Merge pull request #22 from Dvorinka/feat/builder-resources

C3: builder selection, resource reservations, static builder

.env.example

@@ -1,4 +1,5 @@
-# Local development env file. Use .env.prod for production.
+# Local development env file. install.sh writes ENVIRONMENT=production for
+# self-hosted installs - keep development here only for the checkout workflow.
 
 # Domain Configuration
 DOMAIN=localhost
@@ -11,6 +12,10 @@ API_PORT=8082
 POSTGRES_PORT=5432
 REDIS_PORT=6379
 
+# Image tag to pull from GHCR (e.g. latest, 0.1.1). Use CONTAINR_BUILD=1
+# with install.sh to build from source instead.
+CONTAINR_VERSION=latest
+
 # Database Configuration
 POSTGRES_DB=containr
 POSTGRES_USER=containr_user
@@ -24,9 +29,12 @@ AUTO_MIGRATE=true
 MIGRATION_LOCK_TIMEOUT=2m
 SEED_DATA_ON_START=false
 
-# Redis Configuration
+# Dragonfly Configuration (Redis-compatible cache - REDIS_* names kept for compatibility)
 REDIS_PASSWORD=your_secure_redis_password
 REDIS_URL=redis://:your_secure_redis_password@localhost:6379/0
+# DRAGONFLY_VERSION=latest
+# DRAGONFLY_THREADS=1
+# DRAGONFLY_MAXMEMORY=256mb
 
 # Application Configuration
 # In production this must be a strong value with at least 32 characters.
@@ -36,8 +44,11 @@ CONTAINR_AGENT_AUTH_TOKEN=replace_with_strong_agent_secret
 # Optional rotation list (comma-separated). When set, this takes precedence.
 # CONTAINR_AGENT_AUTH_TOKENS=current_secret,next_secret
 CORS_ORIGINS=http://localhost:3000,http://localhost:8080
-VITE_API_URL=http://localhost:8082
-VITE_AUTH_URL=http://localhost:8082/api/auth
+# Optional build-time API URL overrides. Leave empty for the default
+# same-origin setup - the frontend nginx proxies /api to the backend, which
+# works from any host or IP without rebuilding the image.
+# VITE_API_URL=https://api.example.com
+# VITE_AUTH_URL=https://api.example.com/api/auth
 AUTH_PORT=3001
 # In production this must be true.
 COOKIE_SECURE=false
@@ -50,7 +61,15 @@ BETTER_AUTH_AUTO_MIGRATE=true
 BETTER_AUTH_INTERNAL_TOKEN=PLACEHOLDER_INTERNAL_AUTH_TOKEN
 BETTER_AUTH_INTERNAL_URL=http://127.0.0.1:3001/internal/session
 BETTER_AUTH_PROXY_URL=http://127.0.0.1:3001
+# Extra trusted origins (comma-separated). Same-origin traffic is trusted
+# automatically, so this only needs entries for cross-origin callers.
 BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000,http://localhost:8082
+
+# Platform owner bootstrap — creates/promotes the admin account on startup.
+# Keep the real values in a local untracked file, never in committed env files.
+ADMIN_EMAIL=[email protected]
+ADMIN_PASSWORD=
+ADMIN_NAME=Platform Admin
 # Optional explicit auth DB settings (recommended when password contains URL special chars)
 DB_HOST=postgres
 DB_PORT=5432
@@ -60,7 +79,9 @@ DB_PASSWORD=your_secure_postgres_password
 FRONTEND_URL=http://localhost:3000
 BACKEND_URL=http://localhost:8082
 
-# OAuth (user auth)
+# OAuth (user auth) - GitHub/Google sign-in is reserved for the managed
+# offering. Self-hosted installs use email/password only; PLACEHOLDER_*
+# values are treated as unset and the buttons stay hidden.
 GITHUB_CLIENT_ID=PLACEHOLDER_GITHUB_OAUTH_CLIENT_ID
 GITHUB_CLIENT_SECRET=PLACEHOLDER_GITHUB_OAUTH_CLIENT_SECRET
 GITLAB_CLIENT_ID=PLACEHOLDER_GITLAB_CLIENT_ID
@@ -105,10 +126,21 @@ TRAEFIK_AUTH=admin:$$apr1$$b8mh8c8v$$KkR8hQZQZQZQZQZQZQZQZ/
 # Development convenience: true in local dev, false in production
 TRAEFIK_API_INSECURE=true
 
-# Optional: Cloudflare Tunnel (alternative to domain)
+# Optional: Cloudflare Tunnel (alternative to domain). Can also be set in-app
+# under Settings > Platform (in-app value overrides this).
 # Get token from: https://dash.cloudflare.com/argotunnel
 CLOUDFLARED_TOKEN=your_cloudflare_tunnel_token_here
 
+# Optional: reopen public registration after the owner account exists.
+# Manageable in-app under Settings > Platform (in-app value overrides this).
+# SIGNUP_ENABLED=false
+
+# Docker socket gid AS SEEN INSIDE containers - lets the backend manage
+# containers (deployments, cloudflared sidecar). install.sh detects it with a
+# throwaway container. Modern Docker maps the socket to root: use 0.
+# Older daemons expose the host docker gid: stat -c %g /var/run/docker.sock
+DOCKER_GID=0
+
 # Optional: Custom Docker Registry
 # DOCKER_REGISTRY=your-registry.com
 # DOCKER_USERNAME=your_username

.github/FUNDING.yml

@@ -0,0 +1 @@
+github: Dvorinka

.github/workflows/ci.yml

@@ -109,7 +109,7 @@ jobs:
           BETTER_AUTH_SECRET=$(openssl rand -hex 32)
           BETTER_AUTH_INTERNAL_TOKEN=$(openssl rand -hex 32)
           export BETTER_AUTH_SECRET BETTER_AUTH_INTERNAL_TOKEN
-          docker compose -f infra/docker-compose.yml up -d --build postgres redis backend frontend traefik
+          docker compose -f infra/docker-compose.yml up -d --build postgres dragonfly backend frontend traefik
 
       - name: Wait for backend health
         run: |
@@ -222,3 +222,96 @@ jobs:
           ignore-unfixed: true
           vuln-type: os,library
           severity: CRITICAL,HIGH
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    needs: [docker]
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: write
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Conventional-commit bump. Tags pushed with GITHUB_TOKEN do not
+      # retrigger this workflow, so images are retagged below instead.
+      - name: Bump version and push tag
+        if: github.ref == 'refs/heads/main'
+        id: tag_version
+        uses: mathieudutour/[email protected]
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          default_bump: false
+
+      - name: Resolve release tag
+        id: release
+        run: |
+          if [ "${{ github.ref_type }}" = "tag" ]; then
+            tag="${GITHUB_REF_NAME}"
+          else
+            tag="${{ steps.tag_version.outputs.new_tag }}"
+          fi
+          if [ -z "$tag" ]; then
+            echo "No releasable commits since last tag - skipping release."
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Go
+        if: steps.release.outputs.tag != ''
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: app/backend/go.mod
+          cache: true
+
+      - name: Build CLI binaries
+        if: steps.release.outputs.tag != ''
+        working-directory: app/backend
+        env:
+          VERSION: ${{ steps.release.outputs.tag }}
+        run: bash ../../scripts/build-cli.sh
+
+      - name: Checksums
+        if: steps.release.outputs.tag != ''
+        working-directory: app/backend/bin
+        run: sha256sum containr-* > checksums.txt
+
+      - name: Login to GHCR
+        if: steps.release.outputs.tag != '' && github.ref == 'refs/heads/main'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Tag pushes from github-tag-action do not trigger workflows, so the
+      # release job retags the just-published :main images in-registry.
+      - name: Tag release images in GHCR
+        if: steps.release.outputs.tag != '' && github.ref == 'refs/heads/main'
+        env:
+          TAG: ${{ steps.release.outputs.tag }}
+        run: |
+          repo="${GITHUB_REPOSITORY,,}"
+          for img in backend frontend; do
+            docker buildx imagetools create \
+              --tag "ghcr.io/${repo}-${img}:${TAG}" \
+              --tag "ghcr.io/${repo}-${img}:latest" \
+              "ghcr.io/${repo}-${img}:main"
+          done
+
+      - name: Create GitHub Release
+        if: steps.release.outputs.tag != ''
+        working-directory: app/backend/bin
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.release.outputs.tag }}
+        run: |
+          # Delete-then-create keeps reruns idempotent: --clobber uploads
+          # race GitHub's asset tombstones and intermittently 422. The git
+          # tag itself is kept (no --cleanup-tag).
+          gh release delete "$TAG" --yes 2>/dev/null || true
+          gh release create "$TAG" --title "$TAG" --generate-notes \
+            containr-* checksums.txt

.gitignore

@@ -121,3 +121,6 @@ bin
 
 # Local reference checkouts (not project code)
 ref/
+.playwright-mcp/
+canvas-*.png
+.vercel

.vercelignore

@@ -0,0 +1,2 @@
+/*
+!/site

AGENTS.md

@@ -0,0 +1,37 @@
+# AGENTS.md — Containr
+
+Containr is a self-hosted Docker PaaS (Railway-style). Backend: Go + Gin + PostgreSQL (sqlc) + Redis-compatible cache (Dragonfly) + Docker API. Frontend: React + Vite + TypeScript + React Query. API contract: `docs/api/openapi.yaml` (generated types: `app/frontend/src/generated/api-types.ts`).
+
+This file is for **coding agents working on the repo**. For operating Containr as a deployed product, see `llms.txt`.
+
+## Layout
+
+- `app/backend` — Go monolith. Entrypoints: `cmd/server` (API), `cmd/cli` (`containr` CLI), `cmd/mcp` (`containr-mcp` MCP server).
+- `app/backend/internal/api` — Gin handlers + route groups (`routes.go`: public / `read` OptionalAuth / `authed` / `admin`).
+- `app/backend/internal/middleware` — `Auth` (JWT + Better Auth session + PAT), `RequireAdmin`, `Idempotency`.
+- `app/backend/internal/cli/commands` — all CLI commands; shared `Client`, `Output`, `confirm` helpers live here.
+- `app/backend/internal/mcpserver` — declarative MCP tool registry mirroring the API.
+- `app/backend/sqlc` — `schema.sql` + `queries/*.sql`; generate via `sqlc generate` into `internal/database/sqlcdb`.
+- `app/backend/migrations_goose` — goose migrations (`YYYYMMDDHHMMSS_name.sql`).
+- `app/frontend` — React app. Pages under `src/features/`, API calls via `src/lib/api-client.ts`.
+
+## Build / test / verify
+
+```sh
+cd app/backend && go build ./... && go vet ./... && go test ./...
+cd app/frontend && npx tsc --noEmit && npm run lint && npm run build
+cd app/frontend && npm run generate:api   # after any openapi.yaml change
+```
+
+Dev stack: Postgres on `:15432` (`containr-postgres-1`), Dragonfly on `:16379` (`containr-dragonfly-1`). Server needs `DATABASE_URL`, `REDIS_URL`, `JWT_SECRET`, `PORT=8080`.
+
+## Conventions that matter
+
+- New endpoints go in the right route group; mutations on `authed`/`admin` get idempotency for free.
+- Deploy work goes through `deploy_queue` (`internal/deployqueue`) — per-service FIFO; enqueue jobs instead of `go`-ing deployment/reconcile goroutines so they never race a build.
+- New list endpoints use `pageWindow`/`paginationMeta` (`internal/api/pagination.go`) — cursor + page, `next_cursor` in the envelope.
+- New errors use stable codes via `respondError(c, status, code, msg)` in `internal/api/errors.go`.
+- New CLI command → also register an MCP tool in `internal/mcpserver/server.go` and document in OpenAPI. All three surfaces ship together.
+- Destructive CLI commands must gate on `--yes`/`confirm` via `commands.confirm`; destructive MCP tools require `confirm: true`.
+- sqlc: edit `schema.sql` + `queries/*.sql`, run `sqlc generate`, add the goose migration.
+- Don't commit secrets. PATs (`cnp_…`) and agent tokens (`cagt_…`) are sha256-hashed at rest; raw values are shown once.

README.md

@@ -11,8 +11,8 @@
 
 <p align="center">
   <a href="#quick-start">Quick Start</a> •
+  <a href="#screenshots">Screenshots</a> •
   <a href="#features">Features</a> •
-  <a href="#architecture">Architecture</a> •
   <a href="docs/guides/">Guides</a> •
   <a href="CONTRIBUTING.md">Contributing</a>
 </p>
@@ -22,124 +22,121 @@
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT"></a>
 </p>
 
-## What is Containr?
+Containr is an open-source control plane for Docker. Create a project, drop
+services onto a visual canvas, wire them together with environment variables,
+and deploy — no Kubernetes, no cloud bill. Services appear as nodes with
+auto-inferred connections; logs, metrics, builds, and rollbacks are one
+click away.
 
-Containr is an open-source control plane for Docker. It gives you a
-project-first deployment workflow — create a project, drop services onto a
-visual canvas, wire them together with environment variables, and deploy —
-without Kubernetes, without a cloud bill, and without giving up control of
-your infrastructure.
+The platform doubles as a public showcase: visitors browse approved projects
+and the template catalog without an account, while owners manage everything
+behind sign-in and a platform admin approves, curates, and moderates from a
+dedicated console.
 
-The UI is inspired by Railway's project canvas: services appear as nodes,
-connections are inferred automatically, and everything — logs, metrics,
-deployments, builds — is one click away.
+## Screenshots
+
+| Projects dashboard | Project canvas |
+| --- | --- |
+| ![Projects dashboard with host telemetry](docs/screenshots/dashboard.png) | ![Visual service canvas with two services](docs/screenshots/canvas.png) |
+
+| Service detail | Managed databases |
+| --- | --- |
+| ![Service view with metrics, logs and config tabs](docs/screenshots/service-detail.png) | ![Managed database list showing a running PostgreSQL](docs/screenshots/databases.png) |
 
 ## Features
 
-- **Project canvas** — visual service topology with groups, drag/drop layout,
-  and auto-inferred connections
-- **Deployments** — Docker-based deploys with history, logs, and rollback
-- **Git integration** — deploy from GitHub, GitLab, Bitbucket, or Gitea;
-  repository and branch pickers, webhooks, GitHub App support
-- **Builds** — build pipeline with live status over WebSocket
-- **Service metrics** — real CPU/memory/network telemetry from Docker stats
-- **Templates** — one-click service catalog (databases, apps, tooling)
-- **Databases** — managed database services with backup/restore actions
-- **Cron jobs** — scheduled jobs with execution history
-- **Preview environments** — per-project preview deploys
-- **Variables & environments** — per-service env vars, production/preview/dev
-- **Node monitoring** — host CPU, memory, disk, and network telemetry
-- **Security** — audit logs, vulnerability scans, compliance reports
-- **Auth** — Better Auth sessions (email + OAuth), per-user resource scoping
-- **Self-hosted networking** — Traefik reverse proxy, optional Cloudflare
-  Tunnel for exposure without port forwarding
+- **Project canvas** — visual service topology, groups, drag/drop, auto-inferred connections, right-click lifecycle actions
+- **Public project catalog** — approved projects are browsable anonymously; new projects stay private until an admin approves them
+- **Admin console** (`/admin`) — platform stats, project approval/edit/delete, user admin management
+- **Private networking** — every project gets an isolated Docker network; services reach each other by name (`web:3000`) and share variables via `${{service.KEY}}` references
+- **Deployments & builds** — Docker deploys with history, image rollback, live build status
+- **Runtime** — replicas, published ports, domains, health checks, restart policies; start/stop/restart/redeploy from canvas or service page
+- **Git integration** — GitHub, GitLab, Bitbucket, Gitea; webhooks, GitHub App
+- **Managed databases** — create PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Dragonfly, or ClickHouse directly from `/databases`, with backup/restore
+- **Template catalog** — 30 official templates (NocoDB, Plausible, MinIO, n8n, …) plus user-defined templates with JSON upload and owner-scoped edit/delete
+- **Metrics** — per-service Docker stats plus host CPU/memory/disk telemetry
+- **HA & scaling** — failover policies, node agents, autoscaling rules
+- **Auth & security** — Better Auth sessions (email/password self-hosted), personal access tokens with `read`/`write`/`admin` scopes for CLI and agents, audit logs, vulnerability scans
+- **CLI** — `containr` covers the full API: projects, services, deployments, logs, exec, variables, databases, cron, templates, nodes, scaling, HA, security, gateway, admin — with `--json`, `--yes`, named profiles, and `containr up` for current-directory deploys
+- **Integrated docs** — searchable documentation rendered in-app on the landing page and `/docs`; syncs from GitHub, falls back to a bundled snapshot offline
+- **Networking** — Traefik reverse proxy, optional Cloudflare Tunnel
+
+## Access model
+
+| Audience | Can do |
+| --- | --- |
+| **Anonymous** | Browse approved projects, services, templates, databases, HA status, docs |
+| **Signed-in user** | Create/manage own projects, services, databases, templates; view own logs, variables, builds, deployments |
+| **Admin** | Everything above plus project approval/moderation, user admin flags, HA manager controls, agent tokens, platform settings |
+
+Logs, variables, exec consoles, and database connection URLs are never
+public — they require owner, member, or admin access regardless of a
+project's public visibility.
+
+## Quick Start
+
+Requires Docker with the Compose plugin, `openssl`, and `curl`:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/Dvorinka/Containr/main/install.sh | bash
+```
+
+Installs into `./containr`, generates secrets, pulls the published `:latest`
+images, and starts the stack — UI at `http://localhost:3000`, API at
+`http://localhost:8082`. Non-interactive; re-runs never overwrite `.env`.
+
+The platform admin is provisioned at startup from environment variables:
+
+```bash
+ADMIN_EMAIL=[email protected]
+ADMIN_PASSWORD=<generated>   # keep in a local untracked file
+ADMIN_NAME=Your Name         # optional
+```
+
+Both the local account and the Better Auth session account are created, so
+either sign-in path works. Without `ADMIN_*`, the first registered account
+becomes owner; registration then closes automatically. The owner can reopen
+it and configure a Cloudflare Tunnel token under **Settings → Platform** —
+in-app values override env vars.
+
+Override install defaults with env vars:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/Dvorinka/Containr/main/install.sh | \
+  HTTP_PORT=8080 CONTAINR_DIR=/opt/containr bash
+```
+
+`CONTAINR_VERSION` pins a release tag, `CONTAINR_REF` selects the git ref for
+downloaded files, `CONTAINR_BUILD=1` builds from source. From a git checkout,
+`./install.sh` installs in place; plain `docker compose up -d` pulls the same
+images (`--build` to compile locally).
+
+Local development and self-hosted deployment (Traefik + Cloudflare Tunnel):
+see [docs/guides/](docs/guides/) and `infra/docker-compose.yml`.
 
 ## Architecture
 
 ```
 app/frontend/   React 19 + Vite + TypeScript + Tailwind + React Flow
-app/backend/    Go API (Gin) · PostgreSQL · Redis · Docker SDK · Better Auth sidecar
+app/backend/    Go API (Gin) · PostgreSQL · Dragonfly · Docker SDK · Better Auth sidecar
 infra/          Self-hosted compose: Traefik + Cloudflare Tunnel
 docs/           Guides, OpenAPI spec, design documents
 ```
 
-| Component    | Default port |
-| ------------ | ------------ |
-| Frontend     | 3000 (prod) / 5173 (dev) |
-| API          | 8082 |
-| Auth sidecar | 3001 |
-| PostgreSQL   | 5432 |
-| Redis        | 6379 |
-
-## Quick Start
-
-### Easy install (recommended)
-
-Requires Docker with the Compose plugin, `openssl`, and `curl`.
-
-```bash
-git clone https://github.com/Dvorinka/Containr.git
-cd Containr
-./install.sh
-```
-
-The script creates `.env` from `.env.example`, fills in all required secrets
-with random values, builds the images, and starts the stack. It keeps an
-existing `.env` untouched, so it is safe to re-run.
-
-Frontend at `http://localhost:3000`, API at `http://localhost:8082`.
-
-### Docker Compose (manual)
-
-```bash
-cp .env.example .env   # fill in secrets
-docker compose up -d --build
-```
-
-Host ports can be remapped in `.env` (`HTTP_PORT`, `API_PORT`,
-`POSTGRES_PORT`, `REDIS_PORT`) if the defaults collide with other services.
-
-### Local development
-
-```bash
-docker compose up -d postgres redis   # data services only
-cd app/backend && go run ./cmd/server # API + embedded auth sidecar
-cd app/frontend && npm install && npm run dev
-```
-
-Frontend dev server at `http://localhost:5173`.
-
-### Self-hosted with Traefik + Cloudflare Tunnel
-
-See `infra/docker-compose.yml` and
-[docs/guides/CLOUDFLARE_SETUP.md](docs/guides/CLOUDFLARE_SETUP.md).
-
-## Configuration
-
-All configuration is via environment variables — see `.env.example`.
-Required for production: `JWT_SECRET`, `BETTER_AUTH_SECRET`,
-`BETTER_AUTH_INTERNAL_TOKEN`, database and Redis credentials.
-
-**Never commit `.env` or `.env.prod`.** Both are gitignored; if a secret was
-ever committed, rotate it.
+All configuration is via environment variables — see `.env.example`. Never
+commit `.env` or `.env.prod`; keep generated admin credentials in a local
+untracked file (e.g. `admin-credentials.local`). If a secret was ever
+committed, rotate it.
 
 ## Documentation
 
+- In-app: the landing page and `/docs` render searchable docs — synced from
+  this repository, with a bundled snapshot so they are never blank offline
 - [docs/guides/](docs/guides/) — setup, deployment, Cloudflare, autoscaling
 - [docs/api/openapi.yaml](docs/api/openapi.yaml) — API contract
 - [docs/developers/onboarding.md](docs/developers/onboarding.md) — contributor onboarding
-- [docs/design/](docs/design/) — UI design references
 - `make help` — common tasks
 
-## Contributing
+---
 
-See [CONTRIBUTING.md](CONTRIBUTING.md). Issues and PRs welcome.
-
-## Security
-
-See [SECURITY.md](SECURITY.md). Report vulnerabilities privately — do not
-open public issues.
-
-## License
-
-[MIT](LICENSE) © 2026 Tomas Dvorak
+[Contributing](CONTRIBUTING.md) · [Security](SECURITY.md) · [MIT License](LICENSE) © 2026 Tomas Dvorak

ROADMAP2.md

@@ -0,0 +1,396 @@
+# Containr — Roadmap 2: The dflow Convergence
+
+Last verified: **2026-10-08** — deep pass over the full dflow codebase
+(`~/Desktop/PROG+HTML/dflow`, community fork of dflow-sh/dflow, frozen for
+preservation) against Containr `main` (`15b5b0e`).
+
+Goal: make Containr the superior successor — absorb everything worth having
+from dflow, then go past it and past Railway. Same power for humans and
+agents: the UI is the friendly face, the CLI and MCP are the machine face,
+all three sit on the same API. **Branding stays Containr/Vertice** —
+white-labeling is an admin option, not an identity change.
+
+---
+
+## 1. What dflow actually is (verified)
+
+Next.js 15 + PayloadCMS 3 + MongoDB + Redis/BullMQ. Runtime model: every
+host is a remote server driven **over SSH** with Dokku auto-installed as the
+per-app container manager. Async work = 43 BullMQ queue processors
+(`src/queues/**`), live logs via Redis pub/sub → SSE endpoint, persisted to
+deployment records. ~30 collections, ~180 server actions, 11 dashboard
+routes per service (general, deployments, logs, environment, domains,
+volumes, proxy, scaling, backups, settings).
+
+### Full capability matrix — dflow → Containr
+
+Legend: ✅ done · 🟡 partial/different · ❌ missing · ➖ not applicable (dokku/SSH-specific)
+
+#### Deployment pipeline
+| dflow capability | Containr status | Action |
+|---|---|---|
+| Queued deployments, serialized per server, cancellable while queued | ❌ goroutine fire-and-forget; `CancelDeployment` exists in engine but is **never routed** | Add deploy queue + cancel route |
+| Deployment states `queued → building → success/failed`, live SSE logs + persisted record | 🟡 states exist (`building→running`); WS streams builds; no queued state | Extend status + stream |
+| Redeploy cache modes (`ps:rebuild` vs fresh pull); webhook pushes force `no-cache` | ❌ always rebuilds | Add `cache` flag on deploy/redeploy |
+| Cancel queued deployment from UI | ❌ (engine fn unrouted) | Route it |
+| Per-service job ordering | ❌ concurrent deploys of one service can race | Serialize per service |
+
+#### Service configuration
+| dflow capability | Containr status | Action |
+|---|---|---|
+| Multi-domain per service + default flag + cert type | ❌ single `services.domain` | `service_domains` table |
+| Cert types: letsencrypt / none / Cloudflare Origin / **CF-for-SaaS custom hostnames** | 🟡 Traefik ACME only | LE default; CF custom hostnames deferred (only needed if hosting tenant domains) |
+| DNS preflight check (`checkDNSConfigAction`) | ❌ | `GET /services/:id/domains/check` |
+| Volumes per service + dangling-volume browser/attach/delete | ❌ engine supports `VolumeMounts`; no API/UI | `services.volumes` jsonb + Volumes tab |
+| Resource **limits and reservations**, per-server defaults | 🟡 `cpu_limit`/`memory_limit` int columns (unclear units) | explicit string units + reserves + instance defaults |
+| Pre-deploy capacity check (dokku binary interceptor) | ❌ | Node capacity check pre-deploy/scale |
+| Maintenance mode toggle | ❌ | Traefik middleware label |
+| Basic-auth gate per service (`toggleHttpAuth`) | ❌ | Traefik basic-auth middleware |
+| Raw proxy config override (`setServiceNginxConfig`) | ❌ | Allowlisted `traefik_labels` jsonb |
+| Service clone (full config copy) | ❌ | `POST /services/:id/clone` |
+| Move service between projects (`SwitchServiceProjectDialog`) | ❌ | `PUT /services/:id {project_id}` |
+| Env var save → hot-apply + optional restart (`noRestart`) | ❌ rows rewritten; containers keep stale env until manual redeploy | Apply→redeploy flow |
+| Static-site builder; Heroku buildpacks | 🟡 railpack/nixpacks/dockerfile auto-detect, no user override | `services.builder` enum + static builder |
+| Docker registry accounts (private registries) | ❌ | `registry_credentials` per service/instance |
+
+#### Databases
+| dflow capability | Containr status | Action |
+|---|---|---|
+| Managed DBs (pg/mysql/mariadb/mongo/redis/clickhouse via dokku plugins) | ✅ plus dragonfly | — |
+| **External DB registration** (Neon/Atlas/RDS conn details + test) | ❌ | `provider=external` + test endpoint |
+| Internal backups + restore (same-type enforced) | ✅ | — |
+| Scheduled backups | ✅ cron field | — |
+| **External S3 backups** (auth/schedule/unschedule ops) | ❌ | `backup_targets` + shipper |
+| **Cross-server DB migration** (export → sftp hop → import) | ❌ | `POST /databases/:id/migrate` |
+| Public DB port expose/unexpose | ❌ loopback only | opt-in TCP expose |
+| DB → service env linking (`dokku link`) | ✅ Bind action injects `DATABASE_URL` | — |
+
+#### Servers / infrastructure
+| dflow capability | Containr status | Action |
+|---|---|---|
+| Attach server = paste IP + SSH key; Dokku auto-installs | 🟡 agents exist, manual install | **SSH bootstrap**: one SSH session installs agent, never needed again |
+| Tailscale/Headscale, NetBird, ZeroTier enroll + mesh connect | ❌ | Agent mesh-IP detection first; auth-key enroll optional |
+| AWS EC2 + Hetzner provisioning w/ cloud-init | ❌ | IaC (ROADMAP §2.2): Terraform Proxmox/AWS + Hetzner module |
+| Security groups (AWS SG rules, sync) | ❌ | Under IaC provider modules |
+| Server-level global/wildcard domain (`updateServerDomain`) | ❌ | `nodes.default_domain` |
+| Scheduled server cleanup (dokku cleanup → docker prune) | ❌ | Agent `prune` command + schedule |
+| Queue flush/inspect per server (`flushServerQueues`, `getServerQueues`) | ➖ no queue yet | Ops page shows jobs once queue exists |
+| Arbitrary SSH command on server (`executeCommand`) | ➖ exec is container-scoped | Node terminal via agent (PTY) |
+| Server onboarding wizard, reset, cleanup-on-delete | 🟡 token issue/revoke only | Onboarding flow + `nodes add` UX |
+| Ansible playbooks (stored, runnable per server, exec history) | ➖ | **Defer** — security surface; SSH bootstrap covers provisioning |
+| Per-node resource dashboards | 🟡 heartbeat telemetry exists | Node detail page |
+
+#### Platform / org
+| dflow capability | Containr status | Action |
+|---|---|---|
+| Multi-tenant organisations + custom RBAC (per-resource CRUD, create-limits, read-scope) | 🟡 `is_admin` + `project_members` | Defer full RBAC; design PAT scopes role-compatible |
+| Team invite links/emails | 🟡 manual user create only | `POST /invites` → link join |
+| User API keys → full REST API | ❌ **the big gap** — session/JWT only | PATs (Phase A) |
+| Outbound webhooks (collection events, HMAC, custom headers) | ❌ | `webhooks` table + delivery log |
+| Banners (global + per-tenant, dismissible) | ❌ | `banners` table + top bar |
+| White-label (logo/favicon/title/OG/theme colors) | ❌ | `app_settings.branding` — **Containr remains the default brand** |
+| Activity feed (icon/severity/category/metadata, 90-day TTL job) | 🟡 `audit_logs` coarser | Enrich + project feed UI |
+| Admin metrics dashboard (users/servers/queued/failed counts) | 🟡 `/admin` exists | Extend |
+| **Impersonate user** | ❌ | Admin support tool |
+| In-app docs (content-collections markdown) | ✅ `/docs` | — |
+| Dynamic client-side filter framework (535-line `filter.utils`) | 🟡 audit page filters only | Reuse pattern for tables |
+| Ops "bubble" (queue monitor, terminal, sync) | ❌ | Operations page |
+
+#### Agent surface
+| dflow capability | Containr status | Action |
+|---|---|---|
+| Payload REST/GraphQL auto-API + per-user API keys | ❌ | PATs + OpenAPI (better: typed, documented) |
+| CLI | ❌ | none in dflow — **Containr CLI is a genuine leap past it** |
+| MCP | ❌ | none — same leap |
+| Railway migrator script | ❌ | `containr migrate railway` |
+| GitHub App **manifest flow** (instance self-provisions the App) | 🟡 env-configured App | `POST /git/github-app/manifest` flow |
+| fork-sync webhook deploy trigger | ❌ | ~20 lines on receiver |
+| Azure DevOps provider | ❌ | Optional (dflow does token-clone only) |
+
+---
+
+## 2. The spine: agent-first platform
+
+*Agent and user on the same level.* Concretely:
+
+- Every operation reachable by a **personal access token**, not just
+  sessions.
+- Every operation in the **CLI** with `--json`, stable exit codes, `--yes`.
+- Every operation in an **MCP server** (stdio first) so Devin/Claude Code/
+  Cursor/Codex drive Containr natively.
+- `openapi.yaml` stays the single source of truth; UI, CLI, MCP are thin
+  clients.
+
+### Phase A — Agent surface (do this FIRST; everything after inherits it)
+
+- [ ] **Personal access tokens.** `user_tokens` table — `id`, `user_id`,
+  `name`, `key_prefix` (`cnp_…`), `key_hash` (sha256), `scopes`
+  (`read`/`write`/`admin`, later resource-scoped), `expires_at`,
+  `last_used_at`. Model on `agent_auth_tokens` (raw shown once, hash stored).
+  `POST/GET/DELETE /api/v1/user/tokens`; `middleware.Auth` accepts
+  `Bearer cnp_…`; Settings → Access tokens UI with one-time display +
+  copyable CLI/MCP config snippets.
+- [ ] **CLI v2.** Current `cmd/cli` is auth + projects only. Full client:
+  - `auth login [--token] [--url] [--profile]` (multi-instance profiles).
+  - Resources: `projects services deploy logs exec variables databases
+    cron templates nodes scaling ha security gateway notifications
+    webhooks domains volumes backups admin`.
+  - `containr up` / `deploy` — cwd→service create-or-update→watch
+    (the `railway up` equivalent; single most important command).
+  - `containr link` (bind cwd→service), `containr open`, `containr run`,
+    `containr shell` (PTY once exec upgrade lands), `completion`.
+  - Universal `--json`, `-o yaml`, `--watch`, `--yes`; exit codes
+    0/1/2/3/4 (ok/err/not-found/unauthorized/conflict).
+  - GoReleaser → GH releases + `install.sh`; `version` command.
+  - Conventions from docsync/envdiff/cix/repolint.
+- [ ] **MCP server** (`cmd/mcp`, same module, stdio). Tools mirror the
+  CLI: `list_projects create_service deploy get_logs set_variable
+  restart rollback create_database trigger_cron deploy_template exec
+  get_metrics security_scan …`. Auth: `CONTAINR_URL` + `CONTAINR_TOKEN`
+  or shared `~/.containr/config`. `containr mcp serve` + install snippets
+  for Devin/Claude/Cursor.
+- [ ] **API agent ergonomics.** `Idempotency-Key` on mutating endpoints;
+  uniform `{error, code, details}` envelope (audit bare-string returns);
+  cursor pagination on growing lists; name-or-id lookup everywhere.
+- [ ] **Agent docs.** Root `AGENTS.md`, `/docs` serves `llms.txt` +
+  `llms-full.txt`, MCP tool list generated from OpenAPI where possible.
+
+**Gate**: an agent holding only a PAT registers a project, deploys from a
+git repo, streams logs, sets vars, rolls back — zero UI. Same via CLI
+for a human.
+
+---
+
+## 3. Phase B — Deployment pipeline maturity
+
+dflow's one real architectural edge. Containr deploys are fire-and-forget
+goroutines; this fixes correctness *and* unlocks the ops surface.
+
+- [ ] **Deploy job queue.** Lightweight internal queue (Postgres
+  `deployment_queue` table + single worker loop — no new infra; Redis
+  exists but don't add BullMQ-style sprawl). Serialize per service;
+  optional per-node serialization. Status gains `queued`.
+- [ ] **Cancel deployments.** Route `POST /deployments/:id/cancel` →
+  engine `CancelDeployment` (exists, unrouted). Queued jobs cancel
+  cleanly; building jobs cancel context where safe.
+- [ ] **Cache modes.** `?cache=full` on redeploy → rebuild from existing
+  image layers vs clean pull/checkout. Webhook-triggered deploys default
+  to no-cache (dflow convention — prevents stale-layer surprises).
+- [ ] **Queued→building→running status + persisted step logs.** Already
+  mostly there; add `queued`, stream over existing `/ws`.
+- [ ] **Env var apply → redeploy.** Saving variables asks "restart to
+  apply?" (or `--apply` flag in CLI); backend triggers redeploy honoring
+  running state. Currently rows update but containers keep stale env —
+  silent-drift bug class, not just UX.
+- [ ] **Encrypt variables at rest.** `environment_variables.value` is
+  plaintext today (verified). Envelope-encrypt `is_secret` values
+  (AES-GCM, key from `JWT_SECRET` or dedicated `SECRETS_KEY`); dflow
+  encrypts every var, we encrypt secrets — migration = transparent
+  encrypt-on-write + decrypt-on-read.
+
+## 4. Phase C — Service configuration parity
+
+- [ ] **Volumes on services** — `services.volumes` jsonb
+  `[{volume|host_path, container_path, read_only}]`; engine accepts
+  `VolumeMounts` already. Volumes tab + orphan-volume listing
+  (`docker volume ls -f dangling`) with delete/attach.
+- [ ] **Multi-domain** — `service_domains(service_id, domain, is_default,
+  cert_type, status, last_checked_at)`. Domains tab: add/remove/
+  set-default/DNS-status badge. Keep `services.domain` as derived
+  default for compat.
+- [ ] **DNS preflight** — `GET /services/:id/domains/check` resolves and
+  compares vs edge IP → `ok|wrong-target|pending`.
+- [ ] **Maintenance mode + basic-auth gate** — Traefik middleware labels;
+  no proxy code needed.
+- [ ] **Routing overrides** — `services.traefik_labels` jsonb with
+  allowlist validation (middlewares, headers, redirects).
+- [ ] **Builder override** — `services.builder` enum
+  `auto|railpack|nixpacks|dockerfile|static`; fix hardcoded `nixpacks`
+  at `deployments.go:406`. Static builder = build + nginx sidecar.
+- [ ] **Resource limits + reserves** — adopt dflow-style explicit units
+  (`"0.5"`/`"512m"`); add `cpu_reserve`/`memory_reserve` →
+  `NanoCPUs`/`Memory`/`MemoryReservation`; instance defaults in
+  `app_settings`.
+- [ ] **Pre-deploy capacity check** — sum reservations vs node capacity
+  (agent telemetry); warn or block per policy flag.
+- [ ] **Service clone** + **move between projects**.
+- [ ] **Private registries** — `registry_credentials`
+  (server/username/secret, encrypted); `docker login` at pull time;
+  per-service registry link.
+- [ ] **Service detail tabs to match dflow's surface**: add Domains,
+  Volumes, Proxy/access-controls, Backups sections to the service page
+  (Cron/Previews/Scaling already exist).
+
+## 5. Phase D — Data layer maturity
+
+- [ ] **External DB registration** — `provider='managed'|'external'`,
+  conn fields, `POST /databases/test-connection`, same bind flow.
+- [ ] **Public DB port expose** — opt-in Traefik TCP route or host port;
+  default stays loopback.
+- [ ] **Offsite backups** — `backup_targets` (S3-compatible:
+  endpoint/bucket/keys encrypted); per-DB destination; ship archives via
+  utility container + s3 SDK; restore-from-S3.
+- [ ] **Cross-node DB migration** — `POST /databases/:id/migrate
+  {target_node_id}`: dump → stream transfer → provision → restore →
+  re-point bound services. Needs ≥2 nodes or local↔node.
+- [ ] **Backup import** — upload archive → new restore point (pairs with
+  migrators).
+
+## 6. Phase E — Templates v2 (absorbs compose-catalog spec + dflow graph templates)
+
+- [ ] **Template = ordered service graph** — `services[]` entries with
+  `{name, type, source, build, ports, volumes, variables, depends_on}`;
+  deploy order from dependency refs.
+- [ ] **Expressions** — `${{service.KEY}}` (already the runtime ref
+  syntax — reuse), `{{secret(len,"charset")}}`, `{{random:int}}`,
+  `{{VAR:-default}}`; `POST /templates/:id/plan` returns the resolved
+  graph without deploying (agents love this).
+- [ ] **Compose import** — `POST /templates/import/compose` (compose-go
+  parser → graph), `POST /templates/import/github` (compose file from
+  repo path). Implements `docs/superpowers/specs/2026-04-14-*`.
+- [ ] **Graph deploy pipeline** — creates project + services in
+  dependency order, resolves vars, triggers builds; defined
+  partial-failure policy.
+- [ ] **Visual template builder** — canvas mode: drop git/image/db
+  nodes, wire refs, set order, save/publish. Reuses existing canvas
+  primitives (dflow's `templates/compose` is exactly this).
+- [ ] **Catalog growth** — convert `templates/*.md` (20 app guides) into
+  real graph templates; screenshots + badges per the old spec.
+
+**Gate**: paste n8n compose → 3-service project with generated secrets
+and wired refs, one click or one CLI call.
+
+## 7. Phase F — Nodes & infrastructure
+
+- [ ] **SSH bootstrap install** — `containr nodes add --ssh user@host` +
+  UI flow: one SSH session runs agent install (binary + systemd +
+  enroll token), SSH closed forever. dflow onboarding UX, agent-model
+  security.
+- [ ] **Mesh awareness** — agent detects + reports tailscale0/netbird0/
+  zt0 IPs at register; backend stores + displays. Optional
+  `TAILSCALE_AUTH_KEY` enroll-at-provision later.
+- [ ] **Node detail page** — placed services, telemetry history, agent
+  version + self-upgrade, **drain/cordon**, remove.
+- [ ] **Node housekeeping** — agent `prune` command (docker system
+  prune, bounded) + optional schedule (`setServerAutoCleanup` analog —
+  disk pressure is the #1 small-VPS killer).
+- [ ] **Multi-node scheduling** — wire `scheduling_rules` (table exists):
+  pin/spread/affinity, prefer-lowest-usage; deploy engine routes to
+  `services.node_id` via agent commands (agent already runs containers).
+- [ ] **Build-on-node** — agents currently `docker run` prebuilt images
+  only; extend agent to pull registry images (build stays central) —
+  private registry creds flow through Phase C.
+- [ ] **IaC provisioning (ROADMAP §2.2, unchanged)** — Terraform/
+  OpenTofu, `infra_connections`, Proxmox + AWS modules, + Hetzner module
+  (dflow's second provider), cloud-init → auto-enroll.
+- [ ] **Global/wildcard domain per node** (`nodes.default_domain`) —
+  auto-domains for services on that node.
+
+## 8. Phase G — Platform polish
+
+- [ ] **Outbound webhooks** — `webhooks(url, secret, events[], headers,
+  enabled)` + `webhook_deliveries` log; HMAC `X-Containr-Signature`;
+  events: `deployment.* service.* database.* security.* agent.*`.
+- [ ] **Activity feed** — enrich `audit_logs` with `severity category
+  icon label metadata`; per-project timeline + global feed; TTL job.
+- [ ] **Banners** — `banners(title, body, level, scope, active)`; top
+  bar in UI + surfaced to CLI on `auth status`.
+- [ ] **White-label** — `app_settings.branding`: product name, logos,
+  favicon, accent override, docs/support links. `GET /api/v1/branding`
+  public + cached. **Containr/Vertice remains default;** this is for
+  self-hosters who rebrand their instance.
+- [ ] **Operations page** — unified view of running/queued/failed jobs
+  (deploys, builds, backups, cron, scans, agent commands) — dflow's
+  bubble panel as a real page; flush/stuck-job tools once queue exists.
+- [ ] **Interactive terminal** — upgrade exec to WS PTY (`xterm.js`);
+  `nodes/:id/terminal` via agent (dflow's wetty without the extra
+  container).
+- [ ] **Team invites** — `POST /invites` → signed link → join flow;
+  replaces manual-only user creation.
+- [ ] **Impersonate user** — admin support tool, audit-logged.
+- [ ] **GitHub App manifest flow** — `POST /git/github-app/manifest`
+  returns manifest + redirect; instance self-provisions its App
+  (dflow pattern — removes the env-setup barrier).
+- [ ] **fork-sync trigger** — accept repo-sync events on webhook
+  receiver.
+- [ ] **Dynamic filter framework** — port dflow's `filter.utils`
+  pattern (typed filter configs → URL state → client filtering) for
+  audit logs, deployments, notifications tables.
+- [ ] **Notification producers round-out** — backups, agent offline,
+  upgrade available, security findings.
+- [ ] **Custom roles/RBAC** — defer until demanded; PAT scopes designed
+  forward-compatible now.
+
+## 9. Phase H — Migration & ecosystem
+
+- [ ] **Railway migrator** — `containr migrate railway --token --project
+  --dry-run`: Railway GraphQL → services/vars/domains → recreate via
+  PAT. Landing-page pitch: "off Railway in one command."
+- [ ] **dflow importer** — `containr migrate dflow` via Payload REST
+  export or Mongo dump: servers→nodes, projects, services(+vars/
+  domains/volumes), databases, templates. Onboards dflow refugees.
+- [ ] **`containr import compose`** — Phase-E parser straight to a
+  project (no template intermediate).
+- [ ] **Template registry** — optional `CONTAINR_TEMPLATE_REGISTRY_URL`
+  fetch/publish; bundled catalog works offline (dflow's self-contained
+  principle — nothing phones home).
+
+## 10. Carried-over debt (ROADMAP.md items still open)
+
+- [ ] **Gateway traffic path** — mount `/g/:slug/*` → key → rate-limit →
+  `gateway/proxy.go` → metrics. Management API exists; proxy unwired.
+- [ ] **Preview environments runtime** — real build+deploy+subdomain+TTL
+  (bookkeeping only now). Pairs with clone + multi-domain.
+- [ ] **Environments** — env switcher, per-env vars/domains, promote.
+- [ ] **sqlc port** — ~140 raw `database/sql` sites → `sqlc/queries/`.
+- [ ] **Tests** — canvas/wizard frontend coverage, deployment/template/
+  webhook table tests, Playwright e2e golden path.
+- [ ] **First-run wizard** — admin → GitHub App (manifest flow from
+  Phase G makes this self-serve) → Tunnel → done.
+- [ ] **Self-upgrade loop verification**, docs freshness, v1.0.0 release.
+
+## 11. Deliberately not imported from dflow
+
+- Dokku-over-SSH runtime — our Docker API + agent model is strictly
+  better.
+- Per-server-named BullMQ queues — our queue stays a single ordered
+  table.
+- Payload/Mongo/Next.js stack, multi-tenant plugin machinery.
+- Ansible playbook runner — arbitrary code-on-node is a security
+  surface; SSH bootstrap + agent commands cover the real needs.
+  Revisit only with a concrete demand.
+- `isAdmin`-only collection access — our owner/admin/public model is
+  richer already.
+- Netdata install flow — our agent telemetry + optional Beszel covers
+  monitoring; don't ship a third dashboard stack.
+
+## 12. Recommended order
+
+```
+A (agent surface) ──► B (deploy pipeline) ──► C/D (service+data depth)
+      │                                              │
+      ▼                                              ▼
+ CLI/MCP dogfood every feature              E (templates v2)
+                                                    │
+                                             F (nodes/infra) ──► H (migrators)
+                                                    │
+                                             G (polish) + debt
+```
+
+Why this order: PATs+CLI+MCP first = every later feature ships
+user-and-agent-visible at once. The queue (B) is prerequisite for
+the ops surface and correct concurrency. Templates v2 needs volumes,
+multi-domain, clone. Migrators last — they're launch marketing, not
+foundation.
+
+## 13. Design rules
+
+- **API is the contract.** UI, CLI, MCP are thin clients over
+  `openapi.yaml`. A feature isn't done until all three reach it.
+- **Everything scriptable.** JSON in/out, `--json`/`--yes`, uniform
+  pagination, name-or-id addressing.
+- **Same powers, same position.** Nothing user-facing that isn't
+  API-facing; agent-visible state (tokens, jobs) visible to users too.
+- **dflow is a donor, not a dependency.** Port semantics, not code.
+- **Containr branding is the default**; white-label is instance config.
+- **Self-hosted first** — no required external service, no phone-home.

app/backend/README_BACKEND.md

@@ -5,7 +5,7 @@
 ### Prerequisites
 - Go 1.21+
 - PostgreSQL 12+
-- Redis (optional)
+- Dragonfly (Redis-compatible cache)
 
 ### Environment Variables
 

app/backend/auth/src/auth.js

@@ -46,10 +46,15 @@ const database = new PostgresDialect({
   pool,
 });
 
-const githubClientId = env.GITHUB_CLIENT_ID?.trim() || '';
-const githubClientSecret = env.GITHUB_CLIENT_SECRET?.trim() || '';
-const googleClientId = env.GOOGLE_CLIENT_ID?.trim() || '';
-const googleClientSecret = env.GOOGLE_CLIENT_SECRET?.trim() || '';
+const realCredential = (value) => {
+  const trimmed = (value || '').trim();
+  return trimmed && !trimmed.startsWith('PLACEHOLDER_') ? trimmed : '';
+};
+
+const githubClientId = realCredential(env.GITHUB_CLIENT_ID);
+const githubClientSecret = realCredential(env.GITHUB_CLIENT_SECRET);
+const googleClientId = realCredential(env.GOOGLE_CLIENT_ID);
+const googleClientSecret = realCredential(env.GOOGLE_CLIENT_SECRET);
 
 const socialProviders = {};
 if (githubClientId && githubClientSecret) {
@@ -67,7 +72,7 @@ if (googleClientId && googleClientSecret) {
   };
 }
 
-const trustedOrigins = [
+const staticTrustedOrigins = [
   ...splitCsv(env.BETTER_AUTH_TRUSTED_ORIGINS),
   env.FRONTEND_URL,
   env.BACKEND_URL,
@@ -86,12 +91,33 @@ const trustedOrigins = [
   .map((origin) => (origin || '').trim())
   .filter(Boolean);
 
+// Self-hosted installs are reached over arbitrary hosts/IPs, so the static
+// list above cannot cover them. Trust an Origin only when it matches the
+// request's own Host header - that is genuine same-origin traffic (browsers
+// cannot forge either header cross-origin). Do NOT consult x-forwarded-host
+// here: clients can set it freely.
+const resolveTrustedOrigins = (request) => {
+  const origins = new Set(staticTrustedOrigins);
+  const host = request?.headers?.get('host');
+  const origin = request?.headers?.get('origin');
+  if (host && origin) {
+    try {
+      if (new URL(origin).host === host) {
+        origins.add(origin);
+      }
+    } catch {
+      // malformed Origin header - leave untrusted
+    }
+  }
+  return [...origins];
+};
+
 export const auth = betterAuth({
   appName: env.BETTER_AUTH_APP_NAME || 'Containr',
   baseURL: env.BETTER_AUTH_URL || defaultBackendURL,
   basePath: '/api/auth',
   secret: env.BETTER_AUTH_SECRET || 'PLACEHOLDER_BETTER_AUTH_SECRET_CHANGE_ME_32CHARS_MIN',
-  trustedOrigins,
+  trustedOrigins: resolveTrustedOrigins,
   database,
   user: {
     modelName: 'auth_users',

app/backend/cmd/cli/main.go

@@ -6,9 +6,14 @@ import (
 	"os"
 )
 
+// Injected at build time via -ldflags (see scripts/build-cli.sh).
+var (
+	Version   = "dev"
+	BuildTime = "unknown"
+	GitCommit = "unknown"
+)
+
 func main() {
-	if err := cli.Run(); err != nil {
-		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
-		os.Exit(1)
-	}
+	cli.SetVersion(fmt.Sprintf("%s (%s, %s)", Version, GitCommit, BuildTime))
+	os.Exit(cli.Execute())
 }

app/backend/cmd/dumptemplates/main.go

@@ -0,0 +1,24 @@
+// dumptemplates prints the seeded official template catalog as JSON in the same
+// shape as GET /api/v1/templates. The landing site (site/templates.json) uses it
+// as the offline fallback catalog: `go run ./cmd/dumptemplates > ../../site/templates.json`.
+package main
+
+import (
+	"containr/internal/api"
+	"encoding/json"
+	"fmt"
+	"os"
+)
+
+func main() {
+	out := struct {
+		Templates []api.ServiceTemplate `json:"templates"`
+	}{Templates: api.SeedTemplates()}
+
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(out); err != nil {
+		fmt.Fprintln(os.Stderr, "encode:", err)
+		os.Exit(1)
+	}
+}

app/backend/cmd/mcp/main.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+
+	"containr/internal/mcpserver"
+)
+
+// Injected at build time via -ldflags.
+var Version = "dev"
+
+// containr-mcp exposes the whole Containr API as MCP tools over stdio.
+// Configure it in an MCP client with:
+//
+//	command: containr-mcp
+//	env: CONTAINR_API_URL, CONTAINR_TOKEN (a cnp_ personal access token)
+func main() {
+	apiURL := os.Getenv("CONTAINR_API_URL")
+	if apiURL == "" {
+		apiURL = "http://localhost:8080/api/v1"
+	}
+	apiURL = strings.TrimSuffix(apiURL, "/")
+	if !strings.HasSuffix(apiURL, "/api/v1") {
+		apiURL += "/api/v1"
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+
+	if err := mcpserver.Run(ctx, apiURL, os.Getenv("CONTAINR_TOKEN"), Version); err != nil {
+		fmt.Fprintf(os.Stderr, "containr-mcp: %v\n", err)
+		os.Exit(1)
+	}
+}

app/backend/cmd/server/main.go

@@ -86,9 +86,15 @@ func main() {
 		}()
 	}
 
+	// Provision the platform owner account (idempotent, non-fatal).
+	api.EnsureAdminAccount(context.Background(), db, cfg)
+
 	// Setup Gin router
 	if cfg.IsProduction() {
 		gin.SetMode(gin.ReleaseMode)
+		if !cfg.CookieSecure {
+			log.Println("Warning: COOKIE_SECURE=false in production - session cookies are sent over plain HTTP. Enable TLS and set COOKIE_SECURE=true.")
+		}
 	}
 
 	router := gin.New()

app/backend/docker-compose.yml

@@ -14,15 +14,15 @@ services:
       retries: 10
     restart: unless-stopped
 
-  redis:
-    image: redis:7-alpine
+  dragonfly:
+    image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
     env_file:
       - ../../.env.prod
-    command: ["sh", "-c", "redis-server --requirepass \"$$REDIS_PASSWORD\""]
+    command: ["sh", "-c", "exec dragonfly --requirepass \"$${REDIS_PASSWORD}\" --proactor_threads=1 --maxmemory=256mb --dir=/data"]
     ports:
       - "6379:6379"
     volumes:
-      - backend_redis_data:/data
+      - backend_dragonfly_data:/data
     healthcheck:
       test: ["CMD-SHELL", "redis-cli -a \"$${REDIS_PASSWORD}\" ping | grep PONG"]
       interval: 10s
@@ -38,10 +38,14 @@ services:
       - ../../.env.prod
     ports:
       - "8080:8080"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    group_add:
+      - "${DOCKER_GID:-0}"
     depends_on:
       postgres:
         condition: service_healthy
-      redis:
+      dragonfly:
         condition: service_healthy
     restart: unless-stopped
     healthcheck:
@@ -52,4 +56,4 @@ services:
 
 volumes:
   backend_postgres_data:
-  backend_redis_data:
+  backend_dragonfly_data:

app/backend/go.mod

@@ -8,11 +8,12 @@ require (
 	github.com/gin-gonic/gin v1.9.1
 	github.com/go-playground/validator/v10 v10.30.1
 	github.com/go-redis/redis/v8 v8.11.5
-	github.com/golang-jwt/jwt/v5 v5.2.2
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.3
 	github.com/lib/pq v1.10.9
 	github.com/miekg/dns v1.1.72
+	github.com/modelcontextprotocol/go-sdk v1.7.0
 	github.com/pressly/goose/v3 v3.24.1
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/rs/cors v1.10.1
@@ -21,6 +22,7 @@ require (
 	github.com/sqlc-dev/pqtype v0.3.0
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/crypto v0.57.0
+	golang.org/x/term v0.46.0
 )
 
 require (
@@ -45,6 +47,7 @@ require (
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/google/jsonschema-go v0.4.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.4 // indirect
@@ -63,6 +66,8 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
+	github.com/segmentio/encoding v0.5.4 // indirect
 	github.com/sethvargo/go-retry v0.3.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
@@ -71,6 +76,7 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.11 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
 	go.opentelemetry.io/otel v1.41.0 // indirect
@@ -84,10 +90,11 @@ require (
 	golang.org/x/arch v0.3.0 // indirect
 	golang.org/x/mod v0.41.0 // indirect
 	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
 	golang.org/x/sync v0.23.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.42.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.49.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect

app/backend/go.sum

@@ -65,11 +65,13 @@ github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9L
 github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
-github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
-github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0=
+github.com/google/jsonschema-go v0.4.3/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
@@ -105,6 +107,8 @@ github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7z
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
+github.com/modelcontextprotocol/go-sdk v1.7.0 h1:yqjY2dsbKAC0LSuWZVBMrHgiG8ukXv6NRo0JiALay44=
+github.com/modelcontextprotocol/go-sdk v1.7.0/go.mod h1:dL7u98E/zjJTGzEq+j30jQ8K2k1mb6LeAH4inEcSGts=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -143,6 +147,10 @@ github.com/rs/cors v1.10.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc=
 github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik=
+github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
+github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
+github.com/segmentio/encoding v0.5.4 h1:OW1VRern8Nw6ITAtwSZ7Idrl3MXCFwXHPgqESYfvNt0=
+github.com/segmentio/encoding v0.5.4/go.mod h1:HS1ZKa3kSN32ZHVZ7ZLPLXWvOVIiZtyJnO1gPH1sKt0=
 github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
 github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
@@ -178,6 +186,8 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.2.11 h1:BMaWp1Bb6fHwEtbplGBGJ498wD+LKlNSl25MjdZY4dU=
 github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
@@ -213,16 +223,20 @@ golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
 golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
 golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
 golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20220704084225-05e143d24a9e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
 golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
 golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
-golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
-golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
 golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M=

app/backend/internal/api/admin.go

@@ -0,0 +1,295 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"containr/internal/config"
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// ---------------------------------------------------------------------------
+// Admin account bootstrap
+// ---------------------------------------------------------------------------
+
+// EnsureAdminAccount provisions the platform owner account from
+// ADMIN_EMAIL/ADMIN_PASSWORD (optional ADMIN_NAME). It is idempotent: existing
+// users are simply promoted to admin. Both the local users row (legacy JWT
+// login) and the Better Auth account (cookie sessions) are created so either
+// sign-in path works. Failures are logged, never fatal — the platform must
+// boot even when auth is misconfigured.
+func EnsureAdminAccount(ctx context.Context, db *database.DB, cfg *config.Config) {
+	email := strings.ToLower(strings.TrimSpace(cfg.AdminEmail))
+	password := cfg.AdminPassword
+	if email == "" || password == "" {
+		return
+	}
+	if db == nil || db.DB == nil {
+		log.Println("Admin bootstrap skipped: database unavailable")
+		return
+	}
+	name := strings.TrimSpace(cfg.AdminName)
+	if name == "" {
+		name = "Platform Admin"
+	}
+
+	// Local users row (owns resources, is_admin flag, legacy login hash).
+	hashed, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		log.Printf("Admin bootstrap failed: %v", err)
+		return
+	}
+
+	var userID string
+	err = db.QueryRowContext(ctx, `
+		INSERT INTO users (email, password_hash, name, is_admin)
+		VALUES ($1, $2, $3, true)
+		ON CONFLICT (email) DO UPDATE
+		SET is_admin = true, updated_at = NOW()
+		RETURNING id
+	`, email, string(hashed), name).Scan(&userID)
+	if err != nil {
+		log.Printf("Admin bootstrap failed to upsert user %s: %v", email, err)
+		return
+	}
+
+	// Better Auth account (cookie-session sign-in). Duplicate sign-up returns
+	// an error which we treat as "already provisioned".
+	if err := ensureBetterAuthUser(ctx, name, email, password); err != nil {
+		if errors.Is(err, errBetterAuthUserExists) {
+			log.Printf("Admin account %s already exists in auth service; ensured admin flag", email)
+		} else {
+			log.Printf("Warning: admin bootstrap could not create auth user for %s: %v", email, err)
+		}
+		return
+	}
+	log.Printf("Admin account provisioned: %s", email)
+}
+
+// ensureBetterAuthUser calls the Better Auth sign-up endpoint directly. Unlike
+// createBetterAuthUser it runs outside a request context.
+func ensureBetterAuthUser(ctx context.Context, name, email, password string) error {
+	endpoint, err := betterAuthSignUpURL()
+	if err != nil {
+		return err
+	}
+
+	body, err := json.Marshal(gin.H{"name": name, "email": email, "password": password})
+	if err != nil {
+		return err
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	request.Header.Set("Content-Type", "application/json")
+	request.Header.Set("Accept", "application/json")
+	if token := strings.TrimSpace(os.Getenv("BETTER_AUTH_INTERNAL_TOKEN")); token != "" {
+		request.Header.Set("X-Containr-Auth-Internal", token)
+	}
+
+	response, err := (&http.Client{Timeout: 10 * time.Second}).Do(request)
+	if err != nil {
+		return err
+	}
+	defer response.Body.Close()
+
+	if response.StatusCode >= http.StatusOK && response.StatusCode < http.StatusMultipleChoices {
+		return nil
+	}
+
+	var payload map[string]interface{}
+	_ = json.NewDecoder(response.Body).Decode(&payload)
+	message := ""
+	if raw, ok := payload["message"].(string); ok {
+		message = strings.ToLower(raw)
+	} else if raw, ok := payload["error"].(string); ok {
+		message = strings.ToLower(raw)
+	}
+	if strings.Contains(message, "exist") || strings.Contains(message, "already") {
+		return errBetterAuthUserExists
+	}
+	if message == "" {
+		message = http.StatusText(response.StatusCode)
+	}
+	return errors.New(message)
+}
+
+// ---------------------------------------------------------------------------
+// Admin API
+// ---------------------------------------------------------------------------
+
+type adminUserRow struct {
+	ID        string `json:"id"`
+	Email     string `json:"email"`
+	Name      string `json:"name"`
+	AvatarURL string `json:"avatar_url"`
+	IsAdmin   bool   `json:"is_admin"`
+	CreatedAt string `json:"created_at"`
+}
+
+func handleAdminOverview(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+	ctx := c.Request.Context()
+
+	count := func(query string) int {
+		var n int
+		if err := db.QueryRowContext(ctx, query).Scan(&n); err != nil {
+			return 0
+		}
+		return n
+	}
+
+	pendingRows, err := queries.ListPendingProjects(ctx)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list pending projects"})
+		return
+	}
+	pending := make([]Project, 0, len(pendingRows))
+	for _, row := range pendingRows {
+		pending = append(pending, mapSQLCProject(row))
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"stats": gin.H{
+			"users":             count(`SELECT COUNT(*) FROM users`),
+			"projects":          count(`SELECT COUNT(*) FROM projects`),
+			"pending_projects":  count(`SELECT COUNT(*) FROM projects WHERE is_approved = false`),
+			"services":          count(`SELECT COUNT(*) FROM services`),
+			"running_services":  count(`SELECT COUNT(*) FROM services WHERE status = 'running'`),
+			"databases":         count(`SELECT COUNT(*) FROM database_services`),
+			"agents":            count(`SELECT COUNT(*) FROM node_agents`),
+			"templates":         count(`SELECT COUNT(*) FROM service_templates`),
+			"user_templates":    count(`SELECT COUNT(*) FROM service_templates WHERE is_official = false`),
+			"cron_jobs":         count(`SELECT COUNT(*) FROM cron_jobs`),
+			"deployments_total": count(`SELECT COUNT(*) FROM deployments`),
+		},
+		"pending_projects": pending,
+	})
+}
+
+func handleAdminListUsers(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+
+	rows, err := db.QueryContext(c.Request.Context(), `
+		SELECT id, email, name, COALESCE(avatar_url, ''), is_admin, COALESCE(to_char(created_at, 'YYYY-MM-DD"T"HH24:MI:SS"Z"'), '')
+		FROM users
+		ORDER BY created_at ASC
+	`)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list users"})
+		return
+	}
+	defer rows.Close()
+
+	users := make([]adminUserRow, 0)
+	for rows.Next() {
+		var u adminUserRow
+		if err := rows.Scan(&u.ID, &u.Email, &u.Name, &u.AvatarURL, &u.IsAdmin, &u.CreatedAt); err != nil {
+			continue
+		}
+		users = append(users, u)
+	}
+	c.JSON(http.StatusOK, gin.H{"users": users})
+}
+
+func handleAdminSetUserAdmin(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	targetID := strings.TrimSpace(c.Param("id"))
+	if _, err := uuid.Parse(targetID); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid user ID"})
+		return
+	}
+
+	var req struct {
+		IsAdmin bool `json:"is_admin"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	callerID := optionalUserID(c)
+	if callerID == targetID && !req.IsAdmin {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Cannot revoke your own admin access"})
+		return
+	}
+
+	result, err := db.ExecContext(c.Request.Context(),
+		`UPDATE users SET is_admin = $1, updated_at = NOW() WHERE id = $2`,
+		req.IsAdmin, targetID,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update user"})
+		return
+	}
+	if n, _ := result.RowsAffected(); n == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})
+		return
+	}
+
+	LogAudit(callerID, "user", targetID, "set_admin", map[string]interface{}{"is_admin": req.IsAdmin})
+	c.JSON(http.StatusOK, gin.H{"message": "User updated"})
+}
+
+func handleAdminSetProjectApproval(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	projectID, ok := parseProjectIDParam(c)
+	if !ok {
+		return
+	}
+
+	var req struct {
+		IsApproved bool `json:"is_approved"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	rows, err := queries.SetProjectApproved(c.Request.Context(), sqlcdb.SetProjectApprovedParams{
+		IsApproved: req.IsApproved,
+		ProjectID:  projectID,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update project"})
+		return
+	}
+	if rows == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+		return
+	}
+
+	action := "unapprove"
+	if req.IsApproved {
+		action = "approve"
+	}
+	LogAudit(optionalUserID(c), "project", projectID.String(), action, nil)
+
+	row, err := queries.GetProjectByIDForUser(c.Request.Context(), sqlcdb.GetProjectByIDForUserParams{
+		ProjectID: projectID,
+		UserID:    optionalUserUUID(c),
+		IsAdmin:   true,
+	})
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{"message": "Project updated"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"project": mapSQLCProject(row)})
+}

app/backend/internal/api/agents.go

@@ -1217,8 +1217,10 @@ func (h *NodeAgentHandler) SetupPublicRoutes(router *gin.RouterGroup) {
 	}
 }
 
-// SetupRoutes registers authenticated dashboard/control agent routes.
-func (h *NodeAgentHandler) SetupRoutes(router *gin.RouterGroup) {
+// SetupAdminRoutes registers dashboard/control agent routes. Command
+// history and container details can leak sensitive output, so these stay
+// admin-only rather than joining the public read group.
+func (h *NodeAgentHandler) SetupAdminRoutes(router *gin.RouterGroup) {
 	tokens := router.Group("/agent-tokens")
 	{
 		tokens.POST("", h.CreateAgentToken)

app/backend/internal/api/auth.go

@@ -46,6 +46,7 @@ type User struct {
 	Email     string `json:"email"`
 	Name      string `json:"name"`
 	AvatarURL string `json:"avatar_url,omitempty"`
+	IsAdmin   bool   `json:"is_admin"`
 	CreatedAt string `json:"created_at"`
 }
 
@@ -63,10 +64,10 @@ func handleLogin(c *gin.Context) {
 	var user User
 	var hashedPassword string
 	err := db.QueryRow(`
-		SELECT id, email, password_hash, name, COALESCE(avatar_url, ''), created_at 
-		FROM users 
+		SELECT id, email, password_hash, name, COALESCE(avatar_url, ''), is_admin, created_at
+		FROM users
 		WHERE email = $1
-	`, req.Email).Scan(&user.ID, &user.Email, &hashedPassword, &user.Name, &user.AvatarURL, &user.CreatedAt)
+	`, req.Email).Scan(&user.ID, &user.Email, &hashedPassword, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
 
 	if err == sql.ErrNoRows {
 		authUser, ok := verifyBetterAuthCredentials(c, req.Email, req.Password)
@@ -120,13 +121,32 @@ func handleAuthBootstrap(c *gin.Context) {
 		mode = "register"
 	}
 
+	providers := []string{}
+	for _, provider := range []string{"GITHUB", "GOOGLE"} {
+		if oauthProviderConfigured(provider) {
+			providers = append(providers, strings.ToLower(provider))
+		}
+	}
+
 	c.JSON(http.StatusOK, gin.H{
-		"has_users":  count > 0,
-		"user_count": count,
-		"mode":       mode,
+		"has_users":      count > 0,
+		"user_count":     count,
+		"mode":           mode,
+		"providers":      providers,
+		"signup_enabled": signupEnabled(db),
 	})
 }
 
+// oauthProviderConfigured reports whether an OAuth provider has real
+// credentials. Placeholder values from .env.example do not count, so
+// self-hosted installs default to email/password only.
+func oauthProviderConfigured(provider string) bool {
+	id := strings.TrimSpace(os.Getenv(provider + "_CLIENT_ID"))
+	secret := strings.TrimSpace(os.Getenv(provider + "_CLIENT_SECRET"))
+	return id != "" && secret != "" &&
+		!strings.HasPrefix(id, "PLACEHOLDER_") && !strings.HasPrefix(secret, "PLACEHOLDER_")
+}
+
 type betterAuthLoginUser struct {
 	ID    string `json:"id"`
 	Email string `json:"email"`
@@ -236,17 +256,23 @@ func createLocalUserFromBetterAuth(db *database.DB, authUser betterAuthLoginUser
 		return User{}, err
 	}
 
+	// A mirrored first account owns the platform, same as handleRegister.
+	var total int
+	if err := db.QueryRow("SELECT COUNT(*) FROM users").Scan(&total); err != nil {
+		return User{}, err
+	}
+
 	var user User
 	err = db.QueryRow(`
-		INSERT INTO users (email, password_hash, name, avatar_url)
-		VALUES ($1, $2, $3, NULLIF($4, ''))
+		INSERT INTO users (email, password_hash, name, avatar_url, is_admin)
+		VALUES ($1, $2, $3, NULLIF($4, ''), $5)
 		ON CONFLICT (email) DO UPDATE
 		SET name = EXCLUDED.name,
 		    avatar_url = COALESCE(EXCLUDED.avatar_url, users.avatar_url),
 		    updated_at = NOW()
-		RETURNING id, email, name, COALESCE(avatar_url, ''), created_at
-	`, email, string(hashedPassword), name, strings.TrimSpace(authUser.Image)).
-		Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
+	`, email, string(hashedPassword), name, strings.TrimSpace(authUser.Image), total == 0).
+		Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
 	if err != nil {
 		return User{}, err
 	}
@@ -264,24 +290,26 @@ func handleRegister(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
 	jwtSecret := c.MustGet("jwt_secret").(string)
 
-	count, err := countLocalUsers(db)
+	total, err := countLocalUsers(db)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
 
-	if count > 0 {
+	// Closed once the first account exists unless the owner reopens registration.
+	if total > 0 && !signupEnabled(db) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Public registration is disabled after bootstrap"})
 		return
 	}
 
-	err = db.QueryRow("SELECT COUNT(*) FROM users WHERE email = $1", strings.ToLower(strings.TrimSpace(req.Email))).Scan(&count)
+	var existing int
+	err = db.QueryRow("SELECT COUNT(*) FROM users WHERE email = $1", strings.ToLower(strings.TrimSpace(req.Email))).Scan(&existing)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database error"})
 		return
 	}
 
-	if count > 0 {
+	if existing > 0 {
 		c.JSON(http.StatusConflict, gin.H{"error": "User already exists"})
 		return
 	}
@@ -293,13 +321,13 @@ func handleRegister(c *gin.Context) {
 		return
 	}
 
-	// Create user
+	// First account owns the platform.
 	var user User
 	err = db.QueryRow(`
-		INSERT INTO users (email, password_hash, name) 
-		VALUES ($1, $2, $3) 
-		RETURNING id, email, name, COALESCE(avatar_url, ''), created_at
-	`, req.Email, string(hashedPassword), req.Name).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+		INSERT INTO users (email, password_hash, name, is_admin)
+		VALUES ($1, $2, $3, $4)
+		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
+	`, req.Email, string(hashedPassword), req.Name, total == 0).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create user"})
@@ -320,13 +348,16 @@ func handleRegister(c *gin.Context) {
 }
 
 func handleCreateUser(c *gin.Context) {
+	db, ok := requireAdmin(c)
+	if !ok {
+		return
+	}
+
 	var req ManualUserCreateRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return
 	}
-
-	db := c.MustGet("db").(*database.DB)
 	req.Email = strings.ToLower(strings.TrimSpace(req.Email))
 	req.Name = strings.TrimSpace(req.Name)
 	if req.Email == "" || req.Name == "" {
@@ -363,8 +394,8 @@ func handleCreateUser(c *gin.Context) {
 	err = db.QueryRow(`
 		INSERT INTO users (email, password_hash, name)
 		VALUES ($1, $2, $3)
-		RETURNING id, email, name, COALESCE(avatar_url, ''), created_at
-	`, req.Email, string(hashedPassword), req.Name).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+		RETURNING id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
+	`, req.Email, string(hashedPassword), req.Name).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
 	if err != nil {
 		c.JSON(http.StatusConflict, gin.H{"error": "User already exists"})
 		return
@@ -459,10 +490,10 @@ func handleGetProfile(c *gin.Context) {
 
 	var user User
 	err := db.QueryRow(`
-		SELECT id, email, name, COALESCE(avatar_url, ''), created_at 
-		FROM users 
+		SELECT id, email, name, COALESCE(avatar_url, ''), is_admin, created_at
+		FROM users
 		WHERE id = $1
-	`, userID).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.CreatedAt)
+	`, userID).Scan(&user.ID, &user.Email, &user.Name, &user.AvatarURL, &user.IsAdmin, &user.CreatedAt)
 
 	if err == sql.ErrNoRows {
 		c.JSON(http.StatusNotFound, gin.H{"error": "User not found"})

app/backend/internal/api/auth_proxy.go

@@ -67,7 +67,9 @@ func shouldBlockPublicBetterAuthSignup(c *gin.Context, cfg *config.Config, db *d
 		return true
 	}
 
-	return count > 0
+	// Registration is closed once the first account exists unless the owner
+	// reopens it in Settings (signup_enabled).
+	return count > 0 && !signupEnabled(db)
 }
 
 func parseAuthProxyTarget(rawTarget string) (*url.URL, error) {

app/backend/internal/api/context_user.go

@@ -3,7 +3,10 @@ package api
 import (
 	"net/http"
 
+	"containr/internal/database"
+
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 )
 
 func requireAuthenticatedUserID(c *gin.Context) (string, bool) {
@@ -21,3 +24,107 @@ func requireAuthenticatedUserID(c *gin.Context) (string, bool) {
 
 	return userID, true
 }
+
+// optionalUserID returns the resolved user id or "" for anonymous callers on
+// OptionalAuth routes. Never writes a response.
+func optionalUserID(c *gin.Context) string {
+	userIDValue, exists := c.Get("user_id")
+	if !exists {
+		return ""
+	}
+	userID, _ := userIDValue.(string)
+	return userID
+}
+
+// optionalUserUUID is the uuid variant of optionalUserID; anonymous callers
+// get uuid.Nil, which matches no owner_id and therefore only sees approved
+// public resources.
+func optionalUserUUID(c *gin.Context) uuid.UUID {
+	userID := optionalUserID(c)
+	parsed, err := uuid.Parse(userID)
+	if err != nil {
+		return uuid.Nil
+	}
+	return parsed
+}
+
+// contextIsAdmin reports whether the resolved caller is a platform admin.
+func contextIsAdmin(c *gin.Context) bool {
+	return c.GetBool("is_admin")
+}
+
+// projectReadAccess reports (exists, allowedToRead). Approved projects are
+// public; unapproved ones are visible to the owner, project members, and
+// platform admins only.
+func projectReadAccess(c *gin.Context, db *database.DB, projectID uuid.UUID) (bool, bool) {
+	var isApproved bool
+	var ownerID string
+	err := db.QueryRow(
+		`SELECT is_approved, owner_id::text FROM projects WHERE id = $1`,
+		projectID,
+	).Scan(&isApproved, &ownerID)
+	if err != nil {
+		return false, false
+	}
+	if isApproved || contextIsAdmin(c) {
+		return true, true
+	}
+	userID := optionalUserID(c)
+	if userID == "" {
+		return true, false
+	}
+	if ownerID == userID {
+		return true, true
+	}
+	var member bool
+	if err := db.QueryRow(
+		`SELECT EXISTS(SELECT 1 FROM project_members WHERE project_id = $1 AND user_id = $2)`,
+		projectID, userID,
+	).Scan(&member); err == nil && member {
+		return true, true
+	}
+	return true, false
+}
+
+// projectManageAccess reports (exists, allowedToOperate). Unlike
+// projectReadAccess, approval does NOT grant access — only the owner,
+// project members, and platform admins may reach secret-adjacent data
+// such as variables and runtime logs.
+func projectManageAccess(c *gin.Context, db *database.DB, projectID uuid.UUID) (bool, bool) {
+	var ownerID string
+	err := db.QueryRow(
+		`SELECT owner_id::text FROM projects WHERE id = $1`,
+		projectID,
+	).Scan(&ownerID)
+	if err != nil {
+		return false, false
+	}
+	if contextIsAdmin(c) {
+		return true, true
+	}
+	userID := optionalUserID(c)
+	if userID == "" {
+		return true, false
+	}
+	if ownerID == userID {
+		return true, true
+	}
+	var member bool
+	if err := db.QueryRow(
+		`SELECT EXISTS(SELECT 1 FROM project_members WHERE project_id = $1 AND user_id = $2)`,
+		projectID, userID,
+	).Scan(&member); err == nil && member {
+		return true, true
+	}
+	return true, false
+}
+
+// serviceProjectID resolves the project that owns a service.
+func serviceProjectID(db *database.DB, serviceID uuid.UUID) (uuid.UUID, bool) {
+	var projectID uuid.UUID
+	err := db.QueryRow(`SELECT project_id FROM services WHERE id = $1`, serviceID).Scan(&projectID)
+	if err != nil {
+		return uuid.Nil, false
+	}
+	return projectID, true
+}

app/backend/internal/api/cron.go

@@ -65,19 +65,34 @@ type UpdateCronJobRequest struct {
 	Retention int    `json:"retention"`
 }
 
+// cronJobProjectID resolves the project a cron job belongs to.
+func cronJobProjectID(db *database.DB, jobID string) (uuid.UUID, bool) {
+	var projectID uuid.UUID
+	err := db.QueryRow(
+		`SELECT cj.project_id FROM cron_jobs cj WHERE cj.id = $1`,
+		jobID,
+	).Scan(&projectID)
+	if err != nil {
+		return uuid.Nil, false
+	}
+	return projectID, true
+}
+
 func handleGetCronJobs(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
-	userID := c.MustGet("user_id").(string)
+	userID := optionalUserUUID(c)
+	isAdmin := contextIsAdmin(c)
 	projectID := c.Query("project_id")
 	serviceID := c.Query("service_id")
 
-	query := `SELECT cj.id, cj.project_id, cj.service_id, cj.name, cj.schedule, cj.timezone, 
-	          cj.enabled, cj.last_run_at, cj.next_run_at, cj.last_status, cj.last_output, 
+	query := `SELECT cj.id, cj.project_id, cj.service_id, cj.name, cj.schedule, cj.timezone,
+	          cj.enabled, cj.last_run_at, cj.next_run_at, cj.last_status, cj.last_output,
 	          cj.retention, cj.created_at, cj.updated_at
 	          FROM cron_jobs cj
 	          JOIN projects p ON cj.project_id = p.id
-	          WHERE p.owner_id = $1`
-	args := []interface{}{userID}
+	          WHERE (p.is_approved OR p.owner_id = $1 OR $2::bool
+	              OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1))`
+	args := []interface{}{userID, isAdmin}
 
 	if projectID != "" {
 		args = append(args, projectID)
@@ -130,7 +145,7 @@ func handleCreateCronJob(c *gin.Context) {
 		req.ServiceID,
 	).Scan(&ownerCheck)
 
-	if err != nil || ownerCheck != userID {
+	if err != nil || (ownerCheck != userID && !contextIsAdmin(c)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -184,30 +199,32 @@ func handleCreateCronJob(c *gin.Context) {
 
 func handleGetCronJob(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
-	userID := c.MustGet("user_id").(string)
 	jobID := c.Param("id")
 
 	var job CronJob
-	var ownerCheck string
 	err := db.QueryRow(
-		`SELECT cj.id, cj.project_id, cj.service_id, cj.name, cj.schedule, cj.timezone, 
-		        cj.enabled, cj.last_run_at, cj.next_run_at, cj.last_status, cj.last_output, 
-		        cj.retention, cj.created_at, cj.updated_at, p.owner_id
+		`SELECT cj.id, cj.project_id, cj.service_id, cj.name, cj.schedule, cj.timezone,
+		        cj.enabled, cj.last_run_at, cj.next_run_at, cj.last_status, cj.last_output,
+		        cj.retention, cj.created_at, cj.updated_at
 		 FROM cron_jobs cj
-		 JOIN projects p ON cj.project_id = p.id
 		 WHERE cj.id = $1`,
 		jobID,
 	).Scan(&job.ID, &job.ProjectID, &job.ServiceID, &job.Name, &job.Schedule, &job.Timezone,
 		&job.Enabled, &job.LastRunAt, &job.NextRunAt, &job.LastStatus, &job.LastOutput,
-		&job.Retention, &job.CreatedAt, &job.UpdatedAt, &ownerCheck)
+		&job.Retention, &job.CreatedAt, &job.UpdatedAt)
 
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Cron job not found"})
 		return
 	}
 
-	if ownerCheck != userID {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+	projectID, found := cronJobProjectID(db, jobID)
+	if !found {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Cron job not found"})
+		return
+	}
+	if _, allowed := projectReadAccess(c, db, projectID); !allowed {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Cron job not found"})
 		return
 	}
 
@@ -233,7 +250,7 @@ func handleUpdateCronJob(c *gin.Context) {
 		jobID,
 	).Scan(&ownerCheck)
 
-	if err != nil || ownerCheck != userID {
+	if err != nil || (ownerCheck != userID && !contextIsAdmin(c)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -303,7 +320,7 @@ func handleDeleteCronJob(c *gin.Context) {
 		jobID,
 	).Scan(&ownerCheck)
 
-	if err != nil || ownerCheck != userID {
+	if err != nil || (ownerCheck != userID && !contextIsAdmin(c)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -321,19 +338,15 @@ func handleDeleteCronJob(c *gin.Context) {
 
 func handleGetCronExecutions(c *gin.Context) {
 	db := c.MustGet("db").(*database.DB)
-	userID := c.MustGet("user_id").(string)
 	jobID := c.Param("id")
 
-	var ownerCheck string
-	err := db.QueryRow(
-		`SELECT p.owner_id FROM cron_jobs cj
-		 JOIN projects p ON cj.project_id = p.id
-		 WHERE cj.id = $1`,
-		jobID,
-	).Scan(&ownerCheck)
-
-	if err != nil || ownerCheck != userID {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+	projectID, found := cronJobProjectID(db, jobID)
+	if !found {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Cron job not found"})
+		return
+	}
+	if _, allowed := projectReadAccess(c, db, projectID); !allowed {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Cron job not found"})
 		return
 	}
 
@@ -380,7 +393,7 @@ func handleTriggerCronJob(c *gin.Context) {
 		jobID,
 	).Scan(&job.ServiceID, &job.Command, &job.Schedule, &job.Timezone, &job.Retention, &ownerCheck)
 
-	if err != nil || ownerCheck != userID {
+	if err != nil || (ownerCheck != userID && !contextIsAdmin(c)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}

app/backend/internal/api/databases.go

@@ -23,6 +23,7 @@ import (
 
 	dockercontainer "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/registry"
 	"github.com/docker/go-connections/nat"
 	"github.com/gin-gonic/gin"
@@ -41,6 +42,7 @@ const (
 // DatabaseService represents a managed database service
 type DatabaseService struct {
 	ID             string               `json:"id" db:"id"`
+	OwnerID        string               `json:"-" db:"user_id"`
 	Name           string               `json:"name" db:"name"`
 	Type           string               `json:"type" db:"type"`     // postgresql, redis, mysql, mariadb, mongodb, clickhouse, dragonfly
 	Status         string               `json:"status" db:"status"` // running, stopped, building, error
@@ -168,13 +170,14 @@ func NewDatabaseHandler(db *sql.DB, dockerClient *docker.Client) *DatabaseHandle
 	}
 }
 
-// GetDatabases returns all database services for a user
+// GetDatabases returns database services. The platform is public-read: every
+// caller sees the fleet, but connection URLs (which may embed credentials)
+// are only exposed to admins.
 func (h *DatabaseHandler) GetDatabases(c *gin.Context) {
-	userID, ok := requireAuthenticatedUserID(c)
-	if !ok {
-		return
-	}
-	rows, err := h.queries.ListDatabaseServicesByUser(c.Request.Context(), userID)
+	userID := optionalUserID(c)
+	isAdmin := contextIsAdmin(c)
+
+	rows, err := h.queries.ListAllDatabaseServices(c.Request.Context())
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch databases"})
 		return
@@ -182,17 +185,23 @@ func (h *DatabaseHandler) GetDatabases(c *gin.Context) {
 
 	databases := make([]DatabaseService, 0, len(rows))
 	for _, row := range rows {
-		db := mapDatabaseServiceListRow(row)
+		db := mapDatabaseServiceRow(row)
 		db = h.reconcileManagedDatabaseState(c.Request.Context(), db)
 
 		db.Metrics = h.resolveDatabaseMetrics(c.Request.Context(), db)
-		if backupConfig, err := h.resolveBackupConfig(c.Request.Context(), userID, db); err == nil {
-			db.Backups = backupConfig
+		privileged := isAdmin || (userID != "" && db.OwnerID == userID)
+		if privileged {
+			if backupConfig, err := h.resolveBackupConfig(c.Request.Context(), db.OwnerID, db); err == nil {
+				db.Backups = backupConfig
+			} else {
+				db.Backups = DatabaseBackupConfig{Backups: []DatabaseBackup{}}
+			}
+			db.Settings = h.generateMockSettings()
+			db.ConnectionURL = rewriteLoopbackURL(h.resolveConnectionURL(db), requestHostname(c))
 		} else {
-			db.Backups = h.generateMockBackupConfig()
+			db.Backups = DatabaseBackupConfig{Backups: []DatabaseBackup{}}
+			db.ConnectionURL = ""
 		}
-		db.Settings = h.generateMockSettings()
-		db.ConnectionURL = h.resolveConnectionURL(db)
 
 		databases = append(databases, db)
 	}
@@ -202,15 +211,11 @@ func (h *DatabaseHandler) GetDatabases(c *gin.Context) {
 
 // GetDatabase returns a specific database service
 func (h *DatabaseHandler) GetDatabase(c *gin.Context) {
-	userID, ok := requireAuthenticatedUserID(c)
-	if !ok {
-		return
-	}
+	userID := optionalUserID(c)
+	isAdmin := contextIsAdmin(c)
+
 	databaseID := c.Param("id")
-	row, err := h.queries.GetDatabaseServiceByIDAndUser(c.Request.Context(), sqlcdb.GetDatabaseServiceByIDAndUserParams{
-		ID:     databaseID,
-		UserID: userID,
-	})
+	row, err := h.queries.GetDatabaseServiceByID(c.Request.Context(), databaseID)
 	if err != nil {
 		if err == sql.ErrNoRows {
 			c.JSON(http.StatusNotFound, gin.H{"error": "Database not found"})
@@ -219,21 +224,40 @@ func (h *DatabaseHandler) GetDatabase(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch database"})
 		return
 	}
-	db := mapDatabaseServiceGetRow(row)
+	db := mapDatabaseServiceRow(row)
 	db = h.reconcileManagedDatabaseState(c.Request.Context(), db)
 
 	db.Metrics = h.resolveDatabaseMetrics(c.Request.Context(), db)
-	if backupConfig, err := h.resolveBackupConfig(c.Request.Context(), userID, db); err == nil {
-		db.Backups = backupConfig
+	privileged := isAdmin || (userID != "" && db.OwnerID == userID)
+	if privileged {
+		if backupConfig, err := h.resolveBackupConfig(c.Request.Context(), db.OwnerID, db); err == nil {
+			db.Backups = backupConfig
+		} else {
+			db.Backups = DatabaseBackupConfig{Backups: []DatabaseBackup{}}
+		}
+		db.Settings = h.generateMockSettings()
+		db.ConnectionURL = rewriteLoopbackURL(h.resolveConnectionURL(db), requestHostname(c))
 	} else {
-		db.Backups = h.generateMockBackupConfig()
+		db.Backups = DatabaseBackupConfig{Backups: []DatabaseBackup{}}
+		db.ConnectionURL = ""
 	}
-	db.Settings = h.generateMockSettings()
-	db.ConnectionURL = h.resolveConnectionURL(db)
 
 	c.JSON(http.StatusOK, db)
 }
 
+// effectiveUserID returns the user scope for row-level queries. Admins act
+// on behalf of the row's owner so management works across accounts.
+func (h *DatabaseHandler) effectiveUserID(c *gin.Context, userID, databaseID string) string {
+	if !contextIsAdmin(c) || databaseID == "" {
+		return userID
+	}
+	owner, err := h.queries.GetDatabaseServiceOwnerID(c.Request.Context(), databaseID)
+	if err == nil && owner != "" {
+		return owner
+	}
+	return userID
+}
+
 // CreateDatabase creates a new database service
 func (h *DatabaseHandler) CreateDatabase(c *gin.Context) {
 	userID, ok := requireAuthenticatedUserID(c)
@@ -357,6 +381,7 @@ func (h *DatabaseHandler) UpdateDatabase(c *gin.Context) {
 		return
 	}
 	databaseID := c.Param("id")
+	userID = h.effectiveUserID(c, userID, databaseID)
 
 	var req DatabaseUpdateRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -440,6 +465,7 @@ func (h *DatabaseHandler) DeleteDatabase(c *gin.Context) {
 		return
 	}
 	databaseID := c.Param("id")
+	userID = h.effectiveUserID(c, userID, databaseID)
 
 	exists, err := h.queries.DatabaseServiceExistsByIDAndUser(c.Request.Context(), sqlcdb.DatabaseServiceExistsByIDAndUserParams{
 		ID:     databaseID,
@@ -481,6 +507,7 @@ func (h *DatabaseHandler) PerformDatabaseAction(c *gin.Context) {
 		return
 	}
 	databaseID := c.Param("id")
+	userID = h.effectiveUserID(c, userID, databaseID)
 
 	var req DatabaseActionRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -574,6 +601,7 @@ func (h *DatabaseHandler) CreateBackup(c *gin.Context) {
 		return
 	}
 	databaseID := c.Param("id")
+	userID = h.effectiveUserID(c, userID, databaseID)
 
 	row, err := h.queries.GetDatabaseServiceByIDAndUser(c.Request.Context(), sqlcdb.GetDatabaseServiceByIDAndUserParams{
 		ID:     databaseID,
@@ -623,6 +651,7 @@ func (h *DatabaseHandler) RestoreBackup(c *gin.Context) {
 		return
 	}
 	databaseID := c.Param("id")
+	userID = h.effectiveUserID(c, userID, databaseID)
 
 	var req DatabaseRestoreRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -684,6 +713,7 @@ func (h *DatabaseHandler) DownloadBackup(c *gin.Context) {
 		return
 	}
 	databaseID := c.Param("id")
+	userID = h.effectiveUserID(c, userID, databaseID)
 	backupID := c.Param("bid")
 
 	backup, err := h.queries.GetDatabaseBackupByIDAndDatabaseAndUser(c.Request.Context(), sqlcdb.GetDatabaseBackupByIDAndDatabaseAndUserParams{
@@ -904,35 +934,6 @@ func (h *DatabaseHandler) resolveBackupConfig(ctx context.Context, userID string
 	}, nil
 }
 
-func (h *DatabaseHandler) generateMockBackupConfig() DatabaseBackupConfig {
-	return DatabaseBackupConfig{
-		Enabled:    true,
-		LastBackup: &time.Time{},
-		Retention:  30,
-		NextBackup: &time.Time{},
-		Backups: []DatabaseBackup{
-			{
-				ID:        "backup_1",
-				CreatedAt: time.Now().Add(-6 * time.Hour),
-				Size:      "245 MB",
-				Status:    "completed",
-			},
-			{
-				ID:        "backup_2",
-				CreatedAt: time.Now().Add(-24 * time.Hour),
-				Size:      "238 MB",
-				Status:    "completed",
-			},
-			{
-				ID:        "backup_3",
-				CreatedAt: time.Now().Add(-48 * time.Hour),
-				Size:      "241 MB",
-				Status:    "completed",
-			},
-		},
-	}
-}
-
 func (h *DatabaseHandler) generateMockSettings() DatabaseSettings {
 	return DatabaseSettings{
 		MaxConnections: 100,
@@ -942,33 +943,47 @@ func (h *DatabaseHandler) generateMockSettings() DatabaseSettings {
 	}
 }
 
+// resolveConnectionURL returns the stored connection URL for privileged
+// viewers, or "" when the runtime has not produced one (not provisioned yet).
 func (h *DatabaseHandler) resolveConnectionURL(db DatabaseService) string {
-	if strings.TrimSpace(db.ConnectionURL) != "" {
-		return db.ConnectionURL
-	}
-	return h.generateConnectionURL(db)
+	return strings.TrimSpace(db.ConnectionURL)
 }
 
-func (h *DatabaseHandler) generateConnectionURL(db DatabaseService) string {
-	safeName := sanitizeDBIdentifier(db.Name, "app")
-	switch db.Type {
-	case "postgresql":
-		return fmt.Sprintf("postgresql://user:password@%s.containr.local:5432/%s", safeName, safeName)
-	case "redis":
-		return fmt.Sprintf("redis://%s.containr.local:6379", safeName)
-	case "dragonfly":
-		return fmt.Sprintf("redis://%s.containr.local:6379", safeName)
-	case "mysql":
-		return fmt.Sprintf("mysql://user:password@%s.containr.local:3306/%s", safeName, safeName)
-	case "mariadb":
-		return fmt.Sprintf("mysql://user:password@%s.containr.local:3306/%s", safeName, safeName)
-	case "mongodb":
-		return fmt.Sprintf("mongodb://user:password@%s.containr.local:27017/%s", safeName, safeName)
-	case "clickhouse":
-		return fmt.Sprintf("http://%s.containr.local:8123", safeName)
-	default:
+// requestHostname returns the host the client used to reach the API, without
+// the port. Empty when it cannot be determined.
+func requestHostname(c *gin.Context) string {
+	host := strings.TrimSpace(c.Request.Host)
+	if host == "" {
 		return ""
 	}
+	if h, _, err := net.SplitHostPort(host); err == nil {
+		return strings.Trim(h, "[]")
+	}
+	return strings.Trim(host, "[]")
+}
+
+// rewriteLoopbackURL swaps loopback/unspecified hosts in rawURL for the host
+// the caller actually used, so URLs handed to remote browsers are usable.
+func rewriteLoopbackURL(rawURL, host string) string {
+	if rawURL == "" || host == "" {
+		return rawURL
+	}
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return rawURL
+	}
+	switch strings.ToLower(u.Hostname()) {
+	case "localhost", "127.0.0.1", "0.0.0.0", "::1", "":
+	default:
+		return rawURL
+	}
+	port := u.Port()
+	if port == "" {
+		u.Host = host
+	} else {
+		u.Host = net.JoinHostPort(host, port)
+	}
+	return u.String()
 }
 
 func (h *DatabaseHandler) reconcileManagedDatabaseState(ctx context.Context, db DatabaseService) DatabaseService {
@@ -1038,26 +1053,10 @@ func (h *DatabaseHandler) resolveManagedRuntimeStatus(ctx context.Context, db Da
 	}
 }
 
-func mapDatabaseServiceListRow(row sqlcdb.ListDatabaseServicesByUserRow) DatabaseService {
-	return DatabaseService{
-		ID:             row.ID,
-		Name:           row.Name,
-		Type:           row.Type,
-		Status:         row.Status,
-		Version:        row.Version,
-		Plan:           row.Plan,
-		Region:         row.Region,
-		BackupSchedule: databaseNullString(row.BackupSchedule),
-		NextBackupAt:   databaseNullTimePtr(row.NextBackupAt),
-		ConnectionURL:  databaseNullString(row.ConnectionUrl),
-		CreatedAt:      databaseNullTime(row.CreatedAt),
-		UpdatedAt:      databaseNullTime(row.UpdatedAt),
-	}
-}
-
-func mapDatabaseServiceGetRow(row sqlcdb.GetDatabaseServiceByIDAndUserRow) DatabaseService {
+func mapDatabaseServiceRow(row sqlcdb.DatabaseService) DatabaseService {
 	return DatabaseService{
 		ID:             row.ID,
+		OwnerID:        row.UserID,
 		Name:           row.Name,
 		Type:           row.Type,
 		Status:         row.Status,
@@ -1239,13 +1238,13 @@ func (h *DatabaseHandler) provisionDatabaseWithVariables(databaseID, databaseNam
 	defer cancel()
 
 	if h.dockerClient == nil {
-		fallbackURL := h.generateConnectionURL(DatabaseService{Name: databaseName, Type: dbType})
-		_ = h.setDatabaseStatusAndConnection(databaseID, "running", sql.NullString{String: fallbackURL, Valid: fallbackURL != ""})
+		_ = h.setDatabaseStatusAndConnection(databaseID, "running", sql.NullString{})
 		return
 	}
 
 	connectionURL, err := h.provisionDatabaseRuntime(ctx, databaseID, databaseName, dbType, runtimeVariables)
 	if err != nil {
+		log.Printf("containr: managed database %s (%s) provisioning failed: %v", databaseID, dbType, err)
 		_ = h.setDatabaseStatusAndConnection(databaseID, "error", sql.NullString{})
 		return
 	}
@@ -1353,7 +1352,7 @@ func (h *DatabaseHandler) provisionDatabaseRuntime(ctx context.Context, database
 	if err != nil {
 		return "", err
 	}
-	if err := waitForRuntimePortReadiness(ctx, hostPort); err != nil {
+	if err := h.waitForDatabaseReadiness(ctx, containerID, hostPort, plan.Port.Port()); err != nil {
 		return "", err
 	}
 
@@ -1387,12 +1386,24 @@ func (h *DatabaseHandler) resolvePublishedHostPort(ctx context.Context, containe
 	return "", fmt.Errorf("published host port not available")
 }
 
-func waitForRuntimePortReadiness(ctx context.Context, hostPort string) error {
-	addr := net.JoinHostPort("127.0.0.1", strings.TrimSpace(hostPort))
-	deadline := time.Now().Add(30 * time.Second)
+// waitForDatabaseReadiness probes the database's TCP port until it accepts a
+// connection. The published port lives on host loopback, which a containerized
+// backend cannot reach; in that case the database is additionally attached to
+// the backend's own network and probed by container IP.
+func (h *DatabaseHandler) waitForDatabaseReadiness(ctx context.Context, containerID, hostPort, containerPort string) error {
+	probeAddr := net.JoinHostPort("127.0.0.1", strings.TrimSpace(hostPort))
+	if backendNet := h.dockerClient.OwnNetworkName(ctx); backendNet != "" {
+		if err := h.dockerClient.ConnectNetwork(ctx, backendNet, containerID, network.EndpointSettings{}); err != nil {
+			log.Printf("containr: attach database %s to %s failed: %v", containerID, backendNet, err)
+		}
+		if ip := h.containerIPOnNetwork(ctx, containerID, backendNet); ip != "" {
+			probeAddr = net.JoinHostPort(ip, containerPort)
+		}
+	}
 
+	deadline := time.Now().Add(30 * time.Second)
 	for time.Now().Before(deadline) {
-		conn, err := net.DialTimeout("tcp", addr, 1500*time.Millisecond)
+		conn, err := net.DialTimeout("tcp", probeAddr, 1500*time.Millisecond)
 		if err == nil {
 			_ = conn.Close()
 			return nil
@@ -1405,7 +1416,18 @@ func waitForRuntimePortReadiness(ctx context.Context, hostPort string) error {
 		}
 	}
 
-	return fmt.Errorf("database runtime did not become reachable on %s", addr)
+	return fmt.Errorf("database runtime did not become reachable on %s", probeAddr)
+}
+
+func (h *DatabaseHandler) containerIPOnNetwork(ctx context.Context, containerID, networkName string) string {
+	inspect, err := h.dockerClient.GetContainer(ctx, containerID)
+	if err != nil || inspect.NetworkSettings == nil {
+		return ""
+	}
+	if ep, ok := inspect.NetworkSettings.Networks[networkName]; ok && ep != nil {
+		return strings.TrimSpace(ep.IPAddress)
+	}
+	return ""
 }
 
 func (h *DatabaseHandler) ensureImage(ctx context.Context, imageRef string) error {

app/backend/internal/api/databases_test.go

@@ -51,15 +51,16 @@ func TestDatabaseConnectionURLAndDefaultVersion(t *testing.T) {
 	}
 
 	for _, tc := range cases {
-		url := handler.generateConnectionURL(DatabaseService{
-			Type: tc.dbType,
-			Name: "example",
-		})
-		if url == "" {
-			t.Fatalf("generateConnectionURL returned empty for type %q", tc.dbType)
+		plan, err := buildDatabaseRuntimePlan(tc.dbType, "example", nil)
+		if err != nil {
+			t.Fatalf("buildDatabaseRuntimePlan(%q) failed: %v", tc.dbType, err)
 		}
+		url := plan.ConnectionURL("15432")
 		if len(tc.urlContains) > 0 && !strings.HasPrefix(url, tc.urlContains) {
-			t.Fatalf("generateConnectionURL(%q) = %q, expected prefix %q", tc.dbType, url, tc.urlContains)
+			t.Fatalf("ConnectionURL(%q) = %q, expected prefix %q", tc.dbType, url, tc.urlContains)
+		}
+		if !strings.Contains(url, ":15432") {
+			t.Fatalf("ConnectionURL(%q) = %q, expected published port", tc.dbType, url)
 		}
 
 		gotVersion := handler.getDefaultVersion(tc.dbType)
@@ -69,6 +70,17 @@ func TestDatabaseConnectionURLAndDefaultVersion(t *testing.T) {
 	}
 }
 
+func TestResolveConnectionURLNeverFabricates(t *testing.T) {
+	handler := &DatabaseHandler{}
+
+	if got := handler.resolveConnectionURL(DatabaseService{Type: "postgresql", Name: "example"}); got != "" {
+		t.Fatalf("resolveConnectionURL with no stored URL = %q, want empty", got)
+	}
+	if got := handler.resolveConnectionURL(DatabaseService{ConnectionURL: "postgresql://u:p@localhost:15432/db"}); got != "postgresql://u:p@localhost:15432/db" {
+		t.Fatalf("resolveConnectionURL = %q, want stored URL", got)
+	}
+}
+
 func TestBuildDatabaseRuntimePlanSupportsAllTypes(t *testing.T) {
 	cases := []struct {
 		dbType        string
@@ -199,3 +211,23 @@ func TestHumanReadableBytes(t *testing.T) {
 		}
 	}
 }
+
+func TestRewriteLoopbackURL(t *testing.T) {
+	tests := []struct {
+		name, raw, host, want string
+	}{
+		{"service url", "http://localhost:35981", "10.0.0.182", "http://10.0.0.182:35981"},
+		{"db url keeps creds", "postgresql://u:p@localhost:35432/db?sslmode=disable", "10.0.0.182", "postgresql://u:[email protected]:35432/db?sslmode=disable"},
+		{"ipv4 loopback", "redis://:[email protected]:36379/0", "host.lan", "redis://:[email protected]:36379/0"},
+		{"unspecified", "http://0.0.0.0:9000/x", "10.0.0.182", "http://10.0.0.182:9000/x"},
+		{"external host untouched", "https://example.com:443/x", "10.0.0.182", "https://example.com:443/x"},
+		{"empty raw", "", "10.0.0.182", ""},
+		{"empty host", "http://localhost:35981", "", "http://localhost:35981"},
+		{"no port", "http://localhost/path", "10.0.0.182", "http://10.0.0.182/path"},
+	}
+	for _, tt := range tests {
+		if got := rewriteLoopbackURL(tt.raw, tt.host); got != tt.want {
+			t.Errorf("%s: rewriteLoopbackURL(%q,%q) = %q, want %q", tt.name, tt.raw, tt.host, got, tt.want)
+		}
+	}
+}

app/backend/internal/api/deployments.go

@@ -3,8 +3,12 @@ package api
 import (
 	"containr/internal/database"
 	"containr/internal/deployment"
+	"containr/internal/deployqueue"
+	"containr/internal/docker"
 	"context"
+	"errors"
 	"fmt"
+	"log/slog"
 	"net/http"
 	"strings"
 	"time"
@@ -34,6 +38,7 @@ type CreateDeploymentRequest struct {
 	Branch     string            `json:"branch"`
 	Trigger    string            `json:"trigger"`
 	EnvVars    map[string]string `json:"env_vars"`
+	NoCache    bool              `json:"no_cache"`
 }
 
 type DeploymentResponse struct {
@@ -63,38 +68,31 @@ func handleGetDeployments(c *gin.Context) {
 		return
 	}
 
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+	projectID, found := serviceProjectID(db.(*database.DB), serviceID)
+	if !found {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
-
-	var ownerCheck string
-	err = db.(*database.DB).QueryRow(
-		`SELECT p.owner_id FROM services s 
-		 JOIN projects p ON s.project_id = p.id 
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(&ownerCheck)
-
-	if err != nil {
+	if _, allowed := projectReadAccess(c, db.(*database.DB), projectID); !allowed {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
 
-	if ownerCheck != userID.(string) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
-		return
-	}
+	offset, limit := pageWindow(c, 50, 100)
+
+	var total int
+	_ = db.(*database.DB).QueryRow(
+		`SELECT COUNT(*) FROM deployments WHERE service_id = $1`, serviceID,
+	).Scan(&total)
 
 	rows, err := db.(*database.DB).Query(
-		`SELECT id, service_id, commit_hash, status, image_name, image_tag, 
+		`SELECT id, service_id, commit_hash, status, image_name, image_tag,
 		        build_log, runtime_log, error, started_at, completed_at, created_at, updated_at
-		 FROM deployments 
-		 WHERE service_id = $1 
-		 ORDER BY created_at DESC 
-		 LIMIT 50`,
-		serviceID,
+		 FROM deployments
+		 WHERE service_id = $1
+		 ORDER BY created_at DESC
+		 LIMIT $2 OFFSET $3`,
+		serviceID, limit, offset,
 	)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve deployments"})
@@ -117,7 +115,85 @@ func handleGetDeployments(c *gin.Context) {
 		deployments = append(deployments, d)
 	}
 
-	c.JSON(http.StatusOK, gin.H{"deployments": deployments})
+	c.JSON(http.StatusOK, gin.H{
+		"deployments": deployments,
+		"pagination":  paginationMeta(offset, limit, total),
+	})
+}
+
+// RecentDeployment is a deployment row joined with its service and project names.
+type RecentDeployment struct {
+	ID          uuid.UUID  `json:"id"`
+	ServiceID   uuid.UUID  `json:"service_id"`
+	ServiceName string     `json:"service_name"`
+	ProjectName string     `json:"project_name"`
+	Status      string     `json:"status"`
+	ImageName   string     `json:"image_name"`
+	StartedAt   *time.Time `json:"started_at"`
+	CompletedAt *time.Time `json:"completed_at"`
+	CreatedAt   time.Time  `json:"created_at"`
+}
+
+// handleGetRecentDeployments lists the latest deployments across all of the
+// caller's services — feeds the dashboard deploy feed.
+func handleGetRecentDeployments(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return
+	}
+
+	userID := optionalUserUUID(c)
+	isAdmin := contextIsAdmin(c)
+
+	offset, limit := pageWindow(c, 10, 50)
+
+	var total int
+	if err := db.(*database.DB).QueryRow(
+		`SELECT COUNT(*)
+		 FROM deployments d
+		 JOIN services s ON s.id = d.service_id
+		 JOIN projects p ON p.id = s.project_id
+		 WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
+		    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)`,
+		userID, isAdmin,
+	).Scan(&total); err != nil {
+		total = 0
+	}
+
+	rows, err := db.(*database.DB).Query(
+		`SELECT d.id, d.service_id, s.name, p.name, d.status,
+		        COALESCE(d.image_name, ''), d.started_at, d.completed_at, d.created_at
+		 FROM deployments d
+		 JOIN services s ON s.id = d.service_id
+		 JOIN projects p ON p.id = s.project_id
+		 WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
+		    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)
+		 ORDER BY d.created_at DESC
+		 LIMIT $3 OFFSET $4`,
+		userID, isAdmin, limit, offset,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve deployments"})
+		return
+	}
+	defer rows.Close()
+
+	deployments := []RecentDeployment{}
+	for rows.Next() {
+		var d RecentDeployment
+		if err := rows.Scan(&d.ID, &d.ServiceID, &d.ServiceName, &d.ProjectName,
+			&d.Status, &d.ImageName, &d.StartedAt, &d.CompletedAt, &d.CreatedAt); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan deployment"})
+			return
+		}
+		deployments = append(deployments, d)
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"deployments": deployments,
+		"pagination":  paginationMeta(offset, limit, total),
+	})
 }
 
 func handleCreateDeployment(c *gin.Context) {
@@ -153,8 +229,14 @@ func handleCreateDeployment(c *gin.Context) {
 	var service Service
 	var projectOwner string
 	err = db.(*database.DB).QueryRow(
-		`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command, 
-		        s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory, 
+		`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
+		        s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
+		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
+		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
+		        COALESCE(s.restart_policy, 'unless-stopped'),
+		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
+		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
+		        COALESCE(s.static_dir, ''),
 		        s.created_at, s.updated_at, p.owner_id
 		 FROM services s
 		 JOIN projects p ON s.project_id = p.id
@@ -164,6 +246,9 @@ func handleCreateDeployment(c *gin.Context) {
 		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
 		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
 		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
+		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
+		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
 		&service.CreatedAt, &service.UpdatedAt, &projectOwner,
 	)
 
@@ -234,7 +319,23 @@ func handleCreateDeployment(c *gin.Context) {
 		}
 
 		engineInstance := engine.(*deployment.DeploymentEngine)
-		go runDeploymentAndSync(context.Background(), db.(*database.DB), engineInstance, &d, service, req, userID.(string))
+		pos := getDeployQueue(c).Enqueue(serviceID, deployqueue.Job{
+			DeploymentID: d.ID,
+			Run: func(jctx context.Context) {
+				runDeploymentAndSync(jctx, db.(*database.DB), engineInstance, &d, service, req, userID.(string))
+			},
+		})
+		if pos > 0 {
+			d.Status = "queued"
+			_, _ = db.(*database.DB).Exec(
+				`UPDATE deployments SET status = 'queued', updated_at = $1 WHERE id = $2`,
+				time.Now(), d.ID,
+			)
+			_, _ = db.(*database.DB).Exec(
+				`UPDATE services SET status = 'queued', updated_at = $1 WHERE id = $2`,
+				time.Now(), serviceID,
+			)
+		}
 	}
 
 	c.JSON(http.StatusCreated, DeploymentResponse{
@@ -256,6 +357,22 @@ func runDeploymentAndSync(
 	service Service,
 	req CreateDeploymentRequest,
 	userID string,
+) {
+	runDeploymentAndSyncWithImage(parentCtx, db, engine, dbDeployment, service, req, userID, "")
+}
+
+// runDeploymentAndSyncWithImage deploys imageOverride as a prebuilt image
+// (rollback / redeploy of an existing tag) when set; otherwise builds from
+// source or pulls the service image.
+func runDeploymentAndSyncWithImage(
+	parentCtx context.Context,
+	db *database.DB,
+	engine *deployment.DeploymentEngine,
+	dbDeployment *DeploymentModel,
+	service Service,
+	req CreateDeploymentRequest,
+	userID string,
+	imageOverride string,
 ) {
 	ctx, cancel := context.WithTimeout(parentCtx, 30*time.Minute)
 	defer cancel()
@@ -265,21 +382,71 @@ func runDeploymentAndSync(
 		sourcePath = "."
 	}
 
+	// Resolve the runtime env: stored service variables (with ${{svc.KEY}}
+	// references expanded) plus any per-deployment overrides.
+	env, envErr := resolveServiceEnv(db, service)
+	if envErr != nil {
+		env = map[string]string{}
+	}
+	for k, v := range req.EnvVars {
+		env[k] = v
+	}
+
+	var command []string
+	if cmd := strings.TrimSpace(service.Command); cmd != "" {
+		command = strings.Fields(cmd)
+	}
+
+	replicas := service.Replicas
+	if replicas < 1 {
+		replicas = 1
+	}
+
+	var publishedPort int32
+	// Best effort: reuse the host port from the last live deployment so public
+	// URLs survive redeploys. Column exists post-migration; older DBs get
+	// ephemeral ports.
+	_ = db.QueryRow(`SELECT published_port FROM services WHERE id = $1`, service.ID).Scan(&publishedPort)
+
+	publicPort := int32(service.Port)
+	if service.Builder == "static" && publicPort == 0 {
+		// The static builder's image is nginx — route to its default port
+		// unless the user picked another.
+		publicPort = 80
+	}
+
+	maintenanceMode, basicAuthUsers := serviceAccess(db, service.ID)
+	maintURL := ""
+	if maintenanceMode {
+		maintURL = maintenanceURL(db)
+	}
+
 	deployReq := &deployment.DeploymentRequest{
 		ProjectID:   service.ProjectID.String(),
 		ServiceID:   service.ID.String(),
 		Environment: service.Environment,
 		Config: deployment.ServiceConfig{
-			Name:        service.Name,
-			Image:       service.Image,
-			Environment: req.EnvVars,
-			Replicas:    1,
-		},
-		BuildConfig: &deployment.BuildConfig{
-			BuildType:  "nixpacks",
-			SourcePath: sourcePath,
-			Branch:     req.Branch,
-			Commit:     req.CommitHash,
+			Name:          service.Name,
+			Image:         service.Image,
+			Command:       command,
+			Environment:   env,
+			Replicas:      replicas,
+			PublicPort:    publicPort,
+			PublishedPort: publishedPort,
+			Domain:        service.Domain,
+			HealthPath:    service.HealthCheckPath,
+			RestartPolicy: service.RestartPolicy,
+			VolumeMounts:  loadServiceVolumes(db, service.ID),
+			Domains:       serviceDomainNames(db, service.ID, service.Domain),
+			Resources: deployment.ResourceLimits{
+				MemoryBytes:       parseMemoryLimit(service.Memory),
+				MemoryReservation: parseMemoryLimit(service.MemoryReserve),
+				CPUQuota:          parseCPULimit(service.CPU),
+				CPUShares:         parseCPUReserveShares(service.CPUReserve),
+			},
+			Maintenance:    maintenanceMode,
+			MaintenanceURL: maintURL,
+			BasicAuthUsers: basicAuthUsers,
 		},
 		Trigger: deployment.TriggerConfig{
 			Type:      req.Trigger,
@@ -289,6 +456,47 @@ func runDeploymentAndSync(
 		},
 	}
 
+	if imageOverride != "" {
+		deployReq.BuildConfig = &deployment.BuildConfig{
+			BuildType:     "prebuilt",
+			PrebuiltImage: imageOverride,
+		}
+	} else if service.GitRepo == "" {
+		// Image-sourced service: pull the image instead of building.
+		deployReq.BuildConfig = &deployment.BuildConfig{
+			BuildType:     "prebuilt",
+			PrebuiltImage: service.Image,
+		}
+	} else {
+		// "auto" leaves BuildType empty so the manager detects it; the static
+		// builder additionally feeds its generated Dockerfile the service's
+		// build command and output dir.
+		buildType := ""
+		if service.Builder != "" && service.Builder != "auto" {
+			buildType = service.Builder
+		}
+		deployReq.BuildConfig = &deployment.BuildConfig{
+			BuildType:  buildType,
+			SourcePath: sourcePath,
+			Branch:     req.Branch,
+			Commit:     req.CommitHash,
+			NoCache:    req.NoCache,
+		}
+		if buildType == "static" {
+			deployReq.BuildConfig.BuildCommand = firstNonEmpty(service.StaticBuildCmd, "npm ci && npm run build")
+			deployReq.BuildConfig.BuildArgs = map[string]string{"STATIC_DIR": firstNonEmpty(service.StaticDir, "dist")}
+		}
+	}
+
+	if msg := capacityCheck(parentCtx, db, engine.DockerClient(), service, replicas); msg != "" {
+		failedAt := time.Now()
+		_, _ = db.Exec(
+			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
+			msg, failedAt, dbDeployment.ID,
+		)
+		return
+	}
+
 	engineDeployment, err := engine.Deploy(ctx, deployReq)
 	if err != nil {
 		failedAt := time.Now()
@@ -313,16 +521,19 @@ func runDeploymentAndSync(
 		select {
 		case <-ctx.Done():
 			failedAt := time.Now()
-			timeoutErr := "Deployment timed out before completion"
+			finalStatus, finalErr := "failed", "Deployment timed out before completion"
+			if errors.Is(ctx.Err(), context.Canceled) {
+				finalStatus, finalErr = "cancelled", "Deployment cancelled"
+			}
 			_, _ = db.Exec(
 				`UPDATE deployments
-				 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
-				 WHERE id = $3`,
-				timeoutErr, failedAt, dbDeployment.ID,
+				 SET status = $1, error = $2, completed_at = $3, updated_at = $3
+				 WHERE id = $4`,
+				finalStatus, finalErr, failedAt, dbDeployment.ID,
 			)
 			_, _ = db.Exec(
-				`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
-				failedAt, service.ID,
+				`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`,
+				finalStatus, failedAt, service.ID,
 			)
 			return
 		case <-syncTicker.C:
@@ -389,13 +600,86 @@ func runDeploymentAndSync(
 }
 
 func mapEngineStatusToDBStatus(status string) string {
-	switch status {
-	case "running":
+	if status == "running" {
 		return "deployed"
-	case "cancelled":
-		return "failed"
+	}
+	return status
+}
+
+// getDeployQueue returns the per-service deploy queue. SetupRoutes always
+// sets it; the fallback keeps handler tests that skip SetupRoutes working.
+func getDeployQueue(c *gin.Context) *deployqueue.Queue {
+	if v, exists := c.Get("deploy_queue"); exists {
+		if q, ok := v.(*deployqueue.Queue); ok && q != nil {
+			return q
+		}
+	}
+	return deployqueue.New()
+}
+
+// handleCancelDeployment cancels a queued or in-flight deployment. Queued
+// jobs are dropped and marked cancelled immediately; active jobs get their
+// context cancelled so the build/reconcile aborts and the sync loop writes
+// the terminal 'cancelled' status.
+func handleCancelDeployment(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available", "code": "DEPENDENCY_UNAVAILABLE"})
+		return
+	}
+
+	deploymentID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid deployment ID", "code": "VALIDATION"})
+		return
+	}
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated", "code": "UNAUTHENTICATED"})
+		return
+	}
+
+	var status, owner string
+	var serviceID uuid.UUID
+	err = db.(*database.DB).QueryRow(
+		`SELECT d.status, d.service_id, p.owner_id
+		 FROM deployments d
+		 JOIN services s ON d.service_id = s.id
+		 JOIN projects p ON s.project_id = p.id
+		 WHERE d.id = $1`,
+		deploymentID,
+	).Scan(&status, &serviceID, &owner)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found", "code": "NOT_FOUND"})
+		return
+	}
+	if owner != userID.(string) && !contextIsAdmin(c) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied", "code": "FORBIDDEN"})
+		return
+	}
+
+	switch status {
+	case "deployed", "failed", "cancelled":
+		c.JSON(http.StatusConflict, gin.H{"error": "Deployment already finished", "code": "NOT_CANCELLABLE"})
+		return
+	}
+
+	switch getDeployQueue(c).Cancel(serviceID, deploymentID) {
+	case deployqueue.WasQueued:
+		now := time.Now()
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE deployments SET status = 'cancelled', error = 'Deployment cancelled', completed_at = $1, updated_at = $1 WHERE id = $2`,
+			now, deploymentID,
+		)
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE services SET status = 'cancelled', updated_at = $1 WHERE id = $2`,
+			now, serviceID,
+		)
+		c.JSON(http.StatusOK, gin.H{"status": "cancelled"})
+	case deployqueue.WasActive:
+		c.JSON(http.StatusAccepted, gin.H{"status": "cancelling"})
 	default:
-		return status
+		c.JSON(http.StatusConflict, gin.H{"error": "Deployment is not running on this node", "code": "NOT_CANCELLABLE"})
 	}
 }
 
@@ -427,18 +711,12 @@ func handleGetDeployment(c *gin.Context) {
 		return
 	}
 
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
 	var d DeploymentModel
-	var ownerCheck string
+	var projectID uuid.UUID
 	err = db.(*database.DB).QueryRow(
-		`SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag, 
-		        d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at, 
-		        d.created_at, d.updated_at, p.owner_id
+		`SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
+		        d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
+		        d.created_at, d.updated_at, p.id
 		 FROM deployments d
 		 JOIN services s ON d.service_id = s.id
 		 JOIN projects p ON s.project_id = p.id
@@ -447,7 +725,7 @@ func handleGetDeployment(c *gin.Context) {
 	).Scan(
 		&d.ID, &d.ServiceID, &d.CommitHash, &d.Status, &d.ImageName, &d.ImageTag,
 		&d.BuildLog, &d.RuntimeLog, &d.Error, &d.StartedAt, &d.CompletedAt,
-		&d.CreatedAt, &d.UpdatedAt, &ownerCheck,
+		&d.CreatedAt, &d.UpdatedAt, &projectID,
 	)
 
 	if err != nil {
@@ -455,8 +733,8 @@ func handleGetDeployment(c *gin.Context) {
 		return
 	}
 
-	if ownerCheck != userID.(string) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+	if _, allowed := projectReadAccess(c, db.(*database.DB), projectID); !allowed {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
 		return
 	}
 
@@ -509,7 +787,7 @@ func handleRollbackDeployment(c *gin.Context) {
 		return
 	}
 
-	if ownerCheck != userID.(string) {
+	if ownerCheck != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -550,17 +828,68 @@ func handleRollbackDeployment(c *gin.Context) {
 		time.Now(), serviceID,
 	)
 
-	go func() {
-		time.Sleep(2 * time.Second)
-		db.(*database.DB).Exec(
-			`UPDATE deployments SET status = 'deployed', completed_at = $1, updated_at = $1 WHERE id = $2`,
-			time.Now(), rollbackID,
+	// Real rollback: redeploy the target deployment's image.
+	engineValue, _ := c.Get("deployment_engine")
+	engine, _ := engineValue.(*deployment.DeploymentEngine)
+	targetImage := targetDeployment.ImageName
+	if targetDeployment.ImageTag != "" {
+		targetImage += ":" + targetDeployment.ImageTag
+	}
+
+	if engine == nil || targetImage == "" {
+		completedAt := time.Now()
+		reason := "Rollback image unavailable"
+		if engine == nil {
+			reason = "Deployment engine unavailable. Docker may not be configured on this server."
+		}
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
+			reason, completedAt, rollbackID,
 		)
-		db.(*database.DB).Exec(
-			`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`,
-			time.Now(), serviceID,
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
+			completedAt, serviceID,
 		)
-	}()
+	} else {
+		var service Service
+		_ = db.(*database.DB).QueryRow(
+			`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
+			        s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
+			        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
+			        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
+			        COALESCE(s.restart_policy, 'unless-stopped'),
+			        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
+			        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
+			        COALESCE(s.static_dir, ''),
+			        s.created_at, s.updated_at
+			 FROM services s WHERE s.id = $1`, serviceID,
+		).Scan(
+			&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
+			&service.Image, &service.Command, &service.Environment, &service.GitRepo,
+			&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+			&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
+			&service.RestartPolicy, &service.Builder, &service.CPUReserve,
+			&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
+			&service.CreatedAt, &service.UpdatedAt,
+		)
+
+		rollbackReq := CreateDeploymentRequest{
+			CommitHash: func() string {
+				if targetDeployment.CommitHash != nil {
+					return *targetDeployment.CommitHash
+				}
+				return ""
+			}(),
+			Trigger: "rollback",
+		}
+		// Reuse the stored image directly — no rebuild.
+		getDeployQueue(c).Enqueue(serviceID, deployqueue.Job{
+			DeploymentID: rollback.ID,
+			Run: func(jctx context.Context) {
+				runDeploymentAndSyncWithImage(jctx, db.(*database.DB), engine, &rollback, service, rollbackReq, userID.(string), targetImage)
+			},
+		})
+	}
 
 	c.JSON(http.StatusCreated, gin.H{
 		"deployment": DeploymentResponse{
@@ -575,3 +904,35 @@ func handleRollbackDeployment(c *gin.Context) {
 		"message": "Rollback initiated",
 	})
 }
+
+// capacityCheck compares the requested per-replica memory (limit, falling
+// back to reservation) against node capacity. app_settings.capacity_policy
+// = "block" fails the deployment; the default "warn" only logs. CPU is not
+// gated — shares are a weight, not a reservation.
+func capacityCheck(ctx context.Context, db *database.DB, client *docker.Client, service Service, replicas int) string {
+	if client == nil {
+		return ""
+	}
+	requested := parseMemoryLimit(service.Memory)
+	if requested == 0 {
+		requested = parseMemoryLimit(service.MemoryReserve)
+	}
+	if requested == 0 {
+		return ""
+	}
+	info, err := client.GetSystemInfo(ctx)
+	if err != nil || info.MemTotal <= 0 {
+		return ""
+	}
+	need := requested * int64(replicas)
+	if need <= info.MemTotal {
+		return ""
+	}
+	msg := fmt.Sprintf("requested %d bytes x %d replicas exceeds node memory (%d bytes)",
+		requested, replicas, info.MemTotal)
+	if strings.ToLower(settingValue(db, "capacity_policy", "", "warn")) == "block" {
+		return msg
+	}
+	slog.Warn("capacity check exceeded", "service_id", service.ID, "detail", msg)
+	return ""
+}

app/backend/internal/api/domains.go

@@ -0,0 +1,375 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"net"
+	"net/http"
+	"regexp"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// ServiceDomain is one hostname routed to a service. services.domain stays
+// the derived default; this table is the source of truth for the full set.
+type ServiceDomain struct {
+	ID            uuid.UUID  `json:"id"`
+	ServiceID     uuid.UUID  `json:"service_id"`
+	Domain        string     `json:"domain"`
+	IsDefault     bool       `json:"is_default"`
+	CertType      string     `json:"cert_type"`
+	CertStatus    string     `json:"cert_status"`
+	LastCheckedAt *time.Time `json:"last_checked_at,omitempty"`
+	CreatedAt     time.Time  `json:"created_at"`
+}
+
+// BasicAuthCred is a plaintext credential the server encodes to htpasswd.
+type BasicAuthCred struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+var hostnameRE = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$`)
+
+func validHostname(d string) bool {
+	return len(d) <= 253 && hostnameRE.MatchString(d)
+}
+
+func loadServiceDomains(db *database.DB, serviceID uuid.UUID) []ServiceDomain {
+	rows, err := db.Query(
+		`SELECT id, service_id, domain, is_default, cert_type, cert_status, last_checked_at, created_at
+		 FROM service_domains WHERE service_id = $1 ORDER BY is_default DESC, created_at ASC`, serviceID)
+	if err != nil {
+		return nil
+	}
+	defer rows.Close()
+	out := []ServiceDomain{}
+	for rows.Next() {
+		var d ServiceDomain
+		if err := rows.Scan(&d.ID, &d.ServiceID, &d.Domain, &d.IsDefault, &d.CertType, &d.CertStatus, &d.LastCheckedAt, &d.CreatedAt); err == nil {
+			out = append(out, d)
+		}
+	}
+	return out
+}
+
+func serviceDomainNames(db *database.DB, serviceID uuid.UUID, fallback string) []string {
+	domains := loadServiceDomains(db, serviceID)
+	out := make([]string, 0, len(domains))
+	for _, d := range domains {
+		out = append(out, d.Domain)
+	}
+	if len(out) == 0 && fallback != "" {
+		out = []string{fallback}
+	}
+	return out
+}
+
+// syncDefaultDomain writes the is_default row back to services.domain so
+// legacy reads (CLI tables, public_url) keep working.
+func syncDefaultDomain(db *database.DB, serviceID uuid.UUID) {
+	var domain string
+	err := db.QueryRow(
+		`SELECT domain FROM service_domains WHERE service_id = $1 AND is_default`, serviceID).Scan(&domain)
+	if err == sql.ErrNoRows {
+		err = db.QueryRow(
+			`SELECT domain FROM service_domains WHERE service_id = $1 ORDER BY created_at ASC LIMIT 1`, serviceID).Scan(&domain)
+	}
+	if err == sql.ErrNoRows {
+		domain = ""
+	}
+	_, _ = db.Exec(`UPDATE services SET domain = $1 WHERE id = $2`, domain, serviceID)
+}
+
+// serviceAccess loads the maintenance/basic-auth columns for the runtime spec.
+func serviceAccess(db *database.DB, serviceID uuid.UUID) (maintenance bool, basicAuth string) {
+	_ = db.QueryRow(`SELECT maintenance_mode, basic_auth_users FROM services WHERE id = $1`, serviceID).
+		Scan(&maintenance, &basicAuth)
+	return maintenance, basicAuth
+}
+
+// maintenanceURL is the redirect target for maintenance mode — the public
+// base URL of this API plus the maintenance page path.
+func maintenanceURL(db *database.DB) string {
+	base := strings.TrimRight(settingValue(db, "base_url", "BASE_URL", ""), "/")
+	if base == "" {
+		return ""
+	}
+	return base + "/api/v1/maintenance"
+}
+
+// encodeBasicAuth turns plaintext creds into Traefik's htpasswd format
+// (user:bcrypt hash, comma-separated). Bcrypt is what Traefik expects.
+func encodeBasicAuth(creds []BasicAuthCred) (string, error) {
+	pairs := make([]string, 0, len(creds))
+	for _, cred := range creds {
+		if cred.Username == "" || cred.Password == "" {
+			continue
+		}
+		hash, err := bcrypt.GenerateFromPassword([]byte(cred.Password), bcrypt.DefaultCost)
+		if err != nil {
+			return "", err
+		}
+		pairs = append(pairs, cred.Username+":"+string(hash))
+	}
+	return strings.Join(pairs, ","), nil
+}
+
+// basicAuthUsernames returns just the usernames for API responses — never
+// the hashes.
+func basicAuthUsernames(encoded string) []string {
+	var out []string
+	for _, pair := range strings.Split(encoded, ",") {
+		if u, _, ok := strings.Cut(pair, ":"); ok && u != "" {
+			out = append(out, u)
+		}
+	}
+	return out
+}
+
+// serviceWriteAccess mirrors the service update handler's access check.
+func serviceWriteAccess(c *gin.Context, db *database.DB, serviceID uuid.UUID) bool {
+	userID, _ := c.Get("user_id")
+	var ok bool
+	err := db.QueryRow(
+		`SELECT EXISTS(SELECT 1 FROM services s JOIN projects p ON s.project_id = p.id
+			WHERE s.id = $1 AND (p.owner_id = $2 OR $3::bool))`,
+		serviceID, userID, contextIsAdmin(c)).Scan(&ok)
+	return err == nil && ok
+}
+
+func handleListServiceDomains(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Database connection not available")
+		return
+	}
+	serviceID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid service ID")
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"domains": loadServiceDomains(db.(*database.DB), serviceID)})
+}
+
+func handleAddServiceDomain(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Database connection not available")
+		return
+	}
+	serviceID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid service ID")
+		return
+	}
+	if !serviceWriteAccess(c, db.(*database.DB), serviceID) {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Service not found")
+		return
+	}
+	var req struct {
+		Domain    string `json:"domain" binding:"required"`
+		IsDefault bool   `json:"is_default"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
+		return
+	}
+	domain := strings.ToLower(strings.TrimSpace(req.Domain))
+	if !validHostname(domain) {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid hostname")
+		return
+	}
+
+	// First domain on a service becomes the default automatically.
+	var count int
+	_ = db.(*database.DB).QueryRow(`SELECT COUNT(*) FROM service_domains WHERE service_id = $1`, serviceID).Scan(&count)
+	makeDefault := req.IsDefault || count == 0
+
+	tx, err := db.(*database.DB).Begin()
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to add domain")
+		return
+	}
+	defer tx.Rollback()
+	if makeDefault {
+		if _, err := tx.Exec(`UPDATE service_domains SET is_default = false WHERE service_id = $1`, serviceID); err != nil {
+			respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to add domain")
+			return
+		}
+	}
+	var inserted ServiceDomain
+	err = tx.QueryRow(
+		`INSERT INTO service_domains (service_id, domain, is_default)
+		 VALUES ($1, $2, $3)
+		 RETURNING id, service_id, domain, is_default, cert_type, cert_status, created_at`,
+		serviceID, domain, makeDefault).
+		Scan(&inserted.ID, &inserted.ServiceID, &inserted.Domain, &inserted.IsDefault, &inserted.CertType, &inserted.CertStatus, &inserted.CreatedAt)
+	if err != nil {
+		if strings.Contains(err.Error(), "duplicate") || strings.Contains(err.Error(), "unique") {
+			respondError(c, http.StatusConflict, "CONFLICT", "Domain already attached to this service")
+			return
+		}
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to add domain")
+		return
+	}
+	if err := tx.Commit(); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to add domain")
+		return
+	}
+	syncDefaultDomain(db.(*database.DB), serviceID)
+	c.JSON(http.StatusCreated, gin.H{"domain": inserted})
+}
+
+func handleDeleteServiceDomain(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Database connection not available")
+		return
+	}
+	serviceID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid service ID")
+		return
+	}
+	if !serviceWriteAccess(c, db.(*database.DB), serviceID) {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Service not found")
+		return
+	}
+	domainID, err := uuid.Parse(c.Param("domain_id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid domain ID")
+		return
+	}
+	res, err := db.(*database.DB).Exec(
+		`DELETE FROM service_domains WHERE id = $1 AND service_id = $2`, domainID, serviceID)
+	affected, _ := res.RowsAffected()
+	if err != nil || affected == 0 {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Domain not found")
+		return
+	}
+	syncDefaultDomain(db.(*database.DB), serviceID)
+	c.JSON(http.StatusOK, gin.H{"deleted": domainID})
+}
+
+func handleSetDefaultDomain(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Database connection not available")
+		return
+	}
+	serviceID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid service ID")
+		return
+	}
+	if !serviceWriteAccess(c, db.(*database.DB), serviceID) {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Service not found")
+		return
+	}
+	domainID, err := uuid.Parse(c.Param("domain_id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid domain ID")
+		return
+	}
+	res, err := db.(*database.DB).Exec(
+		`UPDATE service_domains SET is_default = (id = $1) WHERE service_id = $2`,
+		domainID, serviceID)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to set default domain")
+		return
+	}
+	affected, _ := res.RowsAffected()
+	if affected == 0 {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Domain not found")
+		return
+	}
+	syncDefaultDomain(db.(*database.DB), serviceID)
+	c.JSON(http.StatusOK, gin.H{"domains": loadServiceDomains(db.(*database.DB), serviceID)})
+}
+
+// handleCheckServiceDomains resolves each domain's DNS and compares it to
+// the configured expected target (app_settings.public_ip / PUBLIC_IP, or the
+// base_url host). Statuses: ok | wrong-target | pending.
+func handleCheckServiceDomains(c *gin.Context) {
+	db, exists := c.Get("db")
+	if !exists {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Database connection not available")
+		return
+	}
+	dbh := db.(*database.DB)
+	serviceID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid service ID")
+		return
+	}
+
+	expectedIP := settingValue(dbh, "public_ip", "PUBLIC_IP", "")
+	expectedHost := ""
+	if base := settingValue(dbh, "base_url", "BASE_URL", ""); base != "" {
+		if u := strings.TrimPrefix(strings.TrimPrefix(base, "https://"), "http://"); u != "" {
+			expectedHost, _, _ = strings.Cut(u, "/")
+			expectedHost, _, _ = strings.Cut(expectedHost, ":")
+		}
+	}
+
+	type result struct {
+		Domain   string   `json:"domain"`
+		Status   string   `json:"status"` // ok | wrong-target | pending
+		Resolved []string `json:"resolved"`
+	}
+	results := []result{}
+	resolver := net.DefaultResolver
+	for _, d := range loadServiceDomains(dbh, serviceID) {
+		ctx, cancel := context.WithTimeout(c.Request.Context(), 4*time.Second)
+		addrs, _ := resolver.LookupHost(ctx, d.Domain)
+		cname, _ := resolver.LookupCNAME(ctx, d.Domain)
+		cancel()
+
+		r := result{Domain: d.Domain, Resolved: addrs}
+		cname = strings.TrimSuffix(cname, ".")
+		switch {
+		case len(addrs) == 0:
+			r.Status = "pending"
+		case expectedIP != "":
+			r.Status = "wrong-target"
+			for _, a := range addrs {
+				if a == expectedIP {
+					r.Status = "ok"
+				}
+			}
+		case expectedHost != "":
+			r.Status = "ok" // resolves; CNAME match is advisory only
+			if cname != "" && cname != d.Domain && cname != expectedHost {
+				r.Status = "wrong-target"
+			}
+		default:
+			r.Status = "ok"
+		}
+		results = append(results, r)
+		_, _ = dbh.Exec(`UPDATE service_domains SET last_checked_at = NOW() WHERE id = $1`, d.ID)
+	}
+	c.JSON(http.StatusOK, gin.H{"domains": results})
+}
+
+// handleMaintenancePage serves the maintenance-mode landing page. Public:
+// browsers hit it via the Traefik redirect before any auth.
+func handleMaintenancePage(c *gin.Context) {
+	c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(`<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Maintenance</title><style>
+body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;background:#0b0e14;color:#e6e8ee;font-family:system-ui,sans-serif}
+.card{text-align:center;padding:2rem}.title{font-size:1.4rem;font-weight:600;margin-bottom:.5rem}
+.sub{color:#9aa3b2;font-size:.95rem}.brand{margin-top:2rem;color:#5b6472;font-size:.75rem;letter-spacing:.12em;text-transform:uppercase}
+</style></head><body><div class="card">
+<div class="title">This service is under maintenance</div>
+<div class="sub">Please check back shortly.</div>
+<div class="brand">Containr</div>
+</div></body></html>`))
+}

app/backend/internal/api/errors.go

@@ -0,0 +1,29 @@
+package api
+
+import (
+	"github.com/gin-gonic/gin"
+)
+
+// Stable machine-readable error codes for agent clients. The "error" field
+// stays human-readable; "code" is the contract the CLI/MCP rely on.
+const (
+	CodeUnauthorized       = "UNAUTHENTICATED"
+	CodeInvalidToken       = "INVALID_TOKEN"
+	CodeForbidden          = "FORBIDDEN"
+	CodeAdminRequired      = "ADMIN_REQUIRED"
+	CodeScopeInsufficient  = "SCOPE_INSUFFICIENT"
+	CodeNotFound           = "NOT_FOUND"
+	CodeValidation         = "VALIDATION"
+	CodeConflict           = "CONFLICT"
+	CodeInternal           = "INTERNAL"
+	CodeUnavailable        = "DEPENDENCY_UNAVAILABLE"
+	CodeIdempotencyRunning = "IDEMPOTENCY_IN_PROGRESS"
+)
+
+// respondError emits the standard error envelope. Existing handlers return
+// bare {"error": msg} — this adds the stable code for new and
+// agent-facing paths.
+func respondError(c *gin.Context, status int, code, message string) {
+	c.JSON(status, gin.H{"error": message, "code": code})
+	c.Abort()
+}

app/backend/internal/api/exec.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
 
 	"containr/internal/database"
 	"containr/internal/docker"
@@ -17,7 +18,6 @@ import (
 // commands run as the container's default user with a 30s ceiling.
 func handleExecInService(c *gin.Context) {
 	serviceID := c.Param("id")
-	userID := c.MustGet("user_id").(string)
 	db := c.MustGet("db").(*database.DB)
 
 	var req struct {
@@ -33,17 +33,20 @@ func handleExecInService(c *gin.Context) {
 		return
 	}
 
-	var ownerID string
-	err := db.QueryRow(
-		`SELECT p.owner_id FROM services s
-		 JOIN projects p ON p.id = s.project_id
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(&ownerID)
-	if err != nil || ownerID != userID {
+	serviceUUID, err := uuid.Parse(serviceID)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return
+	}
+	projectID, found := serviceProjectID(db, serviceUUID)
+	if !found {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
+	if _, allowed := projectManageAccess(c, db, projectID); !allowed {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return
+	}
 
 	dockerClient, _ := c.Get("docker_client")
 	dockerCli, _ := dockerClient.(*docker.Client)

app/backend/internal/api/git_receiver.go

@@ -14,6 +14,7 @@ import (
 
 	"containr/internal/database"
 	"containr/internal/deployment"
+	"containr/internal/deployqueue"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -178,11 +179,24 @@ func handleGitWebhookPush(c *gin.Context) {
 			`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
 			time.Now(), service.ID,
 		)
-		go runDeploymentAndSync(
-			context.Background(), db, engine, &d, service,
-			CreateDeploymentRequest{CommitHash: commit, Branch: branch, Trigger: "webhook"},
-			repoUserID,
-		)
+		// Webhook pushes default to a clean build — stale layers are the
+		// classic silent-rollback failure (dflow convention).
+		webhookReq := CreateDeploymentRequest{CommitHash: commit, Branch: branch, Trigger: "webhook", NoCache: true}
+		if pos := getDeployQueue(c).Enqueue(service.ID, deployqueue.Job{
+			DeploymentID: d.ID,
+			Run: func(jctx context.Context) {
+				runDeploymentAndSync(jctx, db, engine, &d, service, webhookReq, repoUserID)
+			},
+		}); pos > 0 {
+			_, _ = db.Exec(
+				`UPDATE deployments SET status = 'queued', updated_at = $1 WHERE id = $2`,
+				time.Now(), d.ID,
+			)
+			_, _ = db.Exec(
+				`UPDATE services SET status = 'queued', updated_at = $1 WHERE id = $2`,
+				time.Now(), service.ID,
+			)
+		}
 		enqueued++
 	}
 

app/backend/internal/api/ha.go

@@ -25,43 +25,58 @@ func NewHAManager(haManager *ha.HighAvailabilityManager) *HAManager {
 	}
 }
 
-// RegisterRoutes registers HA routes
-func (h *HAManager) RegisterRoutes(router *gin.RouterGroup) {
+// RegisterReadRoutes registers public HA read endpoints.
+func (h *HAManager) RegisterReadRoutes(router *gin.RouterGroup) {
 	ha := router.Group("/ha")
 	{
 		ha.GET("/status", h.GetHAStatus)
+
+		// Failover policies
+		ha.GET("/failover/policies", h.GetFailoverPolicies)
+		ha.GET("/failover/policies/:serviceId", h.GetFailoverPolicy)
+
+		// Health checks
+		ha.GET("/health/checks", h.GetHealthChecks)
+		ha.GET("/health/checks/:checkId", h.GetHealthCheck)
+		ha.GET("/health/results", h.GetHealthResults)
+
+		// Alerts
+		ha.GET("/alerts/rules", h.GetAlertRules)
+		ha.GET("/alerts/rules/:ruleId", h.GetAlertRule)
+		ha.GET("/alerts/active", h.GetActiveAlerts)
+
+		// Notifiers
+		ha.GET("/notifiers", h.GetNotifiers)
+		ha.GET("/notifiers/:notifierId", h.GetNotifier)
+	}
+}
+
+// RegisterAdminRoutes registers HA mutation endpoints.
+func (h *HAManager) RegisterAdminRoutes(router *gin.RouterGroup) {
+	ha := router.Group("/ha")
+	{
 		ha.POST("/enable", h.EnableHA)
 		ha.POST("/disable", h.DisableHA)
 		ha.POST("/failover", h.TriggerFailover)
 
 		// Failover policies
-		ha.GET("/failover/policies", h.GetFailoverPolicies)
 		ha.POST("/failover/policies", h.SetFailoverPolicy)
-		ha.GET("/failover/policies/:serviceId", h.GetFailoverPolicy)
 		ha.PUT("/failover/policies/:serviceId", h.UpdateFailoverPolicy)
 		ha.DELETE("/failover/policies/:serviceId", h.DeleteFailoverPolicy)
 
 		// Health checks
-		ha.GET("/health/checks", h.GetHealthChecks)
 		ha.POST("/health/checks", h.AddHealthCheck)
-		ha.GET("/health/checks/:checkId", h.GetHealthCheck)
 		ha.PUT("/health/checks/:checkId", h.UpdateHealthCheck)
 		ha.DELETE("/health/checks/:checkId", h.DeleteHealthCheck)
-		ha.GET("/health/results", h.GetHealthResults)
 
 		// Alerts
-		ha.GET("/alerts/rules", h.GetAlertRules)
 		ha.POST("/alerts/rules", h.AddAlertRule)
-		ha.GET("/alerts/rules/:ruleId", h.GetAlertRule)
 		ha.PUT("/alerts/rules/:ruleId", h.UpdateAlertRule)
 		ha.DELETE("/alerts/rules/:ruleId", h.DeleteAlertRule)
-		ha.GET("/alerts/active", h.GetActiveAlerts)
 		ha.POST("/alerts/:alertId/resolve", h.ResolveAlert)
 
 		// Notifiers
-		ha.GET("/notifiers", h.GetNotifiers)
 		ha.POST("/notifiers", h.AddNotifier)
-		ha.GET("/notifiers/:notifierId", h.GetNotifier)
 		ha.DELETE("/notifiers/:notifierId", h.DeleteNotifier)
 	}
 }

app/backend/internal/api/logs.go

@@ -8,9 +8,11 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"sort"
 	"strings"
 	"time"
 
+	"github.com/docker/docker/api/types/filters"
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
@@ -35,27 +37,13 @@ func handleGetLogs(c *gin.Context) {
 		return
 	}
 
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
-	var ownerCheck string
-	err = db.(*database.DB).QueryRow(
-		`SELECT p.owner_id FROM services s 
-		 JOIN projects p ON s.project_id = p.id 
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(&ownerCheck)
-
-	if err != nil {
+	projectID, found := serviceProjectID(db.(*database.DB), serviceID)
+	if !found {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
-
-	if ownerCheck != userID.(string) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+	if _, allowed := projectManageAccess(c, db.(*database.DB), projectID); !allowed {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
 
@@ -73,7 +61,21 @@ func handleGetLogs(c *gin.Context) {
 		respondEmptyServiceLogs(c, "Container log streaming is unavailable because Docker is not configured.")
 		return
 	}
-	containerName := fmt.Sprintf("containr-%s", serviceID)
+	// Replicas are named containr-<serviceID>-<n>; resolve them by label and
+	// merge logs across all of them.
+	ctx := context.Background()
+	containers, err := client.ListContainersFiltered(ctx, filters.NewArgs(
+		filters.Arg("label", "containr.service="+serviceID.String()),
+	), false)
+	if err != nil {
+		respondDependencyUnavailable(c, "docker", "Failed to fetch container logs. The container may be unavailable.")
+		return
+	}
+	if len(containers) == 0 {
+		respondEmptyServiceLogs(c, "No container logs are available for this service yet.")
+		return
+	}
+	sort.Slice(containers, func(i, j int) bool { return containers[i].Names[0] < containers[j].Names[0] })
 
 	logOpts := docker.LogOptions{
 		Stdout:     true,
@@ -83,17 +85,25 @@ func handleGetLogs(c *gin.Context) {
 		Timestamps: true,
 	}
 
-	ctx := context.Background()
-	logsReader, err := client.GetContainerLogs(ctx, containerName, logOpts)
-	if err != nil {
-		if isDockerNotFoundError(err) {
-			respondEmptyServiceLogs(c, "No container logs are available for this service yet.")
-			return
+	var readers []io.ReadCloser
+	var streams []io.Reader
+	for _, ctr := range containers {
+		r, rerr := client.GetContainerLogs(ctx, ctr.ID, logOpts)
+		if rerr == nil {
+			readers = append(readers, r)
+			streams = append(streams, r)
 		}
-		respondDependencyUnavailable(c, "docker", "Failed to fetch container logs. The container may be unavailable.")
+	}
+	if len(readers) == 0 {
+		respondEmptyServiceLogs(c, "No container logs are available for this service yet.")
 		return
 	}
-	defer logsReader.Close()
+	logsReader := io.MultiReader(streams...)
+	defer func() {
+		for _, r := range readers {
+			_ = r.Close()
+		}
+	}()
 
 	if follow {
 		c.Header("Content-Type", "text/event-stream")
@@ -185,30 +195,24 @@ func handleGetDeploymentLogs(c *gin.Context) {
 		return
 	}
 
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
 	var buildLog, runtimeLog string
-	var ownerCheck string
+	var projectID uuid.UUID
 	err = db.(*database.DB).QueryRow(
-		`SELECT d.build_log, d.runtime_log, p.owner_id
+		`SELECT d.build_log, d.runtime_log, p.id
 		 FROM deployments d
 		 JOIN services s ON d.service_id = s.id
 		 JOIN projects p ON s.project_id = p.id
 		 WHERE d.id = $1`,
 		deploymentID,
-	).Scan(&buildLog, &runtimeLog, &ownerCheck)
+	).Scan(&buildLog, &runtimeLog, &projectID)
 
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
 		return
 	}
 
-	if ownerCheck != userID.(string) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+	if _, allowed := projectManageAccess(c, db.(*database.DB), projectID); !allowed {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
 		return
 	}
 

app/backend/internal/api/metrics.go

@@ -60,26 +60,19 @@ func handleGetServiceMetrics(c *gin.Context) {
 		return
 	}
 
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
-	var ownerID string
+	var projectID uuid.UUID
 	var status string
 	err = db.QueryRow(
-		`SELECT p.owner_id, COALESCE(s.status, '')
-		 FROM services s JOIN projects p ON s.project_id = p.id
-		 WHERE s.id = $1`,
+		`SELECT s.project_id, COALESCE(s.status, '')
+		 FROM services s WHERE s.id = $1`,
 		serviceID,
-	).Scan(&ownerID, &status)
+	).Scan(&projectID, &status)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
-	if ownerID != userID.(string) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+	if _, allowed := projectReadAccess(c, db, projectID); !allowed {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
 

app/backend/internal/api/pagination.go

@@ -0,0 +1,52 @@
+package api
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+)
+
+// pageWindow parses pagination from either ?page=&limit= (legacy) or
+// ?cursor=&limit= (agent-friendly). The cursor is an opaque base64 offset —
+// cheap to implement over the existing offset queries while the public
+// contract stays cursor-shaped for clients.
+func pageWindow(c *gin.Context, defaultLimit, maxLimit int) (offset, limit int) {
+	limit = defaultLimit
+	if v := c.Query("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 && n <= maxLimit {
+			limit = n
+		}
+	}
+	if cur := c.Query("cursor"); cur != "" {
+		if raw, err := base64.RawURLEncoding.DecodeString(strings.TrimPrefix(cur, "o_")); err == nil {
+			if n, err := strconv.Atoi(string(raw)); err == nil && n >= 0 {
+				return n, limit
+			}
+		}
+		return 0, limit // invalid cursor → first page, fail soft
+	}
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	if page < 1 {
+		page = 1
+	}
+	return (page - 1) * limit, limit
+}
+
+// paginationMeta renders the standard envelope: legacy page fields plus
+// next_cursor when another page exists.
+func paginationMeta(offset, limit, total int) gin.H {
+	page := offset/limit + 1
+	meta := gin.H{
+		"page":  page,
+		"limit": limit,
+		"total": total,
+		"pages": (total + limit - 1) / limit,
+	}
+	if offset+limit < total {
+		meta["next_cursor"] = "o_" + base64.RawURLEncoding.EncodeToString([]byte(fmt.Sprint(offset+limit)))
+	}
+	return meta
+}

app/backend/internal/api/pagination_test.go

@@ -0,0 +1,55 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func ctxWithQuery(q string) *gin.Context {
+	gin.SetMode(gin.TestMode)
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = httptest.NewRequest("GET", "/x?"+q, nil)
+	return c
+}
+
+func TestPageWindowDefaults(t *testing.T) {
+	offset, limit := pageWindow(ctxWithQuery(""), 10, 100)
+	if offset != 0 || limit != 10 {
+		t.Fatalf("expected 0/10, got %d/%d", offset, limit)
+	}
+}
+
+func TestPageWindowLegacyPage(t *testing.T) {
+	offset, limit := pageWindow(ctxWithQuery("page=3&limit=20"), 10, 100)
+	if offset != 40 || limit != 20 {
+		t.Fatalf("expected 40/20, got %d/%d", offset, limit)
+	}
+}
+
+func TestPageWindowCursor(t *testing.T) {
+	// cursor for offset 50 produced by paginationMeta
+	meta := paginationMeta(0, 50, 200)
+	cursor := meta["next_cursor"].(string)
+	offset, limit := pageWindow(ctxWithQuery("cursor="+cursor+"&limit=50"), 10, 100)
+	if offset != 50 || limit != 50 {
+		t.Fatalf("expected 50/50, got %d/%d", offset, limit)
+	}
+}
+
+func TestPageWindowInvalidCursorFailsSoft(t *testing.T) {
+	offset, _ := pageWindow(ctxWithQuery("cursor=garbage"), 10, 100)
+	if offset != 0 {
+		t.Fatalf("expected offset 0 on invalid cursor, got %d", offset)
+	}
+}
+
+func TestPaginationMetaNextCursorOnlyWhenMore(t *testing.T) {
+	if _, ok := paginationMeta(0, 10, 10)["next_cursor"]; ok {
+		t.Fatal("no next page should omit next_cursor")
+	}
+	if _, ok := paginationMeta(0, 10, 25)["next_cursor"]; !ok {
+		t.Fatal("expected next_cursor when more pages exist")
+	}
+}

app/backend/internal/api/preview_environments.go

@@ -69,31 +69,13 @@ func handleGetPreviewEnvironments(c *gin.Context) {
 		return
 	}
 
-	// Check if project exists and user has access
-	var project Project
-	err = db.(*database.DB).QueryRow(
-		"SELECT id, name, owner_id FROM projects WHERE id = $1",
-		projectID,
-	).Scan(&project.ID, &project.Name, &project.OwnerID)
-
-	if err != nil {
+	// Approved projects are public; unapproved ones need owner/member/admin.
+	projectExists, allowed := projectReadAccess(c, db.(*database.DB), projectID)
+	if !projectExists || !allowed {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
 		return
 	}
 
-	// Get user ID from JWT token (set by auth middleware)
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
-	// Check if user owns the project
-	if project.OwnerID != userID.(string) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
-		return
-	}
-
 	// Get preview environments for the project with service info
 	rows, err := db.(*database.DB).Query(
 		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
@@ -193,7 +175,7 @@ func handleCreatePreviewEnvironment(c *gin.Context) {
 	}
 
 	// Check if user owns the project
-	if project.OwnerID != userID.(string) {
+	if project.OwnerID != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -332,27 +314,22 @@ func handleGetPreviewEnvironment(c *gin.Context) {
 		return
 	}
 
-	// Get user ID from JWT token
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
-	// Get preview environment with project ownership check
+	// Public when the parent project is approved; otherwise owner/member/admin.
+	userID := optionalUserUUID(c)
 	var env PreviewEnvironment
 	var serviceID sql.NullString
 	var serviceName sql.NullString
 	var serviceType sql.NullString
 	err = db.(*database.DB).QueryRow(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
+		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number,
 				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
 				s.id as service_id, s.name as service_name, s.type as service_type
 			FROM preview_environments pe
 			LEFT JOIN services s ON pe.service_id = s.id
 			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND p.owner_id = $2`,
-		envID, userID,
+			WHERE pe.id = $1 AND (p.is_approved OR p.owner_id = $2 OR $3::bool
+				OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $2))`,
+		envID, userID, contextIsAdmin(c),
 	).Scan(
 		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
 		&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
@@ -414,8 +391,8 @@ func handleUpdatePreviewEnvironment(c *gin.Context) {
 				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at
 			FROM preview_environments pe
 			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND p.owner_id = $2`,
-		envID, userID,
+			WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)`,
+		envID, userID, contextIsAdmin(c),
 	).Scan(
 		&existingEnv.ID, &existingEnv.ProjectID, &existingEnv.ServiceID, &existingEnv.BranchName,
 		&existingEnv.PRNumber, &existingEnv.Environment, &existingEnv.Status, &existingEnv.URL,
@@ -498,7 +475,7 @@ func handleDeletePreviewEnvironment(c *gin.Context) {
 	}
 
 	// Check if user owns the project
-	if projectOwnerID != userID.(string) {
+	if projectOwnerID != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -568,8 +545,8 @@ func handlePromotePreviewEnvironment(c *gin.Context) {
 		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.environment, pe.status
 			FROM preview_environments pe
 			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND p.owner_id = $2`,
-		envID, userID,
+			WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)`,
+		envID, userID, contextIsAdmin(c),
 	).Scan(
 		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.Environment, &env.Status,
 	)
@@ -665,8 +642,8 @@ func handleCleanupExpiredPreviewEnvironments(c *gin.Context) {
 		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.environment
 			FROM preview_environments pe
 			JOIN projects p ON pe.project_id = p.id
-			WHERE p.owner_id = $1 AND pe.expires_at < NOW() AND pe.status != 'expired'`,
-		userID,
+			WHERE (p.owner_id = $1 OR $2::bool) AND pe.expires_at < NOW() AND pe.status != 'expired'`,
+		userID, contextIsAdmin(c),
 	)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to find expired preview environments"})

app/backend/internal/api/production_behavior_test.go

@@ -86,3 +86,19 @@ func TestRequireAuthenticatedUserIDRejectsMissingUserContext(t *testing.T) {
 		t.Fatalf("expected status %d, got %d", http.StatusUnauthorized, rec.Code)
 	}
 }
+
+func TestRecentDeploymentsAllowAnonymousRead(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.GET("/api/v1/deployments", handleGetRecentDeployments)
+
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/deployments", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// Deployments are publicly readable; with no db in context the handler
+	// fails at the dependency boundary, never at an auth check.
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("expected status %d, got %d", http.StatusInternalServerError, rec.Code)
+	}
+}

app/backend/internal/api/projects.go

@@ -3,10 +3,11 @@ package api
 import (
 	"containr/internal/database"
 	"containr/internal/database/sqlcdb"
+	"containr/internal/deployment"
+	"context"
 	"database/sql"
 	"errors"
 	"net/http"
-	"strconv"
 	"strings"
 	"time"
 
@@ -19,6 +20,7 @@ type Project struct {
 	Name        string `json:"name"`
 	Description string `json:"description"`
 	OwnerID     string `json:"owner_id"`
+	IsApproved  bool   `json:"is_approved"`
 	CreatedAt   string `json:"created_at"`
 	UpdatedAt   string `json:"updated_at"`
 }
@@ -46,26 +48,15 @@ type UpdateProjectRequest struct {
 }
 
 func handleGetProjects(c *gin.Context) {
-	userID, ok := requireAuthenticatedUserUUID(c)
-	if !ok {
-		return
-	}
+	userID := optionalUserUUID(c)
+	isAdmin := contextIsAdmin(c)
 
 	db := c.MustGet("db").(*database.DB)
 	queries := sqlcdb.New(db.DB)
 
-	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
-	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+	offset, limit := pageWindow(c, 10, 100)
 	search := strings.TrimSpace(c.DefaultQuery("search", ""))
 
-	if page < 1 {
-		page = 1
-	}
-	if limit > 100 || limit < 1 {
-		limit = 10
-	}
-	offset := (page - 1) * limit
-
 	searchParam := sql.NullString{}
 	if search != "" {
 		searchParam = sql.NullString{String: search, Valid: true}
@@ -73,6 +64,7 @@ func handleGetProjects(c *gin.Context) {
 
 	rows, err := queries.ListProjectsWithStatsByUser(c.Request.Context(), sqlcdb.ListProjectsWithStatsByUserParams{
 		UserID:      userID,
+		IsAdmin:     isAdmin,
 		Search:      searchParam,
 		LimitCount:  int32(limit),
 		OffsetCount: int32(offset),
@@ -88,23 +80,18 @@ func handleGetProjects(c *gin.Context) {
 	}
 
 	total, err := queries.CountProjectsByUser(c.Request.Context(), sqlcdb.CountProjectsByUserParams{
-		UserID: userID,
-		Search: searchParam,
+		UserID:  userID,
+		IsAdmin: isAdmin,
+		Search:  searchParam,
 	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database count error"})
 		return
 	}
 
-	totalCount := int(total)
 	c.JSON(http.StatusOK, gin.H{
-		"projects": projects,
-		"pagination": gin.H{
-			"page":  page,
-			"limit": limit,
-			"total": totalCount,
-			"pages": (totalCount + limit - 1) / limit,
-		},
+		"projects":   projects,
+		"pagination": paginationMeta(offset, limit, int(total)),
 	})
 }
 
@@ -169,10 +156,7 @@ func handleCreateProject(c *gin.Context) {
 }
 
 func handleGetProject(c *gin.Context) {
-	userID, ok := requireAuthenticatedUserUUID(c)
-	if !ok {
-		return
-	}
+	userID := optionalUserUUID(c)
 
 	db := c.MustGet("db").(*database.DB)
 	queries := sqlcdb.New(db.DB)
@@ -185,6 +169,7 @@ func handleGetProject(c *gin.Context) {
 	projectRow, err := queries.GetProjectByIDForUser(c.Request.Context(), sqlcdb.GetProjectByIDForUserParams{
 		ProjectID: projectID,
 		UserID:    userID,
+		IsAdmin:   contextIsAdmin(c),
 	})
 	if errors.Is(err, sql.ErrNoRows) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
@@ -215,6 +200,7 @@ func handleUpdateProject(c *gin.Context) {
 	role, err := queries.GetProjectRoleForUser(c.Request.Context(), sqlcdb.GetProjectRoleForUserParams{
 		ProjectID: projectID,
 		UserID:    userID,
+		IsAdmin:   contextIsAdmin(c),
 	})
 	if errors.Is(err, sql.ErrNoRows) || role == "" || role == "viewer" {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Insufficient permissions"})
@@ -268,6 +254,7 @@ func handleUpdateProject(c *gin.Context) {
 	projectRow, err := queries.GetProjectByIDForUser(c.Request.Context(), sqlcdb.GetProjectByIDForUserParams{
 		ProjectID: projectID,
 		UserID:    userID,
+		IsAdmin:   contextIsAdmin(c),
 	})
 	if errors.Is(err, sql.ErrNoRows) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
@@ -305,11 +292,21 @@ func handleDeleteProject(c *gin.Context) {
 		return
 	}
 
-	if ownerID != userID {
+	if ownerID != userID && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Only project owners can delete projects"})
 		return
 	}
 
+	// Remove live containers and the project network before dropping rows.
+	// Best-effort: Docker may be unavailable; DB cleanup proceeds regardless.
+	if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+		engine := engineValue.(*deployment.DeploymentEngine)
+		ctx, cancel := context.WithTimeout(c.Request.Context(), 30*time.Second)
+		_ = engine.RemoveProjectContainers(ctx, projectID.String())
+		_ = engine.RemoveProjectNetwork(ctx, projectID.String())
+		cancel()
+	}
+
 	deletedRows, err := queries.DeleteProjectByID(c.Request.Context(), projectID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete project"})
@@ -349,7 +346,7 @@ func parseProjectIDParam(c *gin.Context) (uuid.UUID, bool) {
 
 func mapProjectWithStatsRow(row sqlcdb.ListProjectsWithStatsByUserRow) ProjectWithStats {
 	result := ProjectWithStats{
-		Project: mapProjectFields(row.ID, row.Name, row.Description, row.OwnerID, row.CreatedAt, row.UpdatedAt),
+		Project: mapProjectFields(row.ID, row.Name, row.Description, row.OwnerID, row.IsApproved, row.CreatedAt, row.UpdatedAt),
 		Stats: ProjectStats{
 			ServiceCount:    int(row.ServiceCount),
 			DeploymentCount: int(row.DeploymentCount),
@@ -361,15 +358,16 @@ func mapProjectWithStatsRow(row sqlcdb.ListProjectsWithStatsByUserRow) ProjectWi
 }
 
 func mapSQLCProject(project sqlcdb.Project) Project {
-	return mapProjectFields(project.ID, project.Name, project.Description, project.OwnerID, project.CreatedAt, project.UpdatedAt)
+	return mapProjectFields(project.ID, project.Name, project.Description, project.OwnerID, project.IsApproved, project.CreatedAt, project.UpdatedAt)
 }
 
-func mapProjectFields(id uuid.UUID, name string, description sql.NullString, ownerID uuid.UUID, createdAt, updatedAt sql.NullTime) Project {
+func mapProjectFields(id uuid.UUID, name string, description sql.NullString, ownerID uuid.UUID, isApproved bool, createdAt, updatedAt sql.NullTime) Project {
 	return Project{
 		ID:          id.String(),
 		Name:        name,
 		Description: nullableStringValue(description),
 		OwnerID:     ownerID.String(),
+		IsApproved:  isApproved,
 		CreatedAt:   nullableTimestampString(createdAt),
 		UpdatedAt:   nullableTimestampString(updatedAt),
 	}

app/backend/internal/api/resources_test.go

@@ -0,0 +1,48 @@
+package api
+
+import "testing"
+
+func TestParseCPUReserveShares(t *testing.T) {
+	cases := map[string]int64{
+		"":      0,
+		"0":     0,
+		"-1":    0,
+		"abc":   0,
+		"0.25":  256,
+		"1":     1024,
+		"2.5":   2560,
+		" 0.5 ": 512,
+	}
+	for in, want := range cases {
+		if got := parseCPUReserveShares(in); got != want {
+			t.Errorf("parseCPUReserveShares(%q) = %d, want %d", in, got, want)
+		}
+	}
+}
+
+func TestValidateResourceSpecs(t *testing.T) {
+	if err := validateCPUSpec(""); err != nil {
+		t.Error("empty cpu should pass")
+	}
+	if err := validateCPUSpec("0.5"); err != nil {
+		t.Error("0.5 should be valid cpu")
+	}
+	if err := validateCPUSpec("512mb"); err == nil {
+		t.Error("512mb should fail cpu validation")
+	}
+	if err := validateMemorySpec(""); err != nil {
+		t.Error("empty memory should pass")
+	}
+	if err := validateMemorySpec("512Mi"); err != nil {
+		t.Error("512Mi should be valid memory")
+	}
+	if err := validateMemorySpec("1g"); err != nil {
+		t.Error("1g should be valid memory")
+	}
+	if err := validateMemorySpec("0.5"); err == nil {
+		t.Error("0.5 should fail memory validation (parses to <1 byte)")
+	}
+	if err := validateMemorySpec("lots"); err == nil {
+		t.Error("'lots' should fail memory validation")
+	}
+}

app/backend/internal/api/routes.go

@@ -4,17 +4,20 @@ import (
 	"context"
 	"log"
 	"net/http"
+	"os"
 	"time"
 
 	"containr/internal/build"
 	"containr/internal/config"
 	"containr/internal/database"
 	"containr/internal/deployment"
+	"containr/internal/deployqueue"
 	"containr/internal/docker"
 	"containr/internal/ha"
 	"containr/internal/metrics"
 	"containr/internal/middleware"
 	"containr/internal/scaling"
+	"containr/internal/secrets"
 
 	"github.com/gin-gonic/gin"
 )
@@ -35,6 +38,8 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		dockerClient = client
 		buildManager = build.NewBuildManager("/tmp/containr-builds", dockerClient)
 		deploymentEngine = deployment.NewDeploymentEngine(buildManager, dockerClient)
+		// Restore managed sidecars (e.g. cloudflared) from saved settings.
+		syncManagedContainers(dockerClient, db)
 	}
 
 	// Initialize build handler
@@ -55,6 +60,33 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		}
 	}
 	haManager := ha.NewHighAvailabilityManager(scheduler, metricsCollector)
+	if db != nil && db.DB != nil {
+		haManager.WithPersistence(db.DB)
+		if err := haManager.LoadHealthChecks(context.Background()); err != nil {
+			log.Printf("Failed to restore health checks: %v", err)
+		}
+	}
+	if dockerClient != nil && db != nil {
+		// Service-bound checks probe the service DNS name on the project
+		// network — the backend container joins it on demand. The old
+		// 127.0.0.1 fallback stays for node-bound checks.
+		docker := dockerClient
+		haManager.WithServiceResolver(func(ctx context.Context, serviceID string) (string, int, error) {
+			var name, projectID string
+			var port int
+			err := db.QueryRowContext(ctx,
+				`SELECT name, project_id::text, COALESCE(port, 0) FROM services WHERE id = $1`,
+				serviceID,
+			).Scan(&name, &projectID, &port)
+			if err != nil {
+				return "", 0, err
+			}
+			if err := docker.ConnectSelfToNetwork(ctx, deployment.ProjectNetworkName(projectID)); err != nil {
+				return "", 0, err
+			}
+			return name, port, nil
+		})
+	}
 	haAPIManager := NewHAManager(haManager)
 
 	// Initialize scaling handler
@@ -69,6 +101,45 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 	// Initialize database handler
 	databaseHandler := NewDatabaseHandler(db.DB, dockerClient)
 
+	// Per-service serialized deploy queue — one active deployment per
+	// service, the rest wait as 'queued'.
+	deployQueue := deployqueue.New()
+
+	// Encrypt-at-rest for secret env vars. SECRETS_KEY wins, JWT_SECRET is
+	// the fallback so existing installs need no new config.
+	secrets.Configure(os.Getenv("SECRETS_KEY"), cfg.JWTSecret)
+
+	// Boot sweep: in-memory engine state dies on restart, so anything that
+	// looked in-flight is actually orphaned — mark it failed rather than
+	// leaving phantom 'building'/'queued' rows.
+	_, _ = db.Exec(
+		`UPDATE deployments SET status = 'failed', error = 'Interrupted by server restart', completed_at = NOW(), updated_at = NOW()
+		 WHERE status IN ('queued', 'pending', 'building', 'deploying', 'rolling_back')`,
+	)
+
+	// Boot sweep: encrypt any plaintext secret values left over from before
+	// encryption-at-rest landed. Transparent and idempotent.
+	if encRows, err := db.Query(`SELECT id, value FROM environment_variables WHERE is_secret = TRUE`); err == nil {
+		type encRow struct {
+			id    string
+			value string
+		}
+		var toEncrypt []encRow
+		for encRows.Next() {
+			var r encRow
+			if err := encRows.Scan(&r.id, &r.value); err == nil && !secrets.IsEncrypted(r.value) {
+				toEncrypt = append(toEncrypt, r)
+			}
+		}
+		encRows.Close()
+		for _, r := range toEncrypt {
+			_, _ = db.Exec(`UPDATE environment_variables SET value = $1, updated_at = NOW() WHERE id = $2`, secrets.Encrypt(r.value), r.id)
+		}
+		if len(toEncrypt) > 0 {
+			log.Printf("secrets: encrypted %d plaintext secret variable(s)", len(toEncrypt))
+		}
+	}
+
 	// Initialize security handler
 	securityHandler := NewSecurityHandler(db, cfg.JWTSecret)
 
@@ -86,6 +157,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		if deploymentEngine != nil {
 			c.Set("deployment_engine", deploymentEngine)
 		}
+		c.Set("deploy_queue", deployQueue)
 		c.Set("scheduler", scheduler)
 		c.Set("metrics_collector", metricsCollector)
 		c.Set("auto_scaler", autoScaler)
@@ -94,6 +166,9 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		c.Next()
 	})
 
+	// Seed the official service template catalog (idempotent upserts).
+	go SeedOfficialTemplates(context.Background(), db)
+
 	go func() {
 		if err := haManager.Start(context.Background()); err != nil {
 			log.Printf("HA manager exited: %v", err)
@@ -134,7 +209,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 
 		if redis == nil {
 			redisStatus = "unhealthy"
-			checks["redis"] = redisStatus
+			checks["redis"] = "unhealthy"
 			checks["redisError"] = "redis client not initialized"
 			overallStatus = "degraded"
 			statusCode = http.StatusServiceUnavailable
@@ -173,153 +248,200 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			public.GET("/auth/bootstrap", handleAuthBootstrap)
 			public.POST("/auth/login", handleLogin)
 			public.POST("/auth/register", handleRegister)
+			public.GET("/maintenance", handleMaintenancePage)
 		}
 
-		// Protected routes (authentication required)
-		protected := v1.Group("/")
-		protected.Use(middleware.Auth(cfg.JWTSecret))
+		// Read routes — public browsing. OptionalAuth resolves a session when
+		// present so handlers can widen visibility for owners/admins; anonymous
+		// callers see approved resources only.
+		read := v1.Group("/")
+		read.Use(middleware.OptionalAuth(cfg.JWTSecret))
 		{
-			// User routes
-			protected.GET("/user/profile", handleGetProfile)
-			protected.PUT("/user/profile", handleUpdateProfile)
-			protected.POST("/users", handleCreateUser)
+			read.GET("/projects", handleGetProjects)
+			read.GET("/projects/:id", handleGetProject)
+			read.GET("/projects/:id/services", handleGetServices)
+			read.GET("/projects/:id/preview-environments", handleGetPreviewEnvironments)
+			read.GET("/projects/:id/security/history", securityHandler.GetProjectSecurityHistory)
+			read.GET("/projects/:id/vulnerabilities", securityHandler.GetVulnerabilities)
+			read.GET("/projects/:id/security/metrics", securityHandler.GetSecurityMetrics)
 
-			// Project routes
-			protected.GET("/projects", handleGetProjects)
-			protected.POST("/projects", handleCreateProject)
+			read.GET("/services/:id", handleGetService)
+			read.GET("/services/:id/metrics", handleGetServiceMetrics)
+			read.GET("/services/:id/runtime", handleGetServiceRuntime)
+			read.GET("/services/:id/deployments", handleGetDeployments)
+			read.GET("/services/:id/domains", handleListServiceDomains)
+			read.GET("/services/:id/domains/check", handleCheckServiceDomains)
+			read.GET("/deployments", handleGetRecentDeployments)
+			read.GET("/deployments/:id", handleGetDeployment)
 
-			// Service routes (nested under projects)
-			protected.GET("/projects/:id/services", handleGetServices)
-			protected.POST("/projects/:id/services", handleCreateService)
+			read.GET("/databases", databaseHandler.GetDatabases)
+			read.GET("/databases/:id", databaseHandler.GetDatabase)
 
-			// Generic project routes
-			protected.GET("/projects/:id", handleGetProject)
-			protected.PUT("/projects/:id", handleUpdateProject)
-			protected.DELETE("/projects/:id", handleDeleteProject)
+			read.GET("/templates", handleGetTemplates)
+			read.GET("/templates/:id", handleGetTemplate)
 
-			// Service routes
-			protected.GET("/services/:id", handleGetService)
-			protected.PUT("/services/:id", handleUpdateService)
-			protected.DELETE("/services/:id", handleDeleteService)
-			protected.GET("/services/:id/metrics", handleGetServiceMetrics)
+			read.GET("/cron-jobs", handleGetCronJobs)
+			read.GET("/cron-jobs/:id", handleGetCronJob)
+			read.GET("/cron-jobs/:id/executions", handleGetCronExecutions)
 
-			// Deployment routes
-			protected.GET("/services/:id/deployments", handleGetDeployments)
-			protected.POST("/services/:id/deployments", handleCreateDeployment)
-			protected.GET("/deployments/:id", handleGetDeployment)
-			protected.POST("/deployments/:id/rollback", handleRollbackDeployment)
+			read.GET("/security/scans/:id", securityHandler.GetSecurityScan)
+			read.GET("/security/compliance/reports/:id", securityHandler.GetComplianceReport)
+			read.GET("/security/compliance/frameworks", securityHandler.GetComplianceFrameworks)
 
-			// Environment variables routes
-			protected.GET("/services/:id/variables", handleGetVariables)
-			protected.PUT("/services/:id/variables", handleUpdateVariables)
+			read.GET("/preview-environments/:id", handleGetPreviewEnvironment)
 
-			// Logs routes
-			protected.GET("/services/:id/logs", handleGetLogs)
-			protected.GET("/deployments/:id/logs", handleGetDeploymentLogs)
+			read.GET("/system/upgrade/status", handleGetUpgradeStatus)
+			read.GET("/system/host", handleGetHostMonitoring)
 
-			// One-off exec console (docker exec, 30s ceiling)
-			protected.POST("/services/:id/exec", handleExecInService)
+			// HA + scaling read endpoints (status, policies, health, alerts)
+			haAPIManager.RegisterReadRoutes(read)
+			scalingHandler.RegisterReadRoutes(read)
+		}
 
-			// Git integration routes
-			protected.GET("/git/github-app/install-url", handleGetGitHubAppInstallURL)
-			protected.POST("/git/github-app/connect", handleConnectGitHubApp)
-			protected.GET("/git/providers", handleGetGitProviders)
-			protected.POST("/git/providers", handleCreateGitProvider)
-			protected.DELETE("/git/providers/:providerId", handleDeleteGitProvider)
-			protected.GET("/git/providers/:providerId/repositories", handleGetGitRepositories)
-			protected.GET("/git/providers/:providerId/repositories/:owner/:repo/branches", handleGetGitRepositoryBranches)
-			protected.POST("/git/repositories/connect", handleConnectGitRepository)
-			protected.GET("/git/repositories", handleGetConnectedRepositories)
-			protected.POST("/git/webhooks", handleCreateWebhook)
+		// Authenticated routes — a valid session is required and handlers
+		// enforce ownership; platform admins additionally pass every check.
+		authed := v1.Group("/")
+		authed.Use(middleware.Auth(cfg.JWTSecret))
+		authed.Use(middleware.Idempotency())
+		{
+			authed.GET("/user/profile", handleGetProfile)
+			authed.PUT("/user/profile", handleUpdateProfile)
 
-			// Build routes
-			protected.POST("/builds", buildHandler.StartBuild)
-			protected.GET("/builds", buildHandler.ListBuilds)
-			protected.GET("/builds/:id", buildHandler.GetBuildStatus)
-			protected.POST("/builds/:id/cancel", buildHandler.CancelBuild)
-			protected.GET("/builds/:id/logs", buildHandler.GetBuildLogs)
-			protected.POST("/builds/plan", buildHandler.GetBuildPlan)
-			protected.GET("/builds/detect", buildHandler.DetectBuildType)
+			// Personal access tokens for CLI/MCP/agent auth.
+			authed.GET("/user/tokens", handleListUserTokens)
+			authed.POST("/user/tokens", handleCreateUserToken)
+			authed.DELETE("/user/tokens/:id", handleDeleteUserToken)
 
-			// System routes
-			protected.GET("/system/upgrade/status", handleGetUpgradeStatus)
-			protected.POST("/system/upgrade/pull", handlePullUpgradeImage)
-			protected.GET("/system/host", handleGetHostMonitoring)
-
-			// Scaling routes
-			scalingHandler.RegisterRoutes(protected)
-			haAPIManager.RegisterRoutes(protected)
-
-			// Database routes
-			protected.GET("/databases", databaseHandler.GetDatabases)
-			protected.POST("/databases", databaseHandler.CreateDatabase)
-			protected.GET("/databases/:id", databaseHandler.GetDatabase)
-			protected.PUT("/databases/:id", databaseHandler.UpdateDatabase)
-			protected.DELETE("/databases/:id", databaseHandler.DeleteDatabase)
-			protected.POST("/databases/:id/action", databaseHandler.PerformDatabaseAction)
-			protected.POST("/databases/:id/backup", databaseHandler.CreateBackup)
-			protected.POST("/databases/:id/restore", databaseHandler.RestoreBackup)
-			protected.GET("/databases/:id/backups/:bid/download", databaseHandler.DownloadBackup)
-
-			// Notification routes
-			protected.GET("/notifications", handleListNotifications)
-			protected.POST("/notifications/:id/read", handleMarkNotificationRead)
-			protected.POST("/notifications/read-all", handleMarkAllNotificationsRead)
-
-			// Node Agent routes
-			agentHandler.SetupRoutes(protected)
-
-			// Preview Environments routes
-			protected.GET("/projects/:id/preview-environments", handleGetPreviewEnvironments)
-			protected.POST("/projects/:id/preview-environments", handleCreatePreviewEnvironment)
-			protected.GET("/preview-environments/:id", handleGetPreviewEnvironment)
-			protected.PUT("/preview-environments/:id", handleUpdatePreviewEnvironment)
-			protected.DELETE("/preview-environments/:id", handleDeletePreviewEnvironment)
-			protected.POST("/preview-environments/:id/promote", handlePromotePreviewEnvironment)
-			protected.POST("/preview-environments/cleanup-expired", handleCleanupExpiredPreviewEnvironments)
-
-			// Security routes
-			protected.POST("/security/scans", securityHandler.StartSecurityScan)
-			protected.GET("/security/scans/:id", securityHandler.GetSecurityScan)
-			protected.GET("/projects/:id/security/history", securityHandler.GetProjectSecurityHistory)
-			protected.GET("/projects/:id/vulnerabilities", securityHandler.GetVulnerabilities)
-			protected.PUT("/vulnerabilities/:id", securityHandler.UpdateVulnerability)
-			protected.POST("/security/compliance/assess", securityHandler.StartComplianceAssessment)
-			protected.GET("/security/compliance/reports/:id", securityHandler.GetComplianceReport)
-			protected.GET("/security/compliance/frameworks", securityHandler.GetComplianceFrameworks)
-			protected.POST("/security/compliance/gdpr/init", securityHandler.InitializeGDPRFramework)
-			protected.GET("/projects/:id/security/metrics", securityHandler.GetSecurityMetrics)
-			protected.GET("/projects/:id/security/audit-logs", securityHandler.GetAuditLogs)
+			authed.GET("/notifications", handleListNotifications)
+			authed.POST("/notifications/:id/read", handleMarkNotificationRead)
+			authed.POST("/notifications/read-all", handleMarkAllNotificationsRead)
 
 			// WebSocket endpoint
-			protected.GET("/ws", handleWebSocket)
+			authed.GET("/ws", handleWebSocket)
 
-			// Templates routes
-			protected.GET("/templates", handleGetTemplates)
-			protected.GET("/templates/:id", handleGetTemplate)
-			protected.POST("/templates/:id/deploy", handleCreateFromTemplate)
+			// Owned-resource mutations — handlers scope to the caller and
+			// admit admins. New projects land unapproved until an admin
+			// publishes them.
+			authed.POST("/projects", handleCreateProject)
+			authed.POST("/projects/:id/services", handleCreateService)
+			authed.PUT("/projects/:id", handleUpdateProject)
+			authed.DELETE("/projects/:id", handleDeleteProject)
 
-			// Cron Jobs routes
-			protected.GET("/cron-jobs", handleGetCronJobs)
-			protected.POST("/cron-jobs", handleCreateCronJob)
-			protected.GET("/cron-jobs/:id", handleGetCronJob)
-			protected.PUT("/cron-jobs/:id", handleUpdateCronJob)
-			protected.DELETE("/cron-jobs/:id", handleDeleteCronJob)
-			protected.GET("/cron-jobs/:id/executions", handleGetCronExecutions)
-			protected.POST("/cron-jobs/:id/trigger", handleTriggerCronJob)
+			authed.PUT("/services/:id", handleUpdateService)
+			authed.DELETE("/services/:id", handleDeleteService)
+			authed.POST("/services/:id/domains", handleAddServiceDomain)
+			authed.DELETE("/services/:id/domains/:domain_id", handleDeleteServiceDomain)
+			authed.POST("/services/:id/domains/:domain_id/default", handleSetDefaultDomain)
+			authed.POST("/services/:id/start", handleServiceStart)
+			authed.POST("/services/:id/stop", handleServiceStop)
+			authed.POST("/services/:id/restart", handleServiceRestart)
+			authed.POST("/services/:id/redeploy", handleServiceRedeploy)
+			authed.POST("/services/:id/deployments", handleCreateDeployment)
+			authed.POST("/deployments/:id/rollback", handleRollbackDeployment)
+			authed.POST("/deployments/:id/cancel", handleCancelDeployment)
 
-			// Audit Logs routes
-			protected.GET("/audit-logs", handleGetAuditLogs)
-			protected.GET("/audit-logs/:resource/:id", handleGetResourceAuditLogs)
+			// Environment variables — secrets, owner/admin only.
+			authed.GET("/services/:id/variables", handleGetVariables)
+			authed.PUT("/services/:id/variables", handleUpdateVariables)
+
+			// Runtime logs — container stdout routinely echoes secrets,
+			// so these stay behind authentication like build logs.
+			authed.GET("/services/:id/logs", handleGetLogs)
+			authed.GET("/deployments/:id/logs", handleGetDeploymentLogs)
+
+			// One-off exec console (docker exec, 30s ceiling)
+			authed.POST("/services/:id/exec", handleExecInService)
+
+			// Git integration — providers carry per-user credentials.
+			authed.GET("/git/github-app/install-url", handleGetGitHubAppInstallURL)
+			authed.POST("/git/github-app/connect", handleConnectGitHubApp)
+			authed.GET("/git/providers", handleGetGitProviders)
+			authed.POST("/git/providers", handleCreateGitProvider)
+			authed.DELETE("/git/providers/:providerId", handleDeleteGitProvider)
+			authed.GET("/git/providers/:providerId/repositories", handleGetGitRepositories)
+			authed.GET("/git/providers/:providerId/repositories/:owner/:repo/branches", handleGetGitRepositoryBranches)
+			authed.POST("/git/repositories/connect", handleConnectGitRepository)
+			authed.GET("/git/repositories", handleGetConnectedRepositories)
+			authed.POST("/git/webhooks", handleCreateWebhook)
+
+			// Builds have no per-user scoping and logs may carry secrets —
+			// keep every build endpoint behind authentication.
+			authed.POST("/builds", buildHandler.StartBuild)
+			authed.GET("/builds", buildHandler.ListBuilds)
+			authed.GET("/builds/:id", buildHandler.GetBuildStatus)
+			authed.GET("/builds/:id/logs", buildHandler.GetBuildLogs)
+			authed.GET("/builds/detect", buildHandler.DetectBuildType)
+			authed.POST("/builds/:id/cancel", buildHandler.CancelBuild)
+			authed.POST("/builds/plan", buildHandler.GetBuildPlan)
+
+			authed.POST("/databases", databaseHandler.CreateDatabase)
+			authed.PUT("/databases/:id", databaseHandler.UpdateDatabase)
+			authed.DELETE("/databases/:id", databaseHandler.DeleteDatabase)
+			authed.POST("/databases/:id/action", databaseHandler.PerformDatabaseAction)
+			authed.POST("/databases/:id/backup", databaseHandler.CreateBackup)
+			authed.POST("/databases/:id/restore", databaseHandler.RestoreBackup)
+			authed.GET("/databases/:id/backups/:bid/download", databaseHandler.DownloadBackup)
+
+			authed.POST("/projects/:id/preview-environments", handleCreatePreviewEnvironment)
+			authed.PUT("/preview-environments/:id", handleUpdatePreviewEnvironment)
+			authed.DELETE("/preview-environments/:id", handleDeletePreviewEnvironment)
+			authed.POST("/preview-environments/:id/promote", handlePromotePreviewEnvironment)
+
+			authed.POST("/security/scans", securityHandler.StartSecurityScan)
+			authed.PUT("/vulnerabilities/:id", securityHandler.UpdateVulnerability)
+			authed.POST("/security/compliance/assess", securityHandler.StartComplianceAssessment)
+			authed.POST("/security/compliance/gdpr/init", securityHandler.InitializeGDPRFramework)
+			authed.GET("/projects/:id/security/audit-logs", securityHandler.GetAuditLogs)
+
+			// User templates — ownership enforced inside the handlers.
+			authed.POST("/templates", handleCreateTemplate)
+			authed.PUT("/templates/:id", handleUpdateTemplate)
+			authed.DELETE("/templates/:id", handleDeleteTemplate)
+			authed.POST("/templates/:id/deploy", handleCreateFromTemplate)
+
+			authed.POST("/cron-jobs", handleCreateCronJob)
+			authed.PUT("/cron-jobs/:id", handleUpdateCronJob)
+			authed.DELETE("/cron-jobs/:id", handleDeleteCronJob)
+			authed.POST("/cron-jobs/:id/trigger", handleTriggerCronJob)
+		}
+
+		// Admin routes — platform-wide controls and cross-user management.
+		admin := v1.Group("/")
+		admin.Use(middleware.Auth(cfg.JWTSecret))
+		admin.Use(middleware.Idempotency())
+		admin.Use(middleware.RequireAdmin())
+		{
+			admin.GET("/admin/overview", handleAdminOverview)
+			admin.GET("/admin/users", handleAdminListUsers)
+			admin.PATCH("/admin/users/:id", handleAdminSetUserAdmin)
+			admin.PATCH("/admin/projects/:id", handleAdminSetProjectApproval)
+
+			admin.POST("/users", handleCreateUser)
+
+			admin.GET("/settings", handleGetSettings)
+			admin.PUT("/settings", handleUpdateSettings)
+
+			admin.POST("/system/upgrade/pull", handlePullUpgradeImage)
+			admin.POST("/preview-environments/cleanup-expired", handleCleanupExpiredPreviewEnvironments)
+
+			// HA + scaling + agent mutations — platform-level controls.
+			haAPIManager.RegisterAdminRoutes(admin)
+			scalingHandler.RegisterAdminRoutes(admin)
+			agentHandler.SetupAdminRoutes(admin)
+
+			admin.GET("/admin/volumes", handleAdminListVolumes)
+			admin.DELETE("/admin/volumes/:name", handleAdminDeleteVolume)
+			admin.GET("/audit-logs", handleGetAuditLogs)
+			admin.GET("/audit-logs/:resource/:id", handleGetResourceAuditLogs)
 
 			// API Gateway routes (merged APwhy) - namespaced to avoid
 			// colliding with Containr's own /services paths.
-			gateway := protected.Group("/gateway")
+			gateway := admin.Group("/gateway")
 			{
 				gateway.GET("/services", handleAPwhyServicesList)
 				gateway.POST("/services", handleAPwhyServicesCreate)
 				gateway.PATCH("/services/:id", handleAPwhyServicesPatch)
-				gateway.GET("/services/:id/validate", handleAPwhyServiceValidate)
+				gateway.GET("/services/:id", handleAPwhyServiceValidate)
 
 				gateway.GET("/keys", handleAPwhyKeysList)
 				gateway.POST("/keys", handleAPwhyKeysCreate)

app/backend/internal/api/runtime.go

@@ -0,0 +1,640 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/deployment"
+	"containr/internal/deployqueue"
+	"containr/internal/secrets"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// serviceRuntimeSpec builds the container spec for a service: stored env vars
+// merged with ${{Service.KEY}} references resolved across the project.
+func serviceRuntimeSpec(db *database.DB, service Service) (deployment.RuntimeSpec, error) {
+	env, err := resolveServiceEnv(db, service)
+	if err != nil {
+		return deployment.RuntimeSpec{}, err
+	}
+
+	spec := deployment.RuntimeSpec{
+		ProjectID:     service.ProjectID.String(),
+		ServiceID:     service.ID.String(),
+		Name:          service.Name,
+		Image:         service.Image,
+		Env:           env,
+		Replicas:      service.Replicas,
+		Port:          int32(service.Port),
+		Domain:        service.Domain,
+		HealthPath:    service.HealthCheckPath,
+		RestartPolicy: service.RestartPolicy,
+	}
+	// Best effort: reuse the host port from the last live deployment so the
+	// public URL survives restarts. Column exists post-migration; older DBs
+	// silently get ephemeral ports.
+	_ = db.QueryRow(`SELECT published_port FROM services WHERE id = $1`, service.ID).Scan(&spec.PublishedPort)
+	if cmd := strings.TrimSpace(service.Command); cmd != "" {
+		spec.Command = strings.Fields(cmd)
+	}
+	if spec.Replicas < 1 {
+		spec.Replicas = 1
+	}
+	if spec.RestartPolicy == "" {
+		spec.RestartPolicy = "unless-stopped"
+	}
+	spec.NanoCPUs = parseCPULimit(service.CPU)
+	spec.MemoryBytes = parseMemoryLimit(service.Memory)
+	spec.MemoryReserve = parseMemoryLimit(service.MemoryReserve)
+	spec.CPUShares = parseCPUReserveShares(service.CPUReserve)
+	if service.Builder == "static" && spec.Port == 0 {
+		// The static builder's image is nginx; expose its default port so
+		// Traefik has something to route to without extra config.
+		spec.Port = 80
+	}
+	spec.Volumes = loadServiceVolumes(db, service.ID)
+	spec.Domains = serviceDomainNames(db, service.ID, service.Domain)
+	spec.Maintenance, spec.BasicAuthUsers = serviceAccess(db, service.ID)
+	if spec.Maintenance {
+		spec.MaintenanceURL = maintenanceURL(db)
+	}
+	if spec.Port > 0 {
+		env["PORT"] = strconv.Itoa(service.Port)
+	}
+	return spec, nil
+}
+
+var refVarPattern = regexp.MustCompile(`\$\{\{\s*([A-Za-z0-9_-]+)\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}`)
+
+// resolveServiceEnv loads the service's variables (real values, including
+// secrets) and expands ${{service.KEY}} references. KEY may be a variable on
+// the referenced service, or the builtins HOST (service name alias) and PORT.
+func resolveServiceEnv(db *database.DB, service Service) (map[string]string, error) {
+	rows, err := db.Query(
+		`SELECT key, value FROM environment_variables WHERE service_id = $1`,
+		service.ID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	env := map[string]string{}
+	for rows.Next() {
+		var k, v string
+		if err := rows.Scan(&k, &v); err != nil {
+			return nil, err
+		}
+		env[k] = secrets.Decrypt(v)
+	}
+
+	var refServices []struct{ ID, Name string }
+	svcRows, err := db.Query(
+		`SELECT id, name FROM services WHERE project_id = $1`,
+		service.ProjectID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer svcRows.Close()
+	for svcRows.Next() {
+		var s struct{ ID, Name string }
+		if err := svcRows.Scan(&s.ID, &s.Name); err != nil {
+			return nil, err
+		}
+		refServices = append(refServices, s)
+	}
+
+	byName := map[string]string{}
+	for _, s := range refServices {
+		byName[strings.ToLower(s.Name)] = s.ID
+	}
+
+	resolve := func(serviceName, key string) (string, bool) {
+		id, ok := byName[strings.ToLower(serviceName)]
+		if !ok {
+			return "", false
+		}
+		switch strings.ToUpper(key) {
+		case "HOST":
+			return serviceName, true
+		case "PORT":
+			var port int
+			if err := db.QueryRow(`SELECT COALESCE(port, 0) FROM services WHERE id = $1`, id).Scan(&port); err == nil && port > 0 {
+				return strconv.Itoa(port), true
+			}
+			return "", false
+		}
+		var value string
+		err := db.QueryRow(
+			`SELECT value FROM environment_variables WHERE service_id = $1 AND key = $2`,
+			id, key,
+		).Scan(&value)
+		if err != nil {
+			return "", false
+		}
+		return secrets.Decrypt(value), true
+	}
+
+	for k, v := range env {
+		env[k] = refVarPattern.ReplaceAllStringFunc(v, func(match string) string {
+			parts := refVarPattern.FindStringSubmatch(match)
+			if len(parts) != 3 {
+				return match
+			}
+			if resolved, ok := resolve(parts[1], parts[2]); ok {
+				return resolved
+			}
+			return match
+		})
+	}
+	return env, nil
+}
+
+func parseCPULimit(cpu string) int64 {
+	v, err := strconv.ParseFloat(strings.TrimSpace(cpu), 64)
+	if err != nil || v <= 0 {
+		return 0
+	}
+	return int64(v * 1e9)
+}
+
+// parseCPUReserveShares maps a cpu fraction to Docker's relative share
+// weight: 1024 shares ≈ one CPU.
+func parseCPUReserveShares(cpu string) int64 {
+	v, err := strconv.ParseFloat(strings.TrimSpace(cpu), 64)
+	if err != nil || v <= 0 {
+		return 0
+	}
+	return int64(v * 1024)
+}
+
+// validateCPUSpec and validateMemorySpec reject values that silently parse
+// to zero — a typo like "512mb" must fail loudly instead of dropping the limit.
+func validateCPUSpec(v string) error {
+	if s := strings.TrimSpace(v); s != "" && parseCPULimit(s) <= 0 {
+		return fmt.Errorf("must be a positive cpu fraction (e.g. 0.5, 2)")
+	}
+	return nil
+}
+
+func validateMemorySpec(v string) error {
+	if s := strings.TrimSpace(v); s != "" && parseMemoryLimit(s) <= 0 {
+		return fmt.Errorf("must be bytes with unit (e.g. 256Mi, 1g)")
+	}
+	return nil
+}
+
+var memUnits = map[string]int64{"k": 1e3, "m": 1e6, "g": 1e9, "ki": 1 << 10, "mi": 1 << 20, "gi": 1 << 30}
+
+func parseMemoryLimit(mem string) int64 {
+	s := strings.ToLower(strings.TrimSpace(mem))
+	for suffix, mult := range memUnits {
+		if strings.HasSuffix(s, suffix) {
+			if v, err := strconv.ParseFloat(strings.TrimSuffix(s, suffix), 64); err == nil {
+				return int64(v * float64(mult))
+			}
+		}
+	}
+	if v, err := strconv.ParseInt(s, 10, 64); err == nil {
+		return v
+	}
+	return 0
+}
+
+func getRuntimeEngine(c *gin.Context) (*deployment.DeploymentEngine, *database.DB, bool) {
+	dbValue, exists := c.Get("db")
+	if !exists {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Database connection not available"})
+		return nil, nil, false
+	}
+	engineValue, exists := c.Get("deployment_engine")
+	if !exists || engineValue == nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "Deployment engine unavailable. Docker may not be configured on this server."})
+		return nil, nil, false
+	}
+	return engineValue.(*deployment.DeploymentEngine), dbValue.(*database.DB), true
+}
+
+func loadOwnedService(c *gin.Context, db *database.DB) (Service, bool) {
+	serviceID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return Service{}, false
+	}
+	userID, exists := c.Get("user_id")
+	if !exists {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
+		return Service{}, false
+	}
+
+	var service Service
+	var owner string
+	err = db.QueryRow(
+		`SELECT s.id, s.project_id, s.name,
+		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
+		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
+		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
+		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
+		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
+		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
+		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
+		        COALESCE(s.restart_policy, 'unless-stopped'),
+		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
+		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
+		        COALESCE(s.static_dir, ''),
+		        s.created_at, s.updated_at, p.owner_id
+		 FROM services s JOIN projects p ON s.project_id = p.id
+		 WHERE s.id = $1`,
+		serviceID,
+	).Scan(
+		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
+		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
+		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
+		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
+		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
+		&service.CreatedAt, &service.UpdatedAt, &owner,
+	)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return Service{}, false
+	}
+	if owner != userID.(string) && !isAdminUser(db, userID.(string)) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+		return Service{}, false
+	}
+	return service, true
+}
+
+// loadReadableService loads a service when the caller may read its project:
+// approved projects are public, unapproved ones need owner/member/admin.
+func loadReadableService(c *gin.Context, db *database.DB) (Service, bool) {
+	serviceID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid service ID"})
+		return Service{}, false
+	}
+
+	var service Service
+	var projectID uuid.UUID
+	err = db.QueryRow(
+		`SELECT s.id, s.project_id, s.name,
+		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
+		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
+		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
+		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
+		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
+		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
+		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
+		        COALESCE(s.restart_policy, 'unless-stopped'),
+		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
+		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
+		        COALESCE(s.static_dir, ''),
+		        s.created_at, s.updated_at, s.project_id
+		 FROM services s
+		 WHERE s.id = $1`,
+		serviceID,
+	).Scan(
+		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
+		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
+		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
+		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
+		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
+		&service.CreatedAt, &service.UpdatedAt, &projectID,
+	)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return Service{}, false
+	}
+	if _, allowed := projectReadAccess(c, db, projectID); !allowed {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
+		return Service{}, false
+	}
+	return service, true
+}
+
+// handleServiceRuntime returns live container state for a service.
+func handleGetServiceRuntime(c *gin.Context) {
+	engine, db, ok := getRuntimeEngine(c)
+	if !ok {
+		return
+	}
+	service, ok := loadReadableService(c, db)
+	if !ok {
+		return
+	}
+	state, err := engine.RuntimeState(c.Request.Context(), service.ID.String(), service.Replicas)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	engine.ProbeServiceHealth(c.Request.Context(), state, service.ProjectID.String(), service.Name, service.Port, service.HealthCheckPath)
+	persistPublishedPort(db, service.ID, state.Ports)
+	if host := requestHostname(c); host != "" {
+		for i, u := range state.URLs {
+			state.URLs[i] = rewriteLoopbackURL(u, host)
+		}
+	}
+	c.JSON(http.StatusOK, gin.H{"runtime": state})
+}
+
+func reconcileNow(c *gin.Context, engine *deployment.DeploymentEngine, db *database.DB, service Service) bool {
+	spec, err := serviceRuntimeSpec(db, service)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return false
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	state, err := engine.ReconcileService(ctx, spec)
+	if err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		return false
+	}
+	status := "stopped"
+	if state != nil {
+		status = state.Status
+		persistPublishedPort(db, service.ID, state.Ports)
+	}
+	_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
+	c.JSON(http.StatusOK, gin.H{"runtime": state})
+	return true
+}
+
+// handleServiceStart starts all stopped replicas.
+func handleServiceStart(c *gin.Context) {
+	engine, db, ok := getRuntimeEngine(c)
+	if !ok {
+		return
+	}
+	service, ok := loadOwnedService(c, db)
+	if !ok {
+		return
+	}
+	if err := engine.StartService(c.Request.Context(), service.ID.String()); err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		return
+	}
+	_, _ = db.Exec(`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	c.JSON(http.StatusOK, gin.H{"status": "running"})
+}
+
+// handleServiceStop stops all replicas without removing them.
+func handleServiceStop(c *gin.Context) {
+	engine, db, ok := getRuntimeEngine(c)
+	if !ok {
+		return
+	}
+	service, ok := loadOwnedService(c, db)
+	if !ok {
+		return
+	}
+	if err := engine.StopService(c.Request.Context(), service.ID.String()); err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		return
+	}
+	_, _ = db.Exec(`UPDATE services SET status = 'stopped', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	c.JSON(http.StatusOK, gin.H{"status": "stopped"})
+}
+
+// handleServiceRestart restarts all replicas.
+func handleServiceRestart(c *gin.Context) {
+	engine, db, ok := getRuntimeEngine(c)
+	if !ok {
+		return
+	}
+	service, ok := loadOwnedService(c, db)
+	if !ok {
+		return
+	}
+	ctx := c.Request.Context()
+	if err := engine.StopService(ctx, service.ID.String()); err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		return
+	}
+	if err := engine.StartService(ctx, service.ID.String()); err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
+		return
+	}
+	_, _ = db.Exec(`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	c.JSON(http.StatusOK, gin.H{"status": "running"})
+}
+
+// handleServiceRedeploy re-applies the current spec: pulls the image for
+// image-sourced services and reconciles containers (env, ports, replicas).
+// Runs through the per-service deploy queue so it never overlaps a build.
+func handleServiceRedeploy(c *gin.Context) {
+	engine, db, ok := getRuntimeEngine(c)
+	if !ok {
+		return
+	}
+	service, ok := loadOwnedService(c, db)
+	if !ok {
+		return
+	}
+
+	image := service.Image
+	if image == "" {
+		// Git-sourced service: reuse the last successful deployment image.
+		err := db.QueryRow(
+			`SELECT image_name || ':' || image_tag FROM deployments
+			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
+			 ORDER BY created_at DESC LIMIT 1`,
+			service.ID,
+		).Scan(&image)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "No deployable image yet — run a deployment first"})
+			return
+		}
+	}
+	service.Image = image
+
+	finished := make(chan struct{})
+	var recErr error
+	var state *deployment.RuntimeState
+	getDeployQueue(c).Enqueue(service.ID, deployqueue.Job{Run: func(jctx context.Context) {
+		defer close(finished)
+		state, recErr = reconcileServiceJob(jctx, db, engine, service)
+	}})
+
+	select {
+	case <-finished:
+		if recErr != nil {
+			c.JSON(http.StatusBadGateway, gin.H{"error": recErr.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"runtime": state})
+	case <-c.Request.Context().Done():
+		c.JSON(http.StatusAccepted, gin.H{"status": "queued"})
+	}
+}
+
+// reconcileServiceJob is the shared queue-job body for redeploy paths:
+// build the spec from current DB state, reconcile containers, persist the
+// resulting status and published port.
+func reconcileServiceJob(ctx context.Context, db *database.DB, engine *deployment.DeploymentEngine, service Service) (*deployment.RuntimeState, error) {
+	spec, err := serviceRuntimeSpec(db, service)
+	if err != nil {
+		return nil, err
+	}
+	state, err := engine.ReconcileService(ctx, spec)
+	if err != nil {
+		return nil, err
+	}
+	if state != nil {
+		persistPublishedPort(db, service.ID, state.Ports)
+		status := "stopped"
+		if state.Status != "" {
+			status = state.Status
+		}
+		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
+	}
+	return state, nil
+}
+
+// enqueueServiceRedeploy resolves a deployable image (service.Image, else
+// the last successful deployment's tag) and queues a reconcile. Returns
+// false when no image is available or the engine is missing.
+func enqueueServiceRedeploy(c *gin.Context, db *database.DB, service Service) bool {
+	engineValue, exists := c.Get("deployment_engine")
+	if !exists || engineValue == nil {
+		return false
+	}
+	engine, ok := engineValue.(*deployment.DeploymentEngine)
+	if !ok {
+		return false
+	}
+	image := service.Image
+	if image == "" {
+		if err := db.QueryRow(
+			`SELECT image_name || ':' || image_tag FROM deployments
+			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
+			 ORDER BY created_at DESC LIMIT 1`,
+			service.ID,
+		).Scan(&image); err != nil {
+			return false
+		}
+	}
+	service.Image = image
+	getDeployQueue(c).Enqueue(service.ID, deployqueue.Job{Run: func(jctx context.Context) {
+		_, _ = reconcileServiceJob(jctx, db, engine, service)
+	}})
+	return true
+}
+
+// persistPublishedPort records the host port Docker actually bound so later
+// redeploys can reuse it. Idempotent — only writes when the value changed.
+func persistPublishedPort(db *database.DB, serviceID uuid.UUID, ports []uint16) {
+	if len(ports) == 0 {
+		return
+	}
+	_, _ = db.Exec(
+		`UPDATE services SET published_port = $1 WHERE id = $2 AND published_port <> $1`,
+		int(ports[0]), serviceID,
+	)
+}
+
+// liveServiceStatus reconciles the stored status with real container state.
+// No-op when Docker is unavailable — the stored status is returned as-is.
+func liveServiceStatus(c *gin.Context, db *database.DB, service *Service) {
+	engineValue, exists := c.Get("deployment_engine")
+	if !exists || engineValue == nil {
+		return
+	}
+	engine := engineValue.(*deployment.DeploymentEngine)
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 3*time.Second)
+	defer cancel()
+	state, err := engine.RuntimeState(ctx, service.ID.String(), service.Replicas)
+	if err != nil || state == nil || len(state.Containers) == 0 {
+		return
+	}
+	if state.Status != service.Status {
+		service.Status = state.Status
+		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, state.Status, time.Now(), service.ID)
+	}
+	persistPublishedPort(db, service.ID, state.Ports)
+	if service.Domain != "" {
+		service.PublicURL = "https://" + service.Domain
+	} else if len(state.URLs) > 0 {
+		service.PublicURL = rewriteLoopbackURL(state.URLs[0], requestHostname(c))
+	}
+}
+
+// runtimeScaleService adjusts replica count both in bookkeeping and reality.
+func runtimeScaleService(c *gin.Context, serviceID string, replicas int) error {
+	dbValue, _ := c.Get("db")
+	engineValue, _ := c.Get("deployment_engine")
+	db, _ := dbValue.(*database.DB)
+	engine, _ := engineValue.(*deployment.DeploymentEngine)
+	if db == nil || engine == nil {
+		return fmt.Errorf("runtime unavailable")
+	}
+
+	var service Service
+	var owner string
+	err := db.QueryRow(
+		`SELECT s.id, s.project_id, s.name,
+		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
+		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
+		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
+		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
+		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
+		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
+		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
+		        COALESCE(s.restart_policy, 'unless-stopped'),
+		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
+		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
+		        COALESCE(s.static_dir, ''),
+		        s.created_at, s.updated_at, p.owner_id
+		 FROM services s JOIN projects p ON s.project_id = p.id
+		 WHERE s.id = $1`, serviceID,
+	).Scan(
+		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
+		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
+		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
+		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
+		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
+		&service.CreatedAt, &service.UpdatedAt, &owner,
+	)
+	if err != nil {
+		return err
+	}
+	if service.Image == "" {
+		if err := db.QueryRow(
+			`SELECT image_name || ':' || image_tag FROM deployments
+			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
+			 ORDER BY created_at DESC LIMIT 1`, service.ID,
+		).Scan(&service.Image); err != nil {
+			return fmt.Errorf("no deployed image to scale")
+		}
+	}
+
+	spec, err := serviceRuntimeSpec(db, service)
+	if err != nil {
+		return err
+	}
+	spec.Replicas = replicas
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+	state, err := engine.ReconcileService(ctx, spec)
+	if err != nil {
+		return err
+	}
+	if state != nil {
+		persistPublishedPort(db, service.ID, state.Ports)
+	}
+	_, _ = db.Exec(`UPDATE services SET replicas = $1, updated_at = $2 WHERE id = $3`, replicas, time.Now(), service.ID)
+	return nil
+}

app/backend/internal/api/scaling.go

@@ -24,31 +24,39 @@ func NewScalingHandler(autoScaler *scaling.AutoScaler) *ScalingHandler {
 	}
 }
 
-// RegisterRoutes registers scaling routes
-func (h *ScalingHandler) RegisterRoutes(router *gin.RouterGroup) {
+// RegisterReadRoutes registers public scaling read endpoints.
+func (h *ScalingHandler) RegisterReadRoutes(router *gin.RouterGroup) {
 	scaling := router.Group("/scaling")
 	{
 		scaling.GET("/policies", h.GetScalingPolicies)
-		scaling.POST("/policies", h.SetScalingPolicy)
 		scaling.GET("/policies/:serviceId", h.GetScalingPolicy)
-		scaling.PUT("/policies/:serviceId", h.UpdateScalingPolicy)
-		scaling.DELETE("/policies/:serviceId", h.DeleteScalingPolicy)
 
 		scaling.GET("/services", h.GetServiceStates)
 		scaling.GET("/services/:serviceId", h.GetServiceState)
 		scaling.GET("/services/:serviceId/history", h.GetScalingHistory)
 
-		scaling.POST("/services/:serviceId/scale", h.ManualScale)
-
 		scaling.GET("/status", h.GetScalingStatus)
-		scaling.POST("/enable", h.EnableAutoScaler)
-		scaling.POST("/disable", h.DisableAutoScaler)
 
 		scaling.GET("/metrics", h.GetScalingMetrics)
 		scaling.GET("/events", h.GetScalingEvents)
 	}
 }
 
+// RegisterAdminRoutes registers scaling mutation endpoints.
+func (h *ScalingHandler) RegisterAdminRoutes(router *gin.RouterGroup) {
+	scaling := router.Group("/scaling")
+	{
+		scaling.POST("/policies", h.SetScalingPolicy)
+		scaling.PUT("/policies/:serviceId", h.UpdateScalingPolicy)
+		scaling.DELETE("/policies/:serviceId", h.DeleteScalingPolicy)
+
+		scaling.POST("/services/:serviceId/scale", h.ManualScale)
+
+		scaling.POST("/enable", h.EnableAutoScaler)
+		scaling.POST("/disable", h.DisableAutoScaler)
+	}
+}
+
 // GetScalingPolicies returns all scaling policies
 func (h *ScalingHandler) GetScalingPolicies(c *gin.Context) {
 	states := h.autoScaler.GetAllServiceStates()
@@ -204,7 +212,16 @@ func (h *ScalingHandler) ManualScale(c *gin.Context) {
 
 	event, err := h.autoScaler.ManualScale(c.Request.Context(), serviceID, request.Replicas, strings.TrimSpace(request.Reason))
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		// Service unknown to the autoscaler: the runtime is authoritative —
+		// reconcile containers directly and persist the replica count.
+		if runtimeErr := runtimeScaleService(c, serviceID, request.Replicas); runtimeErr != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "runtime_error": runtimeErr.Error()})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{
+			"message": "Service scaled successfully",
+			"state":   gin.H{"service_id": serviceID, "desired_replicas": request.Replicas},
+		})
 		return
 	}
 
@@ -214,11 +231,19 @@ func (h *ScalingHandler) ManualScale(c *gin.Context) {
 		return
 	}
 
-	c.JSON(http.StatusOK, gin.H{
+	// Apply the replica change to live containers (best effort — the
+	// bookkeeping update above already succeeded).
+	runtimeErr := runtimeScaleService(c, serviceID, request.Replicas)
+
+	resp := gin.H{
 		"message": "Service scaled successfully",
 		"event":   event,
 		"state":   state,
-	})
+	}
+	if runtimeErr != nil {
+		resp["runtime_error"] = runtimeErr.Error()
+	}
+	c.JSON(http.StatusOK, resp)
 }
 
 // GetScalingStatus returns the overall status of the auto-scaler

app/backend/internal/api/scaling_test.go

@@ -49,7 +49,9 @@ func setupScalingTestRouter(t *testing.T) *gin.Engine {
 	gin.SetMode(gin.TestMode)
 	router := gin.New()
 	handler := NewScalingHandler(autoScaler)
-	handler.RegisterRoutes(router.Group("/api/v1"))
+	group := router.Group("/api/v1")
+	handler.RegisterReadRoutes(group)
+	handler.RegisterAdminRoutes(group)
 	return router
 }
 

app/backend/internal/api/security.go

@@ -589,16 +589,7 @@ func (sh *SecurityHandler) GetAuditLogs(c *gin.Context) {
 }
 
 func (sh *SecurityHandler) requireProjectAccess(c *gin.Context, projectID string) (string, bool) {
-	userIDValue, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return "", false
-	}
-	userID, ok := userIDValue.(string)
-	if !ok || userID == "" {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context"})
-		return "", false
-	}
+	userID := optionalUserID(c)
 
 	if _, err := uuid.Parse(projectID); err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid project ID"})
@@ -611,12 +602,14 @@ func (sh *SecurityHandler) requireProjectAccess(c *gin.Context, projectID string
 			SELECT 1
 			FROM projects p
 			WHERE p.id = $1
-			  AND (p.owner_id = $2 OR EXISTS (
+			  AND (p.is_approved
+				   OR $3::bool
+				   OR p.owner_id = $2 OR EXISTS (
 					SELECT 1 FROM project_members pm
 					WHERE pm.project_id = p.id AND pm.user_id = $2
 			  ))
 		)`,
-		projectID, userID,
+		projectID, optionalUserUUID(c), contextIsAdmin(c),
 	).Scan(&hasAccess)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to verify project access"})

app/backend/internal/api/services.go

@@ -2,7 +2,13 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/deployment"
+	"containr/internal/deployqueue"
+	"context"
+	"encoding/json"
+	"fmt"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -24,37 +30,130 @@ type Service struct {
 	BuildPath   string    `json:"build_path" db:"build_path"`
 	CPU         string    `json:"cpu" db:"cpu"`
 	Memory      string    `json:"memory" db:"memory"`
-	CreatedAt   time.Time `json:"created_at" db:"created_at"`
-	UpdatedAt   time.Time `json:"updated_at" db:"updated_at"`
+	// Runtime spec
+	Replicas        int             `json:"replicas" db:"replicas"`
+	Port            int             `json:"port" db:"port"`                         // container port to expose
+	Domain          string          `json:"domain" db:"domain"`                     // public hostname via Traefik
+	HealthCheckPath string          `json:"healthcheck_path" db:"healthcheck_path"` // probed on Port
+	RestartPolicy   string          `json:"restart_policy" db:"restart_policy"`
+	PublicURL       string          `json:"public_url,omitempty" db:"-"` // computed at read time
+	Volumes         []ServiceVolume `json:"volumes" db:"-"`              // loaded lazily — stored as JSONB
+	Domains         []ServiceDomain `json:"domains,omitempty" db:"-"`
+	MaintenanceMode bool            `json:"maintenance_mode" db:"-"`
+	BasicAuth       []string        `json:"basic_auth,omitempty" db:"-"` // usernames only, never hashes
+	Builder         string          `json:"builder" db:"builder"`        // auto|railpack|nixpacks|dockerfile|static
+	CPUReserve      string          `json:"cpu_reserve,omitempty" db:"cpu_reserve"`
+	MemoryReserve   string          `json:"memory_reserve,omitempty" db:"memory_reserve"`
+	StaticBuildCmd  string          `json:"static_build_cmd,omitempty" db:"static_build_cmd"`
+	StaticDir       string          `json:"static_dir,omitempty" db:"static_dir"`
+	CreatedAt       time.Time       `json:"created_at" db:"created_at"`
+	UpdatedAt       time.Time       `json:"updated_at" db:"updated_at"`
+}
+
+// ServiceVolume is a volume/bind mount applied to every replica.
+type ServiceVolume struct {
+	Type     string `json:"type"`   // volume | bind (empty = volume)
+	Source   string `json:"source"` // volume name or host path
+	Target   string `json:"target"` // container path (absolute)
+	ReadOnly bool   `json:"read_only"`
+}
+
+// loadServiceVolumes reads the JSONB column; absent/invalid data degrades
+// to no mounts rather than failing the request.
+func loadServiceVolumes(db *database.DB, serviceID uuid.UUID) []deployment.VolumeMount {
+	var raw []byte
+	if err := db.QueryRow(`SELECT volumes FROM services WHERE id = $1`, serviceID).Scan(&raw); err != nil {
+		return nil
+	}
+	var stored []ServiceVolume
+	if err := json.Unmarshal(raw, &stored); err != nil {
+		return nil
+	}
+	out := make([]deployment.VolumeMount, 0, len(stored))
+	for _, v := range stored {
+		out = append(out, deployment.VolumeMount{
+			Type:        v.Type,
+			Source:      v.Source,
+			Destination: v.Target,
+			ReadOnly:    v.ReadOnly,
+		})
+	}
+	return out
+}
+
+// validateServiceVolumes enforces the mount contract — bad paths fail
+// fast at write time instead of surfacing as docker create errors later.
+func validateServiceVolumes(vols []ServiceVolume) error {
+	for i, v := range vols {
+		if v.Type == "" {
+			v.Type = "volume"
+		}
+		if v.Type != "volume" && v.Type != "bind" {
+			return fmt.Errorf("volumes[%d].type must be volume or bind", i)
+		}
+		if strings.TrimSpace(v.Source) == "" {
+			return fmt.Errorf("volumes[%d].source is required", i)
+		}
+		if !strings.HasPrefix(v.Target, "/") {
+			return fmt.Errorf("volumes[%d].target must be an absolute container path", i)
+		}
+	}
+	return nil
 }
 
 // CreateServiceRequest represents a request to create a service
 type CreateServiceRequest struct {
-	ProjectID   uuid.UUID `json:"project_id"`
-	Name        string    `json:"name" binding:"required,min=1,max=255"`
-	Type        string    `json:"type" binding:"required,oneof=web worker database cron"`
-	Image       string    `json:"image"`
-	Command     string    `json:"command"`
-	Environment string    `json:"environment" binding:"required,oneof=production preview development"`
-	GitRepo     string    `json:"git_repo"`
-	GitBranch   string    `json:"git_branch"`
-	BuildPath   string    `json:"build_path"`
-	CPU         string    `json:"cpu"`
-	Memory      string    `json:"memory"`
+	ProjectID       uuid.UUID       `json:"project_id"`
+	Name            string          `json:"name" binding:"required,min=1,max=255"`
+	Type            string          `json:"type" binding:"required,oneof=web worker database cron"`
+	Image           string          `json:"image"`
+	Command         string          `json:"command"`
+	Environment     string          `json:"environment" binding:"required,oneof=production preview development"`
+	GitRepo         string          `json:"git_repo"`
+	GitBranch       string          `json:"git_branch"`
+	BuildPath       string          `json:"build_path"`
+	CPU             string          `json:"cpu"`
+	Memory          string          `json:"memory"`
+	Replicas        int             `json:"replicas"`
+	Port            int             `json:"port"`
+	Domain          string          `json:"domain"`
+	HealthCheckPath string          `json:"healthcheck_path"`
+	RestartPolicy   string          `json:"restart_policy"`
+	Volumes         []ServiceVolume `json:"volumes"`
+	MaintenanceMode bool            `json:"maintenance_mode"`
+	BasicAuth       []BasicAuthCred `json:"basic_auth"`
+	Builder         string          `json:"builder" binding:"omitempty,oneof=auto railpack nixpacks dockerfile static"`
+	CPUReserve      string          `json:"cpu_reserve"`
+	MemoryReserve   string          `json:"memory_reserve"`
+	StaticBuildCmd  string          `json:"static_build_cmd"`
+	StaticDir       string          `json:"static_dir"`
 }
 
 // UpdateServiceRequest represents a request to update a service
 type UpdateServiceRequest struct {
-	Name        string `json:"name" binding:"omitempty,min=1,max=255"`
-	Type        string `json:"type" binding:"omitempty,oneof=web worker database cron"`
-	Image       string `json:"image"`
-	Command     string `json:"command"`
-	Environment string `json:"environment" binding:"omitempty,oneof=production preview development"`
-	GitRepo     string `json:"git_repo"`
-	GitBranch   string `json:"git_branch"`
-	BuildPath   string `json:"build_path"`
-	CPU         string `json:"cpu"`
-	Memory      string `json:"memory"`
+	Name            string           `json:"name" binding:"omitempty,min=1,max=255"`
+	Type            string           `json:"type" binding:"omitempty,oneof=web worker database cron"`
+	Image           string           `json:"image"`
+	Command         string           `json:"command"`
+	Environment     string           `json:"environment" binding:"omitempty,oneof=production preview development"`
+	GitRepo         string           `json:"git_repo"`
+	GitBranch       string           `json:"git_branch"`
+	BuildPath       string           `json:"build_path"`
+	CPU             string           `json:"cpu"`
+	Memory          string           `json:"memory"`
+	Replicas        *int             `json:"replicas"`
+	Port            *int             `json:"port"`
+	Domain          *string          `json:"domain"`
+	HealthCheckPath *string          `json:"healthcheck_path"`
+	RestartPolicy   string           `json:"restart_policy"`
+	Volumes         *[]ServiceVolume `json:"volumes"`
+	MaintenanceMode *bool            `json:"maintenance_mode"`
+	BasicAuth       *[]BasicAuthCred `json:"basic_auth"`
+	Builder         string           `json:"builder" binding:"omitempty,oneof=auto railpack nixpacks dockerfile static"`
+	CPUReserve      *string          `json:"cpu_reserve"`
+	MemoryReserve   *string          `json:"memory_reserve"`
+	StaticBuildCmd  *string          `json:"static_build_cmd"`
+	StaticDir       *string          `json:"static_dir"`
 }
 
 // handleGetServices retrieves all services for a project
@@ -72,28 +171,14 @@ func handleGetServices(c *gin.Context) {
 		return
 	}
 
-	// Check if project exists and user has access
-	var project Project
-	err = db.(*database.DB).QueryRow(
-		"SELECT id, name, owner_id FROM projects WHERE id = $1",
-		projectID,
-	).Scan(&project.ID, &project.Name, &project.OwnerID)
-
-	if err != nil {
+	// Approved projects are public; unapproved ones need owner/member/admin.
+	projectExists, allowed := projectReadAccess(c, db.(*database.DB), projectID)
+	if !projectExists {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
 		return
 	}
-
-	// Get user ID from JWT token (set by auth middleware)
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
-	// Check if user owns the project
-	if project.OwnerID != userID.(string) {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
+	if !allowed {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
 		return
 	}
 
@@ -110,6 +195,12 @@ func handleGetServices(c *gin.Context) {
 				COALESCE(build_path, ''),
 				COALESCE(cpu, ''),
 				COALESCE(memory, ''),
+				COALESCE(replicas, 1), COALESCE(port, 0),
+				COALESCE(domain, ''), COALESCE(healthcheck_path, ''),
+				COALESCE(restart_policy, 'unless-stopped'),
+				COALESCE(builder, 'auto'), COALESCE(cpu_reserve, ''),
+				COALESCE(memory_reserve, ''), COALESCE(static_build_cmd, ''),
+				COALESCE(static_dir, ''),
 				created_at, updated_at 
 			FROM services 
 			WHERE project_id = $1 
@@ -129,6 +220,9 @@ func handleGetServices(c *gin.Context) {
 			&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
 			&service.Image, &service.Command, &service.Environment, &service.GitRepo,
 			&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+			&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
+			&service.RestartPolicy, &service.Builder, &service.CPUReserve,
+			&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
 			&service.CreatedAt, &service.UpdatedAt,
 		)
 		if err != nil {
@@ -138,6 +232,11 @@ func handleGetServices(c *gin.Context) {
 		services = append(services, service)
 	}
 
+	// Reconcile stored status with live container state (no-op without Docker).
+	for i := range services {
+		liveServiceStatus(c, db.(*database.DB), &services[i])
+	}
+
 	c.JSON(http.StatusOK, gin.H{"services": services})
 }
 
@@ -189,7 +288,7 @@ func handleCreateService(c *gin.Context) {
 	}
 
 	// Check if user owns the project
-	if project.OwnerID != userID.(string) {
+	if project.OwnerID != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -213,29 +312,75 @@ func handleCreateService(c *gin.Context) {
 
 	// Create new service
 	service := Service{
-		ID:          uuid.New(),
-		ProjectID:   req.ProjectID,
-		Name:        req.Name,
-		Type:        req.Type,
-		Status:      "stopped", // Initial status
-		Image:       req.Image,
-		Command:     req.Command,
-		Environment: req.Environment,
-		GitRepo:     req.GitRepo,
-		GitBranch:   req.GitBranch,
-		BuildPath:   req.BuildPath,
-		CPU:         req.CPU,
-		Memory:      req.Memory,
-		CreatedAt:   time.Now(),
-		UpdatedAt:   time.Now(),
+		ID:              uuid.New(),
+		ProjectID:       req.ProjectID,
+		Name:            req.Name,
+		Type:            req.Type,
+		Status:          "stopped", // Initial status
+		Image:           req.Image,
+		Command:         req.Command,
+		Environment:     req.Environment,
+		GitRepo:         req.GitRepo,
+		GitBranch:       req.GitBranch,
+		BuildPath:       req.BuildPath,
+		CPU:             req.CPU,
+		Memory:          req.Memory,
+		Replicas:        req.Replicas,
+		Port:            req.Port,
+		Domain:          req.Domain,
+		HealthCheckPath: req.HealthCheckPath,
+		RestartPolicy:   req.RestartPolicy,
+		CreatedAt:       time.Now(),
+		UpdatedAt:       time.Now(),
 	}
 
-	// Set default values if not provided
+	// Set default values if not provided; app_settings.default_cpu /
+	// default_memory override the hardcoded fallbacks.
 	if service.CPU == "" {
-		service.CPU = "0.5"
+		service.CPU = firstNonEmpty(settingValue(db.(*database.DB), "default_cpu", "", ""), "0.5")
 	}
 	if service.Memory == "" {
-		service.Memory = "512Mi"
+		service.Memory = firstNonEmpty(settingValue(db.(*database.DB), "default_memory", "", ""), "512Mi")
+	}
+	if req.Builder == "" {
+		service.Builder = "auto"
+	} else {
+		service.Builder = req.Builder
+	}
+	service.CPUReserve = req.CPUReserve
+	service.MemoryReserve = req.MemoryReserve
+	service.StaticBuildCmd = req.StaticBuildCmd
+	service.StaticDir = req.StaticDir
+	if service.Builder == "static" && service.StaticDir == "" {
+		service.StaticDir = "dist"
+	}
+	for label, check := range map[string]func(string) error{
+		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
+		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
+	} {
+		v := map[string]string{
+			"cpu": service.CPU, "cpu_reserve": service.CPUReserve,
+			"memory": service.Memory, "memory_reserve": service.MemoryReserve,
+		}[label]
+		if err := check(v); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("invalid %s: %s", label, err.Error()), "code": "VALIDATION"})
+			return
+		}
+	}
+	if service.Replicas < 1 {
+		service.Replicas = 1
+	}
+	if service.RestartPolicy == "" {
+		service.RestartPolicy = "unless-stopped"
+	}
+	if err := validateServiceVolumes(req.Volumes); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "code": "VALIDATION"})
+		return
+	}
+	service.Volumes = req.Volumes
+	volumesJSON, _ := json.Marshal(req.Volumes)
+	if len(req.Volumes) == 0 {
+		volumesJSON = []byte("[]")
 	}
 
 	environmentID, err := getProjectEnvironmentID(db.(*database.DB), service.ProjectID, service.Environment)
@@ -248,16 +393,22 @@ func handleCreateService(c *gin.Context) {
 
 	// Insert service into database
 	_, err = db.(*database.DB).Exec(
-		`INSERT INTO services 
+		`INSERT INTO services
 			(id, project_id, name, environment_id, service_type, source_type, source_url, image_name,
 				 build_command, start_command, type, status, image, command, environment,
-				 git_repo, git_branch, build_path, cpu, memory, created_at, updated_at)
-			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22)`,
+				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
+				 healthcheck_path, restart_policy, volumes,
+				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
+				 created_at, updated_at)
+			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26,
+					$27, $28, $29, $30, $31, $32, $33)`,
 		service.ID, service.ProjectID, service.Name, environmentID, service.Type,
 		sourceType, firstNonEmpty(service.GitRepo, service.Image), service.Image,
 		"", service.Command, service.Type, service.Status, service.Image, service.Command,
 		service.Environment, service.GitRepo, service.GitBranch, service.BuildPath, service.CPU, service.Memory,
-		service.CreatedAt, service.UpdatedAt,
+		service.Replicas, service.Port, service.Domain, service.HealthCheckPath, service.RestartPolicy,
+		volumesJSON, service.Builder, service.CPUReserve, service.MemoryReserve,
+		service.StaticBuildCmd, service.StaticDir, service.CreatedAt, service.UpdatedAt,
 	)
 
 	if err != nil {
@@ -265,6 +416,26 @@ func handleCreateService(c *gin.Context) {
 		return
 	}
 
+	// Domains live in service_domains; services.domain is the derived default.
+	if req.Domain != "" && validHostname(strings.ToLower(req.Domain)) {
+		_, _ = db.(*database.DB).Exec(
+			`INSERT INTO service_domains (service_id, domain, is_default) VALUES ($1, $2, true)
+			 ON CONFLICT (service_id, domain) DO UPDATE SET is_default = true`,
+			service.ID, strings.ToLower(req.Domain))
+	}
+	if req.MaintenanceMode || len(req.BasicAuth) > 0 {
+		basicAuthUsers := ""
+		if encoded, encErr := encodeBasicAuth(req.BasicAuth); encErr == nil {
+			basicAuthUsers = encoded
+		}
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE services SET maintenance_mode = $1, basic_auth_users = $2 WHERE id = $3`,
+			req.MaintenanceMode, basicAuthUsers, service.ID)
+		service.MaintenanceMode = req.MaintenanceMode
+		service.BasicAuth = basicAuthUsernames(basicAuthUsers)
+	}
+	service.Domains = loadServiceDomains(db.(*database.DB), service.ID)
+
 	c.JSON(http.StatusCreated, gin.H{"service": service})
 }
 
@@ -303,14 +474,9 @@ func handleGetService(c *gin.Context) {
 		return
 	}
 
-	// Get user ID from JWT token
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
-	// Get service with project ownership check
+	// Get service — public when its project is approved, otherwise
+	// owner/member/admin only.
+	userID := optionalUserUUID(c)
 	var service Service
 	err = db.(*database.DB).QueryRow(
 		`SELECT s.id, s.project_id, s.name,
@@ -324,15 +490,25 @@ func handleGetService(c *gin.Context) {
 				COALESCE(s.build_path, ''),
 				COALESCE(s.cpu, ''),
 				COALESCE(s.memory, ''),
+				COALESCE(s.replicas, 1), COALESCE(s.port, 0),
+				COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
+				COALESCE(s.restart_policy, 'unless-stopped'),
+				COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
+				COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
+				COALESCE(s.static_dir, ''),
 				s.created_at, s.updated_at
 			FROM services s
 			JOIN projects p ON s.project_id = p.id
-			WHERE s.id = $1 AND p.owner_id = $2`,
-		serviceID, userID,
+			WHERE s.id = $1 AND (p.is_approved OR p.owner_id = $2 OR $3::bool
+				OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $2))`,
+		serviceID, userID, contextIsAdmin(c),
 	).Scan(
 		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
 		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
 		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
+		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
+		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
+		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
 		&service.CreatedAt, &service.UpdatedAt,
 	)
 
@@ -341,6 +517,16 @@ func handleGetService(c *gin.Context) {
 		return
 	}
 
+	liveServiceStatus(c, db.(*database.DB), &service)
+	for _, v := range loadServiceVolumes(db.(*database.DB), service.ID) {
+		service.Volumes = append(service.Volumes, ServiceVolume{
+			Type: v.Type, Source: v.Source, Target: v.Destination, ReadOnly: v.ReadOnly,
+		})
+	}
+	service.Domains = loadServiceDomains(db.(*database.DB), service.ID)
+	maintenance, basicAuth := serviceAccess(db.(*database.DB), service.ID)
+	service.MaintenanceMode = maintenance
+	service.BasicAuth = basicAuthUsernames(basicAuth)
 	c.JSON(http.StatusOK, gin.H{"service": service})
 }
 
@@ -386,16 +572,27 @@ func handleUpdateService(c *gin.Context) {
 				COALESCE(s.build_path, ''),
 				COALESCE(s.cpu, ''),
 				COALESCE(s.memory, ''),
+				COALESCE(s.replicas, 1), COALESCE(s.port, 0),
+				COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
+				COALESCE(s.restart_policy, 'unless-stopped'),
+				COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
+				COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
+				COALESCE(s.static_dir, ''),
 				s.created_at, s.updated_at
 			FROM services s
 			JOIN projects p ON s.project_id = p.id
-			WHERE s.id = $1 AND p.owner_id = $2`,
-		serviceID, userID,
+			WHERE s.id = $1 AND (p.owner_id = $2 OR $3::bool)`,
+		serviceID, userID, contextIsAdmin(c),
 	).Scan(
 		&existingService.ID, &existingService.ProjectID, &existingService.Name, &existingService.Type,
 		&existingService.Status, &existingService.Image, &existingService.Command,
 		&existingService.Environment, &existingService.GitRepo, &existingService.GitBranch,
 		&existingService.BuildPath, &existingService.CPU, &existingService.Memory,
+		&existingService.Replicas, &existingService.Port, &existingService.Domain,
+		&existingService.HealthCheckPath, &existingService.RestartPolicy,
+		&existingService.Builder, &existingService.CPUReserve,
+		&existingService.MemoryReserve, &existingService.StaticBuildCmd,
+		&existingService.StaticDir,
 		&existingService.CreatedAt, &existingService.UpdatedAt,
 	)
 
@@ -435,19 +632,85 @@ func handleUpdateService(c *gin.Context) {
 	if req.Memory != "" {
 		existingService.Memory = req.Memory
 	}
+	if req.Replicas != nil {
+		existingService.Replicas = *req.Replicas
+	}
+	if req.Port != nil {
+		existingService.Port = *req.Port
+	}
+	if req.Domain != nil {
+		existingService.Domain = *req.Domain
+	}
+	if req.HealthCheckPath != nil {
+		existingService.HealthCheckPath = *req.HealthCheckPath
+	}
+	if req.RestartPolicy != "" {
+		existingService.RestartPolicy = req.RestartPolicy
+	}
+	if req.Builder != "" {
+		existingService.Builder = req.Builder
+	}
+	if req.CPUReserve != nil {
+		existingService.CPUReserve = *req.CPUReserve
+	}
+	if req.MemoryReserve != nil {
+		existingService.MemoryReserve = *req.MemoryReserve
+	}
+	if req.StaticBuildCmd != nil {
+		existingService.StaticBuildCmd = *req.StaticBuildCmd
+	}
+	if req.StaticDir != nil {
+		existingService.StaticDir = *req.StaticDir
+	}
+	if existingService.Builder == "static" && existingService.StaticDir == "" {
+		existingService.StaticDir = "dist"
+	}
+	for label, check := range map[string]func(string) error{
+		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
+		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
+	} {
+		v := map[string]string{
+			"cpu": existingService.CPU, "cpu_reserve": existingService.CPUReserve,
+			"memory": existingService.Memory, "memory_reserve": existingService.MemoryReserve,
+		}[label]
+		if err := check(v); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": fmt.Sprintf("invalid %s: %s", label, err.Error()), "code": "VALIDATION"})
+			return
+		}
+	}
+	// lib/pq sends a nil []byte as an empty bytea literal rather than NULL,
+	// so the COALESCE fallback needs an untyped nil when volumes aren't sent.
+	var volumesArg interface{}
+	if req.Volumes != nil {
+		if err := validateServiceVolumes(*req.Volumes); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "code": "VALIDATION"})
+			return
+		}
+		existingService.Volumes = *req.Volumes
+		volumesJSON, _ := json.Marshal(*req.Volumes)
+		volumesArg = volumesJSON
+	}
 
 	existingService.UpdatedAt = time.Now()
 
 	// Update service in database
 	_, err = db.(*database.DB).Exec(
-		`UPDATE services 
+		`UPDATE services
 			SET name = $1, type = $2, image = $3, command = $4, environment = $5,
-				git_repo = $6, git_branch = $7, build_path = $8, cpu = $9, memory = $10, updated_at = $11
-			WHERE id = $12`,
+				git_repo = $6, git_branch = $7, build_path = $8, cpu = $9, memory = $10,
+				replicas = $11, port = $12, domain = $13, healthcheck_path = $14,
+				restart_policy = $15, volumes = COALESCE($17::jsonb, volumes), updated_at = $16,
+				builder = $19, cpu_reserve = $20, memory_reserve = $21,
+				static_build_cmd = $22, static_dir = $23
+			WHERE id = $18`,
 		existingService.Name, existingService.Type, existingService.Image, existingService.Command,
 		existingService.Environment, existingService.GitRepo, existingService.GitBranch,
 		existingService.BuildPath, existingService.CPU, existingService.Memory,
-		existingService.UpdatedAt, existingService.ID,
+		existingService.Replicas, existingService.Port, existingService.Domain,
+		existingService.HealthCheckPath, existingService.RestartPolicy,
+		existingService.UpdatedAt, volumesArg, existingService.ID,
+		existingService.Builder, existingService.CPUReserve, existingService.MemoryReserve,
+		existingService.StaticBuildCmd, existingService.StaticDir,
 	)
 
 	if err != nil {
@@ -455,6 +718,68 @@ func handleUpdateService(c *gin.Context) {
 		return
 	}
 
+	// Domain writes route through service_domains — services.domain is the
+	// derived default and gets rewritten by syncDefaultDomain.
+	if req.Domain != nil {
+		domain := strings.ToLower(strings.TrimSpace(*req.Domain))
+		if domain == "" {
+			_, _ = db.(*database.DB).Exec(`DELETE FROM service_domains WHERE service_id = $1`, serviceID)
+		} else if validHostname(domain) {
+			_, _ = db.(*database.DB).Exec(`UPDATE service_domains SET is_default = false WHERE service_id = $1`, serviceID)
+			_, _ = db.(*database.DB).Exec(
+				`INSERT INTO service_domains (service_id, domain, is_default) VALUES ($1, $2, true)
+				 ON CONFLICT (service_id, domain) DO UPDATE SET is_default = true`,
+				serviceID, domain)
+		} else {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid hostname", "code": "VALIDATION"})
+			return
+		}
+		syncDefaultDomain(db.(*database.DB), serviceID)
+		_ = db.(*database.DB).QueryRow(`SELECT domain FROM services WHERE id = $1`, serviceID).Scan(&existingService.Domain)
+	}
+
+	if req.MaintenanceMode != nil || req.BasicAuth != nil {
+		maintenance, basicAuth := serviceAccess(db.(*database.DB), serviceID)
+		if req.MaintenanceMode != nil {
+			maintenance = *req.MaintenanceMode
+		}
+		if req.BasicAuth != nil {
+			encoded, encErr := encodeBasicAuth(*req.BasicAuth)
+			if encErr != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to encode basic auth", "code": "INTERNAL"})
+				return
+			}
+			basicAuth = encoded
+		}
+		_, _ = db.(*database.DB).Exec(
+			`UPDATE services SET maintenance_mode = $1, basic_auth_users = $2 WHERE id = $3`,
+			maintenance, basicAuth, serviceID)
+		existingService.MaintenanceMode = maintenance
+	}
+	existingService.Domains = loadServiceDomains(db.(*database.DB), serviceID)
+	_, storedAuth := serviceAccess(db.(*database.DB), serviceID)
+	existingService.BasicAuth = basicAuthUsernames(storedAuth)
+
+	// A replica change applies immediately when the service has live
+	// containers; other spec fields take effect on the next deploy.
+	// Runs through the deploy queue so it can't overlap a build.
+	if req.Replicas != nil && existingService.Status == "running" {
+		if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+			engine := engineValue.(*deployment.DeploymentEngine)
+			serviceCopy := existingService
+			dbCopy := db.(*database.DB)
+			getDeployQueue(c).Enqueue(serviceCopy.ID, deployqueue.Job{Run: func(jctx context.Context) {
+				spec, err := serviceRuntimeSpec(dbCopy, serviceCopy)
+				if err != nil {
+					return
+				}
+				if state, err := engine.ReconcileService(jctx, spec); err == nil && state != nil {
+					persistPublishedPort(dbCopy, serviceCopy.ID, state.Ports)
+				}
+			}})
+		}
+	}
+
 	c.JSON(http.StatusOK, gin.H{"service": existingService})
 }
 
@@ -496,11 +821,18 @@ func handleDeleteService(c *gin.Context) {
 	}
 
 	// Check if user owns the project
-	if projectOwnerID != userID.(string) {
+	if projectOwnerID != userID.(string) && !isAdminUser(db.(*database.DB), userID.(string)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
 
+	// Remove runtime containers before dropping the row.
+	if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+		if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+			_ = engine.RemoveServiceContainers(c.Request.Context(), serviceID.String())
+		}
+	}
+
 	// Delete service (cascade will handle related records)
 	_, err = db.(*database.DB).Exec(
 		"DELETE FROM services WHERE id = $1",

app/backend/internal/api/settings.go

@@ -0,0 +1,290 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/docker"
+
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/docker/api/types/registry"
+	"github.com/gin-gonic/gin"
+)
+
+// Platform setting keys. Values stored in app_settings take precedence over
+// environment variables; env remains the fallback for optional overrides.
+const (
+	settingSignupEnabled         = "signup_enabled"
+	settingCloudflareTunnelToken = "cloudflare_tunnel_token"
+
+	cloudflaredContainerName = "containr-cloudflared"
+	cloudflaredImage         = "cloudflare/cloudflared:latest"
+)
+
+// settingValue resolves a setting: app_settings row first, env fallback,
+// then the caller's default.
+func settingValue(db *database.DB, key, envKey, fallback string) string {
+	if db != nil && db.DB != nil {
+		var value string
+		err := db.QueryRow(`SELECT value FROM app_settings WHERE key = $1`, key).Scan(&value)
+		if err == nil {
+			return value
+		}
+		if err != sql.ErrNoRows {
+			log.Printf("Failed to read setting %s: %v", key, err)
+		}
+	}
+	if envKey != "" {
+		if value := strings.TrimSpace(os.Getenv(envKey)); value != "" {
+			return value
+		}
+	}
+	return fallback
+}
+
+func setSetting(db *database.DB, key, value string, secret bool) error {
+	_, err := db.Exec(`
+		INSERT INTO app_settings (key, value, is_secret, updated_at)
+		VALUES ($1, $2, $3, NOW())
+		ON CONFLICT (key) DO UPDATE
+		SET value = EXCLUDED.value, is_secret = EXCLUDED.is_secret, updated_at = NOW()
+	`, key, value, secret)
+	return err
+}
+
+func deleteSetting(db *database.DB, key string) error {
+	_, err := db.Exec(`DELETE FROM app_settings WHERE key = $1`, key)
+	return err
+}
+
+// signupEnabled controls whether public registration stays open after the
+// first account exists. Defaults to closed; the platform owner can reopen it
+// in Settings or via SIGNUP_ENABLED=true.
+func signupEnabled(db *database.DB) bool {
+	return strings.EqualFold(settingValue(db, settingSignupEnabled, "SIGNUP_ENABLED", "false"), "true")
+}
+
+func isAdminUser(db *database.DB, userID string) bool {
+	var isAdmin bool
+	if err := db.QueryRow(`SELECT is_admin FROM users WHERE id = $1`, userID).Scan(&isAdmin); err != nil {
+		return false
+	}
+	return isAdmin
+}
+
+func requireAdmin(c *gin.Context) (*database.DB, bool) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return nil, false
+	}
+	db, _ := c.Get("db")
+	database, _ := db.(*database.DB)
+	if database == nil || database.DB == nil || !isAdminUser(database, userID) {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required"})
+		return nil, false
+	}
+	return database, true
+}
+
+type cloudflareTunnelStatus struct {
+	TokenSet  bool   `json:"token_set"`
+	Source    string `json:"source"` // "app" | "env" | "none"
+	Container string `json:"container"`
+}
+
+func handleGetSettings(c *gin.Context) {
+	db, ok := requireAdmin(c)
+	if !ok {
+		return
+	}
+
+	dockerClient, _ := c.Get("docker_client")
+	client, _ := dockerClient.(*docker.Client)
+
+	c.JSON(http.StatusOK, gin.H{
+		"signup_enabled":    signupEnabled(db),
+		"cloudflare_tunnel": cloudflareTunnelState(c.Request.Context(), db, client),
+	})
+}
+
+func handleUpdateSettings(c *gin.Context) {
+	db, ok := requireAdmin(c)
+	if !ok {
+		return
+	}
+
+	var req struct {
+		SignupEnabled         *bool   `json:"signup_enabled"`
+		CloudflareTunnelToken *string `json:"cloudflare_tunnel_token"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if req.SignupEnabled != nil {
+		value := "false"
+		if *req.SignupEnabled {
+			value = "true"
+		}
+		if err := setSetting(db, settingSignupEnabled, value, false); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update signup setting"})
+			return
+		}
+	}
+
+	if req.CloudflareTunnelToken != nil {
+		token := strings.TrimSpace(*req.CloudflareTunnelToken)
+		if token == "" {
+			if err := deleteSetting(db, settingCloudflareTunnelToken); err != nil {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clear tunnel token"})
+				return
+			}
+		} else if err := setSetting(db, settingCloudflareTunnelToken, token, true); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to save tunnel token"})
+			return
+		}
+
+		if dockerClient, exists := c.Get("docker_client"); exists {
+			if client, ok := dockerClient.(*docker.Client); ok && client != nil {
+				go applyCloudflaredTunnel(client, token)
+			}
+		}
+	}
+
+	handleGetSettings(c)
+}
+
+// resolvedTunnelToken prefers the in-app value and falls back to the env.
+func resolvedTunnelToken(db *database.DB) (string, string) {
+	if db != nil && db.DB != nil {
+		var value string
+		if err := db.QueryRow(`SELECT value FROM app_settings WHERE key = $1`, settingCloudflareTunnelToken).Scan(&value); err == nil && strings.TrimSpace(value) != "" {
+			return strings.TrimSpace(value), "app"
+		}
+	}
+	if value := strings.TrimSpace(os.Getenv("CLOUDFLARED_TOKEN")); value != "" && value != "your_cloudflare_tunnel_token_here" {
+		return value, "env"
+	}
+	return "", "none"
+}
+
+func cloudflareTunnelState(ctx context.Context, db *database.DB, client *docker.Client) cloudflareTunnelStatus {
+	token, source := resolvedTunnelToken(db)
+	state := cloudflareTunnelStatus{TokenSet: token != "", Source: source, Container: "missing"}
+
+	if client == nil {
+		state.Container = "unavailable"
+		return state
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	container, err := findCloudflaredContainer(ctx, client)
+	if err != nil || container == "" {
+		return state
+	}
+	if inspect, err := client.GetContainer(ctx, container); err == nil && inspect.State != nil {
+		state.Container = inspect.State.Status
+	}
+	return state
+}
+
+// syncManagedContainers reconciles containers the platform manages from
+// settings - currently only the optional Cloudflare Tunnel sidecar.
+func syncManagedContainers(client *docker.Client, db *database.DB) {
+	token, _ := resolvedTunnelToken(db)
+	if token == "" {
+		return
+	}
+	go applyCloudflaredTunnel(client, token)
+}
+
+func findCloudflaredContainer(ctx context.Context, client *docker.Client) (string, error) {
+	containers, err := client.ListContainers(ctx, true)
+	if err != nil {
+		return "", err
+	}
+	for _, item := range containers {
+		for _, name := range item.Names {
+			if strings.TrimPrefix(name, "/") == cloudflaredContainerName {
+				return item.ID, nil
+			}
+		}
+	}
+	return "", nil
+}
+
+// applyCloudflaredTunnel ensures a cloudflared container mirrors the stored
+// token: created/recreated when set, removed when cleared. It joins the same
+// networks as the backend so tunnel targets can use compose service names.
+func applyCloudflaredTunnel(client *docker.Client, token string) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	if existing, err := findCloudflaredContainer(ctx, client); err == nil && existing != "" {
+		if err := client.RemoveContainer(ctx, existing, true); err != nil {
+			log.Printf("Failed to remove existing cloudflared container: %v", err)
+			return
+		}
+	}
+
+	if token == "" {
+		return
+	}
+
+	if err := client.PullImageWait(ctx, cloudflaredImage, registry.AuthConfig{}); err != nil {
+		log.Printf("Failed to pull %s: %v", cloudflaredImage, err)
+	}
+
+	networks, err := backendNetworks(ctx, client)
+	if err != nil {
+		log.Printf("Failed to resolve backend networks for cloudflared: %v", err)
+		return
+	}
+
+	id, err := client.CreateContainer(ctx, docker.ContainerConfig{
+		Name:          cloudflaredContainerName,
+		Image:         cloudflaredImage,
+		Cmd:           []string{"tunnel", "--no-autoupdate", "run", "--token", token},
+		RestartPolicy: "unless-stopped",
+		Labels:        map[string]string{"containr.managed": "cloudflared"},
+		Networks:      networks,
+	})
+	if err != nil {
+		log.Printf("Failed to create cloudflared container: %v", err)
+		return
+	}
+	if err := client.StartContainer(ctx, id); err != nil {
+		log.Printf("Failed to start cloudflared container: %v", err)
+	}
+}
+
+// backendNetworks returns the networks this backend container sits on, so the
+// managed cloudflared container can reach the frontend/backend by name.
+func backendNetworks(ctx context.Context, client *docker.Client) (map[string]*network.EndpointSettings, error) {
+	hostname, err := os.Hostname()
+	if err != nil {
+		return nil, err
+	}
+	self, err := client.GetContainer(ctx, hostname)
+	if err != nil {
+		return nil, err
+	}
+
+	networks := map[string]*network.EndpointSettings{}
+	for name := range self.NetworkSettings.Networks {
+		networks[name] = &network.EndpointSettings{}
+	}
+	if len(networks) == 0 {
+		return nil, sql.ErrNoRows
+	}
+	return networks, nil
+}

app/backend/internal/api/system.go

@@ -40,7 +40,10 @@ type hostMonitoringResponse struct {
 	UptimeSeconds   int64          `json:"uptime_seconds"`
 	DockerAvailable bool           `json:"docker_available"`
 	Docker          map[string]any `json:"docker,omitempty"`
-	CollectedAt     string         `json:"collected_at"`
+	// Scope names what the telemetry actually measures: the physical host for
+	// native dockerd, or the Docker Desktop VM when the daemon runs in one.
+	Scope       string `json:"scope"`
+	CollectedAt string `json:"collected_at"`
 }
 
 type hostCPU struct {
@@ -159,6 +162,7 @@ func handleGetHostMonitoring(c *gin.Context) {
 		Storage:       storage,
 		Load:          load,
 		UptimeSeconds: uptime,
+		Scope:         "host",
 		CollectedAt:   time.Now().UTC().Format(time.RFC3339),
 	}
 
@@ -173,6 +177,10 @@ func handleGetHostMonitoring(c *gin.Context) {
 					"images":     info.Images,
 					"driver":     info.Driver,
 					"server":     info.ServerVersion,
+					"os":         info.OperatingSystem,
+				}
+				if strings.Contains(strings.ToLower(info.OperatingSystem), "docker desktop") {
+					response.Scope = "docker-desktop-vm"
 				}
 			}
 		}

app/backend/internal/api/templates.go

@@ -3,16 +3,19 @@ package api
 import (
 	"containr/internal/database"
 	"containr/internal/database/sqlcdb"
+	"context"
 	"database/sql"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log"
 	"net/http"
 	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
 )
 
 type ServiceTemplate struct {
@@ -24,6 +27,8 @@ type ServiceTemplate struct {
 	Config      string    `json:"config" db:"config"`
 	Variables   string    `json:"variables" db:"variables"`
 	IsOfficial  bool      `json:"is_official" db:"is_official"`
+	OwnerID     string    `json:"owner_id,omitempty" db:"owner_id"`
+	IsPublic    bool      `json:"is_public" db:"is_public"`
 	CreatedAt   time.Time `json:"created_at" db:"created_at"`
 	UpdatedAt   time.Time `json:"updated_at" db:"updated_at"`
 }
@@ -67,12 +72,18 @@ func handleGetTemplates(c *gin.Context) {
 	ctx := c.Request.Context()
 	queries := sqlcdb.New(db.DB)
 
+	userID := optionalUserUUID(c)
+	owner := uuid.NullUUID{UUID: userID, Valid: userID != uuid.Nil}
+
 	var templateRows []sqlcdb.ServiceTemplate
 	var err error
 	if category != "" {
-		templateRows, err = queries.ListServiceTemplatesByCategory(ctx, category)
+		templateRows, err = queries.ListServiceTemplatesByCategoryForUser(ctx, sqlcdb.ListServiceTemplatesByCategoryForUserParams{
+			Category: category,
+			OwnerID:  owner,
+		})
 	} else {
-		templateRows, err = queries.ListServiceTemplates(ctx)
+		templateRows, err = queries.ListServiceTemplatesForUser(ctx, owner)
 	}
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch templates"})
@@ -103,7 +114,7 @@ func handleGetTemplate(c *gin.Context) {
 	}
 
 	t := mapSQLCTemplate(row)
-	if t.ID == "" {
+	if t.ID == "" || !templateVisibleTo(c, t) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Template not found"})
 		return
 	}
@@ -169,7 +180,7 @@ func handleCreateFromTemplate(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch project"})
 		return
 	}
-	if ownerID.String() != userID {
+	if ownerID.String() != userID && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -185,8 +196,8 @@ func handleCreateFromTemplate(c *gin.Context) {
 	}
 
 	template := mapSQLCTemplate(templateRow)
-	if template.ID == "" {
-		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
+	if template.ID == "" || !templateVisibleTo(c, template) {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Template not found"})
 		return
 	}
 
@@ -325,6 +336,16 @@ func handleCreateFromTemplate(c *gin.Context) {
 		return
 	}
 
+	// sqlc's schema predates the runtime columns; port and healthcheck_path are
+	// written via raw SQL like every other service mutation path.
+	if _, err = tx.ExecContext(ctx,
+		`UPDATE services SET port = $1, healthcheck_path = $2 WHERE id = $3`,
+		config.Port, strings.TrimSpace(config.HealthCheck), serviceID,
+	); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create service from template"})
+		return
+	}
+
 	for key, value := range envVars {
 		if strings.TrimSpace(key) == "" {
 			continue
@@ -363,6 +384,246 @@ func handleCreateFromTemplate(c *gin.Context) {
 	})
 }
 
+// templateWriteRequest is the admin payload for creating/updating a user
+// template. config must decode into TemplateConfig; variables into
+// []TemplateVariable.
+type templateWriteRequest struct {
+	Name        string          `json:"name" binding:"required"`
+	Description string          `json:"description"`
+	Category    string          `json:"category"`
+	Logo        string          `json:"logo"`
+	Config      json.RawMessage `json:"config" binding:"required"`
+	Variables   json.RawMessage `json:"variables"`
+	IsPublic    bool            `json:"is_public"`
+}
+
+var templateCategories = map[string]bool{
+	"web": true, "frontend": true, "api": true, "database": true,
+	"worker": true, "cron": true, "app": true, "custom": true,
+}
+
+func normalizeTemplateCategory(category string) string {
+	normalized := strings.ToLower(strings.TrimSpace(category))
+	if templateCategories[normalized] {
+		return normalized
+	}
+	return "custom"
+}
+
+func validateTemplateWrite(c *gin.Context, req *templateWriteRequest) bool {
+	req.Name = strings.TrimSpace(req.Name)
+	if len(req.Name) < 2 || len(req.Name) > 120 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name must be 2-120 characters"})
+		return false
+	}
+	req.Category = normalizeTemplateCategory(req.Category)
+	req.Logo = strings.TrimSpace(req.Logo)
+	if len(req.Logo) > 500 || (req.Logo != "" && !strings.HasPrefix(req.Logo, "https://") && !strings.HasPrefix(req.Logo, "http://")) {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "logo must be an http(s) URL up to 500 chars"})
+		return false
+	}
+	if len(req.Config) == 0 || len(req.Config) > 64*1024 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "config is required and must be under 64KB"})
+		return false
+	}
+	var config TemplateConfig
+	if err := json.Unmarshal(req.Config, &config); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "config must be a valid template config object"})
+		return false
+	}
+	if _, err := normalizeTemplateServiceType(config.Type); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return false
+	}
+	if len(req.Variables) > 0 {
+		if len(req.Variables) > 64*1024 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "variables must be under 64KB"})
+			return false
+		}
+		var variables []TemplateVariable
+		if err := json.Unmarshal(req.Variables, &variables); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "variables must be an array"})
+			return false
+		}
+		for _, v := range variables {
+			if strings.TrimSpace(v.Key) == "" {
+				c.JSON(http.StatusBadRequest, gin.H{"error": "every variable needs a key"})
+				return false
+			}
+		}
+	}
+	return true
+}
+
+func templateVariablesParam(raw json.RawMessage) pqtype.NullRawMessage {
+	if len(raw) == 0 {
+		return pqtype.NullRawMessage{}
+	}
+	return pqtype.NullRawMessage{RawMessage: raw, Valid: true}
+}
+
+func handleCreateTemplate(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	var req templateWriteRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if !validateTemplateWrite(c, &req) {
+		return
+	}
+
+	ownerUUID, err := uuid.Parse(userID)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context"})
+		return
+	}
+
+	id := "usr-" + uuid.NewString()
+	if err := queries.CreateUserTemplate(c.Request.Context(), sqlcdb.CreateUserTemplateParams{
+		ID:          id,
+		Name:        req.Name,
+		Description: nullableText(strings.TrimSpace(req.Description)),
+		Category:    req.Category,
+		Logo:        nullableText(req.Logo),
+		Config:      req.Config,
+		Variables:   templateVariablesParam(req.Variables),
+		OwnerID:     uuid.NullUUID{UUID: ownerUUID, Valid: true},
+		IsPublic:    req.IsPublic,
+	}); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create template"})
+		return
+	}
+
+	LogAudit(userID, "template", id, "create", map[string]interface{}{"name": req.Name})
+
+	row, err := queries.GetServiceTemplateByID(c.Request.Context(), id)
+	if err != nil {
+		c.JSON(http.StatusCreated, gin.H{"template": gin.H{"id": id, "name": req.Name}})
+		return
+	}
+	c.JSON(http.StatusCreated, gin.H{"template": mapSQLCTemplate(row)})
+}
+
+func handleUpdateTemplate(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+	templateID := c.Param("id")
+
+	var req templateWriteRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if !validateTemplateWrite(c, &req) {
+		return
+	}
+
+	ownerUUID, err := uuid.Parse(userID)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context"})
+		return
+	}
+
+	rows, err := queries.UpdateUserTemplate(c.Request.Context(), sqlcdb.UpdateUserTemplateParams{
+		Name:        req.Name,
+		Description: nullableText(strings.TrimSpace(req.Description)),
+		Category:    req.Category,
+		Logo:        nullableText(req.Logo),
+		Config:      req.Config,
+		Variables:   templateVariablesParam(req.Variables),
+		IsPublic:    req.IsPublic,
+		ID:          templateID,
+		OwnerID:     uuid.NullUUID{UUID: ownerUUID, Valid: true},
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update template"})
+		return
+	}
+	if rows == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Template not found or not editable"})
+		return
+	}
+
+	LogAudit(userID, "template", templateID, "update", map[string]interface{}{"name": req.Name})
+
+	row, err := queries.GetServiceTemplateByID(c.Request.Context(), templateID)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{"message": "Template updated"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"template": mapSQLCTemplate(row)})
+}
+
+func handleDeleteTemplate(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+	templateID := c.Param("id")
+
+	ownerUUID, err := uuid.Parse(userID)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context"})
+		return
+	}
+
+	rows, err := queries.DeleteUserTemplate(c.Request.Context(), sqlcdb.DeleteUserTemplateParams{
+		ID:      templateID,
+		OwnerID: uuid.NullUUID{UUID: ownerUUID, Valid: true},
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete template"})
+		return
+	}
+	if rows == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Template not found or not deletable"})
+		return
+	}
+
+	LogAudit(userID, "template", templateID, "delete", nil)
+	c.JSON(http.StatusOK, gin.H{"message": "Template deleted"})
+}
+
+// SeedOfficialTemplates upserts the built-in catalog on startup so new
+// templates ship with releases without needing a migration per entry.
+func SeedOfficialTemplates(ctx context.Context, db *database.DB) {
+	if db == nil || db.DB == nil {
+		return
+	}
+	queries := sqlcdb.New(db.DB)
+	for _, t := range SeedTemplates() {
+		variables := pqtype.NullRawMessage{}
+		if strings.TrimSpace(t.Variables) != "" {
+			variables = pqtype.NullRawMessage{RawMessage: json.RawMessage(t.Variables), Valid: true}
+		}
+		if err := queries.UpsertServiceTemplate(ctx, sqlcdb.UpsertServiceTemplateParams{
+			ID:          t.ID,
+			Name:        t.Name,
+			Description: nullableText(t.Description),
+			Category:    t.Category,
+			Logo:        nullableText(t.Logo),
+			Config:      json.RawMessage(t.Config),
+			Variables:   variables,
+			IsOfficial:  sql.NullBool{Bool: true, Valid: true},
+		}); err != nil {
+			log.Printf("Failed to seed template %s: %v", t.ID, err)
+		}
+	}
+}
+
 func SeedTemplates() []ServiceTemplate {
 	templates := []ServiceTemplate{
 		{
@@ -480,7 +741,7 @@ func SeedTemplates() []ServiceTemplate {
 			Name:        "Background Worker",
 			Description: "Background job processing service",
 			Category:    "worker",
-			Logo:        "https://cdn.simpleicons.org/terminal",
+			Logo:        "https://cdn.simpleicons.org/gnubash",
 			Config:      `{"type":"worker","runtime":"node","build_command":"npm install","start_command":"npm run worker"}`,
 			Variables:   `[{"key":"WORKER_CONCURRENCY","label":"Concurrency","default":"4","required":false,"secret":false}]`,
 			IsOfficial:  true,
@@ -490,7 +751,7 @@ func SeedTemplates() []ServiceTemplate {
 			Name:        "Cron Job",
 			Description: "Scheduled task runner",
 			Category:    "cron",
-			Logo:        "https://cdn.simpleicons.org/clock",
+			Logo:        "https://cdn.simpleicons.org/clockify",
 			Config:      `{"type":"cron","runtime":"node","build_command":"npm install","start_command":"npm run cron"}`,
 			Variables:   `[{"key":"CRON_SCHEDULE","label":"Schedule","default":"0 * * * *","required":true,"secret":false}]`,
 			IsOfficial:  true,
@@ -505,6 +766,167 @@ func SeedTemplates() []ServiceTemplate {
 			Variables:   `[{"key":"IMAGE","label":"Docker Image","default":"","required":true,"secret":false},{"key":"TAG","label":"Image Tag","default":"latest","required":false,"secret":false}]`,
 			IsOfficial:  true,
 		},
+		// Self-hosted applications — runtime doubles as the image reference.
+		{
+			ID:          "tpl-nextcloud",
+			Name:        "Nextcloud",
+			Description: "Self-hosted file sync, share and collaboration platform",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/nextcloud",
+			Config:      `{"type":"web","runtime":"nextcloud:30-apache","port":80,"health_check":"/status.php"}`,
+			Variables:   `[{"key":"NEXTCLOUD_ADMIN_USER","label":"Admin User","default":"admin","required":false,"secret":false},{"key":"NEXTCLOUD_ADMIN_PASSWORD","label":"Admin Password","default":"","required":true,"secret":true},{"key":"NEXTCLOUD_TRUSTED_DOMAINS","label":"Trusted Domains","default":"","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-gitea",
+			Name:        "Gitea",
+			Description: "Lightweight self-hosted Git service",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/gitea",
+			Config:      `{"type":"web","runtime":"gitea/gitea:1","port":3000,"health_check":"/api/healthz"}`,
+			Variables:   `[{"key":"GITEA__server__DOMAIN","label":"Server Domain","default":"localhost","required":false,"secret":false},{"key":"GITEA__server__ROOT_URL","label":"Root URL","default":"","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-ghost",
+			Name:        "Ghost",
+			Description: "Independent publishing platform for blogs and newsletters",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/ghost",
+			Config:      `{"type":"web","runtime":"ghost:5-alpine","port":2368,"health_check":"/ghost/api/admin/site/"}`,
+			Variables:   `[{"key":"url","label":"Public URL","default":"","required":true,"secret":false},{"key":"database__client","label":"Database Client","default":"sqlite3","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-uptime-kuma",
+			Name:        "Uptime Kuma",
+			Description: "Self-hosted monitoring tool for services and websites",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/uptimerobot",
+			Config:      `{"type":"web","runtime":"louislam/uptime-kuma:1","port":3001,"health_check":"/"}`,
+			Variables:   `[]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-vaultwarden",
+			Name:        "Vaultwarden",
+			Description: "Lightweight Bitwarden-compatible password manager",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/bitwarden",
+			Config:      `{"type":"web","runtime":"vaultwarden/server:latest","port":80,"health_check":"/alive"}`,
+			Variables:   `[{"key":"ADMIN_TOKEN","label":"Admin Token","default":"","required":false,"secret":true},{"key":"SIGNUPS_ALLOWED","label":"Allow Signups","default":"false","required":false,"secret":false},{"key":"DOMAIN","label":"Domain URL","default":"","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-jellyfin",
+			Name:        "Jellyfin",
+			Description: "Free software media system for movies, shows and music",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/jellyfin",
+			Config:      `{"type":"web","runtime":"jellyfin/jellyfin:latest","port":8096,"health_check":"/health"}`,
+			Variables:   `[]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-n8n",
+			Name:        "n8n",
+			Description: "Workflow automation tool with hundreds of integrations",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/n8n",
+			Config:      `{"type":"web","runtime":"n8nio/n8n:latest","port":5678,"health_check":"/healthz"}`,
+			Variables:   `[{"key":"N8N_HOST","label":"Hostname","default":"","required":false,"secret":false},{"key":"N8N_ENCRYPTION_KEY","label":"Encryption Key","default":"","required":true,"secret":true},{"key":"WEBHOOK_URL","label":"Webhook URL","default":"","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-grafana",
+			Name:        "Grafana",
+			Description: "Observability dashboards for metrics, logs and traces",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/grafana",
+			Config:      `{"type":"web","runtime":"grafana/grafana:latest","port":3000,"health_check":"/api/health"}`,
+			Variables:   `[{"key":"GF_SECURITY_ADMIN_PASSWORD","label":"Admin Password","default":"","required":true,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-immich",
+			Name:        "Immich",
+			Description: "Self-hosted photo and video backup",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/immich",
+			Config:      `{"type":"web","runtime":"ghcr.io/immich-app/immich-server:release","port":2283,"health_check":"/api/server/ping"}`,
+			Variables:   `[{"key":"DB_PASSWORD","label":"Database Password","default":"","required":true,"secret":true},{"key":"DB_HOSTNAME","label":"Database Host","default":"","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-meilisearch",
+			Name:        "Meilisearch",
+			Description: "Fast, typo-tolerant search engine API",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/meilisearch",
+			Config:      `{"type":"web","runtime":"getmeili/meilisearch:v1","port":7700,"health_check":"/health"}`,
+			Variables:   `[{"key":"MEILI_MASTER_KEY","label":"Master Key","default":"","required":true,"secret":true},{"key":"MEILI_ENV","label":"Environment","default":"production","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-plausible",
+			Name:        "Plausible Analytics",
+			Description: "Lightweight, privacy-friendly web analytics",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/plausibleanalytics",
+			Config:      `{"type":"web","runtime":"ghcr.io/plausible/community-edition:v2","port":8000,"health_check":"/api/health"}`,
+			Variables:   `[{"key":"BASE_URL","label":"Base URL","default":"","required":true,"secret":false},{"key":"SECRET_KEY_BASE","label":"Secret Key Base","default":"","required":true,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-minio",
+			Name:        "MinIO",
+			Description: "S3-compatible object storage",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/minio",
+			Config:      `{"type":"web","runtime":"minio/minio:latest","start_command":"server /data --console-address \":9001\"","port":9001,"health_check":"/minio/health/live"}`,
+			Variables:   `[{"key":"MINIO_ROOT_USER","label":"Root User","default":"minioadmin","required":true,"secret":false},{"key":"MINIO_ROOT_PASSWORD","label":"Root Password","default":"","required":true,"secret":true}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-appwrite",
+			Name:        "Appwrite",
+			Description: "Backend-as-a-service for web and mobile apps",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/appwrite",
+			Config:      `{"type":"web","runtime":"appwrite/appwrite:1.6","port":80,"health_check":"/health"}`,
+			Variables:   `[]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-wordpress",
+			Name:        "WordPress",
+			Description: "Classic CMS powering a large share of the web",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/wordpress",
+			Config:      `{"type":"web","runtime":"wordpress:6-apache","port":80,"health_check":"/wp-login.php"}`,
+			Variables:   `[{"key":"WORDPRESS_DB_HOST","label":"Database Host","default":"","required":true,"secret":false},{"key":"WORDPRESS_DB_USER","label":"Database User","default":"wordpress","required":true,"secret":false},{"key":"WORDPRESS_DB_PASSWORD","label":"Database Password","default":"","required":true,"secret":true},{"key":"WORDPRESS_DB_NAME","label":"Database Name","default":"wordpress","required":true,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-paperless",
+			Name:        "Paperless-ngx",
+			Description: "Document management system with OCR",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/paperlessngx",
+			Config:      `{"type":"web","runtime":"ghcr.io/paperless-ngx/paperless-ngx:latest","port":8000,"health_check":"/api/"}`,
+			Variables:   `[{"key":"PAPERLESS_ADMIN_PASSWORD","label":"Admin Password","default":"","required":true,"secret":true},{"key":"PAPERLESS_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
+			IsOfficial:  true,
+		},
+		{
+			ID:          "tpl-ntfy",
+			Name:        "ntfy",
+			Description: "Push notification service over HTTP",
+			Category:    "app",
+			Logo:        "https://cdn.simpleicons.org/ntfy",
+			Config:      `{"type":"web","runtime":"binwiederhier/ntfy:latest","start_command":"serve","port":80,"health_check":"/v1/health"}`,
+			Variables:   `[]`,
+			IsOfficial:  true,
+		},
 	}
 	return templates
 }
@@ -605,12 +1027,31 @@ func defaultTemplateResources(serviceType string) (cpu, memory string) {
 	}
 }
 
+// templateVisibleTo reports whether the caller may see a template: official and
+// published (is_public) templates are public, other user templates are
+// owner/admin only.
+func templateVisibleTo(c *gin.Context, t ServiceTemplate) bool {
+	if t.IsOfficial || t.IsPublic {
+		return true
+	}
+	if contextIsAdmin(c) {
+		return true
+	}
+	userID := optionalUserID(c)
+	return userID != "" && t.OwnerID == userID
+}
+
 func mapSQLCTemplate(row sqlcdb.ServiceTemplate) ServiceTemplate {
 	variables := "[]"
 	if row.Variables.Valid && len(row.Variables.RawMessage) > 0 {
 		variables = string(row.Variables.RawMessage)
 	}
 
+	ownerID := ""
+	if row.OwnerID.Valid {
+		ownerID = row.OwnerID.UUID.String()
+	}
+
 	return ServiceTemplate{
 		ID:          row.ID,
 		Name:        row.Name,
@@ -620,6 +1061,8 @@ func mapSQLCTemplate(row sqlcdb.ServiceTemplate) ServiceTemplate {
 		Config:      string(row.Config),
 		Variables:   variables,
 		IsOfficial:  row.IsOfficial.Valid && row.IsOfficial.Bool,
+		OwnerID:     ownerID,
+		IsPublic:    row.IsPublic,
 		CreatedAt:   templateNullTime(row.CreatedAt),
 		UpdatedAt:   templateNullTime(row.UpdatedAt),
 	}

app/backend/internal/api/user_tokens.go

@@ -0,0 +1,194 @@
+package api
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"net/http"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+	sqlcdb "containr/internal/database/sqlcdb"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// Personal access tokens let the CLI, MCP server, and third-party agents
+// authenticate without a browser session. The raw token (cnp_…) is
+// returned exactly once at creation; only its sha256 hash persists.
+
+var userTokenScopes = map[string]bool{"read": true, "write": true, "admin": true}
+
+func generateUserToken() (token string, prefix string, hash string, err error) {
+	buf := make([]byte, 24)
+	if _, err = rand.Read(buf); err != nil {
+		return "", "", "", err
+	}
+	token = "cnp_" + hex.EncodeToString(buf)
+	prefix = token[:12] // cnp_ + 8 hex chars, enough to identify in a list
+	sum := sha256.Sum256([]byte(token))
+	return token, prefix, hex.EncodeToString(sum[:]), nil
+}
+
+func userTokenJSON(t sqlcdb.UserToken) gin.H {
+	row := gin.H{
+		"id":         t.ID.String(),
+		"name":       t.Name,
+		"key_prefix": t.KeyPrefix,
+		"scope":      t.Scope,
+	}
+	if t.CreatedAt.Valid {
+		row["created_at"] = t.CreatedAt.Time
+	}
+	if t.LastUsedAt.Valid {
+		row["last_used_at"] = t.LastUsedAt.Time
+	}
+	if t.ExpiresAt.Valid {
+		row["expires_at"] = t.ExpiresAt.Time
+	}
+	return row
+}
+
+func handleCreateUserToken(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	var req struct {
+		Name          string `json:"name"`
+		Scope         string `json:"scope"`
+		ExpiresInDays int    `json:"expires_in_days"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	req.Name = strings.TrimSpace(req.Name)
+	if req.Name == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "name is required", "code": "VALIDATION"})
+		return
+	}
+	if req.Scope == "" {
+		req.Scope = "write"
+	}
+	if !userTokenScopes[req.Scope] {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "scope must be one of: read, write, admin", "code": "VALIDATION"})
+		return
+	}
+	// A token can never outrank its owner: non-admin users cannot mint
+	// admin-scope tokens even for themselves.
+	if req.Scope == "admin" && !c.GetBool("is_admin") {
+		c.JSON(http.StatusForbidden, gin.H{"error": "admin scope requires a platform admin account", "code": "FORBIDDEN"})
+		return
+	}
+	if req.ExpiresInDays < 0 || req.ExpiresInDays > 3650 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "expires_in_days must be between 0 (never) and 3650", "code": "VALIDATION"})
+		return
+	}
+
+	token, prefix, hash, err := generateUserToken()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate token", "code": "INTERNAL"})
+		return
+	}
+
+	ownerUUID, err := uuid.Parse(userID)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context", "code": "INVALID_TOKEN"})
+		return
+	}
+
+	expiresAt := sql.NullTime{}
+	if req.ExpiresInDays > 0 {
+		expiresAt = sql.NullTime{Time: time.Now().Add(time.Duration(req.ExpiresInDays) * 24 * time.Hour), Valid: true}
+	}
+
+	row, err := queries.CreateUserToken(c.Request.Context(), sqlcdb.CreateUserTokenParams{
+		UserID:    ownerUUID,
+		Name:      req.Name,
+		KeyPrefix: prefix,
+		TokenHash: hash,
+		Scope:     req.Scope,
+		ExpiresAt: expiresAt,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to store token", "code": "INTERNAL"})
+		return
+	}
+
+	LogAudit(userID, "user_token", row.ID.String(), "create", map[string]interface{}{"name": req.Name, "scope": req.Scope})
+
+	payload := userTokenJSON(row)
+	payload["token"] = token
+	c.JSON(http.StatusCreated, payload)
+}
+
+func handleListUserTokens(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	ownerUUID, err := uuid.Parse(userID)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context", "code": "INVALID_TOKEN"})
+		return
+	}
+
+	rows, err := queries.ListUserTokens(c.Request.Context(), ownerUUID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to fetch tokens", "code": "INTERNAL"})
+		return
+	}
+
+	out := make([]gin.H, 0, len(rows))
+	for _, t := range rows {
+		out = append(out, userTokenJSON(t))
+	}
+	c.JSON(http.StatusOK, gin.H{"tokens": out})
+}
+
+func handleDeleteUserToken(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	queries := sqlcdb.New(db.DB)
+
+	ownerUUID, err := uuid.Parse(userID)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid user context", "code": "INVALID_TOKEN"})
+		return
+	}
+	tokenUUID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid token ID", "code": "VALIDATION"})
+		return
+	}
+
+	affected, err := queries.RevokeUserToken(c.Request.Context(), sqlcdb.RevokeUserTokenParams{
+		ID:     tokenUUID,
+		UserID: ownerUUID,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to revoke token", "code": "INTERNAL"})
+		return
+	}
+	if affected == 0 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Token not found", "code": "NOT_FOUND"})
+		return
+	}
+
+	LogAudit(userID, "user_token", tokenUUID.String(), "revoke", nil)
+	c.JSON(http.StatusOK, gin.H{"message": "Token revoked"})
+}

app/backend/internal/api/variables.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/secrets"
 	"net/http"
 	"time"
 
@@ -25,6 +26,7 @@ type EnvironmentVariable struct {
 
 type UpdateVariablesRequest struct {
 	Variables []VariableInput `json:"variables" binding:"required"`
+	Redeploy  bool            `json:"redeploy"`
 }
 
 type VariableInput struct {
@@ -47,26 +49,12 @@ func handleGetVariables(c *gin.Context) {
 		return
 	}
 
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
-	var ownerCheck string
-	err = db.(*database.DB).QueryRow(
-		`SELECT p.owner_id FROM services s 
-		 JOIN projects p ON s.project_id = p.id 
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(&ownerCheck)
-
-	if err != nil {
+	projectID, found := serviceProjectID(db.(*database.DB), serviceID)
+	if !found {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
-
-	if ownerCheck != userID.(string) {
+	if _, allowed := projectManageAccess(c, db.(*database.DB), projectID); !allowed {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -123,26 +111,12 @@ func handleUpdateVariables(c *gin.Context) {
 		return
 	}
 
-	userID, exists := c.Get("user_id")
-	if !exists {
-		c.JSON(http.StatusUnauthorized, gin.H{"error": "User not authenticated"})
-		return
-	}
-
-	var ownerCheck string
-	err = db.(*database.DB).QueryRow(
-		`SELECT p.owner_id FROM services s 
-		 JOIN projects p ON s.project_id = p.id 
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(&ownerCheck)
-
-	if err != nil {
+	projectID, found := serviceProjectID(db.(*database.DB), serviceID)
+	if !found {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
-
-	if ownerCheck != userID.(string) {
+	if _, allowed := projectManageAccess(c, db.(*database.DB), projectID); !allowed {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -187,6 +161,9 @@ func handleUpdateVariables(c *gin.Context) {
 				value = stored
 			}
 		}
+		if v.IsSecret {
+			value = secrets.Encrypt(value)
+		}
 		varID := uuid.New()
 		_, err = tx.Exec(
 			`INSERT INTO environment_variables (id, service_id, key, value, is_secret, created_at, updated_at)
@@ -232,5 +209,24 @@ func handleUpdateVariables(c *gin.Context) {
 		variables = append(variables, v)
 	}
 
-	c.JSON(http.StatusOK, gin.H{"variables": variables, "message": "Environment variables updated successfully"})
+	resp := gin.H{"variables": variables, "message": "Environment variables updated successfully"}
+	if req.Redeploy {
+		// Load the service spec inputs and queue a reconcile behind any
+		// in-flight deployment — new env lands in the recreated containers.
+		var svc Service
+		svcErr := db.(*database.DB).QueryRow(
+			`SELECT id, project_id, name, COALESCE(image, ''), COALESCE(command, ''),
+			        COALESCE(replicas, 1), COALESCE(port, 0), COALESCE(domain, ''),
+			        COALESCE(healthcheck_path, ''), COALESCE(restart_policy, 'unless-stopped'),
+			        COALESCE(cpu, ''), COALESCE(memory, ''),
+			        COALESCE(builder, 'auto'), COALESCE(cpu_reserve, ''), COALESCE(memory_reserve, '')
+			 FROM services WHERE id = $1`,
+			serviceID,
+		).Scan(&svc.ID, &svc.ProjectID, &svc.Name, &svc.Image, &svc.Command,
+			&svc.Replicas, &svc.Port, &svc.Domain, &svc.HealthCheckPath,
+			&svc.RestartPolicy, &svc.CPU, &svc.Memory,
+			&svc.Builder, &svc.CPUReserve, &svc.MemoryReserve)
+		resp["redeploy_queued"] = svcErr == nil && enqueueServiceRedeploy(c, db.(*database.DB), svc)
+	}
+	c.JSON(http.StatusOK, resp)
 }

app/backend/internal/api/volumes.go

@@ -0,0 +1,105 @@
+package api
+
+import (
+	"net/http"
+	"time"
+
+	"containr/internal/docker"
+
+	"github.com/gin-gonic/gin"
+)
+
+// VolumeInfo is one docker volume plus whether any container mounts it.
+type VolumeInfo struct {
+	Name       string            `json:"name"`
+	Driver     string            `json:"driver"`
+	Mountpoint string            `json:"mountpoint"`
+	Scope      string            `json:"scope"`
+	InUse      bool              `json:"in_use"`
+	UsedBy     []string          `json:"used_by,omitempty"`
+	Labels     map[string]string `json:"labels,omitempty"`
+	CreatedAt  time.Time         `json:"created_at,omitempty"`
+}
+
+func dockerClientOr500(c *gin.Context) (*docker.Client, bool) {
+	v, exists := c.Get("docker_client")
+	if !exists || v == nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "Docker client not available")
+		return nil, false
+	}
+	return v.(*docker.Client), true
+}
+
+// handleAdminListVolumes returns the node's docker volume inventory with
+// in-use flags. Admin-only: mountpoints reveal host filesystem layout.
+func handleAdminListVolumes(c *gin.Context) {
+	client, ok := dockerClientOr500(c)
+	if !ok {
+		return
+	}
+	ctx := c.Request.Context()
+
+	vols, err := client.ListVolumes(ctx)
+	if err != nil {
+		respondError(c, http.StatusBadGateway, "DEPENDENCY_UNAVAILABLE", "Failed to list volumes: "+err.Error())
+		return
+	}
+
+	containers, err := client.ListContainers(ctx, true)
+	if err != nil {
+		respondError(c, http.StatusBadGateway, "DEPENDENCY_UNAVAILABLE", "Failed to list containers: "+err.Error())
+		return
+	}
+	inUse := map[string][]string{}
+	for _, cont := range containers {
+		for _, m := range cont.Mounts {
+			if m.Type == "volume" {
+				name := cont.ID[:12]
+				if len(cont.Names) > 0 {
+					name = cont.Names[0]
+				}
+				inUse[m.Name] = append(inUse[m.Name], name)
+			}
+		}
+	}
+
+	out := make([]VolumeInfo, 0, len(vols.Volumes))
+	for _, v := range vols.Volumes {
+		if v == nil {
+			continue
+		}
+		info := VolumeInfo{
+			Name:       v.Name,
+			Driver:     v.Driver,
+			Mountpoint: v.Mountpoint,
+			Scope:      v.Scope,
+			Labels:     v.Labels,
+			UsedBy:     inUse[v.Name],
+		}
+		info.InUse = len(info.UsedBy) > 0
+		if t, err := time.Parse(time.RFC3339Nano, v.CreatedAt); err == nil {
+			info.CreatedAt = t
+		}
+		out = append(out, info)
+	}
+	c.JSON(http.StatusOK, gin.H{"volumes": out})
+}
+
+// handleAdminDeleteVolume removes a docker volume. Docker refuses removal
+// of in-use volumes — that error is surfaced as a conflict.
+func handleAdminDeleteVolume(c *gin.Context) {
+	client, ok := dockerClientOr500(c)
+	if !ok {
+		return
+	}
+	name := c.Param("name")
+	if name == "" {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Volume name is required")
+		return
+	}
+	if err := client.RemoveVolume(c.Request.Context(), name, false); err != nil {
+		respondError(c, http.StatusConflict, "CONFLICT", "Failed to remove volume: "+err.Error())
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"deleted": name})
+}

app/backend/internal/build/dockerfile.go

@@ -211,8 +211,12 @@ func (d *DockerfileBuilder) Build(ctx context.Context, req *types.BuildRequest)
 	// Build Docker image
 	imageName := fmt.Sprintf("%s:%s", req.ImageName, req.ImageTag)
 
-	// Create build context tar
-	buildCtx, err := createBuildContext(req.SourcePath, optimizedDockerfile)
+	// createBuildContext wants the Dockerfile contents, not its path.
+	dockerfileContent, err := os.ReadFile(optimizedDockerfile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read Dockerfile: %w", err)
+	}
+	buildCtx, err := createBuildContext(req.SourcePath, string(dockerfileContent))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create build context: %w", err)
 	}
@@ -222,6 +226,7 @@ func (d *DockerfileBuilder) Build(ctx context.Context, req *types.BuildRequest)
 		Dockerfile: "Dockerfile",
 		Tags:       []string{imageName},
 		BuildArgs:  buildArgs,
+		NoCache:    req.NoCache,
 		Remove:     true,
 	}
 

app/backend/internal/build/manager.go

@@ -16,6 +16,7 @@ type BuildManager struct {
 	railpackBuilder   *RailpackBuilder
 	nixpacksBuilder   *NixpacksBuilder
 	dockerfileBuilder *DockerfileBuilder
+	staticBuilder     *StaticBuilder
 	dockerClient      *docker.Client
 	cacheManager      *CacheManager
 	parallelBuilder   *ParallelBuilder
@@ -28,6 +29,7 @@ const (
 	BuildTypeRailpack   BuildType = "railpack"
 	BuildTypeNixpacks   BuildType = "nixpacks"
 	BuildTypeDockerfile BuildType = "dockerfile"
+	BuildTypeStatic     BuildType = "static"
 	BuildTypePrebuilt   BuildType = "prebuilt"
 )
 
@@ -39,6 +41,7 @@ func NewBuildManager(workDir string, dockerClient *docker.Client) *BuildManager
 		railpackBuilder:   NewRailpackBuilder(workDir, dockerClient),
 		nixpacksBuilder:   NewNixpacksBuilder(workDir, dockerClient),
 		dockerfileBuilder: NewDockerfileBuilder(workDir, dockerClient),
+		staticBuilder:     NewStaticBuilder(dockerClient),
 		dockerClient:      dockerClient,
 		cacheManager:      cacheManager,
 		parallelBuilder:   parallelBuilder,
@@ -80,6 +83,8 @@ func (bm *BuildManager) Build(ctx context.Context, req *types.BuildRequest) (*ty
 		return bm.nixpacksBuilder.Build(ctx, req)
 	case BuildTypeDockerfile:
 		return bm.dockerfileBuilder.Build(ctx, req)
+	case BuildTypeStatic:
+		return bm.staticBuilder.Build(ctx, req)
 	case BuildTypePrebuilt:
 		return bm.buildPrebuilt(ctx, req)
 	default:
@@ -93,10 +98,10 @@ func (bm *BuildManager) buildPrebuilt(ctx context.Context, req *types.BuildReque
 		return nil, fmt.Errorf("prebuilt image not specified")
 	}
 
-	// Pull the prebuilt image
+	// Pull the prebuilt image — must drain the pull stream or the daemon
+	// aborts it and the tag below races a missing image.
 	auth := registry.AuthConfig{}
-	_, err := bm.dockerClient.PullImage(ctx, req.PrebuiltImage, auth)
-	if err != nil {
+	if err := bm.dockerClient.PullImageWait(ctx, req.PrebuiltImage, auth); err != nil {
 		return nil, fmt.Errorf("failed to pull prebuilt image: %w", err)
 	}
 
@@ -104,7 +109,7 @@ func (bm *BuildManager) buildPrebuilt(ctx context.Context, req *types.BuildReque
 	if req.ImageName != "" && req.ImageTag != "" {
 		targetImage := fmt.Sprintf("%s:%s", req.ImageName, req.ImageTag)
 		if targetImage != req.PrebuiltImage {
-			err = bm.dockerClient.TagImage(ctx, req.PrebuiltImage, targetImage)
+			err := bm.dockerClient.TagImage(ctx, req.PrebuiltImage, targetImage)
 			if err != nil {
 				return nil, fmt.Errorf("failed to tag image: %w", err)
 			}
@@ -114,7 +119,7 @@ func (bm *BuildManager) buildPrebuilt(ctx context.Context, req *types.BuildReque
 
 	// Push to registry if specified
 	if req.RegistryURL != "" {
-		err = bm.dockerClient.PushImage(ctx, req.PrebuiltImage, req.RegistryURL)
+		err := bm.dockerClient.PushImage(ctx, req.PrebuiltImage, req.RegistryURL)
 		if err != nil {
 			return nil, fmt.Errorf("failed to push image: %w", err)
 		}

app/backend/internal/build/nixpacks.go

@@ -498,7 +498,8 @@ func (n *NixpacksBuilder) Build(ctx context.Context, req *types.BuildRequest) (*
 		BuildArgs: map[string]*string{
 			"BUILDKIT_INLINE_CACHE": strPtr("1"),
 		},
-		Remove: true,
+		NoCache: req.NoCache,
+		Remove:  true,
 	}
 
 	_, err = n.dockerClient.BuildImage(ctx, buildCtx, buildOptions)

app/backend/internal/build/railpack.go

@@ -156,6 +156,7 @@ func (rb *RailpackBuilder) Build(ctx context.Context, req *types.BuildRequest) (
 		Tags:       []string{imageName},
 		BuildArgs:  buildArgs,
 		Labels:     req.Labels,
+		NoCache:    req.NoCache,
 		Remove:     true,
 	}
 

app/backend/internal/build/static.go

@@ -0,0 +1,95 @@
+package build
+
+import (
+	"context"
+	"fmt"
+
+	"containr/internal/docker"
+	"containr/internal/types"
+)
+
+// StaticBuilder produces an nginx-served image from a repo's built assets.
+// STATIC_BUILD_CMD runs inside a node build stage; STATIC_DIR names the
+// output directory copied into the nginx image. Both are overridable via
+// build args so repos with non-node toolchains can swap the build image too.
+type StaticBuilder struct {
+	dockerClient *docker.Client
+}
+
+func NewStaticBuilder(dockerClient *docker.Client) *StaticBuilder {
+	return &StaticBuilder{dockerClient: dockerClient}
+}
+
+const staticDockerfile = `ARG BUILD_IMAGE=node:20-alpine
+FROM ${BUILD_IMAGE} AS assets
+WORKDIR /app
+COPY . .
+ARG STATIC_BUILD_CMD
+RUN sh -c "${STATIC_BUILD_CMD}"
+
+FROM nginx:alpine
+ARG STATIC_DIR=dist
+COPY --from=assets /app/${STATIC_DIR} /usr/share/nginx/html
+EXPOSE 80
+CMD ["nginx", "-g", "daemon off;"]
+`
+
+func (s *StaticBuilder) Build(ctx context.Context, req *types.BuildRequest) (*types.BuildResponse, error) {
+	buildCmd := req.BuildCommand
+	if buildCmd == "" {
+		buildCmd = "npm ci && npm run build"
+	}
+	staticDir := req.BuildArgs["STATIC_DIR"]
+	if staticDir == "" {
+		staticDir = "dist"
+	}
+
+	buildArgs := map[string]*string{}
+	for k, v := range req.BuildArgs {
+		v := v
+		buildArgs[k] = &v
+	}
+	for k, v := range req.Environment {
+		v := v
+		buildArgs[k] = &v
+	}
+	buildArgs["STATIC_BUILD_CMD"] = &buildCmd
+	buildArgs["STATIC_DIR"] = &staticDir
+
+	imageName := fmt.Sprintf("%s:%s", req.ImageName, req.ImageTag)
+	buildCtx, err := createBuildContext(req.SourcePath, staticDockerfile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create build context: %w", err)
+	}
+	defer buildCtx.Close()
+
+	if _, err := s.dockerClient.BuildImage(ctx, buildCtx, docker.BuildOptions{
+		Dockerfile: "Dockerfile",
+		Tags:       []string{imageName},
+		BuildArgs:  buildArgs,
+		NoCache:    req.NoCache,
+		Remove:     true,
+	}); err != nil {
+		return nil, fmt.Errorf("failed to build static image: %w", err)
+	}
+
+	if req.RegistryURL != "" {
+		full := fmt.Sprintf("%s/%s", req.RegistryURL, imageName)
+		if err := s.dockerClient.PushImage(ctx, imageName, req.RegistryURL); err != nil {
+			return nil, fmt.Errorf("failed to push image: %w", err)
+		}
+		imageName = full
+	}
+
+	imageInfo, err := s.dockerClient.GetImageInfo(ctx, imageName)
+	if err != nil {
+		imageInfo = &docker.ImageInfo{Size: 0}
+	}
+
+	return &types.BuildResponse{
+		ImageName: imageName,
+		ImageTag:  req.ImageTag,
+		Size:      imageInfo.Size,
+		Digest:    imageInfo.Digest,
+	}, nil
+}

app/backend/internal/cli/commands/admin.go

@@ -0,0 +1,361 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// AdminCmd groups platform-admin operations.
+var AdminCmd = &cobra.Command{
+	Use:   "admin",
+	Short: "Platform administration (admin scope required)",
+}
+
+var adminOverviewCmd = &cobra.Command{
+	Use:   "overview",
+	Short: "Platform overview",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/admin/overview", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var adminUsersCmd = &cobra.Command{
+	Use:   "users",
+	Short: "List all users",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/admin/users", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "users")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, u := range items {
+			rows = append(rows, []string{
+				str(u, "id"), str(u, "email"), str(u, "name"), str(u, "is_admin"), relTime(u, "created_at"),
+			})
+		}
+		printRows(data, []string{"ID", "EMAIL", "NAME", "ADMIN", "CREATED"}, rows)
+		return nil
+	},
+}
+
+var adminSettingsCmd = &cobra.Command{
+	Use:   "settings",
+	Short: "Show platform settings",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/settings", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var adminAuditCmd = &cobra.Command{
+	Use:   "audit-logs",
+	Short: "List audit log entries",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/audit-logs", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+// GatewayCmd manages the API gateway (admin).
+var GatewayCmd = &cobra.Command{
+	Use:   "gateway",
+	Short: "Manage the API gateway (admin)",
+}
+
+var gatewayServicesCmd = &cobra.Command{
+	Use:   "services",
+	Short: "List gateway services",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/gateway/services", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var gatewayKeysCmd = &cobra.Command{
+	Use:   "keys",
+	Short: "List gateway API keys",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/gateway/keys", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var gatewayAnalyticsCmd = &cobra.Command{
+	Use:   "analytics",
+	Short: "Gateway traffic analytics",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		kind, _ := cmd.Flags().GetString("type")
+		data, err := c.Do("GET", "/gateway/analytics/"+kind, nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+// HACmd manages high availability.
+var HACmd = &cobra.Command{
+	Use:   "ha",
+	Short: "High availability controls",
+}
+
+var haStatusCmd = &cobra.Command{
+	Use:   "status",
+	Short: "Show HA status",
+	RunE:  simpleGet("/ha/status"),
+}
+
+var haAlertsCmd = &cobra.Command{
+	Use:   "alerts",
+	Short: "List active HA alerts",
+	RunE:  simpleGet("/ha/alerts/active"),
+}
+
+var haHealthCmd = &cobra.Command{
+	Use:   "health",
+	Short: "List health check results",
+	RunE:  simpleGet("/ha/health/results"),
+}
+
+var haPoliciesCmd = &cobra.Command{
+	Use:   "policies",
+	Short: "List failover policies",
+	RunE:  simpleGet("/ha/failover/policies"),
+}
+
+var haEnableCmd = &cobra.Command{
+	Use:   "enable",
+	Short: "Enable the HA manager",
+	RunE:  simplePost("/ha/enable"),
+}
+
+var haDisableCmd = &cobra.Command{
+	Use:   "disable",
+	Short: "Disable the HA manager",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if !Confirm("Disable HA? Services will no longer be failed over.") {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		return simplePost("/ha/disable")(cmd, args)
+	},
+}
+
+var haFailoverCmd = &cobra.Command{
+	Use:   "failover",
+	Short: "Trigger a manual failover",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if !Confirm("Trigger a platform failover now? Services may be rescheduled.") {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		return simplePost("/ha/failover")(cmd, args)
+	},
+}
+
+// ScalingCmd manages autoscaling.
+var ScalingCmd = &cobra.Command{
+	Use:   "scaling",
+	Short: "Autoscaling controls",
+}
+
+var scalingStatusCmd = &cobra.Command{
+	Use:   "status",
+	Short: "Show autoscaler status",
+	RunE:  simpleGet("/scaling/status"),
+}
+
+var scalingPoliciesCmd = &cobra.Command{
+	Use:   "policies",
+	Short: "List scaling policies",
+	RunE:  simpleGet("/scaling/policies"),
+}
+
+var scalingServicesCmd = &cobra.Command{
+	Use:   "services",
+	Short: "Show per-service scaling state",
+	RunE:  simpleGet("/scaling/services"),
+}
+
+var scalingScaleCmd = &cobra.Command{
+	Use:   "scale <service-id> <replicas>",
+	Short: "Manually scale a service",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		var replicas int
+		fmt.Sscanf(args[1], "%d", &replicas)
+		data, err := c.Do("POST", "/scaling/services/"+args[0]+"/scale", map[string]int{"replicas": replicas})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+// SecurityCmd manages security scans and findings.
+var SecurityCmd = &cobra.Command{
+	Use:   "security",
+	Short: "Security scans and vulnerabilities",
+}
+
+var securityScanCmd = &cobra.Command{
+	Use:   "scan <project-id>",
+	Short: "Run a security scan",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		scanType, _ := cmd.Flags().GetString("type")
+		serviceID, _ := cmd.Flags().GetString("service")
+		body := map[string]interface{}{"project_id": args[0], "scan_type": scanType}
+		if serviceID != "" {
+			body["service_id"] = serviceID
+		}
+		data, err := c.Do("POST", "/security/scans", body)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var securityVulnsCmd = &cobra.Command{
+	Use:   "vulnerabilities <project-id>",
+	Short: "List a project's vulnerabilities",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/projects/"+args[0]+"/vulnerabilities", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var securityMetricsCmd = &cobra.Command{
+	Use:   "metrics <project-id>",
+	Short: "Show a project's security metrics",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/projects/"+args[0]+"/security/metrics", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+// simpleGet/simplePost cover the many read/trigger endpoints whose full
+// JSON response is the useful output.
+func simpleGet(path string) func(*cobra.Command, []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", path, nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	}
+}
+
+func simplePost(path string) func(*cobra.Command, []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", path, map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	}
+}
+
+func init() {
+	gatewayAnalyticsCmd.Flags().String("type", "traffic", "traffic|ops")
+	securityScanCmd.Flags().String("type", "configuration", "dependency|configuration|comprehensive")
+	securityScanCmd.Flags().String("service", "", "limit scan to one service")
+
+	AdminCmd.AddCommand(adminOverviewCmd, adminUsersCmd, adminSettingsCmd, adminAuditCmd)
+	GatewayCmd.AddCommand(gatewayServicesCmd, gatewayKeysCmd, gatewayAnalyticsCmd)
+	HACmd.AddCommand(haStatusCmd, haAlertsCmd, haHealthCmd, haPoliciesCmd, haEnableCmd, haDisableCmd, haFailoverCmd)
+	ScalingCmd.AddCommand(scalingStatusCmd, scalingPoliciesCmd, scalingServicesCmd, scalingScaleCmd)
+	SecurityCmd.AddCommand(securityScanCmd, securityVulnsCmd, securityMetricsCmd)
+}

app/backend/internal/cli/commands/auth.go

@@ -2,139 +2,150 @@ package commands
 
 import (
 	"fmt"
-	"net/http"
-	"strings"
-	"time"
+	"os"
 
 	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
+	"golang.org/x/term"
 )
 
-// AuthCmd represents the auth command
+// AuthCmd groups authentication commands.
 var AuthCmd = &cobra.Command{
 	Use:   "auth",
-	Short: "Authenticate with Containr API",
-	Long: `Manage authentication with the Containr API.
-You can login, logout, and check your current authentication status.`,
+	Short: "Authenticate with a Containr instance",
+	Long: `Login with a personal access token (cnp_...) created under
+Settings → Personal Access Tokens, check status, or switch profiles.`,
 }
 
-// loginCmd represents the login command
 var loginCmd = &cobra.Command{
 	Use:   "login [token]",
-	Short: "Login to Containr",
-	Long: `Login to Containr using your API token.
-You can get your token from the Containr web interface.`,
+	Short: "Store a personal access token",
+	Long: `Login with a cnp_ token. Reads interactively when no argument is
+given. The token is verified against the API before it is stored.`,
 	Args: cobra.MaximumNArgs(1),
 	RunE: runLogin,
 }
 
-// logoutCmd represents the logout command
 var logoutCmd = &cobra.Command{
 	Use:   "logout",
-	Short: "Logout from Containr",
-	Long:  `Remove stored authentication credentials.`,
+	Short: "Remove the stored token",
 	RunE:  runLogout,
 }
 
-// statusCmd represents the status command
 var statusCmd = &cobra.Command{
 	Use:   "status",
-	Short: "Check authentication status",
-	Long:  `Check if you are currently authenticated with Containr.`,
+	Short: "Show the active profile and verify the token",
 	RunE:  runStatus,
 }
 
 func init() {
-	AuthCmd.AddCommand(loginCmd)
-	AuthCmd.AddCommand(logoutCmd)
-	AuthCmd.AddCommand(statusCmd)
+	loginCmd.Flags().String("url", "", "API URL to store in the profile (e.g. https://containr.example.com)")
+	loginCmd.Flags().String("name", "", "profile name to save under (default: active profile)")
+	AuthCmd.AddCommand(loginCmd, logoutCmd, statusCmd)
+}
+
+type profileResponse struct {
+	ID      string `json:"id"`
+	Email   string `json:"email"`
+	Name    string `json:"name"`
+	IsAdmin bool   `json:"is_admin"`
 }
 
 func runLogin(cmd *cobra.Command, args []string) error {
 	var token string
-
 	if len(args) > 0 {
 		token = args[0]
-	} else {
-		// Prompt for token
-		fmt.Print("Enter your Containr API token: ")
-		fmt.Scanln(&token)
+	} else if isTerminal() {
+		fmt.Fprint(os.Stderr, "Token: ")
+		raw, err := term.ReadPassword(int(os.Stdin.Fd()))
+		fmt.Fprintln(os.Stderr)
+		if err != nil {
+			return err
+		}
+		token = string(raw)
 	}
-
 	if token == "" {
-		return fmt.Errorf("token is required")
+		return &APIError{Message: "token is required — pass it as an argument or pipe it via stdin", ExitCode: ExitValidation}
 	}
 
-	// Store token in config
-	viper.Set("token", token)
-	if err := viper.WriteConfig(); err != nil {
-		return fmt.Errorf("failed to save token: %w", err)
+	// Verify before saving so a mistyped token fails loudly.
+	urlFlag, _ := cmd.Flags().GetString("url")
+	probe := &Client{BaseURL: ResolveAPIURL(), Token: token}
+	if urlFlag != "" {
+		probe.BaseURL = normalizeBase(urlFlag)
+	}
+	var profile profileResponse
+	if err := probe.DoJSON("GET", "/user/profile", nil, &profile); err != nil {
+		return fmt.Errorf("token verification failed: %w", err)
 	}
 
-	fmt.Println("✓ Successfully logged in to Containr")
+	name, _ := cmd.Flags().GetString("name")
+	if name == "" {
+		name = ActiveProfile()
+	}
+	if err := SaveProfile(name, probe.BaseURL, token); err != nil {
+		return fmt.Errorf("failed to save profile: %w", err)
+	}
+
+	if JSONMode() {
+		return PrintJSON(map[string]interface{}{
+			"profile": name, "api_url": probe.BaseURL,
+			"user": profile,
+		})
+	}
+	fmt.Printf("Logged in as %s (%s) — profile %q → %s\n", profile.Name, profile.Email, name, probe.BaseURL)
 	return nil
 }
 
 func runLogout(cmd *cobra.Command, args []string) error {
-	// Remove token from config
-	viper.Set("token", "")
-	if err := viper.WriteConfig(); err != nil {
-		return fmt.Errorf("failed to remove token: %w", err)
+	name := ActiveProfile()
+	if err := ClearProfileToken(name); err != nil {
+		return fmt.Errorf("failed to update config: %w", err)
+	}
+	if !JSONMode() {
+		fmt.Printf("Removed token from profile %q\n", name)
+	} else {
+		return PrintJSON(map[string]string{"status": "ok", "profile": name})
 	}
-
-	fmt.Println("✓ Successfully logged out from Containr")
 	return nil
 }
 
 func runStatus(cmd *cobra.Command, args []string) error {
-	token := viper.GetString("token")
-	if token == "" {
-		fmt.Println("❌ Not authenticated")
-		fmt.Println("Run 'containr auth login <token>' to authenticate")
+	client := NewClient()
+	profile := ActiveProfile()
+
+	if JSONMode() {
+		out := map[string]interface{}{
+			"profile": profile,
+			"api_url": client.BaseURL,
+		}
+		if client.Token != "" {
+			var p profileResponse
+			if err := client.DoJSON("GET", "/user/profile", nil, &p); err == nil {
+				out["user"] = p
+				out["authenticated"] = true
+			} else {
+				out["authenticated"] = false
+			}
+		} else {
+			out["authenticated"] = false
+		}
+		return PrintJSON(out)
+	}
+
+	fmt.Printf("Profile:  %s\n", profile)
+	fmt.Printf("API URL:  %s\n", client.BaseURL)
+	if client.Token == "" {
+		fmt.Println("Token:    not set — run `containr auth login <token>`")
 		return nil
 	}
-
-	fmt.Println("✓ Authenticated with Containr")
-	apiURL := buildAPIURL("/user/profile")
-	fmt.Printf("API URL: %s\n", strings.TrimSuffix(buildAPIURL(""), "/"))
-
-	req, err := http.NewRequest(http.MethodGet, apiURL, nil)
-	if err != nil {
-		return fmt.Errorf("failed to create verification request: %w", err)
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-
-	client := &http.Client{Timeout: 5 * time.Second}
-	resp, err := client.Do(req)
-	if err != nil {
-		fmt.Printf("⚠ Token verification unavailable: %v\n", err)
+	var p profileResponse
+	if err := client.DoJSON("GET", "/user/profile", nil, &p); err != nil {
+		fmt.Printf("Token:    present but rejected (%v)\n", err)
 		return nil
 	}
-	defer resp.Body.Close()
-
-	switch resp.StatusCode {
-	case http.StatusOK:
-		fmt.Println("✓ Token verified against API")
-	case http.StatusUnauthorized, http.StatusForbidden:
-		fmt.Println("❌ Token rejected by API (expired/invalid)")
-	default:
-		fmt.Printf("⚠ Token verification returned unexpected status: %s\n", resp.Status)
+	fmt.Printf("Identity: %s <%s>\n", p.Name, p.Email)
+	if p.IsAdmin {
+		fmt.Println("Role:     platform admin")
 	}
-
 	return nil
 }
-
-func buildAPIURL(endpoint string) string {
-	baseURL := viper.GetString("api-url")
-	if baseURL == "" {
-		baseURL = "http://localhost:8080/api/v1"
-	}
-	baseURL = strings.TrimSuffix(baseURL, "/")
-	if endpoint == "" {
-		return baseURL
-	}
-	if !strings.HasPrefix(endpoint, "/") {
-		endpoint = "/" + endpoint
-	}
-	return baseURL + endpoint
-}

app/backend/internal/cli/commands/auth_test.go

@@ -6,16 +6,52 @@ import (
 	"github.com/spf13/viper"
 )
 
-func TestBuildAPIURLDefaultsAndTrimming(t *testing.T) {
+func TestResolveAPIURLDefaultsAndTrimming(t *testing.T) {
 	viper.Set("api-url", "")
-	got := buildAPIURL("/user/profile")
-	if got != "http://localhost:8080/api/v1/user/profile" {
+	viper.Set("current_profile", "")
+	viper.Set("profiles.default.api_url", "")
+	if got := ResolveAPIURL(); got != "http://localhost:8080/api/v1" {
 		t.Fatalf("unexpected default api url: %s", got)
 	}
 
 	viper.Set("api-url", "https://api.example.com/api/v1/")
-	got = buildAPIURL("user/profile")
-	if got != "https://api.example.com/api/v1/user/profile" {
+	if got := ResolveAPIURL(); got != "https://api.example.com/api/v1" {
 		t.Fatalf("unexpected trimmed api url: %s", got)
 	}
+
+	// Bare hosts gain the /api/v1 suffix.
+	viper.Set("api-url", "https://containr.example.com")
+	if got := ResolveAPIURL(); got != "https://containr.example.com/api/v1" {
+		t.Fatalf("unexpected suffixed api url: %s", got)
+	}
+	viper.Set("api-url", "")
+}
+
+func TestResolveTokenProfileAndEnv(t *testing.T) {
+	viper.Set("token", "")
+	viper.Set("current_profile", "staging")
+	viper.Set("profiles.staging.token", "cnp_staging")
+	if got := ResolveToken(); got != "cnp_staging" {
+		t.Fatalf("expected profile token, got %s", got)
+	}
+	t.Setenv("CONTAINR_TOKEN", "cnp_env")
+	if got := ResolveToken(); got != "cnp_env" {
+		t.Fatalf("env should win over profile, got %s", got)
+	}
+	viper.Set("token", "cnp_flag")
+	if got := ResolveToken(); got != "cnp_flag" {
+		t.Fatalf("flag should win over env, got %s", got)
+	}
+}
+
+func TestExitCodeMapping(t *testing.T) {
+	if got := exitCodeFor(401); got != ExitAuth {
+		t.Fatalf("401 → %d, want %d", got, ExitAuth)
+	}
+	if got := exitCodeFor(404); got != ExitNotFound {
+		t.Fatalf("404 → %d, want %d", got, ExitNotFound)
+	}
+	if got := exitCodeFor(400); got != ExitValidation {
+		t.Fatalf("400 → %d, want %d", got, ExitValidation)
+	}
 }

app/backend/internal/cli/commands/client.go

@@ -0,0 +1,169 @@
+package commands
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/spf13/viper"
+)
+
+// Exit codes — stable for scripting and agent use.
+const (
+	ExitOK          = 0
+	ExitError       = 1
+	ExitAuth        = 2
+	ExitNotFound    = 3
+	ExitValidation  = 4
+	ExitUnavailable = 5
+)
+
+// APIError is a non-2xx response from the Containr API. Code carries the
+// stable exit code so `main` can map errors to exit statuses.
+type APIError struct {
+	Status   int
+	Message  string
+	ExitCode int
+}
+
+func (e *APIError) Error() string {
+	if e.Message != "" {
+		return e.Message
+	}
+	return fmt.Sprintf("request failed with status %d", e.Status)
+}
+
+func exitCodeFor(status int) int {
+	switch status {
+	case http.StatusUnauthorized, http.StatusForbidden:
+		return ExitAuth
+	case http.StatusNotFound:
+		return ExitNotFound
+	case http.StatusBadRequest, http.StatusConflict, http.StatusUnprocessableEntity:
+		return ExitValidation
+	default:
+		return ExitError
+	}
+}
+
+// Client is a thin authenticated HTTP client for the Containr API. All CLI
+// commands go through it — no command builds its own request.
+type Client struct {
+	BaseURL    string
+	Token      string
+	HTTPClient *http.Client
+}
+
+// NewClient resolves the active profile (flag > env > current_profile) and
+// returns a client ready to call the API. Call RequireAuth() for commands
+// that need a token.
+func NewClient() *Client {
+	return &Client{
+		BaseURL:    ResolveAPIURL(),
+		Token:      ResolveToken(),
+		HTTPClient: &http.Client{Timeout: 60 * time.Second},
+	}
+}
+
+// RequireAuth returns an error suitable for the CLI when no token is set.
+func (c *Client) RequireAuth() error {
+	if c.Token == "" {
+		return &APIError{
+			Status:   0,
+			Message:  "not authenticated — run `containr auth login <token>` or set CONTAINR_TOKEN",
+			ExitCode: ExitAuth,
+		}
+	}
+	return nil
+}
+
+// Do performs an API request. body may be nil, a []byte, or any value that
+// marshals to JSON. Returns the raw response body.
+func (c *Client) Do(method, path string, body interface{}) ([]byte, error) {
+	var reader io.Reader
+	if body != nil {
+		var data []byte
+		switch v := body.(type) {
+		case []byte:
+			data = v
+		default:
+			var err error
+			data, err = json.Marshal(body)
+			if err != nil {
+				return nil, fmt.Errorf("failed to encode request: %w", err)
+			}
+		}
+		reader = bytes.NewReader(data)
+	}
+
+	url := c.BaseURL + path
+	req, err := http.NewRequest(method, url, reader)
+	if err != nil {
+		return nil, err
+	}
+	if c.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.Token)
+	}
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	if k := viper.GetString("idempotency-key"); k != "" && method == http.MethodPost {
+		req.Header.Set("Idempotency-Key", k)
+	}
+	req.Header.Set("Accept", "application/json")
+
+	hc := c.HTTPClient
+	if hc == nil {
+		hc = &http.Client{Timeout: 60 * time.Second}
+	}
+	resp, err := hc.Do(req)
+	if err != nil {
+		return nil, &APIError{
+			Status:   0,
+			Message:  fmt.Sprintf("cannot reach %s: %v", c.BaseURL, err),
+			ExitCode: ExitUnavailable,
+		}
+	}
+	defer resp.Body.Close()
+
+	data, err := io.ReadAll(io.LimitReader(resp.Body, 64<<20))
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	if resp.StatusCode >= 400 {
+		msg := strings.TrimSpace(string(data))
+		var envelope struct {
+			Error string `json:"error"`
+			Code  string `json:"code"`
+		}
+		if json.Unmarshal(data, &envelope) == nil && envelope.Error != "" {
+			msg = envelope.Error
+			if envelope.Code != "" {
+				msg = envelope.Code + ": " + msg
+			}
+		}
+		return nil, &APIError{
+			Status:   resp.StatusCode,
+			Message:  msg,
+			ExitCode: exitCodeFor(resp.StatusCode),
+		}
+	}
+	return data, nil
+}
+
+// DoJSON performs a request and unmarshals the response into out.
+func (c *Client) DoJSON(method, path string, body interface{}, out interface{}) error {
+	data, err := c.Do(method, path, body)
+	if err != nil {
+		return err
+	}
+	if out == nil || len(data) == 0 {
+		return nil
+	}
+	return json.Unmarshal(data, out)
+}

app/backend/internal/cli/commands/config.go

@@ -0,0 +1,106 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/spf13/viper"
+)
+
+// ActiveProfile resolves which profile applies: --profile flag >
+// CONTAINR_PROFILE env > current_profile in config > "default".
+func ActiveProfile() string {
+	if p := viper.GetString("profile"); p != "" {
+		return p
+	}
+	if p := os.Getenv("CONTAINR_PROFILE"); p != "" {
+		return p
+	}
+	if p := viper.GetString("current_profile"); p != "" {
+		return p
+	}
+	return "default"
+}
+
+// ResolveAPIURL returns the effective API base URL:
+// --api-url flag > CONTAINR_API_URL env > profile.api_url > localhost default.
+func ResolveAPIURL() string {
+	if u := viper.GetString("api-url"); u != "" {
+		return normalizeBase(u)
+	}
+	if u := os.Getenv("CONTAINR_API_URL"); u != "" {
+		return normalizeBase(u)
+	}
+	if u := viper.GetString("profiles." + ActiveProfile() + ".api_url"); u != "" {
+		return normalizeBase(u)
+	}
+	return "http://localhost:8080/api/v1"
+}
+
+// ResolveToken returns the effective auth token:
+// --token flag > CONTAINR_TOKEN env > profile.token.
+func ResolveToken() string {
+	if t := viper.GetString("token"); t != "" {
+		return t
+	}
+	if t := os.Getenv("CONTAINR_TOKEN"); t != "" {
+		return t
+	}
+	return viper.GetString("profiles." + ActiveProfile() + ".token")
+}
+
+func normalizeBase(u string) string {
+	u = strings.TrimSuffix(strings.TrimSpace(u), "/")
+	// Accept the bare host too — append the API prefix when missing.
+	if u != "" && !strings.HasSuffix(u, "/api/v1") {
+		u += "/api/v1"
+	}
+	return u
+}
+
+// SaveProfile persists api_url/token under a named profile and makes it
+// current. Creates the config file if none exists.
+func SaveProfile(name, apiURL, token string) error {
+	base := "profiles." + name
+	if apiURL != "" {
+		viper.Set(base+".api_url", apiURL)
+	}
+	if token != "" {
+		viper.Set(base+".token", token)
+	}
+	viper.Set("current_profile", name)
+	return writeConfig()
+}
+
+// ClearProfileToken removes only the token from the active profile.
+func ClearProfileToken(name string) error {
+	viper.Set("profiles."+name+".token", "")
+	return writeConfig()
+}
+
+// ListProfiles returns profile name → api_url for `auth status --all`.
+func ListProfiles() map[string]string {
+	out := map[string]string{}
+	profiles := viper.GetStringMap("profiles")
+	for name := range profiles {
+		if u := viper.GetString("profiles." + name + ".api_url"); u != "" {
+			out[name] = u
+		} else {
+			out[name] = "(no url)"
+		}
+	}
+	return out
+}
+
+func writeConfig() error {
+	if err := viper.WriteConfig(); err != nil {
+		// No config file yet — create one.
+		home, herr := os.UserHomeDir()
+		if herr != nil {
+			return fmt.Errorf("cannot locate home directory: %w", herr)
+		}
+		return viper.WriteConfigAs(home + "/.containr.yaml")
+	}
+	return nil
+}

app/backend/internal/cli/commands/cron.go

@@ -0,0 +1,169 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// CronCmd manages scheduled jobs.
+var CronCmd = &cobra.Command{
+	Use:     "cron",
+	Aliases: []string{"cron-jobs"},
+	Short:   "Manage cron jobs",
+}
+
+var cronListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List cron jobs",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/cron-jobs", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "cron_jobs", "jobs")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, j := range items {
+			rows = append(rows, []string{
+				str(j, "id"), str(j, "name"), str(j, "schedule"), str(j, "service_id"),
+				str(j, "enabled", "is_active"), relTime(j, "last_run_at"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "SCHEDULE", "SERVICE", "ENABLED", "LAST RUN"}, rows)
+		return nil
+	},
+}
+
+var cronGetCmd = &cobra.Command{
+	Use:   "get <id>",
+	Short: "Show a cron job",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/cron-jobs/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var cronCreateCmd = &cobra.Command{
+	Use:   "create",
+	Short: "Create a cron job (5-field expression)",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{}
+		for _, f := range []string{"name", "schedule", "command", "service-id", "timezone"} {
+			v, _ := cmd.Flags().GetString(f)
+			if v != "" {
+				key := f
+				if f == "service-id" {
+					key = "service_id"
+				}
+				body[key] = v
+			}
+		}
+		if body["service_id"] == nil || body["schedule"] == nil || body["command"] == nil {
+			return &APIError{Message: "--service-id, --schedule, and --command are required", ExitCode: ExitValidation}
+		}
+		data, err := c.Do("POST", "/cron-jobs", body)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var cronDeleteCmd = &cobra.Command{
+	Use:   "delete <id>",
+	Short: "Delete a cron job",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Delete cron job %s?", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/cron-jobs/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "id": args[0]})
+		}
+		fmt.Printf("Deleted cron job %s\n", args[0])
+		return nil
+	},
+}
+
+var cronTriggerCmd = &cobra.Command{
+	Use:   "trigger <id>",
+	Short: "Run a cron job now",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/cron-jobs/"+args[0]+"/trigger", map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var cronExecutionsCmd = &cobra.Command{
+	Use:   "executions <id>",
+	Short: "List a cron job's execution history",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/cron-jobs/"+args[0]+"/executions", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "executions")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, e := range items {
+			rows = append(rows, []string{
+				str(e, "id"), str(e, "status", "exit_code"), str(e, "started_at"), str(e, "output", "stdout"),
+			})
+		}
+		printRows(data, []string{"ID", "STATUS", "STARTED", "OUTPUT"}, rows)
+		return nil
+	},
+}
+
+func init() {
+	cronCreateCmd.Flags().String("name", "", "job name")
+	cronCreateCmd.Flags().String("service-id", "", "target service id (required)")
+	cronCreateCmd.Flags().String("schedule", "", "5-field cron expression (required)")
+	cronCreateCmd.Flags().String("command", "", "command run inside the container (required)")
+	cronCreateCmd.Flags().String("timezone", "", "IANA timezone (default UTC)")
+	CronCmd.AddCommand(cronListCmd, cronGetCmd, cronCreateCmd, cronDeleteCmd, cronTriggerCmd, cronExecutionsCmd)
+}

app/backend/internal/cli/commands/databases.go

@@ -0,0 +1,204 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+// DatabasesCmd manages managed databases.
+var DatabasesCmd = &cobra.Command{
+	Use:     "databases",
+	Aliases: []string{"database", "db"},
+	Short:   "Manage databases",
+}
+
+var dbListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List managed databases",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/databases", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "databases")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, d := range items {
+			rows = append(rows, []string{
+				str(d, "id"), str(d, "name"), str(d, "type", "engine"), str(d, "status"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "TYPE", "STATUS"}, rows)
+		return nil
+	},
+}
+
+var dbGetCmd = &cobra.Command{
+	Use:   "get <id>",
+	Short: "Show a database (connection URL included)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/databases/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var dbCreateCmd = &cobra.Command{
+	Use:   "create <name>",
+	Short: "Provision a managed database",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		dbType, _ := cmd.Flags().GetString("type")
+		body := map[string]interface{}{"name": args[0], "type": dbType}
+		for _, f := range []string{"version", "storage-size"} {
+			if v, _ := cmd.Flags().GetString(f); v != "" {
+				key := f
+				if f == "storage-size" {
+					key = "storage_size"
+				}
+				body[key] = v
+			}
+		}
+		data, err := c.Do("POST", "/databases", body)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var dbDeleteCmd = &cobra.Command{
+	Use:   "delete <id>",
+	Short: "Delete a database and its data",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Delete database %s and all its data?", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/databases/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "id": args[0]})
+		}
+		fmt.Printf("Deleted database %s\n", args[0])
+		return nil
+	},
+}
+
+var dbActionCmd = &cobra.Command{
+	Use:   "action <id> <start|stop|restart>",
+	Short: "Start, stop, or restart a database",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/databases/"+args[0]+"/action", map[string]string{"action": args[1]})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var dbBackupCmd = &cobra.Command{
+	Use:   "backup <id>",
+	Short: "Take a manual backup snapshot",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/databases/"+args[0]+"/backup", map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var dbRestoreCmd = &cobra.Command{
+	Use:   "restore <id> <backup-id>",
+	Short: "Restore a database from a backup",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Restore database %s from backup %s? Current data will be overwritten.", args[0], args[1])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		data, err := c.Do("POST", "/databases/"+args[0]+"/restore", map[string]string{"backup_id": args[1]})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var dbDownloadCmd = &cobra.Command{
+	Use:   "download-backup <id> <backup-id> [file]",
+	Short: "Download a backup archive",
+	Args:  cobra.RangeArgs(2, 3),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", fmt.Sprintf("/databases/%s/backups/%s/download", args[0], args[1]), nil)
+		if err != nil {
+			return err
+		}
+		out := args[1] + ".tar.gz"
+		if len(args) > 2 {
+			out = args[2]
+		}
+		if err := os.WriteFile(out, data, 0o600); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"file": out})
+		}
+		fmt.Printf("Wrote %s (%d bytes)\n", out, len(data))
+		return nil
+	},
+}
+
+func init() {
+	dbCreateCmd.Flags().String("type", "postgres", "postgres|mysql|mariadb|mongodb|redis|dragonfly|clickhouse")
+	dbCreateCmd.Flags().String("version", "", "engine version tag")
+	dbCreateCmd.Flags().String("storage-size", "", "volume size (e.g. 10Gi)")
+	DatabasesCmd.AddCommand(dbListCmd, dbGetCmd, dbCreateCmd, dbDeleteCmd, dbActionCmd, dbBackupCmd, dbRestoreCmd, dbDownloadCmd)
+}

app/backend/internal/cli/commands/deploy.go

@@ -0,0 +1,162 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// DeployCmd triggers a deployment for a service.
+var DeployCmd = &cobra.Command{
+	Use:   "deploy <service-id>",
+	Short: "Trigger a deployment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{"trigger": "cli"}
+		if nc, _ := cmd.Flags().GetBool("no-cache"); nc {
+			body["no_cache"] = true
+		}
+		for _, f := range []string{"commit-hash", "branch"} {
+			if v, _ := cmd.Flags().GetString(f); v != "" {
+				key := "commit_hash"
+				if f == "branch" {
+					key = "branch"
+				}
+				body[key] = v
+			}
+		}
+		data, err := c.Do("POST", "/services/"+args[0]+"/deployments", body)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		d, _ := unwrapObject(data, "deployment")
+		fmt.Printf("Deployment %s started for service %s (status: %s)\n",
+			str(d, "id"), args[0], str(d, "status"))
+		fmt.Println("Follow with: containr deployments logs " + str(d, "id"))
+		return nil
+	},
+}
+
+// DeploymentsCmd manages deployment history.
+var DeploymentsCmd = &cobra.Command{
+	Use:     "deployments",
+	Aliases: []string{"deployment"},
+	Short:   "Inspect deployments",
+}
+
+var deploymentsListCmd = &cobra.Command{
+	Use:   "list [service-id]",
+	Short: "List deployments (all recent, or for one service)",
+	Args:  cobra.MaximumNArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		path := "/deployments"
+		if len(args) > 0 {
+			path = "/services/" + args[0] + "/deployments"
+		}
+		data, err := c.Do("GET", path, nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "deployments")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, d := range items {
+			rows = append(rows, []string{
+				str(d, "id"), str(d, "service_id"), str(d, "status"), str(d, "trigger"), relTime(d, "created_at", "started_at"),
+			})
+		}
+		printRows(data, []string{"ID", "SERVICE", "STATUS", "TRIGGER", "STARTED"}, rows)
+		return nil
+	},
+}
+
+var deploymentsGetCmd = &cobra.Command{
+	Use:   "get <id>",
+	Short: "Show a deployment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/deployments/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var deploymentsLogsCmd = &cobra.Command{
+	Use:   "logs <id>",
+	Short: "Stream a deployment's build/deploy logs",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runDeploymentLogs,
+}
+
+var deploymentsCancelCmd = &cobra.Command{
+	Use:   "cancel <id>",
+	Short: "Cancel a queued or running deployment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/deployments/"+args[0]+"/cancel", map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		obj, _ := unwrapObject(data)
+		fmt.Printf("Deployment %s: %s\n", args[0], str(obj, "status"))
+		return nil
+	},
+}
+
+var deploymentsRollbackCmd = &cobra.Command{
+	Use:   "rollback <id>",
+	Short: "Roll back to a deployment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/deployments/"+args[0]+"/rollback", map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		fmt.Printf("Rolled back to deployment %s\n", args[0])
+		return nil
+	},
+}
+
+func init() {
+	DeployCmd.Flags().String("commit-hash", "", "commit to deploy")
+	DeployCmd.Flags().String("branch", "", "branch to deploy")
+	DeployCmd.Flags().Bool("no-cache", false, "build without Docker layer cache")
+	DeploymentsCmd.AddCommand(deploymentsListCmd, deploymentsGetCmd, deploymentsLogsCmd, deploymentsRollbackCmd, deploymentsCancelCmd)
+}

app/backend/internal/cli/commands/helpers.go

@@ -0,0 +1,113 @@
+package commands
+
+import (
+	"encoding/json"
+	"fmt"
+	"time"
+)
+
+// client returns an authenticated API client or an ExitAuth error.
+func client() (*Client, error) {
+	c := NewClient()
+	if err := c.RequireAuth(); err != nil {
+		return nil, err
+	}
+	return c, nil
+}
+
+// unwrapList accepts both top-level arrays and {"<key>": [...]} envelopes,
+// which the Containr API uses inconsistently between endpoints.
+func unwrapList(data []byte, keys ...string) ([]map[string]interface{}, error) {
+	var arr []map[string]interface{}
+	if err := json.Unmarshal(data, &arr); err == nil {
+		return arr, nil
+	}
+	var obj map[string]json.RawMessage
+	if err := json.Unmarshal(data, &obj); err != nil {
+		return nil, fmt.Errorf("unexpected response shape: %w", err)
+	}
+	for _, k := range keys {
+		if raw, ok := obj[k]; ok {
+			if err := json.Unmarshal(raw, &arr); err != nil {
+				return nil, fmt.Errorf("cannot decode %q: %w", k, err)
+			}
+			return arr, nil
+		}
+	}
+	return []map[string]interface{}{}, nil
+}
+
+func unwrapObject(data []byte, keys ...string) (map[string]interface{}, error) {
+	var obj map[string]interface{}
+	if err := json.Unmarshal(data, &obj); err != nil {
+		return nil, fmt.Errorf("unexpected response shape: %w", err)
+	}
+	for _, k := range keys {
+		if inner, ok := obj[k].(map[string]interface{}); ok {
+			return inner, nil
+		}
+	}
+	return obj, nil
+}
+
+// str extracts a display string from a response map.
+func str(m map[string]interface{}, keys ...string) string {
+	for _, k := range keys {
+		if v, ok := m[k]; ok && v != nil {
+			switch t := v.(type) {
+			case string:
+				return t
+			case float64:
+				if t == float64(int64(t)) {
+					return fmt.Sprintf("%d", int64(t))
+				}
+				return fmt.Sprintf("%v", t)
+			case bool:
+				return fmt.Sprintf("%t", t)
+			}
+		}
+	}
+	return "-"
+}
+
+func shortID(m map[string]interface{}) string {
+	id := str(m, "id")
+	if len(id) > 8 {
+		return id[:8]
+	}
+	return id
+}
+
+func relTime(m map[string]interface{}, keys ...string) string {
+	for _, k := range keys {
+		s, ok := m[k].(string)
+		if !ok || s == "" {
+			continue
+		}
+		t, err := time.Parse(time.RFC3339Nano, s)
+		if err != nil {
+			return s
+		}
+		d := time.Since(t)
+		switch {
+		case d < time.Minute:
+			return "just now"
+		case d < time.Hour:
+			return fmt.Sprintf("%dm ago", int(d.Minutes()))
+		case d < 24*time.Hour:
+			return fmt.Sprintf("%dh ago", int(d.Hours()))
+		default:
+			return fmt.Sprintf("%dd ago", int(d.Hours()/24))
+		}
+	}
+	return "-"
+}
+
+// printRows renders a table, or raw JSON for the full response in --json mode.
+func printRows(raw []byte, headers []string, rows [][]string) {
+	if JSONMode() {
+		PrintRaw(raw)
+		return
+	}
+	PrintTable(headers, rows)
+}

app/backend/internal/cli/commands/logs.go

@@ -0,0 +1,171 @@
+package commands
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+// LogsCmd prints service runtime logs.
+var LogsCmd = &cobra.Command{
+	Use:   "logs <service-id>",
+	Short: "Print or follow service logs",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		follow, _ := cmd.Flags().GetBool("follow")
+		tail, _ := cmd.Flags().GetInt("tail")
+		path := fmt.Sprintf("/services/%s/logs?tail=%d", args[0], tail)
+		if follow {
+			return streamSSE(c, path+"&follow=true")
+		}
+		data, err := c.Do("GET", path, nil)
+		if err != nil {
+			return err
+		}
+		return printLogEntries(data)
+	},
+}
+
+// ExecCmd runs a one-off command inside a service container.
+var ExecCmd = &cobra.Command{
+	Use:   "exec <service-id> -- <command>",
+	Short: "Run a one-off command in the service container (30s ceiling)",
+	Args:  cobra.MinimumNArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		command := strings.Join(args[1:], " ")
+		if command == "" {
+			return &APIError{Message: "no command given — usage: containr exec <id> -- <command>", ExitCode: ExitValidation}
+		}
+		data, err := c.Do("POST", "/services/"+args[0]+"/exec", map[string]string{"command": command})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		resp, _ := unwrapObject(data)
+		fmt.Print(str(resp, "output", "stdout"))
+		if code := str(resp, "exit_code", "exitCode"); code != "-" && code != "0" {
+			return &APIError{Message: fmt.Sprintf("command exited with %s", code), ExitCode: ExitError}
+		}
+		return nil
+	},
+}
+
+type logEntry struct {
+	Timestamp string `json:"timestamp"`
+	Message   string `json:"message"`
+	Stream    string `json:"stream"`
+}
+
+// printLogEntries decodes the {"logs":[...]} envelope both log endpoints use.
+func printLogEntries(data []byte) error {
+	var payload struct {
+		Logs    []logEntry `json:"logs"`
+		Message string     `json:"message"`
+	}
+	if err := json.Unmarshal(data, &payload); err != nil {
+		PrintRaw(data)
+		return nil
+	}
+	if JSONMode() {
+		PrintRaw(data)
+		return nil
+	}
+	for _, e := range payload.Logs {
+		fmt.Println(e.Message)
+	}
+	if len(payload.Logs) == 0 && payload.Message != "" {
+		fmt.Fprintln(os.Stderr, payload.Message)
+	}
+	return nil
+}
+
+// runDeploymentLogs prints persisted build+runtime logs for a deployment.
+func runDeploymentLogs(cmd *cobra.Command, args []string) error {
+	c, err := client()
+	if err != nil {
+		return err
+	}
+	logType, _ := cmd.Flags().GetString("type")
+	data, err := c.Do("GET", "/deployments/"+args[0]+"/logs?type="+logType, nil)
+	if err != nil {
+		return err
+	}
+	if JSONMode() {
+		PrintRaw(data)
+		return nil
+	}
+	var payload struct {
+		BuildLog   string `json:"build_log"`
+		RuntimeLog string `json:"runtime_log"`
+	}
+	if json.Unmarshal(data, &payload) == nil && (payload.BuildLog != "" || payload.RuntimeLog != "") {
+		if payload.BuildLog != "" {
+			fmt.Print(payload.BuildLog)
+		}
+		if payload.RuntimeLog != "" {
+			fmt.Print(payload.RuntimeLog)
+		}
+		return nil
+	}
+	return printLogEntries(data)
+}
+
+// streamSSE consumes a text/event-stream response and prints each
+// `data:` line's message field until the server closes the stream.
+func streamSSE(c *Client, path string) error {
+	req, err := http.NewRequest("GET", c.BaseURL+path, nil)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+c.Token)
+	req.Header.Set("Accept", "text/event-stream")
+	hc := c.HTTPClient
+	if hc == nil {
+		hc = http.DefaultClient
+	}
+	resp, err := hc.Do(req)
+	if err != nil {
+		return &APIError{Message: fmt.Sprintf("cannot reach %s: %v", c.BaseURL, err), ExitCode: ExitUnavailable}
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return &APIError{Status: resp.StatusCode, ExitCode: exitCodeFor(resp.StatusCode)}
+	}
+	scanner := bufio.NewScanner(resp.Body)
+	scanner.Buffer(make([]byte, 64<<10), 4<<20)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if !strings.HasPrefix(line, "data:") {
+			continue
+		}
+		var e logEntry
+		if err := json.Unmarshal([]byte(strings.TrimPrefix(line, "data:")), &e); err == nil {
+			fmt.Println(e.Message)
+		} else {
+			fmt.Println(strings.TrimSpace(strings.TrimPrefix(line, "data:")))
+		}
+	}
+	return scanner.Err()
+}
+
+func init() {
+	LogsCmd.Flags().BoolP("follow", "f", false, "stream new log lines (SSE)")
+	LogsCmd.Flags().Int("tail", 100, "number of lines to return")
+	deploymentsLogsCmd.Flags().String("type", "all", "log type: all|build|runtime")
+}

app/backend/internal/cli/commands/nodes.go

@@ -0,0 +1,150 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// NodesCmd manages node agents (admin).
+var NodesCmd = &cobra.Command{
+	Use:     "nodes",
+	Aliases: []string{"node", "agents"},
+	Short:   "Manage node agents (admin)",
+}
+
+var nodesListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List registered node agents",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/agents", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "agents")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, a := range items {
+			rows = append(rows, []string{
+				str(a, "id"), str(a, "name", "hostname"), str(a, "status"), str(a, "version"), relTime(a, "last_heartbeat_at"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "STATUS", "VERSION", "HEARTBEAT"}, rows)
+		return nil
+	},
+}
+
+var nodesGetCmd = &cobra.Command{
+	Use:   "get <id>",
+	Short: "Show a node agent",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/agents/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodesDeleteCmd = &cobra.Command{
+	Use:   "delete <id>",
+	Short: "Remove a node agent",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Remove node agent %s?", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/agents/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "id": args[0]})
+		}
+		fmt.Printf("Removed agent %s\n", args[0])
+		return nil
+	},
+}
+
+// Agent tokens (cagt_) onboard new nodes.
+var nodeTokensCmd = &cobra.Command{
+	Use:   "tokens",
+	Short: "Manage agent onboarding tokens",
+}
+
+var nodeTokensIssueCmd = &cobra.Command{
+	Use:   "issue [label]",
+	Short: "Issue an onboarding token (shown once)",
+	Args:  cobra.MaximumNArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{}
+		if len(args) > 0 {
+			body["label"] = args[0]
+		}
+		data, err := c.Do("POST", "/agent-tokens", body)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodeTokensListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List onboarding tokens",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/agent-tokens", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var nodeTokensRevokeCmd = &cobra.Command{
+	Use:   "revoke <id>",
+	Short: "Revoke an onboarding token",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("DELETE", "/agent-tokens/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+func init() {
+	nodeTokensCmd.AddCommand(nodeTokensIssueCmd, nodeTokensListCmd, nodeTokensRevokeCmd)
+	NodesCmd.AddCommand(nodesListCmd, nodesGetCmd, nodesDeleteCmd, nodeTokensCmd)
+}

app/backend/internal/cli/commands/notifications.go

@@ -0,0 +1,65 @@
+package commands
+
+import (
+	"github.com/spf13/cobra"
+)
+
+// NotificationsCmd lists and manages notifications.
+var NotificationsCmd = &cobra.Command{
+	Use:     "notifications",
+	Aliases: []string{"notifs"},
+	Short:   "Manage notifications",
+}
+
+var notifListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List notifications",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/notifications", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "notifications")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, n := range items {
+			rows = append(rows, []string{
+				str(n, "id"), str(n, "type"), str(n, "title"), str(n, "read"), relTime(n, "created_at"),
+			})
+		}
+		printRows(data, []string{"ID", "TYPE", "TITLE", "READ", "AGE"}, rows)
+		return nil
+	},
+}
+
+var notifReadCmd = &cobra.Command{
+	Use:   "read <id>|all",
+	Short: "Mark a notification (or all) as read",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		path := "/notifications/" + args[0] + "/read"
+		if args[0] == "all" {
+			path = "/notifications/read-all"
+		}
+		data, err := c.Do("POST", path, map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+func init() {
+	NotificationsCmd.AddCommand(notifListCmd, notifReadCmd)
+}

app/backend/internal/cli/commands/output.go

@@ -0,0 +1,95 @@
+package commands
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/spf13/viper"
+)
+
+// JSONMode reports whether --json was passed. In JSON mode every command
+// prints the raw API response and nothing else — safe for agents and pipes.
+func JSONMode() bool {
+	return viper.GetBool("json")
+}
+
+// PrintResult renders data: pretty JSON in --json mode, otherwise the
+// default JSON rendering is used unless a command prints its own table
+// first (commands that render a table should check JSONMode() themselves).
+func PrintJSON(v interface{}) error {
+	data, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return err
+	}
+	fmt.Println(string(data))
+	return nil
+}
+
+// PrintRaw prints raw response bytes as pretty JSON when they decode as
+// JSON, else verbatim.
+func PrintRaw(data []byte) {
+	var v interface{}
+	if json.Unmarshal(data, &v) == nil {
+		out, _ := json.MarshalIndent(v, "", "  ")
+		fmt.Println(string(out))
+		return
+	}
+	fmt.Println(string(data))
+}
+
+// PrintTable renders rows under headers with tabwriter alignment.
+// Skipped entirely in JSON mode.
+func PrintTable(headers []string, rows [][]string) {
+	if JSONMode() {
+		return
+	}
+	w := tabwriter.NewWriter(os.Stdout, 0, 4, 2, ' ', 0)
+	fmt.Fprintln(w, strings.Join(headers, "\t"))
+	for _, row := range rows {
+		fmt.Fprintln(w, strings.Join(row, "\t"))
+	}
+	w.Flush()
+}
+
+// Confirm asks the user to confirm a destructive action. Returns true
+// immediately when --yes/--force was passed or stdin is not a TTY and
+// --yes was given. In non-interactive contexts without --yes it refuses.
+func Confirm(prompt string) bool {
+	if viper.GetBool("yes") {
+		return true
+	}
+	if !isTerminal() {
+		return false
+	}
+	fmt.Fprintf(os.Stderr, "%s [y/N] ", prompt)
+	reader := bufio.NewReader(os.Stdin)
+	answer, err := reader.ReadString('\n')
+	if err != nil {
+		return false
+	}
+	answer = strings.ToLower(strings.TrimSpace(answer))
+	return answer == "y" || answer == "yes"
+}
+
+func isTerminal() bool {
+	info, err := os.Stdin.Stat()
+	if err != nil {
+		return false
+	}
+	return info.Mode()&os.ModeCharDevice != 0
+}
+
+// ExitCode inspects an error and returns the process exit code.
+func ExitCode(err error) int {
+	if err == nil {
+		return ExitOK
+	}
+	if apiErr, ok := err.(*APIError); ok {
+		return apiErr.ExitCode
+	}
+	return ExitError
+}

app/backend/internal/cli/commands/projects.go

@@ -1,219 +1,123 @@
 package commands
 
 import (
-	"bytes"
-	"containr/internal/pkg/utils"
-	"encoding/json"
 	"fmt"
-	"io"
-	"net/http"
-	"strings"
 
 	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
-// Project represents a Containr project
-type Project struct {
-	ID          string `json:"id"`
-	Name        string `json:"name"`
-	Description string `json:"description"`
-	OwnerID     string `json:"owner_id"`
-	CreatedAt   string `json:"created_at"`
-	UpdatedAt   string `json:"updated_at"`
-}
-
-// ProjectsCmd represents the projects command
+// ProjectsCmd manages projects.
 var ProjectsCmd = &cobra.Command{
-	Use:   "projects",
-	Short: "Manage projects",
-	Long: `Manage your Containr projects.
-You can list, create, update, and delete projects.`,
+	Use:     "projects",
+	Aliases: []string{"project"},
+	Short:   "Manage projects",
 }
 
-// listProjectsCmd represents the list command
-var listProjectsCmd = &cobra.Command{
+var projectsListCmd = &cobra.Command{
 	Use:   "list",
-	Short: "List all projects",
-	Long:  `List all your Containr projects.`,
-	RunE:  runListProjects,
+	Short: "List projects",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/projects", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "projects")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, p := range items {
+			rows = append(rows, []string{
+				str(p, "id"), str(p, "name"), str(p, "description"), relTime(p, "created_at"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "DESCRIPTION", "CREATED"}, rows)
+		return nil
+	},
 }
 
-// createProjectCmd represents the create command
-var createProjectCmd = &cobra.Command{
-	Use:   "create [name]",
-	Short: "Create a new project",
-	Long: `Create a new Containr project.
-Provide a name and optional description.`,
-	Args: cobra.ExactArgs(1),
-	RunE: runCreateProject,
-}
-
-// deleteProjectCmd represents the delete command
-var deleteProjectCmd = &cobra.Command{
-	Use:   "delete [project-id]",
-	Short: "Delete a project",
-	Long:  `Delete a Containr project by ID.`,
+var projectsGetCmd = &cobra.Command{
+	Use:   "get <id>",
+	Short: "Show a project",
 	Args:  cobra.ExactArgs(1),
-	RunE:  runDeleteProject,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/projects/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		p, _ := unwrapObject(data, "project")
+		fmt.Printf("ID:          %s\n", str(p, "id"))
+		fmt.Printf("Name:        %s\n", str(p, "name"))
+		fmt.Printf("Description: %s\n", str(p, "description"))
+		fmt.Printf("Created:     %s\n", str(p, "created_at"))
+		return nil
+	},
 }
 
-var projectDescription string
+var projectsCreateCmd = &cobra.Command{
+	Use:   "create <name>",
+	Short: "Create a project",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		desc, _ := cmd.Flags().GetString("description")
+		body := map[string]interface{}{"name": args[0]}
+		if desc != "" {
+			body["description"] = desc
+		}
+		data, err := c.Do("POST", "/projects", body)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		p, _ := unwrapObject(data, "project")
+		fmt.Printf("Created project %s (%s)\n", str(p, "name"), str(p, "id"))
+		return nil
+	},
+}
 
-// getAPIURL constructs the full API URL for a given endpoint
-func getAPIURL(endpoint string) string {
-	baseURL := viper.GetString("api-url")
-	if baseURL == "" {
-		baseURL = "http://localhost:8080/api/v1" // Default for development
-	}
-
-	// Ensure baseURL doesn't end with / and endpoint starts with /
-	baseURL = strings.TrimSuffix(baseURL, "/")
-	if !strings.HasPrefix(endpoint, "/") {
-		endpoint = "/" + endpoint
-	}
-
-	return baseURL + endpoint
+var projectsDeleteCmd = &cobra.Command{
+	Use:   "delete <id>",
+	Short: "Delete a project and all its services",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Delete project %s and all its services?", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/projects/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "id": args[0]})
+		}
+		fmt.Printf("Deleted project %s\n", args[0])
+		return nil
+	},
 }
 
 func init() {
-	ProjectsCmd.AddCommand(listProjectsCmd)
-	ProjectsCmd.AddCommand(createProjectCmd)
-	ProjectsCmd.AddCommand(deleteProjectCmd)
-
-	// Add flags
-	createProjectCmd.Flags().StringVarP(&projectDescription, "description", "d", "", "Project description")
-}
-
-func runListProjects(cmd *cobra.Command, args []string) error {
-	apiURL := getAPIURL("/projects")
-
-	req, err := http.NewRequest("GET", apiURL, nil)
-	if err != nil {
-		return fmt.Errorf("failed to create request: %w", err)
-	}
-
-	req.Header.Set("Authorization", "Bearer "+viper.GetString("token"))
-	req.Header.Set("Content-Type", "application/json")
-
-	client := &http.Client{}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("failed to make request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("API request failed: %s - %s", resp.Status, string(body))
-	}
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Errorf("failed to read response: %w", err)
-	}
-
-	var projects []Project
-	if err := json.Unmarshal(body, &projects); err != nil {
-		return fmt.Errorf("failed to parse response: %w", err)
-	}
-
-	if len(projects) == 0 {
-		fmt.Println("No projects found")
-		return nil
-	}
-
-	fmt.Println("Your Projects:")
-	fmt.Println()
-	for _, project := range projects {
-		fmt.Printf("📦 %s (%s)\n", project.Name, project.ID)
-		if project.Description != "" {
-			fmt.Printf("   %s\n", project.Description)
-		}
-		fmt.Printf("   Created: %s\n", utils.FormatTime(project.CreatedAt))
-		fmt.Println()
-	}
-
-	return nil
-}
-
-func runCreateProject(cmd *cobra.Command, args []string) error {
-	name := args[0]
-
-	projectData := map[string]interface{}{
-		"name": name,
-	}
-
-	if projectDescription != "" {
-		projectData["description"] = projectDescription
-	}
-
-	jsonData, err := json.Marshal(projectData)
-	if err != nil {
-		return fmt.Errorf("failed to marshal project data: %w", err)
-	}
-
-	apiURL := getAPIURL("/projects")
-
-	req, err := http.NewRequest("POST", apiURL, bytes.NewBuffer(jsonData))
-	if err != nil {
-		return fmt.Errorf("failed to create request: %w", err)
-	}
-
-	req.Header.Set("Authorization", "Bearer "+viper.GetString("token"))
-	req.Header.Set("Content-Type", "application/json")
-
-	client := &http.Client{}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("failed to make request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusCreated {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("API request failed: %s - %s", resp.Status, string(body))
-	}
-
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return fmt.Errorf("failed to read response: %w", err)
-	}
-
-	var project Project
-	if err := json.Unmarshal(body, &project); err != nil {
-		return fmt.Errorf("failed to parse response: %w", err)
-	}
-
-	fmt.Printf("✓ Project '%s' created successfully!\n", project.Name)
-	fmt.Printf("ID: %s\n", project.ID)
-	return nil
-}
-
-func runDeleteProject(cmd *cobra.Command, args []string) error {
-	projectID := args[0]
-
-	apiURL := getAPIURL("/projects/" + projectID)
-
-	req, err := http.NewRequest("DELETE", apiURL, nil)
-	if err != nil {
-		return fmt.Errorf("failed to create request: %w", err)
-	}
-
-	req.Header.Set("Authorization", "Bearer "+viper.GetString("token"))
-
-	client := &http.Client{}
-	resp, err := client.Do(req)
-	if err != nil {
-		return fmt.Errorf("failed to make request: %w", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusNoContent {
-		body, _ := io.ReadAll(resp.Body)
-		return fmt.Errorf("API request failed: %s - %s", resp.Status, string(body))
-	}
-
-	fmt.Printf("✓ Project '%s' deleted successfully!\n", projectID)
-	return nil
+	projectsCreateCmd.Flags().StringP("description", "d", "", "project description")
+	ProjectsCmd.AddCommand(projectsListCmd, projectsGetCmd, projectsCreateCmd, projectsDeleteCmd)
 }

app/backend/internal/cli/commands/services.go

@@ -0,0 +1,465 @@
+package commands
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+// ServicesCmd manages services.
+var ServicesCmd = &cobra.Command{
+	Use:     "services",
+	Aliases: []string{"service", "svc"},
+	Short:   "Manage services",
+}
+
+var servicesListCmd = &cobra.Command{
+	Use:   "list [project-id]",
+	Short: "List services in a project",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/projects/"+args[0]+"/services", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "services")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, s := range items {
+			rows = append(rows, []string{
+				str(s, "id"), str(s, "name"), str(s, "type"), str(s, "status"), str(s, "environment"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "TYPE", "STATUS", "ENV"}, rows)
+		return nil
+	},
+}
+
+var servicesGetCmd = &cobra.Command{
+	Use:   "get <id>",
+	Short: "Show a service",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/services/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		s, _ := unwrapObject(data, "service")
+		for _, k := range []string{"id", "name", "type", "status", "environment", "image", "git_repo", "git_branch", "domain", "port"} {
+			fmt.Printf("%-14s %s\n", k+":", str(s, k))
+		}
+		return nil
+	},
+}
+
+var servicesCreateCmd = &cobra.Command{
+	Use:   "create <project-id> <name>",
+	Short: "Create a service (image- or git-based)",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{
+			"name": args[1],
+		}
+		for _, f := range []string{"type", "image", "git-repo", "git-branch", "build-path", "command", "environment", "domain", "restart-policy", "healthcheck-path", "cpu", "memory", "builder", "cpu-reserve", "memory-reserve", "static-cmd", "static-dir"} {
+			if v, _ := cmd.Flags().GetString(f); v != "" {
+				key := f
+				// JSON uses snake_case keys matching the API schema.
+				switch f {
+				case "git-repo":
+					key = "git_repo"
+				case "git-branch":
+					key = "git_branch"
+				case "build-path":
+					key = "build_path"
+				case "restart-policy":
+					key = "restart_policy"
+				case "healthcheck-path":
+					key = "healthcheck_path"
+				case "cpu-reserve":
+					key = "cpu_reserve"
+				case "memory-reserve":
+					key = "memory_reserve"
+				case "static-cmd":
+					key = "static_build_cmd"
+				case "static-dir":
+					key = "static_dir"
+				}
+				body[key] = v
+			}
+		}
+		if v, _ := cmd.Flags().GetInt("port"); v > 0 {
+			body["port"] = v
+		}
+		if v, _ := cmd.Flags().GetInt("replicas"); v > 0 {
+			body["replicas"] = v
+		}
+		data, err := c.Do("POST", "/projects/"+args[0]+"/services", body)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		s, _ := unwrapObject(data, "service")
+		fmt.Printf("Created service %s (%s)\n", str(s, "name"), str(s, "id"))
+		return nil
+	},
+}
+
+var servicesDeleteCmd = &cobra.Command{
+	Use:   "delete <id>",
+	Short: "Delete a service",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Delete service %s?", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/services/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "id": args[0]})
+		}
+		fmt.Printf("Deleted service %s\n", args[0])
+		return nil
+	},
+}
+
+var servicesUpdateCmd = &cobra.Command{
+	Use:   "update <id>",
+	Short: "Update a service (volumes, replicas, domain, ...)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{}
+		for _, f := range []string{"name", "image", "command", "domain", "restart-policy", "healthcheck-path", "cpu", "memory", "builder", "cpu-reserve", "memory-reserve", "static-cmd", "static-dir"} {
+			if cmd.Flags().Changed(f) {
+				key := f
+				switch f {
+				case "restart-policy":
+					key = "restart_policy"
+				case "healthcheck-path":
+					key = "healthcheck_path"
+				case "cpu-reserve":
+					key = "cpu_reserve"
+				case "memory-reserve":
+					key = "memory_reserve"
+				case "static-cmd":
+					key = "static_build_cmd"
+				case "static-dir":
+					key = "static_dir"
+				}
+				v, _ := cmd.Flags().GetString(f)
+				body[key] = v
+			}
+		}
+		if cmd.Flags().Changed("replicas") {
+			v, _ := cmd.Flags().GetInt("replicas")
+			body["replicas"] = v
+		}
+		if cmd.Flags().Changed("port") {
+			v, _ := cmd.Flags().GetInt("port")
+			body["port"] = v
+		}
+		if cmd.Flags().Changed("volume") || cmd.Flags().Changed("bind") || cmd.Flags().Changed("clear-volumes") {
+			volumes := []map[string]interface{}{}
+			for _, spec := range volumeFlagValues(cmd, "volume", "bind") {
+				volumes = append(volumes, spec)
+			}
+			body["volumes"] = volumes
+		}
+		if cmd.Flags().Changed("maintenance") {
+			v, _ := cmd.Flags().GetString("maintenance")
+			body["maintenance_mode"] = v == "on" || v == "true"
+		}
+		if cmd.Flags().Changed("basic-auth") {
+			creds := []map[string]interface{}{}
+			pairs, _ := cmd.Flags().GetStringArray("basic-auth")
+			for _, p := range pairs {
+				user, pass, ok := strings.Cut(p, ":")
+				if ok {
+					creds = append(creds, map[string]interface{}{"username": user, "password": pass})
+				}
+			}
+			body["basic_auth"] = creds
+		}
+		if len(body) == 0 {
+			return &APIError{Message: "nothing to update — pass a flag", ExitCode: ExitError}
+		}
+		data, err := c.Do("PUT", "/services/"+args[0], body)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		fmt.Printf("Updated service %s\n", args[0])
+		return nil
+	},
+}
+
+// volumeFlagValues parses repeated "src:target[:ro]" flags into API mount
+// objects. Bind mounts are type=bind, named volumes type=volume.
+func volumeFlagValues(cmd *cobra.Command, flags ...string) []map[string]interface{} {
+	var out []map[string]interface{}
+	for _, f := range flags {
+		vals, _ := cmd.Flags().GetStringArray(f)
+		for _, v := range vals {
+			parts := strings.SplitN(v, ":", 3)
+			if len(parts) < 2 {
+				continue
+			}
+			m := map[string]interface{}{
+				"type":   f,
+				"source": parts[0],
+				"target": parts[1],
+			}
+			if len(parts) == 3 && parts[2] == "ro" {
+				m["read_only"] = true
+			}
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
+var servicesDomainsCmd = &cobra.Command{
+	Use:   "domains",
+	Short: "Manage service domains",
+}
+
+var domainsListCmd = &cobra.Command{
+	Use:   "list <service-id>",
+	Short: "List domains attached to a service",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/services/"+args[0]+"/domains", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "domains")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, d := range items {
+			def := ""
+			if b, ok := d["is_default"].(bool); ok && b {
+				def = "*"
+			}
+			rows = append(rows, []string{str(d, "id"), str(d, "domain"), def, str(d, "cert_status")})
+		}
+		printRows(data, []string{"ID", "DOMAIN", "DEFAULT", "CERT"}, rows)
+		return nil
+	},
+}
+
+var domainsAddCmd = &cobra.Command{
+	Use:   "add <service-id> <domain>",
+	Short: "Attach a domain to a service",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		def, _ := cmd.Flags().GetBool("default")
+		data, err := c.Do("POST", "/services/"+args[0]+"/domains", map[string]interface{}{
+			"domain": args[1], "is_default": def,
+		})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		fmt.Printf("Added domain %s\n", args[1])
+		return nil
+	},
+}
+
+var domainsRemoveCmd = &cobra.Command{
+	Use:   "remove <service-id> <domain-id>",
+	Short: "Detach a domain",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if _, err := c.Do("DELETE", fmt.Sprintf("/services/%s/domains/%s", args[0], args[1]), nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "id": args[1]})
+		}
+		fmt.Printf("Removed domain %s\n", args[1])
+		return nil
+	},
+}
+
+var domainsDefaultCmd = &cobra.Command{
+	Use:   "default <service-id> <domain-id>",
+	Short: "Set the default domain",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", fmt.Sprintf("/services/%s/domains/%s/default", args[0], args[1]), map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		fmt.Printf("Default domain updated\n")
+		return nil
+	},
+}
+
+var domainsCheckCmd = &cobra.Command{
+	Use:   "check <service-id>",
+	Short: "DNS preflight for all service domains",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/services/"+args[0]+"/domains/check", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "domains")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, d := range items {
+			resolved, _ := d["resolved"].([]interface{})
+			addrs := make([]string, 0, len(resolved))
+			for _, a := range resolved {
+				if s, ok := a.(string); ok {
+					addrs = append(addrs, s)
+				}
+			}
+			rows = append(rows, []string{str(d, "domain"), str(d, "status"), strings.Join(addrs, ", ")})
+		}
+		printRows(data, []string{"DOMAIN", "STATUS", "RESOLVED"}, rows)
+		return nil
+	},
+}
+
+// serviceAction returns a RunE for the simple POST action endpoints.
+func serviceAction(verb string) func(*cobra.Command, []string) error {
+	return func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", fmt.Sprintf("/services/%s/%s", args[0], verb), map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		fmt.Printf("%s: %s\n", verb, args[0])
+		return nil
+	}
+}
+
+func init() {
+	f := servicesCreateCmd.Flags()
+	f.String("type", "web", "service type: web|worker|database|cron")
+	f.String("image", "", "container image (image-based service)")
+	f.String("git-repo", "", "git repository URL (build-from-source service)")
+	f.String("git-branch", "main", "git branch")
+	f.String("build-path", "", "build context subdirectory")
+	f.String("command", "", "container start command override")
+	f.String("environment", "production", "production|preview|development")
+	f.String("domain", "", "public domain")
+	f.String("restart-policy", "unless-stopped", "docker restart policy")
+	f.String("healthcheck-path", "", "HTTP health check path")
+	f.String("cpu", "", "CPU limit (e.g. 0.5)")
+	f.String("memory", "", "memory limit (e.g. 512m)")
+	f.Int("port", 0, "container port")
+	f.Int("replicas", 0, "replica count")
+	f.String("builder", "", "build strategy: auto|railpack|nixpacks|dockerfile|static")
+	f.String("cpu-reserve", "", "soft CPU reservation (e.g. 0.25)")
+	f.String("memory-reserve", "", "soft memory reservation (e.g. 128Mi)")
+	f.String("static-cmd", "", "build command for the static builder")
+	f.String("static-dir", "", "output dir for the static builder (default dist)")
+
+	uf := servicesUpdateCmd.Flags()
+	uf.String("name", "", "service name")
+	uf.String("image", "", "container image")
+	uf.String("command", "", "container start command")
+	uf.String("domain", "", "public domain (empty string clears)")
+	uf.String("restart-policy", "", "docker restart policy")
+	uf.String("healthcheck-path", "", "HTTP health check path")
+	uf.String("cpu", "", "CPU limit (e.g. 0.5)")
+	uf.String("memory", "", "memory limit (e.g. 512m)")
+	uf.Int("replicas", 0, "replica count")
+	uf.Int("port", 0, "container port")
+	uf.StringArray("volume", nil, "named volume mount name:path[:ro] (repeatable, replaces all mounts)")
+	uf.StringArray("bind", nil, "bind mount src:path[:ro] (repeatable)")
+	uf.Bool("clear-volumes", false, "remove all volume mounts")
+	uf.String("maintenance", "", "maintenance mode: on|off")
+	uf.StringArray("basic-auth", nil, "basic-auth credential user:password (repeatable, replaces all)")
+	uf.String("builder", "", "build strategy: auto|railpack|nixpacks|dockerfile|static")
+	uf.String("cpu-reserve", "", "soft CPU reservation (empty clears)")
+	uf.String("memory-reserve", "", "soft memory reservation (empty clears)")
+	uf.String("static-cmd", "", "build command for the static builder (empty clears)")
+	uf.String("static-dir", "", "output dir for the static builder (empty clears)")
+
+	for _, a := range []string{"start", "stop", "restart", "redeploy"} {
+		verb := a
+		ServicesCmd.AddCommand(&cobra.Command{
+			Use:   verb + " <id>",
+			Short: verb + " a service",
+			Args:  cobra.ExactArgs(1),
+			RunE:  serviceAction(verb),
+		})
+	}
+	domainsAddCmd.Flags().Bool("default", false, "set as the default domain")
+	servicesDomainsCmd.AddCommand(domainsListCmd, domainsAddCmd, domainsRemoveCmd, domainsDefaultCmd, domainsCheckCmd)
+	ServicesCmd.AddCommand(servicesListCmd, servicesGetCmd, servicesCreateCmd, servicesUpdateCmd, servicesDeleteCmd, servicesDomainsCmd)
+}

app/backend/internal/cli/commands/templates.go

@@ -0,0 +1,127 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+// TemplatesCmd manages the template catalog.
+var TemplatesCmd = &cobra.Command{
+	Use:     "templates",
+	Aliases: []string{"template"},
+	Short:   "Browse and deploy templates",
+}
+
+var templatesListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List templates",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/templates", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "templates")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, t := range items {
+			rows = append(rows, []string{
+				str(t, "id"), str(t, "name"), str(t, "category"), str(t, "description"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "CATEGORY", "DESCRIPTION"}, rows)
+		return nil
+	},
+}
+
+var templatesGetCmd = &cobra.Command{
+	Use:   "get <id>",
+	Short: "Show a template definition",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/templates/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var templatesCreateCmd = &cobra.Command{
+	Use:   "create <file>",
+	Short: "Create a user template from a JSON file",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		raw, err := os.ReadFile(args[0])
+		if err != nil {
+			return fmt.Errorf("cannot read %s: %w", args[0], err)
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/templates", raw)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var templatesDeleteCmd = &cobra.Command{
+	Use:   "delete <id>",
+	Short: "Delete a user template",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Delete template %s?", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/templates/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "id": args[0]})
+		}
+		fmt.Printf("Deleted template %s\n", args[0])
+		return nil
+	},
+}
+
+var templatesDeployCmd = &cobra.Command{
+	Use:   "deploy <template-id> <project-id>",
+	Short: "Deploy a template into a project",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/templates/"+args[0]+"/deploy", map[string]string{"project_id": args[1]})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+func init() {
+	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd)
+}

app/backend/internal/cli/commands/tokens.go

@@ -0,0 +1,101 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+// TokensCmd manages personal access tokens (cnp_...).
+var TokensCmd = &cobra.Command{
+	Use:   "tokens",
+	Short: "Manage personal access tokens",
+	Long: `Create, list, and revoke the cnp_ tokens used by this CLI,
+the MCP server, and external agents.`,
+}
+
+var tokensListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List your tokens (metadata only)",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/user/tokens", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "tokens")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, t := range items {
+			rows = append(rows, []string{
+				str(t, "id"), str(t, "name"), str(t, "key_prefix"), str(t, "scope"),
+				relTime(t, "last_used_at"), str(t, "expires_at"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "PREFIX", "SCOPE", "LAST USED", "EXPIRES"}, rows)
+		return nil
+	},
+}
+
+var tokensCreateCmd = &cobra.Command{
+	Use:   "create <name>",
+	Short: "Create a token (raw value printed once)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		scope, _ := cmd.Flags().GetString("scope")
+		days, _ := cmd.Flags().GetInt("expires-in-days")
+		data, err := c.Do("POST", "/user/tokens", map[string]interface{}{
+			"name": args[0], "scope": scope, "expires_in_days": days,
+		})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		t, _ := unwrapObject(data)
+		fmt.Println(str(t, "token"))
+		fmt.Fprintln(os.Stderr, "Store it now — it is shown only once. Scope: "+str(t, "scope"))
+		return nil
+	},
+}
+
+var tokensRevokeCmd = &cobra.Command{
+	Use:   "revoke <id>",
+	Short: "Revoke a token",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Revoke token %s? Clients using it lose access immediately.", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/user/tokens/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "revoked", "id": args[0]})
+		}
+		fmt.Printf("Revoked token %s\n", args[0])
+		return nil
+	},
+}
+
+func init() {
+	tokensCreateCmd.Flags().String("scope", "write", "read|write|admin (admin requires an admin account)")
+	tokensCreateCmd.Flags().Int("expires-in-days", 0, "0 = never expires, max 3650")
+	TokensCmd.AddCommand(tokensListCmd, tokensCreateCmd, tokensRevokeCmd)
+}

app/backend/internal/cli/commands/up.go

@@ -0,0 +1,145 @@
+package commands
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+)
+
+// UpCmd deploys the current directory: resolves a project, creates (or
+// reuses) a service named after the directory, and triggers a deployment.
+// The git remote URL and current branch become the build source.
+var UpCmd = &cobra.Command{
+	Use:   "up",
+	Short: "Deploy the current directory (create service + deploy)",
+	Long: `Deploy the current directory to Containr.
+
+The git remote and current branch are used as the build source. If no
+service named after this directory exists in the project, one is
+created; an existing service is redeployed.`,
+	RunE: runUp,
+}
+
+func runUp(cmd *cobra.Command, args []string) error {
+	c, err := client()
+	if err != nil {
+		return err
+	}
+
+	projectID, _ := cmd.Flags().GetString("project")
+	if projectID == "" {
+		projectID = viper.GetString("profiles." + ActiveProfile() + ".project_id")
+	}
+	if projectID == "" {
+		return &APIError{
+			Message:  "no project selected — pass --project <id> or set project_id on the active profile",
+			ExitCode: ExitValidation,
+		}
+	}
+
+	cwd, err := os.Getwd()
+	if err != nil {
+		return err
+	}
+	name, _ := cmd.Flags().GetString("name")
+	if name == "" {
+		name = filepath.Base(cwd)
+	}
+	repo := gitOutput(cwd, "config", "--get", "remote.origin.url")
+	branch := gitOutput(cwd, "rev-parse", "--abbrev-ref", "HEAD")
+	commit := gitOutput(cwd, "rev-parse", "HEAD")
+	image, _ := cmd.Flags().GetString("image")
+
+	if repo == "" && image == "" {
+		return &APIError{
+			Message:  "no git remote and no --image — either init git with an origin remote or pass --image",
+			ExitCode: ExitValidation,
+		}
+	}
+
+	// Reuse an existing same-named service when present.
+	svcID, _ := cmd.Flags().GetString("service")
+	if svcID == "" {
+		if data, err := c.Do("GET", "/projects/"+projectID+"/services", nil); err == nil {
+			if items, err := unwrapList(data, "services"); err == nil {
+				for _, s := range items {
+					if str(s, "name") == name {
+						svcID = str(s, "id")
+						break
+					}
+				}
+			}
+		}
+	}
+
+	if svcID == "" {
+		body := map[string]interface{}{
+			"name":        name,
+			"type":        "web",
+			"environment": "production",
+		}
+		if repo != "" {
+			body["git_repo"] = repo
+			if branch != "" {
+				body["git_branch"] = branch
+			}
+		}
+		if image != "" {
+			body["image"] = image
+		}
+		data, err := c.Do("POST", "/projects/"+projectID+"/services", body)
+		if err != nil {
+			return err
+		}
+		s, _ := unwrapObject(data, "service")
+		svcID = str(s, "id")
+		if svcID == "" || svcID == "-" {
+			PrintRaw(data)
+			return &APIError{Message: "service created but id missing from response", ExitCode: ExitError}
+		}
+		if !JSONMode() {
+			fmt.Fprintf(os.Stderr, "Created service %s (%s)\n", name, svcID)
+		}
+	}
+
+	deployBody := map[string]interface{}{"trigger": "cli-up"}
+	if commit != "" {
+		deployBody["commit_hash"] = commit
+	}
+	if branch != "" {
+		deployBody["branch"] = branch
+	}
+	data, err := c.Do("POST", "/services/"+svcID+"/deployments", deployBody)
+	if err != nil {
+		return err
+	}
+	if JSONMode() {
+		PrintRaw(data)
+		return nil
+	}
+	d, _ := unwrapObject(data, "deployment")
+	fmt.Printf("Deploying %s → service %s (deployment %s)\n", name, svcID, str(d, "id"))
+	return nil
+}
+
+func gitOutput(dir string, args ...string) string {
+	cmd := exec.Command("git", args...)
+	cmd.Dir = dir
+	out, err := cmd.Output()
+	if err != nil {
+		return ""
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func init() {
+	UpCmd.Flags().String("project", "", "target project id (or set project_id on the profile)")
+	UpCmd.Flags().String("name", "", "service name (default: directory name)")
+	UpCmd.Flags().String("service", "", "existing service id to redeploy")
+	UpCmd.Flags().String("image", "", "deploy this image instead of building from git")
+}

app/backend/internal/cli/commands/variables.go

@@ -0,0 +1,151 @@
+package commands
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+// VariablesCmd manages service environment variables.
+var VariablesCmd = &cobra.Command{
+	Use:     "variables",
+	Aliases: []string{"vars", "env"},
+	Short:   "Manage service environment variables",
+}
+
+var varsListCmd = &cobra.Command{
+	Use:   "list <service-id>",
+	Short: "List variables (secrets shown masked)",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/services/"+args[0]+"/variables", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "variables")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, v := range items {
+			rows = append(rows, []string{str(v, "key"), str(v, "value"), str(v, "is_secret")})
+		}
+		printRows(data, []string{"KEY", "VALUE", "SECRET"}, rows)
+		return nil
+	},
+}
+
+// Variables are replaced wholesale server-side — set/unset fetch the
+// current list, mutate it, and PUT it back. Masked secret placeholders are
+// preserved by the server.
+var varsSetCmd = &cobra.Command{
+	Use:   "set <service-id> KEY=VALUE [KEY=VALUE...]",
+	Short: "Set one or more variables",
+	Args:  cobra.MinimumNArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		secret, _ := cmd.Flags().GetBool("secret")
+		redeploy, _ := cmd.Flags().GetBool("redeploy")
+		return mutateVars(args[0], redeploy, func(vars []map[string]interface{}) []map[string]interface{} {
+			for _, pair := range args[1:] {
+				k, v, found := strings.Cut(pair, "=")
+				if !found || k == "" {
+					continue
+				}
+				vars = upsertVar(vars, k, v, secret)
+			}
+			return vars
+		})
+	},
+}
+
+var varsUnsetCmd = &cobra.Command{
+	Use:   "unset <service-id> KEY [KEY...]",
+	Short: "Remove variables",
+	Args:  cobra.MinimumNArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		drop := map[string]bool{}
+		for _, k := range args[1:] {
+			drop[k] = true
+		}
+		redeploy, _ := cmd.Flags().GetBool("redeploy")
+		return mutateVars(args[0], redeploy, func(vars []map[string]interface{}) []map[string]interface{} {
+			out := vars[:0]
+			for _, v := range vars {
+				if !drop[str(v, "key")] {
+					out = append(out, v)
+				}
+			}
+			return out
+		})
+	},
+}
+
+func fetchVars(c *Client, serviceID string) ([]map[string]interface{}, error) {
+	data, err := c.Do("GET", "/services/"+serviceID+"/variables", nil)
+	if err != nil {
+		return nil, err
+	}
+	return unwrapList(data, "variables")
+}
+
+func mutateVars(serviceID string, redeploy bool, mutate func([]map[string]interface{}) []map[string]interface{}) error {
+	c, err := client()
+	if err != nil {
+		return err
+	}
+	vars, err := fetchVars(c, serviceID)
+	if err != nil {
+		return err
+	}
+	vars = mutate(vars)
+	payload := make([]map[string]interface{}, 0, len(vars))
+	for _, v := range vars {
+		payload = append(payload, map[string]interface{}{
+			"key":       str(v, "key"),
+			"value":     str(v, "value"),
+			"is_secret": v["is_secret"] == true,
+		})
+	}
+	body := map[string]interface{}{"variables": payload}
+	if redeploy {
+		body["redeploy"] = true
+	}
+	data, err := c.Do("PUT", "/services/"+serviceID+"/variables", body)
+	if err != nil {
+		return err
+	}
+	if JSONMode() {
+		PrintRaw(data)
+		return nil
+	}
+	obj, _ := unwrapObject(data)
+	if obj["redeploy_queued"] == true {
+		fmt.Printf("Variables updated on %s — redeploy queued\n", serviceID)
+	} else {
+		fmt.Printf("Variables updated on %s — redeploy to apply to running containers\n", serviceID)
+	}
+	return nil
+}
+
+func upsertVar(vars []map[string]interface{}, key, value string, secret bool) []map[string]interface{} {
+	for _, v := range vars {
+		if str(v, "key") == key {
+			v["value"] = value
+			v["is_secret"] = secret
+			return vars
+		}
+	}
+	return append(vars, map[string]interface{}{"key": key, "value": value, "is_secret": secret})
+}
+
+func init() {
+	varsSetCmd.Flags().Bool("secret", false, "mark the variable(s) as secret")
+	varsSetCmd.Flags().Bool("redeploy", false, "redeploy the service after saving")
+	varsUnsetCmd.Flags().Bool("redeploy", false, "redeploy the service after saving")
+	VariablesCmd.AddCommand(varsListCmd, varsSetCmd, varsUnsetCmd)
+}

app/backend/internal/cli/commands/volumes.go

@@ -0,0 +1,71 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// VolumesCmd manages docker volumes on the node (admin).
+var VolumesCmd = &cobra.Command{
+	Use:     "volumes",
+	Aliases: []string{"volume"},
+	Short:   "Manage docker volumes (admin)",
+}
+
+var volumesListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List docker volumes with in-use flags",
+	Args:  cobra.NoArgs,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/admin/volumes", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "volumes")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, v := range items {
+			inUse := "no"
+			if b, ok := v["in_use"].(bool); ok && b {
+				inUse = "yes"
+			}
+			rows = append(rows, []string{str(v, "name"), str(v, "driver"), inUse})
+		}
+		printRows(data, []string{"NAME", "DRIVER", "IN USE"}, rows)
+		return nil
+	},
+}
+
+var volumesDeleteCmd = &cobra.Command{
+	Use:   "delete <name>",
+	Short: "Delete an unused docker volume",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		if !Confirm(fmt.Sprintf("Delete volume %s?", args[0])) {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		if _, err := c.Do("DELETE", "/admin/volumes/"+args[0], nil); err != nil {
+			return err
+		}
+		if JSONMode() {
+			return PrintJSON(map[string]string{"status": "deleted", "name": args[0]})
+		}
+		fmt.Printf("Deleted volume %s\n", args[0])
+		return nil
+	},
+}
+
+func init() {
+	VolumesCmd.AddCommand(volumesListCmd, volumesDeleteCmd)
+}

app/backend/internal/cli/root.go

@@ -12,64 +12,93 @@ import (
 
 var cfgFile string
 
-// rootCmd represents the base command when called without any subcommands
 var rootCmd = &cobra.Command{
 	Use:   "containr",
-	Short: "Containr CLI - Manage your self-hosted PaaS",
-	Long: `Containr CLI is a command-line interface for managing your Containr platform.
-You can manage projects, services, deployments, databases, and more from your terminal.`,
-	Version: "1.0.0",
+	Short: "Containr CLI - manage your self-hosted PaaS",
+	Long: `Containr CLI controls every part of a Containr instance: projects,
+services, deployments, databases, cron jobs, templates, nodes, scaling,
+HA, security, and the API gateway.
+
+Authenticate once with a personal access token (Settings → Personal
+Access Tokens in the web UI):
+
+  containr auth login cnp_...
+
+Every command supports --json for machine-readable output, and
+destructive actions accept --yes to skip confirmation.`,
+	Version:       "2.0.0",
+	SilenceUsage:  true,
+	SilenceErrors: true,
 }
 
-// Execute adds all child commands to the root command and sets flags appropriately.
-// This is called by main.main(). It only needs to happen once to the rootCmd.
-func Execute() {
-	cobra.CheckErr(rootCmd.Execute())
+// Execute runs the root command and returns the process exit code.
+func Execute() int {
+	if err := rootCmd.Execute(); err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		return commands.ExitCode(err)
+	}
+	return commands.ExitOK
+}
+
+// SetVersion overrides the version reported by `containr --version`.
+func SetVersion(v string) {
+	rootCmd.Version = v
 }
 
 func init() {
 	cobra.OnInitialize(initConfig)
 
-	// Global flags
-	rootCmd.PersistentFlags().StringVar(&cfgFile, "config", "", "config file (default is $HOME/.containr.yaml)")
-	rootCmd.PersistentFlags().String("api-url", "", "Containr API URL (default is https://api.containr.dev)")
-	rootCmd.PersistentFlags().String("token", "", "Authentication token")
+	pf := rootCmd.PersistentFlags()
+	pf.StringVar(&cfgFile, "config", "", "config file (default $HOME/.containr.yaml)")
+	pf.String("api-url", "", "Containr API URL (overrides profile and CONTAINR_API_URL)")
+	pf.String("token", "", "auth token (overrides profile and CONTAINR_TOKEN)")
+	pf.StringP("profile", "p", "", "config profile to use (default current_profile)")
+	pf.Bool("json", false, "machine-readable JSON output")
+	pf.BoolP("yes", "y", false, "skip confirmation prompts (required for destructive ops in scripts)")
+	pf.String("idempotency-key", "", "Idempotency-Key header for POST mutations (safe retries)")
 
-	// Bind flags to viper
-	viper.BindPFlag("api-url", rootCmd.PersistentFlags().Lookup("api-url"))
-	viper.BindPFlag("token", rootCmd.PersistentFlags().Lookup("token"))
+	viper.BindPFlag("api-url", pf.Lookup("api-url"))
+	viper.BindPFlag("token", pf.Lookup("token"))
+	viper.BindPFlag("profile", pf.Lookup("profile"))
+	viper.BindPFlag("json", pf.Lookup("json"))
+	viper.BindPFlag("yes", pf.Lookup("yes"))
+	viper.BindPFlag("idempotency-key", pf.Lookup("idempotency-key"))
 
-	// Add command groups
 	rootCmd.AddCommand(commands.AuthCmd)
+	rootCmd.AddCommand(commands.TokensCmd)
 	rootCmd.AddCommand(commands.ProjectsCmd)
+	rootCmd.AddCommand(commands.ServicesCmd)
+	rootCmd.AddCommand(commands.DeployCmd)
+	rootCmd.AddCommand(commands.DeploymentsCmd)
+	rootCmd.AddCommand(commands.LogsCmd)
+	rootCmd.AddCommand(commands.ExecCmd)
+	rootCmd.AddCommand(commands.VariablesCmd)
+	rootCmd.AddCommand(commands.VolumesCmd)
+	rootCmd.AddCommand(commands.DatabasesCmd)
+	rootCmd.AddCommand(commands.CronCmd)
+	rootCmd.AddCommand(commands.TemplatesCmd)
+	rootCmd.AddCommand(commands.NodesCmd)
+	rootCmd.AddCommand(commands.ScalingCmd)
+	rootCmd.AddCommand(commands.HACmd)
+	rootCmd.AddCommand(commands.SecurityCmd)
+	rootCmd.AddCommand(commands.GatewayCmd)
+	rootCmd.AddCommand(commands.AdminCmd)
+	rootCmd.AddCommand(commands.NotificationsCmd)
+	rootCmd.AddCommand(commands.UpCmd)
 }
 
-// initConfig reads in config file and ENV variables if set.
 func initConfig() {
 	if cfgFile != "" {
-		// Use config file from the flag.
 		viper.SetConfigFile(cfgFile)
 	} else {
-		// Find home directory.
 		home, err := os.UserHomeDir()
 		cobra.CheckErr(err)
-
-		// Search config in home directory with name ".containr" (without extension).
 		viper.AddConfigPath(home)
 		viper.SetConfigType("yaml")
 		viper.SetConfigName(".containr")
 	}
-
-	viper.AutomaticEnv() // read in environment variables that match
-
-	// If a config file is found, read it in.
-	if err := viper.ReadInConfig(); err == nil {
-		fmt.Fprintln(os.Stderr, "Using config file:", viper.ConfigFileUsed())
-	}
-}
-
-// Run executes the CLI
-func Run() error {
-	rootCmd.Execute()
-	return nil
+	viper.AutomaticEnv()
+	// CONTAINR_TOKEN / CONTAINR_API_URL are read explicitly in config.go;
+	// AutomaticEnv covers them only when bound, so this is belt-and-braces.
+	viper.ReadInConfig()
 }

app/backend/internal/cli/utils.go

@@ -1,25 +0,0 @@
-package cli
-
-import (
-	"strings"
-
-	"github.com/spf13/viper"
-)
-
-// getAPIURL constructs the full API URL for a given endpoint
-func getAPIURL(endpoint string) string {
-	baseURL := viper.GetString("api-url")
-	if baseURL == "" {
-		baseURL = "http://localhost:8080/api/v1" // Default for development
-	}
-
-	// Ensure baseURL doesn't end with / and endpoint starts with /
-	if strings.HasSuffix(baseURL, "/") {
-		baseURL = baseURL[:len(baseURL)-1]
-	}
-	if !strings.HasPrefix(endpoint, "/") {
-		endpoint = "/" + endpoint
-	}
-
-	return baseURL + endpoint
-}

app/backend/internal/config/config.go

@@ -91,6 +91,12 @@ type Config struct {
 
 	// Dashboard UI Configuration
 	DashboardUIBasePath string `env:"DASHBOARD_UI_BASE_PATH" default:"/"`
+
+	// Admin bootstrap — when set, the account is provisioned/promoted on
+	// startup so the owner always has admin credentials that work.
+	AdminEmail    string `env:"ADMIN_EMAIL" default:""`
+	AdminPassword string `env:"ADMIN_PASSWORD" default:""`
+	AdminName     string `env:"ADMIN_NAME" default:""`
 }
 
 // Environment represents the application environment
@@ -181,6 +187,10 @@ func Load() *Config {
 
 	cfg.DashboardUIBasePath = getenv("DASHBOARD_UI_BASE_PATH", "/")
 
+	cfg.AdminEmail = getenv("ADMIN_EMAIL", "")
+	cfg.AdminPassword = getenv("ADMIN_PASSWORD", "")
+	cfg.AdminName = getenv("ADMIN_NAME", "")
+
 	// Validate configuration
 	if err := cfg.Validate(); err != nil {
 		panic(fmt.Sprintf("Invalid configuration: %v", err))
@@ -215,9 +225,8 @@ func (c *Config) Validate() error {
 			return fmt.Errorf("SEED_DATA_ON_START must be false in production")
 		}
 
-		if !c.CookieSecure {
-			return fmt.Errorf("COOKIE_SECURE must be true in production")
-		}
+		// COOKIE_SECURE=false is legal for plain-HTTP self-hosted installs and is
+		// reported as a startup warning in main.go rather than a fatal error.
 
 		if c.BetterAuthEnabled {
 			if len(strings.TrimSpace(c.BetterAuthSecret)) < 32 ||

app/backend/internal/config/config_test.go

@@ -108,7 +108,7 @@ func TestValidateAllowsWildcardCorsWithoutCredentialsInProduction(t *testing.T)
 	}
 }
 
-func TestValidateRejectsInsecureCookieInProduction(t *testing.T) {
+func TestValidateAllowsInsecureCookieInProduction(t *testing.T) {
 	t.Setenv("ENVIRONMENT", "production")
 	cfg := Config{
 		JWTSecret:       "this-is-a-very-strong-production-secret-123",
@@ -120,9 +120,10 @@ func TestValidateRejectsInsecureCookieInProduction(t *testing.T) {
 		CORSCredentials: true,
 	}
 
-	err := cfg.Validate()
-	if err == nil || !strings.Contains(err.Error(), "COOKIE_SECURE must be true") {
-		t.Fatalf("expected COOKIE_SECURE validation error, got %v", err)
+	// Plain-HTTP self-hosted installs are a supported production deployment;
+	// insecure cookies are allowed and surfaced as a startup warning.
+	if err := cfg.Validate(); err != nil {
+		t.Fatalf("expected production config with insecure cookies to validate, got %v", err)
 	}
 }
 

app/backend/internal/database/postgres.go

@@ -55,5 +55,5 @@ func (db *DB) Health(ctx context.Context) error {
 
 // Stats returns connection pool statistics for monitoring
 func (db *DB) Stats() sql.DBStats {
-	return db.Stats()
+	return db.DB.Stats()
 }

app/backend/internal/database/sqlcdb/databases.sql.go

@@ -149,37 +149,18 @@ func (q *Queries) GetDatabaseBackupByIDAndDatabaseAndUser(ctx context.Context, a
 	return i, err
 }
 
-const getDatabaseServiceByIDAndUser = `-- name: GetDatabaseServiceByIDAndUser :one
-SELECT id, name, type, status, version, plan, region, connection_url, backup_schedule, next_backup_at, created_at, updated_at
+const getDatabaseServiceByID = `-- name: GetDatabaseServiceByID :one
+SELECT id, user_id, name, type, status, version, plan, region, connection_url, backup_schedule, next_backup_at, created_at, updated_at
 FROM database_services
-WHERE id = $1 AND user_id = $2
+WHERE id = $1
 `
 
-type GetDatabaseServiceByIDAndUserParams struct {
-	ID     string `json:"id"`
-	UserID string `json:"user_id"`
-}
-
-type GetDatabaseServiceByIDAndUserRow struct {
-	ID             string         `json:"id"`
-	Name           string         `json:"name"`
-	Type           string         `json:"type"`
-	Status         string         `json:"status"`
-	Version        string         `json:"version"`
-	Plan           string         `json:"plan"`
-	Region         string         `json:"region"`
-	ConnectionUrl  sql.NullString `json:"connection_url"`
-	BackupSchedule sql.NullString `json:"backup_schedule"`
-	NextBackupAt   sql.NullTime   `json:"next_backup_at"`
-	CreatedAt      sql.NullTime   `json:"created_at"`
-	UpdatedAt      sql.NullTime   `json:"updated_at"`
-}
-
-func (q *Queries) GetDatabaseServiceByIDAndUser(ctx context.Context, arg GetDatabaseServiceByIDAndUserParams) (GetDatabaseServiceByIDAndUserRow, error) {
-	row := q.db.QueryRowContext(ctx, getDatabaseServiceByIDAndUser, arg.ID, arg.UserID)
-	var i GetDatabaseServiceByIDAndUserRow
+func (q *Queries) GetDatabaseServiceByID(ctx context.Context, id string) (DatabaseService, error) {
+	row := q.db.QueryRowContext(ctx, getDatabaseServiceByID, id)
+	var i DatabaseService
 	err := row.Scan(
 		&i.ID,
+		&i.UserID,
 		&i.Name,
 		&i.Type,
 		&i.Status,
@@ -195,6 +176,94 @@ func (q *Queries) GetDatabaseServiceByIDAndUser(ctx context.Context, arg GetData
 	return i, err
 }
 
+const getDatabaseServiceByIDAndUser = `-- name: GetDatabaseServiceByIDAndUser :one
+SELECT id, user_id, name, type, status, version, plan, region, connection_url, backup_schedule, next_backup_at, created_at, updated_at
+FROM database_services
+WHERE id = $1 AND user_id = $2
+`
+
+type GetDatabaseServiceByIDAndUserParams struct {
+	ID     string `json:"id"`
+	UserID string `json:"user_id"`
+}
+
+func (q *Queries) GetDatabaseServiceByIDAndUser(ctx context.Context, arg GetDatabaseServiceByIDAndUserParams) (DatabaseService, error) {
+	row := q.db.QueryRowContext(ctx, getDatabaseServiceByIDAndUser, arg.ID, arg.UserID)
+	var i DatabaseService
+	err := row.Scan(
+		&i.ID,
+		&i.UserID,
+		&i.Name,
+		&i.Type,
+		&i.Status,
+		&i.Version,
+		&i.Plan,
+		&i.Region,
+		&i.ConnectionUrl,
+		&i.BackupSchedule,
+		&i.NextBackupAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getDatabaseServiceOwnerID = `-- name: GetDatabaseServiceOwnerID :one
+SELECT user_id
+FROM database_services
+WHERE id = $1
+`
+
+func (q *Queries) GetDatabaseServiceOwnerID(ctx context.Context, id string) (string, error) {
+	row := q.db.QueryRowContext(ctx, getDatabaseServiceOwnerID, id)
+	var user_id string
+	err := row.Scan(&user_id)
+	return user_id, err
+}
+
+const listAllDatabaseServices = `-- name: ListAllDatabaseServices :many
+SELECT id, user_id, name, type, status, version, plan, region, connection_url, backup_schedule, next_backup_at, created_at, updated_at
+FROM database_services
+ORDER BY created_at DESC
+`
+
+func (q *Queries) ListAllDatabaseServices(ctx context.Context) ([]DatabaseService, error) {
+	rows, err := q.db.QueryContext(ctx, listAllDatabaseServices)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []DatabaseService{}
+	for rows.Next() {
+		var i DatabaseService
+		if err := rows.Scan(
+			&i.ID,
+			&i.UserID,
+			&i.Name,
+			&i.Type,
+			&i.Status,
+			&i.Version,
+			&i.Plan,
+			&i.Region,
+			&i.ConnectionUrl,
+			&i.BackupSchedule,
+			&i.NextBackupAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listDatabaseBackupsByDatabaseAndUser = `-- name: ListDatabaseBackupsByDatabaseAndUser :many
 SELECT b.id, b.database_id, b.size, b.status, b.backup_path, b.created_at, b.completed_at
 FROM database_backups b
@@ -242,38 +311,24 @@ func (q *Queries) ListDatabaseBackupsByDatabaseAndUser(ctx context.Context, arg
 }
 
 const listDatabaseServicesByUser = `-- name: ListDatabaseServicesByUser :many
-SELECT id, name, type, status, version, plan, region, connection_url, backup_schedule, next_backup_at, created_at, updated_at
+SELECT id, user_id, name, type, status, version, plan, region, connection_url, backup_schedule, next_backup_at, created_at, updated_at
 FROM database_services
 WHERE user_id = $1
 ORDER BY created_at DESC
 `
 
-type ListDatabaseServicesByUserRow struct {
-	ID             string         `json:"id"`
-	Name           string         `json:"name"`
-	Type           string         `json:"type"`
-	Status         string         `json:"status"`
-	Version        string         `json:"version"`
-	Plan           string         `json:"plan"`
-	Region         string         `json:"region"`
-	ConnectionUrl  sql.NullString `json:"connection_url"`
-	BackupSchedule sql.NullString `json:"backup_schedule"`
-	NextBackupAt   sql.NullTime   `json:"next_backup_at"`
-	CreatedAt      sql.NullTime   `json:"created_at"`
-	UpdatedAt      sql.NullTime   `json:"updated_at"`
-}
-
-func (q *Queries) ListDatabaseServicesByUser(ctx context.Context, userID string) ([]ListDatabaseServicesByUserRow, error) {
+func (q *Queries) ListDatabaseServicesByUser(ctx context.Context, userID string) ([]DatabaseService, error) {
 	rows, err := q.db.QueryContext(ctx, listDatabaseServicesByUser, userID)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
-	items := []ListDatabaseServicesByUserRow{}
+	items := []DatabaseService{}
 	for rows.Next() {
-		var i ListDatabaseServicesByUserRow
+		var i DatabaseService
 		if err := rows.Scan(
 			&i.ID,
+			&i.UserID,
 			&i.Name,
 			&i.Type,
 			&i.Status,

app/backend/internal/database/sqlcdb/models.go

@@ -154,6 +154,7 @@ type Project struct {
 	Name        string         `json:"name"`
 	Description sql.NullString `json:"description"`
 	OwnerID     uuid.UUID      `json:"owner_id"`
+	IsApproved  bool           `json:"is_approved"`
 	CreatedAt   sql.NullTime   `json:"created_at"`
 	UpdatedAt   sql.NullTime   `json:"updated_at"`
 }
@@ -167,33 +168,53 @@ type ProjectMember struct {
 }
 
 type Service struct {
-	ID             uuid.UUID      `json:"id"`
-	Name           string         `json:"name"`
-	Description    sql.NullString `json:"description"`
-	ProjectID      uuid.UUID      `json:"project_id"`
-	EnvironmentID  uuid.UUID      `json:"environment_id"`
-	ServiceType    string         `json:"service_type"`
-	SourceType     string         `json:"source_type"`
-	SourceUrl      sql.NullString `json:"source_url"`
-	ImageName      sql.NullString `json:"image_name"`
-	BuildCommand   sql.NullString `json:"build_command"`
-	StartCommand   sql.NullString `json:"start_command"`
-	CpuLimit       sql.NullInt32  `json:"cpu_limit"`
-	MemoryLimit    sql.NullInt32  `json:"memory_limit"`
-	PublicUrl      sql.NullString `json:"public_url"`
-	HealthCheckUrl sql.NullString `json:"health_check_url"`
-	Status         sql.NullString `json:"status"`
-	CreatedAt      sql.NullTime   `json:"created_at"`
-	UpdatedAt      sql.NullTime   `json:"updated_at"`
-	Type           sql.NullString `json:"type"`
-	Image          sql.NullString `json:"image"`
-	Command        sql.NullString `json:"command"`
-	Environment    sql.NullString `json:"environment"`
-	GitRepo        sql.NullString `json:"git_repo"`
-	GitBranch      sql.NullString `json:"git_branch"`
-	BuildPath      sql.NullString `json:"build_path"`
-	Cpu            sql.NullString `json:"cpu"`
-	Memory         sql.NullString `json:"memory"`
+	ID              uuid.UUID       `json:"id"`
+	Name            string          `json:"name"`
+	Description     sql.NullString  `json:"description"`
+	ProjectID       uuid.UUID       `json:"project_id"`
+	EnvironmentID   uuid.UUID       `json:"environment_id"`
+	ServiceType     string          `json:"service_type"`
+	SourceType      string          `json:"source_type"`
+	SourceUrl       sql.NullString  `json:"source_url"`
+	ImageName       sql.NullString  `json:"image_name"`
+	BuildCommand    sql.NullString  `json:"build_command"`
+	StartCommand    sql.NullString  `json:"start_command"`
+	CpuLimit        sql.NullInt32   `json:"cpu_limit"`
+	MemoryLimit     sql.NullInt32   `json:"memory_limit"`
+	PublicUrl       sql.NullString  `json:"public_url"`
+	HealthCheckUrl  sql.NullString  `json:"health_check_url"`
+	Status          sql.NullString  `json:"status"`
+	CreatedAt       sql.NullTime    `json:"created_at"`
+	UpdatedAt       sql.NullTime    `json:"updated_at"`
+	Type            sql.NullString  `json:"type"`
+	Image           sql.NullString  `json:"image"`
+	Command         sql.NullString  `json:"command"`
+	Environment     sql.NullString  `json:"environment"`
+	GitRepo         sql.NullString  `json:"git_repo"`
+	GitBranch       sql.NullString  `json:"git_branch"`
+	BuildPath       sql.NullString  `json:"build_path"`
+	Cpu             sql.NullString  `json:"cpu"`
+	Memory          sql.NullString  `json:"memory"`
+	Replicas        int32           `json:"replicas"`
+	Port            int32           `json:"port"`
+	Domain          string          `json:"domain"`
+	HealthcheckPath string          `json:"healthcheck_path"`
+	RestartPolicy   string          `json:"restart_policy"`
+	PublishedPort   int32           `json:"published_port"`
+	Volumes         json.RawMessage `json:"volumes"`
+	MaintenanceMode bool            `json:"maintenance_mode"`
+	BasicAuthUsers  string          `json:"basic_auth_users"`
+}
+
+type ServiceDomain struct {
+	ID            uuid.UUID    `json:"id"`
+	ServiceID     uuid.UUID    `json:"service_id"`
+	Domain        string       `json:"domain"`
+	IsDefault     bool         `json:"is_default"`
+	CertType      string       `json:"cert_type"`
+	CertStatus    string       `json:"cert_status"`
+	LastCheckedAt sql.NullTime `json:"last_checked_at"`
+	CreatedAt     time.Time    `json:"created_at"`
 }
 
 type ServiceTemplate struct {
@@ -205,6 +226,21 @@ type ServiceTemplate struct {
 	Config      json.RawMessage       `json:"config"`
 	Variables   pqtype.NullRawMessage `json:"variables"`
 	IsOfficial  sql.NullBool          `json:"is_official"`
+	OwnerID     uuid.NullUUID         `json:"owner_id"`
+	IsPublic    bool                  `json:"is_public"`
 	CreatedAt   sql.NullTime          `json:"created_at"`
 	UpdatedAt   sql.NullTime          `json:"updated_at"`
 }
+
+type UserToken struct {
+	ID         uuid.UUID    `json:"id"`
+	UserID     uuid.UUID    `json:"user_id"`
+	Name       string       `json:"name"`
+	KeyPrefix  string       `json:"key_prefix"`
+	TokenHash  string       `json:"token_hash"`
+	Scope      string       `json:"scope"`
+	ExpiresAt  sql.NullTime `json:"expires_at"`
+	LastUsedAt sql.NullTime `json:"last_used_at"`
+	RevokedAt  sql.NullTime `json:"revoked_at"`
+	CreatedAt  sql.NullTime `json:"created_at"`
+}

app/backend/internal/database/sqlcdb/projects.sql.go

@@ -16,25 +16,31 @@ const countProjectsByUser = `-- name: CountProjectsByUser :one
 SELECT COUNT(*)::bigint AS total
 FROM projects p
 WHERE
-    (p.owner_id = $1 OR EXISTS (
-        SELECT 1
-        FROM project_members pm
-        WHERE pm.project_id = p.id AND pm.user_id = $1
-    ))
+    (
+        p.is_approved
+        OR p.owner_id = $1
+        OR $2::bool
+        OR EXISTS (
+            SELECT 1
+            FROM project_members pm
+            WHERE pm.project_id = p.id AND pm.user_id = $1
+        )
+    )
     AND (
-        $2::text IS NULL
-        OR p.name ILIKE ('%' || $2::text || '%')
-        OR COALESCE(p.description, '') ILIKE ('%' || $2::text || '%')
+        $3::text IS NULL
+        OR p.name ILIKE ('%' || $3::text || '%')
+        OR COALESCE(p.description, '') ILIKE ('%' || $3::text || '%')
     )
 `
 
 type CountProjectsByUserParams struct {
-	UserID uuid.UUID      `json:"user_id"`
-	Search sql.NullString `json:"search"`
+	UserID  uuid.UUID      `json:"user_id"`
+	IsAdmin bool           `json:"is_admin"`
+	Search  sql.NullString `json:"search"`
 }
 
 func (q *Queries) CountProjectsByUser(ctx context.Context, arg CountProjectsByUserParams) (int64, error) {
-	row := q.db.QueryRowContext(ctx, countProjectsByUser, arg.UserID, arg.Search)
+	row := q.db.QueryRowContext(ctx, countProjectsByUser, arg.UserID, arg.IsAdmin, arg.Search)
 	var total int64
 	err := row.Scan(&total)
 	return total, err
@@ -43,7 +49,7 @@ func (q *Queries) CountProjectsByUser(ctx context.Context, arg CountProjectsByUs
 const createProject = `-- name: CreateProject :one
 INSERT INTO projects (name, description, owner_id)
 VALUES ($1, $2, $3)
-RETURNING id, name, description, owner_id, created_at, updated_at
+RETURNING id, name, description, owner_id, is_approved, created_at, updated_at
 `
 
 type CreateProjectParams struct {
@@ -60,6 +66,7 @@ func (q *Queries) CreateProject(ctx context.Context, arg CreateProjectParams) (P
 		&i.Name,
 		&i.Description,
 		&i.OwnerID,
+		&i.IsApproved,
 		&i.CreatedAt,
 		&i.UpdatedAt,
 	)
@@ -80,11 +87,13 @@ func (q *Queries) DeleteProjectByID(ctx context.Context, projectID uuid.UUID) (i
 }
 
 const getProjectByIDForUser = `-- name: GetProjectByIDForUser :one
-SELECT p.id, p.name, p.description, p.owner_id, p.created_at, p.updated_at
+SELECT p.id, p.name, p.description, p.owner_id, p.is_approved, p.created_at, p.updated_at
 FROM projects p
 WHERE p.id = $1
   AND (
-      p.owner_id = $2
+      p.is_approved
+      OR p.owner_id = $2
+      OR $3::bool
       OR EXISTS (
           SELECT 1
           FROM project_members pm
@@ -96,16 +105,18 @@ WHERE p.id = $1
 type GetProjectByIDForUserParams struct {
 	ProjectID uuid.UUID `json:"project_id"`
 	UserID    uuid.UUID `json:"user_id"`
+	IsAdmin   bool      `json:"is_admin"`
 }
 
 func (q *Queries) GetProjectByIDForUser(ctx context.Context, arg GetProjectByIDForUserParams) (Project, error) {
-	row := q.db.QueryRowContext(ctx, getProjectByIDForUser, arg.ProjectID, arg.UserID)
+	row := q.db.QueryRowContext(ctx, getProjectByIDForUser, arg.ProjectID, arg.UserID, arg.IsAdmin)
 	var i Project
 	err := row.Scan(
 		&i.ID,
 		&i.Name,
 		&i.Description,
 		&i.OwnerID,
+		&i.IsApproved,
 		&i.CreatedAt,
 		&i.UpdatedAt,
 	)
@@ -127,21 +138,22 @@ func (q *Queries) GetProjectOwnerByID(ctx context.Context, projectID uuid.UUID)
 
 const getProjectRoleForUser = `-- name: GetProjectRoleForUser :one
 SELECT (CASE
-    WHEN p.owner_id = $1 THEN 'owner'
+    WHEN p.owner_id = $1 OR $2::bool THEN 'owner'
     ELSE COALESCE(pm.role, '')
 END)::text AS role
 FROM projects p
 LEFT JOIN project_members pm ON p.id = pm.project_id AND pm.user_id = $1
-WHERE p.id = $2
+WHERE p.id = $3
 `
 
 type GetProjectRoleForUserParams struct {
 	UserID    uuid.UUID `json:"user_id"`
+	IsAdmin   bool      `json:"is_admin"`
 	ProjectID uuid.UUID `json:"project_id"`
 }
 
 func (q *Queries) GetProjectRoleForUser(ctx context.Context, arg GetProjectRoleForUserParams) (string, error) {
-	row := q.db.QueryRowContext(ctx, getProjectRoleForUser, arg.UserID, arg.ProjectID)
+	row := q.db.QueryRowContext(ctx, getProjectRoleForUser, arg.UserID, arg.IsAdmin, arg.ProjectID)
 	var role string
 	err := row.Scan(&role)
 	return role, err
@@ -162,12 +174,52 @@ func (q *Queries) InsertProjectEnvironment(ctx context.Context, arg InsertProjec
 	return err
 }
 
+const listPendingProjects = `-- name: ListPendingProjects :many
+SELECT p.id, p.name, p.description, p.owner_id, p.is_approved, p.created_at, p.updated_at
+FROM projects p
+WHERE p.is_approved = false
+ORDER BY p.created_at DESC
+`
+
+func (q *Queries) ListPendingProjects(ctx context.Context) ([]Project, error) {
+	rows, err := q.db.QueryContext(ctx, listPendingProjects)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []Project{}
+	for rows.Next() {
+		var i Project
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Description,
+			&i.OwnerID,
+			&i.IsApproved,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listProjectsWithStatsByUser = `-- name: ListProjectsWithStatsByUser :many
+
 SELECT
     p.id,
     p.name,
     p.description,
     p.owner_id,
+    p.is_approved,
     p.created_at,
     p.updated_at,
     COUNT(DISTINCT s.id)::bigint AS service_count,
@@ -185,23 +237,29 @@ FROM projects p
 LEFT JOIN services s ON s.project_id = p.id
 LEFT JOIN deployments d ON d.service_id = s.id
 WHERE
-    (p.owner_id = $1 OR EXISTS (
-        SELECT 1
-        FROM project_members pm
-        WHERE pm.project_id = p.id AND pm.user_id = $1
-    ))
-    AND (
-        $2::text IS NULL
-        OR p.name ILIKE ('%' || $2::text || '%')
-        OR COALESCE(p.description, '') ILIKE ('%' || $2::text || '%')
+    (
+        p.is_approved
+        OR p.owner_id = $1
+        OR $2::bool
+        OR EXISTS (
+            SELECT 1
+            FROM project_members pm
+            WHERE pm.project_id = p.id AND pm.user_id = $1
+        )
     )
-GROUP BY p.id, p.name, p.description, p.owner_id, p.created_at, p.updated_at
+    AND (
+        $3::text IS NULL
+        OR p.name ILIKE ('%' || $3::text || '%')
+        OR COALESCE(p.description, '') ILIKE ('%' || $3::text || '%')
+    )
+GROUP BY p.id, p.name, p.description, p.owner_id, p.is_approved, p.created_at, p.updated_at
 ORDER BY p.updated_at DESC
-LIMIT $4 OFFSET $3
+LIMIT $5 OFFSET $4
 `
 
 type ListProjectsWithStatsByUserParams struct {
 	UserID      uuid.UUID      `json:"user_id"`
+	IsAdmin     bool           `json:"is_admin"`
 	Search      sql.NullString `json:"search"`
 	OffsetCount int32          `json:"offset_count"`
 	LimitCount  int32          `json:"limit_count"`
@@ -212,6 +270,7 @@ type ListProjectsWithStatsByUserRow struct {
 	Name            string         `json:"name"`
 	Description     sql.NullString `json:"description"`
 	OwnerID         uuid.UUID      `json:"owner_id"`
+	IsApproved      bool           `json:"is_approved"`
 	CreatedAt       sql.NullTime   `json:"created_at"`
 	UpdatedAt       sql.NullTime   `json:"updated_at"`
 	ServiceCount    int64          `json:"service_count"`
@@ -220,9 +279,13 @@ type ListProjectsWithStatsByUserRow struct {
 	LastDeployment  sql.NullTime   `json:"last_deployment"`
 }
 
+// Visibility model: a project is readable when it is approved for public
+// display, when the caller owns or is a member of it, or when the caller is a
+// platform admin. Anonymous callers pass user_id = uuid.Nil, is_admin = false.
 func (q *Queries) ListProjectsWithStatsByUser(ctx context.Context, arg ListProjectsWithStatsByUserParams) ([]ListProjectsWithStatsByUserRow, error) {
 	rows, err := q.db.QueryContext(ctx, listProjectsWithStatsByUser,
 		arg.UserID,
+		arg.IsAdmin,
 		arg.Search,
 		arg.OffsetCount,
 		arg.LimitCount,
@@ -239,6 +302,7 @@ func (q *Queries) ListProjectsWithStatsByUser(ctx context.Context, arg ListProje
 			&i.Name,
 			&i.Description,
 			&i.OwnerID,
+			&i.IsApproved,
 			&i.CreatedAt,
 			&i.UpdatedAt,
 			&i.ServiceCount,
@@ -259,6 +323,25 @@ func (q *Queries) ListProjectsWithStatsByUser(ctx context.Context, arg ListProje
 	return items, nil
 }
 
+const setProjectApproved = `-- name: SetProjectApproved :execrows
+UPDATE projects
+SET is_approved = $1, updated_at = NOW()
+WHERE id = $2
+`
+
+type SetProjectApprovedParams struct {
+	IsApproved bool      `json:"is_approved"`
+	ProjectID  uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) SetProjectApproved(ctx context.Context, arg SetProjectApprovedParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, setProjectApproved, arg.IsApproved, arg.ProjectID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
 const updateProjectByID = `-- name: UpdateProjectByID :execrows
 UPDATE projects
 SET

app/backend/internal/database/sqlcdb/querier.go

@@ -25,10 +25,13 @@ type Querier interface {
 	CreateNotification(ctx context.Context, arg CreateNotificationParams) error
 	CreateProject(ctx context.Context, arg CreateProjectParams) (Project, error)
 	CreateServiceFromTemplate(ctx context.Context, arg CreateServiceFromTemplateParams) error
+	CreateUserTemplate(ctx context.Context, arg CreateUserTemplateParams) error
+	CreateUserToken(ctx context.Context, arg CreateUserTokenParams) (UserToken, error)
 	DatabaseServiceExistsByIDAndUser(ctx context.Context, arg DatabaseServiceExistsByIDAndUserParams) (bool, error)
 	DeleteAgent(ctx context.Context, id string) error
 	DeleteDatabaseServiceByIDAndUser(ctx context.Context, arg DeleteDatabaseServiceByIDAndUserParams) error
 	DeleteProjectByID(ctx context.Context, projectID uuid.UUID) (int64, error)
+	DeleteUserTemplate(ctx context.Context, arg DeleteUserTemplateParams) (int64, error)
 	GetActiveAgentAuthTokenByHash(ctx context.Context, tokenHash string) (AgentAuthToken, error)
 	GetAgent(ctx context.Context, id string) (NodeAgent, error)
 	GetAgentByHostAndIP(ctx context.Context, arg GetAgentByHostAndIPParams) (NodeAgent, error)
@@ -36,37 +39,49 @@ type Querier interface {
 	GetContainer(ctx context.Context, id string) (ContainerInstance, error)
 	GetContainerForAgent(ctx context.Context, arg GetContainerForAgentParams) (ContainerInstance, error)
 	GetDatabaseBackupByIDAndDatabaseAndUser(ctx context.Context, arg GetDatabaseBackupByIDAndDatabaseAndUserParams) (DatabaseBackup, error)
-	GetDatabaseServiceByIDAndUser(ctx context.Context, arg GetDatabaseServiceByIDAndUserParams) (GetDatabaseServiceByIDAndUserRow, error)
+	GetDatabaseServiceByID(ctx context.Context, id string) (DatabaseService, error)
+	GetDatabaseServiceByIDAndUser(ctx context.Context, arg GetDatabaseServiceByIDAndUserParams) (DatabaseService, error)
+	GetDatabaseServiceOwnerID(ctx context.Context, id string) (string, error)
 	GetProjectByIDForUser(ctx context.Context, arg GetProjectByIDForUserParams) (Project, error)
 	GetProjectOwnerByID(ctx context.Context, projectID uuid.UUID) (uuid.UUID, error)
 	GetProjectOwnerID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
 	GetProjectRoleForUser(ctx context.Context, arg GetProjectRoleForUserParams) (string, error)
 	GetServiceTemplateByID(ctx context.Context, id string) (ServiceTemplate, error)
+	GetUserTokenByHash(ctx context.Context, tokenHash string) (UserToken, error)
 	InsertAgentHeartbeat(ctx context.Context, arg InsertAgentHeartbeatParams) error
 	InsertProjectEnvironment(ctx context.Context, arg InsertProjectEnvironmentParams) error
 	ListAgentAuthTokens(ctx context.Context) ([]AgentAuthToken, error)
 	ListAgentHeartbeatsSince(ctx context.Context, arg ListAgentHeartbeatsSinceParams) ([]AgentHeartbeat, error)
 	ListAgents(ctx context.Context) ([]NodeAgent, error)
+	ListAllDatabaseServices(ctx context.Context) ([]DatabaseService, error)
 	ListCommandsForAgent(ctx context.Context, nodeAgentID string) ([]AgentCommand, error)
 	ListContainersForAgent(ctx context.Context, nodeAgentID string) ([]ContainerInstance, error)
 	ListDatabaseBackupsByDatabaseAndUser(ctx context.Context, arg ListDatabaseBackupsByDatabaseAndUserParams) ([]DatabaseBackup, error)
-	ListDatabaseServicesByUser(ctx context.Context, userID string) ([]ListDatabaseServicesByUserRow, error)
+	ListDatabaseServicesByUser(ctx context.Context, userID string) ([]DatabaseService, error)
 	ListDueDatabaseBackups(ctx context.Context) ([]ListDueDatabaseBackupsRow, error)
 	ListNotificationsByUser(ctx context.Context, arg ListNotificationsByUserParams) ([]Notification, error)
 	ListPendingCommands(ctx context.Context, nodeAgentID string) ([]AgentCommand, error)
+	ListPendingProjects(ctx context.Context) ([]Project, error)
+	// Visibility model: a project is readable when it is approved for public
+	// display, when the caller owns or is a member of it, or when the caller is a
+	// platform admin. Anonymous callers pass user_id = uuid.Nil, is_admin = false.
 	ListProjectsWithStatsByUser(ctx context.Context, arg ListProjectsWithStatsByUserParams) ([]ListProjectsWithStatsByUserRow, error)
-	ListServiceTemplates(ctx context.Context) ([]ServiceTemplate, error)
-	ListServiceTemplatesByCategory(ctx context.Context, category string) ([]ServiceTemplate, error)
+	ListServiceTemplatesByCategoryForUser(ctx context.Context, arg ListServiceTemplatesByCategoryForUserParams) ([]ServiceTemplate, error)
+	ListServiceTemplatesForUser(ctx context.Context, ownerID uuid.NullUUID) ([]ServiceTemplate, error)
+	ListUserTokens(ctx context.Context, userID uuid.UUID) ([]UserToken, error)
 	MarkAllNotificationsReadByUser(ctx context.Context, arg MarkAllNotificationsReadByUserParams) error
 	MarkNotificationReadByIDAndUser(ctx context.Context, arg MarkNotificationReadByIDAndUserParams) error
 	RevokeAgentAuthToken(ctx context.Context, id uuid.UUID) (AgentAuthToken, error)
+	RevokeUserToken(ctx context.Context, arg RevokeUserTokenParams) (int64, error)
 	SetDatabaseBackupScheduleByIDAndUser(ctx context.Context, arg SetDatabaseBackupScheduleByIDAndUserParams) error
 	SetDatabaseBackupStatusByID(ctx context.Context, arg SetDatabaseBackupStatusByIDParams) error
 	SetDatabaseNextBackupAt(ctx context.Context, arg SetDatabaseNextBackupAtParams) error
 	SetDatabaseServiceStatusAndConnectionByID(ctx context.Context, arg SetDatabaseServiceStatusAndConnectionByIDParams) error
 	SetDatabaseServiceStatusByID(ctx context.Context, arg SetDatabaseServiceStatusByIDParams) error
 	SetDatabaseServiceStatusByIDAndUser(ctx context.Context, arg SetDatabaseServiceStatusByIDAndUserParams) error
+	SetProjectApproved(ctx context.Context, arg SetProjectApprovedParams) (int64, error)
 	TouchAgentAuthToken(ctx context.Context, tokenHash string) error
+	TouchUserToken(ctx context.Context, id uuid.UUID) error
 	UpdateAgent(ctx context.Context, arg UpdateAgentParams) (NodeAgent, error)
 	UpdateAgentHeartbeat(ctx context.Context, arg UpdateAgentHeartbeatParams) error
 	UpdateContainerStatus(ctx context.Context, arg UpdateContainerStatusParams) error
@@ -74,7 +89,9 @@ type Querier interface {
 	UpdateDatabaseServiceNameByIDAndUser(ctx context.Context, arg UpdateDatabaseServiceNameByIDAndUserParams) error
 	UpdateDatabaseServicePlanByIDAndUser(ctx context.Context, arg UpdateDatabaseServicePlanByIDAndUserParams) error
 	UpdateProjectByID(ctx context.Context, arg UpdateProjectByIDParams) (int64, error)
+	UpdateUserTemplate(ctx context.Context, arg UpdateUserTemplateParams) (int64, error)
 	UpsertEnvironmentVariable(ctx context.Context, arg UpsertEnvironmentVariableParams) error
+	UpsertServiceTemplate(ctx context.Context, arg UpsertServiceTemplateParams) error
 }
 
 var _ Querier = (*Queries)(nil)

app/backend/internal/database/sqlcdb/templates.sql.go

@@ -8,8 +8,10 @@ package sqlcdb
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 
 	"github.com/google/uuid"
+	"github.com/sqlc-dev/pqtype"
 )
 
 const countServicesByProjectAndName = `-- name: CountServicesByProjectAndName :one
@@ -122,6 +124,69 @@ func (q *Queries) CreateServiceFromTemplate(ctx context.Context, arg CreateServi
 	return err
 }
 
+const createUserTemplate = `-- name: CreateUserTemplate :exec
+INSERT INTO service_templates (id, name, description, category, logo, config, variables, is_official, owner_id, is_public)
+VALUES (
+    $1,
+    $2,
+    $3,
+    $4,
+    $5,
+    $6,
+    $7,
+    false,
+    $8,
+    $9
+)
+`
+
+type CreateUserTemplateParams struct {
+	ID          string                `json:"id"`
+	Name        string                `json:"name"`
+	Description sql.NullString        `json:"description"`
+	Category    string                `json:"category"`
+	Logo        sql.NullString        `json:"logo"`
+	Config      json.RawMessage       `json:"config"`
+	Variables   pqtype.NullRawMessage `json:"variables"`
+	OwnerID     uuid.NullUUID         `json:"owner_id"`
+	IsPublic    bool                  `json:"is_public"`
+}
+
+func (q *Queries) CreateUserTemplate(ctx context.Context, arg CreateUserTemplateParams) error {
+	_, err := q.db.ExecContext(ctx, createUserTemplate,
+		arg.ID,
+		arg.Name,
+		arg.Description,
+		arg.Category,
+		arg.Logo,
+		arg.Config,
+		arg.Variables,
+		arg.OwnerID,
+		arg.IsPublic,
+	)
+	return err
+}
+
+const deleteUserTemplate = `-- name: DeleteUserTemplate :execrows
+DELETE FROM service_templates
+WHERE id = $1
+  AND owner_id = $2
+  AND is_official = false
+`
+
+type DeleteUserTemplateParams struct {
+	ID      string        `json:"id"`
+	OwnerID uuid.NullUUID `json:"owner_id"`
+}
+
+func (q *Queries) DeleteUserTemplate(ctx context.Context, arg DeleteUserTemplateParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, deleteUserTemplate, arg.ID, arg.OwnerID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
 const getProjectOwnerID = `-- name: GetProjectOwnerID :one
 SELECT owner_id
 FROM projects
@@ -136,7 +201,7 @@ func (q *Queries) GetProjectOwnerID(ctx context.Context, id uuid.UUID) (uuid.UUI
 }
 
 const getServiceTemplateByID = `-- name: GetServiceTemplateByID :one
-SELECT id, name, description, category, logo, config, variables, is_official, created_at, updated_at
+SELECT id, name, description, category, logo, config, variables, is_official, owner_id, is_public, created_at, updated_at
 FROM service_templates
 WHERE id = $1
 `
@@ -153,20 +218,29 @@ func (q *Queries) GetServiceTemplateByID(ctx context.Context, id string) (Servic
 		&i.Config,
 		&i.Variables,
 		&i.IsOfficial,
+		&i.OwnerID,
+		&i.IsPublic,
 		&i.CreatedAt,
 		&i.UpdatedAt,
 	)
 	return i, err
 }
 
-const listServiceTemplates = `-- name: ListServiceTemplates :many
-SELECT id, name, description, category, logo, config, variables, is_official, created_at, updated_at
+const listServiceTemplatesByCategoryForUser = `-- name: ListServiceTemplatesByCategoryForUser :many
+SELECT id, name, description, category, logo, config, variables, is_official, owner_id, is_public, created_at, updated_at
 FROM service_templates
+WHERE category = $1
+  AND (is_official = true OR is_public = true OR owner_id = $2)
 ORDER BY is_official DESC, name ASC
 `
 
-func (q *Queries) ListServiceTemplates(ctx context.Context) ([]ServiceTemplate, error) {
-	rows, err := q.db.QueryContext(ctx, listServiceTemplates)
+type ListServiceTemplatesByCategoryForUserParams struct {
+	Category string        `json:"category"`
+	OwnerID  uuid.NullUUID `json:"owner_id"`
+}
+
+func (q *Queries) ListServiceTemplatesByCategoryForUser(ctx context.Context, arg ListServiceTemplatesByCategoryForUserParams) ([]ServiceTemplate, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceTemplatesByCategoryForUser, arg.Category, arg.OwnerID)
 	if err != nil {
 		return nil, err
 	}
@@ -183,6 +257,8 @@ func (q *Queries) ListServiceTemplates(ctx context.Context) ([]ServiceTemplate,
 			&i.Config,
 			&i.Variables,
 			&i.IsOfficial,
+			&i.OwnerID,
+			&i.IsPublic,
 			&i.CreatedAt,
 			&i.UpdatedAt,
 		); err != nil {
@@ -199,15 +275,15 @@ func (q *Queries) ListServiceTemplates(ctx context.Context) ([]ServiceTemplate,
 	return items, nil
 }
 
-const listServiceTemplatesByCategory = `-- name: ListServiceTemplatesByCategory :many
-SELECT id, name, description, category, logo, config, variables, is_official, created_at, updated_at
+const listServiceTemplatesForUser = `-- name: ListServiceTemplatesForUser :many
+SELECT id, name, description, category, logo, config, variables, is_official, owner_id, is_public, created_at, updated_at
 FROM service_templates
-WHERE category = $1
+WHERE is_official = true OR is_public = true OR owner_id = $1
 ORDER BY is_official DESC, name ASC
 `
 
-func (q *Queries) ListServiceTemplatesByCategory(ctx context.Context, category string) ([]ServiceTemplate, error) {
-	rows, err := q.db.QueryContext(ctx, listServiceTemplatesByCategory, category)
+func (q *Queries) ListServiceTemplatesForUser(ctx context.Context, ownerID uuid.NullUUID) ([]ServiceTemplate, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceTemplatesForUser, ownerID)
 	if err != nil {
 		return nil, err
 	}
@@ -224,6 +300,8 @@ func (q *Queries) ListServiceTemplatesByCategory(ctx context.Context, category s
 			&i.Config,
 			&i.Variables,
 			&i.IsOfficial,
+			&i.OwnerID,
+			&i.IsPublic,
 			&i.CreatedAt,
 			&i.UpdatedAt,
 		); err != nil {
@@ -240,6 +318,51 @@ func (q *Queries) ListServiceTemplatesByCategory(ctx context.Context, category s
 	return items, nil
 }
 
+const updateUserTemplate = `-- name: UpdateUserTemplate :execrows
+UPDATE service_templates
+SET name = $1,
+    description = $2,
+    category = $3,
+    logo = $4,
+    config = $5,
+    variables = $6,
+    is_public = $7,
+    updated_at = NOW()
+WHERE id = $8
+  AND owner_id = $9
+  AND is_official = false
+`
+
+type UpdateUserTemplateParams struct {
+	Name        string                `json:"name"`
+	Description sql.NullString        `json:"description"`
+	Category    string                `json:"category"`
+	Logo        sql.NullString        `json:"logo"`
+	Config      json.RawMessage       `json:"config"`
+	Variables   pqtype.NullRawMessage `json:"variables"`
+	IsPublic    bool                  `json:"is_public"`
+	ID          string                `json:"id"`
+	OwnerID     uuid.NullUUID         `json:"owner_id"`
+}
+
+func (q *Queries) UpdateUserTemplate(ctx context.Context, arg UpdateUserTemplateParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, updateUserTemplate,
+		arg.Name,
+		arg.Description,
+		arg.Category,
+		arg.Logo,
+		arg.Config,
+		arg.Variables,
+		arg.IsPublic,
+		arg.ID,
+		arg.OwnerID,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
 const upsertEnvironmentVariable = `-- name: UpsertEnvironmentVariable :exec
 INSERT INTO environment_variables (id, service_id, key, value, is_secret, created_at, updated_at)
 VALUES ($1, $2, $3, $4, $5, $6, $7)
@@ -271,3 +394,51 @@ func (q *Queries) UpsertEnvironmentVariable(ctx context.Context, arg UpsertEnvir
 	)
 	return err
 }
+
+const upsertServiceTemplate = `-- name: UpsertServiceTemplate :exec
+INSERT INTO service_templates (id, name, description, category, logo, config, variables, is_official)
+VALUES (
+    $1,
+    $2,
+    $3,
+    $4,
+    $5,
+    $6,
+    $7,
+    $8
+)
+ON CONFLICT (id) DO UPDATE
+SET name = EXCLUDED.name,
+    description = EXCLUDED.description,
+    category = EXCLUDED.category,
+    logo = EXCLUDED.logo,
+    config = EXCLUDED.config,
+    variables = EXCLUDED.variables,
+    is_official = EXCLUDED.is_official,
+    updated_at = NOW()
+`
+
+type UpsertServiceTemplateParams struct {
+	ID          string                `json:"id"`
+	Name        string                `json:"name"`
+	Description sql.NullString        `json:"description"`
+	Category    string                `json:"category"`
+	Logo        sql.NullString        `json:"logo"`
+	Config      json.RawMessage       `json:"config"`
+	Variables   pqtype.NullRawMessage `json:"variables"`
+	IsOfficial  sql.NullBool          `json:"is_official"`
+}
+
+func (q *Queries) UpsertServiceTemplate(ctx context.Context, arg UpsertServiceTemplateParams) error {
+	_, err := q.db.ExecContext(ctx, upsertServiceTemplate,
+		arg.ID,
+		arg.Name,
+		arg.Description,
+		arg.Category,
+		arg.Logo,
+		arg.Config,
+		arg.Variables,
+		arg.IsOfficial,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/user_tokens.sql.go

@@ -0,0 +1,147 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: user_tokens.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const createUserToken = `-- name: CreateUserToken :one
+INSERT INTO user_tokens (user_id, name, key_prefix, token_hash, scope, expires_at)
+VALUES ($1, $2, $3, $4, $5, $6)
+RETURNING id, user_id, name, key_prefix, token_hash, scope, expires_at, last_used_at, revoked_at, created_at
+`
+
+type CreateUserTokenParams struct {
+	UserID    uuid.UUID    `json:"user_id"`
+	Name      string       `json:"name"`
+	KeyPrefix string       `json:"key_prefix"`
+	TokenHash string       `json:"token_hash"`
+	Scope     string       `json:"scope"`
+	ExpiresAt sql.NullTime `json:"expires_at"`
+}
+
+func (q *Queries) CreateUserToken(ctx context.Context, arg CreateUserTokenParams) (UserToken, error) {
+	row := q.db.QueryRowContext(ctx, createUserToken,
+		arg.UserID,
+		arg.Name,
+		arg.KeyPrefix,
+		arg.TokenHash,
+		arg.Scope,
+		arg.ExpiresAt,
+	)
+	var i UserToken
+	err := row.Scan(
+		&i.ID,
+		&i.UserID,
+		&i.Name,
+		&i.KeyPrefix,
+		&i.TokenHash,
+		&i.Scope,
+		&i.ExpiresAt,
+		&i.LastUsedAt,
+		&i.RevokedAt,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const getUserTokenByHash = `-- name: GetUserTokenByHash :one
+SELECT id, user_id, name, key_prefix, token_hash, scope, expires_at, last_used_at, revoked_at, created_at FROM user_tokens
+WHERE token_hash = $1
+  AND revoked_at IS NULL
+  AND (expires_at IS NULL OR expires_at > NOW())
+LIMIT 1
+`
+
+func (q *Queries) GetUserTokenByHash(ctx context.Context, tokenHash string) (UserToken, error) {
+	row := q.db.QueryRowContext(ctx, getUserTokenByHash, tokenHash)
+	var i UserToken
+	err := row.Scan(
+		&i.ID,
+		&i.UserID,
+		&i.Name,
+		&i.KeyPrefix,
+		&i.TokenHash,
+		&i.Scope,
+		&i.ExpiresAt,
+		&i.LastUsedAt,
+		&i.RevokedAt,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const listUserTokens = `-- name: ListUserTokens :many
+SELECT id, user_id, name, key_prefix, token_hash, scope, expires_at, last_used_at, revoked_at, created_at FROM user_tokens
+WHERE user_id = $1 AND revoked_at IS NULL
+ORDER BY created_at DESC
+`
+
+func (q *Queries) ListUserTokens(ctx context.Context, userID uuid.UUID) ([]UserToken, error) {
+	rows, err := q.db.QueryContext(ctx, listUserTokens, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []UserToken{}
+	for rows.Next() {
+		var i UserToken
+		if err := rows.Scan(
+			&i.ID,
+			&i.UserID,
+			&i.Name,
+			&i.KeyPrefix,
+			&i.TokenHash,
+			&i.Scope,
+			&i.ExpiresAt,
+			&i.LastUsedAt,
+			&i.RevokedAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const revokeUserToken = `-- name: RevokeUserToken :execrows
+UPDATE user_tokens SET revoked_at = NOW()
+WHERE id = $1 AND user_id = $2 AND revoked_at IS NULL
+`
+
+type RevokeUserTokenParams struct {
+	ID     uuid.UUID `json:"id"`
+	UserID uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) RevokeUserToken(ctx context.Context, arg RevokeUserTokenParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, revokeUserToken, arg.ID, arg.UserID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const touchUserToken = `-- name: TouchUserToken :exec
+UPDATE user_tokens SET last_used_at = NOW()
+WHERE id = $1 AND revoked_at IS NULL
+`
+
+func (q *Queries) TouchUserToken(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, touchUserToken, id)
+	return err
+}

app/backend/internal/deployment/engine.go

@@ -9,10 +9,6 @@ import (
 	"containr/internal/build"
 	"containr/internal/docker"
 	"containr/internal/types"
-
-	"github.com/docker/docker/api/types/mount"
-	"github.com/docker/docker/api/types/network"
-	"github.com/docker/go-connections/nat"
 )
 
 type DeploymentEngine struct {
@@ -56,6 +52,21 @@ type ServiceConfig struct {
 	Resources     ResourceLimits    `json:"resources,omitempty"`
 	HealthCheck   *HealthCheck      `json:"health_check,omitempty"`
 	Replicas      int               `json:"replicas"`
+	// PublicPort is the container port exposed to users (published host port,
+	// or Traefik routing when Domain is set). 0 = internal-only service.
+	PublicPort int32 `json:"public_port,omitempty"`
+	// Domain is a public hostname routed to PublicPort via Traefik.
+	Domain string `json:"domain,omitempty"`
+	// Domains is the full hostname set (includes Domain when set).
+	Domains        []string `json:"domains,omitempty"`
+	Maintenance    bool     `json:"maintenance,omitempty"`
+	MaintenanceURL string   `json:"maintenance_url,omitempty"`
+	BasicAuthUsers string   `json:"basic_auth_users,omitempty"`
+	// HealthPath is an HTTP path probed on PublicPort for container health.
+	HealthPath string `json:"health_path,omitempty"`
+	// PublishedPort is the host port bound by the previous deployment; replica 0
+	// reuses it so public URLs survive restarts. 0 = pick ephemeral.
+	PublishedPort int32 `json:"published_port,omitempty"`
 }
 
 type PortMapping struct {
@@ -73,10 +84,11 @@ type VolumeMount struct {
 }
 
 type ResourceLimits struct {
-	MemoryBytes int64 `json:"memory_bytes,omitempty"`
-	CPUQuota    int64 `json:"cpu_quota,omitempty"`
-	CPUPeriod   int64 `json:"cpu_period,omitempty"`
-	CPUShares   int64 `json:"cpu_shares,omitempty"`
+	MemoryBytes       int64 `json:"memory_bytes,omitempty"`
+	MemoryReservation int64 `json:"memory_reservation,omitempty"`
+	CPUQuota          int64 `json:"cpu_quota,omitempty"`
+	CPUPeriod         int64 `json:"cpu_period,omitempty"`
+	CPUShares         int64 `json:"cpu_shares,omitempty"`
 }
 
 type HealthCheck struct {
@@ -141,9 +153,11 @@ type BuildConfig struct {
 	PrebuiltImage string            `json:"prebuilt_image"`
 	BuildCommand  string            `json:"build_command"`
 	StartCommand  string            `json:"start_command"`
+	BuildArgs     map[string]string `json:"build_args,omitempty"`
 	Environment   map[string]string `json:"environment"`
 	Branch        string            `json:"branch"`
 	Commit        string            `json:"commit"`
+	NoCache       bool              `json:"no_cache"`
 }
 
 type TriggerConfig struct {
@@ -154,6 +168,12 @@ type TriggerConfig struct {
 	Timestamp time.Time         `json:"timestamp"` // When trigger occurred
 }
 
+// DockerClient exposes the engine's docker handle for read-only queries
+// (capacity checks, image info).
+func (de *DeploymentEngine) DockerClient() *docker.Client {
+	return de.dockerClient
+}
+
 func NewDeploymentEngine(buildManager *build.BuildManager, dockerClient *docker.Client) *DeploymentEngine {
 	return &DeploymentEngine{
 		buildManager:  buildManager,
@@ -278,6 +298,7 @@ func (de *DeploymentEngine) buildImage(ctx context.Context, deployment *Deployme
 		ImageTag:      deployment.ID,
 		BuildCommand:  buildConfig.BuildCommand,
 		StartCommand:  buildConfig.StartCommand,
+		BuildArgs:     buildConfig.BuildArgs,
 		Environment:   buildConfig.Environment,
 		ProjectID:     deployment.ProjectID,
 		ServiceID:     deployment.ServiceID,
@@ -285,6 +306,7 @@ func (de *DeploymentEngine) buildImage(ctx context.Context, deployment *Deployme
 		TriggeredBy:   "deployment_engine",
 		Branch:        buildConfig.Branch,
 		Commit:        buildConfig.Commit,
+		NoCache:       buildConfig.NoCache,
 	}
 
 	response, err := de.buildManager.Build(ctx, buildReq)
@@ -297,91 +319,59 @@ func (de *DeploymentEngine) buildImage(ctx context.Context, deployment *Deployme
 	return response.ImageName, nil
 }
 
-// deployService deploys the service using the built image
+// deployService deploys the service using the built image. Containers are
+// reconciled onto the project network with a DNS alias per service name —
+// other services reach it at http://<name>:<port>.
 func (de *DeploymentEngine) deployService(ctx context.Context, deployment *Deployment) error {
-	// Convert service config to Docker container config
-	containerConfig := &docker.ContainerConfig{
-		Name:     fmt.Sprintf("containr-%s-%s", deployment.ServiceID, deployment.ID),
-		Image:    deployment.ImageName,
-		Cmd:      deployment.Config.Command,
-		Labels:   deployment.Config.Labels,
-		Networks: make(map[string]*network.EndpointSettings),
+	cfg := deployment.Config
+
+	spec := RuntimeSpec{
+		ProjectID:      deployment.ProjectID,
+		ServiceID:      deployment.ServiceID,
+		Name:           cfg.Name,
+		Image:          deployment.ImageName,
+		Command:        cfg.Command,
+		Env:            cfg.Environment,
+		Replicas:       cfg.Replicas,
+		Port:           cfg.PublicPort,
+		PublishedPort:  cfg.PublishedPort,
+		Domain:         cfg.Domain,
+		HealthPath:     cfg.HealthPath,
+		RestartPolicy:  cfg.RestartPolicy,
+		MemoryBytes:    cfg.Resources.MemoryBytes,
+		MemoryReserve:  cfg.Resources.MemoryReservation,
+		NanoCPUs:       cfg.Resources.CPUQuota,
+		CPUShares:      cfg.Resources.CPUShares,
+		Volumes:        cfg.VolumeMounts,
+		Domains:        cfg.Domains,
+		Maintenance:    cfg.Maintenance,
+		MaintenanceURL: cfg.MaintenanceURL,
+		BasicAuthUsers: cfg.BasicAuthUsers,
 	}
-
-	// Set environment variables
-	for k, v := range deployment.Config.Environment {
-		containerConfig.Env = append(containerConfig.Env, fmt.Sprintf("%s=%s", k, v))
-	}
-
-	// Set restart policy
-	containerConfig.RestartPolicy = deployment.Config.RestartPolicy
-
-	// Configure port mappings
-	portBindings := make(nat.PortMap)
-	for _, pm := range deployment.Config.PortMappings {
-		port := nat.Port(fmt.Sprintf("%d/%s", pm.ContainerPort, pm.Protocol))
-		if pm.HostPort > 0 {
-			portBindings[port] = []nat.PortBinding{
-				{
-					HostIP:   pm.HostIP,
-					HostPort: fmt.Sprintf("%d", pm.HostPort),
-				},
-			}
+	for _, pm := range cfg.PortMappings {
+		if spec.Port == 0 {
+			spec.Port = pm.ContainerPort
 		}
 	}
-	containerConfig.PortBindings = portBindings
-
-	// Configure resource limits
-	if deployment.Config.Resources.MemoryBytes > 0 {
-		containerConfig.Memory = deployment.Config.Resources.MemoryBytes
-	}
-	if deployment.Config.Resources.CPUQuota > 0 {
-		containerConfig.NanoCPUs = deployment.Config.Resources.CPUQuota
+	if spec.RestartPolicy == "" {
+		spec.RestartPolicy = "unless-stopped"
 	}
 
-	// Configure volume mounts
-	for _, vm := range deployment.Config.VolumeMounts {
-		mount := mount.Mount{
-			Type:     mount.Type(vm.Type),
-			Source:   vm.Source,
-			Target:   vm.Destination,
-			ReadOnly: vm.ReadOnly,
-		}
-		containerConfig.Mounts = append(containerConfig.Mounts, mount)
+	state, err := de.ReconcileService(ctx, spec)
+	if err != nil {
+		return err
 	}
 
-	// Create containers based on replica count
-	deployment.Containers = make([]ContainerInfo, deployment.Config.Replicas)
-	for i := 0; i < deployment.Config.Replicas; i++ {
-		containerName := fmt.Sprintf("%s-%d", containerConfig.Name, i)
-
-		// Create container
-		containerID, err := de.dockerClient.CreateContainer(ctx, *containerConfig)
-		if err != nil {
-			return fmt.Errorf("failed to create container %d: %w", i, err)
-		}
-
-		// Start container
-		err = de.dockerClient.StartContainer(ctx, containerID)
-		if err != nil {
-			return fmt.Errorf("failed to start container %d: %w", i, err)
-		}
-
-		// Get container info
-		_, err = de.dockerClient.GetContainer(ctx, containerID)
-		if err != nil {
-			log.Printf("Failed to get container info for %s: %v", containerID, err)
-		}
-
+	deployment.Containers = make([]ContainerInfo, len(state.Containers))
+	for i, c := range state.Containers {
 		deployment.Containers[i] = ContainerInfo{
-			ID:        containerID,
-			Name:      containerName,
-			Status:    "running",
+			ID:        c.ID,
+			Name:      c.Name,
+			Status:    c.State,
 			CreatedAt: time.Now(),
 			StartedAt: time.Now(),
 		}
 	}
-
 	return nil
 }
 

app/backend/internal/deployment/runtime.go

@@ -0,0 +1,544 @@
+package deployment
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"containr/internal/docker"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/network"
+	"github.com/docker/go-connections/nat"
+)
+
+// Container labels used to associate runtime containers with services.
+const (
+	LabelManaged    = "containr.managed"
+	LabelProject    = "containr.project"
+	LabelService    = "containr.service"
+	LabelReplica    = "containr.replica"
+	LabelSpecHash   = "containr.spec-hash"
+	LabelDeployment = "containr.deployment"
+)
+
+// RuntimeSpec is everything needed to run a service's containers.
+type RuntimeSpec struct {
+	ProjectID      string
+	ServiceID      string
+	Name           string // DNS alias on the project network
+	Image          string
+	Command        []string
+	Env            map[string]string // already resolved
+	Replicas       int
+	Port           int32  // container port to expose publicly; 0 = none
+	PublishedPort  int32  // preferred host port for replica 0; 0 = pick ephemeral
+	Domain         string // public hostname routed via Traefik; empty = none
+	HealthPath     string // http path probed on Port for container healthcheck
+	RestartPolicy  string
+	MemoryBytes    int64
+	MemoryReserve  int64 // soft reservation; scheduler hint, not a hard cap
+	NanoCPUs       int64
+	CPUShares      int64         // relative weight (1024 ≈ 1 cpu), not a cap
+	Volumes        []VolumeMount // applied to every replica
+	Domains        []string      // all public hostnames; Domain is the default
+	Maintenance    bool          // redirect traffic to MaintenanceURL
+	MaintenanceURL string        // absolute URL; empty = serve empty response
+	BasicAuthUsers string        // htpasswd-format user:hash pairs, comma-separated
+}
+
+// RuntimeContainer describes one live replica.
+type RuntimeContainer struct {
+	ID      string `json:"id"`
+	Name    string `json:"name"`
+	State   string `json:"state"` // running, exited, ...
+	Replica int    `json:"replica"`
+}
+
+// RuntimeState is the live view of a service's containers.
+type RuntimeState struct {
+	Desired    int                `json:"desired"`
+	Containers []RuntimeContainer `json:"containers"`
+	URLs       []string           `json:"urls"`
+	Ports      []uint16           `json:"ports"`
+	Health     string             `json:"health,omitempty"` // healthy, unhealthy, unreachable
+	Status     string             `json:"status"`           // running, degraded, stopped
+}
+
+// ProjectNetworkName is the deterministic docker network every service in a
+// project joins — containr-proj-<first 12 hex chars of the project uuid>.
+func ProjectNetworkName(projectID string) string {
+	short := strings.ReplaceAll(projectID, "-", "")
+	if len(short) > 12 {
+		short = short[:12]
+	}
+	return "containr-proj-" + short
+}
+
+func serviceNamePrefix(serviceID string) string {
+	return fmt.Sprintf("containr-%s-", serviceID)
+}
+
+// EnsureProjectNetwork creates the per-project bridge network if missing.
+// Containers on it resolve each other by service name (private networking).
+func (de *DeploymentEngine) EnsureProjectNetwork(ctx context.Context, projectID string) (string, error) {
+	name := ProjectNetworkName(projectID)
+
+	networks, err := de.dockerClient.ListNetworks(ctx)
+	if err != nil {
+		return "", err
+	}
+	for _, n := range networks {
+		if n.Name == name {
+			return name, nil
+		}
+	}
+
+	_, err = de.dockerClient.CreateNetwork(ctx, docker.NetworkConfig{
+		Name:   name,
+		Driver: "bridge",
+		Labels: map[string]string{
+			LabelManaged: "true",
+			LabelProject: projectID,
+		},
+	})
+	if err != nil {
+		// Concurrent reconciles race on create; re-resolve before failing.
+		networks, lerr := de.dockerClient.ListNetworks(ctx)
+		if lerr == nil {
+			for _, n := range networks {
+				if n.Name == name {
+					return name, nil
+				}
+			}
+		}
+		return "", fmt.Errorf("create project network: %w", err)
+	}
+	return name, nil
+}
+
+// traefikNetworkName finds the shared edge network (the infra stack's
+// containr-network where Traefik listens) if it exists.
+func (de *DeploymentEngine) traefikNetworkName(ctx context.Context) string {
+	networks, err := de.dockerClient.ListNetworks(ctx)
+	if err != nil {
+		return ""
+	}
+	for _, n := range networks {
+		if n.Name == "containr-network" {
+			return n.Name
+		}
+	}
+	return ""
+}
+
+// ListServiceContainers returns containers managed for a service.
+func (de *DeploymentEngine) ListServiceContainers(ctx context.Context, serviceID string) ([]container.Summary, error) {
+	return de.dockerClient.ListContainersFiltered(ctx, filters.NewArgs(
+		filters.Arg("label", LabelService+"="+serviceID),
+	), true)
+}
+
+// ReconcileService brings live containers in line with the spec. When the
+// spec hash changed (image/env/ports/etc.) all replicas are recreated;
+// otherwise only the replica delta is applied.
+func (de *DeploymentEngine) ReconcileService(ctx context.Context, spec RuntimeSpec) (*RuntimeState, error) {
+	if spec.Replicas < 1 {
+		spec.Replicas = 1
+	}
+
+	networkName, err := de.EnsureProjectNetwork(ctx, spec.ProjectID)
+	if err != nil {
+		return nil, err
+	}
+
+	edgeNetwork := ""
+	if spec.Domain != "" {
+		edgeNetwork = de.traefikNetworkName(ctx)
+	}
+
+	hash := specHash(spec)
+	existing, err := de.ListServiceContainers(ctx, spec.ServiceID)
+	if err != nil {
+		return nil, err
+	}
+	// Deterministic order: scale-down removes the highest replica indices.
+	sort.Slice(existing, func(i, j int) bool {
+		return replicaIndex(existing[i]) < replicaIndex(existing[j])
+	})
+
+	drifted := false
+	for _, c := range existing {
+		if c.Labels[LabelSpecHash] != hash {
+			drifted = true
+			break
+		}
+	}
+
+	if drifted {
+		for _, c := range existing {
+			_ = de.dockerClient.RemoveContainer(ctx, c.ID, true)
+		}
+		existing = nil
+	}
+
+	for i := len(existing); i > spec.Replicas; i-- {
+		victim := existing[i-1]
+		_ = de.dockerClient.StopContainer(ctx, victim.ID, nil)
+		_ = de.dockerClient.RemoveContainer(ctx, victim.ID, true)
+		existing = existing[:i-1]
+	}
+
+	for i := len(existing); i < spec.Replicas; i++ {
+		if _, err := de.createReplica(ctx, spec, networkName, edgeNetwork, i, hash); err != nil {
+			return nil, fmt.Errorf("create replica %d: %w", i, err)
+		}
+	}
+
+	for _, c := range existing {
+		if c.State != "running" {
+			_ = de.dockerClient.StartContainer(ctx, c.ID)
+		}
+	}
+
+	return de.RuntimeState(ctx, spec.ServiceID, spec.Replicas)
+}
+
+func (de *DeploymentEngine) createReplica(ctx context.Context, spec RuntimeSpec, projectNet, edgeNet string, index int, hash string) (string, error) {
+	env := make([]string, 0, len(spec.Env))
+	for k, v := range spec.Env {
+		env = append(env, k+"="+v)
+	}
+	sort.Strings(env)
+
+	labels := map[string]string{
+		LabelManaged:  "true",
+		LabelProject:  spec.ProjectID,
+		LabelService:  spec.ServiceID,
+		LabelReplica:  fmt.Sprintf("%d", index),
+		LabelSpecHash: hash,
+	}
+
+	endpoints := map[string]*network.EndpointSettings{
+		projectNet: {Aliases: []string{spec.Name}},
+	}
+	if edgeNet != "" {
+		router := "svc-" + spec.ServiceID[:8]
+		domains := spec.Domains
+		if len(domains) == 0 && spec.Domain != "" {
+			domains = []string{spec.Domain}
+		}
+		sort.Strings(domains)
+		rules := make([]string, 0, len(domains))
+		for _, d := range domains {
+			rules = append(rules, "Host(`"+d+"`)")
+		}
+		endpoints[edgeNet] = &network.EndpointSettings{}
+		labels["traefik.enable"] = "true"
+		labels["traefik.docker.network"] = edgeNet
+		labels["traefik.http.routers."+router+".rule"] = strings.Join(rules, " || ")
+		labels["traefik.http.routers."+router+".entrypoints"] = "web"
+		labels["traefik.http.services."+router+".loadbalancer.server.port"] = fmt.Sprintf("%d", spec.Port)
+
+		var middlewares []string
+		if spec.Maintenance {
+			if spec.MaintenanceURL != "" {
+				mw := router + "-maint"
+				labels["traefik.http.middlewares."+mw+".redirectregex.regex"] = "^https?://[^/]+/.*"
+				labels["traefik.http.middlewares."+mw+".redirectregex.replacement"] = spec.MaintenanceURL
+				labels["traefik.http.middlewares."+mw+".redirectregex.permanent"] = "false"
+				middlewares = append(middlewares, mw)
+			} else {
+				// No redirect target configured — take the site offline with
+				// empty responses instead of leaking traffic to the app.
+				labels["traefik.http.routers."+router+".service"] = "noop@internal"
+			}
+		}
+		if spec.BasicAuthUsers != "" {
+			mw := router + "-auth"
+			labels["traefik.http.middlewares."+mw+".basicauth.users"] = spec.BasicAuthUsers
+			middlewares = append(middlewares, mw)
+		}
+		if len(middlewares) > 0 {
+			labels["traefik.http.routers."+router+".middlewares"] = strings.Join(middlewares, ",")
+		}
+	}
+
+	cfg := docker.ContainerConfig{
+		Name:              fmt.Sprintf("%s%d", serviceNamePrefix(spec.ServiceID), index),
+		Image:             spec.Image,
+		Cmd:               spec.Command,
+		Env:               env,
+		Labels:            labels,
+		RestartPolicy:     spec.RestartPolicy,
+		Memory:            spec.MemoryBytes,
+		MemoryReservation: spec.MemoryReserve,
+		NanoCPUs:          spec.NanoCPUs,
+		CPUShares:         spec.CPUShares,
+		Networks:          endpoints,
+	}
+
+	for _, v := range spec.Volumes {
+		mountType := mount.TypeVolume
+		if v.Type == "bind" {
+			mountType = mount.TypeBind
+		}
+		cfg.Mounts = append(cfg.Mounts, mount.Mount{
+			Type:     mountType,
+			Source:   v.Source,
+			Target:   v.Destination,
+			ReadOnly: v.ReadOnly,
+		})
+	}
+
+	var wantPort nat.Port
+	if spec.Port > 0 {
+		wantPort = nat.Port(fmt.Sprintf("%d/tcp", spec.Port))
+		cfg.ExposedPorts = nat.PortSet{wantPort: struct{}{}}
+	}
+
+	// tryBind creates and starts a container publishing wantPort on hostPort
+	// ("" = ephemeral). A requested port is verified after start: Docker
+	// Desktop accepts a conflicting binding at create/start but publishes
+	// nothing, which would leave the service running with no endpoint.
+	tryBind := func(hostPort string) (string, error) {
+		if spec.Port > 0 {
+			cfg.PortBindings = nat.PortMap{wantPort: []nat.PortBinding{{HostIP: "0.0.0.0", HostPort: hostPort}}}
+		}
+		id, err := de.dockerClient.CreateContainer(ctx, cfg)
+		if err != nil {
+			return "", err
+		}
+		if err := de.dockerClient.StartContainer(ctx, id); err != nil {
+			_ = de.dockerClient.RemoveContainer(ctx, id, true)
+			return "", fmt.Errorf("start: %w", err)
+		}
+		if hostPort != "" {
+			info, err := de.dockerClient.GetContainer(ctx, id)
+			if err != nil {
+				_ = de.dockerClient.RemoveContainer(ctx, id, true)
+				return "", fmt.Errorf("inspect: %w", err)
+			}
+			if info.NetworkSettings == nil || len(info.NetworkSettings.Ports[wantPort]) == 0 {
+				_ = de.dockerClient.RemoveContainer(ctx, id, true)
+				return "", errPortNotBound
+			}
+		}
+		return id, nil
+	}
+
+	preferred := ""
+	if index == 0 && spec.PublishedPort > 0 {
+		preferred = strconv.Itoa(int(spec.PublishedPort))
+	}
+	id, err := tryBind(preferred)
+	if err != nil && preferred != "" && (isPortConflict(err) || errors.Is(err, errPortNotBound)) {
+		// Stored port got taken since last deploy — fall back to ephemeral; the
+		// new assignment is persisted on the next runtime read.
+		id, err = tryBind("")
+	}
+	if err != nil {
+		return "", err
+	}
+	return id, nil
+}
+
+// errPortNotBound marks a container that started but failed to publish the
+// requested host port (seen on Docker Desktop, which reports success while
+// vpnkit drops a conflicting binding).
+var errPortNotBound = errors.New("requested host port not bound")
+
+// isPortConflict reports whether a container create failed because the
+// requested host port was already bound.
+func isPortConflict(err error) bool {
+	msg := strings.ToLower(err.Error())
+	return strings.Contains(msg, "port is already allocated") ||
+		strings.Contains(msg, "address already in use") ||
+		strings.Contains(msg, "cannot assign requested address")
+}
+
+// RuntimeState reads live container state for a service.
+func (de *DeploymentEngine) RuntimeState(ctx context.Context, serviceID string, desired int) (*RuntimeState, error) {
+	containers, err := de.ListServiceContainers(ctx, serviceID)
+	if err != nil {
+		return nil, err
+	}
+
+	state := &RuntimeState{Desired: desired, Status: "stopped"}
+	running := 0
+	for _, c := range containers {
+		rc := RuntimeContainer{ID: c.ID, Name: strings.TrimPrefix(c.Names[0], "/"), State: c.State, Replica: replicaIndex(c)}
+		state.Containers = append(state.Containers, rc)
+		if c.State == "running" {
+			running++
+		}
+		for _, p := range c.Ports {
+			if p.PublicPort != 0 {
+				state.URLs = append(state.URLs, fmt.Sprintf("http://localhost:%d", p.PublicPort))
+				state.Ports = append(state.Ports, p.PublicPort)
+			}
+		}
+	}
+	sort.Slice(state.Containers, func(i, j int) bool { return state.Containers[i].Replica < state.Containers[j].Replica })
+	sort.Strings(state.URLs)
+
+	switch {
+	case running == 0:
+		state.Status = "stopped"
+	case running < desired:
+		state.Status = "degraded"
+	default:
+		state.Status = "running"
+	}
+	return state, nil
+}
+
+// ProbeServiceHealth performs an HTTP GET on healthPath and records the
+// outcome on state.Health. When the backend runs containerized it first
+// attaches to the service's project network and probes the service by DNS
+// name — this works for every image (no shell or wget required inside the
+// container) and checks the service itself, not the published edge. A
+// host-run backend falls back to probing the published host port.
+func (de *DeploymentEngine) ProbeServiceHealth(ctx context.Context, state *RuntimeState, projectID, serviceName string, port int, healthPath string) {
+	if state == nil {
+		return
+	}
+	state.Health = ""
+	if healthPath == "" || port <= 0 {
+		return
+	}
+	if !strings.HasPrefix(healthPath, "/") {
+		healthPath = "/" + healthPath
+	}
+
+	probeURL := ""
+	if networkName := ProjectNetworkName(projectID); networkName != "" {
+		if err := de.dockerClient.ConnectSelfToNetwork(ctx, networkName); err == nil {
+			probeURL = fmt.Sprintf("http://%s:%d%s", serviceName, port, healthPath)
+		}
+	}
+	if probeURL == "" && len(state.Ports) > 0 {
+		probeURL = fmt.Sprintf("http://%s:%d%s", de.dockerClient.HostProbeHost(ctx), state.Ports[0], healthPath)
+	}
+	if probeURL == "" {
+		return
+	}
+
+	reqCtx, cancel := context.WithTimeout(ctx, 3*time.Second)
+	defer cancel()
+	req, err := http.NewRequestWithContext(reqCtx, http.MethodGet, probeURL, nil)
+	if err != nil {
+		state.Health = "unreachable"
+		return
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		state.Health = "unreachable"
+		return
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 200 && resp.StatusCode < 400 {
+		state.Health = "healthy"
+		return
+	}
+	state.Health = "unhealthy"
+}
+
+// StopService stops (but keeps) all replicas of a service.
+func (de *DeploymentEngine) StopService(ctx context.Context, serviceID string) error {
+	containers, err := de.ListServiceContainers(ctx, serviceID)
+	if err != nil {
+		return err
+	}
+	for _, c := range containers {
+		if c.State == "running" {
+			if err := de.dockerClient.StopContainer(ctx, c.ID, nil); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// StartService starts all stopped replicas.
+func (de *DeploymentEngine) StartService(ctx context.Context, serviceID string) error {
+	containers, err := de.ListServiceContainers(ctx, serviceID)
+	if err != nil {
+		return err
+	}
+	for _, c := range containers {
+		if c.State != "running" {
+			if err := de.dockerClient.StartContainer(ctx, c.ID); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// RemoveServiceContainers deletes every replica of a service.
+func (de *DeploymentEngine) RemoveServiceContainers(ctx context.Context, serviceID string) error {
+	containers, err := de.ListServiceContainers(ctx, serviceID)
+	if err != nil {
+		return err
+	}
+	for _, c := range containers {
+		_ = de.dockerClient.RemoveContainer(ctx, c.ID, true)
+	}
+	return nil
+}
+
+// RemoveProjectContainers deletes every managed container in a project.
+func (de *DeploymentEngine) RemoveProjectContainers(ctx context.Context, projectID string) error {
+	containers, err := de.dockerClient.ListContainersFiltered(ctx, filters.NewArgs(
+		filters.Arg("label", LabelProject+"="+projectID),
+	), true)
+	if err != nil {
+		return err
+	}
+	for _, c := range containers {
+		_ = de.dockerClient.RemoveContainer(ctx, c.ID, true)
+	}
+	return nil
+}
+
+// RemoveProjectNetwork removes the per-project bridge network if present.
+func (de *DeploymentEngine) RemoveProjectNetwork(ctx context.Context, projectID string) error {
+	return de.dockerClient.RemoveNetwork(ctx, ProjectNetworkName(projectID))
+}
+
+func replicaIndex(c container.Summary) int {
+	replica := 0
+	fmt.Sscanf(c.Labels[LabelReplica], "%d", &replica)
+	return replica
+}
+
+func specHash(spec RuntimeSpec) string {
+	payload, _ := json.Marshal(struct {
+		Image, Name, Domain, HealthPath, RestartPolicy string
+		Command                                        []string
+		Env                                            map[string]string
+		Port                                           int32
+		MemoryBytes, NanoCPUs                          int64
+		MemoryReserve, CPUShares                       int64
+		Volumes                                        []VolumeMount
+		Domains                                        []string
+		Maintenance                                    bool
+		BasicAuth                                      string
+	}{spec.Image, spec.Name, spec.Domain, spec.HealthPath, spec.RestartPolicy,
+		spec.Command, spec.Env, spec.Port, spec.MemoryBytes, spec.NanoCPUs,
+		spec.MemoryReserve, spec.CPUShares, spec.Volumes,
+		spec.Domains, spec.Maintenance, spec.BasicAuthUsers})
+	sum := sha256.Sum256(payload)
+	return hex.EncodeToString(sum[:8])
+}

app/backend/internal/deployqueue/queue.go

@@ -0,0 +1,146 @@
+package deployqueue
+
+import (
+	"context"
+	"sync"
+
+	"github.com/google/uuid"
+)
+
+// Job is a unit of serialized deployment work. DeploymentID is the
+// deployments row it mirrors (uuid.Nil for runtime ops with no row).
+// Run is invoked with a cancellable context — cancelled by Cancel for
+// active jobs, or the job is dropped before starting when queued.
+type Job struct {
+	DeploymentID uuid.UUID
+	Run          func(ctx context.Context)
+}
+
+// Queue serializes deploy work per service: one active job, the rest FIFO.
+// A build for service A never races a redeploy or second build of A, while
+// services B, C proceed in parallel. Not a global worker pool — per-service
+// serialization is what prevents container thrash.
+type Queue struct {
+	mu      sync.Mutex
+	states  map[uuid.UUID]*serviceState
+	cancels map[uuid.UUID]context.CancelFunc
+}
+
+type serviceState struct {
+	running bool
+	pending []Job
+}
+
+func New() *Queue {
+	return &Queue{
+		states:  make(map[uuid.UUID]*serviceState),
+		cancels: make(map[uuid.UUID]context.CancelFunc),
+	}
+}
+
+// Enqueue schedules a job. Returns the position: 0 means it starts
+// immediately, >0 means that many jobs run first.
+func (q *Queue) Enqueue(serviceID uuid.UUID, job Job) int {
+	q.mu.Lock()
+	st := q.states[serviceID]
+	if st == nil {
+		st = &serviceState{}
+		q.states[serviceID] = st
+	}
+	if st.running {
+		st.pending = append(st.pending, job)
+		pos := len(st.pending)
+		q.mu.Unlock()
+		return pos
+	}
+	st.running = true
+	q.mu.Unlock()
+
+	q.start(serviceID, job)
+	return 0
+}
+
+func (q *Queue) start(serviceID uuid.UUID, job Job) {
+	ctx, cancel := context.WithCancel(context.Background())
+	if job.DeploymentID != uuid.Nil {
+		q.mu.Lock()
+		q.cancels[job.DeploymentID] = cancel
+		q.mu.Unlock()
+	}
+
+	go func() {
+		defer func() {
+			if job.DeploymentID != uuid.Nil {
+				q.mu.Lock()
+				delete(q.cancels, job.DeploymentID)
+				q.mu.Unlock()
+			}
+			cancel()
+			q.promote(serviceID)
+		}()
+		job.Run(ctx)
+	}()
+}
+
+// promote marks the service free and starts the next queued job, if any.
+func (q *Queue) promote(serviceID uuid.UUID) {
+	q.mu.Lock()
+	st := q.states[serviceID]
+	if st == nil || len(st.pending) == 0 {
+		if st != nil {
+			st.running = false
+		}
+		q.mu.Unlock()
+		return
+	}
+	next := st.pending[0]
+	st.pending = st.pending[1:]
+	q.mu.Unlock()
+	q.start(serviceID, next)
+}
+
+// CancelState distinguishes what Cancel found.
+type CancelState int
+
+const (
+	NotFound  CancelState = iota
+	WasQueued             // removed before it started — caller marks DB cancelled
+	WasActive             // ctx cancelled — the running job marks DB itself
+)
+
+// Cancel cancels a job by its deployment row id.
+func (q *Queue) Cancel(serviceID, deploymentID uuid.UUID) CancelState {
+	q.mu.Lock()
+	if st := q.states[serviceID]; st != nil {
+		for i, j := range st.pending {
+			if j.DeploymentID == deploymentID {
+				st.pending = append(st.pending[:i], st.pending[i+1:]...)
+				q.mu.Unlock()
+				return WasQueued
+			}
+		}
+	}
+	cancel, ok := q.cancels[deploymentID]
+	q.mu.Unlock()
+	if ok {
+		cancel()
+		return WasActive
+	}
+	return NotFound
+}
+
+// Do runs fn through the queue and waits for completion — for synchronous
+// endpoints (redeploy) that still must not overlap an in-flight deployment.
+// ctx bounds the wait, not the job; on timeout the job still runs to
+// completion to avoid orphaned reconcile state.
+func (q *Queue) Do(ctx context.Context, serviceID uuid.UUID, fn func(ctx context.Context)) {
+	done := make(chan struct{})
+	q.Enqueue(serviceID, Job{Run: func(jctx context.Context) {
+		defer close(done)
+		fn(jctx)
+	}})
+	select {
+	case <-done:
+	case <-ctx.Done():
+	}
+}

app/backend/internal/deployqueue/queue_test.go

@@ -0,0 +1,142 @@
+package deployqueue
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+func TestSerializesPerService(t *testing.T) {
+	q := New()
+	svc := uuid.New()
+
+	var active, maxActive int32
+	finish := make(chan struct{})
+	for i := 0; i < 3; i++ {
+		q.Enqueue(svc, Job{Run: func(ctx context.Context) {
+			if n := atomic.AddInt32(&active, 1); n > atomic.LoadInt32(&maxActive) {
+				atomic.StoreInt32(&maxActive, n)
+			}
+			<-finish // hold until released
+			atomic.AddInt32(&active, -1)
+		}})
+	}
+
+	deadline := time.After(2 * time.Second)
+	for atomic.LoadInt32(&active) < 1 {
+		select {
+		case <-deadline:
+			t.Fatal("first job never started")
+		default:
+			time.Sleep(time.Millisecond)
+		}
+	}
+	close(finish)
+	deadline = time.After(2 * time.Second)
+	for atomic.LoadInt32(&active) > 0 {
+		select {
+		case <-deadline:
+			t.Fatal("jobs did not drain")
+		default:
+			time.Sleep(time.Millisecond)
+		}
+	}
+	if got := atomic.LoadInt32(&maxActive); got != 1 {
+		t.Fatalf("expected max concurrency 1, got %d", got)
+	}
+}
+
+func TestDifferentServicesRunInParallel(t *testing.T) {
+	q := New()
+	started := make(chan struct{}, 2)
+	release := make(chan struct{})
+	for i := 0; i < 2; i++ {
+		q.Enqueue(uuid.New(), Job{Run: func(ctx context.Context) {
+			started <- struct{}{}
+			<-release
+		}})
+	}
+	for i := 0; i < 2; i++ {
+		select {
+		case <-started:
+		case <-time.After(2 * time.Second):
+			t.Fatal("parallel services did not both start")
+		}
+	}
+	close(release)
+}
+
+func TestCancelQueuedRemovesJob(t *testing.T) {
+	q := New()
+	svc := uuid.New()
+	release := make(chan struct{})
+	q.Enqueue(svc, Job{DeploymentID: uuid.New(), Run: func(ctx context.Context) { <-release }})
+
+	queuedID := uuid.New()
+	ran := make(chan struct{})
+	q.Enqueue(svc, Job{DeploymentID: queuedID, Run: func(ctx context.Context) { close(ran) }})
+
+	if got := q.Cancel(svc, queuedID); got != WasQueued {
+		t.Fatalf("expected WasQueued, got %v", got)
+	}
+	close(release)
+	select {
+	case <-ran:
+		t.Fatal("cancelled queued job still ran")
+	case <-time.After(200 * time.Millisecond):
+	}
+}
+
+func TestCancelActiveCancelsContext(t *testing.T) {
+	q := New()
+	svc := uuid.New()
+	id := uuid.New()
+	ctxDone := make(chan struct{})
+	q.Enqueue(svc, Job{DeploymentID: id, Run: func(ctx context.Context) {
+		<-ctx.Done()
+		close(ctxDone)
+	}})
+
+	deadline := time.After(2 * time.Second)
+	for {
+		q.mu.Lock()
+		_, ok := q.cancels[id]
+		q.mu.Unlock()
+		if ok {
+			break
+		}
+		select {
+		case <-deadline:
+			t.Fatal("job never registered")
+		default:
+			time.Sleep(time.Millisecond)
+		}
+	}
+	if got := q.Cancel(svc, id); got != WasActive {
+		t.Fatalf("expected WasActive, got %v", got)
+	}
+	select {
+	case <-ctxDone:
+	case <-time.After(2 * time.Second):
+		t.Fatal("active job context not cancelled")
+	}
+}
+
+func TestEnqueuePosition(t *testing.T) {
+	q := New()
+	svc := uuid.New()
+	release := make(chan struct{})
+	if pos := q.Enqueue(svc, Job{Run: func(ctx context.Context) { <-release }}); pos != 0 {
+		t.Fatalf("first job position = %d, want 0", pos)
+	}
+	if pos := q.Enqueue(svc, Job{Run: func(ctx context.Context) {}}); pos != 1 {
+		t.Fatalf("second job position = %d, want 1", pos)
+	}
+	if pos := q.Enqueue(svc, Job{Run: func(ctx context.Context) {}}); pos != 2 {
+		t.Fatalf("third job position = %d, want 2", pos)
+	}
+	close(release)
+}

app/backend/internal/docker/client.go

@@ -3,13 +3,18 @@ package docker
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"fmt"
 	"io"
+	"os"
+	"sort"
+	"strings"
 	"time"
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/events"
+	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/api/types/registry"
@@ -21,7 +26,8 @@ import (
 
 // Client wraps the Docker client with additional functionality
 type Client struct {
-	cli *client.Client
+	cli       *client.Client
+	probeHost string
 }
 
 // NewClient creates a new Docker client
@@ -43,6 +49,75 @@ func NewClient() (*Client, error) {
 	return &Client{cli: cli}, nil
 }
 
+// HostProbeHost returns an address through which host-published container
+// ports are reachable. When this process runs inside a container, host
+// loopback is unreachable; the bridge gateway IP routes to ports published
+// on 0.0.0.0. Result is cached for the process lifetime.
+func (c *Client) HostProbeHost(ctx context.Context) string {
+	if c.probeHost != "" {
+		return c.probeHost
+	}
+	host := "127.0.0.1"
+	if self, err := c.self(ctx); err == nil && self.NetworkSettings != nil {
+		for _, n := range self.NetworkSettings.Networks {
+			if n != nil && n.Gateway != "" {
+				host = n.Gateway
+				break
+			}
+		}
+	}
+	c.probeHost = host
+	return host
+}
+
+// OwnNetworkName returns the name of the platform network this process's
+// container is attached to, or "" when not running containerized. Per-project
+// and default Docker networks are never selected; among remaining networks
+// the lexicographically first wins so the choice is deterministic.
+func (c *Client) OwnNetworkName(ctx context.Context) string {
+	self, err := c.self(ctx)
+	if err != nil || self.NetworkSettings == nil {
+		return ""
+	}
+	names := make([]string, 0, len(self.NetworkSettings.Networks))
+	for name := range self.NetworkSettings.Networks {
+		switch {
+		case name == "bridge" || name == "host" || name == "none":
+		case strings.HasPrefix(name, "containr-proj-"):
+		default:
+			names = append(names, name)
+		}
+	}
+	sort.Strings(names)
+	if len(names) == 0 {
+		return ""
+	}
+	return names[0]
+}
+
+// self inspects the container this process runs in (hostname == container ID).
+func (c *Client) self(ctx context.Context) (types.ContainerJSON, error) {
+	hostname, err := os.Hostname()
+	if err != nil || hostname == "" {
+		return types.ContainerJSON{}, fmt.Errorf("hostname unavailable")
+	}
+	return c.cli.ContainerInspect(ctx, hostname)
+}
+
+// ConnectSelfToNetwork attaches this process's container to the given network.
+// No-op when already attached or when not running containerized.
+func (c *Client) ConnectSelfToNetwork(ctx context.Context, networkName string) error {
+	hostname, err := os.Hostname()
+	if err != nil || hostname == "" {
+		return fmt.Errorf("hostname unavailable")
+	}
+	err = c.cli.NetworkConnect(ctx, networkName, hostname, &network.EndpointSettings{})
+	if err != nil && strings.Contains(strings.ToLower(err.Error()), "already exists") {
+		return nil
+	}
+	return err
+}
+
 // ListContainers returns all containers
 func (c *Client) ListContainers(ctx context.Context, all bool) ([]types.Container, error) {
 	return c.cli.ContainerList(ctx, container.ListOptions{
@@ -50,6 +125,14 @@ func (c *Client) ListContainers(ctx context.Context, all bool) ([]types.Containe
 	})
 }
 
+// ListContainersFiltered returns containers matching the given filters.
+func (c *Client) ListContainersFiltered(ctx context.Context, f filters.Args, all bool) ([]types.Container, error) {
+	return c.cli.ContainerList(ctx, container.ListOptions{
+		All:     all,
+		Filters: f,
+	})
+}
+
 // GetContainer returns detailed information about a specific container
 func (c *Client) GetContainer(ctx context.Context, containerID string) (types.ContainerJSON, error) {
 	return c.cli.ContainerInspect(ctx, containerID)
@@ -63,6 +146,7 @@ func (c *Client) CreateContainer(ctx context.Context, config ContainerConfig) (s
 		Env:          config.Env,
 		Labels:       config.Labels,
 		ExposedPorts: config.ExposedPorts,
+		Healthcheck:  config.Healthcheck,
 	}
 
 	hostConfig := &container.HostConfig{
@@ -72,8 +156,10 @@ func (c *Client) CreateContainer(ctx context.Context, config ContainerConfig) (s
 		PortBindings: config.PortBindings,
 		Mounts:       config.Mounts,
 		Resources: container.Resources{
-			Memory:   config.Memory,
-			NanoCPUs: config.NanoCPUs,
+			Memory:            config.Memory,
+			MemoryReservation: config.MemoryReservation,
+			NanoCPUs:          config.NanoCPUs,
+			CPUShares:         config.CPUShares,
 		},
 		NetworkMode: container.NetworkMode(config.NetworkMode),
 	}
@@ -168,7 +254,9 @@ func (c *Client) ListImages(ctx context.Context, all bool) ([]image.Summary, err
 	})
 }
 
-// PullImage pulls an image from a registry
+// PullImage pulls an image from a registry. The pull runs as the returned
+// stream is consumed — callers must drain and close it (or use
+// PullImageWait) or the pull may be aborted.
 func (c *Client) PullImage(ctx context.Context, ref string, auth registry.AuthConfig) (io.ReadCloser, error) {
 	authStr, _ := registry.EncodeAuthConfig(auth)
 	return c.cli.ImagePull(ctx, ref, image.PullOptions{
@@ -176,15 +264,71 @@ func (c *Client) PullImage(ctx context.Context, ref string, auth registry.AuthCo
 	})
 }
 
+// PullImageWait pulls an image and blocks until the pull stream completes.
+func (c *Client) PullImageWait(ctx context.Context, ref string, auth registry.AuthConfig) error {
+	reader, err := c.PullImage(ctx, ref, auth)
+	if err != nil {
+		return err
+	}
+	defer reader.Close()
+	// The daemon performs the pull while streaming progress; drain it fully
+	// and surface any errorDetail the daemon reports in the stream.
+	dec := json.NewDecoder(reader)
+	var msg struct {
+		ErrorDetail *struct {
+			Message string `json:"message"`
+		} `json:"errorDetail"`
+		Error string `json:"error"`
+	}
+	for dec.Decode(&msg) == nil {
+		if msg.ErrorDetail != nil {
+			return fmt.Errorf("%s", msg.ErrorDetail.Message)
+		}
+		if msg.Error != "" {
+			return fmt.Errorf("%s", msg.Error)
+		}
+	}
+	return nil
+}
+
 // BuildImage builds an image from a Dockerfile
 func (c *Client) BuildImage(ctx context.Context, buildContext io.Reader, options BuildOptions) (types.ImageBuildResponse, error) {
-	return c.cli.ImageBuild(ctx, buildContext, types.ImageBuildOptions{
+	resp, err := c.cli.ImageBuild(ctx, buildContext, types.ImageBuildOptions{
 		Dockerfile: options.Dockerfile,
 		Tags:       options.Tags,
 		BuildArgs:  options.BuildArgs,
 		Labels:     options.Labels,
 		Remove:     options.Remove,
+		NoCache:    options.NoCache,
 	})
+	if err != nil {
+		return resp, err
+	}
+	// The daemon aborts the build if the response stream isn't consumed,
+	// and reports failures only inside that stream.
+	defer resp.Body.Close()
+	var buildErr string
+	dec := json.NewDecoder(resp.Body)
+	for {
+		var line struct {
+			ErrorDetail struct {
+				Message string `json:"message"`
+			} `json:"errorDetail"`
+			Error string `json:"error"`
+		}
+		if err := dec.Decode(&line); err != nil {
+			break
+		}
+		if line.ErrorDetail.Message != "" {
+			buildErr = line.ErrorDetail.Message
+		} else if line.Error != "" {
+			buildErr = line.Error
+		}
+	}
+	if buildErr != "" {
+		return resp, fmt.Errorf("docker build failed: %s", buildErr)
+	}
+	return resp, nil
 }
 
 // RemoveImage removes an image

app/backend/internal/docker/types.go

@@ -3,6 +3,7 @@ package docker
 import (
 	"time"
 
+	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/filters"
 	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
@@ -11,19 +12,22 @@ import (
 
 // ContainerConfig represents the configuration for creating a container
 type ContainerConfig struct {
-	Name          string
-	Image         string
-	Cmd           []string
-	Env           []string
-	Labels        map[string]string
-	RestartPolicy string
-	ExposedPorts  nat.PortSet
-	PortBindings  nat.PortMap
-	Mounts        []mount.Mount
-	Memory        int64
-	NanoCPUs      int64
-	NetworkMode   string
-	Networks      map[string]*network.EndpointSettings
+	Name              string
+	Image             string
+	Cmd               []string
+	Env               []string
+	Labels            map[string]string
+	RestartPolicy     string
+	ExposedPorts      nat.PortSet
+	PortBindings      nat.PortMap
+	Mounts            []mount.Mount
+	Memory            int64
+	MemoryReservation int64
+	NanoCPUs          int64
+	CPUShares         int64
+	NetworkMode       string
+	Networks          map[string]*network.EndpointSettings
+	Healthcheck       *container.HealthConfig
 }
 
 // LogOptions represents options for retrieving container logs
@@ -42,6 +46,7 @@ type BuildOptions struct {
 	BuildArgs  map[string]*string
 	Labels     map[string]string
 	Remove     bool
+	NoCache    bool
 }
 
 // NetworkConfig represents the configuration for creating a network

app/backend/internal/ha/manager.go

@@ -3,6 +3,7 @@ package ha
 import (
 	"bytes"
 	"context"
+	"database/sql"
 	"encoding/json"
 	"fmt"
 	"log"
@@ -75,11 +76,13 @@ type HealthCheckConfig struct {
 
 // HealthChecker performs health checks on services and nodes
 type HealthChecker struct {
-	scheduler     *deployment.Scheduler
-	checks        map[string]*HealthCheck
-	results       map[string]*HealthCheckResult
-	mu            sync.RWMutex
-	checkInterval time.Duration
+	scheduler        *deployment.Scheduler
+	checks           map[string]*HealthCheck
+	results          map[string]*HealthCheckResult
+	mu               sync.RWMutex
+	checkInterval    time.Duration
+	serviceResolver  func(ctx context.Context, serviceID string) (host string, port int, err error)
+	db               *sql.DB
 }
 
 // HealthCheck represents a health check configuration
@@ -596,7 +599,11 @@ func (hc *HealthChecker) performHealthChecks(ctx context.Context) error {
 		result := hc.performHealthCheck(ctx, check)
 		hc.mu.Lock()
 		hc.results[check.ID] = result
+		check.Status = result.Status
+		check.LastCheck = result.Timestamp
 		hc.mu.Unlock()
+		// Persist last-known state so a restart resumes with honest history.
+		hc.persistCheck(check)
 	}
 
 	return nil
@@ -617,12 +624,20 @@ func (hc *HealthChecker) performHealthCheck(ctx context.Context, check *HealthCh
 	checkCtx, cancel := context.WithTimeout(ctx, timeout)
 	defer cancel()
 
-	var err error
+	host, port, err := hc.resolveTarget(ctx, check)
+	if err != nil {
+		result.Status = HealthStatusUnhealthy
+		result.Message = err.Error()
+		result.ErrorCode = "TARGET_UNRESOLVED"
+		result.Latency = time.Since(start)
+		return result
+	}
+
 	switch check.Type {
 	case HealthCheckTypeHTTP:
-		err = hc.performHTTPCheck(checkCtx, check)
+		err = hc.performHTTPCheck(checkCtx, check, host, port)
 	case HealthCheckTypeTCP:
-		err = hc.performTCPCheck(checkCtx, check)
+		err = hc.performTCPCheck(checkCtx, check, host, port)
 	case HealthCheckTypeCommand:
 		err = hc.performCommandCheck(checkCtx, check)
 	default:
@@ -642,13 +657,11 @@ func (hc *HealthChecker) performHealthCheck(ctx context.Context, check *HealthCh
 	return result
 }
 
-func (hc *HealthChecker) performHTTPCheck(ctx context.Context, check *HealthCheck) error {
-	host := hc.resolveHealthCheckHost(check)
+func (hc *HealthChecker) performHTTPCheck(ctx context.Context, check *HealthCheck, host string, port int) error {
 	protocol := strings.ToLower(strings.TrimSpace(check.Config.Protocol))
 	if protocol == "" {
 		protocol = "http"
 	}
-	port := check.Config.Port
 	if port <= 0 {
 		if protocol == "https" {
 			port = 443
@@ -684,9 +697,7 @@ func (hc *HealthChecker) performHTTPCheck(ctx context.Context, check *HealthChec
 	return nil
 }
 
-func (hc *HealthChecker) performTCPCheck(ctx context.Context, check *HealthCheck) error {
-	host := hc.resolveHealthCheckHost(check)
-	port := check.Config.Port
+func (hc *HealthChecker) performTCPCheck(ctx context.Context, check *HealthCheck, host string, port int) error {
 	if port <= 0 {
 		port = 80
 	}
@@ -723,6 +734,27 @@ func (hc *HealthChecker) performCommandCheck(ctx context.Context, check *HealthC
 	return nil
 }
 
+// WithServiceResolver lets the API layer plug in service-aware targeting: a
+// ServiceID-bound check resolves to the service's DNS name on its project
+// network instead of the backend container's loopback, where dialing
+// 127.0.0.1:<host port> can never succeed.
+func (m *HighAvailabilityManager) WithServiceResolver(fn func(ctx context.Context, serviceID string) (host string, port int, err error)) *HighAvailabilityManager {
+	m.healthChecker.serviceResolver = fn
+	return m
+}
+
+// WithPersistence attaches Postgres so configured checks survive restarts.
+// Call LoadHealthChecks once during startup to hydrate state.
+func (m *HighAvailabilityManager) WithPersistence(db *sql.DB) *HighAvailabilityManager {
+	m.healthChecker.db = db
+	return m
+}
+
+// LoadHealthChecks hydrates persisted health checks during startup.
+func (m *HighAvailabilityManager) LoadHealthChecks(ctx context.Context) error {
+	return m.healthChecker.LoadHealthChecks(ctx)
+}
+
 func (hc *HealthChecker) resolveHealthCheckHost(check *HealthCheck) string {
 	if strings.TrimSpace(check.NodeID) != "" && hc.scheduler != nil {
 		nodes := hc.scheduler.GetNodes()
@@ -739,19 +771,109 @@ func (hc *HealthChecker) resolveHealthCheckHost(check *HealthCheck) string {
 	return "127.0.0.1"
 }
 
+// resolveTarget picks the dial target for a check: service-bound checks go to
+// the service DNS name on the project network; node-bound and free-standing
+// checks keep the old host behavior. A service-bound resolver failure is
+// surfaced as an error — falling back to loopback would only produce a
+// misleading "service down" result.
+func (hc *HealthChecker) resolveTarget(ctx context.Context, check *HealthCheck) (string, int, error) {
+	port := check.Config.Port
+	if strings.TrimSpace(check.NodeID) == "" && check.ServiceID != "" && hc.serviceResolver != nil {
+		resolveCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+		defer cancel()
+		h, p, err := hc.serviceResolver(resolveCtx, check.ServiceID)
+		if err != nil {
+			return "", 0, fmt.Errorf("resolve service target: %w", err)
+		}
+		if h == "" {
+			return "", 0, fmt.Errorf("resolve service target: service %s not found", check.ServiceID)
+		}
+		if port <= 0 {
+			port = p
+		}
+		return h, port, nil
+	}
+	return hc.resolveHealthCheckHost(check), port, nil
+}
+
 // AddHealthCheck adds a new health check
 func (hc *HealthChecker) AddHealthCheck(check *HealthCheck) {
 	hc.mu.Lock()
-	defer hc.mu.Unlock()
 	hc.checks[check.ID] = check
+	hc.mu.Unlock()
+	hc.persistCheck(check)
 }
 
 // RemoveHealthCheck removes a health check
 func (hc *HealthChecker) RemoveHealthCheck(checkID string) {
 	hc.mu.Lock()
-	defer hc.mu.Unlock()
 	delete(hc.checks, checkID)
 	delete(hc.results, checkID)
+	hc.mu.Unlock()
+	if hc.db != nil {
+		_, _ = hc.db.ExecContext(context.Background(), `DELETE FROM ha_health_checks WHERE id = $1`, checkID)
+	}
+}
+
+// persistCheck upserts one check. Best effort — a write failure never blocks
+// the in-memory path, matching the scaling-policy persistence style.
+func (hc *HealthChecker) persistCheck(check *HealthCheck) {
+	if hc.db == nil {
+		return
+	}
+	cfg, _ := json.Marshal(check.Config)
+	var lastCheck interface{}
+	if !check.LastCheck.IsZero() {
+		lastCheck = check.LastCheck
+	}
+	_, _ = hc.db.ExecContext(context.Background(),
+		`INSERT INTO ha_health_checks (id, service_id, node_id, type, config, status, last_check, updated_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, $7, now())
+		 ON CONFLICT (id) DO UPDATE
+		 SET service_id = EXCLUDED.service_id, node_id = EXCLUDED.node_id,
+		     type = EXCLUDED.type, config = EXCLUDED.config,
+		     status = EXCLUDED.status, last_check = EXCLUDED.last_check,
+		     updated_at = now()`,
+		check.ID, check.ServiceID, check.NodeID, string(check.Type), cfg, string(check.Status), lastCheck,
+	)
+}
+
+// LoadHealthChecks hydrates checks persisted across restarts.
+func (hc *HealthChecker) LoadHealthChecks(ctx context.Context) error {
+	if hc.db == nil {
+		return nil
+	}
+	rows, err := hc.db.QueryContext(ctx,
+		`SELECT id, service_id, node_id, type, config, status, last_check FROM ha_health_checks`)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+
+	loaded := 0
+	for rows.Next() {
+		var check HealthCheck
+		var cfg []byte
+		var status, checkType string
+		var lastCheck sql.NullTime
+		if err := rows.Scan(&check.ID, &check.ServiceID, &check.NodeID, &checkType, &cfg, &status, &lastCheck); err != nil {
+			continue
+		}
+		check.Type = HealthCheckType(checkType)
+		check.Status = HealthStatus(status)
+		if lastCheck.Valid {
+			check.LastCheck = lastCheck.Time
+		}
+		_ = json.Unmarshal(cfg, &check.Config)
+		hc.mu.Lock()
+		hc.checks[check.ID] = &check
+		hc.mu.Unlock()
+		loaded++
+	}
+	if loaded > 0 {
+		log.Printf("Restored %d health checks", loaded)
+	}
+	return rows.Err()
 }
 
 // GetHealthCheck returns one configured health check.

app/backend/internal/mcpserver/server.go

@@ -0,0 +1,291 @@
+// Package mcpserver exposes the Containr API as MCP tools over stdio.
+// It reuses the CLI's thin client — same PAT auth, same endpoints —
+// so agents reach everything the UI and CLI do.
+package mcpserver
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"containr/internal/cli/commands"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+
+// spec describes one MCP tool as an HTTP call. {placeholder} segments in
+// Path are filled from arguments; remaining string/number/bool args become
+// the JSON body for POST/PUT/PATCH.
+type spec struct {
+	name        string
+	description string
+	method      string
+	path        string
+	// params are the arguments that fill path placeholders (required).
+	params []string
+	// bodyKeys restrict which args go into the request body; when empty all
+	// non-param args are sent.
+	bodyKeys []string
+	// destructive tools refuse unless args["confirm"] == true.
+	destructive bool
+}
+
+var tools []spec
+
+func register(s spec) { tools = append(tools, s) }
+
+func init() {
+	register(spec{"containr_auth_status", "Show which profile/token is active and the authenticated identity", "GET", "/user/profile", nil, nil, false})
+
+	// Personal access tokens
+	register(spec{"containr_tokens_list", "List personal access tokens (metadata only, never values)", "GET", "/user/tokens", nil, nil, false})
+	register(spec{"containr_tokens_create", "Create a personal access token. Args: name (required), scope (read|write|admin, default write), expires_in_days (0=never). Returns the raw token once.", "POST", "/user/tokens", nil, []string{"name", "scope", "expires_in_days"}, false})
+	register(spec{"containr_tokens_revoke", "Revoke a personal access token by id. Requires confirm:true.", "DELETE", "/user/tokens/{id}", []string{"id"}, nil, true})
+
+	// Projects
+	register(spec{"containr_projects_list", "List projects", "GET", "/projects", nil, nil, false})
+	register(spec{"containr_projects_get", "Get a project by id", "GET", "/projects/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_projects_create", "Create a project. Args: name (required), description.", "POST", "/projects", nil, []string{"name", "description"}, false})
+	register(spec{"containr_projects_delete", "Delete a project and all its services. Requires confirm:true.", "DELETE", "/projects/{id}", []string{"id"}, nil, true})
+
+	// Services
+	register(spec{"containr_services_list", "List services in a project", "GET", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
+	register(spec{"containr_services_get", "Get a service by id", "GET", "/services/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_services_create", "Create a service in a project. Args: name (required), type, image, git_repo, git_branch, environment, port, domain, replicas, volumes = [{type: volume|bind, source, target, read_only}], builder = auto|railpack|nixpacks|dockerfile|static, cpu, memory, cpu_reserve, memory_reserve, static_build_cmd, static_dir.", "POST", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
+	register(spec{"containr_services_delete", "Delete a service. Requires confirm:true.", "DELETE", "/services/{id}", []string{"id"}, nil, true})
+	register(spec{"containr_services_start", "Start a service", "POST", "/services/{id}/start", []string{"id"}, nil, false})
+	register(spec{"containr_services_stop", "Stop a service", "POST", "/services/{id}/stop", []string{"id"}, nil, false})
+	register(spec{"containr_services_restart", "Restart a service", "POST", "/services/{id}/restart", []string{"id"}, nil, false})
+	register(spec{"containr_services_redeploy", "Rebuild and redeploy a service", "POST", "/services/{id}/redeploy", []string{"id"}, nil, false})
+	register(spec{"containr_services_logs", "Get service runtime logs. Args: id, tail (default 100).", "GET", "/services/{id}/logs", []string{"id"}, nil, false})
+	register(spec{"containr_services_exec", "Run a one-off command in the service container (30s ceiling). Args: id, command (required).", "POST", "/services/{id}/exec", []string{"id"}, []string{"command"}, false})
+	register(spec{"containr_services_update", "Update a service. Args: id, name, image, command, domain, restart_policy, healthcheck_path, cpu, memory, replicas, port, volumes = [{type: volume|bind, source, target, read_only}] — volumes replaces the whole mount list; pass [] to clear. maintenance_mode (bool), basic_auth = [{username, password}] — replaces all creds; [] clears. builder = auto|railpack|nixpacks|dockerfile|static, cpu_reserve, memory_reserve, static_build_cmd, static_dir (empty string clears reserves/static fields).", "PUT", "/services/{id}", []string{"id"}, nil, false})
+
+	// Domains
+	register(spec{"containr_domains_list", "List domains attached to a service", "GET", "/services/{id}/domains", []string{"id"}, nil, false})
+	register(spec{"containr_domains_add", "Attach a domain to a service. Args: id, domain (required), is_default.", "POST", "/services/{id}/domains", []string{"id"}, []string{"domain", "is_default"}, false})
+	register(spec{"containr_domains_remove", "Detach a domain. Args: id (service), domain_id.", "DELETE", "/services/{id}/domains/{domain_id}", []string{"id", "domain_id"}, nil, false})
+	register(spec{"containr_domains_default", "Set the default domain. Args: id (service), domain_id.", "POST", "/services/{id}/domains/{domain_id}/default", []string{"id", "domain_id"}, nil, false})
+	register(spec{"containr_domains_check", "DNS preflight for all service domains — returns ok|wrong-target|pending per domain", "GET", "/services/{id}/domains/check", []string{"id"}, nil, false})
+
+	// Docker volumes (admin)
+	register(spec{"containr_volumes_list", "List docker volumes on the node with in-use flags (admin)", "GET", "/admin/volumes", nil, nil, false})
+	register(spec{"containr_volumes_delete", "Delete an unused docker volume. Requires confirm:true. (admin)", "DELETE", "/admin/volumes/{name}", []string{"name"}, nil, true})
+
+	// Variables
+	register(spec{"containr_variables_list", "List service environment variables (secrets masked)", "GET", "/services/{id}/variables", []string{"id"}, nil, false})
+	register(spec{"containr_variables_set", "Replace all variables on a service. Args: id, variables = [{key, value, is_secret}], redeploy (queue a redeploy to apply). Fetch the current list first and merge — the server replaces wholesale.", "PUT", "/services/{id}/variables", []string{"id"}, []string{"variables", "redeploy"}, false})
+
+	// Deployments
+	register(spec{"containr_deploy", "Trigger a deployment for a service. Args: id (service), commit_hash, branch, no_cache.", "POST", "/services/{id}/deployments", []string{"id"}, []string{"commit_hash", "branch", "trigger", "no_cache"}, false})
+	register(spec{"containr_deployments_list", "List recent deployments across services", "GET", "/deployments", nil, nil, false})
+	register(spec{"containr_services_deployments", "List deployments for one service", "GET", "/services/{id}/deployments", []string{"id"}, nil, false})
+	register(spec{"containr_deployments_get", "Get a deployment", "GET", "/deployments/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_deployments_logs", "Get persisted build/runtime logs for a deployment. Args: id, type (all|build|runtime).", "GET", "/deployments/{id}/logs", []string{"id"}, nil, false})
+	register(spec{"containr_deployments_rollback", "Roll back to a deployment. Requires confirm:true.", "POST", "/deployments/{id}/rollback", []string{"id"}, nil, true})
+	register(spec{"containr_deployments_cancel", "Cancel a queued or running deployment", "POST", "/deployments/{id}/cancel", []string{"id"}, nil, false})
+
+	// Databases
+	register(spec{"containr_databases_list", "List managed databases", "GET", "/databases", nil, nil, false})
+	register(spec{"containr_databases_get", "Get a database (connection URL included)", "GET", "/databases/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_databases_create", "Provision a managed database. Args: name, type (postgres|mysql|mariadb|mongodb|redis|dragonfly|clickhouse).", "POST", "/databases", nil, nil, false})
+	register(spec{"containr_databases_action", "Start/stop/restart a database. Args: id, action.", "POST", "/databases/{id}/action", []string{"id"}, []string{"action"}, false})
+	register(spec{"containr_databases_backup", "Take a manual backup snapshot", "POST", "/databases/{id}/backup", []string{"id"}, nil, false})
+	register(spec{"containr_databases_restore", "Restore a database from a backup — overwrites current data. Requires confirm:true.", "POST", "/databases/{id}/restore", []string{"id"}, []string{"backup_id"}, true})
+	register(spec{"containr_databases_delete", "Delete a database and its data. Requires confirm:true.", "DELETE", "/databases/{id}", []string{"id"}, nil, true})
+
+	// Cron
+	register(spec{"containr_cron_list", "List cron jobs", "GET", "/cron-jobs", nil, nil, false})
+	register(spec{"containr_cron_create", "Create a cron job. Args: service_id, schedule (5-field), command, name, timezone.", "POST", "/cron-jobs", nil, nil, false})
+	register(spec{"containr_cron_trigger", "Run a cron job now", "POST", "/cron-jobs/{id}/trigger", []string{"id"}, nil, false})
+	register(spec{"containr_cron_executions", "List a cron job's execution history", "GET", "/cron-jobs/{id}/executions", []string{"id"}, nil, false})
+	register(spec{"containr_cron_delete", "Delete a cron job. Requires confirm:true.", "DELETE", "/cron-jobs/{id}", []string{"id"}, nil, true})
+
+	// Templates
+	register(spec{"containr_templates_list", "List templates", "GET", "/templates", nil, nil, false})
+	register(spec{"containr_templates_get", "Get a template definition", "GET", "/templates/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_templates_deploy", "Deploy a template into a project. Args: id (template), project_id.", "POST", "/templates/{id}/deploy", []string{"id"}, []string{"project_id"}, false})
+
+	// Notifications
+	register(spec{"containr_notifications_list", "List notifications", "GET", "/notifications", nil, nil, false})
+	register(spec{"containr_notifications_read", "Mark a notification read, or all notifications with id=all", "POST", "/notifications/{id}/read", []string{"id"}, nil, false})
+
+	// Nodes / agent tokens (admin)
+	register(spec{"containr_nodes_list", "List node agents (admin)", "GET", "/agents", nil, nil, false})
+	register(spec{"containr_nodes_get", "Get a node agent (admin)", "GET", "/agents/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_agent_tokens_issue", "Issue an agent onboarding token (admin). Args: label.", "POST", "/agent-tokens", nil, []string{"label"}, false})
+	register(spec{"containr_agent_tokens_list", "List agent onboarding tokens (admin)", "GET", "/agent-tokens", nil, nil, false})
+
+	// Scaling / HA / security
+	register(spec{"containr_scaling_status", "Autoscaler status", "GET", "/scaling/status", nil, nil, false})
+	register(spec{"containr_scaling_policies", "List scaling policies", "GET", "/scaling/policies", nil, nil, false})
+	register(spec{"containr_scaling_scale", "Manually scale a service. Args: service_id, replicas. (admin)", "POST", "/scaling/services/{service_id}/scale", []string{"service_id"}, []string{"replicas"}, false})
+	register(spec{"containr_ha_status", "HA manager status", "GET", "/ha/status", nil, nil, false})
+	register(spec{"containr_ha_alerts", "Active HA alerts", "GET", "/ha/alerts/active", nil, nil, false})
+	register(spec{"containr_ha_failover", "Trigger a manual failover — reschedules services. Requires confirm:true. (admin)", "POST", "/ha/failover", nil, nil, true})
+	register(spec{"containr_security_scan", "Run a security scan. Args: project_id (required), scan_type, service_id.", "POST", "/security/scans", nil, nil, false})
+	register(spec{"containr_security_vulnerabilities", "List a project's vulnerabilities", "GET", "/projects/{project_id}/vulnerabilities", []string{"project_id"}, nil, false})
+
+	// Admin
+	register(spec{"containr_admin_overview", "Platform overview (admin)", "GET", "/admin/overview", nil, nil, false})
+	register(spec{"containr_admin_users", "List all users (admin)", "GET", "/admin/users", nil, nil, false})
+	register(spec{"containr_admin_audit_logs", "List audit log entries (admin)", "GET", "/audit-logs", nil, nil, false})
+	register(spec{"containr_gateway_services", "List gateway services (admin)", "GET", "/gateway/services", nil, nil, false})
+	register(spec{"containr_gateway_keys", "List gateway API keys (admin)", "GET", "/gateway/keys", nil, nil, false})
+}
+
+// Run starts the stdio MCP server. apiURL/token come from env or config —
+// the caller resolves them before calling.
+func Run(ctx context.Context, apiURL, token, version string) error {
+	if token == "" {
+		return fmt.Errorf("CONTAINR_TOKEN is required (create a cnp_ token under Settings → Personal Access Tokens)")
+	}
+	client := &commands.Client{BaseURL: apiURL, Token: token}
+
+	server := mcp.NewServer(&mcp.Implementation{
+		Name:    "containr",
+		Version: version,
+	}, nil)
+
+	for _, s := range tools {
+		s := s
+		server.AddTool(&mcp.Tool{
+			Name:        s.name,
+			Description: s.description,
+			InputSchema: schemaFor(s),
+		}, func(ctx context.Context, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+			return call(ctx, client, s, req)
+		})
+	}
+
+	return server.Run(ctx, &mcp.StdioTransport{})
+}
+
+// schemaFor builds a JSON Schema for the tool's arguments: path params +
+// body keys + confirm for destructive tools. Properties accept any JSON
+// type — the API validates values.
+func schemaFor(s spec) map[string]interface{} {
+	props := map[string]interface{}{}
+	var required []string
+	for _, p := range s.params {
+		props[p] = map[string]interface{}{"type": "string", "description": "path parameter"}
+		required = append(required, p)
+	}
+	bodySrc := s.bodyKeys
+	if len(bodySrc) == 0 && s.method != "GET" && s.method != "DELETE" {
+		// Unrestricted body: advertise nothing, accept anything.
+	}
+	for _, k := range bodySrc {
+		props[k] = map[string]interface{}{"description": "request body field"}
+	}
+	if s.destructive {
+		props["confirm"] = map[string]interface{}{"type": "boolean", "description": "must be true — this operation is destructive"}
+		required = append(required, "confirm")
+	}
+	schema := map[string]interface{}{
+		"type":                 "object",
+		"properties":           props,
+		"additionalProperties": true,
+	}
+	if len(required) > 0 {
+		schema["required"] = required
+	}
+	return schema
+}
+
+func call(ctx context.Context, c *commands.Client, s spec, req *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	var args map[string]interface{}
+	if len(req.Params.Arguments) > 0 {
+		if err := json.Unmarshal(req.Params.Arguments, &args); err != nil {
+			return errorResult("invalid arguments: " + err.Error()), nil
+		}
+	}
+	if args == nil {
+		args = map[string]interface{}{}
+	}
+
+	if s.destructive && args["confirm"] != true {
+		return errorResult("destructive operation — pass confirm:true to proceed"), nil
+	}
+
+	path := s.path
+	for _, p := range s.params {
+		v, ok := args[p]
+		if !ok || fmt.Sprint(v) == "" {
+			return errorResult(fmt.Sprintf("missing required argument %q", p)), nil
+		}
+		path = strings.ReplaceAll(path, "{"+p+"}", fmt.Sprint(v))
+	}
+
+	var body interface{}
+	var query []string
+	for k, v := range args {
+		if k == "confirm" {
+			continue
+		}
+		inParams := false
+		for _, p := range s.params {
+			if k == p {
+				inParams = true
+				break
+			}
+		}
+		if inParams {
+			continue
+		}
+		if s.method == "GET" || s.method == "DELETE" {
+			// Non-path args on reads become query parameters.
+			query = append(query, url.QueryEscape(k)+"="+url.QueryEscape(fmt.Sprint(v)))
+			continue
+		}
+		if len(s.bodyKeys) > 0 {
+			allowed := false
+			for _, b := range s.bodyKeys {
+				if k == b {
+					allowed = true
+					break
+				}
+			}
+			if !allowed {
+				continue
+			}
+		}
+		if body == nil {
+			body = map[string]interface{}{}
+		}
+		body.(map[string]interface{})[k] = v
+	}
+	if len(query) > 0 {
+		sep := "?"
+		if strings.Contains(path, "?") {
+			sep = "&"
+		}
+		path += sep + strings.Join(query, "&")
+	}
+
+	data, err := c.Do(s.method, path, body)
+	if err != nil {
+		return errorResult(err.Error()), nil
+	}
+	return textResult(data), nil
+}
+
+func textResult(data []byte) *mcp.CallToolResult {
+	var v interface{}
+	if json.Unmarshal(data, &v) != nil {
+		v = string(data)
+	}
+	out, _ := json.MarshalIndent(v, "", "  ")
+	return &mcp.CallToolResult{
+		Content: []mcp.Content{&mcp.TextContent{Text: string(out)}},
+	}
+}
+
+func errorResult(msg string) *mcp.CallToolResult {
+	return &mcp.CallToolResult{
+		IsError: true,
+		Content: []mcp.Content{&mcp.TextContent{Text: msg}},
+	}
+}

app/backend/internal/middleware/idempotency.go

@@ -0,0 +1,132 @@
+package middleware
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"containr/internal/database"
+
+	"github.com/gin-gonic/gin"
+	"github.com/go-redis/redis/v8"
+)
+
+// Idempotency replays POST responses for a repeated Idempotency-Key header
+// so agents can safely retry mutations. The first request wins; concurrent
+// duplicates get 409 IDEMPOTENCY_IN_PROGRESS; completed responses replay
+// verbatim for 24h. Keys are scoped to the authenticated identity.
+func Idempotency() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if c.Request.Method != http.MethodPost {
+			c.Next()
+			return
+		}
+		key := c.GetHeader("Idempotency-Key")
+		if key == "" || len(key) > 128 {
+			c.Next()
+			return
+		}
+		dbValue, exists := c.Get("redis")
+		if !exists {
+			c.Next()
+			return
+		}
+		rdb, ok := dbValue.(*database.Redis)
+		if !ok || rdb == nil || rdb.Client == nil {
+			c.Next()
+			return
+		}
+
+		// Scope by caller identity so a stolen key can't replay across users.
+		actor := c.GetString("user_id")
+		if actor == "" {
+			actor = c.GetHeader("Authorization")
+		}
+		sum := sha256.Sum256([]byte(actor + ":" + c.Request.URL.Path + ":" + key))
+		redisKey := "idem:" + hex.EncodeToString(sum[:16])
+
+		ctx, cancel := context.WithTimeout(c.Request.Context(), 3*time.Second)
+		defer cancel()
+
+		stored, err := rdb.Client.Get(ctx, redisKey).Result()
+		switch {
+		case err == nil:
+			if stored == "processing" {
+				c.JSON(http.StatusConflict, gin.H{
+					"error": "a request with this idempotency key is still in progress",
+					"code":  "IDEMPOTENCY_IN_PROGRESS",
+				})
+				c.Abort()
+				return
+			}
+			var rec idemRecord
+			if json.Unmarshal([]byte(stored), &rec) == nil {
+				c.Header("X-Idempotent-Replay", "true")
+				c.Data(rec.Status, rec.ContentType, rec.Body)
+				c.Abort()
+				return
+			}
+		case err != redis.Nil:
+			// Redis hiccup — degrade to pass-through rather than failing the request.
+			c.Next()
+			return
+		}
+
+		// Claim the key for the duration of the request.
+		if set, serr := rdb.Client.SetNX(ctx, redisKey, "processing", 2*time.Minute).Result(); serr != nil || !set {
+			c.JSON(http.StatusConflict, gin.H{
+				"error": "a request with this idempotency key is still in progress",
+				"code":  "IDEMPOTENCY_IN_PROGRESS",
+			})
+			c.Abort()
+			return
+		}
+
+		recorder := &responseRecorder{ResponseWriter: c.Writer, status: http.StatusOK, body: &bytes.Buffer{}}
+		c.Writer = recorder
+		c.Next()
+
+		// Cache terminal responses only — 5xx is retryable and must not be replayed.
+		if recorder.status < 500 && recorder.body.Len() <= 1<<20 {
+			rec := idemRecord{
+				Status:      recorder.status,
+				ContentType: recorder.Header().Get("Content-Type"),
+				Body:        recorder.body.Bytes(),
+			}
+			if rec.ContentType == "" {
+				rec.ContentType = "application/json; charset=utf-8"
+			}
+			if raw, merr := json.Marshal(rec); merr == nil {
+				_ = rdb.Client.Set(context.Background(), redisKey, raw, 24*time.Hour).Err()
+			}
+		} else {
+			_ = rdb.Client.Del(context.Background(), redisKey).Err()
+		}
+	}
+}
+
+type idemRecord struct {
+	Status      int    `json:"s"`
+	ContentType string `json:"ct"`
+	Body        []byte `json:"b"`
+}
+
+type responseRecorder struct {
+	gin.ResponseWriter
+	status int
+	body   *bytes.Buffer
+}
+
+func (r *responseRecorder) WriteHeader(code int) {
+	r.status = code
+	r.ResponseWriter.WriteHeader(code)
+}
+
+func (r *responseRecorder) Write(b []byte) (int, error) {
+	r.body.Write(b)
+	return r.ResponseWriter.Write(b)
+}

app/backend/internal/middleware/idempotency_test.go

@@ -0,0 +1,60 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestIdempotencyPassThroughWithoutKey(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	called := 0
+	router := gin.New()
+	router.Use(Idempotency())
+	router.POST("/x", func(c *gin.Context) { called++; c.JSON(200, gin.H{"ok": true}) })
+
+	req := httptest.NewRequest(http.MethodPost, "/x", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if called != 1 || rec.Code != 200 {
+		t.Fatalf("expected pass-through, called=%d code=%d", called, rec.Code)
+	}
+}
+
+func TestIdempotencyPassThroughWithoutRedis(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	called := 0
+	router := gin.New()
+	router.Use(Idempotency())
+	router.POST("/x", func(c *gin.Context) { called++; c.JSON(200, gin.H{"ok": true}) })
+
+	// Key present but no redis in context — must not block the request.
+	req := httptest.NewRequest(http.MethodPost, "/x", nil)
+	req.Header.Set("Idempotency-Key", "abc-123")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if called != 1 || rec.Code != 200 {
+		t.Fatalf("expected pass-through without redis, called=%d code=%d", called, rec.Code)
+	}
+}
+
+func TestIdempotencySkipsNonPOST(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	called := 0
+	router := gin.New()
+	router.Use(Idempotency())
+	router.GET("/x", func(c *gin.Context) { called++; c.String(200, "ok") })
+
+	req := httptest.NewRequest(http.MethodGet, "/x", nil)
+	req.Header.Set("Idempotency-Key", "abc")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if called != 1 {
+		t.Fatalf("GET should bypass idempotency, called=%d", called)
+	}
+}

app/backend/internal/middleware/middleware.go

@@ -2,7 +2,10 @@ package middleware
 
 import (
 	"containr/internal/database"
+	sqlcdb "containr/internal/database/sqlcdb"
+	"crypto/sha256"
 	"database/sql"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -69,58 +72,192 @@ func RequestID() gin.HandlerFunc {
 	}
 }
 
+// resolveRequestUser authenticates the request via Bearer JWT or the Better
+// Auth session cookie. On success it returns the local user id and email.
+// tokenErr/hasToken mirror the legacy error contract for Auth.
+func resolveRequestUser(c *gin.Context, jwtSecret string, sessionVerifier *betterAuthSessionVerifier) (userID, email, tokenErr string, hasToken, ok bool) {
+	tokenString, tokenErr, hasToken := extractJWTToken(c)
+	if tokenString != "" {
+		// Personal access tokens (cnp_…) are not JWTs — they resolve
+		// against the user_tokens table by sha256 hash.
+		if strings.HasPrefix(tokenString, patPrefix) {
+			if id, mail, verified := resolvePersonalAccessToken(c, tokenString); verified {
+				return id, mail, "", hasToken, true
+			}
+			return "", "", "Invalid token", hasToken, false
+		}
+		if claims, valid := validateJWTClaims(tokenString, jwtSecret); valid {
+			userIDClaim, exists := claims["user_id"]
+			if exists {
+				id := strings.TrimSpace(fmt.Sprint(userIDClaim))
+				if _, err := uuid.Parse(id); err == nil {
+					if emailClaim, exists := claims["email"]; exists && emailClaim != nil {
+						email = strings.TrimSpace(fmt.Sprint(emailClaim))
+					}
+					return id, email, "", hasToken, true
+				}
+			}
+			tokenErr = "Invalid token claims"
+		} else if tokenErr == "" {
+			tokenErr = "Invalid token"
+		}
+	}
+
+	if sessionVerifier != nil {
+		if id, mail, verified := sessionVerifier.resolveUser(c); verified {
+			return id, mail, "", hasToken, true
+		}
+	}
+
+	return "", "", tokenErr, hasToken, false
+}
+
+const patPrefix = "cnp_"
+
+// resolvePersonalAccessToken authenticates a `cnp_` bearer token against the
+// user_tokens table (sha256 hash match, not revoked, not expired). On success
+// it stamps last_used_at, records the token scope on the context, and
+// returns the owner's id and email.
+func resolvePersonalAccessToken(c *gin.Context, token string) (string, string, bool) {
+	dbValue, exists := c.Get("db")
+	if !exists {
+		return "", "", false
+	}
+	db, ok := dbValue.(*database.DB)
+	if !ok || db == nil || db.DB == nil {
+		return "", "", false
+	}
+
+	sum := sha256.Sum256([]byte(token))
+	queries := sqlcdb.New(db.DB)
+	row, err := queries.GetUserTokenByHash(c.Request.Context(), hex.EncodeToString(sum[:]))
+	if err != nil {
+		return "", "", false
+	}
+
+	var email string
+	if err := db.QueryRowContext(c.Request.Context(),
+		`SELECT email FROM users WHERE id = $1`, row.UserID).Scan(&email); err != nil {
+		return "", "", false
+	}
+
+	_ = queries.TouchUserToken(c.Request.Context(), row.ID)
+	c.Set("pat_scope", row.Scope)
+	return row.UserID.String(), email, true
+}
+
+// patScopeAllows reports whether a PAT-authenticated request may proceed.
+// read scope permits only safe methods; write and admin are unrestricted at
+// this layer (admin routes still require the admin scope AND a platform
+// admin account — enforced via is_admin in setAuthenticatedContext).
+func patScopeAllows(c *gin.Context) bool {
+	if c.GetString("pat_scope") != "read" {
+		return true
+	}
+	switch c.Request.Method {
+	case http.MethodGet, http.MethodHead, http.MethodOptions:
+		return true
+	}
+	return false
+}
+
+// setAuthenticatedContext stores the resolved identity plus the admin flag on
+// the gin context so handlers and RequireAdmin can rely on it.
+func setAuthenticatedContext(c *gin.Context, userID, email string) {
+	c.Set("user_id", userID)
+	c.Set("email", email)
+	isAdmin := loadIsAdmin(c, userID)
+	// A PAT can never outrank its scope: non-admin scopes cap the token at
+	// non-admin even when the owning user is a platform admin.
+	if scope := c.GetString("pat_scope"); scope != "" && scope != "admin" {
+		isAdmin = false
+	}
+	c.Set("is_admin", isAdmin)
+}
+
+func loadIsAdmin(c *gin.Context, userID string) bool {
+	dbValue, exists := c.Get("db")
+	if !exists {
+		return false
+	}
+	db, ok := dbValue.(*database.DB)
+	if !ok || db == nil || db.DB == nil {
+		return false
+	}
+	var isAdmin bool
+	if err := db.QueryRow(`SELECT is_admin FROM users WHERE id = $1`, userID).Scan(&isAdmin); err != nil {
+		return false
+	}
+	return isAdmin
+}
+
 // Auth middleware for JWT authentication
 func Auth(jwtSecret string) gin.HandlerFunc {
 	sessionVerifier := newBetterAuthSessionVerifier()
 
 	return func(c *gin.Context) {
-		tokenString, tokenErr, hasToken := extractJWTToken(c)
-		if tokenString != "" {
-			if claims, valid := validateJWTClaims(tokenString, jwtSecret); valid {
-				userIDClaim, exists := claims["user_id"]
-				if exists {
-					userID := strings.TrimSpace(fmt.Sprint(userIDClaim))
-					if _, err := uuid.Parse(userID); err == nil {
-						email := ""
-						if emailClaim, ok := claims["email"]; ok && emailClaim != nil {
-							email = strings.TrimSpace(fmt.Sprint(emailClaim))
-						}
-						c.Set("user_id", userID)
-						c.Set("email", email)
-						c.Next()
-						return
-					}
-				}
-				tokenErr = "Invalid token claims"
-			} else if tokenErr == "" {
-				tokenErr = "Invalid token"
-			}
-		}
-
-		if sessionVerifier != nil {
-			if userID, email, ok := sessionVerifier.resolveUser(c); ok {
-				c.Set("user_id", userID)
-				c.Set("email", email)
-				c.Next()
+		userID, email, tokenErr, hasToken, ok := resolveRequestUser(c, jwtSecret, sessionVerifier)
+		if ok {
+			setAuthenticatedContext(c, userID, email)
+			if !patScopeAllows(c) {
+				c.JSON(http.StatusForbidden, gin.H{
+					"error": "Token scope is read-only",
+					"code":  "SCOPE_INSUFFICIENT",
+				})
+				c.Abort()
 				return
 			}
+			c.Next()
+			return
 		}
 
 		if tokenErr != "" {
-			c.JSON(http.StatusUnauthorized, gin.H{"error": tokenErr})
+			c.JSON(http.StatusUnauthorized, gin.H{"error": tokenErr, "code": "INVALID_TOKEN"})
 			c.Abort()
 			return
 		}
 
 		if hasToken {
-			c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token"})
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token", "code": "INVALID_TOKEN"})
 		} else {
-			c.JSON(http.StatusUnauthorized, gin.H{"error": "Authentication required"})
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "Authentication required", "code": "UNAUTHENTICATED"})
 		}
 		c.Abort()
 	}
 }
 
+// OptionalAuth resolves identity when a valid credential is present but never
+// rejects the request — anonymous callers simply get no user context. Read
+// endpoints hang off this so the public site can browse approved resources.
+func OptionalAuth(jwtSecret string) gin.HandlerFunc {
+	sessionVerifier := newBetterAuthSessionVerifier()
+
+	return func(c *gin.Context) {
+		if userID, email, _, _, ok := resolveRequestUser(c, jwtSecret, sessionVerifier); ok {
+			setAuthenticatedContext(c, userID, email)
+		}
+		c.Next()
+	}
+}
+
+// RequireAdmin rejects requests whose resolved user is not a platform admin.
+// Must run after Auth (or OptionalAuth) so user_id/is_admin are populated.
+func RequireAdmin() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if _, exists := c.Get("user_id"); !exists {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "Authentication required", "code": "UNAUTHENTICATED"})
+			c.Abort()
+			return
+		}
+		if !c.GetBool("is_admin") {
+			c.JSON(http.StatusForbidden, gin.H{"error": "Admin access required", "code": "ADMIN_REQUIRED"})
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}
+
 type betterAuthSessionVerifier struct {
 	internalURL   string
 	internalToken string
@@ -248,11 +385,18 @@ func ensureLocalUserRecord(c *gin.Context, user betterAuthSessionUser) (string,
 		return "", hashErr
 	}
 
+	// The first mirrored account owns the platform.
+	var userCount int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM users`).Scan(&userCount); err != nil {
+		return "", err
+	}
+	isFirstUser := userCount == 0
+
 	if err := db.QueryRow(`
-		INSERT INTO users (email, password_hash, name, avatar_url)
-		VALUES ($1, $2, $3, NULLIF($4, ''))
+		INSERT INTO users (email, password_hash, name, avatar_url, is_admin)
+		VALUES ($1, $2, $3, NULLIF($4, ''), $5)
 		RETURNING id
-	`, email, string(hashedPassword), name, avatarURL).Scan(&localUserID); err != nil {
+	`, email, string(hashedPassword), name, avatarURL, isFirstUser).Scan(&localUserID); err != nil {
 		return "", err
 	}
 

app/backend/internal/middleware/middleware_test.go

@@ -131,6 +131,61 @@ func TestAuthStoresStringUserIDForValidClaims(t *testing.T) {
 	}
 }
 
+func TestAuthRejectsPATWithoutDatabase(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(Auth("secret"))
+	router.GET("/test", func(c *gin.Context) {
+		c.String(http.StatusOK, "ok")
+	})
+
+	// A cnp_-prefixed token takes the PAT path, not JWT parsing — without a
+	// db handle it must fail closed with 401.
+	req := httptest.NewRequest(http.MethodGet, "/test", nil)
+	req.Header.Set("Authorization", "Bearer cnp_"+strings.Repeat("ab", 24))
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("expected status %d, got %d", http.StatusUnauthorized, rec.Code)
+	}
+}
+
+func TestPATScopeAllows(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+
+	cases := []struct {
+		name   string
+		scope  string
+		method string
+		want   bool
+	}{
+		{"read allows GET", "read", http.MethodGet, true},
+		{"read allows HEAD", "read", http.MethodHead, true},
+		{"read allows OPTIONS", "read", http.MethodOptions, true},
+		{"read blocks POST", "read", http.MethodPost, false},
+		{"read blocks DELETE", "read", http.MethodDelete, false},
+		{"write allows POST", "write", http.MethodPost, true},
+		{"write allows DELETE", "write", http.MethodDelete, true},
+		{"admin allows PATCH", "admin", http.MethodPatch, true},
+		{"no scope (session/JWT) unrestricted", "", http.MethodPost, true},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			c, _ := gin.CreateTestContext(rec)
+			c.Request = httptest.NewRequest(tc.method, "/x", nil)
+			if tc.scope != "" {
+				c.Set("pat_scope", tc.scope)
+			}
+			if got := patScopeAllows(c); got != tc.want {
+				t.Fatalf("patScopeAllows(scope=%q, method=%s) = %v, want %v", tc.scope, tc.method, got, tc.want)
+			}
+		})
+	}
+}
+
 func issueJWT(t *testing.T, secret string, claims jwt.MapClaims) string {
 	t.Helper()
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

app/backend/internal/secrets/secrets.go

@@ -0,0 +1,98 @@
+package secrets
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"log"
+	"strings"
+	"sync"
+)
+
+// Prefix marks AES-GCM-encrypted values in environment_variables.value.
+// Plaintext rows keep working — Decrypt returns them unchanged, so the
+// rollout is transparent encrypt-on-write / decrypt-on-read.
+const Prefix = "enc:v1:"
+
+var (
+	keyOnce sync.Once
+	key     []byte
+	enabled bool
+)
+
+// Configure derives the AES-256 key. SECRETS_KEY wins; JWT_SECRET is the
+// fallback so existing installs need no new config. With neither, encrypt
+// degrades to plaintext with a single warning.
+func Configure(secretsKey, jwtSecret string) {
+	keyOnce.Do(func() {
+		seed := secretsKey
+		if seed == "" {
+			seed = jwtSecret
+		}
+		if seed == "" {
+			log.Printf("secrets: no SECRETS_KEY or JWT_SECRET — secret variables stay plaintext")
+			return
+		}
+		sum := sha256.Sum256([]byte("containr-env-secrets:" + seed))
+		key = sum[:]
+		enabled = true
+	})
+}
+
+func IsEncrypted(value string) bool {
+	return strings.HasPrefix(value, Prefix)
+}
+
+// Encrypt returns value unchanged if disabled or already encrypted.
+func Encrypt(value string) string {
+	if !enabled || IsEncrypted(value) {
+		return value
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return value
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return value
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := rand.Read(nonce); err != nil {
+		return value
+	}
+	sealed := gcm.Seal(nonce, nonce, []byte(value), nil)
+	return Prefix + base64.StdEncoding.EncodeToString(sealed)
+}
+
+// Decrypt returns plaintext for enc:v1 values, the input otherwise.
+// Corrupt ciphertext fails soft to the stored value rather than erroring
+// the deploy path — an unreadable secret is no worse than a plaintext one.
+func Decrypt(value string) string {
+	if !enabled || !IsEncrypted(value) {
+		return value
+	}
+	raw, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(value, Prefix))
+	if err != nil {
+		return value
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return value
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return value
+	}
+	if len(raw) < gcm.NonceSize() {
+		return value
+	}
+	plain, err := gcm.Open(nil, raw[:gcm.NonceSize()], raw[gcm.NonceSize():], nil)
+	if err != nil {
+		log.Printf("secrets: decrypt failed (%v) — check SECRETS_KEY/JWT_SECRET rotation", fmt.Errorf("%w", err))
+		return value
+	}
+	return string(plain)
+}