Release v1.16.0

Erste Schritte nach der Installation. Ende-zu-Ende gegen einen isolierten Stack getestet, siehe Handbuch „Einrichtungsassistent und Passwort-Reset“: - **Einrichtungsassistent** (`/setup`, System › Einrichtung): vier Schritte mit Erklärungen — Willkommen und Sprache, Konto (eigenes Passwort, Zwei-Faktor-Anmeldung), erste Firewall verbinden (inklusive Anleitung für den API-Key in OPNsense, Zertifikat festsetzen, Verbindungsstatus) und eine Übersicht, was als Nächstes sinnvoll ist. Auf einer frischen Installation ohne Hosts öffnet er sich nach der ersten Anmeldung von selbst; „Assistent überspringen“ merkt sich das pro Benutzer, erneut öffnen geht jederzeit über System › Einrichtung oder die Einstellungen. Nur für Admins. Neue Spalte `user_preferences.setup_done` (Migration `0005`). - **`opnexus password [NAME]`** setzt ein neues Zufallspasswort für den Admin und zeigt es an (`--yes` ohne Rückfrage; Rückfrage nur, wenn sich schon jemand angemeldet hat). Ersetzt das Suchen im Backend-Log nach dem beim ersten Start erzeugten Passwort und taugt zugleich für ein vergessenes Admin-Passwort. Alle Sitzungen des Kontos enden. Dahinter steht `python -m app.reset_password`. Die Meldung beim ersten Start verweist darauf.
Remove maintainer and website tooling from the public repository
2026-10-10 14:15:55 +02:00 · 2026-10-10 12:43:22 +02:00 · 2026-10-10 12:40:41 +02:00 · 2026-10-10 00:24:01 +02:00 · 2026-10-09 22:49:10 +02:00 · 2026-10-09 22:08:39 +02:00
74 changed files with 5338 additions and 369 deletions
@@ -71,10 +71,18 @@ TRUST_PROXY_HEADERS=false
 # Release-Feed (GitHub/Forgejo "releases/latest"). Leer = aus: dann macht
 # OPNexus keine ausgehende Anfrage. Gesendet wird nur ein GET mit
 # User-Agent "OPNexus/<Version>". Admins sehen bei einer neueren Version einen
-# Hinweis; aktualisiert wird nie automatisch, sondern mit `opnexus update`.
+# Hinweis; aktualisiert wird nie automatisch, sondern mit `opnexus update` oder
 # (optional, siehe unten) per Klick im Webinterface.
 # UPDATE_CHECK_URL=https://updates.opnexus.dev/latest.json
 # UPDATE_CHECK_INTERVAL_HOURS=12
 # ── Updates aus dem Webinterface (optional, braucht Release-Images) ───
 # Startet den Updater-Container, mit dem Admins unter Einstellungen › „OPNexus
 # aktualisieren“ ein Update auslösen können. Er ist der einzige Container mit
 # Docker-Socket-Zugriff (= root-gleiche Rechte auf diesem Host) und standardmäßig
 # AUS. Benötigt außerdem UPDATE_CHECK_URL (oben). Siehe Handbuch.
 # COMPOSE_PROFILES=updater
 # ── Transportsicherheit (nur ändern, wenn nötig) ──────────────────────
 # Firewall-API-Zugangsdaten gehen per HTTP-Basic-Auth raus, deshalb sind
 # http://-Adressen für Firewalls abgelehnt (beim Anlegen UND bei jeder
@@ -59,3 +59,5 @@ jobs:
      - uses: actions/checkout@v4
      - run: python3 scripts/check_i18n.py
      - run: bash -n scripts/opnexus && bash -n scripts/check_version.sh && bash -n scripts/make_release_bundle.sh
      # Updater-Container (Zustandsübergänge, Ablehnungen, Auth) ohne Docker-Daemon.
      - run: python3 -m unittest discover -s updater -p 'test_*.py'
@@ -12,7 +12,7 @@
 #                                 Berechtigung "write:package" eintragen)
 # Wer auf mehrere Registries veröffentlichen will, pusht den Tag einfach zu
 # mehreren Remotes — jeder Remote baut mit seiner eigenen Konfiguration.
-# Ergebnis: <REGISTRY>/<IMAGE_NAMESPACE>/opnexus-{backend,frontend,proxy}:<version>
+# Ergebnis: <REGISTRY>/<IMAGE_NAMESPACE>/opnexus-{backend,frontend,proxy,updater}:<version>
 # (flache Namen, weil verschachtelte Pfade je Registry unterschiedlich gehen).
 #
 # Der Publish-Job braucht einen Runner mit Docker-Zugriff, der QEMU-
@@ -42,7 +42,7 @@ jobs:
    strategy:
      fail-fast: true
      matrix:
-        service: [backend, frontend, proxy]
+        service: [backend, frontend, proxy, updater]
    steps:
      - uses: actions/checkout@v4
@@ -31,6 +31,80 @@ den Einstellungen.
 Nächste Codenamen (der Reihe nach, wenn die jeweils nächste MINOR-Version
 ansteht): Merlin …
 ## [1.16.0] "Hobby" — 2026-10-10
 Erste Schritte nach der Installation. Ende-zu-Ende gegen einen isolierten Stack getestet, siehe
 Handbuch „Einrichtungsassistent und Passwort-Reset“:
 - **Einrichtungsassistent** (`/setup`, System › Einrichtung): vier Schritte mit Erklärungen —
  Willkommen und Sprache, Konto (eigenes Passwort, Zwei-Faktor-Anmeldung), erste Firewall
  verbinden (inklusive Anleitung für den API-Key in OPNsense, Zertifikat festsetzen,
  Verbindungsstatus) und eine Übersicht, was als Nächstes sinnvoll ist. Auf einer frischen
  Installation ohne Hosts öffnet er sich nach der ersten Anmeldung von selbst; „Assistent
  überspringen“ merkt sich das pro Benutzer, erneut öffnen geht jederzeit über System › Einrichtung
  oder die Einstellungen. Nur für Admins. Neue Spalte `user_preferences.setup_done`
  (Migration `0005`).
 - **`opnexus password [NAME]`** setzt ein neues Zufallspasswort für den Admin und zeigt es an
  (`--yes` ohne Rückfrage; Rückfrage nur, wenn sich schon jemand angemeldet hat). Ersetzt das
  Suchen im Backend-Log nach dem beim ersten Start erzeugten Passwort und taugt zugleich für ein
  vergessenes Admin-Passwort. Alle Sitzungen des Kontos enden. Dahinter steht
  `python -m app.reset_password`. Die Meldung beim ersten Start verweist darauf.
 ## [1.15.0] "Gyrfalcon" — 2026-10-10
 Updates aus dem Webinterface. Auf Klick, mit Fortschritt und automatischem Rollback; ein eigener,
 optionaler Container erledigt die Arbeit. Ende-zu-Ende mit echten Images getestet, siehe Handbuch
 „Update aus dem Webinterface (optional)“:
 - **Updates aus dem Webinterface (optional):** Einstellungen › „OPNexus aktualisieren“ zeigt die
  neueste Version samt Release-Notes und aktualisiert auf Klick — mit Fortschrittsanzeige,
  automatischem Rollback bei einem fehlgeschlagenen Update und „Auf Vorversion zurücksetzen“
  (mit Hinweis, ob dabei Daten verloren gehen). Dahinter arbeitet ein eigener, kleiner
  **Updater-Container** (`updater/`, Compose-Profil `updater`, mit `COMPOSE_PROFILES=updater`
  in `.env` aktivieren), der dieselbe Logik wie `opnexus update` ausführt. Er ist standardmäßig
  **aus** und der einzige Container mit Docker-Socket; das Backend bekommt ihn nie. Der Updater
  hat keinen veröffentlichten Port, ist nur mit einem selbst erzeugten Token ansprechbar und kann
  ausschließlich „aktualisieren auf die vom Release-Feed gemeldete neueste stabile Version“,
  „zurückrollen“ und „Status“. Hauptversions-Sprünge bleiben der Kommandozeile vorbehalten.
  Anfragen stehen im Audit-Log (neuer Typ „OPNexus-System“). Gilt nur für Release-Images.
 - `opnexus` (jetzt in `updater/opnexus`, `scripts/opnexus` ist ein Symlink): `status --porcelain`,
  Exit-Code 3 für „fehlgeschlagen und sauber zurückgerollt“. Release-Images und -Bundle enthalten
  zusätzlich `opnexus-updater`.
 - Der Banner „Neue Version verfügbar“ verlinkt auf den neuen Abschnitt in den Einstellungen.
 ## [1.14.0] "Eagle" — 2026-10-09
 Diagnose von der Firewall aus sowie VXLAN und GIF. Gegen die OPNsense-Core-Quellen
 geprüft und live auf den Test-Firewalls getestet, siehe Handbuch „Erweiterung 1.14.0“:
 - **Host-System › Diagnose:** Ping, Traceroute, Port-Prüfung und DNS-Abfrage, ausgeführt von der
  ausgewählten Firewall. Nur für Admins, strenge Eingabeprüfung, jeder Lauf im Audit-Log,
  Ping-Jobs werden immer wieder aufgeräumt, der Banner der Gegenstelle wird nicht weitergegeben.
  Packet-Capture gibt es bewusst nicht (Mitschnitte enthalten fremde Nutzdaten).
 - **Netzwerk › Geräte:** VXLAN und GIF-Tunnel (anlegen, ändern, löschen) über dieselbe abgesicherte
  Engine wie die übrigen Geräte.
 - **Fehlerkorrektur:** Auf den Host-System-Seiten war „Übersicht › Hosts“ markiert und der Seitentitel
  falsch, weil `/hostsystem` mit `/hosts` beginnt.
 ## [1.13.0] "Buzzard" — 2026-10-09
 Mehr Verwaltung pro Firewall und ein Abgleich der Cluster-Knoten. Alles über
 dieselbe abgesicherte Engine wie in 1.12.0 und live auf drei Test-Firewalls
 geprüft, siehe Handbuch „Erweiterung 1.13.0“:
 - **Netzwerk › Geräte:** LAGG, Bridge, Loopback und GRE. Dazu Gateway-Gruppen,
  DNS-Weiterleitungen (Unbound) und DHCP-Bereiche (dnsmasq).
 - **Neue Gruppe „Host-System“:** Tunables (immer mit Bestätigung, Vorgaben nur per
  „Überschreiben“), Cron, Syslog-Ziele und ZFS-Snapshots (anlegen und löschen; der
  aktive Snapshot ist geschützt, das Aktivieren bleibt OPNsense selbst überlassen).
 - **Netzwerk › Abgleich:** zeigt Unterschiede in der Netzwerk-Konfiguration zwischen den
  Knoten eines Clusters. Neuer Alarm „Netzwerk-Abweichung im Cluster“ (Einstellungen ›
  Benachrichtigungen, Migration 0004).
 - **Auf den Partner übertragen:** Nach dem Anlegen eines Objekts lässt es sich mit
  einem Klick auch auf dem anderen Cluster-Knoten anlegen (eigene Vorschau, eigenes Backup).
 - **Kopfzeile:** Mit acht Gruppen zeigt die Navigation die Namen ab 1150 px, darunter
  nur Icons, damit Suche und Abmelden in einer Zeile bleiben.
 ## [1.12.0] "Condor" — 2026-10-09
 Netzwerk-Verwaltung und Übernahme von Hand angelegter Regeln. Alles gegen die
@@ -5,9 +5,9 @@ Zentrale Verwaltung mehrerer [OPNsense](https://opnsense.org)-Firewalls: Regeln,
 [Website](https://opnexus.dev/) · [Changelog](CHANGELOG.md) · [Handbuch](docs/HANDBUCH.md) · [English](README.md)
-![Zentrale Firewall-Regeln](website/assets/screenshots/de/rules-light-desktop.webp)
+![Zentrale Firewall-Regeln](docs/screenshots/readme-rules-de.webp)
-> **Stand:** `1.12.0` ist die aktuelle stabile Version. Entwickelt und getestet wurde gegen echte OPNsense-Instanzen; eine frische Installation aus dem Release-Bundle sowie Updates und Rollbacks sind durchgängig geprüft. Ecken und Kanten bitte melden.
+> **Stand:** `1.16.0` ist die aktuelle stabile Version. Entwickelt und getestet wurde gegen echte OPNsense-Instanzen; eine frische Installation aus dem Release-Bundle sowie Updates und Rollbacks sind durchgängig geprüft. Ecken und Kanten bitte melden.
 ## Funktionen
@@ -16,14 +16,23 @@ Zentrale Verwaltung mehrerer [OPNsense](https://opnsense.org)-Firewalls: Regeln,
 - **Sichere Änderungen** — jede Änderung läuft *Prüfen → Ausrollen → Bestätigen*; bleibt die Bestätigung im Zeitfenster aus, rollt OPNexus zurück.
 - **Hierarchische Policies** — Pre-/Post-Rulebases mit Vererbung über Gruppenbäume.
 - **VPN** — IPsec-Site-to-Site, OpenVPN und WireGuard, einmal definiert und ausgerollt.
- **Netzwerk** — Schnittstellen, VLANs, virtuelle IPs, Gateways, Routen, DNS und DHCP je Firewall, mit Diff-Vorschau, Backup vor jeder Änderung und Schutz davor, die eigene Verbindung zu kappen; von Hand angelegte Regeln lassen sich übernehmen.
+- **Netzwerk** — Schnittstellen, VLANs, virtuelle IPs, Gateways, Routen, LAGG/Bridge/GRE, DNS und DHCP je Firewall, dazu Tunables, Cron, Syslog, Snapshots und Diagnose (Ping, Traceroute, Port-Prüfung, DNS), ein Abgleich der Cluster-Knoten, mit Diff-Vorschau, Backup vor jeder Änderung und Schutz davor, die eigene Verbindung zu kappen; von Hand angelegte Regeln lassen sich übernehmen.
 - **Zertifikate** — Trust-Store für alle Firewalls und Ausstellung per ACME / Let's Encrypt.
 - **Logs & Audit** — zentrale Log-Suche mit Korrelation, Dashboards und lückenloser Deploy-Verlauf.
 - **Update-Center** — Firmware-Updates für die Flotte, mit Blick auf HA-Reihenfolge und Wartungsmodus.
 - **Einrichtungsassistent** — geführter Erststart nach der Installation: eigenes Passwort, Zwei-Faktor und die erste Firewall verbinden.
 - **Selbst-Update** — OPNexus aktualisiert sich auf Wunsch aus der eigenen Oberfläche, mit Fortschritt und automatischem Rollback (optional).
 - **Zugang** — HTTPS mit gepinnten Firewall-Zertifikaten, optionale Zwei-Faktor-Anmeldung, Rollen (Admin / Nur-Lesen), Tastaturbedienung, Dark Mode, Oberfläche auf Deutsch und Englisch.
 Alle Screenshots zeigen fiktive Beispieldaten.
 ## Ratgeber
 - [OPNsense-Firewalls zentral verwalten](https://opnexus.dev/opnsense-zentral-verwalten/) – wann sich zentrale Verwaltung lohnt und wie sie funktioniert
 - [OPNsense-HA-Cluster mit CARP verwalten](https://opnexus.dev/opnsense-ha-cluster-carp/) – Rollen, Alarme, geordnete Updates, Abgleich beider Knoten
 - [OPNsense-Regeln sicher ausrollen](https://opnexus.dev/opnsense-regeln-sicher-ausrollen/) – Vorschau, Bestätigungsfenster und automatischer Rollback
 - [Das Kommandozeilen-Werkzeug `opnexus`](https://opnexus.dev/docs/cli/) – Installation aktualisieren, zurückrollen und sichern
 ## Schnellstart
 Voraussetzung: Docker mit Compose-Plugin.
@@ -35,19 +44,21 @@ cp .env.example .env        # POSTGRES_PASSWORD (und ADMIN_PASSWORD) setzen
 docker compose up -d --build
 ```
-Die Oberfläche läuft dann unter `http://localhost:3100`. Ohne `ADMIN_PASSWORD` wird beim ersten Start ein zufälliges Admin-Passwort erzeugt und **einmalig** im Backend-Log ausgegeben:
+Die Oberfläche läuft dann unter `http://localhost:3100`. Ohne `ADMIN_PASSWORD` wird beim ersten Start ein zufälliges Admin-Passwort erzeugt und **einmalig** im Backend-Log ausgegeben. Verloren oder nie gesehen? Dieses Kommando setzt ein neues Zufallspasswort und zeigt es an (im Repo-Checkout `scripts/opnexus`, im Release-Bundle `./opnexus`):
 ```bash
-docker compose logs backend | grep -A5 "generated password"
+scripts/opnexus password
 ```
 Nach der ersten Anmeldung öffnet sich von selbst ein kurzer **Einrichtungsassistent**: eigenes Passwort setzen, optional Zwei-Faktor-Anmeldung einschalten, die erste Firewall verbinden (samt Anleitung für den API-Key in OPNsense). Er lässt sich überspringen und jederzeit unter System › Einrichtung wieder öffnen.
 Für den Zugriff von anderen Rechnern und den Produktivbetrieb mit TLS (mitgelieferter Caddy-Proxy) siehe das [Handbuch](docs/HANDBUCH.md#zugriff-von-außerhalb-dieser-vm--produktivbetrieb-mit-tls).
 **Fertige Images** (amd64) liegen in der Registry dieses Gitea. In der `.env`:
 ```bash
 OPNEXUS_IMAGE_REPO=git.opnexus.dev/opnexus
-OPNEXUS_VERSION=1.12.0
+OPNEXUS_VERSION=1.16.0
 ```
 ```bash
@@ -5,9 +5,9 @@ Central management for multiple [OPNsense](https://opnsense.org) firewalls: rule
 [Website](https://opnexus.dev) · [Changelog](CHANGELOG.md) · [Handbook (German)](docs/HANDBUCH.md) · [Deutsch](README.de.md)
-![Central firewall rules](website/assets/screenshots/en/rules-light-desktop.webp)
+![Central firewall rules](docs/screenshots/readme-rules-en.webp)
-> **Status:** `1.12.0` is the current stable release. It has been developed and tested against real OPNsense instances; a clean install from the release bundle, updates and rollbacks have been verified end to end. Please report rough edges.
+> **Status:** `1.16.0` is the current stable release. It has been developed and tested against real OPNsense instances; a clean install from the release bundle, updates and rollbacks have been verified end to end. Please report rough edges.
 ## What it does
@@ -16,16 +16,25 @@ Central management for multiple [OPNsense](https://opnsense.org) firewalls: rule
 - **Safe changes** — every change goes *preview → deploy → confirm*; without your confirmation inside the time window OPNexus rolls it back.
 - **Hierarchical policies** — pre/post rulebases with inheritance across group trees.
 - **VPN** — IPsec site-to-site, OpenVPN and WireGuard, defined once and rolled out.
- **Network** — interfaces, VLANs, virtual IPs, gateways, routes, DNS and DHCP per firewall, with a diff preview, a backup before every change and a guard against cutting your own connection; rules created by hand on a firewall can be adopted.
+- **Network** — interfaces, VLANs, virtual IPs, gateways, routes, LAGG/bridge/GRE, DNS and DHCP per firewall, plus tunables, cron, syslog, snapshots and diagnostics (ping, traceroute, port check, DNS), a comparison of cluster nodes, with a diff preview, a backup before every change and a guard against cutting your own connection; rules created by hand on a firewall can be adopted.
 - **Certificates** — trust store for all firewalls and ACME / Let's Encrypt issuance.
 - **Logs & audit** — central log search with correlation, dashboards and a complete deploy audit trail.
 - **Update center** — firmware updates for the fleet, aware of HA order and maintenance mode.
 - **Setup assistant** — a guided first run after installation: your own password, two-factor, and connecting the first firewall.
 - **Self-update** — OPNexus can update itself from its web interface, with progress and automatic rollback (opt-in).
 - **Access** — HTTPS with pinned firewall certificates, optional two-factor sign-in, roles (admin / read-only), keyboard operation, dark mode, German and English UI.
-![Cluster view](website/assets/screenshots/en/cluster-light-desktop.webp)
+![Cluster view](docs/screenshots/readme-cluster-en.webp)
 All screenshots show fictitious sample data.
 ## Guides
 - [Manage OPNsense firewalls centrally](https://opnexus.dev/en/manage-opnsense-centrally/) – when central management pays off and how it works
 - [Manage OPNsense HA clusters with CARP](https://opnexus.dev/en/opnsense-ha-cluster-carp/) – roles, alerts, ordered updates, comparing both nodes
 - [Roll out OPNsense rules safely](https://opnexus.dev/en/roll-out-opnsense-rules-safely/) – preview, confirmation window and automatic rollback
 - [The `opnexus` command-line tool](https://opnexus.dev/en/docs/cli/) – update, roll back and back up an installation
 ## Quick start
 Requires Docker with the Compose plugin.
@@ -37,19 +46,21 @@ cp .env.example .env        # set POSTGRES_PASSWORD (and ADMIN_PASSWORD)
 docker compose up -d --build
 ```
-The UI is then available at `http://localhost:3100`. Without `ADMIN_PASSWORD` a random admin password is generated on first start and printed **once** in the backend log:
+The UI is then available at `http://localhost:3100`. Without `ADMIN_PASSWORD` a random admin password is generated on first start and printed **once** in the backend log. Lost it, or never saw it? This sets a new random one and prints it (use `scripts/opnexus` in a repo checkout, `./opnexus` in the release bundle):
 ```bash
-docker compose logs backend | grep -A5 "generated password"
+scripts/opnexus password
 ```
 After the first sign-in a short **setup assistant** opens on its own: set your own password, optionally enable two-factor sign-in, connect your first firewall (including how to create the API key in OPNsense). You can skip it and reopen it any time under System › Setup.
 For access from other machines and for production use with TLS (bundled Caddy proxy), see the [handbook](docs/HANDBUCH.md#zugriff-von-außerhalb-dieser-vm--produktivbetrieb-mit-tls) (German).
 **Prebuilt images** (amd64) are published to this Gitea's registry. In `.env`:
 ```bash
 OPNEXUS_IMAGE_REPO=git.opnexus.dev/opnexus
-OPNEXUS_VERSION=1.12.0
+OPNEXUS_VERSION=1.16.0
 ```
 ```bash
@@ -58,6 +69,8 @@ docker compose pull && docker compose up -d --no-build
 `scripts/opnexus update` / `rollback` then update the installation (pull first, database backup before migrations, automatic rollback if the services do not become healthy).
 **Updating from the web interface** is available as an opt-in: set `COMPOSE_PROFILES=updater` in `.env` and an administrator can update (and roll back) under *Settings › Update OPNexus*. It runs as a separate small container that is the only one with Docker access — see the [handbook](docs/HANDBUCH.md#update-aus-dem-webinterface-optional) (German) for the security model.
 ## Privacy
 OPNexus is self-hosted and has no telemetry. It only connects to your firewalls and to notification targets you configure yourself. The optional new-version notice (`UPDATE_CHECK_URL=https://updates.opnexus.dev/latest.json`) is **off** unless you set it; when on, it makes one plain `GET` at most every 12 hours with the user agent `OPNexus/<version>` — no instance or user data.
@@ -92,7 +92,7 @@ class AuthMiddleware(BaseHTTPMiddleware):
                user = await auth_service.resolve_session(db, token)
            if user is not None:
                parts = request.url.path.strip("/").split("/")
-                kinds = {"rules": "rule", "aliases": "alias", "port-forward": "port_forward", "one-to-one": "one_to_one", "outbound-nat": "outbound_nat", "hosts": "host", "users": "user"}
+                kinds = {"rules": "rule", "aliases": "alias", "port-forward": "port_forward", "one-to-one": "one_to_one", "outbound-nat": "outbound_nat", "hosts": "host", "users": "user", "system": "system"}
                writing = request.method in ("POST", "PUT", "PATCH", "DELETE")
                if len(parts) > 1 and parts[1] in _SECURITY_KINDS:
                    event = {**_security_event(parts, request.method), "details": {"method": request.method, "path": request.url.path}}
@@ -28,6 +28,14 @@ class Settings(BaseSettings):
    update_check_url: str = ""
    update_check_interval_hours: int = 12
    # ── Updates aus dem Webinterface (app/services/updater_client.py) ─────
    # Optionaler Updater-Container (Compose-Profil "updater"). Das Backend hat
    # nie Zugriff auf den Docker-Socket; es reicht nur "aktualisieren" /
    # "zurückrollen" an diesen Dienst weiter, authentifiziert mit dem Token,
    # den der Updater in sein Zustands-Volume schreibt.
    updater_url: str = "http://updater:8080"
    updater_token_file: str = "/updater/token"
    # Cookies now carry the session, so this can no longer be a bare "*"
    # (the Fetch spec forbids credentialed requests against a wildcard
    # response) — see main.py's allow_origin_regex. Default only matches
@@ -6,6 +6,12 @@ from fastapi import HTTPException
 class ErrorCode(str, Enum):
    UPDATER_UNAVAILABLE = "UPDATER_UNAVAILABLE"
    UPDATER_BUSY = "UPDATER_BUSY"
    UPDATER_REJECTED = "UPDATER_REJECTED"
    UPDATE_NOT_OFFERED = "UPDATE_NOT_OFFERED"
    UPDATE_MAJOR_CHANGE = "UPDATE_MAJOR_CHANGE"
    ADMIN_REQUIRED = "ADMIN_REQUIRED"
    BACKUP_EMPTY = "BACKUP_EMPTY"
    BACKUP_INVALID_XML = "BACKUP_INVALID_XML"
    BACKUP_TOO_LARGE = "BACKUP_TOO_LARGE"
@@ -37,6 +37,9 @@ from app.routers import openvpn as openvpn_router
 from app.routers import wireguard as wireguard_router
 from app.routers import certificates as certificates_router
 from app.routers import network as network_router
 from app.routers import snapshots as snapshots_router
 from app.routers import network_drift as network_drift_router
 from app.routers import diagnostics as diagnostics_router
 from app.routers import restore as restore_router
 from app.version import APP_VERSION
 from app.routers import dashboard as dashboard_router
@@ -392,5 +395,8 @@ app.include_router(dashboard_router.router, prefix="/api")
 app.include_router(cluster_router.router, prefix="/api")
 app.include_router(services_router.router, prefix="/api")
 app.include_router(network_router.router, prefix="/api")
 app.include_router(snapshots_router.router, prefix="/api")
 app.include_router(network_drift_router.router, prefix="/api")
 app.include_router(diagnostics_router.router, prefix="/api")
 app.include_router(resource_samples_router.router, prefix="/api")
 app.include_router(scheduled_maintenance_router.router, prefix="/api")
@@ -48,6 +48,7 @@ class NotificationSettings(Base):
    maintenance_unknown_enabled: Mapped[bool] = mapped_column(Boolean, default=True)
    carp_health_enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default="true")
    nat_drift_enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default="true")
    network_drift_enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default="true")
    carp_auto_revert_failed_enabled: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True, server_default="true")
    poll_interval_seconds: Mapped[int] = mapped_column(Integer, default=300)
@@ -1,5 +1,5 @@
 import uuid
-from sqlalchemy import ForeignKey, String
+from sqlalchemy import Boolean, ForeignKey, String
 from sqlalchemy.dialects.postgresql import UUID as PGUUID
 from sqlalchemy.orm import Mapped, mapped_column
 from app.database import Base
@@ -9,3 +9,6 @@ class UserPreferences(Base):
    user_id: Mapped[uuid.UUID] = mapped_column(PGUUID(as_uuid=True), ForeignKey('admin_users.id',ondelete='CASCADE'), primary_key=True)
    theme: Mapped[str] = mapped_column(String(10), default='system')
    language: Mapped[str] = mapped_column(String(5), nullable=False, default='de', server_default='de')
    # Set once the user finished or dismissed the first-run setup assistant
    # (frontend /setup); it is then no longer offered automatically.
    setup_done: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False, server_default='false')
@@ -0,0 +1,66 @@
 """Recovery: give an account a new random password and print it once.
 For a fresh install whose generated first-start password scrolled out of the
 log, and for an admin who forgot theirs. Needs shell access to the server,
 which is the trust boundary for this tool anyway (same as app.reset_2fa).
 All sessions of the account are ended. Normally called through the host
 CLI:
    ./opnexus password [username]
 or directly:
    docker compose exec backend python -m app.reset_password [username]
 Without a username the configured ADMIN_USERNAME is used; if that account does
 not exist and there is exactly one admin, that one.
 """
 import asyncio
 import secrets
 import sys
 from sqlalchemy import select
 from app.config import settings
 from app.database import SessionLocal
 from app.models.user import AdminUser
 from app.services import auth_service
 async def main(username: str | None) -> int:
    async with SessionLocal() as db:
        if username is None:
            username = settings.admin_username
            user = (await db.execute(select(AdminUser).where(AdminUser.username == username))).scalar_one_or_none()
            if user is None:
                admins = (await db.execute(select(AdminUser).where(AdminUser.role == "admin"))).scalars().all()
                if len(admins) != 1:
                    names = ", ".join(sorted(a.username for a in admins)) or "-"
                    print(f"No account named '{username}'. Pass the username (admins: {names}).", file=sys.stderr)
                    return 1
                user = admins[0]
        else:
            user = (await db.execute(select(AdminUser).where(AdminUser.username == username))).scalar_one_or_none()
            if user is None:
                print(f"No such user: {username}", file=sys.stderr)
                return 1
        password = secrets.token_urlsafe(18)
        user.password_hash = await auth_service.hash_password_async(password)
        await auth_service.revoke_sessions(db, user.id, commit=False)
        await db.commit()
        name = user.username
        has_totp = user.totp_enabled
    print(f"Username: {name}")
    print(f"Password: {password}")
    if has_totp:
        print("Two-factor sign-in is still on (lost the code? python -m app.reset_2fa).", file=sys.stderr)
    return 0
 if __name__ == "__main__":
    if len(sys.argv) > 2:
        print("usage: python -m app.reset_password [username]", file=sys.stderr)
        sys.exit(2)
    sys.exit(asyncio.run(main(sys.argv[1] if len(sys.argv) == 2 else None)))
@@ -0,0 +1,68 @@
 import uuid
 from typing import Literal
 from fastapi import APIRouter, Depends
 from pydantic import BaseModel, Field
 from sqlalchemy.ext.asyncio import AsyncSession
 from app.database import get_db
 from app.errors import ErrorCode, api_error
 from app.models.host import OpnsenseHost
 from app.services import diagnostics_service
 router = APIRouter(prefix="/hosts/{host_id}/diagnostics", tags=["diagnostics"])
 IpProto = Literal["inet", "inet6"]
 class PingRequest(BaseModel):
    target: str = Field(min_length=1, max_length=253)
    ipproto: IpProto = "inet"
    count: int = Field(default=4, ge=1, le=10)
    packetsize: int | None = Field(default=None, ge=1, le=9000)
    source: str | None = Field(default=None, max_length=64)
 class TracerouteRequest(BaseModel):
    target: str = Field(min_length=1, max_length=253)
    ipproto: IpProto = "inet"
    protocol: Literal["udp", "icmp"] = "icmp"
    source: str | None = Field(default=None, max_length=64)
 class PortprobeRequest(BaseModel):
    target: str = Field(min_length=1, max_length=253)
    port: int = Field(ge=1, le=65535)
    ipproto: IpProto = "inet"
    source: str | None = Field(default=None, max_length=64)
 class DnsRequest(BaseModel):
    name: str = Field(min_length=1, max_length=253)
    server: str | None = Field(default=None, max_length=64)
 async def _host(db: AsyncSession, host_id: uuid.UUID) -> OpnsenseHost:
    host = await db.get(OpnsenseHost, host_id)
    if not host:
        raise api_error(404, ErrorCode.HOST_NICHT_GEFUNDEN)
    return host
@router.post("/ping")
 async def ping(host_id: uuid.UUID, p: PingRequest, db: AsyncSession = Depends(get_db)):
    return await diagnostics_service.ping(await _host(db, host_id), p.target, p.ipproto, p.count, p.packetsize, p.source)
@router.post("/traceroute")
 async def traceroute(host_id: uuid.UUID, p: TracerouteRequest, db: AsyncSession = Depends(get_db)):
    return await diagnostics_service.traceroute(await _host(db, host_id), p.target, p.ipproto, p.protocol, p.source)
@router.post("/portprobe")
 async def portprobe(host_id: uuid.UUID, p: PortprobeRequest, db: AsyncSession = Depends(get_db)):
    return await diagnostics_service.portprobe(await _host(db, host_id), p.target, p.port, p.ipproto, p.source)
@router.post("/dns")
 async def dns(host_id: uuid.UUID, p: DnsRequest, db: AsyncSession = Depends(get_db)):
    return await diagnostics_service.dns_lookup(await _host(db, host_id), p.name, p.server)
@@ -76,3 +76,15 @@ async def current_item(host_id: uuid.UUID, kind: str, item_uuid: str, db: AsyncS
        return await network_change_service.item(host, kind, item_uuid)
    except OpnsenseAPIError as exc:
        raise _upstream_error(host, exc) from exc
@router.get("/objects/{kind}")
 async def list_objects(host_id: uuid.UUID, kind: str, db: AsyncSession = Depends(get_db)):
    """Rows of a generic object kind (tunables, cron jobs, LAGG, ...), reduced to their display columns."""
    if kind not in network_change_service.OBJECT_COLUMNS:
        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
    host = await _host_or_404(db, host_id)
    try:
        return await network_change_service.list_objects(host, kind)
    except OpnsenseAPIError as exc:
        raise _upstream_error(host, exc) from exc
@@ -0,0 +1,29 @@
 from collections import defaultdict
 from fastapi import APIRouter, Depends
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 from app.database import get_db
 from app.models.host import OpnsenseHost
 from app.services import network_drift_service
 router = APIRouter(prefix="/network", tags=["network"])
@router.get("/drift")
 async def network_drift(db: AsyncSession = Depends(get_db)):
    """Per cluster: differences in the network configuration between its nodes (live read of every node)."""
    hosts = (await db.scalars(select(OpnsenseHost).where(OpnsenseHost.enabled.is_(True)).order_by(OpnsenseHost.name))).all()
    by_cluster: dict[str, list[OpnsenseHost]] = defaultdict(list)
    for host in hosts:
        if host.cluster_name:
            by_cluster[host.cluster_name].append(host)
    clusters = []
    for name, members in sorted(by_cluster.items()):
        if len(members) < 2:
            continue
        differences, compared, unreachable = await network_drift_service.compute_cluster(members)
        clusters.append({"name": name, "hosts": [h.name for h in members], "compared": compared,
                         "unreachable": unreachable, "differences": differences})
    return {"clusters": clusters}
@@ -14,12 +14,14 @@ router=APIRouter(prefix='/settings',tags=['settings'])
 class Preferences(BaseModel):
    theme: Literal['light','dark','system'] | None = None
    language: Literal['de','en'] | None = None
    setup_done: bool | None = None
@router.get('')
 async def read(user: AdminUser=Depends(current_user),db:AsyncSession=Depends(get_db)):
    preferences=await db.get(UserPreferences,user.id)
    return {'username':user.username,'theme':preferences.theme if preferences else 'system',
            'language':preferences.language if preferences else 'de',
            'setup_done':preferences.setup_done if preferences else False,
            'deploy_confirm_window_seconds':settings.deploy_confirm_window_seconds,
            'session_lifetime_seconds':settings.session_lifetime}
@@ -29,8 +31,9 @@ async def update(payload:Preferences,user:AdminUser=Depends(current_user),db:Asy
    current = await db.get(UserPreferences, user.id)
    theme = payload.theme or (current.theme if current else 'system')
    language = payload.language or (current.language if current else 'de')
-    await db.execute(insert(UserPreferences).values(user_id=user.id,theme=theme,language=language).on_conflict_do_update(index_elements=['user_id'],set_={'theme':theme,'language':language}))
+    setup_done = payload.setup_done if payload.setup_done is not None else bool(current.setup_done if current else False)
    await db.execute(insert(UserPreferences).values(user_id=user.id,theme=theme,language=language,setup_done=setup_done).on_conflict_do_update(index_elements=['user_id'],set_={'theme':theme,'language':language,'setup_done':setup_done}))
    await db.commit()
-    return {'username':username,'theme':theme,'language':language,
+    return {'username':username,'theme':theme,'language':language,'setup_done':setup_done,
            'deploy_confirm_window_seconds':settings.deploy_confirm_window_seconds,
            'session_lifetime_seconds':settings.session_lifetime}
@@ -0,0 +1,55 @@
 import uuid
 from fastapi import APIRouter, Depends
 from pydantic import BaseModel, Field
 from sqlalchemy.ext.asyncio import AsyncSession
 from app.database import get_db
 from app.errors import ErrorCode, api_error
 from app.models.host import OpnsenseHost
 from app.routers.hosts import _upstream_error
 from app.services import snapshot_service
 from app.services.host_maintenance_service import ensure_no_maintenance
 from app.services.opnsense_client import OpnsenseAPIError
 from app.services.policy_service import policy_lock
 router = APIRouter(prefix="/hosts/{host_id}/snapshots", tags=["snapshots"])
 class SnapshotCreate(BaseModel):
    name: str = Field(min_length=1, max_length=64)
    note: str = Field(default="", max_length=200)
 async def _host(db: AsyncSession, host_id: uuid.UUID) -> OpnsenseHost:
    host = await db.get(OpnsenseHost, host_id)
    if not host:
        raise api_error(404, ErrorCode.HOST_NICHT_GEFUNDEN)
    return host
@router.get("")
 async def list_snapshots(host_id: uuid.UUID, db: AsyncSession = Depends(get_db)):
    host = await _host(db, host_id)
    try:
        return await snapshot_service.list_snapshots(host)
    except OpnsenseAPIError as exc:
        raise _upstream_error(host, exc) from exc
@router.post("", status_code=201)
 async def create_snapshot(host_id: uuid.UUID, payload: SnapshotCreate, db: AsyncSession = Depends(get_db)):
    await policy_lock(db)
    host = await _host(db, host_id)
    await ensure_no_maintenance(db, [host])
    return await snapshot_service.create(host, payload.name, payload.note)
@router.delete("/{snapshot_uuid}", status_code=204)
 async def delete_snapshot(host_id: uuid.UUID, snapshot_uuid: str, db: AsyncSession = Depends(get_db)):
    await policy_lock(db)
    host = await _host(db, host_id)
    await ensure_no_maintenance(db, [host])
    if not snapshot_uuid.replace("-", "").isalnum() or len(snapshot_uuid) > 64:
        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
    await snapshot_service.delete(host, snapshot_uuid)
@@ -1,6 +1,10 @@
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends
 from pydantic import BaseModel, Field
-from app.services import update_check_service
+from app.errors import ErrorCode, api_error
 from app.models.user import AdminUser
 from app.routers.auth import current_user
 from app.services import update_check_service, updater_client
 router = APIRouter(prefix="/system", tags=["system"])
@@ -10,3 +14,93 @@ async def version_check() -> dict:
    """Ist eine neuere OPNexus-Version veröffentlicht? Aus, solange
    UPDATE_CHECK_URL nicht gesetzt ist (dann ohne ausgehende Anfrage)."""
    return await update_check_service.check()
 def _admin(user: AdminUser) -> AdminUser:
    # Der Updater ist Administration der Installation selbst — auch das reine
    # Lesen (Logs, Rollback-Optionen) bleibt Admins vorbehalten.
    if user.role != "admin":
        raise api_error(403, ErrorCode.ADMIN_REQUIRED)
    return user
 def _major(version: str | None) -> int | None:
    try:
        return int((version or "").split(".")[0])
    except ValueError:
        return None
 class UpdateRequest(BaseModel):
    version: str = Field(min_length=5, max_length=20)
@router.get("/updater")
 async def updater_status(user: AdminUser = Depends(current_user)) -> dict:
    """Zustand für den Abschnitt "OPNexus aktualisieren" in den Einstellungen:
    Versionshinweis des Release-Feeds plus (falls aktiviert) der Updater."""
    _admin(user)
    check = await update_check_service.check()
    result: dict = {
        "available": False, "reason": None, "mode": None,
        "current": check["current"], "latest": check["latest"], "update_available": check["update_available"],
        "release_url": check["release_url"], "feed_enabled": check["enabled"],
        "feed_error": check["error"], "checked_at": check["checked_at"],
        "can_update": False, "major_change": False,
        "job": None, "phases": [], "log": [], "services": {},
        "rollback_available": False, "rollback_loses_data": False, "rollback_version": None,
    }
    try:
        updater = await updater_client.status()
    except updater_client.UpdaterUnavailable as exc:
        result["reason"] = str(exc)
        return result
    except updater_client.UpdaterRejected:
        result["reason"] = "unreachable"
        return result
    mode = updater.get("mode")
    running = (updater.get("job") or {}).get("state") == "running"
    result.update(
        available=True, mode=mode, job=updater.get("job"), phases=updater.get("phases") or [],
        log=updater.get("log") or [], services=updater.get("services") or {},
        rollback_available=bool(updater.get("rollback_available")),
        rollback_loses_data=bool(updater.get("rollback_loses_data")),
        rollback_version=((updater.get("last_update") or {}).get("prev_version")),
    )
    # Hauptversionssprünge nur bewusst über die Kommandozeile (Release-Notes lesen).
    result["major_change"] = bool(check["latest"]) and _major(check["latest"]) != _major(check["current"])
    result["can_update"] = (
        mode == "release" and not running and bool(check["update_available"]) and not result["major_change"]
    )
    return result
@router.post("/updater/update", status_code=202)
 async def updater_update(payload: UpdateRequest, user: AdminUser = Depends(current_user)) -> dict:
    """Aktualisiert OPNexus auf die vom Release-Feed gemeldete neueste stabile
    Version. Beliebige Versionen werden bewusst nicht angenommen."""
    _admin(user)
    check = await update_check_service.check()
    if not check["update_available"] or payload.version.lstrip("v") != check["latest"]:
        raise api_error(409, ErrorCode.UPDATE_NOT_OFFERED)
    if _major(check["latest"]) != _major(check["current"]):
        raise api_error(409, ErrorCode.UPDATE_MAJOR_CHANGE)
    return await _forward(updater_client.start_update(check["latest"]))
@router.post("/updater/rollback", status_code=202)
 async def updater_rollback(user: AdminUser = Depends(current_user)) -> dict:
    _admin(user)
    return await _forward(updater_client.start_rollback())
 async def _forward(call) -> dict:
    try:
        return await call
    except updater_client.UpdaterUnavailable:
        raise api_error(503, ErrorCode.UPDATER_UNAVAILABLE)
    except updater_client.UpdaterRejected as rejected:
        if rejected.code == "busy":
            raise api_error(409, ErrorCode.UPDATER_BUSY)
        raise api_error(409, ErrorCode.UPDATER_REJECTED, reason=rejected.code)
@@ -135,7 +135,8 @@ class HostNetwork(BaseModel):
 class NetworkChangeRequest(BaseModel):
-    kind: Literal["vlan", "vip", "gateway", "route", "interface", "dns_host", "dhcp_host", "kea_subnet", "kea_reservation"]
+    kind: Literal["vlan", "vip", "gateway", "route", "interface", "dns_host", "dhcp_host", "kea_subnet", "kea_reservation",
                  "tunable", "cron_job", "syslog_destination", "gateway_group", "lagg", "bridge", "loopback", "gre", "gif", "vxlan", "dns_forward", "dhcp_range"]
    action: Literal["add", "set", "del"]
    # Goes into a URL path, so only plain identifiers.
    uuid: str | None = Field(default=None, pattern=r"^[A-Za-z0-9_.:-]{1,64}$")
@@ -9,7 +9,7 @@ from app.config import settings
 SmtpSecurity = Literal["none", "starttls", "ssl"]
 ProblemType = Literal[
    "host_offline", "cert_expiry", "rule_drift", "revert_failed", "maintenance_unknown",
-    "carp_split_brain", "nat_drift", "carp_auto_revert_failed",
+    "carp_split_brain", "nat_drift", "carp_auto_revert_failed", "network_drift",
 ]
@@ -36,6 +36,7 @@ class NotificationSettingsRead(BaseModel):
    maintenance_unknown_enabled: bool
    carp_health_enabled: bool
    nat_drift_enabled: bool
    network_drift_enabled: bool = True
    carp_auto_revert_failed_enabled: bool
    poll_interval_seconds: int
@@ -71,6 +72,7 @@ class NotificationSettingsUpdate(BaseModel):
    maintenance_unknown_enabled: bool | None = None
    carp_health_enabled: bool | None = None
    nat_drift_enabled: bool | None = None
    network_drift_enabled: bool | None = None
    carp_auto_revert_failed_enabled: bool | None = None
    poll_interval_seconds: int | None = Field(
@@ -367,7 +367,8 @@ async def bootstrap_admin(db: AsyncSession) -> None:
        logger.warning(
            "\n%s\n  No ADMIN_PASSWORD set — created admin user '%s' with a\n"
            "  generated password:\n\n      %s\n\n"
-            "  Log in and change it now. This is shown only once.\n%s",
+            "  Log in and change it now. This is shown only once.\n"
            "  Lost it?  ./opnexus password   (sets and prints a new one)\n%s",
            "=" * 64, settings.admin_username, password, "=" * 64,
        )
    else:
@@ -0,0 +1,142 @@
 """Network probes run FROM a firewall: ping, traceroute, TCP port probe, DNS lookup.
 Admin-only by construction (every call is a POST, which the read-only role is
 refused for) and audited with the target, because a firewall that probes
 arbitrary addresses on request is also a scanning tool. Inputs are checked
 here before they are sent (the firewall validates them again); results are
 shown and never stored. Ping runs as a short job that is always stopped and
 removed again, even when polling fails.
 """
 import asyncio
 import ipaddress
 import re
 import time
 from app.errors import ErrorCode, api_error
 from app.models.host import OpnsenseHost
 from app.services import audit_service, opnsense_client
 from app.services.opnsense_client import OpnsenseAPIError, OpnsenseDiagnosticRejected
 TARGET = re.compile(r"^[A-Za-z0-9]([A-Za-z0-9.:_-]{0,251}[A-Za-z0-9])?$")
 # At most a few probes at a time per OPNexus process, so the page cannot be used to hammer a firewall.
 _SLOTS = asyncio.Semaphore(4)
 def clean_target(value: str, field: str = "target") -> str:
    value = (value or "").strip()
    if not TARGET.match(value):
        raise api_error(422, ErrorCode.NETWORK_FIELD_INVALID, field=field)
    return value
 def clean_source(value: str | None) -> str:
    value = (value or "").strip()
    if not value:
        return ""
    try:
        return str(ipaddress.ip_address(value))
    except ValueError:
        raise api_error(422, ErrorCode.NETWORK_FIELD_INVALID, field="source") from None
 async def _audit(host: OpnsenseHost, tool: str, target: str, ok: bool, details: dict, message: str | None = None) -> None:
    await audit_service.persist(kind="diagnostic", action=f"diag.{tool}", status="ok" if ok else "failed",
                                entity_name=target, host_id=str(host.id), host_name=host.name, message=message, details=details)
 def _rejected(exc: OpnsenseDiagnosticRejected):
    field = next(iter(exc.validations), "target").split(".")[-1]
    return api_error(422, ErrorCode.NETWORK_FIELD_INVALID, field=field)
 async def _guarded(host: OpnsenseHost, tool: str, target: str, params: dict, call):
    async with _SLOTS:
        try:
            result = await call()
        except OpnsenseDiagnosticRejected as exc:
            await _audit(host, tool, target, False, params, "rejected: " + ", ".join(exc.validations))
            raise _rejected(exc) from exc
        except OpnsenseAPIError as exc:
            await _audit(host, tool, target, False, params, str(exc)[:300])
            raise api_error(502, ErrorCode.HOST_REQUEST_FAILED, host=host.name) from exc
    await _audit(host, tool, target, True, params)
    return result
 async def traceroute(host: OpnsenseHost, target: str, ipproto: str, protocol: str, source: str | None) -> dict:
    target, source = clean_target(target), clean_source(source)
    params = {"target": target, "ipproto": ipproto, "protocol": protocol, "source": source}
    async def call():
        data = await opnsense_client.diagnostic_set(
            host, "/diagnostics/traceroute/set", "traceroute",
            {"hostname": target, "ipproto": ipproto, "protocol": protocol, "source_address": source})
        resp = data.get("response") or {}
        hops = [{"ttl": str(r.get("ttl", "")), "address": str(r.get("address", "")), "host": str(r.get("host", "")),
                 "as": str(r.get("AS", "")), "probes": str(r.get("probes", ""))} for r in resp.get("rows", []) if isinstance(r, dict)]
        return {"target": target, "notice": str(resp.get("notice", "")), "hops": hops}
    return await _guarded(host, "traceroute", target, params, call)
 async def portprobe(host: OpnsenseHost, target: str, port: int, ipproto: str, source: str | None) -> dict:
    target, source = clean_target(target), clean_source(source)
    params = {"target": target, "port": port, "ipproto": ipproto, "source": source}
    async def call():
        data = await opnsense_client.diagnostic_set(
            host, "/diagnostics/portprobe/set", "portprobe",
            {"hostname": target, "port": str(port), "ipproto": ipproto, "source_address": source, "source_port": "", "showtext": "0"})
        message = str((data.get("response") or {}).get("message", ""))
        # Never forward the remote payload (a service banner): only whether the connection worked.
        return {"target": target, "port": port, "open": "succeeded" in message.lower(), "message": message}
    return await _guarded(host, "portprobe", target, params, call)
 async def dns_lookup(host: OpnsenseHost, name: str, server: str | None) -> dict:
    name = clean_target(name, "name")
    server = clean_source(server)
    params = {"name": name, "server": server}
    async def call():
        data = await opnsense_client.diagnostic_set(host, "/diagnostics/dns_diagnostics/set", "dns", {"hostname": name, "server": server})
        out = {}
        for rtype, rec in (data.get("response") or {}).items():
            if isinstance(rec, dict):
                out[str(rtype)] = {"answers": [str(a) for a in rec.get("answers", [])], "query_time": str(rec.get("query_time", "")),
                                   "server": str(rec.get("server", ""))}
        return {"name": name, "records": out}
    return await _guarded(host, "dns", name, params, call)
 async def ping(host: OpnsenseHost, target: str, ipproto: str, count: int, packetsize: int | None, source: str | None) -> dict:
    target, source = clean_target(target), clean_source(source)
    params = {"target": target, "ipproto": ipproto, "count": count, "packetsize": packetsize, "source": source}
    async def call():
        job = await opnsense_client.ping_job_start(host, {
            "hostname": target, "fam": "ip6" if ipproto == "inet6" else "ip", "source_address": source,
            "packetsize": str(packetsize or ""), "disable_frag": "0", "interval": "1", "description": "OPNexus"})
        try:
            state = None
            deadline = time.monotonic() + count + 6
            while time.monotonic() < deadline:
                await asyncio.sleep(1)
                state = await opnsense_client.ping_job_state(host, job)
                if state and int(state.get("send") or 0) >= count:
                    break
            await opnsense_client.ping_job_stop(host, job)
            await asyncio.sleep(0.5)
            state = await opnsense_client.ping_job_state(host, job) or state
        finally:
            # Never leave a job running on the firewall.
            try:
                await opnsense_client.ping_job_stop(host, job)
                await opnsense_client.ping_job_remove(host, job)
            except OpnsenseAPIError:
                pass
        if not state:
            raise OpnsenseAPIError("Ping: kein Ergebnis von der Firewall")
        return {"target": target, "sent": int(state.get("send") or 0), "received": int(state.get("received") or 0),
                "loss": str(state.get("loss", "")), "min": state.get("min"), "avg": state.get("avg"), "max": state.get("max"),
                "stddev": state.get("std-dev"), "error": state.get("last_error")}
    return await _guarded(host, "ping", target, params, call)
@@ -48,6 +48,18 @@ FIELDS: dict[str, set[str]] = {
    "kea_subnet": {"subnet", "pools", "valid_lifetime", "next_server", "description", "option_data.routers",
                   "option_data.domain_name_servers", "option_data.domain_name", "option_data.ntp_servers"},
    "kea_reservation": {"subnet", "ip_address", "hw_address", "client_id", "hostname", "description", "next_server"},
    "tunable": {"tunable", "value", "descr"},
    "cron_job": {"enabled", "minutes", "hours", "days", "months", "weekdays", "who", "command", "parameters", "description"},
    "syslog_destination": {"enabled", "transport", "program", "level", "facility", "hostname", "port", "rfc5424", "description"},
    "gateway_group": {"name", "item", "item2", "item3", "item4", "item5", "trigger", "poolopts", "descr"},
    "lagg": {"members", "primary_member", "proto", "lacp_fast_timeout", "use_flowid", "lagghash", "lacp_strict", "mtu", "descr"},
    "bridge": {"members", "linklocal", "enablestp", "proto", "descr"},
    "loopback": {"deviceId", "description"},
    "gre": {"local-addr", "remote-addr", "tunnel-local-addr", "tunnel-remote-addr", "tunnel-remote-net", "descr"},
    "gif": {"local-addr", "remote-addr", "tunnel-local-addr", "tunnel-remote-addr", "tunnel-remote-net", "descr"},
    "vxlan": {"deviceId", "vxlanid", "vxlanlocal", "vxlanlocalport", "vxlanremote", "vxlanremoteport", "vxlangroup", "vxlandev"},
    "dns_forward": {"enabled", "type", "domain", "server", "port", "verify", "forward_tcp_upstream", "forward_first", "description"},
    "dhcp_range": {"interface", "start_addr", "end_addr", "subnet_mask", "lease_time", "domain_type", "domain", "description"},
    "interface": {"if", "descr", "enable", "type4", "ipaddr", "gateway", "type6", "ipaddrv6", "gatewayv6", "mtu",
                  "blockpriv", "blockbogons", "lock"},
 }
@@ -56,8 +68,23 @@ SECRET_FIELDS: dict[str, set[str]] = {"vip": {"password"}}
 SECTION = {"vlan": "vlans", "vip": "vips", "gateway": "gateways", "route": "routes", "interface": "assignments",
           "dns_host": "dns_hosts", "dhcp_host": "dhcp_hosts", "kea_subnet": "kea_subnets",
           "kea_reservation": "kea_reservations"}
 # Columns the generic object lists show (the firewall's own field names). Lists never carry fields outside FIELDS.
 OBJECT_COLUMNS: dict[str, list[str]] = {
    "tunable": ["tunable", "value", "default_value", "descr"],
    "cron_job": ["enabled", "minutes", "hours", "days", "months", "weekdays", "command", "description"],
    "syslog_destination": ["enabled", "transport", "hostname", "port", "program", "level", "description"],
    "gateway_group": ["name", "item", "item2", "item3", "trigger", "descr"],
    "lagg": ["laggif", "members", "proto", "descr"],
    "bridge": ["bridgeif", "members", "proto", "descr"],
    "loopback": ["deviceId", "description"],
    "gre": ["greif", "local-addr", "remote-addr", "tunnel-local-addr", "tunnel-remote-addr", "descr"],
    "gif": ["gifif", "local-addr", "remote-addr", "tunnel-local-addr", "tunnel-remote-addr", "descr"],
    "vxlan": ["deviceId", "vxlanid", "vxlanlocal", "vxlanremote", "vxlangroup", "vxlandev"],
    "dns_forward": ["enabled", "type", "domain", "server", "port", "description"],
    "dhcp_range": ["interface", "start_addr", "end_addr", "subnet_mask", "lease_time", "description"],
 }
 # These change how the network is wired; the others (DNS/DHCP data) cannot cut the connection to the firewall.
-WIRING_KINDS = {"vlan", "vip", "gateway", "route", "interface"}
+WIRING_KINDS = {"vlan", "vip", "gateway", "route", "interface", "lagg", "bridge", "gre", "gif", "vxlan"}
 _CONTROL = re.compile(r"[\x00-\x1f\x7f]")
@@ -135,7 +162,7 @@ def assess(kind: str, action: str, uuid: str | None, before: dict, after: dict,
    mgmt_iface = next((i for i in net.interfaces if i.device == mgmt_device), None)
    mgmt_ident = mgmt_iface.identifier if mgmt_iface else None
-    if SECTION[kind] in net.unavailable:
+    if SECTION.get(kind) in net.unavailable:
        blocks.append(_risk("api_unavailable", section=SECTION[kind]))
    if mgmt_device is None and kind in WIRING_KINDS:
        # We cannot tell what this change could cut, so treat every change to existing objects as risky.
@@ -160,6 +187,22 @@ def assess(kind: str, action: str, uuid: str | None, before: dict, after: dict,
        if action in ("set", "del") and uuid in ("wan", "lan") and uuid != mgmt_ident:
            warnings.append(_risk("core_interface", name=uuid))
    if kind in ("lagg", "bridge"):
        members = {m for side in (before, after) for m in side.get("members", "").split(",") if m}
        if mgmt_device and mgmt_device in members:
            risks.append(_risk("management_member", device=mgmt_device))
        elif mgmt_device is None and action in ("set", "del"):
            pass  # already covered by management_unknown above
    if kind == "tunable":
        # sysctl values can change how the whole system behaves (and some only apply after a reboot).
        risks.append(_risk("tunable_change"))
        if action in ("set", "del") and uuid and "-" not in uuid:
            # A built-in default (its id is not a UUID): the firewall would create a new entry instead of
            # changing it, so overriding one is an "add", not an edit.
            blocks.append(_risk("tunable_default_row"))
    if kind == "gateway_group" and action == "del":
        warnings.append(_risk("gateway_group_in_use"))
    if kind == "vlan" and action in ("set", "del"):
        device = next((v.device for v in net.vlans if v.uuid == uuid), None)
        if device and device == mgmt_device:
@@ -231,6 +274,26 @@ async def _peers(db: AsyncSession, host: OpnsenseHost) -> list[str]:
    return list(rows.all())
 async def list_objects(host: OpnsenseHost, kind: str) -> dict:
    """Rows of one generic object kind, reduced to the columns above (plus uuid) — never whole rows,
    so nothing the list does not need (or must not show) leaves the server."""
    columns = OBJECT_COLUMNS[kind]
    try:
        rows = await opnsense_client.search_network_objects(host, kind)
    except OpnsenseAPIError as exc:
        if "404" in str(exc):
            return {"available": False, "columns": columns, "rows": []}   # this OPNsense version lacks the API
        raise
    out = []
    for row in rows:
        item = {"uuid": str(row.get("uuid", ""))}
        for col in columns:
            value = row.get(col)
            item[col] = "" if value is None or isinstance(value, (dict, list)) else str(value)
        out.append(item)
    return {"available": True, "columns": columns, "rows": out}
 async def _rules_using(host: OpnsenseHost, identifier: str) -> list[str]:
    """Descriptions of the user-made rules that name this interface (OPNsense deletes them with it)."""
    data = await opnsense_client.search_rules(host, all_rows=True)
@@ -0,0 +1,86 @@
 """Compares the network configuration of the nodes of an HA cluster.
 Interfaces, VLANs, virtual IPs, gateways, routes, DNS and DHCP objects should
 be the same on both nodes of a pair; a VLAN or gateway that exists on one node
 only is exactly the kind of difference that breaks a failover months later.
 Per-node values are deliberately NOT compared: interface addresses, CARP
 advskew/password and the active default gateway legitimately differ between
 the nodes. What is compared is the identity of each object (its key) and the
 settings that must agree (its signature). A category is skipped when any
 reachable node cannot deliver it (older OPNsense), instead of reporting that
 as a difference.
 """
 from app.models.host import OpnsenseHost
 from app.schemas.network import HostNetwork
 from app.services import network_service
 from app.services.opnsense_client import OpnsenseAPIError
 CATEGORIES = ["interfaces", "vlans", "vips", "gateways", "routes", "dns_hosts", "dhcp_hosts", "kea_subnets", "kea_reservations"]
 def signatures(net: HostNetwork) -> dict[str, dict[str, str]]:
    out: dict[str, dict[str, str]] = {c: {} for c in CATEGORIES}
    for i in net.interfaces:
        if i.assigned and i.identifier:
            out["interfaces"][i.identifier] = f"{i.description}|{i.vlan_tag or ''}|{i.ipv4_type or ''}"
    for v in net.vlans:
        out["vlans"][f"{v.tag}@{v.parent}"] = v.description
    for v in net.vips:
        if v.mode == "carp":
            out["vips"][f"carp:{v.vhid}"] = f"{v.address}|{v.advbase or ''}|{v.description}"
        else:
            out["vips"][f"{v.mode}:{v.address}"] = v.description
    for g in net.gateways:
        out["gateways"][g.name] = f"{g.interface}|{g.ip_protocol}|{g.address}|{g.disabled}"
    for r in net.routes:
        out["routes"][r.network] = f"{r.gateway}|{r.disabled}"
    for d in net.dns_hosts:
        out["dns_hosts"][f"{d.hostname}.{d.domain}|{d.record_type}"] = f"{d.server}|{d.enabled}"
    for h in net.dhcp_hosts:
        out["dhcp_hosts"][f"{h.host}.{h.domain}"] = f"{h.ip}|{h.hwaddr}"
    for s in net.kea_subnets:
        out["kea_subnets"][s.subnet] = f"{s.pools}|{s.routers}|{s.dns_servers}"
    for k in net.kea_reservations:
        out["kea_reservations"][f"{k.ip_address}|{k.hw_address}"] = k.hostname
    return out
 # Which HostNetwork.unavailable entry makes a category incomparable.
 _UNAVAILABLE_KEY = {"interfaces": "assignments"}
 def compare(per_host: dict[str, HostNetwork]) -> list[dict]:
    """per_host: host name -> its network. Returns one row per object that is missing on a node or differs."""
    names = sorted(per_host)
    sigs = {n: signatures(per_host[n]) for n in names}
    rows: list[dict] = []
    for category in CATEGORIES:
        skip_key = _UNAVAILABLE_KEY.get(category, category)
        if any(skip_key in per_host[n].unavailable for n in names):
            continue
        keys = sorted({k for n in names for k in sigs[n][category]})
        for key in keys:
            present = {n: sigs[n][category][key] for n in names if key in sigs[n][category]}
            if len(present) < len(names):
                rows.append({"category": category, "key": key, "status": "missing",
                             "present_on": sorted(present), "missing_from": sorted(set(names) - set(present)),
                             "signatures": present})
            elif len(set(present.values())) > 1:
                rows.append({"category": category, "key": key, "status": "different",
                             "present_on": names, "missing_from": [], "signatures": present})
    return rows
 async def compute_cluster(hosts: list[OpnsenseHost]) -> tuple[list[dict], list[str], list[str]]:
    """Returns (differences, compared host names, unreachable host names)."""
    per_host: dict[str, HostNetwork] = {}
    unreachable: list[str] = []
    for host in hosts:
        try:
            per_host[host.name] = await network_service.get_host_network(host)
        except OpnsenseAPIError:
            unreachable.append(host.name)
    if len(per_host) < 2:
        return [], sorted(per_host), sorted(unreachable)
    return compare(per_host), sorted(per_host), sorted(unreachable)
@@ -14,7 +14,7 @@ from app.models.one_to_one_deployment import OneToOneDeployment
 from app.models.outbound_nat_deployment import OutboundNatDeployment
 from app.models.port_forward_deployment import PortForwardDeployment
 from app.models.rule_deployment import RuleDeployment
-from app.services import nat_drift_service, rule_drift_service
+from app.services import nat_drift_service, network_drift_service, rule_drift_service
 from app.services.notification_dedup import Problems
 from app.services.host_status_service import get_statuses
 from app.services.live_certificates_service import get_live_certificates
@@ -148,6 +148,40 @@ async def check_nat_drift(db: AsyncSession) -> dict[str, dict]:
    return problems
 _NETWORK_LABELS = {
    "interfaces": "Schnittstelle", "vlans": "VLAN", "vips": "Virtuelle IP", "gateways": "Gateway", "routes": "Route",
    "dns_hosts": "DNS-Eintrag", "dhcp_hosts": "DHCP-Host", "kea_subnets": "DHCP-Subnetz", "kea_reservations": "DHCP-Reservierung",
 }
 async def check_network_drift(db: AsyncSession) -> dict[str, dict]:
    hosts = await _enabled_hosts(db)
    by_cluster: dict[str, list[OpnsenseHost]] = defaultdict(list)
    for host in hosts:
        if host.cluster_name:
            by_cluster[host.cluster_name].append(host)
    problems = Problems()
    for cluster_name, cluster_hosts in by_cluster.items():
        if len(cluster_hosts) < 2:
            continue
        differences, compared, _unreachable = await network_drift_service.compute_cluster(cluster_hosts)
        if len(compared) < 2:
            # Not evaluable right now (a node is down, which check_host_offline reports): keep what is open.
            problems.preserve_prefixes.add(f"{cluster_name}:")
            continue
        for row in differences:
            key = f"{cluster_name}:{row['category']}:{row['key']}"
            problems[key] = {
                "cluster_name": cluster_name,
                "object": f"{_NETWORK_LABELS.get(row['category'], row['category'])} {row['key']}",
                "status": "fehlt auf einem Knoten" if row["status"] == "missing" else "Einstellungen weichen ab",
                "present_on": row["present_on"],
                "missing_from": row["missing_from"],
            }
    return problems
 async def check_revert_failed(db: AsyncSession) -> dict[str, dict]:
    problems: dict[str, dict] = {}
    for deployment_type, model, id_attr in _DEPLOYMENT_MODELS:
@@ -31,6 +31,7 @@ _LABELS = {
    "maintenance_unknown": "Wartungsergebnis unklar",
    "carp_split_brain": "CARP-Zustand kritisch",
    "nat_drift": "NAT-Drift im Cluster",
    "network_drift": "Netzwerk-Abweichung im Cluster",
    "carp_auto_revert_failed": "CARP-Auto-Revert fehlgeschlagen",
 }
@@ -28,6 +28,7 @@ _CHECKS = [
    ("maintenance_unknown", "maintenance_unknown_enabled", notification_checks.check_maintenance_unknown),
    ("carp_split_brain", "carp_health_enabled", notification_checks.check_carp_health),
    ("nat_drift", "nat_drift_enabled", notification_checks.check_nat_drift),
    ("network_drift", "network_drift_enabled", notification_checks.check_network_drift),
    ("carp_auto_revert_failed", "carp_auto_revert_failed_enabled", notification_checks.check_carp_auto_revert_failed),
 ]
@@ -25,7 +25,7 @@ async def update_settings(db: AsyncSession, payload: NotificationSettingsUpdate)
        "smtp_from_address", "smtp_to_addresses",
        "host_offline_enabled", "cert_expiring_enabled", "rule_drift_enabled",
        "revert_failed_enabled", "maintenance_unknown_enabled", "carp_health_enabled", "nat_drift_enabled",
-        "carp_auto_revert_failed_enabled",
+        "network_drift_enabled", "carp_auto_revert_failed_enabled",
        "poll_interval_seconds",
    ]
    for field in simple_fields:
@@ -1101,6 +1101,34 @@ NETWORK_ITEM_APIS = {
    "kea_subnet": {"body_key": "subnet4", "base": "/kea/dhcpv4", "add": "addSubnet", "set": "setSubnet",
                   "del": "delSubnet", "get": "getSubnet", "search": "searchSubnet",
                   "reconfigure": "/kea/service/reconfigure"},
    # System / interface devices / DNS+DHCP extras (same controllers pattern; read 2026-10-09).
    "tunable": {"body_key": "sysctl", "base": "/core/tunables", "add": "addItem", "set": "setItem", "del": "delItem",
                "get": "getItem", "search": "searchItem", "reconfigure": "/core/tunables/reconfigure"},
    "cron_job": {"body_key": "job", "base": "/cron/settings", "add": "addJob", "set": "setJob", "del": "delJob",
                 "get": "getJob", "search": "searchJobs", "reconfigure": "/cron/service/reconfigure"},
    "syslog_destination": {"body_key": "destination", "base": "/syslog/settings", "add": "addDestination",
                           "set": "setDestination", "del": "delDestination", "get": "getDestination",
                           "search": "searchDestinations", "reconfigure": "/syslog/service/reconfigure"},
    "gateway_group": {"body_key": "gateway_group", "base": "/routing/group_settings", "add": "add", "set": "set",
                      "del": "del", "get": "get", "search": "search", "reconfigure": "/routing/group_settings/reconfigure"},
    "lagg": {"body_key": "lagg", "base": "/interfaces/lagg_settings", "add": "addItem", "set": "setItem",
             "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/lagg_settings/reconfigure"},
    "bridge": {"body_key": "bridge", "base": "/interfaces/bridge_settings", "add": "addItem", "set": "setItem",
               "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/bridge_settings/reconfigure"},
    "loopback": {"body_key": "loopback", "base": "/interfaces/loopback_settings", "add": "addItem", "set": "setItem",
                 "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/loopback_settings/reconfigure"},
    "gre": {"body_key": "gre", "base": "/interfaces/gre_settings", "add": "addItem", "set": "setItem",
            "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/gre_settings/reconfigure"},
    "vxlan": {"body_key": "vxlan", "base": "/interfaces/vxlan_settings", "add": "addItem", "set": "setItem",
              "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/vxlan_settings/reconfigure"},
    "gif": {"body_key": "gif", "base": "/interfaces/gif_settings", "add": "addItem", "set": "setItem",
            "del": "delItem", "get": "getItem", "search": "searchItem", "reconfigure": "/interfaces/gif_settings/reconfigure"},
    "dns_forward": {"body_key": "dot", "base": "/unbound/settings", "add": "addForward", "set": "setForward",
                    "del": "delForward", "get": "getForward", "search": "searchForward",
                    "reconfigure": "/unbound/service/reconfigure"},
    "dhcp_range": {"body_key": "range", "base": "/dnsmasq/settings", "add": "addRange", "set": "setRange",
                   "del": "delRange", "get": "getRange", "search": "searchRange",
                   "reconfigure": "/dnsmasq/service/reconfigure"},
    "kea_reservation": {"body_key": "reservation", "base": "/kea/dhcpv4", "add": "addReservation",
                        "set": "setReservation", "del": "delReservation", "get": "getReservation",
                        "search": "searchReservation", "reconfigure": "/kea/service/reconfigure"},
@@ -1178,3 +1206,82 @@ async def search_kea_subnets(host: OpnsenseHost) -> dict:
 async def search_kea_reservations(host: OpnsenseHost) -> dict:
    return await _search_all(host, "/kea/dhcpv4/searchReservation")
 async def search_network_objects(host: OpnsenseHost, kind: str) -> list[dict]:
    api = NETWORK_ITEM_APIS[kind]
    data = await _request(host, "GET", f"{api['base']}/{api['search']}", params={"rowCount": -1})
    rows = data.get("rows", []) if isinstance(data, dict) else []
    return [r for r in rows if isinstance(r, dict)]
 # ── ZFS snapshots (Core/Api/SnapshotsController, read 2026-10-09) ────────
 # Not a config object: flat form fields instead of {body_key: {...}}, no reconfigure, and the answers are
 # free-form ("OK" strings / {"status": ...}), so callers confirm by listing again.
 async def list_snapshots(host: OpnsenseHost) -> list[dict]:
    data = await _request(host, "GET", "/core/snapshots/search", params={"rowCount": -1})
    rows = data.get("rows", []) if isinstance(data, dict) else []
    return [r for r in rows if isinstance(r, dict)]
 async def create_snapshot(host: OpnsenseHost, name: str, note: str = "") -> None:
    data = await _request(host, "POST", "/core/snapshots/add", json={"name": name, "note": note})
    if isinstance(data, dict) and (data.get("validations") or str(data.get("status", "")).lower() == "failed"):
        raise OpnsenseAPIError(f"Snapshot anlegen von Firewall nicht bestätigt: {redact_data(data)}")
 async def delete_snapshot(host: OpnsenseHost, uuid: str) -> None:
    data = await _request(host, "POST", f"/core/snapshots/del/{uuid}")
    if isinstance(data, dict) and (data.get("validations") or str(data.get("status", "")).lower() == "failed"):
        raise OpnsenseAPIError(f"Snapshot löschen von Firewall nicht bestätigt: {redact_data(data)}")
 # ── Diagnostics (Diagnostics/Api/{Ping,Traceroute,Portprobe,DnsDiagnostics}Controller, read + live 2026-10-09) ──
 # Traceroute/portprobe/DNS answer synchronously to the same "set" call that validates the form:
 #   {"result": "ok", "response": {...}} or {"result": "failed", "validations": {"<model>.settings.<field>": "..."}}.
 # Ping is a job: set (returns a uuid) -> start -> searchJobs shows live counters -> stop -> remove.
 # A probe to a closed/blackholed port takes the firewall 10 s, so these calls need a longer timeout.
 DIAGNOSTIC_TIMEOUT = 40.0
 async def diagnostic_set(host: OpnsenseHost, path: str, model: str, settings: dict) -> dict:
    data = await _request(host, "POST", path, json={model: {"settings": settings}}, timeout=DIAGNOSTIC_TIMEOUT)
    if not isinstance(data, dict):
        raise OpnsenseAPIError("Diagnose: keine auswertbare Antwort der Firewall")
    if data.get("result") != "ok":
        raise OpnsenseDiagnosticRejected(data.get("validations") or {})
    return data
 class OpnsenseDiagnosticRejected(OpnsenseAPIError):
    """The firewall refused the input (its own validation); carries {field: message}."""
    def __init__(self, validations: dict):
        super().__init__("Eingabe von der Firewall abgelehnt")
        self.validations = validations
 async def ping_job_start(host: OpnsenseHost, settings: dict) -> str:
    data = await diagnostic_set(host, "/diagnostics/ping/set", "ping", settings)
    job = data.get("uuid")
    if not job:
        raise OpnsenseAPIError("Ping: die Firewall hat keine Job-ID geliefert")
    started = await _request(host, "POST", f"/diagnostics/ping/start/{job}", timeout=DIAGNOSTIC_TIMEOUT)
    if not isinstance(started, dict) or started.get("status") != "ok":
        await ping_job_remove(host, job)
        raise OpnsenseAPIError("Ping: der Job konnte nicht gestartet werden")
    return job
 async def ping_job_state(host: OpnsenseHost, job: str) -> dict | None:
    data = await _request(host, "GET", "/diagnostics/ping/searchJobs", params={"rowCount": -1})
    rows = data.get("rows", []) if isinstance(data, dict) else []
    return next((r for r in rows if isinstance(r, dict) and r.get("id") == job), None)
 async def ping_job_stop(host: OpnsenseHost, job: str) -> None:
    await _request(host, "POST", f"/diagnostics/ping/stop/{job}")
 async def ping_job_remove(host: OpnsenseHost, job: str) -> None:
    await _request(host, "POST", f"/diagnostics/ping/remove/{job}")
@@ -0,0 +1,73 @@
 """ZFS snapshots (boot environments) of one firewall: list, create, delete.
 Snapshots are a safety net before bigger changes, not a rollback button:
 activating one needs a reboot and discards everything since, so that action is
 deliberately NOT offered here. Deleting refuses the active/next-boot snapshot
 (the firewall refuses too; we say so up front). Every step is audited.
 """
 import re
 from app.errors import ErrorCode, api_error
 from app.models.host import OpnsenseHost
 from app.services import audit_service, opnsense_client
 from app.services.opnsense_client import OpnsenseAPIError
 NAME = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$")
 def _row(row: dict) -> dict:
    return {
        "uuid": str(row.get("uuid", "")), "name": str(row.get("name", "")), "active": str(row.get("active", "")),
        "size": str(row.get("size", "")), "created": str(row.get("created_str", "")),
        "mountpoint": str(row.get("mountpoint", "")),
    }
 async def list_snapshots(host: OpnsenseHost) -> dict:
    try:
        supported = (await opnsense_client._request(host, "GET", "/core/snapshots/isSupported")).get("supported")
    except OpnsenseAPIError as exc:
        if "404" in str(exc):
            return {"supported": False, "rows": []}
        raise
    if not supported:
        return {"supported": False, "rows": []}
    return {"supported": True, "rows": [_row(r) for r in await opnsense_client.list_snapshots(host)]}
 async def create(host: OpnsenseHost, name: str, note: str) -> dict:
    if not NAME.match(name):
        raise api_error(422, ErrorCode.NETWORK_FIELD_INVALID, field="name")
    audit = {"kind": "snapshot", "action": "snapshot.add", "entity_name": name, "host_id": str(host.id), "host_name": host.name}
    await audit_service.persist(**audit, status="started", message=None, details={"note": note[:200]})
    try:
        await opnsense_client.create_snapshot(host, name, note[:200])
        created = next((r for r in await opnsense_client.list_snapshots(host) if r.get("name") == name), None)
    except OpnsenseAPIError as exc:
        await audit_service.persist(**audit, status="rejected", message=str(exc)[:500], details={})
        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)[:300]) from exc
    await audit_service.persist(**audit, status="applied" if created else "unverified", message=None, details={})
    if not created:
        raise api_error(502, ErrorCode.NETWORK_APPLY_UNCERTAIN, host=host.name, backup_id="-")
    return _row(created)
 async def delete(host: OpnsenseHost, uuid: str) -> None:
    rows = await opnsense_client.list_snapshots(host)
    target = next((r for r in rows if str(r.get("uuid")) == uuid), None)
    if target is None:
        raise api_error(404, ErrorCode.NETWORK_ITEM_NOT_FOUND)
    if str(target.get("active", "")).strip() not in ("", "-"):
        # N = active now, R = active after reboot: removing either would break the boot environment.
        raise api_error(409, ErrorCode.NETWORK_CHANGE_BLOCKED, reasons="snapshot_active")
    audit = {"kind": "snapshot", "action": "snapshot.del", "entity_name": str(target.get("name")), "host_id": str(host.id), "host_name": host.name}
    await audit_service.persist(**audit, status="started", message=None, details={})
    try:
        await opnsense_client.delete_snapshot(host, uuid)
        still = any(str(r.get("uuid")) == uuid for r in await opnsense_client.list_snapshots(host))
    except OpnsenseAPIError as exc:
        await audit_service.persist(**audit, status="rejected", message=str(exc)[:500], details={})
        raise api_error(502, ErrorCode.UPSTREAM_REJECTED, reason=str(exc)[:300]) from exc
    await audit_service.persist(**audit, status="unverified" if still else "applied", message=None, details={})
    if still:
        raise api_error(502, ErrorCode.NETWORK_APPLY_UNCERTAIN, host=host.name, backup_id="-")
@@ -0,0 +1,70 @@
 """Client für den optionalen OPNexus-Updater-Container (updater/server.py).
 Das Backend kann selbst nichts am Host ändern und soll das auch nicht können:
 Es fragt den Updater-Dienst nach dem Zustand und reicht eine bereits
 geprüfte Update-/Rollback-Anfrage weiter. Ist der Dienst nicht aktiviert oder
 nicht erreichbar, ist das ein normaler Zustand ("nicht verfügbar"), kein Fehler.
 """
 import logging
 from pathlib import Path
 import httpx
 from app.config import settings
 logger = logging.getLogger(__name__)
 _STATUS_TIMEOUT = 50.0  # der Updater fragt docker ab (bis zu 45 s)
 _ACTION_TIMEOUT = 15.0
 class UpdaterUnavailable(Exception):
    """Updater nicht aktiviert (kein Token) oder nicht erreichbar."""
 class UpdaterRejected(Exception):
    def __init__(self, code: str):
        super().__init__(code)
        self.code = code
 def _token() -> str:
    try:
        token = Path(settings.updater_token_file).read_text(encoding="utf-8").strip()
    except OSError:
        token = ""
    if not token:
        raise UpdaterUnavailable("not_enabled")
    return token
 async def _call(method: str, path: str, payload: dict | None, timeout: float) -> dict:
    headers = {"Authorization": f"Bearer {_token()}"}
    try:
        async with httpx.AsyncClient(timeout=timeout) as http:
            response = await http.request(method, settings.updater_url.rstrip("/") + path, headers=headers, json=payload)
    except httpx.HTTPError as exc:
        logger.info("Updater nicht erreichbar: %s", exc.__class__.__name__)
        raise UpdaterUnavailable("unreachable") from exc
    try:
        body = response.json()
    except ValueError:
        body = {}
    if response.status_code == 401:
        # Token passt nicht (Volume neu angelegt?) — wie "nicht verfügbar" behandeln.
        raise UpdaterUnavailable("unauthorized")
    if response.status_code >= 400:
        raise UpdaterRejected(str(body.get("error") or "rejected"))
    return body
 async def status() -> dict:
    return await _call("GET", "/status", None, _STATUS_TIMEOUT)
 async def start_update(version: str) -> dict:
    return await _call("POST", "/update", {"version": version}, _ACTION_TIMEOUT)
 async def start_rollback() -> dict:
    return await _call("POST", "/rollback", {}, _ACTION_TIMEOUT)
@@ -6,5 +6,5 @@ convention — but both are bumped together whenever a release ships).
 Versioning scheme: see CHANGELOG.md ("Versionierung").
 """
-APP_VERSION = "1.12.0"
+APP_VERSION = "1.16.0"
-APP_CODENAME = "Condor"
+APP_CODENAME = "Hobby"
@@ -0,0 +1,20 @@
 """Benachrichtigung bei Netzwerk-Abweichungen zwischen den Knoten eines Clusters.
 Revision ID: 0004
 Revises: 0003
 Create Date: 2026-10-09
 """
 from alembic import op
 revision = "0004"
 down_revision = "0003"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.execute("ALTER TABLE notification_settings ADD COLUMN IF NOT EXISTS network_drift_enabled boolean NOT NULL DEFAULT true")
 def downgrade() -> None:
    op.execute("ALTER TABLE notification_settings DROP COLUMN IF EXISTS network_drift_enabled")
@@ -0,0 +1,20 @@
 """Einrichtungsassistent: Merker, dass ein Nutzer ihn abgeschlossen oder übersprungen hat.
 Revision ID: 0005
 Revises: 0004
 Create Date: 2026-10-10
 """
 from alembic import op
 revision = "0005"
 down_revision = "0004"
 branch_labels = None
 depends_on = None
 def upgrade() -> None:
    op.execute("ALTER TABLE user_preferences ADD COLUMN IF NOT EXISTS setup_done boolean NOT NULL DEFAULT false")
 def downgrade() -> None:
    op.execute("ALTER TABLE user_preferences DROP COLUMN IF EXISTS setup_done")
@@ -0,0 +1,143 @@
 """Ping / traceroute / port probe / DNS lookup run from a firewall."""
 import asyncio
 import json
 import httpx
 import pytest
 from sqlalchemy import select
 from app.database import SessionLocal
 from app.models.audit import AuditEvent
 BASE = "https://10.20.30.85"
 async def _host(client, respx_mock, name="fw-diag"):
    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
    return (await client.post("/api/hosts", json={"name": name, "base_url": BASE, "api_key": "k", "api_secret": "s"})).json()["id"]
 def _url(path):
    return f"{BASE}/api{path}"
 async def _events(host_id):
    async with SessionLocal() as db:
        rows = await db.scalars(select(AuditEvent).where(AuditEvent.host_id == host_id, AuditEvent.kind == "diagnostic").order_by(AuditEvent.created_at))
        return list(rows.all())
@pytest.fixture
 def fast_sleep(monkeypatch):
    async def instant(_seconds):
        return None
    monkeypatch.setattr(asyncio, "sleep", instant)
@pytest.mark.asyncio
 async def test_traceroute_is_parsed_and_audited(client, respx_mock):
    host_id = await _host(client, respx_mock)
    sent = respx_mock.post(_url("/diagnostics/traceroute/set")).mock(return_value=httpx.Response(200, json={
        "result": "ok", "response": {"notice": "traceroute to x", "rows": [
            {"address": "10.0.0.1", "ttl": "1", "AS": "AS0", "host": "gw.lan", "probes": "0.4 ms"}]}}))
    resp = await client.post(f"/api/hosts/{host_id}/diagnostics/traceroute", json={"target": "example.com", "protocol": "icmp"})
    assert resp.status_code == 200, resp.text
    assert resp.json()["hops"] == [{"ttl": "1", "address": "10.0.0.1", "host": "gw.lan", "as": "AS0", "probes": "0.4 ms"}]
    assert json.loads(sent.calls.last.request.content)["traceroute"]["settings"]["hostname"] == "example.com"
    events = await _events(host_id)
    assert [(e.action, e.status, e.entity_name) for e in events] == [("diag.traceroute", "ok", "example.com")]
@pytest.mark.asyncio
 async def test_bad_targets_never_reach_the_firewall(client, respx_mock):
    host_id = await _host(client, respx_mock, "fw-diag2")
    route = respx_mock.post(_url("/diagnostics/traceroute/set")).mock(return_value=httpx.Response(200, json={"result": "ok", "response": {}}))
    for bad in ("a;b", "x y", "$(reboot)", "-h", "a" * 300, "host/../x"):
        resp = await client.post(f"/api/hosts/{host_id}/diagnostics/traceroute", json={"target": bad})
        assert resp.status_code == 422, bad
    assert not route.called
    assert (await client.post(f"/api/hosts/{host_id}/diagnostics/portprobe", json={"target": "x.test", "port": 70000})).status_code == 422
    assert (await client.post(f"/api/hosts/{host_id}/diagnostics/ping", json={"target": "x.test", "count": 500})).status_code == 422
    assert (await client.post(f"/api/hosts/{host_id}/diagnostics/ping", json={"target": "x.test", "source": "not-an-ip"})).status_code == 422
@pytest.mark.asyncio
 async def test_the_firewalls_own_validation_is_reported_as_422_and_audited(client, respx_mock):
    host_id = await _host(client, respx_mock, "fw-diag3")
    respx_mock.post(_url("/diagnostics/dns_diagnostics/set")).mock(return_value=httpx.Response(200, json={
        "result": "failed", "validations": {"dns.settings.server": "Provide a valid server."}}))
    resp = await client.post(f"/api/hosts/{host_id}/diagnostics/dns", json={"name": "example.com", "server": "1.2.3.4"})
    assert resp.status_code == 422 and resp.json()["detail"]["params"]["field"] == "server"
    assert [(e.status) for e in await _events(host_id)] == ["failed"]
@pytest.mark.asyncio
 async def test_portprobe_reports_open_or_closed_and_never_the_banner(client, respx_mock):
    host_id = await _host(client, respx_mock, "fw-diag4")
    answers = iter([
        {"result": "ok", "response": {"message": "Connection to 10.0.0.1 443 port [tcp/https] succeeded!", "payload": "SSH-2.0-SECRET-BANNER"}},
        {"result": "ok", "response": {"message": "nc: connect to 10.0.0.1 port 1 (tcp) failed: Operation timed out", "payload": ""}},
    ])
    respx_mock.post(_url("/diagnostics/portprobe/set")).mock(side_effect=lambda r: httpx.Response(200, json=next(answers)))
    opened = await client.post(f"/api/hosts/{host_id}/diagnostics/portprobe", json={"target": "10.0.0.1", "port": 443})
    closed = await client.post(f"/api/hosts/{host_id}/diagnostics/portprobe", json={"target": "10.0.0.1", "port": 1})
    assert opened.json()["open"] is True and closed.json()["open"] is False
    assert "SECRET-BANNER" not in opened.text
@pytest.mark.asyncio
 async def test_dns_lookup(client, respx_mock):
    host_id = await _host(client, respx_mock, "fw-diag5")
    respx_mock.post(_url("/diagnostics/dns_diagnostics/set")).mock(return_value=httpx.Response(200, json={"result": "ok", "response": {
        "A": {"answers": ["example.com.\t300\tIN\tA\t192.0.2.1"], "query_time": "42 msec", "server": "10.0.0.1"}}}))
    body = (await client.post(f"/api/hosts/{host_id}/diagnostics/dns", json={"name": "example.com"})).json()
    assert body["records"]["A"]["answers"][0].endswith("192.0.2.1") and body["records"]["A"]["query_time"] == "42 msec"
@pytest.mark.asyncio
 async def test_ping_runs_a_job_and_always_cleans_it_up(client, respx_mock, fast_sleep):
    host_id = await _host(client, respx_mock, "fw-diag6")
    respx_mock.post(_url("/diagnostics/ping/set")).mock(return_value=httpx.Response(200, json={"result": "ok", "uuid": "job-1"}))
    start = respx_mock.post(_url("/diagnostics/ping/start/job-1")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
    row = {"id": "job-1", "status": "running", "send": 4, "received": 4, "loss": "0.0%", "min": 0.3, "avg": 0.4, "max": 0.5, "std-dev": 0.05, "last_error": None}
    respx_mock.get(_url("/diagnostics/ping/searchJobs")).mock(return_value=httpx.Response(200, json={"rows": [row]}))
    stop = respx_mock.post(_url("/diagnostics/ping/stop/job-1")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
    remove = respx_mock.post(_url("/diagnostics/ping/remove/job-1")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
    resp = await client.post(f"/api/hosts/{host_id}/diagnostics/ping", json={"target": "10.0.0.1", "count": 4})
    assert resp.status_code == 200, resp.text
    body = resp.json()
    assert (body["sent"], body["received"], body["loss"], body["avg"]) == (4, 4, "0.0%", 0.4)
    assert start.called and stop.called and remove.called
@pytest.mark.asyncio
 async def test_ping_job_is_removed_even_when_polling_fails(client, respx_mock, fast_sleep):
    host_id = await _host(client, respx_mock, "fw-diag7")
    respx_mock.post(_url("/diagnostics/ping/set")).mock(return_value=httpx.Response(200, json={"result": "ok", "uuid": "job-2"}))
    respx_mock.post(_url("/diagnostics/ping/start/job-2")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
    respx_mock.get(_url("/diagnostics/ping/searchJobs")).mock(side_effect=httpx.ConnectError("gone"))
    stop = respx_mock.post(_url("/diagnostics/ping/stop/job-2")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
    remove = respx_mock.post(_url("/diagnostics/ping/remove/job-2")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
    resp = await client.post(f"/api/hosts/{host_id}/diagnostics/ping", json={"target": "10.0.0.1"})
    assert resp.status_code == 502
    assert stop.called and remove.called       # no orphaned job on the firewall
    assert [e.status for e in await _events(host_id)] == ["failed"]
@pytest.mark.asyncio
 async def test_only_admins_can_run_probes(anon_client, client, respx_mock):
    from httpx import ASGITransport, AsyncClient
    from app.main import app
    host_id = await _host(client, respx_mock, "fw-diag8")
    assert (await anon_client.post(f"/api/hosts/{host_id}/diagnostics/dns", json={"name": "example.com"})).status_code == 401
    created = await client.post("/api/users", json={"username": "diag_ro", "password": "Diag-Read-Only-2026", "role": "read_only"})
    assert created.status_code == 201, created.text
    try:
        async with AsyncClient(transport=ASGITransport(app=app), base_url="http://test") as ro:
            assert (await ro.post("/api/auth/login", json={"username": "diag_ro", "password": "Diag-Read-Only-2026"})).status_code == 200
            probe = respx_mock.post(_url("/diagnostics/dns_diagnostics/set")).mock(return_value=httpx.Response(200, json={"result": "ok", "response": {}}))
            for tool, body in (("dns", {"name": "example.com"}), ("ping", {"target": "10.0.0.1"}), ("traceroute", {"target": "10.0.0.1"}), ("portprobe", {"target": "10.0.0.1", "port": 22})):
                assert (await ro.post(f"/api/hosts/{host_id}/diagnostics/{tool}", json=body)).status_code == 403, tool
            assert not probe.called
    finally:
        await client.delete(f"/api/users/{created.json()['id']}")
@@ -496,3 +496,64 @@ async def test_verification_catches_a_field_that_changed_without_being_asked(cli
    plan = (await _preview(client, host_id, **change)).json()
    done = (await _execute(client, host_id, plan["token"], **change)).json()
    assert done["verified"] is False and done["mismatches"] == ["network"]
 # ── generic object kinds ─────────────────────────────────────────────────
@pytest.mark.asyncio
 async def test_objects_list_returns_only_the_display_columns(client, respx_mock):
    host_id = await _setup(client, respx_mock, "fw-o1")
    respx_mock.get(_url("/syslog/settings/searchDestinations")).mock(return_value=httpx.Response(200, json={"rows": [
        {"uuid": "d1", "enabled": "1", "transport": "udp4", "hostname": "192.0.2.10", "port": "514", "program": "", "level": "info",
         "facility": "daemon", "certificate": "SECRET-CERT-REF", "description": "central"}]}))
    body = (await client.get(f"/api/hosts/{host_id}/network/objects/syslog_destination")).json()
    assert body["available"] is True and body["rows"][0]["hostname"] == "192.0.2.10"
    assert "certificate" not in body["rows"][0] and "facility" not in body["rows"][0]
    assert (await client.get(f"/api/hosts/{host_id}/network/objects/vlan")).status_code == 404  # typed kinds have their own lists
@pytest.mark.asyncio
 async def test_objects_list_reports_a_missing_api_instead_of_failing(client, respx_mock):
    host_id = await _setup(client, respx_mock, "fw-o2")
    respx_mock.get(_url("/interfaces/gre_settings/searchItem")).mock(return_value=httpx.Response(404, json={"errorMessage": "Endpoint not found"}))
    body = (await client.get(f"/api/hosts/{host_id}/network/objects/gre")).json()
    assert body == {"available": False, "columns": body["columns"], "rows": []}
@pytest.mark.asyncio
 async def test_tunables_always_need_acknowledgement_and_defaults_cannot_be_edited(client, respx_mock):
    host_id = await _setup(client, respx_mock, "fw-o3")
    add = (await _preview(client, host_id, kind="tunable", action="add", fields={"tunable": "vfs.read_max", "value": "128"})).json()
    assert [r["code"] for r in add["risks"]] == ["tunable_change"] and add["requires_acknowledgement"] is True
    _item(respx_mock, "/core/tunables/getItem/0add3c58db981d0d24d5d4ab322e3695", "sysctl",
          {"tunable": "net.inet.tcp.drop_synfin", "value": "1", "descr": "built in"})
    default = (await _preview(client, host_id, kind="tunable", action="set", uuid="0add3c58db981d0d24d5d4ab322e3695", fields={"value": "0"})).json()
    assert [b["code"] for b in default["blocks"]] == ["tunable_default_row"] and default["can_execute"] is False
@pytest.mark.asyncio
 async def test_lagg_or_bridge_containing_the_management_device_needs_acknowledgement(client, respx_mock):
    host_id = await _setup(client, respx_mock, "fw-o4")   # reached on vtnet0
    mine = (await _preview(client, host_id, kind="lagg", action="add", fields={"members": "vtnet0,vtnet2", "proto": "failover"})).json()
    assert [r["code"] for r in mine["risks"]] == ["management_member"]
    other = (await _preview(client, host_id, kind="lagg", action="add", fields={"members": "vtnet2,vtnet3", "proto": "failover"})).json()
    assert other["risks"] == []
@pytest.mark.asyncio
 async def test_vxlan_and_gif_are_listed_and_changed_like_the_other_devices(client, respx_mock):
    host_id = await _setup(client, respx_mock, "fw-o5")
    respx_mock.get(_url("/interfaces/vxlan_settings/searchItem")).mock(return_value=httpx.Response(200, json={"rows": [
        {"uuid": "x1", "vxlanif": "vxlan1", "vxlanid": "100", "vxlanlocal": "10.20.30.57", "vxlanremote": "10.20.30.58",
         "vxlangroup": "", "vxlandev": "lan", "secret_like": "dropped"}]}))
    body = (await client.get(f"/api/hosts/{host_id}/network/objects/vxlan")).json()
    assert body["rows"][0]["vxlanid"] == "100" and "secret_like" not in body["rows"][0]
    _backup(respx_mock)
    add = respx_mock.post(_url("/interfaces/gif_settings/addItem")).mock(return_value=httpx.Response(200, json={"result": "saved", "uuid": "g1"}))
    respx_mock.post(_url("/interfaces/gif_settings/reconfigure")).mock(return_value=httpx.Response(200, json={"status": "ok"}))
    _item(respx_mock, "/interfaces/gif_settings/getItem/g1", "gif", {"local-addr": "10.20.30.57", "remote-addr": "198.51.100.9", "descr": "t"})
    change = {"kind": "gif", "action": "add", "fields": {"local-addr": "10.20.30.57", "remote-addr": "198.51.100.9", "descr": "t"}}
    plan = (await _preview(client, host_id, **change)).json()
    done = await _execute(client, host_id, plan["token"], **change)
    assert done.status_code == 200 and done.json()["verified"] is True, done.text
    assert _body(add.calls.last) == {"gif": change["fields"]}
@@ -0,0 +1,94 @@
 """Network configuration differences between the nodes of an HA cluster."""
 import httpx
 import pytest
 from app.database import SessionLocal
 from app.schemas.network import HostNetwork
 from app.services import network_drift_service, notification_checks
 from tests.test_network import DHCP_HOSTS, DNS_HOSTS, GATEWAYS, INTERFACES_INFO, KEA_RESERVATIONS, KEA_SUBNETS, ROUTES, VIPS, VLANS, ASSIGNMENTS
 ENDPOINTS = {
    "/interfaces/overview/interfacesInfo": INTERFACES_INFO, "/interfaces/assignment/searchItem": ASSIGNMENTS,
    "/interfaces/vlan_settings/searchItem": VLANS, "/interfaces/vip_settings/searchItem": VIPS,
    "/routing/settings/searchGateway": GATEWAYS, "/routes/routes/searchroute": ROUTES,
    "/unbound/settings/searchHostOverride": DNS_HOSTS, "/dnsmasq/settings/searchHost": DHCP_HOSTS,
    "/kea/dhcpv4/searchSubnet": KEA_SUBNETS, "/kea/dhcpv4/searchReservation": KEA_RESERVATIONS,
 }
 async def _host(client, name, base, cluster="ha"):
    r = await client.post("/api/hosts", json={"name": name, "base_url": base, "api_key": "k", "api_secret": "s",
                                              "verify_tls": False, "cluster_name": cluster})
    assert r.status_code == 201, r.text
 def _serve(respx_mock, base, **replace):
    for path, body in ENDPOINTS.items():
        respx_mock.get(f"{base}/api{path}").mock(return_value=httpx.Response(200, json=replace.get(path, body)))
 def _net(**replace) -> HostNetwork:
    data = {
        "host_id": "x", "host_name": "x", "interfaces": [], "vlans": [], "vips": [], "gateways": [], "routes": [],
        "management_device": None, "can_configure_interfaces": True, "unavailable": [],
    }
    data.update(replace)
    return HostNetwork(**data)
 def test_identical_configuration_has_no_differences_even_with_per_node_values():
    vip_a = {"uuid": "1", "interface": "lan", "interface_label": "LAN", "mode": "carp", "address": "192.168.1.1/24",
             "vhid": "10", "advbase": "1", "advskew": "0", "description": "x"}
    vip_b = {**vip_a, "uuid": "2", "advskew": "100"}   # advskew legitimately differs between master and backup
    a, b = _net(vips=[vip_a]), _net(vips=[vip_b])
    assert network_drift_service.compare({"a": a, "b": b}) == []
 def test_missing_and_different_objects_are_reported_with_who_has_what():
    vlan = {"uuid": "1", "parent": "vtnet1", "tag": "10", "pcp": "0", "description": "LAN", "device": "vtnet1_vlan10"}
    gw_a = {"uuid": "g", "name": "WAN_GW", "description": "", "interface": "wan", "interface_label": "WAN", "ip_protocol": "inet",
            "address": "10.0.0.1", "is_default": True, "disabled": False, "priority": "255", "status": "Online"}
    a = _net(vlans=[vlan, {**vlan, "uuid": "2", "tag": "20"}], gateways=[gw_a])
    b = _net(vlans=[vlan], gateways=[{**gw_a, "address": "10.0.0.9"}])
    rows = {(r["category"], r["key"]): r for r in network_drift_service.compare({"a": a, "b": b})}
    assert rows[("vlans", "20@vtnet1")]["status"] == "missing" and rows[("vlans", "20@vtnet1")]["missing_from"] == ["b"]
    assert rows[("gateways", "WAN_GW")]["status"] == "different"
    assert rows[("gateways", "WAN_GW")]["signatures"]["a"] != rows[("gateways", "WAN_GW")]["signatures"]["b"]
    assert ("vlans", "10@vtnet1") not in rows
 def test_a_category_one_node_cannot_deliver_is_not_reported_as_a_difference():
    vlan = {"uuid": "1", "parent": "vtnet1", "tag": "10", "pcp": "0", "description": "", "device": "d"}
    a, b = _net(vlans=[vlan]), _net(vlans=[], unavailable=["vlans"])
    assert network_drift_service.compare({"a": a, "b": b}) == []
@pytest.mark.asyncio
 async def test_endpoint_and_alert_report_a_route_missing_on_one_node(client, respx_mock):
    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
    await _host(client, "fw-da", "https://10.20.30.91")
    await _host(client, "fw-db", "https://10.20.30.92")
    _serve(respx_mock, "https://10.20.30.91")
    _serve(respx_mock, "https://10.20.30.92", **{"/routes/routes/searchroute": {"rows": []}})
    body = (await client.get("/api/network/drift")).json()
    cluster = next(c for c in body["clusters"] if c["name"] == "ha")
    assert cluster["unreachable"] == []
    diff = [d for d in cluster["differences"] if d["category"] == "routes"]
    assert [(d["key"], d["status"], d["missing_from"]) for d in diff] == [("10.9.0.0/16", "missing", ["fw-db"])]
    async with SessionLocal() as db:
        problems = await notification_checks.check_network_drift(db)
    mine = [v for k, v in problems.items() if k.startswith("ha:routes:")]
    assert mine and mine[0]["missing_from"] == ["fw-db"] and "Route" in mine[0]["object"]
@pytest.mark.asyncio
 async def test_an_unreachable_node_keeps_open_alerts_instead_of_resolving_them(client, respx_mock):
    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
    await _host(client, "fw-dc", "https://10.20.30.93", cluster="ha2")
    await _host(client, "fw-dd", "https://10.20.30.94", cluster="ha2")
    _serve(respx_mock, "https://10.20.30.93")
    respx_mock.get(url__regex=r"https://10\.20\.30\.94/.*").mock(side_effect=httpx.ConnectError("down"))
    async with SessionLocal() as db:
        problems = await notification_checks.check_network_drift(db)
    assert "ha2:" in problems.preserve_prefixes
@@ -0,0 +1,66 @@
 """First-run setup assistant: per-user "done" flag and the password reset tool."""
 import pytest
 from sqlalchemy import select
 from app import reset_password
 from app.config import settings
 from app.database import SessionLocal
 from app.models.user import AdminUser, Session
 from app.services import auth_service
@pytest.mark.asyncio
 async def test_setup_done_defaults_to_false_and_persists(client):
    assert (await client.get("/api/settings")).json()["setup_done"] is False
    resp = await client.put("/api/settings", json={"setup_done": True})
    assert resp.status_code == 200
    assert resp.json()["setup_done"] is True
    assert (await client.get("/api/settings")).json()["setup_done"] is True
@pytest.mark.asyncio
 async def test_other_preference_changes_keep_setup_done(client):
    await client.put("/api/settings", json={"setup_done": True})
    resp = await client.put("/api/settings", json={"theme": "dark", "language": "en"})
    body = resp.json()
    assert (body["theme"], body["language"], body["setup_done"]) == ("dark", "en", True)
    # ...and the other direction: saving setup_done leaves theme/language alone.
    resp = await client.put("/api/settings", json={"setup_done": False})
    body = resp.json()
    assert (body["theme"], body["language"], body["setup_done"]) == ("dark", "en", False)
@pytest.mark.asyncio
 async def test_setup_done_rejects_non_boolean(client):
    assert (await client.put("/api/settings", json={"setup_done": "maybe"})).status_code == 422
@pytest.mark.asyncio
 async def test_reset_password_prints_new_password_and_ends_sessions(client, capsys):
    async with SessionLocal() as db:
        before = (await db.execute(select(Session))).scalars().all()
        assert before, "the client fixture logged in, so a session must exist"
    assert await reset_password.main(None) == 0
    out = capsys.readouterr().out
    lines = dict(line.split(": ", 1) for line in out.strip().splitlines())
    assert lines["Username"] == settings.admin_username
    new_password = lines["Password"]
    assert len(new_password) >= 20 and new_password != settings.admin_password
    async with SessionLocal() as db:
        assert (await db.execute(select(Session))).scalars().all() == []
        user = (await db.execute(select(AdminUser).where(AdminUser.username == settings.admin_username))).scalar_one()
        assert await auth_service.verify_password_async(user.password_hash, new_password)
        assert not await auth_service.verify_password_async(user.password_hash, settings.admin_password)
        # Put the shared bootstrap admin back for the tests that follow.
        user.password_hash = await auth_service.hash_password_async(settings.admin_password)
        await db.commit()
@pytest.mark.asyncio
 async def test_reset_password_unknown_user_fails(capsys):
    assert await reset_password.main("does-not-exist") == 1
    assert "No such user" in capsys.readouterr().err
@@ -0,0 +1,69 @@
 """ZFS snapshots: list, create, delete (never the active one)."""
 import httpx
 import pytest
 BASE = "https://10.20.30.80"
 async def _host(client, respx_mock, name="fw-snap"):
    respx_mock.get(url__regex=r".*/getVipStatus").mock(return_value=httpx.Response(200, json={"rows": []}))
    return (await client.post("/api/hosts", json={"name": name, "base_url": BASE, "api_key": "k", "api_secret": "s"})).json()["id"]
 def _snaps(respx_mock, rows):
    respx_mock.get(f"{BASE}/api/core/snapshots/isSupported").mock(return_value=httpx.Response(200, json={"supported": True}))
    return respx_mock.get(f"{BASE}/api/core/snapshots/search").mock(return_value=httpx.Response(200, json={"rows": rows}))
 ROW = {"uuid": "s1", "name": "default", "active": "NR", "mountpoint": "/", "size": "1.2G", "created_str": "2026-10-06 13:59"}
@pytest.mark.asyncio
 async def test_list_snapshots(client, respx_mock):
    host_id = await _host(client, respx_mock)
    _snaps(respx_mock, [ROW])
    body = (await client.get(f"/api/hosts/{host_id}/snapshots")).json()
    assert body["supported"] is True and body["rows"][0]["name"] == "default" and body["rows"][0]["active"] == "NR"
@pytest.mark.asyncio
 async def test_unsupported_firewall_is_reported(client, respx_mock):
    host_id = await _host(client, respx_mock, "fw-nozfs")
    respx_mock.get(f"{BASE}/api/core/snapshots/isSupported").mock(return_value=httpx.Response(200, json={"supported": False}))
    assert (await client.get(f"/api/hosts/{host_id}/snapshots")).json() == {"supported": False, "rows": []}
@pytest.mark.asyncio
 async def test_create_is_confirmed_by_listing_again(client, respx_mock):
    host_id = await _host(client, respx_mock, "fw-snap2")
    new = {"uuid": "s2", "name": "before_change", "active": "-", "mountpoint": "-", "size": "0", "created_str": "now"}
    respx_mock.get(f"{BASE}/api/core/snapshots/search").mock(return_value=httpx.Response(200, json={"rows": [ROW, new]}))
    post = respx_mock.post(f"{BASE}/api/core/snapshots/add").mock(return_value=httpx.Response(200, json="OK"))
    resp = await client.post(f"/api/hosts/{host_id}/snapshots", json={"name": "before_change", "note": "x"})
    assert resp.status_code == 201, resp.text
    assert resp.json()["uuid"] == "s2" and post.called
@pytest.mark.asyncio
 async def test_create_rejects_bad_names_and_reports_a_snapshot_that_never_appeared(client, respx_mock):
    host_id = await _host(client, respx_mock, "fw-snap3")
    assert (await client.post(f"/api/hosts/{host_id}/snapshots", json={"name": "bad name!"})).status_code == 422
    respx_mock.get(f"{BASE}/api/core/snapshots/search").mock(return_value=httpx.Response(200, json={"rows": [ROW]}))
    respx_mock.post(f"{BASE}/api/core/snapshots/add").mock(return_value=httpx.Response(200, json="OK"))
    assert (await client.post(f"/api/hosts/{host_id}/snapshots", json={"name": "ghost"})).status_code == 502
@pytest.mark.asyncio
 async def test_active_snapshot_cannot_be_deleted_others_can(client, respx_mock):
    host_id = await _host(client, respx_mock, "fw-snap4")
    old = {"uuid": "s3", "name": "old", "active": "-", "mountpoint": "-", "size": "1M", "created_str": "x"}
    state = {"rows": [ROW, old]}
    respx_mock.get(f"{BASE}/api/core/snapshots/search").mock(side_effect=lambda r: httpx.Response(200, json=state))
    def drop(request):
        state["rows"] = [ROW]
        return httpx.Response(200, json={"status": "ok"})
    delete = respx_mock.post(f"{BASE}/api/core/snapshots/del/s3").mock(side_effect=drop)
    blocked = await client.delete(f"/api/hosts/{host_id}/snapshots/s1")
    assert blocked.status_code == 409 and blocked.json()["detail"]["params"]["reasons"] == "snapshot_active"
    assert (await client.delete(f"/api/hosts/{host_id}/snapshots/s3")).status_code == 204 and delete.called
    assert (await client.delete(f"/api/hosts/{host_id}/snapshots/nope")).status_code == 404
@@ -0,0 +1,176 @@
 import httpx
 import pytest
 from tests.test_users import _login_as
 from app.config import settings
 from app.services import update_check_service
 from app.version import APP_VERSION
 FEED = "https://feed.test/api/v1/repos/o/r/releases/latest"
 UPDATER = "http://updater.test:8080"
 def _bump(minor=0, patch=0, major=0):
    a, b, c = (int(x) for x in APP_VERSION.split("."))
    return f"{a + major}.{b + minor}.{c + patch}"
@pytest.fixture(autouse=True)
 def _setup(monkeypatch, tmp_path):
    token = tmp_path / "token"
    token.write_text("t" * 40)
    monkeypatch.setattr(settings, "update_check_url", FEED)
    monkeypatch.setattr(settings, "updater_url", UPDATER)
    monkeypatch.setattr(settings, "updater_token_file", str(token))
    update_check_service.reset_cache()
    yield
    update_check_service.reset_cache()
 def _feed(respx_mock, version):
    respx_mock.get(FEED).mock(return_value=httpx.Response(200, json={"tag_name": f"v{version}"}))
 def _updater_status(respx_mock, **over):
    body = {"mode": "release", "running_version": APP_VERSION, "job": None, "phases": [], "log": [],
            "services": {"backend": "healthy"}, "rollback_available": False, "rollback_loses_data": False,
            "last_update": None}
    body.update(over)
    return respx_mock.get(f"{UPDATER}/status").mock(return_value=httpx.Response(200, json=body))
@pytest.mark.asyncio
 async def test_status_reports_update_and_can_update(client, respx_mock):
    _feed(respx_mock, _bump(minor=1))
    _updater_status(respx_mock)
    body = (await client.get("/api/system/updater")).json()
    assert body["available"] is True and body["can_update"] is True
    assert body["latest"] == _bump(minor=1) and body["major_change"] is False
@pytest.mark.asyncio
 async def test_status_without_token_is_unavailable_not_an_error(client, respx_mock, monkeypatch, tmp_path):
    monkeypatch.setattr(settings, "updater_token_file", str(tmp_path / "missing"))
    _feed(respx_mock, _bump(minor=1))
    body = (await client.get("/api/system/updater")).json()
    assert body["available"] is False and body["reason"] == "not_enabled" and body["can_update"] is False
    assert body["update_available"] is True  # der Hinweis bleibt trotzdem
@pytest.mark.asyncio
 async def test_status_unreachable_updater(client, respx_mock):
    _feed(respx_mock, _bump(minor=1))
    respx_mock.get(f"{UPDATER}/status").mock(side_effect=httpx.ConnectError("down"))
    body = (await client.get("/api/system/updater")).json()
    assert body["available"] is False and body["reason"] == "unreachable"
@pytest.mark.asyncio
 async def test_major_change_is_not_offered_for_one_click(client, respx_mock):
    _feed(respx_mock, _bump(major=1))
    _updater_status(respx_mock)
    body = (await client.get("/api/system/updater")).json()
    assert body["major_change"] is True and body["can_update"] is False
    resp = await client.post("/api/system/updater/update", json={"version": _bump(major=1)})
    assert resp.status_code == 409 and resp.json()["detail"]["code"] == "UPDATE_MAJOR_CHANGE"
@pytest.mark.asyncio
 async def test_local_build_install_cannot_update(client, respx_mock):
    _feed(respx_mock, _bump(minor=1))
    _updater_status(respx_mock, mode="local")
    body = (await client.get("/api/system/updater")).json()
    assert body["can_update"] is False and body["mode"] == "local"
@pytest.mark.asyncio
 async def test_update_forwards_only_the_feed_version(client, respx_mock):
    newer = _bump(patch=1)
    _feed(respx_mock, newer)
    route = respx_mock.post(f"{UPDATER}/update").mock(return_value=httpx.Response(202, json={"job": {"id": "x"}}))
    resp = await client.post("/api/system/updater/update", json={"version": newer})
    assert resp.status_code == 202
    sent = route.calls.last.request
    assert sent.headers["authorization"] == "Bearer " + "t" * 40
    assert b'"version": "%s"' % newer.encode() in sent.content or newer.encode() in sent.content
@pytest.mark.asyncio
@pytest.mark.parametrize("version", ["0.0.1", "99.99.99", "1.0.0-rc1", "latest", "../../x"])
 async def test_update_rejects_any_other_version(client, respx_mock, version):
    _feed(respx_mock, _bump(patch=1))
    route = respx_mock.post(f"{UPDATER}/update").mock(return_value=httpx.Response(202, json={}))
    resp = await client.post("/api/system/updater/update", json={"version": version})
    assert resp.status_code in (409, 422)
    assert route.call_count == 0
@pytest.mark.asyncio
 async def test_update_when_no_update_available(client, respx_mock):
    _feed(respx_mock, APP_VERSION)
    resp = await client.post("/api/system/updater/update", json={"version": APP_VERSION})
    assert resp.status_code == 409 and resp.json()["detail"]["code"] == "UPDATE_NOT_OFFERED"
@pytest.mark.asyncio
 async def test_busy_and_rejected_map_to_error_codes(client, respx_mock):
    newer = _bump(patch=1)
    _feed(respx_mock, newer)
    route = respx_mock.post(f"{UPDATER}/update")
    route.mock(return_value=httpx.Response(409, json={"error": "busy"}))
    resp = await client.post("/api/system/updater/update", json={"version": newer})
    assert resp.json()["detail"]["code"] == "UPDATER_BUSY"
    route.mock(return_value=httpx.Response(409, json={"error": "not_release_mode"}))
    resp = await client.post("/api/system/updater/update", json={"version": newer})
    assert resp.json()["detail"] == {"code": "UPDATER_REJECTED", "params": {"reason": "not_release_mode"}}
@pytest.mark.asyncio
 async def test_update_without_updater_is_503(client, respx_mock, monkeypatch, tmp_path):
    monkeypatch.setattr(settings, "updater_token_file", str(tmp_path / "missing"))
    newer = _bump(patch=1)
    _feed(respx_mock, newer)
    resp = await client.post("/api/system/updater/update", json={"version": newer})
    assert resp.status_code == 503 and resp.json()["detail"]["code"] == "UPDATER_UNAVAILABLE"
@pytest.mark.asyncio
 async def test_rollback_is_forwarded(client, respx_mock):
    route = respx_mock.post(f"{UPDATER}/rollback").mock(return_value=httpx.Response(202, json={"job": {"id": "r"}}))
    resp = await client.post("/api/system/updater/rollback")
    assert resp.status_code == 202 and route.call_count == 1
@pytest.mark.asyncio
 async def test_read_only_user_cannot_read_or_start_updates(client, respx_mock):
    newer = _bump(patch=1)
    _feed(respx_mock, newer)
    status = _updater_status(respx_mock)
    route = respx_mock.post(f"{UPDATER}/update").mock(return_value=httpx.Response(202, json={}))
    await client.post("/api/users", json={"username": "viewer-upd", "password": "password-123456", "role": "read_only"})
    viewer = await _login_as("viewer-upd", "password-123456")
    try:
        assert (await viewer.get("/api/system/updater")).status_code == 403
        assert (await viewer.post("/api/system/updater/update", json={"version": newer})).status_code == 403
        assert (await viewer.post("/api/system/updater/rollback")).status_code == 403
    finally:
        await viewer.aclose()
    assert status.call_count == 0 and route.call_count == 0
@pytest.mark.asyncio
 async def test_anonymous_is_rejected(anon_client):
    assert (await anon_client.get("/api/system/updater")).status_code == 401
    assert (await anon_client.post("/api/system/updater/rollback")).status_code == 401
@pytest.mark.asyncio
 async def test_update_request_is_audited(client, respx_mock):
    newer = _bump(patch=1)
    _feed(respx_mock, newer)
    respx_mock.post(f"{UPDATER}/update").mock(return_value=httpx.Response(202, json={"job": {"id": "x"}}))
    assert (await client.post("/api/system/updater/update", json={"version": newer})).status_code == 202
    events = (await client.get("/api/audit?kind=system")).json()["items"]
    assert {(e["action"], e["status"]) for e in events} >= {("update", "requested"), ("update", "accepted")}
@@ -16,3 +16,6 @@ services:
  proxy:
    build: ./proxy
  updater:
    build: ./updater
@@ -120,6 +120,9 @@ services:
      ALLOW_INSECURE_SMTP_AUTH: ${ALLOW_INSECURE_SMTP_AUTH:-false}
      SMTP_CA_FILE: ${SMTP_CA_FILE:-}
      UPDATE_CHECK_INTERVAL_HOURS: ${UPDATE_CHECK_INTERVAL_HOURS:-12}
      # Optionaler Updater-Dienst (Profil "updater", siehe unten). Ohne ihn
      # zeigt das Webinterface nur an, wie man ihn aktiviert.
      UPDATER_URL: ${UPDATER_URL:-http://updater:8080}
    volumes:
      - secrets:/data/opnsense-secrets
      - backups:/data/opnsense-backups
@@ -133,6 +136,9 @@ services:
      # Gleiches Volume wie der postgres-backup-Service: hier landet das
      # automatische Sicherheits-Backup vor einer Schema-Migration.
      - postgres_backups:/backups
      # Zugriffstoken des Updaters (nur lesen). Leer, solange der Updater
      # nicht aktiviert ist.
      - updater_state:/updater:ro
    # Bound to loopback only by default — reachable from this host, not
    # the network. Set BIND_ADDRESS in .env (e.g. to 0.0.0.0, or a
    # specific interface IP) for network-wide access instead of editing
@@ -195,7 +201,34 @@ services:
      - caddy_data:/data
      - caddy_config:/config
  # ── Optional: Updates aus dem Webinterface ──────────────────────────
  # Standardmäßig NICHT gestartet. Aktivieren mit COMPOSE_PROFILES=updater in
  # .env und `docker compose up -d`. Dies ist der einzige Container mit
  # Zugriff auf den Docker-Socket (= root-gleiche Rechte auf diesem Host): er
  # hat keine veröffentlichten Ports, ist nur mit seinem Token ansprechbar
  # und kann nur "aktualisieren"/"zurückrollen" (updater/server.py). Das
  # Backend selbst bekommt den Socket nie. Nur für Release-Images
  # (OPNEXUS_IMAGE_REPO gesetzt).
  updater:
    profiles: ["updater"]
    image: ${OPNEXUS_IMAGE_REPO:-local}/opnexus-updater:${OPNEXUS_VERSION:-latest}
    restart: unless-stopped
    logging: *default-logging
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      # Das Verzeichnis mit docker-compose.yml und .env (der Updater schreibt
      # nur OPNEXUS_VERSION und .opnexus-update-state hinein).
      - .:/project
      - updater_state:/state
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3)"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s
 volumes:
  updater_state:
  postgres_data:
  postgres_backups:
  secrets:
@@ -157,6 +157,56 @@ Verkehrsunterbrechung auf dem falschen Knoten.
 ---
 ## Einrichtungsassistent und Passwort-Reset
 **Einrichtungsassistent** (`/setup`, System › Einrichtung). Vier Schritte mit
 kurzen Erklärungen, damit eine frische Installation ohne Handbuch funktioniert:
 1. **Willkommen:** was der Assistent tut, Sprache (Deutsch/Englisch). Er liest
   nur von der Firewall; geändert wird dort erst, wenn du selbst etwas ausrollst.
 2. **Konto:** eigenes Passwort setzen (optional, empfohlen, wenn OPNexus beim
   Start eines erzeugt hat) und Zwei-Faktor-Anmeldung einrichten (derselbe
   Baustein wie in den Einstellungen).
 3. **Firewall:** Anleitung für den API-Key in OPNsense (System › Access › Users,
   Benutzer, „API keys“, `apikey.txt`), dann Name, Adresse, Key und Secret
   eintragen, Zertifikat abrufen und den Fingerabdruck bestätigen (dasselbe
   Festsetzen wie beim Hinzufügen eines Hosts). Nach dem Anlegen zeigt der
   Schritt sofort, ob die Firewall antwortet, und bei „offline“ was man prüft.
   Weitere Firewalls, auch die Knoten eines HA-Paars, lassen sich im selben
   Schritt nacheinander eintragen.
 4. **Fertig:** Zusammenfassung (Firewalls erreichbar, Zwei-Faktor an/aus) und
   Verweise auf das, was danach sinnvoll ist: Regeln, Benachrichtigungen,
   Updates, Datenbank-Sicherung.
 *Wann er sich öffnet:* nach der Anmeldung auf dem Dashboard, solange es **keinen
 Host** gibt und dieser Benutzer den Assistenten weder abgeschlossen noch
 übersprungen hat. Der Merker liegt pro Benutzer in `user_preferences.setup_done`
 (Migration `0005`, `PUT /api/settings {"setup_done": true}`). `read_only`-Benutzer
 bekommen ihn nicht angeboten. Wieder öffnen geht über System › Einrichtung, die
 Einstellungen und die Schnellsuche (Strg/⌘+K).
 **Passwort-Reset** (`opnexus password [BENUTZER] [--yes]`). Setzt für das
 Admin-Konto (Standard: `ADMIN_USERNAME`; gibt es das nicht und genau einen Admin,
 dieser) ein neues Zufallspasswort, gibt es einmal aus und beendet alle Sitzungen
 des Kontos. Eine Rückfrage kommt nur, wenn sich schon jemand angemeldet hat;
 ohne Terminal ist `--yes` nötig. Dahinter steht
 `docker compose exec backend python -m app.reset_password [BENUTZER]`, wie
 `app.reset_2fa` ein Werkzeug mit Shell-Zugriff auf den Server als
 Vertrauensgrenze. Eine eingeschaltete Zwei-Faktor-Anmeldung bleibt bestehen
 (verloren: `app.reset_2fa`). Es gibt bewusst keine Anzeige des alten Passworts:
 Gespeichert wird nur der Argon2id-Hash.
 *Verifikation 2026-10-10:* Backend-Tests (`test_setup_assistant.py`: Merker
 persistiert und bleibt bei anderen Einstellungen erhalten, Reset gibt Passwort
 aus, beendet Sitzungen und tauscht den Hash, unbekannter Benutzer scheitert;
 vollständige Suite 583 bestanden). Kommandozeile gegen einen Wegwerf-Stack:
 frische Installation ohne Rückfrage, nach einer Anmeldung Rückfrage bzw.
 `--yes`, ungültige Option/Benutzer mit Fehlercode. Browser (Chromium, 1440 und
 375 px, Wegwerf-Stack mit Mock-Firewall): Anmeldung landet auf `/setup`,
 Sprachwechsel, Passwortwechsel inklusive Fehlerfall, Host online und offline,
 Zusammenfassung, Abschließen merkt sich den Zustand, keine Konsolenfehler, kein
 horizontaler Überlauf.
 ## Barrierefreiheit (2026-10-04)
 Version 1.8.0 „Harris“. Ziel: OPNexus per Tastatur und mit Screenreader
@@ -183,10 +233,6 @@ fand.
  `aria-hidden`, Unternavigation als eigene Landmarke. Leere Tabellenköpfe
  tragen einen nur für Screenreader sichtbaren Text („Aktionen“). Der
  Host-Status (`StatusDot`) war fest deutsch und folgt jetzt der Sprache.
 - **Prüfen.** `scripts/verify_a11y.mjs` wiederholt den axe-Lauf (nur lesend:
  schreibende Anfragen werden im Browser lokal beantwortet, das Theme wird nur
  in der Antwort überschrieben). Aufruf siehe Skriptkopf; Exit-Code ≠ 0 bei
  Verstößen.
 **Verifikation:** axe-core (WCAG 2.0/2.1/2.2 A + AA, Best Practices) auf allen
 18 Seiten, Hell/Dunkel bei 1440 px und Hell bei 375 px: 0 Verstöße. Zusätzlich
@@ -379,14 +425,7 @@ unter `frontend/lib/i18n/` (`de.json`/`en.json`, ca. 1.400 Schlüssel).
  Firewall-Daten (Aliase, Regelbeschreibungen) und die deutschen Suchbegriffe der
  Befehlspalette (sie bleiben zusätzlich zu den englischen Seitentiteln nutzbar).
 - **Prüfwerkzeuge:** `python3 scripts/check_i18n.py` (Katalog-Parität,
-  Platzhalter, Abdeckung aller `ErrorCode`s, referenzierte Schlüssel) und
+  Platzhalter, Abdeckung aller `ErrorCode`s, referenzierte Schlüssel).
  `scripts/verify_i18n.mjs` (Browser: Umschalten über die Einstellungen, alle
  lesenden Seiten samt „Neu“-Dialogen auf deutsche Restwörter prüfen, 375 px auf
  horizontalen Überlauf; schreibende Requests werden abgefangen; `/updates` wird
  ausgelassen, weil das Öffnen dort Update-Suchen auf den Firewalls startet).
  Das Skript braucht `OPNEXUS_TEST_PASSWORD` und als `OPNEXUS_BASE_URL` den in
  `FRONTEND_ORIGIN` konfigurierten Origin (sonst blockiert die CORS-Freigabe die
  Anmeldung).
 **Verifiziert 2026-09-19:** DE→EN→DE mit DB-Persistenz und Reload; 17 Seiten und
 alle „Neu“-Dialoge im Englischen ohne deutsche Restwörter (Treffer nur aus
@@ -909,7 +948,7 @@ bestätigt, bevor mit dem Picker begonnen wurde).
 ## Restore, Stufe 1: Vorschau + manuelle Übergabe (2026-09-09)
-Setzt `docs/restore-plan.md` (8. September) in seiner ersten Ausbaustufe um:
+Erste Ausbaustufe des Restore-Assistenten (geplant am 8. September):
 eine lokal gespeicherte OPNsense-Konfigurationssicherung (`backup_store.py`,
 bereits vorhandenes "Backups"-Panel) prüfen, sicher als Vorschau anzeigen und
 den Wechsel auf das OPNsense-Webinterface dokumentiert übergeben — **OPNexus
@@ -2096,7 +2135,7 @@ Details: `docs/verification/log-search-*`.
  Tabelle werden durch einen Datenbank-Trigger blockiert; Datenbankadministratoren
  können technisch weiterhin das Schema ändern. Keine rückwirkende Rekonstruktion
  früherer Aktionen. XML-Backups, Passwörter und API-Secrets werden nicht protokolliert.
- **Restore**: separat ausgearbeiteter [Restore-Plan](restore-plan.md).
+- **Restore**: separat ausgearbeitet, siehe Abschnitt „Restore, Stufe 1“.
  Es gibt keine implementierte Restore-Ausführung. Der Plan unterscheidet lokale
  OPNexus-XML-Dateien von bereits auf der Firewall vorhandenen Revisionen.
@@ -2415,9 +2454,12 @@ in die Backend-Logs geschrieben:
 docker compose logs backend | grep -A5 "generated password"
 ```
-Danach in `.env` ein eigenes `ADMIN_PASSWORD` setzen (empfohlen) oder das
+Ist das Passwort verloren oder nie gesehen worden, setzt `opnexus password`
-Passwort über die künftige "Passwort ändern"-Funktion (`POST
+(im Repo-Checkout `scripts/opnexus password`) ein **neues** Zufallspasswort und
-/api/auth/change-password`, aktuell nur per API, kein UI-Formular) ändern.
+zeigt es an; siehe "Einrichtungsassistent und Passwort-Reset" unten. Danach
 das Passwort im Einrichtungsassistenten oder unter Einstellungen › Konto
 ändern, oder in `.env` ein eigenes `ADMIN_PASSWORD` setzen (gilt nur beim
 Anlegen des ersten Kontos).
 Login-Versuche sind pro (IP, Benutzername) und pro IP rate-limitiert
 (Standard: 5 Fehlversuche / 5 Minuten Sperre).
@@ -2520,37 +2562,6 @@ Release-Seite angehängt (GitHub und Forgejo haben dafür verschiedene APIs, die
 CI lädt es deshalb nicht hoch). Anwender brauchen damit nur Docker und diese
 vier Dateien.
 **Ein Release veröffentlichen:** Versionsdateien und `CHANGELOG.md` anpassen,
 committen, dann `git tag v1.9.1 && git push origin v1.9.1`. Der Release-
 Workflow prüft per `scripts/check_version.sh`, dass Tag, `version.py`,
 `version.ts` und CHANGELOG zusammenpassen, lässt die Tests laufen und pusht
 erst dann die Tags `1.9.1`, `1.9` und `1` (Vorabversionen wie `v1.10.0-rc1`
 nur mit vollem Tag).
 **Entwicklungs-Repo und öffentliches Repo (seit 2026-10-05):** Entwickelt wird
 im privaten Repo (volle Historie). Öffentlich ist `git.opnexus.dev/opnexus/opnexus`,
 und dort landet pro Release nur ein sauberer Snapshot-Commit — nie die
 Entwicklungs-Historie (frühere Lizenzstände, interne Übergaben,
 Live-Verifikation mit echten Adressen). Ablauf eines Releases:
 ```bash
 git tag v1.11.0                                   # im Entwicklungs-Repo, nach check_version.sh
 scripts/publish_public.sh v1.11.0                 # Trockenlauf: Snapshot nach .public-repo/ prüfen
 scripts/publish_public.sh v1.11.0 --push          # Snapshot + Tag ins öffentliche Repo
 scripts/build_release_images.sh v1.11.0 --push    # Images bauen + in die Registry (ohne CI-Runner)
 scripts/make_update_feed.sh v1.11.0               # erst jetzt: Feed für updates.opnexus.dev
 ```
 `publish_public.sh` exportiert den Tag (nicht den Working Tree), lässt
 `.claude/`, `docs/HANDOFF-*`, `docs/verification*` und `.env` weg und bricht
 ab, wenn im Export interne Adressen/Hostnamen (Muster stehen im Skript) oder
 Schlüsselblöcke stehen — ein Sicherheitsnetz, kein Ersatz fürs Durchsehen.
 Folge: Verweise auf `docs/verification*` laufen im öffentlichen Repo ins Leere
 (siehe Hinweis oben im Handbuch). Hinter dem Cloudflare-Proxy (Free) sind
 Uploads auf 100 MB pro Request begrenzt; der Push des 1.10.0-rc1 ging
 problemlos durch, bei größeren Layern die Registry-Domain auf „DNS only“
 stellen oder aus dem LAN pushen.
 **Registry ist reine Konfiguration**, nicht Teil der Workflow-Datei —
 Repository-Variablen `REGISTRY` (Default `ghcr.io`) und `IMAGE_NAMESPACE`
 (Default: Repo-Besitzer), Secrets `REGISTRY_USERNAME`/`REGISTRY_TOKEN`. Für
@@ -2566,8 +2577,8 @@ GitHub/Forgejo `releases/latest`, den man in `.env` einträgt:
 UPDATE_CHECK_URL=https://updates.opnexus.dev/latest.json
 ```
-Das ist der offizielle Feed des Projekts (statische JSON-Datei aus
+Das ist der offizielle Feed des Projekts (eine statische JSON-Datei, ausgeliefert als
-`website/latest.json`, siehe `website/README.md`). Jeder andere Feed im
+`updates.opnexus.dev/latest.json`). Jeder andere Feed im
 selben Format funktioniert ebenso, etwa `…/api/v1/repos/<owner>/opnexus/releases/latest`
 auf einer eigenen Forgejo/GitHub-Instanz.
@@ -2578,7 +2589,78 @@ einzelnes GET mit dem User-Agent `OPNexus/<Version>` hinaus, ohne Instanz- oder
 Nutzerdaten. Ein unerreichbarer Feed bleibt unauffällig (der letzte bekannte
 Stand bleibt, Neuversuch frühestens nach 15 Minuten); Vorabversionen
 (`-rc1`) werden nie vorgeschlagen. Der Hinweis lässt sich pro Version
-wegklicken und installiert nichts — dafür gibt es `opnexus update`.
+wegklicken und installiert nichts — dafür gibt es den optionalen Updater
 (nächster Abschnitt) oder `opnexus update`.
 #### Update aus dem Webinterface (optional)
 Statt `opnexus update` auf dem Server kann ein Administrator OPNexus auch in
 den **Einstellungen › „OPNexus aktualisieren“** aktualisieren: Version und
 Release-Notes ansehen, „Auf X.Y.Z aktualisieren“ klicken, bestätigen,
 Fortschritt verfolgen. Die Seite überbrückt den kurzen Neustart der Dienste
 selbst und lädt sich danach neu. Ein fehlgeschlagenes Update rollt wie auf der
 Kommandozeile automatisch zurück und zeigt das Ergebnis samt Protokoll an;
 „Auf Vorversion zurücksetzen“ macht das letzte Update rückgängig (mit Hinweis,
 ob dabei Daten verloren gehen — nur wenn das Update die Datenbank migriert hat).
 **Das ist bewusst abgeschaltet und muss aktiviert werden**, weil es Docker-Zugriff
 braucht. Dafür gibt es einen eigenen kleinen Dienst, den **Updater**
 (`updater/`, Compose-Profil `updater`):
 ```bash
 # .env auf dem Server
 COMPOSE_PROFILES=updater
 ```
 ```bash
 docker compose pull && docker compose up -d --no-build
 ```
 Sicherheitsmodell:
 - Der Updater ist der **einzige** Container mit dem Docker-Socket. Das
  entspricht root-gleichen Rechten auf dem Host — deshalb ist er optional und
  winzig gehalten (`updater/server.py`, nur Standardbibliothek). Das Backend
  bekommt den Socket nie.
 - Er hat **keinen veröffentlichten Port** und ist nur aus dem Compose-Netz
  erreichbar, nur mit einem Token, den er beim ersten Start selbst erzeugt
  und in sein Volume `updater_state` schreibt (das Backend hängt es
  schreibgeschützt ein). Von außen kommt man nicht heran.
 - Er kann **nur** „aktualisieren auf X.Y.Z“, „zurückrollen“ und „Status“ — es
  gibt keinen Weg, einen eigenen Befehl auszuführen. Eine Zielversion muss
  eine stabile `X.Y.Z` sein, neuer als die laufende, mit derselben
  Hauptversion.
 - Das Backend leitet nur Admin-Anfragen weiter und nimmt als Ziel
  ausschließlich die Version an, die der Release-Feed (`UPDATE_CHECK_URL`)
  als neueste stabile meldet. Jede Anfrage steht im Audit-Log (Typ
  „OPNexus-System“). Nur-Lese-Konten sehen den Abschnitt nicht.
 - **Hauptversions-Sprünge** (z. B. 1.x → 2.0) lassen sich bewusst nicht per
  Klick auslösen: Release-Notes lesen, dann auf dem Server `opnexus update 2.0.0`.
 Voraussetzungen und Grenzen:
 - Nur für **Release-Images** (`OPNEXUS_IMAGE_REPO` gesetzt) und mit aktivem
  Release-Feed (`UPDATE_CHECK_URL`). Installationen, die lokal aus dem
  Quellcode bauen, aktualisieren weiter mit `git pull && docker compose up -d --build`;
  die Einstellungen sagen das an.
 - Der Updater arbeitet im Verzeichnis mit `docker-compose.yml` und `.env`
  (als `/project` eingehängt, schreibend — er setzt `OPNEXUS_VERSION` und
  legt `.opnexus-update-state` ab) und führt dieselbe Logik aus wie
  `opnexus update`: Images zuerst ziehen, wechseln, auf „gesund“ warten,
  sonst Rollback. Ein Update wechselt die Images, aber **nicht** die
  Compose-Datei; braucht eine Version neue Compose-Einträge, steht das in
  den Release-Notes und ist dann einmal von Hand zu tun.
 - Der Updater erneuert sich nach einem erfolgreichen Update selbst (aus einem
  kurzlebigen Hilfs-Container heraus); schlägt das fehl, läuft er weiter und
  wird beim nächsten `docker compose up -d` erneuert.
 - Läuft kein Updater, ist die Weboberfläche trotzdem voll nutzbar — der
  Abschnitt erklärt dann nur, wie man ihn aktiviert.
 **Verifikation 1.15.0:** Update, Rollback mit Datenbank-Wiederherstellung und ein kaputtes
 Update mit automatischem Rollback liefen über die Oberfläche gegen einen isolierten Stack mit
 echten Release-Images und lokaler Registry (inklusive Selbsterneuerung des Updaters und
 Neuladen der Seite); Backend-API-Tests, Updater-Tests ohne Docker und die Browser-Prüfung
 (1440 px hell/dunkel, 375 px, alle Zustände, axe ohne Verstöße) sind grün.
 #### Update und Rollback mit `opnexus`
@@ -3129,10 +3211,83 @@ Vergabe von DHCP-Leases (Kea ist auf den Test-Firewalls deaktiviert).
 **Bekannte Grenzen:** Übernommene Regeln werden je Firewall einzeln übernommen. Wer
 eine übernommene Regel zusätzlich auf einen weiteren Host als Ziel setzt, legt dort
-eine zweite, doppelte Regel an (die Vorschau zeigt „create“). Keine Multi-Host-Vorlagen für Netzwerkobjekte, kein
+eine zweite, doppelte Regel an (die Vorschau zeigt „create“). Keine Multi-Host-Vorlagen
-Rolling-Apply auf CARP-Paaren (die Vorschau weist auf den Partner hin), keine
+für Netzwerkobjekte, kein automatisches Rolling-Apply auf CARP-Paaren (nur das
-LAGG/Bridge/GRE/VXLAN-Verwaltung, keine dnsmasq-Bereiche, keine Kea-DDNS-Felder,
+Übertragen auf den Partner per Klick), keine Kea-DDNS-Felder.
-Gateway-Gruppen nicht enthalten.
+
 ### Erweiterung 1.13.0: Geräte, Host-System, Abgleich im Cluster
 Alles über dieselbe Engine (Vorschau, Backup, Anwenden, Zurücklesen, Audit, Guard):
 - **Netzwerk › Geräte:** LAGG, Bridge, Loopback und GRE. Ein LAGG oder eine Bridge, die
  die Verwaltungs-Schnittstelle als Mitglied enthält, braucht die Bestätigung
  (`management_member`). Beim Anlegen einer Bridge sind die Mitglieder Schnittstellen-
  Kennungen (opt1, opt2), bei einem LAGG Gerätenamen.
 - **Gateways › Gateway-Gruppen**, **DNS › Weiterleitungen** (Unbound-Forwards) und
  **DHCP › Bereiche** (dnsmasq).
 - **Host-System** (neue Gruppe): **Tunables** (jede Änderung braucht die Bestätigung; die
  eingebauten Vorgaben lassen sich nicht bearbeiten, nur per „Überschreiben“ mit einem
  eigenen Eintrag übersteuern), **Cron**, **Syslog** (entfernte Log-Ziele) und
  **Snapshots** (ZFS: anlegen und löschen; das aktive Boot-Environment lässt sich nicht
  löschen, das Aktivieren mit Neustart gibt es bewusst nicht). Snapshots haben eine
  eigene, flache API und laufen deshalb über `services/snapshot_service.py`, nicht über
  die Engine.
 - **Netzwerk › Abgleich:** vergleicht die Knoten jedes Clusters (Schnittstellen,
  VLANs, VIPs, Gateways, Routen, DNS, DHCP). Adressen, CARP-Advskew/-Passwort und das
  aktive Standard-Gateway sind pro Knoten verschieden und werden nicht verglichen; eine
  Kategorie, die ein Knoten nicht liefern kann, wird übersprungen statt als Abweichung
  gemeldet. Dazu ein neuer Alarm „Netzwerk-Abweichung im Cluster“
  (`network_drift`, Einstellungen › Benachrichtigungen, Migration 0004), der sich nach
  der Korrektur selbst auflöst und bei einem nicht erreichbaren Knoten offene Meldungen
  stehen lässt.
 - **Auf den Partner übertragen:** Nach dem Anlegen eines Objekts auf einem Cluster-Knoten
  bietet der Ergebnis-Schritt „Auf <Partner> übertragen“ an (Dialog mit denselben
  Werten, mit eigener Vorschau, eigenem Backup und eigenem Guard). Empfohlene
  Reihenfolge: zuerst der Backup-Knoten, dann der Master.
 - **Kopfzeile:** Bei acht Gruppen zeigt die Hauptnavigation die Namen ab 1150 px Breite,
  darunter nur Icons mit Tooltip, damit Suche und Abmelden in einer Zeile bleiben.
 **Verifikation 1.13.0 (live auf test-fw-1/-2/-3):** je anlegen, ändern, in der Liste
 sehen und löschen mit Backup, Apply und Rücklesen für Tunable, Cron-Job, Syslog-Ziel,
 Gateway-Gruppe, Loopback, GRE, DNS-Forward und dnsmasq-Bereich auf test-fw-3, Bridge
 auf test-fw-1 (mit zwei dafür zugewiesenen, unbenutzten VLANs) und LAGG auf test-fw-3;
 Snapshots anlegen/löschen auf test-fw-1 und -3 (der aktive wird abgelehnt). Der Abgleich
 und sein Alarm wurden mit einem nur auf einem Knoten vorhandenen VLAN geprüft
 (Meldung geöffnet, nach dem Löschen aufgelöst). Browser: Übertragen auf den Partner,
 Abgleich vor und nach dem Angleichen, Überschreiben und Löschen eines Tunables,
 Snapshot anlegen/löschen, alle neuen Seiten in Deutsch und Englisch (Dark Mode),
 axe-core über die ganze App ohne Verstöße, Kopfzeile in einer Zeile ab 768 px.
 ### Erweiterung 1.14.0: Diagnose, VXLAN, GIF
 - **Netzwerk › Geräte** kennt jetzt auch **VXLAN** und **GIF** (gleiche Engine wie LAGG, Bridge
  und GRE: Vorschau, Backup, Anwenden, Zurücklesen, Audit).
 - **Host-System › Diagnose:** Ping, Traceroute, Port-Prüfung (TCP) und DNS-Abfrage, die die
  ausgewählte Firewall selbst ausführt (`/api/hosts/{id}/diagnostics/{ping|traceroute|portprobe|dns}`,
  `services/diagnostics_service.py`). Sicherheitsmerkmale:
  - nur für Admins (alles sind POSTs, die Nur-Lesen-Rolle bekommt 403),
  - das Ziel wird vor dem Senden streng geprüft (nur Hostname-/IP-Zeichen, Quelladresse nur als IP,
    Anzahl 1–10, Port 1–65535); die Firewall prüft zusätzlich selbst und lehnt Ungültiges mit 422 ab,
  - jeder Lauf steht mit Tool und Ziel im Audit-Log (`kind=diagnostic`), Ergebnisse werden nicht gespeichert,
  - höchstens vier Abfragen gleichzeitig pro OPNexus-Prozess,
  - die Port-Prüfung gibt nie den Banner/Payload der Gegenstelle weiter, nur „offen/nicht erreichbar“,
  - ein Ping läuft als kurzer Job und wird **immer** wieder gestoppt und entfernt, auch wenn das Abfragen
    der Zwischenstände scheitert (live geprüft: danach keine Jobs auf den Firewalls).
  Ein Port-Test auf einen geschlossenen oder blockierten Port dauert bei OPNsense 10 Sekunden; die
  Diagnose-Aufrufe haben deshalb ein Zeitlimit von 40 s.
 - **Bewusst nicht gebaut: Packet-Capture.** Mitschnitte enthalten Nutzdaten fremder Verbindungen und
  Zugangsdaten im Klartext; das gehört nicht in eine Verwaltungsoberfläche ohne eigenes Aufbewahrungs-
  und Berechtigungskonzept.
 - **Fehlerkorrektur:** Die neue Route `/hostsystem` beginnt mit `/hosts`; die Navigation markierte
  dadurch „Übersicht › Hosts“ und der Seitentitel zeigte „Hosts“. Der Pfadvergleich prüft jetzt auf
  die ganze Seite oder Unterseiten.
 **Verifikation 1.14.0 (live):** VXLAN und GIF auf test-fw-3 (anlegen, ändern, auflisten, löschen, Geräteliste
 danach unverändert). Alle vier Diagnose-Werkzeuge auf test-fw-1 und -3 gegen das Gateway im Management-Netz
 (Ping 4/4 und 3/3 verloren zu einer nicht erreichbaren Adresse, Traceroute, Port 443 offen und Port 1 nach
 10 s „nicht erreichbar“, DNS mit mehreren Record-Typen, ungültige Eingabe → 422). Browser (1440 und 375 px):
 alle vier Werkzeuge, VXLAN und GIF über die Geräteseite, Englisch/Dark Mode ohne deutsche Reste,
 axe-core über die ganze App ohne Verstöße. 560 Backend-Tests grün.
 ## Definition of Done — Stand
@@ -5,7 +5,7 @@ import { api, AuditEvent, AuditPage } from "@/lib/api";
 import { Button } from "@/components/ui/Button";
 import { Input, Select } from "@/components/ui/Field";
 import { useLanguage } from "@/components/LanguageProvider";
-const kindKeys = ["rule","alias","port_forward","one_to_one","outbound_nat","host","user","auth","backup","ipsec_tunnel","openvpn_instance","wireguard_tunnel","certificate","acme","notification"];
+const kindKeys = ["rule","alias","port_forward","one_to_one","outbound_nat","host","user","auth","backup","ipsec_tunnel","openvpn_instance","wireguard_tunnel","certificate","acme","notification","system"];
 const actionKeys = ["deploy","confirm","rollback","remove","retry-rollback","delete","create","edit","reboot","update"];
 const statusKeys = ["requested","accepted","rejected","interrupted","success","pending","error","reverted","revert_failed","removed","submitted","acknowledged","starting","unknown","denied"];
 export default function AuditHistory() {
@@ -18,6 +18,7 @@ import {
  ShieldAlert,
 } from "lucide-react";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useEffect, useState } from "react";
 import { useLanguage } from "@/components/LanguageProvider";
 import { labelFor, type Language } from "@/lib/i18n";
@@ -110,6 +111,7 @@ function certProblemLabel(context: Record<string, unknown>, t: (key: string, par
 export default function DashboardPage() {
  const { language, t, errorMessage } = useLanguage();
  const router = useRouter();
  const [summary, setSummary] = useState<DashboardSummary | null>(null);
  const [problems, setProblems] = useState<NotificationProblem[] | null>(null);
  const [firmwareWarnings, setFirmwareWarnings] = useState<FirmwareWarning[] | null>(null);
@@ -133,6 +135,15 @@ export default function DashboardPage() {
      .then(async (data) => {
        if (!active) return;
        setSummary(data);
        // Fresh install: nothing to manage yet and the setup assistant was
        // never finished or skipped, so open it instead of an empty dashboard.
        if (data.hosts.length === 0) {
          Promise.all([api.me(), api.settings()])
            .then(([me, prefs]) => {
              if (active && me.role !== "read_only" && !prefs.setup_done) router.replace("/setup");
            })
            .catch(() => {});
        }
        const reachableHosts = data.hosts.filter((h) => h.status !== "offline" && h.status !== "disabled");
        const results = await Promise.all(
          reachableHosts.map(async (host) => {
@@ -164,7 +175,7 @@ export default function DashboardPage() {
    return () => {
      active = false;
    };
-  }, [errorMessage]);
+  }, [errorMessage, router]);
  const healthProblems = (problems ?? []).filter((p) => ["host_offline", "cert_expiry", "rule_drift"].includes(p.problem_type));
  const securityWarningsLoading = problems === null || firmwareWarnings === null;
@@ -212,7 +223,7 @@ export default function DashboardPage() {
          {summary === null ? (
            <div className="space-y-2">{[0, 1].map((i) => <Skeleton key={i} className="h-10" />)}</div>
          ) : summary.hosts.length === 0 ? (
-            <EmptyState icon={Network} title={t("dashboard.noHosts")} action={<Link href="/hosts" className="text-sm text-sky-700 hover:underline">{t("dashboard.toHosts")}</Link>} />
+            <EmptyState icon={Network} title={t("dashboard.noHosts")} action={<span className="flex flex-wrap justify-center gap-x-4 gap-y-1"><Link href="/setup" className="text-sm font-medium text-sky-700 hover:underline">{t("dashboard.startSetup")}</Link><Link href="/hosts" className="text-sm text-sky-700 hover:underline">{t("dashboard.toHosts")}</Link></span>} />
          ) : (
            <ul className="divide-y divide-slate-100">
              {summary.hosts.map((host) => (
@@ -0,0 +1,231 @@
 "use client";
 import { useLanguage } from "@/components/LanguageProvider";
 import { NetworkChangeModal } from "@/components/NetworkChangeModal";
 import { NetworkObjectSection, ObjectChange } from "@/components/NetworkObjectSection";
 import { Button } from "@/components/ui/Button";
 import { Card } from "@/components/ui/Card";
 import { EmptyState } from "@/components/ui/EmptyState";
 import { FieldGroup, Input } from "@/components/ui/Field";
 import { Modal } from "@/components/ui/Modal";
 import { Skeleton } from "@/components/ui/Skeleton";
 import { useToast } from "@/components/ui/Toast";
 import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
 import { api, Host, HostSnapshot, NetworkKind } from "@/lib/api";
 import { useReadOnly } from "@/lib/useReadOnly";
 import { HostDiagnostics } from "@/components/HostDiagnostics";
 import { HardDrive, Plus, Trash2 } from "lucide-react";
 import { useParams } from "next/navigation";
 import { useEffect, useState } from "react";
 const HOST_KEY = "opnexus-network-host"; // shared with the network pages: one firewall stays selected
 const KIND_BY_TAB: Record<string, NetworkKind> = { tunables: "tunable", cron: "cron_job", syslog: "syslog_destination" };
 /** Settings that live on the firewall itself: tunables, cron jobs, remote syslog targets and ZFS snapshots. */
 export default function HostSystemPage() {
  const { t, errorMessage } = useLanguage();
  const { tab } = useParams<{ tab: string }>();
  const section = ["tunables", "cron", "syslog", "snapshots", "diagnostics"].includes(tab) ? tab : "tunables";
  const readOnly = useReadOnly();
  const [hosts, setHosts] = useState<Host[] | null>(null);
  const [hostId, setHostId] = useState("");
  const [error, setError] = useState<string | null>(null);
  const [change, setChange] = useState<ObjectChange | null>(null);
  const [reloadKey, setReloadKey] = useState(0);
  useEffect(() => {
    api
      .listHosts()
      .then((list) => {
        setHosts(list);
        let remembered = "";
        try { remembered = sessionStorage.getItem(HOST_KEY) ?? ""; } catch { /* storage may be blocked */ }
        setHostId(list.find((h) => h.id === remembered)?.id ?? list[0]?.id ?? "");
      })
      .catch((e) => setError(errorMessage(e, "network.loadFailed")));
  }, [errorMessage]);
  if (hosts && hosts.length === 0) {
    return (
      <div>
        <h1 className="mb-6 text-2xl font-semibold text-slate-900">{t(`nav.items.hostsystem-${section}`)}</h1>
        <EmptyState icon={HardDrive} title={t("drift.noHosts")} />
      </div>
    );
  }
  const host = hosts?.find((h) => h.id === hostId);
  const kind = KIND_BY_TAB[section];
  return (
    <div>
      <div className="mb-6 flex flex-wrap items-center justify-between gap-3">
        <h1 className="text-2xl font-semibold text-slate-900">{t(`nav.items.hostsystem-${section}`)}</h1>
        {hosts && (
          <label className="flex items-center gap-2 text-sm text-slate-600">
            {t("network.host")}
            <select
              value={hostId}
              onChange={(e) => {
                setHostId(e.target.value);
                try { sessionStorage.setItem(HOST_KEY, e.target.value); } catch { /* ignore */ }
              }}
              className="rounded-lg border border-slate-300 bg-white px-3 py-1.5 text-sm"
            >
              {hosts.map((h) => (
                <option key={h.id} value={h.id}>{h.name}</option>
              ))}
            </select>
          </label>
        )}
      </div>
      <p className="mb-4 text-sm text-slate-600">{t(`hostsystem.intro.${section}`)}</p>
      {error && <p className="mb-4 text-sm text-red-600">{error}</p>}
      {!hostId && !error && <Skeleton className="h-48 w-full" />}
      {hostId && (
        <Card className="overflow-x-auto">
          {kind ? (
            <NetworkObjectSection
              hostId={hostId}
              kind={kind}
              title={t(`nav.items.hostsystem-${section}`)}
              reloadKey={reloadKey}
              readOnly={readOnly}
              onChange={setChange}
            />
          ) : section === "diagnostics" ? (
            <HostDiagnostics hostId={hostId} readOnly={readOnly} />
          ) : (
            <Snapshots hostId={hostId} readOnly={readOnly} />
          )}
        </Card>
      )}
      {change && host && (
        <NetworkChangeModal
          key={`${hostId}:${change.kind}:${change.action}:${change.uuid ?? ""}`}
          hostId={hostId}
          hostName={host.name}
          kind={change.kind}
          action={change.action}
          uuid={change.uuid}
          preset={change.preset}
          onClose={() => setChange(null)}
          onDone={() => setReloadKey((k) => k + 1)}
        />
      )}
    </div>
  );
 }
 function Snapshots({ hostId, readOnly }: { hostId: string; readOnly: boolean }) {
  const { t, errorMessage } = useLanguage();
  const toast = useToast();
  const [data, setData] = useState<{ supported: boolean; rows: HostSnapshot[] } | null>(null);
  const [error, setError] = useState<string | null>(null);
  const [showCreate, setShowCreate] = useState(false);
  const [name, setName] = useState("");
  const [note, setNote] = useState("");
  const [busy, setBusy] = useState(false);
  const [formError, setFormError] = useState<string | null>(null);
  function load() {
    setData(null);
    api.listSnapshots(hostId).then(setData).catch((e) => setError(errorMessage(e, "network.loadFailed")));
  }
  useEffect(load, [hostId]); // eslint-disable-line react-hooks/exhaustive-deps
  async function create(e: React.FormEvent) {
    e.preventDefault();
    setBusy(true);
    setFormError(null);
    try {
      await api.createSnapshot(hostId, name.trim(), note.trim());
      toast.show(t("hostsystem.snapshots.created", { name: name.trim() }), "success");
      setShowCreate(false);
      setName("");
      setNote("");
      load();
    } catch (err) {
      setFormError(errorMessage(err, "hostsystem.snapshots.createFailed"));
    } finally {
      setBusy(false);
    }
  }
  async function remove(row: HostSnapshot) {
    if (!confirm(t("hostsystem.snapshots.deleteConfirm", { name: row.name }))) return;
    try {
      await api.deleteSnapshot(hostId, row.uuid);
      toast.show(t("hostsystem.snapshots.deleted", { name: row.name }), "success");
      load();
    } catch (err) {
      toast.show(errorMessage(err, "hostsystem.snapshots.deleteFailed"), "danger");
    }
  }
  return (
    <div>
      <div className="flex items-center justify-between border-b border-slate-200 px-5 py-3">
        <h2 className="text-sm font-semibold text-slate-700">{t("nav.items.hostsystem-snapshots")}</h2>
        <Button variant="outline" disabled={readOnly || data?.supported === false} onClick={() => setShowCreate(true)}>
          <Plus size={16} />
          {t("hostsystem.snapshots.create")}
        </Button>
      </div>
      {error && <p className="px-5 py-3 text-sm text-red-600">{error}</p>}
      {!data && !error && <p className="px-5 py-4 text-sm text-slate-500">{t("common.loading")}</p>}
      {data && !data.supported && <p className="px-5 py-4 text-sm text-slate-500">{t("hostsystem.snapshots.unsupported")}</p>}
      {data && data.supported && (
        <Table>
          <THead>
            <TRow>
              <TH>{t("hostsystem.snapshots.name")}</TH>
              <TH>{t("hostsystem.snapshots.state")}</TH>
              <TH>{t("hostsystem.snapshots.size")}</TH>
              <TH>{t("hostsystem.snapshots.createdAt")}</TH>
              <TH><span className="sr-only">{t("common.actions")}</span></TH>
            </TRow>
          </THead>
          <TBody>
            {data.rows.map((row) => (
              <TRow key={row.uuid}>
                <TD className="font-mono text-xs">{row.name}</TD>
                <TD>{row.active.includes("N") ? t("hostsystem.snapshots.activeNow") : row.active.includes("R") ? t("hostsystem.snapshots.activeNext") : "–"}</TD>
                <TD>{row.size || "–"}</TD>
                <TD>{row.created || "–"}</TD>
                <TD>
                  <fieldset disabled={readOnly} className="contents">
                    <div className="flex justify-end">
                      {(row.active === "-" || row.active === "") && (
                        <Button variant="dangerSubtle" aria-label={t("network.rowDelete")} onClick={() => remove(row)}>
                          <Trash2 size={14} />
                        </Button>
                      )}
                    </div>
                  </fieldset>
                </TD>
              </TRow>
            ))}
          </TBody>
        </Table>
      )}
      {showCreate && (
        <Modal title={t("hostsystem.snapshots.create")} onClose={() => setShowCreate(false)}>
          <form onSubmit={create} className="space-y-4">
            <p className="text-sm text-slate-600">{t("hostsystem.snapshots.createHint")}</p>
            <FieldGroup label={t("hostsystem.snapshots.name")} hint={t("hostsystem.snapshots.nameHint")}>
              <Input required value={name} onChange={(e) => setName(e.target.value)} pattern="[A-Za-z0-9][A-Za-z0-9._\-]{0,63}" autoComplete="off" />
            </FieldGroup>
            <FieldGroup label={t("hostsystem.snapshots.note")}>
              <Input value={note} onChange={(e) => setNote(e.target.value)} maxLength={200} />
            </FieldGroup>
            {formError && <p role="alert" className="text-sm text-red-600">{formError}</p>}
            <div className="flex justify-end gap-2">
              <Button type="button" variant="ghost" onClick={() => setShowCreate(false)}>{t("common.cancel")}</Button>
              <Button type="submit" disabled={busy} loading={busy}>{t("hostsystem.snapshots.create")}</Button>
            </div>
          </form>
        </Modal>
      )}
    </div>
  );
 }
@@ -7,6 +7,8 @@ import { EmptyState } from "@/components/ui/EmptyState";
 import { Skeleton } from "@/components/ui/Skeleton";
 import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
 import { NetworkChangeModal } from "@/components/NetworkChangeModal";
 import { NetworkCompare } from "@/components/NetworkCompare";
 import { NetworkObjectSection } from "@/components/NetworkObjectSection";
 import { Button } from "@/components/ui/Button";
 import { api, Host, HostNetwork, NetworkAction, NetworkKind } from "@/lib/api";
 import { useReadOnly } from "@/lib/useReadOnly";
@@ -14,12 +16,28 @@ import { AlertTriangle, Cable, Pencil, Plus, Trash2 } from "lucide-react";
 import { useParams } from "next/navigation";
 import { useEffect, useRef, useState } from "react";
-type Section = "interfaces" | "vlans" | "vips" | "gateways" | "routes" | "dns" | "dhcp";
+type Section = "interfaces" | "vlans" | "vips" | "gateways" | "routes" | "dns" | "dhcp" | "devices" | "compare";
-type Change = { kind: NetworkKind; action: NetworkAction; uuid?: string; preset?: Record<string, string> };
+// hostId/hostName are set when the dialog targets another node than the one on screen (transfer to a cluster partner).
 type Change = { kind: NetworkKind; action: NetworkAction; uuid?: string; preset?: Record<string, string>; hostId?: string; hostName?: string };
 type OpenChange = (change: Change) => void;
 const HOST_KEY = "opnexus-network-host";
 // Extra generic object lists shown below the main table of a page (and the whole "devices" page).
 const EXTRA_SECTIONS: Partial<Record<Section, { kind: NetworkKind; titleKey: string }[]>> = {
  gateways: [{ kind: "gateway_group", titleKey: "network.kinds.gateway_group" }],
  dns: [{ kind: "dns_forward", titleKey: "network.kinds.dns_forward" }],
  dhcp: [{ kind: "dhcp_range", titleKey: "network.kinds.dhcp_range" }],
  devices: [
    { kind: "lagg", titleKey: "network.kinds.lagg" },
    { kind: "bridge", titleKey: "network.kinds.bridge" },
    { kind: "loopback", titleKey: "network.kinds.loopback" },
    { kind: "gre", titleKey: "network.kinds.gre" },
    { kind: "gif", titleKey: "network.kinds.gif" },
    { kind: "vxlan", titleKey: "network.kinds.vxlan" },
  ],
 };
 const SECTION_KIND: Partial<Record<Section, NetworkKind>> = { interfaces: "interface", vlans: "vlan", vips: "vip", gateways: "gateway", routes: "route", dns: "dns_host" };
 function statusTone(status: string): BadgeTone {
@@ -37,7 +55,7 @@ export default function NetworkPage() {
  const [error, setError] = useState<string | null>(null);
  // The sub-navigation in the header picks the section; the path is the single source of truth.
  const { tab } = useParams<{ tab: string }>();
-  const section: Section = (["interfaces", "vlans", "vips", "gateways", "routes", "dns", "dhcp"].includes(tab) ? tab : "interfaces") as Section;
+  const section: Section = (["interfaces", "vlans", "vips", "gateways", "routes", "dns", "dhcp", "devices", "compare"].includes(tab) ? tab : "interfaces") as Section;
  const [change, setChange] = useState<Change | null>(null);
  const readOnly = useReadOnly();
  const [reloadKey, setReloadKey] = useState(0);
@@ -57,7 +75,7 @@ export default function NetworkPage() {
  }, [errorMessage]);
  useEffect(() => {
-    if (!hostId) return;
+    if (!hostId || section === "compare") return;
    let cancelled = false;
    setError(null);
    // Switching host clears the view; a reload after a change keeps it so an open dialog is not torn down.
@@ -72,7 +90,23 @@ export default function NetworkPage() {
    return () => {
      cancelled = true;
    };
-  }, [hostId, errorMessage, reloadKey]);
+  }, [hostId, errorMessage, reloadKey, section]);
  if (section === "compare") {
    return (
      <div>
        <h1 className="mb-6 text-2xl font-semibold text-slate-900">{t("nav.items.network-compare")}</h1>
        <NetworkCompare />
      </div>
    );
  }
  const modalHostId = change?.hostId ?? hostId;
  const modalHost = hosts?.find((h) => h.id === modalHostId);
  const current = hosts?.find((h) => h.id === modalHostId);
  const peers = current?.cluster_name
    ? (hosts ?? []).filter((h) => h.cluster_name === current.cluster_name && h.id !== current.id).map((h) => ({ id: h.id, name: h.name }))
    : [];
  if (hosts && hosts.length === 0) {
    return (
@@ -134,13 +168,29 @@ export default function NetworkPage() {
              {section === "dns" && <DnsTable network={network} onChange={setChange} />}
              {section === "dhcp" && <DhcpSections network={network} onChange={setChange} />}
            </fieldset>
            {(EXTRA_SECTIONS[section] ?? []).map((extra) => (
              <NetworkObjectSection
                key={extra.kind}
                hostId={hostId}
                kind={extra.kind}
                title={t(extra.titleKey)}
                reloadKey={reloadKey}
                readOnly={readOnly}
                onChange={setChange}
              />
            ))}
          </Card>
        </>
      )}
      {change && (
        <NetworkChangeModal
-          hostId={hostId}
+          key={`${modalHostId}:${change.kind}:${change.action}:${change.uuid ?? ""}`}
-          hostName={hosts?.find((h) => h.id === hostId)?.name ?? ""}
+          hostId={modalHostId}
          hostName={modalHost?.name ?? ""}
          peers={peers}
          onTransfer={(peer, fields) =>
            setChange({ kind: change.kind, action: "add", preset: fields, hostId: peer.id, hostName: peer.name })
          }
          kind={change.kind}
          action={change.action}
          uuid={change.uuid}
@@ -1,5 +1,6 @@
 "use client";
 import { TwoFactorSection } from "@/components/TwoFactorSection";
 import { OpnexusUpdateSection } from "@/components/OpnexusUpdateSection";
 import { InfoTip, Tooltip } from "@/components/ui/Tooltip";
 import { useEffect, useState } from "react";
 import { api, AppSettings, LogSettings, NotificationSettings, SmtpSecurity, Theme } from "@/lib/api";
@@ -11,6 +12,21 @@ import { useReadOnly } from "@/lib/useReadOnly";
 import { APP_CODENAME, APP_MAINTAINER, APP_VERSION } from "@/lib/version";
 import { translate } from "@/lib/i18n";
 function SetupAssistantSection() {
  const { t } = useLanguage();
  const readOnly = useReadOnly();
  if (readOnly) return null;
  return (
    <section className="flex flex-wrap items-center justify-between gap-3 rounded-xl border border-slate-200 bg-white p-5">
      <div>
        <h2 className="text-lg font-medium">{t("settings.setup.title")}</h2>
        <p className="mt-1 text-sm text-slate-600">{t("settings.setup.intro")}</p>
      </div>
      <Button href="/setup" variant="outline">{t("settings.setup.open")}</Button>
    </section>
  );
 }
 function NotificationsSection() {
  const { t, errorMessage } = useLanguage();
  const readOnly = useReadOnly();
@@ -42,6 +58,7 @@ function NotificationsSection() {
  const [maintenanceUnknown, setMaintenanceUnknown] = useState(true);
  const [carpHealth, setCarpHealth] = useState(true);
  const [natDrift, setNatDrift] = useState(true);
  const [networkDrift, setNetworkDrift] = useState(true);
  const [carpAutoRevertFailed, setCarpAutoRevertFailed] = useState(true);
  const [pollInterval, setPollInterval] = useState(300);
@@ -63,6 +80,7 @@ function NotificationsSection() {
    setMaintenanceUnknown(data.maintenance_unknown_enabled);
    setCarpHealth(data.carp_health_enabled);
    setNatDrift(data.nat_drift_enabled);
    setNetworkDrift(data.network_drift_enabled);
    setCarpAutoRevertFailed(data.carp_auto_revert_failed_enabled);
    setPollInterval(data.poll_interval_seconds);
    setWebhookSecret("");
@@ -102,6 +120,7 @@ function NotificationsSection() {
        maintenance_unknown_enabled: maintenanceUnknown,
        carp_health_enabled: carpHealth,
        nat_drift_enabled: natDrift,
        network_drift_enabled: networkDrift,
        carp_auto_revert_failed_enabled: carpAutoRevertFailed,
        poll_interval_seconds: pollInterval,
      });
@@ -129,7 +148,7 @@ function NotificationsSection() {
  }
  return (
-    <section className="space-y-5 rounded-xl border border-slate-200 bg-white p-5">
+    <section id="notifications" className="scroll-mt-4 space-y-5 rounded-xl border border-slate-200 bg-white p-5">
      <h2 className="flex items-center gap-2 text-lg font-medium">{t("settings.notify.title")}<InfoTip text={t("settings.notify.intro", { seconds: pollInterval })} /></h2>
      <form onSubmit={save} className="space-y-5">
@@ -232,6 +251,7 @@ function NotificationsSection() {
            [t("settings.notify.event.maintenanceUnknown"), maintenanceUnknown, setMaintenanceUnknown],
            [t("settings.notify.event.carpHealth"), carpHealth, setCarpHealth],
            [t("settings.notify.event.natDrift"), natDrift, setNatDrift],
            [t("settings.notify.event.networkDrift"), networkDrift, setNetworkDrift],
            [t("settings.notify.event.carpAutoRevertFailed"), carpAutoRevertFailed, setCarpAutoRevertFailed],
          ].map(([label, value, setter]) => (
            <label key={label as string} className="flex items-center gap-2 text-sm">
@@ -372,5 +392,5 @@ export default function SettingsPage(){
  async function saveTheme(value:Theme){setSaving(true);setError('');setNotice('');const old=theme;setTheme(value);try{setSettings(await api.saveSettings({theme:value,language}));setNotice(t('settings.appearanceSaved'));}catch(e){setTheme(old);setError(errorMessage(e));}finally{setSaving(false);}}
  async function saveLanguage(value:"de"|"en"){setSaving(true);setError('');setNotice('');const old=language;setLanguage(value);try{setSettings(await api.saveSettings({theme,language:value}));setNotice(translate(value,'settings.language.saved'));}catch(e){setLanguage(old);setError(errorMessage(e));}finally{setSaving(false);}}
  async function changePassword(e:React.FormEvent){e.preventDefault();setError('');setNotice('');if(password!==repeat){setError(t('settings.passwordMismatch'));return;}setSaving(true);try{await api.changePassword(current,password);setCurrent('');setPassword('');setRepeat('');setNotice(t('settings.passwordChanged'));}catch(e){setError(errorMessage(e,'settings.passwordFailed'));}finally{setSaving(false);}}
-  return <div className="mx-auto max-w-3xl space-y-6"><h1 className="text-2xl font-semibold">{t("settings.title")}</h1>{error && <p role="alert" className="rounded-lg bg-red-50 p-3 text-sm text-red-700">{error}</p>}{notice && <p role="status" className="text-sm text-emerald-700">{notice}</p>}<section className="space-y-4 rounded-xl border border-slate-200 bg-white p-5"><h2 className="flex items-center gap-2 text-lg font-medium">{t('settings.appearance')}<InfoTip text={t('settings.appearanceHint')} /></h2><div role="radiogroup" aria-label={t('settings.colorScheme')} className="flex flex-wrap gap-3">{(['light','dark','system'] as const).map((v)=><label key={v} className={`flex cursor-pointer items-center gap-2 rounded-lg border px-4 py-3 text-sm ${theme===v?'border-sky-500 bg-sky-50 text-sky-700':'border-slate-200'}`}><input type="radio" name="theme" checked={theme===v} disabled={saving || !settings} onChange={()=>saveTheme(v)}/>{t(`settings.theme.${v}`)}</label>)}</div></section><section className="space-y-4 rounded-xl border border-slate-200 bg-white p-5"><h2 className="text-lg font-medium">{t('settings.language.label')}</h2><div role="radiogroup" aria-label={t('settings.language.label')} className="flex flex-wrap gap-3">{(['de','en'] as const).map(value=><label key={value} className={`flex cursor-pointer items-center gap-2 rounded-lg border px-4 py-3 text-sm ${language===value?'border-sky-500 bg-sky-50 text-sky-700':'border-slate-200'}`}><input type="radio" name="language" checked={language===value} disabled={saving || !settings} onChange={()=>saveLanguage(value)}/>{t(`settings.language.${value}`)}</label>)}</div></section><section className="space-y-4 rounded-xl border border-slate-200 bg-white p-5"><h2 className="text-lg font-medium">{t('settings.account')} {settings?.username ? `· ${settings.username}`:''}</h2><form onSubmit={changePassword} className="space-y-4"><label className="block text-sm"><span className="mb-1 block font-medium text-slate-700">{t('settings.currentPassword')}</span><Input aria-label={t('settings.currentPassword')} type="password" autoComplete="current-password" required value={current} onChange={e=>setCurrent(e.target.value)}/></label><label className="block text-sm"><span className="mb-1 block font-medium text-slate-700">{t('settings.newPassword')}</span><Input aria-label={t('settings.newPassword')} type="password" autoComplete="new-password" minLength={10} maxLength={1024} required value={password} onChange={e=>setPassword(e.target.value)}/></label><label className="block text-sm"><span className="mb-1 block font-medium text-slate-700">{t('settings.repeatPassword')}</span><Input aria-label={t('settings.repeatPassword')} type="password" autoComplete="new-password" minLength={10} required value={repeat} onChange={e=>setRepeat(e.target.value)}/></label><Button type="submit" disabled={saving}>{t('settings.changePassword')}</Button></form></section><section className="space-y-3 rounded-xl border border-slate-200 bg-white p-5"><h2 className="flex items-center gap-2 text-lg font-medium">{t('settings.operational')}<InfoTip text={t('settings.serverManaged')} /></h2>{settings?<dl className="grid grid-cols-2 gap-3 text-sm"><dt>{t('settings.deployWindow')}</dt><dd>{t('settings.seconds',{n:settings.deploy_confirm_window_seconds})}</dd><dt>{t('settings.sessionLifetime')}</dt><dd>{t('settings.days',{n:Math.round(settings.session_lifetime_seconds/86400)})}</dd></dl>:<p className="text-sm text-slate-500">{t('common.loading')}</p>}</section><TwoFactorSection/><NotificationsSection/><LogIngestSection/><section className="space-y-2 rounded-xl border border-slate-200 bg-white p-5"><h2 className="flex items-center gap-2 text-lg font-medium">{t('settings.about')}<InfoTip text={t('settings.changelogNote',{file:'CHANGELOG.md'})} /></h2><dl className="grid grid-cols-2 gap-3 text-sm"><dt>{t('settings.version')}</dt><dd>{APP_VERSION} {language==='en'?'“':'„'}{APP_CODENAME}{language==='en'?'”':'“'}</dd><dt>{t('settings.development')}</dt><dd>{APP_MAINTAINER}</dd></dl></section></div>;
+  return <div className="mx-auto max-w-3xl space-y-6"><h1 className="text-2xl font-semibold">{t("settings.title")}</h1>{error && <p role="alert" className="rounded-lg bg-red-50 p-3 text-sm text-red-700">{error}</p>}{notice && <p role="status" className="text-sm text-emerald-700">{notice}</p>}<section className="space-y-4 rounded-xl border border-slate-200 bg-white p-5"><h2 className="flex items-center gap-2 text-lg font-medium">{t('settings.appearance')}<InfoTip text={t('settings.appearanceHint')} /></h2><div role="radiogroup" aria-label={t('settings.colorScheme')} className="flex flex-wrap gap-3">{(['light','dark','system'] as const).map((v)=><label key={v} className={`flex cursor-pointer items-center gap-2 rounded-lg border px-4 py-3 text-sm ${theme===v?'border-sky-500 bg-sky-50 text-sky-700':'border-slate-200'}`}><input type="radio" name="theme" checked={theme===v} disabled={saving || !settings} onChange={()=>saveTheme(v)}/>{t(`settings.theme.${v}`)}</label>)}</div></section><section className="space-y-4 rounded-xl border border-slate-200 bg-white p-5"><h2 className="text-lg font-medium">{t('settings.language.label')}</h2><div role="radiogroup" aria-label={t('settings.language.label')} className="flex flex-wrap gap-3">{(['de','en'] as const).map(value=><label key={value} className={`flex cursor-pointer items-center gap-2 rounded-lg border px-4 py-3 text-sm ${language===value?'border-sky-500 bg-sky-50 text-sky-700':'border-slate-200'}`}><input type="radio" name="language" checked={language===value} disabled={saving || !settings} onChange={()=>saveLanguage(value)}/>{t(`settings.language.${value}`)}</label>)}</div></section><section className="space-y-4 rounded-xl border border-slate-200 bg-white p-5"><h2 className="text-lg font-medium">{t('settings.account')} {settings?.username ? `· ${settings.username}`:''}</h2><form onSubmit={changePassword} className="space-y-4"><label className="block text-sm"><span className="mb-1 block font-medium text-slate-700">{t('settings.currentPassword')}</span><Input aria-label={t('settings.currentPassword')} type="password" autoComplete="current-password" required value={current} onChange={e=>setCurrent(e.target.value)}/></label><label className="block text-sm"><span className="mb-1 block font-medium text-slate-700">{t('settings.newPassword')}</span><Input aria-label={t('settings.newPassword')} type="password" autoComplete="new-password" minLength={10} maxLength={1024} required value={password} onChange={e=>setPassword(e.target.value)}/></label><label className="block text-sm"><span className="mb-1 block font-medium text-slate-700">{t('settings.repeatPassword')}</span><Input aria-label={t('settings.repeatPassword')} type="password" autoComplete="new-password" minLength={10} required value={repeat} onChange={e=>setRepeat(e.target.value)}/></label><Button type="submit" disabled={saving}>{t('settings.changePassword')}</Button></form></section><section className="space-y-3 rounded-xl border border-slate-200 bg-white p-5"><h2 className="flex items-center gap-2 text-lg font-medium">{t('settings.operational')}<InfoTip text={t('settings.serverManaged')} /></h2>{settings?<dl className="grid grid-cols-2 gap-3 text-sm"><dt>{t('settings.deployWindow')}</dt><dd>{t('settings.seconds',{n:settings.deploy_confirm_window_seconds})}</dd><dt>{t('settings.sessionLifetime')}</dt><dd>{t('settings.days',{n:Math.round(settings.session_lifetime_seconds/86400)})}</dd></dl>:<p className="text-sm text-slate-500">{t('common.loading')}</p>}</section><SetupAssistantSection/><TwoFactorSection/><NotificationsSection/><LogIngestSection/><OpnexusUpdateSection/><section className="space-y-2 rounded-xl border border-slate-200 bg-white p-5"><h2 className="flex items-center gap-2 text-lg font-medium">{t('settings.about')}<InfoTip text={t('settings.changelogNote',{file:'CHANGELOG.md'})} /></h2><dl className="grid grid-cols-2 gap-3 text-sm"><dt>{t('settings.version')}</dt><dd>{APP_VERSION} {language==='en'?'“':'„'}{APP_CODENAME}{language==='en'?'”':'“'}</dd><dt>{t('settings.development')}</dt><dd>{APP_MAINTAINER}</dd></dl></section></div>;
 }
@@ -0,0 +1,7 @@
 "use client";
 import { SetupWizard } from "@/components/SetupWizard";
 export default function SetupPage() {
  return <SetupWizard />;
 }
@@ -10,7 +10,7 @@ import { APP_CODENAME, APP_VERSION } from "@/lib/version";
 import Link from "next/link";
 import { usePathname, useRouter } from "next/navigation";
 import { ReactNode, useEffect, useState } from "react";
-import { navGroups, navLabelKey } from "@/components/Nav";
+import { matchesNav, navGroups, navLabelKey } from "@/components/Nav";
 /**
 * Single-role auth guard — there's exactly one protected "area" (everything
@@ -40,7 +40,7 @@ export function AuthGate({ children }: { children: ReactNode }) {
  // The app is a client-rendered SPA with one static metadata title; screen reader users rely on
  // the title (and its change) to know a navigation happened and where they are. A rendered
  // <title> is hoisted into <head> by React 19 and wins over the static metadata one.
-  const item = navGroups.flatMap((g) => g.items).find((i) => pathname?.startsWith(i.href));
+  const item = navGroups.flatMap((g) => g.items).find((i) => matchesNav(pathname, i.href));
  const pageName = item ? t(navLabelKey(item.href)) : pathname === "/login" ? t("login.signIn") : pathname?.startsWith("/about") ? t("settings.about") : null;
  const title = <title>{pageName ? pageName.includes("OPNexus") ? pageName : `${pageName} · OPNexus` : "OPNexus"}</title>;
@@ -0,0 +1,185 @@
 "use client";
 import { useLanguage } from "@/components/LanguageProvider";
 import { Badge } from "@/components/ui/Badge";
 import { Button } from "@/components/ui/Button";
 import { FieldGroup, Input, Select } from "@/components/ui/Field";
 import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
 import { Tabs } from "@/components/ui/Tabs";
 import { api, DnsLookupResult, PingResult, PortprobeResult, TracerouteResult } from "@/lib/api";
 import { useState } from "react";
 type Tool = "ping" | "traceroute" | "portprobe" | "dns";
 type Result = { tool: "ping"; data: PingResult } | { tool: "traceroute"; data: TracerouteResult } | { tool: "portprobe"; data: PortprobeResult } | { tool: "dns"; data: DnsLookupResult };
 /**
 * Network probes run FROM the selected firewall. Results are only shown, never stored; every run is
 * recorded in the audit log by the backend (target and tool).
 */
 export function HostDiagnostics({ hostId, readOnly }: { hostId: string; readOnly: boolean }) {
  const { t, errorMessage } = useLanguage();
  const [tool, setTool] = useState<Tool>("ping");
  const [target, setTarget] = useState("");
  const [ipproto, setIpproto] = useState("inet");
  const [source, setSource] = useState("");
  const [count, setCount] = useState("4");
  const [packetsize, setPacketsize] = useState("");
  const [protocol, setProtocol] = useState("icmp");
  const [port, setPort] = useState("443");
  const [server, setServer] = useState("");
  const [running, setRunning] = useState(false);
  const [error, setError] = useState<string | null>(null);
  const [result, setResult] = useState<Result | null>(null);
  async function run(e: React.FormEvent) {
    e.preventDefault();
    setRunning(true);
    setError(null);
    setResult(null);
    try {
      const src = source.trim() || undefined;
      if (tool === "ping")
        setResult({ tool, data: await api.runPing(hostId, { target: target.trim(), ipproto, count: Number(count), packetsize: packetsize ? Number(packetsize) : null, source: src }) });
      else if (tool === "traceroute") setResult({ tool, data: await api.runTraceroute(hostId, { target: target.trim(), ipproto, protocol, source: src }) });
      else if (tool === "portprobe") setResult({ tool, data: await api.runPortprobe(hostId, { target: target.trim(), port: Number(port), ipproto, source: src }) });
      else setResult({ tool, data: await api.runDnsLookup(hostId, { name: target.trim(), server: server.trim() || undefined }) });
    } catch (err) {
      setError(errorMessage(err, "hostsystem.diag.failed"));
    } finally {
      setRunning(false);
    }
  }
  const tabs = (["ping", "traceroute", "portprobe", "dns"] as Tool[]).map((k) => ({ key: k, label: t(`hostsystem.diag.tools.${k}`) }));
  return (
    <div>
      <Tabs items={tabs} active={tool} onChange={(k) => { setTool(k as Tool); setResult(null); setError(null); }} className="overflow-x-auto px-3 [&>button]:whitespace-nowrap" />
      <form onSubmit={run} className="space-y-4 p-5">
        <fieldset disabled={readOnly} className="contents">
          <div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
            <FieldGroup label={tool === "dns" ? t("hostsystem.diag.name") : t("hostsystem.diag.target")}>
              <Input required value={target} onChange={(e) => setTarget(e.target.value)} autoComplete="off" placeholder={tool === "dns" ? "example.com" : "192.0.2.1"} />
            </FieldGroup>
            {tool === "portprobe" && (
              <FieldGroup label={t("hostsystem.diag.port")}>
                <Input required type="number" min={1} max={65535} value={port} onChange={(e) => setPort(e.target.value)} />
              </FieldGroup>
            )}
            {tool === "ping" && (
              <FieldGroup label={t("hostsystem.diag.count")}>
                <Input required type="number" min={1} max={10} value={count} onChange={(e) => setCount(e.target.value)} />
              </FieldGroup>
            )}
            {tool === "traceroute" && (
              <FieldGroup label={t("hostsystem.diag.protocol")}>
                <Select value={protocol} onChange={(e) => setProtocol(e.target.value)}>
                  <option value="icmp">ICMP</option>
                  <option value="udp">UDP</option>
                </Select>
              </FieldGroup>
            )}
            {tool === "dns" ? (
              <FieldGroup label={t("hostsystem.diag.server")} hint={t("hostsystem.diag.serverHint")}>
                <Input value={server} onChange={(e) => setServer(e.target.value)} autoComplete="off" />
              </FieldGroup>
            ) : (
              <>
                <FieldGroup label={t("hostsystem.diag.ipproto")}>
                  <Select value={ipproto} onChange={(e) => setIpproto(e.target.value)}>
                    <option value="inet">IPv4</option>
                    <option value="inet6">IPv6</option>
                  </Select>
                </FieldGroup>
                <FieldGroup label={t("hostsystem.diag.source")} hint={t("hostsystem.diag.sourceHint")}>
                  <Input value={source} onChange={(e) => setSource(e.target.value)} autoComplete="off" />
                </FieldGroup>
              </>
            )}
            {tool === "ping" && (
              <FieldGroup label={t("hostsystem.diag.packetsize")}>
                <Input type="number" min={1} max={9000} value={packetsize} onChange={(e) => setPacketsize(e.target.value)} />
              </FieldGroup>
            )}
          </div>
          <div className="flex items-center gap-3">
            <Button type="submit" disabled={running || !target.trim()} loading={running}>
              {running ? t("hostsystem.diag.running") : t("hostsystem.diag.run")}
            </Button>
            <span className="text-xs text-slate-500">{t("hostsystem.diag.auditNote")}</span>
          </div>
        </fieldset>
      </form>
      {error && <p role="alert" className="px-5 pb-4 text-sm text-red-600">{error}</p>}
      {result && (
        <div className="border-t border-slate-200 px-5 py-4" aria-live="polite">
          {result.tool === "ping" && <PingView r={result.data} />}
          {result.tool === "traceroute" && <TracerouteView r={result.data} />}
          {result.tool === "portprobe" && <PortView r={result.data} />}
          {result.tool === "dns" && <DnsView r={result.data} />}
        </div>
      )}
    </div>
  );
 }
 function PingView({ r }: { r: PingResult }) {
  const { t } = useLanguage();
  const ok = r.received > 0;
  const ms = (v: number | null) => (v === null || v === undefined ? "–" : `${v} ms`);
  return (
    <div className="space-y-2 text-sm">
      <Badge tone={ok ? "success" : "danger"}>{ok ? t("hostsystem.diag.reachable") : t("hostsystem.diag.unreachable")}</Badge>
      <p>{t("hostsystem.diag.pingSummary", { sent: r.sent, received: r.received, loss: r.loss })}</p>
      <p className="font-mono text-xs text-slate-600">min {ms(r.min)} · avg {ms(r.avg)} · max {ms(r.max)} · σ {ms(r.stddev)}</p>
      {r.error && <p className="text-amber-700">{r.error}</p>}
    </div>
  );
 }
 function TracerouteView({ r }: { r: TracerouteResult }) {
  const { t } = useLanguage();
  return (
    <div className="space-y-2">
      <p className="font-mono text-xs text-slate-600">{r.notice}</p>
      {r.hops.length === 0 ? <p className="text-sm text-slate-500">{t("network.empty")}</p> : (
        <Table>
          <THead><TRow><TH>{t("hostsystem.diag.hop")}</TH><TH>{t("network.col.address")}</TH><TH>{t("hostsystem.diag.hostname")}</TH><TH>AS</TH><TH>{t("hostsystem.diag.time")}</TH></TRow></THead>
          <TBody>
            {r.hops.map((h) => (
              <TRow key={h.ttl + h.address}><TD>{h.ttl}</TD><TD className="font-mono text-xs">{h.address || "*"}</TD><TD className="font-mono text-xs">{h.host}</TD><TD>{h.as}</TD><TD className="font-mono text-xs">{h.probes}</TD></TRow>
            ))}
          </TBody>
        </Table>
      )}
    </div>
  );
 }
 function PortView({ r }: { r: PortprobeResult }) {
  const { t } = useLanguage();
  return (
    <div className="space-y-2 text-sm">
      <Badge tone={r.open ? "success" : "danger"}>{r.open ? t("hostsystem.diag.open", { port: r.port }) : t("hostsystem.diag.closed", { port: r.port })}</Badge>
      <p className="font-mono text-xs text-slate-600">{r.message}</p>
    </div>
  );
 }
 function DnsView({ r }: { r: DnsLookupResult }) {
  const { t } = useLanguage();
  const types = Object.keys(r.records);
  if (types.length === 0) return <p className="text-sm text-slate-500">{t("hostsystem.diag.noRecords", { name: r.name })}</p>;
  return (
    <div className="space-y-3">
      {types.map((type) => (
        <div key={type}>
          <p className="text-sm font-medium">{type} <span className="font-normal text-slate-500">· {r.records[type].server} · {r.records[type].query_time}</span></p>
          <ul className="font-mono text-xs text-slate-700">
            {r.records[type].answers.map((a, i) => (<li key={i}>{a.replace(/\t/g, "  ")}</li>))}
          </ul>
        </div>
      ))}
    </div>
  );
 }
@@ -8,9 +8,17 @@ import {
  FolderTree,
  Globe,
  GitBranch,
  HardDrive,
  Activity,
  Clock,
  Camera,
  Sliders,
  GitCompare,
  Boxes,
  KeyRound,
  LayoutDashboard,
  Layers,
  ListChecks,
  LogOut,
  Network,
  RefreshCw,
@@ -74,7 +82,21 @@ export const navGroups: NavGroup[] = [
      { href: "/network/gateways", label: "Gateways", icon: Router, keywords: ["Standard-Gateway", "Uplink"] },
      { href: "/network/routes", label: "Routen", icon: Route, keywords: ["Routing", "Statische Routen"] },
      { href: "/network/dns", label: "DNS", icon: Globe, keywords: ["Unbound", "Host-Override", "Hostnamen"] },
-      { href: "/network/dhcp", label: "DHCP", icon: Server, keywords: ["Kea", "dnsmasq", "Reservierung", "Statische Zuweisung", "Subnetz"] },
+      { href: "/network/dhcp", label: "DHCP", icon: Server, keywords: ["Kea", "dnsmasq", "Reservierung", "Statische Zuweisung", "Subnetz", "Bereich", "Range"] },
      { href: "/network/devices", label: "Geräte", icon: Boxes, keywords: ["LAGG", "Link Aggregation", "Bridge", "Brücke", "Loopback", "GRE", "Tunnel"] },
      { href: "/network/compare", label: "Abgleich", icon: GitCompare, keywords: ["Vergleich", "Cluster", "HA", "Abweichung", "Drift", "Unterschiede"] },
    ],
  },
  {
    key: "hostsystem",
    label: "Host-System",
    icon: HardDrive,
    items: [
      { href: "/hostsystem/tunables", label: "Tunables", icon: Sliders, keywords: ["sysctl", "Kernel", "kTLS", "Systemparameter"] },
      { href: "/hostsystem/cron", label: "Cron", icon: Clock, keywords: ["Zeitplan", "Aufgaben", "Jobs", "geplante Aufgaben"] },
      { href: "/hostsystem/syslog", label: "Syslog", icon: ScrollText, keywords: ["Remote-Logging", "Log-Ziel", "Logserver"] },
      { href: "/hostsystem/snapshots", label: "Snapshots", icon: Camera, keywords: ["ZFS", "Boot-Umgebung", "Sicherung vor Änderung"] },
      { href: "/hostsystem/diagnostics", label: "Diagnose", icon: Activity, keywords: ["Ping", "Traceroute", "Port prüfen", "Portprobe", "DNS-Abfrage", "Erreichbarkeit", "Fehlersuche"] },
    ],
  },
  {
@@ -141,6 +163,12 @@ export const navGroups: NavGroup[] = [
        icon: Users,
        keywords: ["User", "Accounts", "Rollen", "Rechte", "Read-Only", "Nur-Lesen", "Admin-Rolle", "Passwort zurücksetzen"],
      },
      {
        href: "/setup",
        label: "Einrichtung",
        icon: ListChecks,
        keywords: ["Assistent", "Wizard", "Setup", "Erste Schritte", "Onboarding", "Firewall verbinden", "API-Key", "Einführung"],
      },
    ],
  },
 ];
@@ -150,13 +178,18 @@ export function navLabelKey(href: string): string {
  return `nav.items.${href.slice(1).replace(/\//g, "-")}`;
 }
 /** True when pathname is the nav item's page or below it ("/hostsystem/x" must NOT match "/hosts"). */
 export function matchesNav(pathname: string | null | undefined, href: string): boolean {
  return !!pathname && (pathname === href || pathname.startsWith(href + "/"));
 }
 export function Nav() {
  const { t } = useLanguage();
  const pathname = usePathname();
  const router = useRouter();
  const [readOnly, setReadOnly] = useState(false);
-  const activeGroup = navGroups.find((g) => g.items.some((i) => pathname?.startsWith(i.href))) ?? null;
+  const activeGroup = navGroups.find((g) => g.items.some((i) => matchesNav(pathname, i.href))) ?? null;
  useEffect(() => {
    api.me().then((state) => setReadOnly(state.role === "read_only")).catch(() => {});
@@ -169,11 +202,11 @@ export function Nav() {
  return (
    <header className="border-b border-slate-200 bg-white">
-      <div className="mx-auto flex max-w-6xl flex-wrap items-center gap-x-4 gap-y-2 px-3 py-3 sm:px-6">
+      <div className="mx-auto flex max-w-6xl flex-wrap items-center gap-x-3 gap-y-2 px-3 py-3 sm:px-6">
        <Link href="/about" title={t("nav.aboutTitle")} className="shrink-0">
          <Logo className="h-6 w-auto sm:h-7" />
        </Link>
-        <nav aria-label={t("nav.mainNavigation")} className="order-3 flex w-full min-w-0 gap-0.5 overflow-x-auto sm:order-none sm:w-auto sm:gap-1">
+        <nav aria-label={t("nav.mainNavigation")} className="order-3 flex w-full min-w-0 gap-0.5 overflow-x-auto sm:order-none sm:w-auto">
          {navGroups.map(({ key, icon: Icon, items }) => {
            const active = activeGroup?.key === key;
            return (
@@ -184,12 +217,12 @@ export function Nav() {
                aria-label={t(`nav.groups.${key}`)}
                aria-current={active ? "true" : undefined}
                className={clsx(
-                  "flex shrink-0 items-center gap-2 rounded-lg px-2.5 py-1.5 text-sm font-medium transition-colors sm:px-3",
+                  "flex shrink-0 items-center gap-1.5 rounded-lg px-2 py-1.5 text-sm font-medium transition-colors",
                  active ? "bg-brand-50 text-brand-600" : "text-slate-600 hover:bg-slate-100"
                )}
              >
                <Icon size={16} aria-hidden="true" />
-                <span className="hidden sm:inline">{t(`nav.groups.${key}`)}</span>
+                <span className="hidden min-[1150px]:inline">{t(`nav.groups.${key}`)}</span>
              </Link>
            );
          })}
@@ -227,7 +260,7 @@ export function Nav() {
        <div className="border-t border-slate-100 bg-slate-50">
          <nav aria-label={t("nav.subNavigation")} className="mx-auto flex max-w-6xl items-center gap-0.5 overflow-x-auto px-3 py-1.5 sm:px-6 sm:gap-1">
            {activeGroup.items.map(({ href, icon: Icon }) => {
-              const active = pathname?.startsWith(href);
+              const active = matchesNav(pathname, href);
              return (
                <Link
                  key={href}
@@ -114,6 +114,110 @@ const FIELDS: Record<NetworkKind, FieldDef[]> = {
    { name: "next_server", type: "text" },
    { name: "description", type: "text" },
  ],
  tunable: [
    { name: "tunable", type: "text" },
    { name: "value", type: "text" },
    { name: "descr", type: "text" },
  ],
  cron_job: [
    { name: "enabled", type: "check" },
    { name: "minutes", type: "text" },
    { name: "hours", type: "text" },
    { name: "days", type: "text" },
    { name: "months", type: "text" },
    { name: "weekdays", type: "text" },
    { name: "who", type: "text" },
    { name: "command", type: "select" },
    { name: "parameters", type: "text" },
    { name: "description", type: "text" },
  ],
  syslog_destination: [
    { name: "enabled", type: "check" },
    { name: "transport", type: "select" },
    { name: "hostname", type: "text" },
    { name: "port", type: "text" },
    { name: "program", type: "text" },
    { name: "level", type: "text" },
    { name: "facility", type: "text" },
    { name: "rfc5424", type: "check" },
    { name: "description", type: "text" },
  ],
  gateway_group: [
    { name: "name", type: "text" },
    { name: "item", type: "text" },
    { name: "item2", type: "text" },
    { name: "item3", type: "text" },
    { name: "item4", type: "text" },
    { name: "item5", type: "text" },
    { name: "trigger", type: "select" },
    { name: "poolopts", type: "select" },
    { name: "descr", type: "text" },
  ],
  lagg: [
    { name: "members", type: "text" },
    { name: "proto", type: "select" },
    { name: "primary_member", type: "text" },
    { name: "lagghash", type: "select" },
    { name: "mtu", type: "text" },
    { name: "descr", type: "text" },
  ],
  bridge: [
    { name: "members", type: "text" },
    { name: "proto", type: "select" },
    { name: "enablestp", type: "check" },
    { name: "linklocal", type: "check" },
    { name: "descr", type: "text" },
  ],
  loopback: [
    { name: "deviceId", type: "text" },
    { name: "description", type: "text" },
  ],
  gre: [
    { name: "local-addr", type: "text" },
    { name: "remote-addr", type: "text" },
    { name: "tunnel-local-addr", type: "text" },
    { name: "tunnel-remote-addr", type: "text" },
    { name: "tunnel-remote-net", type: "text" },
    { name: "descr", type: "text" },
  ],
  dns_forward: [
    { name: "enabled", type: "check" },
    { name: "type", type: "select" },
    { name: "domain", type: "text" },
    { name: "server", type: "text" },
    { name: "port", type: "text" },
    { name: "forward_tcp_upstream", type: "check" },
    { name: "forward_first", type: "check" },
    { name: "description", type: "text" },
  ],
  dhcp_range: [
    { name: "interface", type: "select" },
    { name: "start_addr", type: "text" },
    { name: "end_addr", type: "text" },
    { name: "subnet_mask", type: "text" },
    { name: "lease_time", type: "text" },
    { name: "domain_type", type: "select" },
    { name: "domain", type: "text" },
    { name: "description", type: "text" },
  ],
  gif: [
    { name: "local-addr", type: "text" },
    { name: "remote-addr", type: "text" },
    { name: "tunnel-local-addr", type: "text" },
    { name: "tunnel-remote-addr", type: "text" },
    { name: "tunnel-remote-net", type: "text" },
    { name: "descr", type: "text" },
  ],
  vxlan: [
    { name: "deviceId", type: "text" },
    { name: "vxlanid", type: "text" },
    { name: "vxlanlocal", type: "text" },
    { name: "vxlanlocalport", type: "text" },
    { name: "vxlanremote", type: "text" },
    { name: "vxlanremoteport", type: "text" },
    { name: "vxlangroup", type: "text" },
    { name: "vxlandev", type: "select" },
  ],
  route: [
    { name: "network", type: "text" },
    { name: "gateway", type: "select" },
@@ -130,6 +234,9 @@ interface Props {
  uuid?: string;
  /** Values to start a new object with (e.g. the device being assigned). */
  preset?: Record<string, string>;
  /** Other nodes of the same cluster; after an add the same object can be created there too. */
  peers?: { id: string; name: string }[];
  onTransfer?: (peer: { id: string; name: string }, fields: Record<string, string>) => void;
  onClose: () => void;
  onDone: () => void;
 }
@@ -142,7 +249,7 @@ function isVisible(f: FieldDef, values: Record<string, string>): boolean {
  return wanted.includes(values[f.when.field] ?? "");
 }
-export function NetworkChangeModal({ hostId, hostName, kind, action, uuid, preset, onClose, onDone }: Props) {
+export function NetworkChangeModal({ hostId, hostName, kind, action, uuid, preset, peers, onTransfer, onClose, onDone }: Props) {
  const { t, errorMessage } = useLanguage();
  const toast = useToast();
  const [step, setStep] = useState<Step>(action === "del" ? "review" : "form");
@@ -155,6 +262,7 @@ export function NetworkChangeModal({ hostId, hostName, kind, action, uuid, prese
  const [acknowledged, setAcknowledged] = useState(false);
  const [typedHost, setTypedHost] = useState("");
  const [busy, setBusy] = useState(false);
  const [sent, setSent] = useState<Record<string, string>>({});
  const [error, setError] = useState<string | null>(null);
  // The form starts from what the firewall itself offers for a new object (defaults + valid choices).
@@ -212,6 +320,7 @@ export function NetworkChangeModal({ hostId, hostName, kind, action, uuid, prese
    setError(null);
    try {
      const fields = action === "del" ? {} : changedFields();
      setSent(fields);
      const res = await api.executeNetworkChange(hostId, { kind, action, uuid, fields }, plan.token, acknowledged);
      setResult(res);
      setStep("done");
@@ -363,6 +472,18 @@ export function NetworkChangeModal({ hostId, hostName, kind, action, uuid, prese
              </p>
            )}
            <p className="text-xs text-slate-500">{t("network.change.backupId", { id: result.backup_id })}</p>
            {action === "add" && peers && peers.length > 0 && onTransfer && (
              <div className="space-y-2 rounded-lg border border-slate-200 p-3">
                <p className="text-sm text-slate-600">{t("network.change.transferHint")}</p>
                <div className="flex flex-wrap gap-2">
                  {peers.map((peer) => (
                    <Button key={peer.id} type="button" variant="outline" onClick={() => onTransfer(peer, sent)}>
                      {t("network.change.transfer", { host: peer.name })}
                    </Button>
                  ))}
                </div>
              </div>
            )}
            <div className="flex justify-end">
              <Button type="button" onClick={onClose}>{t("common.close")}</Button>
            </div>
@@ -0,0 +1,97 @@
 "use client";
 import { useLanguage } from "@/components/LanguageProvider";
 import { Badge } from "@/components/ui/Badge";
 import { Card } from "@/components/ui/Card";
 import { EmptyState } from "@/components/ui/EmptyState";
 import { Skeleton } from "@/components/ui/Skeleton";
 import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
 import { api, ClusterNetworkDrift } from "@/lib/api";
 import { CheckCircle2, Layers } from "lucide-react";
 import Link from "next/link";
 import { useEffect, useState } from "react";
 const CATEGORY_TAB: Record<string, string> = {
  interfaces: "interfaces", vlans: "vlans", vips: "vips", gateways: "gateways", routes: "routes",
  dns_hosts: "dns", dhcp_hosts: "dhcp", kea_subnets: "dhcp", kea_reservations: "dhcp",
 };
 /** Network configuration differences between the nodes of every HA cluster. */
 export function NetworkCompare() {
  const { t, errorMessage } = useLanguage();
  const [clusters, setClusters] = useState<ClusterNetworkDrift[] | null>(null);
  const [error, setError] = useState<string | null>(null);
  useEffect(() => {
    api
      .getNetworkDrift()
      .then((d) => setClusters(d.clusters))
      .catch((e) => setError(errorMessage(e, "network.compare.loadFailed")));
  }, [errorMessage]);
  if (error) return <p className="text-sm text-red-600">{error}</p>;
  if (!clusters) return <Skeleton className="h-48 w-full" />;
  if (clusters.length === 0) return <EmptyState icon={Layers} title={t("network.compare.noClusters")} />;
  return (
    <div className="space-y-6">
      <p className="text-sm text-slate-600">{t("network.compare.intro")}</p>
      {clusters.map((c) => (
        <Card key={c.name}>
          <div className="flex flex-wrap items-center justify-between gap-2 border-b border-slate-200 px-5 py-3">
            <h2 className="text-sm font-semibold text-slate-700">
              {c.name} <span className="font-normal text-slate-500">({c.hosts.join(", ")})</span>
            </h2>
            {c.unreachable.length > 0 ? (
              <Badge tone="warning">{t("network.compare.unreachable", { hosts: c.unreachable.join(", ") })}</Badge>
            ) : c.differences.length === 0 ? (
              <Badge tone="success">
                <CheckCircle2 size={12} aria-hidden /> {t("network.compare.same")}
              </Badge>
            ) : (
              <Badge tone="danger">{t("network.compare.count", { count: c.differences.length })}</Badge>
            )}
          </div>
          {c.differences.length > 0 && (
            <div className="overflow-x-auto">
              <Table>
                <THead>
                  <TRow>
                    <TH>{t("network.compare.category")}</TH>
                    <TH>{t("network.compare.object")}</TH>
                    <TH>{t("network.compare.state")}</TH>
                    {c.compared.map((h) => (
                      <TH key={h}>{h}</TH>
                    ))}
                  </TRow>
                </THead>
                <TBody>
                  {c.differences.map((d) => (
                    <TRow key={`${d.category}:${d.key}`}>
                      <TD>
                        <Link className="text-brand-600 hover:underline" href={`/network/${CATEGORY_TAB[d.category] ?? "interfaces"}`}>
                          {t(`network.compare.categories.${d.category}`)}
                        </Link>
                      </TD>
                      <TD className="font-mono text-xs">{d.key}</TD>
                      <TD>
                        <Badge tone={d.status === "missing" ? "danger" : "warning"}>
                          {d.status === "missing" ? t("network.compare.missing") : t("network.compare.different")}
                        </Badge>
                      </TD>
                      {c.compared.map((h) => (
                        <TD key={h} className="font-mono text-xs">
                          {d.signatures[h] === undefined ? <span className="text-red-600">{t("network.compare.absent")}</span> : d.signatures[h] || "✓"}
                        </TD>
                      ))}
                    </TRow>
                  ))}
                </TBody>
              </Table>
            </div>
          )}
        </Card>
      ))}
    </div>
  );
 }
@@ -0,0 +1,121 @@
 "use client";
 import { useLanguage } from "@/components/LanguageProvider";
 import { Badge } from "@/components/ui/Badge";
 import { Button } from "@/components/ui/Button";
 import { Table, TBody, TD, TH, THead, TRow } from "@/components/ui/Table";
 import { api, NetworkAction, NetworkKind, NetworkObjects } from "@/lib/api";
 import { Pencil, Plus, Trash2 } from "lucide-react";
 import { useEffect, useState } from "react";
 export interface ObjectChange {
  kind: NetworkKind;
  action: NetworkAction;
  uuid?: string;
  preset?: Record<string, string>;
 }
 interface Props {
  hostId: string;
  kind: NetworkKind;
  title: string;
  reloadKey: number;
  readOnly: boolean;
  onChange: (change: ObjectChange) => void;
 }
 const FLAG_COLUMNS = new Set(["enabled"]);
 /**
 * One table of a generic object kind (tunables, cron jobs, LAGG, ...) with its add/edit/delete
 * actions. The rows come from the firewall via the backend's reduced column list.
 */
 export function NetworkObjectSection({ hostId, kind, title, reloadKey, readOnly, onChange }: Props) {
  const { t, errorMessage } = useLanguage();
  const [data, setData] = useState<NetworkObjects | null>(null);
  const [error, setError] = useState<string | null>(null);
  useEffect(() => {
    let cancelled = false;
    api
      .listNetworkObjects(hostId, kind)
      .then((d) => !cancelled && (setData(d), setError(null)))
      .catch((e) => !cancelled && setError(errorMessage(e, "network.loadFailed")));
    return () => {
      cancelled = true;
    };
  }, [hostId, kind, reloadKey, errorMessage]);
  // Built-in tunables carry a plain name as id (no UUID): the firewall creates an override instead of editing them.
  const isBuiltIn = (uuid: string) => kind === "tunable" && !uuid.includes("-");
  return (
    <div>
      <div className="flex items-center justify-between border-b border-slate-200 px-5 py-3">
        <h2 className="text-sm font-semibold text-slate-700">{title}</h2>
        <Button variant="outline" disabled={readOnly || data?.available === false} onClick={() => onChange({ kind, action: "add" })}>
          <Plus size={16} />
          {t("network.rowAdd")}
        </Button>
      </div>
      {error && <p className="px-5 py-3 text-sm text-red-600">{error}</p>}
      {!data && !error && <p className="px-5 py-4 text-sm text-slate-500">{t("common.loading")}</p>}
      {data && !data.available && <p className="px-5 py-4 text-sm text-slate-500">{t("network.objectsUnavailable")}</p>}
      {data && data.available && data.rows.length === 0 && <p className="px-5 py-4 text-sm text-slate-500">{t("network.empty")}</p>}
      {data && data.available && data.rows.length > 0 && (
        <div className="overflow-x-auto">
          <Table>
            <THead>
              <TRow>
                {data.columns.map((c) => (
                  <TH key={c}>{t(`network.field.${c}`)}</TH>
                ))}
                <TH>
                  <span className="sr-only">{t("common.actions")}</span>
                </TH>
              </TRow>
            </THead>
            <TBody>
              {data.rows.map((row) => (
                <TRow key={row.uuid}>
                  {data.columns.map((c) => (
                    <TD key={c} className={c === "description" || c === "descr" ? "" : "font-mono text-xs"}>
                      {FLAG_COLUMNS.has(c) ? (
                        <Badge tone={row[c] === "1" ? "success" : "neutral"}>{row[c] === "1" ? t("network.active") : t("common.statusDisabled")}</Badge>
                      ) : (
                        row[c] || "–"
                      )}
                    </TD>
                  ))}
                  <TD>
                    <fieldset disabled={readOnly} className="contents">
                      <div className="flex justify-end gap-1">
                        {isBuiltIn(row.uuid) ? (
                          <Button
                            variant="ghost"
                            onClick={() => onChange({ kind, action: "add", preset: { tunable: row.tunable ?? "", value: row.value ?? "" } })}
                          >
                            {t("network.override")}
                          </Button>
                        ) : (
                          <>
                            <Button variant="ghost" aria-label={t("network.rowEdit")} onClick={() => onChange({ kind, action: "set", uuid: row.uuid })}>
                              <Pencil size={14} />
                            </Button>
                            <Button variant="dangerSubtle" aria-label={t("network.rowDelete")} onClick={() => onChange({ kind, action: "del", uuid: row.uuid })}>
                              <Trash2 size={14} />
                            </Button>
                          </>
                        )}
                      </div>
                    </fieldset>
                  </TD>
                </TRow>
              ))}
            </TBody>
          </Table>
        </div>
      )}
    </div>
  );
 }
@@ -0,0 +1,258 @@
 "use client";
 import { Badge, badgeToneClasses } from "@/components/ui/Badge";
 import { Button } from "@/components/ui/Button";
 import { Modal } from "@/components/ui/Modal";
 import { InfoTip } from "@/components/ui/Tooltip";
 import { api, UpdaterStatus } from "@/lib/api";
 import { useLanguage } from "@/components/LanguageProvider";
 import { useReadOnly } from "@/lib/useReadOnly";
 import { AlertTriangle, CheckCircle2, Loader2 } from "lucide-react";
 import clsx from "clsx";
 import { useCallback, useEffect, useRef, useState } from "react";
 const POLL_MS = 2000;
 const RELOAD_DELAY_MS = 3500;
 /**
 * Settings card "OPNexus aktualisieren": zeigt die verfügbare Version und löst
 * das Update über den optionalen Updater-Container aus (siehe updater/server.py).
 * Das Backend selbst fasst den Host nie an. Während des Updates starten Backend
 * und Proxy neu — die Karte fragt weiter nach und übersteht die Lücke.
 */
 export function OpnexusUpdateSection() {
  const { t, errorMessage, locale } = useLanguage();
  const readOnly = useReadOnly();
  const [status, setStatus] = useState<UpdaterStatus | null>(null);
  const [error, setError] = useState("");
  const [confirm, setConfirm] = useState<"update" | "rollback" | null>(null);
  const [busy, setBusy] = useState(false);
  const [reconnecting, setReconnecting] = useState(false);
  // Wurde in dieser Sitzung ein laufender Auftrag gesehen? Nur dann ist ein
  // "succeeded" Anlass, die Seite neu zu laden (neue Frontend-Version).
  const sawRunning = useRef(false);
  const reloadTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
  const load = useCallback(async () => {
    try {
      const next = await api.updaterStatus();
      setStatus(next);
      setReconnecting(false);
      setError("");
      if (next.job?.state === "running") sawRunning.current = true;
      return next;
    } catch (e) {
      if (sawRunning.current) {
        setReconnecting(true); // Dienste starten gerade neu — weiter versuchen
      } else {
        setError(errorMessage(e, "common.requestFailed"));
      }
      return null;
    }
  }, [errorMessage]);
  useEffect(() => {
    if (readOnly) return;
    void load();
  }, [load, readOnly]);
  const running = status?.job?.state === "running" || reconnecting;
  useEffect(() => {
    if (!running) return;
    const timer = setInterval(() => void load(), POLL_MS);
    return () => clearInterval(timer);
  }, [running, load]);
  const job = status?.job ?? null;
  const finishedNow = !!job && job.state === "succeeded" && sawRunning.current;
  useEffect(() => {
    if (!finishedNow) return;
    reloadTimer.current = setTimeout(() => window.location.reload(), RELOAD_DELAY_MS);
    return () => {
      if (reloadTimer.current) clearTimeout(reloadTimer.current);
    };
  }, [finishedNow]);
  if (readOnly) return null;
  async function start(kind: "update" | "rollback") {
    setBusy(true);
    setError("");
    try {
      if (kind === "update" && status?.latest) await api.updaterUpdate(status.latest);
      else if (kind === "rollback") await api.updaterRollback();
      sawRunning.current = true;
      setConfirm(null);
      await load();
    } catch (e) {
      setConfirm(null);
      setError(errorMessage(e, "settings.update.startFailed"));
    } finally {
      setBusy(false);
    }
  }
  const phases = status?.phases ?? [];
  const steps = phases.filter((p, i) => p !== phases[i - 1]);
  const isRollbackJob = job?.action === "rollback";
  const finishedAt = job?.finished_at ? new Date(job.finished_at).toLocaleString(locale) : "";
  const releaseUrl = status?.release_url && /^https?:\/\//.test(status.release_url) ? status.release_url : null;
  return (
    <section id="opnexus-update" className="space-y-4 rounded-xl border border-slate-200 bg-white p-5">
      <h2 className="flex items-center gap-2 text-lg font-medium">
        {t("settings.update.title")}
        <InfoTip text={t("settings.update.hint")} />
      </h2>
      {error && <p role="alert" className="rounded-lg bg-red-50 p-3 text-sm text-red-700">{error}</p>}
      {!status && !error && <p className="text-sm text-slate-500">{t("common.loading")}</p>}
      {status && (
        <>
          <dl className="grid grid-cols-2 gap-3 text-sm">
            <dt>{t("settings.update.installed")}</dt>
            <dd>{status.current}</dd>
            <dt>{t("settings.update.latest")}</dt>
            <dd className="flex flex-wrap items-center gap-2">
              {status.latest ?? "—"}
              {status.update_available && <Badge tone="info">{t("settings.update.badge")}</Badge>}
              {releaseUrl && (
                <a href={releaseUrl} target="_blank" rel="noopener noreferrer" className="font-medium text-brand-600 underline">
                  {t("settings.update.notes")}
                </a>
              )}
            </dd>
          </dl>
          {!status.feed_enabled && <p className="text-sm text-slate-600">{t("settings.update.feedOff")}</p>}
          {status.feed_enabled && status.feed_error && <p className="text-sm text-amber-700">{t("settings.update.feedError")}</p>}
          {status.feed_enabled && !status.feed_error && !status.update_available && (
            <p className="flex items-center gap-2 text-sm text-emerald-700">
              <CheckCircle2 size={16} aria-hidden="true" /> {t("settings.update.upToDate")}
              {status.checked_at && <span className="text-slate-500">· {t("settings.update.checked", { time: new Date(status.checked_at).toLocaleString(locale) })}</span>}
            </p>
          )}
          {!status.available && (
            <div className="space-y-2 rounded-lg border border-slate-200 bg-slate-50 p-3 text-sm text-slate-700">
              {status.reason === "not_enabled" || status.reason === "unauthorized" ? (
                <>
                  <p className="font-medium">{t("settings.update.notEnabledTitle")}</p>
                  <p>{t("settings.update.notEnabledBody")}</p>
                  <p>{t("settings.update.notEnabledStep1")}</p>
                  <pre className="overflow-x-auto rounded bg-white p-2 text-xs">COMPOSE_PROFILES=updater</pre>
                  <p>{t("settings.update.notEnabledStep2")}</p>
                  <pre className="overflow-x-auto rounded bg-white p-2 text-xs">docker compose up -d</pre>
                  <p className="text-slate-500">{t("settings.update.notEnabledCli")}</p>
                </>
              ) : (
                <p>{t("settings.update.unreachable")}</p>
              )}
            </div>
          )}
          {status.available && status.mode === "local" && (
            <p className="text-sm text-slate-600">{t("settings.update.localMode")}</p>
          )}
          {status.available && status.major_change && status.latest && (
            <p className={clsx("flex items-start gap-2 rounded-lg border p-3 text-sm", badgeToneClasses.warning)}>
              <AlertTriangle size={16} className="mt-0.5 shrink-0" aria-hidden="true" />
              {t("settings.update.majorChange", { latest: status.latest })}
            </p>
          )}
          {running && (
            <div role="status" className={clsx("space-y-2 rounded-lg border p-3 text-sm", badgeToneClasses.info)}>
              <p className="flex items-center gap-2 font-medium">
                <Loader2 size={16} className="animate-spin motion-reduce:animate-none" aria-hidden="true" />
                {isRollbackJob ? t("settings.update.rollingBack") : t("settings.update.running", { target: job?.target ?? status.latest ?? "" })}
              </p>
              {steps.length > 0 && (
                <ol className="list-inside list-decimal text-xs">
                  {steps.map((step) => (
                    <li key={step}>{t(`settings.update.phase.${step}`)}</li>
                  ))}
                </ol>
              )}
              {reconnecting && <p className="text-xs">{t("settings.update.reconnecting")}</p>}
            </div>
          )}
          {!running && job && job.state === "succeeded" && sawRunning.current && (
            <p role="status" className="flex items-center gap-2 text-sm text-emerald-700">
              <CheckCircle2 size={16} aria-hidden="true" />
              {isRollbackJob
                ? t("settings.update.result.succeededRollback", { version: status.current })
                : t("settings.update.result.succeededUpdate", { version: status.current })}
            </p>
          )}
          {!running && job?.state === "rolled_back" && (
            <p role="alert" className={clsx("rounded-lg border p-3 text-sm", badgeToneClasses.warning)}>
              {t("settings.update.result.rolledBack", { target: job.target ?? "" })}
              {finishedAt && <span className="mt-1 block text-xs opacity-80">{t("settings.update.resultTime", { time: finishedAt })}</span>}
            </p>
          )}
          {!running && job?.state === "failed" && (
            <p role="alert" className="rounded-lg bg-red-50 p-3 text-sm text-red-700">
              {t("settings.update.result.failed")}
              {finishedAt && <span className="mt-1 block text-xs opacity-80">{t("settings.update.resultTime", { time: finishedAt })}</span>}
            </p>
          )}
          {status.log.length > 0 && (job?.state !== "succeeded" || running) && (
            <details className="text-xs" open={!running && job?.state !== "succeeded"}>
              <summary className="cursor-pointer text-slate-600">{t("settings.update.showLog")}</summary>
              <pre className="mt-2 max-h-64 overflow-auto whitespace-pre-wrap break-words rounded bg-slate-50 p-3">{status.log.join("\n")}</pre>
            </details>
          )}
          {status.can_update && status.latest && !running && (
            <Button onClick={() => setConfirm("update")} disabled={busy}>
              {t("settings.update.button", { latest: status.latest })}
            </Button>
          )}
          {status.available && status.mode === "release" && status.rollback_available && !running && (
            <div className="flex flex-wrap items-center gap-3 border-t border-slate-100 pt-3 text-sm">
              <Button variant="outline" onClick={() => setConfirm("rollback")} disabled={busy}>
                {t("settings.update.rollback.button")}
              </Button>
              <span className="text-slate-500">{t("settings.update.rollback.hint", { version: status.rollback_version ?? "—" })}</span>
            </div>
          )}
        </>
      )}
      {confirm === "update" && status?.latest && (
        <Modal title={t("settings.update.confirmTitle", { latest: status.latest })} onClose={() => setConfirm(null)}>
          <div className="space-y-3 text-sm text-slate-700">
            <p>{t("settings.update.confirmBody")}</p>
            <p>{t("settings.update.confirmSafety")}</p>
            <div className="flex justify-end gap-2 pt-2">
              <Button variant="ghost" onClick={() => setConfirm(null)} disabled={busy}>{t("common.cancel")}</Button>
              <Button onClick={() => void start("update")} loading={busy}>{t("settings.update.confirm")}</Button>
            </div>
          </div>
        </Modal>
      )}
      {confirm === "rollback" && status && (
        <Modal title={t("settings.update.rollback.confirmTitle", { version: status.rollback_version ?? "—" })} onClose={() => setConfirm(null)}>
          <div className="space-y-3 text-sm text-slate-700">
            <p className={status.rollback_loses_data ? clsx("rounded-lg border p-3", badgeToneClasses.warning) : ""}>
              {status.rollback_loses_data ? t("settings.update.rollback.dataLoss") : t("settings.update.rollback.noDataLoss")}
            </p>
            <div className="flex justify-end gap-2 pt-2">
              <Button variant="ghost" onClick={() => setConfirm(null)} disabled={busy}>{t("common.cancel")}</Button>
              <Button variant={status.rollback_loses_data ? "danger" : "primary"} onClick={() => void start("rollback")} loading={busy}>
                {t("settings.update.rollback.confirm")}
              </Button>
            </div>
          </div>
        </Modal>
      )}
    </section>
  );
 }
@@ -0,0 +1,462 @@
 "use client";
 import { useLanguage } from "@/components/LanguageProvider";
 import { TlsPinControl, TlsPinValue } from "@/components/TlsPinControl";
 import { TwoFactorSection } from "@/components/TwoFactorSection";
 import { Badge } from "@/components/ui/Badge";
 import { Button } from "@/components/ui/Button";
 import { Card } from "@/components/ui/Card";
 import { FieldGroup, Input } from "@/components/ui/Field";
 import { StatusDot } from "@/components/ui/StatusDot";
 import { useToast } from "@/components/ui/Toast";
 import { InfoTip } from "@/components/ui/Tooltip";
 import { api, AppSettings, Host } from "@/lib/api";
 import clsx from "clsx";
 import { ArrowLeft, ArrowRight, Bell, Check, DownloadCloud, ExternalLink, Shield, ShieldCheck } from "lucide-react";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useEffect, useRef, useState } from "react";
 const STEPS = ["welcome", "account", "firewall", "done"] as const;
 type Step = (typeof STEPS)[number];
 const emptyHostForm = { name: "", base_url: "", api_key: "", api_secret: "", cluster_name: "" };
 const noPin: TlsPinValue = { pem: null, insecure: false, clear: false };
 function Stepper({ step, onGo }: { step: number; onGo: (index: number) => void }) {
  const { t } = useLanguage();
  return (
    <nav aria-label={t("setup.stepsLabel")}>
      <ol className="flex flex-wrap gap-2">
        {STEPS.map((key, index) => {
          const current = index === step;
          const done = index < step;
          return (
            <li key={key}>
              <button
                type="button"
                aria-current={current ? "step" : undefined}
                onClick={() => onGo(index)}
                className={clsx(
                  "inline-flex items-center gap-2 rounded-full border px-3 py-1.5 text-sm font-medium transition-colors focus-visible:outline focus-visible:outline-2 focus-visible:outline-brand-500",
                  current ? "border-brand-500 bg-brand-500 text-white" : done ? "border-slate-300 text-slate-700 hover:bg-slate-100" : "border-slate-200 text-slate-500 hover:bg-slate-100"
                )}
              >
                <span
                  aria-hidden="true"
                  className={clsx("flex h-5 w-5 items-center justify-center rounded-full text-xs", current ? "bg-white/25" : done ? "bg-emerald-100 text-emerald-700" : "bg-slate-100")}
                >
                  {done ? <Check size={12} /> : index + 1}
                </span>
                {t(`setup.steps.${key}`)}
              </button>
            </li>
          );
        })}
      </ol>
    </nav>
  );
 }
 function WelcomeStep({ settings, onSettings }: { settings: AppSettings | null; onSettings: (s: AppSettings) => void }) {
  const { t, errorMessage, language, setLanguage } = useLanguage();
  const [error, setError] = useState("");
  async function pick(value: "de" | "en") {
    const previous = language;
    setLanguage(value);
    setError("");
    try {
      onSettings(await api.saveSettings({ language: value }));
    } catch (e) {
      setLanguage(previous);
      setError(errorMessage(e, "common.saveFailed"));
    }
  }
  return (
    <div className="space-y-5">
      <p className="text-sm text-slate-600">{t("setup.welcome.intro")}</p>
      <ul className="space-y-2 text-sm text-slate-700">
        {(["account", "firewall", "done"] as const).map((key) => (
          <li key={key} className="flex items-start gap-2">
            <Check size={16} className="mt-0.5 shrink-0 text-emerald-600" aria-hidden="true" />
            <span>{t(`setup.welcome.points.${key}`)}</span>
          </li>
        ))}
      </ul>
      <p className="flex items-start gap-2 rounded-xl bg-slate-50 p-3 text-sm text-slate-600">
        <ShieldCheck size={16} className="mt-0.5 shrink-0 text-emerald-600" aria-hidden="true" />
        {t("setup.welcome.readOnlyNote")}
      </p>
      <fieldset className="space-y-2">
        <legend className="text-sm font-medium text-slate-700">{t("settings.language.label")}</legend>
        <div role="radiogroup" aria-label={t("settings.language.label")} className="flex flex-wrap gap-3">
          {(["de", "en"] as const).map((value) => (
            <label
              key={value}
              className={clsx("flex cursor-pointer items-center gap-2 rounded-lg border px-4 py-2.5 text-sm", language === value ? "border-sky-500 bg-sky-50 text-sky-700" : "border-slate-200")}
            >
              <input type="radio" name="setup-language" checked={language === value} disabled={!settings} onChange={() => void pick(value)} />
              {t(`settings.language.${value}`)}
            </label>
          ))}
        </div>
        {error && <p role="alert" className="text-sm text-red-600">{error}</p>}
      </fieldset>
    </div>
  );
 }
 function AccountStep() {
  const { t, errorMessage } = useLanguage();
  const toast = useToast();
  const [current, setCurrent] = useState("");
  const [password, setPassword] = useState("");
  const [repeat, setRepeat] = useState("");
  const [busy, setBusy] = useState(false);
  const [changed, setChanged] = useState(false);
  const [error, setError] = useState("");
  async function submit(e: React.FormEvent) {
    e.preventDefault();
    setError("");
    if (password !== repeat) {
      setError(t("settings.passwordMismatch"));
      return;
    }
    setBusy(true);
    try {
      await api.changePassword(current, password);
      setCurrent("");
      setPassword("");
      setRepeat("");
      setChanged(true);
      toast.show(t("settings.passwordChanged"), "success");
    } catch (err) {
      setError(errorMessage(err, "settings.passwordFailed"));
    } finally {
      setBusy(false);
    }
  }
  return (
    <div className="space-y-6">
      <section aria-labelledby="setup-password" className="space-y-3">
        <h3 id="setup-password" className="flex items-center gap-2 text-base font-semibold text-slate-900">
          {t("setup.account.passwordTitle")}
          {changed && <Badge tone="success"><Check size={12} />{t("setup.account.passwordDone")}</Badge>}
        </h3>
        <p className="text-sm text-slate-600">{t("setup.account.passwordIntro")}</p>
        <form onSubmit={submit} className="max-w-md space-y-3">
          <FieldGroup label={t("settings.currentPassword")} hint={t("setup.account.currentHint")}>
            <Input type="password" autoComplete="current-password" required value={current} onChange={(e) => setCurrent(e.target.value)} />
          </FieldGroup>
          <FieldGroup label={t("settings.newPassword")} hint={t("setup.account.newHint")}>
            <Input type="password" autoComplete="new-password" minLength={10} maxLength={1024} required value={password} onChange={(e) => setPassword(e.target.value)} />
          </FieldGroup>
          <FieldGroup label={t("settings.repeatPassword")}>
            <Input type="password" autoComplete="new-password" minLength={10} required value={repeat} onChange={(e) => setRepeat(e.target.value)} />
          </FieldGroup>
          {error && <p role="alert" className="text-sm text-red-600">{error}</p>}
          <Button type="submit" variant="secondary" loading={busy}>{t("settings.changePassword")}</Button>
        </form>
      </section>
      <section aria-labelledby="setup-2fa" className="space-y-3">
        <h3 id="setup-2fa" className="text-base font-semibold text-slate-900">{t("setup.account.twofaTitle")}</h3>
        <p className="text-sm text-slate-600">{t("setup.account.twofaIntro")}</p>
        <TwoFactorSection />
      </section>
    </div>
  );
 }
 function FirewallStep({ hosts, onHostsChanged }: { hosts: Host[] | null; onHostsChanged: () => Promise<void> }) {
  const { t, ts, errorMessage } = useLanguage();
  const toast = useToast();
  const [form, setForm] = useState(emptyHostForm);
  const [pin, setPin] = useState<TlsPinValue>(noPin);
  const [saving, setSaving] = useState(false);
  const [error, setError] = useState("");
  const [checking, setChecking] = useState<string | null>(null);
  const firstHost = !hosts || hosts.length === 0;
  async function create(e: React.FormEvent) {
    e.preventDefault();
    setSaving(true);
    setError("");
    try {
      const created = await api.createHost({
        name: form.name.trim(),
        base_url: form.base_url.trim(),
        api_key: form.api_key.trim(),
        api_secret: form.api_secret.trim(),
        verify_tls: !pin.insecure,
        tls_ca_pem: pin.pem,
        enabled: true,
        cluster_name: form.cluster_name.trim() || null,
        policy_hierarchy_group_id: null,
      });
      toast.show(t("hosts.created", { name: created.name }), "success");
      setForm(emptyHostForm);
      setPin(noPin);
      await onHostsChanged();
    } catch (err) {
      setError(errorMessage(err, "hosts.createFailed"));
    } finally {
      setSaving(false);
    }
  }
  async function recheck(id: string) {
    setChecking(id);
    try {
      await onHostsChanged();
    } finally {
      setChecking(null);
    }
  }
  return (
    <div className="space-y-6">
      <p className="text-sm text-slate-600">{t("setup.firewall.intro")}</p>
      {hosts && hosts.length > 0 && (
        <section aria-labelledby="setup-hosts" className="space-y-2">
          <h3 id="setup-hosts" className="text-base font-semibold text-slate-900">{t("setup.firewall.connected")}</h3>
          <ul className="divide-y divide-slate-100 rounded-xl border border-slate-200">
            {hosts.map((host) => (
              <li key={host.id} className="flex flex-wrap items-center gap-x-4 gap-y-1 px-4 py-3 text-sm">
                <Link href={`/hosts/${host.id}`} className="font-medium text-sky-700 hover:underline">{host.name}</Link>
                <span className="text-slate-500">{host.base_url}</span>
                <span className="ml-auto flex items-center gap-3">
                  <StatusDot status={host.status} />
                  {host.status === "offline" && (
                    <Button type="button" variant="outline" loading={checking === host.id} onClick={() => void recheck(host.id)}>
                      {t("setup.firewall.recheck")}
                    </Button>
                  )}
                </span>
                {host.status === "offline" && (
                  <div className="basis-full space-y-0.5 text-xs">
                    {host.status_detail && <p className="text-slate-500">{ts(host.status_detail).slice(0, 160)}</p>}
                    <p className="text-flame-700">{t("setup.firewall.offlineHelp")}</p>
                  </div>
                )}
              </li>
            ))}
          </ul>
        </section>
      )}
      <section aria-labelledby="setup-key" className="space-y-3 rounded-xl border border-slate-200 p-4">
        <h3 id="setup-key" className="text-base font-semibold text-slate-900">{t("setup.firewall.keyTitle")}</h3>
        <ol className="list-decimal space-y-1.5 pl-5 text-sm text-slate-700">
          {(["menu", "user", "key", "rights"] as const).map((key) => (
            <li key={key}>{t(`setup.firewall.keySteps.${key}`)}</li>
          ))}
        </ol>
        <p className="flex items-start gap-1.5 text-xs text-slate-500">
          <DownloadCloud size={14} className="mt-0.5 shrink-0" aria-hidden="true" />
          {t("setup.firewall.keyFileNote")}
        </p>
      </section>
      <form onSubmit={create} className="space-y-4" aria-labelledby="setup-add">
        <h3 id="setup-add" className="text-base font-semibold text-slate-900">
          {firstHost ? t("setup.firewall.addFirst") : t("setup.firewall.addAnother")}
        </h3>
        <div className="grid gap-4 sm:grid-cols-2">
          <FieldGroup label="Name" hint={t("setup.firewall.nameHint")}>
            <Input required value={form.name} onChange={(e) => setForm({ ...form, name: e.target.value })} placeholder="fw-primary" />
          </FieldGroup>
          <FieldGroup label={t("hosts.baseUrl")} hint={t("setup.firewall.urlHint")}>
            <Input required value={form.base_url} onChange={(e) => setForm({ ...form, base_url: e.target.value })} placeholder="https://192.168.1.1" />
          </FieldGroup>
          <FieldGroup label="API-Key">
            <Input required autoComplete="off" value={form.api_key} onChange={(e) => setForm({ ...form, api_key: e.target.value })} />
          </FieldGroup>
          <FieldGroup label="API-Secret">
            <Input required type="password" autoComplete="off" value={form.api_secret} onChange={(e) => setForm({ ...form, api_secret: e.target.value })} />
          </FieldGroup>
          <FieldGroup label={t("hosts.clusterOptional")} hint={t("setup.firewall.clusterHint")}>
            <Input value={form.cluster_name} onChange={(e) => setForm({ ...form, cluster_name: e.target.value })} placeholder={t("hosts.clusterPlaceholder")} />
          </FieldGroup>
        </div>
        <TlsPinControl baseUrl={form.base_url} value={pin} onChange={setPin} />
        {error && <p role="alert" className="text-sm text-red-600">{error}</p>}
        <div className="flex flex-wrap items-center gap-3">
          <Button type="submit" loading={saving}>{saving ? t("hosts.saving") : t("setup.firewall.connect")}</Button>
          <span className="text-xs text-slate-500">{t("setup.firewall.connectNote")}</span>
        </div>
      </form>
    </div>
  );
 }
 function DoneStep({ hosts, settings }: { hosts: Host[] | null; settings: AppSettings | null }) {
  const { t } = useLanguage();
  const [twofa, setTwofa] = useState<boolean | null>(null);
  useEffect(() => {
    api.twoFactorStatus().then((s) => setTwofa(s.enabled)).catch(() => setTwofa(null));
  }, []);
  const online = hosts?.filter((h) => h.status === "online").length ?? 0;
  const total = hosts?.length ?? 0;
  const seconds = settings?.deploy_confirm_window_seconds ?? 0;
  const next: { href: string; icon: typeof Shield; key: string; params?: Record<string, string | number> }[] = [
    { href: "/rules", icon: Shield, key: "rules", params: { seconds } },
    { href: "/settings#notifications", icon: Bell, key: "notify" },
    { href: "/settings#opnexus-update", icon: DownloadCloud, key: "update" },
  ];
  return (
    <div className="space-y-6">
      <ul className="space-y-2 text-sm">
        <li className="flex items-center gap-2">
          <Badge tone={total > 0 && online === total ? "success" : total > 0 ? "warning" : "neutral"}>
            {total > 0 ? t("setup.done.hostsOnline", { online, total }) : t("setup.done.noHosts")}
          </Badge>
        </li>
        <li className="flex items-center gap-2">
          <Badge tone={twofa ? "success" : "neutral"}>{twofa ? t("setup.done.twofaOn") : t("setup.done.twofaOff")}</Badge>
        </li>
      </ul>
      <section aria-labelledby="setup-next" className="space-y-3">
        <h3 id="setup-next" className="text-base font-semibold text-slate-900">{t("setup.done.nextTitle")}</h3>
        <ul className="grid gap-3 sm:grid-cols-3">
          {next.map(({ href, icon: Icon, key, params }) => (
            <li key={key}>
              <Link href={href} className="flex h-full flex-col gap-1 rounded-xl border border-slate-200 p-4 text-sm transition-colors hover:border-brand-500 hover:bg-slate-50 focus-visible:outline focus-visible:outline-2 focus-visible:outline-brand-500">
                <span className="flex items-center gap-2 font-medium text-slate-900"><Icon size={16} aria-hidden="true" />{t(`setup.done.next.${key}.title`)}</span>
                <span className="text-slate-600">{t(`setup.done.next.${key}.text`, params)}</span>
              </Link>
            </li>
          ))}
        </ul>
        <p className="text-sm text-slate-600">
          {t("setup.done.backupBefore")} <code className="rounded bg-slate-100 px-1.5 py-0.5 text-xs">./opnexus backup</code>
          <InfoTip text={t("setup.done.backupHelp")} size={13} className="ml-1 align-middle" />
        </p>
        <p className="text-sm text-slate-500">
          <a href="https://opnexus.dev/docs/cli/" target="_blank" rel="noreferrer" className="inline-flex items-center gap-1 text-sky-700 hover:underline">
            {t("setup.done.docs")} <ExternalLink size={13} aria-hidden="true" />
          </a>
        </p>
      </section>
    </div>
  );
 }
 export function SetupWizard() {
  const { t } = useLanguage();
  const router = useRouter();
  const [index, setIndex] = useState(0);
  const [role, setRole] = useState<string | null>(null);
  const [settings, setSettings] = useState<AppSettings | null>(null);
  const [hosts, setHosts] = useState<Host[] | null>(null);
  const [finishing, setFinishing] = useState(false);
  const [error, setError] = useState("");
  const headingRef = useRef<HTMLHeadingElement>(null);
  const mounted = useRef(false);
  async function loadHosts() {
    try {
      setHosts(await api.listHosts());
    } catch {
      setHosts([]);
    }
  }
  useEffect(() => {
    api.me().then((s) => setRole(s.role ?? "admin")).catch(() => setRole("admin"));
    api.settings().then(setSettings).catch(() => {});
    void loadHosts();
  }, []);
  // Move focus to the step heading on navigation so screen-reader users hear
  // where they are; skipped on the very first render.
  useEffect(() => {
    if (!mounted.current) {
      mounted.current = true;
      return;
    }
    headingRef.current?.focus();
  }, [index]);
  async function leave(markDone: boolean) {
    setFinishing(true);
    setError("");
    try {
      if (markDone && !settings?.setup_done) await api.saveSettings({ setup_done: true });
      router.push("/dashboard");
    } catch {
      setError(t("common.saveFailed"));
      setFinishing(false);
    }
  }
  const step: Step = STEPS[index];
  const last = index === STEPS.length - 1;
  if (role === "read_only") {
    return (
      <div className="mx-auto max-w-3xl space-y-3">
        <h1 className="text-2xl font-semibold text-slate-900">{t("setup.title")}</h1>
        <p className="text-sm text-slate-600">{t("setup.readOnly")}</p>
        <Button href="/dashboard" variant="outline">{t("setup.toDashboard")}</Button>
      </div>
    );
  }
  return (
    <div className="mx-auto max-w-3xl space-y-5">
      <div className="flex flex-wrap items-start justify-between gap-3">
        <div>
          <h1 className="text-2xl font-semibold text-slate-900">{t("setup.title")}</h1>
          <p className="mt-1 text-sm text-slate-500">{t("setup.stepOf", { current: index + 1, total: STEPS.length })}</p>
        </div>
        <Button type="button" variant="ghost" loading={finishing} onClick={() => void leave(true)}>
          {t("setup.skip")}
        </Button>
      </div>
      <Stepper step={index} onGo={setIndex} />
      <Card className="space-y-5 p-5 sm:p-6">
        <div>
          <h2 ref={headingRef} tabIndex={-1} className="text-xl font-semibold text-slate-900 outline-none">
            {t(`setup.${step}.title`)}
          </h2>
        </div>
        {step === "welcome" && <WelcomeStep settings={settings} onSettings={setSettings} />}
        {step === "account" && <AccountStep />}
        {step === "firewall" && <FirewallStep hosts={hosts} onHostsChanged={loadHosts} />}
        {step === "done" && <DoneStep hosts={hosts} settings={settings} />}
      </Card>
      {error && <p role="alert" className="text-sm text-red-600">{error}</p>}
      <div className="flex items-center justify-between gap-3">
        <Button type="button" variant="outline" disabled={index === 0} onClick={() => setIndex(index - 1)}>
          <ArrowLeft size={16} aria-hidden="true" />
          {t("setup.back")}
        </Button>
        {last ? (
          <Button type="button" loading={finishing} onClick={() => void leave(true)}>
            {t("setup.finish")}
          </Button>
        ) : (
          <Button type="button" onClick={() => setIndex(index + 1)}>
            {t("setup.next")}
            <ArrowRight size={16} aria-hidden="true" />
          </Button>
        )}
      </div>
    </div>
  );
 }
@@ -65,7 +65,10 @@ export function UpdateBanner() {
        <div className="flex-1">
          <p className="font-medium">{t("updateBanner.title", { latest: check.latest, current: check.current })}</p>
          <p className="text-xs">
-            {t("updateBanner.how")}
+            {t("updateBanner.how")}{" "}
            <a href="/settings#opnexus-update" className="font-medium underline">
              {t("updateBanner.settings")}
            </a>
            {releaseUrl && (
              <>
                {" "}
@@ -224,7 +224,72 @@ export interface NetRoute {
  disabled: boolean;
 }
-export type NetworkKind = "vlan" | "vip" | "gateway" | "route" | "interface" | "dns_host" | "dhcp_host" | "kea_subnet" | "kea_reservation";
+export type NetworkKind =
  | "vlan" | "vip" | "gateway" | "route" | "interface" | "dns_host" | "dhcp_host" | "kea_subnet" | "kea_reservation"
  | "tunable" | "cron_job" | "syslog_destination" | "gateway_group" | "lagg" | "bridge" | "loopback" | "gre" | "gif" | "vxlan"
  | "dns_forward" | "dhcp_range";
 export interface PingResult {
  target: string;
  sent: number;
  received: number;
  loss: string;
  min: number | null;
  avg: number | null;
  max: number | null;
  stddev: number | null;
  error: string | null;
 }
 export interface TracerouteResult {
  target: string;
  notice: string;
  hops: { ttl: string; address: string; host: string; as: string; probes: string }[];
 }
 export interface PortprobeResult {
  target: string;
  port: number;
  open: boolean;
  message: string;
 }
 export interface DnsLookupResult {
  name: string;
  records: Record<string, { answers: string[]; query_time: string; server: string }>;
 }
 export interface NetworkObjects {
  available: boolean;
  columns: string[];
  rows: Record<string, string>[];
 }
 export interface NetworkDifference {
  category: string;
  key: string;
  status: "missing" | "different";
  present_on: string[];
  missing_from: string[];
  signatures: Record<string, string>;
 }
 export interface ClusterNetworkDrift {
  name: string;
  hosts: string[];
  compared: string[];
  unreachable: string[];
  differences: NetworkDifference[];
 }
 export interface HostSnapshot {
  uuid: string;
  name: string;
  active: string;
  size: string;
  created: string;
  mountpoint: string;
 }
 export type NetworkAction = "add" | "set" | "del";
 export interface NetworkChangeRequest {
@@ -996,10 +1061,44 @@ export interface VersionCheck {
  error: string | null;
 }
 export interface UpdaterJob {
  id: string;
  action: "update" | "rollback";
  target: string | null;
  state: "running" | "succeeded" | "failed" | "rolled_back";
  started_at: string;
  finished_at: string | null;
  exit_code: number | null;
  from_version: string | null;
 }
 export interface UpdaterStatus {
  /** false = Updater nicht aktiviert/erreichbar (`reason` sagt warum). */
  available: boolean;
  reason: "not_enabled" | "unreachable" | "unauthorized" | null;
  mode: "release" | "local" | null;
  current: string;
  latest: string | null;
  update_available: boolean;
  release_url: string | null;
  feed_enabled: boolean;
  feed_error: string | null;
  checked_at: string | null;
  can_update: boolean;
  major_change: boolean;
  job: UpdaterJob | null;
  phases: string[];
  log: string[];
  services: Record<string, string>;
  rollback_available: boolean;
  rollback_loses_data: boolean;
  rollback_version: string | null;
 }
 export const api = {
  search: (q: string, options?: RequestInit) => request<SearchHit[]>(`/search?${new URLSearchParams({ q })}`, options),
  settings: () => request<AppSettings>("/settings"),
-  saveSettings: (partial:{theme?:Theme;language?:Language}) => request<AppSettings>("/settings",{method:"PUT",body:JSON.stringify(partial)}),
+  saveSettings: (partial:{theme?:Theme;language?:Language;setup_done?:boolean}) => request<AppSettings>("/settings",{method:"PUT",body:JSON.stringify(partial)}),
  notificationSettings: () => request<NotificationSettings>("/notifications/settings"),
  saveNotificationSettings: (data: NotificationSettingsUpdate) => request<NotificationSettings>("/notifications/settings", { method: "PUT", body: JSON.stringify(data) }),
  logSettings: () => request<LogSettings>("/logs/settings"),
@@ -1028,6 +1127,9 @@ export const api = {
  audit: (filters: Record<string,string | number> = {}) => request<AuditPage>(`/audit?${new URLSearchParams(Object.entries(filters).filter(([,v])=>v!=="").map(([k,v])=>[k,String(v)]))}`),
  dashboard: () => request<DashboardSummary>("/dashboard"),
  versionCheck: () => request<VersionCheck>("/system/version-check"),
  updaterStatus: () => request<UpdaterStatus>("/system/updater"),
  updaterUpdate: (version: string) => request<{ job: UpdaterJob }>("/system/updater/update", { method: "POST", body: JSON.stringify({ version }) }),
  updaterRollback: () => request<{ job: UpdaterJob }>("/system/updater/rollback", { method: "POST" }),
  getOutboundMode: (id: string) => request<OutboundMode>(`/outbound-nat/hosts/${id}/mode`),
  listPortForwards: () => request<PortForward[]>(`/port-forward`),
  createPortForward: (data: PortForwardCreate) => request<PortForward>(`/port-forward`, { method: "POST", body: JSON.stringify(data) }),
@@ -1071,6 +1173,20 @@ export const api = {
  deleteHost: (id: string) => request<void>(`/hosts/${id}`, { method: "DELETE" }),
  getLiveRules: (id: string) => request<LiveRule[]>(`/hosts/${id}/live-rules`),
  getHostNetwork: (id: string) => request<HostNetwork>(`/hosts/${id}/network`),
  runPing: (id: string, data: { target: string; ipproto: string; count: number; packetsize?: number | null; source?: string }) =>
    request<PingResult>(`/hosts/${id}/diagnostics/ping`, { method: "POST", body: JSON.stringify(data) }),
  runTraceroute: (id: string, data: { target: string; ipproto: string; protocol: string; source?: string }) =>
    request<TracerouteResult>(`/hosts/${id}/diagnostics/traceroute`, { method: "POST", body: JSON.stringify(data) }),
  runPortprobe: (id: string, data: { target: string; port: number; ipproto: string; source?: string }) =>
    request<PortprobeResult>(`/hosts/${id}/diagnostics/portprobe`, { method: "POST", body: JSON.stringify(data) }),
  runDnsLookup: (id: string, data: { name: string; server?: string }) =>
    request<DnsLookupResult>(`/hosts/${id}/diagnostics/dns`, { method: "POST", body: JSON.stringify(data) }),
  listNetworkObjects: (id: string, kind: NetworkKind) => request<NetworkObjects>(`/hosts/${id}/network/objects/${kind}`),
  getNetworkDrift: () => request<{ clusters: ClusterNetworkDrift[] }>("/network/drift"),
  listSnapshots: (id: string) => request<{ supported: boolean; rows: HostSnapshot[] }>(`/hosts/${id}/snapshots`),
  createSnapshot: (id: string, name: string, note: string) =>
    request<HostSnapshot>(`/hosts/${id}/snapshots`, { method: "POST", body: JSON.stringify({ name, note }) }),
  deleteSnapshot: (id: string, uuid: string) => request<void>(`/hosts/${id}/snapshots/${uuid}`, { method: "DELETE" }),
  getNetworkItem: (id: string, kind: NetworkKind, uuid: string) => request<Record<string, string>>(`/hosts/${id}/network/item/${kind}/${uuid}`),
  getNetworkTemplate: (id: string, kind: NetworkKind) => request<NetworkTemplate>(`/hosts/${id}/network/template/${kind}`),
  previewNetworkChange: (id: string, data: NetworkChangeRequest) =>
@@ -1411,7 +1527,7 @@ export interface CarpSwitchState {
 export interface CarpSwitchPreview {preview_id:string;expires_at:string;action:"carp_enter"|"carp_leave";state:CarpSwitchState;}
 export type Theme="light"|"dark"|"system";
-export interface AppSettings {username:string;theme:Theme;language:Language;deploy_confirm_window_seconds:number;session_lifetime_seconds:number;}
+export interface AppSettings {username:string;theme:Theme;language:Language;setup_done:boolean;deploy_confirm_window_seconds:number;session_lifetime_seconds:number;}
 export type SmtpSecurity = "none" | "starttls" | "ssl";
@@ -1434,6 +1550,7 @@ export interface NotificationSettings {
  maintenance_unknown_enabled: boolean;
  carp_health_enabled: boolean;
  nat_drift_enabled: boolean;
  network_drift_enabled: boolean;
  carp_auto_revert_failed_enabled: boolean;
  poll_interval_seconds: number;
  updated_at: string;
@@ -1460,6 +1577,7 @@ export interface NotificationSettingsUpdate {
  maintenance_unknown_enabled?: boolean;
  carp_health_enabled?: boolean;
  nat_drift_enabled?: boolean;
  network_drift_enabled?: boolean;
  carp_auto_revert_failed_enabled?: boolean;
  poll_interval_seconds?: number;
 }
@@ -1483,7 +1601,7 @@ export interface LogSettingsUpdate {
 export type ProblemType =
  | "host_offline" | "cert_expiry" | "rule_drift" | "revert_failed" | "maintenance_unknown"
-  | "carp_split_brain" | "nat_drift" | "carp_auto_revert_failed";
+  | "carp_split_brain" | "nat_drift" | "carp_auto_revert_failed" | "network_drift";
 export interface CarpEvent {
  id: string;
@@ -62,7 +62,8 @@
        "maintenanceUnknown": "Wartungsergebnis unklar",
        "carpHealth": "CARP-Zustand kritisch (Split-Brain / kein Master)",
        "natDrift": "NAT-Drift im Cluster",
-        "carpAutoRevertFailed": "CARP-Auto-Revert fehlgeschlagen"
+        "carpAutoRevertFailed": "CARP-Auto-Revert fehlgeschlagen",
        "networkDrift": "Netzwerk-Abweichung im Cluster"
      },
      "pollInterval": "Prüfintervall (Sekunden)",
      "pollHint": "Mindestens 60s, um die Firewalls nicht unnötig zu belasten."
@@ -109,7 +110,66 @@
    "about": "Über OPNexus",
    "version": "Version",
    "development": "Entwicklung",
-    "changelogNote": "Änderungsverlauf und Versionsschema stehen in {file}."
+    "changelogNote": "Änderungsverlauf und Versionsschema stehen in {file}.",
    "update": {
      "title": "OPNexus aktualisieren",
      "hint": "Lädt die neuen Images, wechselt die Dienste und prüft, ob alles gesund ist. Schlägt das fehl, wird automatisch auf die vorherige Version zurückgerollt.",
      "installed": "Installiert",
      "latest": "Neueste Version",
      "upToDate": "OPNexus ist auf dem neuesten Stand.",
      "notes": "Release-Notes",
      "checked": "Zuletzt geprüft: {time}",
      "feedOff": "Die Versionsprüfung ist aus. Trage UPDATE_CHECK_URL in der .env des Servers ein, damit OPNexus neue Versionen erkennt.",
      "feedError": "Der Release-Feed ist gerade nicht erreichbar.",
      "notEnabledTitle": "Updates aus dem Webinterface sind nicht aktiviert.",
      "notEnabledBody": "Dafür läuft ein eigener kleiner Dienst (Updater) mit Zugriff auf Docker — er ist bewusst optional. Aktivieren:",
      "notEnabledStep1": "In der .env auf dem Server eintragen:",
      "notEnabledStep2": "Dann ausführen:",
      "notEnabledCli": "Bis dahin geht das Update auf dem Server mit „opnexus update“.",
      "unreachable": "Der Updater antwortet nicht. Auf dem Server prüfen: docker compose ps updater",
      "localMode": "Diese Installation baut OPNexus lokal aus dem Quellcode (kein Release-Image). Aktualisieren auf dem Server mit git pull und docker compose up -d --build.",
      "majorChange": "Version {latest} ist ein Hauptversions-Sprung. Bitte erst die Release-Notes lesen und dann auf dem Server mit „opnexus update {latest}“ aktualisieren.",
      "button": "Auf {latest} aktualisieren",
      "confirmTitle": "Auf {latest} aktualisieren?",
      "confirmBody": "OPNexus lädt die neuen Images und startet sich neu. Die Oberfläche ist dabei etwa ein bis zwei Minuten nicht erreichbar; die verwalteten Firewalls sind nicht betroffen.",
      "confirmSafety": "Vor einer Datenbank-Migration wird automatisch ein Backup angelegt. Wird die neue Version nicht gesund, setzt OPNexus selbst auf die vorherige Version zurück.",
      "confirm": "Jetzt aktualisieren",
      "startFailed": "Update konnte nicht gestartet werden",
      "running": "Update auf {target} läuft …",
      "rollingBack": "Rollback läuft …",
      "reconnecting": "Verbindung wird neu aufgebaut — beim Neustart der Dienste ist das normal.",
      "phase": {
        "pulling": "Neue Images laden",
        "switching": "Dienste wechseln",
        "waiting": "Auf gesunde Dienste warten",
        "stopping": "Dienste anhalten",
        "restoring": "Datenbank zurückspielen",
        "rolled_back": "Zurückgerollt",
        "done": "Fertig"
      },
      "result": {
        "succeededUpdate": "OPNexus läuft jetzt auf {version}. Die Seite wird neu geladen …",
        "succeededRollback": "OPNexus wurde auf {version} zurückgesetzt. Die Seite wird neu geladen …",
        "rolledBack": "Das Update auf {target} ist fehlgeschlagen. OPNexus wurde automatisch auf die vorherige Version zurückgesetzt.",
        "failed": "Der Vorgang ist fehlgeschlagen. Protokoll und Serverzustand prüfen (auf dem Server: opnexus status)."
      },
      "showLog": "Protokoll",
      "rollback": {
        "button": "Auf Vorversion zurücksetzen",
        "hint": "Macht das letzte Update rückgängig (zurück auf {version}).",
        "confirmTitle": "Auf {version} zurücksetzen?",
        "dataLoss": "Das Update hat die Datenbank migriert. Beim Zurücksetzen wird der Stand vor dem Update wiederhergestellt: Änderungen seit dem Update und die Log-Historie gehen verloren.",
        "noDataLoss": "Die Datenbank wurde nicht migriert — es gehen keine Daten verloren.",
        "confirm": "Zurücksetzen"
      },
      "badge": "Update verfügbar",
      "resultTime": "Ergebnis vom {time}"
    },
    "setup": {
      "title": "Einrichtungsassistent",
      "intro": "Führt Schritt für Schritt durch Passwort, Zwei-Faktor-Anmeldung und das Verbinden einer Firewall.",
      "open": "Assistent öffnen"
    }
  },
  "nav": {
    "aboutTitle": "Über OPNexus — Fleet-Status & Versionen",
@@ -126,7 +186,8 @@
      "vpn": "VPN",
      "certificates": "Zertifikate",
      "monitoring": "Monitoring",
-      "system": "System"
+      "system": "System",
      "hostsystem": "Host-System"
    },
    "items": {
      "dashboard": "Dashboard",
@@ -152,7 +213,15 @@
      "audit": "Audit",
      "updates": "Update Center",
      "settings": "Einstellungen",
-      "users": "Benutzer"
+      "users": "Benutzer",
      "network-devices": "Geräte",
      "network-compare": "Abgleich",
      "hostsystem-tunables": "Tunables",
      "hostsystem-cron": "Cron",
      "hostsystem-syslog": "Syslog",
      "hostsystem-snapshots": "Snapshots",
      "hostsystem-diagnostics": "Diagnose",
      "setup": "Einrichtung"
    }
  },
  "dashboard": {
@@ -164,6 +233,7 @@
    "fleetHealth": "Fleet-/CARP-Gesundheit",
    "noHosts": "Noch keine Hosts angelegt",
    "toHosts": "Zu den Hosts",
    "startSetup": "Einrichtungsassistent starten",
    "nothingPending": "Nichts offen",
    "nothingPendingDescription": "Keine ausstehenden Bestätigungen, Fehler oder unklaren Wartungsvorgänge.",
    "securityAndExpiryWarnings": "Sicherheits- & Ablauf-Warnungen",
@@ -500,7 +570,13 @@
    "NETWORK_BACKUP_FAILED": "Backup von „{host}“ vor der Änderung fehlgeschlagen – es wurde nichts geändert",
    "NETWORK_CHANGE_BLOCKED": "Die Änderung ist nicht möglich ({reasons})",
    "NETWORK_FIELD_INVALID": "Ungültiges Feld: {field}",
-    "NETWORK_ITEM_NOT_FOUND": "Das Objekt existiert auf der Firewall nicht (mehr)"
+    "NETWORK_ITEM_NOT_FOUND": "Das Objekt existiert auf der Firewall nicht (mehr)",
    "UPDATER_UNAVAILABLE": "Der Updater ist nicht aktiviert oder nicht erreichbar.",
    "UPDATER_BUSY": "Es läuft bereits ein Update oder Rollback.",
    "UPDATER_REJECTED": "Der Updater hat die Anfrage abgelehnt ({reason}).",
    "UPDATE_NOT_OFFERED": "Diese Version wird nicht zur Installation angeboten — nur die neueste stabile Version.",
    "UPDATE_MAJOR_CHANGE": "Hauptversions-Sprünge bitte bewusst auf dem Server mit „opnexus update“ ausführen.",
    "ADMIN_REQUIRED": "Diese Funktion erfordert die Rolle „Admin“."
  },
  "workflow": {
    "attention": "Fehler prüfen",
@@ -552,8 +628,9 @@
  "updateBanner": {
    "title": "OPNexus {latest} ist verfügbar (installiert: {current}).",
    "notes": "Release-Notes",
-    "how": "Aktualisieren auf dem Server mit „opnexus update“.",
+    "how": "Aktualisieren in den Einstellungen oder auf dem Server mit „opnexus update“.",
-    "dismiss": "Hinweis für diese Version ausblenden"
+    "dismiss": "Hinweis für diese Version ausblenden",
    "settings": "Zu den Einstellungen"
  },
  "acme": {
    "externalCaWarning": "Kontaktiert die echte Zertifizierungsstelle (z. B. Let's Encrypt) über das Internet — keine rein lokale Änderung. Zählt gegen deren Rate-Limits (z. B. Ausstellungen pro Domain und Woche). Für Tests eine *_test-CA (z. B. letsencrypt_test) verwenden.",
@@ -1443,7 +1520,8 @@
      "wireguard_tunnel": "WireGuard",
      "certificate": "Zertifikate",
      "acme": "ACME",
-      "notification": "Benachrichtigungen"
+      "notification": "Benachrichtigungen",
      "system": "OPNexus-System"
    },
    "action": {
      "deploy": "Push",
@@ -1817,7 +1895,19 @@
      "dns_host": "DNS-Eintrag",
      "dhcp_host": "DHCP-Host (dnsmasq)",
      "kea_subnet": "DHCP-Subnetz (Kea)",
-      "kea_reservation": "DHCP-Reservierung (Kea)"
+      "kea_reservation": "DHCP-Reservierung (Kea)",
      "tunable": "Tunable",
      "cron_job": "Cron-Job",
      "syslog_destination": "Syslog-Ziel",
      "gateway_group": "Gateway-Gruppen",
      "lagg": "LAGG",
      "bridge": "Bridge",
      "loopback": "Loopback",
      "gre": "GRE-Tunnel",
      "dns_forward": "DNS-Weiterleitungen",
      "dhcp_range": "DHCP-Bereiche (dnsmasq)",
      "gif": "GIF-Tunnel",
      "vxlan": "VXLAN"
    },
    "field": {
      "if": "Eltern-Schnittstelle",
@@ -1894,7 +1984,66 @@
        "domain_name_servers": "DNS-Server",
        "domain_name": "Domain-Name",
        "ntp_servers": "NTP-Server"
-      }
+      },
      "tunable": "Tunable",
      "value": "Wert",
      "default_value": "Standardwert",
      "minutes": "Minute",
      "hours": "Stunde",
      "days": "Tag",
      "months": "Monat",
      "weekdays": "Wochentag",
      "who": "Benutzer",
      "command": "Befehl",
      "parameters": "Parameter",
      "transport": "Transport",
      "program": "Programme",
      "level": "Level",
      "facility": "Facility",
      "rfc5424": "RFC 5424",
      "rfc5424Hint": "RFC-5424-Format verwenden",
      "item": "Gateways (Stufe 1)",
      "item2": "Gateways (Stufe 2)",
      "item3": "Gateways (Stufe 3)",
      "item4": "Gateways (Stufe 4)",
      "item5": "Gateways (Stufe 5)",
      "trigger": "Auslöser",
      "poolopts": "Pool-Optionen",
      "members": "Mitglieder",
      "primary_member": "Primäres Mitglied",
      "lacp_fast_timeout": "LACP Fast-Timeout",
      "lagghash": "Hash-Verfahren",
      "laggif": "Gerät",
      "bridgeif": "Gerät",
      "linklocal": "Link-Local",
      "linklocalHint": "Link-Local-Adresse automatisch vergeben",
      "enablestp": "STP",
      "enablestpHint": "Spanning Tree aktivieren",
      "deviceId": "Geräte-Nr.",
      "local-addr": "Lokale Adresse",
      "remote-addr": "Gegenstelle",
      "tunnel-local-addr": "Tunnel-Adresse lokal",
      "tunnel-remote-addr": "Tunnel-Adresse Gegenstelle",
      "tunnel-remote-net": "Tunnel-Präfix",
      "greif": "Gerät",
      "type": "Typ",
      "verify": "Zertifikat prüfen",
      "forward_tcp_upstream": "TCP zum Upstream",
      "forward_tcp_upstreamHint": "Anfragen per TCP weiterleiten",
      "forward_first": "Zuerst weiterleiten",
      "forward_firstHint": "Erst weiterleiten, danach selbst auflösen",
      "start_addr": "Von",
      "end_addr": "Bis",
      "subnet_mask": "Subnetzmaske",
      "domain_type": "Domain-Art",
      "vxlanid": "VNI",
      "vxlanlocal": "Lokale Adresse",
      "vxlanlocalport": "Lokaler Port",
      "vxlanremote": "Gegenstelle",
      "vxlanremoteport": "Port der Gegenstelle",
      "vxlangroup": "Multicast-Gruppe",
      "vxlandev": "Gerät",
      "gifif": "Gerät"
    },
    "risks": {
      "management_interface": "Diese Änderung betrifft {device}, die Schnittstelle, über die OPNexus die Firewall erreicht. Die Verbindung kann abbrechen.",
@@ -1905,19 +2054,23 @@
      "management_gateway": "{name} hängt an der Schnittstelle, über die OPNexus die Firewall erreicht.",
      "default_route": "Eine Standardroute ({network}) verändert den Weg für fast den gesamten Verkehr.",
      "route_covers_management": "Die Route {network} deckt die Adresse der Firewall ab. Die Antworten an OPNexus können einen anderen Weg nehmen.",
-      "interface_rules_removed": "Beim Entfernen löscht OPNsense selbst {count} Regel(n), die diese Schnittstelle nutzen: {names}"
+      "interface_rules_removed": "Beim Entfernen löscht OPNsense selbst {count} Regel(n), die diese Schnittstelle nutzen: {names}",
      "management_member": "{device} ist die Schnittstelle, über die OPNexus die Firewall erreicht, und gehört zu diesem Gerät. Die Verbindung kann abbrechen.",
      "tunable_change": "Tunables ändern das Verhalten des gesamten Systems; manche greifen erst nach einem Neustart und manche können die Firewall unbrauchbar machen."
    },
    "warnings": {
      "carp_change": "CARP-Änderungen können einen Wechsel zwischen Master und Backup auslösen.",
      "cluster_peers": "Diese Firewall gehört zu einem Cluster. Dieselbe Änderung muss ggf. auch auf {hosts} erfolgen. VIPs und Gateways werden nicht automatisch synchronisiert.",
-      "core_interface": "{name} ist eine Kern-Schnittstelle der Firewall. Änderungen wirken sich auf alle Regeln und Dienste darauf aus."
+      "core_interface": "{name} ist eine Kern-Schnittstelle der Firewall. Änderungen wirken sich auf alle Regeln und Dienste darauf aus.",
      "gateway_group_in_use": "Regeln, die diese Gateway-Gruppe nutzen, verlieren ihr Ziel."
    },
    "blocks": {
      "api_unavailable": "Diese Firewall stellt dafür keine API bereit ({section}).",
      "nothing_to_change": "Es gibt nichts zu ändern.",
      "interface_api_unavailable": "Diese OPNsense-Version kann Schnittstellen nicht per API konfigurieren (ab ca. 26.7.6).",
      "interface_changes_pending": "Auf der Firewall warten bereits vorgemerkte Schnittstellen-Änderungen auf das Anwenden. Zuerst dort prüfen und anwenden oder verwerfen.",
-      "interface_locked": "Die Schnittstelle ist gesperrt. Zuerst die Sperre aufheben, dann löschen."
+      "interface_locked": "Die Schnittstelle ist gesperrt. Zuerst die Sperre aufheben, dann löschen.",
      "tunable_default_row": "Das ist eine Vorgabe der Firewall. Zum Ändern einen eigenen Eintrag mit „Überschreiben“ anlegen."
    },
    "change": {
      "title": {
@@ -1948,7 +2101,9 @@
        "after": "Nachher"
      },
      "invalidValue": "Ungültiger Wert.",
-      "unreachable": "Die Änderung wurde angewendet, aber „{host}“ antwortet unter der bisherigen Adresse nicht mehr. Wurde die Verwaltungs-Adresse geändert, die neue Adresse unter Hosts › Bearbeiten eintragen. Das Backup vor der Änderung bleibt gespeichert."
+      "unreachable": "Die Änderung wurde angewendet, aber „{host}“ antwortet unter der bisherigen Adresse nicht mehr. Wurde die Verwaltungs-Adresse geändert, die neue Adresse unter Hosts › Bearbeiten eintragen. Das Backup vor der Änderung bleibt gespeichert.",
      "transferHint": "Dieselbe Änderung auch auf den Partner im Cluster anwenden? Zuerst den Backup-Knoten, dann den Master.",
      "transfer": "Auf {host} übertragen"
    },
    "rowAdd": "Hinzufügen",
    "rowEdit": "Bearbeiten",
@@ -1960,6 +2115,176 @@
      "dnsmasq": "Hosts (dnsmasq: statisches DHCP und DNS)",
      "keaSubnets": "Subnetze (Kea)",
      "keaReservations": "Reservierungen (Kea)"
    },
    "objectsUnavailable": "Diese OPNsense-Version bietet dafür keine API.",
    "override": "Überschreiben",
    "compare": {
      "loadFailed": "Der Abgleich konnte nicht geladen werden.",
      "noClusters": "Kein Cluster mit mindestens zwei Hosts vorhanden.",
      "intro": "Vergleicht die Netzwerk-Konfiguration der Knoten eines Clusters. Adressen, CARP-Advskew und das aktive Standard-Gateway dürfen sich unterscheiden und werden nicht verglichen.",
      "unreachable": "Nicht erreichbar: {hosts}",
      "same": "Identisch",
      "count": "{count} Abweichung(en)",
      "category": "Bereich",
      "object": "Objekt",
      "state": "Zustand",
      "missing": "Fehlt",
      "different": "Weicht ab",
      "absent": "fehlt",
      "categories": {
        "interfaces": "Schnittstelle",
        "vlans": "VLAN",
        "vips": "Virtuelle IP",
        "gateways": "Gateway",
        "routes": "Route",
        "dns_hosts": "DNS-Eintrag",
        "dhcp_hosts": "DHCP-Host",
        "kea_subnets": "DHCP-Subnetz",
        "kea_reservations": "DHCP-Reservierung"
      }
    }
  },
  "hostsystem": {
    "intro": {
      "tunables": "Systemparameter der Firewall (sysctl). Die Werte der Firewall selbst bleiben unberührt, eigene Einträge überschreiben sie.",
      "cron": "Zeitgesteuerte Aufgaben, die die Firewall selbst ausführt.",
      "syslog": "Entfernte Log-Ziele, an die die Firewall ihre Meldungen schickt.",
      "snapshots": "ZFS-Snapshots der Firewall als zusätzliches Sicherheitsnetz vor größeren Änderungen. Aktivieren (mit Neustart) geschieht bewusst nur in OPNsense selbst.",
      "diagnostics": "Netzwerk-Abfragen, die die ausgewählte Firewall selbst ausführt (Erreichbarkeit, Wege, Ports, Namensauflösung). Ergebnisse werden nur angezeigt; jeder Lauf steht mit Ziel im Audit-Log."
    },
    "snapshots": {
      "create": "Snapshot anlegen",
      "createHint": "Der Snapshot hält den aktuellen Systemzustand fest. Er ersetzt kein Konfigurations-Backup.",
      "name": "Name",
      "nameHint": "Buchstaben, Ziffern, Punkt, Unterstrich und Bindestrich.",
      "note": "Notiz",
      "state": "Zustand",
      "size": "Größe",
      "createdAt": "Erstellt",
      "activeNow": "aktiv",
      "activeNext": "aktiv nach Neustart",
      "unsupported": "Diese Firewall unterstützt keine Snapshots (kein ZFS).",
      "created": "Snapshot „{name}“ angelegt.",
      "createFailed": "Snapshot konnte nicht angelegt werden.",
      "deleted": "Snapshot „{name}“ gelöscht.",
      "deleteFailed": "Snapshot konnte nicht gelöscht werden.",
      "deleteConfirm": "Snapshot „{name}“ wirklich löschen?"
    },
    "diag": {
      "tools": {
        "ping": "Ping",
        "traceroute": "Traceroute",
        "portprobe": "Port prüfen",
        "dns": "DNS-Abfrage"
      },
      "target": "Ziel (Host oder IP)",
      "name": "Name",
      "ipproto": "IP-Version",
      "source": "Quelladresse (optional)",
      "sourceHint": "Eigene Adresse der Firewall, von der aus abgefragt wird. Leer = automatisch.",
      "count": "Anzahl (1–10)",
      "packetsize": "Paketgröße (optional)",
      "protocol": "Protokoll",
      "port": "Port",
      "server": "DNS-Server (optional)",
      "serverHint": "Leer = die Resolver der Firewall.",
      "run": "Ausführen",
      "running": "Läuft…",
      "auditNote": "Wird im Audit-Log festgehalten.",
      "failed": "Die Abfrage ist fehlgeschlagen.",
      "reachable": "Erreichbar",
      "unreachable": "Nicht erreichbar",
      "pingSummary": "{sent} gesendet, {received} empfangen, {loss} Verlust",
      "hop": "Hop",
      "hostname": "Name",
      "time": "Zeit",
      "open": "Port {port} offen",
      "closed": "Port {port} nicht erreichbar",
      "noRecords": "Keine Antwort für „{name}“."
    }
  },
  "setup": {
    "title": "Einrichtungsassistent",
    "skip": "Assistent überspringen",
    "stepsLabel": "Einrichtungsschritte",
    "stepOf": "Schritt {current} von {total}",
    "back": "Zurück",
    "next": "Weiter",
    "finish": "Einrichtung abschließen",
    "readOnly": "Der Assistent richtet Konto und Firewalls ein und ist deshalb Administratoren vorbehalten.",
    "toDashboard": "Zum Dashboard",
    "steps": {
      "welcome": "Willkommen",
      "account": "Konto",
      "firewall": "Firewall",
      "done": "Fertig"
    },
    "welcome": {
      "title": "Willkommen bei OPNexus",
      "intro": "OPNexus verwaltet deine OPNsense-Firewalls zentral: Regeln, NAT, VPN, Zertifikate, Updates und HA-Cluster an einem Ort. Dieser Assistent richtet das Nötigste in wenigen Minuten ein. Du kannst ihn jederzeit überspringen und später unter System › Einrichtung wieder öffnen.",
      "points": {
        "account": "Konto absichern: eigenes Passwort und Zwei-Faktor-Anmeldung.",
        "firewall": "Erste Firewall verbinden: API-Key anlegen, Zertifikat prüfen, fertig.",
        "done": "Überblick, was als Nächstes sinnvoll ist."
      },
      "readOnlyNote": "Der Assistent liest nur von deiner Firewall. Geändert wird dort erst, wenn du später selbst etwas ausrollst."
    },
    "account": {
      "title": "Konto absichern",
      "passwordTitle": "Eigenes Passwort",
      "passwordDone": "Geändert",
      "passwordIntro": "Hast du beim Start kein ADMIN_PASSWORD gesetzt, hat OPNexus ein Zufallspasswort erzeugt. Setze jetzt ein eigenes. Dieser Schritt ist optional.",
      "currentHint": "Das Passwort, mit dem du dich gerade angemeldet hast. Verloren? Auf dem Server: ./opnexus password",
      "newHint": "Mindestens 10 Zeichen. Ein Passwortmanager ist am bequemsten.",
      "twofaTitle": "Zwei-Faktor-Anmeldung (empfohlen)",
      "twofaIntro": "OPNexus kann Firewalls verändern. Ein zweiter Faktor aus einer Authenticator-App schützt das Konto auch dann, wenn das Passwort bekannt wird."
    },
    "firewall": {
      "title": "Erste Firewall verbinden",
      "intro": "OPNexus spricht über die REST-API mit deiner OPNsense. Dafür braucht es einen API-Key. Das Anlegen dauert eine Minute.",
      "connected": "Verbundene Firewalls",
      "recheck": "Erneut prüfen",
      "offlineHelp": "Prüfe Adresse und API-Key und ob die Firewall den Zugriff auf die Weboberfläche von diesem Server aus erlaubt.",
      "keyTitle": "So legst du den API-Key in OPNsense an",
      "keySteps": {
        "menu": "In OPNsense System › Access › Users öffnen.",
        "user": "Einen eigenen Benutzer (z. B. „opnexus“) anlegen oder einen vorhandenen bearbeiten.",
        "key": "Beim Benutzer unter „API keys“ auf das Plus klicken. Der Browser lädt eine Datei apikey.txt herunter.",
        "rights": "Dem Benutzer ausreichende Rechte geben, am einfachsten die Gruppe „admin“. Mit weniger Rechten schlagen einzelne Funktionen fehl."
      },
      "keyFileNote": "In apikey.txt steht der Key hinter key=, das Secret hinter secret=. Das Secret gibt es nur in dieser Datei.",
      "addFirst": "Firewall eintragen",
      "addAnother": "Weitere Firewall eintragen",
      "nameHint": "Frei wählbar, nur zur Anzeige. Bei einem HA-Paar z. B. fw-a und fw-b.",
      "urlHint": "Adresse der OPNsense-Weboberfläche, mit https:// und gegebenenfalls Port, z. B. https://192.168.1.1:8443.",
      "clusterHint": "Besteht die Firewall aus einem HA-Paar? Trage beide Knoten als eigene Firewall ein und gib bei beiden denselben Cluster-Namen an.",
      "connect": "Verbinden",
      "connectNote": "OPNexus prüft sofort, ob die Firewall antwortet."
    },
    "done": {
      "title": "Fertig",
      "hostsOnline": "{online} von {total} Firewalls erreichbar",
      "noHosts": "Noch keine Firewall verbunden",
      "twofaOn": "Zwei-Faktor aktiv",
      "twofaOff": "Zwei-Faktor nicht aktiv",
      "nextTitle": "Das kannst du als Nächstes tun",
      "next": {
        "rules": {
          "title": "Regeln anlegen",
          "text": "Neue Regeln rollst du mit Bestätigung aus: Bestätigst du nicht innerhalb von {seconds} Sekunden, rollt OPNexus automatisch zurück."
        },
        "notify": {
          "title": "Benachrichtigungen",
          "text": "Per Webhook oder E-Mail melden lassen, wenn eine Firewall ausfällt oder ein Zertifikat abläuft."
        },
        "update": {
          "title": "Updates",
          "text": "Hinweis auf neue OPNexus-Versionen und Updates per Klick einrichten."
        }
      },
      "backupBefore": "Eine Sicherung der OPNexus-Datenbank erstellst du auf dem Server mit",
      "backupHelp": "Sichert die Datenbank (Regeln, Hosts, Verlauf). API-Secrets und Schlüssel liegen in eigenen Docker-Volumes und sind nicht im Dump. Details im Handbuch.",
      "docs": "Dokumentation zum Kommandozeilen-Werkzeug"
    }
  }
 }
@@ -62,7 +62,8 @@
        "maintenanceUnknown": "Maintenance outcome unclear",
        "carpHealth": "CARP state critical (split-brain / no master)",
        "natDrift": "NAT drift in the cluster",
-        "carpAutoRevertFailed": "CARP auto-revert failed"
+        "carpAutoRevertFailed": "CARP auto-revert failed",
        "networkDrift": "Network differences in the cluster"
      },
      "pollInterval": "Check interval (seconds)",
      "pollHint": "At least 60s, so the firewalls are not loaded unnecessarily."
@@ -109,7 +110,66 @@
    "about": "About OPNexus",
    "version": "Version",
    "development": "Development",
-    "changelogNote": "The change history and version scheme are in {file}."
+    "changelogNote": "The change history and version scheme are in {file}.",
    "update": {
      "title": "Update OPNexus",
      "hint": "Pulls the new images, switches the services and checks that everything is healthy. If that fails, OPNexus rolls back to the previous version automatically.",
      "installed": "Installed",
      "latest": "Latest version",
      "upToDate": "OPNexus is up to date.",
      "notes": "Release notes",
      "checked": "Last checked: {time}",
      "feedOff": "The version check is off. Set UPDATE_CHECK_URL in the server's .env so OPNexus can detect new versions.",
      "feedError": "The release feed is currently unreachable.",
      "notEnabledTitle": "Updates from the web interface are not enabled.",
      "notEnabledBody": "They need a small separate service (the updater) with access to Docker — deliberately optional. To enable it:",
      "notEnabledStep1": "Add to the .env on the server:",
      "notEnabledStep2": "Then run:",
      "notEnabledCli": "Until then, update on the server with “opnexus update”.",
      "unreachable": "The updater does not respond. Check on the server: docker compose ps updater",
      "localMode": "This installation builds OPNexus locally from source (no release image). Update on the server with git pull and docker compose up -d --build.",
      "majorChange": "Version {latest} is a major version jump. Please read the release notes first, then update on the server with “opnexus update {latest}”.",
      "button": "Update to {latest}",
      "confirmTitle": "Update to {latest}?",
      "confirmBody": "OPNexus pulls the new images and restarts itself. The interface is unavailable for about one to two minutes; the managed firewalls are not affected.",
      "confirmSafety": "A backup is taken automatically before a database migration. If the new version does not become healthy, OPNexus rolls back to the previous version on its own.",
      "confirm": "Update now",
      "startFailed": "Could not start the update",
      "running": "Updating to {target} …",
      "rollingBack": "Rolling back …",
      "reconnecting": "Reconnecting — this is normal while the services restart.",
      "phase": {
        "pulling": "Pulling new images",
        "switching": "Switching services",
        "waiting": "Waiting for healthy services",
        "stopping": "Stopping services",
        "restoring": "Restoring the database",
        "rolled_back": "Rolled back",
        "done": "Done"
      },
      "result": {
        "succeededUpdate": "OPNexus is now running {version}. Reloading the page …",
        "succeededRollback": "OPNexus was rolled back to {version}. Reloading the page …",
        "rolledBack": "The update to {target} failed. OPNexus was rolled back to the previous version automatically.",
        "failed": "The operation failed. Check the log and the server state (on the server: opnexus status)."
      },
      "showLog": "Log",
      "rollback": {
        "button": "Roll back to previous version",
        "hint": "Undoes the last update (back to {version}).",
        "confirmTitle": "Roll back to {version}?",
        "dataLoss": "The update migrated the database. Rolling back restores the state from before the update: changes made since the update and the log history are lost.",
        "noDataLoss": "The database was not migrated — no data is lost.",
        "confirm": "Roll back"
      },
      "badge": "Update available",
      "resultTime": "Result from {time}"
    },
    "setup": {
      "title": "Setup assistant",
      "intro": "Walks you step by step through password, two-factor sign-in and connecting a firewall.",
      "open": "Open assistant"
    }
  },
  "nav": {
    "aboutTitle": "About OPNexus — fleet status & versions",
@@ -126,7 +186,8 @@
      "vpn": "VPN",
      "certificates": "Certificates",
      "monitoring": "Monitoring",
-      "system": "System"
+      "system": "System",
      "hostsystem": "Host system"
    },
    "items": {
      "dashboard": "Dashboard",
@@ -152,7 +213,15 @@
      "audit": "Audit",
      "updates": "Update Center",
      "settings": "Settings",
-      "users": "Users"
+      "users": "Users",
      "network-devices": "Devices",
      "network-compare": "Compare",
      "hostsystem-tunables": "Tunables",
      "hostsystem-cron": "Cron",
      "hostsystem-syslog": "Syslog",
      "hostsystem-snapshots": "Snapshots",
      "hostsystem-diagnostics": "Diagnostics",
      "setup": "Setup"
    }
  },
  "dashboard": {
@@ -164,6 +233,7 @@
    "fleetHealth": "Fleet/CARP health",
    "noHosts": "No hosts yet",
    "toHosts": "Go to hosts",
    "startSetup": "Start the setup assistant",
    "nothingPending": "Nothing pending",
    "nothingPendingDescription": "No pending confirmations, errors, or unclear maintenance operations.",
    "securityAndExpiryWarnings": "Security & expiry warnings",
@@ -500,7 +570,13 @@
    "NETWORK_BACKUP_FAILED": "Backup of “{host}” before the change failed – nothing was changed",
    "NETWORK_CHANGE_BLOCKED": "The change is not possible ({reasons})",
    "NETWORK_FIELD_INVALID": "Invalid field: {field}",
-    "NETWORK_ITEM_NOT_FOUND": "The object does not exist on the firewall (any more)"
+    "NETWORK_ITEM_NOT_FOUND": "The object does not exist on the firewall (any more)",
    "UPDATER_UNAVAILABLE": "The updater is not enabled or not reachable.",
    "UPDATER_BUSY": "An update or rollback is already running.",
    "UPDATER_REJECTED": "The updater rejected the request ({reason}).",
    "UPDATE_NOT_OFFERED": "This version is not offered for installation — only the latest stable version.",
    "UPDATE_MAJOR_CHANGE": "Please run major version jumps deliberately on the server with “opnexus update”.",
    "ADMIN_REQUIRED": "This function requires the “Admin” role."
  },
  "workflow": {
    "attention": "Check errors",
@@ -552,8 +628,9 @@
  "updateBanner": {
    "title": "OPNexus {latest} is available (installed: {current}).",
    "notes": "Release notes",
-    "how": "Update on the server with “opnexus update”.",
+    "how": "Update in the settings or on the server with “opnexus update”.",
-    "dismiss": "Hide this notice for this version"
+    "dismiss": "Hide this notice for this version",
    "settings": "Go to settings"
  },
  "acme": {
    "externalCaWarning": "Contacts the real certificate authority (e.g. Let's Encrypt) over the internet — not a purely local change. Counts against its rate limits (e.g. issuances per domain per week). Use a *_test CA (e.g. letsencrypt_test) for testing.",
@@ -1443,7 +1520,8 @@
      "wireguard_tunnel": "WireGuard",
      "certificate": "Certificates",
      "acme": "ACME",
-      "notification": "Notifications"
+      "notification": "Notifications",
      "system": "OPNexus system"
    },
    "action": {
      "deploy": "Push",
@@ -1817,7 +1895,19 @@
      "dns_host": "DNS entry",
      "dhcp_host": "DHCP host (dnsmasq)",
      "kea_subnet": "DHCP subnet (Kea)",
-      "kea_reservation": "DHCP reservation (Kea)"
+      "kea_reservation": "DHCP reservation (Kea)",
      "tunable": "Tunable",
      "cron_job": "Cron job",
      "syslog_destination": "Syslog target",
      "gateway_group": "Gateway groups",
      "lagg": "LAGG",
      "bridge": "Bridge",
      "loopback": "Loopback",
      "gre": "GRE tunnel",
      "dns_forward": "DNS forwards",
      "dhcp_range": "DHCP ranges (dnsmasq)",
      "gif": "GIF tunnel",
      "vxlan": "VXLAN"
    },
    "field": {
      "if": "Parent interface",
@@ -1894,7 +1984,66 @@
        "domain_name_servers": "DNS servers",
        "domain_name": "Domain name",
        "ntp_servers": "NTP servers"
-      }
+      },
      "tunable": "Tunable",
      "value": "Value",
      "default_value": "Default value",
      "minutes": "Minute",
      "hours": "Hour",
      "days": "Day",
      "months": "Month",
      "weekdays": "Weekday",
      "who": "User",
      "command": "Command",
      "parameters": "Parameters",
      "transport": "Transport",
      "program": "Programs",
      "level": "Level",
      "facility": "Facility",
      "rfc5424": "RFC 5424",
      "rfc5424Hint": "Use RFC 5424 format",
      "item": "Gateways (tier 1)",
      "item2": "Gateways (tier 2)",
      "item3": "Gateways (tier 3)",
      "item4": "Gateways (tier 4)",
      "item5": "Gateways (tier 5)",
      "trigger": "Trigger",
      "poolopts": "Pool options",
      "members": "Members",
      "primary_member": "Primary member",
      "lacp_fast_timeout": "LACP fast timeout",
      "lagghash": "Hash algorithm",
      "laggif": "Device",
      "bridgeif": "Device",
      "linklocal": "Link-local",
      "linklocalHint": "Assign a link-local address automatically",
      "enablestp": "STP",
      "enablestpHint": "Enable spanning tree",
      "deviceId": "Device no.",
      "local-addr": "Local address",
      "remote-addr": "Remote address",
      "tunnel-local-addr": "Tunnel address (local)",
      "tunnel-remote-addr": "Tunnel address (remote)",
      "tunnel-remote-net": "Tunnel prefix",
      "greif": "Device",
      "type": "Type",
      "verify": "Verify certificate",
      "forward_tcp_upstream": "TCP to upstream",
      "forward_tcp_upstreamHint": "Forward queries over TCP",
      "forward_first": "Forward first",
      "forward_firstHint": "Forward first, then resolve locally",
      "start_addr": "From",
      "end_addr": "To",
      "subnet_mask": "Subnet mask",
      "domain_type": "Domain type",
      "vxlanid": "VNI",
      "vxlanlocal": "Local address",
      "vxlanlocalport": "Local port",
      "vxlanremote": "Remote address",
      "vxlanremoteport": "Remote port",
      "vxlangroup": "Multicast group",
      "vxlandev": "Device",
      "gifif": "Device"
    },
    "risks": {
      "management_interface": "This change affects {device}, the interface OPNexus uses to reach the firewall. The connection may drop.",
@@ -1905,19 +2054,23 @@
      "management_gateway": "{name} sits on the interface OPNexus uses to reach the firewall.",
      "default_route": "A default route ({network}) changes the path for almost all traffic.",
      "route_covers_management": "The route {network} covers the firewall's own address. Replies to OPNexus may take a different path.",
-      "interface_rules_removed": "Removing it makes OPNsense itself delete {count} rule(s) that use this interface: {names}"
+      "interface_rules_removed": "Removing it makes OPNsense itself delete {count} rule(s) that use this interface: {names}",
      "management_member": "{device} is the interface OPNexus uses to reach the firewall, and it is a member of this device. The connection may drop.",
      "tunable_change": "Tunables change how the whole system behaves; some only apply after a reboot and some can make the firewall unusable."
    },
    "warnings": {
      "carp_change": "CARP changes can trigger a switch between master and backup.",
      "cluster_peers": "This firewall is part of a cluster. The same change may be needed on {hosts} as well. VIPs and gateways are not synchronised automatically.",
-      "core_interface": "{name} is a core interface of the firewall. Changes affect every rule and service on it."
+      "core_interface": "{name} is a core interface of the firewall. Changes affect every rule and service on it.",
      "gateway_group_in_use": "Rules that use this gateway group lose their target."
    },
    "blocks": {
      "api_unavailable": "This firewall does not offer an API for this ({section}).",
      "nothing_to_change": "There is nothing to change.",
      "interface_api_unavailable": "This OPNsense version cannot configure interfaces through its API (from about 26.7.6).",
      "interface_changes_pending": "Interface changes are already staged on the firewall and waiting to be applied. Check and apply or discard them there first.",
-      "interface_locked": "The interface is locked. Remove the lock first, then delete."
+      "interface_locked": "The interface is locked. Remove the lock first, then delete.",
      "tunable_default_row": "This is a built-in default of the firewall. To change it, create your own entry with “Override”."
    },
    "change": {
      "title": {
@@ -1948,7 +2101,9 @@
        "after": "After"
      },
      "invalidValue": "Invalid value.",
-      "unreachable": "The change was applied, but “{host}” no longer answers on its previous address. If the management address was changed, enter the new one under Hosts › Edit. The backup taken before the change is kept."
+      "unreachable": "The change was applied, but “{host}” no longer answers on its previous address. If the management address was changed, enter the new one under Hosts › Edit. The backup taken before the change is kept.",
      "transferHint": "Apply the same change to the partner in the cluster as well? Backup node first, then the master.",
      "transfer": "Transfer to {host}"
    },
    "rowAdd": "Add",
    "rowEdit": "Edit",
@@ -1960,6 +2115,176 @@
      "dnsmasq": "Hosts (dnsmasq: static DHCP and DNS)",
      "keaSubnets": "Subnets (Kea)",
      "keaReservations": "Reservations (Kea)"
    },
    "objectsUnavailable": "This OPNsense version offers no API for this.",
    "override": "Override",
    "compare": {
      "loadFailed": "Could not load the comparison.",
      "noClusters": "No cluster with at least two hosts.",
      "intro": "Compares the network configuration of a cluster's nodes. Addresses, CARP advskew and the active default gateway may differ and are not compared.",
      "unreachable": "Unreachable: {hosts}",
      "same": "Identical",
      "count": "{count} difference(s)",
      "category": "Area",
      "object": "Object",
      "state": "State",
      "missing": "Missing",
      "different": "Differs",
      "absent": "missing",
      "categories": {
        "interfaces": "Interface",
        "vlans": "VLAN",
        "vips": "Virtual IP",
        "gateways": "Gateway",
        "routes": "Route",
        "dns_hosts": "DNS entry",
        "dhcp_hosts": "DHCP host",
        "kea_subnets": "DHCP subnet",
        "kea_reservations": "DHCP reservation"
      }
    }
  },
  "hostsystem": {
    "intro": {
      "tunables": "System parameters of the firewall (sysctl). The firewall's own values stay untouched; your own entries override them.",
      "cron": "Scheduled tasks the firewall runs itself.",
      "syslog": "Remote log targets the firewall sends its messages to.",
      "snapshots": "ZFS snapshots of the firewall as an extra safety net before bigger changes. Activating one (with a reboot) is deliberately left to OPNsense itself.",
      "diagnostics": "Network queries the selected firewall runs itself (reachability, paths, ports, name resolution). Results are only shown; every run is recorded with its target in the audit log."
    },
    "snapshots": {
      "create": "Create snapshot",
      "createHint": "The snapshot captures the current system state. It does not replace a configuration backup.",
      "name": "Name",
      "nameHint": "Letters, digits, dot, underscore and hyphen.",
      "note": "Note",
      "state": "State",
      "size": "Size",
      "createdAt": "Created",
      "activeNow": "active",
      "activeNext": "active after reboot",
      "unsupported": "This firewall does not support snapshots (no ZFS).",
      "created": "Snapshot “{name}” created.",
      "createFailed": "Could not create the snapshot.",
      "deleted": "Snapshot “{name}” deleted.",
      "deleteFailed": "Could not delete the snapshot.",
      "deleteConfirm": "Really delete snapshot “{name}”?"
    },
    "diag": {
      "tools": {
        "ping": "Ping",
        "traceroute": "Traceroute",
        "portprobe": "Port check",
        "dns": "DNS lookup"
      },
      "target": "Target (host or IP)",
      "name": "Name",
      "ipproto": "IP version",
      "source": "Source address (optional)",
      "sourceHint": "The firewall's own address to query from. Empty = automatic.",
      "count": "Count (1–10)",
      "packetsize": "Packet size (optional)",
      "protocol": "Protocol",
      "port": "Port",
      "server": "DNS server (optional)",
      "serverHint": "Empty = the firewall's resolvers.",
      "run": "Run",
      "running": "Running…",
      "auditNote": "Recorded in the audit log.",
      "failed": "The query failed.",
      "reachable": "Reachable",
      "unreachable": "Unreachable",
      "pingSummary": "{sent} sent, {received} received, {loss} loss",
      "hop": "Hop",
      "hostname": "Name",
      "time": "Time",
      "open": "Port {port} open",
      "closed": "Port {port} not reachable",
      "noRecords": "No answer for “{name}”."
    }
  },
  "setup": {
    "title": "Setup assistant",
    "skip": "Skip assistant",
    "stepsLabel": "Setup steps",
    "stepOf": "Step {current} of {total}",
    "back": "Back",
    "next": "Next",
    "finish": "Finish setup",
    "readOnly": "The assistant sets up the account and firewalls, so it is reserved for administrators.",
    "toDashboard": "Go to dashboard",
    "steps": {
      "welcome": "Welcome",
      "account": "Account",
      "firewall": "Firewall",
      "done": "Done"
    },
    "welcome": {
      "title": "Welcome to OPNexus",
      "intro": "OPNexus manages your OPNsense firewalls in one place: rules, NAT, VPN, certificates, updates and HA clusters. This assistant sets up the essentials in a few minutes. You can skip it at any time and reopen it later under System › Setup.",
      "points": {
        "account": "Secure the account: your own password and two-factor sign-in.",
        "firewall": "Connect your first firewall: create an API key, check the certificate, done.",
        "done": "An overview of what makes sense next."
      },
      "readOnlyNote": "The assistant only reads from your firewall. Nothing there changes until you roll something out yourself later."
    },
    "account": {
      "title": "Secure the account",
      "passwordTitle": "Your own password",
      "passwordDone": "Changed",
      "passwordIntro": "If you did not set ADMIN_PASSWORD at startup, OPNexus generated a random password. Set your own now. This step is optional.",
      "currentHint": "The password you just signed in with. Lost it? On the server: ./opnexus password",
      "newHint": "At least 10 characters. A password manager is the most convenient way.",
      "twofaTitle": "Two-factor sign-in (recommended)",
      "twofaIntro": "OPNexus can change firewalls. A second factor from an authenticator app protects the account even if the password becomes known."
    },
    "firewall": {
      "title": "Connect your first firewall",
      "intro": "OPNexus talks to your OPNsense through its REST API, which needs an API key. Creating one takes a minute.",
      "connected": "Connected firewalls",
      "recheck": "Check again",
      "offlineHelp": "Check the address and API key, and that the firewall allows web interface access from this server.",
      "keyTitle": "How to create the API key in OPNsense",
      "keySteps": {
        "menu": "In OPNsense open System › Access › Users.",
        "user": "Create a dedicated user (e.g. “opnexus”) or edit an existing one.",
        "key": "Under “API keys” on that user click the plus. Your browser downloads a file called apikey.txt.",
        "rights": "Give the user sufficient privileges, most simply the “admin” group. With fewer privileges individual features fail."
      },
      "keyFileNote": "In apikey.txt the key follows key= and the secret follows secret=. The secret exists only in this file.",
      "addFirst": "Add a firewall",
      "addAnother": "Add another firewall",
      "nameHint": "Free choice, display only. For an HA pair e.g. fw-a and fw-b.",
      "urlHint": "Address of the OPNsense web interface, with https:// and the port if needed, e.g. https://192.168.1.1:8443.",
      "clusterHint": "Is the firewall an HA pair? Add both nodes as separate firewalls and give both the same cluster name.",
      "connect": "Connect",
      "connectNote": "OPNexus checks right away whether the firewall answers."
    },
    "done": {
      "title": "Done",
      "hostsOnline": "{online} of {total} firewalls reachable",
      "noHosts": "No firewall connected yet",
      "twofaOn": "Two-factor on",
      "twofaOff": "Two-factor off",
      "nextTitle": "What you can do next",
      "next": {
        "rules": {
          "title": "Create rules",
          "text": "New rules are rolled out with a confirmation: if you do not confirm within {seconds} seconds, OPNexus rolls back automatically."
        },
        "notify": {
          "title": "Notifications",
          "text": "Get told by webhook or email when a firewall goes down or a certificate expires."
        },
        "update": {
          "title": "Updates",
          "text": "Set up the notice about new OPNexus versions and one-click updates."
        }
      },
      "backupBefore": "You back up the OPNexus database on the server with",
      "backupHelp": "Covers the database (rules, hosts, history). API secrets and keys live in their own Docker volumes and are not in the dump. See the manual for details.",
      "docs": "Documentation for the command-line tool"
    }
  }
 }
@@ -1,6 +1,6 @@
 // Manually bumped whenever a notable change ships — mirrors the dated
 // entries already kept in the project README/CHANGELOG.md, no build
 // tooling involved. Versioning scheme: see CHANGELOG.md ("Versionierung").
-export const APP_VERSION = "1.12.0";
+export const APP_VERSION = "1.16.0";
-export const APP_CODENAME = "Condor";
+export const APP_CODENAME = "Hobby";
 export const APP_MAINTAINER = "Julian Boldt";
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
-# Baut die drei Release-Images (backend, frontend, proxy) aus dem Stand eines
+# Baut die Release-Images (backend, frontend, proxy, updater) aus dem Stand eines
 # Tags und pusht sie optional — für den Fall, dass (noch) kein CI-Runner
 # existiert. Tags und Namen entsprechen .github/workflows/release.yml:
-#   <REPO>/opnexus-{backend,frontend,proxy}:X.Y.Z, :X.Y, :X (+ :latest bei stabilen Versionen)
+#   <REPO>/opnexus-{backend,frontend,proxy,updater}:X.Y.Z, :X.Y, :X (+ :latest bei stabilen Versionen)
 #
 #   scripts/build_release_images.sh v1.10.0                    # nur bauen (Architektur dieses Hosts)
 #   docker login git.opnexus.dev
@@ -35,7 +35,7 @@ if [[ "$version" != *-* ]]; then   # nur stabile Versionen bekommen Kurz-Tags un
  tags+=("$major.$minor" "$major" latest)
 fi
-for svc in backend frontend proxy; do
+for svc in backend frontend proxy updater; do
  image="$repo/opnexus-$svc"
  targs=(); for t in "${tags[@]}"; do targs+=(-t "$image:$t"); done
  echo "==> $image  (${tags[*]})"
@@ -38,11 +38,17 @@ OPNexus $version
 1. cp .env.example .env     und POSTGRES_PASSWORD (und was sonst nötig ist) eintragen
 2. docker compose pull && docker compose up -d --no-build
-3. Updates:   ./opnexus update            (neueste Version der in .env gewählten Spur)
+3. Anmelden:  ./opnexus password          (zeigt das Admin-Passwort, wenn ADMIN_PASSWORD leer war)
              dann im Browser öffnen — der Einrichtungsassistent führt durch den Rest
 4. Updates:   ./opnexus update            (neueste Version der in .env gewählten Spur)
              ./opnexus update 1.10.1     (feste Version)
   Zurück:    ./opnexus rollback
   Sichern:   ./opnexus backup
 Optional: Updates per Klick im Webinterface (Einstellungen › "OPNexus aktualisieren"):
   in .env  COMPOSE_PROFILES=updater  und UPDATE_CHECK_URL setzen, dann
   docker compose up -d --no-build     (Hinweise zur Sicherheit: Handbuch)
 Vollständige Anleitung: README.md im Repository, Abschnitt "Release-Images & CI".
 TXT
@@ -1,222 +0,0 @@
 #!/usr/bin/env bash
 # opnexus — Update, Rollback und Backup für eine OPNexus-Installation aus
 # fertigen Release-Images (siehe README, "Release-Images & CI").
 #
 #   opnexus status            Version, Container, Datenbank-Revision
 #   opnexus update [VERSION]  Neue Images ziehen, wechseln, auf "gesund" warten;
 #                             bei Fehler automatisch zurückrollen
 #   opnexus rollback          Letztes Update rückgängig machen
 #   opnexus backup            Sofort-Backup der OPNexus-Datenbank
 #
 # Läuft im Verzeichnis mit docker-compose.yml und .env (oder OPNEXUS_DIR=...).
 # Braucht: docker (compose v2), bash. OPNEXUS_IMAGE_REPO muss in .env stehen.
 set -euo pipefail
 here="$(dirname "$(readlink -f "$0")")"
 # Im Release-Bundle liegt das Skript neben docker-compose.yml, im Repo in scripts/.
 if [ -f "$here/docker-compose.yml" ]; then default_dir="$here"; else default_dir="$here/.."; fi
 cd "${OPNEXUS_DIR:-$default_dir}"
 ENV_FILE=".env"
 STATE_FILE=".opnexus-update-state"
 SERVICES=(backend frontend proxy)
 TIMEOUT="${OPNEXUS_UPDATE_TIMEOUT:-240}"
 c() { docker compose "$@" 2> >(grep -v 'level=warning' >&2); }
 say() { printf '\033[1m==>\033[0m %s\n' "$*"; }
 die() { printf '\033[31mFehler:\033[0m %s\n' "$*" >&2; exit 1; }
 env_get() { sed -n "s/^$1=//p" "$ENV_FILE" 2>/dev/null | tail -n1; }
 DB_USER="$(env_get POSTGRES_USER)"; DB_USER="${DB_USER:-opnexus}"
 DB_NAME="$(env_get POSTGRES_DB)"; DB_NAME="${DB_NAME:-opnexus}"
 env_set() {
  if grep -q "^$1=" "$ENV_FILE" 2>/dev/null; then
    sed -i "s|^$1=.*|$1=$2|" "$ENV_FILE"
  else
    printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
  fi
 }
 # Postgres-Client-Tools aus dem Backend-Image (Client 17): Die Pre-Upgrade-
 # Dumps schreibt das Backend mit pg_dump 17 — das kann pg_restore 16 (Sidecar)
 # NICHT lesen. Also Dump UND Restore immer mit diesen Tools.
 pgtool() {
  local tool="$1"; shift
  # Passwort über die Umgebung durchreichen (`-e PGPASSWORD` ohne Wert), nicht als
  # Argument — sonst stünde es in der Prozessliste.
  PGPASSWORD="$(env_get POSTGRES_PASSWORD)" c run --rm --no-deps -T -e PGPASSWORD --entrypoint "$tool" backend "$@"
 }
 psql_db() { c exec -T postgres psql -U "$DB_USER" -d "$DB_NAME" -Atq "$@"; }
 db_revision() {
  psql_db -c "SELECT version_num FROM alembic_version" 2>/dev/null || true
 }
 running_version() {
  c exec -T backend python -c 'from app.version import APP_VERSION; print(APP_VERSION)' 2>/dev/null || true
 }
 service_state() {  # healthy | unhealthy | starting | running | (leer)
  local h
  h=$(c ps "$1" --format '{{.Health}}' 2>/dev/null || true)
  if [ -n "$h" ]; then echo "$h"; else c ps "$1" --format '{{.State}}' 2>/dev/null || true; fi
 }
 wait_healthy() {
  local deadline=$((SECONDS + TIMEOUT)) all svc st
  while [ "$SECONDS" -lt "$deadline" ]; do
    all=1
    for svc in "${SERVICES[@]}"; do
      st=$(service_state "$svc")
      case "$st" in healthy|running) ;; *) all=0 ;; esac
    done
    [ "$all" = 1 ] && return 0
    sleep 3
  done
  return 1
 }
 require_release_mode() {
  [ -f docker-compose.yml ] || die "docker-compose.yml nicht gefunden (OPNEXUS_DIR setzen?)"
  [ -f "$ENV_FILE" ] || die "$ENV_FILE nicht gefunden"
  [ -n "$(env_get OPNEXUS_IMAGE_REPO)" ] || die "OPNEXUS_IMAGE_REPO ist in $ENV_FILE nicht gesetzt — dieses Kommando arbeitet mit fertigen Release-Images (lokale Builds: git pull && docker compose up -d --build)."
 }
 cmd_status() {
  require_release_mode
  echo "Image-Repo:        $(env_get OPNEXUS_IMAGE_REPO)"
  echo "OPNEXUS_VERSION:   $(env_get OPNEXUS_VERSION)"
  echo "Laufende Version:  $(running_version)"
  echo "DB-Revision:       $(db_revision)"
  for svc in "${SERVICES[@]}"; do echo "$svc: $(service_state "$svc")"; done
  [ -f "$STATE_FILE" ] && { echo; echo "Letztes Update (für 'rollback'):"; sed 's/^/  /' "$STATE_FILE"; }
  return 0
 }
 cmd_backup() {
  local name="manual-$(date -u +%Y%m%d-%H%M%S).dump"
  pgtool pg_dump -h postgres -U "$DB_USER" -d "$DB_NAME" -F c \
    --exclude-table-data=firewall_log_entries --exclude-table-data=host_resource_samples \
    -f "/backups/$name"
  say "Backup geschrieben: /backups/$name (Volume postgres_backups)"
 }
 cmd_update() {
  require_release_mode
  local target="${1:-$(env_get OPNEXUS_VERSION)}"
  target="${target:-latest}"
  # Landet in .env und in Image-Tags: nur Zeichen, die ein Tag enthalten darf.
  [[ "$target" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]] || die "Ungültige Version '$target' (erlaubt: Buchstaben, Ziffern, . _ -)."
  local prev_setting prev_version prev_rev started
  prev_setting=$(env_get OPNEXUS_VERSION)
  prev_version=$(running_version)
  [ -n "$prev_version" ] || die "Backend läuft nicht oder antwortet nicht — erst reparieren, dann updaten."
  prev_rev=$(db_revision)
  say "Aktuell: $prev_version (DB-Revision ${prev_rev:-keine}) — Ziel: $target"
  say "Ziehe neue Images (am laufenden System ändert sich dabei nichts) …"
  OPNEXUS_VERSION="$target" c pull "${SERVICES[@]}" || die "Pull fehlgeschlagen — nichts wurde verändert."
  started=$(date -u +%Y%m%dT%H%M%SZ)
  cat > "$STATE_FILE" <<STATE
 started=$started
 prev_version=$prev_version
 prev_setting=$prev_setting
 prev_db_revision=$prev_rev
 target=$target
 STATE
  env_set OPNEXUS_VERSION "$target"
  say "Wechsle auf $target (das Backend sichert die Datenbank selbst vor einer Migration) …"
  # `up` selbst scheitert, sobald das Backend nicht gesund wird (depends_on) —
  # das ist der Fehlerfall, nicht das Ende des Skripts.
  if c up -d --no-build && wait_healthy; then
    say "Fertig: läuft jetzt auf $(running_version) (DB-Revision $(db_revision))."
    return 0
  fi
  printf '\033[31mUpdate nicht gesund geworden.\033[0m Backend-Log:\n' >&2
  c logs --tail 25 backend >&2 || true
  if [ "${OPNEXUS_NO_AUTO_ROLLBACK:-}" = 1 ]; then
    die "Automatisches Zurückrollen ist aus. Manuell: opnexus rollback"
  fi
  say "Rolle automatisch zurück …"
  cmd_rollback
  die "Update auf $target fehlgeschlagen und zurückgerollt auf $prev_version."
 }
 latest_pre_upgrade_dump() {
  c exec -T postgres-backup sh -c 'ls -1t /backups/pre-upgrade-*.dump 2>/dev/null | head -n1' | tr -d '\r'
 }
 cmd_rollback() {
  require_release_mode
  [ -f "$STATE_FILE" ] || die "Kein Update-Zustand ($STATE_FILE) — es gibt nichts zurückzurollen."
  # shellcheck disable=SC1090
  . "./$STATE_FILE"
  [ -n "${prev_version:-}" ] || die "$STATE_FILE ist unvollständig."
  # Rollback target = the exact image tag that was configured before the update.
  # The version the backend REPORTS only matches the tag for final releases: an
  # rc image reports its final version (rc1 images say 1.11.0), so rolling back
  # to that would land on a different, newer image. Floating tags ("latest",
  # "1.11") cannot be restored by name, so those fall back to the reported version.
  if [[ "${prev_setting:-}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$ ]]; then
    prev_version="$prev_setting"
  fi
  say "Rolle zurück auf $prev_version …"
  c stop "${SERVICES[@]}"
  local now_rev dump
  now_rev=$(db_revision)
  if [ "$now_rev" != "$prev_db_revision" ]; then
    dump=$(latest_pre_upgrade_dump)
    [ -n "$dump" ] || die "Datenbank wurde migriert ($prev_db_revision → $now_rev), aber es gibt kein pre-upgrade-Backup. Backend bleibt gestoppt."
    # Nur ein Backup, das nach dem Start DIESES Updates entstanden ist, darf
    # zurückgespielt werden — ein älteres würde stillschweigend Daten verwerfen.
    dump_ts=$(echo "$dump" | sed -E 's/.*-([0-9]{8})-([0-9]{6})\.dump$/\1\2/')
    [ "$dump_ts" -ge "${started//[-:TZ]/}" ] 2>/dev/null \
      || die "Neuestes pre-upgrade-Backup ($dump) ist älter als dieses Update (SKIP_MIGRATION_BACKUP gesetzt?). Backend bleibt gestoppt — manuell eingreifen."
    say "Datenbank wurde migriert ($prev_db_revision → $now_rev): spiele $dump zurück."
    say "Hinweis: Log-Historie und Ressourcen-Messwerte sind im Backup nicht enthalten und danach leer; alles andere steht auf dem Stand vor dem Update."
    # Erst prüfen, dass das Backup lesbar ist — BEVOR irgendetwas gelöscht wird.
    pgtool pg_restore --list "$dump" > /dev/null \
      || die "Backup $dump ist nicht lesbar. Datenbank unverändert, Backend bleibt gestoppt."
    local safety="pre-rollback-$(date -u +%Y%m%d-%H%M%S).dump"
    pgtool pg_dump -h postgres -U "$DB_USER" -d "$DB_NAME" -F c \
      --exclude-table-data=firewall_log_entries --exclude-table-data=host_resource_samples \
      -f "/backups/$safety"
    say "Sicherheitskopie des jetzigen Zustands: /backups/$safety"
    reset_schema() {
      pgtool psql -h postgres -U "$DB_USER" -d "$DB_NAME" -v ON_ERROR_STOP=1 -q \
        -c 'DROP SCHEMA public CASCADE' -c 'CREATE SCHEMA public' 2>&1 | grep -v '^NOTICE\|^DETAIL\|^drop cascades' || true
    }
    reset_schema
    if ! pgtool pg_restore -h postgres -U "$DB_USER" -d "$DB_NAME" --no-owner --exit-on-error "$dump"; then
      say "Zurückspielen fehlgeschlagen — stelle den Zustand vor dem Rollback aus /backups/$safety wieder her …"
      reset_schema
      pgtool pg_restore -h postgres -U "$DB_USER" -d "$DB_NAME" --no-owner --exit-on-error "/backups/$safety" \
        || die "Auch die Wiederherstellung schlug fehl. Backups liegen in /backups ($dump, $safety). Backend bleibt gestoppt."
      die "Rollback der Datenbank fehlgeschlagen; Zustand vor dem Rollback wiederhergestellt. Backend bleibt gestoppt."
    fi
  else
    say "Datenbank-Revision unverändert ($now_rev) — kein Zurückspielen nötig."
  fi
  env_set OPNEXUS_VERSION "$prev_version"
  c up -d --no-build || true
  wait_healthy || die "Nach dem Rollback sind nicht alle Dienste gesund — 'docker compose logs' prüfen."
  say "Fertig: läuft wieder auf $(running_version) (DB-Revision $(db_revision)). OPNEXUS_VERSION in $ENV_FILE ist jetzt fest auf $prev_version gesetzt."
  rm -f "$STATE_FILE"
 }
 case "${1:-}" in
  status)   cmd_status ;;
  update)   shift; cmd_update "${1:-}" ;;
  rollback) cmd_rollback ;;
  backup)   cmd_backup ;;
  *) sed -n '2,11p' "$0" | sed 's/^# \{0,1\}//'; exit 1 ;;
 esac
@@ -0,0 +1 @@
 ../updater/opnexus
@@ -0,0 +1,2 @@
 __pycache__
 *.pyc
@@ -0,0 +1,18 @@
 # Optionaler Updater-Dienst (Compose-Profil "updater"). Er enthält Docker-CLI
 # und Compose, damit das Webinterface ein Update auslösen kann, ohne dass das
 # Backend je den Docker-Socket sieht (siehe server.py und Handbuch).
 FROM python:3.12-alpine
 RUN apk add --no-cache bash docker-cli docker-cli-compose
 COPY opnexus /usr/local/bin/opnexus
 COPY server.py /app/server.py
 RUN chmod 0755 /usr/local/bin/opnexus
 WORKDIR /app
 ENV PYTHONUNBUFFERED=1 OPNEXUS_DIR=/project UPDATER_STATE_DIR=/state
 HEALTHCHECK --interval=10s --timeout=5s --retries=5 --start-period=5s \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3)"
 CMD ["python", "/app/server.py"]
@@ -0,0 +1,307 @@
 #!/usr/bin/env bash
 # opnexus — Update, Rollback und Backup für eine OPNexus-Installation aus
 # fertigen Release-Images (siehe README, "Release-Images & CI").
 #
 #   opnexus status            Version, Container, Datenbank-Revision
 #   opnexus update [VERSION]  Neue Images ziehen, wechseln, auf "gesund" warten;
 #                             bei Fehler automatisch zurückrollen
 #   opnexus rollback          Letztes Update rückgängig machen
 #   opnexus backup            Sofort-Backup der OPNexus-Datenbank
 #   opnexus password [NAME]   Neues Zufallspasswort für den Admin setzen und
 #                             anzeigen (--yes: ohne Rückfrage)
 #   opnexus status --porcelain  Zustand als key=value-Zeilen (für den Updater)
 #
 # Läuft im Verzeichnis mit docker-compose.yml und .env (oder OPNEXUS_DIR=...).
 # Braucht: docker (compose v2), bash. OPNEXUS_IMAGE_REPO muss in .env stehen.
 #
 # Exit-Codes von `update`: 0 = läuft auf der neuen Version, 3 = Update ist
 # fehlgeschlagen und wurde sauber zurückgerollt, 1 = sonstiger Fehler.
 #
 # Umgebung (nur für den Updater-Container, siehe updater/server.py):
 #   OPNEXUS_UPDATER=1        `up` fasst nur backend/frontend/proxy an — der
 #                            Updater-Container selbst wird nie aus seinem
 #                            eigenen Lauf heraus neu gestartet.
 #   OPNEXUS_PHASE_FILE=PATH  hängt bei jedem Schritt eine Zeile "phase" an.
 set -euo pipefail
 here="$(dirname "$(readlink -f "$0")")"
 # Im Release-Bundle liegt das Skript neben docker-compose.yml, im Repo in scripts/.
 if [ -f "$here/docker-compose.yml" ]; then default_dir="$here"; else default_dir="$here/.."; fi
 cd "${OPNEXUS_DIR:-$default_dir}"
 ENV_FILE=".env"
 STATE_FILE=".opnexus-update-state"
 SERVICES=(backend frontend proxy)
 TIMEOUT="${OPNEXUS_UPDATE_TIMEOUT:-240}"
 c() { docker compose "$@" 2> >(grep -v 'level=warning' >&2); }
 say() { printf '\033[1m==>\033[0m %s\n' "$*"; }
 # Schritt für den Updater-Container (Fortschrittsanzeige im Webinterface).
 phase() { [ -z "${OPNEXUS_PHASE_FILE:-}" ] || echo "$1" >> "$OPNEXUS_PHASE_FILE"; }
 die() { printf '\033[31mFehler:\033[0m %s\n' "$*" >&2; exit 1; }
 env_get() { sed -n "s/^$1=//p" "$ENV_FILE" 2>/dev/null | tail -n1; }
 DB_USER="$(env_get POSTGRES_USER)"; DB_USER="${DB_USER:-opnexus}"
 DB_NAME="$(env_get POSTGRES_DB)"; DB_NAME="${DB_NAME:-opnexus}"
 env_set() {
  if grep -q "^$1=" "$ENV_FILE" 2>/dev/null; then
    sed -i "s|^$1=.*|$1=$2|" "$ENV_FILE"
  else
    printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
  fi
 }
 # Postgres-Client-Tools aus dem Backend-Image (Client 17): Die Pre-Upgrade-
 # Dumps schreibt das Backend mit pg_dump 17 — das kann pg_restore 16 (Sidecar)
 # NICHT lesen. Also Dump UND Restore immer mit diesen Tools.
 pgtool() {
  local tool="$1"; shift
  # Passwort über die Umgebung durchreichen (`-e PGPASSWORD` ohne Wert), nicht als
  # Argument — sonst stünde es in der Prozessliste.
  PGPASSWORD="$(env_get POSTGRES_PASSWORD)" c run --rm --no-deps -T -e PGPASSWORD --entrypoint "$tool" backend "$@"
 }
 # Der Updater-Container ist ein optionaler Dienst (Compose-Profil "updater"):
 # nur wenn er aktiv ist, wird sein Image mitgezogen — sonst würde ein Update
 # daran scheitern, dass es für eine ältere Version noch kein Updater-Image gibt.
 updater_enabled() {
  local profiles
  profiles="${COMPOSE_PROFILES:-$(env_get COMPOSE_PROFILES)}"
  [[ ",$profiles," == *",updater,"* ]]
 }
 # Welche Dienste `up` anfasst: im Updater-Container nur die Anwendung, auf dem
 # Host (CLI) alles — dort darf sich auch der Updater selbst erneuern.
 up_targets() {
  if [ -n "${OPNEXUS_UPDATER:-}" ]; then printf '%s\n' "${SERVICES[@]}"; fi
 }
 psql_db() { c exec -T postgres psql -U "$DB_USER" -d "$DB_NAME" -Atq "$@"; }
 db_revision() {
  psql_db -c "SELECT version_num FROM alembic_version" 2>/dev/null || true
 }
 running_version() {
  c exec -T backend python -c 'from app.version import APP_VERSION; print(APP_VERSION)' 2>/dev/null || true
 }
 service_state() {  # healthy | unhealthy | starting | running | (leer)
  local h
  h=$(c ps "$1" --format '{{.Health}}' 2>/dev/null || true)
  if [ -n "$h" ]; then echo "$h"; else c ps "$1" --format '{{.State}}' 2>/dev/null || true; fi
 }
 wait_healthy() {
  local deadline=$((SECONDS + TIMEOUT)) all svc st
  while [ "$SECONDS" -lt "$deadline" ]; do
    all=1
    for svc in "${SERVICES[@]}"; do
      st=$(service_state "$svc")
      case "$st" in healthy|running) ;; *) all=0 ;; esac
    done
    [ "$all" = 1 ] && return 0
    sleep 3
  done
  return 1
 }
 require_release_mode() {
  [ -f docker-compose.yml ] || die "docker-compose.yml nicht gefunden (OPNEXUS_DIR setzen?)"
  [ -f "$ENV_FILE" ] || die "$ENV_FILE nicht gefunden"
  [ -n "$(env_get OPNEXUS_IMAGE_REPO)" ] || die "OPNEXUS_IMAGE_REPO ist in $ENV_FILE nicht gesetzt — dieses Kommando arbeitet mit fertigen Release-Images (lokale Builds: git pull && docker compose up -d --build)."
 }
 cmd_status_porcelain() {
  require_release_mode
  echo "repo=$(env_get OPNEXUS_IMAGE_REPO)"
  echo "version_setting=$(env_get OPNEXUS_VERSION)"
  echo "running_version=$(running_version)"
  echo "db_revision=$(db_revision)"
  for svc in "${SERVICES[@]}"; do echo "service.$svc=$(service_state "$svc")"; done
  if [ -f "$STATE_FILE" ]; then
    # Nur bekannte Schlüssel durchlassen — die Datei wird vom Skript selbst geschrieben.
    grep -E '^(started|prev_version|prev_setting|prev_db_revision|target)=' "$STATE_FILE" | sed 's/^/last_update./'
  fi
 }
 cmd_status() {
  require_release_mode
  echo "Image-Repo:        $(env_get OPNEXUS_IMAGE_REPO)"
  echo "OPNEXUS_VERSION:   $(env_get OPNEXUS_VERSION)"
  echo "Laufende Version:  $(running_version)"
  echo "DB-Revision:       $(db_revision)"
  for svc in "${SERVICES[@]}"; do echo "$svc: $(service_state "$svc")"; done
  [ -f "$STATE_FILE" ] && { echo; echo "Letztes Update (für 'rollback'):"; sed 's/^/  /' "$STATE_FILE"; }
  return 0
 }
 cmd_backup() {
  local name="manual-$(date -u +%Y%m%d-%H%M%S).dump"
  pgtool pg_dump -h postgres -U "$DB_USER" -d "$DB_NAME" -F c \
    --exclude-table-data=firewall_log_entries --exclude-table-data=host_resource_samples \
    -f "/backups/$name"
  say "Backup geschrieben: /backups/$name (Volume postgres_backups)"
 }
 cmd_update() {
  require_release_mode
  local target="${1:-$(env_get OPNEXUS_VERSION)}"
  target="${target:-latest}"
  # Landet in .env und in Image-Tags: nur Zeichen, die ein Tag enthalten darf.
  [[ "$target" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$ ]] || die "Ungültige Version '$target' (erlaubt: Buchstaben, Ziffern, . _ -)."
  local prev_setting prev_version prev_rev started
  prev_setting=$(env_get OPNEXUS_VERSION)
  prev_version=$(running_version)
  [ -n "$prev_version" ] || die "Backend läuft nicht oder antwortet nicht — erst reparieren, dann updaten."
  prev_rev=$(db_revision)
  say "Aktuell: $prev_version (DB-Revision ${prev_rev:-keine}) — Ziel: $target"
  say "Ziehe neue Images (am laufenden System ändert sich dabei nichts) …"
  phase pulling
  local pull_services=("${SERVICES[@]}")
  if updater_enabled; then pull_services+=(updater); fi
  OPNEXUS_VERSION="$target" c pull "${pull_services[@]}" || die "Pull fehlgeschlagen — nichts wurde verändert."
  started=$(date -u +%Y%m%dT%H%M%SZ)
  cat > "$STATE_FILE" <<STATE
 started=$started
 prev_version=$prev_version
 prev_setting=$prev_setting
 prev_db_revision=$prev_rev
 target=$target
 STATE
  env_set OPNEXUS_VERSION "$target"
  say "Wechsle auf $target (das Backend sichert die Datenbank selbst vor einer Migration) …"
  phase switching
  local targets=()
  mapfile -t targets < <(up_targets)
  # `up` selbst scheitert, sobald das Backend nicht gesund wird (depends_on) —
  # das ist der Fehlerfall, nicht das Ende des Skripts.
  if c up -d --no-build "${targets[@]}" && { phase waiting; wait_healthy; }; then
    say "Fertig: läuft jetzt auf $(running_version) (DB-Revision $(db_revision))."
    phase done
    return 0
  fi
  printf '\033[31mUpdate nicht gesund geworden.\033[0m Backend-Log:\n' >&2
  c logs --tail 25 backend >&2 || true
  if [ "${OPNEXUS_NO_AUTO_ROLLBACK:-}" = 1 ]; then
    die "Automatisches Zurückrollen ist aus. Manuell: opnexus rollback"
  fi
  say "Rolle automatisch zurück …"
  cmd_rollback
  phase rolled_back
  printf '\033[31mFehler:\033[0m Update auf %s fehlgeschlagen und zurückgerollt auf %s.\n' "$target" "$prev_version" >&2
  exit 3
 }
 latest_pre_upgrade_dump() {
  c exec -T postgres-backup sh -c 'ls -1t /backups/pre-upgrade-*.dump 2>/dev/null | head -n1' | tr -d '\r'
 }
 cmd_rollback() {
  require_release_mode
  [ -f "$STATE_FILE" ] || die "Kein Update-Zustand ($STATE_FILE) — es gibt nichts zurückzurollen."
  # shellcheck disable=SC1090
  . "./$STATE_FILE"
  [ -n "${prev_version:-}" ] || die "$STATE_FILE ist unvollständig."
  # Rollback target = the exact image tag that was configured before the update.
  # The version the backend REPORTS only matches the tag for final releases: an
  # rc image reports its final version (rc1 images say 1.11.0), so rolling back
  # to that would land on a different, newer image. Floating tags ("latest",
  # "1.11") cannot be restored by name, so those fall back to the reported version.
  if [[ "${prev_setting:-}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9.]+)?$ ]]; then
    prev_version="$prev_setting"
  fi
  say "Rolle zurück auf $prev_version …"
  phase stopping
  c stop "${SERVICES[@]}"
  local now_rev dump
  now_rev=$(db_revision)
  if [ "$now_rev" != "$prev_db_revision" ]; then
    dump=$(latest_pre_upgrade_dump)
    [ -n "$dump" ] || die "Datenbank wurde migriert ($prev_db_revision → $now_rev), aber es gibt kein pre-upgrade-Backup. Backend bleibt gestoppt."
    # Nur ein Backup, das nach dem Start DIESES Updates entstanden ist, darf
    # zurückgespielt werden — ein älteres würde stillschweigend Daten verwerfen.
    dump_ts=$(echo "$dump" | sed -E 's/.*-([0-9]{8})-([0-9]{6})\.dump$/\1\2/')
    [ "$dump_ts" -ge "${started//[-:TZ]/}" ] 2>/dev/null \
      || die "Neuestes pre-upgrade-Backup ($dump) ist älter als dieses Update (SKIP_MIGRATION_BACKUP gesetzt?). Backend bleibt gestoppt — manuell eingreifen."
    say "Datenbank wurde migriert ($prev_db_revision → $now_rev): spiele $dump zurück."
    phase restoring
    say "Hinweis: Log-Historie und Ressourcen-Messwerte sind im Backup nicht enthalten und danach leer; alles andere steht auf dem Stand vor dem Update."
    # Erst prüfen, dass das Backup lesbar ist — BEVOR irgendetwas gelöscht wird.
    pgtool pg_restore --list "$dump" > /dev/null \
      || die "Backup $dump ist nicht lesbar. Datenbank unverändert, Backend bleibt gestoppt."
    local safety="pre-rollback-$(date -u +%Y%m%d-%H%M%S).dump"
    pgtool pg_dump -h postgres -U "$DB_USER" -d "$DB_NAME" -F c \
      --exclude-table-data=firewall_log_entries --exclude-table-data=host_resource_samples \
      -f "/backups/$safety"
    say "Sicherheitskopie des jetzigen Zustands: /backups/$safety"
    reset_schema() {
      pgtool psql -h postgres -U "$DB_USER" -d "$DB_NAME" -v ON_ERROR_STOP=1 -q \
        -c 'DROP SCHEMA public CASCADE' -c 'CREATE SCHEMA public' 2>&1 | grep -v '^NOTICE\|^DETAIL\|^drop cascades' || true
    }
    reset_schema
    if ! pgtool pg_restore -h postgres -U "$DB_USER" -d "$DB_NAME" --no-owner --exit-on-error "$dump"; then
      say "Zurückspielen fehlgeschlagen — stelle den Zustand vor dem Rollback aus /backups/$safety wieder her …"
      reset_schema
      pgtool pg_restore -h postgres -U "$DB_USER" -d "$DB_NAME" --no-owner --exit-on-error "/backups/$safety" \
        || die "Auch die Wiederherstellung schlug fehl. Backups liegen in /backups ($dump, $safety). Backend bleibt gestoppt."
      die "Rollback der Datenbank fehlgeschlagen; Zustand vor dem Rollback wiederhergestellt. Backend bleibt gestoppt."
    fi
  else
    say "Datenbank-Revision unverändert ($now_rev) — kein Zurückspielen nötig."
  fi
  env_set OPNEXUS_VERSION "$prev_version"
  phase switching
  local rb_targets=()
  mapfile -t rb_targets < <(up_targets)
  c up -d --no-build "${rb_targets[@]}" || true
  phase waiting
  wait_healthy || die "Nach dem Rollback sind nicht alle Dienste gesund — 'docker compose logs' prüfen."
  say "Fertig: läuft wieder auf $(running_version) (DB-Revision $(db_revision)). OPNEXUS_VERSION in $ENV_FILE ist jetzt fest auf $prev_version gesetzt."
  rm -f "$STATE_FILE"
  phase done
 }
 # Setzt ein neues Zufallspasswort und gibt es einmalig aus. Gedacht für die
 # frische Installation (das beim ersten Start erzeugte Passwort steht nur
 # einmal im Log) und für ein vergessenes Admin-Passwort. Alle Sitzungen des
 # Kontos enden. Rückfrage nur, wenn sich schon jemand angemeldet hat.
 cmd_password() {
  local user="" yes=0 arg
  for arg in "$@"; do
    case "$arg" in
      --yes|-y) yes=1 ;;
      -*) die "Unbekannte Option: $arg" ;;
      *) [ -z "$user" ] || die "Nur ein Benutzername erlaubt."; user="$arg" ;;
    esac
  done
  c ps --status running --services 2>/dev/null | grep -qx backend \
    || die "Das Backend läuft nicht. Erst starten: docker compose up -d"
  if [ "$yes" != 1 ]; then
    local logins; logins="$(psql_db -c 'SELECT count(*) FROM admin_users WHERE last_login_at IS NOT NULL' 2>/dev/null || echo 1)"
    if [ "$logins" != 0 ]; then
      [ -t 0 ] || die "Ohne Terminal nur mit --yes."
      read -r -p "Passwort von ${user:-dem Admin} neu setzen? Alle Sitzungen enden. [j/N] " answer
      case "$answer" in j|J|y|Y) ;; *) die "Abgebrochen." ;; esac
    fi
  fi
  c exec -T backend python -m app.reset_password ${user:+"$user"}
 }
 case "${1:-}" in
  password) shift; cmd_password "$@" ;;
  status)   if [ "${2:-}" = "--porcelain" ]; then cmd_status_porcelain; else cmd_status; fi ;;
  update)   shift; cmd_update "${1:-}" ;;
  rollback) cmd_rollback ;;
  backup)   cmd_backup ;;
  *) sed -n '2,13p' "$0" | sed 's/^# \{0,1\}//'; exit 1 ;;
 esac
@@ -0,0 +1,395 @@
 #!/usr/bin/env python3
 """OPNexus-Updater: kleine interne HTTP-API vor dem `opnexus`-Skript.
 Läuft als eigener, optionaler Container (Compose-Profil "updater") und ist der
 EINZIGE Teil von OPNexus, der den Docker-Socket sieht — das Backend bekommt ihn
 nie. Er kann bewusst nur drei Dinge:
    GET  /status    Zustand der Installation und des letzten/laufenden Auftrags
    POST /update    {"version": "X.Y.Z"}  auf eine neuere stabile Version wechseln
    POST /rollback  das letzte Update rückgängig machen
 und es gibt keinen Weg, einen eigenen Befehl auszuführen. Erreichbar ist er nur
 aus dem Compose-Netz (kein veröffentlichter Port) und nur mit dem Token, den er
 beim ersten Start selbst erzeugt und in sein Zustands-Volume schreibt (das
 Backend hängt dasselbe Volume schreibgeschützt ein).
 Die eigentliche Arbeit — pullen, wechseln, auf "gesund" warten, bei Fehler
 zurückrollen, Datenbank sichern/zurückspielen — macht dasselbe Skript wie auf
 der Kommandozeile (`updater/opnexus`), damit es nur eine Update-Logik gibt.
 """
 import hmac
 import json
 import os
 import re
 import secrets
 import subprocess
 import sys
 import threading
 import time
 from datetime import datetime, timezone
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 STATE_DIR = Path(os.environ.get("UPDATER_STATE_DIR", "/state"))
 PROJECT_DIR = Path(os.environ.get("OPNEXUS_DIR", "/project"))
 SCRIPT = os.environ.get("OPNEXUS_SCRIPT", "/usr/local/bin/opnexus")
 PORT = int(os.environ.get("UPDATER_PORT", "8080"))
 # Wie in einem Docker-Tag, aber ohne Vorabversionen: nur X.Y.Z wird akzeptiert.
 VERSION_RE = re.compile(r"^(\d{1,4})\.(\d{1,5})\.(\d{1,6})$")
 ANSI_RE = re.compile(r"\x1b\[[0-9;]*[A-Za-z]")
 MAX_BODY = 1024
 LOG_TAIL_LINES = 150
 LOG_TAIL_BYTES = 16_000
 STATUS_CACHE_SECONDS = 3.0
 TOKEN_FILE = STATE_DIR / "token"
 JOB_FILE = STATE_DIR / "job.json"
 LOG_FILE = STATE_DIR / "job.log"
 PHASE_FILE = STATE_DIR / "job.phases"
 _lock = threading.Lock()  # genau ein Auftrag zur Zeit
 _status_cache: dict = {"at": 0.0, "value": None}
 def now_iso() -> str:
    return datetime.now(timezone.utc).isoformat(timespec="seconds")
 def parse_version(value: str | None):
    match = VERSION_RE.match((value or "").strip())
    return tuple(int(part) for part in match.groups()) if match else None
 def read_env_file() -> dict[str, str]:
    values: dict[str, str] = {}
    try:
        for line in (PROJECT_DIR / ".env").read_text(encoding="utf-8").splitlines():
            if "=" in line and not line.lstrip().startswith("#"):
                key, _, value = line.partition("=")
                values[key.strip()] = value.strip()
    except OSError:
        pass
    return values
 def load_token() -> str:
    """Token einmalig erzeugen; danach immer aus der Datei lesen."""
    STATE_DIR.mkdir(parents=True, exist_ok=True)
    try:
        existing = TOKEN_FILE.read_text(encoding="utf-8").strip()
        if len(existing) >= 32:
            return existing
    except OSError:
        pass
    token = secrets.token_urlsafe(32)
    tmp = TOKEN_FILE.with_suffix(".tmp")
    tmp.write_text(token + "\n", encoding="utf-8")
    os.chmod(tmp, 0o644)  # Zugriff regelt, welche Container das Volume sehen
    tmp.replace(TOKEN_FILE)
    return token
 def read_job() -> dict:
    try:
        return json.loads(JOB_FILE.read_text(encoding="utf-8"))
    except (OSError, ValueError):
        return {}
 def write_job(job: dict) -> None:
    tmp = JOB_FILE.with_suffix(".tmp")
    tmp.write_text(json.dumps(job), encoding="utf-8")
    tmp.replace(JOB_FILE)
 def log_tail() -> list[str]:
    try:
        raw = LOG_FILE.read_bytes()[-LOG_TAIL_BYTES:].decode("utf-8", errors="replace")
    except OSError:
        return []
    lines = [ANSI_RE.sub("", line).rstrip() for line in raw.splitlines()]
    return [line for line in lines if line][-LOG_TAIL_LINES:]
 def phases() -> list[str]:
    try:
        return [line.strip() for line in PHASE_FILE.read_text(encoding="utf-8").splitlines() if line.strip()]
    except OSError:
        return []
 def script_env(extra: dict[str, str] | None = None) -> dict[str, str]:
    env = dict(os.environ)
    env.update({"OPNEXUS_DIR": str(PROJECT_DIR), "OPNEXUS_UPDATER": "1"})
    env.update(extra or {})
    return env
 def live_status() -> dict:
    """`opnexus status --porcelain`, kurz zwischengespeichert (docker exec ist nicht gratis)."""
    cached = _status_cache["value"]
    if cached is not None and time.monotonic() - _status_cache["at"] < STATUS_CACHE_SECONDS:
        return cached
    env_file = read_env_file()
    result: dict = {
        "mode": "release" if env_file.get("OPNEXUS_IMAGE_REPO") else "local",
        "version_setting": env_file.get("OPNEXUS_VERSION") or None,
        "running_version": None,
        "db_revision": None,
        "services": {},
        "last_update": None,
    }
    if result["mode"] == "release":
        try:
            proc = subprocess.run(
                [SCRIPT, "status", "--porcelain"], cwd=PROJECT_DIR, env=script_env(),
                capture_output=True, text=True, timeout=45,
            )
        except (OSError, subprocess.TimeoutExpired):
            proc = None
        if proc is not None and proc.returncode == 0:
            last: dict[str, str] = {}
            for line in proc.stdout.splitlines():
                key, _, value = line.partition("=")
                if key == "running_version":
                    result["running_version"] = value or None
                elif key == "db_revision":
                    result["db_revision"] = value or None
                elif key.startswith("service."):
                    result["services"][key.split(".", 1)[1]] = value
                elif key.startswith("last_update."):
                    last[key.split(".", 1)[1]] = value
            if last:
                result["last_update"] = {
                    "prev_version": last.get("prev_setting") if parse_version(last.get("prev_setting")) else last.get("prev_version"),
                    "prev_db_revision": last.get("prev_db_revision") or None,
                    "target": last.get("target"),
                    "started": last.get("started"),
                }
    _status_cache.update(at=time.monotonic(), value=result)
    return result
 def status_payload() -> dict:
    job = read_job()
    running = job.get("state") == "running"
    payload = {"job": job or None, "phases": phases() if job else [], "log": log_tail() if job else []}
    if running:
        # Während eines Auftrags kann das Backend gerade fehlen — nicht anfragen.
        payload.update(mode="release", running_version=None, db_revision=None, services={}, last_update=None,
                       rollback_available=False, rollback_loses_data=False)
        return payload
    live = live_status()
    last = live["last_update"]
    payload.update(live)
    payload["rollback_available"] = bool(last and last.get("prev_version"))
    payload["rollback_loses_data"] = bool(last and last.get("prev_db_revision") != live["db_revision"])
    return payload
 class Reject(Exception):
    def __init__(self, code: str, status: int = 409):
        super().__init__(code)
        self.code, self.status = code, status
 def start_job(action: str, target: str | None) -> dict:
    if not _lock.acquire(blocking=False):
        raise Reject("busy")
    try:
        if read_job().get("state") == "running":
            raise Reject("busy")
        _status_cache["value"] = None
        live = live_status()
        if live["mode"] != "release":
            raise Reject("not_release_mode")
        if action == "update":
            current = parse_version(live["running_version"])
            wanted = parse_version(target)
            if wanted is None:
                raise Reject("invalid_version", 400)
            if current is None:
                raise Reject("backend_unreachable")
            if wanted <= current:
                raise Reject("not_newer")
            if wanted[0] != current[0]:
                raise Reject("major_change")
        elif action == "rollback":
            last = live["last_update"]
            if not (last and last.get("prev_version")):
                raise Reject("no_rollback")
        job = {
            "id": secrets.token_hex(8), "action": action, "target": target, "state": "running",
            "started_at": now_iso(), "finished_at": None, "exit_code": None,
            "from_version": live["running_version"],
        }
        for path in (LOG_FILE, PHASE_FILE):
            path.write_text("", encoding="utf-8")
        write_job(job)
    except BaseException:
        _lock.release()
        raise
    # Ab hier gehört das Lock dem Worker-Thread.
    threading.Thread(target=_run_job, args=(job,), daemon=True).start()
    return job
 def _run_job(job: dict) -> None:
    args = [SCRIPT, "update", job["target"]] if job["action"] == "update" else [SCRIPT, "rollback"]
    env = script_env({"OPNEXUS_PHASE_FILE": str(PHASE_FILE), "TERM": "dumb"})
    try:
        with LOG_FILE.open("ab") as log:
            proc = subprocess.Popen(args, cwd=PROJECT_DIR, env=env, stdout=log, stderr=subprocess.STDOUT,
                                    stdin=subprocess.DEVNULL, start_new_session=True)
            code = proc.wait()
    except OSError as exc:
        code = 127
        with LOG_FILE.open("a", encoding="utf-8") as log:
            log.write(f"Updater: Skript konnte nicht gestartet werden: {exc}\n")
    if code == 0:
        state = "succeeded"
    elif code == 3 and job["action"] == "update":
        state = "rolled_back"
    else:
        state = "failed"
    job.update(state=state, exit_code=code, finished_at=now_iso())
    write_job(job)
    _status_cache["value"] = None
    try:
        if state == "succeeded" and job["action"] == "update":
            self_update()
    finally:
        _lock.release()
 def _docker(*args: str, timeout: int = 120) -> subprocess.CompletedProcess:
    return subprocess.run(["docker", *args], capture_output=True, text=True, timeout=timeout,
                          cwd=PROJECT_DIR, env=script_env())
 def self_update() -> None:
    """Den Updater-Container selbst auf das neue Image bringen.
    Läuft in einem eigenen, kurzlebigen Container: Würde der Updater sich aus
    sich selbst heraus neu erstellen, würde `docker compose` mitten im Vorgang
    mit ihm beendet. Das Ergebnis des Auftrags ist zu diesem Zeitpunkt längst
    gespeichert; schlägt dieser Schritt fehl, läuft der Updater einfach in der
    alten Version weiter und wird beim nächsten `docker compose up -d` erneuert.
    """
    def note(text: str) -> None:
        with LOG_FILE.open("a", encoding="utf-8") as log:
            log.write(text + "\n")
    try:
        me = os.environ.get("HOSTNAME", "")
        inspect = _docker("inspect", me, "--format",
                          '{{.Config.Image}}|{{range .Mounts}}{{if eq .Destination "' + str(PROJECT_DIR) + '"}}{{.Source}}{{end}}{{end}}')
        current_image, _, host_dir = inspect.stdout.strip().partition("|")
        if inspect.returncode != 0 or not host_dir.startswith("/"):
            note("Updater: eigenes Verzeichnis auf dem Host nicht ermittelbar — Updater-Container nicht erneuert.")
            return
        images = _docker("compose", "config", "--images").stdout.split()
        new_image = next((i for i in images if "/opnexus-updater:" in i or i.startswith("opnexus-updater:")), "")
        if not new_image or new_image == current_image:
            return
        _docker("rm", "-f", "opnexus-updater-self-update")
        started = _docker(
            "run", "-d", "--rm", "--name", "opnexus-updater-self-update",
            "-v", "/var/run/docker.sock:/var/run/docker.sock", "-v", f"{host_dir}:{host_dir}", "-w", host_dir,
            "--entrypoint", "docker", new_image, "compose", "up", "-d", "--no-build", "--no-deps", "updater",
        )
        note("Updater: erneuert sich selbst auf " + new_image if started.returncode == 0
             else "Updater: Selbst-Update fehlgeschlagen: " + started.stderr.strip()[:300])
    except (OSError, subprocess.TimeoutExpired) as exc:
        note(f"Updater: Selbst-Update fehlgeschlagen: {exc}")
 class Handler(BaseHTTPRequestHandler):
    server_version = "opnexus-updater"
    token = ""
    def log_message(self, fmt, *args):  # Zugriffsprotokoll auf stderr, ohne Query/Header
        sys.stderr.write("updater: %s %s\n" % (self.command, self.path.split("?", 1)[0]))
    def _send(self, status: int, body: dict) -> None:
        data = json.dumps(body).encode()
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(data)))
        self.send_header("Cache-Control", "no-store")
        self.end_headers()
        self.wfile.write(data)
    def _authorized(self) -> bool:
        header = self.headers.get("Authorization", "")
        supplied = header[7:] if header.startswith("Bearer ") else ""
        # Ein leeres Token darf nie "passen" (leerer Header == leeres Token).
        return bool(self.token) and hmac.compare_digest(supplied.encode(), self.token.encode())
    def _body(self) -> dict:
        try:
            length = int(self.headers.get("Content-Length") or 0)
        except ValueError:
            raise Reject("bad_request", 400)
        if length > MAX_BODY:
            raise Reject("bad_request", 413)
        if length == 0:
            return {}
        try:
            data = json.loads(self.rfile.read(length))
        except ValueError:
            raise Reject("bad_request", 400)
        if not isinstance(data, dict):
            raise Reject("bad_request", 400)
        return data
    def do_GET(self):
        path = self.path.split("?", 1)[0]
        if path == "/health":
            return self._send(200, {"ok": True})
        if not self._authorized():
            return self._send(401, {"error": "unauthorized"})
        if path == "/status":
            return self._send(200, status_payload())
        self._send(404, {"error": "not_found"})
    def do_POST(self):
        path = self.path.split("?", 1)[0]
        if not self._authorized():
            return self._send(401, {"error": "unauthorized"})
        try:
            body = self._body()
            if path == "/update":
                version = body.get("version")
                job = start_job("update", version if isinstance(version, str) else None)
            elif path == "/rollback":
                job = start_job("rollback", None)
            else:
                return self._send(404, {"error": "not_found"})
        except Reject as rejected:
            return self._send(rejected.status, {"error": rejected.code})
        self._send(202, {"job": job})
 def mark_interrupted() -> None:
    """Ein Auftrag, der beim Start noch als "running" steht, hat nie geendet."""
    job = read_job()
    if job.get("state") == "running":
        job.update(state="failed", finished_at=now_iso())
        write_job(job)
        with LOG_FILE.open("a", encoding="utf-8") as log:
            log.write("Updater: wurde während des Auftrags neu gestartet — Zustand bitte prüfen (opnexus status).\n")
 def main() -> None:
    Handler.token = load_token()
    mark_interrupted()
    server = ThreadingHTTPServer(("0.0.0.0", PORT), Handler)
    server.daemon_threads = True
    print(f"updater: listening on :{PORT}", flush=True)
    server.serve_forever()
 if __name__ == "__main__":
    main()
@@ -0,0 +1,215 @@
 """Tests für updater/server.py — nur Standardbibliothek:
    python3 -m unittest discover -s updater -p 'test_*.py'
 Das echte `opnexus`-Skript und Docker werden durch ein Fake-Skript ersetzt, das
 `status --porcelain` beantwortet und `update`/`rollback` mit einem vorgegebenen
 Exit-Code beendet; so sind Zustandsübergänge, Ablehnungen und die Authentifizierung
 prüfbar, ohne einen Docker-Daemon.
 """
 import json
 import os
 import stat
 import tempfile
 import threading
 import time
 import unittest
 import urllib.error
 import urllib.request
 from http.server import ThreadingHTTPServer
 from pathlib import Path
 import server
 FAKE = """#!/bin/sh
 case "$1" in
  status)
    echo "running_version=${FAKE_RUNNING:-1.14.0}"
    echo "db_revision=0004"
    echo "service.backend=healthy"
    if [ -n "$FAKE_LAST" ]; then
      echo "last_update.prev_version=1.13.0"
      echo "last_update.prev_setting=1.13.0"
      echo "last_update.prev_db_revision=${FAKE_PREV_REV:-0004}"
    fi
    ;;
  update|rollback)
    [ -z "$OPNEXUS_PHASE_FILE" ] || echo pulling >> "$OPNEXUS_PHASE_FILE"
    echo "arbeite $1 $2"
    sleep "${FAKE_SLEEP:-0.2}"
    exit "${FAKE_EXIT:-0}"
    ;;
 esac
 """
 class UpdaterTest(unittest.TestCase):
    def setUp(self):
        self.tmp = tempfile.TemporaryDirectory()
        root = Path(self.tmp.name)
        (root / "state").mkdir()
        (root / "project").mkdir()
        (root / "project" / ".env").write_text("OPNEXUS_IMAGE_REPO=reg.test/opnexus\nOPNEXUS_VERSION=1.14.0\n")
        script = root / "opnexus"
        script.write_text(FAKE)
        script.chmod(script.stat().st_mode | stat.S_IEXEC)
        state = root / "state"
        server.STATE_DIR = state
        server.TOKEN_FILE = state / "token"
        server.JOB_FILE = state / "job.json"
        server.LOG_FILE = state / "job.log"
        server.PHASE_FILE = state / "job.phases"
        server.PROJECT_DIR = root / "project"
        server.SCRIPT = str(script)
        server._status_cache.update(at=0.0, value=None)
        for key in ("FAKE_EXIT", "FAKE_RUNNING", "FAKE_LAST", "FAKE_PREV_REV", "FAKE_SLEEP"):
            os.environ.pop(key, None)
        self.token = server.load_token()
        server.Handler.token = self.token
        self.httpd = ThreadingHTTPServer(("127.0.0.1", 0), server.Handler)
        self.httpd.daemon_threads = True
        threading.Thread(target=self.httpd.serve_forever, daemon=True).start()
        self.base = f"http://127.0.0.1:{self.httpd.server_address[1]}"
    def tearDown(self):
        self.httpd.shutdown()
        self.httpd.server_close()
        deadline = time.time() + 5
        while server._lock.locked() and time.time() < deadline:
            time.sleep(0.05)
        self.tmp.cleanup()
    def call(self, method, path, body=None, token="__default__"):
        token = self.token if token == "__default__" else token
        headers = {"Content-Type": "application/json"}
        if token is not None:
            headers["Authorization"] = "Bearer " + token
        req = urllib.request.Request(self.base + path, method=method, headers=headers,
                                     data=json.dumps(body).encode() if body is not None else None)
        try:
            with urllib.request.urlopen(req, timeout=10) as resp:
                return resp.status, json.loads(resp.read())
        except urllib.error.HTTPError as err:
            return err.code, json.loads(err.read())
    def wait_done(self):
        deadline = time.time() + 10
        while time.time() < deadline:
            _, body = self.call("GET", "/status")
            if body["job"] and body["job"]["state"] != "running":
                return body
            time.sleep(0.1)
        self.fail("job did not finish")
    # --- Authentifizierung -------------------------------------------------
    def test_health_is_public_everything_else_needs_the_token(self):
        self.assertEqual(self.call("GET", "/health", token=None)[0], 200)
        for token in (None, "", "wrong", self.token[:-1]):
            self.assertEqual(self.call("GET", "/status", token=token)[0], 401, token)
            self.assertEqual(self.call("POST", "/update", {"version": "1.14.1"}, token=token)[0], 401)
            self.assertEqual(self.call("POST", "/rollback", {}, token=token)[0], 401)
    def test_token_is_generated_once_and_reused(self):
        self.assertGreaterEqual(len(self.token), 32)
        self.assertEqual(server.load_token(), self.token)
    def test_unknown_paths_are_404(self):
        self.assertEqual(self.call("GET", "/etc/passwd")[0], 404)
        self.assertEqual(self.call("POST", "/exec", {"cmd": "id"})[0], 404)
    # --- Status ------------------------------------------------------------
    def test_status_reports_version_and_mode(self):
        status, body = self.call("GET", "/status")
        self.assertEqual(status, 200)
        self.assertEqual(body["mode"], "release")
        self.assertEqual(body["running_version"], "1.14.0")
        self.assertFalse(body["rollback_available"])
    def test_local_build_install_is_reported_as_local(self):
        (server.PROJECT_DIR / ".env").write_text("POSTGRES_PASSWORD=x\n")
        _, body = self.call("GET", "/status")
        self.assertEqual(body["mode"], "local")
        self.assertEqual(self.call("POST", "/update", {"version": "1.14.1"})[1], {"error": "not_release_mode"})
    # --- Update ------------------------------------------------------------
    def test_update_runs_and_succeeds(self):
        status, body = self.call("POST", "/update", {"version": "1.14.1"})
        self.assertEqual(status, 202)
        self.assertEqual(body["job"]["target"], "1.14.1")
        done = self.wait_done()
        self.assertEqual(done["job"]["state"], "succeeded")
        self.assertIn("pulling", done["phases"])
        self.assertTrue(any("arbeite update 1.14.1" in line for line in done["log"]))
    def test_failed_update_exit_codes(self):
        os.environ["FAKE_EXIT"] = "3"
        self.call("POST", "/update", {"version": "1.14.1"})
        self.assertEqual(self.wait_done()["job"]["state"], "rolled_back")
        server._status_cache.update(at=0.0, value=None)
        os.environ["FAKE_EXIT"] = "1"
        self.call("POST", "/update", {"version": "1.14.1"})
        self.assertEqual(self.wait_done()["job"]["state"], "failed")
    def test_invalid_and_disallowed_versions_never_start_a_job(self):
        cases = {
            "1.14.0": "not_newer", "1.13.9": "not_newer", "2.0.0": "major_change",
            "latest": "invalid_version", "1.14.1-rc1": "invalid_version", "1.14": "invalid_version",
            "1.14.1; id": "invalid_version", "../1.14.1": "invalid_version", "": "invalid_version",
        }
        for version, error in cases.items():
            status, body = self.call("POST", "/update", {"version": version})
            self.assertEqual(body, {"error": error}, version)
            self.assertIn(status, (400, 409))
        self.assertEqual(self.call("POST", "/update", {})[1], {"error": "invalid_version"})
        self.assertEqual(self.call("POST", "/update", {"version": 5})[1], {"error": "invalid_version"})
        self.assertIsNone(self.call("GET", "/status")[1]["job"])
    def test_second_request_while_running_is_busy(self):
        os.environ["FAKE_SLEEP"] = "1.5"
        self.assertEqual(self.call("POST", "/update", {"version": "1.14.1"})[0], 202)
        self.assertEqual(self.call("POST", "/update", {"version": "1.14.2"}), (409, {"error": "busy"}))
        self.assertEqual(self.call("POST", "/rollback", {}), (409, {"error": "busy"}))
        _, running = self.call("GET", "/status")
        self.assertEqual(running["job"]["state"], "running")
        self.assertEqual(self.wait_done()["job"]["state"], "succeeded")
    def test_oversized_or_malformed_body_is_rejected(self):
        req = urllib.request.Request(self.base + "/update", method="POST", data=b"x" * 5000,
                                     headers={"Authorization": "Bearer " + self.token, "Content-Length": "5000"})
        with self.assertRaises(urllib.error.HTTPError) as ctx:
            urllib.request.urlopen(req, timeout=5)
        self.assertEqual(ctx.exception.code, 413)
        req = urllib.request.Request(self.base + "/update", method="POST", data=b"{not json",
                                     headers={"Authorization": "Bearer " + self.token})
        with self.assertRaises(urllib.error.HTTPError) as ctx:
            urllib.request.urlopen(req, timeout=5)
        self.assertEqual(ctx.exception.code, 400)
    # --- Rollback ----------------------------------------------------------
    def test_rollback_needs_a_previous_update(self):
        self.assertEqual(self.call("POST", "/rollback", {}), (409, {"error": "no_rollback"}))
    def test_rollback_and_data_loss_flag(self):
        os.environ["FAKE_LAST"] = "1"
        _, body = self.call("GET", "/status")
        self.assertTrue(body["rollback_available"])
        self.assertFalse(body["rollback_loses_data"])  # Revision unverändert
        server._status_cache.update(at=0.0, value=None)
        os.environ["FAKE_PREV_REV"] = "0003"
        _, body = self.call("GET", "/status")
        self.assertTrue(body["rollback_loses_data"])
        server._status_cache.update(at=0.0, value=None)
        self.assertEqual(self.call("POST", "/rollback", {})[0], 202)
        self.assertEqual(self.wait_done()["job"]["state"], "succeeded")
    # --- Neustart ----------------------------------------------------------
    def test_job_left_running_after_a_restart_is_marked_failed(self):
        server.write_job({"id": "x", "action": "update", "target": "1.14.1", "state": "running"})
        server.mark_interrupted()
        job = server.read_job()
        self.assertEqual(job["state"], "failed")
        self.assertIn("neu gestartet", server.LOG_FILE.read_text())
 if __name__ == "__main__":
    unittest.main()
Author	SHA1	Message	Date
Julian Boldt	cf326d2d17	Release v1.16.0 Release / verify (push) Canceled after 0s Details CI / checks (push) Canceled after 0s Details CI / frontend (push) Canceled after 0s Details CI / backend (push) Canceled after 0s Details Release / test (push) Canceled after 0s Details Release / publish (backend) (push) Canceled after 0s Details Release / publish (frontend) (push) Canceled after 0s Details Release / publish (proxy) (push) Canceled after 0s Details Release / publish (updater) (push) Canceled after 0s Details Erste Schritte nach der Installation. Ende-zu-Ende gegen einen isolierten Stack getestet, siehe Handbuch „Einrichtungsassistent und Passwort-Reset“: - Einrichtungsassistent (`/setup`, System › Einrichtung): vier Schritte mit Erklärungen — Willkommen und Sprache, Konto (eigenes Passwort, Zwei-Faktor-Anmeldung), erste Firewall verbinden (inklusive Anleitung für den API-Key in OPNsense, Zertifikat festsetzen, Verbindungsstatus) und eine Übersicht, was als Nächstes sinnvoll ist. Auf einer frischen Installation ohne Hosts öffnet er sich nach der ersten Anmeldung von selbst; „Assistent überspringen“ merkt sich das pro Benutzer, erneut öffnen geht jederzeit über System › Einrichtung oder die Einstellungen. Nur für Admins. Neue Spalte `user_preferences.setup_done` (Migration `0005`). - `opnexus password [NAME]` setzt ein neues Zufallspasswort für den Admin und zeigt es an (`--yes` ohne Rückfrage; Rückfrage nur, wenn sich schon jemand angemeldet hat). Ersetzt das Suchen im Backend-Log nach dem beim ersten Start erzeugten Passwort und taugt zugleich für ein vergessenes Admin-Passwort. Alle Sitzungen des Kontos enden. Dahinter steht `python -m app.reset_password`. Die Meldung beim ersten Start verweist darauf.	2026-10-10 14:15:55 +02:00
Julian Boldt	8fccb1a547	Remove maintainer and website tooling from the public repository Website build/deploy scripts, release/publishing tooling, developer verification scripts and internal planning notes are not part of the product for operators. The release process notes moved out of the manual.	2026-10-10 12:43:22 +02:00
Julian Boldt	cf59bdb38e	Remove website sources from the public repository The site opnexus.dev is built and deployed from a separate repository. README images now live in docs/screenshots/.	2026-10-10 12:40:41 +02:00
Julian Boldt	c662a58426	Release v1.15.0 Release / verify (push) Canceled after 0s Details CI / checks (push) Canceled after 0s Details CI / frontend (push) Canceled after 0s Details CI / backend (push) Canceled after 0s Details Release / test (push) Canceled after 0s Details Release / publish (backend) (push) Canceled after 0s Details Release / publish (frontend) (push) Canceled after 0s Details Release / publish (proxy) (push) Canceled after 0s Details Release / publish (updater) (push) Canceled after 0s Details Updates aus dem Webinterface. Auf Klick, mit Fortschritt und automatischem Rollback; ein eigener, optionaler Container erledigt die Arbeit. Ende-zu-Ende mit echten Images getestet, siehe Handbuch „Update aus dem Webinterface (optional)“: - Updates aus dem Webinterface (optional): Einstellungen › „OPNexus aktualisieren“ zeigt die neueste Version samt Release-Notes und aktualisiert auf Klick — mit Fortschrittsanzeige, automatischem Rollback bei einem fehlgeschlagenen Update und „Auf Vorversion zurücksetzen“ (mit Hinweis, ob dabei Daten verloren gehen). Dahinter arbeitet ein eigener, kleiner Updater-Container (`updater/`, Compose-Profil `updater`, mit `COMPOSE_PROFILES=updater` in `.env` aktivieren), der dieselbe Logik wie `opnexus update` ausführt. Er ist standardmäßig aus und der einzige Container mit Docker-Socket; das Backend bekommt ihn nie. Der Updater hat keinen veröffentlichten Port, ist nur mit einem selbst erzeugten Token ansprechbar und kann ausschließlich „aktualisieren auf die vom Release-Feed gemeldete neueste stabile Version“, „zurückrollen“ und „Status“. Hauptversions-Sprünge bleiben der Kommandozeile vorbehalten. Anfragen stehen im Audit-Log (neuer Typ „OPNexus-System“). Gilt nur für Release-Images. - `opnexus` (jetzt in `updater/opnexus`, `scripts/opnexus` ist ein Symlink): `status --porcelain`, Exit-Code 3 für „fehlgeschlagen und sauber zurückgerollt“. Release-Images und -Bundle enthalten zusätzlich `opnexus-updater`. - Der Banner „Neue Version verfügbar“ verlinkt auf den neuen Abschnitt in den Einstellungen.	2026-10-10 00:24:01 +02:00
Julian Boldt	3b76f9f5fa	Release v1.14.0 Release / verify (push) Canceled after 0s Details CI / checks (push) Canceled after 0s Details CI / frontend (push) Canceled after 0s Details CI / backend (push) Canceled after 0s Details Release / test (push) Canceled after 0s Details Release / publish (backend) (push) Canceled after 0s Details Release / publish (frontend) (push) Canceled after 0s Details Release / publish (proxy) (push) Canceled after 0s Details Diagnose von der Firewall aus sowie VXLAN und GIF. Gegen die OPNsense-Core-Quellen geprüft und live auf den Test-Firewalls getestet, siehe Handbuch „Erweiterung 1.14.0“: - Host-System › Diagnose: Ping, Traceroute, Port-Prüfung und DNS-Abfrage, ausgeführt von der ausgewählten Firewall. Nur für Admins, strenge Eingabeprüfung, jeder Lauf im Audit-Log, Ping-Jobs werden immer wieder aufgeräumt, der Banner der Gegenstelle wird nicht weitergegeben. Packet-Capture gibt es bewusst nicht (Mitschnitte enthalten fremde Nutzdaten). - Netzwerk › Geräte: VXLAN und GIF-Tunnel (anlegen, ändern, löschen) über dieselbe abgesicherte Engine wie die übrigen Geräte. - Fehlerkorrektur: Auf den Host-System-Seiten war „Übersicht › Hosts“ markiert und der Seitentitel falsch, weil `/hostsystem` mit `/hosts` beginnt.	2026-10-09 22:49:10 +02:00
Julian Boldt	b341ccd49f	Release v1.13.0 Release / verify (push) Canceled after 0s Details CI / checks (push) Canceled after 0s Details CI / frontend (push) Canceled after 0s Details CI / backend (push) Canceled after 0s Details Release / test (push) Canceled after 0s Details Release / publish (backend) (push) Canceled after 0s Details Release / publish (frontend) (push) Canceled after 0s Details Release / publish (proxy) (push) Canceled after 0s Details Mehr Verwaltung pro Firewall und ein Abgleich der Cluster-Knoten. Alles über dieselbe abgesicherte Engine wie in 1.12.0 und live auf drei Test-Firewalls geprüft, siehe Handbuch „Erweiterung 1.13.0“: - Netzwerk › Geräte: LAGG, Bridge, Loopback und GRE. Dazu Gateway-Gruppen, DNS-Weiterleitungen (Unbound) und DHCP-Bereiche (dnsmasq). - Neue Gruppe „Host-System“: Tunables (immer mit Bestätigung, Vorgaben nur per „Überschreiben“), Cron, Syslog-Ziele und ZFS-Snapshots (anlegen und löschen; der aktive Snapshot ist geschützt, das Aktivieren bleibt OPNsense selbst überlassen). - Netzwerk › Abgleich: zeigt Unterschiede in der Netzwerk-Konfiguration zwischen den Knoten eines Clusters. Neuer Alarm „Netzwerk-Abweichung im Cluster“ (Einstellungen › Benachrichtigungen, Migration 0004). - Auf den Partner übertragen: Nach dem Anlegen eines Objekts lässt es sich mit einem Klick auch auf dem anderen Cluster-Knoten anlegen (eigene Vorschau, eigenes Backup). - Kopfzeile: Mit acht Gruppen zeigt die Navigation die Namen ab 1150 px, darunter nur Icons, damit Suche und Abmelden in einer Zeile bleiben.	2026-10-09 22:08:39 +02:00