dashcaddy.net/src/app/docs/premium/page.tsx

import Navbar from '@/components/Navbar';
import Footer from '@/components/Footer';
import DocsLayout from '@/components/docs/DocsLayout';

export default function DocsPremiumPage() {
  return (
    <div className="flex min-h-screen flex-col bg-surface-950 text-surface-50">
      <Navbar />
      <DocsLayout
        title="Premium Features"
        intro="DashCaddy keeps its Premium model intentionally narrow. The core platform — deployment, DNS, reverse proxy, HTTPS, monitoring, templates, service discovery, and the API — is fully useful without a license. Premium unlocks a focused set of advanced orchestration features."
      >
        <p>
          DashCaddy&apos;s philosophy is that the day-to-day platform should be free forever. Everything you need to run
          a single host — the dashboard, the full template catalog, Caddy + DNS + TLS automation, real-time monitoring,
          Prometheus metrics, multi-user accounts with 2FA and RBAC, the Security Center, the AI Intent Router, the MCP
          Server, the REST API, and backup/restore — works without a license. Premium adds four capabilities aimed at
          teams and multi-host operators who need single sign-on, multi-container stacks, cluster orchestration, or
          fleet-wide management.
        </p>
        <p>
          This guide explains exactly what each Premium feature does, how it differs from the free tier, how to set it
          up, and how pricing and licensing work. If you only ever run one host, you may never need Premium — and
          that&apos;s by design.
        </p>

        <h2>Free vs Premium at a glance</h2>
        <p>
          The comparison table below covers every major capability. &ldquo;Free&rdquo; means available on an unlicensed
          install; &ldquo;Premium&rdquo; means the feature requires an active license.
        </p>
        <table>
          <thead>
            <tr>
              <th>Capability</th>
              <th>Free</th>
              <th>Premium</th>
            </tr>
          </thead>
          <tbody>
            <tr><td>Dashboard &amp; web UI</td><td>✓</td><td>✓</td></tr>
            <tr><td>92+ application templates</td><td>✓</td><td>✓</td></tr>
            <tr><td>Caddy reverse proxy + auto HTTPS</td><td>✓</td><td>✓</td></tr>
            <tr><td>Caddyfile-as-Code builder</td><td>✓</td><td>✓</td></tr>
            <tr><td>Technitium DNS automation</td><td>✓</td><td>✓</td></tr>
            <tr><td>DashCA internal certificate authority</td><td>✓</td><td>✓</td></tr>
            <tr><td>Service Discovery</td><td>✓</td><td>✓</td></tr>
            <tr><td>Real-time monitoring + WebSocket updates</td><td>✓</td><td>✓</td></tr>
            <tr><td>Prometheus metrics endpoint</td><td>✓</td><td>✓</td></tr>
            <tr><td>Multi-user accounts (invites, email magic link)</td><td>✓</td><td>✓</td></tr>
            <tr><td>TOTP 2FA &amp; RBAC roles</td><td>✓</td><td>✓</td></tr>
            <tr><td>Encrypted credential storage</td><td>✓</td><td>✓</td></tr>
            <tr><td>Security Center &amp; audit logging</td><td>✓</td><td>✓</td></tr>
            <tr><td>AI Intent Router &amp; MCP Server</td><td>✓</td><td>✓</td></tr>
            <tr><td>REST API &amp; MCP Server</td><td>✓</td><td>✓</td></tr>
            <tr><td>Backup / restore &amp; Disaster Recovery</td><td>✓</td><td>✓</td></tr>
            <tr><td>Internationalization (5 languages)</td><td>✓</td><td>✓</td></tr>
            <tr><td>Plugin &amp; extension system</td><td>✓</td><td>✓</td></tr>
            <tr><td>Smart Defaults Wizard</td><td>✓</td><td>✓</td></tr>
            <tr><td><strong>Auto-Login SSO</strong></td><td>—</td><td>✓</td></tr>
            <tr><td><strong>Recipes (multi-container stacks)</strong></td><td>—</td><td>✓</td></tr>
            <tr><td><strong>Docker Swarm orchestration</strong></td><td>—</td><td>✓</td></tr>
            <tr><td><strong>Multi-Host Fleet Management</strong></td><td>—</td><td>✓</td></tr>
            <tr><td>Priority support</td><td>—</td><td>✓</td></tr>
          </tbody>
        </table>

        <h2>Premium feature deep dive</h2>

        <h3>Auto-Login SSO</h3>
        <p>
          <strong>Auto-Login SSO</strong> provides single sign-on across all services published through DashCaddy, so an
          authenticated DashCaddy user reaches their apps without logging in again to each one. Once you sign into the
          DashCaddy dashboard, SSO forwards a signed token to participating services that auto-authenticates the session.
          This creates a seamless internal portal experience — ideal for teams that want one front door to every tool.
        </p>
        <p>
          SSO integrates with services that accept a shared authentication header or token exchange. Supported targets
          include apps that read a configurable auth header (common in self-hosted dashboards, wikis, and admin panels)
          as well as services that expose a login callback URL. The exact wiring is per-service: in the publish dialog,
          enable <strong>SSO</strong> and provide the header name or callback endpoint the target expects. DashCaddy
          handles token signing, rotation, and revocation.
        </p>
        <p>
          SSO respects your existing RBAC roles. A user with read-only access in DashCaddy will be passed through to
          services as a read-only identity where the target supports role mapping. Revoking a user in DashCaddy
          immediately invalidates their SSO sessions across all linked services.
        </p>
        <blockquote className="border-l-4 border-brand-500/50 bg-brand-500/5 p-4 rounded-r-lg">
          <p className="text-surface-300">
            <strong className="text-brand-400">Note:</strong> SSO is a pass-through convenience layer, not a replacement
            for per-service authentication. Services that require their own login (e.g. a database admin tool) will still
            prompt unless they explicitly support header/token SSO.
          </p>
        </blockquote>

        <h3>Recipes — multi-container stacks</h3>
        <p>
          <strong>Recipes</strong> let you deploy multi-container application stacks as a single coordinated unit. A
          Recipe bundles several templates together with pre-wired networking, shared volumes, environment variable
          links, and startup ordering, so a complex stack comes up in one click instead of a dozen manual steps.
        </p>
        <p>
          Typical Recipe stacks include an application plus its dependencies: a web app + PostgreSQL + Redis, a media
          suite with its transcoder and metadata store, an analytics pipeline with a database and dashboard, or a
          development environment with a code server, language runtime, and database. Each Recipe declares its components,
          the network connections between them, and any secrets or config the stack needs at launch.
        </p>
        <p>
          You can also <strong>create your own Recipes</strong>. Define the component templates, wire the internal
          network (e.g. app → <code>db:5432</code>), set environment variable references, and save the Recipe to your
          catalog. Custom Recipes are versioned and shareable, so a team can standardize on the same stack definition
          across hosts.
        </p>
        <pre className="mt-4 overflow-x-auto rounded-lg border border-surface-700/50 bg-surface-950/80 p-4 text-sm"><code>{`# Deploy a Recipe via the API
curl -X POST -H "Authorization: Bearer ***" \\
  -H "Content-Type: application/json" \\
  -d '{"recipe":"analytics-stack","name":"analytics"}' \\
  https://dashcaddy-host/api/v1/recipes/deploy`}</code></pre>

        <h3>Docker Swarm — multi-node orchestration</h3>
        <p>
          <strong>Docker Swarm</strong> support extends DashCaddy&apos;s deployment model from a single host to a cluster.
          Run services across a Swarm cluster instead of one machine, with DashCaddy managing placement, replicas,
          rolling updates, routing, and TLS across every node. This is the right feature when a single host can no longer
          carry the load or when you need redundancy for critical services.
        </p>
        <p>
          Multi-node setup follows Docker&apos;s standard Swarm workflow: initialize the manager
          (<code>docker swarm init</code>), join workers (<code>docker swarm join --token ... &lt;manager-ip&gt;</code>),
          then enable Swarm mode in DashCaddy under <strong>Settings → Cluster</strong>. DashCaddy detects the cluster
          and switches from single-container operations to service-level operations — deploy, scale, update, and rollback
          all operate on Swarm services rather than individual containers.
        </p>
        <p>
          Routing and TLS are handled cluster-wide: Caddy&apos;s ingress mesh routes traffic to the correct node, and
          certificates are issued per published hostname regardless of which node the container lands on. DashCaddy&apos;s
          service discovery tracks placement changes as the scheduler rebalances containers.
        </p>

        <h3>Multi-Host Fleet Management</h3>
        <p>
          <strong>Multi-Host Fleet Management</strong> lets you manage DashCaddy deployments across multiple hosts from
          one control plane. Instead of opening a separate dashboard per server, you register every host in a single
          fleet view and deploy, monitor, and operate services across the entire fleet with unified visibility. This is
          designed for operators running DashCaddy on several physical boxes, VPSes, or edge locations.
        </p>
        <p>
          The fleet workflow has three parts. <strong>Register hosts</strong> by installing the DashCaddy agent on each
          machine and pairing it with your control plane — each host reports its resources, running services, and health.
          <strong> Health probes</strong> poll every host on an interval and surface failures (container down, disk full,
          cert expiring) in a unified alert feed. <strong>Deploy plans</strong> let you target a service or Recipe at a
          specific host or a group of hosts, so you can place the media stack on the box with GPU and the database on the
          box with SSD without switching dashboards.
        </p>
        <p>
          Fleet Management is distinct from Swarm: Swarm orchestrates containers across a single logical cluster, while
          Fleet Management orchestrates DashCaddy instances across independent hosts. You can use both together — a fleet
          of hosts, some of which are themselves Swarm clusters.
        </p>

        <h2>Pricing</h2>
        <p>
          Premium is sold as one-time payments for fixed license durations. There is a single Premium tier — no ladder
          of plans to navigate. Longer durations are discounted relative to the monthly rate.
        </p>
        <table>
          <thead>
            <tr>
              <th>Duration</th>
              <th>Price</th>
              <th>Effective monthly rate</th>
            </tr>
          </thead>
          <tbody>
            <tr><td>30 days</td><td><strong>$20</strong></td><td>~$20.00 / month</td></tr>
            <tr><td>90 days</td><td><strong>$50</strong></td><td>~$16.67 / month</td></tr>
            <tr><td>180 days</td><td><strong>$70</strong></td><td>~$11.67 / month</td></tr>
            <tr><td>365 days</td><td><strong>$99</strong></td><td>~$8.25 / month</td></tr>
          </tbody>
        </table>
        <p>
          The 365-day plan offers the best value at roughly $8.25/month equivalent — about 59% off the 30-day rate.
          All durations unlock the identical Premium feature set; only the length and per-month cost differ.
        </p>

        <h2>Plan terms</h2>
        <ul>
          <li><strong>One-time payments</strong> — no auto-renewing subscription; your license runs for the purchased duration and then expires.</li>
          <li><strong>One Premium tier</strong> — every duration unlocks the same features.</li>
          <li><strong>One active machine per license</strong> — a license is bound to a single host at a time.</li>
          <li><strong>7-day grace period</strong> after expiry — services keep running while you renew; Premium features are read-only during grace.</li>
          <li><strong>No perpetual licenses</strong> — Premium is term-based; the free tier is permanent.</li>
          <li><strong>No free trial</strong> — the free tier is comprehensive enough to evaluate the platform first.</li>
        </ul>

        <h2>License lifecycle</h2>
        <p>
          A license moves through a defined lifecycle from purchase to deactivation. Understanding this flow helps you
          renew on time, move between hosts, and recover from validation failures.
        </p>
        <ol>
          <li>
            <strong>Purchase</strong> — buy a duration from the dashboard
            (<strong>Settings → Licensing</strong>). You receive a license key tied to your account.
          </li>
          <li>
            <strong>Activate</strong> — on first launch with the key, DashCaddy contacts the licensing server and binds
            the license to that machine. Premium features unlock immediately.
          </li>
          <li>
            <strong>Periodic validation</strong> — DashCaddy re-validates the license against the licensing server on
            launch and at regular intervals thereafter. This keeps the license tied to one active machine and enables
            clean deactivation.
          </li>
          <li>
            <strong>Grace period (7 days)</strong> — if the license expires or the server is unreachable, DashCaddy
            enters a 7-day grace window. Your services keep running; Premium features become read-only. Renew or
            reactivate during this window to restore full functionality.
          </li>
          <li>
            <strong>Deactivate</strong> — to move a license to a new host, deactivate it on the old machine from
            <strong> Settings → Licensing</strong>. This releases the binding so the key can be activated on the new host.
          </li>
        </ol>
        <blockquote className="border-l-4 border-brand-500/50 bg-brand-500/5 p-4 rounded-r-lg">
          <p className="text-surface-300">
            <strong className="text-brand-400">Important:</strong> The one-active-machine limit is enforced by the
            licensing server. If you reinstall the OS or replace the host without deactivating first, contact support to
            release the stale binding.
          </p>
        </blockquote>

        <h2>How to subscribe</h2>
        <ol>
          <li>Open the dashboard and go to <strong>Settings → Licensing</strong>.</li>
          <li>Choose a plan duration (30 / 90 / 180 / 365 days) and complete checkout.</li>
          <li>Your license key is validated automatically — Premium features unlock immediately.</li>
          <li>Manage renewal, reactivation, and machine deactivation from the same panel.</li>
          <li>If you migrate hosts, deactivate on the old machine before activating on the new one.</li>
        </ol>

        <h2>Frequently asked questions</h2>
        <h3>Do I lose my services if my license expires?</h3>
        <p>
          No. Running services are never stopped by a license expiry. During the 7-day grace period everything keeps
          running; Premium features become read-only. After grace, Premium-only features are disabled but the free tier
          (including all your deployed services) continues to operate.
        </p>
        <h3>Can I use one license on multiple hosts?</h3>
        <p>
          No — each license is bound to one active machine at a time. To move a license, deactivate it on the current
          host and activate it on the new one. For managing multiple hosts simultaneously, use <strong>Fleet Management</strong>,
          which is itself a Premium feature requiring a license per host you want under centralized control.
        </p>
        <h3>Is there a free trial?</h3>
        <p>
          No. The free tier is permanent and feature-rich — you can evaluate the entire core platform without paying.
          Premium adds orchestration features that you likely already know you need (SSO, Recipes, Swarm, Fleet).
        </p>
        <h3>What happens to my Premium Recipes and Swarm services if I let the license lapse?</h3>
        <p>
          They keep running under the grace period and continue to run as ordinary services after that. You lose the
          ability to <em>modify</em> them through Premium tooling (e.g. redeploying a Recipe or scaling a Swarm service)
          until you renew, but the workloads themselves are not destroyed.
        </p>
        <h3>How is the license validated?</h3>
        <p>
          DashCaddy contacts an external licensing server on launch and periodically thereafter. The host must be able
          to reach the licensing server for validation to succeed. If the server is temporarily unreachable, the grace
          period covers the gap.
        </p>
        <p>
          Ready to upgrade? Head to <strong>Settings → Licensing</strong> in your dashboard, or learn more about the
          platform in the <a href="/docs/overview">Product Overview</a> and <a href="/docs/integrations">Integrations</a> guides.
        </p>
      </DocsLayout>
      <Footer />
    </div>
  );
}