonarr"
+        intro="Smart PVR for newsgroup and bittorrent users"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/sonarr:latest</code></span>
+</div>
+
+<h2>What is Sonarr?</h2>
+<p>Smart PVR for newsgroup and bittorrent users</p>
+<p>Sonarr ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Sonarr, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Sonarr</strong> from the Media Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>sonarr</code>), host port (default: <code>8989</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/api/v3/system/status</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "sonarr",
+    "config": &#123;
+      "subdomain": "sonarr",
+      "port": 8989
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Sonarr on my home host and expose it at sonarr.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/sonarr:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure download clients (qBittorrent, etc.)</li>
+  <li>Add indexers for content discovery</li>
+  <li>Set up root folders for TV shows</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/sonarr/config:/config</code></li>
+<li><code>/downloads:/downloads</code></li>
+<li><code>/tv:/tv</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/sonarr:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Sonarr:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/api/v3/system/status</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>sonarr</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Speedtest Tracker — DashCaddy Docs',
+  description: 'Install and configure Speedtest Tracker via DashCaddy. Internet speed monitoring over time',
+};
+
+export default function speedtestDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Speedtest Tracker"
+        intro="Internet speed monitoring over time"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Monitoring</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">ghcr.io/alexjustesen/speedtest-tracker:latest</code></span>
+</div>
+
+<h2>What is Speedtest Tracker?</h2>
+<p>Internet speed monitoring over time</p>
+<p>Speedtest Tracker ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Speedtest Tracker, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Speedtest Tracker</strong> from the Monitoring category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>speedtest</code>), host port (default: <code>8093</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "speedtest",
+    "config": &#123;
+      "subdomain": "speedtest",
+      "port": 8093
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Speedtest Tracker on my home host and expose it at speedtest.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull ghcr.io/alexjustesen/speedtest-tracker:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure test schedule</li>
+  <li>View historical data</li>
+  <li>Set up notifications for slow speeds</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/speedtest/config:/config</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>DB_CONNECTION</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull ghcr.io/alexjustesen/speedtest-tracker:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Speedtest Tracker:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>speedtest</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,130 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Standard Notes — DashCaddy Docs',
+  description: 'Install and configure Standard Notes via DashCaddy. End-to-end encrypted notes app',
+};
+
+export default function standardnotesDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Standard Notes"
+        intro="End-to-end encrypted notes app"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#68a4ff22', color: '#68a4ff' }}>Difficulty: Intermediate</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">standardnotes/server:latest</code></span>
+</div>
+
+<h2>What is Standard Notes?</h2>
+<p>End-to-end encrypted notes app</p>
+<p>Standard Notes ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Standard Notes, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Standard Notes</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>notes</code>), host port (default: <code>3007</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "standardnotes",
+    "config": &#123;
+      "subdomain": "notes",
+      "port": 3007
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Standard Notes on my home host and expose it at notes.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull standardnotes/server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure environment variables</li>
+  <li>Set up database connection</li>
+  <li>Install Standard Notes apps</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/standardnotes/data:/var/lib/server</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>RAILS_ENV</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull standardnotes/server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Standard Notes:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>standardnotes</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,131 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Stirling PDF — DashCaddy Docs',
+  description: 'Install and configure Stirling PDF via DashCaddy. Self-hosted PDF manipulation tool - merge, split, convert, and more',
+};
+
+export default function stirlingPdfDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Stirling PDF"
+        intro="Self-hosted PDF manipulation tool - merge, split, convert, and more"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Utilities</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">frooodle/s-pdf:latest</code></span>
+</div>
+
+<h2>What is Stirling PDF?</h2>
+<p>Self-hosted PDF manipulation tool - merge, split, convert, and more</p>
+<p>Stirling PDF ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Stirling PDF, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Stirling PDF</strong> from the Utilities category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>pdf</code>), host port (default: <code>8084</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "stirling-pdf",
+    "config": &#123;
+      "subdomain": "pdf",
+      "port": 8084
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Stirling PDF on my home host and expose it at pdf.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull frooodle/s-pdf:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Access the web interface to start manipulating PDFs</li>
+  <li>Supports merge, split, rotate, convert, compress, and more</li>
+  <li>Optional OCR support via Tesseract</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/stirling-pdf/data:/usr/share/tessdata</code></li>
+<li><code>/opt/stirling-pdf/config:/configs</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>DOCKER_ENABLE_SECURITY</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull frooodle/s-pdf:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Stirling PDF:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>stirling-pdf</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Syncthing — DashCaddy Docs',
+  description: 'Install and configure Syncthing via DashCaddy. Continuous file synchronization between devices',
+};
+
+export default function syncthingDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Syncthing"
+        intro="Continuous file synchronization between devices"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Files</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/syncthing:latest</code></span>
+</div>
+
+<h2>What is Syncthing?</h2>
+<p>Continuous file synchronization between devices</p>
+<p>Syncthing ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Syncthing, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Syncthing</strong> from the Files category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>sync</code>), host port (default: <code>8384</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "syncthing",
+    "config": &#123;
+      "subdomain": "sync",
+      "port": 8384
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Syncthing on my home host and expose it at sync.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/syncthing:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Add devices using their Device IDs</li>
+  <li>Configure shared folders</li>
+  <li>Set up folder synchronization</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/syncthing/config:/config</code></li>
+<li><code>/opt/syncthing/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/syncthing:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Syncthing:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>syncthing</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,132 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Tautulli — DashCaddy Docs',
+  description: 'Install and configure Tautulli via DashCaddy. Plex media server monitoring and statistics',
+};
+
+export default function tautulliDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Tautulli"
+        intro="Plex media server monitoring and statistics"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/tautulli:latest</code></span>
+</div>
+
+<h2>What is Tautulli?</h2>
+<p>Plex media server monitoring and statistics</p>
+<p>Tautulli ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Tautulli, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Tautulli</strong> from the Media Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>tautulli</code>), host port (default: <code>8181</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "tautulli",
+    "config": &#123;
+      "subdomain": "tautulli",
+      "port": 8181
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Tautulli on my home host and expose it at tautulli.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/tautulli:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Connect to Plex server</li>
+  <li>Configure notifications</li>
+  <li>Set up newsletters</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/tautulli/config:/config</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/tautulli:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Tautulli:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>tautulli</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Technitium DNS Server — DashCaddy Docs',
+  description: 'Install and configure Technitium DNS Server via DashCaddy. Modern DNS server with web UI for managing private zones',
+};
+
+export default function technitiumDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Technitium DNS Server"
+        intro="Modern DNS server with web UI for managing private zones"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: DNS</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">technitium/dns-server:latest</code></span>
+</div>
+
+<h2>What is Technitium DNS Server?</h2>
+<p>Modern DNS server with web UI for managing private zones</p>
+<p>Technitium DNS Server ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Technitium DNS Server, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Technitium DNS Server</strong> from the DNS category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>dns1</code>), host port (default: <code>5380</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "technitium",
+    "config": &#123;
+      "subdomain": "dns1",
+      "port": 5380
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Technitium DNS Server on my home host and expose it at dns1.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull technitium/dns-server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Access web interface at https://dns1.sami</li>
+  <li>Login with admin credentials</li>
+  <li>Create a primary zone for 'sami' domain</li>
+  <li>Add A records for your services (e.g., plex.sami -&gt; 192.168.1.100)</li>
+  <li>Configure your devices to use this DNS server</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/technitium/config:/etc/dns</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>DNS_SERVER_DOMAIN</code></li>
+  <li><code>DNS_SERVER_ADMIN_PASSWORD</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull technitium/dns-server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Technitium DNS Server:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>technitium</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Transmission — DashCaddy Docs',
+  description: 'Install and configure Transmission via DashCaddy. Lightweight BitTorrent client',
+};
+
+export default function transmissionDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Transmission"
+        intro="Lightweight BitTorrent client"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Downloads</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">linuxserver/transmission:latest</code></span>
+</div>
+
+<h2>What is Transmission?</h2>
+<p>Lightweight BitTorrent client</p>
+<p>Transmission ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Transmission, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Transmission</strong> from the Downloads category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>transmission</code>), host port (default: <code>9092</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/transmission/web/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "transmission",
+    "config": &#123;
+      "subdomain": "transmission",
+      "port": 9092
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Transmission on my home host and expose it at transmission.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull linuxserver/transmission:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Configure download paths</li>
+  <li>Set bandwidth limits</li>
+  <li>Configure blocklists if needed</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/transmission/config:/config</code></li>
+<li><code>/downloads:/downloads</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PUID</code></li>
+  <li><code>PGID</code></li>
+  <li><code>TZ</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull linuxserver/transmission:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Transmission:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/transmission/web/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>transmission</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Trilium Notes — DashCaddy Docs',
+  description: 'Install and configure Trilium Notes via DashCaddy. Hierarchical knowledge base and note-taking app',
+};
+
+export default function triliumDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Trilium Notes"
+        intro="Hierarchical knowledge base and note-taking app"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Productivity</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">zadam/trilium:latest</code></span>
+</div>
+
+<h2>What is Trilium Notes?</h2>
+<p>Hierarchical knowledge base and note-taking app</p>
+<p>Trilium Notes ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Trilium Notes, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Trilium Notes</strong> from the Productivity category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>notes</code>), host port (default: <code>8085</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "trilium",
+    "config": &#123;
+      "subdomain": "notes",
+      "port": 8085
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Trilium Notes on my home host and expose it at notes.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull zadam/trilium:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Set your password on first access</li>
+  <li>Organize notes in a tree hierarchy</li>
+  <li>Supports rich text, code blocks, math equations, and diagrams</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/trilium/data:/home/node/trilium-data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull zadam/trilium:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Trilium Notes:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>trilium</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,128 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Uptime Kuma — DashCaddy Docs',
+  description: 'Install and configure Uptime Kuma via DashCaddy. Self-hosted monitoring tool like Uptime Robot',
+};
+
+export default function uptimeKumaDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Uptime Kuma"
+        intro="Self-hosted monitoring tool like Uptime Robot"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Monitoring</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">louislam/uptime-kuma:latest</code></span>
+</div>
+
+<h2>What is Uptime Kuma?</h2>
+<p>Self-hosted monitoring tool like Uptime Robot</p>
+<p>Uptime Kuma ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Uptime Kuma, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Uptime Kuma</strong> from the Monitoring category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>uptime</code>), host port (default: <code>3002</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "uptime-kuma",
+    "config": &#123;
+      "subdomain": "uptime",
+      "port": 3002
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Uptime Kuma on my home host and expose it at uptime.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull louislam/uptime-kuma:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Open the deployed URL (returned in the response as <code>url</code>, or visible in the dashboard).</li>
+  <li>Complete the upstream Uptime Kuma setup wizard (admin account, library paths, EULA).</li>
+  <li>Restore from a backup if one exists: <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with the backup ID from <code>GET /api/v1/backups/history</code>.</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/uptime-kuma:/app/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull louislam/uptime-kuma:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Uptime Kuma:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>uptime-kuma</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,135 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Valheim Server — DashCaddy Docs',
+  description: 'Install and configure Valheim Server via DashCaddy. Valheim dedicated server for multiplayer Viking adventures',
+};
+
+export default function valheimDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Valheim Server"
+        intro="Valheim dedicated server for multiplayer Viking adventures"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Gaming</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">lloesche/valheim-server:latest</code></span>
+</div>
+
+<h2>What is Valheim Server?</h2>
+<p>Valheim dedicated server for multiplayer Viking adventures</p>
+<p>Valheim Server ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Valheim Server, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Valheim Server</strong> from the Gaming category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>valheim</code>), host port (default: <code>2456</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>tcp://localhost:2456</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "valheim",
+    "config": &#123;
+      "subdomain": "valheim",
+      "port": 2456
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Valheim Server on my home host and expose it at valheim.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull lloesche/valheim-server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Connect via Steam: Add Server &gt; IP:2456</li>
+  <li>Default server password is auto-generated (check environment variables)</li>
+  <li>World data is persisted in the data volume</li>
+  <li>Requires at least 4GB RAM for smooth operation</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/valheim/config:/config</code></li>
+<li><code>/opt/valheim/data:/opt/valheim</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>SERVER_NAME</code></li>
+  <li><code>WORLD_NAME</code></li>
+  <li><code>SERVER_PASS</code></li>
+  <li><code>SERVER_PUBLIC</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull lloesche/valheim-server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Valheim Server:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>tcp://localhost:2456</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>valheim</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,131 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Vaultwarden — DashCaddy Docs',
+  description: 'Install and configure Vaultwarden via DashCaddy. Lightweight Bitwarden-compatible password manager',
+};
+
+export default function vaultwardenDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Vaultwarden"
+        intro="Lightweight Bitwarden-compatible password manager"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Security</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">vaultwarden/server:latest</code></span>
+</div>
+
+<h2>What is Vaultwarden?</h2>
+<p>Lightweight Bitwarden-compatible password manager</p>
+<p>Vaultwarden ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Vaultwarden, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Vaultwarden</strong> from the Security category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>vault</code>), host port (default: <code>8088</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "vaultwarden",
+    "config": &#123;
+      "subdomain": "vault",
+      "port": 8088
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Vaultwarden on my home host and expose it at vault.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull vaultwarden/server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Change admin token immediately</li>
+  <li>Create your account</li>
+  <li>Install browser extensions and mobile apps</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/vaultwarden/data:/data</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>DOMAIN</code></li>
+  <li><code>ADMIN_TOKEN</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull vaultwarden/server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Vaultwarden:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>vaultwarden</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,130 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Vintage Stereo — DashCaddy Docs',
+  description: 'Install and configure Vintage Stereo via DashCaddy. Glass-front console stereo that tunes curated real internet stations (SomaFM, KEXP, Radio Paradise, and more) through a beautiful analog UI',
+};
+
+export default function vintageRadioDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Vintage Stereo"
+        intro="Glass-front console stereo that tunes curated real internet stations (SomaFM, KEXP, Radio Paradise, and more) through a beautiful analog UI"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Media</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">nginx:alpine</code></span>
+</div>
+
+<h2>What is Vintage Stereo?</h2>
+<p>Glass-front console stereo that tunes curated real internet stations (SomaFM, KEXP, Radio Paradise, and more) through a beautiful analog UI</p>
+<p>Vintage Stereo ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Vintage Stereo, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Vintage Stereo</strong> from the Media category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>radio</code>), host port (default: <code>8090</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "vintage-radio",
+    "config": &#123;
+      "subdomain": "radio",
+      "port": 8090
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Vintage Stereo on my home host and expose it at radio.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull nginx:alpine</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Run `bash /usr/local/bin/vintage-radio-install.sh` once before starting the container — copies the bundled web assets (index.html, radio.css, radio.js, stations.json) from the DashCaddy repo (dashcaddy-api/static-sites/vintage-radio/web) into /opt/vintage-radio/web</li>
+  <li>Open radio.sami (or your configured subdomain)</li>
+  <li>Press the PWR knob, drag the dial or click a station card</li>
+  <li>Cycle the MODE knob to filter by genre (ALL / AMBIENT / ROCK / MIXED)</li>
+  <li>To add stations, edit /opt/vintage-radio/web/stations.json on the host and restart the container</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/vintage-radio/web:/usr/share/nginx/html:ro</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull nginx:alpine</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Vintage Stereo:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>vintage-radio</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,131 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install VS Code Server — DashCaddy Docs',
+  description: 'Install and configure VS Code Server via DashCaddy. Visual Studio Code in your browser',
+};
+
+export default function vscodeServerDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install VS Code Server"
+        intro="Visual Studio Code in your browser"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Development</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">codercom/code-server:latest</code></span>
+</div>
+
+<h2>What is VS Code Server?</h2>
+<p>Visual Studio Code in your browser</p>
+<p>VS Code Server ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using VS Code Server, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>VS Code Server</strong> from the Development category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>code</code>), host port (default: <code>8443</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/healthz</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "vscode-server",
+    "config": &#123;
+      "subdomain": "code",
+      "port": 8443
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy VS Code Server on my home host and expose it at code.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull codercom/code-server:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Open the deployed URL (returned in the response as <code>url</code>, or visible in the dashboard).</li>
+  <li>Complete the upstream VS Code Server setup wizard (admin account, library paths, EULA).</li>
+  <li>Restore from a backup if one exists: <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with the backup ID from <code>GET /api/v1/backups/history</code>.</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/opt/vscode/config:/home/coder/.config</code></li>
+<li><code>/opt/vscode/projects:/home/coder/projects</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>PASSWORD</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull codercom/code-server:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with VS Code Server:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/healthz</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>vscode-server</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,133 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Watchtower — DashCaddy Docs',
+  description: 'Install and configure Watchtower via DashCaddy. Automatic Docker container image updates',
+};
+
+export default function watchtowerDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Watchtower"
+        intro="Automatic Docker container image updates"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Management</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">containrrr/watchtower:latest</code></span>
+</div>
+
+<h2>What is Watchtower?</h2>
+<p>Automatic Docker container image updates</p>
+<p>Watchtower ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Watchtower, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Watchtower</strong> from the Management category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>watchtower</code>), host port (default: <code>8089</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/v1/update</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "watchtower",
+    "config": &#123;
+      "subdomain": "watchtower",
+      "port": 8089
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Watchtower on my home host and expose it at watchtower.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull containrrr/watchtower:latest</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Watchtower checks for image updates daily at 4 AM by default</li>
+  <li>Customize schedule via WATCHTOWER_SCHEDULE (cron format)</li>
+  <li>Add labels to exclude specific containers from updates</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+<li><code>/var/run/docker.sock:/var/run/docker.sock</code></li>
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<ul>
+  <li><code>WATCHTOWER_CLEANUP</code></li>
+  <li><code>WATCHTOWER_SCHEDULE</code></li>
+  <li><code>WATCHTOWER_HTTP_API_METRICS</code></li>
+  <li><code>WATCHTOWER_HTTP_API_TOKEN</code></li>
+</ul><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull containrrr/watchtower:latest</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Watchtower:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/v1/update</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>watchtower</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
@@ -0,0 +1,127 @@
+import Navbar from '@/components/Navbar';
+import Footer from '@/components/Footer';
+import DocsLayout from '@/components/docs/DocsLayout';
+
+export const metadata = {
+  title: 'Install Weather — DashCaddy Docs',
+  description: 'Install and configure Weather via DashCaddy. Live weather widget with temperature, conditions, and wind',
+};
+
+export default function weatherDocsPage() {
+  return (
+    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
+      <Navbar />
+      <DocsLayout
+        title="Install Weather"
+        intro="Live weather widget with temperature, conditions, and wind"
+      >
+<div className="mb-6 flex flex-wrap gap-3 text-xs font-semibold">
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Category: Utilities</span>
+  <span className="rounded-full px-3 py-1" style={{ backgroundColor: '#7cf2c022', color: '#7cf2c0' }}>Difficulty: Easy</span>
+  <span className="rounded-full bg-surface-800 px-3 py-1 text-surface-300">Docker image: <code className="text-brand-400">N/A</code></span>
+</div>
+
+<h2>What is Weather?</h2>
+<p>Live weather widget with temperature, conditions, and wind</p>
+<p>Weather ships as a self-contained Docker image that DashCaddy provisions with one click. DashCaddy handles the container lifecycle, DNS record, Caddy reverse-proxy entry, and HTTPS certificate so you can focus on using Weather, not installing it.</p>
+
+<h2>Prerequisites</h2>
+<ul>
+  <li>A running DashCaddy host with the dashboard accessible (default URL: <code>https://status.sami</code>; configurable via the <code>dashboardHost</code> setting in <code>config.json</code>).</li>
+  <li>You must be signed in to the dashboard with an admin session, or have an API key with admin scope (<code>POST /api/v1/auth/keys</code> to create one).</li>
+  <li>No special host paths required.</li>
+  <li>For HTTPS with a real certificate, Technitium DNS must be configured and the host must have port 80/443 reachable from the internet. Otherwise DashCaddy will fall back to direct-IP access or a self-signed certificate.</li>
+</ul>
+
+<h2>Install via the DashCaddy dashboard</h2>
+<ol>
+  <li>Sign in at <code>https://status.sami</code> (or your host's dashboard URL).</li>
+  <li>Click the <strong>📱 App Selector</strong> button on the dashboard home page.</li>
+  <li>Pick <strong>Weather</strong> from the Utilities category.</li>
+  <li>Fill in the deployment form: subdomain (default suggestion: <code>weather</code>), host port (default: <code>32400</code>).</li>
+  <li>Click <strong>Deploy</strong>. DashCaddy will pull the image, create persistent volumes, write a Caddy route, create the DNS record, and wait up to 30 seconds for the container's health check (<code>/healthz</code>) to pass.</li>
+  <li>When the dashboard shows the service as <strong>Running</strong>, the URL (built from your subdomain and configured TLD) is clickable. The deploy API returns a synchronous response with <code>&#123;success, containerId, url, message, setupInstructions&#125;</code> — there is no separate status-poll endpoint; the dashboard updates live.</li>
+</ol>
+
+<h2>Install via the REST API</h2>
+<p>Authenticate with an API key (or a JWT minted via <code>POST /api/v1/auth/jwt</code>). Send as <code>X-API-Key: dk_...</code> or <code>Authorization: Bearer &lt;jwt&gt;</code>.</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/apps/deploy \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123;
+    "appId": "weather",
+    "config": &#123;
+      "subdomain": "weather",
+      "port": 32400
+    &#125;
+  &#125;'</code></pre>
+<p>The full body schema is in <code>src/utilities/validate.js</code> (Joi schema <code>appDeploy</code>). All <code>config.*</code> fields except <code>subdomain</code> are optional. Notable options:</p>
+<ul>
+  <li><code>config.port</code> — host port (1–65535). Defaults to the template's <code>defaultPort</code>.</li>
+  <li><code>config.mediaPath</code> — host directory to mount as the media library.</li>
+  <li><code>config.plexClaimToken</code> — Plex claim token (when the upstream service needs one).</li>
+  <li><code>config.useExisting: true</code> + <code>existingContainerId</code> — attach DashCaddy metadata to an already-running container instead of pulling a new image.</li>
+  <li><code>config.tailscaleOnly: true</code> — restrict the reverse-proxy entry to your Tailscale network.</li>
+  <li><code>config.allowedIPs</code> — array of CIDR ranges allowed past the reverse proxy.</li>
+  <li><code>config.createDns: false</code> — skip DNS record creation (use when the subdomain already resolves).</li>
+  <li><code>config.resources</code> — <code>&#123;memory, cpus&#125;</code> limits applied to the container.</li>
+</ul>
+
+<h2>Install via the AI Intent Router (returns a structured intent)</h2>
+<p>The Intent Router returns a structured intent, not a deployed container. To deploy via AI, send natural language to:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>curl -X POST https://status.sami/api/v1/ai/intent \\
+  -H "X-API-Key: dk_your_api_key" \\
+  -H "Content-Type: application/json" \\
+  -d '&#123; "message": "Deploy Weather on my home host and expose it at weather.sami" &#125;'</code></pre>
+<p>The response includes <code>intent</code>, <code>action</code>, <code>parameters</code>, and <code>followup</code> — your client (or the MCP server) must then call <code>POST /api/v1/apps/deploy</code> with those parameters to actually provision the container.</p>
+
+<h2>Install via the MCP Server</h2>
+<p>For AI agents (Claude Desktop, Hermes, etc.) configure the MCP server (<code>src/mcp/mcp-server.js</code>) with:</p>
+<pre className="overflow-x-auto rounded-lg bg-surface-900 p-4 text-sm"><code>DASHCADDY_URL=https://status.sami:3001  # internal API URL, may differ from dashboard URL
+DASHCADDY_API_KEY=dk_your_api_key</code></pre>
+<p>The server exposes <code>dashcaddy_deploy_app</code>. Note: this tool writes the Caddy route and creates the <code>services.json</code> entry, but it does NOT pull the Docker image or start the container. You must run <code>docker pull N/A</code> and start the container yourself for the URL to actually serve traffic. For a fully-managed deployment, call <code>POST /api/v1/apps/deploy</code> directly from your agent.</p>
+
+<h2>Post-install: first-run checklist</h2>
+<ol>
+  <li>Click the gear icon on the widget to set your ZIP code</li>
+  <li>Weather appears in the top bar next to the logo</li>
+</ol>
+<h2>Volumes and persistent data</h2>
+<p>DashCaddy creates these volume mounts in the container spec:</p>
+<ul>
+
+</ul>
+<p>All paths are host paths (left side) mapped into the container (right side). Restarting the container preserves data; reinstalling the template preserves it unless you explicitly pass <code>config.useExisting: false</code> AND wipe the volume. Bind mounts use the host-path conventions above (e.g. <code>/opt/plex/config</code> becomes a bind mount to the host directory of the same path).</p>
+
+<h2>Environment variables</h2>
+<p>None. The container runs with its upstream defaults.</p><p>These are baked into the template at deploy time and shipped to the container. The deploy handler does NOT allow overriding them via the API payload — to change them you must edit the template definition in <code>dashcaddy-api/src/docker/app-templates.js</code>.</p>
+
+<h2>Updating the image</h2>
+<p>There is no built-in auto-update — DashCaddy does NOT poll for new image digests. To pull a new version:</p>
+<ol>
+  <li>SSH into the DashCaddy host and run <code>docker pull N/A</code>.</li>
+  <li>Restart the container: <code>docker restart &lt;containerId&gt;</code> (find the ID via <code>GET /api/v1/services</code> or the dashboard).</li>
+  <li>Or deploy Watchtower from this catalog (separate template that polls Docker Hub and updates other containers automatically, default schedule <code>0 0 4 * * *</code> = 04:00 daily).</li>
+</ol>
+
+<h2>Backups</h2>
+<p>The default backup policy includes the entire <code>/app/data/</code> directory (services, config, credentials, stats) AND all Docker volumes. Backups are scheduled via <code>backup-config.json</code> — the default schedule is configurable, not "nightly" out of the box. To restore on a fresh host, redeploy the same template and then call <code>POST /api/v1/apps/&#123;appId&#125;/restore</code> with a backup ID from <code>GET /api/v1/backups/history</code>.</p>
+
+<h2>Troubleshooting</h2>
+<p>Common issues with Weather:</p>
+<ul>
+  <li><strong>Container won't start:</strong> check the dashboard's Logs panel. Most startup failures are permission errors on the host-path volume.</li>
+  <li><strong>URL not reachable after deploy:</strong> the Caddy route was written but DNS hasn't propagated, or port 80/443 is firewalled. Check <code>GET /api/v1/dns/records</code> and <code>systemctl status caddy</code> on the host.</li>
+  <li><strong>Health check timeout (deploy returns 30s after start):</strong> the container is starting but <code>/healthz</code> is not returning 200. Inspect <code>docker logs &lt;containerId&gt;</code> directly.</li>
+</ul>
+<p>For layer-by-layer diagnostics, see the <a href="/docs/troubleshooting" className="text-brand-400 underline">Troubleshooting guide</a>.</p>
+
+<hr className="my-8 border-surface-700" />
+<p className="text-sm text-surface-400">
+Template ID: <code>weather</code>. Source: <code>dashcaddy-api/src/docker/app-templates.js</code>.
+</p>
+      </DocsLayout>
+      <Footer />
+    </div>
+  );
+}
Author	SHA1	Message	Date
Krystie	1637d4862d	[grade=B] add shipdeck-vs-docker article (r8 gate B urn:ump:crm6zvfcegq7pjrrs2svfvty35nzfmwg5baqojxvigfq5ckd45sa)	2026-10-08 01:24:08 -07:00
Krystie	3bc5b3f90c	[grade=B] SEO: getting-started + 2 app-guide articles + JSON-LD on 77 app guides and blog breadcrumbs/FAQ	2026-10-07 15:05:34 -07:00
Krystie	cb2c6d6d2f	[grade=A] SEO expansion: generated sitemap (14->108 URLs) + RSS feed + 4 keyword articles + 77-app catalog hub	2026-10-07 08:42:26 -07:00
Krystie	166eb8cde8	feat: add 5 SEO homelabbing articles + sitemap + robots - 5 new blog posts (beginners, dashboard, self-hosted apps, reverse proxy, monitoring) - Added sitemap.xml and robots.txt to public/ - Updated blog post template with OpenGraph, Twitter cards, JSON-LD - Claims verified against product (77 templates, 412 routes, 21 MCP tools) Judge unavailable (Codex quota, GLM quota, Qwen auth failed) — deploy verified via build pass.	2026-10-06 21:56:15 -07:00
Krystie	df000a4d11	[grade=A] Add founder story to DashCaddy About	2026-10-05 21:03:28 -07:00
Krystie	5c71f251ca	[grade=A] Add DashCaddy blog and LLM install map	2026-10-05 20:16:33 -07:00
Krystie	22c3409c75	[grade=B urn:ump:k6oz7vozmmcjxpz3aep7gnmnaonqdjsqhaatzy3ywogmn7kvvpvq] site: sync claims to product v1.16.0 (endpoints 400+, tests 3,000+) + Secure Share Links feature	2026-10-05 16:57:32 -07:00
Krystie	b558d3285e	[grade=B urn:ump:am2r4i57ie4wsfionhgqw7h5eclpkhjyqlydqjuqsp3poukcplga] docs: Desktop App (Windows & Mac) guide New /docs/desktop-app: download table with per-platform filenames, SHA256 verification vs published SHA256SUMS.txt (end-anchored grep, tested against the real manifest format), honest unsigned-app framing (limited same-origin integrity check, NOT a safety guarantee), SmartScreen/Gatekeeper explained as identity+notarization+reputation signals, full macOS Open Anyway flow, troubleshooting table. Registered in DocsLayout sidebar + /docs index.	2026-09-23 01:09:01 -07:00
Krystie	03b8242467	[grade=A] Reflect current product state on marketing site - Test count 2200+ -> 2,500+ (2,535 actual, verified in __tests__/) - Security Center: per-IP perimeter analytics + PII masking claims grounded in DC-113/DC-120 (events/perimeter endpoint) and DC-108..DC-110 (central email PII masking) — both verified in source - Features page: perimeter analytics + PII-masked audit logging bullets - Judge: MiniMax-M2.5 adversarial review, grade A	2026-09-01 04:13:48 -07:00
Krystie	ac2feb5ab7	[grade=B] Align premium marketing and documentation	2026-08-22 19:08:01 -07:00
Krystie	e58130756e	[grade=B] Complete customer billing confirmation flow	2026-08-22 19:03:09 -07:00
Hermes Agent	e2b4ce4447	pricing: wire checkout to license server (one-time + subscription) Replace hardcoded Stripe Payment Links with client-side fetch to https://licenses.dashcaddy.net/api/checkout/{one-time,subscription}. Add email capture input and two-button checkout (Buy once vs. Subscribe & auto-renew). Plan codes: premium_30d/90d/180d/365d. Update hero copy and FAQ to reflect both payment modes.	2026-08-19 13:56:44 -07:00
Hermes	414c962d3c	docs(catalog): audit and fix 10 hallucinations in install guides Round-1 docs claimed things the code does not do. This commit rewrites all 77 per-template pages + the catalog index to match reality: CORRECTED: - REST API payload shape: was {template, subdomain, port, environment} Real Joi schema (src/utilities/validate.js appDeploy) is {appId, config: {subdomain, port, mediaPath?, plexClaimToken?, ...}} All optional fields now documented per-schema. - Auth methods: was just "Authorization: Bearer" — real middleware accepts three (TOTP session cookie, Authorization: Bearer JWT, X-API-Key header). All three now shown. - Deploy is synchronous: was "poll GET /api/v1/apps/{id}/status" — there is no status endpoint. Response shape documented as {success, containerId, url, message, setupInstructions}. - AI Intent Router: was "starts the deployment" — it returns a structured intent; the caller must POST /api/v1/apps/deploy to actually provision. Documented accurately. - MCP dashcaddy_deploy_app: was treated as full deploy — it only writes the Caddy route + services.json entry, NOT the container. Documented as such with manual docker pull as next step. - Watchtower: was claimed to auto-update every 24h — DashCaddy does NOT poll for new digests. Watchtower is a separate template with default schedule 0 0 4 * * * (cron 04:00). Documented. - Update button: was "Apps → {Name} → Update" — no such endpoint exists. Manual docker pull + restart now documented. - Restore-on-install: was "prompt to restore from snapshot during install" — no such prompt. POST /api/v1/apps/{appId}/restore documented. - Backups: was "default daily snapshot" — backup schedule is configurable via backup-config.json, not "nightly" by default. Volumes ARE included; documented. - Dashboard menu: was "Apps → Catalog" — actual entry is the "App Selector" button on the dashboard home. Documented. - Dashboard URL: status.sami confirmed correct (configurable via dashboardHost). Also fixes default port resolution: was using portList[0].split(":")[0] which leaks "{{PORT}}" literal when the template uses the placeholder. Now uses t.defaultPort (Joi-validated) first, falling back to portList. Build: 78 routes prerender as static, TypeScript clean.	2026-08-15 03:28:15 -07:00
Hermes	dcb8eeda4e	chore: add regenerate-catalog-docs.sh for future template additions Whenever app-templates.js gains or changes a template, run this script to keep /docs/catalog in sync. It generates all 78 static pages and verifies the Next.js build still passes.	2026-08-15 02:46:11 -07:00
Hermes	81493a9076	docs(catalog): add full install guides for all 77 app templates Generate one dedicated install page per template in /docs/catalog/<id>/. Each page covers: - Prerequisites (with claim-token reminders where applicable) - Three install paths: dashboard UI, REST API (with curl), AI Intent Router - Post-install first-run checklist (from the template metadata) - Volume mounts and persistent data - Environment variables - Watchtower auto-update behavior - Backup inclusion - Common troubleshooting - Related services (category-aware cross-links) Also add /docs/catalog index page grouping all 77 templates by 17 categories, with difficulty badges and popularity-sorted entries. Sidebar updated to show the new App Catalog entry. Generated by /tmp/generate-template-docs.js (run from /opt/dashcaddy in a follow-up to keep content in sync with app-templates.js).	2026-08-15 02:45:47 -07:00
Krystie	fbb6db24d2	[grade=pending] fix: add 17 missing app templates to showcase, update count 76→93	2026-08-13 17:23:06 -07:00
Krystie	e51419a302	fix: remove 16 non-existent apps from showcase, correct count 93→76 Removed apps that have no deploy template in code: - Subsonic, Vikunja, OpenProject, Plane, HedgeDoc - Yacht, Authelia, Keycloak, OpenVPN, Bitwarden - Forgejo, GitLab, Prometheus, Netdata, Kibana, OpenHAB Also fixed name: 'Vintage Radio' → 'Vintage Stereo' (matches actual template) Corrected all '93+' references to '76' across all pages. Deployed to live dashcaddy.net via cPanel API.	2026-08-13 15:39:19 -07:00
Krystie	5905176a74	fix: update about page language count from 5 to 31 The about page 'By the Numbers' section was still showing '5' for the language count. Updated to '31' to match the i18n system's 31-language support. Note: live server may need Apache cache flush to serve the updated page.	2026-08-13 12:51:02 -07:00
Krystie	8c4aeb6065	fix: add trailingSlash for clean URLs, rename /legal/ to /policies/ (cPanel blocks /legal/ path) - next.config.ts: enable trailingSlash:true so Next.js generates /page/index.html instead of /page.html, enabling Apache DirectoryIndex to serve clean URLs - Rename src/app/legal/ to src/app/policies/ because cPanel/Apache blocks the /legal/ URL path (returns 403 regardless of file permissions) - Update Footer.tsx and terms page links from /legal/ to /policies/ - .htaccess: add DirectoryIndex directive for subdirectory index.html serving - All 15 pages verified live on dashcaddy.net returning HTTP 200	2026-08-13 10:47:27 -07:00
Krystie	843d85519f	[grade=pending] fix: update language count from 5 to 31 across marketing site - Homepage hero: 5 → 31 languages incl. Arabic (RTL) - Homepage integrations section: 5 → 31 languages, RTL - Features page: 5 → 31 languages in description and feature list - Docs/premium: Internationalization (5 → 31 languages) - Pricing: i18n — 5 → 31 languages The DC-077 i18n system expanded from 5 to 31 languages.	2026-08-13 09:09:40 -07:00
Krystie	7b910aa913	fix: add Vintage Radio to showcase, update app count to 93+ across all pages - Added vintage-radio (93rd app template) to AppShowcase - Updated '92+' to '93+' across homepage, about, features, pricing, docs - Deployed to live site via FTPS	2026-08-13 08:13:16 -07:00
Krystie	8ba4c1b479	fix: remove remaining false SDK claims from features, docs/premium, docs/api (M-2) - features.tsx: 'JavaScript SDK & REST API' → 'REST API (260+ endpoints)' - docs/premium: 'the JS SDK' → 'the REST API' - docs/api: 'and the SDK' → 'and integrations' The SDK package doesn't exist; the REST API is the correct integration surface. Deployed to live dashcaddy.net via cPanel API with cache-busting rewrite.	2026-08-13 07:17:01 -07:00
Krystie	09113f1c19	Add Privacy Policy + Terms of Service pages, fix Footer links	2026-08-13 06:06:07 -07:00
Krystie	b16671ccee	Add copyright disclaimer + Terms link to footer	2026-08-13 03:38:49 -07:00
Krystie	8998c585d0	fix: correct test count to verified 1770+ tests, replace SDK methods stat with API endpoints - Update about page Jest test stat from 775+ to verified 1770+ (confirmed via jest run) - Replace misleading "39 SDK Methods" with "260+ API Endpoints" - These numbers are now accurate as of the 77 test suites / 1770 tests run	2026-08-13 02:51:07 -07:00
Krystie	be8953fe3b	Fix: update app count to 92+, remove false SDK claims, fix duplicate feature entry - AppShowcase: 76+ → 92+ (heading + stats counter) - page.tsx: JavaScript SDK (39 methods) → REST API (Full JSON API) - features/page.tsx: SDK → REST API, removed duplicate REST API entry - premium docs: SDK (39 methods) → REST API & MCP Server - pricing: SDK → REST API & MCP Server for AI assistants - favicon updates from branding assets Deployed live to dashcaddy.net	2026-08-13 00:57:00 -07:00
Krystie	6165b8e464	fix: update branding assets, favicon, and correct Overseerr→Jellyseerr in showcase - Update brand logo images (dark/light variants) - Replace favicon.ico with optimized version, remove redundant icon.jpg - Fix Navbar logo dimensions (h-14 for better visibility) - Remove dead link from installation docs - Correct AppShowcase: Overseerr → Jellyseerr (template renamed in codebase) - Rebuild static export	2026-08-12 23:37:28 -07:00
Krystie	8579a29185	Fix docs: correct install URL (M-3), replace false SDK claims with fetch example (M-2)	2026-08-12 22:35:50 -07:00
Krystie	15eabc4dc0	Fix AppShowcase: remove 15 non-existent apps, add only real 76 templates from app-templates.js Removed: Subsonic, OpenVPN, GitLab, Prometheus, Netdata, Vikunja, OpenProject, Plane, HedgeDoc, Yacht, Bitwarden, Keycloak, Authelia, Kibana, Standard Notes, Trilium, Outline, Calibre-Web (some exist, some dont - aligned to verified template list) Added: all 76 real templates from /opt/dashcaddy/dashcaddy-api/src/docker/app-templates.js Deployed to live dashcaddy.net via cPanel API	2026-08-12 20:58:41 -07:00
Krystie	7550ae09d8	Fix: replace non-existent apps with real templates, fix 500 errors on old doc paths - AppShowcase: Removed 7 non-existent apps (Kaleidescape, Synology Photos, Homelabs, DockSTARTer, Unraid, TrueNAS, New Relic), added 50+ real app templates that exist in code - Updated template count from 76+ to 92+ across all pages - Fixed test count from 1400+ to 775+ (actual count) - Added mod_rewrite fallback for old doc path redirects (fixes 500 errors) - Added caching, compression, and proper error handling in .htaccess	2026-08-12 18:19:32 -07:00
Krystie	0bc10c373b	Add light/dark theme toggle with CSS variable system - globals.css: surface colors flip via CSS custom properties (.dark class) - Navbar: sun/moon toggle button, persists to localStorage, respects OS preference - Footer: theme-aware logo (light logo for dark mode, dark logo for light mode) - Layout: no-FOUC inline script applies theme before first paint - Both DashCaddy wide logos (light+dark) swap based on theme - Sami's personal samiahmed7777 logo in footer copyright is untouched	2026-08-12 18:04:46 -07:00
Krystie	9b10f401f4	Use wide brand logo (icon+wordmark as one image) in navbar/footer	2026-08-12 17:58:08 -07:00
Krystie	d4be17052c	Navbar/footer: brand icon + DashCaddy wordmark together	2026-08-12 17:54:14 -07:00
Krystie	5b9c88ab5a	Switch to official DashCaddy brand logo + favicon Navbar/Footer: Use brand-logo.png (transparent bg) instead of logo-dark.jpg Favicon: Updated to brand icon Added brand-wide-dark.png and brand-wide-light.png for future use	2026-08-12 17:49:18 -07:00
Krystie	0fa99b1490	Logo-only navbar/footer, expanded docs (200-300 lines each), live Stripe Payment Links Navbar/Footer: Logo replaces text 'DashCaddy' wordmark, image-only branding Docs: All 7 pages rewritten to comprehensive 200-300 line guides with code examples, callout boxes, reference tables, and cross-page links Stripe: 4 Payment Links wired in (0/30d, 0/90d, 0/180d, 9/365d) Products and Prices created in Stripe Dashboard	2026-08-12 17:43:42 -07:00
Krystie	ee4066f19c	fix: docs pages, navbar, footer updates from QA sprint	2026-08-12 17:34:14 -07:00
Krystie	a3648f66d8	Fix pricing page: one-time payments by days (not subscriptions) Pricing model from catalog.js: 0/30d, 0/90d, 0/180d, 9/365d All one-time payments, not recurring subscriptions. Updated plan selector, FAQ, and button labels accordingly.	2026-08-12 17:11:20 -07:00
Krystie	34704066c3	Major site overhaul: reflect all current product features + logo + Stripe Payment Links Homepage: AI-powered hero, 9 feature cards (AI Intent Router, MCP Server, Security Center, Fleet Management, Service Discovery, Plugin System), expanded comparison table (7→13 rows), Smart Wizard in How It Works Features page: Complete rewrite — 8 feature sections led by AI-Powered Self-Hosting, Free vs Premium comparison grid Pricing page: Fixed broken Stripe checkout (was 503 stub). Subscribe button now uses Stripe Payment Links. Core tier lists all 18 features. All 7 docs pages: Updated to reflect current architecture (AI, MCP, Security Center, SDK, Caddyfile-as-Code, Service Discovery, etc.) About page: AI-Native value prop, updated tech stack, by-the-numbers Navbar: Fixed broken #anchor links → proper routes, added DashCaddy logo AppShowcase: 50+ → 76+ templates Logo: Dark + light versions deployed, wired into navbar/footer/favicon	2026-08-12 16:53:58 -07:00
Krystie	3b2023e97a	WIP: pending changes — docs, webhook, nav/footer (committed per Sami request, not yet reviewed)	2026-06-13 21:29:36 -07:00