feat: auto-restart policies, SSL monitoring, DNS propagation, dependency tracking, config drift detection

Service categories (described in README roadmap, never wired):
- Backend: POST /services now persists category/containerId/port/ip/tailscaleOnly
- Backend: POST /services/update accepts category for in-place changes
- Frontend: category <select> in add-service modal (local + external)
- Frontend: category <select> in edit-service modal with current value
- Frontend: All Categories dropdown in service filter bar (auto-populated
  from both API categories and any categories present on rendered cards)
- Frontend: colored category badge (icon + name) on service cards
- Frontend: filter auto-refreshes after buildGrid

Monitoring on main dashboard (replaces orphaned monitoring-dashboard.html):
- New monitoring-widgets.js embeds a 5-card System Overview panel above
  the filter bar: Services, Containers Up, Avg CPU, Avg Memory, Health
- Pulls /api/v1/monitoring/stats + /api/v1/health-checks/status
- Auto-refreshes on DC.POLL.STATS (5s), color-coded bars (warn >=65%, bad >=85%)

Build:
- Added monitoring-widgets.js to init.js bundle in build.js
- Rebuilt dist/ bundles (core.js, features.js, init.js)
- sw.js cache version bumped automatically
- CSP hash regenerated

dashcaddy-api/VERSION

@@ -1 +1 @@
-dev
+1.9.0

dashcaddy-api/app-templates.js

@@ -2459,74 +2459,6 @@ const APP_TEMPLATES = {
       "World data is persisted in the data volume",
       "Requires at least 4GB RAM for smooth operation"
     ]
-  },
-  // === FILE MANAGEMENT — HOST-SERVICE TEMPLATES ===
-  // Sami Files is a host-systemd service, NOT a Docker container. The
-  // template exists so users get the right metadata + category in the App
-  // Selector, but the actual deployment is via `deploy/sami-files.service`
-  // unit + a Caddy reverse_proxy (see README in /opt/sami-files/deploy/).
-  // Service health is checked by probing the FastAPI /api/health endpoint
-  // on 127.0.0.1:8765; Caddy proxies the public URL.
-  "sami-files": {
-    name: "Sami Files",
-    description: "Multi-server SSH file manager — browse, edit, upload, and exec across all your machines from one browser tab",
-    icon: "📂",
-    logo: "/assets/sami-files.png",
-    category: "Files",
-    popularity: 80,
-    difficulty: "Intermediate",
-    isSystemdService: true,
-    systemdUnit: "sami-files.service",
-    healthCheck: "http://127.0.0.1:8765/api/health",
-    healthCheckExpect: "ok",
-    defaultPort: 8765,
-    subdomain: "files",
-    proxyPass: "http://127.0.0.1:8765",
-    subpathSupport: 'none',
-    externalConfig: {
-      // Where the source code / config lives on the host. DashCaddy reads
-      // these paths when generating a fresh setup via "Deploy" in the App
-      // Selector — they are informational for the systemd variant.
-      installDir: "/opt/sami-files",
-      configFile: "/opt/sami-files/config/servers.yaml",
-      serviceFile: "/opt/sami-files/deploy/sami-files.service",
-      logFile: "/opt/sami-files/logs/backend.log",
-      pythonVenv: "/usr/local/lib/hermes-agent/venv",
-      repo: "git.sami/sami7777/sami-files",
-      dependencies: [
-        "python3 >= 3.11 with uvicorn + asyncssh + pyyaml + fastapi",
-        "systemd >= 245 (for StandardOutput=append: journal syntax)"
-      ],
-      caddySnippet: [
-        "files.sami {",
-        "    reverse_proxy 127.0.0.1:8765",
-        "    import dashcaddy_auth",
-        "}"
-      ]
-    },
-    setupInstructions: [
-      "Clone the repo: git clone http://100.81.59.99:3030/sami7777/sami-files.git /opt/sami-files",
-      "Create venv and install deps: /usr/local/lib/hermes-agent/venv/bin/pip install fastapi uvicorn asyncssh pyyaml python-multipart",
-      "Copy deploy/sami-files.service to /etc/systemd/system/ and `systemctl daemon-reload`",
-      "Enable + start: systemctl enable --now sami-files.service",
-      "Edit /opt/sami-files/config/servers.yaml to add your SSH targets",
-      "Add the Caddy snippet (above) to your Caddyfile and reload Caddy",
-      "Browse to https://files.sami — log in via DashCaddy SSO"
-    ],
-    troubleshooting: [
-      {
-        symptom: "Service fails to start with 'No such file or directory'",
-        fix: "Verify the python venv path in the .service file matches your installation (use `which python3` and update ExecStart accordingly)."
-      },
-      {
-        symptom: "Backend logs show 'Permission denied' on key file",
-        fix: "Run `chmod 600 /root/.ssh/<key>` for each key_file listed in servers.yaml — backend refuses to load keys with looser permissions."
-      },
-      {
-        symptom: "Browser shows 'Cannot connect' but systemctl says running",
-        fix: "Check that uvicorn is binding 127.0.0.1:8765 (not 0.0.0.0). Use `ss -tlnp | grep 8765` to confirm."
-      }
-    ]
   }
 };
 

dashcaddy-api/auto-restart-manager.js

@@ -0,0 +1,503 @@
+/**
+ * Auto-Restart Manager - Per-container restart policies with retry tracking
+ *
+ * When a container goes down, attempts automatic restart up to N times
+ * (configurable per-service). Sends notifications on each attempt and
+ * when max retries are exceeded. Integrates with HealthChecker events.
+ *
+ * @module auto-restart-manager
+ */
+
+const EventEmitter = require('events');
+const path = require('path');
+const { readJsonFile, writeJsonFile } = require('./fs-helpers');
+
+/**
+ * Default policy values applied when a new policy is created.
+ * @readonly
+ */
+const DEFAULT_POLICY = {
+  enabled: true,
+  maxRetries: 3,
+  retryIntervalMs: 5000,
+  windowMinutes: 10,
+  currentRetries: 0,
+  lastRestartAt: null,
+  cooldownUntil: null,
+};
+
+/**
+ * Manages automatic container restart policies and execution.
+ *
+ * @extends EventEmitter
+ *
+ * @fires AutoRestartManager#auto-restart-attempt
+ * @fires AutoRestartManager#auto-restart-success
+ * @fires AutoRestartManager#auto-restart-failed
+ * @fires AutoRestartManager#auto-restart-max-reached
+ */
+class AutoRestartManager extends EventEmitter {
+  /**
+   * @param {Object} ctx - Shared application context
+   * @param {Object} ctx.docker - Docker client wrapper ({ client: Dockerode })
+   * @param {Object} ctx.healthChecker - HealthChecker singleton
+   * @param {Object} ctx.notification - NotificationManager instance
+   * @param {Object} ctx.log - Logger instance
+   * @param {Function} ctx.logError - Error logging function
+   * @param {string} ctx.SERVICES_FILE - Path to services.json (used to derive data dir)
+   */
+  constructor(ctx) {
+    super();
+    this.ctx = ctx;
+    this.log = ctx.log || console;
+    this.logError = ctx.logError || ((_ctx, err) => console.error(err));
+    this.docker = ctx.docker;
+    this.healthChecker = ctx.healthChecker;
+    this.notification = ctx.notification;
+
+    /** @type {Map<string, Object>} serviceId -> policy */
+    this.policies = new Map();
+
+    /** Path to the JSON file that persists policies */
+    this.policiesFile = path.join(path.dirname(ctx.SERVICES_FILE), 'auto-restart-policies.json');
+
+    /** Track previous health status per service for transition detection */
+    this._previousHealth = new Map();
+
+    /** Bound handlers so we can remove them on stop() */
+    this._onStatusCheck = this._handleStatusCheck.bind(this);
+    this._started = false;
+  }
+
+  // ─── Lifecycle ────────────────────────────────────────────────────────
+
+  /**
+   * Load persisted policies, then wire into HealthChecker events.
+   * @returns {Promise<void>}
+   */
+  async start() {
+    if (this._started) return;
+
+    // Load persisted policies from disk
+    try {
+      const data = await readJsonFile(this.policiesFile, {});
+      for (const [serviceId, policy] of Object.entries(data)) {
+        this.policies.set(serviceId, { ...DEFAULT_POLICY, ...policy });
+      }
+      this.log.info('auto-restart', 'Policies loaded', { count: this.policies.size });
+    } catch (err) {
+      this.log.error('auto-restart', 'Failed to load policies', { error: err.message });
+    }
+
+    // Listen to health checker status transitions
+    if (this.healthChecker) {
+      this.healthChecker.on('status-check', this._onStatusCheck);
+    }
+
+    this._started = true;
+    this.log.info('auto-restart', 'Manager started');
+  }
+
+  /**
+   * Remove event listeners and stop processing health events.
+   */
+  stop() {
+    if (!this._started) return;
+
+    if (this.healthChecker) {
+      this.healthChecker.removeListener('status-check', this._onStatusCheck);
+    }
+
+    this._started = false;
+    this.log.info('auto-restart', 'Manager stopped');
+  }
+
+  // ─── Policy CRUD ─────────────────────────────────────────────────────
+
+  /**
+   * Create or update a restart policy for a service.
+   *
+   * @param {string} serviceId - Unique service identifier
+   * @param {Object}  policy - Partial policy fields to merge
+   * @param {boolean} [policy.enabled=true]
+   * @param {number}  [policy.maxRetries=3]
+   * @param {number}  [policy.retryIntervalMs=5000]
+   * @param {number}  [policy.windowMinutes=10]
+   * @returns {Promise<Object>} The resulting policy
+   * @throws {Error} If serviceId is invalid
+   */
+  async setPolicy(serviceId, policy) {
+    if (!serviceId || typeof serviceId !== 'string') {
+      throw new Error('serviceId is required');
+    }
+
+    const existing = this.policies.get(serviceId) || { ...DEFAULT_POLICY, serviceId };
+
+    const merged = {
+      ...existing,
+      ...policy,
+      serviceId,
+      // Never allow caller to override runtime counters directly
+      currentRetries: existing.currentRetries || 0,
+      lastRestartAt: existing.lastRestartAt,
+      cooldownUntil: existing.cooldownUntil,
+    };
+
+    this.policies.set(serviceId, merged);
+    await this._savePolicies();
+
+    this.log.info('auto-restart', 'Policy set', { serviceId, enabled: merged.enabled });
+    return { ...merged };
+  }
+
+  /**
+   * Retrieve the policy for a service.
+   *
+   * @param {string} serviceId
+   * @returns {Object|null} Policy object or null if none exists
+   */
+  getPolicy(serviceId) {
+    const policy = this.policies.get(serviceId);
+    return policy ? { ...policy } : null;
+  }
+
+  /**
+   * Return all policies as an array.
+   * @returns {Object[]}
+   */
+  listPolicies() {
+    return Array.from(this.policies.values()).map(p => ({ ...p }));
+  }
+
+  /**
+   * Remove a service's restart policy.
+   *
+   * @param {string} serviceId
+   * @returns {Promise<boolean>} true if a policy was removed
+   */
+  async removePolicy(serviceId) {
+    if (!this.policies.has(serviceId)) return false;
+
+    this.policies.delete(serviceId);
+    await this._savePolicies();
+
+    this.log.info('auto-restart', 'Policy removed', { serviceId });
+    return true;
+  }
+
+  // ─── Core Restart Logic ──────────────────────────────────────────────
+
+  /**
+   * Called when a container is detected as down.
+   *
+   * Checks policy, cooldown, and retry count, then either attempts a
+   * Docker restart or notifies that max retries were exceeded.
+   *
+   * @param {string} serviceId - Service identifier
+   * @param {string} containerId - Docker container ID to restart
+   * @returns {Promise<Object>} Result of the operation
+   */
+  async handleContainerDown(serviceId, containerId) {
+    const policy = this.policies.get(serviceId);
+    if (!policy) {
+      return { action: 'ignored', reason: 'no-policy' };
+    }
+
+    if (!policy.enabled) {
+      return { action: 'ignored', reason: 'disabled' };
+    }
+
+    // Check cooldown window
+    const now = Date.now();
+    if (policy.cooldownUntil && now < policy.cooldownUntil) {
+      this.log.info('auto-restart', 'Skipping — cooldown active', {
+        serviceId,
+        cooldownUntil: new Date(policy.cooldownUntil).toISOString(),
+      });
+      return { action: 'skipped', reason: 'cooldown' };
+    }
+
+    // Max retries exceeded — notify and enter cooldown
+    if (policy.currentRetries >= policy.maxRetries) {
+      const cooldownMs = policy.windowMinutes * 60 * 1000;
+      policy.cooldownUntil = now + cooldownMs;
+      policy.currentRetries = 0; // Reset so next window can try again
+      await this._savePolicies();
+
+      const eventData = {
+        serviceId,
+        containerId,
+        maxRetries: policy.maxRetries,
+        cooldownUntil: policy.cooldownUntil,
+        timestamp: new Date().toISOString(),
+      };
+
+      /**
+       * @event AutoRestartManager#auto-restart-max-reached
+       * @type {Object}
+       */
+      this.emit('auto-restart-max-reached', eventData);
+
+      // Send notification
+      try {
+        await this._notify('auto-restart', {
+          containerName: serviceId,
+          message: `⛔ Max auto-restart retries (${policy.maxRetries}) exceeded for "${serviceId}". Cooldown until ${new Date(policy.cooldownUntil).toISOString()}.`,
+          ...eventData,
+        });
+      } catch (notifErr) {
+        this.log.error('auto-restart', 'Notification failed', { error: notifErr.message });
+      }
+
+      return { action: 'max-reached', ...eventData };
+    }
+
+    // Wait for the configured retry interval before attempting
+    if (policy.retryIntervalMs > 0 && policy.lastRestartAt) {
+      const elapsed = now - new Date(policy.lastRestartAt).getTime();
+      if (elapsed < policy.retryIntervalMs) {
+        const waitMs = policy.retryIntervalMs - elapsed;
+        this.log.info('auto-restart', 'Waiting for retry interval', { serviceId, waitMs });
+        await new Promise(resolve => setTimeout(resolve, waitMs));
+      }
+    }
+
+    // Attempt restart
+    policy.currentRetries += 1;
+    const attemptNum = policy.currentRetries;
+    const maxRetries = policy.maxRetries;
+
+    /**
+     * @event AutoRestartManager#auto-restart-attempt
+     * @type {Object}
+     */
+    this.emit('auto-restart-attempt', {
+      serviceId,
+      containerId,
+      attempt: attemptNum,
+      maxRetries,
+      timestamp: new Date().toISOString(),
+    });
+
+    try {
+      if (!this.docker?.client) {
+        throw new Error('Docker client not available');
+      }
+
+      const container = this.docker.client.getContainer(containerId);
+      await container.start();
+
+      policy.lastRestartAt = new Date().toISOString();
+      await this._savePolicies();
+
+      const successData = {
+        serviceId,
+        containerId,
+        attempt: attemptNum,
+        maxRetries,
+        timestamp: new Date().toISOString(),
+      };
+
+      /**
+       * @event AutoRestartManager#auto-restart-success
+       * @type {Object}
+       */
+      this.emit('auto-restart-success', successData);
+
+      // Notify
+      try {
+        await this._notify('auto-restart', {
+          containerName: serviceId,
+          message: `🔄 Auto-restart attempt ${attemptNum}/${maxRetries} succeeded for "${serviceId}".`,
+          ...successData,
+        });
+      } catch (notifErr) {
+        this.log.error('auto-restart', 'Notification failed', { error: notifErr.message });
+      }
+
+      this.log.info('auto-restart', 'Container restarted', {
+        serviceId,
+        attempt: attemptNum,
+        maxRetries,
+      });
+
+      return { action: 'restarted', ...successData };
+    } catch (restartErr) {
+      policy.lastRestartAt = new Date().toISOString();
+      await this._savePolicies();
+
+      const failData = {
+        serviceId,
+        containerId,
+        attempt: attemptNum,
+        maxRetries,
+        error: restartErr.message,
+        timestamp: new Date().toISOString(),
+      };
+
+      /**
+       * @event AutoRestartManager#auto-restart-failed
+       * @type {Object}
+       */
+      this.emit('auto-restart-failed', failData);
+
+      // Notify
+      try {
+        await this._notify('auto-restart', {
+          containerName: serviceId,
+          message: `❌ Auto-restart attempt ${attemptNum}/${maxRetries} failed for "${serviceId}": ${restartErr.message}`,
+          ...failData,
+        });
+      } catch (notifErr) {
+        this.log.error('auto-restart', 'Notification failed', { error: notifErr.message });
+      }
+
+      this.log.error('auto-restart', 'Restart failed', {
+        serviceId,
+        attempt: attemptNum,
+        error: restartErr.message,
+      });
+
+      return { action: 'failed', ...failData };
+    }
+  }
+
+  /**
+   * Called when a container recovers to healthy state.
+   * Resets the retry counter for the associated service.
+   *
+   * @param {string} serviceId
+   * @returns {Promise<void>}
+   */
+  async handleContainerUp(serviceId) {
+    const policy = this.policies.get(serviceId);
+    if (!policy) return;
+
+    if (policy.currentRetries > 0) {
+      policy.currentRetries = 0;
+      policy.cooldownUntil = null;
+      await this._savePolicies();
+
+      this.log.info('auto-restart', 'Retries reset after recovery', { serviceId });
+    }
+  }
+
+  // ─── Health Event Bridge ─────────────────────────────────────────────
+
+  /**
+   * Internal handler for HealthChecker `status-check` events.
+   * Detects healthy→unhealthy and unhealthy→healthy transitions for tracked services.
+   *
+   * @param {Object} status - HealthChecker status object
+   * @param {string} status.serviceId
+   * @param {string} status.status - "up" or "down"
+   * @private
+   */
+  async _handleStatusCheck(status) {
+    const { serviceId, status: currentStatus } = status;
+    if (!serviceId) return;
+
+    // Only process services that have a restart policy
+    if (!this.policies.has(serviceId)) return;
+
+    const previousStatus = this._previousHealth.get(serviceId);
+    this._previousHealth.set(serviceId, currentStatus);
+
+    // Transition: healthy → unhealthy
+    if (previousStatus === 'up' && currentStatus === 'down') {
+      // Find the containerId from the health checker config or status details
+      const containerId = this._resolveContainerId(serviceId, status);
+      if (containerId) {
+        try {
+          await this.handleContainerDown(serviceId, containerId);
+        } catch (err) {
+          this.logError('auto-restart-health-bridge', err);
+        }
+      }
+    }
+
+    // Transition: unhealthy → healthy (recovery)
+    if (previousStatus === 'down' && currentStatus === 'up') {
+      try {
+        await this.handleContainerUp(serviceId);
+      } catch (err) {
+        this.logError('auto-restart-health-bridge', err);
+      }
+    }
+  }
+
+  /**
+   * Attempt to find the containerId for a service from various sources.
+   *
+   * @param {string} serviceId
+   * @param {Object} status - The status-check event data
+   * @returns {string|null}
+   * @private
+   */
+  _resolveContainerId(serviceId, status) {
+    // Check if it's in the status details (some health checks embed it)
+    if (status.details?.containerId) return status.details.containerId;
+
+    // Look in the health checker config
+    const hcService = this.healthChecker?.config?.services?.[serviceId];
+    if (hcService?.containerId) return hcService.containerId;
+
+    // Try to look it up from the services state manager
+    try {
+      const servicesStateManager = this.ctx.servicesStateManager;
+      if (servicesStateManager) {
+        const readResult = servicesStateManager.read();
+        if (readResult && typeof readResult.then === 'function') {
+          // It returns a promise — fire-and-forget lookup
+          readResult.then(list => {
+            const found = (list || []).find(s => s.id === serviceId);
+            return found?.containerId || null;
+          }).catch(() => null);
+        } else {
+          const found = (readResult || []).find(s => s.id === serviceId);
+          if (found?.containerId) return found.containerId;
+        }
+      }
+    } catch (_) { /* best effort */ }
+
+    return null;
+  }
+
+  // ─── Persistence ─────────────────────────────────────────────────────
+
+  /**
+   * Persist current policies to disk.
+   * @returns {Promise<void>}
+   * @private
+   */
+  async _savePolicies() {
+    try {
+      const obj = {};
+      for (const [serviceId, policy] of this.policies.entries()) {
+        obj[serviceId] = { ...policy };
+      }
+      await writeJsonFile(this.policiesFile, obj);
+    } catch (err) {
+      this.log.error('auto-restart', 'Failed to save policies', { error: err.message });
+    }
+  }
+
+  // ─── Helpers ─────────────────────────────────────────────────────────
+
+  /**
+   * Send a notification via the notification manager.
+   *
+   * @param {string} event - Event type (e.g. 'auto-restart')
+   * @param {Object} data - Notification payload
+   * @returns {Promise<Object>}
+   * @private
+   */
+  async _notify(event, data) {
+    if (this.notification?.send) {
+      return this.notification.send(event, data);
+    }
+    return { success: false, reason: 'no-notification-manager' };
+  }
+}
+
+module.exports = { AutoRestartManager, DEFAULT_POLICY };

dashcaddy-api/backup-manager.js

@@ -9,15 +9,6 @@ const { execSync } = require('child_process');
 const crypto = require('crypto');
 const EventEmitter = require('events');
 
-// Format bytes to human readable string
-function formatBytes(bytes) {
-  if (bytes === 0 || bytes === undefined || bytes === null) return '0 B';
-  const k = 1024;
-  const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
-  const i = Math.floor(Math.log(bytes) / Math.log(k));
-  return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
-}
-
 const BACKUP_CONFIG_FILE = process.env.BACKUP_CONFIG_FILE || path.join(__dirname, 'backup-config.json');
 const BACKUP_HISTORY_FILE = process.env.BACKUP_HISTORY_FILE || path.join(__dirname, 'backup-history.json');
 const DEFAULT_BACKUP_DIR = process.env.BACKUP_DIR || path.join(__dirname, 'backups');
@@ -29,6 +20,14 @@ class BackupManager extends EventEmitter {
     this.history = this.loadHistory();
     this.scheduledJobs = new Map();
     this.running = false;
+    this.notificationManager = null;
+  }
+
+  /**
+   * Set the notification manager for sending backup notifications
+   */
+  setNotificationManager(nm) {
+    this.notificationManager = nm;
   }
 
   /**
@@ -84,7 +83,7 @@ class BackupManager extends EventEmitter {
       case 'monthly':
         intervalMs = 30 * 24 * 60 * 60 * 1000;
         break;
-      default:
+      default: {
         // Custom interval in minutes
         const minutes = parseInt(backup.schedule, 10);
         if (!isNaN(minutes) && minutes > 0) {
@@ -93,6 +92,7 @@ class BackupManager extends EventEmitter {
           console.error(`[BackupManager] Invalid schedule for ${name}: ${backup.schedule}`);
           return;
         }
+      }
     }
 
     // Schedule the job
@@ -184,12 +184,15 @@ class BackupManager extends EventEmitter {
         await this.cleanupOldBackups(name, backup.retention);
       }
 
-      // Enforce storage limit (delete oldest until within maxStorageBytes)
-      if (backup.maxStorageBytes) {
-        await this.enforceStorageLimit(name, backup.maxStorageBytes);
+      this.emit('backup-complete', historyEntry);
+
+      // Send notification if manager is configured
+      if (this.notificationManager) {
+        this.notificationManager.sendBackupComplete(historyEntry).catch(err => {
+          console.error('[BackupManager] Failed to send backup-complete notification:', err.message);
+        });
       }
 
-      this.emit('backup-complete', historyEntry);
       console.log(`[BackupManager] Backup ${name} completed in ${duration}ms`);
 
       return historyEntry;
@@ -206,7 +209,14 @@ class BackupManager extends EventEmitter {
 
       this.addToHistory(historyEntry);
       this.emit('backup-failed', historyEntry);
-      
+
+      // Send notification if manager is configured
+      if (this.notificationManager) {
+        this.notificationManager.sendBackupFailed(historyEntry).catch(err => {
+          console.error('[BackupManager] Failed to send backup-failed notification:', err.message);
+        });
+      }
+
       throw error;
     }
   }
@@ -556,17 +566,42 @@ class BackupManager extends EventEmitter {
     switch (destination.type) {
       case 'local':
         return await this.saveToLocal(data, destination, backupId);
+      case 'dropbox':
+        return await this.saveToDropbox(data, destination, backupId);
+      case 'webdav':
+        return await this.saveToWebDAV(data, destination, backupId);
+      case 'sftp':
+        return await this.saveToSFTP(data, destination, backupId);
       default:
         throw new Error(`Unsupported destination type: ${destination.type}`);
     }
   }
 
+  /**
+   * Load encrypted backup blob from a destination location.
+   * Returns a Buffer that can be passed to decryptBackup/decompressBackup.
+   */
+  async loadFromDestination(location) {
+    switch (location.type) {
+      case 'local':
+        return fs.readFileSync(location.path);
+      case 'dropbox':
+        return await this.loadFromDropbox(location);
+      case 'webdav':
+        return await this.loadFromWebDAV(location);
+      case 'sftp':
+        return await this.loadFromSFTP(location);
+      default:
+        throw new Error(`Unsupported destination type: ${location.type}`);
+    }
+  }
+
   /**
    * Save to local filesystem
    */
   async saveToLocal(data, destination, backupId) {
     const backupDir = destination.path || DEFAULT_BACKUP_DIR;
-    
+
     // Ensure directory exists
     if (!fs.existsSync(backupDir)) {
       fs.mkdirSync(backupDir, { recursive: true });
@@ -574,9 +609,9 @@ class BackupManager extends EventEmitter {
 
     const filename = `${backupId}.backup`;
     const filepath = path.join(backupDir, filename);
-    
+
     fs.writeFileSync(filepath, data);
-    
+
     return {
       type: 'local',
       path: filepath,
@@ -584,6 +619,257 @@ class BackupManager extends EventEmitter {
     };
   }
 
+  // ==================== CLOUD DESTINATIONS ====================
+
+  /**
+   * Resolve credentials for a given provider via the credentialManager.
+   * Throws if required fields are missing.
+   */
+  async _getCloudCredentials(provider) {
+    const credentialManager = require('./credential-manager');
+    const creds = {};
+    if (provider === 'dropbox') {
+      creds.token = await credentialManager.retrieve('backup.dropbox.token');
+      if (!creds.token) throw new Error('Dropbox token not configured');
+    } else if (provider === 'webdav') {
+      creds.url = await credentialManager.retrieve('backup.webdav.url');
+      creds.username = await credentialManager.retrieve('backup.webdav.username');
+      creds.password = await credentialManager.retrieve('backup.webdav.password');
+      if (!creds.url || !creds.username || !creds.password) {
+        throw new Error('WebDAV credentials incomplete (need url, username, password)');
+      }
+    } else if (provider === 'sftp') {
+      creds.host = await credentialManager.retrieve('backup.sftp.host');
+      const portStr = await credentialManager.retrieve('backup.sftp.port');
+      creds.port = parseInt(portStr || '22', 10);
+      creds.username = await credentialManager.retrieve('backup.sftp.username');
+      creds.password = await credentialManager.retrieve('backup.sftp.password');
+      creds.privateKey = await credentialManager.retrieve('backup.sftp.privateKey');
+      if (!creds.host || !creds.username || (!creds.password && !creds.privateKey)) {
+        throw new Error('SFTP credentials incomplete (need host, username, and either password or privateKey)');
+      }
+    }
+    return creds;
+  }
+
+  // ----- Dropbox -----
+
+  async saveToDropbox(data, destination, backupId) {
+    const { Dropbox } = require('dropbox');
+    const creds = await this._getCloudCredentials('dropbox');
+    const dbx = new Dropbox({ accessToken: creds.token });
+
+    const folder = (destination.path || '/dashcaddy-backups').replace(/\/+$/, '');
+    const remotePath = `${folder}/${backupId}.backup`;
+
+    await dbx.filesUpload({
+      path: remotePath,
+      contents: data,
+      mode: { '.tag': 'overwrite' },
+      autorename: false,
+      mute: true
+    });
+
+    return {
+      type: 'dropbox',
+      path: remotePath,
+      size: data.length
+    };
+  }
+
+  async loadFromDropbox(location) {
+    const { Dropbox } = require('dropbox');
+    const creds = await this._getCloudCredentials('dropbox');
+    const dbx = new Dropbox({ accessToken: creds.token });
+    const result = await dbx.filesDownload({ path: location.path });
+    // Node SDK returns fileBinary on the result
+    const fileBinary = result.result.fileBinary || result.result.fileBlob;
+    if (Buffer.isBuffer(fileBinary)) return fileBinary;
+    return Buffer.from(fileBinary);
+  }
+
+  // ----- WebDAV -----
+
+  async saveToWebDAV(data, destination, backupId) {
+    const { createClient } = require('webdav');
+    const creds = await this._getCloudCredentials('webdav');
+    const client = createClient(creds.url, {
+      username: creds.username,
+      password: creds.password
+    });
+
+    const folder = (destination.path || '/dashcaddy-backups').replace(/\/+$/, '');
+
+    // Ensure folder exists
+    try {
+      const exists = await client.exists(folder);
+      if (!exists) await client.createDirectory(folder, { recursive: true });
+    } catch (_) {
+      // best-effort
+    }
+
+    const remotePath = `${folder}/${backupId}.backup`;
+    await client.putFileContents(remotePath, data, { overwrite: true });
+
+    return {
+      type: 'webdav',
+      path: remotePath,
+      size: data.length
+    };
+  }
+
+  async loadFromWebDAV(location) {
+    const { createClient } = require('webdav');
+    const creds = await this._getCloudCredentials('webdav');
+    const client = createClient(creds.url, {
+      username: creds.username,
+      password: creds.password
+    });
+    const data = await client.getFileContents(location.path);
+    return Buffer.isBuffer(data) ? data : Buffer.from(data);
+  }
+
+  // ----- SFTP -----
+
+  async saveToSFTP(data, destination, backupId) {
+    const SftpClient = require('ssh2-sftp-client');
+    const creds = await this._getCloudCredentials('sftp');
+    const client = new SftpClient();
+
+    try {
+      await client.connect({
+        host: creds.host,
+        port: creds.port,
+        username: creds.username,
+        password: creds.password || undefined,
+        privateKey: creds.privateKey || undefined
+      });
+
+      const folder = (destination.path || '/dashcaddy-backups').replace(/\/+$/, '');
+      // Ensure remote dir exists
+      try {
+        const exists = await client.exists(folder);
+        if (!exists) await client.mkdir(folder, true);
+      } catch (_) {
+        // best-effort
+      }
+
+      const remotePath = `${folder}/${backupId}.backup`;
+      await client.put(Buffer.from(data), remotePath);
+
+      return {
+        type: 'sftp',
+        path: remotePath,
+        size: data.length
+      };
+    } finally {
+      try { await client.end(); } catch (_) { /* ignore */ }
+    }
+  }
+
+  async loadFromSFTP(location) {
+    const SftpClient = require('ssh2-sftp-client');
+    const creds = await this._getCloudCredentials('sftp');
+    const client = new SftpClient();
+    try {
+      await client.connect({
+        host: creds.host,
+        port: creds.port,
+        username: creds.username,
+        password: creds.password || undefined,
+        privateKey: creds.privateKey || undefined
+      });
+      const buffer = await client.get(location.path);
+      return Buffer.isBuffer(buffer) ? buffer : Buffer.from(buffer);
+    } finally {
+      try { await client.end(); } catch (_) { /* ignore */ }
+    }
+  }
+
+  /**
+   * Test that a destination is reachable + writable + deletable.
+   * Performs a small write/read/delete probe.
+   */
+  async testDestination(destination) {
+    const probeId = `test-${Date.now()}`;
+    const probeData = Buffer.from(`dashcaddy-test-${probeId}`);
+    const start = Date.now();
+
+    try {
+      const location = await this.saveToDestination(probeData, destination, probeId);
+
+      // Read it back
+      let readBack = null;
+      try {
+        readBack = await this.loadFromDestination(location);
+      } catch (_) {
+        // Some providers (e.g. local) we already trust the file system; skip
+      }
+
+      // Delete the probe
+      try {
+        await this._deleteFromDestination(location);
+      } catch (_) { /* ignore */ }
+
+      const elapsed = Date.now() - start;
+      return {
+        success: true,
+        type: destination.type,
+        elapsedMs: elapsed,
+        verified: readBack ? readBack.equals(probeData) : null
+      };
+    } catch (error) {
+      return {
+        success: false,
+        type: destination.type,
+        error: error.message,
+        elapsedMs: Date.now() - start
+      };
+    }
+  }
+
+  /**
+   * Delete a backup from a destination location
+   */
+  async _deleteFromDestination(location) {
+    if (location.type === 'local') {
+      if (fs.existsSync(location.path)) fs.unlinkSync(location.path);
+      return;
+    }
+    if (location.type === 'dropbox') {
+      const { Dropbox } = require('dropbox');
+      const creds = await this._getCloudCredentials('dropbox');
+      const dbx = new Dropbox({ accessToken: creds.token });
+      try { await dbx.filesDeleteV2({ path: location.path }); } catch (_) { /* ignore */ }
+      return;
+    }
+    if (location.type === 'webdav') {
+      const { createClient } = require('webdav');
+      const creds = await this._getCloudCredentials('webdav');
+      const client = createClient(creds.url, { username: creds.username, password: creds.password });
+      try { await client.deleteFile(location.path); } catch (_) { /* ignore */ }
+      return;
+    }
+    if (location.type === 'sftp') {
+      const SftpClient = require('ssh2-sftp-client');
+      const creds = await this._getCloudCredentials('sftp');
+      const client = new SftpClient();
+      try {
+        await client.connect({
+          host: creds.host,
+          port: creds.port,
+          username: creds.username,
+          password: creds.password || undefined,
+          privateKey: creds.privateKey || undefined
+        });
+        try { await client.delete(location.path); } catch (_) { /* ignore */ }
+      } finally {
+        try { await client.end(); } catch (_) { /* ignore */ }
+      }
+      return;
+    }
+  }
+
   /**
    * Verify backup integrity
    */
@@ -618,9 +904,24 @@ class BackupManager extends EventEmitter {
         throw new Error(`Backup not found: ${backupId}`);
       }
 
-      // Load backup data
-      const location = backup.locations[0]; // Use first location
-      let data = fs.readFileSync(location.path);
+      // Load backup data — try each destination location until one succeeds
+      const location = backup.locations[0]; // Primary location
+      let data;
+      try {
+        data = await this.loadFromDestination(location);
+      } catch (loadErr) {
+        // Fall back to other locations if available
+        let recovered = false;
+        for (let i = 1; i < backup.locations.length; i++) {
+          try {
+            data = await this.loadFromDestination(backup.locations[i]);
+            recovered = true;
+            console.log(`[BackupManager] Loaded backup from fallback location ${backup.locations[i].type}`);
+            break;
+          } catch (_) { /* ignore */ }
+        }
+        if (!recovered) throw loadErr;
+      }
 
       // Decrypt if needed
       if (backup.encrypted && options.encryptionKey) {
@@ -717,63 +1018,6 @@ class BackupManager extends EventEmitter {
     console.log('[BackupManager] Stats restored');
   }
 
-  /**
-   * Enforce storage limit by deleting oldest backups until total is within limit
-   */
-  async enforceStorageLimit(name, maxBytes) {
-    const maxStr = formatBytes(maxBytes);
-    console.log("[BackupManager] Enforcing storage limit: " + maxStr + " for \"" + name + "\"");
-
-    const backups = this.history
-      .filter(b => b.name === name && b.status === 'success')
-      .sort((a, b) => new Date(a.timestamp) - new Date(b.timestamp));
-
-    let totalSize = 0;
-    const locationsMap = {};
-
-    for (const backup of backups) {
-      for (const loc of backup.locations || []) {
-        if (loc.type === 'local' && loc.path) {
-          totalSize += loc.size || 0;
-          locationsMap[backup.id] = locationsMap[backup.id] || [];
-          locationsMap[backup.id].push(loc.path);
-        }
-      }
-    }
-
-    console.log("[BackupManager] Current total size: " + formatBytes(totalSize) + ", limit: " + maxStr);
-
-    if (totalSize <= maxBytes) {
-      console.log("[BackupManager] Storage limit OK (" + formatBytes(totalSize) + " <= " + maxStr + ")");
-      return;
-    }
-
-    let freed = 0;
-    for (const backup of backups) {
-      if (totalSize <= maxBytes) break;
-
-      const paths = locationsMap[backup.id] || [];
-      for (const path of paths) {
-        try {
-          if (fs.existsSync(path)) {
-            fs.unlinkSync(path);
-            const sz = backup.size || 0;
-            totalSize -= sz;
-            freed += sz;
-            console.log("[BackupManager] Deleted " + formatBytes(sz) + ": " + path);
-          }
-        } catch (error) {
-          console.error("[BackupManager] Error deleting " + path + ": " + error.message);
-        }
-      }
-
-      this.history = this.history.filter(b => b.id !== backup.id);
-    }
-
-    this.saveHistory();
-    console.log("[BackupManager] Storage limit enforced. Freed " + formatBytes(freed) + ", now " + formatBytes(totalSize));
-  }
-
   /**
    * Cleanup old backups based on retention policy
    */
@@ -788,16 +1032,18 @@ class BackupManager extends EventEmitter {
 
     for (const backup of toDelete) {
       try {
-        // Delete from all locations
+        // Delete from all locations (local + cloud)
         for (const location of backup.locations) {
-          if (location.type === 'local' && fs.existsSync(location.path)) {
-            fs.unlinkSync(location.path);
+          try {
+            await this._deleteFromDestination(location);
+          } catch (delErr) {
+            console.warn(`[BackupManager] Could not delete ${location.type} location for ${backup.id}:`, delErr.message);
           }
         }
 
         // Remove from history
         this.history = this.history.filter(b => b.id !== backup.id);
-        
+
         console.log(`[BackupManager] Deleted old backup: ${backup.id}`);
       } catch (error) {
         console.error(`[BackupManager] Error deleting backup ${backup.id}:`, error.message);

dashcaddy-api/config-drift-detector.js

@@ -0,0 +1,376 @@
+/**
+ * Config Drift Detector - Compares services.json with live Docker state
+ *
+ * Detects discrepancies between the configured service list and what is
+ * actually running in Docker, including missing containers, unknown
+ * containers, port mismatches, state mismatches, and stale records.
+ *
+ * @module config-drift-detector
+ */
+
+const EventEmitter = require('events');
+
+/**
+ * @typedef {Object} DriftReport
+ * @property {string}            checkedAt          - ISO timestamp of the check
+ * @property {Object[]}          missingContainers  - Services with containerId but container absent in Docker
+ * @property {Object[]}          unknownContainers  - Running Docker containers with sami.managed label but not in services.json
+ * @property {Object[]}          portMismatch       - Service port != container mapped port
+ * @property {Object[]}          stateMismatch      - Service expected up but container stopped/absent
+ * @property {Object[]}          staleRecords       - Services with containerId pointing to removed containers
+ * @property {boolean}           hasDrift           - Whether any drift category is non-empty
+ */
+
+/**
+ * Detects and reports configuration drift between services.json and Docker.
+ *
+ * @extends EventEmitter
+ *
+ * @fires ConfigDriftDetector#drift-detected
+ */
+class ConfigDriftDetector extends EventEmitter {
+  /**
+   * @param {Object} ctx - Shared application context
+   * @param {Object}   ctx.docker                    - Docker client wrapper ({ client: Dockerode })
+   * @param {Object}   ctx.servicesStateManager      - StateManager for services.json
+   * @param {Object}   ctx.notification              - NotificationManager instance
+   * @param {Object}   ctx.log                       - Logger instance
+   * @param {Function} ctx.logError                  - Error logging function
+   */
+  constructor(ctx) {
+    super();
+    this.ctx = ctx;
+    this.log = ctx.log || console;
+    this.logError = ctx.logError || ((_c, err) => console.error(err));
+    this.docker = ctx.docker;
+    this.servicesStateManager = ctx.servicesStateManager;
+    this.notification = ctx.notification;
+
+    /** @type {DriftReport|null} Cached report from last detection */
+    this.lastReport = null;
+
+    /** @type {NodeJS.Timeout|null} Polling timer reference */
+    this._pollTimer = null;
+
+    /** Whether polling is currently active */
+    this._polling = false;
+  }
+
+  // ─── Detection ───────────────────────────────────────────────────────
+
+  /**
+   * Run a full drift detection and return the report.
+   *
+   * Reads services from servicesStateManager and live containers from Docker,
+   * then compares them across five drift categories.
+   *
+   * @returns {Promise<DriftReport>}
+   */
+  async detect() {
+    const checkedAt = new Date().toISOString();
+
+    // Gather configured services
+    let services = [];
+    try {
+      const data = await this.servicesStateManager.read();
+      services = Array.isArray(data) ? data : (data.services || []);
+    } catch (err) {
+      this.log.error('drift', 'Failed to read services', { error: err.message });
+    }
+
+    // Gather live Docker containers
+    let containers = [];
+    try {
+      containers = await this.docker.client.listContainers({ all: true });
+    } catch (err) {
+      this.log.error('drift', 'Failed to list containers', { error: err.message });
+    }
+
+    // Build lookup maps
+    const containerById = new Map();   // containerId (short or long) → container info
+    const containerByName = new Map(); // container name → container info
+
+    for (const c of containers) {
+      // Store by full ID
+      containerById.set(c.Id, c);
+      // Store by short ID (first 12 chars)
+      if (c.Id && c.Id.length >= 12) {
+        containerById.set(c.Id.substring(0, 12), c);
+      }
+      // Store by name (strip leading /)
+      for (const name of (c.Names || [])) {
+        containerByName.set(name.replace(/^\//, ''), c);
+      }
+    }
+
+    // Build set of service containerIds for reverse lookup
+    const serviceContainerIds = new Set();
+    const serviceByContainerId = new Map();
+
+    for (const svc of services) {
+      if (svc.containerId) {
+        serviceContainerIds.add(svc.containerId);
+        // Index by both full and short ID
+        serviceByContainerId.set(svc.containerId, svc);
+        if (svc.containerId.length >= 12) {
+          serviceByContainerId.set(svc.containerId.substring(0, 12), svc);
+        }
+      }
+    }
+
+    const missingContainers = [];
+    const portMismatch = [];
+    const stateMismatch = [];
+    const staleRecords = [];
+
+    for (const svc of services) {
+      if (!svc.containerId) continue;
+
+      // Look up the container
+      const container = containerById.get(svc.containerId)
+        || containerById.get(svc.containerId.substring(0, 12));
+
+      if (!container) {
+        // Container ID referenced but not found in Docker at all
+        staleRecords.push({
+          serviceId: svc.id,
+          name: svc.name,
+          containerId: svc.containerId,
+          reason: 'Container not found in Docker',
+        });
+        continue;
+      }
+
+      // Missing container — service expects it but it's not running
+      if (container.State !== 'running') {
+        missingContainers.push({
+          serviceId: svc.id,
+          name: svc.name,
+          containerId: svc.containerId,
+          containerState: container.State,
+          containerStatus: container.Status,
+        });
+
+        // Also a state mismatch if the service is expected to be up
+        stateMismatch.push({
+          serviceId: svc.id,
+          name: svc.name,
+          expectedState: 'running',
+          actualState: container.State,
+          containerId: svc.containerId,
+        });
+      }
+
+      // Port mismatch detection
+      if (svc.port && container.State === 'running') {
+        const actualPorts = this._extractContainerPorts(container);
+        if (actualPorts.length > 0 && !actualPorts.includes(svc.port)) {
+          portMismatch.push({
+            serviceId: svc.id,
+            name: svc.name,
+            configuredPort: svc.port,
+            actualPorts,
+            containerId: svc.containerId,
+          });
+        }
+      }
+    }
+
+    // Unknown managed containers: Docker containers with sami.managed label
+    // that are NOT in services.json
+    const unknownContainers = [];
+    for (const c of containers) {
+      const isManaged = c.Labels && c.Labels['sami.managed'] === 'true';
+      if (!isManaged) continue;
+
+      const isInServices = serviceByContainerId.has(c.Id)
+        || serviceByContainerId.has(c.Id.substring(0, 12));
+
+      if (!isInServices) {
+        unknownContainers.push({
+          containerId: c.Id,
+          name: (c.Names && c.Names[0] || '').replace(/^\//, ''),
+          image: c.Image,
+          state: c.State,
+          status: c.Status,
+          app: c.Labels?.['sami.app'] || null,
+          subdomain: c.Labels?.['sami.subdomain'] || null,
+        });
+      }
+    }
+
+    const report = {
+      checkedAt,
+      missingContainers,
+      unknownContainers,
+      portMismatch,
+      stateMismatch,
+      staleRecords,
+      hasDrift: missingContainers.length > 0
+        || unknownContainers.length > 0
+        || portMismatch.length > 0
+        || stateMismatch.length > 0
+        || staleRecords.length > 0,
+    };
+
+    // Cache for quick API access
+    this.lastReport = report;
+
+    // Emit and notify if drift detected
+    if (report.hasDrift) {
+      /**
+       * @event ConfigDriftDetector#drift-detected
+       * @type {DriftReport}
+       */
+      this.emit('drift-detected', report);
+
+      try {
+        await this._sendDriftNotification(report);
+      } catch (notifErr) {
+        this.log.error('drift', 'Failed to send drift notification', {
+          error: notifErr.message,
+        });
+      }
+    }
+
+    this.log.info('drift', 'Detection complete', {
+      hasDrift: report.hasDrift,
+      missing: report.missingContainers.length,
+      unknown: report.unknownContainers.length,
+      portMismatch: report.portMismatch.length,
+      stateMismatch: report.stateMismatch.length,
+      stale: report.staleRecords.length,
+    });
+
+    return report;
+  }
+
+  // ─── Auto-fix ────────────────────────────────────────────────────────
+
+  /**
+   * Attempt to auto-fix drift:
+   *  - Remove stale records (services referencing removed containers)
+   *  - Flag unknown containers for review
+   *
+   * @returns {Promise<{ staleRemoved: number, unknownFlagged: number }>}
+   */
+  async autoFix() {
+    const report = await this.detect();
+    let staleRemoved = 0;
+
+    // Remove stale records from services.json
+    if (report.staleRecords.length > 0) {
+      const staleIds = new Set(report.staleRecords.map(r => r.serviceId));
+      await this.servicesStateManager.update(services => {
+        const before = services.length;
+        const cleaned = services.filter(s => !staleIds.has(s.id));
+        staleRemoved = before - cleaned.length;
+        return cleaned;
+      });
+    }
+
+    const unknownFlagged = report.unknownContainers.length;
+
+    this.log.info('drift', 'Auto-fix applied', { staleRemoved, unknownFlagged });
+
+    return { staleRemoved, unknownFlagged };
+  }
+
+  // ─── Polling ─────────────────────────────────────────────────────────
+
+  /**
+   * Start periodic drift detection.
+   *
+   * @param {number} [intervalMs=300000] - Polling interval in milliseconds (default 5 min)
+   */
+  startPolling(intervalMs = 300000) {
+    this.stopPolling();
+
+    this._polling = true;
+    this._pollTimer = setInterval(async () => {
+      try {
+        await this.detect();
+      } catch (err) {
+        this.logError('drift-poll', err);
+      }
+    }, intervalMs);
+
+    this.log.info('drift', 'Polling started', { intervalMs });
+  }
+
+  /**
+   * Stop periodic drift detection.
+   */
+  stopPolling() {
+    if (this._pollTimer) {
+      clearInterval(this._pollTimer);
+      this._pollTimer = null;
+    }
+    this._polling = false;
+    this.log.info('drift', 'Polling stopped');
+  }
+
+  /**
+   * Whether polling is currently active.
+   * @returns {boolean}
+   */
+  isPolling() {
+    return this._polling;
+  }
+
+  // ─── Helpers ─────────────────────────────────────────────────────────
+
+  /**
+   * Extract mapped host ports from a Docker container info object.
+   *
+   * @param {Object} container - Dockerode container info
+   * @returns {number[]} Array of host port numbers
+   * @private
+   */
+  _extractContainerPorts(container) {
+    const ports = [];
+    if (!container.Ports) return ports;
+
+    for (const p of container.Ports) {
+      if (p.PublicPort) {
+        ports.push(p.PublicPort);
+      }
+    }
+
+    return ports;
+  }
+
+  /**
+   * Send a notification about detected drift.
+   *
+   * @param {DriftReport} report
+   * @returns {Promise<Object>}
+   * @private
+   */
+  async _sendDriftNotification(report) {
+    if (!this.notification?.send) {
+      return { success: false, reason: 'no-notification-manager' };
+    }
+
+    const parts = [];
+    if (report.missingContainers.length > 0) {
+      parts.push(`Missing containers: ${report.missingContainers.map(c => c.name).join(', ')}`);
+    }
+    if (report.unknownContainers.length > 0) {
+      parts.push(`Unknown managed containers: ${report.unknownContainers.map(c => c.name).join(', ')}`);
+    }
+    if (report.portMismatch.length > 0) {
+      parts.push(`Port mismatches: ${report.portMismatch.map(c => c.name).join(', ')}`);
+    }
+    if (report.staleRecords.length > 0) {
+      parts.push(`Stale records: ${report.staleRecords.map(c => c.name).join(', ')}`);
+    }
+
+    return this.notification.send('drift-detected', {
+      text: `⚠️ Configuration drift detected:\n${parts.join('\n')}`,
+      report,
+    });
+  }
+}
+
+module.exports = { ConfigDriftDetector };

dashcaddy-api/data/services.json

@@ -1,109 +0,0 @@
-[
-  {
-    "id": "router",
-    "name": "Router UI",
-    "logo": "/assets/router.png",
-    "url": "https://router.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false
-  },
-  {
-    "id": "chat",
-    "name": "Chat",
-    "logo": "/assets/chat.png",
-    "url": "https://chat.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false
-  },
-  {
-    "id": "sync",
-    "name": "Syncthing",
-    "logo": "/assets/syncthing.png",
-    "url": "https://sync.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false
-  },
-  {
-    "id": "torrent",
-    "name": "qBittorrent",
-    "logo": "/assets/qBittorrent.png",
-    "url": "https://torrent.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false,
-    "deployedAt": "2026-01-18T06:04:55.246Z"
-  },
-  {
-    "id": "sonarr",
-    "name": "Sonarr",
-    "logo": "/assets/sonarr.png",
-    "url": "https://sonarr.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false,
-    "deployedAt": "2026-01-18T06:04:56.612Z"
-  },
-  {
-    "id": "radarr",
-    "name": "Radarr",
-    "logo": "/assets/radarr.png",
-    "url": "https://radarr.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false,
-    "deployedAt": "2026-01-18T08:28:12.359Z"
-  },
-  {
-    "id": "prowlarr",
-    "name": "Prowlarr",
-    "logo": "/assets/prowlarr.png",
-    "url": "https://prowlarr.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false,
-    "deployedAt": "2026-01-18T08:28:13.739Z"
-  },
-  {
-    "id": "ca",
-    "name": "DashCA",
-    "logo": "/assets/certificate-icon.png",
-    "containerId": null,
-    "appTemplate": "dashca",
-    "tailscaleOnly": false,
-    "deployedAt": "2026-02-11T11:47:08.383Z",
-    "url": "https://ca.sami"
-  },
-  {
-    "id": "plex",
-    "name": "Plex",
-    "logo": "/assets/plex.png",
-    "containerId": null,
-    "appTemplate": "plex",
-    "tailscaleOnly": false,
-    "deployedAt": "2026-02-12T02:18:36.067Z",
-    "url": "https://plex.sami"
-  },
-  {
-    "id": "requests",
-    "name": "Seerr",
-    "logo": "/assets/seerr.png",
-    "url": "https://requests.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false
-  },
-  {
-    "id": "git",
-    "name": "Gitea",
-    "logo": "/assets/gitea.png",
-    "url": "https://git.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false
-  },
-  {
-    "id": "files",
-    "name": "Sami Files",
-    "logo": "/assets/sami-files.png",
-    "url": "https://files.sami",
-    "ip": "localhost",
-    "tailscaleOnly": false,
-    "containerId": null,
-    "appTemplate": "sami-files",
-    "deployedAt": "2026-06-19T00:00:00.000Z"
-  }
-] 

dashcaddy-api/dependency-manager.js

@@ -0,0 +1,605 @@
+/**
+ * Dependency Manager - Service dependency tracking with ordered restart chains
+ *
+ * Manages directed acyclic graph (DAG) of service dependencies. Services can
+ * declare which other services they depend on, and this manager provides:
+ *  - Full dependency graph inspection
+ *  - Topological ordering for safe restart chains
+ *  - Circular dependency detection
+ *  - Health-aware restart with per-service polling
+ *
+ * Dependencies are stored directly on service objects in services.json:
+ *   { id, name, ..., dependsOn: ['service-id-1', 'service-id-2'] }
+ *
+ * @module dependency-manager
+ */
+
+const EventEmitter = require('events');
+
+/** Maximum seconds to wait for a single container to become healthy after restart */
+const HEALTH_CHECK_TIMEOUT_MS = 30_000;
+
+/** Interval between container health polls */
+const HEALTH_CHECK_INTERVAL_MS = 1_000;
+
+/**
+ * @typedef {Object} ServiceNode
+ * @property {string} serviceId
+ * @property {string} name
+ * @property {string|null} containerId
+ */
+
+/**
+ * @typedef {Object} DependencyEdge
+ * @property {string} from - The service that depends
+ * @property {string} to   - The service being depended upon
+ */
+
+/**
+ * @typedef {Object} DependencyGraph
+ * @property {ServiceNode[]}  nodes
+ * @property {DependencyEdge[]} edges
+ */
+
+/**
+ * @typedef {Object} DependencyStatusEntry
+ * @property {string}  serviceId
+ * @property {string}  name
+ * @property {boolean} isUp
+ * @property {string}  [error]
+ */
+
+/**
+ * DependencyManager — tracks service dependencies and orchestrates ordered restarts.
+ *
+ * Events emitted:
+ *  - `dependency-restart-start`    ({ serviceId, chain: string[] })
+ *  - `dependency-restart-progress` ({ serviceId, currentServiceId, index, total })
+ *  - `dependency-restart-complete`  ({ serviceId, chain: string[], results: Array })
+ *  - `dependency-restart-failed`    ({ serviceId, failedServiceId, error, chain: string[] })
+ *
+ * @extends EventEmitter
+ */
+class DependencyManager extends EventEmitter {
+  /**
+   * @param {Object} ctx - Application context
+   * @param {Object} ctx.servicesStateManager - StateManager for services.json
+   * @param {Object} ctx.docker - Docker context ({ client: Dockerode })
+   * @param {Object} ctx.notification - NotificationManager instance
+   * @param {Object} ctx.log - Logger instance
+   */
+  constructor(ctx) {
+    super();
+    /** @private */
+    this.ctx = ctx;
+    /** @private */
+    this._servicesStateManager = ctx.servicesStateManager;
+    /** @private */
+    this._docker = ctx.docker;
+    /** @private */
+    this._notification = ctx.notification;
+    /** @private */
+    this._log = ctx.log || console;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Core helpers
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Load all services from the state manager.
+   * @private
+   * @returns {Promise<Object[]>}
+   */
+  async _loadServices() {
+    const data = await this._servicesStateManager.read();
+    return Array.isArray(data) ? data : (data.services || []);
+  }
+
+  /**
+   * Find a single service by ID.
+   * @private
+   * @param {string} serviceId
+   * @returns {Promise<Object|null>}
+   */
+  async _findService(serviceId) {
+    const services = await this._loadServices();
+    return services.find(s => s.id === serviceId) || null;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Graph queries
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Return the full dependency graph for visualisation.
+   *
+   * @returns {Promise<DependencyGraph>}
+   */
+  async getDependencyGraph() {
+    const services = await this._loadServices();
+
+    const nodes = services.map(s => ({
+      serviceId: s.id,
+      name: s.name,
+      containerId: s.containerId || null,
+    }));
+
+    const edges = [];
+    for (const service of services) {
+      const deps = service.dependsOn || [];
+      for (const depId of deps) {
+        edges.push({ from: service.id, to: depId });
+      }
+    }
+
+    return { nodes, edges };
+  }
+
+  /**
+   * Return the services that depend on the given service (reverse deps).
+   *
+   * @param {string} serviceId
+   * @returns {Promise<Object[]>} Services whose `dependsOn` includes `serviceId`.
+   */
+  async getDependents(serviceId) {
+    const services = await this._loadServices();
+    return services.filter(s => (s.dependsOn || []).includes(serviceId));
+  }
+
+  /**
+   * Return the direct dependencies for a service.
+   *
+   * @param {string} serviceId
+   * @returns {Promise<Object[]>} Services that `serviceId` depends on.
+   */
+  async getDependencies(serviceId) {
+    const services = await this._loadServices();
+    const service = services.find(s => s.id === serviceId);
+    if (!service) return [];
+    const depIds = service.dependsOn || [];
+    return services.filter(s => depIds.includes(s.id));
+  }
+
+  // ---------------------------------------------------------------------------
+  // Topological sort
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Build an adjacency list for the current dependency graph.
+   * Edge direction: service → its dependencies (i.e. what it depends on).
+   *
+   * @private
+   * @param {Object[]} services
+   * @returns {Map<string, string[]>}
+   */
+  _buildAdjacencyList(services) {
+    const adj = new Map();
+    for (const service of services) {
+      adj.set(service.id, (service.dependsOn || []).slice());
+    }
+    return adj;
+  }
+
+  /**
+   * DFS-based topological sort with cycle detection (white/gray/black coloring).
+   *
+   * Returns services in restart order: dependencies first, dependents last.
+   * The target service is included at the end.
+   *
+   * @private
+   * @param {string}   serviceId - Target service (will be last in the result).
+   * @param {Object[]} services  - All services.
+   * @param {Map<string, string[]>} adj - Adjacency list (service → deps).
+   * @returns {string[]} Ordered service IDs for restart.
+   * @throws {Error} If a circular dependency is detected.
+   */
+  _topologicalSort(serviceId, services, adj) {
+    // Collect only the reachable sub-graph from serviceId
+    const visited = new Set();
+    const reachable = new Set();
+
+    const collectReachable = (id) => {
+      if (reachable.has(id)) return;
+      reachable.add(id);
+      for (const dep of (adj.get(id) || [])) {
+        collectReachable(dep);
+      }
+    };
+    collectReachable(serviceId);
+
+    // DFS topological sort on the reachable sub-graph
+    const WHITE = 0, GRAY = 1, BLACK = 2;
+    const color = new Map();
+    for (const id of reachable) color.set(id, WHITE);
+
+    const result = [];
+
+    const dfs = (id) => {
+      if (color.get(id) === BLACK) return;
+      if (color.get(id) === GRAY) {
+        throw new Error(`Circular dependency detected involving service "${id}"`);
+      }
+      color.set(id, GRAY);
+      for (const dep of (adj.get(id) || [])) {
+        dfs(dep);
+      }
+      color.set(id, BLACK);
+      result.push(id);
+    };
+
+    // Visit the target last so it ends up at the end of the result
+    // Actually, we want deps *first* then the target.
+    // The DFS naturally puts deps before dependents, so starting from
+    // serviceId will place it last (which is correct for restart order).
+    dfs(serviceId);
+
+    return result;
+  }
+
+  /**
+   * Get the topologically ordered restart chain for a service.
+   *
+   * The returned array lists all services that must be restarted,
+   * starting with leaf dependencies and ending with the target service.
+   *
+   * @param {string} serviceId - The service to build the chain for.
+   * @returns {Promise<string[]>} Ordered service IDs.
+   * @throws {Error} If `serviceId` doesn't exist or a circular dependency is found.
+   */
+  async getOrderedRestartChain(serviceId) {
+    const services = await this._loadServices();
+    const service = services.find(s => s.id === serviceId);
+    if (!service) {
+      throw new Error(`Service "${serviceId}" not found`);
+    }
+
+    const adj = this._buildAdjacencyList(services);
+    return this._topologicalSort(serviceId, services, adj);
+  }
+
+  // ---------------------------------------------------------------------------
+  // Validation
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Validate a proposed set of dependencies for a service.
+   *
+   * Checks:
+   *  - All referenced service IDs exist.
+   *  - Adding these dependencies would not create a circular dependency.
+   *  - A service cannot depend on itself.
+   *
+   * @param {string}   serviceId  - The service to set dependencies on.
+   * @param {string[]} dependsOn  - Proposed dependency IDs.
+   * @returns {Promise<{ valid: boolean, errors: string[] }>}
+   */
+  async validateDependencies(serviceId, dependsOn) {
+    const errors = [];
+
+    if (!Array.isArray(dependsOn)) {
+      return { valid: false, errors: ['dependsOn must be an array'] };
+    }
+
+    const services = await this._loadServices();
+    const allIds = new Set(services.map(s => s.id));
+
+    // Service must exist
+    if (!allIds.has(serviceId)) {
+      return { valid: false, errors: [`Service "${serviceId}" not found`] };
+    }
+
+    // Self-dependency
+    if (dependsOn.includes(serviceId)) {
+      errors.push(`Service "${serviceId}" cannot depend on itself`);
+    }
+
+    // Existence check
+    for (const depId of dependsOn) {
+      if (!allIds.has(depId)) {
+        errors.push(`Dependency service "${depId}" does not exist`);
+      }
+    }
+
+    if (errors.length > 0) {
+      return { valid: false, errors };
+    }
+
+    // Circular dependency check: temporarily set the proposed dependsOn
+    // and attempt a topological sort.
+    const tempServices = services.map(s => {
+      if (s.id === serviceId) {
+        return { ...s, dependsOn: dependsOn.slice() };
+      }
+      return { ...s };
+    });
+
+    const adj = this._buildAdjacencyList(tempServices);
+
+    // Check every node for cycles with the new edges
+    try {
+      const WHITE = 0, GRAY = 1, BLACK = 2;
+      const color = new Map();
+      for (const s of tempServices) color.set(s.id, WHITE);
+
+      const dfs = (id) => {
+        if (color.get(id) === BLACK) return;
+        if (color.get(id) === GRAY) {
+          throw new Error(`Circular dependency detected involving service "${id}"`);
+        }
+        color.set(id, GRAY);
+        for (const dep of (adj.get(id) || [])) {
+          dfs(dep);
+        }
+        color.set(id, BLACK);
+      };
+
+      for (const s of tempServices) {
+        if (color.get(s.id) === WHITE) {
+          dfs(s.id);
+        }
+      }
+    } catch (err) {
+      errors.push(err.message);
+    }
+
+    return { valid: errors.length === 0, errors };
+  }
+
+  // ---------------------------------------------------------------------------
+  // Health status
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Get the current container status for a service and all its transitive dependencies.
+   *
+   * @param {string} serviceId
+   * @returns {Promise<DependencyStatusEntry[]>}
+   * @throws {Error} If `serviceId` doesn't exist.
+   */
+  async getDependencyStatus(serviceId) {
+    const services = await this._loadServices();
+    const service = services.find(s => s.id === serviceId);
+    if (!service) {
+      throw new Error(`Service "${serviceId}" not found`);
+    }
+
+    // Collect all transitive dependencies via BFS
+    const serviceMap = new Map(services.map(s => [s.id, s]));
+    const visited = new Set();
+    const queue = [serviceId];
+    const allRelated = [];
+
+    while (queue.length > 0) {
+      const currentId = queue.shift();
+      if (visited.has(currentId)) continue;
+      visited.add(currentId);
+
+      const svc = serviceMap.get(currentId);
+      if (!svc) continue;
+
+      allRelated.push(svc);
+
+      for (const depId of (svc.dependsOn || [])) {
+        if (!visited.has(depId)) {
+          queue.push(depId);
+        }
+      }
+    }
+
+    // Query container status for each
+    const results = [];
+    for (const svc of allRelated) {
+      const entry = {
+        serviceId: svc.id,
+        name: svc.name,
+        isUp: false,
+      };
+
+      if (!svc.containerId) {
+        entry.error = 'No container associated with this service';
+        results.push(entry);
+        continue;
+      }
+
+      try {
+        const container = this._docker.client.getContainer(svc.containerId);
+        const info = await container.inspect();
+        entry.isUp = info.State?.Running === true;
+      } catch (err) {
+        entry.error = err.message || 'Unable to inspect container';
+      }
+
+      results.push(entry);
+    }
+
+    return results;
+  }
+
+  // ---------------------------------------------------------------------------
+  // Restart with dependencies
+  // ---------------------------------------------------------------------------
+
+  /**
+   * Wait for a container to report as running after a restart.
+   *
+   * @private
+   * @param {string} containerId
+   * @param {number} [timeoutMs=30000]
+   * @returns {Promise<boolean>} `true` if healthy, `false` if timed out.
+   */
+  async _waitForContainerHealthy(containerId, timeoutMs = HEALTH_CHECK_TIMEOUT_MS) {
+    const start = Date.now();
+    while (Date.now() - start < timeoutMs) {
+      try {
+        const container = this._docker.client.getContainer(containerId);
+        const info = await container.inspect();
+        if (info.State?.Running === true) {
+          return true;
+        }
+      } catch {
+        // Container might not be inspectable during restart — keep polling
+      }
+      await new Promise(r => setTimeout(r, HEALTH_CHECK_INTERVAL_MS));
+    }
+    return false;
+  }
+
+  /**
+   * Restart a service and all its dependencies in topological order.
+   *
+   * Emits progress events and sends a notification on completion/failure.
+   * This method is designed to be called from the route handler and
+   * **does not throw** — errors are reported via events and notifications.
+   *
+   * @param {string} serviceId - Target service to restart (with deps).
+   * @returns {Promise<{ success: boolean, chain: string[], results: Array }>}
+   */
+  async restartWithDependencies(serviceId) {
+    const service = await this._findService(serviceId);
+    if (!service) {
+      const err = new Error(`Service "${serviceId}" not found`);
+      this.emit('dependency-restart-failed', {
+        serviceId,
+        failedServiceId: serviceId,
+        error: err.message,
+        chain: [],
+      });
+      throw err;
+    }
+
+    let chain;
+    try {
+      chain = await this.getOrderedRestartChain(serviceId);
+    } catch (err) {
+      this.emit('dependency-restart-failed', {
+        serviceId,
+        failedServiceId: serviceId,
+        error: err.message,
+        chain: [],
+      });
+      throw err;
+    }
+
+    const services = await this._loadServices();
+    const serviceMap = new Map(services.map(s => [s.id, s]));
+
+    this._log.info('dependency', 'Starting dependency restart chain', {
+      serviceId,
+      chain,
+    });
+
+    this.emit('dependency-restart-start', { serviceId, chain });
+
+    const results = [];
+    const total = chain.length;
+
+    for (let i = 0; i < total; i++) {
+      const currentId = chain[i];
+      const svc = serviceMap.get(currentId);
+
+      this.emit('dependency-restart-progress', {
+        serviceId,
+        currentServiceId: currentId,
+        index: i,
+        total,
+      });
+
+      if (!svc || !svc.containerId) {
+        const msg = !svc
+          ? `Service "${currentId}" not found in state`
+          : `Service "${currentId}" has no container — skipping restart`;
+        this._log.warn('dependency', msg);
+        results.push({ serviceId: currentId, restarted: false, skipped: true, reason: msg });
+        continue;
+      }
+
+      try {
+        const container = this._docker.client.getContainer(svc.containerId);
+        this._log.info('dependency', `Restarting container for service "${currentId}"`, {
+          containerId: svc.containerId,
+        });
+        await container.restart();
+
+        // Wait for it to come back up
+        const healthy = await this._waitForContainerHealthy(svc.containerId);
+        if (!healthy) {
+          const msg = `Container for service "${currentId}" did not become healthy within ${HEALTH_CHECK_TIMEOUT_MS / 1000}s`;
+          this._log.warn('dependency', msg);
+          results.push({ serviceId: currentId, restarted: true, healthy: false, error: msg });
+
+          // Abort chain — dependency didn't come back
+          this.emit('dependency-restart-failed', {
+            serviceId,
+            failedServiceId: currentId,
+            error: msg,
+            chain,
+          });
+          await this._notifyRestartResult(serviceId, false, chain, results, currentId);
+          return { success: false, chain, results };
+        }
+
+        this._log.info('dependency', `Service "${currentId}" is healthy after restart`);
+        results.push({ serviceId: currentId, restarted: true, healthy: true });
+      } catch (err) {
+        const msg = err.message || 'Unknown error during restart';
+        this._log.error('dependency', `Failed to restart service "${currentId}"`, {
+          error: msg,
+        });
+        results.push({ serviceId: currentId, restarted: false, error: msg });
+
+        this.emit('dependency-restart-failed', {
+          serviceId,
+          failedServiceId: currentId,
+          error: msg,
+          chain,
+        });
+        await this._notifyRestartResult(serviceId, false, chain, results, currentId);
+        return { success: false, chain, results };
+      }
+    }
+
+    this.emit('dependency-restart-complete', { serviceId, chain, results });
+    await this._notifyRestartResult(serviceId, true, chain, results);
+    return { success: true, chain, results };
+  }
+
+  /**
+   * Send a notification about the restart result.
+   *
+   * @private
+   * @param {string} serviceId
+   * @param {boolean} success
+   * @param {string[]} chain
+   * @param {Array} results
+   * @param {string} [failedServiceId]
+   */
+  async _notifyRestartResult(serviceId, success, chain, results, failedServiceId) {
+    if (!this._notification) return;
+
+    try {
+      if (success) {
+        await this._notification.send('dependency-restart-complete', {
+          text: `✅ Dependency restart chain completed for "${serviceId}". Restarted: ${chain.join(' → ')}`,
+          serviceId,
+          chain,
+          results,
+        });
+      } else {
+        await this._notification.send('dependency-restart-failed', {
+          text: `❌ Dependency restart chain failed for "${serviceId}" at "${failedServiceId}". Chain: ${chain.join(' → ')}`,
+          serviceId,
+          failedServiceId,
+          chain,
+          results,
+        });
+      }
+    } catch (err) {
+      this._log.error('dependency', 'Failed to send restart notification', {
+        error: err.message,
+      });
+    }
+  }
+}
+
+module.exports = DependencyManager;

dashcaddy-api/dns-propagation.js

@@ -0,0 +1,273 @@
+/**
+ * DNS Propagation Checker
+ * Verifies DNS record propagation by querying multiple resolvers.
+ * Runs as background jobs with configurable timeout and interval.
+ *
+ * @module dns-propagation
+ */
+
+const dns = require('dns').promises;
+const EventEmitter = require('events');
+
+/** Default verification options */
+const DEFAULT_OPTIONS = {
+  timeout: 300000,    // 5 minutes
+  interval: 10000,    // 10 seconds
+  resolvers: ['1.1.1.1', '8.8.8.8', '9.9.9.9']
+};
+
+/** Maximum age for stored verification results (1 hour) */
+const MAX_RESULT_AGE_MS = 3600000;
+
+class DNSPropagationChecker extends EventEmitter {
+  /**
+   * Create a DNSPropagationChecker instance.
+   * @param {Object} ctx - Shared application context
+   * @param {Object} ctx.notification - NotificationManager instance
+   * @param {Object} ctx.log - Logger instance
+   */
+  constructor(ctx) {
+    super();
+    this.ctx = ctx;
+    this.log = ctx.log || console;
+
+    /** @type {Map<string, Object>} domain → verification status */
+    this.verifications = new Map();
+  }
+
+  /**
+   * Verify that a DNS record has propagated by querying multiple resolvers.
+   * Retries every `interval` ms until `timeout` is reached.
+   *
+   * @param {string} domain - The domain to check (e.g., 'test.sami')
+   * @param {string} expectedIp - The expected IP address
+   * @param {Object} [options={}] - Verification options
+   * @param {number} [options.timeout=300000] - Maximum time to wait (ms)
+   * @param {number} [options.interval=10000] - Time between retries (ms)
+   * @param {string[]} [options.resolvers] - DNS resolvers to query
+   * @returns {Promise<Object>} Verification result
+   */
+  async verifyRecord(domain, expectedIp, options = {}) {
+    const startTime = Date.now();
+    const {
+      timeout = DEFAULT_OPTIONS.timeout,
+      interval = DEFAULT_OPTIONS.interval,
+      resolvers = DEFAULT_OPTIONS.resolvers
+    } = options;
+
+    const allResults = [];
+    let propagated = false;
+
+    while (Date.now() - startTime < timeout) {
+      const roundResults = [];
+
+      for (const resolver of resolvers) {
+        const checkStart = Date.now();
+        try {
+          // Use dns.resolve4 with a custom resolver
+          const resolverInstance = new dns.Resolver();
+          resolverInstance.setServers([resolver]);
+          resolverInstance.setTimeout(5000);
+
+          const addresses = await resolverInstance.resolve4(domain);
+          const matched = addresses.includes(expectedIp);
+
+          const result = {
+            resolver,
+            ips: addresses,
+            matched,
+            checkedAt: new Date().toISOString(),
+            responseTime: Date.now() - checkStart
+          };
+
+          roundResults.push(result);
+
+          if (matched) {
+            propagated = true;
+          }
+        } catch (err) {
+          roundResults.push({
+            resolver,
+            ips: [],
+            matched: false,
+            checkedAt: new Date().toISOString(),
+            error: err.code || err.message,
+            responseTime: Date.now() - checkStart
+          });
+        }
+      }
+
+      allResults.push(...roundResults);
+
+      // Emit progress event
+      this.emit('propagation-check', {
+        domain,
+        expectedIp,
+        roundResults,
+        elapsed: Date.now() - startTime,
+        propagated
+      });
+
+      if (propagated) {
+        break;
+      }
+
+      // Wait before next attempt
+      await new Promise(resolve => setTimeout(resolve, interval));
+    }
+
+    const totalTime = Date.now() - startTime;
+
+    return {
+      domain,
+      expectedIp,
+      propagated,
+      results: allResults,
+      totalTime,
+      checkedAt: new Date().toISOString()
+    };
+  }
+
+  /**
+   * Start a background DNS propagation verification.
+   * Does not block — returns immediately with the job reference.
+   *
+   * @param {string} domain - The domain to verify
+   * @param {string} expectedIp - The expected IP address
+   * @param {Object} [options={}] - Verification options
+   * @returns {Object} Job status object
+   */
+  startVerification(domain, expectedIp, options = {}) {
+    // If there's already a running verification for this domain, return it
+    const existing = this.verifications.get(domain);
+    if (existing && existing.status === 'running') {
+      return existing;
+    }
+
+    const job = {
+      domain,
+      expectedIp,
+      status: 'running',
+      startedAt: new Date().toISOString(),
+      progress: [],
+      result: null
+    };
+
+    this.verifications.set(domain, job);
+
+    // Run verification in background (non-blocking)
+    this.verifyRecord(domain, expectedIp, options)
+      .then(result => {
+        job.status = 'completed';
+        job.result = result;
+        job.completedAt = new Date().toISOString();
+
+        if (result.propagated) {
+          this.emit('propagation-complete', result);
+
+          if (this.ctx.notification) {
+            this.ctx.notification.send('dns-propagation', {
+              text: `✅ DNS record for ${domain} propagated successfully to ${expectedIp}`,
+              domain,
+              expectedIp,
+              totalTime: result.totalTime
+            }, 'success').catch(err => {
+              this.log.error('dns-propagation', 'Failed to send propagation notification', {
+                error: err.message
+              });
+            });
+          }
+        } else {
+          this.emit('propagation-timeout', result);
+
+          if (this.ctx.notification) {
+            this.ctx.notification.send('dns-propagation', {
+              text: `⏱️ DNS propagation timeout for ${domain} — expected ${expectedIp} not found after ${Math.round(result.totalTime / 1000)}s`,
+              domain,
+              expectedIp,
+              totalTime: result.totalTime
+            }, 'warning').catch(err => {
+              this.log.error('dns-propagation', 'Failed to send timeout notification', {
+                error: err.message
+              });
+            });
+          }
+        }
+      })
+      .catch(err => {
+        job.status = 'error';
+        job.error = err.message;
+        job.completedAt = new Date().toISOString();
+
+        this.log.error('dns-propagation', `Verification failed for ${domain}`, {
+          error: err.message
+        });
+      });
+
+    return job;
+  }
+
+  /**
+   * Get the current verification status for a domain.
+   *
+   * @param {string} domain - The domain to look up
+   * @returns {Object|null} Verification status or null if not found
+   */
+  getVerificationStatus(domain) {
+    const job = this.verifications.get(domain);
+    if (!job) return null;
+    return {
+      domain: job.domain,
+      expectedIp: job.expectedIp,
+      status: job.status,
+      startedAt: job.startedAt,
+      completedAt: job.completedAt || null,
+      result: job.result || null,
+      error: job.error || null
+    };
+  }
+
+  /**
+   * Get all recent verifications.
+   *
+   * @returns {Object[]} Array of verification statuses
+   */
+  getAllVerifications() {
+    const results = [];
+    for (const [domain, job] of this.verifications.entries()) {
+      results.push({
+        domain,
+        expectedIp: job.expectedIp,
+        status: job.status,
+        startedAt: job.startedAt,
+        completedAt: job.completedAt || null,
+        propagated: job.result?.propagated || null,
+        totalTime: job.result?.totalTime || null,
+        error: job.error || null
+      });
+    }
+    return results;
+  }
+
+  /**
+   * Remove verifications older than 1 hour.
+   */
+  cleanup() {
+    const now = Date.now();
+    for (const [domain, job] of this.verifications.entries()) {
+      const completedAt = job.completedAt ? new Date(job.completedAt).getTime() : null;
+      const startedAt = new Date(job.startedAt).getTime();
+
+      // Clean up completed/error jobs older than 1 hour
+      // Also clean up stale running jobs that started over 2 hours ago
+      const age = completedAt ? (now - completedAt) : (now - startedAt);
+      const maxAge = job.status === 'running' ? MAX_RESULT_AGE_MS * 2 : MAX_RESULT_AGE_MS;
+
+      if (age > maxAge) {
+        this.verifications.delete(domain);
+      }
+    }
+  }
+}
+
+module.exports = DNSPropagationChecker;

dashcaddy-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dashcaddy-api",
-  "version": "1.6.0",
+  "version": "1.9.0",
   "description": "DashCaddy API server - Dashboard backend for Docker, Caddy & DNS management",
   "main": "server.js",
   "scripts": {

dashcaddy-api/routes/auto-restart.js

@@ -0,0 +1,164 @@
+/**
+ * Auto-Restart Policy Routes
+ *
+ * CRUD endpoints for per-container auto-restart policies.
+ * Also provides a dry-run test endpoint.
+ *
+ * @module routes/auto-restart
+ */
+
+const express = require('express');
+const { success } = require('../response-helpers');
+const { ValidationError, NotFoundError } = require('../errors');
+
+/**
+ * Auto-restart route factory
+ *
+ * @param {Object} deps - Explicit dependencies
+ * @param {Object}   deps.autoRestartManager - AutoRestartManager instance
+ * @param {Function} deps.asyncHandler - Async route handler wrapper
+ * @param {Function} deps.logError - Error logging function
+ * @returns {express.Router}
+ */
+module.exports = function ({ autoRestartManager, asyncHandler, logError }) {
+  const router = express.Router();
+
+  /**
+   * GET /auto-restart/policies
+   * List all configured auto-restart policies.
+   */
+  router.get('/policies', asyncHandler(async (_req, res) => {
+    const policies = autoRestartManager.listPolicies();
+    success(res, { policies });
+  }, 'auto-restart-list'));
+
+  /**
+   * GET /auto-restart/policies/:serviceId
+   * Get the restart policy for a single service.
+   */
+  router.get('/policies/:serviceId', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+
+    if (!serviceId || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,100}$/.test(serviceId)) {
+      throw new ValidationError('Invalid service ID format');
+    }
+
+    const policy = autoRestartManager.getPolicy(serviceId);
+    if (!policy) {
+      throw new NotFoundError(`Auto-restart policy for "${serviceId}"`);
+    }
+
+    success(res, { policy });
+  }, 'auto-restart-get'));
+
+  /**
+   * POST /auto-restart/policies/:serviceId
+   * Create or update a restart policy.
+   *
+   * Body: { enabled, maxRetries, retryIntervalMs, windowMinutes }
+   */
+  router.post('/policies/:serviceId', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+
+    if (!serviceId || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,100}$/.test(serviceId)) {
+      throw new ValidationError('Invalid service ID format');
+    }
+
+    const { enabled, maxRetries, retryIntervalMs, windowMinutes } = req.body;
+
+    // Validate inputs
+    if (enabled !== undefined && typeof enabled !== 'boolean') {
+      throw new ValidationError('enabled must be a boolean');
+    }
+    if (maxRetries !== undefined) {
+      if (!Number.isInteger(maxRetries) || maxRetries < 0 || maxRetries > 100) {
+        throw new ValidationError('maxRetries must be an integer between 0 and 100');
+      }
+    }
+    if (retryIntervalMs !== undefined) {
+      if (!Number.isInteger(retryIntervalMs) || retryIntervalMs < 0 || retryIntervalMs > 3600000) {
+        throw new ValidationError('retryIntervalMs must be an integer between 0 and 3600000');
+      }
+    }
+    if (windowMinutes !== undefined) {
+      if (!Number.isInteger(windowMinutes) || windowMinutes < 0 || windowMinutes > 1440) {
+        throw new ValidationError('windowMinutes must be an integer between 0 and 1440');
+      }
+    }
+
+    const policy = await autoRestartManager.setPolicy(serviceId, {
+      ...(enabled !== undefined && { enabled }),
+      ...(maxRetries !== undefined && { maxRetries }),
+      ...(retryIntervalMs !== undefined && { retryIntervalMs }),
+      ...(windowMinutes !== undefined && { windowMinutes }),
+    });
+
+    success(res, { policy, message: `Policy ${serviceId} saved` });
+  }, 'auto-restart-set'));
+
+  /**
+   * DELETE /auto-restart/policies/:serviceId
+   * Remove a restart policy.
+   */
+  router.delete('/policies/:serviceId', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+
+    if (!serviceId || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,100}$/.test(serviceId)) {
+      throw new ValidationError('Invalid service ID format');
+    }
+
+    const removed = await autoRestartManager.removePolicy(serviceId);
+    if (!removed) {
+      throw new NotFoundError(`Auto-restart policy for "${serviceId}"`);
+    }
+
+    success(res, { message: `Policy for "${serviceId}" removed` });
+  }, 'auto-restart-delete'));
+
+  /**
+   * POST /auto-restart/policies/:serviceId/test
+   * Dry-run: simulate a restart attempt without actually restarting.
+   * Returns what *would* happen given the current policy state.
+   */
+  router.post('/policies/:serviceId/test', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+
+    if (!serviceId || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,100}$/.test(serviceId)) {
+      throw new ValidationError('Invalid service ID format');
+    }
+
+    const policy = autoRestartManager.getPolicy(serviceId);
+    if (!policy) {
+      throw new NotFoundError(`Auto-restart policy for "${serviceId}"`);
+    }
+
+    const now = Date.now();
+    const inCooldown = policy.cooldownUntil && now < policy.cooldownUntil;
+    const wouldRetry = !inCooldown && policy.currentRetries < policy.maxRetries;
+    const nextAttempt = policy.currentRetries + 1;
+
+    success(res, {
+      dryRun: true,
+      serviceId,
+      policy: {
+        enabled: policy.enabled,
+        currentRetries: policy.currentRetries,
+        maxRetries: policy.maxRetries,
+        cooldownUntil: policy.cooldownUntil,
+        inCooldown,
+      },
+      wouldRestart: policy.enabled && wouldRetry,
+      wouldMaxOut: !wouldRetry && !inCooldown,
+      nextAttempt: wouldRetry ? nextAttempt : null,
+      message: !policy.enabled
+        ? 'Policy is disabled — no restart would occur'
+        : inCooldown
+          ? `In cooldown until ${new Date(policy.cooldownUntil).toISOString()} — would skip`
+          : wouldRetry
+            ? `Would attempt restart ${nextAttempt}/${policy.maxRetries}`
+            : `Max retries (${policy.maxRetries}) already reached — would enter cooldown`,
+    });
+  }, 'auto-restart-test'));
+
+  return router;
+};

dashcaddy-api/routes/config-drift.js

@@ -0,0 +1,92 @@
+/**
+ * Config Drift Detection Routes
+ *
+ * API endpoints for running drift detection, reading cached reports,
+ * auto-fixing drift, and controlling periodic polling.
+ *
+ * @module routes/config-drift
+ */
+
+const express = require('express');
+const { success } = require('../response-helpers');
+const { ValidationError, NotFoundError } = require('../errors');
+
+/**
+ * Config-drift route factory
+ *
+ * @param {Object} deps - Explicit dependencies
+ * @param {Object}   deps.driftDetector - ConfigDriftDetector instance
+ * @param {Function} deps.asyncHandler  - Async route handler wrapper
+ * @param {Function} deps.logError      - Error logging function
+ * @returns {express.Router}
+ */
+module.exports = function ({ driftDetector, asyncHandler, logError }) {
+  const router = express.Router();
+
+  /**
+   * GET /config-drift/report
+   * Run a fresh drift detection and return the full report.
+   */
+  router.get('/report', asyncHandler(async (_req, res) => {
+    const report = await driftDetector.detect();
+    success(res, { report });
+  }, 'drift-report'));
+
+  /**
+   * GET /config-drift/last
+   * Return the last cached drift report (no re-detection).
+   */
+  router.get('/last', asyncHandler(async (_req, res) => {
+    if (!driftDetector.lastReport) {
+      throw new NotFoundError('No cached drift report — run detection first');
+    }
+
+    success(res, { report: driftDetector.lastReport });
+  }, 'drift-last'));
+
+  /**
+   * POST /config-drift/fix
+   * Auto-fix detected drift: remove stale records, flag unknown containers.
+   */
+  router.post('/fix', asyncHandler(async (_req, res) => {
+    const result = await driftDetector.autoFix();
+    success(res, {
+      message: 'Auto-fix applied',
+      staleRemoved: result.staleRemoved,
+      unknownFlagged: result.unknownFlagged,
+    });
+  }, 'drift-fix'));
+
+  /**
+   * POST /config-drift/polling
+   * Enable or disable periodic drift detection polling.
+   *
+   * Body: { enabled: boolean, intervalMs?: number }
+   */
+  router.post('/polling', asyncHandler(async (req, res) => {
+    const { enabled, intervalMs } = req.body;
+
+    if (typeof enabled !== 'boolean') {
+      throw new ValidationError('enabled must be a boolean');
+    }
+
+    if (intervalMs !== undefined) {
+      if (!Number.isInteger(intervalMs) || intervalMs < 10000 || intervalMs > 86400000) {
+        throw new ValidationError('intervalMs must be an integer between 10000 and 86400000 (10s – 24h)');
+      }
+    }
+
+    if (enabled) {
+      driftDetector.startPolling(intervalMs || 300000);
+      success(res, {
+        message: 'Drift polling enabled',
+        intervalMs: intervalMs || 300000,
+      });
+    } else {
+      driftDetector.stopPolling();
+      success(res, { message: 'Drift polling disabled' });
+    }
+  }, 'drift-polling'));
+
+  return router;
+};

dashcaddy-api/routes/dependencies.js

@@ -0,0 +1,235 @@
+/**
+ * Dependencies Route — REST API for service dependency tracking
+ *
+ * Endpoints:
+ *  GET    /dependencies/graph                Full dependency graph
+ *  GET    /dependencies/validate             Validate a proposed dep chain
+ *  GET    /dependencies/:serviceId           Direct deps for one service
+ *  GET    /dependencies/:serviceId/chain     Ordered restart chain
+ *  GET    /dependencies/:serviceId/status    Dependency health status
+ *  POST   /dependencies/:serviceId           Set dependencies
+ *  DELETE /dependencies/:serviceId           Remove all dependencies
+ *  POST   /dependencies/:serviceId/restart   Restart with dependency chain
+ *
+ * @module routes/dependencies
+ */
+
+const express = require('express');
+const { success, error: errorResponse } = require('../response-helpers');
+const { NotFoundError, ValidationError } = require('../errors');
+
+/**
+ * Dependencies route factory
+ *
+ * @param {Object} deps - Explicit dependencies
+ * @param {Object} deps.dependencyManager - DependencyManager instance
+ * @param {Object} deps.servicesStateManager - State manager for services.json
+ * @param {Object} deps.docker - Docker client wrapper
+ * @param {Function} deps.asyncHandler - Async route handler wrapper
+ * @param {Function} deps.logError - Error logging function
+ * @param {Function} deps.resyncHealthChecker - Health checker resync function
+ * @param {Object} deps.log - Logger instance
+ * @returns {express.Router}
+ */
+module.exports = function({
+  dependencyManager,
+  servicesStateManager,
+  docker,
+  asyncHandler,
+  logError,
+  resyncHealthChecker,
+  log,
+}) {
+  const router = express.Router();
+
+  // -------------------------------------------------------------------------
+  // GET /dependencies/graph — Full dependency graph
+  // -------------------------------------------------------------------------
+  router.get('/graph', asyncHandler(async (req, res) => {
+    const graph = await dependencyManager.getDependencyGraph();
+    success(res, { graph });
+  }, 'dep-graph'));
+
+  // -------------------------------------------------------------------------
+  // GET /dependencies/validate — Validate a proposed dep chain (query params)
+  // -------------------------------------------------------------------------
+  router.get('/validate', asyncHandler(async (req, res) => {
+    const { serviceId, dependsOn } = req.query;
+
+    if (!serviceId) {
+      throw new ValidationError('serviceId query parameter is required');
+    }
+
+    // dependsOn may be a comma-separated string or already an array
+    let parsed;
+    if (Array.isArray(dependsOn)) {
+      parsed = dependsOn;
+    } else if (typeof dependsOn === 'string' && dependsOn.length > 0) {
+      parsed = dependsOn.split(',').map(s => s.trim()).filter(Boolean);
+    } else {
+      parsed = [];
+    }
+
+    const result = await dependencyManager.validateDependencies(serviceId, parsed);
+    success(res, result);
+  }, 'dep-validate'));
+
+  // -------------------------------------------------------------------------
+  // GET /dependencies/:serviceId — Direct deps for one service
+  // -------------------------------------------------------------------------
+  router.get('/:serviceId', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+    const dependencies = await dependencyManager.getDependencies(serviceId);
+    const dependents = await dependencyManager.getDependents(serviceId);
+
+    // Read the service's current dependsOn array
+    const services = await servicesStateManager.read();
+    const allServices = Array.isArray(services) ? services : (services.services || []);
+    const service = allServices.find(s => s.id === serviceId);
+
+    if (!service) {
+      throw new NotFoundError(`Service "${serviceId}"`);
+    }
+
+    success(res, {
+      serviceId,
+      dependsOn: service.dependsOn || [],
+      dependencies,
+      dependents: dependents.map(d => ({ id: d.id, name: d.name })),
+    });
+  }, 'dep-get'));
+
+  // -------------------------------------------------------------------------
+  // GET /dependencies/:serviceId/chain — Ordered restart chain
+  // -------------------------------------------------------------------------
+  router.get('/:serviceId/chain', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+    const chain = await dependencyManager.getOrderedRestartChain(serviceId);
+    success(res, { serviceId, chain });
+  }, 'dep-chain'));
+
+  // -------------------------------------------------------------------------
+  // GET /dependencies/:serviceId/status — Dependency health status
+  // -------------------------------------------------------------------------
+  router.get('/:serviceId/status', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+    const statuses = await dependencyManager.getDependencyStatus(serviceId);
+    success(res, { serviceId, statuses });
+  }, 'dep-status'));
+
+  // -------------------------------------------------------------------------
+  // POST /dependencies/:serviceId — Set dependencies
+  // -------------------------------------------------------------------------
+  router.post('/:serviceId', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+    const { dependsOn } = req.body;
+
+    if (!Array.isArray(dependsOn)) {
+      throw new ValidationError('Request body must include dependsOn as an array of service IDs');
+    }
+
+    // Validate first
+    const validation = await dependencyManager.validateDependencies(serviceId, dependsOn);
+    if (!validation.valid) {
+      return errorResponse(res, validation.errors.join('; '), 400);
+    }
+
+    // Update the service
+    let found = false;
+    await servicesStateManager.update(services => {
+      const arr = Array.isArray(services) ? services : [];
+      return arr.map(s => {
+        if (s.id === serviceId) {
+          found = true;
+          return { ...s, dependsOn: dependsOn.slice() };
+        }
+        return s;
+      });
+    });
+
+    if (!found) {
+      throw new NotFoundError(`Service "${serviceId}"`);
+    }
+
+    log.info('dependency', 'Dependencies updated', { serviceId, dependsOn });
+
+    success(res, {
+      message: `Dependencies updated for "${serviceId}"`,
+      serviceId,
+      dependsOn,
+    });
+  }, 'dep-set'));
+
+  // -------------------------------------------------------------------------
+  // DELETE /dependencies/:serviceId — Remove all dependencies for a service
+  // -------------------------------------------------------------------------
+  router.delete('/:serviceId', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+
+    let found = false;
+    await servicesStateManager.update(services => {
+      const arr = Array.isArray(services) ? services : [];
+      return arr.map(s => {
+        if (s.id === serviceId) {
+          found = true;
+          const updated = { ...s };
+          delete updated.dependsOn;
+          return updated;
+        }
+        return s;
+      });
+    });
+
+    if (!found) {
+      throw new NotFoundError(`Service "${serviceId}"`);
+    }
+
+    log.info('dependency', 'Dependencies removed', { serviceId });
+
+    success(res, {
+      message: `All dependencies removed for "${serviceId}"`,
+      serviceId,
+    });
+  }, 'dep-delete'));
+
+  // -------------------------------------------------------------------------
+  // POST /dependencies/:serviceId/restart — Restart with dependency chain
+  // -------------------------------------------------------------------------
+  router.post('/:serviceId/restart', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+
+    // Verify the service exists
+    const services = await servicesStateManager.read();
+    const allServices = Array.isArray(services) ? services : (services.services || []);
+    if (!allServices.find(s => s.id === serviceId)) {
+      throw new NotFoundError(`Service "${serviceId}"`);
+    }
+
+    // Get the chain first for the response (before async restart begins)
+    let chain;
+    try {
+      chain = await dependencyManager.getOrderedRestartChain(serviceId);
+    } catch (err) {
+      return errorResponse(res, err.message, 400);
+    }
+
+    // Respond immediately with the chain order
+    success(res, {
+      message: `Dependency restart initiated for "${serviceId}"`,
+      serviceId,
+      chain,
+    });
+
+    // Run the restart chain asynchronously so the client doesn't block
+    dependencyManager.restartWithDependencies(serviceId).catch(err => {
+      if (log) {
+        log.error('dependency', 'Async dependency restart failed', {
+          serviceId,
+          error: err.message,
+        });
+      }
+    });
+  }, 'dep-restart'));
+
+  return router;
+};

dashcaddy-api/routes/dns.js

@@ -26,7 +26,8 @@ module.exports = function({
   log,
   safeErrorMessage,
   fetchT,
-  credentialManager
+  credentialManager,
+  dnsPropagationChecker
 }) {
   const router = express.Router();
 
@@ -139,6 +140,14 @@ module.exports = function({
       });
 
       if (result.status === 'ok') {
+        // Start DNS propagation verification in background
+        if (dnsPropagationChecker && ip) {
+          const fullDomain = domain;
+          dnsPropagationChecker.startVerification(fullDomain, ip).catch(err => {
+            log('DNS propagation check start failed:', err.message);
+          });
+        }
+
         success(res, { message: `DNS record ${domain} -> ${ip} created` });
       } else {
         // Error handled by middleware
@@ -641,5 +650,68 @@ module.exports = function({
     }
   }, 'dns-update'));
 
+  // ===== DNS PROPAGATION =====
+
+  // GET /propagation — Get all recent DNS propagation checks
+  router.get('/propagation', asyncHandler(async (req, res) => {
+    if (!dnsPropagationChecker) {
+      return success(res, { verifications: [], message: 'DNS propagation checker not available' });
+    }
+
+    // Cleanup old entries
+    dnsPropagationChecker.cleanup();
+
+    const verifications = dnsPropagationChecker.getAllVerifications();
+    success(res, { verifications });
+  }, 'dns-propagation-all'));
+
+  // POST /propagation/verify — Manually trigger DNS propagation verification
+  router.post('/propagation/verify', asyncHandler(async (req, res) => {
+    if (!dnsPropagationChecker) {
+      return errorResponse(res, 'DNS propagation checker not available', 503);
+    }
+
+    const { domain, expectedIp } = req.body;
+
+    if (!domain || !expectedIp) {
+      throw new ValidationError('domain and expectedIp are required');
+    }
+
+    // Validate domain format
+    if (!REGEX.DOMAIN.test(domain)) {
+      throw new ValidationError('[DC-301] Invalid domain format');
+    }
+
+    // Validate IP address
+    const validatorLib = require('validator');
+    if (!validatorLib.isIP(expectedIp)) {
+      throw new ValidationError('[DC-210] Invalid IP address');
+    }
+
+    const job = dnsPropagationChecker.startVerification(domain, expectedIp);
+    success(res, {
+      message: 'DNS propagation verification started',
+      domain,
+      expectedIp,
+      status: job.status
+    });
+  }, 'dns-propagation-verify'));
+
+  // GET /propagation/:domain — Get propagation status for a specific domain
+  router.get('/propagation/:domain', asyncHandler(async (req, res) => {
+    if (!dnsPropagationChecker) {
+      return success(res, { verification: null, message: 'DNS propagation checker not available' });
+    }
+
+    const { domain } = req.params;
+    const status = dnsPropagationChecker.getVerificationStatus(domain);
+
+    if (!status) {
+      throw new NotFoundError(`No propagation check found for domain: ${domain}`);
+    }
+
+    success(res, { verification: status });
+  }, 'dns-propagation-domain'));
+
   return router;
 };

dashcaddy-api/routes/events.js

@@ -8,9 +8,10 @@ const express = require('express');
  * @param {Object} deps.healthChecker - Health checker
  * @param {Object} deps.updateManager - Update manager
  * @param {Function} deps.logError - Error logging function
+ * @param {Object} deps.dependencyManager - Dependency manager for restart chain events
  * @returns {express.Router}
  */
-module.exports = function({ resourceMonitor, healthChecker, updateManager, logError }) {
+module.exports = function({ resourceMonitor, healthChecker, updateManager, logError, dependencyManager, autoRestartManager, driftDetector, sslMonitor, dnsPropagationChecker }) {
   const router = express.Router();
   const clients = new Set();
 
@@ -74,6 +75,48 @@ module.exports = function({ resourceMonitor, healthChecker, updateManager, logEr
     });
   }
 
+  // Dependency manager events
+  if (dependencyManager) {
+    dependencyManager.on('dependency-restart-start', (data) => {
+      broadcast('dependency-restart-start', data);
+    });
+    dependencyManager.on('dependency-restart-progress', (data) => {
+      broadcast('dependency-restart-progress', data);
+    });
+    dependencyManager.on('dependency-restart-complete', (data) => {
+      broadcast('dependency-restart-complete', data);
+    });
+    dependencyManager.on('dependency-restart-failed', (data) => {
+      broadcast('dependency-restart-failed', data);
+    });
+  }
+
+  // Auto-restart manager events
+  if (autoRestartManager) {
+    autoRestartManager.on('auto-restart-attempt', (data) => broadcast('auto-restart-attempt', data));
+    autoRestartManager.on('auto-restart-success', (data) => broadcast('auto-restart-success', data));
+    autoRestartManager.on('auto-restart-failed', (data) => broadcast('auto-restart-failed', data));
+    autoRestartManager.on('auto-restart-max-reached', (data) => broadcast('auto-restart-max-reached', data));
+  }
+
+  // Config drift detector events
+  if (driftDetector) {
+    driftDetector.on('drift-detected', (data) => broadcast('drift-detected', data));
+  }
+
+  // SSL monitor events
+  if (sslMonitor) {
+    sslMonitor.on('cert-expiring', (data) => broadcast('cert-expiring', data));
+    sslMonitor.on('cert-critical', (data) => broadcast('cert-critical', data));
+  }
+
+  // DNS propagation checker events
+  if (dnsPropagationChecker) {
+    dnsPropagationChecker.on('propagation-check', (data) => broadcast('dns-propagation-check', data));
+    dnsPropagationChecker.on('propagation-complete', (data) => broadcast('dns-propagation-complete', data));
+    dnsPropagationChecker.on('propagation-timeout', (data) => broadcast('dns-propagation-timeout', data));
+  }
+
   // SSE endpoint
   router.get('/stream', (req, res) => {
     res.writeHead(200, {

dashcaddy-api/routes/services.js

@@ -372,7 +372,7 @@ module.exports = function({
   // Add a new service
   router.post('/services', asyncHandler(async (req, res) => {
     try {
-      const { id, name, logo } = req.body;
+      const { id, name, logo, category, containerId, port, ip, tailscaleOnly } = req.body;
 
       if (!id || !name) {
         throw new ValidationError('id and name are required');
@@ -391,7 +391,14 @@ module.exports = function({
           throw new ConflictError(`Service "${id}" already exists`, id);
         }
 
-        services.push({ id, name, logo: logo || `/assets/${id}.png` });
+        const newService = { id, name, logo: logo || `/assets/${id}.png` };
+        // Persist optional metadata fields if provided
+        if (category) newService.category = category;
+        if (containerId) newService.containerId = containerId;
+        if (port) newService.port = port;
+        if (ip) newService.ip = ip;
+        if (typeof tailscaleOnly === 'boolean') newService.tailscaleOnly = tailscaleOnly;
+        services.push(newService);
         return services;
       });
 
@@ -542,6 +549,8 @@ module.exports = function({
           };
           if (name) services[serviceIndex].name = name;
           if (logo) services[serviceIndex].logo = logo;
+          // Allow category update via update endpoint too (optional body field)
+          if (req.body.category !== undefined) services[serviceIndex].category = req.body.category || undefined;
           results.services = 'updated';
         } else {
           results.services = 'not found';

dashcaddy-api/routes/ssl-monitor.js

@@ -0,0 +1,113 @@
+/**
+ * SSL Monitor Routes
+ * REST API endpoints for SSL certificate monitoring.
+ *
+ * @module routes/ssl-monitor
+ */
+
+const express = require('express');
+const { success, error: errorResponse, notFound } = require('../response-helpers');
+
+/**
+ * SSL Monitor route factory
+ * @param {Object} deps - Explicit dependencies
+ * @param {Object} deps.sslMonitor - SSLMonitor instance
+ * @param {Function} deps.asyncHandler - Async route handler wrapper
+ * @param {Function} deps.logError - Error logging function
+ * @returns {express.Router}
+ */
+module.exports = function({ sslMonitor, asyncHandler, logError }) {
+  const router = express.Router();
+
+  /**
+   * GET /ssl/certificates
+   * Get all SSL certificate statuses
+   */
+  router.get('/certificates', asyncHandler(async (req, res) => {
+    const status = sslMonitor.getStatus();
+    success(res, { certificates: status });
+  }, 'ssl-certificates'));
+
+  /**
+   * GET /ssl/certificates/:serviceId
+   * Get SSL certificate status for a specific service
+   */
+  router.get('/certificates/:serviceId', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+    const certStatus = sslMonitor.getServiceCertStatus(serviceId);
+
+    if (!certStatus) {
+      return notFound(res, `No SSL certificate status found for service: ${serviceId}`);
+    }
+
+    success(res, { certificate: certStatus });
+  }, 'ssl-certificate-service'));
+
+  /**
+   * POST /ssl/check
+   * Trigger an on-demand check of all SSL certificates
+   */
+  router.post('/check', asyncHandler(async (req, res) => {
+    const results = await sslMonitor.checkAll();
+    success(res, { certificates: results, message: 'SSL check completed' });
+  }, 'ssl-check-all'));
+
+  /**
+   * POST /ssl/check/:serviceId
+   * Check the SSL certificate for a specific service
+   */
+  router.post('/check/:serviceId', asyncHandler(async (req, res) => {
+    const { serviceId } = req.params;
+
+    // Look up the existing cert status to find the hostname
+    const existingCert = sslMonitor.getServiceCertStatus(serviceId);
+    if (!existingCert) {
+      return notFound(res, `No HTTPS URL found for service: ${serviceId}`);
+    }
+
+    try {
+      const result = await sslMonitor.checkCert(existingCert.hostname, existingCert.port);
+      success(res, { certificate: { ...result, serviceId } });
+    } catch (err) {
+      errorResponse(res, `Failed to check SSL certificate: ${err.message}`, 500);
+    }
+  }, 'ssl-check-service'));
+
+  /**
+   * GET /ssl/config
+   * Get current SSL monitoring configuration
+   */
+  router.get('/config', asyncHandler(async (req, res) => {
+    const config = sslMonitor.getConfig();
+    success(res, { config });
+  }, 'ssl-config-get'));
+
+  /**
+   * POST /ssl/config
+   * Update SSL monitoring configuration
+   * Body: { enabled: boolean, intervalMs: number }
+   */
+  router.post('/config', asyncHandler(async (req, res) => {
+    const { enabled, intervalMs } = req.body;
+
+    // Validate inputs
+    if (enabled !== undefined && typeof enabled !== 'boolean') {
+      return errorResponse(res, 'enabled must be a boolean', 400);
+    }
+    if (intervalMs !== undefined) {
+      if (typeof intervalMs !== 'number' || intervalMs < 60000) {
+        return errorResponse(res, 'intervalMs must be a number >= 60000 (1 minute)', 400);
+      }
+    }
+
+    const updates = {};
+    if (enabled !== undefined) updates.enabled = enabled;
+    if (intervalMs !== undefined) updates.intervalMs = intervalMs;
+
+    sslMonitor.updateConfig(updates);
+    const config = sslMonitor.getConfig();
+    success(res, { config, message: 'SSL monitoring config updated' });
+  }, 'ssl-config-update'));
+
+  return router;
+};

dashcaddy-api/src/app.js

@@ -39,6 +39,13 @@ let dockerMaintenance, logDigest;
 try { dockerMaintenance = require('../docker-maintenance'); } catch (_) { /* optional module */ }
 try { logDigest = require('../log-digest'); } catch (_) { /* optional module */ }
 
+// Workflow engine (bundled workflows)
+let bundledWorkflowsModule;
+let workflowEngine = null;
+try { 
+  bundledWorkflowsModule = require('../bundled-workflows'); 
+} catch (_) { /* optional module */ }
+
 // Templates
 const { APP_TEMPLATES, TEMPLATE_CATEGORIES, DIFFICULTY_LEVELS } = require('../app-templates');
 const { RECIPE_TEMPLATES, RECIPE_CATEGORIES } = require('../recipe-templates');
@@ -69,6 +76,16 @@ const recipesRoutes = require('../routes/recipes');
 const themesRoutes = require('../routes/themes');
 const dockerResourcesRoutes = require('../routes/docker-resources');
 const eventsRoutes = require('../routes/events');
+const workflowsRoutes = require('../routes/workflows');
+const dependenciesRoutes = require('../routes/dependencies');
+const DependencyManager = require('../dependency-manager');
+const autoRestartRoutes = require('../routes/auto-restart');
+const configDriftRoutes = require('../routes/config-drift');
+const sslMonitorRoutes = require('../routes/ssl-monitor');
+const { AutoRestartManager } = require('../auto-restart-manager');
+const { ConfigDriftDetector } = require('../config-drift-detector');
+const { SSLMonitor } = require('../ssl-monitor');
+const { DNSPropagationChecker } = require('../dns-propagation');
 
 // Constants
 const { APP } = require('../constants');
@@ -308,9 +325,88 @@ async function createApp() {
     app,
   });
 
+  // Initialize workflow engine if bundled-workflows is available
+  if (bundledWorkflowsModule && ctx.docker) {
+    try {
+      const { WorkflowEngine } = bundledWorkflowsModule;
+      const workflowCtx = {
+        docker: ctx.docker,
+        notification: ctx.notification,
+        backupManager: ctx.backupManager,
+        resourceMonitor: ctx.resourceMonitor,
+        servicesStateManager: ctx.servicesStateManager
+      };
+      workflowEngine = new WorkflowEngine(workflowCtx);
+      ctx.workflowEngine = workflowEngine;
+      log.info('app', 'Workflow engine initialized');
+    } catch (err) {
+      log.error('app', 'Failed to initialize workflow engine', { error: err.message });
+    }
+  }
+
+  // Initialize dependency manager
+  const dependencyManager = new DependencyManager({
+    servicesStateManager,
+    docker: ctx.docker,
+    notification: ctx.notification,
+    log,
+  });
+  ctx.dependencyManager = dependencyManager;
+  log.info('app', 'Dependency manager initialized');
+
+  // Initialize auto-restart manager
+  const autoRestartManager = new AutoRestartManager(ctx);
+  ctx.autoRestartManager = autoRestartManager;
+  autoRestartManager.start();
+  log.info('app', 'Auto-restart manager initialized');
+
+  // Initialize config drift detector
+  const driftDetector = new ConfigDriftDetector(ctx);
+  ctx.driftDetector = driftDetector;
+  driftDetector.startPolling(300000); // 5 min
+  log.info('app', 'Config drift detector initialized');
+
+  // Initialize SSL monitor
+  const sslMonitor = new SSLMonitor(ctx);
+  ctx.sslMonitor = sslMonitor;
+  sslMonitor.start(3600000); // 1 hour
+  log.info('app', 'SSL monitor initialized');
+
+  // Initialize DNS propagation checker
+  const dnsPropagationChecker = new DNSPropagationChecker(ctx);
+  ctx.dnsPropagationChecker = dnsPropagationChecker;
+  log.info('app', 'DNS propagation checker initialized');
+
   // Build versioned API router
   const apiRouter = express.Router();
-  
+
+  // Wire up notification listeners for resourceMonitor and backupManager
+  if (ctx.notification && ctx.resourceMonitor) {
+    ctx.resourceMonitor.on('alert', (alertData) => {
+      ctx.notification.sendAlert(alertData).catch(err => {
+        log.error('notification', 'Failed to send alert', { error: err.message });
+      });
+    });
+    ctx.resourceMonitor.on('auto-restart', (data) => {
+      ctx.notification.sendServiceEvent('auto-restart', data).catch(err => {
+        log.error('notification', 'Failed to send auto-restart notification', { error: err.message });
+      });
+    });
+  }
+
+  if (ctx.notification && ctx.backupManager) {
+    ctx.backupManager.on('backup-complete', (data) => {
+      ctx.notification.send('backup-complete', data).catch(err => {
+        log.error('notification', 'Failed to send backup-complete', { error: err.message });
+      });
+    });
+    ctx.backupManager.on('backup-failed', (data) => {
+      ctx.notification.send('backup-failed', data).catch(err => {
+        log.error('notification', 'Failed to send backup-failed', { error: err.message });
+      });
+    });
+  }
+
   // Mount route modules
   apiRouter.use(authRoutes(ctx));
   apiRouter.use(configRoutes(ctx));
@@ -321,7 +417,8 @@ async function createApp() {
     log: ctx.log,
     safeErrorMessage: ctx.safeErrorMessage,
     fetchT: ctx.fetchT,
-    credentialManager: ctx.credentialManager
+    credentialManager: ctx.credentialManager,
+    dnsPropagationChecker: ctx.dnsPropagationChecker
   }));
   apiRouter.use('/notifications', notificationRoutes({
     notification: ctx.notification,
@@ -330,7 +427,8 @@ async function createApp() {
   apiRouter.use('/containers', containerRoutes({
     docker: ctx.docker,
     log: ctx.log,
-    asyncHandler: ctx.asyncHandler
+    asyncHandler: ctx.asyncHandler,
+    workflowEngine: ctx.workflowEngine
   }));
   apiRouter.use(serviceRoutes({
     servicesStateManager: ctx.servicesStateManager,
@@ -361,7 +459,8 @@ async function createApp() {
     resourceMonitor: ctx.resourceMonitor,
     docker: ctx.docker,
     asyncHandler: ctx.asyncHandler,
-    log: ctx.log
+    log: ctx.log,
+    notificationManager: ctx.notification
   }));
   apiRouter.use(updatesRoutes({
     updateManager: ctx.updateManager,
@@ -404,8 +503,8 @@ async function createApp() {
   }));
   apiRouter.use(backupsRoutes({
     backupManager: ctx.backupManager,
-    asyncHandler: ctx.asyncHandler,
-    licenseManager: ctx.licenseManager
+    licenseManager: ctx.licenseManager,
+    asyncHandler: ctx.asyncHandler
   }));
   apiRouter.use('/ca', caRoutes(ctx));
   apiRouter.use(browseRoutes({
@@ -433,7 +532,41 @@ async function createApp() {
     resourceMonitor: ctx.resourceMonitor,
     healthChecker: ctx.healthChecker,
     updateManager: ctx.updateManager,
-    logError: ctx.logError
+    logError: ctx.logError,
+    dependencyManager: ctx.dependencyManager,
+    autoRestartManager: ctx.autoRestartManager,
+    driftDetector: ctx.driftDetector,
+    sslMonitor: ctx.sslMonitor,
+    dnsPropagationChecker: ctx.dnsPropagationChecker
+  }));
+  apiRouter.use(workflowsRoutes({
+    workflowEngine: ctx.workflowEngine,
+    licenseManager: ctx.licenseManager,
+    asyncHandler: ctx.asyncHandler
+  }));
+  apiRouter.use('/dependencies', dependenciesRoutes({
+    dependencyManager: ctx.dependencyManager,
+    servicesStateManager: ctx.servicesStateManager,
+    docker: ctx.docker,
+    asyncHandler: ctx.asyncHandler,
+    logError: ctx.logError,
+    resyncHealthChecker: ctx.resyncHealthChecker,
+    log: ctx.log,
+  }));
+  apiRouter.use(autoRestartRoutes({
+    autoRestartManager: ctx.autoRestartManager,
+    asyncHandler: ctx.asyncHandler,
+    logError: ctx.logError,
+  }));
+  apiRouter.use(configDriftRoutes({
+    driftDetector: ctx.driftDetector,
+    asyncHandler: ctx.asyncHandler,
+    logError: ctx.logError,
+  }));
+  apiRouter.use(sslMonitorRoutes({
+    sslMonitor: ctx.sslMonitor,
+    asyncHandler: ctx.asyncHandler,
+    logError: ctx.logError,
   }));
 
   // Inline API routes

dashcaddy-api/ssl-monitor.js

@@ -0,0 +1,411 @@
+/**
+ * SSL Certificate Monitor
+ * Periodically checks SSL certificates on services with HTTPS URLs.
+ * Alerts at 30, 14, and 7 days before expiry.
+ *
+ * @module ssl-monitor
+ */
+
+const tls = require('tls');
+const EventEmitter = require('events');
+const path = require('path');
+const { readJsonFile, writeJsonFile } = require('./fs-helpers');
+const { resolveServiceUrl } = require('./url-resolver');
+
+/** Default check interval: 1 hour */
+const DEFAULT_INTERVAL_MS = 3600000;
+
+/** Alert thresholds in days */
+const THRESHOLDS = {
+  WARNING: 30,
+  URGENT: 14,
+  CRITICAL: 7
+};
+
+/** TLS connection timeout in milliseconds */
+const TLS_TIMEOUT_MS = 10000;
+
+class SSLMonitor extends EventEmitter {
+  /**
+   * Create an SSLMonitor instance.
+   * @param {Object} ctx - Shared application context
+   * @param {Object} ctx.servicesStateManager - State manager for reading services
+   * @param {Function} ctx.buildServiceUrl - URL builder helper
+   * @param {Object} ctx.siteConfig - Site configuration
+   * @param {Object} ctx.notification - NotificationManager instance
+   * @param {Object} ctx.log - Logger instance
+   * @param {string} [ctx.SSL_CACHE_FILE] - Path to persist SSL cache
+   */
+  constructor(ctx) {
+    super();
+    this.ctx = ctx;
+    this.log = ctx.log || console;
+
+    /** @type {Map<string, Object>} hostname → last cert check result */
+    this.certStatus = new Map();
+
+    /** @type {Map<string, number>} hostname → last notified threshold level */
+    this.notifiedThresholds = new Map();
+
+    /** @type {Map<string, string>} hostname → service ID mapping */
+    this.hostnameToServiceId = new Map();
+
+    /** @type {NodeJS.Timeout|null} */
+    this.intervalHandle = null;
+
+    /** Current config */
+    this.config = {
+      enabled: true,
+      intervalMs: DEFAULT_INTERVAL_MS
+    };
+
+    /** Cache file path */
+    this.cacheFile = ctx.SSL_CACHE_FILE ||
+      path.join(path.dirname(ctx.SERVICES_FILE || './data'), 'ssl-cache.json');
+  }
+
+  /**
+   * Check the SSL certificate for a given hostname and port.
+   * Connects via TLS with rejectUnauthorized: false to retrieve certificate info.
+   *
+   * @param {string} hostname - The hostname to check
+   * @param {number} [port=443] - The port to connect to
+   * @returns {Promise<Object>} Certificate information
+   */
+  async checkCert(hostname, port = 443) {
+    return new Promise((resolve, reject) => {
+      const socket = tls.connect({
+        host: hostname,
+        port,
+        rejectUnauthorized: false,
+        servername: hostname,
+        timeout: TLS_TIMEOUT_MS
+      }, () => {
+        try {
+          const cert = socket.getPeerCertificate();
+
+          if (!cert || Object.keys(cert).length === 0) {
+            socket.destroy();
+            return reject(new Error(`No certificate returned for ${hostname}:${port}`));
+          }
+
+          const validFrom = new Date(cert.valid_from);
+          const validTo = new Date(cert.valid_to);
+          const now = new Date();
+          const msRemaining = validTo.getTime() - now.getTime();
+          const daysRemaining = Math.ceil(msRemaining / (1000 * 60 * 60 * 24));
+
+          const result = {
+            hostname,
+            port,
+            subject: cert.subject?.CN || cert.subject?.O || 'Unknown',
+            issuer: cert.issuer?.CN || cert.issuer?.O || 'Unknown',
+            validFrom: cert.valid_from,
+            validTo: cert.valid_to,
+            daysRemaining,
+            fingerprint: cert.fingerprint || null,
+            isExpiring: daysRemaining <= THRESHOLDS.WARNING,
+            checkedAt: new Date().toISOString()
+          };
+
+          socket.destroy();
+          resolve(result);
+        } catch (err) {
+          socket.destroy();
+          reject(err);
+        }
+      });
+
+      socket.on('error', (err) => {
+        reject(new Error(`TLS connect error for ${hostname}:${port}: ${err.message}`));
+      });
+
+      socket.setTimeout(TLS_TIMEOUT_MS, () => {
+        socket.destroy(new Error(`TLS connection timeout for ${hostname}:${port}`));
+        reject(new Error(`TLS connection timeout for ${hostname}:${port}`));
+      });
+    });
+  }
+
+  /**
+   * Check SSL certificates for all services that have HTTPS URLs.
+   * Reads services from ctx.servicesStateManager, resolves URLs, and checks each HTTPS cert.
+   *
+   * @returns {Promise<Object>} Map of hostname → cert status
+   */
+  async checkAll() {
+    if (!this.config.enabled) {
+      this.log.info('ssl-monitor', 'SSL monitoring is disabled, skipping check');
+      return this.getStatus();
+    }
+
+    let servicesData;
+    try {
+      servicesData = await this.ctx.servicesStateManager.read();
+    } catch (err) {
+      this.log.error('ssl-monitor', 'Failed to read services', { error: err.message });
+      return this.getStatus();
+    }
+
+    const services = Array.isArray(servicesData) ? servicesData : (servicesData.services || []);
+
+    for (const service of services) {
+      const serviceId = service.id || service.name?.toLowerCase();
+      if (!serviceId) continue;
+
+      try {
+        const url = resolveServiceUrl(serviceId, service, this.ctx.siteConfig, this.ctx.buildServiceUrl);
+        if (!url) continue;
+
+        const parsed = new URL(url);
+        if (parsed.protocol !== 'https:') continue;
+
+        const hostname = parsed.hostname;
+        const port = parseInt(parsed.port) || 443;
+
+        // Map hostname back to service ID
+        this.hostnameToServiceId.set(hostname, serviceId);
+
+        const result = await this.checkCert(hostname, port);
+
+        // Store result
+        this.certStatus.set(hostname, result);
+
+        // Emit check event
+        this.emit('cert-check', { serviceId, hostname, result });
+
+        // Check alert thresholds
+        await this._checkAndNotify(hostname, result, serviceId);
+      } catch (err) {
+        this.log.warn('ssl-monitor', `Failed to check cert for service ${serviceId}`, {
+          error: err.message
+        });
+      }
+    }
+
+    // Persist results
+    await this._saveCache();
+
+    return this.getStatus();
+  }
+
+  /**
+   * Start periodic SSL certificate checking.
+   *
+   * @param {number} [intervalMs=3600000] - Check interval in milliseconds
+   */
+  start(intervalMs) {
+    if (intervalMs !== undefined) {
+      this.config.intervalMs = intervalMs;
+    }
+    if (this.intervalHandle) {
+      this.log.warn('ssl-monitor', 'SSL monitor is already running');
+      return;
+    }
+
+    this.config.enabled = true;
+
+    // Load cached data
+    this._loadCache().catch(err => {
+      this.log.warn('ssl-monitor', 'Failed to load SSL cache', { error: err.message });
+    });
+
+    // Initial check (non-blocking)
+    this.checkAll().catch(err => {
+      this.log.error('ssl-monitor', 'Initial SSL check failed', { error: err.message });
+    });
+
+    // Schedule periodic checks
+    this.intervalHandle = setInterval(() => {
+      this.checkAll().catch(err => {
+        this.log.error('ssl-monitor', 'Periodic SSL check failed', { error: err.message });
+      });
+    }, this.config.intervalMs);
+
+    this.log.info('ssl-monitor', 'SSL monitoring started', {
+      intervalMs: this.config.intervalMs
+    });
+  }
+
+  /**
+   * Stop periodic SSL certificate checking.
+   */
+  stop() {
+    if (this.intervalHandle) {
+      clearInterval(this.intervalHandle);
+      this.intervalHandle = null;
+    }
+    this.config.enabled = false;
+    this.log.info('ssl-monitor', 'SSL monitoring stopped');
+  }
+
+  /**
+   * Get the current SSL certificate status for all checked hostnames.
+   *
+   * @returns {Object} Map of hostname → cert status
+   */
+  getStatus() {
+    const status = {};
+    for (const [hostname, cert] of this.certStatus.entries()) {
+      status[hostname] = { ...cert };
+    }
+    return status;
+  }
+
+  /**
+   * Get the SSL certificate status for a specific service.
+   *
+   * @param {string} serviceId - The service ID to look up
+   * @returns {Object|null} Certificate status or null if not found
+   */
+  getServiceCertStatus(serviceId) {
+    // Find hostname mapped to this service
+    for (const [hostname, id] of this.hostnameToServiceId.entries()) {
+      if (id === serviceId) {
+        const cert = this.certStatus.get(hostname);
+        return cert ? { ...cert, serviceId } : null;
+      }
+    }
+    return null;
+  }
+
+  /**
+   * Get current monitoring configuration.
+   *
+   * @returns {Object} Config with interval and enabled state
+   */
+  getConfig() {
+    return { ...this.config };
+  }
+
+  /**
+   * Update monitoring configuration.
+   *
+   * @param {Object} updates - Config updates
+   * @param {boolean} [updates.enabled] - Enable/disable monitoring
+   * @param {number} [updates.intervalMs] - Check interval in milliseconds
+   */
+  updateConfig(updates) {
+    if (typeof updates.enabled === 'boolean') {
+      this.config.enabled = updates.enabled;
+      if (!updates.enabled && this.intervalHandle) {
+        this.stop();
+      }
+    }
+    if (typeof updates.intervalMs === 'number' && updates.intervalMs >= 60000) {
+      this.config.intervalMs = updates.intervalMs;
+      // Restart interval if running
+      if (this.intervalHandle) {
+        clearInterval(this.intervalHandle);
+        this.intervalHandle = setInterval(() => {
+          this.checkAll().catch(err => {
+            this.log.error('ssl-monitor', 'Periodic SSL check failed', { error: err.message });
+          });
+        }, this.config.intervalMs);
+      }
+    }
+  }
+
+  // ===== Private Methods =====
+
+  /**
+   * Check alert thresholds and send notifications if thresholds are crossed.
+   * Only sends one notification per threshold per hostname.
+   *
+   * @param {string} hostname
+   * @param {Object} certResult
+   * @param {string} serviceId
+   */
+  async _checkAndNotify(hostname, certResult, serviceId) {
+    const { daysRemaining } = certResult;
+    const key = hostname;
+    const lastNotified = this.notifiedThresholds.get(key) || Infinity;
+
+    let level = null;
+    let eventType = null;
+    let message = null;
+
+    if (daysRemaining <= THRESHOLDS.CRITICAL) {
+      level = THRESHOLDS.CRITICAL;
+      eventType = 'cert-critical';
+      message = `🔒 CRITICAL: SSL certificate for ${hostname} expires in ${daysRemaining} days!`;
+    } else if (daysRemaining <= THRESHOLDS.URGENT) {
+      level = THRESHOLDS.URGENT;
+      eventType = 'cert-expiring';
+      message = `⚠️ URGENT: SSL certificate for ${hostname} expires in ${daysRemaining} days`;
+    } else if (daysRemaining <= THRESHOLDS.WARNING) {
+      level = THRESHOLDS.WARNING;
+      eventType = 'cert-expiring';
+      message = `⚠️ SSL certificate for ${hostname} expires in ${daysRemaining} days`;
+    }
+
+    if (level !== null && level < lastNotified) {
+      // New threshold crossed — send notification
+      this.notifiedThresholds.set(key, level);
+      this.emit(eventType, { hostname, serviceId, daysRemaining, level });
+
+      if (this.ctx.notification) {
+        try {
+          await this.ctx.notification.send('ssl-cert-expiry', {
+            text: message,
+            hostname,
+            serviceId,
+            daysRemaining,
+            level,
+            validTo: certResult.validTo
+          }, level <= THRESHOLDS.CRITICAL ? 'error' : 'warning');
+        } catch (err) {
+          this.log.error('ssl-monitor', 'Failed to send SSL notification', { error: err.message });
+        }
+      }
+    } else if (level === null) {
+      // Cert is healthy — reset notification tracking
+      this.notifiedThresholds.delete(key);
+    }
+  }
+
+  /**
+   * Persist cert status cache to disk.
+   */
+  async _saveCache() {
+    try {
+      const data = {
+        lastChecked: new Date().toISOString(),
+        certs: {},
+        hostnameToServiceId: Object.fromEntries(this.hostnameToServiceId)
+      };
+      for (const [hostname, cert] of this.certStatus.entries()) {
+        data.certs[hostname] = cert;
+      }
+      await writeJsonFile(this.cacheFile, data);
+    } catch (err) {
+      this.log.warn('ssl-monitor', 'Failed to save SSL cache', { error: err.message });
+    }
+  }
+
+  /**
+   * Load cert status cache from disk.
+   */
+  async _loadCache() {
+    try {
+      const data = await readJsonFile(this.cacheFile, null);
+      if (data && data.certs) {
+        for (const [hostname, cert] of Object.entries(data.certs)) {
+          this.certStatus.set(hostname, cert);
+        }
+        if (data.hostnameToServiceId) {
+          for (const [hostname, serviceId] of Object.entries(data.hostnameToServiceId)) {
+            this.hostnameToServiceId.set(hostname, serviceId);
+          }
+        }
+        this.log.info('ssl-monitor', 'Loaded SSL cache', {
+          certCount: this.certStatus.size
+        });
+      }
+    } catch (err) {
+      this.log.warn('ssl-monitor', 'Failed to load SSL cache', { error: err.message });
+    }
+  }
+}
+
+module.exports = SSLMonitor;

dashcaddy-installer/install.sh

@@ -27,14 +27,10 @@ readonly API_DIR="${SITES_DIR}/dashcaddy-api"
 readonly DASHBOARD_DIR="${SITES_DIR}/status"
 readonly CONTAINER_NAME="dashcaddy-api"
 readonly CADDY_ADMIN_PORT=2019
-readonly BACKUP_DIR="${BACKUP_DIR:-${INSTALL_DIR}/backups}"
-readonly DEFAULT_MAX_STORAGE_BYTES=""
 
 # ---- Tunables (overridable via flags) --------------------------------------
 API_PORT=3001
 LOCAL_PORT=8080
-BACKUP_DIR=""
-BACKUP_LIMIT=""
 
 # ---- Runtime state ---------------------------------------------------------
 DOMAIN_MODE=""    # public | custom-tld | local
@@ -393,7 +389,6 @@ EOF
 create_directories() {
   mkdir -p "$INSTALL_DIR" "$DOCKER_DATA" "$SITES_DIR" "$API_DIR" "$DASHBOARD_DIR" "${DASHBOARD_DIR}/assets"
   mkdir -p /opt/dashcaddy/updates /opt/dashcaddy/scripts
-  mkdir -p "${BACKUP_DIR}"
   ok "Directories created"
 }
 
@@ -631,41 +626,7 @@ CEOF
 # Docker Compose
 # ============================================================================
 
-# Parse size string like "10GB" or "1TB" to bytes
-parse_size_to_bytes() {
-  local size="$1"
-  local value unit
-
-  # Strip whitespace
-  size=$(echo "$size" | tr -d ' ')
-
-  # Extract numeric value and unit
-  if [[ $size =~ ^([0-9.]+)([kmgtKMGT][bb]?|[bB]?)$ ]]; then
-    value="${BASH_REMATCH[1]}"
-    unit="${BASH_REMATCH[2]}"
-
-    # Normalize unit to uppercase without 'B' suffix for simplicity
-    unit=$(echo "$unit" | tr '[:lower:]' '[:upper:]')
-    case "$unit" in
-      K|KB)      echo $((value * 1024)) ;;
-      M|MB)      echo $((value * 1024 * 1024)) ;;
-      G|GB)      echo $((value * 1024 * 1024 * 1024)) ;;
-      T|TB)      echo $((value * 1024 * 1024 * 1024 * 1024)) ;;
-      *)         echo "$value" ;;
-    esac
-  else
-    # Not recognized, treat as raw bytes
-    echo "$size"
-  fi
-}
-
 generate_docker_compose() {
-  # Convert BACKUP_LIMIT to bytes if set (e.g., "10GB" -> 10737418240)
-  local backup_limit_bytes=""
-  if [[ -n "$BACKUP_LIMIT" ]]; then
-    backup_limit_bytes=$(parse_size_to_bytes "$BACKUP_LIMIT")
-  fi
-
   cat > "${API_DIR}/docker-compose.yml" <<DCEOF
 services:
   dashcaddy-api:
@@ -687,7 +648,6 @@ services:
       - ${DASHBOARD_DIR}:/app/dashboard:rw
       - /opt/dashcaddy/updates:/app/updates:rw
       - /var/run/docker.sock:/var/run/docker.sock
-      - dashcaddy-backups:/app/backups
     environment:
       - CADDYFILE_PATH=/caddyfile
       - CADDY_ADMIN_URL=http://host.docker.internal:${CADDY_ADMIN_PORT}
@@ -705,10 +665,6 @@ services:
       - DASHCADDY_HOST_UPDATES_DIR=/opt/dashcaddy/updates
       - DASHCADDY_API_SOURCE_DIR=${API_DIR}
       - DASHCADDY_FRONTEND_DIR=/app/dashboard
-      - BACKUP_DIR=/app/backups
-      - BACKUP_MAX_STORAGE_BYTES=${backup_limit_bytes:-0}
-      - BACKUP_CONFIG_FILE=/app/backup-config.json
-      - BACKUP_HISTORY_FILE=/app/backup-history.json
     extra_hosts:
       - "host.docker.internal:host-gateway"
     restart: unless-stopped
@@ -717,14 +673,6 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
-
-volumes:
-  dashcaddy-backups:
-    driver: local
-    driver_opts:
-      type: none
-      o: bind
-      device: ${BACKUP_DIR}
 DCEOF
 
   ok "docker-compose.yml generated"
@@ -932,8 +880,6 @@ parse_args() {
       --skip-caddy)  SKIP_CADDY=true; shift ;;
       --uninstall)   UNINSTALL=true; shift ;;
       --keep-config) KEEP_CONFIG=true; shift ;;
-      --backup-dir)  BACKUP_DIR="${2:-}"; shift; shift ;;
-      --backup-limit) BACKUP_LIMIT="${2:-}"; shift; shift ;;
       --yes|-y)      AUTO_YES=true; shift ;;
       --help|-h)     print_help; exit 0 ;;
       *) warn "Unknown option: $1 (ignored)"; shift ;;
@@ -968,8 +914,6 @@ print_help() {
     --source PATH      Use local source files
     --skip-docker      Already have Docker
     --skip-caddy       Already have Caddy
-    --backup-dir PATH  Backup directory (default: /etc/dashcaddy/backups)
-    --backup-limit SIZE Storage limit for backups (e.g., 10GB, 1TB)
     --uninstall        Remove DashCaddy
     --keep-config      Keep configs during uninstall
     --yes              Skip confirmations

dashcaddy-installer/src/main/config-manager.js

@@ -226,34 +226,17 @@ class ConfigManager {
    * @returns {Promise<Object>} Disk space info
    */
   async getDiskSpace(testPath) {
+    // Note: This is a simplified version. In production, you'd use a library like 'check-disk-space'
     try {
-      const fsPromises = require('fs').promises;
-      const pathModule = require('path');
-
-      // Ensure directory exists
-      await fsPromises.mkdir(testPath, { recursive: true });
-
-      // Use statfs for true disk space (works on all filesystems: ext4, Btrfs, XFS, ZFS, APFS, NTFS)
-      const stats = await fsPromises.statfs(testPath);
-
-      const totalBytes = stats.blocks * stats.bsize;
-      const freeBytes = stats.bfree * stats.bsize;
-      const availableBytes = stats.bavail * stats.bsize; // Available to non-root users
-      const usedBytes = totalBytes - freeBytes;
-
+      const stats = await fs.stat(testPath);
+      
       return {
         available: true,
-        path: testPath,
-        total: totalBytes,
-        used: usedBytes,
-        free: freeBytes,
-        availableBytes: availableBytes,
-        usagePercent: parseFloat(((usedBytes / totalBytes) * 100).toFixed(2))
+        path: testPath
       };
     } catch (error) {
       return {
         available: false,
-        path: testPath,
         error: error.message
       };
     }

dashcaddy-installer/src/renderer/wizard.js

@@ -62,11 +62,6 @@ const state = {
     installPath: '',
     health: null
   },
-  // Backup configuration
-  backup: {
-    maxStorageGB: 10,
-    backupDir: ''
-  },
   // Uninstall mode
   uninstallMode: false,
   uninstall: {
@@ -378,24 +373,6 @@ function updateBranding(field, value) {
   if (field === 'primaryColor') render();
 }
 
-// Backup functions
-function updateBackup(field, value) {
-  state.backup[field] = value;
-  render();
-}
-
-async function selectBackupDir() {
-  try {
-    const result = await window.electronAPI.selectFolder();
-    if (result.success && result.path) {
-      state.backup.backupDir = result.path;
-      render();
-    }
-  } catch (err) {
-    console.error('Backup dir selection failed:', err);
-  }
-}
-
 async function selectLogo() {
   try {
     const result = await window.electronAPI.selectFile({
@@ -443,10 +420,6 @@ async function startInstallation() {
         password: state.dns.password,
         token: state.dns.token
       } : null,
-      backup: {
-        maxStorageGB: state.backup.maxStorageGB,
-        backupDir: state.backup.backupDir || null
-      },
       autoStart: true
     });
   } catch (err) {
@@ -990,31 +963,6 @@ function renderDashboardSetup() {
             <p class="hint">Port for the DashCaddy API server (default: 3001)</p>
           </div>
         ` : ''}
-
-        <div class="folder-input">
-          <label>Backup Storage Limit (GB)</label>
-          <div class="input-row">
-            <input type="number"
-                   value="${state.backup.maxStorageGB}"
-                   min="1" max="10240"
-                   oninput="updateBackup('maxStorageGB', parseInt(this.value) || 10)">
-          </div>
-          <p class="hint">Maximum storage for backups in GB (default: 10, max: 10TB)</p>
-        </div>
-
-        ${state.tier !== 'basic' ? `
-          <div class="folder-input">
-            <label>Backup Directory</label>
-            <div class="input-row">
-              <input type="text"
-                     value="${escapeHtml(state.backup.backupDir)}"
-                     readonly
-                     placeholder="Default: $INSTALL_DIR/backups">
-              <button class="btn-browse" onclick="selectBackupDir()">Browse...</button>
-            </div>
-            <p class="hint">Where backup files are stored on the host</p>
-          </div>
-        ` : ''}
       </div>
     </div>
   `;

dashcaddy-installer/templates/docker-compose.template.yml

@@ -7,28 +7,15 @@ services:
     volumes:
       - {{API_PATH}}:/app
       - /var/run/docker.sock:/var/run/docker.sock
-      - dashcaddy-backups:/app/backups
     environment:
       - NODE_ENV=production
       - PORT={{API_PORT}}
       - SERVICES_FILE=/app/services.json
       - CADDY_ADMIN_URL=http://host.docker.internal:2019
-      - BACKUP_DIR=/app/backups
-      - BACKUP_MAX_STORAGE_BYTES={{BACKUP_MAX_STORAGE_BYTES}}
-      - BACKUP_CONFIG_FILE=/app/backup-config.json
-      - BACKUP_HISTORY_FILE=/app/backup-history.json
     restart: unless-stopped
     networks:
       - dashcaddy
 
-volumes:
-  dashcaddy-backups:
-    driver: local
-    driver_opts:
-      type: none
-      o: bind
-      device: {{BACKUP_DIR}}
-
 networks:
   dashcaddy:
     driver: bridge

scripts/backup-gitea-to-dropbox.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# =============================================================================
+# DashCaddy Gitea — Off-host backup to Dropbox
+# =============================================================================
+# - Stops gitea container briefly to ensure SQLite DB consistency
+# - Syncs /var/lib/docker/volumes/gitea-data to dropbox:/Apps/dashcaddy-gitea-backups/<date>/
+# - Date-stamped snapshots (one per day), kept for 7 days locally
+# - Restarts gitea even if sync fails
+# - Logs to /var/log/gitea-backup.log
+# =============================================================================
+set -u  # don't use -e: we want to always restart gitea
+
+LOG=/var/log/gitea-backup.log
+DATA_SRC=/var/lib/docker/volumes/gitea-data/_data
+DEST="dropbox:/Apps/dashcaddy-gitea-backups"
+TODAY=$(date -u +%Y-%m-%d)
+BACKUP_PATH="${DEST}/${TODAY}"
+RETENTION_DAYS=7
+
+log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" | tee -a "$LOG"; }
+
+log "=== Backup start ==="
+
+# 0. Sanity checks
+if [ ! -d "$DATA_SRC" ]; then
+  log "ERROR: data dir $DATA_SRC missing"
+  exit 1
+fi
+
+# 1. Stop gitea to flush SQLite
+log "Stopping gitea container..."
+docker stop gitea >> "$LOG" 2>&1
+STOP_RC=$?
+if [ $STOP_RC -ne 0 ]; then
+  log "WARNING: docker stop returned $STOP_RC — container may not be running"
+fi
+
+# 2. Sync (use copy so source files are preserved as-is, no --delete)
+log "Syncing $DATA_SRC -> $BACKUP_PATH"
+rclone copy "$DATA_SRC" "$BACKUP_PATH" \
+  --transfers 4 \
+  --checkers 8 \
+  --retries 3 \
+  --low-level-retries 10 \
+  --stats 30s \
+  --log-file "$LOG" \
+  --log-level INFO
+SYNC_RC=$?
+
+# 3. Always restart gitea
+log "Starting gitea container..."
+docker start gitea >> "$LOG" 2>&1
+START_RC=$?
+
+# Wait for gitea to be ready
+for i in {1..30}; do
+  if curl -sf http://localhost:3000/api/v1/version > /dev/null 2>&1; then
+    log "Gitea is up after ${i}s"
+    break
+  fi
+  sleep 1
+done
+
+# 4. Cleanup old backups (older than RETENTION_DAYS)
+log "Pruning local + remote snapshots older than ${RETENTION_DAYS} days..."
+CUTOFF=$(date -u -d "${RETENTION_DAYS} days ago" +%Y-%m-%d)
+rclone lsf "$DEST/" --dirs-only 2>/dev/null | while read -r d; do
+  # rclone returns names with trailing /
+  name="${d%/}"
+  if [[ "$name" < "$CUTOFF" ]]; then
+    log "  removing old: $name"
+    rclone purge "${DEST}/${name}" >> "$LOG" 2>&1
+  fi
+done
+
+# 5. Report
+if [ $SYNC_RC -eq 0 ] && [ $START_RC -eq 0 ]; then
+  log "=== Backup OK ==="
+  exit 0
+else
+  log "=== Backup completed with errors (sync=$SYNC_RC, start=$START_RC) ==="
+  exit 1
+fi

scripts/samihost-fail2ban-watchdog.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+# Samihost fail2ban watchdog — auto-unban whitelisted IPs and keep ignoreip list in sync.
+# Deployed to /usr/local/bin/samihost-fail2ban-watchdog.sh on 194.163.161.162
+# Cron: every 30 min (0,30 * * * *)
+
+set -euo pipefail
+
+JAIL_LOCAL=/etc/fail2ban/jail.local
+BACKUP=/etc/fail2ban/jail.local.watchdog.bak
+EXPECTED_IGNOREIP="127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 fc00::/7 fe80::/10 100.64.0.0/10 100.121.150.22 100.85.236.10 100.71.97.12 100.81.59.99 100.98.123.59 194.233.88.206 173.212.201.200 194.163.161.162"
+LOG=/var/log/samihost-fail2ban-watchdog.log
+TELEGRAM_LOG=/tmp/fail2ban-watchdog-last-action
+
+ts() { date -u +"%Y-%m-%dT%H:%M:%SZ"; }
+log() { echo "$(ts) $*" | tee -a "$LOG"; }
+
+mkdir -p "$(dirname "$LOG")"
+touch "$LOG"
+
+# --- 1. Verify ignoreip line is intact and matches expected ---
+CURRENT=$(grep '^ignoreip' "$JAIL_LOCAL" | sed 's/^ignoreip[[:space:]]*=[[:space:]]*//' || true)
+EXPECTED_NORMALIZED=$(echo "$EXPECTED_IGNOREIP" | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
+CURRENT_NORMALIZED=$(echo "$CURRENT" | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
+
+if [ "$CURRENT_NORMALIZED" != "$EXPECTED_NORMALIZED" ]; then
+  log "ALERT: ignoreip line drifted. Restoring."
+  cp "$JAIL_LOCAL" "$BACKUP"
+  sed -i "s|^ignoreip = .*|ignoreip = $EXPECTED_IGNOREIP|" "$JAIL_LOCAL"
+  fail2ban-client reload
+  echo "ignoreip restored at $(ts)" > "$TELEGRAM_LOG"
+  log "ignoreip restored, fail2ban reloaded"
+fi
+
+# --- 2. Unban any currently-banned IPs that match our trusted set ---
+BANNED=$(fail2ban-client status sshd 2>/dev/null | awk -F: '/Banned IP list/{print $2}' | tr ' ' '\n' | grep -v '^$' || true)
+UNBANNED=0
+for ip in $BANNED; do
+  # Match against any trusted network
+  is_trusted=0
+  for net in 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 ::1 fc00::/7 fe80::/10 100.121.150.22 100.85.236.10 100.71.97.12 100.81.59.99 100.98.123.59 194.233.88.206 173.212.201.200 194.163.161.162; do
+    if [[ "$net" == *"/"* ]]; then
+      # CIDR match (simple IPv4 only — IPv6 needs python or ipcalc, skip for now)
+      base="${net%/*}"
+      mask="${net#*/}"
+      if [[ "$ip" == "$base"* ]] || python3 -c "import ipaddress,sys; sys.exit(0 if ipaddress.ip_address('$ip') in ipaddress.ip_network('$net', strict=False) else 1)" 2>/dev/null; then
+        is_trusted=1
+        break
+      fi
+    else
+      if [ "$ip" = "$net" ]; then
+        is_trusted=1
+        break
+      fi
+    fi
+  done
+  if [ "$is_trusted" = "1" ]; then
+    if fail2ban-client set sshd unbanip "$ip" >/dev/null 2>&1; then
+      log "auto-unbanned trusted IP: $ip"
+      UNBANNED=$((UNBANNED+1))
+    fi
+  fi
+done
+
+[ "$UNBANNED" -gt 0 ] && echo "auto-unbanned $UNBANNED trusted IPs at $(ts)" > "$TELEGRAM_LOG"
+
+# --- 3. Cap the ban count — if more than 200 are banned, mass-unban stale ones ---
+TOTAL_BANNED=$(fail2ban-client status sshd 2>/dev/null | awk '/Currently banned/{print $NF}' || echo 0)
+if [ "$TOTAL_BANNED" -gt 200 ]; then
+  log "ALERT: $TOTAL_BANNED IPs banned. Mass-unbanning all."
+  for ip in $BANNED; do
+    fail2ban-client set sshd unbanip "$ip" >/dev/null 2>&1 || true
+  done
+  echo "mass-unbanned $TOTAL_BANNED stale bans at $(ts)" > "$TELEGRAM_LOG"
+fi
+
+log "watchdog run complete (unbanned=$UNBANNED, total_banned=$TOTAL_BANNED)"

status/build.js

@@ -72,6 +72,7 @@ const bundles = {
   ],
   'init.js': [
     JS('core', 'init.js'),
+    JS('monitoring-widgets.js'),
     JS('keyboard-shortcuts.js'),
   ],
 };

status/index.html

@@ -256,6 +256,9 @@
       <option value="on">🟢 Online</option>
       <option value="off">🔴 Offline</option>
     </select>
+    <select id="service-filter-category" style="padding: 8px 12px; background: var(--bg); border: 1px solid var(--border); border-radius: 6px; color: var(--fg); font-size: 0.9rem;">
+      <option value="all">All Categories</option>
+    </select>
     <button id="batch-operations-btn" class="btn-sm" style="padding: 8px 12px;">☰ Batch Operations</button>
     <span id="service-filter-count" style="color: var(--muted); font-size: 0.85rem; white-space: nowrap;"></span>
   </div>

status/js/core/grid.js

@@ -95,6 +95,8 @@
       const card = el('div', 'card');
       card.setAttribute('data-app', s.id);
       card.setAttribute('data-status', 'off'); // Initial status
+      if (s.containerId) card.setAttribute('data-container-id', s.containerId);
+      if (s.category) card.setAttribute('data-category', s.category);
       if (s.recipeId) card.setAttribute('data-recipe-id', s.recipeId);
 
       const dot = el('span', 'dot bad at-bl'); dot.id = 'dot-' + s.id + '-grid'; card.appendChild(dot);
@@ -156,6 +158,16 @@
         nameSpan.appendChild(tsBadge);
       }
 
+      // Add Category badge if service has one (colored pill with icon)
+      if (s.category) {
+        const cats = (typeof DC !== 'undefined' && DC.CATEGORIES) || window.DC_CATEGORIES || {};
+        const catInfo = cats[s.category] || {};
+        const catBadge = el('span', 'cat-badge', `${catInfo.icon || ''} ${s.category}`.trim());
+        catBadge.title = `Category: ${s.category}`;
+        catBadge.style.cssText = `margin-left: 6px; font-size: 0.65rem; padding: 1px 6px; border-radius: 999px; background: color-mix(in srgb, ${catInfo.color || '#7f8c8d'} 25%, transparent); color: ${catInfo.color || '#7f8c8d'}; border: 1px solid color-mix(in srgb, ${catInfo.color || '#7f8c8d'} 50%, transparent); white-space: nowrap; font-weight: 500;`;
+        nameSpan.appendChild(catBadge);
+      }
+
       row.appendChild(el('span', 'spacer'));
 
       const pill = el('span', 'badge off', 'OFF'); pill.id = 'badge-' + s.id; row.appendChild(pill);
@@ -282,6 +294,9 @@
 
     // Group recipe cards visually after grid is built
     if (window.groupRecipeCards) requestAnimationFrame(() => window.groupRecipeCards());
+
+    // Refresh the service filter so the category dropdown reflects new services
+    if (window.refreshServiceFilter) window.refreshServiceFilter();
   }
 
   function setBadge(id, up, responseTime = null) {

status/js/core/init.js

@@ -59,11 +59,13 @@
     }
     _dashboardInitialized = true;
     await window.loadServices();
+    await loadTemplateCategories();
     window.buildGrid();
     animateTopCards();
     window.refreshAll();
     setInterval(window.refreshAll, DC.POLL.DASHBOARD);
     if (typeof window.refreshCredsButtons === 'function') window.refreshCredsButtons();
+    if (typeof window.refreshMonitoringWidgets === 'function') window.refreshMonitoringWidgets();
     // Update auth card (may have already been updated by the auto-load IIFE but ensure it's correct)
     if (typeof window._updateAuthCard === 'function') {
       try {
@@ -200,6 +202,55 @@
   window.loadCustomServices = loadCustomServices;
   registerServiceWorker();
 
+  // ===== TEMPLATE CATEGORIES =====
+  // Cached template categories from /api/v1/templates for use across the UI
+  // (service create/edit, filter dropdown, category badges, etc.)
+  async function loadTemplateCategories() {
+    try {
+      const r = await fetch('/api/v1/templates', { cache: 'no-store' });
+      if (!r.ok) return;
+      const data = await r.json();
+      if (data && data.categories) {
+        window.DC_CATEGORIES = data.categories;
+        // Also expose via globals.js constant for convenience
+        if (typeof DC !== 'undefined') DC.CATEGORIES = data.categories;
+        // Populate any category <select> that's already in the DOM
+        populateCategorySelects();
+      }
+    } catch (e) {
+      console.warn('[init] Failed to load template categories:', e);
+    }
+  }
+
+  function populateCategorySelects() {
+    const cats = window.DC_CATEGORIES || (typeof DC !== 'undefined' && DC.CATEGORIES);
+    if (!cats) return;
+    document.querySelectorAll('select[data-role="service-category"]').forEach(select => {
+      const current = select.dataset.current || '';
+      // Clear options but keep the first (placeholder)
+      const placeholder = select.querySelector('option[value=""]');
+      select.innerHTML = '';
+      if (placeholder) select.appendChild(placeholder);
+      else {
+        const ph = document.createElement('option');
+        ph.value = '';
+        ph.textContent = '— Select category —';
+        select.appendChild(ph);
+      }
+      Object.entries(cats).forEach(([name, info]) => {
+        const opt = document.createElement('option');
+        opt.value = name;
+        opt.textContent = `${info.icon || ''} ${name}`.trim();
+        if (name === current) opt.selected = true;
+        select.appendChild(opt);
+      });
+    });
+  }
+
+  // Allow other modules to re-run population after they (re)inject selects
+  window.populateCategorySelects = populateCategorySelects;
+  window.loadTemplateCategories = loadTemplateCategories;
+
   // TOTP-gated initialization
   (async () => {
     try {

status/js/core/service-create.js

@@ -262,6 +262,7 @@
     const proxyIp = document.getElementById('external-proxy-ip').value.trim() || SITE.dnsIp || 'localhost';
     const preserveHost = document.getElementById('external-preserve-host').checked;
     const followRedirects = document.getElementById('external-follow-redirects').checked;
+    const category = document.getElementById('external-service-category')?.value || '';
 
     if (!name || !externalUrl) {
       showNotification('Please fill in Name and External URL', 'warning');
@@ -341,6 +342,8 @@
         isExternal: true,
         isCustom: true
       };
+      // Only attach category if user actually picked one
+      if (category) newService.category = category;
 
       window.APPS.push(newService);
       results.dashboard = true;
@@ -457,6 +460,13 @@
     const healthCheck = document.getElementById('health-check-input')?.value || '';
     const timeout = document.getElementById('timeout-input')?.value || 30;
 
+    // Category is optional — pulled from either local or external select by the
+    // openAddServiceModal reset. If user doesn't choose one, it stays undefined
+    // and we don't send it (so the backend keeps the existing behavior).
+    const categoryEl = document.getElementById('service-category-input')
+      || document.getElementById('external-service-category');
+    const category = categoryEl?.value || '';
+
     const dnsToken = window.getToken(getPrimaryDnsId(), 'admin');
 
     if (!name || !port || !ip) {
@@ -525,6 +535,8 @@
         logo: logo || `/assets/${subdomain}.png`,
         tailscaleOnly: tailscaleOnly || false
       };
+      // Only include category if user actually picked one
+      if (category) serviceConfig.category = category;
 
       await window.addServiceToConfig(serviceConfig);
       results.dashboard = true;

status/js/core/service-crud.js

@@ -19,6 +19,16 @@
     document.getElementById('edit-tailscale-only').checked = service.tailscaleOnly || false;
     document.getElementById('edit-logo-url').value = service.logo || '';
 
+    // Populate the category select for this service, then set the current value.
+    // populateCategorySelects() uses data-current so we set it first, then call.
+    const categorySelect = document.getElementById('edit-service-category');
+    if (categorySelect) {
+      categorySelect.dataset.current = service.category || '';
+      if (typeof window.populateCategorySelects === 'function') {
+        window.populateCategorySelects();
+      }
+    }
+
     modal.classList.add('show');
   }
 
@@ -36,6 +46,7 @@
     const newIp = document.getElementById('edit-ip').value.trim() || 'localhost';
     const tailscaleOnly = document.getElementById('edit-tailscale-only').checked;
     const newLogo = document.getElementById('edit-logo-url').value.trim();
+    const newCategory = document.getElementById('edit-service-category')?.value || '';
 
     if (!newSubdomain) {
       showNotification('Subdomain is required', 'warning');
@@ -51,6 +62,7 @@
     if (newIp !== currentEditService.ip) changes.push('ip');
     if (tailscaleOnly !== (currentEditService.tailscaleOnly || false)) changes.push('tailscale');
     if (newLogo && newLogo !== currentEditService.logo) changes.push('logo');
+    if (newCategory !== (currentEditService.category || '')) changes.push('category');
 
     if (changes.length === 0) {
       closeServiceEditModal();
@@ -72,7 +84,8 @@
           port: newPort || currentEditService.port,
           ip: newIp,
           tailscaleOnly,
-          logo: newLogo || undefined
+          logo: newLogo || undefined,
+          category: newCategory
         })
       });
 
@@ -91,7 +104,8 @@
           port: newPort || window.APPS[appIndex].port,
           ip: newIp,
           tailscaleOnly,
-          logo: newLogo || window.APPS[appIndex].logo
+          logo: newLogo || window.APPS[appIndex].logo,
+          category: newCategory || undefined
         };
       }
 

status/js/core/service-infrastructure.js

@@ -187,6 +187,9 @@
       name: serviceConfig.name,
       logo: serviceConfig.logo || `/assets/${serviceConfig.subdomain}.png`
     };
+    // Forward optional metadata fields if provided
+    if (serviceConfig.category) newService.category = serviceConfig.category;
+    if (serviceConfig.containerId) newService.containerId = serviceConfig.containerId;
 
     try {
       const response = await secureFetch('/api/v1/services', {

status/js/core/service-modals.js

@@ -82,6 +82,16 @@
             Enter a URL or upload an image file (PNG, JPG, SVG)
           </div>
         </div>
+
+        <!-- Category -->
+        <div>
+          <label for="edit-service-category" class="form-label-accent-sm">
+            Category
+          </label>
+          <select id="edit-service-category" data-role="service-category" class="form-input-md">
+            <option value="">— No category —</option>
+          </select>
+        </div>
       </div>
 
       <div class="weather-modal-buttons" style="margin-top: 24px;">
@@ -239,6 +249,15 @@
               Reload Caddy after adding
             </label>
 
+            <!-- Category -->
+            <div>
+              <label for="service-category-input" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Category</label>
+              <select id="service-category-input" data-role="service-category" style="width: 100%;">
+                <option value="">— No category —</option>
+              </select>
+              <div style="font-size: 0.7rem; color: var(--muted); margin-top: 3px;">Group services on the dashboard by purpose (Media, Productivity, etc.)</div>
+            </div>
+
             <hr style="border: none; border-top: 1px solid var(--border); margin: 4px 0;" />
 
             <div class="grid-2col">
@@ -326,6 +345,14 @@
                 Follow Redirects
               </label>
 
+              <!-- Category (external) -->
+              <div>
+                <label for="external-service-category" style="font-size: 0.8rem; color: var(--muted); margin-bottom: 4px; display: block;">Category</label>
+                <select id="external-service-category" data-role="service-category" style="width: 100%;">
+                  <option value="">— No category —</option>
+                </select>
+              </div>
+
             </div>
           </details>
         </div>

status/js/monitoring-widgets.js

@@ -155,47 +155,16 @@
     return b.toFixed(1) + ' ' + units[i];
   }
 
-  // ----- Robust services count -----
-  // Read from multiple sources so we always have a number:
-  //  1. window.APPS (populated by grid.js after loadServices)
-  //  2. #cards .card elements (post-buildGrid)
-  //  3. live fetch /api/v1/services (last-resort fallback if grid hasn't run)
-  async function fetchServicesCount() {
-    // Source 1+2: window.APPS / DOM cards
-    if (Array.isArray(window.APPS) && window.APPS.length > 0) {
-      const up = document.querySelectorAll('#cards .card[data-status="on"]').length;
-      return { total: window.APPS.length, up, source: 'APPS' };
-    }
-    const cards = document.querySelectorAll('#cards .card');
-    if (cards.length > 0) {
-      const up = Array.from(cards).filter(c => c.dataset.status === 'on').length;
-      return { total: cards.length, up, source: 'DOM' };
-    }
-    // Source 3: fetch live (endpoints may return {success, services:[...]} OR raw array)
-    try {
-      const r = await fetch('/api/v1/services', { cache: 'no-store' });
-      if (!r.ok) return { total: 0, up: 0, source: 'fetch-fail' };
-      const body = await r.json();
-      const list = (body && Array.isArray(body.services)) ? body.services
-                 : (Array.isArray(body)) ? body
-                 : [];
-      // Persist for the grid so this fallback only fires once
-      if (Array.isArray(window.APPS) || typeof window.APPS === 'undefined') window.APPS = list;
-      const up = document.querySelectorAll('#cards .card[data-status="on"]').length;
-      return { total: list.length, up, source: 'fetch' };
-    } catch (_) {
-      return { total: 0, up: 0, source: 'fetch-error' };
-    }
-  }
-
-  async function setServicesCard() {
-    const { total, up } = await fetchServicesCount();
+  function setServicesCard() {
+    const total = (window.APPS || []).length;
+    let up = 0;
+    document.querySelectorAll('#cards .card').forEach(c => {
+      if (c.dataset.status === 'on') up++;
+    });
     const el = document.getElementById('dc-monitor-services');
     const sub = document.getElementById('dc-monitor-services-sub');
     if (el) el.textContent = `${up} / ${total}`;
-    if (sub) sub.textContent = total === 0
-      ? 'no services yet'
-      : `${up} online · ${total - up} offline`;
+    if (sub) sub.textContent = total === 0 ? 'no services yet' : `${up} online · ${total - up} offline`;
   }
 
   function applyHealthSummary(data) {

status/js/service-filter.js

@@ -2,11 +2,50 @@
 (function() {
   const searchInput = document.getElementById('service-filter-search');
   const statusSelect = document.getElementById('service-filter-status');
+  const categorySelect = document.getElementById('service-filter-category');
   const countSpan = document.getElementById('service-filter-count');
 
+  // Build a single category list from both the API categories and any
+  // categories present on the actual rendered cards (covers custom services
+  // whose category isn't in TEMPLATE_CATEGORIES).
+  function getCategoryList() {
+    const seen = new Set();
+    const fromCards = new Set();
+    document.querySelectorAll('#cards .card[data-category]').forEach(c => {
+      const cat = c.dataset.category.trim();
+      if (cat) fromCards.add(cat);
+    });
+    const apiCats = (window.DC_CATEGORIES || (typeof DC !== 'undefined' && DC.CATEGORIES)) || {};
+    const all = Object.keys(apiCats).concat([...fromCards].filter(c => !apiCats[c]));
+    all.forEach(c => seen.add(c));
+    return { list: [...seen], apiCats };
+  }
+
+  function refreshCategoryDropdown() {
+    if (!categorySelect) return;
+    const { list, apiCats } = getCategoryList();
+    const current = categorySelect.value;
+    categorySelect.innerHTML = '<option value="all">All Categories</option>';
+    list.sort().forEach(name => {
+      const info = apiCats[name];
+      const opt = document.createElement('option');
+      opt.value = name;
+      opt.textContent = info ? `${info.icon || ''} ${name}`.trim() : name;
+      categorySelect.appendChild(opt);
+    });
+    // Restore selection if it still exists
+    if (current && [...categorySelect.options].some(o => o.value === current)) {
+      categorySelect.value = current;
+    } else {
+      categorySelect.value = 'all';
+    }
+  }
+
   function updateFilter() {
+    refreshCategoryDropdown();
     const query = searchInput.value.toLowerCase().trim();
     const statusFilter = statusSelect.value; // 'all', 'on', or 'off'
+    const categoryFilter = categorySelect ? categorySelect.value : 'all';
 
     const cards = document.querySelectorAll('#cards .card');
     let visibleCount = 0;
@@ -15,11 +54,13 @@
       const name = card.querySelector('.name')?.textContent?.toLowerCase() || '';
       const app = card.dataset.app?.toLowerCase() || '';
       const status = card.dataset.status || 'off'; // 'on' or 'off'
+      const category = card.dataset.category || '';
 
       const matchesSearch = !query || name.includes(query) || app.includes(query);
       const matchesStatus = statusFilter === 'all' || status === statusFilter;
+      const matchesCategory = categoryFilter === 'all' || category === categoryFilter;
 
-      if (matchesSearch && matchesStatus) {
+      if (matchesSearch && matchesStatus && matchesCategory) {
         card.style.display = '';
         visibleCount++;
       } else {
@@ -44,6 +85,7 @@
 
   searchInput?.addEventListener('input', debounce(updateFilter, 200));
   statusSelect?.addEventListener('change', updateFilter);
+  categorySelect?.addEventListener('change', updateFilter);
 
   // Initial count on page load
   if (document.readyState === 'loading') {
@@ -52,6 +94,7 @@
     setTimeout(updateFilter, 500);
   }
 
-  // Expose for external triggers
+  // Expose for external triggers (called after buildGrid to repopulate categories)
   window.refreshServiceFilter = updateFilter;
+  window.refreshCategoryDropdown = refreshCategoryDropdown;
 })();

status/sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'dashcaddy-shell-8ef9c82616';
+const CACHE = 'dashcaddy-shell-43a872cc40';
 const PRECACHE = [
   '/',
   '/index.html',