build: bump SW cache to dashcaddy-shell-f6673e7190

Forces clients to pull the rebuilt core.js bundle that includes
totp-recovery.js.

.gitignore

@@ -2,6 +2,8 @@
 node_modules/
 
 # Runtime state/config files (generated, not source)
+# Note: data/ subdir contains runtime state (credentials, secrets, history) — never commit
+dashcaddy-api/data/
 dashcaddy-api/credentials.json
 dashcaddy-api/.env
 .env
@@ -17,6 +19,19 @@ dashcaddy-api/update-config.json
 dashcaddy-api/update-history.json
 dashcaddy-api/dashcaddy-errors.log
 
+# Auto-updater backups (created by dashcaddy-update.sh when rolling back)
+start.sh.bak*
+scripts/*.bak*
+
+# Auto-updater runtime state (history + secrets + staging)
+updates/
+
+# Scratch / debug scripts (left over from past sessions)
+cm_check*.js
+full_test.js
+login_test.js
+login_backup_test.js
+
 # Build output
 dashcaddy-installer/build-output/
 dashcaddy-installer/dist/

dashcaddy-api/VERSION

@@ -1 +1 @@
-dev
+c64bbe2

dashcaddy-api/app-templates.js

@@ -2459,6 +2459,74 @@ const APP_TEMPLATES = {
       "World data is persisted in the data volume",
       "Requires at least 4GB RAM for smooth operation"
     ]
+  },
+  // === FILE MANAGEMENT — HOST-SERVICE TEMPLATES ===
+  // Sami Files is a host-systemd service, NOT a Docker container. The
+  // template exists so users get the right metadata + category in the App
+  // Selector, but the actual deployment is via `deploy/sami-files.service`
+  // unit + a Caddy reverse_proxy (see README in /opt/sami-files/deploy/).
+  // Service health is checked by probing the FastAPI /api/health endpoint
+  // on 127.0.0.1:8765; Caddy proxies the public URL.
+  "sami-files": {
+    name: "Sami Files",
+    description: "Multi-server SSH file manager — browse, edit, upload, and exec across all your machines from one browser tab",
+    icon: "📂",
+    logo: "/assets/sami-files.png",
+    category: "Files",
+    popularity: 80,
+    difficulty: "Intermediate",
+    isSystemdService: true,
+    systemdUnit: "sami-files.service",
+    healthCheck: "http://127.0.0.1:8765/api/health",
+    healthCheckExpect: "ok",
+    defaultPort: 8765,
+    subdomain: "files",
+    proxyPass: "http://127.0.0.1:8765",
+    subpathSupport: 'none',
+    externalConfig: {
+      // Where the source code / config lives on the host. DashCaddy reads
+      // these paths when generating a fresh setup via "Deploy" in the App
+      // Selector — they are informational for the systemd variant.
+      installDir: "/opt/sami-files",
+      configFile: "/opt/sami-files/config/servers.yaml",
+      serviceFile: "/opt/sami-files/deploy/sami-files.service",
+      logFile: "/opt/sami-files/logs/backend.log",
+      pythonVenv: "/usr/local/lib/hermes-agent/venv",
+      repo: "git.sami/sami7777/sami-files",
+      dependencies: [
+        "python3 >= 3.11 with uvicorn + asyncssh + pyyaml + fastapi",
+        "systemd >= 245 (for StandardOutput=append: journal syntax)"
+      ],
+      caddySnippet: [
+        "files.sami {",
+        "    reverse_proxy 127.0.0.1:8765",
+        "    import dashcaddy_auth",
+        "}"
+      ]
+    },
+    setupInstructions: [
+      "Clone the repo: git clone http://100.81.59.99:3030/sami7777/sami-files.git /opt/sami-files",
+      "Create venv and install deps: /usr/local/lib/hermes-agent/venv/bin/pip install fastapi uvicorn asyncssh pyyaml python-multipart",
+      "Copy deploy/sami-files.service to /etc/systemd/system/ and `systemctl daemon-reload`",
+      "Enable + start: systemctl enable --now sami-files.service",
+      "Edit /opt/sami-files/config/servers.yaml to add your SSH targets",
+      "Add the Caddy snippet (above) to your Caddyfile and reload Caddy",
+      "Browse to https://files.sami — log in via DashCaddy SSO"
+    ],
+    troubleshooting: [
+      {
+        symptom: "Service fails to start with 'No such file or directory'",
+        fix: "Verify the python venv path in the .service file matches your installation (use `which python3` and update ExecStart accordingly)."
+      },
+      {
+        symptom: "Backend logs show 'Permission denied' on key file",
+        fix: "Run `chmod 600 /root/.ssh/<key>` for each key_file listed in servers.yaml — backend refuses to load keys with looser permissions."
+      },
+      {
+        symptom: "Browser shows 'Cannot connect' but systemctl says running",
+        fix: "Check that uvicorn is binding 127.0.0.1:8765 (not 0.0.0.0). Use `ss -tlnp | grep 8765` to confirm."
+      }
+    ]
   }
 };
 

dashcaddy-api/backup-manager.js

@@ -9,6 +9,15 @@ const { execSync } = require('child_process');
 const crypto = require('crypto');
 const EventEmitter = require('events');
 
+// Format bytes to human readable string
+function formatBytes(bytes) {
+  if (bytes === 0 || bytes === undefined || bytes === null) return '0 B';
+  const k = 1024;
+  const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+}
+
 const BACKUP_CONFIG_FILE = process.env.BACKUP_CONFIG_FILE || path.join(__dirname, 'backup-config.json');
 const BACKUP_HISTORY_FILE = process.env.BACKUP_HISTORY_FILE || path.join(__dirname, 'backup-history.json');
 const DEFAULT_BACKUP_DIR = process.env.BACKUP_DIR || path.join(__dirname, 'backups');
@@ -20,14 +29,6 @@ class BackupManager extends EventEmitter {
     this.history = this.loadHistory();
     this.scheduledJobs = new Map();
     this.running = false;
-    this.notificationManager = null;
-  }
-
-  /**
-   * Set the notification manager for sending backup notifications
-   */
-  setNotificationManager(nm) {
-    this.notificationManager = nm;
   }
 
   /**
@@ -83,7 +84,7 @@ class BackupManager extends EventEmitter {
       case 'monthly':
         intervalMs = 30 * 24 * 60 * 60 * 1000;
         break;
-      default: {
+      default:
         // Custom interval in minutes
         const minutes = parseInt(backup.schedule, 10);
         if (!isNaN(minutes) && minutes > 0) {
@@ -92,7 +93,6 @@ class BackupManager extends EventEmitter {
           console.error(`[BackupManager] Invalid schedule for ${name}: ${backup.schedule}`);
           return;
         }
-      }
     }
 
     // Schedule the job
@@ -184,15 +184,12 @@ class BackupManager extends EventEmitter {
         await this.cleanupOldBackups(name, backup.retention);
       }
 
-      this.emit('backup-complete', historyEntry);
-
-      // Send notification if manager is configured
-      if (this.notificationManager) {
-        this.notificationManager.sendBackupComplete(historyEntry).catch(err => {
-          console.error('[BackupManager] Failed to send backup-complete notification:', err.message);
-        });
+      // Enforce storage limit (delete oldest until within maxStorageBytes)
+      if (backup.maxStorageBytes) {
+        await this.enforceStorageLimit(name, backup.maxStorageBytes);
       }
 
+      this.emit('backup-complete', historyEntry);
       console.log(`[BackupManager] Backup ${name} completed in ${duration}ms`);
 
       return historyEntry;
@@ -210,13 +207,6 @@ class BackupManager extends EventEmitter {
       this.addToHistory(historyEntry);
       this.emit('backup-failed', historyEntry);
       
-      // Send notification if manager is configured
-      if (this.notificationManager) {
-        this.notificationManager.sendBackupFailed(historyEntry).catch(err => {
-          console.error('[BackupManager] Failed to send backup-failed notification:', err.message);
-        });
-      }
-
       throw error;
     }
   }
@@ -566,36 +556,11 @@ class BackupManager extends EventEmitter {
     switch (destination.type) {
       case 'local':
         return await this.saveToLocal(data, destination, backupId);
-      case 'dropbox':
-        return await this.saveToDropbox(data, destination, backupId);
-      case 'webdav':
-        return await this.saveToWebDAV(data, destination, backupId);
-      case 'sftp':
-        return await this.saveToSFTP(data, destination, backupId);
       default:
         throw new Error(`Unsupported destination type: ${destination.type}`);
     }
   }
 
-  /**
-   * Load encrypted backup blob from a destination location.
-   * Returns a Buffer that can be passed to decryptBackup/decompressBackup.
-   */
-  async loadFromDestination(location) {
-    switch (location.type) {
-      case 'local':
-        return fs.readFileSync(location.path);
-      case 'dropbox':
-        return await this.loadFromDropbox(location);
-      case 'webdav':
-        return await this.loadFromWebDAV(location);
-      case 'sftp':
-        return await this.loadFromSFTP(location);
-      default:
-        throw new Error(`Unsupported destination type: ${location.type}`);
-    }
-  }
-
   /**
    * Save to local filesystem
    */
@@ -619,257 +584,6 @@ class BackupManager extends EventEmitter {
     };
   }
 
-  // ==================== CLOUD DESTINATIONS ====================
-
-  /**
-   * Resolve credentials for a given provider via the credentialManager.
-   * Throws if required fields are missing.
-   */
-  async _getCloudCredentials(provider) {
-    const credentialManager = require('./credential-manager');
-    const creds = {};
-    if (provider === 'dropbox') {
-      creds.token = await credentialManager.retrieve('backup.dropbox.token');
-      if (!creds.token) throw new Error('Dropbox token not configured');
-    } else if (provider === 'webdav') {
-      creds.url = await credentialManager.retrieve('backup.webdav.url');
-      creds.username = await credentialManager.retrieve('backup.webdav.username');
-      creds.password = await credentialManager.retrieve('backup.webdav.password');
-      if (!creds.url || !creds.username || !creds.password) {
-        throw new Error('WebDAV credentials incomplete (need url, username, password)');
-      }
-    } else if (provider === 'sftp') {
-      creds.host = await credentialManager.retrieve('backup.sftp.host');
-      const portStr = await credentialManager.retrieve('backup.sftp.port');
-      creds.port = parseInt(portStr || '22', 10);
-      creds.username = await credentialManager.retrieve('backup.sftp.username');
-      creds.password = await credentialManager.retrieve('backup.sftp.password');
-      creds.privateKey = await credentialManager.retrieve('backup.sftp.privateKey');
-      if (!creds.host || !creds.username || (!creds.password && !creds.privateKey)) {
-        throw new Error('SFTP credentials incomplete (need host, username, and either password or privateKey)');
-      }
-    }
-    return creds;
-  }
-
-  // ----- Dropbox -----
-
-  async saveToDropbox(data, destination, backupId) {
-    const { Dropbox } = require('dropbox');
-    const creds = await this._getCloudCredentials('dropbox');
-    const dbx = new Dropbox({ accessToken: creds.token });
-
-    const folder = (destination.path || '/dashcaddy-backups').replace(/\/+$/, '');
-    const remotePath = `${folder}/${backupId}.backup`;
-
-    await dbx.filesUpload({
-      path: remotePath,
-      contents: data,
-      mode: { '.tag': 'overwrite' },
-      autorename: false,
-      mute: true
-    });
-
-    return {
-      type: 'dropbox',
-      path: remotePath,
-      size: data.length
-    };
-  }
-
-  async loadFromDropbox(location) {
-    const { Dropbox } = require('dropbox');
-    const creds = await this._getCloudCredentials('dropbox');
-    const dbx = new Dropbox({ accessToken: creds.token });
-    const result = await dbx.filesDownload({ path: location.path });
-    // Node SDK returns fileBinary on the result
-    const fileBinary = result.result.fileBinary || result.result.fileBlob;
-    if (Buffer.isBuffer(fileBinary)) return fileBinary;
-    return Buffer.from(fileBinary);
-  }
-
-  // ----- WebDAV -----
-
-  async saveToWebDAV(data, destination, backupId) {
-    const { createClient } = require('webdav');
-    const creds = await this._getCloudCredentials('webdav');
-    const client = createClient(creds.url, {
-      username: creds.username,
-      password: creds.password
-    });
-
-    const folder = (destination.path || '/dashcaddy-backups').replace(/\/+$/, '');
-
-    // Ensure folder exists
-    try {
-      const exists = await client.exists(folder);
-      if (!exists) await client.createDirectory(folder, { recursive: true });
-    } catch (_) {
-      // best-effort
-    }
-
-    const remotePath = `${folder}/${backupId}.backup`;
-    await client.putFileContents(remotePath, data, { overwrite: true });
-
-    return {
-      type: 'webdav',
-      path: remotePath,
-      size: data.length
-    };
-  }
-
-  async loadFromWebDAV(location) {
-    const { createClient } = require('webdav');
-    const creds = await this._getCloudCredentials('webdav');
-    const client = createClient(creds.url, {
-      username: creds.username,
-      password: creds.password
-    });
-    const data = await client.getFileContents(location.path);
-    return Buffer.isBuffer(data) ? data : Buffer.from(data);
-  }
-
-  // ----- SFTP -----
-
-  async saveToSFTP(data, destination, backupId) {
-    const SftpClient = require('ssh2-sftp-client');
-    const creds = await this._getCloudCredentials('sftp');
-    const client = new SftpClient();
-
-    try {
-      await client.connect({
-        host: creds.host,
-        port: creds.port,
-        username: creds.username,
-        password: creds.password || undefined,
-        privateKey: creds.privateKey || undefined
-      });
-
-      const folder = (destination.path || '/dashcaddy-backups').replace(/\/+$/, '');
-      // Ensure remote dir exists
-      try {
-        const exists = await client.exists(folder);
-        if (!exists) await client.mkdir(folder, true);
-      } catch (_) {
-        // best-effort
-      }
-
-      const remotePath = `${folder}/${backupId}.backup`;
-      await client.put(Buffer.from(data), remotePath);
-
-      return {
-        type: 'sftp',
-        path: remotePath,
-        size: data.length
-      };
-    } finally {
-      try { await client.end(); } catch (_) { /* ignore */ }
-    }
-  }
-
-  async loadFromSFTP(location) {
-    const SftpClient = require('ssh2-sftp-client');
-    const creds = await this._getCloudCredentials('sftp');
-    const client = new SftpClient();
-    try {
-      await client.connect({
-        host: creds.host,
-        port: creds.port,
-        username: creds.username,
-        password: creds.password || undefined,
-        privateKey: creds.privateKey || undefined
-      });
-      const buffer = await client.get(location.path);
-      return Buffer.isBuffer(buffer) ? buffer : Buffer.from(buffer);
-    } finally {
-      try { await client.end(); } catch (_) { /* ignore */ }
-    }
-  }
-
-  /**
-   * Test that a destination is reachable + writable + deletable.
-   * Performs a small write/read/delete probe.
-   */
-  async testDestination(destination) {
-    const probeId = `test-${Date.now()}`;
-    const probeData = Buffer.from(`dashcaddy-test-${probeId}`);
-    const start = Date.now();
-
-    try {
-      const location = await this.saveToDestination(probeData, destination, probeId);
-
-      // Read it back
-      let readBack = null;
-      try {
-        readBack = await this.loadFromDestination(location);
-      } catch (_) {
-        // Some providers (e.g. local) we already trust the file system; skip
-      }
-
-      // Delete the probe
-      try {
-        await this._deleteFromDestination(location);
-      } catch (_) { /* ignore */ }
-
-      const elapsed = Date.now() - start;
-      return {
-        success: true,
-        type: destination.type,
-        elapsedMs: elapsed,
-        verified: readBack ? readBack.equals(probeData) : null
-      };
-    } catch (error) {
-      return {
-        success: false,
-        type: destination.type,
-        error: error.message,
-        elapsedMs: Date.now() - start
-      };
-    }
-  }
-
-  /**
-   * Delete a backup from a destination location
-   */
-  async _deleteFromDestination(location) {
-    if (location.type === 'local') {
-      if (fs.existsSync(location.path)) fs.unlinkSync(location.path);
-      return;
-    }
-    if (location.type === 'dropbox') {
-      const { Dropbox } = require('dropbox');
-      const creds = await this._getCloudCredentials('dropbox');
-      const dbx = new Dropbox({ accessToken: creds.token });
-      try { await dbx.filesDeleteV2({ path: location.path }); } catch (_) { /* ignore */ }
-      return;
-    }
-    if (location.type === 'webdav') {
-      const { createClient } = require('webdav');
-      const creds = await this._getCloudCredentials('webdav');
-      const client = createClient(creds.url, { username: creds.username, password: creds.password });
-      try { await client.deleteFile(location.path); } catch (_) { /* ignore */ }
-      return;
-    }
-    if (location.type === 'sftp') {
-      const SftpClient = require('ssh2-sftp-client');
-      const creds = await this._getCloudCredentials('sftp');
-      const client = new SftpClient();
-      try {
-        await client.connect({
-          host: creds.host,
-          port: creds.port,
-          username: creds.username,
-          password: creds.password || undefined,
-          privateKey: creds.privateKey || undefined
-        });
-        try { await client.delete(location.path); } catch (_) { /* ignore */ }
-      } finally {
-        try { await client.end(); } catch (_) { /* ignore */ }
-      }
-      return;
-    }
-  }
-
   /**
    * Verify backup integrity
    */
@@ -904,24 +618,9 @@ class BackupManager extends EventEmitter {
         throw new Error(`Backup not found: ${backupId}`);
       }
 
-      // Load backup data — try each destination location until one succeeds
-      const location = backup.locations[0]; // Primary location
-      let data;
-      try {
-        data = await this.loadFromDestination(location);
-      } catch (loadErr) {
-        // Fall back to other locations if available
-        let recovered = false;
-        for (let i = 1; i < backup.locations.length; i++) {
-          try {
-            data = await this.loadFromDestination(backup.locations[i]);
-            recovered = true;
-            console.log(`[BackupManager] Loaded backup from fallback location ${backup.locations[i].type}`);
-            break;
-          } catch (_) { /* ignore */ }
-        }
-        if (!recovered) throw loadErr;
-      }
+      // Load backup data
+      const location = backup.locations[0]; // Use first location
+      let data = fs.readFileSync(location.path);
 
       // Decrypt if needed
       if (backup.encrypted && options.encryptionKey) {
@@ -1018,6 +717,63 @@ class BackupManager extends EventEmitter {
     console.log('[BackupManager] Stats restored');
   }
 
+  /**
+   * Enforce storage limit by deleting oldest backups until total is within limit
+   */
+  async enforceStorageLimit(name, maxBytes) {
+    const maxStr = formatBytes(maxBytes);
+    console.log("[BackupManager] Enforcing storage limit: " + maxStr + " for \"" + name + "\"");
+
+    const backups = this.history
+      .filter(b => b.name === name && b.status === 'success')
+      .sort((a, b) => new Date(a.timestamp) - new Date(b.timestamp));
+
+    let totalSize = 0;
+    const locationsMap = {};
+
+    for (const backup of backups) {
+      for (const loc of backup.locations || []) {
+        if (loc.type === 'local' && loc.path) {
+          totalSize += loc.size || 0;
+          locationsMap[backup.id] = locationsMap[backup.id] || [];
+          locationsMap[backup.id].push(loc.path);
+        }
+      }
+    }
+
+    console.log("[BackupManager] Current total size: " + formatBytes(totalSize) + ", limit: " + maxStr);
+
+    if (totalSize <= maxBytes) {
+      console.log("[BackupManager] Storage limit OK (" + formatBytes(totalSize) + " <= " + maxStr + ")");
+      return;
+    }
+
+    let freed = 0;
+    for (const backup of backups) {
+      if (totalSize <= maxBytes) break;
+
+      const paths = locationsMap[backup.id] || [];
+      for (const path of paths) {
+        try {
+          if (fs.existsSync(path)) {
+            fs.unlinkSync(path);
+            const sz = backup.size || 0;
+            totalSize -= sz;
+            freed += sz;
+            console.log("[BackupManager] Deleted " + formatBytes(sz) + ": " + path);
+          }
+        } catch (error) {
+          console.error("[BackupManager] Error deleting " + path + ": " + error.message);
+        }
+      }
+
+      this.history = this.history.filter(b => b.id !== backup.id);
+    }
+
+    this.saveHistory();
+    console.log("[BackupManager] Storage limit enforced. Freed " + formatBytes(freed) + ", now " + formatBytes(totalSize));
+  }
+
   /**
    * Cleanup old backups based on retention policy
    */
@@ -1032,12 +788,10 @@ class BackupManager extends EventEmitter {
 
     for (const backup of toDelete) {
       try {
-        // Delete from all locations (local + cloud)
+        // Delete from all locations
         for (const location of backup.locations) {
-          try {
-            await this._deleteFromDestination(location);
-          } catch (delErr) {
-            console.warn(`[BackupManager] Could not delete ${location.type} location for ${backup.id}:`, delErr.message);
+          if (location.type === 'local' && fs.existsSync(location.path)) {
+            fs.unlinkSync(location.path);
           }
         }
 

dashcaddy-api/credential-manager.js

@@ -319,6 +319,53 @@ class CredentialManager {
       : data.value;
   }
 
+  /**
+   * Retrieve a credential with diagnostic info on failure.
+   *
+   * Used by the TOTP recovery flow: when a user is locked out and the secret
+   * can't be decrypted (e.g. encryption key was rotated by a container
+   * recreate), we need to distinguish "no secret was ever set" from "secret
+   * is on disk but unreadable" so the UI can show a useful next step.
+   *
+   * Status codes:
+   *   'ok'                    — value decrypted / returned as-is
+   *   'missing'               — key is not present in the store at all
+   *   'unreadable'            — key is present but decryption failed (key mismatch / corruption)
+   *   'malformed'             — entry exists but value is not in expected encrypted format
+   *
+   * @param {string} key - Credential identifier
+   * @returns {Promise<{ status: string, value: string|null, error?: string }>}
+   */
+  async diagnose(key) {
+    try {
+      const credentials = await this.loadCredentialsFile();
+      const data = credentials[key];
+      if (!data) return { status: 'missing', value: null };
+
+      if (!cryptoUtils.isEncrypted(data.value)) {
+        // Plaintext entry — return as-is
+        return { status: 'ok', value: data.value };
+      }
+
+      try {
+        const decrypted = cryptoUtils.decrypt(data.value);
+        return { status: 'ok', value: decrypted };
+      } catch (decryptErr) {
+        // Most common cause: the encryption key on disk is different from
+        // the key that originally encrypted this entry (rotated by a
+        // container recreate that didn't preserve CREDENTIALS_FILE env).
+        console.warn(
+          `[CredentialManager] '${key}' is present but cannot be decrypted ` +
+          `(likely encryption-key mismatch): ${decryptErr.message}`
+        );
+        return { status: 'unreadable', value: null, error: decryptErr.message };
+      }
+    } catch (err) {
+      console.error(`[CredentialManager] diagnose('${key}') failed:`, err.message);
+      return { status: 'malformed', value: null, error: err.message };
+    }
+  }
+
   async deleteFromFile(key) {
     await this._lockedUpdate(credentials => {
       delete credentials[key];

dashcaddy-api/crypto-utils.js

@@ -66,6 +66,31 @@ function loadOrCreateKey() {
       if (keyData.length >= 64) {
         encryptionKey = Buffer.from(keyData, 'hex');
         console.log('[Crypto] Loaded encryption key from file');
+        // First-run bootstrap: if .bak doesn't exist yet, write the current
+        // key to it. This ensures the silent recovery path is available from
+        // the very next restart without requiring an explicit rotateKey().
+        if (!fs.existsSync(KEY_FILE + '.bak')) {
+          try {
+            fs.writeFileSync(KEY_FILE + '.bak', keyData, { mode: 0o600 });
+            console.log(`[Crypto] Seeded ${KEY_FILE}.bak with current key for future fallback`);
+          } catch (e) {
+            console.warn('[Crypto] Could not seed .bak key file:', e.message);
+          }
+        }
+        // Try fallback to .bak key if primary can't decrypt existing credentials.
+        // This handles the "container recreate rotated the key" case where the
+        // backup key on disk is the ORIGINAL key that can still read the
+        // bind-mounted /app/data/credentials.json written before the upgrade.
+        if (fs.existsSync(KEY_FILE + '.bak')) {
+          try {
+            const backupData = fs.readFileSync(KEY_FILE + '.bak', 'utf8').trim();
+            if (backupData.length >= 64) {
+              encryptionKey = tryFallbackToBackupKey(Buffer.from(keyData, 'hex'), Buffer.from(backupData, 'hex'));
+            }
+          } catch (e) {
+            console.warn('[Crypto] Could not check backup key:', e.message);
+          }
+        }
         return encryptionKey;
       }
       // File exists but key is invalid/empty - will generate new one below
@@ -89,6 +114,64 @@ function loadOrCreateKey() {
   return encryptionKey;
 }
 
+/**
+ * If the primary key fails to decrypt any existing credentials, try the backup
+ * key. This is the silent recovery path: if a container recreate replaced
+ * .encryption-key with a fresh one but left .encryption-key.bak (the previous
+ * key), the old key can still decrypt the bind-mounted credentials.json and
+ * the user stays logged in without ever noticing.
+ *
+ * Called only at startup when both key files exist. Returns the working key
+ * (either primary or backup). If neither works, returns the primary (existing
+ * behavior — `retrieve()` will surface "unreadable" via credential-manager.diagnose).
+ *
+ * @param {Buffer} primaryKey - key from .encryption-key
+ * @param {Buffer} backupKey  - key from .encryption-key.bak
+ * @returns {Buffer} the key that should be used
+ */
+function tryFallbackToBackupKey(primaryKey, backupKey) {
+  const CREDENTIALS_FILE = process.env.CREDENTIALS_FILE ||
+    require('path').join(__dirname, 'credentials.json');
+  if (!fs.existsSync(CREDENTIALS_FILE)) return primaryKey;
+
+  let credentials;
+  try {
+    credentials = JSON.parse(fs.readFileSync(CREDENTIALS_FILE, 'utf8'));
+  } catch {
+    return primaryKey;
+  }
+
+  // Find the first encrypted entry to probe
+  const probeEntry = Object.values(credentials).find(v => v && v.value && isEncrypted(v.value));
+  if (!probeEntry) return primaryKey;
+
+  const tryDecrypt = (key) => {
+    const parts = probeEntry.value.split(':');
+    if (parts.length !== 3) return false;
+    try {
+      const iv = Buffer.from(parts[0], 'base64');
+      const tag = Buffer.from(parts[1], 'base64');
+      const ct = Buffer.from(parts[2], 'base64');
+      const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+      decipher.setAuthTag(tag);
+      Buffer.concat([decipher.update(ct), decipher.final()]);
+      return true;
+    } catch { return false; }
+  };
+
+  if (tryDecrypt(primaryKey)) return primaryKey;
+  if (tryDecrypt(backupKey)) {
+    console.warn(
+      '[Crypto] Primary encryption key failed to decrypt credentials; ' +
+      'fell back to .encryption-key.bak. The current primary key was set ' +
+      'without preserving the original. Consider rotating the key explicitly ' +
+      'via the credential-manager API to avoid this warning next restart.'
+    );
+    return backupKey;
+  }
+  return primaryKey; // neither works — credential-manager.diagnose() will report 'unreadable'
+}
+
 /**
  * Encrypt sensitive data
  * @param {string|object} data - Data to encrypt (strings or objects)
@@ -276,6 +359,17 @@ function rotateKey() {
   const oldKey = loadOrCreateKey(); // Ensure we have the current key loaded
   const newKey = generateKey();
 
+  // Save the OLD key to .bak BEFORE swapping the primary. This gives the
+  // startup-time fallback a way to recover the previous key if a future
+  // restart loses the new one (e.g. another accidental recreate). The .bak
+  // file is overwritten on each rotate so it always holds the previous key,
+  // not an ever-accumulating history.
+  try {
+    fs.writeFileSync(KEY_FILE + '.bak', oldKey.toString('hex'), { mode: 0o600 });
+  } catch (error) {
+    console.warn(`[Crypto] Could not save backup key to ${KEY_FILE}.bak:`, error.message);
+  }
+
   try {
     fs.writeFileSync(KEY_FILE, newKey.toString('hex'), { mode: 0o600 });
   } catch (error) {

dashcaddy-api/data/services.json

@@ -0,0 +1,109 @@
+[
+  {
+    "id": "router",
+    "name": "Router UI",
+    "logo": "/assets/router.png",
+    "url": "https://router.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false
+  },
+  {
+    "id": "chat",
+    "name": "Chat",
+    "logo": "/assets/chat.png",
+    "url": "https://chat.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false
+  },
+  {
+    "id": "sync",
+    "name": "Syncthing",
+    "logo": "/assets/syncthing.png",
+    "url": "https://sync.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false
+  },
+  {
+    "id": "torrent",
+    "name": "qBittorrent",
+    "logo": "/assets/qBittorrent.png",
+    "url": "https://torrent.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false,
+    "deployedAt": "2026-01-18T06:04:55.246Z"
+  },
+  {
+    "id": "sonarr",
+    "name": "Sonarr",
+    "logo": "/assets/sonarr.png",
+    "url": "https://sonarr.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false,
+    "deployedAt": "2026-01-18T06:04:56.612Z"
+  },
+  {
+    "id": "radarr",
+    "name": "Radarr",
+    "logo": "/assets/radarr.png",
+    "url": "https://radarr.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false,
+    "deployedAt": "2026-01-18T08:28:12.359Z"
+  },
+  {
+    "id": "prowlarr",
+    "name": "Prowlarr",
+    "logo": "/assets/prowlarr.png",
+    "url": "https://prowlarr.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false,
+    "deployedAt": "2026-01-18T08:28:13.739Z"
+  },
+  {
+    "id": "ca",
+    "name": "DashCA",
+    "logo": "/assets/certificate-icon.png",
+    "containerId": null,
+    "appTemplate": "dashca",
+    "tailscaleOnly": false,
+    "deployedAt": "2026-02-11T11:47:08.383Z",
+    "url": "https://ca.sami"
+  },
+  {
+    "id": "plex",
+    "name": "Plex",
+    "logo": "/assets/plex.png",
+    "containerId": null,
+    "appTemplate": "plex",
+    "tailscaleOnly": false,
+    "deployedAt": "2026-02-12T02:18:36.067Z",
+    "url": "https://plex.sami"
+  },
+  {
+    "id": "requests",
+    "name": "Seerr",
+    "logo": "/assets/seerr.png",
+    "url": "https://requests.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false
+  },
+  {
+    "id": "git",
+    "name": "Gitea",
+    "logo": "/assets/gitea.png",
+    "url": "https://git.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false
+  },
+  {
+    "id": "files",
+    "name": "Sami Files",
+    "logo": "/assets/sami-files.png",
+    "url": "https://files.sami",
+    "ip": "localhost",
+    "tailscaleOnly": false,
+    "containerId": null,
+    "appTemplate": "sami-files",
+    "deployedAt": "2026-06-19T00:00:00.000Z"
+  }
+] 

dashcaddy-api/health-checker.js

@@ -9,9 +9,24 @@ const http = require('http');
 const EventEmitter = require('events');
 const fs = require('fs');
 const path = require('path');
+const paths = require('./platform-paths');
 
-const HEALTH_CONFIG_FILE = process.env.HEALTH_CONFIG_FILE || path.join(__dirname, 'health-config.json');
-const HEALTH_HISTORY_FILE = process.env.HEALTH_HISTORY_FILE || path.join(__dirname, 'health-history.json');
+// Persist health config + history alongside the other state files (services.json,
+// config.json) rather than next to the source. In a container that data dir is the
+// mounted /app/data volume, so uptime history survives container recreates/updates;
+// previously these defaulted to __dirname (unmounted /app) and every recreate wiped
+// the accumulated history, blanking the dashboard uptime bars. Explicit env vars
+// still override.
+const HEALTH_DATA_DIR = process.env.HEALTH_DATA_DIR || path.dirname(paths.configFile);
+const HEALTH_CONFIG_FILE = process.env.HEALTH_CONFIG_FILE || path.join(HEALTH_DATA_DIR, 'health-config.json');
+const HEALTH_HISTORY_FILE = process.env.HEALTH_HISTORY_FILE || path.join(HEALTH_DATA_DIR, 'health-history.json');
+
+// Legacy locations (next to the source) used before the data-dir default. Read these
+// once on first load if the new files are absent, so upgrading installs migrate their
+// accumulated history/config instead of starting empty. The next save() rewrites to
+// the new location.
+const LEGACY_HEALTH_CONFIG_FILE = path.join(__dirname, 'health-config.json');
+const LEGACY_HEALTH_HISTORY_FILE = path.join(__dirname, 'health-history.json');
 const CHECK_INTERVAL = parseInt(process.env.HEALTH_CHECK_INTERVAL || '30000', 10); // 30 seconds
 const MAX_CHECK_INTERVAL = parseInt(process.env.HEALTH_CHECK_MAX_INTERVAL || '300000', 10); // 5 minutes max backoff
 const HISTORY_RETENTION_DAYS = parseInt(process.env.HEALTH_HISTORY_RETENTION || '30', 10);
@@ -541,8 +556,10 @@ class HealthChecker extends EventEmitter {
    */
   loadConfig() {
     try {
-      if (fs.existsSync(HEALTH_CONFIG_FILE)) {
-        return JSON.parse(fs.readFileSync(HEALTH_CONFIG_FILE, 'utf8'));
+      const file = fs.existsSync(HEALTH_CONFIG_FILE) ? HEALTH_CONFIG_FILE
+        : (HEALTH_CONFIG_FILE !== LEGACY_HEALTH_CONFIG_FILE && fs.existsSync(LEGACY_HEALTH_CONFIG_FILE) ? LEGACY_HEALTH_CONFIG_FILE : null);
+      if (file) {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
       }
     } catch (error) {
       this.emit('log', 'error', `Error loading config: ${error.message}`);
@@ -566,8 +583,10 @@ class HealthChecker extends EventEmitter {
    */
   loadHistory() {
     try {
-      if (fs.existsSync(HEALTH_HISTORY_FILE)) {
-        return JSON.parse(fs.readFileSync(HEALTH_HISTORY_FILE, 'utf8'));
+      const file = fs.existsSync(HEALTH_HISTORY_FILE) ? HEALTH_HISTORY_FILE
+        : (HEALTH_HISTORY_FILE !== LEGACY_HEALTH_HISTORY_FILE && fs.existsSync(LEGACY_HEALTH_HISTORY_FILE) ? LEGACY_HEALTH_HISTORY_FILE : null);
+      if (file) {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
       }
     } catch (error) {
       this.emit('log', 'error', `Error loading history: ${error.message}`);

dashcaddy-api/middleware.js

@@ -283,6 +283,7 @@ module.exports = function configureMiddleware(app, {
     { path: '/probe/',                   prefix: true },
     { path: '/api/v1/tailscale/',        prefix: true },
     { path: '/api/v1/totp/config',        exact: true,  method: 'GET' },
+    { path: '/api/v1/totp/recovery-info', exact: true,  method: 'GET' },
     { path: '/api/v1/totp/verify',        exact: true },
     { path: '/api/v1/totp/setup',         exact: true,  method: 'POST' },
     { path: '/api/v1/totp/verify-setup',  exact: true,  method: 'POST' },
@@ -304,6 +305,15 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/license/feature/',  prefix: true, method: 'GET' },
     { path: '/api/v1/config',             exact: true,  method: 'GET' },
     { path: '/api/v1/services/status',    exact: true,  method: 'GET' },
+    { path: '/api/v1/health-checks/status', exact: true, method: 'GET' },
+    // Read-only update/version info shown on the dashboard view (verification
+    // modal, topbar version, update badges). Mutating actions — update-apply,
+    // rollback (POST) — are NOT listed here and stay TOTP-protected.
+    { path: '/api/v1/system/version',        exact: true, method: 'GET' },
+    { path: '/api/v1/system/update-status',  exact: true, method: 'GET' },
+    { path: '/api/v1/system/update-history', exact: true, method: 'GET' },
+    { path: '/api/v1/system/update-check',   exact: true, method: 'GET' },
+    { path: '/api/v1/updates/available',     exact: true, method: 'GET' },
     { path: '/api/v1/system/update-notify', exact: true, method: 'POST' },
   ];
 

dashcaddy-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dashcaddy-api",
-  "version": "1.6.0",
+  "version": "1.7.8",
   "description": "DashCaddy API server - Dashboard backend for Docker, Caddy & DNS management",
   "main": "server.js",
   "scripts": {

dashcaddy-api/routes/auth/totp.js

@@ -37,6 +37,66 @@ module.exports = function({ authManager, credentialManager, totpConfig, saveTotp
     });
   }, 'totp-config-get'));
 
+  // Recovery diagnostic (public, no auth required).
+  //
+  // Returns information a locked-out user needs to choose a recovery path:
+  //   - whether TOTP is configured at all (isSetUp)
+  //   - whether the stored secret is readable by the current encryption key
+  //   - a human-readable hint matching the situation
+  //
+  // Status values:
+  //   'not_configured'  — no TOTP setup yet, user should set it up
+  //   'healthy'         — secret present and decryptable, normal login
+  //   'unreadable'      — secret on disk but can't decrypt (key rotated)
+  //   'corrupt'         — entry exists but value is malformed
+  //
+  // This route never returns the secret itself — only metadata about it.
+  router.get('/totp/recovery-info', asyncHandler(async (req, res) => {
+    if (!ctx.totpConfig.isSetUp) {
+      return res.json({
+        success: true,
+        status: 'not_configured',
+        isSetUp: false,
+        hint: 'TOTP has not been set up on this server yet. Open settings to configure it.'
+      });
+    }
+
+    const diag = await ctx.credentialManager.diagnose('totp.secret');
+    if (diag.status === 'ok') {
+      return res.json({
+        success: true,
+        status: 'healthy',
+        isSetUp: true,
+        hint: 'TOTP is configured and the stored secret is readable. Enter your authenticator code to log in.'
+      });
+    }
+    if (diag.status === 'unreadable') {
+      return res.json({
+        success: true,
+        status: 'unreadable',
+        isSetUp: true,
+        hint: 'Your stored TOTP secret is on disk but cannot be decrypted — this usually means the encryption key changed during an upgrade. ' +
+              'If you saved your Base32 secret when you first set up TOTP, paste it below to restore access. ' +
+              'Otherwise you will need SSH access to the server to recover or rotate the key.'
+      });
+    }
+    if (diag.status === 'missing') {
+      // Config says isSetUp:true but no secret in store — corrupted config state
+      return res.json({
+        success: true,
+        status: 'corrupt',
+        isSetUp: true,
+        hint: 'TOTP is marked as configured but the secret is missing. Set up TOTP again with a fresh secret.'
+      });
+    }
+    return res.json({
+      success: true,
+      status: 'corrupt',
+      isSetUp: true,
+      hint: 'TOTP storage is in an unexpected state. ' + (diag.error || '')
+    });
+  }, 'totp-recovery-info'));
+
   // Generate new TOTP secret + QR code
   router.post('/totp/setup', asyncHandler(async (req, res) => {
     const { authenticator } = require('otplib');

dashcaddy-api/routes/backups.js

@@ -1,9 +1,13 @@
 const express = require('express');
-const { success } = require('../response-helpers');
-const fs = require('fs');
+const fsp = require('fs').promises;
 const path = require('path');
+const fs = require('fs');
+const { success } = require('../response-helpers');
 
-const DEFAULT_BACKUP_DIR = process.env.BACKUP_DIR || path.join(__dirname, 'backups');
+const DEFAULT_BACKUP_DIR = process.env.BACKUP_DIR || path.join(__dirname, '..', 'backups');
+const DEFAULT_MAX_STORAGE_BYTES = process.env.BACKUP_MAX_STORAGE_BYTES
+  ? parseInt(process.env.BACKUP_MAX_STORAGE_BYTES, 10)
+  : 0;
 
 /**
  * Backups routes factory
@@ -41,6 +45,7 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
         runImmediately: backup.runImmediately || false,
         destination: backup.destination || 'local',
         destinationPath: backup.destinationPath || DEFAULT_BACKUP_DIR,
+        maxStorageBytes: backup.maxStorageBytes || null,
         lastRun: lastRun ? lastRun.toISOString() : null,
         nextRun: nextRun ? nextRun.toISOString() : null,
         lastBackupId: appHistory.length > 0 ? appHistory[0].id : null
@@ -52,7 +57,7 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
 
   // Create or update a scheduled backup for an app
   router.post('/backups/schedule', premiumGating, asyncHandler(async (req, res) => {
-    const { appId, enabled, schedule, retention, runImmediately, destination, destinationPath } = req.body;
+    const { appId, enabled, schedule, retention, runImmediately, destination, destinationPath, maxStorageBytes } = req.body;
 
     if (!appId) {
       const { ValidationError } = require('../errors');
@@ -62,6 +67,11 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
     const config = backupManager.getConfig();
     if (!config.backups) config.backups = {};
 
+    // Parse maxStorageBytes if provided as string (e.g. "10GB")
+    const parsedMaxStorage = maxStorageBytes
+      ? (typeof maxStorageBytes === 'string' ? parseStorageSize(maxStorageBytes) : maxStorageBytes)
+      : null;
+
     // Build the backup config for this app
     const backupConfig = {
       enabled: enabled !== undefined ? enabled : true,
@@ -71,7 +81,8 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
       destination: destination || 'local',
       destinationPath: destinationPath || DEFAULT_BACKUP_DIR,
       include: ['all'],
-      destinations: [{ type: destination || 'local', path: destinationPath || DEFAULT_BACKUP_DIR }]
+      destinations: [{ type: destination || 'local', path: destinationPath || DEFAULT_BACKUP_DIR }],
+      maxStorageBytes: parsedMaxStorage
     };
 
     config.backups[appId] = backupConfig;
@@ -490,6 +501,39 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
     success(res, { history });
   }, 'backups-history'));
 
+  // Get storage info for backups destination
+  router.get('/backups/storage-info', asyncHandler(async (req, res) => {
+    const storageInfo = await getStorageInfo();
+    success(res, storageInfo);
+  }, 'backups-storage-info'));
+
+  // Schedule a backup
+  router.post('/backups/schedule', asyncHandler(async (req, res) => {
+    const { name, schedule, maxStorageBytes, ...backupConfig } = req.body;
+
+    if (!name || !schedule) {
+      return res.status(400).json({ error: 'name and schedule are required' });
+    }
+
+    const config = backupManager.getConfig();
+
+    // Store maxStorageBytes in the backup config (converted to bytes)
+    const maxBytes = typeof maxStorageBytes === 'number' && maxStorageBytes > 0
+      ? maxStorageBytes
+      : (typeof maxStorageBytes === 'string' ? parseStorageSize(maxStorageBytes) : 0);
+
+    config.backups[name] = {
+      ...backupConfig,
+      enabled: true,
+      schedule,
+      maxStorageBytes: maxBytes,
+      destinations: backupConfig.destinations || [{ type: 'local' }]
+    };
+
+    backupManager.updateConfig(config);
+    success(res, { message: `Backup '${name}' scheduled`, maxStorageBytes: maxBytes });
+  }, 'backups-schedule'));
+
   // Restore from backup
   router.post('/backups/restore/:backupId', asyncHandler(async (req, res) => {
     const result = await backupManager.restoreBackup(req.params.backupId, req.body);
@@ -653,3 +697,121 @@ function formatBytes(bytes) {
   const i = Math.floor(Math.log(bytes) / Math.log(k));
   return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
 }
+
+/**
+ * Get storage information for the backup directory
+ */
+async function getStorageInfo() {
+  const result = {
+    destination: DEFAULT_BACKUP_DIR,
+    maxStorageBytes: DEFAULT_MAX_STORAGE_BYTES,
+    usedBytes: 0,
+    availableBytes: 0,
+    usagePercent: 0,
+    backupCount: 0,
+    oldestBackup: null,
+    newestBackup: null
+  };
+
+  try {
+    // Get disk space info
+    const diskSpace = await getDiskSpaceInfo(DEFAULT_BACKUP_DIR);
+    result.availableBytes = diskSpace.available;
+
+    // Scan for backup files
+    if (DEFAULT_MAX_STORAGE_BYTES > 0) {
+      result.maxStorageBytes = DEFAULT_MAX_STORAGE_BYTES;
+    } else {
+      result.maxStorageBytes = diskSpace.total || 0;
+    }
+
+    let totalSize = 0;
+    let oldestTime = null;
+    let newestTime = null;
+
+    try {
+      const entries = await fsp.readdir(DEFAULT_BACKUP_DIR);
+      for (const entry of entries) {
+        if (entry.endsWith('.backup')) {
+          const filePath = path.join(DEFAULT_BACKUP_DIR, entry);
+          try {
+            const stats = await fsp.stat(filePath);
+            totalSize += stats.size;
+            result.backupCount++;
+
+            const fileTime = new Date(stats.mtime);
+            if (!oldestTime || fileTime < oldestTime) oldestTime = fileTime;
+            if (!newestTime || fileTime > newestTime) newestTime = fileTime;
+          } catch (e) {
+            // Skip files we can't stat
+          }
+        }
+      }
+    } catch (e) {
+      // Backup directory might not exist yet
+    }
+
+    result.usedBytes = totalSize;
+    result.oldestBackup = oldestTime ? oldestTime.toISOString() : null;
+    result.newestBackup = newestTime ? newestTime.toISOString() : null;
+
+    // Calculate available (total limit - used), or from disk space if no limit set
+    if (result.maxStorageBytes > 0) {
+      result.availableBytes = Math.max(0, result.maxStorageBytes - totalSize);
+      result.usagePercent = parseFloat(((totalSize / result.maxStorageBytes) * 100).toFixed(2));
+    } else if (diskSpace.total) {
+      result.availableBytes = diskSpace.available;
+      result.usagePercent = diskSpace.total > 0
+        ? parseFloat((((diskSpace.total - diskSpace.available) / diskSpace.total) * 100).toFixed(2))
+        : 0;
+    }
+  } catch (error) {
+    console.error('[BackupsRouter] Error getting storage info:', error.message);
+  }
+
+  return result;
+}
+
+/**
+ * Get disk space info (filesystem-agnostic)
+ */
+async function getDiskSpaceInfo(dirPath) {
+  try {
+    const diskInfo = await fsp.statfs(dirPath);
+    return {
+      total: diskInfo.blocks * diskInfo.bsize,
+      available: diskInfo.bfree * diskInfo.bsize,
+      used: (diskInfo.blocks - diskInfo.bfree) * diskInfo.bsize
+    };
+  } catch (error) {
+    // Directory might not exist or be accessible
+    return { total: 0, available: 0, used: 0 };
+  }
+}
+
+/**
+ * Parse storage size string like "10GB" to bytes
+ */
+function parseStorageSize(sizeStr) {
+  if (!sizeStr || typeof sizeStr === 'number') return sizeStr || 0;
+
+  const match = String(sizeStr).match(/^(\d+(?:\.\d+)?)\s*(B|KB|MB|GB|TB|K|M|G|T)?$/i);
+  if (!match) return 0;
+
+  const value = parseFloat(match[1]);
+  const unit = (match[2] || 'B').toUpperCase();
+
+  const multipliers = {
+    'B': 1,
+    'K': 1024,
+    'KB': 1024,
+    'M': 1024 * 1024,
+    'MB': 1024 * 1024,
+    'G': 1024 * 1024 * 1024,
+    'GB': 1024 * 1024 * 1024,
+    'T': 1024 * 1024 * 1024 * 1024,
+    'TB': 1024 * 1024 * 1024 * 1024
+  };
+
+  return Math.floor(value * (multipliers[unit] || 1));
+}

dashcaddy-api/scripts/dashcaddy-update.sh

@@ -134,11 +134,16 @@ restart_container() {
   # Stop and remove existing container so new env var is applied
   docker rm -f "$CONTAINER_NAME" 2>/dev/null || true
 
-  # Re-create with same volumes and the SERVICES_FILE env var
+  # Re-create with same volumes. CRITICAL: must include CREDENTIALS_FILE +
+  # ENCRYPTION_KEY_FILE pointing at /app/data/ so the container reads the TOTP
+  # secret from the bind-mounted host data dir (not image-local /app/credentials.json
+  # which gets a fresh encryption key on every container recreate = TOTP breaks).
   docker run -d --restart unless-stopped --name "$CONTAINER_NAME" \
     -p 127.0.0.1:3001:3001 \
     -v /opt/dashcaddy/dashcaddy-api/data:/app/data \
     -e SERVICES_FILE=/app/data/services.json \
+    -e CREDENTIALS_FILE=/app/d...son \
+    -e ENCRYPTION_KEY_FILE=/app/data/.encryption-key \
     "$image"
   log "Container restarted with fresh env"
 }

dashcaddy-api/src/app.js

@@ -164,6 +164,21 @@ async function createApp() {
     return null;
   }
 
+  // Back-compat: reverse-proxy SSO snippets (Caddy forward_auth + per-service
+  // auto-login pages) historically call these endpoints under the pre-1.5.0
+  // prefix `/api/auth/...`. The canonical mount is `/api/v1`. Hand-maintained
+  // Caddyfiles have repeatedly drifted back to the old prefix and 404'd the SSO
+  // gate (breaking Plex/Jellyfin/Emby/chat). Transparently rewrite ONLY these two
+  // auth paths to the v1 mount so the gate is tolerant of that drift. Must run
+  // before configureMiddleware() so CSRF/auth see the canonical path. This is
+  // deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
+  app.use((req, res, next) => {
+    if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/auth/app-token/')) {
+      req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4
+    }
+    next();
+  });
+
   // Configure middleware
   const middlewareResult = configureMiddleware(app, {
     siteConfig: config.siteConfig,

dashcaddy-api/status/js/monitoring-widgets.js

@@ -0,0 +1,335 @@
+// ========== MONITORING WIDGETS ==========
+// Embeds a compact system-resource + health summary panel directly on the
+// main dashboard. Replaces the need for a separate monitoring-dashboard.html
+// page — quick at-a-glance stats where you already are.
+(function () {
+
+  // ----- Style injection (scoped to .dc-monitor so it doesn't leak) -----
+  const styleEl = document.createElement('style');
+  styleEl.textContent = `
+    .dc-monitor {
+      display: grid;
+      grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+      gap: 12px;
+      margin-bottom: 16px;
+      padding: 12px 16px;
+      background: var(--card-base);
+      border: 1px solid var(--border);
+      border-radius: var(--radius);
+    }
+    .dc-monitor-card {
+      padding: 10px 12px;
+      background: var(--card-bg, rgba(255,255,255,0.04));
+      border-radius: 8px;
+      border: 1px solid var(--border);
+    }
+    .dc-monitor-label {
+      font-size: 0.7rem;
+      color: var(--muted);
+      text-transform: uppercase;
+      letter-spacing: 0.5px;
+      margin-bottom: 4px;
+    }
+    .dc-monitor-value {
+      font-size: 1.4rem;
+      font-weight: 600;
+      color: var(--fg);
+    }
+    .dc-monitor-sub {
+      font-size: 0.7rem;
+      color: var(--muted);
+      margin-top: 4px;
+    }
+    .dc-monitor-bar {
+      margin-top: 6px;
+      width: 100%;
+      height: 4px;
+      background: color-mix(in srgb, var(--muted) 20%, transparent);
+      border-radius: 2px;
+      overflow: hidden;
+    }
+    .dc-monitor-bar-fill {
+      height: 100%;
+      width: 0%;
+      background: var(--ok-fg, #27ae60);
+      transition: width 0.3s ease, background 0.3s ease;
+    }
+    .dc-monitor-bar-fill.warn { background: #f39c12; }
+    .dc-monitor-bar-fill.bad  { background: #e74c3c; }
+    .dc-monitor-header {
+      display: flex;
+      align-items: center;
+      justify-content: space-between;
+      margin-bottom: 8px;
+    }
+    .dc-monitor-title {
+      font-size: 0.85rem;
+      font-weight: 500;
+      color: var(--muted);
+      display: flex;
+      align-items: center;
+      gap: 6px;
+    }
+    .dc-monitor-pill {
+      display: inline-flex;
+      align-items: center;
+      gap: 4px;
+      padding: 2px 8px;
+      border-radius: 999px;
+      font-size: 0.7rem;
+      font-weight: 500;
+    }
+    .dc-monitor-pill.ok   { background: color-mix(in srgb, #27ae60 20%, transparent); color: #27ae60; }
+    .dc-monitor-pill.warn { background: color-mix(in srgb, #f39c12 20%, transparent); color: #f39c12; }
+    .dc-monitor-pill.bad  { background: color-mix(in srgb, #e74c3c 20%, transparent); color: #e74c3c; }
+    .dc-monitor-refresh {
+      font-size: 0.7rem;
+      color: var(--muted);
+      opacity: 0.7;
+    }
+  `;
+  document.head.appendChild(styleEl);
+
+  // ----- Container element (inserted above service-filter-bar) -----
+  const filterBar = document.getElementById('service-filter-bar');
+  if (!filterBar) return;
+
+  const panel = document.createElement('div');
+  panel.className = 'dc-monitor';
+  panel.id = 'dc-monitor-panel';
+  panel.innerHTML = `
+    <div class="dc-monitor-header" style="grid-column: 1 / -1;">
+      <div class="dc-monitor-title">📊 System Overview</div>
+      <span class="dc-monitor-refresh" id="dc-monitor-refresh-stamp">—</span>
+    </div>
+    <div class="dc-monitor-card">
+      <div class="dc-monitor-label">Services</div>
+      <div class="dc-monitor-value" id="dc-monitor-services">—</div>
+      <div class="dc-monitor-sub" id="dc-monitor-services-sub">loading…</div>
+    </div>
+    <div class="dc-monitor-card">
+      <div class="dc-monitor-label">Containers Up</div>
+      <div class="dc-monitor-value" id="dc-monitor-containers">—</div>
+      <div class="dc-monitor-sub" id="dc-monitor-containers-sub">loading…</div>
+    </div>
+    <div class="dc-monitor-card">
+      <div class="dc-monitor-label">Avg CPU</div>
+      <div class="dc-monitor-value" id="dc-monitor-cpu">—</div>
+      <div class="dc-monitor-bar"><div class="dc-monitor-bar-fill" id="dc-monitor-cpu-bar"></div></div>
+    </div>
+    <div class="dc-monitor-card">
+      <div class="dc-monitor-label">Avg Memory</div>
+      <div class="dc-monitor-value" id="dc-monitor-mem">—</div>
+      <div class="dc-monitor-bar"><div class="dc-monitor-bar-fill" id="dc-monitor-mem-bar"></div></div>
+    </div>
+    <div class="dc-monitor-card">
+      <div class="dc-monitor-label">Health</div>
+      <div class="dc-monitor-value" id="dc-monitor-health">—</div>
+      <div class="dc-monitor-sub" id="dc-monitor-health-sub">—</div>
+    </div>
+  `;
+  // Insert ABOVE the filter bar
+  filterBar.parentNode.insertBefore(panel, filterBar);
+
+  // ----- Helpers -----
+  function setBar(id, pct) {
+    const el = document.getElementById(id);
+    if (!el) return;
+    const p = Math.max(0, Math.min(100, Number(pct) || 0));
+    el.style.width = p + '%';
+    el.classList.remove('warn', 'bad');
+    if (p >= 85) el.classList.add('bad');
+    else if (p >= 65) el.classList.add('warn');
+  }
+
+  function fmtPct(v) {
+    if (v == null || isNaN(v)) return '—';
+    return (Math.round(v * 10) / 10) + '%';
+  }
+
+  function fmtBytes(b) {
+    if (b == null || isNaN(b)) return '—';
+    const units = ['B', 'KB', 'MB', 'GB', 'TB'];
+    let i = 0;
+    while (b >= 1024 && i < units.length - 1) { b /= 1024; i++; }
+    return b.toFixed(1) + ' ' + units[i];
+  }
+
+  // ----- Robust services count -----
+  // Read from multiple sources so we always have a number:
+  //  1. window.APPS (populated by grid.js after loadServices)
+  //  2. #cards .card elements (post-buildGrid)
+  //  3. live fetch /api/v1/services (last-resort fallback if grid hasn't run)
+  async function fetchServicesCount() {
+    // Source 1+2: window.APPS / DOM cards
+    if (Array.isArray(window.APPS) && window.APPS.length > 0) {
+      const up = document.querySelectorAll('#cards .card[data-status="on"]').length;
+      return { total: window.APPS.length, up, source: 'APPS' };
+    }
+    const cards = document.querySelectorAll('#cards .card');
+    if (cards.length > 0) {
+      const up = Array.from(cards).filter(c => c.dataset.status === 'on').length;
+      return { total: cards.length, up, source: 'DOM' };
+    }
+    // Source 3: fetch live (endpoints may return {success, services:[...]} OR raw array)
+    try {
+      const r = await fetch('/api/v1/services', { cache: 'no-store' });
+      if (!r.ok) return { total: 0, up: 0, source: 'fetch-fail' };
+      const body = await r.json();
+      const list = (body && Array.isArray(body.services)) ? body.services
+                 : (Array.isArray(body)) ? body
+                 : [];
+      // Persist for the grid so this fallback only fires once
+      if (Array.isArray(window.APPS) || typeof window.APPS === 'undefined') window.APPS = list;
+      const up = document.querySelectorAll('#cards .card[data-status="on"]').length;
+      return { total: list.length, up, source: 'fetch' };
+    } catch (_) {
+      return { total: 0, up: 0, source: 'fetch-error' };
+    }
+  }
+
+  async function setServicesCard() {
+    const { total, up } = await fetchServicesCount();
+    const el = document.getElementById('dc-monitor-services');
+    const sub = document.getElementById('dc-monitor-services-sub');
+    if (el) el.textContent = `${up} / ${total}`;
+    if (sub) sub.textContent = total === 0
+      ? 'no services yet'
+      : `${up} online · ${total - up} offline`;
+  }
+
+  function applyHealthSummary(data) {
+    const el = document.getElementById('dc-monitor-health');
+    const sub = document.getElementById('dc-monitor-health-sub');
+    if (!el) return;
+    if (!data || data.summary == null) {
+      el.textContent = '—';
+      if (sub) sub.textContent = 'no data';
+      return;
+    }
+    const s = data.summary;
+    const healthy = s.healthy ?? s.up ?? 0;
+    const unhealthy = s.unhealthy ?? s.down ?? 0;
+    const total = s.total ?? (healthy + unhealthy);
+    el.textContent = `${healthy}/${total}`;
+    if (sub) {
+      if (unhealthy === 0) {
+        sub.innerHTML = '<span class="dc-monitor-pill ok">● all healthy</span>';
+      } else if (unhealthy <= 2) {
+        sub.innerHTML = `<span class="dc-monitor-pill warn">● ${unhealthy} degraded</span>`;
+      } else {
+        sub.innerHTML = `<span class="dc-monitor-pill bad">● ${unhealthy} down</span>`;
+      }
+    }
+  }
+
+  // ----- Data fetches -----
+  async function fetchStats() {
+    try {
+      const r = await fetch('/api/v1/monitoring/stats', { cache: 'no-store' });
+      if (!r.ok) return null;
+      const data = await r.json();
+      return (data && data.stats) ? data.stats : null;
+    } catch (_) {
+      return null;
+    }
+  }
+
+  async function fetchHealth() {
+    try {
+      const r = await fetch('/api/v1/health-checks/status', { cache: 'no-store' });
+      if (!r.ok) return null;
+      return await r.json();
+    } catch (_) {
+      return null;
+    }
+  }
+
+  function applyStats(stats) {
+    const containers = document.getElementById('dc-monitor-containers');
+    const containersSub = document.getElementById('dc-monitor-containers-sub');
+    const cpuEl = document.getElementById('dc-monitor-cpu');
+    const memEl = document.getElementById('dc-monitor-mem');
+
+    if (!stats) {
+      if (containers) containers.textContent = '—';
+      if (cpuEl) cpuEl.textContent = '—';
+      if (memEl) memEl.textContent = '—';
+      return;
+    }
+
+    const entries = Object.values(stats);
+    if (entries.length === 0) {
+      if (containers) containers.textContent = '0';
+      if (containersSub) containersSub.textContent = 'no containers reporting';
+      if (cpuEl) cpuEl.textContent = '0%';
+      if (memEl) memEl.textContent = '0%';
+      setBar('dc-monitor-cpu-bar', 0);
+      setBar('dc-monitor-mem-bar', 0);
+      return;
+    }
+
+    let cpuSum = 0, memSum = 0, memBytes = 0, cpuCount = 0, memCount = 0;
+    entries.forEach(s => {
+      // CPU may be percentage (0-100) or fraction (0-1) — handle both
+      if (s.cpu != null) {
+        const cpu = Number(s.cpu);
+        if (!isNaN(cpu)) {
+          cpuSum += cpu > 1 ? cpu : cpu * 100;
+          cpuCount++;
+        }
+      }
+      if (s.memory != null) {
+        const mem = Number(s.memory);
+        if (!isNaN(mem)) {
+          memSum += mem;
+          memBytes += Number(s.memoryUsage || 0);
+          memCount++;
+        }
+      }
+    });
+
+    const avgCpu = cpuCount ? cpuSum / cpuCount : 0;
+    const avgMem = memCount ? memSum / memCount : 0;
+
+    if (containers) containers.textContent = String(entries.length);
+    if (containersSub) {
+      const memTxt = memBytes ? ` · ${fmtBytes(memBytes)} RAM` : '';
+      containersSub.textContent = `running${memTxt}`;
+    }
+    if (cpuEl) cpuEl.textContent = fmtPct(avgCpu);
+    if (memEl) memEl.textContent = fmtPct(avgMem);
+    setBar('dc-monitor-cpu-bar', avgCpu);
+    setBar('dc-monitor-mem-bar', avgMem);
+  }
+
+  // ----- Public refresh function -----
+  let inFlight = false;
+  async function refresh() {
+    if (inFlight) return;
+    inFlight = true;
+    try {
+      setServicesCard();
+      const [stats, health] = await Promise.all([fetchStats(), fetchHealth()]);
+      applyStats(stats);
+      applyHealthSummary(health);
+      const stamp = document.getElementById('dc-monitor-refresh-stamp');
+      if (stamp) {
+        const now = new Date();
+        stamp.textContent = `updated ${now.toLocaleTimeString()}`;
+      }
+    } finally {
+      inFlight = false;
+    }
+  }
+
+  // Expose for init.js to call once and re-call after each refreshAll cycle
+  window.refreshMonitoringWidgets = refresh;
+
+  // Auto-refresh on the STATS interval (separate from full DASHBOARD refresh)
+  setInterval(refresh, (typeof DC !== 'undefined' && DC.POLL && DC.POLL.STATS) || 5000);
+
+  // Refresh once on first script load (init.js also calls this; double-call is harmless)
+  setTimeout(refresh, 200);
+
+})();

dashcaddy-installer/install.sh

@@ -27,10 +27,14 @@ readonly API_DIR="${SITES_DIR}/dashcaddy-api"
 readonly DASHBOARD_DIR="${SITES_DIR}/status"
 readonly CONTAINER_NAME="dashcaddy-api"
 readonly CADDY_ADMIN_PORT=2019
+readonly BACKUP_DIR="${BACKUP_DIR:-${INSTALL_DIR}/backups}"
+readonly DEFAULT_MAX_STORAGE_BYTES=""
 
 # ---- Tunables (overridable via flags) --------------------------------------
 API_PORT=3001
 LOCAL_PORT=8080
+BACKUP_DIR=""
+BACKUP_LIMIT=""
 
 # ---- Runtime state ---------------------------------------------------------
 DOMAIN_MODE=""    # public | custom-tld | local
@@ -389,6 +393,7 @@ EOF
 create_directories() {
   mkdir -p "$INSTALL_DIR" "$DOCKER_DATA" "$SITES_DIR" "$API_DIR" "$DASHBOARD_DIR" "${DASHBOARD_DIR}/assets"
   mkdir -p /opt/dashcaddy/updates /opt/dashcaddy/scripts
+  mkdir -p "${BACKUP_DIR}"
   ok "Directories created"
 }
 
@@ -626,7 +631,41 @@ CEOF
 # Docker Compose
 # ============================================================================
 
+# Parse size string like "10GB" or "1TB" to bytes
+parse_size_to_bytes() {
+  local size="$1"
+  local value unit
+
+  # Strip whitespace
+  size=$(echo "$size" | tr -d ' ')
+
+  # Extract numeric value and unit
+  if [[ $size =~ ^([0-9.]+)([kmgtKMGT][bb]?|[bB]?)$ ]]; then
+    value="${BASH_REMATCH[1]}"
+    unit="${BASH_REMATCH[2]}"
+
+    # Normalize unit to uppercase without 'B' suffix for simplicity
+    unit=$(echo "$unit" | tr '[:lower:]' '[:upper:]')
+    case "$unit" in
+      K|KB)      echo $((value * 1024)) ;;
+      M|MB)      echo $((value * 1024 * 1024)) ;;
+      G|GB)      echo $((value * 1024 * 1024 * 1024)) ;;
+      T|TB)      echo $((value * 1024 * 1024 * 1024 * 1024)) ;;
+      *)         echo "$value" ;;
+    esac
+  else
+    # Not recognized, treat as raw bytes
+    echo "$size"
+  fi
+}
+
 generate_docker_compose() {
+  # Convert BACKUP_LIMIT to bytes if set (e.g., "10GB" -> 10737418240)
+  local backup_limit_bytes=""
+  if [[ -n "$BACKUP_LIMIT" ]]; then
+    backup_limit_bytes=$(parse_size_to_bytes "$BACKUP_LIMIT")
+  fi
+
   cat > "${API_DIR}/docker-compose.yml" <<DCEOF
 services:
   dashcaddy-api:
@@ -648,6 +687,7 @@ services:
       - ${DASHBOARD_DIR}:/app/dashboard:rw
       - /opt/dashcaddy/updates:/app/updates:rw
       - /var/run/docker.sock:/var/run/docker.sock
+      - dashcaddy-backups:/app/backups
     environment:
       - CADDYFILE_PATH=/caddyfile
       - CADDY_ADMIN_URL=http://host.docker.internal:${CADDY_ADMIN_PORT}
@@ -665,6 +705,10 @@ services:
       - DASHCADDY_HOST_UPDATES_DIR=/opt/dashcaddy/updates
       - DASHCADDY_API_SOURCE_DIR=${API_DIR}
       - DASHCADDY_FRONTEND_DIR=/app/dashboard
+      - BACKUP_DIR=/app/backups
+      - BACKUP_MAX_STORAGE_BYTES=${backup_limit_bytes:-0}
+      - BACKUP_CONFIG_FILE=/app/backup-config.json
+      - BACKUP_HISTORY_FILE=/app/backup-history.json
     extra_hosts:
       - "host.docker.internal:host-gateway"
     restart: unless-stopped
@@ -673,6 +717,14 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
+
+volumes:
+  dashcaddy-backups:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: ${BACKUP_DIR}
 DCEOF
 
   ok "docker-compose.yml generated"
@@ -880,6 +932,8 @@ parse_args() {
       --skip-caddy)  SKIP_CADDY=true; shift ;;
       --uninstall)   UNINSTALL=true; shift ;;
       --keep-config) KEEP_CONFIG=true; shift ;;
+      --backup-dir)  BACKUP_DIR="${2:-}"; shift; shift ;;
+      --backup-limit) BACKUP_LIMIT="${2:-}"; shift; shift ;;
       --yes|-y)      AUTO_YES=true; shift ;;
       --help|-h)     print_help; exit 0 ;;
       *) warn "Unknown option: $1 (ignored)"; shift ;;
@@ -914,6 +968,8 @@ print_help() {
     --source PATH      Use local source files
     --skip-docker      Already have Docker
     --skip-caddy       Already have Caddy
+    --backup-dir PATH  Backup directory (default: /etc/dashcaddy/backups)
+    --backup-limit SIZE Storage limit for backups (e.g., 10GB, 1TB)
     --uninstall        Remove DashCaddy
     --keep-config      Keep configs during uninstall
     --yes              Skip confirmations

dashcaddy-installer/src/main/config-manager.js

@@ -226,17 +226,34 @@ class ConfigManager {
    * @returns {Promise<Object>} Disk space info
    */
   async getDiskSpace(testPath) {
-    // Note: This is a simplified version. In production, you'd use a library like 'check-disk-space'
     try {
-      const stats = await fs.stat(testPath);
+      const fsPromises = require('fs').promises;
+      const pathModule = require('path');
+
+      // Ensure directory exists
+      await fsPromises.mkdir(testPath, { recursive: true });
+
+      // Use statfs for true disk space (works on all filesystems: ext4, Btrfs, XFS, ZFS, APFS, NTFS)
+      const stats = await fsPromises.statfs(testPath);
+
+      const totalBytes = stats.blocks * stats.bsize;
+      const freeBytes = stats.bfree * stats.bsize;
+      const availableBytes = stats.bavail * stats.bsize; // Available to non-root users
+      const usedBytes = totalBytes - freeBytes;
 
       return {
         available: true,
-        path: testPath
+        path: testPath,
+        total: totalBytes,
+        used: usedBytes,
+        free: freeBytes,
+        availableBytes: availableBytes,
+        usagePercent: parseFloat(((usedBytes / totalBytes) * 100).toFixed(2))
       };
     } catch (error) {
       return {
         available: false,
+        path: testPath,
         error: error.message
       };
     }

dashcaddy-installer/src/renderer/wizard.js

@@ -62,6 +62,11 @@ const state = {
     installPath: '',
     health: null
   },
+  // Backup configuration
+  backup: {
+    maxStorageGB: 10,
+    backupDir: ''
+  },
   // Uninstall mode
   uninstallMode: false,
   uninstall: {
@@ -373,6 +378,24 @@ function updateBranding(field, value) {
   if (field === 'primaryColor') render();
 }
 
+// Backup functions
+function updateBackup(field, value) {
+  state.backup[field] = value;
+  render();
+}
+
+async function selectBackupDir() {
+  try {
+    const result = await window.electronAPI.selectFolder();
+    if (result.success && result.path) {
+      state.backup.backupDir = result.path;
+      render();
+    }
+  } catch (err) {
+    console.error('Backup dir selection failed:', err);
+  }
+}
+
 async function selectLogo() {
   try {
     const result = await window.electronAPI.selectFile({
@@ -420,6 +443,10 @@ async function startInstallation() {
         password: state.dns.password,
         token: state.dns.token
       } : null,
+      backup: {
+        maxStorageGB: state.backup.maxStorageGB,
+        backupDir: state.backup.backupDir || null
+      },
       autoStart: true
     });
   } catch (err) {
@@ -963,6 +990,31 @@ function renderDashboardSetup() {
             <p class="hint">Port for the DashCaddy API server (default: 3001)</p>
           </div>
         ` : ''}
+
+        <div class="folder-input">
+          <label>Backup Storage Limit (GB)</label>
+          <div class="input-row">
+            <input type="number"
+                   value="${state.backup.maxStorageGB}"
+                   min="1" max="10240"
+                   oninput="updateBackup('maxStorageGB', parseInt(this.value) || 10)">
+          </div>
+          <p class="hint">Maximum storage for backups in GB (default: 10, max: 10TB)</p>
+        </div>
+
+        ${state.tier !== 'basic' ? `
+          <div class="folder-input">
+            <label>Backup Directory</label>
+            <div class="input-row">
+              <input type="text"
+                     value="${escapeHtml(state.backup.backupDir)}"
+                     readonly
+                     placeholder="Default: $INSTALL_DIR/backups">
+              <button class="btn-browse" onclick="selectBackupDir()">Browse...</button>
+            </div>
+            <p class="hint">Where backup files are stored on the host</p>
+          </div>
+        ` : ''}
       </div>
     </div>
   `;

dashcaddy-installer/templates/docker-compose.template.yml

@@ -7,15 +7,28 @@ services:
     volumes:
       - {{API_PATH}}:/app
       - /var/run/docker.sock:/var/run/docker.sock
+      - dashcaddy-backups:/app/backups
     environment:
       - NODE_ENV=production
       - PORT={{API_PORT}}
       - SERVICES_FILE=/app/services.json
       - CADDY_ADMIN_URL=http://host.docker.internal:2019
+      - BACKUP_DIR=/app/backups
+      - BACKUP_MAX_STORAGE_BYTES={{BACKUP_MAX_STORAGE_BYTES}}
+      - BACKUP_CONFIG_FILE=/app/backup-config.json
+      - BACKUP_HISTORY_FILE=/app/backup-history.json
     restart: unless-stopped
     networks:
       - dashcaddy
 
+volumes:
+  dashcaddy-backups:
+    driver: local
+    driver_opts:
+      type: none
+      o: bind
+      device: {{BACKUP_DIR}}
+
 networks:
   dashcaddy:
     driver: bridge

routes/openclaw.js

@@ -1,272 +0,0 @@
-const express = require('express');
-const http = require('http');
-
-/**
- * OpenClaw management routes
- * Proxies gateway API calls through DashCaddy so the token never leaves the server.
- *
- * GET  /openclaw/status          → container info + gateway health
- * POST /openclaw/deploy          → deploy OpenClaw container
- * GET  /openclaw/proxy/*         → proxy GET to gateway
- * POST /openclaw/proxy/*        → proxy POST to gateway
- * DELETE /openclaw               → remove container
- */
-module.exports = function openClawRoutes(ctx) {
-  const router = express.Router();
-  const docker = ctx.docker;
-  const asyncHandler = ctx.asyncHandler;
-  const log = ctx.log || console;
-
-  // ── helpers ──────────────────────────────────────────────────────────────
-
-  async function findOpenClawContainer() {
-    const containers = await docker.client.listContainers({ all: true });
-    return containers.find(function(c) {
-      return c.Image === 'ghcr.io/nousresearch/openclaw:latest' ||
-        (c.Labels && c.Labels['dashcaddy.managed'] === 'true' &&
-         c.Names.some(function(n) { return n.includes('openclaw'); }));
-    }) || null;
-  }
-
-  async function getGatewayToken(containerId) {
-    try {
-      const info = await docker.client.containerInfo(containerId);
-      const entry = (info.Config.Env || []).find(function(e) {
-        return e.startsWith('OPENCLAW_GATEWAY_TOKEN=');
-      });
-      return entry ? entry.split('=')[1] : null;
-    } catch(err) {
-      return null;
-    }
-  }
-
-  async function getContainerPort(containerId) {
-    try {
-      const containers = await docker.client.listContainers({ all: true });
-      const c = containers.find(function(x) {
-        return x.Id === containerId || x.Id.startsWith(containerId);
-      });
-      if (c && c.Ports) {
-        const p = c.Ports.find(function(x) { return x.PrivatePort === 18792; });
-        if (p && p.PublicPort) return String(p.PublicPort);
-      }
-      return '18792';
-    } catch(err) {
-      return '18792';
-    }
-  }
-
-  async function gatewayHealth(baseUrl, token) {
-    return new Promise(function(resolve) {
-      const headers = {};
-      if (token) headers['Authorization'] = 'Bearer ' + token;
-      const req = http.get(baseUrl + '/health', { headers: headers }, function(res) {
-        let data = '';
-        res.on('data', function(d) { data += d; });
-        res.on('end', function() {
-          try { resolve({ ok: true, data: JSON.parse(data) }); }
-          catch(e) { resolve({ ok: true, data: data }); }
-        });
-      });
-      req.on('error', function(e) { resolve({ ok: false, error: e.message }); });
-      req.setTimeout(5000, function() { req.destroy(); resolve({ ok: false, error: 'timeout' }); });
-    });
-  }
-
-  function proxyRequest(req, res, targetBase, path, token) {
-    const headers = {};
-    if (token) headers['Authorization'] = 'Bearer ' + token;
-    headers['X-Forwarded-For'] = req.ip;
-    headers['X-Forwarded-Proto'] = req.protocol;
-
-    const url = targetBase + '/' + path;
-    const method = req.method;
-
-    if (['POST', 'PUT', 'PATCH'].includes(method)) {
-      const body = JSON.stringify(req.body);
-      headers['Content-Type'] = 'application/json';
-      headers['Content-Length'] = Buffer.byteLength(body);
-
-      const proxyReq = http.request(url, { method: method, headers: headers }, function(proxyRes) {
-        res.set(proxyRes.headers);
-        res.status(proxyRes.statusCode);
-        proxyRes.on('data', function(d) { res.write(d); });
-        proxyRes.on('end', function() { res.end(); });
-      });
-      proxyReq.on('error', function(e) { res.status(502).json({ success: false, error: e.message }); });
-      proxyReq.setTimeout(15000, function() { proxyReq.destroy(); res.status(504).json({ success: false, error: 'gateway timeout' }); });
-      proxyReq.write(body);
-      proxyReq.end();
-    } else {
-      const proxyReq = http.get(url, { headers: headers }, function(proxyRes) {
-        res.set(proxyRes.headers);
-        res.status(proxyRes.statusCode);
-        proxyRes.on('data', function(d) { res.write(d); });
-        proxyRes.on('end', function() { res.end(); });
-      });
-      proxyReq.on('error', function(e) { res.status(502).json({ success: false, error: e.message }); });
-      proxyReq.setTimeout(15000, function() { proxyReq.destroy(); res.status(504).json({ success: false, error: 'gateway timeout' }); });
-    }
-  }
-
-  // ── GET /openclaw/status ────────────────────────────────────────────────
-
-  router.get('/status', asyncHandler(async function(req, res) {
-    const container = await findOpenClawContainer();
-
-    if (!container) {
-      return res.json({ success: true, deployed: false });
-    }
-
-    const token = await getGatewayToken(container.Id);
-    const port = await getContainerPort(container.Id);
-    const baseUrl = 'http://localhost:' + port;
-    const health = await gatewayHealth(baseUrl, token);
-
-    res.json({
-      success: true,
-      deployed: true,
-      container: {
-        id: container.Id.slice(0, 12),
-        name: container.Name,
-        state: container.State,
-        status: container.Status,
-        created: container.Created,
-        image: container.Image
-      },
-      gateway: {
-        url: baseUrl,
-        port: port,
-        healthy: health.ok,
-        healthData: health.data || null,
-        tokenSet: !!token
-      }
-    });
-  }));
-
-  // ── POST /openclaw/deploy ───────────────────────────────────────────────
-
-  router.post('/deploy', asyncHandler(async function(req, res) {
-    const existing = await findOpenClawContainer();
-    if (existing) {
-      return res.status(409).json({ success: false, error: 'OpenClaw is already deployed' });
-    }
-
-    const image = 'ghcr.io/nousresearch/openclaw:latest';
-    const name = 'openclaw-' + Date.now();
-    const gatewayToken = generateToken();
-
-    // Pull image
-    log.info('Pulling ' + image + '...');
-    try {
-      await new Promise(function(resolve, reject) {
-        docker.client.pull(image, function(err, stream) {
-          if (err) return reject(err);
-          docker.client.modem.followProgress(stream, function(err2) {
-            if (err2) return reject(err2);
-            resolve();
-          });
-        });
-      });
-    } catch(e) {
-      log.error('OpenClaw pull failed: ' + e.message);
-      return res.status(500).json({ success: false, error: 'Failed to pull image: ' + e.message });
-    }
-
-    // Create + start container
-    try {
-      const container = await docker.client.createContainer({
-        name: name,
-        Image: image,
-        Env: [
-          'OPENCLAW_GATEWAY_MODE=local',
-          'OPENCLAW_GATEWAY_TOKEN=' + gatewayToken
-        ],
-        HostConfig: {
-          PortBindings: { '18792/tcp': [{ HostPort: '18792' }] },
-          RestartPolicy: { Name: 'unless-stopped' },
-          Labels: {
-            'dashcaddy.managed': 'true',
-            'dashcaddy.app': 'openclaw'
-          }
-        },
-        ExposedPorts: { '18792/tcp': {} }
-      });
-
-      await container.start();
-      log.info('OpenClaw deployed: ' + container.id.slice(0, 12));
-
-      res.json({
-        success: true,
-        deployed: true,
-        container: { id: container.id.slice(0, 12), name: name },
-        gateway: {
-          url: 'http://localhost:18792',
-          token: gatewayToken
-        }
-      });
-    } catch(e) {
-      log.error('OpenClaw deploy failed: ' + e.message);
-      res.status(500).json({ success: false, error: 'Deploy failed: ' + e.message });
-    }
-  }));
-
-  // ── GET /openclaw/proxy/* ───────────────────────────────────────────────
-
-  router.get('/proxy/*', asyncHandler(async function(req, res) {
-    const container = await findOpenClawContainer();
-    if (!container) return res.status(404).json({ success: false, error: 'OpenClaw not deployed' });
-
-    const token = await getGatewayToken(container.Id);
-    const port = await getContainerPort(container.Id);
-    const baseUrl = 'http://localhost:' + port;
-    const path = req.params[0];
-
-    proxyRequest(req, res, baseUrl, path, token);
-  }));
-
-  // ── POST /openclaw/proxy/* ──────────────────────────────────────────────
-
-  router.post('/proxy/*', asyncHandler(async function(req, res) {
-    const container = await findOpenClawContainer();
-    if (!container) return res.status(404).json({ success: false, error: 'OpenClaw not deployed' });
-
-    const token = await getGatewayToken(container.Id);
-    const port = await getContainerPort(container.Id);
-    const baseUrl = 'http://localhost:' + port;
-    const path = req.params[0];
-
-    proxyRequest(req, res, baseUrl, path, token);
-  }));
-
-  // ── DELETE /openclaw ───────────────────────────────────────────────────
-
-  router.delete('/', asyncHandler(async function(req, res) {
-    const container = await findOpenClawContainer();
-    if (!container) return res.status(404).json({ success: false, error: 'OpenClaw not deployed' });
-
-    try {
-      const c = docker.client.container(container.Id);
-      await c.stop().catch(function() {});
-      await c.remove({ force: true });
-      log.info('OpenClaw container ' + container.Id.slice(0, 12) + ' removed');
-      res.json({ success: true, message: 'OpenClaw removed' });
-    } catch(e) {
-      log.error('Failed to remove OpenClaw: ' + e.message);
-      res.status(500).json({ success: false, error: e.message });
-    }
-  }));
-
-  return router;
-};
-
-// ── token generator ──────────────────────────────────────────────────────────
-
-function generateToken() {
-  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-  let result = '';
-  for (let i = 0; i < 32; i++) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
-  }
-  return result;
-}

status/build.js

@@ -19,6 +19,9 @@ const bundles = {
     JS('skeleton-loader.js'),
     JS('theme.js'),
     JS('totp-auth.js'),
+    // totp-recovery.js registers window._refreshRecoveryLink which totp-auth.js
+    // calls from showTotpOverlay(). Must come after totp-auth.js.
+    JS('totp-recovery.js'),
     JS('service-credentials.js'),
     JS('totp-settings.js'),
     JS('core', 'credentials.js'),
@@ -72,6 +75,7 @@ const bundles = {
   ],
   'init.js': [
     JS('core', 'init.js'),
+    JS('monitoring-widgets.js'),
     JS('keyboard-shortcuts.js'),
   ],
 };

status/index.html

@@ -43,6 +43,59 @@
         <input type="text" maxlength="1" inputmode="numeric" pattern="[0-9]">
       </div>
       <div class="totp-error" id="totp-error"></div>
+      <div class="totp-recovery-link" id="totp-recovery-link" style="display: none;">
+        <a href="#" id="totp-show-recovery">Lost access? Recover with saved Base32 key →</a>
+      </div>
+    </div>
+  </div>
+
+  <!-- TOTP Recovery Panel (hidden by default, shown via "Lost access?" link on overlay) -->
+  <div id="totp-recovery-panel" class="weather-modal" style="display: none;">
+    <div class="weather-modal-content" style="min-width: 420px; max-width: 540px;">
+      <h3 style="margin: 0 0 12px; font-size: 1.1rem;">Recover TOTP Access</h3>
+      <div id="totp-recovery-status" style="margin-bottom: 12px; padding: 10px 14px; border-radius: 6px; border: 1px solid var(--border); font-size: 0.85rem; line-height: 1.4;"></div>
+
+      <!-- Path A: Paste saved Base32 secret -->
+      <div id="totp-recovery-import">
+        <p style="font-size: 0.85rem; color: var(--muted); margin: 0 0 8px;">
+          Paste the Base32 secret you saved when you first set up TOTP (e.g. <code>JBSWY3DPEHPK3PXP</code>).
+          If you don't have it, you'll need to SSH into the server to rotate the encryption key.
+        </p>
+        <div style="display: flex; gap: 8px; margin-top: 8px;">
+          <input type="text" id="totp-recovery-secret" placeholder="Paste your Base32 key"
+                 autocomplete="off" spellcheck="false"
+                 style="flex: 1; padding: 10px; background: var(--bg); color: var(--fg); border: 1px solid var(--border); border-radius: 6px; font-size: 0.9rem; font-family: monospace; letter-spacing: 1px; text-transform: uppercase;" />
+          <button id="totp-recovery-submit"
+                  style="padding: 10px 16px; background: var(--card-base); color: var(--fg); border: 1px solid var(--border); border-radius: 6px; cursor: pointer; font-weight: 600; font-size: 0.85rem; white-space: nowrap;">
+            Restore
+          </button>
+        </div>
+        <div id="totp-recovery-error" style="color: var(--bad-fg, #ff9aa3); font-size: 0.8rem; min-height: 1.2em; margin-top: 6px;"></div>
+      </div>
+
+      <!-- Path B: After successful import, ask user to verify with code -->
+      <div id="totp-recovery-verify" style="display: none;">
+        <p style="font-size: 0.85rem; color: var(--muted); margin: 0 0 8px;">
+          Secret accepted. Add it to your authenticator app and enter a 6-digit code to confirm.
+        </p>
+        <div style="display: flex; gap: 8px; margin-top: 8px;">
+          <input type="text" id="totp-recovery-code" maxlength="6" inputmode="numeric" pattern="[0-9]{6}"
+                 placeholder="000000" autocomplete="one-time-code"
+                 style="flex: 1; padding: 10px; text-align: center; font-size: 1.2rem; font-family: 'Sami Grotesk', monospace; letter-spacing: 4px; background: var(--bg); color: var(--fg); border: 1px solid var(--border); border-radius: 6px;" />
+          <button id="totp-recovery-confirm"
+                  style="padding: 10px 16px; background: var(--card-base); color: var(--fg); border: 1px solid var(--border); border-radius: 6px; cursor: pointer; font-weight: 600; font-size: 0.85rem; white-space: nowrap;">
+            Confirm
+          </button>
+        </div>
+        <div id="totp-recovery-confirm-error" style="color: var(--bad-fg, #ff9aa3); font-size: 0.8rem; min-height: 1.2em; margin-top: 6px;"></div>
+      </div>
+
+      <div style="margin-top: 14px; text-align: right;">
+        <button id="totp-recovery-close"
+                style="padding: 8px 18px; background: transparent; color: var(--muted); border: 1px solid var(--border); border-radius: 6px; cursor: pointer; font-size: 0.85rem;">
+          Cancel
+        </button>
+      </div>
     </div>
   </div>
 
@@ -199,7 +252,8 @@
       <div class="btn-row"><!-- No button for Internet --></div>
     </div>
 
-    <div class="card" data-app="auth" data-status="off" id="auth-card">
+    <div class="card" data-app="auth" data-status="off" id="auth-card"
+         title="Two-factor authentication (TOTP). On first setup, save the Base32 secret — it's the only way to recover if you ever lose your authenticator.">
       <span id="auth-dot" class="dot bad at-bl"></span>
       <div class="row">
         <div class="logo-wrap">
@@ -256,6 +310,9 @@
       <option value="on">🟢 Online</option>
       <option value="off">🔴 Offline</option>
     </select>
+    <select id="service-filter-category" style="padding: 8px 12px; background: var(--bg); border: 1px solid var(--border); border-radius: 6px; color: var(--fg); font-size: 0.9rem;">
+      <option value="all">All Categories</option>
+    </select>
     <button id="batch-operations-btn" class="btn-sm" style="padding: 8px 12px;">☰ Batch Operations</button>
     <span id="service-filter-count" style="color: var(--muted); font-size: 0.85rem; white-space: nowrap;"></span>
   </div>
@@ -390,8 +447,14 @@
           <!-- DNS Server Configuration -->
           <div>
             <label class="form-label-accent">
-              🗂️ DNS Server (Technitium)
+              🗂️ DNS Provider
             </label>
+            <select id="setup-dns-provider" class="form-input-lg" style="margin-bottom: 12px;">
+              <option value="technitium">Technitium DNS (recommended)</option>
+              <option value="cloudflare">Cloudflare DNS</option>
+              <option value="rfc2136">RFC 2136 (BIND / PowerDNS / other)</option>
+              <option value="manual">Manual / External DNS</option>
+            </select>
             <div style="display: grid; grid-template-columns: 1fr auto; gap: 8px;">
               <input type="text" id="setup-dns-ip" value="" placeholder="DNS server IP"
                      style="padding: 12px; background: var(--card-bg); color: var(--fg); border: 1px solid var(--border); border-radius: 6px; font-size: 1rem;" />
@@ -406,7 +469,7 @@
           <!-- DNS Admin Token -->
           <div>
             <label class="form-label-accent">
-              🔑 Technitium Admin Token
+              🔑 DNS Admin Token / API Key
             </label>
             <input type="password" id="setup-dns-token" placeholder="Paste your admin token here"
                    class="form-input-lg" />

status/js/totp-auth.js

@@ -21,6 +21,13 @@
       const firstInput = overlay.querySelector('.totp-digits input');
       if (firstInput) setTimeout(() => firstInput.focus(), 100);
     }
+    // Refresh the "Lost access?" recovery link visibility based on server state.
+    // Hides itself if TOTP is healthy; shows if unreadable/corrupt. The user
+    // can still click it even when healthy — but the panel will explain there's
+    // no recovery needed. Cheaper than gating it.
+    if (typeof window._refreshRecoveryLink === 'function') {
+      window._refreshRecoveryLink();
+    }
   }
 
   function hideTotpOverlay() {

status/js/totp-recovery.js

@@ -0,0 +1,180 @@
+// ===== TOTP RECOVERY FLOW =====
+// Public, unauthenticated recovery path for users who can't log in.
+// Designed for the "encryption key rotated and lost my authenticator" case.
+// The flow is:
+//
+//  1. On TOTP overlay show, call /api/v1/totp/recovery-info (public).
+//     If status === 'unreadable', show the "Lost access?" link on the overlay.
+//  2. User clicks link → opens recovery panel.
+//  3. User pastes Base32 secret → POST /api/v1/totp/setup with {secret: ...}.
+//     Backend stores as totp.pending_secret (encrypted with current key).
+//  4. Panel switches to "verify" mode. User enters a code from the
+//     newly-added authenticator entry. POST /api/v1/totp/verify-setup
+//     promotes pending → active and starts a session.
+//  5. hideTotpOverlay() and initializeDashboard() — same as normal login.
+//
+// The recovery flow never requires the user to be logged in. It does require
+// them to have their Base32 secret saved (e.g. password manager, screenshot,
+// the "Download backup file" we offer at setup time — see totp-settings.js).
+
+(function() {
+  'use strict';
+
+  // ── Helpers ──
+  async function fetchRecoveryInfo() {
+    try {
+      const r = await fetch('/api/v1/totp/recovery-info', { cache: 'no-store' });
+      return await r.json();
+    } catch (e) {
+      return { success: false, status: 'unknown', hint: 'Could not contact server' };
+    }
+  }
+
+  function showRecoveryLink(show) {
+    const link = document.getElementById('totp-recovery-link');
+    if (link) link.style.display = show ? '' : 'none';
+  }
+
+  function openRecoveryPanel() {
+    const panel = document.getElementById('totp-recovery-panel');
+    if (panel) panel.style.display = '';
+    const statusEl = document.getElementById('totp-recovery-status');
+    const importEl = document.getElementById('totp-recovery-import');
+    const verifyEl = document.getElementById('totp-recovery-verify');
+    if (importEl) importEl.style.display = '';
+    if (verifyEl) verifyEl.style.display = 'none';
+    // Reset state
+    document.getElementById('totp-recovery-error').textContent = '';
+    document.getElementById('totp-recovery-confirm-error').textContent = '';
+    document.getElementById('totp-recovery-secret').value = '';
+    document.getElementById('totp-recovery-code').value = '';
+    // Show current status
+    fetchRecoveryInfo().then(info => {
+      statusEl.textContent = info.hint || '';
+      // Color-code the status banner
+      if (info.status === 'healthy') {
+        statusEl.style.borderColor = 'var(--ok-fg, #7ef2ff)';
+      } else if (info.status === 'unreadable') {
+        statusEl.style.borderColor = 'var(--bad-fg, #ff9aa3)';
+        statusEl.style.background = 'color-mix(in srgb, var(--bad-fg) 6%, transparent)';
+      } else if (info.status === 'not_configured') {
+        statusEl.style.borderColor = 'var(--muted)';
+      } else {
+        statusEl.style.borderColor = 'var(--border)';
+      }
+    });
+    setTimeout(() => {
+      document.getElementById('totp-recovery-secret')?.focus();
+    }, 100);
+  }
+
+  function closeRecoveryPanel() {
+    const panel = document.getElementById('totp-recovery-panel');
+    if (panel) panel.style.display = 'none';
+  }
+
+  async function submitRecoverySecret() {
+    const secret = document.getElementById('totp-recovery-secret').value.trim();
+    const errorEl = document.getElementById('totp-recovery-error');
+    errorEl.textContent = '';
+
+    if (!secret) {
+      errorEl.textContent = 'Paste your Base32 key first';
+      return;
+    }
+    if (!/^[A-Za-z2-7\s]+=*$/.test(secret)) {
+      errorEl.textContent = 'Invalid Base32 format — should be letters A-Z and digits 2-7 only';
+      return;
+    }
+
+    // POST /api/v1/totp/setup with {secret} — backend stores as pending
+    try {
+      const r = await fetch('/api/v1/totp/setup', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ secret })
+      });
+      const data = await r.json();
+      if (!r.ok || !data.success) {
+        errorEl.textContent = data.error || data.message || 'Restore failed';
+        return;
+      }
+      // Switch panel to verify mode
+      document.getElementById('totp-recovery-import').style.display = 'none';
+      document.getElementById('totp-recovery-verify').style.display = '';
+      setTimeout(() => document.getElementById('totp-recovery-code')?.focus(), 100);
+    } catch (e) {
+      errorEl.textContent = 'Network error — try again';
+    }
+  }
+
+  async function submitRecoveryCode() {
+    const code = document.getElementById('totp-recovery-code').value.trim();
+    const errorEl = document.getElementById('totp-recovery-confirm-error');
+    errorEl.textContent = '';
+
+    if (!/^\d{6}$/.test(code)) {
+      errorEl.textContent = 'Enter a 6-digit code';
+      return;
+    }
+
+    // POST /api/v1/totp/verify-setup — promotes pending → active + starts session
+    try {
+      const r = await fetch('/api/v1/totp/verify-setup', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ code })
+      });
+      const data = await r.json();
+      if (!r.ok || !data.success) {
+        errorEl.textContent = data.error || data.message || 'Invalid code';
+        document.getElementById('totp-recovery-code').value = '';
+        document.getElementById('totp-recovery-code')?.focus();
+        return;
+      }
+      // Success — hide everything and initialize dashboard
+      closeRecoveryPanel();
+      const overlay = document.getElementById('totp-overlay');
+      if (overlay) overlay.classList.remove('show');
+      if (typeof window.initializeDashboard === 'function') {
+        window.initializeDashboard();
+      }
+    } catch (e) {
+      errorEl.textContent = 'Network error — try again';
+    }
+  }
+
+  // ── Wire up handlers ──
+  document.getElementById('totp-show-recovery')?.addEventListener('click', (e) => {
+    e.preventDefault();
+    openRecoveryPanel();
+  });
+  document.getElementById('totp-recovery-close')?.addEventListener('click', closeRecoveryPanel);
+  document.getElementById('totp-recovery-submit')?.addEventListener('click', submitRecoverySecret);
+  document.getElementById('totp-recovery-confirm')?.addEventListener('click', submitRecoveryCode);
+
+  // Enter key submits in secret field
+  document.getElementById('totp-recovery-secret')?.addEventListener('keydown', (e) => {
+    if (e.key === 'Enter') { e.preventDefault(); submitRecoverySecret(); }
+  });
+  // Enter key submits in code field
+  document.getElementById('totp-recovery-code')?.addEventListener('keydown', (e) => {
+    if (e.key === 'Enter') { e.preventDefault(); submitRecoveryCode(); }
+  });
+
+  // ── Public API ──
+  // Called by totp-auth.js after showing the overlay, so we can decide whether
+  // to show the recovery link. We do this with a public endpoint that doesn't
+  // require auth — perfect for the locked-out state.
+  window._refreshRecoveryLink = async function() {
+    const info = await fetchRecoveryInfo();
+    // Show the link in any non-healthy state (unreadable / corrupt / unknown).
+    // The hint inside the panel tells the user what the actual issue is.
+    if (info && info.success && info.status && info.status !== 'healthy') {
+      showRecoveryLink(true);
+    } else {
+      showRecoveryLink(false);
+    }
+    return info;
+  };
+})();

status/js/totp-settings.js

@@ -38,11 +38,25 @@
       <div id="totp-qr-section" style="display: none;">
         <!-- Manual Key (primary - for WinAuth/desktop authenticators) -->
         <p style="font-size: 0.85rem; color: var(--muted); margin: 0 0 8px;">Copy this key into your authenticator app:</p>
-        <div style="display: flex; align-items: center; gap: 8px; margin-bottom: 16px;">
+        <div style="display: flex; align-items: center; gap: 8px; margin-bottom: 8px;">
           <code id="totp-manual-key" style="flex: 1; display: block; padding: 12px; background: var(--bg, #0b0f1a); border: 1px solid var(--border); border-radius: 6px; font-size: 1rem; font-family: 'Sami Grotesk', monospace; letter-spacing: 2px; word-break: break-all; user-select: all; color: var(--fg);"></code>
           <button id="totp-copy-key" style="padding: 10px 14px; background: var(--card-base); border: 1px solid var(--border); border-radius: 6px; cursor: pointer; font-size: 1rem; white-space: nowrap; color: var(--fg);" title="Copy to clipboard">📋</button>
         </div>
 
+        <!-- Download backup file (recovery aid) -->
+        <div style="margin-bottom: 16px; padding: 10px 12px; background: var(--bg, #0b0f1a); border: 1px solid var(--border); border-radius: 6px;">
+          <div style="display: flex; align-items: center; gap: 8px;">
+            <span style="font-size: 0.8rem; color: var(--muted); flex: 1;">
+              <strong style="color: var(--fg);">Save a backup file</strong> — if you ever lose your authenticator,
+              this is the only way to recover without SSH access to the server.
+            </span>
+            <button id="totp-download-backup" type="button"
+                    style="padding: 8px 14px; background: var(--card-base); color: var(--fg); border: 1px solid var(--border); border-radius: 6px; cursor: pointer; font-weight: 600; font-size: 0.85rem; white-space: nowrap;">
+              ⬇ Download
+            </button>
+          </div>
+        </div>
+
         <!-- QR Code (secondary - for mobile apps) -->
         <details class="mb-16">
           <summary style="cursor: pointer; color: var(--muted); font-size: 0.8rem;">Show QR code (for mobile authenticator apps)</summary>
@@ -119,7 +133,13 @@
         statusBanner.style.background = 'color-mix(in srgb, var(--ok-fg) 8%, transparent)';
         statusText.textContent = 'TOTP is active';
         statusText.style.color = 'var(--ok-fg, #7ef2ff)';
-        setupSection.style.display = 'none';
+        // Keep the setup section visible (collapsed) so the "Import existing
+        // secret" option is always reachable — users may need to re-enroll
+        // their authenticator with the same secret from a backup file.
+        setupSection.style.display = 'block';
+        const setupBtn = document.getElementById('totp-setup-btn');
+        if (setupBtn) setupBtn.textContent = 'Generate New Secret';
+        // Hide the QR section by default in the active state — setupBtn click shows it
         qrSection.style.display = 'none';
         durationSection.style.display = 'block';
         disableSection.style.display = 'block';
@@ -233,6 +253,41 @@
     });
   });
 
+  // Download backup file — plain JSON so it round-trips through any password
+  // manager, cloud backup, or printed paper. The secret IS recoverable plaintext
+  // (that's the whole point of the backup), so warn the user and rely on
+  // them to keep it safe.
+  document.getElementById('totp-download-backup')?.addEventListener('click', () => {
+    const secret = document.getElementById('totp-manual-key').textContent.trim();
+    if (!secret) return;
+    const payload = {
+      service: 'DashCaddy',
+      type: 'totp-secret',
+      secret: secret,
+      issuer: 'DashCaddy',
+      algorithm: 'SHA1',
+      digits: 6,
+      period: 30,
+      issued: new Date().toISOString(),
+      // Recovery instructions baked into the file so a year from now the
+      // user (or their future self) knows what this file is and how to use it.
+      recovery_url: `${window.location.origin}/  (login screen → "Lost access?")`,
+      note: 'Keep this file somewhere safe. Anyone with this secret can generate your login codes. Use it ONLY to recover TOTP access via the "Lost access?" link on the DashCaddy login screen.'
+    };
+    const blob = new Blob([JSON.stringify(payload, null, 2)], { type: 'application/json' });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = `dashcaddy-totp-backup-${new Date().toISOString().slice(0, 10)}.json`;
+    document.body.appendChild(a);
+    a.click();
+    document.body.removeChild(a);
+    URL.revokeObjectURL(url);
+    const btn = document.getElementById('totp-download-backup');
+    btn.textContent = '✅ Saved';
+    setTimeout(() => { btn.textContent = '⬇ Download'; }, 2000);
+  });
+
   // Confirm setup
   document.getElementById('totp-confirm-setup')?.addEventListener('click', async () => {
     const code = document.getElementById('totp-setup-code').value;

status/sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'dashcaddy-shell-8ef9c82616';
+const CACHE = 'dashcaddy-shell-f6673e7190';
 const PRECACHE = [
   '/',
   '/index.html',