refactor(db): port runtime ops to sqlc

Tranche 5 — all 24 raw sites in runtime.go. Adds runtime.sql with the
legacy-column COALESCE loader (type/image/command/git_repo fall back to
service_type/image_name/start_command/source_url), env-var reads,
sibling refs, deployed-image concat, and conditional published-port /
replica writes. Status transitions reuse SetServiceStatus.

loadReadableService now shares GetServiceRuntimeWithOwner — the projects
join is safe (FK) and drops a duplicated 24-column select.

TestRuntimeLiveInvariants verifies the COALESCE chain against a service
seeded with only legacy columns, plus refs, port, variables, agent
listing, image concat, and conditional updates on live Postgres.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.env.example

@@ -49,6 +49,10 @@ CONTAINR_AGENT_AUTH_TOKEN=replace_with_strong_agent_secret
 # CONTAINR_AGENT_AUTH_TOKENS=current_secret,next_secret
 # Bundled agent binaries dir served at /api/agents/download/:platform.
 # CONTAINR_AGENT_BIN_DIR=/agents
+# Directory Traefik's file provider watches. The backend writes one
+# config per remote service here so domains route to node agents. The
+# infra compose wires a shared volume — set only for custom layouts.
+# TRAEFIK_DYNAMIC_DIR=/traefik-dynamic
 # Optional remote template catalog (another Containr instance). Its
 # templates merge into GET /templates as source:"registry" and
 # materialize locally on deploy. The bundled catalog works without it.

.github/compose.ci.yml

@@ -0,0 +1,18 @@
+# CI-only compose overlay: pull and build through mirror.gcr.io so shared
+# runner egress IPs never touch docker.io (anonymous pulls get 429'd).
+# Production refs in infra/docker-compose.yml stay unchanged.
+services:
+  postgres:
+    image: mirror.gcr.io/library/postgres:15-alpine
+  traefik:
+    image: mirror.gcr.io/library/traefik:v3.2
+  backend:
+    build:
+      args:
+        GO_IMAGE: mirror.gcr.io/library/golang:1.26-alpine
+        NODE_IMAGE: mirror.gcr.io/library/node:22-alpine
+  frontend:
+    build:
+      args:
+        NODE_IMAGE: mirror.gcr.io/library/node:22-alpine
+        NGINX_IMAGE: mirror.gcr.io/library/nginx:alpine

.github/workflows/ci.yml

@@ -163,11 +163,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Boot stack
+        # .github/compose.ci.yml swaps every docker.io ref for
+        # mirror.gcr.io — anonymous Hub pulls 429 on shared CI IPs.
         run: |
           BETTER_AUTH_SECRET=$(openssl rand -hex 32)
           BETTER_AUTH_INTERNAL_TOKEN=$(openssl rand -hex 32)
           export BETTER_AUTH_SECRET BETTER_AUTH_INTERNAL_TOKEN
-          docker compose -f infra/docker-compose.yml up -d --build postgres dragonfly backend frontend traefik
+          docker compose -f infra/docker-compose.yml -f .github/compose.ci.yml up -d --build postgres dragonfly backend frontend traefik
 
       - name: Wait for backend health
         run: |
@@ -204,7 +206,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Docker Buildx
+        # Mirror docker.io through gcr — shared CI IPs hit anonymous
+        # rate limits on base-image metadata resolution otherwise.
         uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."docker.io"]
+              mirrors = ["mirror.gcr.io"]
 
       - name: Login to GHCR
         if: github.event_name != 'pull_request'

README.md

@@ -49,7 +49,7 @@ dedicated console.
 - **Public project catalog** — approved projects are browsable anonymously; new projects stay private until an admin approves them
 - **Admin console** (`/admin`) — platform stats, project approval/edit/delete, user admin management
 - **Private networking** — every project gets an isolated Docker network; services reach each other by name (`web:3000`) and share variables via `${{service.KEY}}` references
-- **Deployments & builds** — Docker deploys with history, image rollback, live build status
+- **Deployments & builds** — Docker deploys with history, image rollback, live build status; git-sourced services build directly on remote node agents (no registry required)
 - **Runtime** — replicas, published ports, domains, health checks, restart policies; start/stop/restart/redeploy from canvas or service page
 - **Git integration** — GitHub, GitLab, Bitbucket, Gitea; webhooks, GitHub App
 - **Managed databases** — create PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Dragonfly, or ClickHouse directly from `/databases`, with backup/restore

ROADMAP2.md

@@ -192,8 +192,11 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
   compares vs edge IP → `ok|wrong-target|pending`.
 - [x] **Maintenance mode + basic-auth gate** — Traefik middleware labels;
   no proxy code needed.
-- [ ] **Routing overrides** — `services.traefik_labels` jsonb with
-  allowlist validation (middlewares, headers, redirects).
+- [x] **Routing overrides** — `services.traefik_labels` jsonb with
+  allowlist validation. Keys `middlewares.<name>.<type>[.<field>]` scope
+  to the service router (`svc-<id>-<name>`), auto-attach after builtins;
+  router/service/provider-level keys rejected. API + CLI
+  (`--traefik-label`) + MCP + service page Access editor.
 - [x] **Builder override** — `services.builder` enum
   `auto|railpack|nixpacks|dockerfile|static`; static builder = build +
   nginx serve. Fixed hardcoded `nixpacks` + `BuildImage` stream drain bug.
@@ -223,29 +226,43 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
   {target_node_id}`: dump → stream transfer → provision → restore →
   re-point bound services. Deferred until Phase F lands real second
   nodes — nothing to migrate between today.
-- [ ] **Backup import** — upload archive → new restore point (pairs with
+- [x] **Backup import** — `POST /databases/:id/backups/import` accepts a
+  `.tar.gz` (multipart `file` or raw body, 2 GiB cap, gzip-magic
+  validated), stores it in the backups volume via a holder container,
+  registers a completed restore point, and ships offsite when a backup
+  target is configured. `api/backuptargets.go`. (pairs with
   migrators).
 
 ## 6. Phase E — Templates v2 (absorbs compose-catalog spec + dflow graph templates)
 
-- [ ] **Template = ordered service graph** — `services[]` entries with
+- [x] **Template = ordered service graph** — `services[]` entries with
   `{name, type, source, build, ports, volumes, variables, depends_on}`;
-  deploy order from dependency refs.
-- [ ] **Expressions** — `${{service.KEY}}` (already the runtime ref
-  syntax — reuse), `{{secret(len,"charset")}}`, `{{random:int}}`,
-  `{{VAR:-default}}`; `POST /templates/:id/plan` returns the resolved
-  graph without deploying (agents love this).
-- [ ] **Compose import** — `POST /templates/import/compose` (compose-go
-  parser → graph), `POST /templates/import/github` (compose file from
-  repo path). Implements `docs/superpowers/specs/2026-04-14-*`.
-- [ ] **Graph deploy pipeline** — creates project + services in
-  dependency order, resolves vars, triggers builds; defined
-  partial-failure policy.
-- [ ] **Visual template builder** — canvas mode: drop git/image/db
-  nodes, wire refs, set order, save/publish. Reuses existing canvas
-  primitives (dflow's `templates/compose` is exactly this).
-- [ ] **Catalog growth** — convert `templates/*.md` (20 app guides) into
-  real graph templates; screenshots + badges per the old spec.
+  deploy order from dependency refs. `templategraph.go`,
+  `topoSortServices`.
+- [x] **Expressions** — `{{service.KEY.prop}}` (host/port/user/password/
+  database/url), `{{secret}}`/`{{secret(N)}}`, `{{random:N}}`,
+  `{{VAR:-default}}` (incl. explicitly-empty defaults); `POST
+  /templates/:id/plan` returns the resolved graph without deploying.
+- [x] **Compose import** — `POST /templates/import/compose` (yaml →
+  graph, known DB images become managed databases), `POST
+  /templates/import/git` (compose file fetched from any git repo — clone
+  URL, ssh remote, or owner/repo via connected providers, `ref` selects
+  branch/commit); `templates import-compose|import-git` CLI, MCP tools,
+  paste-or-git toggle in the template UI.
+- [x] **Graph deploy pipeline** — creates services in dependency order,
+  resolves vars/secrets, triggers builds. `deployTemplateGraph`,
+  `POST /templates/deploy` (inline), `POST /projects/:id/import-compose`.
+- [x] **Visual template builder** — canvas mode in the template editor:
+  web/worker/cron/database nodes, handles wire `depends_on`, inspector
+  edits image/repo/engine/port/env/volumes, live validation, applies
+  back to the version-2 graph JSON. Positions persist under
+  `config.canvas`; flat legacy configs open as a single node.
+  `builder-model.ts` + `TemplateBuilder.tsx`.
+- [x] **Catalog growth** — seeded graph stacks for n8n, Gitea,
+  Nextcloud, Vaultwarden, Umami, Immich (Plausible already shipped).
+  `TestSeedTemplatesResolveCleanly` keeps every seed parseable,
+  topo-sortable, and fully resolved. Remaining single-service guides can
+  convert incrementally via the same endpoint.
 
 **Gate**: paste n8n compose → 3-service project with generated secrets
 and wired refs, one click or one CLI call.
@@ -296,24 +313,60 @@ and wired refs, one click or one CLI call.
   utilisation, then cpu, then container count, with uninstrumented
   agents sorting last. Lifecycle and `GET /runtime` are
   inventory-driven, so remote replicas show up and tear down wherever
-  they run. Remote nodes run registry-pulled
-  images only — git builds, Traefik domains, and remote sleep are
-  documented ceilings. Remaining: `scheduling_rules` affinity
-  policies, deployment status reported back from agent
-  results, spread weighting by real capacity.
-- [🟡] **Build-on-node** — private registry pulls shipped: the dispatch
-  payload carries the project owner's `registries` credentials for the
-  image host; the agent `docker login`s for the pull and logs out after,
-  and command payloads are scrubbed of passwords on completion. Agent
-  also verifies the container is still running ~1.5s after `run` so
-  crash-loops fail the deploy instead of reporting healthy. Remaining:
-  real builds on the node (source checkout + build daemon) — pulls
-  already work.
+  they run. Remote ingress shipped: the agent reports assigned host
+  ports in the `create_container` result, the backend renders a
+  Traefik file-provider config per remote service into
+  `TRAEFIK_DYNAMIC_DIR` (shared volume, `watch=true`) pointing the
+  loadbalancer at each replica's mesh IP + published port; route files
+  are rewritten on every remote reconcile and removed on teardown or
+  local placement. Agents report managed-container states at every
+  heartbeat — exits, OOMs, and crash loops land in inventory between
+  reconciles (tombstones never resurrect). Remote sleep/wake shipped:
+  heartbeats carry per-container net counters, idle remote services
+  lose replicas via agent remove + tombstones, and the route file
+  repoints at `/internal/wake-page/:id` on the backend — first hit
+  retriggers the wake reconcile, which recreates replicas and restores
+  real upstreams. Remote nodes run
+  registry-pulled images only — git builds are the remaining
+  documented ceiling. Tag affinity shipped: `node_agents.tags`
+  (operator-set via `PUT /agents/:id` / `nodes update --tags`) +
+  `services.placement_tags` — `auto` and `spread` only consider
+  online schedulable agents carrying every required tag, tags are
+  re-evaluated each reconcile (a tag change re-spreads replicas),
+  unsatisfiable requirements fail with a clear error, pin + tags
+  and local + tags are rejected, empty array clears. Surfaces:
+  `--placement-tags` on services create/update, `--tags` on
+  `nodes update`, MCP args, OpenAPI, node-detail tag editor +
+  service-detail placement-tags input. Remaining: build-on-node,
+  remote sleep/wake, spread weighting by real capacity.
+- [x] **Agent self-upgrade** — `POST /agents/:id/upgrade` enqueues a
+  `self_upgrade` command carrying platform + sha256 + server version;
+  the agent downloads its replacement from `GET /agents/download/
+  :platform`, verifies the checksum, sanity-checks `--version`,
+  atomically swaps its own executable, reports the result, then
+  re-execs (`syscall.Exec`) — no supervisor needed. Agents now stamp
+  `main.version` via ldflags at image build and report it at
+  register/heartbeat (`node_agents.version` refreshes on re-register;
+  older agents keep their stored value). Surfaces: `nodes upgrade`
+  CLI, `containr_nodes_upgrade` MCP (confirm-gated), node-detail page
+  button (online-gated). Ceilings: linux amd64/arm64 only; agents on
+  other platforms get a `NO_BINARY` 409.
+- [x] **Build-on-node** — private registry pulls + real builds shipped.
+  Git sources materialize via `internal/source` checkout (branch/commit,
+  `GIT_ASKPASS` credential injection, dumb-transport fallback), package
+  through `BuildManager.PackageContext`, ship as agent-token artifacts,
+  and `docker build` on the node (`build_image` command). Remote rollbacks
+  `docker save` → artifact → `load_image` on the node. Verified end-to-end
+  on a live agent (PR #60).
 - [ ] **IaC provisioning (ROADMAP §2.2, unchanged)** — Terraform/
   OpenTofu, `infra_connections`, Proxmox + AWS modules, + Hetzner module
   (dflow's second provider), cloud-init → auto-enroll.
-- [ ] **Global/wildcard domain per node** (`nodes.default_domain`) —
-  auto-domains for services on that node.
+- [x] **Global/wildcard domain per node** (`node_agents.default_domain`) —
+  `PUT /agents/:id {default_domain}`; domainless services placed on the
+  node get `<name>.<default_domain>` (pinned → node's base; spread →
+  union of eligible nodes). `serviceDomainNames` resolves them so
+  routing, wake placeholders, and `public_url` all pick them up.
+  CLI `nodes update --domain`, MCP arg, node-detail editor.
 
 ## 8. Phase G — Platform polish
 
@@ -386,8 +439,11 @@ and wired refs, one click or one CLI call.
   filters. Applied: audit logs (server-backed), builds (server + client
   date-range), activity (severity server + client category/search).
   Notifications table has no list surface yet — apply when one lands.
-- [ ] **Notification producers round-out** — backups, agent offline,
-  upgrade available, security findings.
+- [x] **Notification producers round-out** — all shipped: deployments
+  (deployments.go), backups (databases.go `createBackupProcess` → owner),
+  agent offline/online sweep (`reconcileAgentHealth` → admins),
+  upgrade-available (`checkForUpgrade`, tag-persisted) and security-scan
+  findings (`scanner.OnScanComplete` → project owner).
 - [x] **Sleep-on-idle / wake-on-traffic** (serverless-lite) —
   `services.sleep_enabled` + `sleep_idle_minutes` (PR #29). Sweeper
   polls container NetworkIO deltas; idle past threshold → workload
@@ -452,28 +508,50 @@ and wired refs, one click or one CLI call.
     a prior deployment, database start/stop/restart/backup-now.
   - **Observe** — polling log tail (300 lines, 5s refresh), per-service
     deployment history, env-doctor issues surfaced on the service view.
-  - [ ] **env var edit + apply-redeploy, domain management, replica
-    scaling, cron execution history** — next iteration.
-  - [ ] **Push notifications** — zero-infra path = self-hosted
-    ntfy/Gotify relay (no Firebase dependency), FCM/APNs optional.
-  - [ ] **Offline resilience** — cached last-known state + unreachable
-    banner.
-- [ ] **Status/offline resilience** — app + CLI degrade gracefully when
-  the instance is unreachable (cached last-known state, clear banner).
+  - [x] **env var edit + domain management + replica scaling** (PR #61 —
+    mobile v1.5: variables editor, domains screen, scale + sleep
+    settings, notifications tab, cron jobs screen with run-now and
+    execution history).
+  - [x] **Push notifications** — per-user `notification_channels`
+    (ntfy + Gotify): every `insertUserNotification` fans out best-effort
+    to enabled channels; CRUD + live test-ping via web settings, CLI
+    `notifications channels`, and MCP. FCM/APNs remain optional.
+  - [x] **Offline resilience** — AsyncStorage-persisted query cache
+    (7d, high-churn keys excluded) + banner when the instance is
+    unreachable (`/health` ping + expo-network).
+- [x] **Status/offline resilience** — web persists the query cache to
+  localStorage (24h) and PlatformShell shows a "last-known data" banner
+  on offline/unreachable; CLI exits `ExitUnavailable` with a clean
+  "cannot reach" message (no stack traces).
 
 ## 10. Carried-over debt (ROADMAP.md items still open)
 
-- [ ] **Gateway traffic path** — mount `/g/:slug/*` → key → rate-limit →
-  `gateway/proxy.go` → metrics. Management API exists; proxy unwired.
-- [ ] **Preview environments runtime** — real build+deploy+subdomain+TTL
-  (bookkeeping only now). Pairs with clone + multi-domain.
-- [ ] **Environments** — env switcher, per-env vars/domains, promote.
-- [ ] **sqlc port** — ~140 raw `database/sql` sites → `sqlc/queries/`.
+- [x] **Gateway traffic path** — `/g/:slug/*` mounted → api_key auth →
+  rpm + monthly quota → `gateway/proxy.go` → usage_counters /
+  metrics_timeseries / incident_events.
+- [x] **Preview environments runtime** — previews are real service clones:
+  branch override, queued deployment, node-domain hostnames, TTL sweeper,
+  promote = redeploy of the source at the preview branch.
+- [x] **Environments** — CRUD (`GET/POST /projects/:id/environments`,
+  `DELETE /environments/:id`), switcher chips with service counts in the
+  workspace, CLI `environments` + MCP parity. Per-env vars/domains ride the
+  service's own scope (one env per service); promote ships via preview
+  promote.
+- [ ] **sqlc port** — ~265 raw `database/sql` sites → `sqlc/queries/`. Done in tranches (dynamic queries stay raw). Tranches merged: metrics storage + service domains (#75), service clone/move ops (#76), preview environments (#77), deployments + rollback (#78). Remaining: runtime, compliance, cron, git, security, auth, sleeper, scanner, gateway, and smaller files.
 - [ ] **Tests** — canvas/wizard frontend coverage, deployment/template/
   webhook table tests, Playwright e2e golden path.
-- [ ] **First-run wizard** — admin → GitHub App (manifest flow from
-  Phase G makes this self-serve) → Tunnel → done.
-- [ ] **Self-upgrade loop verification**, docs freshness, v1.0.0 release.
+- [x] **First-run wizard** — public `GET /setup/status` + authed
+  `POST /setup/complete`; `/setup` page steps admin account → GitHub App
+  manifest flow (callback returns to the wizard via a session marker) →
+  optional Cloudflare tunnel token → done. Shell redirects signed-in
+  users to `/setup` while `needs_setup`; installs with existing projects
+  auto-complete so nobody gets nagged retroactively.
+- [x] **Self-upgrade loop verification** — live-verified: admin
+  `POST /agents/:id/upgrade` → `self_upgrade` command → agent downloads
+  `/api/agents/download/linux-amd64` → sha256 verify → `--version`
+  sanity → atomic rename → result posts → `syscall.Exec` re-exec. Agent
+  ran `v0.0.1-old`, came back `v9.9.9-test`, command row `completed`.
+- [ ] **Docs freshness, v1.0.0 release.**
 
 ## 11. Deliberately not imported from dflow
 

app/backend/Dockerfile

@@ -1,5 +1,7 @@
 # Build Go API binary
-FROM golang:1.26-alpine AS go-builder
+ARG GO_IMAGE=golang:1.26-alpine
+ARG NODE_IMAGE=node:22-alpine
+FROM ${GO_IMAGE} AS go-builder
 
 RUN apk add --no-cache git ca-certificates tzdata
 
@@ -14,11 +16,11 @@ RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo \
     -ldflags "-X containr/internal/api.Version=${VERSION}" -o main cmd/server/main.go
 
 # Node-agent binaries served by the API for SSH/bootstrap installs.
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /agents/containr-agent-linux-amd64 ./cmd/agent && \
-    CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -o /agents/containr-agent-linux-arm64 ./cmd/agent
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-X main.version=${VERSION}" -o /agents/containr-agent-linux-amd64 ./cmd/agent && \
+    CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-X main.version=${VERSION}" -o /agents/containr-agent-linux-arm64 ./cmd/agent
 
 # Build embedded Better Auth runtime dependencies
-FROM node:22-alpine AS auth-builder
+FROM ${NODE_IMAGE} AS auth-builder
 
 WORKDIR /auth
 
@@ -28,9 +30,9 @@ RUN npm ci --omit=dev
 COPY auth/src ./src
 
 # Final runtime image (Go API + Better Auth sidecar in one container)
-FROM node:22-alpine
+FROM ${NODE_IMAGE}
 
-RUN apk --no-cache add ca-certificates tzdata wget
+RUN apk --no-cache add ca-certificates tzdata wget git
 
 RUN addgroup -g 1001 -S appgroup && \
     adduser -u 1001 -S appuser -G appgroup

app/backend/cmd/agent/main.go

@@ -3,14 +3,18 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"log"
 	"net"
 	"net/http"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"runtime"
 	"strconv"
 	"strings"
@@ -104,7 +108,15 @@ type registerResponse struct {
 	Status  string `json:"status"`
 }
 
+// version is stamped at build time via -ldflags "-X main.version=…".
+// The server reports it on upgrades so agents can show what they run.
+var version = "dev"
+
 func main() {
+	if len(os.Args) > 1 && (os.Args[1] == "--version" || os.Args[1] == "version") {
+		fmt.Printf("containr-agent %s\n", version)
+		return
+	}
 	cfg, err := loadConfig()
 	if err != nil {
 		log.Fatal(err)
@@ -167,6 +179,7 @@ func register(ctx context.Context, client *http.Client, cfg agentConfig) (string
 		"ip_address":   cfg.IP,
 		"port":         cfg.Port,
 		"capabilities": detectCapabilities(),
+		"version":      firstEnv("CONTAINR_AGENT_VERSION", version),
 		// Always send mesh so a removed interface clears stored state.
 		"mesh": detectMeshInterfaces(),
 	}
@@ -190,11 +203,93 @@ func sendHeartbeat(ctx context.Context, client *http.Client, cfg agentConfig, ag
 		"container_count": dockerContainerCount(),
 		"system_load":     readSystemLoad(),
 		"uptime":          readSystemUptime(),
-		"version":         firstEnv("CONTAINR_AGENT_VERSION", "dev"),
+		"version":         firstEnv("CONTAINR_AGENT_VERSION", version),
+		"containers":      managedContainerStates(),
 	}
 	return postJSON(ctx, client, cfg, "/api/agents/heartbeat", payload, nil)
 }
 
+// managedContainerStates lists every containr-managed container's docker
+// state plus cumulative network counters — state keeps runtime honest,
+// net bytes let the sleeper detect idle remote services.
+func managedContainerStates() []map[string]interface{} {
+	out, err := runDocker("ps", "-a",
+		"--filter", "label=containr.managed=true",
+		"--format", "{{.Names}}\t{{.State}}")
+	if err != nil {
+		return nil
+	}
+	netIO := containerNetIO()
+	var states []map[string]interface{}
+	for _, line := range strings.Split(out, "\n") {
+		parts := strings.SplitN(line, "\t", 2)
+		if len(parts) != 2 || parts[0] == "" {
+			continue
+		}
+		entry := map[string]interface{}{"name": parts[0], "state": parts[1]}
+		if io, ok := netIO[parts[0]]; ok {
+			entry["rx_bytes"], entry["tx_bytes"] = io[0], io[1]
+		}
+		states = append(states, entry)
+	}
+	return states
+}
+
+// containerNetIO snapshots cumulative rx/tx per running container. Stats
+// only covers running containers — stopped replicas report state without
+// counters, which is all the sleeper needs.
+func containerNetIO() map[string][2]int64 {
+	out, err := runDocker("stats", "--no-stream",
+		"--format", "{{.Name}}\t{{.NetIO}}")
+	if err != nil {
+		return nil
+	}
+	result := map[string][2]int64{}
+	for _, line := range strings.Split(out, "\n") {
+		parts := strings.SplitN(line, "\t", 2)
+		if len(parts) != 2 {
+			continue
+		}
+		io := strings.Split(parts[1], "/")
+		if len(io) != 2 {
+			continue
+		}
+		result[parts[0]] = [2]int64{parseHumanBytes(io[0]), parseHumanBytes(io[1])}
+	}
+	return result
+}
+
+// parseHumanBytes converts docker's human units ("1.2kB", "3.4MB") to bytes.
+func parseHumanBytes(s string) int64 {
+	s = strings.TrimSpace(s)
+	var num float64
+	var unit string
+	if _, err := fmt.Sscanf(s, "%f%s", &num, &unit); err != nil {
+		return 0
+	}
+	switch strings.ToUpper(unit) {
+	case "B":
+		return int64(num)
+	case "KB":
+		return int64(num * 1e3)
+	case "MB":
+		return int64(num * 1e6)
+	case "GB":
+		return int64(num * 1e9)
+	case "TB":
+		return int64(num * 1e12)
+	case "KIB":
+		return int64(num * 1024)
+	case "MIB":
+		return int64(num * 1024 * 1024)
+	case "GIB":
+		return int64(num * 1024 * 1024 * 1024)
+	case "TIB":
+		return int64(num * 1024 * 1024 * 1024 * 1024)
+	}
+	return int64(num)
+}
+
 func processCommands(ctx context.Context, client *http.Client, cfg agentConfig, agentID string) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("%s/api/agents/%s/commands", cfg.APIURL, agentID), nil)
 	if err != nil {
@@ -216,7 +311,13 @@ func processCommands(ctx context.Context, client *http.Client, cfg agentConfig,
 		return err
 	}
 	for _, item := range list.Commands {
-		result, runErr := executeCommand(item)
+		var result, reexecPath string
+		var runErr error
+		if item.Type == "self_upgrade" {
+			result, reexecPath, runErr = selfUpgrade(cfg, item.Payload)
+		} else {
+			result, runErr = executeCommand(cfg, item)
+		}
 		status := "completed"
 		errText := ""
 		if runErr != nil {
@@ -232,11 +333,17 @@ func processCommands(ctx context.Context, client *http.Client, cfg agentConfig,
 		if err := postJSON(ctx, client, cfg, path, payload, nil); err != nil {
 			log.Printf("report command result failed: command=%s err=%v", item.ID, err)
 		}
+		// Re-exec AFTER the result posts — the new binary picks up the loop.
+		if reexecPath != "" {
+			if err := syscall.Exec(reexecPath, os.Args, os.Environ()); err != nil {
+				log.Fatalf("re-exec after upgrade failed: %v", err)
+			}
+		}
 	}
 	return nil
 }
 
-func executeCommand(item command) (string, error) {
+func executeCommand(cfg agentConfig, item command) (string, error) {
 	switch item.Type {
 	case "create_container":
 		return createContainer(item.Payload)
@@ -247,7 +354,16 @@ func executeCommand(item command) (string, error) {
 	case "restart_container":
 		return runDocker("restart", commandTarget(item.Payload))
 	case "remove_container":
-		return runDocker("rm", "-f", commandTarget(item.Payload))
+		out, err := runDocker("rm", "-f", commandTarget(item.Payload))
+		// A missing container is the desired end state — report success.
+		if err != nil && strings.Contains(out, "No such container") {
+			return out, nil
+		}
+		return out, err
+	case "build_image":
+		return buildImage(cfg, item.Payload)
+	case "load_image":
+		return loadImage(cfg, item.Payload)
 	case "prune":
 		return dockerPrune(item.Payload)
 	case "system_df":
@@ -257,6 +373,67 @@ func executeCommand(item command) (string, error) {
 	}
 }
 
+// selfUpgrade downloads the agent binary the server bundles for this
+// platform, verifies it, swaps it in atomically, and returns the path to
+// re-exec. On any failure the running binary is left untouched.
+func selfUpgrade(cfg agentConfig, payload map[string]interface{}) (string, string, error) {
+	platform := firstString(stringValue(payload["platform"]), runtime.GOOS+"-"+runtime.GOARCH)
+
+	exe, err := os.Executable()
+	if err != nil {
+		return "", "", fmt.Errorf("resolve own path: %w", err)
+	}
+	if resolved, err := filepath.EvalSymlinks(exe); err == nil {
+		exe = resolved
+	}
+
+	url := fmt.Sprintf("%s/api/agents/download/%s", cfg.APIURL, platform)
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return "", "", err
+	}
+	resp, err := (&http.Client{Timeout: 2 * time.Minute}).Do(req)
+	if err != nil {
+		return "", "", fmt.Errorf("download %s: %w", platform, err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", "", fmt.Errorf("download %s: server returned %d", platform, resp.StatusCode)
+	}
+
+	newPath := exe + ".new"
+	out, err := os.OpenFile(newPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o755)
+	if err != nil {
+		return "", "", fmt.Errorf("write %s: %w", newPath, err)
+	}
+	h := sha256.New()
+	if _, err := io.Copy(io.MultiWriter(out, h), resp.Body); err != nil {
+		out.Close()
+		os.Remove(newPath)
+		return "", "", fmt.Errorf("download write: %w", err)
+	}
+	out.Close()
+
+	if want := stringValue(payload["sha256"]); want != "" {
+		if got := hex.EncodeToString(h.Sum(nil)); got != want {
+			os.Remove(newPath)
+			return "", "", fmt.Errorf("sha256 mismatch: got %s want %s", got, want)
+		}
+	}
+
+	// Sanity: the new binary must at least report its version.
+	if verOut, err := exec.Command(newPath, "--version").CombinedOutput(); err != nil {
+		os.Remove(newPath)
+		return "", "", fmt.Errorf("new binary failed sanity check: %s", strings.TrimSpace(string(verOut)))
+	}
+
+	if err := os.Rename(newPath, exe); err != nil {
+		os.Remove(newPath)
+		return "", "", fmt.Errorf("swap binary: %w", err)
+	}
+	return fmt.Sprintf("upgraded to %s (%s)", firstString(stringValue(payload["version"]), "latest"), platform), exe, nil
+}
+
 // dockerPrune runs a bounded docker system prune. Volumes are excluded
 // unless the payload explicitly opts in — a stray volume prune destroys
 // database data.
@@ -374,7 +551,139 @@ func createContainer(payload map[string]interface{}) (string, error) {
 		logs, _ := runDocker("logs", "--tail", "5", name)
 		return "", fmt.Errorf("container %s is %q after start: %s", name, state, logs)
 	}
-	return name, nil
+	// Report the real host port bindings — ephemeral publishes pick a port
+	// the server can't guess, and remote ingress needs the actual mapping.
+	hostPorts := map[string]string{}
+	portsJSON, _ := runDocker("inspect", "-f", "{{json .NetworkSettings.Ports}}", name)
+	var bindings map[string][]struct {
+		HostIP   string `json:"HostIp"`
+		HostPort string `json:"HostPort"`
+	}
+	if json.Unmarshal([]byte(portsJSON), &bindings) == nil {
+		for cport, addrs := range bindings {
+			for _, a := range addrs {
+				if a.HostPort != "" && a.HostPort != "0" {
+					hostPorts[cport] = a.HostPort
+				}
+			}
+		}
+	}
+	out, _ := json.Marshal(map[string]interface{}{"name": name, "host_ports": hostPorts})
+	return string(out), nil
+}
+
+// fetchArtifact downloads a server-side deploy artifact (build context or
+// docker-save tarball) into a temp file the docker CLI consumes.
+func fetchArtifact(cfg agentConfig, artifactID string) (*os.File, error) {
+	if len(artifactID) != 32 {
+		return nil, fmt.Errorf("invalid artifact id")
+	}
+	url := fmt.Sprintf("%s/api/agents/artifacts/%s", cfg.APIURL, artifactID)
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("X-Containr-Agent-Token", cfg.Token)
+	resp, err := (&http.Client{Timeout: 10 * time.Minute}).Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("download artifact: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("download artifact: server returned %d", resp.StatusCode)
+	}
+	f, err := os.CreateTemp("", "containr-artifact-*.tar")
+	if err != nil {
+		return nil, err
+	}
+	if _, err := io.Copy(f, resp.Body); err != nil {
+		f.Close()
+		os.Remove(f.Name())
+		return nil, fmt.Errorf("write artifact: %w", err)
+	}
+	if _, err := f.Seek(0, io.SeekStart); err != nil {
+		f.Close()
+		os.Remove(f.Name())
+		return nil, err
+	}
+	return f, nil
+}
+
+// buildImage docker-builds a packaged context tar on this node. The context
+// already carries its Dockerfile at the tar root, so `docker build -` can
+// stream it straight from stdin. Result reports the image digest so the
+// server records what each node actually produced.
+func buildImage(cfg agentConfig, payload map[string]interface{}) (string, error) {
+	image := stringValue(payload["image"])
+	artifactID := stringValue(payload["artifact_id"])
+	if image == "" || artifactID == "" {
+		return "", errors.New("build_image requires image and artifact_id")
+	}
+	f, err := fetchArtifact(cfg, artifactID)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	defer os.Remove(f.Name())
+
+	args := []string{"build", "-t", image}
+	if boolValue(payload["no_cache"]) {
+		args = append(args, "--no-cache")
+	}
+	// Bare --build-arg keys read their values from the process env — keeps
+	// token-bearing args out of the node's process list.
+	env := os.Environ()
+	if buildArgs, ok := payload["build_args"].(map[string]interface{}); ok {
+		for k, v := range buildArgs {
+			args = append(args, "--build-arg", k)
+			env = append(env, fmt.Sprintf("%s=%v", k, v))
+		}
+	}
+	args = append(args, "-")
+	cmd := exec.Command("docker", args...)
+	cmd.Stdin = f
+	cmd.Env = env
+	outBytes, err := cmd.CombinedOutput()
+	out := strings.TrimSpace(string(outBytes))
+	if err != nil {
+		return "", fmt.Errorf("docker build failed: %s", tailOutput(out, 4096))
+	}
+	digest, _ := runDocker("inspect", "-f", "{{.Id}}", image)
+	size, _ := runDocker("inspect", "-f", "{{.Size}}", image)
+	result, _ := json.Marshal(map[string]string{
+		"image": image, "id": digest, "size": size,
+		"log_tail": tailOutput(out, 4096),
+	})
+	return string(result), nil
+}
+
+// loadImage imports a docker-save tarball — rollbacks of locally-built tags
+// reach remote nodes this way since no registry serves containr-* images.
+func loadImage(cfg agentConfig, payload map[string]interface{}) (string, error) {
+	artifactID := stringValue(payload["artifact_id"])
+	if artifactID == "" {
+		return "", errors.New("load_image requires artifact_id")
+	}
+	f, err := fetchArtifact(cfg, artifactID)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	defer os.Remove(f.Name())
+	out, err := runDockerStdin(f, "load")
+	if err != nil {
+		return "", fmt.Errorf("docker load failed: %s", tailOutput(out, 4096))
+	}
+	return out, nil
+}
+
+// tailOutput bounds command results — full docker build logs would swamp
+// the agent_commands row.
+func tailOutput(s string, max int) string {
+	if len(s) <= max {
+		return s
+	}
+	return s[len(s)-max:]
 }
 
 // registryHostOf mirrors the server's registryHost: first path segment with
@@ -588,6 +897,15 @@ func runDocker(args ...string) (string, error) {
 	return strings.TrimSpace(string(output)), err
 }
 
+// runDockerStdin pipes stdin into docker — build contexts and saved image
+// tarballs stream in without a second copy on disk.
+func runDockerStdin(stdin io.Reader, args ...string) (string, error) {
+	cmd := exec.Command("docker", args...)
+	cmd.Stdin = stdin
+	output, err := cmd.CombinedOutput()
+	return strings.TrimSpace(string(output)), err
+}
+
 func dockerAvailable() bool {
 	_, err := exec.LookPath("docker")
 	if err != nil {

app/backend/internal/api/agents.go

@@ -11,6 +11,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"log"
 	"math"
 	"net/http"
@@ -41,6 +42,12 @@ type NodeAgent struct {
 	LastHeartbeat time.Time         `json:"last_heartbeat"`
 	AutoPrune     bool              `json:"auto_prune"`
 	Schedulable   bool              `json:"schedulable"`
+	// Tags are operator-set placement labels; services with placement_tags
+	// only schedule onto agents carrying every required tag.
+	Tags []string `json:"tags"`
+	// DefaultDomain is this node's base domain — services placed here with
+	// no explicit domains get <name>.<default_domain> automatically.
+	DefaultDomain string                 `json:"default_domain"`
 	CreatedAt     time.Time              `json:"created_at"`
 	UpdatedAt     time.Time              `json:"updated_at"`
 	Metadata      map[string]interface{} `json:"metadata"`
@@ -194,6 +201,17 @@ type AgentHeartbeat struct {
 	SystemLoad     SystemLoad    `json:"system_load"`
 	Uptime         int64         `json:"uptime"`
 	Version        string        `json:"version"`
+	// Containers reports managed-container liveness — {name, state} per
+	// containr.managed container on the node — so remote replica status
+	// reflects reality between reconciles (exits, OOMs, crash loops).
+	Containers []AgentContainerState `json:"containers,omitempty"`
+}
+
+type AgentContainerState struct {
+	Name    string `json:"name"`
+	State   string `json:"state"`
+	RxBytes int64  `json:"rx_bytes,omitempty"`
+	TxBytes int64  `json:"tx_bytes,omitempty"`
 }
 
 type SystemLoad struct {
@@ -241,10 +259,15 @@ func (h *NodeAgentHandler) ListNodeOptions(c *gin.Context) {
 	}
 	options := make([]gin.H, 0, len(rows))
 	for _, row := range rows {
+		var tags []string
+		if len(row.Tags) > 0 {
+			_ = json.Unmarshal(row.Tags, &tags)
+		}
 		options = append(options, gin.H{
 			"id":     row.ID,
 			"name":   row.Name,
 			"status": row.Status.String,
+			"tags":   tags,
 		})
 	}
 	c.JSON(http.StatusOK, gin.H{"nodes": options})
@@ -261,6 +284,8 @@ func agentFromRow(row sqlcdb.NodeAgent) NodeAgent {
 		Version:       row.Version.String,
 		AutoPrune:     row.AutoPrune,
 		Schedulable:   row.Schedulable,
+		Tags:          []string{},
+		DefaultDomain: row.DefaultDomain,
 		Metadata:      map[string]interface{}{},
 	}
 	if row.LastHeartbeat.Valid {
@@ -275,6 +300,9 @@ func agentFromRow(row sqlcdb.NodeAgent) NodeAgent {
 	unmarshalRaw(row.Capabilities, &agent.Capabilities)
 	unmarshalRaw(row.Resources, &agent.Resources)
 	unmarshalRaw(row.Metadata, &agent.Metadata)
+	if len(row.Tags) > 0 {
+		_ = json.Unmarshal(row.Tags, &agent.Tags)
+	}
 	return agent
 }
 
@@ -353,6 +381,7 @@ func (h *NodeAgentHandler) RegisterAgent(c *gin.Context) {
 		IPAddress    string            `json:"ip_address" binding:"required"`
 		Port         int               `json:"port" binding:"required"`
 		Capabilities AgentCapabilities `json:"capabilities" binding:"required"`
+		Version      string            `json:"version"`
 		AuthToken    string            `json:"auth_token"`
 		Mesh         map[string]string `json:"mesh"`
 	}
@@ -398,7 +427,8 @@ func (h *NodeAgentHandler) RegisterAgent(c *gin.Context) {
 			IpAddress: existing.IpAddress,
 			Port:      int32(req.Port),
 			Status:    sql.NullString{String: "connecting", Valid: true},
-			Version:       existing.Version,
+			// Older agents don't report a version — keep whatever's stored.
+			Version:       sql.NullString{String: firstNonEmpty(req.Version, existing.Version.String), Valid: true},
 			Capabilities:  rawJSON(req.Capabilities),
 			Resources:     existing.Resources,
 			LastHeartbeat: sql.NullTime{Time: time.Now(), Valid: true},
@@ -450,7 +480,7 @@ func (h *NodeAgentHandler) RegisterAgent(c *gin.Context) {
 		IpAddress:     req.IPAddress,
 		Port:          int32(req.Port),
 		Status:        sql.NullString{String: "connecting", Valid: true},
-		Version:       sql.NullString{},
+		Version:       sql.NullString{String: req.Version, Valid: req.Version != ""},
 		Capabilities:  rawJSON(req.Capabilities),
 		Resources:     rawJSON(resources),
 		LastHeartbeat: sql.NullTime{Time: time.Now(), Valid: true},
@@ -543,7 +573,38 @@ func (h *NodeAgentHandler) UpdateAgent(c *gin.Context) {
 		return
 	}
 
-	c.JSON(http.StatusOK, gin.H{"agent": agentFromRow(updated)})
+	// Tags persist through their own column write — UpdateAgent keeps the
+	// register-path signature untouched.
+	resp := agentFromRow(updated)
+	if raw, ok := updates["default_domain"]; ok {
+		domain := strings.ToLower(strings.TrimSpace(fmt.Sprintf("%v", raw)))
+		if domain != "" && !validHostname(domain) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "default_domain must be a valid hostname", "code": "VALIDATION"})
+			return
+		}
+		if err := h.q.SetAgentDefaultDomain(ctx, sqlcdb.SetAgentDefaultDomainParams{ID: id, DefaultDomain: domain}); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update default domain"})
+			return
+		}
+		resp.DefaultDomain = domain
+	}
+	if raw, ok := updates["tags"]; ok {
+		var tags []string
+		if b, mErr := json.Marshal(raw); mErr == nil {
+			_ = json.Unmarshal(b, &tags)
+		}
+		tags = normalizePlacementTags(tags)
+		if err := h.q.SetAgentTags(ctx, sqlcdb.SetAgentTagsParams{
+			ID:      id,
+			Column2: json.RawMessage(tagsJSON(tags)),
+		}); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update agent tags"})
+			return
+		}
+		resp.Tags = tags
+	}
+
+	c.JSON(http.StatusOK, gin.H{"agent": resp})
 }
 
 // applyAgentUpdates merges whitelisted keys from an arbitrary update map.
@@ -631,6 +692,22 @@ func (h *NodeAgentHandler) SendHeartbeat(c *gin.Context) {
 		return
 	}
 
+	// Reconcile remote container liveness — exits and crash loops surface
+	// in inventory between reconciles. Best-effort, never fatal.
+	for _, rc := range heartbeat.Containers {
+		if rc.Name == "" || rc.State == "" {
+			continue
+		}
+		stateJSON, _ := json.Marshal(rc.State)
+		bytesJSON, _ := json.Marshal(rc.RxBytes + rc.TxBytes)
+		_ = h.q.UpdateContainerStateByName(ctx, sqlcdb.UpdateContainerStateByNameParams{
+			Name:        rc.Name,
+			NodeAgentID: heartbeat.NodeAgentID,
+			Column3:     stateJSON,
+			Column4:     bytesJSON,
+		})
+	}
+
 	c.Status(http.StatusOK)
 }
 
@@ -708,7 +785,9 @@ func (h *NodeAgentHandler) CompleteCommand(c *gin.Context) {
 }
 
 // scrubCommandSecrets rewrites a completed command's payload with any
-// registry password blanked. Best-effort — a failed scrub leaves the row.
+// credential-bearing fields blanked — registry passwords and build-time
+// args (tokens like NPM_TOKEN ride along as build args). Best-effort — a
+// failed scrub leaves the row.
 func scrubCommandSecrets(ctx context.Context, q *sqlcdb.Queries, commandID string, payload pqtype.NullRawMessage) {
 	if !payload.Valid || len(payload.RawMessage) == 0 {
 		return
@@ -717,15 +796,24 @@ func scrubCommandSecrets(ctx context.Context, q *sqlcdb.Queries, commandID strin
 	if err := json.Unmarshal(payload.RawMessage, &doc); err != nil {
 		return
 	}
-	container, ok := doc["container"].(map[string]interface{})
-	if !ok {
-		return
-	}
-	reg, ok := container["registry"].(map[string]interface{})
-	if !ok || reg["password"] == nil {
-		return
-	}
+	dirty := false
+	if container, ok := doc["container"].(map[string]interface{}); ok {
+		if reg, ok := container["registry"].(map[string]interface{}); ok && reg["password"] != nil {
 			reg["password"] = "***"
+			dirty = true
+		}
+	}
+	for _, key := range []string{"build_args", "environment"} {
+		if args, ok := doc[key].(map[string]interface{}); ok && len(args) > 0 {
+			for k := range args {
+				args[k] = "***"
+			}
+			dirty = true
+		}
+	}
+	if !dirty {
+		return
+	}
 	if err := q.ScrubCommandPayload(ctx, sqlcdb.ScrubCommandPayloadParams{
 		ID:      commandID,
 		Payload: rawJSON(doc),
@@ -911,6 +999,76 @@ func (h *NodeAgentHandler) PruneAgent(c *gin.Context) {
 	c.JSON(http.StatusAccepted, gin.H{"command": command})
 }
 
+// UpgradeAgent enqueues a self_upgrade command: the agent downloads its
+// replacement binary from this server's bundled /download endpoint,
+// verifies the sha256, swaps it in, and re-execs. Fails fast when no
+// bundled binary exists for the agent's architecture.
+func (h *NodeAgentHandler) UpgradeAgent(c *gin.Context) {
+	ctx := c.Request.Context()
+	id := c.Param("id")
+	agent, err := h.q.GetAgent(ctx, id)
+	if err != nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Agent not found")
+		return
+	}
+	if agent.Status.String != "online" {
+		respondError(c, http.StatusConflict, "NODE_OFFLINE", "node is offline — reconnect it before upgrading")
+		return
+	}
+
+	arch := "amd64"
+	var caps struct {
+		SupportedArchitectures []string `json:"supported_architectures"`
+	}
+	unmarshalRaw(agent.Capabilities, &caps)
+	if len(caps.SupportedArchitectures) > 0 && caps.SupportedArchitectures[0] != "" {
+		arch = caps.SupportedArchitectures[0]
+	}
+	platform := "linux-" + arch // agents only ship for linux today
+
+	dir := os.Getenv("CONTAINR_AGENT_BIN_DIR")
+	if dir == "" {
+		dir = "/agents"
+	}
+	path := filepath.Join(dir, "containr-agent-"+platform)
+	sum, err := sha256File(path)
+	if err != nil {
+		respondError(c, http.StatusConflict, "NO_BINARY",
+			fmt.Sprintf("no bundled agent binary for %s on this server", platform))
+		return
+	}
+
+	command, err := h.q.CreateCommand(ctx, sqlcdb.CreateCommandParams{
+		ID:          uuid.New().String(),
+		Type:        "self_upgrade",
+		NodeAgentID: id,
+		Payload: rawJSON(map[string]interface{}{
+			"platform": platform,
+			"sha256":   sum,
+			"version":  Version,
+		}),
+	})
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL", "failed to enqueue upgrade")
+		return
+	}
+	LogAuditWithRequest(c, "node", id, "upgrade", map[string]interface{}{"platform": platform, "version": Version})
+	c.JSON(http.StatusAccepted, gin.H{"command": command, "platform": platform, "version": Version})
+}
+
+func sha256File(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", err
+	}
+	defer f.Close()
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
 // ExecuteCommand executes a command on an agent
 func (h *NodeAgentHandler) ExecuteCommand(c *gin.Context) {
 	agentID := c.Param("id")
@@ -1327,6 +1485,10 @@ func (h *NodeAgentHandler) SetupPublicRoutes(router *gin.RouterGroup) {
 		// public; the enroll token is the actual secret.
 		agents.GET("/install.sh", h.ServeInstallScript)
 		agents.GET("/download/:platform", h.ServeAgentBinary)
+
+		// Deploy artifacts (build contexts, image tarballs) — token-gated;
+		// the blobs are per-deployment source code, not public bootstrap.
+		agents.GET("/artifacts/:id", h.ServeArtifact)
 	}
 }
 
@@ -1390,6 +1552,7 @@ func (h *NodeAgentHandler) SetupAdminRoutes(router *gin.RouterGroup) {
 		agents.POST("/:id/cordon", h.CordonAgent)
 		agents.POST("/:id/uncordon", h.UncordonAgent)
 		agents.POST("/:id/drain", h.DrainAgent)
+		agents.POST("/:id/upgrade", h.UpgradeAgent)
 		agents.POST("/:id/prune", h.PruneAgent)
 		agents.POST("/:id/commands", h.ExecuteCommand)
 		agents.GET("/:id/commands", h.GetAgentCommands)

app/backend/internal/api/artifacts.go

@@ -0,0 +1,136 @@
+package api
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+// containrWorkDir is the build workspace root — same dir the BuildManager
+// was constructed with; checkouts and agent artifacts live beneath it.
+const containrWorkDir = "/tmp/containr-builds"
+
+// artifacts is a one-shot blob store for node agents: build contexts and
+// docker-save tarballs the server produced on behalf of a deployment. Files
+// live under workdir/artifacts/<id> and are removed when the deployment
+// finishes or after maxArtifactAge.
+var artifacts = &artifactStore{files: map[string]string{}}
+
+type artifactStore struct {
+	mu    sync.Mutex
+	dir   string
+	files map[string]string
+}
+
+const maxArtifactAge = 2 // hours — a deployment can never outlive this
+
+// initArtifacts points the store at dir (created on demand).
+func initArtifacts(dir string) {
+	artifacts.mu.Lock()
+	defer artifacts.mu.Unlock()
+	artifacts.dir = dir
+	_ = os.MkdirAll(dir, 0o755)
+}
+
+// artifactDir returns the store root, defaulting under the build workdir.
+func artifactDir() string {
+	artifacts.mu.Lock()
+	defer artifacts.mu.Unlock()
+	if artifacts.dir != "" {
+		return artifacts.dir
+	}
+	return filepath.Join(containrWorkDir, "artifacts")
+}
+
+// putArtifact streams rc into the store and returns the artifact id.
+func putArtifact(rc io.Reader) (string, error) {
+	buf := make([]byte, 16)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	id := hex.EncodeToString(buf)
+	dir := artifactDir()
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return "", err
+	}
+	path := filepath.Join(dir, id+".tar")
+	f, err := os.Create(path)
+	if err != nil {
+		return "", err
+	}
+	if _, err := io.Copy(f, rc); err != nil {
+		f.Close()
+		os.Remove(path)
+		return "", err
+	}
+	f.Close()
+
+	artifacts.mu.Lock()
+	artifacts.files[id] = path
+	artifacts.mu.Unlock()
+	return id, nil
+}
+
+// removeArtifact deletes the file and forgets the id. Safe on missing ids.
+func removeArtifact(id string) {
+	artifacts.mu.Lock()
+	path, ok := artifacts.files[id]
+	delete(artifacts.files, id)
+	artifacts.mu.Unlock()
+	if ok {
+		_ = os.Remove(path)
+		return
+	}
+	// Registered before a restart — remove best-effort by name.
+	if id != "" {
+		_ = os.Remove(filepath.Join(artifactDir(), id+".tar"))
+	}
+}
+
+// ServeArtifact streams a stored blob to a token-authenticated agent. Files
+// persist across downloads — spread builds share one context — and are
+// deleted by the deployment that created them.
+func (h *NodeAgentHandler) ServeArtifact(c *gin.Context) {
+	if !h.isValidAgentAuthToken(c.Request.Context(), agentAuthTokenFromRequest(c)) {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid auth token"})
+		return
+	}
+	id := c.Param("id")
+	raw, err := hex.DecodeString(id)
+	if len(id) != 32 || err != nil || len(raw) != 16 {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Artifact not found"})
+		return
+	}
+	path := filepath.Join(artifactDir(), id+".tar")
+	info, err := os.Stat(path)
+	if err != nil || info.IsDir() {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Artifact not found"})
+		return
+	}
+	c.Header("Content-Type", "application/x-tar")
+	c.File(path)
+}
+
+// purgeStaleArtifacts drops files older than maxArtifactAge. Called on boot.
+func purgeStaleArtifacts() {
+	entries, err := os.ReadDir(artifactDir())
+	if err != nil {
+		return
+	}
+	for _, e := range entries {
+		info, err := e.Info()
+		if err != nil {
+			continue
+		}
+		if info.ModTime().Before(time.Now().Add(-maxArtifactAge * time.Hour)) {
+			_ = os.Remove(filepath.Join(artifactDir(), e.Name()))
+		}
+	}
+}

app/backend/internal/api/cron_test.go

@@ -0,0 +1,66 @@
+package api
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCalculateNextRun(t *testing.T) {
+	cases := []struct {
+		name     string
+		schedule string
+		timezone string
+		wantErr  bool
+	}{
+		{"every minute", "* * * * *", "", false},
+		{"daily at 4am", "0 4 * * *", "UTC", false},
+		{"weekday run", "0 9 * * 1-5", "Europe/Prague", false},
+		{"whitespace tolerated", "  */15 * * * *  ", "", false},
+		{"empty schedule", "", "", true},
+		{"bad field count", "* * *", "", true},
+		{"garbage", "not a cron", "", true},
+		{"bad timezone", "0 4 * * *", "Mars/Olympus", true},
+	}
+	now := time.Now()
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			next, err := calculateNextRun(tc.schedule, tc.timezone)
+			if tc.wantErr {
+				if err == nil {
+					t.Fatalf("expected error, got next=%v", next)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if next == nil {
+				t.Fatal("expected non-nil next run")
+			}
+			if !next.After(now) {
+				t.Errorf("next run %v is not after %v", next, now)
+			}
+		})
+	}
+}
+
+func TestCalculateNextRunTimezone(t *testing.T) {
+	// CRON_TZ must change the computed instant: 04:00 in a fixed-offset zone
+	// lands at a different UTC hour than 04:00 UTC.
+	utcNext, err := calculateNextRun("0 4 * * *", "UTC")
+	if err != nil {
+		t.Fatalf("utc: %v", err)
+	}
+	tokyoNext, err := calculateNextRun("0 4 * * *", "Asia/Tokyo")
+	if err != nil {
+		t.Fatalf("tokyo: %v", err)
+	}
+	if utcNext.Equal(*tokyoNext) {
+		t.Fatalf("timezone had no effect: both %v", utcNext)
+	}
+	if !strings.EqualFold(utcNext.Location().String(), "Local") {
+		// UTC-scheduled runs still land in server-local time representation.
+		t.Logf("utc next: %v / tokyo next: %v", utcNext, tokyoNext)
+	}
+}

app/backend/internal/api/deployments.go

@@ -2,14 +2,20 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/docker"
+	"containr/internal/source"
+	"containr/internal/types"
 	"context"
+	"database/sql"
 	"errors"
 	"fmt"
 	"log/slog"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -33,6 +39,72 @@ type DeploymentModel struct {
 	UpdatedAt   time.Time  `json:"updated_at" db:"updated_at"`
 }
 
+// deploymentRowShape carries the deployment columns shared by the
+// generated list/detail/rollback row types.
+type deploymentRowShape struct {
+	ID          uuid.UUID
+	ServiceID   uuid.UUID
+	CommitHash  sql.NullString
+	Status      sql.NullString
+	ImageName   sql.NullString
+	ImageTag    sql.NullString
+	BuildLog    sql.NullString
+	RuntimeLog  sql.NullString
+	Error       sql.NullString
+	StartedAt   sql.NullTime
+	CompletedAt sql.NullTime
+	CreatedAt   sql.NullTime
+	UpdatedAt   sql.NullTime
+}
+
+func strPtrNS(v sql.NullString) *string {
+	if !v.Valid {
+		return nil
+	}
+	s := v.String
+	return &s
+}
+
+func ptrStr(s *string) string {
+	if s == nil {
+		return ""
+	}
+	return *s
+}
+
+func timePtrNT(v sql.NullTime) *time.Time {
+	if !v.Valid {
+		return nil
+	}
+	t := v.Time
+	return &t
+}
+
+func ntPtr(t *time.Time) sql.NullTime {
+	if t == nil {
+		return sql.NullTime{}
+	}
+	return sql.NullTime{Time: *t, Valid: true}
+}
+
+func deploymentModelFrom(r deploymentRowShape) DeploymentModel {
+	return DeploymentModel{
+		ID:          r.ID,
+		ServiceID:   r.ServiceID,
+		CommitHash:  strPtrNS(r.CommitHash),
+		Status:      r.Status.String,
+		ImageName:   r.ImageName.String,
+		ImageTag:    r.ImageTag.String,
+		BuildLog:    r.BuildLog.String,
+		RuntimeLog:  r.RuntimeLog.String,
+		Error:       strPtrNS(r.Error),
+		StartedAt:   timePtrNT(r.StartedAt),
+		CompletedAt: timePtrNT(r.CompletedAt),
+		CreatedAt:   r.CreatedAt.Time,
+		UpdatedAt:   r.UpdatedAt.Time,
+	}
+}
+
 type CreateDeploymentRequest struct {
 	CommitHash string            `json:"commit_hash"`
 	Branch     string            `json:"branch"`
@@ -80,44 +152,29 @@ func handleGetDeployments(c *gin.Context) {
 
 	offset, limit := pageWindow(c, 50, 100)
 
-	var total int
-	_ = db.(*database.DB).QueryRow(
-		`SELECT COUNT(*) FROM deployments WHERE service_id = $1`, serviceID,
-	).Scan(&total)
+	q := sqlcdb.New(db.(*database.DB).DB)
+	total, _ := q.CountDeploymentsForService(c.Request.Context(), serviceID)
 
-	rows, err := db.(*database.DB).Query(
-		`SELECT id, service_id, commit_hash, status, image_name, image_tag,
-		        build_log, runtime_log, error, started_at, completed_at, created_at, updated_at
-		 FROM deployments
-		 WHERE service_id = $1
-		 ORDER BY created_at DESC
-		 LIMIT $2 OFFSET $3`,
-		serviceID, limit, offset,
-	)
+	rows, err := q.ListDeploymentsForService(c.Request.Context(), sqlcdb.ListDeploymentsForServiceParams{
+		ServiceID: serviceID, Limit: int32(limit), Offset: int32(offset)})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve deployments"})
 		return
 	}
-	defer rows.Close()
 
-	var deployments []DeploymentModel
-	for rows.Next() {
-		var d DeploymentModel
-		err := rows.Scan(
-			&d.ID, &d.ServiceID, &d.CommitHash, &d.Status, &d.ImageName, &d.ImageTag,
-			&d.BuildLog, &d.RuntimeLog, &d.Error, &d.StartedAt, &d.CompletedAt,
-			&d.CreatedAt, &d.UpdatedAt,
-		)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan deployment"})
-			return
-		}
-		deployments = append(deployments, d)
+	deployments := make([]DeploymentModel, 0, len(rows))
+	for _, r := range rows {
+		deployments = append(deployments, deploymentModelFrom(deploymentRowShape{
+			ID: r.ID, ServiceID: r.ServiceID, CommitHash: r.CommitHash, Status: r.Status,
+			ImageName: r.ImageName, ImageTag: r.ImageTag, BuildLog: r.BuildLog,
+			RuntimeLog: r.RuntimeLog, Error: r.Error, StartedAt: r.StartedAt,
+			CompletedAt: r.CompletedAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+		}))
 	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"deployments": deployments,
-		"pagination":  paginationMeta(offset, limit, total),
+		"pagination":  paginationMeta(offset, limit, int(total)),
 	})
 }
 
@@ -148,51 +205,33 @@ func handleGetRecentDeployments(c *gin.Context) {
 
 	offset, limit := pageWindow(c, 10, 50)
 
-	var total int
-	if err := db.(*database.DB).QueryRow(
-		`SELECT COUNT(*)
-		 FROM deployments d
-		 JOIN services s ON s.id = d.service_id
-		 JOIN projects p ON p.id = s.project_id
-		 WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
-		    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)`,
-		userID, isAdmin,
-	).Scan(&total); err != nil {
+	q := sqlcdb.New(db.(*database.DB).DB)
+	total, err := q.CountAccessibleDeployments(c.Request.Context(), sqlcdb.CountAccessibleDeploymentsParams{
+		OwnerID: userID, Column2: isAdmin})
+	if err != nil {
 		total = 0
 	}
 
-	rows, err := db.(*database.DB).Query(
-		`SELECT d.id, d.service_id, s.name, p.name, d.status,
-		        COALESCE(d.image_name, ''), d.started_at, d.completed_at, d.created_at
-		 FROM deployments d
-		 JOIN services s ON s.id = d.service_id
-		 JOIN projects p ON p.id = s.project_id
-		 WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
-		    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)
-		 ORDER BY d.created_at DESC
-		 LIMIT $3 OFFSET $4`,
-		userID, isAdmin, limit, offset,
-	)
+	rows, err := q.ListRecentAccessibleDeployments(c.Request.Context(), sqlcdb.ListRecentAccessibleDeploymentsParams{
+		OwnerID: userID, Column2: isAdmin, Limit: int32(limit), Offset: int32(offset)})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve deployments"})
 		return
 	}
-	defer rows.Close()
 
-	deployments := []RecentDeployment{}
-	for rows.Next() {
-		var d RecentDeployment
-		if err := rows.Scan(&d.ID, &d.ServiceID, &d.ServiceName, &d.ProjectName,
-			&d.Status, &d.ImageName, &d.StartedAt, &d.CompletedAt, &d.CreatedAt); err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan deployment"})
-			return
-		}
-		deployments = append(deployments, d)
+	deployments := make([]RecentDeployment, 0, len(rows))
+	for _, r := range rows {
+		deployments = append(deployments, RecentDeployment{
+			ID: r.ID, ServiceID: r.ServiceID, ServiceName: r.ServiceName,
+			ProjectName: r.ProjectName, Status: r.Status.String, ImageName: r.ImageName,
+			StartedAt: timePtrNT(r.StartedAt), CompletedAt: timePtrNT(r.CompletedAt),
+			CreatedAt: r.CreatedAt.Time,
+		})
 	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"deployments": deployments,
-		"pagination":  paginationMeta(offset, limit, total),
+		"pagination":  paginationMeta(offset, limit, int(total)),
 	})
 }
 
@@ -226,38 +265,27 @@ func handleCreateDeployment(c *gin.Context) {
 		return
 	}
 
-	var service Service
-	var projectOwner string
-	err = db.(*database.DB).QueryRow(
-		`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
-		        s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at, p.owner_id
-		 FROM services s
-		 JOIN projects p ON s.project_id = p.id
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt, &projectOwner,
-	)
-
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+	sr, err := q.GetServiceForDeployWithOwner(ctx, serviceID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return
 	}
+	service := serviceForDeployFromRow(sqlcdb.GetServiceForDeployRow{
+		ID: sr.ID, ProjectID: sr.ProjectID, Name: sr.Name, Type: sr.Type,
+		Status: sr.Status, Image: sr.Image, Command: sr.Command,
+		Environment: sr.Environment, GitRepo: sr.GitRepo, GitBranch: sr.GitBranch,
+		BuildPath: sr.BuildPath, Cpu: sr.Cpu, Memory: sr.Memory,
+		Replicas: sr.Replicas, Port: sr.Port, Domain: sr.Domain,
+		HealthcheckPath: sr.HealthcheckPath, RestartPolicy: sr.RestartPolicy,
+		Builder: sr.Builder, CpuReserve: sr.CpuReserve, MemoryReserve: sr.MemoryReserve,
+		StaticBuildCmd: sr.StaticBuildCmd, StaticDir: sr.StaticDir,
+		CreatedAt: sr.CreatedAt, UpdatedAt: sr.UpdatedAt,
+	})
+	projectOwner := sr.OwnerID
 
-	if projectOwner != userID.(string) {
+	if projectOwner.String() != userID.(string) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -283,12 +311,17 @@ func handleCreateDeployment(c *gin.Context) {
 		UpdatedAt:  now,
 	}
 
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO deployments
-		 (id, service_id, version, commit_hash, status, image_name, image_tag, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
-		d.ID, d.ServiceID, fmt.Sprintf("v%d", now.Unix()), d.CommitHash, d.Status, d.ImageName, d.ImageTag, d.CreatedAt, d.UpdatedAt,
-	)
+	err = q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID:         d.ID,
+		ServiceID:  d.ServiceID,
+		Version:    fmt.Sprintf("v%d", now.Unix()),
+		CommitHash: sql.NullString{String: ptrStr(d.CommitHash), Valid: d.CommitHash != nil},
+		Status:     sql.NullString{String: d.Status, Valid: true},
+		ImageName:  sql.NullString{String: d.ImageName, Valid: true},
+		ImageTag:   sql.NullString{String: d.ImageTag, Valid: true},
+		CreatedAt:  sql.NullTime{Time: d.CreatedAt, Valid: true},
+		UpdatedAt:  sql.NullTime{Time: d.UpdatedAt, Valid: true},
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create deployment"})
@@ -299,20 +332,20 @@ func handleCreateDeployment(c *gin.Context) {
 	if !exists || engine == nil {
 		unavailableErr := "Deployment engine unavailable. Docker may not be configured on this server."
 		completedAt := time.Now()
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE deployments
-			 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
-			 WHERE id = $3`,
-			unavailableErr, completedAt, d.ID,
-		)
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: unavailableErr, Valid: true},
+			CompletedAt: sql.NullTime{Time: completedAt, Valid: true},
+			ID:          d.ID,
+		})
 		d.Status = "failed"
 		d.Error = &unavailableErr
 		d.CompletedAt = &completedAt
 	} else {
-		_, err = db.(*database.DB).Exec(
-			`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
-			time.Now(), serviceID,
-		)
+		err = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "building", Valid: true},
+			UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+			ID:        serviceID,
+		})
 		if err != nil {
 			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update service status"})
 			return
@@ -327,14 +360,17 @@ func handleCreateDeployment(c *gin.Context) {
 		})
 		if pos > 0 {
 			d.Status = "queued"
-			_, _ = db.(*database.DB).Exec(
-				`UPDATE deployments SET status = 'queued', updated_at = $1 WHERE id = $2`,
-				time.Now(), d.ID,
-			)
-			_, _ = db.(*database.DB).Exec(
-				`UPDATE services SET status = 'queued', updated_at = $1 WHERE id = $2`,
-				time.Now(), serviceID,
-			)
+			now := time.Now()
+			_ = q.SetDeploymentStatus(ctx, sqlcdb.SetDeploymentStatusParams{
+				Status:    sql.NullString{String: "queued", Valid: true},
+				UpdatedAt: sql.NullTime{Time: now, Valid: true},
+				ID:        d.ID,
+			})
+			_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+				Status:    sql.NullString{String: "queued", Valid: true},
+				UpdatedAt: sql.NullTime{Time: now, Valid: true},
+				ID:        serviceID,
+			})
 		}
 	}
 
@@ -376,6 +412,25 @@ func runDeploymentAndSyncWithImage(
 ) {
 	ctx, cancel := context.WithTimeout(parentCtx, 30*time.Minute)
 	defer cancel()
+	q := sqlcdb.New(db.DB)
+
+	// The checkout and any shipped artifacts die with this deployment.
+	var artifactIDs []string
+	checkoutRoot := filepath.Join(containrWorkDir, "repos", dbDeployment.ID.String())
+	defer func() {
+		_ = os.RemoveAll(checkoutRoot)
+		for _, id := range artifactIDs {
+			removeArtifact(id)
+		}
+	}()
+	failDeploy := func(msg string) {
+		failedAt := time.Now()
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: msg, Valid: true},
+			CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+			ID:          dbDeployment.ID,
+		})
+	}
 
 	sourcePath := strings.TrimSpace(service.BuildPath)
 	if sourcePath == "" {
@@ -402,11 +457,10 @@ func runDeploymentAndSyncWithImage(
 		replicas = 1
 	}
 
-	var publishedPort int32
 	// Best effort: reuse the host port from the last live deployment so public
 	// URLs survive redeploys. Column exists post-migration; older DBs get
 	// ephemeral ports.
-	_ = db.QueryRow(`SELECT published_port FROM services WHERE id = $1`, service.ID).Scan(&publishedPort)
+	publishedPort, _ := q.GetServicePublishedPort(ctx, service.ID)
 
 	publicPort := int32(service.Port)
 	if service.Builder == "static" && publicPort == 0 {
@@ -421,20 +475,34 @@ func runDeploymentAndSyncWithImage(
 		maintURL = maintenanceURL(db)
 	}
 
-	// Node-pinned services dispatch to the agent's command queue. Builds run
-	// on the local host, so remote placement only works for registry-pulled
-	// images — git-sourced and rollback deploys fail fast with that message.
+	// Node-pinned and spread services dispatch to agent command queues.
 	nodeID := serviceNodeID(db, service.ID)
 	spread := serviceSpread(db, service.ID)
-	if (nodeID != "" || spread) && (service.GitRepo != "" || imageOverride != "") {
-		failedAt := time.Now()
-		msg := "service uses remote node placement but remote nodes only run registry-pulled images (git builds and rollbacks stay local — build-on-node is not yet supported)"
-		_, _ = db.Exec(
-			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
-			msg, failedAt, dbDeployment.ID,
-		)
+	remote := nodeID != "" || spread
+
+	// Materialize the git checkout — local builds consume it directly;
+	// remote builds package it into a context artifact the node builds.
+	if service.GitRepo != "" && imageOverride == "" {
+		var ownerID string
+		if o, err := q.GetProjectOwner(ctx, service.ProjectID); err == nil {
+			ownerID = o.String()
+		}
+		branch := req.Branch
+		if branch == "" {
+			branch = service.GitBranch
+		}
+		cloneSpec, err := resolveGitCloneSpec(db, ownerID, service.GitRepo, branch, req.CommitHash, service.BuildPath)
+		if err != nil {
+			failDeploy("resolve git source: " + err.Error())
 			return
 		}
+		src, err := source.Checkout(ctx, checkoutRoot, cloneSpec)
+		if err != nil {
+			failDeploy("git checkout: " + err.Error())
+			return
+		}
+		sourcePath = src
+	}
 
 	deployReq := &deployment.DeploymentRequest{
 		ProjectID:   service.ProjectID.String(),
@@ -480,8 +548,31 @@ func runDeploymentAndSyncWithImage(
 		if image == "" {
 			image = service.Image
 		}
+		if remote && strings.HasPrefix(image, "containr-") {
+			// Locally-built tag — no registry serves it. Ship the image
+			// itself as a docker-save artifact; the node loads it.
+			rc, err := engine.DockerClient().SaveImage(ctx, image)
+			if err != nil {
+				failDeploy("export rollback image: " + err.Error())
+				return
+			}
+			artifactID, err := putArtifact(rc)
+			_ = rc.Close()
+			if err != nil {
+				failDeploy("store rollback image artifact: " + err.Error())
+				return
+			}
+			artifactIDs = append(artifactIDs, artifactID)
+			deployReq.Config.RemoteLoad = &deployment.RemoteLoadSpec{ArtifactID: artifactID}
+			deployReq.BuildConfig = &deployment.BuildConfig{
+				BuildType:     "remote",
+				PrebuiltImage: image,
+			}
+		} else {
 			var ownerID string
-		_ = db.QueryRow(`SELECT owner_id FROM projects WHERE id = $1`, service.ProjectID).Scan(&ownerID)
+			if o, err := q.GetProjectOwner(ctx, service.ProjectID); err == nil {
+				ownerID = o.String()
+			}
 			auth := registryAuthFor(db, ownerID, image)
 			deployReq.BuildConfig = &deployment.BuildConfig{
 				BuildType:     "prebuilt",
@@ -489,6 +580,7 @@ func runDeploymentAndSyncWithImage(
 				PullUsername:  auth.Username,
 				PullPassword:  auth.Password,
 			}
+		}
 	} else {
 		// "auto" leaves BuildType empty so the manager detects it; the static
 		// builder additionally feeds its generated Dockerfile the service's
@@ -497,25 +589,64 @@ func runDeploymentAndSyncWithImage(
 		if service.Builder != "" && service.Builder != "auto" {
 			buildType = service.Builder
 		}
-		deployReq.BuildConfig = &deployment.BuildConfig{
+		buildArgs := map[string]string{}
+		buildCommand := ""
+		if buildType == "static" {
+			buildCommand = firstNonEmpty(service.StaticBuildCmd, "npm ci && npm run build")
+			buildArgs["STATIC_DIR"] = firstNonEmpty(service.StaticDir, "dist")
+		}
+		if remote {
+			// Package the context — the node docker-builds it itself.
+			packReq := &types.BuildRequest{
 				BuildType:    buildType,
 				SourcePath:   sourcePath,
+				BuildCommand: buildCommand,
+				BuildArgs:    buildArgs,
+				Environment:  env,
+			}
+			rc, err := engine.BuildManager().PackageContext(ctx, packReq)
+			if err != nil {
+				failDeploy("package build context: " + err.Error())
+				return
+			}
+			artifactID, err := putArtifact(rc)
+			_ = rc.Close()
+			if err != nil {
+				failDeploy("store build context artifact: " + err.Error())
+				return
+			}
+			artifactIDs = append(artifactIDs, artifactID)
+			deployReq.Config.RemoteBuild = &deployment.RemoteBuildSpec{
+				ArtifactID: artifactID,
+				BuildArgs:  buildArgs,
+				NoCache:    req.NoCache,
+			}
+			deployReq.BuildConfig = &deployment.BuildConfig{
+				BuildType: "remote",
+				Branch:    req.Branch,
+				Commit:    req.CommitHash,
+				NoCache:   req.NoCache,
+			}
+		} else {
+			deployReq.BuildConfig = &deployment.BuildConfig{
+				BuildType:    buildType,
+				SourcePath:   sourcePath,
+				BuildCommand: buildCommand,
+				BuildArgs:    buildArgs,
 				Branch:       req.Branch,
 				Commit:       req.CommitHash,
 				NoCache:      req.NoCache,
 			}
-		if buildType == "static" {
-			deployReq.BuildConfig.BuildCommand = firstNonEmpty(service.StaticBuildCmd, "npm ci && npm run build")
-			deployReq.BuildConfig.BuildArgs = map[string]string{"STATIC_DIR": firstNonEmpty(service.StaticDir, "dist")}
 		}
 	}
 
 	if msg := capacityCheck(parentCtx, db, engine.DockerClient(), service, replicas); msg != "" {
 		failedAt := time.Now()
-		_, _ = db.Exec(
-			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
-			msg, failedAt, dbDeployment.ID,
-		)
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: msg, Valid: true},
+			CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+			ID:          dbDeployment.ID,
+		})
 		return
 	}
 
@@ -523,16 +654,16 @@ func runDeploymentAndSyncWithImage(
 	if err != nil {
 		failedAt := time.Now()
 		failure := "Failed to start deployment engine: " + err.Error()
-		_, _ = db.Exec(
-			`UPDATE deployments
-			 SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
-			 WHERE id = $3`,
-			failure, failedAt, dbDeployment.ID,
-		)
-		_, _ = db.Exec(
-			`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
-			failedAt, service.ID,
-		)
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: failure, Valid: true},
+			CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+			ID:          dbDeployment.ID,
+		})
+		_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "failed", Valid: true},
+			UpdatedAt: sql.NullTime{Time: failedAt, Valid: true},
+			ID:        service.ID,
+		})
 		return
 	}
 
@@ -547,16 +678,17 @@ func runDeploymentAndSyncWithImage(
 			if errors.Is(ctx.Err(), context.Canceled) {
 				finalStatus, finalErr = "cancelled", "Deployment cancelled"
 			}
-			_, _ = db.Exec(
-				`UPDATE deployments
-				 SET status = $1, error = $2, completed_at = $3, updated_at = $3
-				 WHERE id = $4`,
-				finalStatus, finalErr, failedAt, dbDeployment.ID,
-			)
-			_, _ = db.Exec(
-				`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`,
-				finalStatus, failedAt, service.ID,
-			)
+			_ = q.CompleteDeployment(ctx, sqlcdb.CompleteDeploymentParams{
+				Status:      sql.NullString{String: finalStatus, Valid: true},
+				Error:       sql.NullString{String: finalErr, Valid: true},
+				CompletedAt: sql.NullTime{Time: failedAt, Valid: true},
+				ID:          dbDeployment.ID,
+			})
+			_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+				Status:    sql.NullString{String: finalStatus, Valid: true},
+				UpdatedAt: sql.NullTime{Time: failedAt, Valid: true},
+				ID:        service.ID,
+			})
 			return
 		case <-syncTicker.C:
 			current, getErr := engine.GetDeployment(engineDeployment.ID)
@@ -567,49 +699,36 @@ func runDeploymentAndSyncWithImage(
 			dbStatus := mapEngineStatusToDBStatus(current.Status)
 			imageName, imageTag := splitImageReference(current.ImageName, dbDeployment.ImageTag)
 
-			var dbError interface{}
-			if current.Error != "" {
-				dbError = current.Error
-			}
-
-			_, _ = db.Exec(
-				`UPDATE deployments
-				 SET status = $1,
-				     image_name = $2,
-				     image_tag = $3,
-				     build_log = $4,
-				     runtime_log = $5,
-				     error = $6,
-				     started_at = $7,
-				     completed_at = $8,
-				     updated_at = $9
-				 WHERE id = $10`,
-				dbStatus,
-				imageName,
-				imageTag,
-				current.BuildLog,
-				current.DeployLog,
-				dbError,
-				current.StartedAt,
-				current.CompletedAt,
-				time.Now(),
-				dbDeployment.ID,
-			)
+			now := time.Now()
+			_ = q.SyncDeploymentProgress(ctx, sqlcdb.SyncDeploymentProgressParams{
+				Status:      sql.NullString{String: dbStatus, Valid: true},
+				ImageName:   sql.NullString{String: imageName, Valid: true},
+				ImageTag:    sql.NullString{String: imageTag, Valid: true},
+				BuildLog:    sql.NullString{String: current.BuildLog, Valid: true},
+				RuntimeLog:  sql.NullString{String: current.DeployLog, Valid: true},
+				Error:       sql.NullString{String: current.Error, Valid: current.Error != ""},
+				StartedAt:   ntPtr(current.StartedAt),
+				CompletedAt: ntPtr(current.CompletedAt),
+				UpdatedAt:   sql.NullTime{Time: now, Valid: true},
+				ID:          dbDeployment.ID,
+			})
 
 			switch dbStatus {
 			case "deployed":
-				_, _ = db.Exec(
-					`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`,
-					time.Now(), service.ID,
-				)
+				_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+					Status:    sql.NullString{String: "running", Valid: true},
+					UpdatedAt: sql.NullTime{Time: now, Valid: true},
+					ID:        service.ID,
+				})
 				insertUserNotification(db, userID, "deployment", "Deployment succeeded",
 					fmt.Sprintf("Service %s is now running.", service.Name), "service", service.ID.String())
 				return
 			case "failed":
-				_, _ = db.Exec(
-					`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
-					time.Now(), service.ID,
-				)
+				_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+					Status:    sql.NullString{String: "failed", Valid: true},
+					UpdatedAt: sql.NullTime{Time: now, Valid: true},
+					ID:        service.ID,
+				})
 				body := fmt.Sprintf("Service %s failed to deploy.", service.Name)
 				if current.Error != "" {
 					body = fmt.Sprintf("Service %s failed to deploy: %s", service.Name, current.Error)
@@ -661,21 +780,16 @@ func handleCancelDeployment(c *gin.Context) {
 		return
 	}
 
-	var status, owner string
-	var serviceID uuid.UUID
-	err = db.(*database.DB).QueryRow(
-		`SELECT d.status, d.service_id, p.owner_id
-		 FROM deployments d
-		 JOIN services s ON d.service_id = s.id
-		 JOIN projects p ON s.project_id = p.id
-		 WHERE d.id = $1`,
-		deploymentID,
-	).Scan(&status, &serviceID, &owner)
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+	access, err := q.GetDeploymentAccess(ctx, deploymentID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found", "code": "NOT_FOUND"})
 		return
 	}
-	if owner != userID.(string) && !contextIsAdmin(c) {
+	serviceID := access.ServiceID
+	status := access.Status.String
+	if access.OwnerID.String() != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied", "code": "FORBIDDEN"})
 		return
 	}
@@ -689,14 +803,17 @@ func handleCancelDeployment(c *gin.Context) {
 	switch getDeployQueue(c).Cancel(serviceID, deploymentID) {
 	case deployqueue.WasQueued:
 		now := time.Now()
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE deployments SET status = 'cancelled', error = 'Deployment cancelled', completed_at = $1, updated_at = $1 WHERE id = $2`,
-			now, deploymentID,
-		)
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE services SET status = 'cancelled', updated_at = $1 WHERE id = $2`,
-			now, serviceID,
-		)
+		_ = q.CompleteDeployment(ctx, sqlcdb.CompleteDeploymentParams{
+			Status:      sql.NullString{String: "cancelled", Valid: true},
+			Error:       sql.NullString{String: "Deployment cancelled", Valid: true},
+			CompletedAt: sql.NullTime{Time: now, Valid: true},
+			ID:          deploymentID,
+		})
+		_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "cancelled", Valid: true},
+			UpdatedAt: sql.NullTime{Time: now, Valid: true},
+			ID:        serviceID,
+		})
 		c.JSON(http.StatusOK, gin.H{"status": "cancelled"})
 	case deployqueue.WasActive:
 		c.JSON(http.StatusAccepted, gin.H{"status": "cancelling"})
@@ -710,9 +827,15 @@ func splitImageReference(image, fallbackTag string) (string, string) {
 		return "", fallbackTag
 	}
 
+	// Digest-pinned refs (name[:tag]@sha256:…) carry no usable tag — the
+	// colon lives inside the digest and must not be split.
+	if strings.Contains(image, "@") {
+		return image, fallbackTag
+	}
+
 	lastSlash := strings.LastIndex(image, "/")
 	lastColon := strings.LastIndex(image, ":")
-	if lastColon > lastSlash && !strings.Contains(image[lastColon:], "@") {
+	if lastColon > lastSlash {
 		return image[:lastColon], image[lastColon+1:]
 	}
 
@@ -733,27 +856,18 @@ func handleGetDeployment(c *gin.Context) {
 		return
 	}
 
-	var d DeploymentModel
-	var projectID uuid.UUID
-	err = db.(*database.DB).QueryRow(
-		`SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
-		        d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
-		        d.created_at, d.updated_at, p.id
-		 FROM deployments d
-		 JOIN services s ON d.service_id = s.id
-		 JOIN projects p ON s.project_id = p.id
-		 WHERE d.id = $1`,
-		deploymentID,
-	).Scan(
-		&d.ID, &d.ServiceID, &d.CommitHash, &d.Status, &d.ImageName, &d.ImageTag,
-		&d.BuildLog, &d.RuntimeLog, &d.Error, &d.StartedAt, &d.CompletedAt,
-		&d.CreatedAt, &d.UpdatedAt, &projectID,
-	)
-
+	r, err := sqlcdb.New(db.(*database.DB).DB).GetDeploymentWithProject(c.Request.Context(), deploymentID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
 		return
 	}
+	projectID := r.ProjectID
+	d := deploymentModelFrom(deploymentRowShape{
+		ID: r.ID, ServiceID: r.ServiceID, CommitHash: r.CommitHash, Status: r.Status,
+		ImageName: r.ImageName, ImageTag: r.ImageTag, BuildLog: r.BuildLog,
+		RuntimeLog: r.RuntimeLog, Error: r.Error, StartedAt: r.StartedAt,
+		CompletedAt: r.CompletedAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+	})
 
 	if _, allowed := projectReadAccess(c, db.(*database.DB), projectID); !allowed {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
@@ -783,33 +897,23 @@ func handleRollbackDeployment(c *gin.Context) {
 		return
 	}
 
-	var targetDeployment DeploymentModel
-	var serviceID uuid.UUID
-	var ownerCheck string
-
-	err = db.(*database.DB).QueryRow(
-		`SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag, 
-		        d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at, 
-		        d.created_at, d.updated_at, p.owner_id
-		 FROM deployments d
-		 JOIN services s ON d.service_id = s.id
-		 JOIN projects p ON s.project_id = p.id
-		 WHERE d.id = $1`,
-		deploymentID,
-	).Scan(
-		&targetDeployment.ID, &serviceID, &targetDeployment.CommitHash, &targetDeployment.Status,
-		&targetDeployment.ImageName, &targetDeployment.ImageTag, &targetDeployment.BuildLog,
-		&targetDeployment.RuntimeLog, &targetDeployment.Error, &targetDeployment.StartedAt,
-		&targetDeployment.CompletedAt, &targetDeployment.CreatedAt, &targetDeployment.UpdatedAt,
-		&ownerCheck,
-	)
-
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+	r, err := q.GetDeploymentForRollback(ctx, deploymentID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Deployment not found"})
 		return
 	}
+	serviceID := r.ServiceID
+	targetDeployment := deploymentModelFrom(deploymentRowShape{
+		ID: r.ID, ServiceID: r.ServiceID, CommitHash: r.CommitHash, Status: r.Status,
+		ImageName: r.ImageName, ImageTag: r.ImageTag, BuildLog: r.BuildLog,
+		RuntimeLog: r.RuntimeLog, Error: r.Error, StartedAt: r.StartedAt,
+		CompletedAt: r.CompletedAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+	})
+	ownerCheck := r.OwnerID
 
-	if ownerCheck != userID.(string) && !contextIsAdmin(c) {
+	if ownerCheck.String() != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
@@ -832,23 +936,28 @@ func handleRollbackDeployment(c *gin.Context) {
 		UpdatedAt:  now,
 	}
 
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO deployments
-		 (id, service_id, version, commit_hash, status, image_name, image_tag, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
-		rollback.ID, rollback.ServiceID, fmt.Sprintf("rollback-%d", now.Unix()), rollback.CommitHash, rollback.Status,
-		rollback.ImageName, rollback.ImageTag, rollback.CreatedAt, rollback.UpdatedAt,
-	)
+	err = q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID:         rollback.ID,
+		ServiceID:  rollback.ServiceID,
+		Version:    fmt.Sprintf("rollback-%d", now.Unix()),
+		CommitHash: sql.NullString{String: ptrStr(rollback.CommitHash), Valid: rollback.CommitHash != nil},
+		Status:     sql.NullString{String: rollback.Status, Valid: true},
+		ImageName:  sql.NullString{String: rollback.ImageName, Valid: true},
+		ImageTag:   sql.NullString{String: rollback.ImageTag, Valid: true},
+		CreatedAt:  sql.NullTime{Time: rollback.CreatedAt, Valid: true},
+		UpdatedAt:  sql.NullTime{Time: rollback.UpdatedAt, Valid: true},
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create rollback deployment"})
 		return
 	}
 
-	_, err = db.(*database.DB).Exec(
-		`UPDATE services SET status = 'building', updated_at = $1 WHERE id = $2`,
-		time.Now(), serviceID,
-	)
+	err = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+		Status:    sql.NullString{String: "building", Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        serviceID,
+	})
 
 	// Real rollback: redeploy the target deployment's image.
 	engineValue, _ := c.Get("deployment_engine")
@@ -864,36 +973,18 @@ func handleRollbackDeployment(c *gin.Context) {
 		if engine == nil {
 			reason = "Deployment engine unavailable. Docker may not be configured on this server."
 		}
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE deployments SET status = 'failed', error = $1, completed_at = $2, updated_at = $2 WHERE id = $3`,
-			reason, completedAt, rollbackID,
-		)
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`,
-			completedAt, serviceID,
-		)
+		_ = q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+			Error:       sql.NullString{String: reason, Valid: true},
+			CompletedAt: sql.NullTime{Time: completedAt, Valid: true},
+			ID:          rollbackID,
+		})
+		_ = q.SetServiceStatus(ctx, sqlcdb.SetServiceStatusParams{
+			Status:    sql.NullString{String: "failed", Valid: true},
+			UpdatedAt: sql.NullTime{Time: completedAt, Valid: true},
+			ID:        serviceID,
+		})
 	} else {
-		var service Service
-		_ = db.(*database.DB).QueryRow(
-			`SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
-			        s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
-			        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-			        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-			        COALESCE(s.restart_policy, 'unless-stopped'),
-			        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-			        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-			        COALESCE(s.static_dir, ''),
-			        s.created_at, s.updated_at
-			 FROM services s WHERE s.id = $1`, serviceID,
-		).Scan(
-			&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-			&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-			&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-			&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-			&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-			&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-			&service.CreatedAt, &service.UpdatedAt,
-		)
+		service, _ := loadServiceForDeploy(db.(*database.DB), serviceID)
 
 		rollbackReq := CreateDeploymentRequest{
 			CommitHash: func() string {

app/backend/internal/api/deployments_test.go

@@ -0,0 +1,46 @@
+package api
+
+import "testing"
+
+func TestSplitImageReference(t *testing.T) {
+	cases := []struct {
+		name      string
+		image     string
+		fallback  string
+		wantImage string
+		wantTag   string
+	}{
+		{"empty uses fallback tag", "", "latest", "", "latest"},
+		{"bare image", "nginx", "latest", "nginx", "latest"},
+		{"tagged image", "nginx:1.27", "latest", "nginx", "1.27"},
+		{"registry with port untagged", "registry.local:5000/app", "latest", "registry.local:5000/app", "latest"},
+		{"registry with port tagged", "registry.local:5000/app:v2", "latest", "registry.local:5000/app", "v2"},
+		{"digest stays whole", "nginx@sha256:abc123", "latest", "nginx@sha256:abc123", "latest"},
+		{"tag and digest", "nginx:1.27@sha256:abc", "latest", "nginx:1.27@sha256:abc", "latest"},
+		{"namespaced tagged", "ghcr.io/owner/repo:dev", "latest", "ghcr.io/owner/repo", "dev"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			img, tag := splitImageReference(tc.image, tc.fallback)
+			if img != tc.wantImage || tag != tc.wantTag {
+				t.Fatalf("splitImageReference(%q, %q) = (%q, %q), want (%q, %q)",
+					tc.image, tc.fallback, img, tag, tc.wantImage, tc.wantTag)
+			}
+		})
+	}
+}
+
+func TestMapEngineStatusToDBStatus(t *testing.T) {
+	cases := map[string]string{
+		"running":   "deployed",
+		"building":  "building",
+		"failed":    "failed",
+		"cancelled": "cancelled",
+		"queued":    "queued",
+	}
+	for in, want := range cases {
+		if got := mapEngineStatusToDBStatus(in); got != want {
+			t.Fatalf("mapEngineStatusToDBStatus(%q) = %q, want %q", in, got, want)
+		}
+	}
+}

app/backend/internal/api/domains.go

@@ -3,6 +3,8 @@ package api
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
+	"fmt"
 	"net"
 	"net/http"
 	"regexp"
@@ -10,6 +12,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -42,19 +45,26 @@ func validHostname(d string) bool {
 }
 
 func loadServiceDomains(db *database.DB, serviceID uuid.UUID) []ServiceDomain {
-	rows, err := db.Query(
-		`SELECT id, service_id, domain, is_default, cert_type, cert_status, last_checked_at, created_at
-		 FROM service_domains WHERE service_id = $1 ORDER BY is_default DESC, created_at ASC`, serviceID)
+	rows, err := sqlcdb.New(db.DB).ListServiceDomains(context.Background(), serviceID)
 	if err != nil {
 		return nil
 	}
-	defer rows.Close()
-	out := []ServiceDomain{}
-	for rows.Next() {
-		var d ServiceDomain
-		if err := rows.Scan(&d.ID, &d.ServiceID, &d.Domain, &d.IsDefault, &d.CertType, &d.CertStatus, &d.LastCheckedAt, &d.CreatedAt); err == nil {
-			out = append(out, d)
+	out := make([]ServiceDomain, 0, len(rows))
+	for _, r := range rows {
+		d := ServiceDomain{
+			ID:         r.ID,
+			ServiceID:  r.ServiceID,
+			Domain:     r.Domain,
+			IsDefault:  r.IsDefault,
+			CertType:   r.CertType,
+			CertStatus: r.CertStatus,
+			CreatedAt:  r.CreatedAt,
 		}
+		if r.LastCheckedAt.Valid {
+			t := r.LastCheckedAt.Time
+			d.LastCheckedAt = &t
+		}
+		out = append(out, d)
 	}
 	return out
 }
@@ -68,30 +78,95 @@ func serviceDomainNames(db *database.DB, serviceID uuid.UUID, fallback string) [
 	if len(out) == 0 && fallback != "" {
 		out = []string{fallback}
 	}
+	if len(out) == 0 {
+		out = serviceAutoDomains(db, serviceID)
+	}
+	return out
+}
+
+// dnsLabel normalizes a service name into a DNS label: lowercase alnum
+// plus single dashes, never leading/trailing, ≤63 chars.
+func dnsLabel(name string) string {
+	var b strings.Builder
+	lastWasSep := false
+	for _, r := range strings.ToLower(strings.TrimSpace(name)) {
+		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') {
+			b.WriteRune(r)
+			lastWasSep = false
+			continue
+		}
+		if !lastWasSep && b.Len() > 0 {
+			b.WriteByte('-')
+			lastWasSep = true
+		}
+	}
+	out := strings.Trim(b.String(), "-")
+	if len(out) > 63 {
+		out = strings.Trim(out[:63], "-")
+	}
+	return out
+}
+
+// serviceAutoDomains generates <service>.<node-default-domain> hostnames
+// for services with no explicit domains. Pinned services take their node's
+// base domain; spread services union every eligible node's base domain.
+// Local services get nothing — there is no instance-level base domain yet.
+func serviceAutoDomains(db *database.DB, serviceID uuid.UUID) []string {
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+	brief, err := q.GetServicePlacementBrief(ctx, serviceID)
+	if err != nil {
+		return nil
+	}
+	label := dnsLabel(brief.Name)
+	if label == "" {
+		return nil
+	}
+
+	var bases []string
+	nodeID := brief.NodeID
+	spread := brief.Spread
+	switch {
+	case nodeID.Valid && nodeID.String != "":
+		if a, err := q.GetAgent(ctx, nodeID.String); err == nil && a.DefaultDomain != "" {
+			bases = []string{a.DefaultDomain}
+		}
+	case spread:
+		var err error
+		bases, err = q.ListSchedulableAgentDomains(ctx, json.RawMessage(tagsJSON(servicePlacementTags(db, serviceID))))
+		if err != nil {
+			bases = nil
+		}
+	}
+	out := make([]string, 0, len(bases))
+	for _, base := range bases {
+		out = append(out, label+"."+base)
+	}
 	return out
 }
 
 // syncDefaultDomain writes the is_default row back to services.domain so
 // legacy reads (CLI tables, public_url) keep working.
 func syncDefaultDomain(db *database.DB, serviceID uuid.UUID) {
-	var domain string
-	err := db.QueryRow(
-		`SELECT domain FROM service_domains WHERE service_id = $1 AND is_default`, serviceID).Scan(&domain)
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+	domain, err := q.GetServiceDomainDefault(ctx, serviceID)
 	if err == sql.ErrNoRows {
-		err = db.QueryRow(
-			`SELECT domain FROM service_domains WHERE service_id = $1 ORDER BY created_at ASC LIMIT 1`, serviceID).Scan(&domain)
+		domain, err = q.GetServiceDomainFirst(ctx, serviceID)
 	}
 	if err == sql.ErrNoRows {
 		domain = ""
 	}
-	_, _ = db.Exec(`UPDATE services SET domain = $1 WHERE id = $2`, domain, serviceID)
+	_ = q.SetServiceLegacyDomain(ctx, sqlcdb.SetServiceLegacyDomainParams{Domain: domain, ID: serviceID})
 }
 
 // serviceAccess loads the maintenance/basic-auth columns for the runtime spec.
 func serviceAccess(db *database.DB, serviceID uuid.UUID) (maintenance bool, basicAuth string) {
-	_ = db.QueryRow(`SELECT maintenance_mode, basic_auth_users FROM services WHERE id = $1`, serviceID).
-		Scan(&maintenance, &basicAuth)
-	return maintenance, basicAuth
+	row, err := sqlcdb.New(db.DB).GetServiceAccess(context.Background(), serviceID)
+	if err != nil {
+		return false, ""
+	}
+	return row.MaintenanceMode, row.BasicAuthUsers
 }
 
 // maintenanceURL is the redirect target for maintenance mode — the public
@@ -136,11 +211,12 @@ func basicAuthUsernames(encoded string) []string {
 // serviceWriteAccess mirrors the service update handler's access check.
 func serviceWriteAccess(c *gin.Context, db *database.DB, serviceID uuid.UUID) bool {
 	userID, _ := c.Get("user_id")
-	var ok bool
-	err := db.QueryRow(
-		`SELECT EXISTS(SELECT 1 FROM services s JOIN projects p ON s.project_id = p.id
-			WHERE s.id = $1 AND (p.owner_id = $2 OR $3::bool))`,
-		serviceID, userID, contextIsAdmin(c)).Scan(&ok)
+	uid, _ := uuid.Parse(fmt.Sprint(userID))
+	ok, err := sqlcdb.New(db.DB).ServiceWriteAccess(context.Background(), sqlcdb.ServiceWriteAccessParams{
+		ID:      serviceID,
+		OwnerID: uid,
+		Column3: contextIsAdmin(c),
+	})
 	return err == nil && ok
 }
 
@@ -187,9 +263,11 @@ func handleAddServiceDomain(c *gin.Context) {
 		return
 	}
 
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+
 	// First domain on a service becomes the default automatically.
-	var count int
-	_ = db.(*database.DB).QueryRow(`SELECT COUNT(*) FROM service_domains WHERE service_id = $1`, serviceID).Scan(&count)
+	count, _ := q.CountServiceDomains(ctx, serviceID)
 	makeDefault := req.IsDefault || count == 0
 
 	tx, err := db.(*database.DB).Begin()
@@ -198,19 +276,18 @@ func handleAddServiceDomain(c *gin.Context) {
 		return
 	}
 	defer tx.Rollback()
+	qtx := q.WithTx(tx)
 	if makeDefault {
-		if _, err := tx.Exec(`UPDATE service_domains SET is_default = false WHERE service_id = $1`, serviceID); err != nil {
+		if err := qtx.ClearServiceDomainDefault(ctx, serviceID); err != nil {
 			respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to add domain")
 			return
 		}
 	}
-	var inserted ServiceDomain
-	err = tx.QueryRow(
-		`INSERT INTO service_domains (service_id, domain, is_default)
-		 VALUES ($1, $2, $3)
-		 RETURNING id, service_id, domain, is_default, cert_type, cert_status, created_at`,
-		serviceID, domain, makeDefault).
-		Scan(&inserted.ID, &inserted.ServiceID, &inserted.Domain, &inserted.IsDefault, &inserted.CertType, &inserted.CertStatus, &inserted.CreatedAt)
+	row, err := qtx.CreateServiceDomain(ctx, sqlcdb.CreateServiceDomainParams{
+		ServiceID: serviceID,
+		Domain:    domain,
+		IsDefault: makeDefault,
+	})
 	if err != nil {
 		if strings.Contains(err.Error(), "duplicate") || strings.Contains(err.Error(), "unique") {
 			respondError(c, http.StatusConflict, "CONFLICT", "Domain already attached to this service")
@@ -224,7 +301,15 @@ func handleAddServiceDomain(c *gin.Context) {
 		return
 	}
 	syncDefaultDomain(db.(*database.DB), serviceID)
-	c.JSON(http.StatusCreated, gin.H{"domain": inserted})
+	c.JSON(http.StatusCreated, gin.H{"domain": ServiceDomain{
+		ID:         row.ID,
+		ServiceID:  row.ServiceID,
+		Domain:     row.Domain,
+		IsDefault:  row.IsDefault,
+		CertType:   row.CertType,
+		CertStatus: row.CertStatus,
+		CreatedAt:  row.CreatedAt,
+	}})
 }
 
 func handleDeleteServiceDomain(c *gin.Context) {
@@ -247,9 +332,8 @@ func handleDeleteServiceDomain(c *gin.Context) {
 		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid domain ID")
 		return
 	}
-	res, err := db.(*database.DB).Exec(
-		`DELETE FROM service_domains WHERE id = $1 AND service_id = $2`, domainID, serviceID)
-	affected, _ := res.RowsAffected()
+	affected, err := sqlcdb.New(db.(*database.DB).DB).DeleteServiceDomain(
+		c.Request.Context(), sqlcdb.DeleteServiceDomainParams{ID: domainID, ServiceID: serviceID})
 	if err != nil || affected == 0 {
 		respondError(c, http.StatusNotFound, "NOT_FOUND", "Domain not found")
 		return
@@ -278,14 +362,12 @@ func handleSetDefaultDomain(c *gin.Context) {
 		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid domain ID")
 		return
 	}
-	res, err := db.(*database.DB).Exec(
-		`UPDATE service_domains SET is_default = (id = $1) WHERE service_id = $2`,
-		domainID, serviceID)
+	affected, err := sqlcdb.New(db.(*database.DB).DB).SetServiceDomainDefault(
+		c.Request.Context(), sqlcdb.SetServiceDomainDefaultParams{ID: domainID, ServiceID: serviceID})
 	if err != nil {
 		respondError(c, http.StatusInternalServerError, "INTERNAL", "Failed to set default domain")
 		return
 	}
-	affected, _ := res.RowsAffected()
 	if affected == 0 {
 		respondError(c, http.StatusNotFound, "NOT_FOUND", "Domain not found")
 		return
@@ -353,7 +435,7 @@ func handleCheckServiceDomains(c *gin.Context) {
 			r.Status = "ok"
 		}
 		results = append(results, r)
-		_, _ = dbh.Exec(`UPDATE service_domains SET last_checked_at = NOW() WHERE id = $1`, d.ID)
+		_ = sqlcdb.New(dbh.DB).TouchServiceDomainChecked(c.Request.Context(), d.ID)
 	}
 	c.JSON(http.StatusOK, gin.H{"domains": results})
 }

app/backend/internal/api/domains_test.go

@@ -0,0 +1,576 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/google/uuid"
+)
+
+func testDSNString(t *testing.T) string {
+	t.Helper()
+	dsn := os.Getenv("METRICS_TEST_DSN")
+	if dsn == "" {
+		dsn = os.Getenv("DATABASE_URL")
+	}
+	if dsn == "" {
+		t.Skip("METRICS_TEST_DSN not set")
+	}
+	return dsn
+}
+
+func TestDNSLabel(t *testing.T) {
+	cases := map[string]string{
+		"my-app":        "my-app",
+		"My App_2":      "my-app-2",
+		"  web  ":       "web",
+		"__weird__name": "weird-name",
+		"---":           "",
+		"":              "",
+	}
+	for in, want := range cases {
+		if got := dnsLabel(in); got != want {
+			t.Errorf("dnsLabel(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestDNSLabelLengthCap(t *testing.T) {
+	long := "a" + string(make([]byte, 0)) + "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+	if got := dnsLabel(long); len(got) > 63 {
+		t.Fatalf("label over 63 chars: %d", len(got))
+	}
+}
+
+// Live invariant test against real Postgres — set METRICS_TEST_DSN (or
+// DATABASE_URL). Verifies the generated domain queries preserve the
+// default-domain and legacy services.domain invariants.
+func TestServiceDomainsLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	suffix := strings.ReplaceAll(serviceID.String()[:8], "-", "")
+
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "domtest-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "domtest-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type)
+		VALUES ($1, 'domtest-`+suffix+`', $2, $3, 'web', 'image')`,
+		serviceID, projectID, envID)
+	must(err)
+	defer func() {
+		_, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID)
+	}()
+
+	d1, err := q.CreateServiceDomain(ctx, sqlcdb.CreateServiceDomainParams{
+		ServiceID: serviceID, Domain: "a-" + suffix + ".example.com", IsDefault: true})
+	if err != nil {
+		t.Fatalf("create d1: %v", err)
+	}
+	d2, err := q.CreateServiceDomain(ctx, sqlcdb.CreateServiceDomainParams{
+		ServiceID: serviceID, Domain: "b-" + suffix + ".example.com", IsDefault: false})
+	if err != nil {
+		t.Fatalf("create d2: %v", err)
+	}
+
+	syncDefaultDomain(db, serviceID)
+	var legacy string
+	if err := db.QueryRow(`SELECT domain FROM services WHERE id = $1`, serviceID).Scan(&legacy); err != nil {
+		t.Fatalf("read legacy: %v", err)
+	}
+	if legacy != d1.Domain {
+		t.Fatalf("legacy domain = %q, want %q", legacy, d1.Domain)
+	}
+
+	// Switch default: exactly one row stays default, legacy follows.
+	if err := q.ClearServiceDomainDefault(ctx, serviceID); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	if _, err := q.SetServiceDomainDefault(ctx, sqlcdb.SetServiceDomainDefaultParams{
+		ID: d2.ID, ServiceID: serviceID}); err != nil {
+		t.Fatalf("set default: %v", err)
+	}
+	syncDefaultDomain(db, serviceID)
+	if err := db.QueryRow(`SELECT domain FROM services WHERE id = $1`, serviceID).Scan(&legacy); err != nil {
+		t.Fatalf("read legacy2: %v", err)
+	}
+	if legacy != d2.Domain {
+		t.Fatalf("legacy after switch = %q, want %q", legacy, d2.Domain)
+	}
+
+	doms := loadServiceDomains(db, serviceID)
+	if len(doms) != 2 || !doms[0].IsDefault || doms[0].Domain != d2.Domain {
+		t.Fatalf("list order wrong: %+v", doms)
+	}
+
+	// Deleting the default falls back to the remaining domain.
+	if _, err := q.DeleteServiceDomain(ctx, sqlcdb.DeleteServiceDomainParams{
+		ID: d2.ID, ServiceID: serviceID}); err != nil {
+		t.Fatalf("delete d2: %v", err)
+	}
+	syncDefaultDomain(db, serviceID)
+	if err := db.QueryRow(`SELECT domain FROM services WHERE id = $1`, serviceID).Scan(&legacy); err != nil {
+		t.Fatalf("read legacy3: %v", err)
+	}
+	if legacy != d1.Domain {
+		t.Fatalf("legacy after delete = %q, want %q", legacy, d1.Domain)
+	}
+}
+
+// Live clone test: cloneServiceRow must copy config, domains, and variables
+// verbatim, start stopped, and land in the target project/environment.
+func TestCloneServiceRowLive(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	suffix := strings.ReplaceAll(serviceID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "clone-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "clone-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type,
+		image_name, port, volumes, traefik_labels, maintenance_mode)
+		VALUES ($1, $2, $3, $4, 'web', 'image', 'traefik/whoami:latest', 80,
+			'[{"mount":"/data"}]'::jsonb,
+			'{"middlewares.rl.ratelimit.average":"100"}'::jsonb, true)`,
+		serviceID, "clonesrc-"+suffix, projectID, envID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	if _, err := q.CreateServiceDomain(ctx, sqlcdb.CreateServiceDomainParams{
+		ServiceID: serviceID, Domain: "src-" + suffix + ".example.com", IsDefault: true}); err != nil {
+		t.Fatalf("seed domain: %v", err)
+	}
+	if _, err := db.Exec(`INSERT INTO environment_variables (id, service_id, key, value, is_secret)
+		VALUES ($1, $2, 'FOO', 'bar', false)`, uuid.New(), serviceID); err != nil {
+		t.Fatalf("seed var: %v", err)
+	}
+
+	cloneID, err := cloneServiceRow(db, serviceID, projectID, "clone-"+suffix, "")
+	if err != nil {
+		t.Fatalf("clone: %v", err)
+	}
+
+	var status, imageName, env string
+	var maintenance bool
+	var volumes, labels []byte
+	if err := db.QueryRow(`SELECT status, image_name, COALESCE(environment,''), maintenance_mode,
+		volumes, traefik_labels FROM services WHERE id = $1`, cloneID).
+		Scan(&status, &imageName, &env, &maintenance, &volumes, &labels); err != nil {
+		t.Fatalf("read clone: %v", err)
+	}
+	if status != "stopped" || imageName != "traefik/whoami:latest" || env != "production" {
+		t.Fatalf("clone mismatch: %v %v %v", status, imageName, env)
+	}
+	if !maintenance || string(volumes) == "[]" || string(labels) == "{}" {
+		t.Fatalf("clone dropped config: maint=%v vol=%s labels=%s", maintenance, volumes, labels)
+	}
+	doms := loadServiceDomains(db, cloneID)
+	if len(doms) != 1 || doms[0].Domain != "src-"+suffix+".example.com" || !doms[0].IsDefault {
+		t.Fatalf("domains not cloned: %+v", doms)
+	}
+	var varVal string
+	if err := db.QueryRow(`SELECT value FROM environment_variables WHERE service_id = $1 AND key = 'FOO'`,
+		cloneID).Scan(&varVal); err != nil || varVal != "bar" {
+		t.Fatalf("vars not cloned: %v %q", err, varVal)
+	}
+}
+
+// Live preview-environment test: generated queries must preserve the
+// access-check join, the status-sync CASE, and the sweep listing.
+func TestPreviewEnvironmentsLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	srcID := uuid.New()
+	cloneID := uuid.New()
+	previewID := uuid.New()
+	suffix := strings.ReplaceAll(previewID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "prev-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "prev-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	for _, p := range [][3]interface{}{{srcID, "src-" + suffix, "running"}, {cloneID, "clone-" + suffix, "running"}} {
+		_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type, status)
+			VALUES ($1, $2, $3, $4, 'web', 'image', $5)`,
+			p[0], p[1], projectID, envID, p[2])
+		must(err)
+	}
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	must(q.CreatePreviewEnvironment(ctx, sqlcdb.CreatePreviewEnvironmentParams{
+		ID:               previewID,
+		ProjectID:        projectID,
+		ServiceID:        srcID,
+		PreviewServiceID: uuid.NullUUID{UUID: cloneID, Valid: true},
+		BranchName:       "feat-" + suffix,
+		Environment:      "preview-feat-" + suffix,
+		Status:           "building",
+		ExpiresAt:        time.Now().Add(-time.Hour), // already past TTL → sweepable
+	}))
+
+	// List + service join.
+	rows, err := q.ListPreviewEnvironmentsForProject(ctx, projectID)
+	if err != nil || len(rows) != 1 {
+		t.Fatalf("list: %v %d", err, len(rows))
+	}
+	if rows[0].ID != previewID || !rows[0].SvcID.Valid || rows[0].ServiceName.String != "src-"+suffix {
+		t.Fatalf("list row: %+v", rows[0])
+	}
+
+	// Access-check join: owner reads; a stranger does not.
+	if _, err := q.GetPreviewEnvironment(ctx, sqlcdb.GetPreviewEnvironmentParams{
+		ID: previewID, OwnerID: userID}); err != nil {
+		t.Fatalf("owner read: %v", err)
+	}
+	if _, err := q.GetPreviewEnvironment(ctx, sqlcdb.GetPreviewEnvironmentParams{
+		ID: previewID, OwnerID: uuid.New()}); err != nil {
+		t.Fatalf("approved project should be public-read: %v", err)
+	}
+
+	// Status sync folds clone's 'running' into the preview row.
+	if err := q.SyncPreviewStatuses(ctx); err != nil {
+		t.Fatalf("sync: %v", err)
+	}
+	var status string
+	if err := db.QueryRow(`SELECT status FROM preview_environments WHERE id = $1`, previewID).Scan(&status); err != nil {
+		t.Fatalf("read status: %v", err)
+	}
+	if status != "running" {
+		t.Fatalf("status after sync = %q, want running", status)
+	}
+
+	// TTL sweep picks it up (expired at insert), marks expired.
+	sweep, err := q.ListSweepablePreviews(ctx)
+	if err != nil {
+		t.Fatalf("sweep list: %v", err)
+	}
+	found := false
+	for _, s := range sweep {
+		if s.ID == previewID && s.PreviewServiceID.UUID == cloneID {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("sweepable list missing preview: %+v", sweep)
+	}
+	must(q.MarkPreviewEnvironmentStatus(ctx, sqlcdb.MarkPreviewEnvironmentStatusParams{Status: "expired", ID: previewID}))
+	sweep, _ = q.ListSweepablePreviews(ctx)
+	for _, s := range sweep {
+		if s.ID == previewID {
+			t.Fatal("expired preview still sweepable")
+		}
+	}
+
+	// Owner lookup and delete.
+	owner, err := q.GetPreviewEnvironmentOwner(ctx, previewID)
+	if err != nil || owner != userID {
+		t.Fatalf("owner: %v %v", owner, err)
+	}
+	must(q.DeletePreviewEnvironment(ctx, previewID))
+}
+
+// Live deployment lifecycle: generated queries preserve list ordering,
+// the access join, and the status-transition writes.
+func TestDeploymentsLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	deployID := uuid.New()
+	suffix := strings.ReplaceAll(deployID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "dep-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "dep-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type, status)
+		VALUES ($1, $2, $3, $4, 'web', 'image', 'running')`,
+		serviceID, "dep-"+suffix, projectID, envID)
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	must(q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID:        deployID,
+		ServiceID: serviceID,
+		Version:   "v1-" + suffix,
+		Status:    sql.NullString{String: "pending", Valid: true},
+	}))
+	total, err := q.CountDeploymentsForService(ctx, serviceID)
+	if err != nil || total != 1 {
+		t.Fatalf("count: %v %d", err, total)
+	}
+	rows, err := q.ListDeploymentsForService(ctx, sqlcdb.ListDeploymentsForServiceParams{
+		ServiceID: serviceID, Limit: 10, Offset: 0})
+	if err != nil || len(rows) != 1 || rows[0].ID != deployID {
+		t.Fatalf("list: %v %+v", err, rows)
+	}
+
+	// Access join returns owner.
+	access, err := q.GetDeploymentAccess(ctx, deployID)
+	if err != nil || access.OwnerID != userID || access.ServiceID != serviceID {
+		t.Fatalf("access: %v %+v", err, access)
+	}
+
+	// Recent feed honors the access predicate.
+	feed, err := q.ListRecentAccessibleDeployments(ctx, sqlcdb.ListRecentAccessibleDeploymentsParams{
+		OwnerID: userID, Limit: 10, Offset: 0})
+	if err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	found := false
+	for _, d := range feed {
+		if d.ID == deployID && d.ServiceName == "dep-"+suffix {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("feed missing deployment: %+v", feed)
+	}
+
+	// Status transitions.
+	must(q.SetDeploymentStatus(ctx, sqlcdb.SetDeploymentStatusParams{
+		Status: sql.NullString{String: "queued", Valid: true}, UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true}, ID: deployID}))
+	must(q.SyncDeploymentProgress(ctx, sqlcdb.SyncDeploymentProgressParams{
+		Status:    sql.NullString{String: "deployed", Valid: true},
+		ImageName: sql.NullString{String: "nginx", Valid: true},
+		ImageTag:  sql.NullString{String: "alpine", Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        deployID,
+	}))
+	r, err := q.GetDeploymentWithProject(ctx, deployID)
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	if r.Status.String != "deployed" || r.ImageName.String != "nginx" || r.ProjectID != projectID {
+		t.Fatalf("post-sync row: %+v", r)
+	}
+	must(q.FailDeployment(ctx, sqlcdb.FailDeploymentParams{
+		Error:       sql.NullString{String: "boom", Valid: true},
+		CompletedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:          deployID,
+	}))
+	r, _ = q.GetDeploymentWithProject(ctx, deployID)
+	if r.Status.String != "failed" || r.Error.String != "boom" {
+		t.Fatalf("post-fail row: %+v", r)
+	}
+}
+
+// TestRuntimeLiveInvariants exercises the runtime.sql queries: the
+// legacy-column COALESCE chain in GetServiceRuntimeWithOwner, the
+// deployed-image concat, and the conditional published-port update.
+func TestRuntimeLiveInvariants(t *testing.T) {
+	dsn := testDSNString(t)
+	db, err := database.NewConnection(dsn)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	defer db.Close()
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	userID := uuid.New()
+	projectID := uuid.New()
+	envID := uuid.New()
+	serviceID := uuid.New()
+	suffix := strings.ReplaceAll(serviceID.String()[:8], "-", "")
+	must := func(err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("setup: %v", err)
+		}
+	}
+	_, err = db.Exec(`INSERT INTO users (id, email, password_hash, name) VALUES ($1, $2, 'x', 'test')`,
+		userID, "rt-"+suffix+"@test.local")
+	must(err)
+	_, err = db.Exec(`INSERT INTO projects (id, name, owner_id, is_approved) VALUES ($1, $2, $3, true)`,
+		projectID, "rt-"+suffix, userID)
+	must(err)
+	_, err = db.Exec(`INSERT INTO environments (id, name, project_id) VALUES ($1, 'production', $2)`,
+		envID, projectID)
+	must(err)
+	// Only legacy columns populated — the COALESCE chain must surface them.
+	_, err = db.Exec(`INSERT INTO services (id, name, project_id, environment_id, service_type, source_type,
+		source_url, image_name, start_command, port) VALUES ($1, $2, $3, $4, 'worker', 'git', $5, $6, 'run.sh', 8080)`,
+		serviceID, "rt-"+suffix, projectID, envID, "https://git.example/x.git", "repo/img:latest")
+	must(err)
+	defer func() { _, _ = db.Exec(`DELETE FROM users WHERE id = $1`, userID) }()
+
+	row, err := q.GetServiceRuntimeWithOwner(ctx, serviceID)
+	if err != nil {
+		t.Fatalf("runtime row: %v", err)
+	}
+	if row.Type != "worker" || row.Image != "repo/img:latest" || row.Command != "run.sh" ||
+		row.GitRepo != "https://git.example/x.git" || row.OwnerID != userID {
+		t.Fatalf("COALESCE chain lost legacy columns: %+v", row)
+	}
+	svc := serviceFromRuntimeRow(row)
+	if svc.Type != "worker" || svc.Image != "repo/img:latest" || svc.Port != 8080 {
+		t.Fatalf("mapped service wrong: %+v", svc)
+	}
+
+	// Sibling refs + port lookup.
+	refs, err := q.ListProjectServiceRefs(ctx, projectID)
+	if err != nil || len(refs) != 1 || refs[0].Name != "rt-"+suffix {
+		t.Fatalf("refs: %v %+v", err, refs)
+	}
+	port, err := q.GetServicePort(ctx, serviceID)
+	if err != nil || port != 8080 {
+		t.Fatalf("port: %v %d", err, port)
+	}
+
+	// Variables round-trip.
+	_, err = db.Exec(`INSERT INTO environment_variables (id, service_id, key, value, is_secret)
+		VALUES (gen_random_uuid(), $1, 'API_KEY', 'shh', true), (gen_random_uuid(), $1, 'PLAIN', 'p', false)`,
+		serviceID)
+	must(err)
+	vars, err := q.ListServiceVariablesWithSecret(ctx, serviceID)
+	if err != nil || len(vars) != 2 {
+		t.Fatalf("vars: %v %+v", err, vars)
+	}
+	vals, err := q.ListServiceVariableValues(ctx, serviceID)
+	if err != nil || len(vals) != 2 {
+		t.Fatalf("vals: %v %+v", err, vals)
+	}
+	got, err := q.GetServiceVariableValue(ctx, sqlcdb.GetServiceVariableValueParams{ServiceID: serviceID, Key: "API_KEY"})
+	if err != nil || got != "shh" {
+		t.Fatalf("var value: %v %q", err, got)
+	}
+
+	// Node agent listing through container_instances.
+	_, err = db.Exec(`INSERT INTO node_agents (id, name, hostname, ip_address, port) VALUES ($1, $2, 'h', '127.0.0.1', 9999)`,
+		"agent-"+suffix, "agent-"+suffix)
+	must(err)
+	_, err = db.Exec(`INSERT INTO container_instances (id, name, image, project_id, service_id, node_agent_id)
+		VALUES ($1, 'c', 'img', $2, $3, $4)`,
+		"ci-"+suffix, projectID.String(), serviceID.String(), "agent-"+suffix)
+	must(err)
+	agents, err := q.ListNodeAgentsForService(ctx, serviceID.String())
+	if err != nil || len(agents) != 1 || agents[0] != "agent-"+suffix {
+		t.Fatalf("agents: %v %+v", err, agents)
+	}
+
+	// Last deployed image: only 'deployed' rows, latest first.
+	d1, d2 := uuid.New(), uuid.New()
+	must(q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID: d1, ServiceID: serviceID, Version: "v1",
+		Status: sql.NullString{String: "failed", Valid: true},
+	}))
+	must(q.InsertDeployment(ctx, sqlcdb.InsertDeploymentParams{
+		ID: d2, ServiceID: serviceID, Version: "v2",
+		Status: sql.NullString{String: "deployed", Valid: true},
+	}))
+	must(q.SyncDeploymentProgress(ctx, sqlcdb.SyncDeploymentProgressParams{
+		Status:    sql.NullString{String: "deployed", Valid: true},
+		ImageName: sql.NullString{String: "app", Valid: true},
+		ImageTag:  sql.NullString{String: "v2", Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        d2,
+	}))
+	img, err := q.GetLastDeployedImage(ctx, serviceID)
+	if err != nil || img != "app:v2" {
+		t.Fatalf("last image: %v %q", err, img)
+	}
+
+	// Conditional published-port update: writes once, no-ops on repeat.
+	must(q.SetServicePublishedPort(ctx, sqlcdb.SetServicePublishedPortParams{PublishedPort: 30001, ID: serviceID}))
+	p, err := q.GetServicePublishedPort(ctx, serviceID)
+	if err != nil || p != 30001 {
+		t.Fatalf("published port: %v %d", err, p)
+	}
+	must(q.SetServiceReplicas(ctx, sqlcdb.SetServiceReplicasParams{
+		Replicas: 3, UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true}, ID: serviceID}))
+	row, _ = q.GetServiceRuntimeWithOwner(ctx, serviceID)
+	if row.Replicas != 3 {
+		t.Fatalf("replicas: %+v", row)
+	}
+}

app/backend/internal/api/environments.go

@@ -0,0 +1,140 @@
+package api
+
+// Project environments — the named lanes services deploy into
+// (production/development/preview are seeded; custom names allowed).
+
+import (
+	"context"
+	"net/http"
+	"regexp"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+var envNamePattern = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,48}[a-z0-9])?$`)
+
+type environmentDTO struct {
+	ID           uuid.UUID `json:"id"`
+	Name         string    `json:"name"`
+	ProjectID    uuid.UUID `json:"project_id"`
+	CreatedAt    time.Time `json:"created_at"`
+	UpdatedAt    time.Time `json:"updated_at"`
+	ServiceCount int64     `json:"service_count"`
+}
+
+func toEnvironmentDTO(id uuid.UUID, name string, projectID uuid.UUID, created, updated time.Time, count int64) environmentDTO {
+	return environmentDTO{ID: id, Name: name, ProjectID: projectID, CreatedAt: created, UpdatedAt: updated, ServiceCount: count}
+}
+
+// handleListEnvironments returns the project's environments with live
+// service counts — the data behind the env switcher.
+func handleListEnvironments(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	projectID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid project ID")
+		return
+	}
+	if exists, allowed := projectReadAccess(c, db, projectID); !exists || !allowed {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Project not found")
+		return
+	}
+	rows, err := sqlcdb.New(db.DB).ListProjectEnvironments(context.Background(), projectID)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to list environments")
+		return
+	}
+	envs := make([]environmentDTO, 0, len(rows))
+	for _, r := range rows {
+		envs = append(envs, toEnvironmentDTO(r.ID, r.Name, r.ProjectID, r.CreatedAt.Time, r.UpdatedAt.Time, r.ServiceCount))
+	}
+	c.JSON(http.StatusOK, gin.H{"environments": envs})
+}
+
+// handleCreateEnvironment adds a named environment lane to the project.
+func handleCreateEnvironment(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	projectID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid project ID")
+		return
+	}
+	userID, exists := c.Get("user_id")
+	if !exists || !ownsProject(db, projectID, userID.(string), contextIsAdmin(c)) {
+		respondError(c, http.StatusForbidden, "FORBIDDEN", "Access denied")
+		return
+	}
+	var req struct {
+		Name string `json:"name" binding:"required"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "name is required")
+		return
+	}
+	name := strings.ToLower(strings.TrimSpace(req.Name))
+	if !envNamePattern.MatchString(name) {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Name must be lowercase alphanumeric with dashes, 1-50 chars")
+		return
+	}
+	q := sqlcdb.New(db.DB)
+	if _, err := q.GetProjectEnvironmentByName(context.Background(), sqlcdb.GetProjectEnvironmentByNameParams{
+		ProjectID: projectID, Name: name,
+	}); err == nil {
+		respondError(c, http.StatusConflict, "CONFLICT", "Environment already exists")
+		return
+	}
+	if err := q.InsertProjectEnvironment(context.Background(), sqlcdb.InsertProjectEnvironmentParams{
+		Name: name, ProjectID: projectID,
+	}); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create environment")
+		return
+	}
+	env, _ := q.GetProjectEnvironmentByName(context.Background(), sqlcdb.GetProjectEnvironmentByNameParams{
+		ProjectID: projectID, Name: name,
+	})
+	LogAuditWithRequest(c, "project", projectID.String(), "environment.create", map[string]interface{}{"name": name})
+	c.JSON(http.StatusCreated, gin.H{"environment": toEnvironmentDTO(env.ID, env.Name, env.ProjectID, env.CreatedAt.Time, env.UpdatedAt.Time, 0)})
+}
+
+// handleDeleteEnvironment removes an environment that holds no services.
+func handleDeleteEnvironment(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	envID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid environment ID")
+		return
+	}
+	userID, exists := c.Get("user_id")
+	if !exists {
+		respondError(c, http.StatusUnauthorized, "UNAUTHORIZED", "User not authenticated")
+		return
+	}
+	var projectID uuid.UUID
+	if err := db.QueryRow(`SELECT project_id FROM environments WHERE id = $1`, envID).Scan(&projectID); err != nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Environment not found")
+		return
+	}
+	if !ownsProject(db, projectID, userID.(string), contextIsAdmin(c)) {
+		respondError(c, http.StatusForbidden, "FORBIDDEN", "Access denied")
+		return
+	}
+	q := sqlcdb.New(db.DB)
+	if n, err := q.CountEnvironmentServices(context.Background(), envID); err == nil && n > 0 {
+		respondError(c, http.StatusConflict, "CONFLICT", "Environment still contains services — move them first")
+		return
+	}
+	if err := q.DeleteProjectEnvironment(context.Background(), sqlcdb.DeleteProjectEnvironmentParams{
+		ID: envID, ProjectID: projectID,
+	}); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to delete environment")
+		return
+	}
+	LogAuditWithRequest(c, "project", projectID.String(), "environment.delete", map[string]interface{}{"environment_id": envID.String()})
+	c.JSON(http.StatusOK, gin.H{"message": "Environment deleted"})
+}

app/backend/internal/api/gateway_proxy.go

@@ -0,0 +1,311 @@
+package api
+
+// Data plane for the public API gateway: /g/:slug/* proxies to the
+// upstream_url of the matching api_services row. Callers authenticate with
+// api_keys (X-API-Key or Authorization: Bearer), pass the rpm + monthly
+// quota gates, and every request lands in usage_counters /
+// metrics_timeseries / incident_events for the /admin/gateway analytics
+// surfaces.
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/gateway"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
+)
+
+// jarvis: ceiling — a single shared transport; per-request timeouts come
+// from api_services.request_timeout_ms on the request context.
+var gatewayHTTPClient = &http.Client{
+	Transport: &http.Transport{
+		MaxIdleConns:        100,
+		MaxIdleConnsPerHost: 10,
+		IdleConnTimeout:     90 * time.Second,
+	},
+}
+
+// gatewayRPM is a process-local per-minute counter map. Containr runs a
+// single API process, so an in-memory bucket is sufficient — a multi-node
+// control plane would need a Redis-backed limiter instead.
+var gatewayRPM = struct {
+	sync.Mutex
+	buckets map[string]*rpmBucket
+}{buckets: map[string]*rpmBucket{}}
+
+type rpmBucket struct {
+	window time.Time
+	count  int
+}
+
+// gatewayRateAllow returns false when the bucket for the current minute has
+// already reached limit. A limit <= 0 disables the check. `now` is injected
+// so tests can freeze the window.
+func gatewayRateAllow(bucketKey string, limit int, now time.Time) bool {
+	if limit <= 0 {
+		return true
+	}
+	window := now.Truncate(time.Minute)
+	gatewayRPM.Lock()
+	defer gatewayRPM.Unlock()
+	b := gatewayRPM.buckets[bucketKey]
+	if b == nil || !b.window.Equal(window) {
+		b = &rpmBucket{window: window}
+		gatewayRPM.buckets[bucketKey] = b
+		// Best-effort sweep so the map cannot grow without bound.
+		for k, old := range gatewayRPM.buckets {
+			if old.window.Before(window.Add(-time.Minute)) {
+				delete(gatewayRPM.buckets, k)
+			}
+		}
+	}
+	b.count++
+	return b.count <= limit
+}
+
+type gatewayService struct {
+	ID                 string
+	UpstreamURL        string
+	RoutePrefix        string
+	UpstreamAuthHeader sql.NullString
+	UpstreamAuthValue  sql.NullString
+	Enabled            bool
+	RPMLimit           sql.NullInt64
+	MonthlyQuota       sql.NullInt64
+	RequestTimeoutMS   int
+}
+
+type gatewayKey struct {
+	ID                string
+	Hash              string
+	Enabled           bool
+	RPMLimit          sql.NullInt64
+	MonthlyQuota      sql.NullInt64
+	AllowedServiceIDs string
+}
+
+// extractGatewayKey reads the caller's API key from X-API-Key first, then
+// Authorization: Bearer.
+func extractGatewayKey(c *gin.Context) string {
+	if k := strings.TrimSpace(c.GetHeader("X-API-Key")); k != "" {
+		return k
+	}
+	auth := strings.TrimSpace(c.GetHeader("Authorization"))
+	if len(auth) > 7 && strings.EqualFold(auth[:7], "Bearer ") {
+		return strings.TrimSpace(auth[7:])
+	}
+	return ""
+}
+
+// lookupGatewayService resolves the slug to an enabled service row.
+func lookupGatewayService(ctx context.Context, db *database.DB, slug string) (*gatewayService, error) {
+	var s gatewayService
+	var enabled int
+	err := db.QueryRowContext(ctx, `
+		SELECT id, upstream_url, route_prefix, upstream_auth_header,
+		       upstream_auth_value, enabled, rpm_limit, monthly_quota,
+		       request_timeout_ms
+		FROM api_services WHERE slug = $1
+	`, slug).Scan(&s.ID, &s.UpstreamURL, &s.RoutePrefix,
+		&s.UpstreamAuthHeader, &s.UpstreamAuthValue, &enabled,
+		&s.RPMLimit, &s.MonthlyQuota, &s.RequestTimeoutMS)
+	if err != nil {
+		return nil, err
+	}
+	s.Enabled = enabled != 0
+	return &s, nil
+}
+
+// authenticateGatewayKey resolves a presented key by its indexed prefix and
+// bcrypt-verifies candidates. Returns nil when nothing matches.
+func authenticateGatewayKey(ctx context.Context, db *database.DB, presented string) (*gatewayKey, error) {
+	prefix := presented
+	if len(prefix) > 8 {
+		prefix = prefix[:8]
+	}
+	rows, err := db.QueryContext(ctx, `
+		SELECT id, key_hash, enabled, rpm_limit, monthly_quota, allowed_service_ids
+		FROM api_keys WHERE key_prefix = $1
+	`, prefix)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var k gatewayKey
+		var enabled int
+		if err := rows.Scan(&k.ID, &k.Hash, &enabled, &k.RPMLimit, &k.MonthlyQuota, &k.AllowedServiceIDs); err != nil {
+			return nil, err
+		}
+		k.Enabled = enabled != 0
+		if bcrypt.CompareHashAndPassword([]byte(k.Hash), []byte(presented)) == nil {
+			return &k, nil
+		}
+	}
+	return nil, rows.Err()
+}
+
+// keyAllowsService applies the allowed_service_ids JSON allowlist. An empty
+// list means the key may call every service.
+func keyAllowsService(k *gatewayKey, serviceID string) bool {
+	var allowed []string
+	if err := json.Unmarshal([]byte(k.AllowedServiceIDs), &allowed); err != nil || len(allowed) == 0 {
+		return true
+	}
+	for _, id := range allowed {
+		if id == serviceID {
+			return true
+		}
+	}
+	return false
+}
+
+// monthlyUsage sums a counter dimension for the current calendar month.
+func monthlyUsage(ctx context.Context, db *database.DB, column, id, period string) (int, error) {
+	var total int
+	err := db.QueryRowContext(ctx, `
+		SELECT COALESCE(SUM(request_count), 0) FROM usage_counters
+		WHERE `+column+` = $1 AND period_month = $2
+	`, id, period).Scan(&total)
+	return total, err
+}
+
+// recordGatewayRequest persists usage, metrics, and failure incidents for a
+// proxied call. Runs in the request path but is three small writes.
+func recordGatewayRequest(ctx context.Context, db *database.DB, svc *gatewayService, k *gatewayKey, status int, period string) {
+	_, _ = db.ExecContext(ctx, `
+		INSERT INTO usage_counters (api_key_id, service_id, period_month, request_count, updated_at)
+		VALUES ($1, $2, $3, 1, NOW())
+		ON CONFLICT (api_key_id, service_id, period_month)
+		DO UPDATE SET request_count = usage_counters.request_count + 1, updated_at = NOW()
+	`, k.ID, svc.ID, period)
+	_, _ = db.ExecContext(ctx, `
+		UPDATE api_keys SET last_used_at = NOW() WHERE id = $1
+	`, k.ID)
+	labels, _ := json.Marshal(map[string]interface{}{
+		"service_id": svc.ID,
+		"key_id":     k.ID,
+		"status":     status,
+	})
+	_, _ = db.ExecContext(ctx, `
+		INSERT INTO metrics_timeseries (metric, value, labels_json, occurred_at)
+		VALUES ('gateway_request', 1, $1, NOW())
+	`, string(labels))
+}
+
+func recordGatewayIncident(ctx context.Context, db *database.DB, svcID string, keyID *string, code, msg, severity string, status int) {
+	var kid interface{}
+	if keyID != nil {
+		kid = *keyID
+	}
+	_, _ = db.ExecContext(ctx, `
+		INSERT INTO incident_events (service_id, api_key_id, code, message, severity, http_status, occurred_at)
+		VALUES ($1, $2, $3, $4, $5, $6, NOW())
+	`, svcID, kid, code, msg, severity, status)
+}
+
+// handleGatewayProxy is mounted at /g/:slug and /g/:slug/*path on the root
+// router — outside /api/v1 so route_prefix stays clean.
+func handleGatewayProxy(c *gin.Context) {
+	db := c.MustGet("db").(*database.DB)
+	ctx := c.Request.Context()
+	slug := c.Param("slug")
+
+	svc, err := lookupGatewayService(ctx, db, slug)
+	if err == sql.ErrNoRows {
+		respondError(c, http.StatusNotFound, "SERVICE_NOT_FOUND", "Gateway service not found")
+		return
+	}
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to resolve gateway service")
+		return
+	}
+	if !svc.Enabled {
+		respondError(c, http.StatusServiceUnavailable, "SERVICE_DISABLED", "Gateway service is disabled")
+		return
+	}
+
+	presented := extractGatewayKey(c)
+	if presented == "" {
+		recordGatewayIncident(ctx, db, svc.ID, nil, "MISSING_API_KEY", "Request without API key", "low", http.StatusUnauthorized)
+		respondError(c, http.StatusUnauthorized, "API_KEY_REQUIRED", "An API key is required for this service")
+		return
+	}
+	key, err := authenticateGatewayKey(ctx, db, presented)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to authenticate API key")
+		return
+	}
+	// Disabled and unknown keys collapse to the same 401 — a disabled key
+	// must not leak its existence.
+	if key == nil || !key.Enabled {
+		recordGatewayIncident(ctx, db, svc.ID, nil, "INVALID_API_KEY", "Request with invalid or disabled API key", "low", http.StatusUnauthorized)
+		respondError(c, http.StatusUnauthorized, "INVALID_API_KEY", "Invalid API key")
+		return
+	}
+	if !keyAllowsService(key, svc.ID) {
+		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "KEY_SCOPE_DENIED", "API key not allowed on this service", "medium", http.StatusForbidden)
+		respondError(c, http.StatusForbidden, "KEY_SCOPE_DENIED", "API key is not permitted for this service")
+		return
+	}
+
+	now := time.Now()
+	if !gatewayRateAllow("key:"+key.ID, int(key.RPMLimit.Int64), now) ||
+		!gatewayRateAllow("svc:"+svc.ID, int(svc.RPMLimit.Int64), now) {
+		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "RATE_LIMITED", "Per-minute rate limit exceeded", "medium", http.StatusTooManyRequests)
+		respondError(c, http.StatusTooManyRequests, "RATE_LIMITED", "Rate limit exceeded")
+		return
+	}
+
+	period := now.Format("2006-01")
+	if key.MonthlyQuota.Valid && key.MonthlyQuota.Int64 > 0 {
+		if used, err := monthlyUsage(ctx, db, "api_key_id", key.ID, period); err == nil && int64(used) >= key.MonthlyQuota.Int64 {
+			respondError(c, http.StatusTooManyRequests, "QUOTA_EXCEEDED", "Monthly request quota exceeded")
+			return
+		}
+	}
+	if svc.MonthlyQuota.Valid && svc.MonthlyQuota.Int64 > 0 {
+		if used, err := monthlyUsage(ctx, db, "service_id", svc.ID, period); err == nil && int64(used) >= svc.MonthlyQuota.Int64 {
+			respondError(c, http.StatusTooManyRequests, "QUOTA_EXCEEDED", "Service monthly quota exceeded")
+			return
+		}
+	}
+
+	target, err := gateway.BuildTargetURL(svc.UpstreamURL, svc.RoutePrefix, c.Request.URL.Path, c.Request.URL.RawQuery)
+	if err != nil {
+		respondError(c, http.StatusBadGateway, "UPSTREAM_URL_INVALID", "Gateway upstream is misconfigured")
+		return
+	}
+	headers := map[string]string{}
+	if svc.UpstreamAuthHeader.Valid && svc.UpstreamAuthHeader.String != "" {
+		headers[svc.UpstreamAuthHeader.String] = svc.UpstreamAuthValue.String
+	}
+
+	timeout := time.Duration(svc.RequestTimeoutMS) * time.Millisecond
+	if timeout <= 0 {
+		timeout = 8 * time.Second
+	}
+	reqCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	status, _, err := gateway.ProxyRequest(gatewayHTTPClient, c.Writer, c.Request.WithContext(reqCtx), target, headers)
+	if err != nil {
+		recordGatewayIncident(reqCtx, db, svc.ID, &key.ID, "UPSTREAM_ERROR", err.Error(), "high", http.StatusBadGateway)
+		recordGatewayRequest(ctx, db, svc, key, http.StatusBadGateway, period)
+		respondError(c, http.StatusBadGateway, "UPSTREAM_ERROR", "Upstream request failed")
+		return
+	}
+
+	recordGatewayRequest(ctx, db, svc, key, status, period)
+	if status >= 500 {
+		recordGatewayIncident(ctx, db, svc.ID, &key.ID, "UPSTREAM_5XX", "Upstream returned "+http.StatusText(status), "high", status)
+	}
+}

app/backend/internal/api/gateway_proxy_test.go

@@ -0,0 +1,81 @@
+package api
+
+import (
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestGatewayRateAllow(t *testing.T) {
+	now := time.Date(2026, 10, 15, 12, 0, 30, 0, time.UTC)
+
+	for i := 0; i < 3; i++ {
+		if !gatewayRateAllow("test:a", 3, now) {
+			t.Fatalf("call %d within limit rejected", i+1)
+		}
+	}
+	if gatewayRateAllow("test:a", 3, now) {
+		t.Fatal("call beyond limit allowed")
+	}
+	if !gatewayRateAllow("test:a", 3, now.Add(time.Minute)) {
+		t.Fatal("new minute window still rejected")
+	}
+	if !gatewayRateAllow("test:unlimited", 0, now) {
+		t.Fatal("non-positive limit should disable the check")
+	}
+}
+
+func TestExtractGatewayKey(t *testing.T) {
+	mkctx := func(headers map[string]string) *gin.Context {
+		c, _ := gin.CreateTestContext(httptest.NewRecorder())
+		c.Request = httptest.NewRequest("GET", "/g/x", nil)
+		for k, v := range headers {
+			c.Request.Header.Set(k, v)
+		}
+		return c
+	}
+
+	if got := extractGatewayKey(mkctx(map[string]string{"X-API-Key": "ap_abc"})); got != "ap_abc" {
+		t.Fatalf("X-API-Key not extracted: %q", got)
+	}
+	if got := extractGatewayKey(mkctx(map[string]string{"Authorization": "Bearer ap_def"})); got != "ap_def" {
+		t.Fatalf("Bearer not extracted: %q", got)
+	}
+	// X-API-Key wins when both are present.
+	if got := extractGatewayKey(mkctx(map[string]string{
+		"X-API-Key":     "ap_first",
+		"Authorization": "Bearer ap_second",
+	})); got != "ap_first" {
+		t.Fatalf("X-API-Key should take precedence: %q", got)
+	}
+	if got := extractGatewayKey(mkctx(map[string]string{})); got != "" {
+		t.Fatalf("expected empty key, got %q", got)
+	}
+}
+
+func TestKeyAllowsService(t *testing.T) {
+	svcID := "11111111-2222-3333-4444-555555555555"
+	other := "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
+
+	cases := []struct {
+		name    string
+		allowed string
+		want    bool
+	}{
+		{"empty list permits all", "[]", true},
+		{"blank permits all", "", true},
+		{"invalid json permits all", "not-json", true},
+		{"listed service allowed", `["` + svcID + `"]`, true},
+		{"unlisted service denied", `["` + other + `"]`, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			k := &gatewayKey{AllowedServiceIDs: tc.allowed}
+			if got := keyAllowsService(k, svcID); got != tc.want {
+				t.Fatalf("keyAllowsService(%q) = %v, want %v", tc.allowed, got, tc.want)
+			}
+		})
+	}
+}

app/backend/internal/api/gitcreds.go

@@ -0,0 +1,84 @@
+package api
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"containr/internal/database"
+	"containr/internal/source"
+)
+
+// resolveGitCloneSpec turns a service's git_repo (clone URL, ssh remote, or
+// owner/repo) into a source.Spec with the project owner's provider token.
+// Public repos get no token — the clone proceeds anonymously. github_app
+// providers store the installation id, not a usable token; a fresh
+// installation token is minted per deploy.
+func resolveGitCloneSpec(db *database.DB, ownerID, gitRepo, branch, commit, buildPath string) (source.Spec, error) {
+	raw := strings.TrimSpace(gitRepo)
+	cloneURL, err := source.NormalizeCloneURL(raw)
+	if err != nil {
+		return source.Spec{}, err
+	}
+
+	spec := source.Spec{Branch: branch, Commit: commit, BuildPath: buildPath}
+
+	var providerID string
+	if !strings.Contains(cloneURL, "://") {
+		// Bare owner/repo — the connected repository row knows the host.
+		err = db.QueryRow(
+			`SELECT clone_url, provider_id FROM git_repositories
+			 WHERE full_name = $1 AND user_id = $2 LIMIT 1`,
+			cloneURL, ownerID,
+		).Scan(&cloneURL, &providerID)
+		if err != nil {
+			return source.Spec{}, fmt.Errorf("repository %s is not connected — connect it under Git settings or store a clone URL", raw)
+		}
+	} else {
+		// URL form — match a connected repo for its provider when possible;
+		// an unmatched public URL still clones, just without credentials.
+		_ = db.QueryRow(
+			`SELECT provider_id FROM git_repositories
+			 WHERE clone_url = $1 AND user_id = $2 LIMIT 1`,
+			cloneURL, ownerID,
+		).Scan(&providerID)
+	}
+
+	if err := source.ValidateRemoteURL(cloneURL); err != nil {
+		return source.Spec{}, err
+	}
+	spec.CloneURL = cloneURL
+
+	if providerID == "" {
+		return spec, nil
+	}
+	var name, apiURL, token string
+	if err := db.QueryRow(
+		`SELECT name, api_url, access_token FROM git_providers
+		 WHERE id = $1 AND user_id = $2`,
+		providerID, ownerID,
+	).Scan(&name, &apiURL, &token); err != nil {
+		return spec, nil // provider row gone — anonymous clone still works for public repos
+	}
+
+	switch strings.ToLower(name) {
+	case "github_app":
+		installationID, err := strconv.ParseInt(strings.TrimSpace(token), 10, 64)
+		if err == nil && installationID > 0 {
+			if minted, err := getGitHubAppInstallationToken(apiURL, installationID); err == nil {
+				spec.Token = minted
+				spec.User = "x-access-token"
+			}
+		}
+	case "gitlab":
+		spec.Token = token
+		spec.User = "oauth2"
+	case "bitbucket":
+		spec.Token = token
+		spec.User = "x-token-auth"
+	default:
+		spec.Token = token
+		spec.User = "x-access-token"
+	}
+	return spec, nil
+}

app/backend/internal/api/ingress.go

@@ -0,0 +1,212 @@
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"containr/internal/deployment"
+)
+
+// Remote ingress: replicas on node agents aren't on the hub's
+// containr-network, so Traefik's Docker provider can't see them. Instead
+// the backend renders one file-provider config per service into
+// TRAEFIK_DYNAMIC_DIR (a directory Traefik watches), pointing the
+// loadbalancer at the node's reachable IP + the ephemeral host port the
+// agent reported back after `create_container`.
+//
+// Empty dir → feature off (bare-metal dev). Files are best-effort: a
+// failed write never fails a reconcile.
+
+func ingressDir() string { return os.Getenv("TRAEFIK_DYNAMIC_DIR") }
+
+func ingressFile(serviceID string) string {
+	return filepath.Join(ingressDir(), "containr-"+serviceID+".yml")
+}
+
+// jsonInt coerces JSON-ish numbers (int/int32/int64/float64) to int —
+// spec fields arrive as int32, agent payloads unmarshal as float64.
+func jsonInt(v interface{}) int {
+	switch n := v.(type) {
+	case int:
+		return n
+	case int32:
+		return int(n)
+	case int64:
+		return int(n)
+	case float64:
+		return int(n)
+	}
+	return 0
+}
+
+// reportedHostPorts parses the agent's create_container result —
+// {"name": ..., "host_ports": {"80/tcp": "32768"}}. Older agents return a
+// bare name string; JSON parse failure means no port info.
+func reportedHostPorts(result string) map[string]string {
+	var out struct {
+		HostPorts map[string]string `json:"host_ports"`
+	}
+	if json.Unmarshal([]byte(result), &out) != nil {
+		return nil
+	}
+	return out.HostPorts
+}
+
+// nodeIngressIP picks the address the hub can reach the node on. Mesh
+// overlays first — the agent operator joined a mesh precisely so the hub
+// can reach it — then the reported primary IP as a LAN fallback.
+func nodeIngressIP(agent sqlcdb.NodeAgent) string {
+	var meta struct {
+		Mesh map[string]string `json:"mesh"`
+	}
+	_ = json.Unmarshal(agent.Metadata.RawMessage, &meta)
+	for _, prefix := range []string{"tailscale", "netbird", "wg", "zt"} {
+		var keys []string
+		for name := range meta.Mesh {
+			keys = append(keys, name)
+		}
+		sort.Strings(keys)
+		for _, name := range keys {
+			if strings.HasPrefix(name, prefix) && meta.Mesh[name] != "" {
+				return meta.Mesh[name]
+			}
+		}
+	}
+	return agent.IpAddress
+}
+
+// syncRemoteIngress rewrites the service's file-provider config from the
+// live remote replica set. Called after every remote reconcile so replica
+// adds/removals and node retargets converge the upstream list.
+func syncRemoteIngress(ctx context.Context, db *database.DB, spec deployment.RuntimeSpec) {
+	if ingressDir() == "" {
+		return
+	}
+	domains := spec.Domains
+	if len(domains) == 0 && spec.Domain != "" {
+		domains = []string{spec.Domain}
+	}
+	if len(domains) == 0 || spec.Port <= 0 {
+		removeServiceIngress(spec.ServiceID)
+		return
+	}
+
+	q := sqlcdb.New(db.DB)
+	rows, err := q.ListServiceContainers(ctx, spec.ServiceID)
+	if err != nil {
+		return
+	}
+	type upstream struct{ ip, port string }
+	var servers []upstream
+	for _, row := range rows {
+		var st struct {
+			State string `json:"state"`
+		}
+		_ = json.Unmarshal(row.Status.RawMessage, &st)
+		if st.State != "running" {
+			continue
+		}
+		var port string
+		var plist []map[string]interface{}
+		if err := json.Unmarshal(row.Ports.RawMessage, &plist); err == nil {
+			for _, p := range plist {
+				if hp, ok := p["host_port"].(float64); ok && hp > 0 {
+					port = fmt.Sprintf("%d", int(hp))
+				}
+			}
+		}
+		if port == "" {
+			continue
+		}
+		agent, err := q.GetAgent(ctx, row.NodeAgentID)
+		if err != nil {
+			continue
+		}
+		if ip := nodeIngressIP(agent); ip != "" {
+			servers = append(servers, upstream{ip, port})
+		}
+	}
+	if len(servers) == 0 {
+		removeServiceIngress(spec.ServiceID)
+		return
+	}
+
+	router := "svc-" + spec.ServiceID[:8]
+	rules := make([]string, 0, len(domains))
+	for _, d := range domains {
+		rules = append(rules, "Host(`"+d+"`)")
+	}
+	var b strings.Builder
+	b.WriteString("http:\n  routers:\n    " + router + ":\n")
+	b.WriteString("      rule: \"" + strings.Join(rules, " || ") + "\"\n")
+	b.WriteString("      entrypoints: [web]\n")
+	b.WriteString("      service: " + router + "\n")
+	b.WriteString("  services:\n    " + router + ":\n      loadBalancer:\n        servers:\n")
+	for _, s := range servers {
+		b.WriteString("          - url: \"http://" + s.ip + ":" + s.port + "\"\n")
+	}
+	// Atomic-ish: write temp then rename so Traefik's watcher never reads a
+	// truncated file.
+	tmp := ingressFile(spec.ServiceID) + ".tmp"
+	if err := os.WriteFile(tmp, []byte(b.String()), 0o644); err != nil {
+		return
+	}
+	_ = os.Rename(tmp, ingressFile(spec.ServiceID))
+}
+
+// removeServiceIngress deletes the service's remote route. Called on
+// remote teardown and when a service returns to local placement.
+func removeServiceIngress(serviceID string) {
+	if ingressDir() == "" {
+		return
+	}
+	_ = os.Remove(ingressFile(serviceID))
+}
+
+// wakeUpstreamURL is where a sleeping remote service's route points —
+// the backend's wake-page endpoint. Defaults to the compose service name;
+// TRAEFIK_BACKEND_URL overrides for custom layouts.
+func wakeUpstreamURL(apiPort int) string {
+	if v := strings.TrimSpace(os.Getenv("TRAEFIK_BACKEND_URL")); v != "" {
+		return strings.TrimRight(v, "/")
+	}
+	return fmt.Sprintf("http://containr-backend:%d", apiPort)
+}
+
+// writeWakeIngress routes the service's domains at the wake-page endpoint —
+// first hit triggers the wake reconcile and serves a reloading page.
+func writeWakeIngress(serviceID string, domains []string, apiPort int) {
+	if ingressDir() == "" {
+		return
+	}
+	sort.Strings(domains)
+	router := "svc-" + serviceID[:8] + "-wake"
+	rules := make([]string, 0, len(domains))
+	for _, d := range domains {
+		rules = append(rules, "Host(`"+d+"`)")
+	}
+	var b strings.Builder
+	mw := router + "-rw"
+	b.WriteString("http:\n  routers:\n    " + router + ":\n")
+	b.WriteString("      rule: \"" + strings.Join(rules, " || ") + "\"\n")
+	b.WriteString("      entrypoints: [web]\n")
+	b.WriteString("      service: " + router + "\n")
+	b.WriteString("      priority: 100\n")
+	b.WriteString("      middlewares: [" + mw + "]\n")
+	b.WriteString("  middlewares:\n    " + mw + ":\n")
+	b.WriteString("      replacePath:\n        path: \"/api/v1/internal/wake-page/" + serviceID + "\"\n")
+	b.WriteString("  services:\n    " + router + ":\n      loadBalancer:\n        servers:\n")
+	b.WriteString("          - url: \"" + wakeUpstreamURL(apiPort) + "\"\n")
+	tmp := ingressFile(serviceID) + ".tmp"
+	if err := os.WriteFile(tmp, []byte(b.String()), 0o644); err != nil {
+		return
+	}
+	_ = os.Rename(tmp, ingressFile(serviceID))
+}

app/backend/internal/api/noderunner.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/sha256"
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"strconv"
 	"strings"
@@ -18,8 +19,8 @@ import (
 
 // agentNodeRunner implements deployment.NodeRunner by dispatching container
 // lifecycle commands to a node agent's command queue and waiting for the
-// reported result. Remote nodes have no Traefik — domains stay local-only
-// until per-node ingress lands.
+// reported result. Domains route through the file provider —
+// syncRemoteIngress renders per-service configs from live inventory.
 type agentNodeRunner struct {
 	q  *sqlcdb.Queries
 	db *database.DB
@@ -56,11 +57,18 @@ func (r *agentNodeRunner) ReconcileOnNode(ctx context.Context, spec deployment.R
 // sorted by id. Replicas wrap when they outnumber nodes. The local host is
 // not a spread target — pin "local" or leave unset for local execution.
 func (r *agentNodeRunner) ReconcileSpread(ctx context.Context, spec deployment.RuntimeSpec) (*deployment.RuntimeState, error) {
-	agents, err := r.q.ListSchedulableAgents(ctx)
+	tagsRaw, _ := json.Marshal(spec.PlacementTags)
+	if len(spec.PlacementTags) == 0 {
+		tagsRaw = []byte("[]")
+	}
+	agents, err := r.q.ListSchedulableAgentsMatching(ctx, json.RawMessage(tagsRaw))
 	if err != nil {
 		return nil, fmt.Errorf("list schedulable nodes: %w", err)
 	}
 	if len(agents) == 0 {
+		if len(spec.PlacementTags) > 0 {
+			return nil, fmt.Errorf("no online schedulable nodes carry placement tags %v — tag a node or relax the requirement", spec.PlacementTags)
+		}
 		return nil, fmt.Errorf("no online schedulable nodes — connect an agent or unset spread")
 	}
 	return r.reconcileOnAgents(ctx, spec, func(i int) string {
@@ -68,6 +76,22 @@ func (r *agentNodeRunner) ReconcileSpread(ctx context.Context, spec deployment.R
 	})
 }
 
+// ReconcileAuto resolves the least-loaded online agent matching the
+// service's placement tags and reconciles every replica onto it. Stale
+// replicas on other agents retire through reconcileOnAgents — a service
+// follows its tags when the matching set changes.
+func (r *agentNodeRunner) ReconcileAuto(ctx context.Context, spec deployment.RuntimeSpec) (*deployment.RuntimeState, error) {
+	tagsRaw, _ := json.Marshal(spec.PlacementTags)
+	if len(spec.PlacementTags) == 0 {
+		tagsRaw = []byte("[]")
+	}
+	agentID, err := r.q.PickLeastLoadedAgentMatching(ctx, json.RawMessage(tagsRaw))
+	if err != nil {
+		return nil, fmt.Errorf("no online nodes carry placement tags %v", spec.PlacementTags)
+	}
+	return r.reconcileOnAgents(ctx, spec, func(int) string { return agentID })
+}
+
 // RemoteRuntimeState reads the service's remote replicas from inventory.
 // Rows only carry the last dispatched state — the agent doesn't stream
 // container events — so "running" means "last create succeeded".
@@ -107,10 +131,6 @@ func (r *agentNodeRunner) RemoteRuntimeState(ctx context.Context, serviceID stri
 // targetFor and retires stale replicas on any agent — including leftovers
 // from a previous pin or a different spread assignment.
 func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment.RuntimeSpec, targetFor func(replica int) string) (*deployment.RuntimeState, error) {
-	if len(spec.Domains) > 0 || spec.Domain != "" {
-		return nil, fmt.Errorf("domains are routed by the local Traefik — remove the service's domains or run it on the local node")
-	}
-
 	replicas := spec.Replicas
 	if replicas < 1 {
 		replicas = 1
@@ -127,7 +147,7 @@ func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment
 		if keep {
 			continue
 		}
-		if cmdErr := r.enqueueAndWait(ctx, row.NodeAgentID, "", "remove_container",
+		if _, cmdErr := r.enqueueAndWait(ctx, row.NodeAgentID, "", "remove_container",
 			map[string]interface{}{"container_name": row.Name}); cmdErr != nil {
 			return nil, fmt.Errorf("remove stale replica %s on node %s: %w", row.Name, row.NodeAgentID, cmdErr)
 		}
@@ -137,6 +157,45 @@ func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment
 		})
 	}
 
+	// Ship the image to every distinct target agent before replicas start.
+	// RemoteBuild nodes docker-build from the packaged context artifact;
+	// RemoteLoad nodes docker-load a saved tarball (local-tag rollbacks).
+	// Registry-pullable images skip this — docker run pulls on demand.
+	if spec.RemoteBuild != nil || spec.RemoteLoad != nil {
+		seen := map[string]bool{}
+		for i := 0; i < replicas; i++ {
+			agentID := targetFor(i)
+			if seen[agentID] {
+				continue
+			}
+			seen[agentID] = true
+			if spec.RemoteBuild != nil {
+				buildArgs := map[string]interface{}{}
+				for k, v := range spec.RemoteBuild.BuildArgs {
+					buildArgs[k] = v
+				}
+				_, err := r.enqueueAndWaitTimeout(ctx, agentID, "", "build_image",
+					map[string]interface{}{
+						"artifact_id": spec.RemoteBuild.ArtifactID,
+						"image":       spec.Image,
+						"build_args":  buildArgs,
+						"no_cache":    spec.RemoteBuild.NoCache,
+					}, 25*time.Minute)
+				if err != nil {
+					return nil, fmt.Errorf("build image on node %s: %w", agentID, err)
+				}
+			} else if spec.RemoteLoad != nil {
+				_, err := r.enqueueAndWaitTimeout(ctx, agentID, "", "load_image",
+					map[string]interface{}{
+						"artifact_id": spec.RemoteLoad.ArtifactID,
+					}, 10*time.Minute)
+				if err != nil {
+					return nil, fmt.Errorf("load image on node %s: %w", agentID, err)
+				}
+			}
+		}
+	}
+
 	state := &deployment.RuntimeState{Desired: replicas, Status: "running"}
 	for i := 0; i < replicas; i++ {
 		agentID := targetFor(i)
@@ -161,18 +220,41 @@ func (r *agentNodeRunner) reconcileOnAgents(ctx context.Context, spec deployment
 			HealthCheck:   rawJSON(map[string]interface{}{"path": spec.HealthPath}),
 		})
 
-		if err := r.enqueueAndWait(ctx, agentID, containerID, "create_container",
-			map[string]interface{}{"container": container}); err != nil {
+		result, err := r.enqueueAndWait(ctx, agentID, containerID, "create_container",
+			map[string]interface{}{"container": container})
+		if err != nil {
 			return nil, fmt.Errorf("replica %d on node %s: %w", i, agentID, err)
 		}
+		if assigned := reportedHostPorts(result); len(assigned) > 0 {
+			for _, p := range ports {
+				pm, ok := p.(map[string]interface{})
+				if !ok {
+					continue
+				}
+				cport := jsonInt(pm["container_port"])
+				proto, _ := pm["protocol"].(string)
+				if hp, ok := assigned[fmt.Sprintf("%d/%s", cport, proto)]; ok {
+					if n, err := strconv.Atoi(hp); err == nil {
+						pm["host_port"] = n
+					}
+				}
+			}
+			_ = r.q.UpdateContainerPorts(ctx, sqlcdb.UpdateContainerPortsParams{
+				ID:     containerID,
+				Status: rawJSON(map[string]interface{}{"state": "running", "health": "none"}),
+				Ports:  rawJSON(ports),
+			})
+		} else {
 			_ = r.q.UpdateContainerStatus(ctx, sqlcdb.UpdateContainerStatusParams{
 				ID:     containerID,
 				Status: rawJSON(map[string]interface{}{"state": "running", "health": "none"}),
 			})
+		}
 		state.Containers = append(state.Containers, deployment.RuntimeContainer{
 			ID: containerID, Name: name, State: "running", Replica: i,
 		})
 	}
+	syncRemoteIngress(ctx, r.db, spec)
 	return state, nil
 }
 
@@ -272,7 +354,17 @@ func (r *agentNodeRunner) ControlService(ctx context.Context, serviceID, agentID
 		if row.ServiceID != serviceID {
 			continue
 		}
-		if err := r.enqueueAndWait(ctx, agentID, row.ID, cmdType,
+		// Tombstoned replicas are already gone remotely — skip the dispatch
+		// or a fresh docker rm on a missing name reports a false failure.
+		if action == "remove" {
+			var st struct {
+				State string `json:"state"`
+			}
+			if err := json.Unmarshal(row.Status.RawMessage, &st); err == nil && st.State == "removed" {
+				continue
+			}
+		}
+		if _, err := r.enqueueAndWait(ctx, agentID, row.ID, cmdType,
 			map[string]interface{}{"container_name": row.Name}); err != nil {
 			return fmt.Errorf("%s %s on node: %w", action, row.Name, err)
 		}
@@ -290,16 +382,42 @@ func (r *agentNodeRunner) RemoveService(ctx context.Context, serviceID, agentID
 	if err := r.ControlService(ctx, serviceID, agentID, "remove"); err != nil {
 		return err
 	}
-	return r.q.DeleteServiceContainersOnAgent(ctx, sqlcdb.DeleteServiceContainersOnAgentParams{
+	if err := r.q.DeleteServiceContainersOnAgent(ctx, sqlcdb.DeleteServiceContainersOnAgentParams{
 		NodeAgentID: agentID,
 		ServiceID:   serviceID,
-	})
+	}); err != nil {
+		return err
+	}
+	removeServiceIngress(serviceID)
+	return nil
+}
+
+// RetireService removes the service's remote replicas wherever they run —
+// called when the service converges to local placement so a cleared pin or
+// removed tag requirement doesn't leave containers behind.
+func (r *agentNodeRunner) RetireService(ctx context.Context, serviceID string) error {
+	agentIDs, err := r.q.ListServiceAgents(ctx, serviceID)
+	if err != nil {
+		return err
+	}
+	for _, agentID := range agentIDs {
+		if err := r.RemoveService(ctx, serviceID, agentID); err != nil {
+			return fmt.Errorf("retire on node %s: %w", agentID, err)
+		}
+	}
+	removeServiceIngress(serviceID)
+	return nil
 }
 
 // enqueueAndWait pushes a command to the agent's queue and polls for the
-// reported result. Agents poll on their own interval (≥5s), so this blocks —
-// it runs inside the deploy queue worker, never on a request path.
-func (r *agentNodeRunner) enqueueAndWait(ctx context.Context, agentID, containerID, cmdType string, payload map[string]interface{}) error {
+// reported result, returning the agent's result string on success. Agents
+// poll on their own interval (≥5s), so this blocks — it runs inside the
+// deploy queue worker, never on a request path.
+func (r *agentNodeRunner) enqueueAndWait(ctx context.Context, agentID, containerID, cmdType string, payload map[string]interface{}) (string, error) {
+	return r.enqueueAndWaitTimeout(ctx, agentID, containerID, cmdType, payload, 8*time.Minute)
+}
+
+func (r *agentNodeRunner) enqueueAndWaitTimeout(ctx context.Context, agentID, containerID, cmdType string, payload map[string]interface{}, timeout time.Duration) (string, error) {
 	var cid sql.NullString
 	if containerID != "" {
 		cid = sql.NullString{String: containerID, Valid: true}
@@ -312,10 +430,10 @@ func (r *agentNodeRunner) enqueueAndWait(ctx context.Context, agentID, container
 		Payload:     rawJSON(payload),
 	})
 	if err != nil {
-		return err
+		return "", err
 	}
 
-	deadline := time.Now().Add(8 * time.Minute) // image pulls on a cold node
+	deadline := time.Now().Add(timeout) // image pulls/builds on a cold node
 	for {
 		row, err := r.q.GetCommandForAgent(ctx, sqlcdb.GetCommandForAgentParams{
 			ID:          cmd.ID,
@@ -324,36 +442,45 @@ func (r *agentNodeRunner) enqueueAndWait(ctx context.Context, agentID, container
 		if err == nil {
 			switch row.Status.String {
 			case "completed":
-				return nil
+				return row.Result.String, nil
 			case "failed":
 				if row.Error.Valid && row.Error.String != "" {
-					return fmt.Errorf("agent: %s", row.Error.String)
+					return "", fmt.Errorf("agent: %s", row.Error.String)
 				}
-				return fmt.Errorf("agent reported failure")
+				return "", fmt.Errorf("agent reported failure")
 			}
 		}
 		if time.Now().After(deadline) {
-			return fmt.Errorf("command %s timed out waiting for the agent", cmdType)
+			return "", fmt.Errorf("command %s timed out waiting for the agent", cmdType)
 		}
 		select {
 		case <-ctx.Done():
-			return ctx.Err()
+			return "", ctx.Err()
 		case <-time.After(2 * time.Second):
 		}
 	}
 }
 
 // resolveNodePin validates or resolves a node_id request value. "auto" picks
-// the least-loaded online agent; "" / "local" clears the pin.
-func resolveNodePin(ctx context.Context, db *database.DB, requested string) (string, error) {
+// the least-loaded online agent that carries every required placement tag;
+// "" / "local" clears the pin. An explicit pin bypasses tag filtering —
+// the operator is overriding placement on purpose.
+func resolveNodePin(ctx context.Context, db *database.DB, requested string, requiredTags []string) (string, error) {
 	requested = strings.TrimSpace(requested)
 	if requested == "" || requested == "local" {
 		return "", nil
 	}
 	q := sqlcdb.New(db.DB)
 	if requested == "auto" {
-		id, err := q.PickLeastLoadedAgent(ctx)
+		tagsRaw, _ := json.Marshal(requiredTags)
+		if len(requiredTags) == 0 {
+			tagsRaw = []byte("[]")
+		}
+		id, err := q.PickLeastLoadedAgentMatching(ctx, json.RawMessage(tagsRaw))
 		if err != nil {
+			if len(requiredTags) > 0 {
+				return "", fmt.Errorf("no online nodes carry placement tags %v", requiredTags)
+			}
 			return "", fmt.Errorf("no online nodes available")
 		}
 		return id, nil

app/backend/internal/api/notification_channels.go

@@ -0,0 +1,225 @@
+package api
+
+// Push notification channels — self-hosted ntfy and Gotify endpoints users
+// attach to their account. insertUserNotification fans out best-effort.
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// jarvis: ceiling — one shared client; no retry/backoff, delivery is
+// best-effort and failures are silent by design (notifications must never
+// break the producing flow).
+var pushHTTPClient = &http.Client{Timeout: 5 * time.Second}
+
+type notificationChannelDTO struct {
+	ID        string `json:"id"`
+	Kind      string `json:"kind"`
+	Endpoint  string `json:"endpoint"`
+	Enabled   bool   `json:"enabled"`
+	CreatedAt string `json:"created_at"`
+}
+
+func mapChannel(row sqlcdb.NotificationChannel) notificationChannelDTO {
+	return notificationChannelDTO{
+		ID:        row.ID.String(),
+		Kind:      row.Kind,
+		Endpoint:  row.Endpoint,
+		Enabled:   row.Enabled,
+		CreatedAt: row.CreatedAt.Time.Format(time.RFC3339),
+	}
+}
+
+func handleListNotificationChannels(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	uid, _ := uuid.Parse(userID)
+	rows, err := sqlcdb.New(db.DB).ListAllNotificationChannelsByUser(c.Request.Context(), uid)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to list channels")
+		return
+	}
+	out := make([]notificationChannelDTO, 0, len(rows))
+	for _, r := range rows {
+		out = append(out, mapChannel(r))
+	}
+	c.JSON(http.StatusOK, gin.H{"channels": out})
+}
+
+func handleCreateNotificationChannel(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	var req struct {
+		Kind     string `json:"kind" binding:"required,oneof=ntfy gotify"`
+		Endpoint string `json:"endpoint" binding:"required"`
+		Token    string `json:"token"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "kind (ntfy|gotify) and endpoint are required")
+		return
+	}
+	endpoint := strings.TrimRight(strings.TrimSpace(req.Endpoint), "/")
+	u, err := url.Parse(endpoint)
+	if err != nil || u.Scheme == "" || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "endpoint must be a valid http(s) URL")
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	uid, _ := uuid.Parse(userID)
+	row, err := sqlcdb.New(db.DB).InsertNotificationChannel(c.Request.Context(), sqlcdb.InsertNotificationChannelParams{
+		UserID:   uid,
+		Kind:     req.Kind,
+		Endpoint: endpoint,
+		Token:    sql.NullString{String: req.Token, Valid: req.Token != ""},
+	})
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to create channel")
+		return
+	}
+	c.JSON(http.StatusCreated, gin.H{"channel": mapChannel(row)})
+}
+
+func handleDeleteNotificationChannel(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid channel id")
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	uid, _ := uuid.Parse(userID)
+	n, err := sqlcdb.New(db.DB).DeleteNotificationChannel(c.Request.Context(), sqlcdb.DeleteNotificationChannelParams{
+		ID: id, UserID: uid,
+	})
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to delete channel")
+		return
+	}
+	if n == 0 {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Channel not found")
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "Channel deleted"})
+}
+
+// handleTestNotificationChannel pushes a probe notification through the
+// channel — surfaces misconfiguration before real alerts depend on it.
+func handleTestNotificationChannel(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		respondError(c, http.StatusBadRequest, "VALIDATION", "Invalid channel id")
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+	uid, _ := uuid.Parse(userID)
+	rows, err := sqlcdb.New(db.DB).ListAllNotificationChannelsByUser(c.Request.Context(), uid)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to load channel")
+		return
+	}
+	var target *sqlcdb.NotificationChannel
+	for i := range rows {
+		if rows[i].ID == id {
+			target = &rows[i]
+			break
+		}
+	}
+	if target == nil {
+		respondError(c, http.StatusNotFound, "NOT_FOUND", "Channel not found")
+		return
+	}
+	if err := deliverPush(c.Request.Context(), *target, "test", "Containr test notification", "Your push channel is configured correctly."); err != nil {
+		respondError(c, http.StatusBadGateway, "DELIVERY_FAILED", fmt.Sprintf("Push failed: %v", err))
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "Test notification sent"})
+}
+
+// deliverPush sends one notification through a channel. ntfy expects the
+// body at POST {endpoint} with Title/Priority headers; Gotify takes JSON at
+// POST {endpoint}/message?token=...
+func deliverPush(ctx context.Context, ch sqlcdb.NotificationChannel, kind, title, body string) error {
+	var req *http.Request
+	var err error
+	switch ch.Kind {
+	case "ntfy":
+		req, err = http.NewRequestWithContext(ctx, http.MethodPost, ch.Endpoint, strings.NewReader(body))
+		if err == nil {
+			req.Header.Set("Title", title)
+			req.Header.Set("Tags", "containr,"+kind)
+			if ch.Token.Valid && ch.Token.String != "" {
+				req.Header.Set("Authorization", "Bearer "+ch.Token.String)
+			}
+		}
+	case "gotify":
+		payload, _ := json.Marshal(map[string]interface{}{
+			"title":    title,
+			"message":  body,
+			"priority": 5,
+		})
+		endpoint := ch.Endpoint + "/message"
+		if ch.Token.Valid && ch.Token.String != "" {
+			endpoint += "?token=" + url.QueryEscape(ch.Token.String)
+		}
+		req, err = http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(payload))
+		if err == nil {
+			req.Header.Set("Content-Type", "application/json")
+		}
+	default:
+		return fmt.Errorf("unsupported channel kind %q", ch.Kind)
+	}
+	if err != nil {
+		return err
+	}
+	res, err := pushHTTPClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode >= 400 {
+		return fmt.Errorf("push endpoint returned %d", res.StatusCode)
+	}
+	return nil
+}
+
+// fanoutUserPush delivers a notification to every enabled channel the user
+// configured. Errors are swallowed — the in-app row already landed.
+func fanoutUserPush(db *database.DB, userID, kind, title, body string) {
+	uid, err := uuid.Parse(userID)
+	if err != nil {
+		return
+	}
+	rows, err := sqlcdb.New(db.DB).ListNotificationChannelsByUser(context.Background(), uid)
+	if err != nil || len(rows) == 0 {
+		return
+	}
+	for _, ch := range rows {
+		_ = deliverPush(context.Background(), ch, kind, title, body)
+	}
+}

app/backend/internal/api/notification_channels_test.go

@@ -0,0 +1,80 @@
+package api
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"containr/internal/database/sqlcdb"
+)
+
+func TestDeliverPushNtfy(t *testing.T) {
+	var gotAuth, gotTitle, gotTags, gotBody string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		gotTitle = r.Header.Get("Title")
+		gotTags = r.Header.Get("Tags")
+		b, _ := io.ReadAll(r.Body)
+		gotBody = string(b)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	ch := sqlcdb.NotificationChannel{
+		Kind:     "ntfy",
+		Endpoint: srv.URL + "/alerts",
+		Token:    sql.NullString{String: "tk_abc", Valid: true},
+	}
+	if err := deliverPush(context.Background(), ch, "deployment", "Deploy done", "svc is live"); err != nil {
+		t.Fatalf("deliverPush: %v", err)
+	}
+	if gotAuth != "Bearer tk_abc" {
+		t.Fatalf("auth header = %q", gotAuth)
+	}
+	if gotTitle != "Deploy done" || gotTags != "containr,deployment" || gotBody != "svc is live" {
+		t.Fatalf("title=%q tags=%q body=%q", gotTitle, gotTags, gotBody)
+	}
+}
+
+func TestDeliverPushGotify(t *testing.T) {
+	var gotPath, gotToken string
+	var payload map[string]interface{}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		gotToken = r.URL.Query().Get("token")
+		_ = json.NewDecoder(r.Body).Decode(&payload)
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	ch := sqlcdb.NotificationChannel{
+		Kind:     "gotify",
+		Endpoint: srv.URL,
+		Token:    sql.NullString{String: "apptoken", Valid: true},
+	}
+	if err := deliverPush(context.Background(), ch, "backup", "Backup done", "db backup ok"); err != nil {
+		t.Fatalf("deliverPush: %v", err)
+	}
+	if gotPath != "/message" || gotToken != "apptoken" {
+		t.Fatalf("path=%q token=%q", gotPath, gotToken)
+	}
+	if payload["title"] != "Backup done" || payload["message"] != "db backup ok" {
+		t.Fatalf("payload = %v", payload)
+	}
+}
+
+func TestDeliverPushFailure(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	ch := sqlcdb.NotificationChannel{Kind: "ntfy", Endpoint: srv.URL}
+	if err := deliverPush(context.Background(), ch, "k", "t", "b"); err == nil {
+		t.Fatal("expected error on 500")
+	}
+}

app/backend/internal/api/notifications.go

@@ -41,6 +41,7 @@ func insertUserNotification(db *database.DB, userID, kind, title, body, resource
 		ResourceID:   sql.NullString{String: resourceID, Valid: resourceID != ""},
 		CreatedAt:    sql.NullTime{Time: time.Now(), Valid: true},
 	})
+	go fanoutUserPush(db, userID, kind, title, body)
 }
 
 func mapNotification(row sqlcdb.Notification) NotificationItem {

app/backend/internal/api/preview_environments.go

@@ -2,7 +2,12 @@ package api
 
 import (
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
+	"containr/internal/deployment"
+	"containr/internal/deployqueue"
+	"context"
 	"database/sql"
+	"encoding/json"
 	"fmt"
 	"net/http"
 	"strings"
@@ -26,11 +31,77 @@ type PreviewEnvironment struct {
 	CreatedAt   time.Time  `json:"created_at" db:"created_at"`
 	UpdatedAt   time.Time  `json:"updated_at" db:"updated_at"`
 
+	// PreviewServiceID is the cloned service this preview actually deploys;
+	// its status is the source of truth while the preview is active.
+	PreviewServiceID *uuid.UUID `json:"preview_service_id,omitempty" db:"preview_service_id"`
+
 	// Related data
 	Service      *Service   `json:"service,omitempty"`
 	DeploymentID *uuid.UUID `json:"deployment_id,omitempty"`
 }
 
+// previewRowShape is the common column set the generated preview rows
+// carry — ListPreviewEnvironmentsForProjectRow and GetPreviewEnvironmentRow
+// share it.
+type previewRowShape struct {
+	ID               uuid.UUID
+	ProjectID        uuid.UUID
+	ServiceID        uuid.UUID
+	PreviewServiceID uuid.NullUUID
+	BranchName       string
+	PrNumber         sql.NullInt32
+	Environment      string
+	Status           string
+	Url              sql.NullString
+	ExpiresAt        time.Time
+	CreatedAt        sql.NullTime
+	UpdatedAt        sql.NullTime
+	SvcID            uuid.NullUUID
+	ServiceName      sql.NullString
+	ServiceType      sql.NullString
+}
+
+func previewFromRow(r previewRowShape) PreviewEnvironment {
+	env := PreviewEnvironment{
+		ID:          r.ID,
+		ProjectID:   r.ProjectID,
+		ServiceID:   r.ServiceID,
+		BranchName:  r.BranchName,
+		Environment: r.Environment,
+		Status:      r.Status,
+		URL:         r.Url.String,
+		CreatedAt:   r.CreatedAt.Time,
+		UpdatedAt:   r.UpdatedAt.Time,
+	}
+	if r.PreviewServiceID.Valid {
+		id := r.PreviewServiceID.UUID
+		env.PreviewServiceID = &id
+	}
+	if r.PrNumber.Valid {
+		n := int(r.PrNumber.Int32)
+		env.PRNumber = &n
+	}
+	if !r.ExpiresAt.IsZero() {
+		t := r.ExpiresAt
+		env.ExpiresAt = &t
+	}
+	if r.SvcID.Valid {
+		env.Service = &Service{
+			ID:   r.SvcID.UUID,
+			Name: r.ServiceName.String,
+			Type: r.ServiceType.String,
+		}
+	}
+	return env
+}
+
+func prNumberSQL(n *int) sql.NullInt32 {
+	if n == nil {
+		return sql.NullInt32{}
+	}
+	return sql.NullInt32{Int32: int32(*n), Valid: true}
+}
+
 // CreatePreviewEnvironmentRequest represents a request to create a preview environment
 type CreatePreviewEnvironmentRequest struct {
 	ProjectID  uuid.UUID `json:"project_id"`
@@ -77,51 +148,21 @@ func handleGetPreviewEnvironments(c *gin.Context) {
 	}
 
 	// Get preview environments for the project with service info
-	rows, err := db.(*database.DB).Query(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
-				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
-				s.id as service_id, s.name as service_name, s.type as service_type
-			FROM preview_environments pe
-			LEFT JOIN services s ON pe.service_id = s.id
-			WHERE pe.project_id = $1 
-			ORDER BY pe.created_at DESC`,
-		projectID,
-	)
+	rows, err := sqlcdb.New(db.(*database.DB).DB).ListPreviewEnvironmentsForProject(c.Request.Context(), projectID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to retrieve preview environments"})
 		return
 	}
-	defer rows.Close()
 
-	var environments []PreviewEnvironment
-	for rows.Next() {
-		var env PreviewEnvironment
-		var serviceID sql.NullString
-		var serviceName sql.NullString
-		var serviceType sql.NullString
-
-		err := rows.Scan(
-			&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
-			&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
-			&serviceID, &serviceName, &serviceType,
-		)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to scan preview environment"})
-			return
-		}
-
-		if serviceID.Valid {
-			parsedServiceID, parseErr := uuid.Parse(serviceID.String)
-			if parseErr == nil {
-				env.Service = &Service{
-					ID:   parsedServiceID,
-					Name: serviceName.String,
-					Type: serviceType.String,
-				}
-			}
-		}
-
-		environments = append(environments, env)
+	environments := make([]PreviewEnvironment, 0, len(rows))
+	for _, r := range rows {
+		environments = append(environments, previewFromRow(previewRowShape{
+			ID: r.ID, ProjectID: r.ProjectID, ServiceID: r.ServiceID,
+			PreviewServiceID: r.PreviewServiceID, BranchName: r.BranchName,
+			PrNumber: r.PrNumber, Environment: r.Environment, Status: r.Status,
+			Url: r.Url, ExpiresAt: r.ExpiresAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+			SvcID: r.SvcID, ServiceName: r.ServiceName, ServiceType: r.ServiceType,
+		}))
 	}
 
 	c.JSON(http.StatusOK, gin.H{"preview_environments": environments})
@@ -162,48 +203,37 @@ func handleCreatePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
-	// Check if project exists and user has access
-	var project Project
-	err = db.(*database.DB).QueryRow(
-		"SELECT id, name, owner_id FROM projects WHERE id = $1",
-		req.ProjectID,
-	).Scan(&project.ID, &project.Name, &project.OwnerID)
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
 
+	// Check if project exists and user has access
+	project, err := q.GetProjectBrief(ctx, req.ProjectID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Project not found"})
 		return
 	}
 
 	// Check if user owns the project
-	if project.OwnerID != userID.(string) && !contextIsAdmin(c) {
+	if project.OwnerID.String() != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
 
 	// Check if service exists and belongs to the project
-	var service Service
-	err = db.(*database.DB).QueryRow(
-		"SELECT id, name, COALESCE(type, service_type, '') FROM services WHERE id = $1 AND project_id = $2",
-		req.ServiceID, req.ProjectID,
-	).Scan(&service.ID, &service.Name, &service.Type)
-
+	service, err := q.GetServiceTypeBrief(ctx, sqlcdb.GetServiceTypeBriefParams{
+		ID: req.ServiceID, ProjectID: req.ProjectID})
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found or doesn't belong to this project"})
 		return
 	}
 
 	// Check if preview environment already exists for this branch and service
-	var count int
-	err = db.(*database.DB).QueryRow(
-		"SELECT COUNT(*) FROM preview_environments WHERE service_id = $1 AND branch_name = $2 AND status NOT IN ('expired', 'stopped')",
-		req.ServiceID, req.BranchName,
-	).Scan(&count)
-
+	count, err := q.CountActivePreviewsForBranch(ctx, sqlcdb.CountActivePreviewsForBranchParams{
+		ServiceID: req.ServiceID, BranchName: req.BranchName})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check existing preview environment"})
 		return
 	}
-
 	if count > 0 {
 		c.JSON(http.StatusConflict, gin.H{"error": "Preview environment already exists for this branch and service"})
 		return
@@ -215,87 +245,111 @@ func handleCreatePreviewEnvironment(c *gin.Context) {
 		ttlHours = 24 // Default 24 hours
 	}
 
-	// Create preview environment
+	// A preview is a real service: clone the source, pin it to the
+	// requested branch, swap its domains for a preview hostname, and run a
+	// normal deployment through the queue. Expiry sweeps the clone away.
+	envName := generatePreviewEnvironmentName(req.BranchName)
+	cloneName := previewServiceName(service.Name, req.BranchName)
+	cloneID, err := cloneServiceRow(db.(*database.DB), req.ServiceID, req.ProjectID, cloneName, "")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clone service for preview"})
+		return
+	}
+
+	// The clone's branch override is what makes it a preview — everything
+	// else (env vars, volumes, builder, resources) stays identical.
+	if err := q.UpdateServicePreviewBranch(ctx, sqlcdb.UpdateServicePreviewBranchParams{
+		GitBranch: sql.NullString{String: req.BranchName, Valid: true}, ID: cloneID}); err != nil {
+		_ = q.DeleteServiceByID(ctx, cloneID)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to configure preview service"})
+		return
+	}
+	// Cloned service_domains would collide with the parent's Traefik
+	// router — previews get their own hostname or none.
+	if err := q.DeleteAllServiceDomains(ctx, cloneID); err != nil {
+		_ = q.DeleteServiceByID(ctx, cloneID)
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to configure preview domains"})
+		return
+	}
+	previewHost := resolvePreviewHost(db.(*database.DB), cloneID, envName)
+	if previewHost != "" {
+		_ = q.CreatePreviewDomain(ctx, sqlcdb.CreatePreviewDomainParams{
+			ServiceID: cloneID, Domain: previewHost})
+	}
+
+	expiresAt := time.Now().Add(time.Duration(ttlHours) * time.Hour)
 	env := PreviewEnvironment{
 		ID:          uuid.New(),
 		ProjectID:   req.ProjectID,
 		ServiceID:   req.ServiceID,
 		BranchName:  req.BranchName,
 		PRNumber:    req.PRNumber,
-		Environment: generatePreviewEnvironmentName(req.BranchName),
+		Environment: envName,
 		Status:      "building",
-		ExpiresAt:   &[]time.Time{time.Now().Add(time.Duration(ttlHours) * time.Hour)}[0],
+		ExpiresAt:   &expiresAt,
 		CreatedAt:   time.Now(),
 		UpdatedAt:   time.Now(),
 	}
+	if previewHost != "" {
+		env.URL = "https://" + previewHost
+	}
 
-	// Insert preview environment into database
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO preview_environments 
-			(id, project_id, service_id, branch_name, pr_number, environment, 
-			 status, url, expires_at, created_at, updated_at)
-			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`,
-		env.ID, env.ProjectID, env.ServiceID, env.BranchName, env.PRNumber,
-		env.Environment, env.Status, env.URL, env.ExpiresAt, env.CreatedAt, env.UpdatedAt,
-	)
-
+	err = q.CreatePreviewEnvironment(ctx, sqlcdb.CreatePreviewEnvironmentParams{
+		ID:               env.ID,
+		ProjectID:        env.ProjectID,
+		ServiceID:        env.ServiceID,
+		PreviewServiceID: uuid.NullUUID{UUID: cloneID, Valid: true},
+		BranchName:       env.BranchName,
+		PrNumber:         prNumberSQL(env.PRNumber),
+		Environment:      env.Environment,
+		Status:           env.Status,
+		Url:              sql.NullString{String: env.URL, Valid: env.URL != ""},
+		ExpiresAt:        *env.ExpiresAt,
+		CreatedAt:        sql.NullTime{Time: env.CreatedAt, Valid: true},
+		UpdatedAt:        sql.NullTime{Time: env.UpdatedAt, Valid: true},
+	})
 	if err != nil {
+		_ = q.DeleteServiceByID(ctx, cloneID)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create preview environment"})
 		return
 	}
 
 	deploymentID := uuid.New()
-	sanitizedBranch := strings.ReplaceAll(req.BranchName, "/", "-")
-	sanitizedBranch = strings.ReplaceAll(sanitizedBranch, "_", "-")
-	version := fmt.Sprintf("preview-%s-%d", sanitizedBranch, time.Now().Unix())
-	startedAt := time.Now().UTC()
-	completedAt := startedAt
-
-	_, deployErr := db.(*database.DB).Exec(
-		`INSERT INTO deployments
-			(id, service_id, version, commit_hash, status, started_at, completed_at, deployment_log, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW(), NOW())`,
-		deploymentID,
-		req.ServiceID,
-		version,
-		req.BranchName,
-		"running",
-		startedAt,
-		completedAt,
-		fmt.Sprintf("Preview environment %s activated for branch %s", env.Environment, req.BranchName),
-	)
-	if deployErr != nil {
-		_, _ = db.(*database.DB).Exec(
-			`UPDATE preview_environments
-			 SET status = 'failed', updated_at = NOW()
-			 WHERE id = $1`,
-			env.ID,
-		)
+	err = q.InsertPendingDeployment(ctx, sqlcdb.InsertPendingDeploymentParams{
+		ID:         deploymentID,
+		ServiceID:  cloneID,
+		Version:    "preview-" + env.Environment,
+		CommitHash: sql.NullString{String: req.BranchName, Valid: true},
+	})
+	if err != nil {
+		_ = q.DeletePreviewEnvironment(ctx, env.ID)
+		_ = q.DeleteServiceByID(ctx, cloneID)
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to provision preview deployment"})
 		return
 	}
-
-	if strings.TrimSpace(env.URL) == "" {
-		env.URL = fmt.Sprintf("https://%s.preview.containr.local", env.Environment)
-	}
-	env.Status = "running"
-	env.UpdatedAt = time.Now().UTC()
 	env.DeploymentID = &deploymentID
 
-	_, err = db.(*database.DB).Exec(
-		`UPDATE preview_environments
-		 SET status = $1, url = $2, updated_at = $3
-		 WHERE id = $4`,
-		env.Status,
-		env.URL,
-		env.UpdatedAt,
-		env.ID,
-	)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to finalize preview environment"})
-		return
+	if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+		if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+			cloneService, loadErr := loadServiceForDeploy(db.(*database.DB), cloneID)
+			if loadErr == nil {
+				engineInstance := engine
+				d := DeploymentModel{ID: deploymentID, ServiceID: cloneID, Status: "pending", CreatedAt: time.Now(), UpdatedAt: time.Now()}
+				getDeployQueue(c).Enqueue(cloneID, deployqueue.Job{
+					DeploymentID: deploymentID,
+					Run: func(jctx context.Context) {
+						runDeploymentAndSync(jctx, db.(*database.DB), engineInstance, &d, cloneService, CreateDeploymentRequest{Branch: req.BranchName, Trigger: "preview"}, userID.(string))
+					},
+				})
+			}
+		}
 	}
 
+	LogAuditWithRequest(c, "service", req.ServiceID.String(), "preview.create", map[string]interface{}{
+		"preview_environment_id": env.ID.String(),
+		"preview_service_id":     cloneID.String(),
+		"branch":                 req.BranchName,
+	})
 	c.JSON(http.StatusCreated, gin.H{"preview_environment": env})
 }
 
@@ -316,43 +370,20 @@ func handleGetPreviewEnvironment(c *gin.Context) {
 
 	// Public when the parent project is approved; otherwise owner/member/admin.
 	userID := optionalUserUUID(c)
-	var env PreviewEnvironment
-	var serviceID sql.NullString
-	var serviceName sql.NullString
-	var serviceType sql.NullString
-	err = db.(*database.DB).QueryRow(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number,
-				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
-				s.id as service_id, s.name as service_name, s.type as service_type
-			FROM preview_environments pe
-			LEFT JOIN services s ON pe.service_id = s.id
-			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND (p.is_approved OR p.owner_id = $2 OR $3::bool
-				OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $2))`,
-		envID, userID, contextIsAdmin(c),
-	).Scan(
-		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.PRNumber,
-		&env.Environment, &env.Status, &env.URL, &env.ExpiresAt, &env.CreatedAt, &env.UpdatedAt,
-		&serviceID, &serviceName, &serviceType,
-	)
-
+	r, err := sqlcdb.New(db.(*database.DB).DB).GetPreviewEnvironment(
+		c.Request.Context(), sqlcdb.GetPreviewEnvironmentParams{
+			ID: envID, OwnerID: userID, Column3: contextIsAdmin(c)})
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
 		return
 	}
-
-	// Populate service info if available
-	if serviceID.Valid {
-		parsedServiceID, parseErr := uuid.Parse(serviceID.String)
-		if parseErr == nil {
-			env.Service = &Service{
-				ID:   parsedServiceID,
-				Name: serviceName.String,
-				Type: serviceType.String,
-			}
-		}
-	}
-
+	env := previewFromRow(previewRowShape{
+		ID: r.ID, ProjectID: r.ProjectID, ServiceID: r.ServiceID,
+		PreviewServiceID: r.PreviewServiceID, BranchName: r.BranchName,
+		PrNumber: r.PrNumber, Environment: r.Environment, Status: r.Status,
+		Url: r.Url, ExpiresAt: r.ExpiresAt, CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+		SvcID: r.SvcID, ServiceName: r.ServiceName, ServiceType: r.ServiceType,
+	})
 	c.JSON(http.StatusOK, gin.H{"preview_environment": env})
 }
 
@@ -385,24 +416,21 @@ func handleUpdatePreviewEnvironment(c *gin.Context) {
 	}
 
 	// Check if preview environment exists and user has access
-	var existingEnv PreviewEnvironment
-	err = db.(*database.DB).QueryRow(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number, 
-				pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at
-			FROM preview_environments pe
-			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)`,
-		envID, userID, contextIsAdmin(c),
-	).Scan(
-		&existingEnv.ID, &existingEnv.ProjectID, &existingEnv.ServiceID, &existingEnv.BranchName,
-		&existingEnv.PRNumber, &existingEnv.Environment, &existingEnv.Status, &existingEnv.URL,
-		&existingEnv.ExpiresAt, &existingEnv.CreatedAt, &existingEnv.UpdatedAt,
-	)
-
+	uid, _ := uuid.Parse(fmt.Sprint(userID))
+	q := sqlcdb.New(db.(*database.DB).DB)
+	r, err := q.GetPreviewEnvironmentForWrite(
+		c.Request.Context(), sqlcdb.GetPreviewEnvironmentForWriteParams{
+			ID: envID, OwnerID: uid, Column3: contextIsAdmin(c)})
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
 		return
 	}
+	existingEnv := previewFromRow(previewRowShape{
+		ID: r.ID, ProjectID: r.ProjectID, ServiceID: r.ServiceID,
+		BranchName: r.BranchName, PrNumber: r.PrNumber, Environment: r.Environment,
+		Status: r.Status, Url: r.Url, ExpiresAt: r.ExpiresAt,
+		CreatedAt: r.CreatedAt, UpdatedAt: r.UpdatedAt,
+	})
 
 	// Update fields if provided
 	if req.Status != "" {
@@ -422,12 +450,17 @@ func handleUpdatePreviewEnvironment(c *gin.Context) {
 	existingEnv.UpdatedAt = time.Now()
 
 	// Update preview environment in database
-	_, err = db.(*database.DB).Exec(
-		`UPDATE preview_environments 
-			SET status = $1, url = $2, expires_at = $3, updated_at = $4
-			WHERE id = $5`,
-		existingEnv.Status, existingEnv.URL, existingEnv.ExpiresAt, existingEnv.UpdatedAt, existingEnv.ID,
-	)
+	expiresAt := time.Time{}
+	if existingEnv.ExpiresAt != nil {
+		expiresAt = *existingEnv.ExpiresAt
+	}
+	err = q.UpdatePreviewEnvironment(c.Request.Context(), sqlcdb.UpdatePreviewEnvironmentParams{
+		Status:    existingEnv.Status,
+		Url:       sql.NullString{String: existingEnv.URL, Valid: existingEnv.URL != ""},
+		ExpiresAt: expiresAt,
+		UpdatedAt: sql.NullTime{Time: existingEnv.UpdatedAt, Valid: true},
+		ID:        existingEnv.ID,
+	})
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update preview environment"})
@@ -459,49 +492,34 @@ func handleDeletePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
-	// Check if preview environment exists and user has access
-	var projectOwnerID string
-	err = db.(*database.DB).QueryRow(
-		`SELECT p.owner_id 
-			FROM preview_environments pe
-			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1`,
-		envID,
-	).Scan(&projectOwnerID)
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
 
+	// Check if preview environment exists and user has access
+	projectOwnerID, err := q.GetPreviewEnvironmentOwner(ctx, envID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
 		return
 	}
 
 	// Check if user owns the project
-	if projectOwnerID != userID.(string) && !contextIsAdmin(c) {
+	if projectOwnerID.String() != userID.(string) && !contextIsAdmin(c) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return
 	}
 
-	cleanupID := uuid.New()
-	cleanupStartedAt := time.Now().UTC()
-	cleanupCompletedAt := cleanupStartedAt
-
-	_, _ = db.(*database.DB).Exec(
-		`INSERT INTO deployments
-			(id, service_id, version, status, started_at, completed_at, deployment_log, created_at, updated_at)
-		 VALUES ($1, (SELECT service_id FROM preview_environments WHERE id = $2), $3, $4, $5, $6, $7, NOW(), NOW())`,
-		cleanupID,
-		envID,
-		"preview-cleanup",
-		"rolled_back",
-		cleanupStartedAt,
-		cleanupCompletedAt,
-		"Preview environment resources cleaned up",
-	)
+	// Tear down the clone's runtime and row — the preview is the clone.
+	if cloneID, err := q.GetPreviewServiceID(ctx, envID); err == nil && cloneID.Valid {
+		if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+			if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+				removeServiceRuntime(ctx, db.(*database.DB), engine, cloneID.UUID)
+			}
+		}
+		_ = q.DeleteServiceByID(ctx, cloneID.UUID)
+	}
 
 	// Delete preview environment
-	_, err = db.(*database.DB).Exec(
-		"DELETE FROM preview_environments WHERE id = $1",
-		envID,
-	)
+	err = q.DeletePreviewEnvironment(ctx, envID)
 
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete preview environment"})
@@ -539,22 +557,30 @@ func handlePromotePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
-	// Get preview environment details
-	var env PreviewEnvironment
-	err = db.(*database.DB).QueryRow(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.environment, pe.status
-			FROM preview_environments pe
-			JOIN projects p ON pe.project_id = p.id
-			WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)`,
-		envID, userID, contextIsAdmin(c),
-	).Scan(
-		&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.Environment, &env.Status,
-	)
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
 
+	// Get preview environment details
+	uid, _ := uuid.Parse(fmt.Sprint(userID))
+	r, err := q.GetPreviewEnvironmentForPromote(
+		ctx, sqlcdb.GetPreviewEnvironmentForPromoteParams{
+			ID: envID, OwnerID: uid, Column3: contextIsAdmin(c)})
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Preview environment not found"})
 		return
 	}
+	env := PreviewEnvironment{
+		ID:          r.ID,
+		ProjectID:   r.ProjectID,
+		ServiceID:   r.ServiceID,
+		BranchName:  r.BranchName,
+		Environment: r.Environment,
+		Status:      r.Status,
+	}
+	if r.PreviewServiceID.Valid {
+		id := r.PreviewServiceID.UUID
+		env.PreviewServiceID = &id
+	}
 
 	// Check if preview environment is in a state that can be promoted
 	if env.Status != "running" {
@@ -562,39 +588,51 @@ func handlePromotePreviewEnvironment(c *gin.Context) {
 		return
 	}
 
+	// Promote is a real redeploy: the source service builds the preview's
+	// branch onto its own deployment track.
 	deploymentID := uuid.New()
 	promotionVersion := fmt.Sprintf("promote-%s-%d", strings.ReplaceAll(env.BranchName, "/", "-"), time.Now().Unix())
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO deployments (id, service_id, version, status, created_at, updated_at)
-		 VALUES ($1, $2, $3, $4, NOW(), NOW())`,
-		deploymentID, env.ServiceID, promotionVersion, "pending",
-	)
+	err = q.InsertPendingDeployment(ctx, sqlcdb.InsertPendingDeploymentParams{
+		ID:         deploymentID,
+		ServiceID:  env.ServiceID,
+		Version:    promotionVersion,
+		CommitHash: sql.NullString{String: env.BranchName, Valid: true},
+	})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create promotion deployment"})
 		return
 	}
 
-	if _, err := db.(*database.DB).Exec(
-		`UPDATE services
-		 SET environment = $1, updated_at = NOW()
-		 WHERE id = $2`,
-		req.TargetEnvironment, env.ServiceID,
-	); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update service target environment"})
+	sourceService, loadErr := loadServiceForDeploy(db.(*database.DB), env.ServiceID)
+	if loadErr != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to load promotion target service"})
 		return
 	}
-
-	previewStatus := "stopped"
-	if req.CreateBackup {
-		previewStatus = "expired"
+	if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+		if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+			engineInstance := engine
+			d := DeploymentModel{ID: deploymentID, ServiceID: env.ServiceID, Status: "pending", CreatedAt: time.Now(), UpdatedAt: time.Now()}
+			getDeployQueue(c).Enqueue(env.ServiceID, deployqueue.Job{
+				DeploymentID: deploymentID,
+				Run: func(jctx context.Context) {
+					runDeploymentAndSync(jctx, db.(*database.DB), engineInstance, &d, sourceService, CreateDeploymentRequest{Branch: env.BranchName, Trigger: "promote"}, userID.(string))
+				},
+			})
+		}
 	}
 
-	if _, err := db.(*database.DB).Exec(
-		`UPDATE preview_environments
-		 SET status = $1, updated_at = NOW()
-		 WHERE id = $2`,
-		previewStatus, env.ID,
-	); err != nil {
+	// Promotion retires the preview — the clone's containers and row go.
+	if env.PreviewServiceID != nil {
+		if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+			if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+				removeServiceRuntime(ctx, db.(*database.DB), engine, *env.PreviewServiceID)
+			}
+		}
+		_ = q.DeleteServiceByID(ctx, *env.PreviewServiceID)
+	}
+
+	if err := q.MarkPreviewEnvironmentStatus(ctx, sqlcdb.MarkPreviewEnvironmentStatusParams{
+		Status: "stopped", ID: env.ID}); err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update preview environment status"})
 		return
 	}
@@ -608,7 +646,7 @@ func handlePromotePreviewEnvironment(c *gin.Context) {
 			"create_backup":          req.CreateBackup,
 			"deployment_id":          deploymentID,
 			"status":                 "queued",
-			"preview_status":         previewStatus,
+			"preview_status":         "stopped",
 		},
 	})
 }
@@ -637,44 +675,46 @@ func handleCleanupExpiredPreviewEnvironments(c *gin.Context) {
 		return
 	}
 
+	ctx := c.Request.Context()
+	q := sqlcdb.New(db.(*database.DB).DB)
+	uid, _ := uuid.Parse(fmt.Sprint(userID))
+
 	// Find expired preview environments for user's projects
-	rows, err := db.(*database.DB).Query(
-		`SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.environment
-			FROM preview_environments pe
-			JOIN projects p ON pe.project_id = p.id
-			WHERE (p.owner_id = $1 OR $2::bool) AND pe.expires_at < NOW() AND pe.status != 'expired'`,
-		userID, contextIsAdmin(c),
-	)
+	rows, err := q.ListExpiredPreviewsForUser(ctx, sqlcdb.ListExpiredPreviewsForUserParams{
+		OwnerID: uid, Column2: contextIsAdmin(c)})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to find expired preview environments"})
 		return
 	}
-	defer rows.Close()
 
-	var expiredEnvs []PreviewEnvironment
-	for rows.Next() {
-		var env PreviewEnvironment
-		err := rows.Scan(
-			&env.ID, &env.ProjectID, &env.ServiceID, &env.BranchName, &env.Environment,
-		)
-		if err != nil {
-			continue
+	expiredEnvs := make([]PreviewEnvironment, 0, len(rows))
+	for _, r := range rows {
+		env := PreviewEnvironment{
+			ID: r.ID, ProjectID: r.ProjectID, ServiceID: r.ServiceID,
+			BranchName: r.BranchName, Environment: r.Environment,
+		}
+		if r.PreviewServiceID.Valid {
+			id := r.PreviewServiceID.UUID
+			env.PreviewServiceID = &id
 		}
 		expiredEnvs = append(expiredEnvs, env)
 	}
 
-	// Mark expired environments as expired and trigger cleanup
+	// Mark expired environments as expired and tear down their clones
 	cleanupCount := 0
 	for _, env := range expiredEnvs {
-		// Update status to expired
-		_, err := db.(*database.DB).Exec(
-			"UPDATE preview_environments SET status = 'expired', updated_at = NOW() WHERE id = $1",
-			env.ID,
-		)
-		if err != nil {
+		if err := q.MarkPreviewEnvironmentStatus(ctx, sqlcdb.MarkPreviewEnvironmentStatusParams{
+			Status: "expired", ID: env.ID}); err != nil {
 			continue
 		}
-
+		if env.PreviewServiceID != nil {
+			if engineValue, exists := c.Get("deployment_engine"); exists && engineValue != nil {
+				if engine, ok := engineValue.(*deployment.DeploymentEngine); ok {
+					removeServiceRuntime(ctx, db.(*database.DB), engine, *env.PreviewServiceID)
+				}
+			}
+			_ = q.DeleteServiceByID(ctx, *env.PreviewServiceID)
+		}
 		cleanupCount++
 	}
 
@@ -684,3 +724,124 @@ func handleCleanupExpiredPreviewEnvironments(c *gin.Context) {
 		"expired_environments": expiredEnvs,
 	})
 }
+
+// previewServiceName builds the clone's service name — deterministic enough
+// to spot in lists, short enough for dnsLabel-derived hostnames.
+func previewServiceName(serviceName, branch string) string {
+	label := dnsLabel(serviceName + "-" + branch)
+	if label == "" {
+		return "preview-" + uuid.NewString()[:8]
+	}
+	return label + "-preview"
+}
+
+// resolvePreviewHost picks a preview hostname under the clone's node default
+// domain — same source as serviceAutoDomains. Returns "" when no node
+// carries a default domain; the preview still runs, reachable internally.
+func resolvePreviewHost(db *database.DB, cloneID uuid.UUID, envName string) string {
+	label := dnsLabel(envName)
+	if label == "" {
+		return ""
+	}
+	q := sqlcdb.New(db.DB)
+	ctx := context.Background()
+	brief, err := q.GetServicePlacementBrief(ctx, cloneID)
+	if err != nil {
+		return ""
+	}
+	nodeID, spread := brief.NodeID, brief.Spread
+	var base string
+	switch {
+	case nodeID.Valid && nodeID.String != "":
+		if a, err := q.GetAgent(ctx, nodeID.String); err == nil {
+			base = a.DefaultDomain
+		}
+	case spread:
+		if bases, err := q.ListSchedulableAgentDomains(ctx, json.RawMessage(tagsJSON(servicePlacementTags(db, cloneID)))); err == nil && len(bases) > 0 {
+			base = bases[0]
+		}
+	default:
+		// Local preview: borrow the first node default domain if any —
+		// still better than no hostname for a Traefik-fronted local host.
+		if bases, err := q.ListSchedulableAgentDomains(ctx, json.RawMessage("[]")); err == nil && len(bases) > 0 {
+			base = bases[0]
+		}
+	}
+	if base == "" {
+		return ""
+	}
+	return label + "." + base
+}
+
+// loadServiceForDeploy hydrates the Service fields runDeploymentAndSync
+// needs — mirrors the loader in handleDeployService.
+func serviceForDeployFromRow(r sqlcdb.GetServiceForDeployRow) Service {
+	return Service{
+		ID: r.ID, ProjectID: r.ProjectID, Name: r.Name, Type: r.Type.String,
+		Status: r.Status.String, Image: r.Image.String, Command: r.Command.String,
+		Environment: r.Environment.String, GitRepo: r.GitRepo.String,
+		GitBranch: r.GitBranch.String, BuildPath: r.BuildPath.String,
+		CPU: r.Cpu.String, Memory: r.Memory.String,
+		Replicas: int(r.Replicas), Port: int(r.Port), Domain: r.Domain,
+		HealthCheckPath: r.HealthcheckPath, RestartPolicy: r.RestartPolicy,
+		Builder: r.Builder, CPUReserve: r.CpuReserve, MemoryReserve: r.MemoryReserve,
+		StaticBuildCmd: r.StaticBuildCmd, StaticDir: r.StaticDir,
+		CreatedAt: r.CreatedAt.Time, UpdatedAt: r.UpdatedAt.Time,
+	}
+}
+
+func loadServiceForDeploy(db *database.DB, serviceID uuid.UUID) (Service, error) {
+	r, err := sqlcdb.New(db.DB).GetServiceForDeploy(context.Background(), serviceID)
+	if err != nil {
+		return Service{}, err
+	}
+	return serviceForDeployFromRow(r), nil
+}
+
+// StartPreviewSweeper expires preview environments past their TTL — tears
+// down each clone's runtime and row, marks the preview expired.
+func StartPreviewSweeper(ctx context.Context, db *database.DB, engine *deployment.DeploymentEngine) {
+	if db == nil || engine == nil {
+		return
+	}
+	go func() {
+		ticker := time.NewTicker(time.Minute)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				sweepExpiredPreviews(ctx, db, engine)
+				syncPreviewStatuses(ctx, db)
+			}
+		}
+	}()
+}
+
+// sweepExpiredPreviews retires previews whose TTL elapsed.
+func sweepExpiredPreviews(ctx context.Context, db *database.DB, engine *deployment.DeploymentEngine) {
+	q := sqlcdb.New(db.DB)
+	rows, err := q.ListSweepablePreviews(ctx)
+	if err != nil {
+		return
+	}
+	var ids []uuid.UUID
+	for _, r := range rows {
+		ids = append(ids, r.ID)
+		if r.PreviewServiceID.Valid {
+			removeServiceRuntime(ctx, db, engine, r.PreviewServiceID.UUID)
+			_ = q.DeleteServiceByID(ctx, r.PreviewServiceID.UUID)
+		}
+	}
+	for _, id := range ids {
+		_ = q.MarkPreviewEnvironmentStatus(ctx, sqlcdb.MarkPreviewEnvironmentStatusParams{
+			Status: "expired", ID: id})
+	}
+}
+
+// syncPreviewStatuses folds the clone's live service status into the
+// preview row so list/detail endpoints reflect the real deploy state.
+func syncPreviewStatuses(ctx context.Context, db *database.DB) {
+	_ = sqlcdb.New(db.DB).SyncPreviewStatuses(ctx)
+}

app/backend/internal/api/preview_environments_test.go

@@ -0,0 +1,30 @@
+package api
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestPreviewServiceName(t *testing.T) {
+	cases := []struct {
+		svc, branch string
+		want        string
+	}{
+		{"whoami-web", "feature-x", "whoami-web-feature-x-preview"},
+		{"My App", "feat/JARV-123_foo", "my-app-feat-jarv-123-foo-preview"},
+		{"svc", "", "svc-preview"},
+	}
+	for _, tc := range cases {
+		got := previewServiceName(tc.svc, tc.branch)
+		if got != tc.want {
+			t.Fatalf("previewServiceName(%q,%q) = %q, want %q", tc.svc, tc.branch, got, tc.want)
+		}
+		if len(got) > 63 {
+			t.Fatalf("name exceeds DNS label limit: %q", got)
+		}
+	}
+	// A name that sanitizes to nothing must still be usable.
+	if got := previewServiceName("!!!", "%%%"); !strings.HasPrefix(got, "preview-") {
+		t.Fatalf("expected fallback name, got %q", got)
+	}
+}

app/backend/internal/api/routes.go

@@ -5,6 +5,7 @@ import (
 	"log"
 	"net/http"
 	"os"
+	"path/filepath"
 	"time"
 
 	"containr/internal/build"
@@ -43,6 +44,8 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		dockerClient = client
 		buildManager = build.NewBuildManager("/tmp/containr-builds", dockerClient)
 		deploymentEngine = deployment.NewDeploymentEngine(buildManager, dockerClient)
+		initArtifacts(filepath.Join("/tmp/containr-builds", "artifacts"))
+		purgeStaleArtifacts()
 		// Node-pinned services dispatch container lifecycle to the agent's
 		// command queue instead of the local Docker socket.
 		deploymentEngine.SetNodeRunner(newAgentNodeRunner(db))
@@ -108,6 +111,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 
 	// Sleep sweeper — scales idle services to zero and prunes wake containers.
 	StartSleepSweeper(context.Background(), db, dockerClient, deploymentEngine, cfg.Port)
+	StartPreviewSweeper(context.Background(), db, deploymentEngine)
 
 	// Audit retention — prunes rows past AUDIT_RETENTION_DAYS (default 90).
 	StartAuditRetention(context.Background(), db)
@@ -266,6 +270,12 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 	// endpoint, verified against the provisioned webhook secret.
 	router.POST("/api/git/github-app/webhook", handleGitHubAppWebhook)
 
+	// Public API gateway data plane. Lives outside /api/v1 so each service's
+	// route_prefix (/g/<slug>) maps cleanly; auth is the caller's api_key,
+	// not a session.
+	router.Any("/g/:slug", handleGatewayProxy)
+	router.Any("/g/:slug/*path", handleGatewayProxy)
+
 	v1 := router.Group("/api/v1")
 	{
 		// Public routes (no authentication required)
@@ -276,6 +286,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			public.POST("/auth/register", handleRegister)
 			public.GET("/maintenance", handleMaintenancePage)
 			public.GET("/branding", handleGetBranding)
+			public.GET("/setup/status", handleSetupStatus)
 
 			// Invite accept flow — validates the link, then registers
 			// even while public signup is closed.
@@ -285,6 +296,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			// Wake callback for sleep-mode placeholders. Unauthenticated but
 			// non-destructive: it only reconciles the service back to running.
 			public.Any("/internal/wake/:id", handleServiceWake)
+			public.Any("/internal/wake-page/:id", handleServiceWakePage)
 		}
 
 		// Read routes — public browsing. OptionalAuth resolves a session when
@@ -296,6 +308,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			read.GET("/projects", handleGetProjects)
 			read.GET("/projects/:id", handleGetProject)
 			read.GET("/projects/:id/services", handleGetServices)
+			read.GET("/projects/:id/environments", handleListEnvironments)
 			read.GET("/projects/:id/preview-environments", handleGetPreviewEnvironments)
 			read.GET("/projects/:id/security/history", securityHandler.GetProjectSecurityHistory)
 			read.GET("/projects/:id/vulnerabilities", securityHandler.GetVulnerabilities)
@@ -343,6 +356,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 		{
 			authed.GET("/user/profile", handleGetProfile)
 			authed.PUT("/user/profile", handleUpdateProfile)
+			authed.POST("/setup/complete", handleSetupComplete)
 
 			// Personal access tokens for CLI/MCP/agent auth.
 			authed.GET("/user/tokens", handleListUserTokens)
@@ -352,6 +366,10 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.GET("/notifications", handleListNotifications)
 			authed.POST("/notifications/:id/read", handleMarkNotificationRead)
 			authed.POST("/notifications/read-all", handleMarkAllNotificationsRead)
+			authed.GET("/notifications/channels", handleListNotificationChannels)
+			authed.POST("/notifications/channels", handleCreateNotificationChannel)
+			authed.POST("/notifications/channels/:id/test", handleTestNotificationChannel)
+			authed.DELETE("/notifications/channels/:id", handleDeleteNotificationChannel)
 
 			// WebSocket endpoint
 			authed.GET("/ws", handleWebSocket)
@@ -465,6 +483,8 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.POST("/databases/:id/backups/import", databaseHandler.ImportBackup)
 			authed.GET("/databases/:id/backups/:bid/download", databaseHandler.DownloadBackup)
 
+			authed.POST("/projects/:id/environments", handleCreateEnvironment)
+			authed.DELETE("/environments/:id", handleDeleteEnvironment)
 			authed.POST("/projects/:id/preview-environments", handleCreatePreviewEnvironment)
 			authed.PUT("/preview-environments/:id", handleUpdatePreviewEnvironment)
 			authed.DELETE("/preview-environments/:id", handleDeletePreviewEnvironment)
@@ -483,6 +503,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.POST("/templates/:id/deploy", handleCreateFromTemplate)
 			authed.POST("/templates/:id/plan", handlePlanTemplate)
 			authed.POST("/templates/import/compose", handleImportCompose)
+			authed.POST("/templates/import/git", handleImportGitCompose)
 			authed.POST("/templates/deploy", handleDeployInlineGraph)
 
 			authed.POST("/cron-jobs", handleCreateCronJob)

app/backend/internal/api/runtime.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
 	"net/http"
 	"regexp"
@@ -10,6 +11,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/secrets"
@@ -22,22 +24,17 @@ import (
 // service — covers pinned placements, spread replicas, and leftovers from a
 // since-cleared pin.
 func remoteAgentsForService(ctx context.Context, db *database.DB, serviceID uuid.UUID) []string {
-	rows, err := db.Query(
-		`SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1`,
-		serviceID,
-	)
+	ids, err := sqlcdb.New(db.DB).ListNodeAgentsForService(ctx, serviceID.String())
 	if err != nil {
 		return nil
 	}
-	defer rows.Close()
-	var ids []string
-	for rows.Next() {
-		var id string
-		if rows.Scan(&id) == nil && id != "" {
-			ids = append(ids, id)
+	out := make([]string, 0, len(ids))
+	for _, id := range ids {
+		if id != "" {
+			out = append(out, id)
 		}
 	}
-	return ids
+	return out
 }
 
 // serviceLifecycle routes a start/stop/restart action to every agent holding
@@ -94,11 +91,14 @@ func serviceRuntimeSpec(db *database.DB, service Service) (deployment.RuntimeSpe
 		RestartPolicy: service.RestartPolicy,
 		NodeID:        serviceNodeID(db, service.ID),
 		Spread:        serviceSpread(db, service.ID),
+		PlacementTags: servicePlacementTags(db, service.ID),
 	}
 	// Best effort: reuse the host port from the last live deployment so the
 	// public URL survives restarts. Column exists post-migration; older DBs
 	// silently get ephemeral ports.
-	_ = db.QueryRow(`SELECT published_port FROM services WHERE id = $1`, service.ID).Scan(&spec.PublishedPort)
+	if p, err := sqlcdb.New(db.DB).GetServicePublishedPort(context.Background(), service.ID); err == nil {
+		spec.PublishedPort = p
+	}
 	if cmd := strings.TrimSpace(service.Command); cmd != "" {
 		spec.Command = strings.Fields(cmd)
 	}
@@ -120,6 +120,7 @@ func serviceRuntimeSpec(db *database.DB, service Service) (deployment.RuntimeSpe
 	spec.Volumes = loadServiceVolumes(db, service.ID)
 	spec.Domains = serviceDomainNames(db, service.ID, service.Domain)
 	spec.Maintenance, spec.BasicAuthUsers = serviceAccess(db, service.ID)
+	spec.TraefikLabels = serviceTraefikLabels(db, service.ID)
 	if spec.Maintenance {
 		spec.MaintenanceURL = maintenanceURL(db)
 	}
@@ -135,42 +136,23 @@ var refVarPattern = regexp.MustCompile(`\$\{\{\s*([A-Za-z0-9_-]+)\.([A-Za-z_][A-
 // secrets) and expands ${{service.KEY}} references. KEY may be a variable on
 // the referenced service, or the builtins HOST (service name alias) and PORT.
 func resolveServiceEnv(db *database.DB, service Service) (map[string]string, error) {
-	rows, err := db.Query(
-		`SELECT key, value FROM environment_variables WHERE service_id = $1`,
-		service.ID,
-	)
+	q := sqlcdb.New(db.DB)
+	vars, err := q.ListServiceVariableValues(context.Background(), service.ID)
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
 
 	env := map[string]string{}
-	for rows.Next() {
-		var k, v string
-		if err := rows.Scan(&k, &v); err != nil {
-			return nil, err
-		}
-		env[k] = secrets.Decrypt(v)
+	for _, v := range vars {
+		env[v.Key] = secrets.Decrypt(v.Value)
 	}
 
-	var refServices []struct{ ID, Name string }
-	svcRows, err := db.Query(
-		`SELECT id, name FROM services WHERE project_id = $1`,
-		service.ProjectID,
-	)
+	refServices, err := q.ListProjectServiceRefs(context.Background(), service.ProjectID)
 	if err != nil {
 		return nil, err
 	}
-	defer svcRows.Close()
-	for svcRows.Next() {
-		var s struct{ ID, Name string }
-		if err := svcRows.Scan(&s.ID, &s.Name); err != nil {
-			return nil, err
-		}
-		refServices = append(refServices, s)
-	}
 
-	byName := map[string]string{}
+	byName := map[string]uuid.UUID{}
 	for _, s := range refServices {
 		byName[strings.ToLower(s.Name)] = s.ID
 	}
@@ -187,17 +169,15 @@ func resolveServiceEnv(db *database.DB, service Service) (map[string]string, err
 		case "HOST":
 			return serviceName, true
 		case "PORT":
-			var port int
-			if err := db.QueryRow(`SELECT COALESCE(port, 0) FROM services WHERE id = $1`, id).Scan(&port); err == nil && port > 0 {
-				return strconv.Itoa(port), true
+			if port, err := q.GetServicePort(context.Background(), id); err == nil && port > 0 {
+				return strconv.Itoa(int(port)), true
 			}
 			return "", false
 		}
-		var value string
-		err := db.QueryRow(
-			`SELECT value FROM environment_variables WHERE service_id = $1 AND key = $2`,
-			id, key,
-		).Scan(&value)
+		value, err := q.GetServiceVariableValue(context.Background(), sqlcdb.GetServiceVariableValueParams{
+			ServiceID: id,
+			Key:       key,
+		})
 		if err != nil {
 			return "", false
 		}
@@ -270,6 +250,15 @@ func parseMemoryLimit(mem string) int64 {
 	return 0
 }
 
+// setServiceStatusNow writes the stored status with a fresh updated_at.
+func setServiceStatusNow(db *database.DB, id uuid.UUID, status string) {
+	_ = sqlcdb.New(db.DB).SetServiceStatus(context.Background(), sqlcdb.SetServiceStatusParams{
+		Status:    sql.NullString{String: status, Valid: true},
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        id,
+	})
+}
+
 func getRuntimeEngine(c *gin.Context) (*deployment.DeploymentEngine, *database.DB, bool) {
 	dbValue, exists := c.Get("db")
 	if !exists {
@@ -284,6 +273,22 @@ func getRuntimeEngine(c *gin.Context) (*deployment.DeploymentEngine, *database.D
 	return engineValue.(*deployment.DeploymentEngine), dbValue.(*database.DB), true
 }
 
+// serviceFromRuntimeRow maps the sqlc runtime row (with legacy-column
+// fallbacks applied in SQL) onto the API Service model.
+func serviceFromRuntimeRow(r sqlcdb.GetServiceRuntimeWithOwnerRow) Service {
+	return Service{
+		ID: r.ID, ProjectID: r.ProjectID, Name: r.Name, Type: r.Type,
+		Status: r.Status, Image: r.Image, Command: r.Command,
+		Environment: r.Environment, GitRepo: r.GitRepo, GitBranch: r.GitBranch,
+		BuildPath: r.BuildPath, CPU: r.Cpu, Memory: r.Memory,
+		Replicas: int(r.Replicas), Port: int(r.Port), Domain: r.Domain,
+		HealthCheckPath: r.HealthcheckPath, RestartPolicy: r.RestartPolicy,
+		Builder: r.Builder, CPUReserve: r.CpuReserve,
+		MemoryReserve: r.MemoryReserve, StaticBuildCmd: r.StaticBuildCmd,
+		StaticDir: r.StaticDir, CreatedAt: r.CreatedAt.Time, UpdatedAt: r.UpdatedAt.Time,
+	}
+}
+
 func loadOwnedService(c *gin.Context, db *database.DB) (Service, bool) {
 	serviceID, err := uuid.Parse(c.Param("id"))
 	if err != nil {
@@ -296,43 +301,16 @@ func loadOwnedService(c *gin.Context, db *database.DB) (Service, bool) {
 		return Service{}, false
 	}
 
-	var service Service
-	var owner string
-	err = db.QueryRow(
-		`SELECT s.id, s.project_id, s.name,
-		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
-		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
-		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
-		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
-		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at, p.owner_id
-		 FROM services s JOIN projects p ON s.project_id = p.id
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt, &owner,
-	)
+	row, err := sqlcdb.New(db.DB).GetServiceRuntimeWithOwner(context.Background(), serviceID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return Service{}, false
 	}
-	if owner != userID.(string) && !isAdminUser(db, userID.(string)) {
+	if row.OwnerID.String() != userID.(string) && !isAdminUser(db, userID.(string)) {
 		c.JSON(http.StatusForbidden, gin.H{"error": "Access denied"})
 		return Service{}, false
 	}
-	return service, true
+	return serviceFromRuntimeRow(row), true
 }
 
 // loadReadableService loads a service when the caller may read its project:
@@ -344,39 +322,13 @@ func loadReadableService(c *gin.Context, db *database.DB) (Service, bool) {
 		return Service{}, false
 	}
 
-	var service Service
-	var projectID uuid.UUID
-	err = db.QueryRow(
-		`SELECT s.id, s.project_id, s.name,
-		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
-		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
-		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
-		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
-		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at, s.project_id
-		 FROM services s
-		 WHERE s.id = $1`,
-		serviceID,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt, &projectID,
-	)
+	row, err := sqlcdb.New(db.DB).GetServiceRuntimeWithOwner(context.Background(), serviceID)
 	if err != nil {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return Service{}, false
 	}
-	if _, allowed := projectReadAccess(c, db, projectID); !allowed {
+	service := serviceFromRuntimeRow(row)
+	if _, allowed := projectReadAccess(c, db, service.ProjectID); !allowed {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found"})
 		return Service{}, false
 	}
@@ -427,7 +379,7 @@ func reconcileNow(c *gin.Context, engine *deployment.DeploymentEngine, db *datab
 		status = state.Status
 		persistPublishedPort(db, service.ID, state.Ports)
 	}
-	_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
+	setServiceStatusNow(db, service.ID, status)
 	c.JSON(http.StatusOK, gin.H{"runtime": state})
 	return true
 }
@@ -446,7 +398,7 @@ func handleServiceStart(c *gin.Context) {
 		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
 		return
 	}
-	_, _ = db.Exec(`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	setServiceStatusNow(db, service.ID, "running")
 	c.JSON(http.StatusOK, gin.H{"status": "running"})
 }
 
@@ -464,7 +416,7 @@ func handleServiceStop(c *gin.Context) {
 		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
 		return
 	}
-	_, _ = db.Exec(`UPDATE services SET status = 'stopped', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	setServiceStatusNow(db, service.ID, "stopped")
 	c.JSON(http.StatusOK, gin.H{"status": "stopped"})
 }
 
@@ -483,7 +435,7 @@ func handleServiceRestart(c *gin.Context) {
 		c.JSON(http.StatusBadGateway, gin.H{"error": err.Error()})
 		return
 	}
-	_, _ = db.Exec(`UPDATE services SET status = 'running', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
+	setServiceStatusNow(db, service.ID, "running")
 	c.JSON(http.StatusOK, gin.H{"status": "running"})
 }
 
@@ -503,12 +455,8 @@ func handleServiceRedeploy(c *gin.Context) {
 	image := service.Image
 	if image == "" {
 		// Git-sourced service: reuse the last successful deployment image.
-		err := db.QueryRow(
-			`SELECT image_name || ':' || image_tag FROM deployments
-			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
-			 ORDER BY created_at DESC LIMIT 1`,
-			service.ID,
-		).Scan(&image)
+		var err error
+		image, err = sqlcdb.New(db.DB).GetLastDeployedImage(context.Background(), service.ID)
 		if err != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "No deployable image yet — run a deployment first"})
 			return
@@ -554,7 +502,7 @@ func reconcileServiceJob(ctx context.Context, db *database.DB, engine *deploymen
 		if state.Status != "" {
 			status = state.Status
 		}
-		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
+		setServiceStatusNow(db, service.ID, status)
 	}
 	return state, nil
 }
@@ -573,12 +521,9 @@ func enqueueServiceRedeploy(c *gin.Context, db *database.DB, service Service) bo
 	}
 	image := service.Image
 	if image == "" {
-		if err := db.QueryRow(
-			`SELECT image_name || ':' || image_tag FROM deployments
-			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
-			 ORDER BY created_at DESC LIMIT 1`,
-			service.ID,
-		).Scan(&image); err != nil {
+		var err error
+		image, err = sqlcdb.New(db.DB).GetLastDeployedImage(context.Background(), service.ID)
+		if err != nil {
 			return false
 		}
 	}
@@ -626,10 +571,10 @@ func persistPublishedPort(db *database.DB, serviceID uuid.UUID, ports []uint16)
 	if len(ports) == 0 {
 		return
 	}
-	_, _ = db.Exec(
-		`UPDATE services SET published_port = $1 WHERE id = $2 AND published_port <> $1`,
-		int(ports[0]), serviceID,
-	)
+	_ = sqlcdb.New(db.DB).SetServicePublishedPort(context.Background(), sqlcdb.SetServicePublishedPortParams{
+		PublishedPort: int32(ports[0]),
+		ID:            serviceID,
+	})
 }
 
 // liveServiceStatus reconciles the stored status with real container state.
@@ -652,11 +597,13 @@ func liveServiceStatus(c *gin.Context, db *database.DB, service *Service) {
 	}
 	if state.Status != service.Status {
 		service.Status = state.Status
-		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, state.Status, time.Now(), service.ID)
+		setServiceStatusNow(db, service.ID, state.Status)
 	}
 	persistPublishedPort(db, service.ID, state.Ports)
 	if service.Domain != "" {
 		service.PublicURL = "https://" + service.Domain
+	} else if auto := serviceAutoDomains(db, service.ID); len(auto) > 0 {
+		service.PublicURL = "https://" + auto[0]
 	} else if len(state.URLs) > 0 {
 		service.PublicURL = rewriteLoopbackURL(state.URLs[0], requestHostname(c))
 	}
@@ -672,44 +619,22 @@ func runtimeScaleService(c *gin.Context, serviceID string, replicas int) error {
 		return fmt.Errorf("runtime unavailable")
 	}
 
-	var service Service
-	var owner string
-	err := db.QueryRow(
-		`SELECT s.id, s.project_id, s.name,
-		        COALESCE(s.type, s.service_type, ''), COALESCE(s.status, ''),
-		        COALESCE(s.image, s.image_name, ''), COALESCE(s.command, s.start_command, ''),
-		        COALESCE(s.environment, ''), COALESCE(s.git_repo, s.source_url, ''),
-		        COALESCE(s.git_branch, ''), COALESCE(s.build_path, ''),
-		        COALESCE(s.cpu, ''), COALESCE(s.memory, ''),
-		        COALESCE(s.replicas, 1), COALESCE(s.port, 0),
-		        COALESCE(s.domain, ''), COALESCE(s.healthcheck_path, ''),
-		        COALESCE(s.restart_policy, 'unless-stopped'),
-		        COALESCE(s.builder, 'auto'), COALESCE(s.cpu_reserve, ''),
-		        COALESCE(s.memory_reserve, ''), COALESCE(s.static_build_cmd, ''),
-		        COALESCE(s.static_dir, ''),
-		        s.created_at, s.updated_at, p.owner_id
-		 FROM services s JOIN projects p ON s.project_id = p.id
-		 WHERE s.id = $1`, serviceID,
-	).Scan(
-		&service.ID, &service.ProjectID, &service.Name, &service.Type, &service.Status,
-		&service.Image, &service.Command, &service.Environment, &service.GitRepo,
-		&service.GitBranch, &service.BuildPath, &service.CPU, &service.Memory,
-		&service.Replicas, &service.Port, &service.Domain, &service.HealthCheckPath,
-		&service.RestartPolicy, &service.Builder, &service.CPUReserve,
-		&service.MemoryReserve, &service.StaticBuildCmd, &service.StaticDir,
-		&service.CreatedAt, &service.UpdatedAt, &owner,
-	)
+	q := sqlcdb.New(db.DB)
+	sid, err := uuid.Parse(serviceID)
 	if err != nil {
 		return err
 	}
+	row, err := q.GetServiceRuntimeWithOwner(context.Background(), sid)
+	if err != nil {
+		return err
+	}
+	service := serviceFromRuntimeRow(row)
 	if service.Image == "" {
-		if err := db.QueryRow(
-			`SELECT image_name || ':' || image_tag FROM deployments
-			 WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
-			 ORDER BY created_at DESC LIMIT 1`, service.ID,
-		).Scan(&service.Image); err != nil {
+		image, err := q.GetLastDeployedImage(context.Background(), service.ID)
+		if err != nil {
 			return fmt.Errorf("no deployed image to scale")
 		}
+		service.Image = image
 	}
 
 	spec, err := serviceRuntimeSpec(db, service)
@@ -727,7 +652,11 @@ func runtimeScaleService(c *gin.Context, serviceID string, replicas int) error {
 	if state != nil {
 		persistPublishedPort(db, service.ID, state.Ports)
 	}
-	_, _ = db.Exec(`UPDATE services SET replicas = $1, updated_at = $2 WHERE id = $3`, replicas, time.Now(), service.ID)
+	_ = q.SetServiceReplicas(context.Background(), sqlcdb.SetServiceReplicasParams{
+		Replicas:  int32(replicas),
+		UpdatedAt: sql.NullTime{Time: time.Now(), Valid: true},
+		ID:        service.ID,
+	})
 	return nil
 }
 
@@ -746,48 +675,35 @@ func handleServiceEnvCheck(c *gin.Context) {
 		return
 	}
 
-	rows, err := db.Query(
-		`SELECT key, value, COALESCE(is_secret, false) FROM environment_variables WHERE service_id = $1`,
-		service.ID,
-	)
+	q := sqlcdb.New(db.DB)
+	vars, err := q.ListServiceVariablesWithSecret(context.Background(), service.ID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
-	defer rows.Close()
 
 	var unresolved, empty, unreadable []string
 	var raw []struct{ key, val string }
-	for rows.Next() {
-		var k, v string
-		var secret bool
-		if err := rows.Scan(&k, &v, &secret); err != nil {
-			continue
-		}
-		decrypted := secrets.Decrypt(v)
-		if secret && secrets.IsEncrypted(v) && decrypted == v {
+	for _, v := range vars {
+		decrypted := secrets.Decrypt(v.Value)
+		if v.IsSecret && secrets.IsEncrypted(v.Value) && decrypted == v.Value {
 			// Ciphertext failed to decrypt — Decrypt returns the input.
-			unreadable = append(unreadable, k)
+			unreadable = append(unreadable, v.Key)
 			continue
 		}
 		if strings.TrimSpace(decrypted) == "" {
-			empty = append(empty, k)
+			empty = append(empty, v.Key)
 		}
-		raw = append(raw, struct{ key, val string }{k, decrypted})
+		raw = append(raw, struct{ key, val string }{v.Key, decrypted})
 	}
 
 	// Project siblings for ${{name.KEY}} resolution.
-	siblingIDs := map[string]string{}
-	svcRows, err := db.Query(`SELECT id, name FROM services WHERE project_id = $1`, service.ProjectID)
-	if err == nil {
-		for svcRows.Next() {
-			var id, name string
-			if err := svcRows.Scan(&id, &name); err == nil {
-				siblingIDs[strings.ToLower(name)] = id
+	siblingIDs := map[string]uuid.UUID{}
+	if refs, err := q.ListProjectServiceRefs(context.Background(), service.ProjectID); err == nil {
+		for _, s := range refs {
+			siblingIDs[strings.ToLower(s.Name)] = s.ID
 		}
 	}
-		svcRows.Close()
-	}
 
 	resolvable := func(serviceName, key string) bool {
 		id, ok := siblingIDs[strings.ToLower(serviceName)]
@@ -798,20 +714,14 @@ func handleServiceEnvCheck(c *gin.Context) {
 			return true
 		}
 		if strings.EqualFold(key, "PORT") {
-			var port int
-			if err := db.QueryRow(`SELECT COALESCE(port, 0) FROM services WHERE id = $1`, id).Scan(&port); err == nil {
-				return port > 0
+			port, err := q.GetServicePort(context.Background(), id)
+			return err == nil && port > 0
 		}
-			return false
-		}
-		var n int
-		if err := db.QueryRow(
-			`SELECT COUNT(*) FROM environment_variables WHERE service_id = $1 AND key = $2`,
-			id, key,
-		).Scan(&n); err == nil {
-			return n > 0
-		}
-		return false
+		_, err := q.GetServiceVariableValue(context.Background(), sqlcdb.GetServiceVariableValueParams{
+			ServiceID: id,
+			Key:       key,
+		})
+		return err == nil
 	}
 
 	for _, kv := range raw {

app/backend/internal/api/service_ops.go

@@ -1,11 +1,14 @@
 package api
 
 import (
+	"context"
+	"database/sql"
 	"net/http"
 	"strings"
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -53,11 +56,8 @@ func handleCloneService(c *gin.Context) {
 	if name == "" {
 		name = source.Name + "-copy"
 	}
-	var count int
-	_ = db.(*database.DB).QueryRow(
-		`SELECT COUNT(*) FROM services WHERE project_id = $1 AND name = $2`,
-		targetProjectID, name,
-	).Scan(&count)
+	count, _ := sqlcdb.New(db.(*database.DB).DB).CountServicesByName(
+		c.Request.Context(), sqlcdb.CountServicesByNameParams{ProjectID: targetProjectID, Name: name})
 	if count > 0 {
 		c.JSON(http.StatusConflict, gin.H{"error": "Service name already exists in target project", "code": "CONFLICT"})
 		return
@@ -67,68 +67,74 @@ func handleCloneService(c *gin.Context) {
 	if req.Environment != "" {
 		environment = req.Environment
 	}
-	if environment == "" {
-		environment = "production"
-	}
-	environmentID, err := getProjectEnvironmentID(db.(*database.DB), targetProjectID, environment)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to resolve target environment"})
-		return
-	}
 
-	maintenance, basicAuth := serviceAccess(db.(*database.DB), source.ID)
-	newID := uuid.New()
-	now := time.Now()
-	// string() so pq sends text — []byte would go as bytea and fail ::jsonb.
-	volumesJSON := string(loadServiceVolumesJSON(db.(*database.DB), source.ID))
-
-	_, err = db.(*database.DB).Exec(
-		`INSERT INTO services
-			(id, project_id, name, environment_id, service_type, source_type, source_url, image_name,
-				 build_command, start_command, type, status, image, command, environment,
-				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
-				 healthcheck_path, restart_policy, volumes, maintenance_mode, basic_auth_users,
-				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
-				 created_at, updated_at)
-			SELECT $1, $2, $3, $4, service_type, source_type, source_url, image_name,
-				 build_command, start_command, type, 'stopped', image, command, $5,
-				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
-				 healthcheck_path, restart_policy, $6::jsonb, $7, $8,
-				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
-				 $9, $9
-			FROM services WHERE id = $10`,
-		newID, targetProjectID, name, environmentID, environment, volumesJSON,
-		maintenance, basicAuth, now, source.ID,
-	)
+	newID, err := cloneServiceRow(db.(*database.DB), source.ID, targetProjectID, name, environment)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clone service"})
 		return
 	}
 
-	if _, err := db.(*database.DB).Exec(
-		`INSERT INTO service_domains (service_id, domain, is_default, cert_type)
-		 SELECT $1, domain, is_default, cert_type FROM service_domains WHERE service_id = $2`,
-		newID, source.ID,
-	); err != nil {
-		_, _ = db.(*database.DB).Exec(`DELETE FROM services WHERE id = $1`, newID)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clone service domains"})
-		return
-	}
-	// Variable values are copied as stored — ciphertext stays ciphertext.
-	if _, err := db.(*database.DB).Exec(
-		`INSERT INTO environment_variables (id, service_id, key, value, is_secret)
-		 SELECT gen_random_uuid(), $1, key, value, is_secret FROM environment_variables WHERE service_id = $2`,
-		newID, source.ID,
-	); err != nil {
-		_, _ = db.(*database.DB).Exec(`DELETE FROM services WHERE id = $1`, newID)
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to clone service variables"})
-		return
-	}
-
 	LogAuditWithRequest(c, "service", source.ID.String(), "service.clone", map[string]interface{}{"cloned_to": newID.String(), "name": name})
 	c.JSON(http.StatusCreated, gin.H{"service_id": newID, "name": name, "message": "Service cloned"})
 }
 
+// cloneServiceRow copies a service's full configuration — source, build
+// settings, volumes, access gates, domains, and variables — under a new id
+// in the target project. The clone starts stopped. An empty environment
+// inherits the source's. Used by the clone endpoint and preview
+// environments, which additionally override git_branch and domains.
+func cloneServiceRow(db *database.DB, sourceID uuid.UUID, targetProjectID uuid.UUID, name, environment string) (uuid.UUID, error) {
+	ctx := context.Background()
+	q := sqlcdb.New(db.DB)
+
+	sourceEnv, err := q.GetServiceEnvironment(ctx, sourceID)
+	if err != nil {
+		return uuid.Nil, err
+	}
+	if environment == "" {
+		environment = sourceEnv
+	}
+	if environment == "" {
+		environment = "production"
+	}
+	environmentID, err := getProjectEnvironmentID(db, targetProjectID, environment)
+	if err != nil {
+		return uuid.Nil, err
+	}
+
+	maintenance, basicAuth := serviceAccess(db, sourceID)
+	newID := uuid.New()
+	now := time.Now()
+
+	err = q.CloneServiceRow(ctx, sqlcdb.CloneServiceRowParams{
+		ID:              newID,
+		ProjectID:       targetProjectID,
+		Name:            name,
+		EnvironmentID:   environmentID,
+		Environment:     sql.NullString{String: environment, Valid: true},
+		MaintenanceMode: maintenance,
+		BasicAuthUsers:  basicAuth,
+		CreatedAt:       sql.NullTime{Time: now, Valid: true},
+		ID_2:            sourceID,
+	})
+	if err != nil {
+		return uuid.Nil, err
+	}
+
+	if err := q.CloneServiceDomains(ctx, sqlcdb.CloneServiceDomainsParams{
+		ServiceID: newID, ServiceID_2: sourceID}); err != nil {
+		_ = q.DeleteServiceByID(ctx, newID)
+		return uuid.Nil, err
+	}
+	// Variable values are copied as stored — ciphertext stays ciphertext.
+	if err := q.CloneServiceVariables(ctx, sqlcdb.CloneServiceVariablesParams{
+		ServiceID: newID, ServiceID_2: sourceID}); err != nil {
+		_ = q.DeleteServiceByID(ctx, newID)
+		return uuid.Nil, err
+	}
+	return newID, nil
+}
+
 type MoveServiceRequest struct {
 	ProjectID uuid.UUID `json:"project_id" binding:"required"`
 }
@@ -169,11 +175,8 @@ func handleMoveService(c *gin.Context) {
 		return
 	}
 
-	var count int
-	_ = db.(*database.DB).QueryRow(
-		`SELECT COUNT(*) FROM services WHERE project_id = $1 AND name = $2`,
-		req.ProjectID, service.Name,
-	).Scan(&count)
+	count, _ := sqlcdb.New(db.(*database.DB).DB).CountServicesByName(
+		c.Request.Context(), sqlcdb.CountServicesByNameParams{ProjectID: req.ProjectID, Name: service.Name})
 	if count > 0 {
 		c.JSON(http.StatusConflict, gin.H{"error": "A service with this name already exists in the target project", "code": "CONFLICT"})
 		return
@@ -189,15 +192,18 @@ func handleMoveService(c *gin.Context) {
 		return
 	}
 
-	res, err := db.(*database.DB).Exec(
-		`UPDATE services SET project_id = $1, environment_id = $2, updated_at = $3 WHERE id = $4`,
-		req.ProjectID, environmentID, time.Now(), serviceID,
-	)
+	n, err := sqlcdb.New(db.(*database.DB).DB).MoveServiceProject(
+		c.Request.Context(), sqlcdb.MoveServiceProjectParams{
+			ProjectID:     req.ProjectID,
+			EnvironmentID: environmentID,
+			UpdatedAt:     sql.NullTime{Time: time.Now(), Valid: true},
+			ID:            serviceID,
+		})
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to move service"})
 		return
 	}
-	if n, _ := res.RowsAffected(); n == 0 {
+	if n == 0 {
 		c.JSON(http.StatusNotFound, gin.H{"error": "Service not found", "code": "NOT_FOUND"})
 		return
 	}
@@ -211,16 +217,10 @@ func ownsProject(db *database.DB, projectID uuid.UUID, userID string, isAdmin bo
 	if isAdmin {
 		return true
 	}
-	var owner string
-	err := db.QueryRow(`SELECT owner_id FROM projects WHERE id = $1`, projectID).Scan(&owner)
-	return err == nil && owner == userID
-}
-
-// loadServiceVolumesJSON returns the raw stored mounts for a verbatim copy.
-func loadServiceVolumesJSON(db *database.DB, serviceID uuid.UUID) []byte {
-	var raw []byte
-	if err := db.QueryRow(`SELECT volumes FROM services WHERE id = $1`, serviceID).Scan(&raw); err != nil || len(raw) == 0 {
-		return []byte("[]")
+	uid, err := uuid.Parse(userID)
+	if err != nil {
+		return false
 	}
-	return raw
+	owner, err := sqlcdb.New(db.DB).GetProjectOwner(context.Background(), projectID)
+	return err == nil && owner == uid
 }

app/backend/internal/api/services.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"regexp"
 	"strings"
 	"time"
 
@@ -56,6 +57,12 @@ type Service struct {
 	// Spread distributes replicas across every online, schedulable agent.
 	// Mutually exclusive with an explicit NodeID pin.
 	Spread bool `json:"spread" db:"-"`
+	// PlacementTags restrict auto/spread candidates to agents carrying all
+	// listed tags. An explicit pin overrides them — pin + tags is rejected.
+	PlacementTags []string `json:"placement_tags,omitempty" db:"-"`
+	// TraefikLabels holds per-service middleware overrides —
+	// "middlewares.<name>.<type>.<field>" → value. Lazy-read.
+	TraefikLabels map[string]string `json:"traefik_labels,omitempty" db:"-"`
 	CreatedAt     time.Time         `json:"created_at" db:"created_at"`
 	UpdatedAt     time.Time         `json:"updated_at" db:"updated_at"`
 }
@@ -91,12 +98,124 @@ func serviceSpread(db *database.DB, serviceID uuid.UUID) bool {
 	return false
 }
 
-// loadServiceNode fills the pin + spread + the agent's display name for
-// responses.
+// servicePlacementTags reads the placement_tags column with the lazy pattern.
+func servicePlacementTags(db *database.DB, serviceID uuid.UUID) []string {
+	var raw []byte
+	if err := db.QueryRow(`SELECT placement_tags FROM services WHERE id = $1`, serviceID).Scan(&raw); err != nil {
+		return nil
+	}
+	var tags []string
+	if err := json.Unmarshal(raw, &tags); err != nil {
+		return nil
+	}
+	return tags
+}
+
+// normalizePlacementTags trims, lowercases, and dedupes tag input. Tags are
+// matched verbatim against node_agents.tags.
+func normalizePlacementTags(tags []string) []string {
+	seen := map[string]bool{}
+	out := make([]string, 0, len(tags))
+	for _, t := range tags {
+		t = strings.ToLower(strings.TrimSpace(t))
+		if t == "" || seen[t] {
+			continue
+		}
+		seen[t] = true
+		out = append(out, t)
+	}
+	return out
+}
+
+// traefikLabelKey matches "middlewares.<name>.<type>" with an optional
+// ".<subkey>" tail — e.g. "middlewares.rl.ratelimit.average".
+var traefikLabelKey = regexp.MustCompile(`^middlewares\.([A-Za-z0-9][A-Za-z0-9_-]{0,39})\.([A-Za-z]+)(\.[A-Za-z0-9_.*+-]+)?$`)
+
+// traefikMiddlewareTypes are the Traefik middleware kinds a service may
+// define. Router/service/provider-level keys are never accepted — those
+// would let a tenant hijack someone else's routing.
+var traefikMiddlewareTypes = map[string]bool{
+	"addprefix": true, "basicauth": true, "buffering": true, "chain": true,
+	"circuitbreaker": true, "compress": true, "digestauth": true,
+	"errors": true, "forwardauth": true, "grpcweb": true, "headers": true,
+	"inflightreq": true, "ipallowlist": true, "ipwhitelist": true,
+	"passtlsclientcert": true, "ratelimit": true, "redirectregex": true,
+	"redirectscheme": true, "replacepath": true, "replacepathregex": true,
+	"retry": true, "stripprefix": true, "stripprefixregex": true,
+}
+
+// normalizeTraefikLabels validates a raw override map. Returns the cleaned
+// map (middleware type lowercased — Traefik label keys are canonical-lower)
+// or an error naming the offending key.
+func normalizeTraefikLabels(raw map[string]string) (map[string]string, error) {
+	if len(raw) > 32 {
+		return nil, fmt.Errorf("traefik_labels: at most 32 entries (got %d)", len(raw))
+	}
+	out := make(map[string]string, len(raw))
+	names := map[string]bool{}
+	for k, v := range raw {
+		m := traefikLabelKey.FindStringSubmatch(k)
+		if m == nil {
+			return nil, fmt.Errorf("traefik_labels: invalid key %q — want middlewares.<name>.<type>[.<field>]", k)
+		}
+		mwType := strings.ToLower(m[2])
+		if !traefikMiddlewareTypes[mwType] {
+			return nil, fmt.Errorf("traefik_labels: unsupported middleware type %q", m[2])
+		}
+		if len(v) == 0 {
+			return nil, fmt.Errorf("traefik_labels: %q has an empty value", k)
+		}
+		if len(v) > 512 || strings.ContainsAny(v, "\r\n") {
+			return nil, fmt.Errorf("traefik_labels: %q value must be a single line under 512 chars", k)
+		}
+		out["middlewares."+m[1]+"."+mwType+m[3]] = v
+		names[m[1]] = true
+	}
+	if len(names) > 16 {
+		return nil, fmt.Errorf("traefik_labels: at most 16 middleware names")
+	}
+	return out, nil
+}
+
+// serviceTraefikLabels lazy-reads the traefik_labels column.
+func serviceTraefikLabels(db *database.DB, serviceID uuid.UUID) map[string]string {
+	var raw []byte
+	if err := db.QueryRow(`SELECT traefik_labels FROM services WHERE id = $1`, serviceID).Scan(&raw); err != nil {
+		return nil
+	}
+	var labels map[string]string
+	if err := json.Unmarshal(raw, &labels); err != nil || len(labels) == 0 {
+		return nil
+	}
+	return labels
+}
+
+// traefikLabelsJSON marshals an override map for the jsonb column.
+func traefikLabelsJSON(labels map[string]string) []byte {
+	if len(labels) == 0 {
+		return []byte("{}")
+	}
+	raw, _ := json.Marshal(labels)
+	return raw
+}
+
+// tagsJSON marshals a tag list for a jsonb column; empty stays an array, not null.
+func tagsJSON(tags []string) []byte {
+	if len(tags) == 0 {
+		return []byte("[]")
+	}
+	raw, _ := json.Marshal(tags)
+	return raw
+}
+
+// loadServiceNode fills the pin + spread + placement tags + the agent's
+// display name for responses.
 func loadServiceNode(db *database.DB, s *Service) {
 	var name sql.NullString
 	s.NodeID = serviceNodeID(db, s.ID)
 	s.Spread = serviceSpread(db, s.ID)
+	s.PlacementTags = servicePlacementTags(db, s.ID)
+	s.TraefikLabels = serviceTraefikLabels(db, s.ID)
 	if s.NodeID == "" {
 		return
 	}
@@ -182,12 +301,23 @@ type CreateServiceRequest struct {
 	MemoryReserve   string          `json:"memory_reserve"`
 	StaticBuildCmd  string          `json:"static_build_cmd"`
 	StaticDir       string          `json:"static_dir"`
+	// SleepEnabled/SleepIdleMinutes opt the service into scale-to-zero at
+	// create time — previously update-only, which surprised API/CLI users.
+	SleepEnabled     *bool `json:"sleep_enabled"`
+	SleepIdleMinutes *int  `json:"sleep_idle_minutes"`
 	// NodeID pins placement to a node agent; "auto" picks the least-loaded
 	// online agent, "local"/"" runs on the Containr host.
 	NodeID string `json:"node_id"`
 	// Spread distributes replicas across every online, schedulable agent.
 	// Mutually exclusive with an explicit node pin.
 	Spread *bool `json:"spread"`
+	// PlacementTags restrict auto/spread candidates to agents carrying all
+	// listed tags. Mutually exclusive with an explicit node pin.
+	PlacementTags []string `json:"placement_tags"`
+	// TraefikLabels defines extra Traefik middlewares for this service's
+	// router — keys "middlewares.<name>.<type>[.<field>]", validated against
+	// an allowlist. Defined middlewares attach to the router automatically.
+	TraefikLabels map[string]string `json:"traefik_labels"`
 }
 
 // UpdateServiceRequest represents a request to update a service
@@ -222,6 +352,13 @@ type UpdateServiceRequest struct {
 	// Spread toggles multi-node replica distribution; pointer so false is
 	// a real update, not a missing field.
 	Spread *bool `json:"spread"`
+	// PlacementTags restrict auto/spread candidates to agents carrying all
+	// listed tags; pointer so [] clears the requirement. Mutually exclusive
+	// with an explicit node pin.
+	PlacementTags *[]string `json:"placement_tags"`
+	// TraefikLabels replaces the service's middleware overrides; pointer so
+	// {} clears them and nil leaves them untouched.
+	TraefikLabels *map[string]string `json:"traefik_labels"`
 }
 
 // handleGetServices retrieves all services for a project
@@ -425,6 +562,14 @@ func handleCreateService(c *gin.Context) {
 	if service.Builder == "static" && service.StaticDir == "" {
 		service.StaticDir = "dist"
 	}
+	if len(req.TraefikLabels) > 0 {
+		labels, err := normalizeTraefikLabels(req.TraefikLabels)
+		if err != nil {
+			respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
+			return
+		}
+		service.TraefikLabels = labels
+	}
 	for label, check := range map[string]func(string) error{
 		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
 		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
@@ -462,15 +607,30 @@ func handleCreateService(c *gin.Context) {
 
 	sourceType := inferServiceSourceType(service)
 
+	if req.SleepEnabled != nil {
+		service.SleepEnabled = *req.SleepEnabled
+	}
+	if req.SleepIdleMinutes != nil {
+		if *req.SleepIdleMinutes < 1 || *req.SleepIdleMinutes > 1440 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "sleep_idle_minutes must be 1-1440", "code": "VALIDATION"})
+			return
+		}
+		service.SleepIdleMinutes = *req.SleepIdleMinutes
+	}
 	if req.Spread != nil {
 		service.Spread = *req.Spread
 	}
+	service.PlacementTags = normalizePlacementTags(req.PlacementTags)
 	if req.NodeID != "" {
-		if service.Spread && req.NodeID != "auto" {
+		if service.Spread && req.NodeID != "auto" && req.NodeID != "local" {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "spread and an explicit node pin are mutually exclusive", "code": "VALIDATION"})
 			return
 		}
-		nodeID, nodeErr := resolveNodePin(c.Request.Context(), db.(*database.DB), req.NodeID)
+		if len(service.PlacementTags) > 0 && req.NodeID != "auto" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "placement tags only apply to remote placement — set node_id=\"auto\" or omit it", "code": "VALIDATION"})
+			return
+		}
+		nodeID, nodeErr := resolveNodePin(c.Request.Context(), db.(*database.DB), req.NodeID, service.PlacementTags)
 		if nodeErr != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": nodeErr.Error(), "code": "VALIDATION"})
 			return
@@ -488,9 +648,10 @@ func handleCreateService(c *gin.Context) {
 				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
 				 healthcheck_path, restart_policy, volumes,
 				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
-				 node_id, spread, created_at, updated_at)
+				 node_id, spread, placement_tags, sleep_enabled, sleep_idle_minutes,
+				 traefik_labels, created_at, updated_at)
 			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26,
-					$27, $28, $29, $30, $31, $32, $33, $34, $35)`,
+					$27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39)`,
 		service.ID, service.ProjectID, service.Name, environmentID, service.Type,
 		sourceType, firstNonEmpty(service.GitRepo, service.Image), service.Image,
 		"", service.Command, service.Type, service.Status, service.Image, service.Command,
@@ -500,6 +661,10 @@ func handleCreateService(c *gin.Context) {
 		service.StaticBuildCmd, service.StaticDir,
 		sql.NullString{String: service.NodeID, Valid: service.NodeID != ""},
 		service.Spread,
+		tagsJSON(service.PlacementTags),
+		service.SleepEnabled,
+		sql.NullInt32{Int32: int32(service.SleepIdleMinutes), Valid: service.SleepIdleMinutes > 0},
+		traefikLabelsJSON(service.TraefikLabels),
 		service.CreatedAt, service.UpdatedAt,
 	)
 
@@ -776,6 +941,16 @@ func handleUpdateService(c *gin.Context) {
 		}
 		existingService.SleepIdleMinutes = *req.SleepIdleMinutes
 	}
+	if req.TraefikLabels != nil {
+		labels, err := normalizeTraefikLabels(*req.TraefikLabels)
+		if err != nil {
+			respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
+			return
+		}
+		existingService.TraefikLabels = labels
+	} else {
+		existingService.TraefikLabels = serviceTraefikLabels(db.(*database.DB), serviceID)
+	}
 	for label, check := range map[string]func(string) error{
 		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
 		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
@@ -807,13 +982,22 @@ func handleUpdateService(c *gin.Context) {
 	} else {
 		existingService.Spread = serviceSpread(db.(*database.DB), serviceID)
 	}
+	if req.PlacementTags != nil {
+		existingService.PlacementTags = normalizePlacementTags(*req.PlacementTags)
+	} else {
+		existingService.PlacementTags = servicePlacementTags(db.(*database.DB), serviceID)
+	}
 	if req.NodeID != nil {
 		nodeValue := strings.TrimSpace(*req.NodeID)
 		if existingService.Spread && nodeValue != "" && nodeValue != "auto" && nodeValue != "local" {
 			c.JSON(http.StatusBadRequest, gin.H{"error": "spread and an explicit node pin are mutually exclusive — set spread=false first", "code": "VALIDATION"})
 			return
 		}
-		nodeID, nodeErr := resolveNodePin(c.Request.Context(), db.(*database.DB), nodeValue)
+		if len(existingService.PlacementTags) > 0 && nodeValue != "" && nodeValue != "auto" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "service has placement tags — clear them (placement_tags=[]) before pinning or going local", "code": "VALIDATION"})
+			return
+		}
+		nodeID, nodeErr := resolveNodePin(c.Request.Context(), db.(*database.DB), nodeValue, existingService.PlacementTags)
 		if nodeErr != nil {
 			c.JSON(http.StatusBadRequest, gin.H{"error": nodeErr.Error(), "code": "VALIDATION"})
 			return
@@ -826,6 +1010,10 @@ func handleUpdateService(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "service already has an explicit node pin — clear it (node_id=\"local\") before enabling spread", "code": "VALIDATION"})
 		return
 	}
+	if len(existingService.PlacementTags) > 0 && existingService.NodeID != "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "service already has an explicit node pin — clear it (node_id=\"local\") before setting placement tags", "code": "VALIDATION"})
+		return
+	}
 
 	existingService.UpdatedAt = time.Now()
 
@@ -838,7 +1026,8 @@ func handleUpdateService(c *gin.Context) {
 				restart_policy = $15, volumes = COALESCE($17::jsonb, volumes), updated_at = $16,
 				builder = $19, cpu_reserve = $20, memory_reserve = $21,
 				static_build_cmd = $22, static_dir = $23,
-				sleep_enabled = $24, sleep_idle_minutes = $25, node_id = $26, spread = $27
+				sleep_enabled = $24, sleep_idle_minutes = $25, node_id = $26, spread = $27,
+				placement_tags = $28::jsonb, traefik_labels = $29::jsonb
 			WHERE id = $18`,
 		existingService.Name, existingService.Type, existingService.Image, existingService.Command,
 		existingService.Environment, existingService.GitRepo, existingService.GitBranch,
@@ -851,6 +1040,8 @@ func handleUpdateService(c *gin.Context) {
 		existingService.SleepEnabled, existingService.SleepIdleMinutes,
 		sql.NullString{String: existingService.NodeID, Valid: existingService.NodeID != ""},
 		existingService.Spread,
+		tagsJSON(existingService.PlacementTags),
+		traefikLabelsJSON(existingService.TraefikLabels),
 	)
 
 	if err != nil {

app/backend/internal/api/services_routing_test.go

@@ -0,0 +1,64 @@
+package api
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestNormalizeTraefikLabels(t *testing.T) {
+	valid := map[string]string{
+		"middlewares.rl.ratelimit.average":                             "100",
+		"middlewares.rl.ratelimit.period":                              "1m",
+		"middlewares.sec.headers.customrequestheaders.X-Frame-Options": "DENY",
+		"middlewares.gzip.compress":                                    "true",
+	}
+	out, err := normalizeTraefikLabels(valid)
+	if err != nil {
+		t.Fatalf("valid labels rejected: %v", err)
+	}
+	if len(out) != len(valid) {
+		t.Fatalf("expected %d labels, got %d", len(valid), len(out))
+	}
+	if out["middlewares.gzip.compress"] != "true" {
+		t.Fatalf("flag-style middleware missing: %v", out)
+	}
+}
+
+func TestNormalizeTraefikLabelsLowercasesType(t *testing.T) {
+	out, err := normalizeTraefikLabels(map[string]string{
+		"middlewares.rl.RateLimit.average": "10",
+	})
+	if err != nil {
+		t.Fatalf("mixed-case type rejected: %v", err)
+	}
+	if out["middlewares.rl.ratelimit.average"] != "10" {
+		t.Fatalf("type not lowercased: %v", out)
+	}
+}
+
+func TestNormalizeTraefikLabelsRejects(t *testing.T) {
+	cases := map[string]string{
+		"traefik.enable":                                 "true", // provider-level
+		"middlewares..ratelimit.average":                 "1",    // empty name
+		"middlewares.x.evilinject.thing":                 "1",    // unknown type
+		"routers.svc.rule":                               "x",    // router hijack
+		"middlewares.x.ratelimit.average.bad\ninjection": "1",    // control char in key fails regex
+	}
+	for k, v := range cases {
+		if _, err := normalizeTraefikLabels(map[string]string{k: v}); err == nil {
+			t.Fatalf("key %q should have been rejected", k)
+		}
+	}
+}
+
+func TestNormalizeTraefikLabelsRejectsBadValues(t *testing.T) {
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": ""}); err == nil {
+		t.Fatal("empty value accepted")
+	}
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": strings.Repeat("x", 600)}); err == nil {
+		t.Fatal("oversized value accepted")
+	}
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": "1\nmalicious"}); err == nil {
+		t.Fatal("newline value accepted")
+	}
+}

app/backend/internal/api/setup.go

@@ -0,0 +1,78 @@
+package api
+
+// First-run setup wizard state. GET /setup/status is public so the web
+// shell can redirect fresh installs before a session exists; the flag
+// lives in app_settings so it survives restarts.
+
+import (
+	"net/http"
+	"strings"
+
+	"containr/internal/database"
+
+	"github.com/gin-gonic/gin"
+)
+
+const settingSetupCompleted = "setup_completed"
+
+// setupComplete resolves the flag. Installs that predate the wizard
+// (users + projects already exist) auto-complete — nobody who has been
+// running Containr for months should get a welcome screen.
+func setupComplete(db *database.DB, hasUsers bool) bool {
+	if strings.EqualFold(settingValue(db, settingSetupCompleted, "", ""), "true") {
+		return true
+	}
+	if !hasUsers {
+		return false
+	}
+	var projects int
+	if err := db.QueryRow(`SELECT COUNT(*) FROM projects`).Scan(&projects); err == nil && projects > 0 {
+		return true
+	}
+	return false
+}
+
+// GET /api/v1/setup/status — public: fresh installs hit it before any
+// session exists.
+func handleSetupStatus(c *gin.Context) {
+	db, ok := c.MustGet("db").(*database.DB)
+	if !ok {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Database connection not available")
+		return
+	}
+	count, err := countLocalUsers(db)
+	if err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to inspect setup state")
+		return
+	}
+	hasUsers := count > 0
+	completed := setupComplete(db, hasUsers)
+	tunnelToken, _ := resolvedTunnelToken(db)
+	c.JSON(http.StatusOK, gin.H{
+		"has_users":       hasUsers,
+		"setup_completed": completed,
+		"needs_setup":     !completed,
+		"has_github_app":  githubAppConfigured(db),
+		"has_tunnel":      tunnelToken != "",
+		"signup_enabled":  signupEnabled(db),
+	})
+}
+
+// POST /api/v1/setup/complete — marks the wizard done. Open to any
+// authenticated user: the first account is the owner, and the flag only
+// suppresses a banner.
+func handleSetupComplete(c *gin.Context) {
+	if _, ok := requireAuthenticatedUserID(c); !ok {
+		return
+	}
+	db, ok := c.MustGet("db").(*database.DB)
+	if !ok {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Database connection not available")
+		return
+	}
+	if err := setSetting(db, settingSetupCompleted, "true", false); err != nil {
+		respondError(c, http.StatusInternalServerError, "INTERNAL_ERROR", "Failed to save setup state")
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "Setup completed"})
+}

app/backend/internal/api/sleeper.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"containr/internal/database"
+	"containr/internal/database/sqlcdb"
 	"containr/internal/deployment"
 	"containr/internal/docker"
 
@@ -100,7 +101,20 @@ func sweepSleeping(ctx context.Context, db *database.DB, dc *docker.Client, engi
 	}
 	rows.Close()
 
+	q := sqlcdb.New(db.DB)
 	for _, svc := range candidates {
+		// Remote replicas live in inventory, not the local docker host —
+		// idleness comes from heartbeat-reported net counters instead.
+		if remote := remoteLiveContainers(ctx, q, svc.ID.String()); len(remote) > 0 {
+			var total uint64
+			for _, row := range remote {
+				total += rowNetBytes(row)
+			}
+			if markIdle(svc.ID, total, time.Duration(svc.IdleMinutes)*time.Minute) {
+				putToSleepRemote(ctx, db, q, svc, apiPort)
+			}
+			continue
+		}
 		containers, err := engine.ListServiceContainers(ctx, svc.ID.String())
 		if err != nil || len(containers) == 0 {
 			continue
@@ -125,6 +139,65 @@ func sweepSleeping(ctx context.Context, db *database.DB, dc *docker.Client, engi
 	}
 }
 
+// remoteLiveContainers returns inventory rows whose replicas are alive on
+// node agents — the signal that idleness must be measured remotely.
+func remoteLiveContainers(ctx context.Context, q *sqlcdb.Queries, serviceID string) []sqlcdb.ListServiceContainersRow {
+	rows, err := q.ListServiceContainers(ctx, serviceID)
+	if err != nil {
+		return nil
+	}
+	live := rows[:0]
+	for _, row := range rows {
+		var st struct {
+			State string `json:"state"`
+		}
+		if err := json.Unmarshal(row.Status.RawMessage, &st); err == nil &&
+			st.State != "" && st.State != "removed" && st.State != "sleeping" {
+			live = append(live, row)
+		}
+	}
+	return live
+}
+
+// rowNetBytes reads the cumulative rx+tx the agent reported at its last
+// heartbeat — 0 for rows written before the counter existed.
+func rowNetBytes(row sqlcdb.ListServiceContainersRow) uint64 {
+	var res struct {
+		NetBytes uint64 `json:"net_bytes"`
+	}
+	_ = json.Unmarshal(row.Resources.RawMessage, &res)
+	return res.NetBytes
+}
+
+// putToSleepRemote removes the service's remote replicas via their agents,
+// marks the service sleeping, and repoints the domain route at the wake
+// endpoint so inbound traffic brings it back.
+func putToSleepRemote(ctx context.Context, db *database.DB, q *sqlcdb.Queries, svc sleepCandidate, apiPort int) {
+	runner := newAgentNodeRunner(db)
+	for _, agentID := range remoteAgentsForService(ctx, db, svc.ID) {
+		if err := runner.ControlService(ctx, svc.ID.String(), agentID, "remove"); err != nil {
+			log.Printf("sleep: remote remove on %s failed: %v", agentID, err)
+			continue
+		}
+		_ = q.DeleteServiceContainersOnAgent(ctx, sqlcdb.DeleteServiceContainersOnAgentParams{
+			NodeAgentID: agentID,
+			ServiceID:   svc.ID.String(),
+		})
+	}
+	tracker.mu.Lock()
+	delete(tracker.activity, svc.ID)
+	tracker.mu.Unlock()
+	_, _ = db.Exec(`UPDATE services SET status = 'sleeping', updated_at = $1 WHERE id = $2`, time.Now(), svc.ID)
+	log.Printf("sleep: %s (%s) remote replicas removed after idle timeout", svc.Name, svc.ID)
+
+	var domain string
+	_ = db.QueryRow(`SELECT COALESCE(domain,'') FROM services WHERE id = $1`, svc.ID).Scan(&domain)
+	domains := serviceDomainNames(db, svc.ID, domain)
+	if len(domains) > 0 {
+		writeWakeIngress(svc.ID.String(), domains, apiPort)
+	}
+}
+
 // markIdle returns true when the network counter stopped growing past the
 // timeout. First sighting only sets the baseline — no idle without history.
 func markIdle(id uuid.UUID, bytes uint64, timeout time.Duration) bool {
@@ -191,9 +264,20 @@ func putToSleep(ctx context.Context, db *database.DB, dc *docker.Client, engine
 	}
 }
 
+// wakeCGIScript is installed as /cgi-bin/wake in the wake container. It
+// fires the wake callback on the first reachable candidate URL, in the
+// background, then serves the reloading placeholder page. Deliberately
+// single-quote-free — the file is written through printf '%s'.
+const wakeCGIScript = `#!/bin/sh
+for u in $WAKE_URLS; do wget -q -O /dev/null --timeout=20 "$u" && break; done >/dev/null 2>&1 &
+printf "Content-Type: text/html\r\n\r\n"
+printf "%s" "$WAKE_PAGE"
+`
+
 // spawnWakeContainer runs a busybox httpd holding the service's Traefik
-// host rule at higher priority. On boot it calls the wake endpoint, then
-// keeps serving a reloading page until the next reconcile removes it.
+// host rule at higher priority. Inbound hits redirect to /cgi-bin/wake,
+// which calls the internal wake endpoint and serves a reloading page
+// until the reconcile removes the placeholder.
 func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client, engine *deployment.DeploymentEngine, svc sleepCandidate, domains []string, apiPort int) error {
 	edgeNet := ""
 	for _, n := range networkList(ctx, dc) {
@@ -223,19 +307,25 @@ func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client,
 		"traefik.http.services." + router + ".loadbalancer.server.port": "80",
 	}
 
-	wakeURL := wakeEndpointURL(ctx, dc, apiPort, svc.ID, edgeNet)
+	wakeURLs := wakeEndpointURLs(ctx, dc, apiPort, svc.ID, edgeNet)
 	page := `<!doctype html><html><head><meta http-equiv="refresh" content="4"><title>Waking up</title>` +
 		`<style>body{font-family:system-ui,sans-serif;background:#0b0d12;color:#dde2ea;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}` +
 		`.card{text-align:center;max-width:34rem;padding:2rem}h1{font-size:1.25rem;font-weight:600}p{color:#98a2b3}</style></head>` +
 		`<body><div class="card"><h1>Service is waking up</h1><p>This Containr service was sleeping and is resuming now. The page reloads automatically.</p></div></body></html>`
-	// httpd without -f daemonizes, so the sequence is: write page, start
-	// httpd, fire the wake callback, then hold PID1 on sleep infinity.
+	// The wake callback must fire when a request arrives, not at boot —
+	// firing unconditionally makes the service flap sleep→wake forever.
+	// index.html redirects to /cgi-bin/wake; the CGI fires the callback
+	// (first reachable URL wins) and serves the reloading page.
+	indexPage := `<!doctype html><html><head><meta http-equiv="refresh" content="0;url=/cgi-bin/wake"></head><body></body></html>`
+	// httpd without -f daemonizes, so PID1 ends on sleep infinity. URLs
+	// and the page travel via env so the CGI script needs no quoting.
 	cmd := fmt.Sprintf(
-		`mkdir -p /www && printf '%%s' '%s' > /www/index.html && `+
-			`httpd -p 80 -h /www && `+
-			`(sleep 2; wget -q -O /dev/null --timeout=20 '%s' 2>/dev/null || true) && `+
-			`sleep infinity`,
-		strings.ReplaceAll(page, "'", "'\\''"), wakeURL)
+		`mkdir -p /www/cgi-bin && printf '%%s' '%s' > /www/index.html && `+
+			`printf '%%s' '%s' > /www/cgi-bin/wake && chmod +x /www/cgi-bin/wake && `+
+			`printf '%%s\n' 'E404:/cgi-bin/wake' > /www/httpd.conf && `+
+			`httpd -p 80 -h /www && sleep infinity`,
+		strings.ReplaceAll(indexPage, "'", "'\\''"),
+		strings.ReplaceAll(wakeCGIScript, "'", "'\\''"))
 
 	endpoints := map[string]*network.EndpointSettings{edgeNet: {}}
 	if ownNet := dc.OwnNetworkName(ctx); ownNet != "" && ownNet != edgeNet {
@@ -259,6 +349,10 @@ func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client,
 		Name:  name,
 		Image: wakeImage,
 		Cmd:   []string{"sh", "-c", cmd},
+		Env: []string{
+			"WAKE_URLS=" + strings.Join(wakeURLs, " "),
+			"WAKE_PAGE=" + page,
+		},
 		Labels:   labels,
 		Networks: endpoints,
 	})
@@ -280,25 +374,41 @@ func networkList(ctx context.Context, dc *docker.Client) []string {
 	return names
 }
 
-// wakeEndpointURL builds the internal URL the wake container calls. The
-// edge network's gateway reaches the host's published API port; when the
-// API itself is containerized its own name resolves on the shared network.
-func wakeEndpointURL(ctx context.Context, dc *docker.Client, apiPort int, serviceID uuid.UUID, edgeNet string) string {
+// wakeEndpointURLs builds ordered candidate URLs for the wake container to
+// call, deduplicated. No single address covers every topology: a containerized
+// API resolves by name on the shared network; Docker Desktop containers reach
+// the host via host.docker.internal; on native Docker the edge network's
+// gateway routes to host-published ports. busybox wget walks the chain until
+// one answers.
+func wakeEndpointURLs(ctx context.Context, dc *docker.Client, apiPort int, serviceID uuid.UUID, edgeNet string) []string {
+	var hosts []string
 	if dc.OwnNetworkName(ctx) != "" {
 		if self, err := dc.GetContainer(ctx, selfID()); err == nil {
-			name := strings.TrimPrefix(self.Name, "/")
-			if name != "" {
-				return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", name, apiPort, serviceID)
+			if name := strings.TrimPrefix(self.Name, "/"); name != "" {
+				hosts = append(hosts, name)
 			}
 		}
 	}
+	hosts = append(hosts, "host.docker.internal")
 	if gw := networkGateway(ctx, dc, edgeNet); gw != "" {
-		return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", gw, apiPort, serviceID)
+		hosts = append(hosts, gw)
 	}
 	if probe := dc.HostProbeHost(ctx); probe != "" {
-		return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", probe, apiPort, serviceID)
+		hosts = append(hosts, probe)
 	}
-	return fmt.Sprintf("http://127.0.0.1:%d/api/v1/internal/wake/%s", apiPort, serviceID)
+	seen := map[string]bool{}
+	var urls []string
+	for _, h := range hosts {
+		if h == "" || seen[h] {
+			continue
+		}
+		seen[h] = true
+		urls = append(urls, fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", h, apiPort, serviceID))
+	}
+	if len(urls) == 0 {
+		urls = append(urls, fmt.Sprintf("http://127.0.0.1:%d/api/v1/internal/wake/%s", apiPort, serviceID))
+	}
+	return urls
 }
 
 func networkGateway(ctx context.Context, dc *docker.Client, name string) string {
@@ -346,18 +456,40 @@ func pruneWakeContainers(ctx context.Context, db *database.DB, dc *docker.Client
 // idempotent and non-destructive, so no token is required; the endpoint
 // never mutates configuration.
 func handleServiceWake(c *gin.Context) {
+	code, body := triggerServiceWake(c)
+	if code != 0 {
+		c.JSON(code, body)
+	}
+}
+
+// handleServiceWakePage is the remote ingress wake target — Traefik routes
+// a sleeping remote service's domain here via the file provider. Every hit
+// (re)triggers the wake reconcile and returns a reloading page.
+func handleServiceWakePage(c *gin.Context) {
+	triggerServiceWake(c)
+	c.Header("Content-Type", "text/html; charset=utf-8")
+	c.String(http.StatusOK, wakePageHTML)
+}
+
+const wakePageHTML = `<!doctype html><html><head><meta http-equiv="refresh" content="4"><title>Waking up</title>` +
+	`<style>body{font-family:system-ui,sans-serif;background:#0b0d12;color:#dde2ea;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}` +
+	`.card{text-align:center;max-width:34rem;padding:2rem}h1{font-size:1.25rem;font-weight:600}p{color:#98a2b3}</style></head>` +
+	`<body><div class="card"><h1>Service is waking up</h1><p>This Containr service was sleeping and is resuming now. The page reloads automatically.</p></div></body></html>`
+
+// triggerServiceWake loads the service and reconciles it back to running
+// in the background. Returns (0, nil) when a response was already written
+// by an embedded handler path, else the JSON status to send.
+func triggerServiceWake(c *gin.Context) (int, gin.H) {
 	dbVal, _ := c.Get("db")
 	db := dbVal.(*database.DB)
 	engineVal, _ := c.Get("deployment_engine")
 	engine, _ := engineVal.(*deployment.DeploymentEngine)
 	if engine == nil {
-		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "deployment engine unavailable"})
-		return
+		return http.StatusServiceUnavailable, gin.H{"error": "deployment engine unavailable"}
 	}
 	id, err := uuid.Parse(c.Param("id"))
 	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid service id"})
-		return
+		return http.StatusBadRequest, gin.H{"error": "invalid service id"}
 	}
 	var service Service
 	err = db.QueryRow(
@@ -385,22 +517,23 @@ func handleServiceWake(c *gin.Context) {
 		&service.CreatedAt, &service.UpdatedAt,
 	)
 	if err != nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "service not found"})
-		return
+		return http.StatusNotFound, gin.H{"error": "service not found"}
 	}
 	if service.Status == "running" || service.Status == "deployed" {
-		c.JSON(http.StatusOK, gin.H{"status": service.Status})
-		return
+		return http.StatusOK, gin.H{"status": service.Status}
 	}
 	go func() {
 		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
 		defer cancel()
 		spec, err := serviceRuntimeSpec(db, service)
 		if err != nil {
+			log.Printf("wake: runtime spec for %s failed: %v", service.ID, err)
+			_, _ = db.Exec(`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
 			return
 		}
 		state, err := engine.ReconcileService(ctx, spec)
 		if err != nil {
+			log.Printf("wake: reconcile for %s failed: %v", service.ID, err)
 			_, _ = db.Exec(`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
 			return
 		}
@@ -411,7 +544,7 @@ func handleServiceWake(c *gin.Context) {
 		}
 		_, _ = db.Exec(`UPDATE services SET status = $1, updated_at = $2 WHERE id = $3`, status, time.Now(), service.ID)
 	}()
-	c.JSON(http.StatusAccepted, gin.H{"status": "waking"})
+	return http.StatusAccepted, gin.H{"status": "waking"}
 }
 
 // handleServiceSleep puts a service to sleep immediately (owner+ only).
@@ -438,7 +571,12 @@ func handleServiceSleep(c *gin.Context) {
 		Name:      service.Name,
 		Status:    service.Status,
 	}
+	q := sqlcdb.New(db.DB)
+	if len(remoteLiveContainers(c.Request.Context(), q, service.ID.String())) > 0 {
+		go putToSleepRemote(context.Background(), db, q, svc, apiPortFromContext(c))
+	} else {
 		go putToSleep(context.Background(), db, dc, engine, svc, apiPortFromContext(c))
+	}
 	c.JSON(http.StatusAccepted, gin.H{"status": "sleeping"})
 }
 

app/backend/internal/api/templategraph.go

@@ -11,6 +11,8 @@ import (
 	"log"
 	"math/big"
 	"net/http"
+	"os"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
@@ -22,6 +24,7 @@ import (
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/secrets"
+	"containr/internal/source"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -227,7 +230,9 @@ func resolveStaticExpr(value string, userVars map[string]string, unresolved *[]s
 		if val, ok := userVars[key]; ok {
 			return val
 		}
-		if sub[2] != "" {
+		// {{VAR:-x}} supplies a default; {{VAR:-}} declares an explicitly
+		// empty one. Both resolve — only a bare {{VAR}} is unresolved.
+		if strings.Contains(m, ":-") {
 			return sub[2]
 		}
 		if unresolved != nil {
@@ -1112,6 +1117,130 @@ func handleImportCompose(c *gin.Context) {
 	})
 }
 
+// handleImportGitCompose fetches a compose file out of a git repository and
+// runs it through the same conversion as handleImportCompose. Works with any
+// git remote — connected providers (including GitHub App installs) supply
+// credentials for private repos. Nothing is persisted; the response feeds
+// the template create form or a direct deploy.
+func handleImportGitCompose(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+
+	var req struct {
+		Repo string `json:"repo" binding:"required"`
+		Path string `json:"path"`
+		Ref  string `json:"ref"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	branch, commit := "", ""
+	if ref := strings.TrimSpace(req.Ref); ref != "" {
+		if isCommitSHA(ref) {
+			commit = ref
+		} else {
+			branch = ref
+		}
+	}
+	spec, err := resolveGitCloneSpec(db, userID, req.Repo, branch, commit, "")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "code": "VALIDATION"})
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 2*time.Minute)
+	defer cancel()
+	checkoutRoot := filepath.Join(containrWorkDir, "repos", "import-"+uuid.NewString())
+	defer os.RemoveAll(checkoutRoot)
+	repoDir, err := source.Checkout(ctx, checkoutRoot, spec)
+	if err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": "git fetch failed: " + err.Error(), "code": "GIT_FETCH"})
+		return
+	}
+
+	// Default search order mirrors common compose conventions.
+	candidates := []string{req.Path}
+	if strings.TrimSpace(req.Path) == "" {
+		candidates = []string{"compose.yaml", "compose.yml", "docker-compose.yml", "docker-compose.yaml"}
+	}
+	var raw []byte
+	for _, rel := range candidates {
+		p, rerr := resolveRepoFile(repoDir, rel)
+		if rerr != nil {
+			continue
+		}
+		raw, err = os.ReadFile(p)
+		if err == nil {
+			break
+		}
+	}
+	if raw == nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "compose file not found in repository", "code": "NOT_FOUND"})
+		return
+	}
+	if len(raw) > 512*1024 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Compose file exceeds 512 KiB"})
+		return
+	}
+
+	var file composeFileDef
+	if err := yaml.Unmarshal(raw, &file); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid compose YAML: " + err.Error()})
+		return
+	}
+	services, warnings, convErr := composeToSpecs(&file)
+	if convErr != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": convErr.Error()})
+		return
+	}
+	config := TemplateConfig{Version: 2, Services: services}
+	configJSON, _ := json.Marshal(config)
+	c.JSON(http.StatusOK, gin.H{
+		"config":    json.RawMessage(configJSON),
+		"variables": []TemplateVariable{},
+		"warnings":  warnings,
+	})
+}
+
+// resolveRepoFile maps a repo-relative file path onto the checkout and
+// rejects escapes — same containment rule as ResolveBuildPath, for files.
+func resolveRepoFile(checkoutDir, rel string) (string, error) {
+	rel = strings.TrimSpace(rel)
+	if rel == "" || filepath.IsAbs(rel) {
+		return "", fmt.Errorf("invalid repo path %q", rel)
+	}
+	clean := filepath.Clean(rel)
+	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("path escapes the checkout: %q", rel)
+	}
+	resolved := filepath.Join(checkoutDir, clean)
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "", fmt.Errorf("path %q not found in checkout", rel)
+	}
+	if !info.Mode().IsRegular() {
+		return "", fmt.Errorf("path %q is not a file", rel)
+	}
+	return resolved, nil
+}
+
+func isCommitSHA(ref string) bool {
+	if len(ref) != 40 {
+		return false
+	}
+	for _, r := range ref {
+		if !('0' <= r && r <= '9') && !('a' <= r && r <= 'f') {
+			return false
+		}
+	}
+	return true
+}
+
 // composeToSpecs converts a parsed compose file into graph service specs.
 // Compose service names become keys; declaration order follows YAML document
 // order — yaml.v3 maps lose order, so sort keys for stability.

app/backend/internal/api/templategraph_compose_test.go

@@ -1,6 +1,8 @@
 package api
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -124,3 +126,42 @@ func TestComposeToSpecsWarnings(t *testing.T) {
 		t.Errorf("missing env warning: %v", warnings)
 	}
 }
+
+func TestResolveRepoFileContainment(t *testing.T) {
+	dir := t.TempDir()
+	inner := filepath.Join(dir, "sub")
+	if err := os.MkdirAll(inner, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(inner, "compose.yml"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	p, err := resolveRepoFile(dir, "sub/compose.yml")
+	if err != nil {
+		t.Fatalf("valid file rejected: %v", err)
+	}
+	if p != filepath.Join(dir, "sub", "compose.yml") {
+		t.Errorf("unexpected path %q", p)
+	}
+
+	for _, bad := range []string{"", "/etc/passwd", "../escape.yml", "..", "sub/../../out.yml"} {
+		if _, err := resolveRepoFile(dir, bad); err == nil {
+			t.Errorf("path %q should have been rejected", bad)
+		}
+	}
+	if _, err := resolveRepoFile(dir, "sub"); err == nil {
+		t.Error("directory accepted as file")
+	}
+}
+
+func TestIsCommitSHA(t *testing.T) {
+	if !isCommitSHA("0123456789abcdef0123456789abcdef01234567") {
+		t.Error("40-hex ref not recognised as a commit")
+	}
+	for _, bad := range []string{"main", "v1.2.3", "0123456789abcdef0123456789abcdef0123456", "0123456789abcdef0123456789abcdef0123456G"} {
+		if isCommitSHA(bad) {
+			t.Errorf("ref %q misclassified as commit SHA", bad)
+		}
+	}
+}

app/backend/internal/api/templates.go

@@ -1102,6 +1102,98 @@ func SeedTemplates() []ServiceTemplate {
 			Variables:  `[{"key":"APP_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
 			IsOfficial: true,
 		},
+		{
+			ID:          "tpl-n8n",
+			Name:        "n8n + PostgreSQL + Redis",
+			Description: "Workflow automation in queue mode with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/n8n",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"n8n","POSTGRES_USER":"n8n"},"volumes":[{"source":"n8n-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"n8n","type":"web","runtime":"docker.n8n.io/n8nio/n8n:latest","port":5678,"health_check":"/healthz","depends_on":["db","redis"],
+				 "environment":{"DB_TYPE":"postgresdb","DB_POSTGRESDB_HOST":"{{service.db.host}}","DB_POSTGRESDB_PORT":"5432","DB_POSTGRESDB_DATABASE":"{{service.db.database}}","DB_POSTGRESDB_USER":"{{service.db.user}}","DB_POSTGRESDB_PASSWORD":"{{service.db.password}}","QUEUE_BULL_REDIS_HOST":"{{service.redis.host}}","QUEUE_BULL_REDIS_PASSWORD":"{{service.redis.password}}","EXECUTIONS_MODE":"queue","N8N_ENCRYPTION_KEY":"{{secret(32)}}","N8N_HOST":"{{APP_URL:-http://localhost:5678}}","N8N_EDITOR_BASE_URL":"{{APP_URL:-http://localhost:5678}}"},
+				 "volumes":[{"source":"n8n-data","target":"/home/node/.n8n"}]},
+				{"key":"worker","name":"n8n-worker","type":"worker","runtime":"docker.n8n.io/n8nio/n8n:latest","start_command":"worker","depends_on":["n8n","db","redis"],
+				 "environment":{"DB_TYPE":"postgresdb","DB_POSTGRESDB_HOST":"{{service.db.host}}","DB_POSTGRESDB_PORT":"5432","DB_POSTGRESDB_DATABASE":"{{service.db.database}}","DB_POSTGRESDB_USER":"{{service.db.user}}","DB_POSTGRESDB_PASSWORD":"{{service.db.password}}","QUEUE_BULL_REDIS_HOST":"{{service.redis.host}}","QUEUE_BULL_REDIS_PASSWORD":"{{service.redis.password}}","EXECUTIONS_MODE":"queue","N8N_ENCRYPTION_KEY":"{{secret(32)}}","QUEUE_HEALTH_CHECK_ACTIVE":"true"},
+				 "volumes":[{"source":"n8n-data","target":"/home/node/.n8n"}]}]}`,
+			Variables:  `[{"key":"APP_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-gitea",
+			Name:        "Gitea + PostgreSQL",
+			Description: "Self-hosted git service with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/gitea",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"gitea","POSTGRES_USER":"gitea"},"volumes":[{"source":"gitea-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"gitea","type":"web","runtime":"gitea/gitea:latest","port":3000,"health_check":"/api/healthz","depends_on":["db"],
+				 "environment":{"GITEA__database__DB_TYPE":"postgres","GITEA__database__HOST":"{{service.db.host}}:{{service.db.port}}","GITEA__database__NAME":"{{service.db.database}}","GITEA__database__USER":"{{service.db.user}}","GITEA__database__PASSWD":"{{service.db.password}}","GITEA__security__INSTALL_LOCK":"true","GITEA__security__SECRET_KEY":"{{secret(32)}}","GITEA__security__INTERNAL_TOKEN":"{{secret(64)}}","GITEA__server__DOMAIN":"{{DOMAIN:-localhost}}","GITEA__server__ROOT_URL":"{{ROOT_URL:-http://localhost:3000}}","GITEA__server__SSH_PORT":"2222","USER_UID":"1000","USER_GID":"1000"},
+				 "volumes":[{"source":"gitea-data","target":"/data"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Public domain","default":"","required":false,"secret":false},{"key":"ROOT_URL","label":"Root URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-nextcloud",
+			Name:        "Nextcloud + PostgreSQL + Redis",
+			Description: "Self-hosted file sync and collaboration with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/nextcloud",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"nextcloud","POSTGRES_USER":"nextcloud"},"volumes":[{"source":"nextcloud-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"nextcloud","type":"web","runtime":"nextcloud:latest","port":80,"depends_on":["db","redis"],
+				 "environment":{"POSTGRES_HOST":"{{service.db.host}}","POSTGRES_DB":"{{service.db.database}}","POSTGRES_USER":"{{service.db.user}}","POSTGRES_PASSWORD":"{{service.db.password}}","REDIS_HOST":"{{service.redis.host}}","REDIS_HOST_PASSWORD":"{{service.redis.password}}","NEXTCLOUD_ADMIN_USER":"admin","NEXTCLOUD_ADMIN_PASSWORD":"{{secret(24)}}","NEXTCLOUD_TRUSTED_DOMAINS":"{{DOMAIN:-localhost}}","OVERWRITEHOST":"{{DOMAIN:-}}","OVERWRITEPROTOCOL":"https"},
+				 "volumes":[{"source":"nextcloud-data","target":"/var/www/html"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Trusted domain","default":"localhost","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-vaultwarden",
+			Name:        "Vaultwarden + PostgreSQL",
+			Description: "Bitwarden-compatible password manager with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/vaultwarden",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"vaultwarden","POSTGRES_USER":"vaultwarden"},"volumes":[{"source":"vaultwarden-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"vaultwarden","type":"web","runtime":"vaultwarden/server:latest","port":80,"health_check":"/alive","depends_on":["db"],
+				 "environment":{"DATABASE_URL":"{{service.db.url}}","ADMIN_TOKEN":"{{secret(48)}}","DOMAIN":"{{DOMAIN:-http://localhost:80}}","SIGNUPS_ALLOWED":"false","WEBSOCKET_ENABLED":"true"},
+				 "volumes":[{"source":"vaultwarden-data","target":"/data"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Public URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-umami",
+			Name:        "Umami + PostgreSQL",
+			Description: "Lightweight privacy-first web analytics with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/umami",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"umami","POSTGRES_USER":"umami"},"volumes":[{"source":"umami-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"umami","type":"web","runtime":"ghcr.io/umami-software/umami:postgresql-latest","port":3000,"depends_on":["db"],
+				 "environment":{"DATABASE_URL":"{{service.db.url}}","APP_SECRET":"{{secret(32)}}"}}]}`,
+			Variables:  `[]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-immich",
+			Name:        "Immich + PostgreSQL + Redis",
+			Description: "Self-hosted photo and video backup with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/immich",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"immich","POSTGRES_USER":"immich"},"volumes":[{"source":"immich-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"ml","name":"immich-machine-learning","type":"worker","runtime":"ghcr.io/immich-app/immich-machine-learning:release",
+				 "environment":{"DB_DATABASE_NAME":"{{service.db.database}}","DB_HOSTNAME":"{{service.db.host}}","DB_USERNAME":"{{service.db.user}}","DB_PASSWORD":"{{service.db.password}}","REDIS_HOSTNAME":"{{service.redis.host}}","REDIS_PASSWORD":"{{service.redis.password}}"},
+				 "volumes":[{"source":"immich-model-cache","target":"/cache"}]},
+				{"key":"immich","name":"immich-server","type":"web","runtime":"ghcr.io/immich-app/immich-server:release","port":2283,"health_check":"/api/server/ping","depends_on":["db","redis","ml"],
+				 "environment":{"DB_DATABASE_NAME":"{{service.db.database}}","DB_HOSTNAME":"{{service.db.host}}","DB_USERNAME":"{{service.db.user}}","DB_PASSWORD":"{{service.db.password}}","REDIS_HOSTNAME":"{{service.redis.host}}","REDIS_PASSWORD":"{{service.redis.password}}"},
+				 "volumes":[{"source":"immich-upload","target":"/usr/src/app/upload"}]}]}`,
+			Variables:  `[]`,
+			IsOfficial: true,
+		},
 	}
 	return templates
 }

app/backend/internal/api/templates_test.go

@@ -1,6 +1,9 @@
 package api
 
-import "testing"
+import (
+	"encoding/json"
+	"testing"
+)
 
 func TestNormalizeTemplateServiceType(t *testing.T) {
 	valid := []string{"web", "worker", "database", "cron"}
@@ -71,3 +74,32 @@ func TestResolveTemplateRuntimeImage(t *testing.T) {
 		t.Fatalf("expected unknown runtime passthrough, got %q", got)
 	}
 }
+
+func TestSeedTemplatesResolveCleanly(t *testing.T) {
+	for _, tpl := range SeedTemplates() {
+		var config TemplateConfig
+		if err := json.Unmarshal([]byte(tpl.Config), &config); err != nil {
+			t.Fatalf("%s: invalid config JSON: %v", tpl.ID, err)
+		}
+		var variables []TemplateVariable
+		if err := json.Unmarshal([]byte(tpl.Variables), &variables); err != nil {
+			t.Fatalf("%s: invalid variables JSON: %v", tpl.ID, err)
+		}
+		if len(config.Services) == 0 {
+			continue // legacy single-service template
+		}
+		sorted, err := topoSortServices(config.Services)
+		if err != nil {
+			t.Fatalf("%s: topo sort: %v", tpl.ID, err)
+		}
+		if err := validateTemplateGraph(sorted); err != nil {
+			t.Fatalf("%s: graph validation: %v", tpl.ID, err)
+		}
+		// User vars left empty — every expression must still resolve via
+		// defaults, secrets, or service refs.
+		graph := resolveTemplateGraph(sorted, map[string]string{})
+		if len(graph.unresolved) > 0 {
+			t.Fatalf("%s: unresolved expressions: %v", tpl.ID, graph.unresolved)
+		}
+	}
+}

app/backend/internal/api/webhooks_test.go

@@ -31,3 +31,33 @@ func TestWebhookEventMatches(t *testing.T) {
 		}
 	}
 }
+
+func TestValidWebhookURL(t *testing.T) {
+	cases := []struct {
+		name    string
+		url     string
+		wantErr bool
+	}{
+		{"https", "https://hooks.example.com/wh/abc", false},
+		{"http", "http://internal.lan:8080/notify", false},
+		{"whitespace trimmed", "  https://example.com/hook  ", false},
+		{"with query", "https://example.com/hook?token=x", false},
+		{"ftp rejected", "ftp://files.example.com/x", true},
+		{"no scheme", "example.com/hook", true},
+		{"bare scheme", "https://", true},
+		{"empty", "", true},
+		{"javascript rejected", "javascript:alert(1)", true},
+		{"host empty", "http:///path-only", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validWebhookURL(tc.url)
+			if tc.wantErr && err == nil {
+				t.Errorf("validWebhookURL(%q) = nil, want error", tc.url)
+			}
+			if !tc.wantErr && err != nil {
+				t.Errorf("validWebhookURL(%q) = %v, want nil", tc.url, err)
+			}
+		})
+	}
+}

app/backend/internal/build/dockerfile.go

@@ -539,12 +539,16 @@ func createBuildContext(sourcePath, dockerfileContent string) (io.ReadCloser, er
 		return nil, err
 	}
 
-	// Add source files to tar
+	// Add source files to tar. The checkout's .git metadata is never build
+	// context — it bloats the tar and ships clone URLs to remote daemons.
 	err = filepath.Walk(sourcePath, func(file string, fi os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
 		if fi.IsDir() {
+			if fi.Name() == ".git" {
+				return filepath.SkipDir
+			}
 			return nil
 		}
 

app/backend/internal/build/manager.go

@@ -3,6 +3,8 @@ package build
 import (
 	"context"
 	"fmt"
+	"io"
+	"os"
 	"path/filepath"
 	"time"
 
@@ -92,6 +94,75 @@ func (bm *BuildManager) Build(ctx context.Context, req *types.BuildRequest) (*ty
 	}
 }
 
+// PackageContext produces the same build-context tar Build would hand the
+// local daemon, without building it. Node agents download the tar and run
+// docker build themselves — the Dockerfile lands at the tar root.
+func (bm *BuildManager) PackageContext(ctx context.Context, req *types.BuildRequest) (io.ReadCloser, error) {
+	if req.BuildType == "" {
+		detectedType, err := bm.DetectBuildType(ctx, req.SourcePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to detect build type: %w", err)
+		}
+		req.BuildType = string(detectedType)
+	}
+
+	var dockerfileContent string
+	switch BuildType(req.BuildType) {
+	case BuildTypeDockerfile:
+		name, err := bm.dockerfileBuilder.DetectDockerfile(ctx, req.SourcePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to detect Dockerfile: %w", err)
+		}
+		path := filepath.Join(req.SourcePath, name)
+		if optimized, err := bm.dockerfileBuilder.OptimizeDockerfile(ctx, path); err == nil {
+			path = optimized
+		}
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read Dockerfile: %w", err)
+		}
+		dockerfileContent = string(data)
+	case BuildTypeRailpack:
+		if err := bm.railpackBuilder.DetectRailpack(ctx, req.SourcePath); err != nil {
+			return nil, fmt.Errorf("Railpack cannot build this project: %w", err)
+		}
+		content, err := bm.railpackBuilder.generateDockerfile(ctx, req.SourcePath, &RailpackConfig{
+			BuildCmd: req.BuildCommand,
+			StartCmd: req.StartCommand,
+			Env:      req.Environment,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate Dockerfile with Railpack: %w", err)
+		}
+		dockerfileContent = content
+	case BuildTypeNixpacks:
+		plan, err := bm.nixpacksBuilder.GeneratePlan(ctx, req.SourcePath, &NixpacksConfig{
+			BuildCmd: req.BuildCommand,
+			StartCmd: req.StartCommand,
+			Env:      req.Environment,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate build plan: %w", err)
+		}
+		path, err := bm.nixpacksBuilder.generateDockerfile(plan)
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate Dockerfile: %w", err)
+		}
+		defer os.Remove(path)
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read generated Dockerfile: %w", err)
+		}
+		dockerfileContent = string(data)
+	case BuildTypeStatic:
+		dockerfileContent = staticDockerfile
+	default:
+		return nil, fmt.Errorf("unsupported build type for remote packaging: %s", req.BuildType)
+	}
+
+	return createBuildContext(req.SourcePath, dockerfileContent)
+}
+
 // buildPrebuilt handles prebuilt image deployments
 func (bm *BuildManager) buildPrebuilt(ctx context.Context, req *types.BuildRequest) (*types.BuildResponse, error) {
 	if req.PrebuiltImage == "" {

app/backend/internal/build/nixpacks.go

@@ -476,17 +476,22 @@ func (n *NixpacksBuilder) Build(ctx context.Context, req *types.BuildRequest) (*
 	}
 
 	// Create temporary Dockerfile
-	dockerfile, err := n.generateDockerfile(plan)
+	dockerfilePath, err := n.generateDockerfile(plan)
 	if err != nil {
 		return nil, fmt.Errorf("failed to generate Dockerfile: %w", err)
 	}
-	defer os.Remove(dockerfile)
+	defer os.Remove(dockerfilePath)
 
 	// Build Docker image
 	imageName := fmt.Sprintf("%s:%s", req.ImageName, req.ImageTag)
 
-	// Create build context tar
-	buildCtx, err := createBuildContext(req.SourcePath, dockerfile)
+	// Create build context tar — createBuildContext takes the Dockerfile
+	// contents, not its path.
+	dockerfileData, err := os.ReadFile(dockerfilePath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read generated Dockerfile: %w", err)
+	}
+	buildCtx, err := createBuildContext(req.SourcePath, string(dockerfileData))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create build context: %w", err)
 	}

app/backend/internal/cli/commands/environments.go

@@ -0,0 +1,97 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// EnvironmentsCmd manages a project's environment lanes
+// (production/development/preview are seeded; custom names allowed).
+var EnvironmentsCmd = &cobra.Command{
+	Use:     "environments",
+	Aliases: []string{"env", "envs"},
+	Short:   "Manage project environments",
+}
+
+var envListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List environments in a project",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		project, _ := cmd.Flags().GetString("project")
+		if project == "" {
+			return fmt.Errorf("--project is required")
+		}
+		data, err := c.Do("GET", "/projects/"+project+"/environments", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "environments")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, e := range items {
+			rows = append(rows, []string{
+				str(e, "id"), str(e, "name"), str(e, "service_count"), relTime(e, "created_at"),
+			})
+		}
+		printRows(data, []string{"ID", "NAME", "SERVICES", "CREATED"}, rows)
+		return nil
+	},
+}
+
+var envCreateCmd = &cobra.Command{
+	Use:   "create <name>",
+	Short: "Create an environment in a project",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		project, _ := cmd.Flags().GetString("project")
+		if project == "" {
+			return fmt.Errorf("--project is required")
+		}
+		data, err := c.Do("POST", "/projects/"+project+"/environments", map[string]interface{}{
+			"name": args[0],
+		})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var envDeleteCmd = &cobra.Command{
+	Use:   "delete <id>",
+	Short: "Delete an empty environment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if !Confirm("Delete environment " + args[0] + "?") {
+			return &APIError{Message: "aborted (pass --yes to skip confirmation)", ExitCode: ExitError}
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		_, err = c.Do("DELETE", "/environments/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		fmt.Println("Environment deleted")
+		return nil
+	},
+}
+
+func init() {
+	envListCmd.Flags().String("project", "", "project ID (required)")
+	envCreateCmd.Flags().String("project", "", "project ID (required)")
+	EnvironmentsCmd.AddCommand(envListCmd, envCreateCmd, envDeleteCmd)
+}

app/backend/internal/cli/commands/nodes.go

@@ -2,6 +2,7 @@ package commands
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/spf13/cobra"
 )
@@ -83,7 +84,7 @@ var nodesDeleteCmd = &cobra.Command{
 
 var nodesUpdateCmd = &cobra.Command{
 	Use:   "update <id>",
-	Short: "Update a node agent (--name, --auto-prune)",
+	Short: "Update a node agent (--name, --auto-prune, --tags, --domain)",
 	Args:  cobra.ExactArgs(1),
 	RunE: func(cmd *cobra.Command, args []string) error {
 		c, err := client()
@@ -97,8 +98,21 @@ var nodesUpdateCmd = &cobra.Command{
 		if cmd.Flags().Changed("auto-prune") {
 			body["auto_prune"], _ = cmd.Flags().GetBool("auto-prune")
 		}
+		if cmd.Flags().Changed("tags") {
+			raw, _ := cmd.Flags().GetString("tags")
+			tags := []string{}
+			for _, t := range strings.Split(raw, ",") {
+				if t = strings.TrimSpace(t); t != "" {
+					tags = append(tags, t)
+				}
+			}
+			body["tags"] = tags
+		}
+		if cmd.Flags().Changed("domain") {
+			body["default_domain"], _ = cmd.Flags().GetString("domain")
+		}
 		if len(body) == 0 {
-			return &APIError{Message: "nothing to update — pass --name or --auto-prune", ExitCode: ExitError}
+			return &APIError{Message: "nothing to update — pass --name, --auto-prune, --tags or --domain", ExitCode: ExitError}
 		}
 		data, err := c.Do("PUT", "/agents/"+args[0], body)
 		if err != nil {
@@ -190,6 +204,24 @@ var nodesDrainCmd = &cobra.Command{
 	},
 }
 
+var nodesUpgradeCmd = &cobra.Command{
+	Use:   "upgrade <id>",
+	Short: "Upgrade the node agent to the server's bundled binary",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/agents/"+args[0]+"/upgrade", nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
 var nodesCommandsCmd = &cobra.Command{
 	Use:   "commands <id>",
 	Short: "List recent commands sent to a node agent",
@@ -274,8 +306,10 @@ var nodeTokensRevokeCmd = &cobra.Command{
 func init() {
 	nodesUpdateCmd.Flags().String("name", "", "node display name")
 	nodesUpdateCmd.Flags().Bool("auto-prune", false, "enqueue a daily bounded docker prune")
+	nodesUpdateCmd.Flags().String("tags", "", "comma-separated placement tags (services with placement_tags only schedule onto matching nodes)")
+	nodesUpdateCmd.Flags().String("domain", "", "base domain for this node — domainless services placed here get <name>.<domain> automatically (empty clears)")
 	nodesPruneCmd.Flags().String("until", "", "only prune objects older than this duration (e.g. 168h)")
 	nodesPruneCmd.Flags().Bool("volumes", false, "also prune volumes (destructive — asks twice)")
 	nodeTokensCmd.AddCommand(nodeTokensIssueCmd, nodeTokensListCmd, nodeTokensRevokeCmd)
-	NodesCmd.AddCommand(nodesListCmd, nodesGetCmd, nodesUpdateCmd, nodesCordonCmd, nodesUncordonCmd, nodesDrainCmd, nodesPruneCmd, nodesCommandsCmd, nodesDeleteCmd, nodeTokensCmd)
+	NodesCmd.AddCommand(nodesListCmd, nodesGetCmd, nodesUpdateCmd, nodesCordonCmd, nodesUncordonCmd, nodesDrainCmd, nodesUpgradeCmd, nodesPruneCmd, nodesCommandsCmd, nodesDeleteCmd, nodeTokensCmd)
 }

app/backend/internal/cli/commands/notifications.go

@@ -1,6 +1,8 @@
 package commands
 
 import (
+	"fmt"
+
 	"github.com/spf13/cobra"
 )
 
@@ -60,6 +62,104 @@ var notifReadCmd = &cobra.Command{
 	},
 }
 
+var notifChannelsCmd = &cobra.Command{
+	Use:   "channels",
+	Short: "Manage push notification channels (ntfy/Gotify)",
+}
+
+var notifChannelsListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List push channels",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/notifications/channels", nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "channels")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, n := range items {
+			rows = append(rows, []string{
+				str(n, "id"), str(n, "kind"), str(n, "endpoint"), str(n, "enabled"), relTime(n, "created_at"),
+			})
+		}
+		printRows(data, []string{"ID", "KIND", "ENDPOINT", "ENABLED", "AGE"}, rows)
+		return nil
+	},
+}
+
+var notifChannelsAddCmd = &cobra.Command{
+	Use:   "add <ntfy|gotify> <endpoint>",
+	Short: "Add a push channel (endpoint includes topic for ntfy)",
+	Args:  cobra.ExactArgs(2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		token, _ := cmd.Flags().GetString("token")
+		data, err := c.Do("POST", "/notifications/channels", map[string]interface{}{
+			"kind":     args[0],
+			"endpoint": args[1],
+			"token":    token,
+		})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var notifChannelsTestCmd = &cobra.Command{
+	Use:   "test <id>",
+	Short: "Send a test notification through a channel",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/notifications/channels/"+args[0]+"/test", map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var notifChannelsRemoveCmd = &cobra.Command{
+	Use:   "remove <id>",
+	Short: "Remove a push channel",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		yes, _ := cmd.Flags().GetBool("yes")
+		if !yes && !Confirm(fmt.Sprintf("Remove channel %s?", args[0])) {
+			return nil
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("DELETE", "/notifications/channels/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
 func init() {
-	NotificationsCmd.AddCommand(notifListCmd, notifReadCmd)
+	notifChannelsAddCmd.Flags().String("token", "", "Auth token (ntfy access token or Gotify app token)")
+	notifChannelsRemoveCmd.Flags().Bool("yes", false, "Skip confirmation")
+	notifChannelsCmd.AddCommand(notifChannelsListCmd, notifChannelsAddCmd, notifChannelsTestCmd, notifChannelsRemoveCmd)
+	NotificationsCmd.AddCommand(notifListCmd, notifReadCmd, notifChannelsCmd)
 }

app/backend/internal/cli/commands/services.go

@@ -117,6 +117,28 @@ var servicesCreateCmd = &cobra.Command{
 		if v, _ := cmd.Flags().GetBool("spread"); v {
 			body["spread"] = v
 		}
+		if cmd.Flags().Changed("sleep") {
+			v, _ := cmd.Flags().GetBool("sleep")
+			body["sleep_enabled"] = v
+		}
+		if cmd.Flags().Changed("sleep-idle") {
+			v, _ := cmd.Flags().GetInt("sleep-idle")
+			body["sleep_idle_minutes"] = v
+		}
+		if v, _ := cmd.Flags().GetString("placement-tags"); v != "" {
+			tags := []string{}
+			for _, t := range strings.Split(v, ",") {
+				if t = strings.TrimSpace(t); t != "" {
+					tags = append(tags, t)
+				}
+			}
+			body["placement_tags"] = tags
+		}
+		if labels, err := traefikLabelFlag(cmd); err != nil {
+			return err
+		} else if labels != nil {
+			body["traefik_labels"] = labels
+		}
 		data, err := c.Do("POST", "/projects/"+args[0]+"/services", body)
 		if err != nil {
 			return err
@@ -131,6 +153,28 @@ var servicesCreateCmd = &cobra.Command{
 	},
 }
 
+// traefikLabelFlag parses --traefik-label key=value pairs into the API's
+// map shape. Returns nil when the flag was never passed; an empty map when
+// only empty values were given (clears overrides on update).
+func traefikLabelFlag(cmd *cobra.Command) (map[string]string, error) {
+	if !cmd.Flags().Changed("traefik-label") {
+		return nil, nil
+	}
+	pairs, _ := cmd.Flags().GetStringArray("traefik-label")
+	labels := map[string]string{}
+	for _, p := range pairs {
+		if strings.TrimSpace(p) == "" {
+			continue
+		}
+		k, v, ok := strings.Cut(p, "=")
+		if !ok || strings.TrimSpace(k) == "" {
+			return nil, &APIError{Message: fmt.Sprintf("invalid --traefik-label %q — want key=value", p), ExitCode: ExitError}
+		}
+		labels[strings.TrimSpace(k)] = v
+	}
+	return labels, nil
+}
+
 var servicesDeleteCmd = &cobra.Command{
 	Use:   "delete <id>",
 	Short: "Delete a service",
@@ -210,10 +254,25 @@ var servicesUpdateCmd = &cobra.Command{
 			v, _ := cmd.Flags().GetBool("spread")
 			body["spread"] = v
 		}
+		if cmd.Flags().Changed("placement-tags") {
+			v, _ := cmd.Flags().GetString("placement-tags")
+			tags := []string{}
+			for _, t := range strings.Split(v, ",") {
+				if t = strings.TrimSpace(t); t != "" {
+					tags = append(tags, t)
+				}
+			}
+			body["placement_tags"] = tags
+		}
 		if cmd.Flags().Changed("sleep-idle") {
 			v, _ := cmd.Flags().GetInt("sleep-idle")
 			body["sleep_idle_minutes"] = v
 		}
+		if labels, err := traefikLabelFlag(cmd); err != nil {
+			return err
+		} else if labels != nil {
+			body["traefik_labels"] = labels
+		}
 		if cmd.Flags().Changed("maintenance") {
 			v, _ := cmd.Flags().GetString("maintenance")
 			body["maintenance_mode"] = v == "on" || v == "true"
@@ -501,8 +560,12 @@ func init() {
 	f.String("memory-reserve", "", "soft memory reservation (e.g. 128Mi)")
 	f.String("static-cmd", "", "build command for the static builder")
 	f.String("static-dir", "", "output dir for the static builder (default dist)")
-	f.String("node", "", "pin to a node agent id, or 'auto' for least-loaded (image services only)")
+	f.String("node", "", "pin to a node agent id, or 'auto' for least-loaded")
 	f.Bool("spread", false, "distribute replicas across all online schedulable nodes")
+	f.Bool("sleep", false, "enable scale-to-zero on idle (sleep mode)")
+	f.Int("sleep-idle", 0, "idle minutes before sleeping (1-1440)")
+	f.String("placement-tags", "", "comma-separated node tags required for remote placement (auto/spread only)")
+	f.StringArray("traefik-label", nil, "Traefik middleware override, key=value (e.g. middlewares.rl.ratelimit.average=100); repeatable")
 
 	uf := servicesUpdateCmd.Flags()
 	uf.String("name", "", "service name")
@@ -527,8 +590,10 @@ func init() {
 	uf.String("static-dir", "", "output dir for the static builder (empty clears)")
 	uf.Bool("sleep", false, "enable scale-to-zero on idle (sleep mode)")
 	uf.Int("sleep-idle", 0, "idle minutes before sleeping (1-1440)")
+	uf.StringArray("traefik-label", nil, "Traefik middleware override, key=value; repeatable; empty list clears via --traefik-label ''")
 	uf.String("node", "", "pin to a node agent id, 'auto' for least-loaded, 'local' to clear")
 	uf.Bool("spread", false, "spread replicas across all online schedulable nodes (--spread=false to disable)")
+	uf.String("placement-tags", "", "comma-separated node tags required for remote placement (empty clears)")
 
 	for _, a := range []string{"start", "stop", "restart", "redeploy", "sleep", "wake"} {
 		verb := a

app/backend/internal/cli/commands/templates.go

@@ -194,6 +194,32 @@ var templatesImportComposeCmd = &cobra.Command{
 	},
 }
 
+var templatesImportGitCmd = &cobra.Command{
+	Use:   "import-git <repo> [path]",
+	Short: "Fetch a compose file from a git repo and convert it into a template graph config",
+	Long:  "repo accepts a clone URL, ssh remote, or owner/repo shorthand resolved via connected git providers (private repos included). path defaults to compose.yaml/yml or docker-compose.yml/yaml. --ref selects a branch or commit.",
+	Args:  cobra.RangeArgs(1, 2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		body := map[string]string{"repo": args[0]}
+		if len(args) > 1 {
+			body["path"] = args[1]
+		}
+		if v, _ := cmd.Flags().GetString("ref"); v != "" {
+			body["ref"] = v
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/templates/import/git", body)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
 var templatesDeployGraphCmd = &cobra.Command{
 	Use:   "deploy-graph <project-id> <config.json|->",
 	Short: "Deploy an ad-hoc service graph (v2 config with services[]) without a stored template",
@@ -257,5 +283,6 @@ func init() {
 	templatesDeployCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
 	templatesPlanCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
 	templatesDeployGraphCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
-	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd, templatesPlanCmd, templatesImportComposeCmd, templatesDeployGraphCmd)
+	templatesImportGitCmd.Flags().String("ref", "", "git branch or commit (default: remote HEAD)")
+	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd, templatesPlanCmd, templatesImportComposeCmd, templatesImportGitCmd, templatesDeployGraphCmd)
 }

app/backend/internal/cli/root.go

@@ -95,6 +95,7 @@ func init() {
 	rootCmd.AddCommand(commands.InvitesCmd)
 	rootCmd.AddCommand(commands.UpCmd)
 	rootCmd.AddCommand(commands.MigrateCmd)
+	rootCmd.AddCommand(commands.EnvironmentsCmd)
 }
 
 func initConfig() {

app/backend/internal/database/sqlcdb/agents.sql.go

@@ -75,7 +75,7 @@ INSERT INTO node_agents (
     id, name, hostname, ip_address, port, status, version,
     capabilities, resources, last_heartbeat, metadata
 ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
-RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable
+RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain
 `
 
 type CreateAgentParams struct {
@@ -123,6 +123,8 @@ func (q *Queries) CreateAgent(ctx context.Context, arg CreateAgentParams) (NodeA
 		&i.Metadata,
 		&i.AutoPrune,
 		&i.Schedulable,
+		&i.Tags,
+		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -257,7 +259,7 @@ func (q *Queries) DeleteServiceContainersOnAgent(ctx context.Context, arg Delete
 }
 
 const getAgent = `-- name: GetAgent :one
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable FROM node_agents WHERE id = $1
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents WHERE id = $1
 `
 
 func (q *Queries) GetAgent(ctx context.Context, id string) (NodeAgent, error) {
@@ -279,12 +281,14 @@ func (q *Queries) GetAgent(ctx context.Context, id string) (NodeAgent, error) {
 		&i.Metadata,
 		&i.AutoPrune,
 		&i.Schedulable,
+		&i.Tags,
+		&i.DefaultDomain,
 	)
 	return i, err
 }
 
 const getAgentByHostAndIP = `-- name: GetAgentByHostAndIP :one
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable FROM node_agents
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents
 WHERE hostname = $1 AND ip_address = $2
 LIMIT 1
 `
@@ -313,6 +317,8 @@ func (q *Queries) GetAgentByHostAndIP(ctx context.Context, arg GetAgentByHostAnd
 		&i.Metadata,
 		&i.AutoPrune,
 		&i.Schedulable,
+		&i.Tags,
+		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -520,7 +526,7 @@ func (q *Queries) ListAgentHeartbeatsSince(ctx context.Context, arg ListAgentHea
 }
 
 const listAgents = `-- name: ListAgents :many
-SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable FROM node_agents ORDER BY created_at ASC
+SELECT id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain FROM node_agents ORDER BY created_at ASC
 `
 
 func (q *Queries) ListAgents(ctx context.Context) ([]NodeAgent, error) {
@@ -548,6 +554,8 @@ func (q *Queries) ListAgents(ctx context.Context) ([]NodeAgent, error) {
 			&i.Metadata,
 			&i.AutoPrune,
 			&i.Schedulable,
+			&i.Tags,
+			&i.DefaultDomain,
 		); err != nil {
 			return nil, err
 		}
@@ -691,6 +699,39 @@ func (q *Queries) ListPendingCommands(ctx context.Context, nodeAgentID string) (
 	return items, nil
 }
 
+const listSchedulableAgentDomains = `-- name: ListSchedulableAgentDomains :many
+SELECT DISTINCT default_domain FROM node_agents
+WHERE status = 'online' AND schedulable
+  AND default_domain <> ''
+  AND tags @> $1::jsonb
+ORDER BY default_domain
+`
+
+// Base domains of every online, schedulable agent carrying the required
+// placement tags — auto-domain candidates for spread services.
+func (q *Queries) ListSchedulableAgentDomains(ctx context.Context, dollar_1 json.RawMessage) ([]string, error) {
+	rows, err := q.db.QueryContext(ctx, listSchedulableAgentDomains, dollar_1)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []string{}
+	for rows.Next() {
+		var default_domain string
+		if err := rows.Scan(&default_domain); err != nil {
+			return nil, err
+		}
+		items = append(items, default_domain)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listSchedulableAgents = `-- name: ListSchedulableAgents :many
 SELECT id, name FROM node_agents
 WHERE status = 'online' AND schedulable
@@ -725,8 +766,72 @@ func (q *Queries) ListSchedulableAgents(ctx context.Context) ([]ListSchedulableA
 	return items, nil
 }
 
+const listSchedulableAgentsMatching = `-- name: ListSchedulableAgentsMatching :many
+SELECT id, name FROM node_agents
+WHERE status = 'online' AND schedulable
+  AND tags @> $1::jsonb
+ORDER BY id
+`
+
+type ListSchedulableAgentsMatchingRow struct {
+	ID   string `json:"id"`
+	Name string `json:"name"`
+}
+
+// Only agents carrying every required placement tag (jsonb array containment).
+func (q *Queries) ListSchedulableAgentsMatching(ctx context.Context, dollar_1 json.RawMessage) ([]ListSchedulableAgentsMatchingRow, error) {
+	rows, err := q.db.QueryContext(ctx, listSchedulableAgentsMatching, dollar_1)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListSchedulableAgentsMatchingRow{}
+	for rows.Next() {
+		var i ListSchedulableAgentsMatchingRow
+		if err := rows.Scan(&i.ID, &i.Name); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceAgents = `-- name: ListServiceAgents :many
+SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1
+`
+
+// Distinct agents holding inventory rows for a service.
+func (q *Queries) ListServiceAgents(ctx context.Context, serviceID string) ([]string, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceAgents, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []string{}
+	for rows.Next() {
+		var node_agent_id string
+		if err := rows.Scan(&node_agent_id); err != nil {
+			return nil, err
+		}
+		items = append(items, node_agent_id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listServiceContainers = `-- name: ListServiceContainers :many
-SELECT id, name, node_agent_id, status FROM container_instances
+SELECT id, name, node_agent_id, status, ports, resources FROM container_instances
 WHERE service_id = $1
 `
 
@@ -735,6 +840,8 @@ type ListServiceContainersRow struct {
 	Name        string                `json:"name"`
 	NodeAgentID string                `json:"node_agent_id"`
 	Status      pqtype.NullRawMessage `json:"status"`
+	Ports       pqtype.NullRawMessage `json:"ports"`
+	Resources   pqtype.NullRawMessage `json:"resources"`
 }
 
 func (q *Queries) ListServiceContainers(ctx context.Context, serviceID string) ([]ListServiceContainersRow, error) {
@@ -751,6 +858,8 @@ func (q *Queries) ListServiceContainers(ctx context.Context, serviceID string) (
 			&i.Name,
 			&i.NodeAgentID,
 			&i.Status,
+			&i.Ports,
+			&i.Resources,
 		); err != nil {
 			return nil, err
 		}
@@ -794,6 +903,36 @@ func (q *Queries) PickLeastLoadedAgent(ctx context.Context) (string, error) {
 	return id, err
 }
 
+const pickLeastLoadedAgentMatching = `-- name: PickLeastLoadedAgentMatching :one
+SELECT a.id FROM node_agents a
+LEFT JOIN LATERAL (
+    SELECT h.container_count FROM agent_heartbeats h
+    WHERE h.node_agent_id = a.id
+    ORDER BY h.timestamp DESC LIMIT 1
+) h ON true
+WHERE a.status = 'online' AND a.schedulable
+  AND a.tags @> $1::jsonb
+ORDER BY
+    COALESCE(
+        (a.resources->'memory'->>'used')::double precision
+        / NULLIF((a.resources->'memory'->>'total')::double precision, 0),
+        1.0
+    ) ASC,
+    COALESCE((a.resources->'cpu'->>'usage')::double precision, 100.0) ASC,
+    COALESCE(h.container_count, 0) ASC,
+    a.created_at ASC
+LIMIT 1
+`
+
+// Same resource-aware ordering as PickLeastLoadedAgent, restricted to agents
+// carrying every required placement tag.
+func (q *Queries) PickLeastLoadedAgentMatching(ctx context.Context, dollar_1 json.RawMessage) (string, error) {
+	row := q.db.QueryRowContext(ctx, pickLeastLoadedAgentMatching, dollar_1)
+	var id string
+	err := row.Scan(&id)
+	return id, err
+}
+
 const scrubCommandPayload = `-- name: ScrubCommandPayload :exec
 UPDATE agent_commands SET payload = $2, updated_at = NOW() WHERE id = $1
 `
@@ -808,6 +947,20 @@ func (q *Queries) ScrubCommandPayload(ctx context.Context, arg ScrubCommandPaylo
 	return err
 }
 
+const setAgentDefaultDomain = `-- name: SetAgentDefaultDomain :exec
+UPDATE node_agents SET default_domain = $2, updated_at = NOW() WHERE id = $1
+`
+
+type SetAgentDefaultDomainParams struct {
+	ID            string `json:"id"`
+	DefaultDomain string `json:"default_domain"`
+}
+
+func (q *Queries) SetAgentDefaultDomain(ctx context.Context, arg SetAgentDefaultDomainParams) error {
+	_, err := q.db.ExecContext(ctx, setAgentDefaultDomain, arg.ID, arg.DefaultDomain)
+	return err
+}
+
 const setAgentSchedulable = `-- name: SetAgentSchedulable :exec
 UPDATE node_agents SET schedulable = $2, updated_at = NOW() WHERE id = $1
 `
@@ -822,6 +975,20 @@ func (q *Queries) SetAgentSchedulable(ctx context.Context, arg SetAgentSchedulab
 	return err
 }
 
+const setAgentTags = `-- name: SetAgentTags :exec
+UPDATE node_agents SET tags = $2::jsonb, updated_at = NOW() WHERE id = $1
+`
+
+type SetAgentTagsParams struct {
+	ID      string          `json:"id"`
+	Column2 json.RawMessage `json:"column_2"`
+}
+
+func (q *Queries) SetAgentTags(ctx context.Context, arg SetAgentTagsParams) error {
+	_, err := q.db.ExecContext(ctx, setAgentTags, arg.ID, arg.Column2)
+	return err
+}
+
 const updateAgent = `-- name: UpdateAgent :one
 UPDATE node_agents SET
     name = $2,
@@ -838,7 +1005,7 @@ UPDATE node_agents SET
     schedulable = $13,
     updated_at = NOW()
 WHERE id = $1
-RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable
+RETURNING id, name, hostname, ip_address, port, status, version, capabilities, resources, last_heartbeat, created_at, updated_at, metadata, auto_prune, schedulable, tags, default_domain
 `
 
 type UpdateAgentParams struct {
@@ -890,6 +1057,8 @@ func (q *Queries) UpdateAgent(ctx context.Context, arg UpdateAgentParams) (NodeA
 		&i.Metadata,
 		&i.AutoPrune,
 		&i.Schedulable,
+		&i.Tags,
+		&i.DefaultDomain,
 	)
 	return i, err
 }
@@ -920,6 +1089,53 @@ func (q *Queries) UpdateAgentHeartbeat(ctx context.Context, arg UpdateAgentHeart
 	return err
 }
 
+const updateContainerPorts = `-- name: UpdateContainerPorts :exec
+UPDATE container_instances SET status = $2, ports = $3, updated_at = NOW()
+WHERE id = $1
+`
+
+type UpdateContainerPortsParams struct {
+	ID     string                `json:"id"`
+	Status pqtype.NullRawMessage `json:"status"`
+	Ports  pqtype.NullRawMessage `json:"ports"`
+}
+
+// Agent reports the real host bindings after create — persist them with
+// the status flip so ingress can route to the assigned port.
+func (q *Queries) UpdateContainerPorts(ctx context.Context, arg UpdateContainerPortsParams) error {
+	_, err := q.db.ExecContext(ctx, updateContainerPorts, arg.ID, arg.Status, arg.Ports)
+	return err
+}
+
+const updateContainerStateByName = `-- name: UpdateContainerStateByName :exec
+UPDATE container_instances SET
+    status = jsonb_set(status, '{state}', $3::jsonb),
+    resources = jsonb_set(COALESCE(resources, '{}'::jsonb), '{net_bytes}', $4::jsonb),
+    updated_at = NOW()
+WHERE name = $1 AND node_agent_id = $2
+  AND status->>'state' IS DISTINCT FROM 'removed'
+`
+
+type UpdateContainerStateByNameParams struct {
+	Name        string          `json:"name"`
+	NodeAgentID string          `json:"node_agent_id"`
+	Column3     json.RawMessage `json:"column_3"`
+	Column4     json.RawMessage `json:"column_4"`
+}
+
+// Agent heartbeat reports real docker state + net counters; reconcile
+// inventory for rows this node owns. Tombstones win — never resurrect a
+// removed replica. $4 is the cumulative rx+tx byte counter.
+func (q *Queries) UpdateContainerStateByName(ctx context.Context, arg UpdateContainerStateByNameParams) error {
+	_, err := q.db.ExecContext(ctx, updateContainerStateByName,
+		arg.Name,
+		arg.NodeAgentID,
+		arg.Column3,
+		arg.Column4,
+	)
+	return err
+}
+
 const updateContainerStatus = `-- name: UpdateContainerStatus :exec
 UPDATE container_instances SET status = $2, updated_at = NOW()
 WHERE id = $1

app/backend/internal/database/sqlcdb/deployments.sql.go

@@ -0,0 +1,536 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: deployments.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const completeDeployment = `-- name: CompleteDeployment :exec
+UPDATE deployments
+SET status = $1, error = $2, completed_at = $3, updated_at = $3
+WHERE id = $4
+`
+
+type CompleteDeploymentParams struct {
+	Status      sql.NullString `json:"status"`
+	Error       sql.NullString `json:"error"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	ID          uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) CompleteDeployment(ctx context.Context, arg CompleteDeploymentParams) error {
+	_, err := q.db.ExecContext(ctx, completeDeployment,
+		arg.Status,
+		arg.Error,
+		arg.CompletedAt,
+		arg.ID,
+	)
+	return err
+}
+
+const countAccessibleDeployments = `-- name: CountAccessibleDeployments :one
+SELECT COUNT(*)
+FROM deployments d
+JOIN services s ON s.id = d.service_id
+JOIN projects p ON p.id = s.project_id
+WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
+   OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)
+`
+
+type CountAccessibleDeploymentsParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+}
+
+func (q *Queries) CountAccessibleDeployments(ctx context.Context, arg CountAccessibleDeploymentsParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countAccessibleDeployments, arg.OwnerID, arg.Column2)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const countDeploymentsForService = `-- name: CountDeploymentsForService :one
+SELECT COUNT(*) FROM deployments WHERE service_id = $1
+`
+
+func (q *Queries) CountDeploymentsForService(ctx context.Context, serviceID uuid.UUID) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countDeploymentsForService, serviceID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const failDeployment = `-- name: FailDeployment :exec
+UPDATE deployments
+SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+WHERE id = $3
+`
+
+type FailDeploymentParams struct {
+	Error       sql.NullString `json:"error"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	ID          uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) FailDeployment(ctx context.Context, arg FailDeploymentParams) error {
+	_, err := q.db.ExecContext(ctx, failDeployment, arg.Error, arg.CompletedAt, arg.ID)
+	return err
+}
+
+const getDeploymentAccess = `-- name: GetDeploymentAccess :one
+SELECT d.status, d.service_id, p.owner_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1
+`
+
+type GetDeploymentAccessRow struct {
+	Status    sql.NullString `json:"status"`
+	ServiceID uuid.UUID      `json:"service_id"`
+	OwnerID   uuid.UUID      `json:"owner_id"`
+}
+
+func (q *Queries) GetDeploymentAccess(ctx context.Context, id uuid.UUID) (GetDeploymentAccessRow, error) {
+	row := q.db.QueryRowContext(ctx, getDeploymentAccess, id)
+	var i GetDeploymentAccessRow
+	err := row.Scan(&i.Status, &i.ServiceID, &i.OwnerID)
+	return i, err
+}
+
+const getDeploymentForRollback = `-- name: GetDeploymentForRollback :one
+SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
+       d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
+       d.created_at, d.updated_at, p.owner_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1
+`
+
+type GetDeploymentForRollbackRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	CommitHash  sql.NullString `json:"commit_hash"`
+	Status      sql.NullString `json:"status"`
+	ImageName   sql.NullString `json:"image_name"`
+	ImageTag    sql.NullString `json:"image_tag"`
+	BuildLog    sql.NullString `json:"build_log"`
+	RuntimeLog  sql.NullString `json:"runtime_log"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+	OwnerID     uuid.UUID      `json:"owner_id"`
+}
+
+func (q *Queries) GetDeploymentForRollback(ctx context.Context, id uuid.UUID) (GetDeploymentForRollbackRow, error) {
+	row := q.db.QueryRowContext(ctx, getDeploymentForRollback, id)
+	var i GetDeploymentForRollbackRow
+	err := row.Scan(
+		&i.ID,
+		&i.ServiceID,
+		&i.CommitHash,
+		&i.Status,
+		&i.ImageName,
+		&i.ImageTag,
+		&i.BuildLog,
+		&i.RuntimeLog,
+		&i.Error,
+		&i.StartedAt,
+		&i.CompletedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OwnerID,
+	)
+	return i, err
+}
+
+const getDeploymentWithProject = `-- name: GetDeploymentWithProject :one
+SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
+       d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
+       d.created_at, d.updated_at, p.id AS project_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1
+`
+
+type GetDeploymentWithProjectRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	CommitHash  sql.NullString `json:"commit_hash"`
+	Status      sql.NullString `json:"status"`
+	ImageName   sql.NullString `json:"image_name"`
+	ImageTag    sql.NullString `json:"image_tag"`
+	BuildLog    sql.NullString `json:"build_log"`
+	RuntimeLog  sql.NullString `json:"runtime_log"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+	ProjectID   uuid.UUID      `json:"project_id"`
+}
+
+func (q *Queries) GetDeploymentWithProject(ctx context.Context, id uuid.UUID) (GetDeploymentWithProjectRow, error) {
+	row := q.db.QueryRowContext(ctx, getDeploymentWithProject, id)
+	var i GetDeploymentWithProjectRow
+	err := row.Scan(
+		&i.ID,
+		&i.ServiceID,
+		&i.CommitHash,
+		&i.Status,
+		&i.ImageName,
+		&i.ImageTag,
+		&i.BuildLog,
+		&i.RuntimeLog,
+		&i.Error,
+		&i.StartedAt,
+		&i.CompletedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.ProjectID,
+	)
+	return i, err
+}
+
+const getServiceForDeployWithOwner = `-- name: GetServiceForDeployWithOwner :one
+SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
+       s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at, p.owner_id
+FROM services s
+JOIN projects p ON s.project_id = p.id
+WHERE s.id = $1
+`
+
+type GetServiceForDeployWithOwnerRow struct {
+	ID              uuid.UUID      `json:"id"`
+	ProjectID       uuid.UUID      `json:"project_id"`
+	Name            string         `json:"name"`
+	Type            sql.NullString `json:"type"`
+	Status          sql.NullString `json:"status"`
+	Image           sql.NullString `json:"image"`
+	Command         sql.NullString `json:"command"`
+	Environment     sql.NullString `json:"environment"`
+	GitRepo         sql.NullString `json:"git_repo"`
+	GitBranch       sql.NullString `json:"git_branch"`
+	BuildPath       sql.NullString `json:"build_path"`
+	Cpu             sql.NullString `json:"cpu"`
+	Memory          sql.NullString `json:"memory"`
+	Replicas        int32          `json:"replicas"`
+	Port            int32          `json:"port"`
+	Domain          string         `json:"domain"`
+	HealthcheckPath string         `json:"healthcheck_path"`
+	RestartPolicy   string         `json:"restart_policy"`
+	Builder         string         `json:"builder"`
+	CpuReserve      string         `json:"cpu_reserve"`
+	MemoryReserve   string         `json:"memory_reserve"`
+	StaticBuildCmd  string         `json:"static_build_cmd"`
+	StaticDir       string         `json:"static_dir"`
+	CreatedAt       sql.NullTime   `json:"created_at"`
+	UpdatedAt       sql.NullTime   `json:"updated_at"`
+	OwnerID         uuid.UUID      `json:"owner_id"`
+}
+
+func (q *Queries) GetServiceForDeployWithOwner(ctx context.Context, id uuid.UUID) (GetServiceForDeployWithOwnerRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceForDeployWithOwner, id)
+	var i GetServiceForDeployWithOwnerRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Type,
+		&i.Status,
+		&i.Image,
+		&i.Command,
+		&i.Environment,
+		&i.GitRepo,
+		&i.GitBranch,
+		&i.BuildPath,
+		&i.Cpu,
+		&i.Memory,
+		&i.Replicas,
+		&i.Port,
+		&i.Domain,
+		&i.HealthcheckPath,
+		&i.RestartPolicy,
+		&i.Builder,
+		&i.CpuReserve,
+		&i.MemoryReserve,
+		&i.StaticBuildCmd,
+		&i.StaticDir,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OwnerID,
+	)
+	return i, err
+}
+
+const getServicePublishedPort = `-- name: GetServicePublishedPort :one
+SELECT published_port FROM services WHERE id = $1
+`
+
+func (q *Queries) GetServicePublishedPort(ctx context.Context, id uuid.UUID) (int32, error) {
+	row := q.db.QueryRowContext(ctx, getServicePublishedPort, id)
+	var published_port int32
+	err := row.Scan(&published_port)
+	return published_port, err
+}
+
+const insertDeployment = `-- name: InsertDeployment :exec
+INSERT INTO deployments
+    (id, service_id, version, commit_hash, status, image_name, image_tag, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+`
+
+type InsertDeploymentParams struct {
+	ID         uuid.UUID      `json:"id"`
+	ServiceID  uuid.UUID      `json:"service_id"`
+	Version    string         `json:"version"`
+	CommitHash sql.NullString `json:"commit_hash"`
+	Status     sql.NullString `json:"status"`
+	ImageName  sql.NullString `json:"image_name"`
+	ImageTag   sql.NullString `json:"image_tag"`
+	CreatedAt  sql.NullTime   `json:"created_at"`
+	UpdatedAt  sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) InsertDeployment(ctx context.Context, arg InsertDeploymentParams) error {
+	_, err := q.db.ExecContext(ctx, insertDeployment,
+		arg.ID,
+		arg.ServiceID,
+		arg.Version,
+		arg.CommitHash,
+		arg.Status,
+		arg.ImageName,
+		arg.ImageTag,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const listDeploymentsForService = `-- name: ListDeploymentsForService :many
+SELECT id, service_id, commit_hash, status, image_name, image_tag,
+       build_log, runtime_log, error, started_at, completed_at, created_at, updated_at
+FROM deployments
+WHERE service_id = $1
+ORDER BY created_at DESC
+LIMIT $2 OFFSET $3
+`
+
+type ListDeploymentsForServiceParams struct {
+	ServiceID uuid.UUID `json:"service_id"`
+	Limit     int32     `json:"limit"`
+	Offset    int32     `json:"offset"`
+}
+
+type ListDeploymentsForServiceRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	CommitHash  sql.NullString `json:"commit_hash"`
+	Status      sql.NullString `json:"status"`
+	ImageName   sql.NullString `json:"image_name"`
+	ImageTag    sql.NullString `json:"image_tag"`
+	BuildLog    sql.NullString `json:"build_log"`
+	RuntimeLog  sql.NullString `json:"runtime_log"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) ListDeploymentsForService(ctx context.Context, arg ListDeploymentsForServiceParams) ([]ListDeploymentsForServiceRow, error) {
+	rows, err := q.db.QueryContext(ctx, listDeploymentsForService, arg.ServiceID, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListDeploymentsForServiceRow{}
+	for rows.Next() {
+		var i ListDeploymentsForServiceRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ServiceID,
+			&i.CommitHash,
+			&i.Status,
+			&i.ImageName,
+			&i.ImageTag,
+			&i.BuildLog,
+			&i.RuntimeLog,
+			&i.Error,
+			&i.StartedAt,
+			&i.CompletedAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listRecentAccessibleDeployments = `-- name: ListRecentAccessibleDeployments :many
+SELECT d.id, d.service_id, s.name AS service_name, p.name AS project_name, d.status,
+       COALESCE(d.image_name, '') AS image_name, d.started_at, d.completed_at, d.created_at
+FROM deployments d
+JOIN services s ON s.id = d.service_id
+JOIN projects p ON p.id = s.project_id
+WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
+   OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)
+ORDER BY d.created_at DESC
+LIMIT $3 OFFSET $4
+`
+
+type ListRecentAccessibleDeploymentsParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+	Limit   int32     `json:"limit"`
+	Offset  int32     `json:"offset"`
+}
+
+type ListRecentAccessibleDeploymentsRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	ServiceName string         `json:"service_name"`
+	ProjectName string         `json:"project_name"`
+	Status      sql.NullString `json:"status"`
+	ImageName   string         `json:"image_name"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+}
+
+func (q *Queries) ListRecentAccessibleDeployments(ctx context.Context, arg ListRecentAccessibleDeploymentsParams) ([]ListRecentAccessibleDeploymentsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listRecentAccessibleDeployments,
+		arg.OwnerID,
+		arg.Column2,
+		arg.Limit,
+		arg.Offset,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListRecentAccessibleDeploymentsRow{}
+	for rows.Next() {
+		var i ListRecentAccessibleDeploymentsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ServiceID,
+			&i.ServiceName,
+			&i.ProjectName,
+			&i.Status,
+			&i.ImageName,
+			&i.StartedAt,
+			&i.CompletedAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const setDeploymentStatus = `-- name: SetDeploymentStatus :exec
+UPDATE deployments SET status = $1, updated_at = $2 WHERE id = $3
+`
+
+type SetDeploymentStatusParams struct {
+	Status    sql.NullString `json:"status"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+	ID        uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) SetDeploymentStatus(ctx context.Context, arg SetDeploymentStatusParams) error {
+	_, err := q.db.ExecContext(ctx, setDeploymentStatus, arg.Status, arg.UpdatedAt, arg.ID)
+	return err
+}
+
+const setServiceStatus = `-- name: SetServiceStatus :exec
+UPDATE services SET status = $1, updated_at = $2 WHERE id = $3
+`
+
+type SetServiceStatusParams struct {
+	Status    sql.NullString `json:"status"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+	ID        uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) SetServiceStatus(ctx context.Context, arg SetServiceStatusParams) error {
+	_, err := q.db.ExecContext(ctx, setServiceStatus, arg.Status, arg.UpdatedAt, arg.ID)
+	return err
+}
+
+const syncDeploymentProgress = `-- name: SyncDeploymentProgress :exec
+UPDATE deployments
+SET status = $1,
+    image_name = $2,
+    image_tag = $3,
+    build_log = $4,
+    runtime_log = $5,
+    error = $6,
+    started_at = $7,
+    completed_at = $8,
+    updated_at = $9
+WHERE id = $10
+`
+
+type SyncDeploymentProgressParams struct {
+	Status      sql.NullString `json:"status"`
+	ImageName   sql.NullString `json:"image_name"`
+	ImageTag    sql.NullString `json:"image_tag"`
+	BuildLog    sql.NullString `json:"build_log"`
+	RuntimeLog  sql.NullString `json:"runtime_log"`
+	Error       sql.NullString `json:"error"`
+	StartedAt   sql.NullTime   `json:"started_at"`
+	CompletedAt sql.NullTime   `json:"completed_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+	ID          uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) SyncDeploymentProgress(ctx context.Context, arg SyncDeploymentProgressParams) error {
+	_, err := q.db.ExecContext(ctx, syncDeploymentProgress,
+		arg.Status,
+		arg.ImageName,
+		arg.ImageTag,
+		arg.BuildLog,
+		arg.RuntimeLog,
+		arg.Error,
+		arg.StartedAt,
+		arg.CompletedAt,
+		arg.UpdatedAt,
+		arg.ID,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/domains.sql.go

@@ -0,0 +1,242 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: domains.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const clearServiceDomainDefault = `-- name: ClearServiceDomainDefault :exec
+UPDATE service_domains SET is_default = false WHERE service_id = $1
+`
+
+func (q *Queries) ClearServiceDomainDefault(ctx context.Context, serviceID uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, clearServiceDomainDefault, serviceID)
+	return err
+}
+
+const countServiceDomains = `-- name: CountServiceDomains :one
+SELECT COUNT(*) FROM service_domains WHERE service_id = $1
+`
+
+func (q *Queries) CountServiceDomains(ctx context.Context, serviceID uuid.UUID) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countServiceDomains, serviceID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createServiceDomain = `-- name: CreateServiceDomain :one
+INSERT INTO service_domains (service_id, domain, is_default)
+VALUES ($1, $2, $3)
+RETURNING id, service_id, domain, is_default, cert_type, cert_status, created_at
+`
+
+type CreateServiceDomainParams struct {
+	ServiceID uuid.UUID `json:"service_id"`
+	Domain    string    `json:"domain"`
+	IsDefault bool      `json:"is_default"`
+}
+
+type CreateServiceDomainRow struct {
+	ID         uuid.UUID `json:"id"`
+	ServiceID  uuid.UUID `json:"service_id"`
+	Domain     string    `json:"domain"`
+	IsDefault  bool      `json:"is_default"`
+	CertType   string    `json:"cert_type"`
+	CertStatus string    `json:"cert_status"`
+	CreatedAt  time.Time `json:"created_at"`
+}
+
+func (q *Queries) CreateServiceDomain(ctx context.Context, arg CreateServiceDomainParams) (CreateServiceDomainRow, error) {
+	row := q.db.QueryRowContext(ctx, createServiceDomain, arg.ServiceID, arg.Domain, arg.IsDefault)
+	var i CreateServiceDomainRow
+	err := row.Scan(
+		&i.ID,
+		&i.ServiceID,
+		&i.Domain,
+		&i.IsDefault,
+		&i.CertType,
+		&i.CertStatus,
+		&i.CreatedAt,
+	)
+	return i, err
+}
+
+const deleteServiceDomain = `-- name: DeleteServiceDomain :execrows
+DELETE FROM service_domains WHERE id = $1 AND service_id = $2
+`
+
+type DeleteServiceDomainParams struct {
+	ID        uuid.UUID `json:"id"`
+	ServiceID uuid.UUID `json:"service_id"`
+}
+
+func (q *Queries) DeleteServiceDomain(ctx context.Context, arg DeleteServiceDomainParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, deleteServiceDomain, arg.ID, arg.ServiceID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const getServiceAccess = `-- name: GetServiceAccess :one
+SELECT maintenance_mode, basic_auth_users FROM services WHERE id = $1
+`
+
+type GetServiceAccessRow struct {
+	MaintenanceMode bool   `json:"maintenance_mode"`
+	BasicAuthUsers  string `json:"basic_auth_users"`
+}
+
+func (q *Queries) GetServiceAccess(ctx context.Context, id uuid.UUID) (GetServiceAccessRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceAccess, id)
+	var i GetServiceAccessRow
+	err := row.Scan(&i.MaintenanceMode, &i.BasicAuthUsers)
+	return i, err
+}
+
+const getServiceDomainDefault = `-- name: GetServiceDomainDefault :one
+SELECT domain FROM service_domains WHERE service_id = $1 AND is_default
+`
+
+func (q *Queries) GetServiceDomainDefault(ctx context.Context, serviceID uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceDomainDefault, serviceID)
+	var domain string
+	err := row.Scan(&domain)
+	return domain, err
+}
+
+const getServiceDomainFirst = `-- name: GetServiceDomainFirst :one
+SELECT domain FROM service_domains WHERE service_id = $1 ORDER BY created_at ASC LIMIT 1
+`
+
+func (q *Queries) GetServiceDomainFirst(ctx context.Context, serviceID uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceDomainFirst, serviceID)
+	var domain string
+	err := row.Scan(&domain)
+	return domain, err
+}
+
+const getServicePlacementBrief = `-- name: GetServicePlacementBrief :one
+SELECT name, node_id, COALESCE(spread, false) AS spread FROM services WHERE id = $1
+`
+
+type GetServicePlacementBriefRow struct {
+	Name   string         `json:"name"`
+	NodeID sql.NullString `json:"node_id"`
+	Spread bool           `json:"spread"`
+}
+
+func (q *Queries) GetServicePlacementBrief(ctx context.Context, id uuid.UUID) (GetServicePlacementBriefRow, error) {
+	row := q.db.QueryRowContext(ctx, getServicePlacementBrief, id)
+	var i GetServicePlacementBriefRow
+	err := row.Scan(&i.Name, &i.NodeID, &i.Spread)
+	return i, err
+}
+
+const listServiceDomains = `-- name: ListServiceDomains :many
+SELECT id, service_id, domain, is_default, cert_type, cert_status, last_checked_at, created_at
+FROM service_domains
+WHERE service_id = $1
+ORDER BY is_default DESC, created_at ASC
+`
+
+func (q *Queries) ListServiceDomains(ctx context.Context, serviceID uuid.UUID) ([]ServiceDomain, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceDomains, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ServiceDomain{}
+	for rows.Next() {
+		var i ServiceDomain
+		if err := rows.Scan(
+			&i.ID,
+			&i.ServiceID,
+			&i.Domain,
+			&i.IsDefault,
+			&i.CertType,
+			&i.CertStatus,
+			&i.LastCheckedAt,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const serviceWriteAccess = `-- name: ServiceWriteAccess :one
+SELECT EXISTS(
+    SELECT 1 FROM services s JOIN projects p ON s.project_id = p.id
+    WHERE s.id = $1 AND (p.owner_id = $2 OR $3::bool)
+) AS allowed
+`
+
+type ServiceWriteAccessParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+func (q *Queries) ServiceWriteAccess(ctx context.Context, arg ServiceWriteAccessParams) (bool, error) {
+	row := q.db.QueryRowContext(ctx, serviceWriteAccess, arg.ID, arg.OwnerID, arg.Column3)
+	var allowed bool
+	err := row.Scan(&allowed)
+	return allowed, err
+}
+
+const setServiceDomainDefault = `-- name: SetServiceDomainDefault :execrows
+UPDATE service_domains SET is_default = (id = $1) WHERE service_id = $2
+`
+
+type SetServiceDomainDefaultParams struct {
+	ID        uuid.UUID `json:"id"`
+	ServiceID uuid.UUID `json:"service_id"`
+}
+
+func (q *Queries) SetServiceDomainDefault(ctx context.Context, arg SetServiceDomainDefaultParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, setServiceDomainDefault, arg.ID, arg.ServiceID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const setServiceLegacyDomain = `-- name: SetServiceLegacyDomain :exec
+UPDATE services SET domain = $1 WHERE id = $2
+`
+
+type SetServiceLegacyDomainParams struct {
+	Domain string    `json:"domain"`
+	ID     uuid.UUID `json:"id"`
+}
+
+func (q *Queries) SetServiceLegacyDomain(ctx context.Context, arg SetServiceLegacyDomainParams) error {
+	_, err := q.db.ExecContext(ctx, setServiceLegacyDomain, arg.Domain, arg.ID)
+	return err
+}
+
+const touchServiceDomainChecked = `-- name: TouchServiceDomainChecked :exec
+UPDATE service_domains SET last_checked_at = NOW() WHERE id = $1
+`
+
+func (q *Queries) TouchServiceDomainChecked(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, touchServiceDomainChecked, id)
+	return err
+}

app/backend/internal/database/sqlcdb/metrics.sql.go

@@ -0,0 +1,623 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: metrics.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+)
+
+const aggregateNodeMetrics = `-- name: AggregateNodeMetrics :many
+SELECT date_bin($1::interval, timestamp, '2000-01-01'::timestamptz) AS bucket,
+       AVG(cpu_usage)::float8 AS avg_cpu,
+       AVG(memory_usage_percent)::float8 AS avg_memory,
+       AVG(storage_usage_percent)::float8 AS avg_storage
+FROM node_metrics
+WHERE node_id = $2 AND timestamp BETWEEN $3 AND $4
+GROUP BY bucket
+ORDER BY bucket ASC
+`
+
+type AggregateNodeMetricsParams struct {
+	Column1     int64     `json:"column_1"`
+	NodeID      string    `json:"node_id"`
+	Timestamp   time.Time `json:"timestamp"`
+	Timestamp_2 time.Time `json:"timestamp_2"`
+}
+
+type AggregateNodeMetricsRow struct {
+	Bucket     interface{} `json:"bucket"`
+	AvgCpu     float64     `json:"avg_cpu"`
+	AvgMemory  float64     `json:"avg_memory"`
+	AvgStorage float64     `json:"avg_storage"`
+}
+
+// Portable bucket bucketing (no TimescaleDB): floor epoch seconds into
+// bucket-sized buckets, then back to timestamptz.
+func (q *Queries) AggregateNodeMetrics(ctx context.Context, arg AggregateNodeMetricsParams) ([]AggregateNodeMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, aggregateNodeMetrics,
+		arg.Column1,
+		arg.NodeID,
+		arg.Timestamp,
+		arg.Timestamp_2,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []AggregateNodeMetricsRow{}
+	for rows.Next() {
+		var i AggregateNodeMetricsRow
+		if err := rows.Scan(
+			&i.Bucket,
+			&i.AvgCpu,
+			&i.AvgMemory,
+			&i.AvgStorage,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listInstanceMetrics = `-- name: ListInstanceMetrics :many
+SELECT instance_id, node_id, status, cpu, memory,
+       network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+       network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+       start_time, last_seen, health_status, health_last_check, health_check_count, health_failure_count
+FROM instance_metrics
+WHERE service_id = $1 AND timestamp = $2
+`
+
+type ListInstanceMetricsParams struct {
+	ServiceID string    `json:"service_id"`
+	Timestamp time.Time `json:"timestamp"`
+}
+
+type ListInstanceMetricsRow struct {
+	InstanceID            string         `json:"instance_id"`
+	NodeID                sql.NullString `json:"node_id"`
+	Status                sql.NullString `json:"status"`
+	Cpu                   sql.NullString `json:"cpu"`
+	Memory                sql.NullInt64  `json:"memory"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	StartTime             sql.NullTime   `json:"start_time"`
+	LastSeen              sql.NullTime   `json:"last_seen"`
+	HealthStatus          sql.NullString `json:"health_status"`
+	HealthLastCheck       sql.NullTime   `json:"health_last_check"`
+	HealthCheckCount      sql.NullInt32  `json:"health_check_count"`
+	HealthFailureCount    sql.NullInt32  `json:"health_failure_count"`
+}
+
+func (q *Queries) ListInstanceMetrics(ctx context.Context, arg ListInstanceMetricsParams) ([]ListInstanceMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listInstanceMetrics, arg.ServiceID, arg.Timestamp)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListInstanceMetricsRow{}
+	for rows.Next() {
+		var i ListInstanceMetricsRow
+		if err := rows.Scan(
+			&i.InstanceID,
+			&i.NodeID,
+			&i.Status,
+			&i.Cpu,
+			&i.Memory,
+			&i.NetworkBytesIn,
+			&i.NetworkBytesOut,
+			&i.NetworkPacketsIn,
+			&i.NetworkPacketsOut,
+			&i.NetworkConnectionsIn,
+			&i.NetworkConnectionsOut,
+			&i.NetworkErrorsIn,
+			&i.NetworkErrorsOut,
+			&i.StartTime,
+			&i.LastSeen,
+			&i.HealthStatus,
+			&i.HealthLastCheck,
+			&i.HealthCheckCount,
+			&i.HealthFailureCount,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listNodeMetrics = `-- name: ListNodeMetrics :many
+SELECT node_id, timestamp, cpu_usage, cpu_cores, load_avg_1, load_avg_5, load_avg_15,
+       memory_total, memory_used, memory_available, memory_usage_percent,
+       storage_total, storage_used, storage_available, storage_usage_percent,
+       network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+       network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+       coalesce(extract(epoch from uptime), 0)::bigint AS uptime_seconds,
+       processes, os, kernel, architecture
+FROM node_metrics
+WHERE node_id = $1 AND timestamp BETWEEN $2 AND $3
+ORDER BY timestamp ASC
+`
+
+type ListNodeMetricsParams struct {
+	NodeID      string    `json:"node_id"`
+	Timestamp   time.Time `json:"timestamp"`
+	Timestamp_2 time.Time `json:"timestamp_2"`
+}
+
+type ListNodeMetricsRow struct {
+	NodeID                string         `json:"node_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	CpuUsage              sql.NullString `json:"cpu_usage"`
+	CpuCores              sql.NullString `json:"cpu_cores"`
+	LoadAvg1              sql.NullString `json:"load_avg_1"`
+	LoadAvg5              sql.NullString `json:"load_avg_5"`
+	LoadAvg15             sql.NullString `json:"load_avg_15"`
+	MemoryTotal           sql.NullInt64  `json:"memory_total"`
+	MemoryUsed            sql.NullInt64  `json:"memory_used"`
+	MemoryAvailable       sql.NullInt64  `json:"memory_available"`
+	MemoryUsagePercent    sql.NullString `json:"memory_usage_percent"`
+	StorageTotal          sql.NullInt64  `json:"storage_total"`
+	StorageUsed           sql.NullInt64  `json:"storage_used"`
+	StorageAvailable      sql.NullInt64  `json:"storage_available"`
+	StorageUsagePercent   sql.NullString `json:"storage_usage_percent"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	UptimeSeconds         int64          `json:"uptime_seconds"`
+	Processes             sql.NullInt32  `json:"processes"`
+	Os                    sql.NullString `json:"os"`
+	Kernel                sql.NullString `json:"kernel"`
+	Architecture          sql.NullString `json:"architecture"`
+}
+
+func (q *Queries) ListNodeMetrics(ctx context.Context, arg ListNodeMetricsParams) ([]ListNodeMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listNodeMetrics, arg.NodeID, arg.Timestamp, arg.Timestamp_2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListNodeMetricsRow{}
+	for rows.Next() {
+		var i ListNodeMetricsRow
+		if err := rows.Scan(
+			&i.NodeID,
+			&i.Timestamp,
+			&i.CpuUsage,
+			&i.CpuCores,
+			&i.LoadAvg1,
+			&i.LoadAvg5,
+			&i.LoadAvg15,
+			&i.MemoryTotal,
+			&i.MemoryUsed,
+			&i.MemoryAvailable,
+			&i.MemoryUsagePercent,
+			&i.StorageTotal,
+			&i.StorageUsed,
+			&i.StorageAvailable,
+			&i.StorageUsagePercent,
+			&i.NetworkBytesIn,
+			&i.NetworkBytesOut,
+			&i.NetworkPacketsIn,
+			&i.NetworkPacketsOut,
+			&i.NetworkConnectionsIn,
+			&i.NetworkConnectionsOut,
+			&i.NetworkErrorsIn,
+			&i.NetworkErrorsOut,
+			&i.UptimeSeconds,
+			&i.Processes,
+			&i.Os,
+			&i.Kernel,
+			&i.Architecture,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceMetrics = `-- name: ListServiceMetrics :many
+SELECT service_id, service_name, project_id, timestamp,
+       requests_total, requests_success, requests_errors, requests_avg_latency,
+       requests_p95_latency, requests_p99_latency, requests_throughput,
+       errors_total, errors_rate, performance_response_time, performance_throughput,
+       performance_concurrency, performance_saturation, performance_utilization,
+       resource_cpu_usage, resource_memory_usage, resource_storage_usage,
+       resource_network_usage, resource_score
+FROM service_metrics
+WHERE service_id = $1 AND timestamp BETWEEN $2 AND $3
+ORDER BY timestamp ASC
+`
+
+type ListServiceMetricsParams struct {
+	ServiceID   string    `json:"service_id"`
+	Timestamp   time.Time `json:"timestamp"`
+	Timestamp_2 time.Time `json:"timestamp_2"`
+}
+
+type ListServiceMetricsRow struct {
+	ServiceID               string         `json:"service_id"`
+	ServiceName             string         `json:"service_name"`
+	ProjectID               string         `json:"project_id"`
+	Timestamp               time.Time      `json:"timestamp"`
+	RequestsTotal           sql.NullInt64  `json:"requests_total"`
+	RequestsSuccess         sql.NullInt64  `json:"requests_success"`
+	RequestsErrors          sql.NullInt64  `json:"requests_errors"`
+	RequestsAvgLatency      sql.NullString `json:"requests_avg_latency"`
+	RequestsP95Latency      sql.NullString `json:"requests_p95_latency"`
+	RequestsP99Latency      sql.NullString `json:"requests_p99_latency"`
+	RequestsThroughput      sql.NullString `json:"requests_throughput"`
+	ErrorsTotal             sql.NullInt64  `json:"errors_total"`
+	ErrorsRate              sql.NullString `json:"errors_rate"`
+	PerformanceResponseTime sql.NullString `json:"performance_response_time"`
+	PerformanceThroughput   sql.NullString `json:"performance_throughput"`
+	PerformanceConcurrency  sql.NullInt64  `json:"performance_concurrency"`
+	PerformanceSaturation   sql.NullString `json:"performance_saturation"`
+	PerformanceUtilization  sql.NullString `json:"performance_utilization"`
+	ResourceCpuUsage        sql.NullString `json:"resource_cpu_usage"`
+	ResourceMemoryUsage     sql.NullInt64  `json:"resource_memory_usage"`
+	ResourceStorageUsage    sql.NullInt64  `json:"resource_storage_usage"`
+	ResourceNetworkUsage    sql.NullInt64  `json:"resource_network_usage"`
+	ResourceScore           sql.NullString `json:"resource_score"`
+}
+
+func (q *Queries) ListServiceMetrics(ctx context.Context, arg ListServiceMetricsParams) ([]ListServiceMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceMetrics, arg.ServiceID, arg.Timestamp, arg.Timestamp_2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListServiceMetricsRow{}
+	for rows.Next() {
+		var i ListServiceMetricsRow
+		if err := rows.Scan(
+			&i.ServiceID,
+			&i.ServiceName,
+			&i.ProjectID,
+			&i.Timestamp,
+			&i.RequestsTotal,
+			&i.RequestsSuccess,
+			&i.RequestsErrors,
+			&i.RequestsAvgLatency,
+			&i.RequestsP95Latency,
+			&i.RequestsP99Latency,
+			&i.RequestsThroughput,
+			&i.ErrorsTotal,
+			&i.ErrorsRate,
+			&i.PerformanceResponseTime,
+			&i.PerformanceThroughput,
+			&i.PerformanceConcurrency,
+			&i.PerformanceSaturation,
+			&i.PerformanceUtilization,
+			&i.ResourceCpuUsage,
+			&i.ResourceMemoryUsage,
+			&i.ResourceStorageUsage,
+			&i.ResourceNetworkUsage,
+			&i.ResourceScore,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const upsertInstanceMetrics = `-- name: UpsertInstanceMetrics :exec
+INSERT INTO instance_metrics (
+    service_id, timestamp, instance_id, node_id, status, cpu, memory,
+    network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+    network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+    start_time, last_seen, health_status, health_last_check, health_check_count, health_failure_count
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21
+)
+ON CONFLICT (service_id, timestamp, instance_id) DO UPDATE SET
+    node_id = EXCLUDED.node_id,
+    status = EXCLUDED.status,
+    cpu = EXCLUDED.cpu,
+    memory = EXCLUDED.memory,
+    network_bytes_in = EXCLUDED.network_bytes_in,
+    network_bytes_out = EXCLUDED.network_bytes_out,
+    network_packets_in = EXCLUDED.network_packets_in,
+    network_packets_out = EXCLUDED.network_packets_out,
+    network_connections_in = EXCLUDED.network_connections_in,
+    network_connections_out = EXCLUDED.network_connections_out,
+    network_errors_in = EXCLUDED.network_errors_in,
+    network_errors_out = EXCLUDED.network_errors_out,
+    start_time = EXCLUDED.start_time,
+    last_seen = EXCLUDED.last_seen,
+    health_status = EXCLUDED.health_status,
+    health_last_check = EXCLUDED.health_last_check,
+    health_check_count = EXCLUDED.health_check_count,
+    health_failure_count = EXCLUDED.health_failure_count
+`
+
+type UpsertInstanceMetricsParams struct {
+	ServiceID             string         `json:"service_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	InstanceID            string         `json:"instance_id"`
+	NodeID                sql.NullString `json:"node_id"`
+	Status                sql.NullString `json:"status"`
+	Cpu                   sql.NullString `json:"cpu"`
+	Memory                sql.NullInt64  `json:"memory"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	StartTime             sql.NullTime   `json:"start_time"`
+	LastSeen              sql.NullTime   `json:"last_seen"`
+	HealthStatus          sql.NullString `json:"health_status"`
+	HealthLastCheck       sql.NullTime   `json:"health_last_check"`
+	HealthCheckCount      sql.NullInt32  `json:"health_check_count"`
+	HealthFailureCount    sql.NullInt32  `json:"health_failure_count"`
+}
+
+func (q *Queries) UpsertInstanceMetrics(ctx context.Context, arg UpsertInstanceMetricsParams) error {
+	_, err := q.db.ExecContext(ctx, upsertInstanceMetrics,
+		arg.ServiceID,
+		arg.Timestamp,
+		arg.InstanceID,
+		arg.NodeID,
+		arg.Status,
+		arg.Cpu,
+		arg.Memory,
+		arg.NetworkBytesIn,
+		arg.NetworkBytesOut,
+		arg.NetworkPacketsIn,
+		arg.NetworkPacketsOut,
+		arg.NetworkConnectionsIn,
+		arg.NetworkConnectionsOut,
+		arg.NetworkErrorsIn,
+		arg.NetworkErrorsOut,
+		arg.StartTime,
+		arg.LastSeen,
+		arg.HealthStatus,
+		arg.HealthLastCheck,
+		arg.HealthCheckCount,
+		arg.HealthFailureCount,
+	)
+	return err
+}
+
+const upsertNodeMetrics = `-- name: UpsertNodeMetrics :exec
+INSERT INTO node_metrics (
+    node_id, timestamp, cpu_usage, cpu_cores, load_avg_1, load_avg_5, load_avg_15,
+    memory_total, memory_used, memory_available, memory_usage_percent,
+    storage_total, storage_used, storage_available, storage_usage_percent,
+    network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+    network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+    uptime, processes, os, kernel, architecture
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28
+)
+ON CONFLICT (node_id, timestamp) DO UPDATE SET
+    cpu_usage = EXCLUDED.cpu_usage,
+    cpu_cores = EXCLUDED.cpu_cores,
+    load_avg_1 = EXCLUDED.load_avg_1,
+    load_avg_5 = EXCLUDED.load_avg_5,
+    load_avg_15 = EXCLUDED.load_avg_15,
+    memory_total = EXCLUDED.memory_total,
+    memory_used = EXCLUDED.memory_used,
+    memory_available = EXCLUDED.memory_available,
+    memory_usage_percent = EXCLUDED.memory_usage_percent,
+    storage_total = EXCLUDED.storage_total,
+    storage_used = EXCLUDED.storage_used,
+    storage_available = EXCLUDED.storage_available,
+    storage_usage_percent = EXCLUDED.storage_usage_percent,
+    network_bytes_in = EXCLUDED.network_bytes_in,
+    network_bytes_out = EXCLUDED.network_bytes_out,
+    network_packets_in = EXCLUDED.network_packets_in,
+    network_packets_out = EXCLUDED.network_packets_out,
+    network_connections_in = EXCLUDED.network_connections_in,
+    network_connections_out = EXCLUDED.network_connections_out,
+    network_errors_in = EXCLUDED.network_errors_in,
+    network_errors_out = EXCLUDED.network_errors_out,
+    uptime = EXCLUDED.uptime,
+    processes = EXCLUDED.processes,
+    os = EXCLUDED.os,
+    kernel = EXCLUDED.kernel,
+    architecture = EXCLUDED.architecture
+`
+
+type UpsertNodeMetricsParams struct {
+	NodeID                string         `json:"node_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	CpuUsage              sql.NullString `json:"cpu_usage"`
+	CpuCores              sql.NullString `json:"cpu_cores"`
+	LoadAvg1              sql.NullString `json:"load_avg_1"`
+	LoadAvg5              sql.NullString `json:"load_avg_5"`
+	LoadAvg15             sql.NullString `json:"load_avg_15"`
+	MemoryTotal           sql.NullInt64  `json:"memory_total"`
+	MemoryUsed            sql.NullInt64  `json:"memory_used"`
+	MemoryAvailable       sql.NullInt64  `json:"memory_available"`
+	MemoryUsagePercent    sql.NullString `json:"memory_usage_percent"`
+	StorageTotal          sql.NullInt64  `json:"storage_total"`
+	StorageUsed           sql.NullInt64  `json:"storage_used"`
+	StorageAvailable      sql.NullInt64  `json:"storage_available"`
+	StorageUsagePercent   sql.NullString `json:"storage_usage_percent"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	Uptime                sql.NullInt64  `json:"uptime"`
+	Processes             sql.NullInt32  `json:"processes"`
+	Os                    sql.NullString `json:"os"`
+	Kernel                sql.NullString `json:"kernel"`
+	Architecture          sql.NullString `json:"architecture"`
+}
+
+func (q *Queries) UpsertNodeMetrics(ctx context.Context, arg UpsertNodeMetricsParams) error {
+	_, err := q.db.ExecContext(ctx, upsertNodeMetrics,
+		arg.NodeID,
+		arg.Timestamp,
+		arg.CpuUsage,
+		arg.CpuCores,
+		arg.LoadAvg1,
+		arg.LoadAvg5,
+		arg.LoadAvg15,
+		arg.MemoryTotal,
+		arg.MemoryUsed,
+		arg.MemoryAvailable,
+		arg.MemoryUsagePercent,
+		arg.StorageTotal,
+		arg.StorageUsed,
+		arg.StorageAvailable,
+		arg.StorageUsagePercent,
+		arg.NetworkBytesIn,
+		arg.NetworkBytesOut,
+		arg.NetworkPacketsIn,
+		arg.NetworkPacketsOut,
+		arg.NetworkConnectionsIn,
+		arg.NetworkConnectionsOut,
+		arg.NetworkErrorsIn,
+		arg.NetworkErrorsOut,
+		arg.Uptime,
+		arg.Processes,
+		arg.Os,
+		arg.Kernel,
+		arg.Architecture,
+	)
+	return err
+}
+
+const upsertServiceMetrics = `-- name: UpsertServiceMetrics :exec
+INSERT INTO service_metrics (
+    service_id, service_name, project_id, timestamp,
+    requests_total, requests_success, requests_errors, requests_avg_latency,
+    requests_p95_latency, requests_p99_latency, requests_throughput,
+    errors_total, errors_rate, performance_response_time, performance_throughput,
+    performance_concurrency, performance_saturation, performance_utilization,
+    resource_cpu_usage, resource_memory_usage, resource_storage_usage,
+    resource_network_usage, resource_score
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21, $22, $23
+)
+ON CONFLICT (service_id, timestamp) DO UPDATE SET
+    requests_total = EXCLUDED.requests_total,
+    requests_success = EXCLUDED.requests_success,
+    requests_errors = EXCLUDED.requests_errors,
+    requests_avg_latency = EXCLUDED.requests_avg_latency,
+    requests_p95_latency = EXCLUDED.requests_p95_latency,
+    requests_p99_latency = EXCLUDED.requests_p99_latency,
+    requests_throughput = EXCLUDED.requests_throughput,
+    errors_total = EXCLUDED.errors_total,
+    errors_rate = EXCLUDED.errors_rate,
+    performance_response_time = EXCLUDED.performance_response_time,
+    performance_throughput = EXCLUDED.performance_throughput,
+    performance_concurrency = EXCLUDED.performance_concurrency,
+    performance_saturation = EXCLUDED.performance_saturation,
+    performance_utilization = EXCLUDED.performance_utilization,
+    resource_cpu_usage = EXCLUDED.resource_cpu_usage,
+    resource_memory_usage = EXCLUDED.resource_memory_usage,
+    resource_storage_usage = EXCLUDED.resource_storage_usage,
+    resource_network_usage = EXCLUDED.resource_network_usage,
+    resource_score = EXCLUDED.resource_score
+`
+
+type UpsertServiceMetricsParams struct {
+	ServiceID               string         `json:"service_id"`
+	ServiceName             string         `json:"service_name"`
+	ProjectID               string         `json:"project_id"`
+	Timestamp               time.Time      `json:"timestamp"`
+	RequestsTotal           sql.NullInt64  `json:"requests_total"`
+	RequestsSuccess         sql.NullInt64  `json:"requests_success"`
+	RequestsErrors          sql.NullInt64  `json:"requests_errors"`
+	RequestsAvgLatency      sql.NullString `json:"requests_avg_latency"`
+	RequestsP95Latency      sql.NullString `json:"requests_p95_latency"`
+	RequestsP99Latency      sql.NullString `json:"requests_p99_latency"`
+	RequestsThroughput      sql.NullString `json:"requests_throughput"`
+	ErrorsTotal             sql.NullInt64  `json:"errors_total"`
+	ErrorsRate              sql.NullString `json:"errors_rate"`
+	PerformanceResponseTime sql.NullString `json:"performance_response_time"`
+	PerformanceThroughput   sql.NullString `json:"performance_throughput"`
+	PerformanceConcurrency  sql.NullInt64  `json:"performance_concurrency"`
+	PerformanceSaturation   sql.NullString `json:"performance_saturation"`
+	PerformanceUtilization  sql.NullString `json:"performance_utilization"`
+	ResourceCpuUsage        sql.NullString `json:"resource_cpu_usage"`
+	ResourceMemoryUsage     sql.NullInt64  `json:"resource_memory_usage"`
+	ResourceStorageUsage    sql.NullInt64  `json:"resource_storage_usage"`
+	ResourceNetworkUsage    sql.NullInt64  `json:"resource_network_usage"`
+	ResourceScore           sql.NullString `json:"resource_score"`
+}
+
+func (q *Queries) UpsertServiceMetrics(ctx context.Context, arg UpsertServiceMetricsParams) error {
+	_, err := q.db.ExecContext(ctx, upsertServiceMetrics,
+		arg.ServiceID,
+		arg.ServiceName,
+		arg.ProjectID,
+		arg.Timestamp,
+		arg.RequestsTotal,
+		arg.RequestsSuccess,
+		arg.RequestsErrors,
+		arg.RequestsAvgLatency,
+		arg.RequestsP95Latency,
+		arg.RequestsP99Latency,
+		arg.RequestsThroughput,
+		arg.ErrorsTotal,
+		arg.ErrorsRate,
+		arg.PerformanceResponseTime,
+		arg.PerformanceThroughput,
+		arg.PerformanceConcurrency,
+		arg.PerformanceSaturation,
+		arg.PerformanceUtilization,
+		arg.ResourceCpuUsage,
+		arg.ResourceMemoryUsage,
+		arg.ResourceStorageUsage,
+		arg.ResourceNetworkUsage,
+		arg.ResourceScore,
+	)
+	return err
+}

app/backend/internal/database/sqlcdb/models.go

@@ -138,9 +138,20 @@ type DatabaseService struct {
 type Deployment struct {
 	ID            uuid.UUID      `json:"id"`
 	ServiceID     uuid.UUID      `json:"service_id"`
+	Version       string         `json:"version"`
+	CommitHash    sql.NullString `json:"commit_hash"`
+	ImageDigest   sql.NullString `json:"image_digest"`
 	Status        sql.NullString `json:"status"`
+	BuildLog      sql.NullString `json:"build_log"`
+	DeploymentLog sql.NullString `json:"deployment_log"`
+	StartedAt     sql.NullTime   `json:"started_at"`
+	CompletedAt   sql.NullTime   `json:"completed_at"`
 	CreatedAt     sql.NullTime   `json:"created_at"`
 	UpdatedAt     sql.NullTime   `json:"updated_at"`
+	ImageName     sql.NullString `json:"image_name"`
+	ImageTag      sql.NullString `json:"image_tag"`
+	RuntimeLog    sql.NullString `json:"runtime_log"`
+	Error         sql.NullString `json:"error"`
 }
 
 type Environment struct {
@@ -161,6 +172,31 @@ type EnvironmentVariable struct {
 	UpdatedAt sql.NullTime `json:"updated_at"`
 }
 
+type InstanceMetric struct {
+	ServiceID             string         `json:"service_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	InstanceID            string         `json:"instance_id"`
+	NodeID                sql.NullString `json:"node_id"`
+	Status                sql.NullString `json:"status"`
+	Cpu                   sql.NullString `json:"cpu"`
+	Memory                sql.NullInt64  `json:"memory"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	StartTime             sql.NullTime   `json:"start_time"`
+	LastSeen              sql.NullTime   `json:"last_seen"`
+	HealthStatus          sql.NullString `json:"health_status"`
+	HealthLastCheck       sql.NullTime   `json:"health_last_check"`
+	HealthCheckCount      sql.NullInt32  `json:"health_check_count"`
+	HealthFailureCount    sql.NullInt32  `json:"health_failure_count"`
+	CreatedAt             sql.NullTime   `json:"created_at"`
+}
+
 type NodeAgent struct {
 	ID            string                `json:"id"`
 	Name          string                `json:"name"`
@@ -177,6 +213,40 @@ type NodeAgent struct {
 	Metadata      pqtype.NullRawMessage `json:"metadata"`
 	AutoPrune     bool                  `json:"auto_prune"`
 	Schedulable   bool                  `json:"schedulable"`
+	Tags          json.RawMessage       `json:"tags"`
+	DefaultDomain string                `json:"default_domain"`
+}
+
+type NodeMetric struct {
+	NodeID                string         `json:"node_id"`
+	Timestamp             time.Time      `json:"timestamp"`
+	CpuUsage              sql.NullString `json:"cpu_usage"`
+	CpuCores              sql.NullString `json:"cpu_cores"`
+	LoadAvg1              sql.NullString `json:"load_avg_1"`
+	LoadAvg5              sql.NullString `json:"load_avg_5"`
+	LoadAvg15             sql.NullString `json:"load_avg_15"`
+	MemoryTotal           sql.NullInt64  `json:"memory_total"`
+	MemoryUsed            sql.NullInt64  `json:"memory_used"`
+	MemoryAvailable       sql.NullInt64  `json:"memory_available"`
+	MemoryUsagePercent    sql.NullString `json:"memory_usage_percent"`
+	StorageTotal          sql.NullInt64  `json:"storage_total"`
+	StorageUsed           sql.NullInt64  `json:"storage_used"`
+	StorageAvailable      sql.NullInt64  `json:"storage_available"`
+	StorageUsagePercent   sql.NullString `json:"storage_usage_percent"`
+	NetworkBytesIn        sql.NullInt64  `json:"network_bytes_in"`
+	NetworkBytesOut       sql.NullInt64  `json:"network_bytes_out"`
+	NetworkPacketsIn      sql.NullInt64  `json:"network_packets_in"`
+	NetworkPacketsOut     sql.NullInt64  `json:"network_packets_out"`
+	NetworkConnectionsIn  sql.NullInt32  `json:"network_connections_in"`
+	NetworkConnectionsOut sql.NullInt32  `json:"network_connections_out"`
+	NetworkErrorsIn       sql.NullInt64  `json:"network_errors_in"`
+	NetworkErrorsOut      sql.NullInt64  `json:"network_errors_out"`
+	Uptime                sql.NullInt64  `json:"uptime"`
+	Processes             sql.NullInt32  `json:"processes"`
+	Os                    sql.NullString `json:"os"`
+	Kernel                sql.NullString `json:"kernel"`
+	Architecture          sql.NullString `json:"architecture"`
+	CreatedAt             sql.NullTime   `json:"created_at"`
 }
 
 type Notification struct {
@@ -191,6 +261,17 @@ type Notification struct {
 	CreatedAt    sql.NullTime   `json:"created_at"`
 }
 
+type NotificationChannel struct {
+	ID        uuid.UUID      `json:"id"`
+	UserID    uuid.UUID      `json:"user_id"`
+	Kind      string         `json:"kind"`
+	Endpoint  string         `json:"endpoint"`
+	Token     sql.NullString `json:"token"`
+	Enabled   bool           `json:"enabled"`
+	CreatedAt sql.NullTime   `json:"created_at"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+}
+
 type OutboundWebhook struct {
 	ID        uuid.UUID             `json:"id"`
 	UserID    uuid.UUID             `json:"user_id"`
@@ -204,6 +285,21 @@ type OutboundWebhook struct {
 	UpdatedAt sql.NullTime          `json:"updated_at"`
 }
 
+type PreviewEnvironment struct {
+	ID               uuid.UUID      `json:"id"`
+	ProjectID        uuid.UUID      `json:"project_id"`
+	ServiceID        uuid.UUID      `json:"service_id"`
+	BranchName       string         `json:"branch_name"`
+	PrNumber         sql.NullInt32  `json:"pr_number"`
+	Environment      string         `json:"environment"`
+	Status           string         `json:"status"`
+	Url              sql.NullString `json:"url"`
+	ExpiresAt        time.Time      `json:"expires_at"`
+	CreatedAt        sql.NullTime   `json:"created_at"`
+	UpdatedAt        sql.NullTime   `json:"updated_at"`
+	PreviewServiceID uuid.NullUUID  `json:"preview_service_id"`
+}
+
 type Project struct {
 	ID          uuid.UUID      `json:"id"`
 	Name        string         `json:"name"`
@@ -277,6 +373,8 @@ type Service struct {
 	StaticDir       string          `json:"static_dir"`
 	NodeID          sql.NullString  `json:"node_id"`
 	Spread          bool            `json:"spread"`
+	PlacementTags   json.RawMessage `json:"placement_tags"`
+	TraefikLabels   json.RawMessage `json:"traefik_labels"`
 }
 
 type ServiceDomain struct {
@@ -290,6 +388,33 @@ type ServiceDomain struct {
 	CreatedAt     time.Time    `json:"created_at"`
 }
 
+type ServiceMetric struct {
+	ServiceID               string         `json:"service_id"`
+	ServiceName             string         `json:"service_name"`
+	ProjectID               string         `json:"project_id"`
+	Timestamp               time.Time      `json:"timestamp"`
+	RequestsTotal           sql.NullInt64  `json:"requests_total"`
+	RequestsSuccess         sql.NullInt64  `json:"requests_success"`
+	RequestsErrors          sql.NullInt64  `json:"requests_errors"`
+	RequestsAvgLatency      sql.NullString `json:"requests_avg_latency"`
+	RequestsP95Latency      sql.NullString `json:"requests_p95_latency"`
+	RequestsP99Latency      sql.NullString `json:"requests_p99_latency"`
+	RequestsThroughput      sql.NullString `json:"requests_throughput"`
+	ErrorsTotal             sql.NullInt64  `json:"errors_total"`
+	ErrorsRate              sql.NullString `json:"errors_rate"`
+	PerformanceResponseTime sql.NullString `json:"performance_response_time"`
+	PerformanceThroughput   sql.NullString `json:"performance_throughput"`
+	PerformanceConcurrency  sql.NullInt64  `json:"performance_concurrency"`
+	PerformanceSaturation   sql.NullString `json:"performance_saturation"`
+	PerformanceUtilization  sql.NullString `json:"performance_utilization"`
+	ResourceCpuUsage        sql.NullString `json:"resource_cpu_usage"`
+	ResourceMemoryUsage     sql.NullInt64  `json:"resource_memory_usage"`
+	ResourceStorageUsage    sql.NullInt64  `json:"resource_storage_usage"`
+	ResourceNetworkUsage    sql.NullInt64  `json:"resource_network_usage"`
+	ResourceScore           sql.NullString `json:"resource_score"`
+	CreatedAt               sql.NullTime   `json:"created_at"`
+}
+
 type ServiceTemplate struct {
 	ID          string                `json:"id"`
 	Name        string                `json:"name"`

app/backend/internal/database/sqlcdb/notifications.sql.go

@@ -53,6 +53,135 @@ func (q *Queries) CreateNotification(ctx context.Context, arg CreateNotification
 	return err
 }
 
+const deleteNotificationChannel = `-- name: DeleteNotificationChannel :execrows
+DELETE FROM notification_channels WHERE id = $1 AND user_id = $2
+`
+
+type DeleteNotificationChannelParams struct {
+	ID     uuid.UUID `json:"id"`
+	UserID uuid.UUID `json:"user_id"`
+}
+
+func (q *Queries) DeleteNotificationChannel(ctx context.Context, arg DeleteNotificationChannelParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, deleteNotificationChannel, arg.ID, arg.UserID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const insertNotificationChannel = `-- name: InsertNotificationChannel :one
+INSERT INTO notification_channels (user_id, kind, endpoint, token)
+VALUES ($1, $2, $3, $4)
+RETURNING id, user_id, kind, endpoint, token, enabled, created_at, updated_at
+`
+
+type InsertNotificationChannelParams struct {
+	UserID   uuid.UUID      `json:"user_id"`
+	Kind     string         `json:"kind"`
+	Endpoint string         `json:"endpoint"`
+	Token    sql.NullString `json:"token"`
+}
+
+func (q *Queries) InsertNotificationChannel(ctx context.Context, arg InsertNotificationChannelParams) (NotificationChannel, error) {
+	row := q.db.QueryRowContext(ctx, insertNotificationChannel,
+		arg.UserID,
+		arg.Kind,
+		arg.Endpoint,
+		arg.Token,
+	)
+	var i NotificationChannel
+	err := row.Scan(
+		&i.ID,
+		&i.UserID,
+		&i.Kind,
+		&i.Endpoint,
+		&i.Token,
+		&i.Enabled,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const listAllNotificationChannelsByUser = `-- name: ListAllNotificationChannelsByUser :many
+SELECT id, user_id, kind, endpoint, token, enabled, created_at, updated_at
+FROM notification_channels
+WHERE user_id = $1
+ORDER BY created_at
+`
+
+func (q *Queries) ListAllNotificationChannelsByUser(ctx context.Context, userID uuid.UUID) ([]NotificationChannel, error) {
+	rows, err := q.db.QueryContext(ctx, listAllNotificationChannelsByUser, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []NotificationChannel{}
+	for rows.Next() {
+		var i NotificationChannel
+		if err := rows.Scan(
+			&i.ID,
+			&i.UserID,
+			&i.Kind,
+			&i.Endpoint,
+			&i.Token,
+			&i.Enabled,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listNotificationChannelsByUser = `-- name: ListNotificationChannelsByUser :many
+SELECT id, user_id, kind, endpoint, token, enabled, created_at, updated_at
+FROM notification_channels
+WHERE user_id = $1 AND enabled
+ORDER BY created_at
+`
+
+func (q *Queries) ListNotificationChannelsByUser(ctx context.Context, userID uuid.UUID) ([]NotificationChannel, error) {
+	rows, err := q.db.QueryContext(ctx, listNotificationChannelsByUser, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []NotificationChannel{}
+	for rows.Next() {
+		var i NotificationChannel
+		if err := rows.Scan(
+			&i.ID,
+			&i.UserID,
+			&i.Kind,
+			&i.Endpoint,
+			&i.Token,
+			&i.Enabled,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listNotificationsByUser = `-- name: ListNotificationsByUser :many
 SELECT id, user_id, kind, title, body, resource_type, resource_id, read_at, created_at
 FROM notifications

app/backend/internal/database/sqlcdb/preview_environments.sql.go

@@ -0,0 +1,635 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: preview_environments.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+const countActivePreviewsForBranch = `-- name: CountActivePreviewsForBranch :one
+SELECT COUNT(*) FROM preview_environments
+WHERE service_id = $1 AND branch_name = $2 AND status NOT IN ('expired', 'stopped')
+`
+
+type CountActivePreviewsForBranchParams struct {
+	ServiceID  uuid.UUID `json:"service_id"`
+	BranchName string    `json:"branch_name"`
+}
+
+func (q *Queries) CountActivePreviewsForBranch(ctx context.Context, arg CountActivePreviewsForBranchParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countActivePreviewsForBranch, arg.ServiceID, arg.BranchName)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createPreviewDomain = `-- name: CreatePreviewDomain :exec
+INSERT INTO service_domains (service_id, domain, is_default, cert_type) VALUES ($1, $2, true, 'tls')
+`
+
+type CreatePreviewDomainParams struct {
+	ServiceID uuid.UUID `json:"service_id"`
+	Domain    string    `json:"domain"`
+}
+
+func (q *Queries) CreatePreviewDomain(ctx context.Context, arg CreatePreviewDomainParams) error {
+	_, err := q.db.ExecContext(ctx, createPreviewDomain, arg.ServiceID, arg.Domain)
+	return err
+}
+
+const createPreviewEnvironment = `-- name: CreatePreviewEnvironment :exec
+INSERT INTO preview_environments
+    (id, project_id, service_id, preview_service_id, branch_name, pr_number, environment,
+     status, url, expires_at, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+`
+
+type CreatePreviewEnvironmentParams struct {
+	ID               uuid.UUID      `json:"id"`
+	ProjectID        uuid.UUID      `json:"project_id"`
+	ServiceID        uuid.UUID      `json:"service_id"`
+	PreviewServiceID uuid.NullUUID  `json:"preview_service_id"`
+	BranchName       string         `json:"branch_name"`
+	PrNumber         sql.NullInt32  `json:"pr_number"`
+	Environment      string         `json:"environment"`
+	Status           string         `json:"status"`
+	Url              sql.NullString `json:"url"`
+	ExpiresAt        time.Time      `json:"expires_at"`
+	CreatedAt        sql.NullTime   `json:"created_at"`
+	UpdatedAt        sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) CreatePreviewEnvironment(ctx context.Context, arg CreatePreviewEnvironmentParams) error {
+	_, err := q.db.ExecContext(ctx, createPreviewEnvironment,
+		arg.ID,
+		arg.ProjectID,
+		arg.ServiceID,
+		arg.PreviewServiceID,
+		arg.BranchName,
+		arg.PrNumber,
+		arg.Environment,
+		arg.Status,
+		arg.Url,
+		arg.ExpiresAt,
+		arg.CreatedAt,
+		arg.UpdatedAt,
+	)
+	return err
+}
+
+const deleteAllServiceDomains = `-- name: DeleteAllServiceDomains :exec
+DELETE FROM service_domains WHERE service_id = $1
+`
+
+func (q *Queries) DeleteAllServiceDomains(ctx context.Context, serviceID uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deleteAllServiceDomains, serviceID)
+	return err
+}
+
+const deletePreviewEnvironment = `-- name: DeletePreviewEnvironment :exec
+DELETE FROM preview_environments WHERE id = $1
+`
+
+func (q *Queries) DeletePreviewEnvironment(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deletePreviewEnvironment, id)
+	return err
+}
+
+const getPreviewEnvironment = `-- name: GetPreviewEnvironment :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
+       s.id AS svc_id, s.name AS service_name, s.type AS service_type
+FROM preview_environments pe
+LEFT JOIN services s ON pe.service_id = s.id
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.is_approved OR p.owner_id = $2 OR $3::bool
+    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $2))
+`
+
+type GetPreviewEnvironmentParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+type GetPreviewEnvironmentRow struct {
+	ID               uuid.UUID      `json:"id"`
+	ProjectID        uuid.UUID      `json:"project_id"`
+	ServiceID        uuid.UUID      `json:"service_id"`
+	PreviewServiceID uuid.NullUUID  `json:"preview_service_id"`
+	BranchName       string         `json:"branch_name"`
+	PrNumber         sql.NullInt32  `json:"pr_number"`
+	Environment      string         `json:"environment"`
+	Status           string         `json:"status"`
+	Url              sql.NullString `json:"url"`
+	ExpiresAt        time.Time      `json:"expires_at"`
+	CreatedAt        sql.NullTime   `json:"created_at"`
+	UpdatedAt        sql.NullTime   `json:"updated_at"`
+	SvcID            uuid.NullUUID  `json:"svc_id"`
+	ServiceName      sql.NullString `json:"service_name"`
+	ServiceType      sql.NullString `json:"service_type"`
+}
+
+func (q *Queries) GetPreviewEnvironment(ctx context.Context, arg GetPreviewEnvironmentParams) (GetPreviewEnvironmentRow, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewEnvironment, arg.ID, arg.OwnerID, arg.Column3)
+	var i GetPreviewEnvironmentRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.ServiceID,
+		&i.PreviewServiceID,
+		&i.BranchName,
+		&i.PrNumber,
+		&i.Environment,
+		&i.Status,
+		&i.Url,
+		&i.ExpiresAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.SvcID,
+		&i.ServiceName,
+		&i.ServiceType,
+	)
+	return i, err
+}
+
+const getPreviewEnvironmentForPromote = `-- name: GetPreviewEnvironmentForPromote :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.environment, pe.status
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)
+`
+
+type GetPreviewEnvironmentForPromoteParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+type GetPreviewEnvironmentForPromoteRow struct {
+	ID               uuid.UUID     `json:"id"`
+	ProjectID        uuid.UUID     `json:"project_id"`
+	ServiceID        uuid.UUID     `json:"service_id"`
+	PreviewServiceID uuid.NullUUID `json:"preview_service_id"`
+	BranchName       string        `json:"branch_name"`
+	Environment      string        `json:"environment"`
+	Status           string        `json:"status"`
+}
+
+func (q *Queries) GetPreviewEnvironmentForPromote(ctx context.Context, arg GetPreviewEnvironmentForPromoteParams) (GetPreviewEnvironmentForPromoteRow, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewEnvironmentForPromote, arg.ID, arg.OwnerID, arg.Column3)
+	var i GetPreviewEnvironmentForPromoteRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.ServiceID,
+		&i.PreviewServiceID,
+		&i.BranchName,
+		&i.Environment,
+		&i.Status,
+	)
+	return i, err
+}
+
+const getPreviewEnvironmentForWrite = `-- name: GetPreviewEnvironmentForWrite :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool)
+`
+
+type GetPreviewEnvironmentForWriteParams struct {
+	ID      uuid.UUID `json:"id"`
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column3 bool      `json:"column_3"`
+}
+
+type GetPreviewEnvironmentForWriteRow struct {
+	ID          uuid.UUID      `json:"id"`
+	ProjectID   uuid.UUID      `json:"project_id"`
+	ServiceID   uuid.UUID      `json:"service_id"`
+	BranchName  string         `json:"branch_name"`
+	PrNumber    sql.NullInt32  `json:"pr_number"`
+	Environment string         `json:"environment"`
+	Status      string         `json:"status"`
+	Url         sql.NullString `json:"url"`
+	ExpiresAt   time.Time      `json:"expires_at"`
+	CreatedAt   sql.NullTime   `json:"created_at"`
+	UpdatedAt   sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) GetPreviewEnvironmentForWrite(ctx context.Context, arg GetPreviewEnvironmentForWriteParams) (GetPreviewEnvironmentForWriteRow, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewEnvironmentForWrite, arg.ID, arg.OwnerID, arg.Column3)
+	var i GetPreviewEnvironmentForWriteRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.ServiceID,
+		&i.BranchName,
+		&i.PrNumber,
+		&i.Environment,
+		&i.Status,
+		&i.Url,
+		&i.ExpiresAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getPreviewEnvironmentOwner = `-- name: GetPreviewEnvironmentOwner :one
+SELECT p.owner_id
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1
+`
+
+func (q *Queries) GetPreviewEnvironmentOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewEnvironmentOwner, id)
+	var owner_id uuid.UUID
+	err := row.Scan(&owner_id)
+	return owner_id, err
+}
+
+const getPreviewServiceID = `-- name: GetPreviewServiceID :one
+SELECT preview_service_id FROM preview_environments WHERE id = $1
+`
+
+func (q *Queries) GetPreviewServiceID(ctx context.Context, id uuid.UUID) (uuid.NullUUID, error) {
+	row := q.db.QueryRowContext(ctx, getPreviewServiceID, id)
+	var preview_service_id uuid.NullUUID
+	err := row.Scan(&preview_service_id)
+	return preview_service_id, err
+}
+
+const getProjectBrief = `-- name: GetProjectBrief :one
+SELECT id, name, owner_id FROM projects WHERE id = $1
+`
+
+type GetProjectBriefRow struct {
+	ID      uuid.UUID `json:"id"`
+	Name    string    `json:"name"`
+	OwnerID uuid.UUID `json:"owner_id"`
+}
+
+func (q *Queries) GetProjectBrief(ctx context.Context, id uuid.UUID) (GetProjectBriefRow, error) {
+	row := q.db.QueryRowContext(ctx, getProjectBrief, id)
+	var i GetProjectBriefRow
+	err := row.Scan(&i.ID, &i.Name, &i.OwnerID)
+	return i, err
+}
+
+const getServiceForDeploy = `-- name: GetServiceForDeploy :one
+SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
+       s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at
+FROM services s
+WHERE s.id = $1
+`
+
+type GetServiceForDeployRow struct {
+	ID              uuid.UUID      `json:"id"`
+	ProjectID       uuid.UUID      `json:"project_id"`
+	Name            string         `json:"name"`
+	Type            sql.NullString `json:"type"`
+	Status          sql.NullString `json:"status"`
+	Image           sql.NullString `json:"image"`
+	Command         sql.NullString `json:"command"`
+	Environment     sql.NullString `json:"environment"`
+	GitRepo         sql.NullString `json:"git_repo"`
+	GitBranch       sql.NullString `json:"git_branch"`
+	BuildPath       sql.NullString `json:"build_path"`
+	Cpu             sql.NullString `json:"cpu"`
+	Memory          sql.NullString `json:"memory"`
+	Replicas        int32          `json:"replicas"`
+	Port            int32          `json:"port"`
+	Domain          string         `json:"domain"`
+	HealthcheckPath string         `json:"healthcheck_path"`
+	RestartPolicy   string         `json:"restart_policy"`
+	Builder         string         `json:"builder"`
+	CpuReserve      string         `json:"cpu_reserve"`
+	MemoryReserve   string         `json:"memory_reserve"`
+	StaticBuildCmd  string         `json:"static_build_cmd"`
+	StaticDir       string         `json:"static_dir"`
+	CreatedAt       sql.NullTime   `json:"created_at"`
+	UpdatedAt       sql.NullTime   `json:"updated_at"`
+}
+
+func (q *Queries) GetServiceForDeploy(ctx context.Context, id uuid.UUID) (GetServiceForDeployRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceForDeploy, id)
+	var i GetServiceForDeployRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Type,
+		&i.Status,
+		&i.Image,
+		&i.Command,
+		&i.Environment,
+		&i.GitRepo,
+		&i.GitBranch,
+		&i.BuildPath,
+		&i.Cpu,
+		&i.Memory,
+		&i.Replicas,
+		&i.Port,
+		&i.Domain,
+		&i.HealthcheckPath,
+		&i.RestartPolicy,
+		&i.Builder,
+		&i.CpuReserve,
+		&i.MemoryReserve,
+		&i.StaticBuildCmd,
+		&i.StaticDir,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getServiceTypeBrief = `-- name: GetServiceTypeBrief :one
+SELECT id, name, COALESCE(type, service_type, '') AS service_type FROM services WHERE id = $1 AND project_id = $2
+`
+
+type GetServiceTypeBriefParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+type GetServiceTypeBriefRow struct {
+	ID          uuid.UUID `json:"id"`
+	Name        string    `json:"name"`
+	ServiceType string    `json:"service_type"`
+}
+
+func (q *Queries) GetServiceTypeBrief(ctx context.Context, arg GetServiceTypeBriefParams) (GetServiceTypeBriefRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceTypeBrief, arg.ID, arg.ProjectID)
+	var i GetServiceTypeBriefRow
+	err := row.Scan(&i.ID, &i.Name, &i.ServiceType)
+	return i, err
+}
+
+const insertPendingDeployment = `-- name: InsertPendingDeployment :exec
+INSERT INTO deployments (id, service_id, version, commit_hash, status, created_at, updated_at)
+VALUES ($1, $2, $3, $4, 'pending', NOW(), NOW())
+`
+
+type InsertPendingDeploymentParams struct {
+	ID         uuid.UUID      `json:"id"`
+	ServiceID  uuid.UUID      `json:"service_id"`
+	Version    string         `json:"version"`
+	CommitHash sql.NullString `json:"commit_hash"`
+}
+
+func (q *Queries) InsertPendingDeployment(ctx context.Context, arg InsertPendingDeploymentParams) error {
+	_, err := q.db.ExecContext(ctx, insertPendingDeployment,
+		arg.ID,
+		arg.ServiceID,
+		arg.Version,
+		arg.CommitHash,
+	)
+	return err
+}
+
+const listExpiredPreviewsForUser = `-- name: ListExpiredPreviewsForUser :many
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.environment
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE (p.owner_id = $1 OR $2::bool) AND pe.expires_at < NOW() AND pe.status != 'expired'
+`
+
+type ListExpiredPreviewsForUserParams struct {
+	OwnerID uuid.UUID `json:"owner_id"`
+	Column2 bool      `json:"column_2"`
+}
+
+type ListExpiredPreviewsForUserRow struct {
+	ID               uuid.UUID     `json:"id"`
+	ProjectID        uuid.UUID     `json:"project_id"`
+	ServiceID        uuid.UUID     `json:"service_id"`
+	PreviewServiceID uuid.NullUUID `json:"preview_service_id"`
+	BranchName       string        `json:"branch_name"`
+	Environment      string        `json:"environment"`
+}
+
+func (q *Queries) ListExpiredPreviewsForUser(ctx context.Context, arg ListExpiredPreviewsForUserParams) ([]ListExpiredPreviewsForUserRow, error) {
+	rows, err := q.db.QueryContext(ctx, listExpiredPreviewsForUser, arg.OwnerID, arg.Column2)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListExpiredPreviewsForUserRow{}
+	for rows.Next() {
+		var i ListExpiredPreviewsForUserRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.ServiceID,
+			&i.PreviewServiceID,
+			&i.BranchName,
+			&i.Environment,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listPreviewEnvironmentsForProject = `-- name: ListPreviewEnvironmentsForProject :many
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
+       s.id AS svc_id, s.name AS service_name, s.type AS service_type
+FROM preview_environments pe
+LEFT JOIN services s ON pe.service_id = s.id
+WHERE pe.project_id = $1
+ORDER BY pe.created_at DESC
+`
+
+type ListPreviewEnvironmentsForProjectRow struct {
+	ID               uuid.UUID      `json:"id"`
+	ProjectID        uuid.UUID      `json:"project_id"`
+	ServiceID        uuid.UUID      `json:"service_id"`
+	PreviewServiceID uuid.NullUUID  `json:"preview_service_id"`
+	BranchName       string         `json:"branch_name"`
+	PrNumber         sql.NullInt32  `json:"pr_number"`
+	Environment      string         `json:"environment"`
+	Status           string         `json:"status"`
+	Url              sql.NullString `json:"url"`
+	ExpiresAt        time.Time      `json:"expires_at"`
+	CreatedAt        sql.NullTime   `json:"created_at"`
+	UpdatedAt        sql.NullTime   `json:"updated_at"`
+	SvcID            uuid.NullUUID  `json:"svc_id"`
+	ServiceName      sql.NullString `json:"service_name"`
+	ServiceType      sql.NullString `json:"service_type"`
+}
+
+func (q *Queries) ListPreviewEnvironmentsForProject(ctx context.Context, projectID uuid.UUID) ([]ListPreviewEnvironmentsForProjectRow, error) {
+	rows, err := q.db.QueryContext(ctx, listPreviewEnvironmentsForProject, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListPreviewEnvironmentsForProjectRow{}
+	for rows.Next() {
+		var i ListPreviewEnvironmentsForProjectRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.ProjectID,
+			&i.ServiceID,
+			&i.PreviewServiceID,
+			&i.BranchName,
+			&i.PrNumber,
+			&i.Environment,
+			&i.Status,
+			&i.Url,
+			&i.ExpiresAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.SvcID,
+			&i.ServiceName,
+			&i.ServiceType,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listSweepablePreviews = `-- name: ListSweepablePreviews :many
+SELECT id, preview_service_id FROM preview_environments
+WHERE expires_at < NOW() AND status NOT IN ('expired', 'stopped')
+`
+
+type ListSweepablePreviewsRow struct {
+	ID               uuid.UUID     `json:"id"`
+	PreviewServiceID uuid.NullUUID `json:"preview_service_id"`
+}
+
+func (q *Queries) ListSweepablePreviews(ctx context.Context) ([]ListSweepablePreviewsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listSweepablePreviews)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListSweepablePreviewsRow{}
+	for rows.Next() {
+		var i ListSweepablePreviewsRow
+		if err := rows.Scan(&i.ID, &i.PreviewServiceID); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const markPreviewEnvironmentStatus = `-- name: MarkPreviewEnvironmentStatus :exec
+UPDATE preview_environments SET status = $1, updated_at = NOW() WHERE id = $2
+`
+
+type MarkPreviewEnvironmentStatusParams struct {
+	Status string    `json:"status"`
+	ID     uuid.UUID `json:"id"`
+}
+
+func (q *Queries) MarkPreviewEnvironmentStatus(ctx context.Context, arg MarkPreviewEnvironmentStatusParams) error {
+	_, err := q.db.ExecContext(ctx, markPreviewEnvironmentStatus, arg.Status, arg.ID)
+	return err
+}
+
+const syncPreviewStatuses = `-- name: SyncPreviewStatuses :exec
+UPDATE preview_environments pe
+SET status = derived.st, updated_at = NOW()
+FROM (
+    SELECT pe2.id,
+        CASE
+            WHEN s.status IN ('running', 'deployed') THEN 'running'
+            WHEN s.status IN ('failed', 'error') THEN 'failed'
+            WHEN s.status IN ('building', 'deploying', 'queued', 'pending', 'cloning') THEN 'building'
+            ELSE pe2.status
+        END AS st
+    FROM preview_environments pe2
+    JOIN services s ON pe2.preview_service_id = s.id
+) derived
+WHERE pe.id = derived.id
+  AND pe.status IN ('building', 'running', 'failed')
+  AND pe.status <> derived.st
+`
+
+func (q *Queries) SyncPreviewStatuses(ctx context.Context) error {
+	_, err := q.db.ExecContext(ctx, syncPreviewStatuses)
+	return err
+}
+
+const updatePreviewEnvironment = `-- name: UpdatePreviewEnvironment :exec
+UPDATE preview_environments
+SET status = $1, url = $2, expires_at = $3, updated_at = $4
+WHERE id = $5
+`
+
+type UpdatePreviewEnvironmentParams struct {
+	Status    string         `json:"status"`
+	Url       sql.NullString `json:"url"`
+	ExpiresAt time.Time      `json:"expires_at"`
+	UpdatedAt sql.NullTime   `json:"updated_at"`
+	ID        uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) UpdatePreviewEnvironment(ctx context.Context, arg UpdatePreviewEnvironmentParams) error {
+	_, err := q.db.ExecContext(ctx, updatePreviewEnvironment,
+		arg.Status,
+		arg.Url,
+		arg.ExpiresAt,
+		arg.UpdatedAt,
+		arg.ID,
+	)
+	return err
+}
+
+const updateServicePreviewBranch = `-- name: UpdateServicePreviewBranch :exec
+UPDATE services SET git_branch = $1, domain = '', updated_at = NOW() WHERE id = $2
+`
+
+type UpdateServicePreviewBranchParams struct {
+	GitBranch sql.NullString `json:"git_branch"`
+	ID        uuid.UUID      `json:"id"`
+}
+
+func (q *Queries) UpdateServicePreviewBranch(ctx context.Context, arg UpdateServicePreviewBranchParams) error {
+	_, err := q.db.ExecContext(ctx, updateServicePreviewBranch, arg.GitBranch, arg.ID)
+	return err
+}

app/backend/internal/database/sqlcdb/projects.sql.go

@@ -12,6 +12,17 @@ import (
 	"github.com/google/uuid"
 )
 
+const countEnvironmentServices = `-- name: CountEnvironmentServices :one
+SELECT COUNT(*) FROM services WHERE environment_id = $1
+`
+
+func (q *Queries) CountEnvironmentServices(ctx context.Context, environmentID uuid.UUID) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countEnvironmentServices, environmentID)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
 const countProjectsByUser = `-- name: CountProjectsByUser :one
 SELECT COUNT(*)::bigint AS total
 FROM projects p
@@ -86,6 +97,20 @@ func (q *Queries) DeleteProjectByID(ctx context.Context, projectID uuid.UUID) (i
 	return result.RowsAffected()
 }
 
+const deleteProjectEnvironment = `-- name: DeleteProjectEnvironment :exec
+DELETE FROM environments WHERE id = $1 AND project_id = $2
+`
+
+type DeleteProjectEnvironmentParams struct {
+	ID        uuid.UUID `json:"id"`
+	ProjectID uuid.UUID `json:"project_id"`
+}
+
+func (q *Queries) DeleteProjectEnvironment(ctx context.Context, arg DeleteProjectEnvironmentParams) error {
+	_, err := q.db.ExecContext(ctx, deleteProjectEnvironment, arg.ID, arg.ProjectID)
+	return err
+}
+
 const getProjectByIDForUser = `-- name: GetProjectByIDForUser :one
 SELECT p.id, p.name, p.description, p.owner_id, p.is_approved, p.created_at, p.updated_at
 FROM projects p
@@ -123,6 +148,30 @@ func (q *Queries) GetProjectByIDForUser(ctx context.Context, arg GetProjectByIDF
 	return i, err
 }
 
+const getProjectEnvironmentByName = `-- name: GetProjectEnvironmentByName :one
+SELECT id, name, project_id, created_at, updated_at
+FROM environments
+WHERE project_id = $1 AND name = $2
+`
+
+type GetProjectEnvironmentByNameParams struct {
+	ProjectID uuid.UUID `json:"project_id"`
+	Name      string    `json:"name"`
+}
+
+func (q *Queries) GetProjectEnvironmentByName(ctx context.Context, arg GetProjectEnvironmentByNameParams) (Environment, error) {
+	row := q.db.QueryRowContext(ctx, getProjectEnvironmentByName, arg.ProjectID, arg.Name)
+	var i Environment
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.ProjectID,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
 const getProjectOwnerByID = `-- name: GetProjectOwnerByID :one
 SELECT owner_id
 FROM projects
@@ -212,6 +261,53 @@ func (q *Queries) ListPendingProjects(ctx context.Context) ([]Project, error) {
 	return items, nil
 }
 
+const listProjectEnvironments = `-- name: ListProjectEnvironments :many
+SELECT e.id, e.name, e.project_id, e.created_at, e.updated_at,
+       (SELECT COUNT(*) FROM services s WHERE s.environment_id = e.id) AS service_count
+FROM environments e
+WHERE e.project_id = $1
+ORDER BY e.created_at
+`
+
+type ListProjectEnvironmentsRow struct {
+	ID           uuid.UUID    `json:"id"`
+	Name         string       `json:"name"`
+	ProjectID    uuid.UUID    `json:"project_id"`
+	CreatedAt    sql.NullTime `json:"created_at"`
+	UpdatedAt    sql.NullTime `json:"updated_at"`
+	ServiceCount int64        `json:"service_count"`
+}
+
+func (q *Queries) ListProjectEnvironments(ctx context.Context, projectID uuid.UUID) ([]ListProjectEnvironmentsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listProjectEnvironments, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListProjectEnvironmentsRow{}
+	for rows.Next() {
+		var i ListProjectEnvironmentsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.ProjectID,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.ServiceCount,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listProjectsWithStatsByUser = `-- name: ListProjectsWithStatsByUser :many
 
 SELECT

app/backend/internal/database/sqlcdb/querier.go

@@ -7,16 +7,31 @@ package sqlcdb
 import (
 	"context"
 	"database/sql"
+	"encoding/json"
 
 	"github.com/google/uuid"
 )
 
 type Querier interface {
+	// Portable bucket bucketing (no TimescaleDB): floor epoch seconds into
+	// bucket-sized buckets, then back to timestamptz.
+	AggregateNodeMetrics(ctx context.Context, arg AggregateNodeMetricsParams) ([]AggregateNodeMetricsRow, error)
+	ClearServiceDomainDefault(ctx context.Context, serviceID uuid.UUID) error
 	ClearServiceNodePins(ctx context.Context, nodeID sql.NullString) (int64, error)
+	CloneServiceDomains(ctx context.Context, arg CloneServiceDomainsParams) error
+	CloneServiceRow(ctx context.Context, arg CloneServiceRowParams) error
+	CloneServiceVariables(ctx context.Context, arg CloneServiceVariablesParams) error
 	CompleteCommand(ctx context.Context, arg CompleteCommandParams) (AgentCommand, error)
+	CompleteDeployment(ctx context.Context, arg CompleteDeploymentParams) error
+	CountAccessibleDeployments(ctx context.Context, arg CountAccessibleDeploymentsParams) (int64, error)
+	CountActivePreviewsForBranch(ctx context.Context, arg CountActivePreviewsForBranchParams) (int64, error)
 	CountDatabaseServicesByUserAndName(ctx context.Context, arg CountDatabaseServicesByUserAndNameParams) (int64, error)
 	CountDatabasesUsingBackupTarget(ctx context.Context, targetID sql.NullString) (int64, error)
+	CountDeploymentsForService(ctx context.Context, serviceID uuid.UUID) (int64, error)
+	CountEnvironmentServices(ctx context.Context, environmentID uuid.UUID) (int64, error)
 	CountProjectsByUser(ctx context.Context, arg CountProjectsByUserParams) (int64, error)
+	CountServiceDomains(ctx context.Context, serviceID uuid.UUID) (int64, error)
+	CountServicesByName(ctx context.Context, arg CountServicesByNameParams) (int64, error)
 	CountServicesByProjectAndName(ctx context.Context, arg CountServicesByProjectAndNameParams) (int64, error)
 	CountUnreadNotificationsByUser(ctx context.Context, userID uuid.UUID) (int64, error)
 	CreateAgent(ctx context.Context, arg CreateAgentParams) (NodeAgent, error)
@@ -30,7 +45,10 @@ type Querier interface {
 	CreateExternalDatabaseService(ctx context.Context, arg CreateExternalDatabaseServiceParams) error
 	CreateNotification(ctx context.Context, arg CreateNotificationParams) error
 	CreateOutboundWebhook(ctx context.Context, arg CreateOutboundWebhookParams) error
+	CreatePreviewDomain(ctx context.Context, arg CreatePreviewDomainParams) error
+	CreatePreviewEnvironment(ctx context.Context, arg CreatePreviewEnvironmentParams) error
 	CreateProject(ctx context.Context, arg CreateProjectParams) (Project, error)
+	CreateServiceDomain(ctx context.Context, arg CreateServiceDomainParams) (CreateServiceDomainRow, error)
 	CreateServiceFromTemplate(ctx context.Context, arg CreateServiceFromTemplateParams) error
 	CreateUserInvite(ctx context.Context, arg CreateUserInviteParams) (UserInvite, error)
 	CreateUserTemplate(ctx context.Context, arg CreateUserTemplateParams) error
@@ -38,15 +56,22 @@ type Querier interface {
 	CreateWebhookDelivery(ctx context.Context, arg CreateWebhookDeliveryParams) error
 	DatabaseServiceExistsByIDAndUser(ctx context.Context, arg DatabaseServiceExistsByIDAndUserParams) (bool, error)
 	DeleteAgent(ctx context.Context, id string) error
+	DeleteAllServiceDomains(ctx context.Context, serviceID uuid.UUID) error
 	DeleteBackupTargetByIDAndUser(ctx context.Context, arg DeleteBackupTargetByIDAndUserParams) error
 	DeleteBanner(ctx context.Context, id uuid.UUID) error
 	DeleteDatabaseServiceByID(ctx context.Context, id string) error
 	DeleteDatabaseServiceByIDAndUser(ctx context.Context, arg DeleteDatabaseServiceByIDAndUserParams) error
+	DeleteNotificationChannel(ctx context.Context, arg DeleteNotificationChannelParams) (int64, error)
 	DeleteOutboundWebhookByIDAndUser(ctx context.Context, arg DeleteOutboundWebhookByIDAndUserParams) error
+	DeletePreviewEnvironment(ctx context.Context, id uuid.UUID) error
 	DeleteProjectByID(ctx context.Context, projectID uuid.UUID) (int64, error)
+	DeleteProjectEnvironment(ctx context.Context, arg DeleteProjectEnvironmentParams) error
+	DeleteServiceByID(ctx context.Context, id uuid.UUID) error
 	DeleteServiceContainersOnAgent(ctx context.Context, arg DeleteServiceContainersOnAgentParams) error
+	DeleteServiceDomain(ctx context.Context, arg DeleteServiceDomainParams) (int64, error)
 	DeleteUserInvite(ctx context.Context, id uuid.UUID) error
 	DeleteUserTemplate(ctx context.Context, arg DeleteUserTemplateParams) (int64, error)
+	FailDeployment(ctx context.Context, arg FailDeploymentParams) error
 	GetActiveAgentAuthTokenByHash(ctx context.Context, tokenHash string) (AgentAuthToken, error)
 	GetAgent(ctx context.Context, id string) (NodeAgent, error)
 	GetAgentByHostAndIP(ctx context.Context, arg GetAgentByHostAndIPParams) (NodeAgent, error)
@@ -60,23 +85,51 @@ type Querier interface {
 	GetDatabaseServiceByID(ctx context.Context, id string) (DatabaseService, error)
 	GetDatabaseServiceByIDAndUser(ctx context.Context, arg GetDatabaseServiceByIDAndUserParams) (DatabaseService, error)
 	GetDatabaseServiceOwnerID(ctx context.Context, id string) (string, error)
+	GetDeploymentAccess(ctx context.Context, id uuid.UUID) (GetDeploymentAccessRow, error)
+	GetDeploymentForRollback(ctx context.Context, id uuid.UUID) (GetDeploymentForRollbackRow, error)
+	GetDeploymentWithProject(ctx context.Context, id uuid.UUID) (GetDeploymentWithProjectRow, error)
 	GetLastAgentCommandByType(ctx context.Context, arg GetLastAgentCommandByTypeParams) (AgentCommand, error)
+	GetLastDeployedImage(ctx context.Context, serviceID uuid.UUID) (string, error)
 	GetOutboundWebhookByID(ctx context.Context, id uuid.UUID) (OutboundWebhook, error)
 	GetOutboundWebhookByIDAndUser(ctx context.Context, arg GetOutboundWebhookByIDAndUserParams) (OutboundWebhook, error)
+	GetPreviewEnvironment(ctx context.Context, arg GetPreviewEnvironmentParams) (GetPreviewEnvironmentRow, error)
+	GetPreviewEnvironmentForPromote(ctx context.Context, arg GetPreviewEnvironmentForPromoteParams) (GetPreviewEnvironmentForPromoteRow, error)
+	GetPreviewEnvironmentForWrite(ctx context.Context, arg GetPreviewEnvironmentForWriteParams) (GetPreviewEnvironmentForWriteRow, error)
+	GetPreviewEnvironmentOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
+	GetPreviewServiceID(ctx context.Context, id uuid.UUID) (uuid.NullUUID, error)
+	GetProjectBrief(ctx context.Context, id uuid.UUID) (GetProjectBriefRow, error)
 	GetProjectByIDForUser(ctx context.Context, arg GetProjectByIDForUserParams) (Project, error)
+	GetProjectEnvironmentByName(ctx context.Context, arg GetProjectEnvironmentByNameParams) (Environment, error)
+	GetProjectOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
 	GetProjectOwnerByID(ctx context.Context, projectID uuid.UUID) (uuid.UUID, error)
 	GetProjectOwnerID(ctx context.Context, id uuid.UUID) (uuid.UUID, error)
 	GetProjectRoleForUser(ctx context.Context, arg GetProjectRoleForUserParams) (string, error)
+	GetServiceAccess(ctx context.Context, id uuid.UUID) (GetServiceAccessRow, error)
+	GetServiceDomainDefault(ctx context.Context, serviceID uuid.UUID) (string, error)
+	GetServiceDomainFirst(ctx context.Context, serviceID uuid.UUID) (string, error)
+	GetServiceEnvironment(ctx context.Context, id uuid.UUID) (string, error)
+	GetServiceForDeploy(ctx context.Context, id uuid.UUID) (GetServiceForDeployRow, error)
+	GetServiceForDeployWithOwner(ctx context.Context, id uuid.UUID) (GetServiceForDeployWithOwnerRow, error)
+	GetServicePlacementBrief(ctx context.Context, id uuid.UUID) (GetServicePlacementBriefRow, error)
+	GetServicePort(ctx context.Context, id uuid.UUID) (int32, error)
+	GetServicePublishedPort(ctx context.Context, id uuid.UUID) (int32, error)
+	GetServiceRuntimeWithOwner(ctx context.Context, id uuid.UUID) (GetServiceRuntimeWithOwnerRow, error)
 	GetServiceTemplateByID(ctx context.Context, id string) (ServiceTemplate, error)
+	GetServiceTypeBrief(ctx context.Context, arg GetServiceTypeBriefParams) (GetServiceTypeBriefRow, error)
+	GetServiceVariableValue(ctx context.Context, arg GetServiceVariableValueParams) (string, error)
 	GetUserInviteByTokenHash(ctx context.Context, tokenHash string) (UserInvite, error)
 	GetUserTokenByHash(ctx context.Context, tokenHash string) (UserToken, error)
 	InsertAgentHeartbeat(ctx context.Context, arg InsertAgentHeartbeatParams) error
+	InsertDeployment(ctx context.Context, arg InsertDeploymentParams) error
+	InsertNotificationChannel(ctx context.Context, arg InsertNotificationChannelParams) (NotificationChannel, error)
+	InsertPendingDeployment(ctx context.Context, arg InsertPendingDeploymentParams) error
 	InsertProjectEnvironment(ctx context.Context, arg InsertProjectEnvironmentParams) error
 	ListActiveBanners(ctx context.Context) ([]Banner, error)
 	ListAgentAuthTokens(ctx context.Context) ([]AgentAuthToken, error)
 	ListAgentHeartbeatsSince(ctx context.Context, arg ListAgentHeartbeatsSinceParams) ([]AgentHeartbeat, error)
 	ListAgents(ctx context.Context) ([]NodeAgent, error)
 	ListAllDatabaseServices(ctx context.Context) ([]DatabaseService, error)
+	ListAllNotificationChannelsByUser(ctx context.Context, userID uuid.UUID) ([]NotificationChannel, error)
 	ListBackupTargetsByUser(ctx context.Context, userID string) ([]BackupTarget, error)
 	ListBanners(ctx context.Context) ([]Banner, error)
 	ListCommandsForAgent(ctx context.Context, nodeAgentID string) ([]AgentCommand, error)
@@ -84,33 +137,63 @@ type Querier interface {
 	ListDatabaseBackupsByDatabaseAndUser(ctx context.Context, arg ListDatabaseBackupsByDatabaseAndUserParams) ([]DatabaseBackup, error)
 	ListDatabaseServicesByProject(ctx context.Context, projectID uuid.NullUUID) ([]DatabaseService, error)
 	ListDatabaseServicesByUser(ctx context.Context, userID string) ([]DatabaseService, error)
+	ListDeploymentsForService(ctx context.Context, arg ListDeploymentsForServiceParams) ([]ListDeploymentsForServiceRow, error)
 	ListDueDatabaseBackups(ctx context.Context) ([]ListDueDatabaseBackupsRow, error)
 	ListEnabledOutboundWebhooks(ctx context.Context) ([]OutboundWebhook, error)
+	ListExpiredPreviewsForUser(ctx context.Context, arg ListExpiredPreviewsForUserParams) ([]ListExpiredPreviewsForUserRow, error)
+	ListInstanceMetrics(ctx context.Context, arg ListInstanceMetricsParams) ([]ListInstanceMetricsRow, error)
+	ListNodeAgentsForService(ctx context.Context, serviceID string) ([]string, error)
+	ListNodeMetrics(ctx context.Context, arg ListNodeMetricsParams) ([]ListNodeMetricsRow, error)
+	ListNotificationChannelsByUser(ctx context.Context, userID uuid.UUID) ([]NotificationChannel, error)
 	ListNotificationsByUser(ctx context.Context, arg ListNotificationsByUserParams) ([]Notification, error)
 	ListOutboundWebhooksByUser(ctx context.Context, userID uuid.UUID) ([]OutboundWebhook, error)
 	ListPendingCommands(ctx context.Context, nodeAgentID string) ([]AgentCommand, error)
 	ListPendingProjects(ctx context.Context) ([]Project, error)
+	ListPreviewEnvironmentsForProject(ctx context.Context, projectID uuid.UUID) ([]ListPreviewEnvironmentsForProjectRow, error)
+	ListProjectEnvironments(ctx context.Context, projectID uuid.UUID) ([]ListProjectEnvironmentsRow, error)
+	ListProjectServiceRefs(ctx context.Context, projectID uuid.UUID) ([]ListProjectServiceRefsRow, error)
 	// Visibility model: a project is readable when it is approved for public
 	// display, when the caller owns or is a member of it, or when the caller is a
 	// platform admin. Anonymous callers pass user_id = uuid.Nil, is_admin = false.
 	ListProjectsWithStatsByUser(ctx context.Context, arg ListProjectsWithStatsByUserParams) ([]ListProjectsWithStatsByUserRow, error)
+	ListRecentAccessibleDeployments(ctx context.Context, arg ListRecentAccessibleDeploymentsParams) ([]ListRecentAccessibleDeploymentsRow, error)
+	// Base domains of every online, schedulable agent carrying the required
+	// placement tags — auto-domain candidates for spread services.
+	ListSchedulableAgentDomains(ctx context.Context, dollar_1 json.RawMessage) ([]string, error)
 	ListSchedulableAgents(ctx context.Context) ([]ListSchedulableAgentsRow, error)
+	// Only agents carrying every required placement tag (jsonb array containment).
+	ListSchedulableAgentsMatching(ctx context.Context, dollar_1 json.RawMessage) ([]ListSchedulableAgentsMatchingRow, error)
+	// Distinct agents holding inventory rows for a service.
+	ListServiceAgents(ctx context.Context, serviceID string) ([]string, error)
 	ListServiceContainers(ctx context.Context, serviceID string) ([]ListServiceContainersRow, error)
+	ListServiceDomains(ctx context.Context, serviceID uuid.UUID) ([]ServiceDomain, error)
+	ListServiceMetrics(ctx context.Context, arg ListServiceMetricsParams) ([]ListServiceMetricsRow, error)
 	ListServiceTemplatesByCategoryForUser(ctx context.Context, arg ListServiceTemplatesByCategoryForUserParams) ([]ServiceTemplate, error)
 	ListServiceTemplatesForUser(ctx context.Context, ownerID uuid.NullUUID) ([]ServiceTemplate, error)
+	ListServiceVariableValues(ctx context.Context, serviceID uuid.UUID) ([]ListServiceVariableValuesRow, error)
+	ListServiceVariablesWithSecret(ctx context.Context, serviceID uuid.UUID) ([]ListServiceVariablesWithSecretRow, error)
+	ListSweepablePreviews(ctx context.Context) ([]ListSweepablePreviewsRow, error)
 	ListUserInvites(ctx context.Context) ([]UserInvite, error)
 	ListUserTokens(ctx context.Context, userID uuid.UUID) ([]UserToken, error)
 	ListWebhookDeliveriesByWebhook(ctx context.Context, webhookID uuid.UUID) ([]WebhookDelivery, error)
 	MarkAllNotificationsReadByUser(ctx context.Context, arg MarkAllNotificationsReadByUserParams) error
 	MarkNotificationReadByIDAndUser(ctx context.Context, arg MarkNotificationReadByIDAndUserParams) error
+	MarkPreviewEnvironmentStatus(ctx context.Context, arg MarkPreviewEnvironmentStatusParams) error
 	MarkUserInviteUsed(ctx context.Context, arg MarkUserInviteUsedParams) error
+	MoveServiceProject(ctx context.Context, arg MoveServiceProjectParams) (int64, error)
 	// Resource-aware: lowest memory utilisation first, then cpu, then container
 	// count. Agents without telemetry sort last (NULL → worst score).
 	PickLeastLoadedAgent(ctx context.Context) (string, error)
+	// Same resource-aware ordering as PickLeastLoadedAgent, restricted to agents
+	// carrying every required placement tag.
+	PickLeastLoadedAgentMatching(ctx context.Context, dollar_1 json.RawMessage) (string, error)
 	RevokeAgentAuthToken(ctx context.Context, id uuid.UUID) (AgentAuthToken, error)
 	RevokeUserToken(ctx context.Context, arg RevokeUserTokenParams) (int64, error)
 	ScrubCommandPayload(ctx context.Context, arg ScrubCommandPayloadParams) error
+	ServiceWriteAccess(ctx context.Context, arg ServiceWriteAccessParams) (bool, error)
+	SetAgentDefaultDomain(ctx context.Context, arg SetAgentDefaultDomainParams) error
 	SetAgentSchedulable(ctx context.Context, arg SetAgentSchedulableParams) error
+	SetAgentTags(ctx context.Context, arg SetAgentTagsParams) error
 	SetDatabaseBackupRemoteKeyByID(ctx context.Context, arg SetDatabaseBackupRemoteKeyByIDParams) error
 	SetDatabaseBackupScheduleByIDAndUser(ctx context.Context, arg SetDatabaseBackupScheduleByIDAndUserParams) error
 	SetDatabaseBackupStatusByID(ctx context.Context, arg SetDatabaseBackupStatusByIDParams) error
@@ -120,23 +203,44 @@ type Querier interface {
 	SetDatabaseServiceStatusAndConnectionByID(ctx context.Context, arg SetDatabaseServiceStatusAndConnectionByIDParams) error
 	SetDatabaseServiceStatusByID(ctx context.Context, arg SetDatabaseServiceStatusByIDParams) error
 	SetDatabaseServiceStatusByIDAndUser(ctx context.Context, arg SetDatabaseServiceStatusByIDAndUserParams) error
+	SetDeploymentStatus(ctx context.Context, arg SetDeploymentStatusParams) error
 	SetProjectApproved(ctx context.Context, arg SetProjectApprovedParams) (int64, error)
+	SetServiceDomainDefault(ctx context.Context, arg SetServiceDomainDefaultParams) (int64, error)
+	SetServiceLegacyDomain(ctx context.Context, arg SetServiceLegacyDomainParams) error
+	SetServicePublishedPort(ctx context.Context, arg SetServicePublishedPortParams) error
+	SetServiceReplicas(ctx context.Context, arg SetServiceReplicasParams) error
+	SetServiceStatus(ctx context.Context, arg SetServiceStatusParams) error
+	SyncDeploymentProgress(ctx context.Context, arg SyncDeploymentProgressParams) error
+	SyncPreviewStatuses(ctx context.Context) error
 	TouchAgentAuthToken(ctx context.Context, tokenHash string) error
+	TouchServiceDomainChecked(ctx context.Context, id uuid.UUID) error
 	TouchUserToken(ctx context.Context, id uuid.UUID) error
 	UpdateAgent(ctx context.Context, arg UpdateAgentParams) (NodeAgent, error)
 	UpdateAgentHeartbeat(ctx context.Context, arg UpdateAgentHeartbeatParams) error
 	UpdateBackupTargetByIDAndUser(ctx context.Context, arg UpdateBackupTargetByIDAndUserParams) error
 	UpdateBanner(ctx context.Context, arg UpdateBannerParams) (Banner, error)
+	// Agent reports the real host bindings after create — persist them with
+	// the status flip so ingress can route to the assigned port.
+	UpdateContainerPorts(ctx context.Context, arg UpdateContainerPortsParams) error
+	// Agent heartbeat reports real docker state + net counters; reconcile
+	// inventory for rows this node owns. Tombstones win — never resurrect a
+	// removed replica. $4 is the cumulative rx+tx byte counter.
+	UpdateContainerStateByName(ctx context.Context, arg UpdateContainerStateByNameParams) error
 	UpdateContainerStatus(ctx context.Context, arg UpdateContainerStatusParams) error
 	UpdateDatabaseServiceNameAndPlanByIDAndUser(ctx context.Context, arg UpdateDatabaseServiceNameAndPlanByIDAndUserParams) error
 	UpdateDatabaseServiceNameByIDAndUser(ctx context.Context, arg UpdateDatabaseServiceNameByIDAndUserParams) error
 	UpdateDatabaseServicePlanByIDAndUser(ctx context.Context, arg UpdateDatabaseServicePlanByIDAndUserParams) error
 	UpdateOutboundWebhook(ctx context.Context, arg UpdateOutboundWebhookParams) error
+	UpdatePreviewEnvironment(ctx context.Context, arg UpdatePreviewEnvironmentParams) error
 	UpdateProjectByID(ctx context.Context, arg UpdateProjectByIDParams) (int64, error)
+	UpdateServicePreviewBranch(ctx context.Context, arg UpdateServicePreviewBranchParams) error
 	UpdateUserTemplate(ctx context.Context, arg UpdateUserTemplateParams) (int64, error)
 	UpdateWebhookDeliveryResult(ctx context.Context, arg UpdateWebhookDeliveryResultParams) error
 	UpsertEnvironmentVariable(ctx context.Context, arg UpsertEnvironmentVariableParams) error
+	UpsertInstanceMetrics(ctx context.Context, arg UpsertInstanceMetricsParams) error
+	UpsertNodeMetrics(ctx context.Context, arg UpsertNodeMetricsParams) error
 	UpsertServiceContainer(ctx context.Context, arg UpsertServiceContainerParams) error
+	UpsertServiceMetrics(ctx context.Context, arg UpsertServiceMetricsParams) error
 	UpsertServiceTemplate(ctx context.Context, arg UpsertServiceTemplateParams) error
 }
 

app/backend/internal/database/sqlcdb/runtime.sql.go

@@ -0,0 +1,289 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: runtime.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const getLastDeployedImage = `-- name: GetLastDeployedImage :one
+SELECT (image_name || ':' || image_tag)::text AS image FROM deployments
+WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
+ORDER BY created_at DESC LIMIT 1
+`
+
+func (q *Queries) GetLastDeployedImage(ctx context.Context, serviceID uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getLastDeployedImage, serviceID)
+	var image string
+	err := row.Scan(&image)
+	return image, err
+}
+
+const getServicePort = `-- name: GetServicePort :one
+SELECT COALESCE(port, 0) AS port FROM services WHERE id = $1
+`
+
+func (q *Queries) GetServicePort(ctx context.Context, id uuid.UUID) (int32, error) {
+	row := q.db.QueryRowContext(ctx, getServicePort, id)
+	var port int32
+	err := row.Scan(&port)
+	return port, err
+}
+
+const getServiceRuntimeWithOwner = `-- name: GetServiceRuntimeWithOwner :one
+SELECT s.id, s.project_id, s.name,
+       COALESCE(s.type, s.service_type, '') AS type, COALESCE(s.status, '') AS status,
+       COALESCE(s.image, s.image_name, '') AS image, COALESCE(s.command, s.start_command, '') AS command,
+       COALESCE(s.environment, '') AS environment, COALESCE(s.git_repo, s.source_url, '') AS git_repo,
+       COALESCE(s.git_branch, '') AS git_branch, COALESCE(s.build_path, '') AS build_path,
+       COALESCE(s.cpu, '') AS cpu, COALESCE(s.memory, '') AS memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at, p.owner_id
+FROM services s
+JOIN projects p ON s.project_id = p.id
+WHERE s.id = $1
+`
+
+type GetServiceRuntimeWithOwnerRow struct {
+	ID              uuid.UUID    `json:"id"`
+	ProjectID       uuid.UUID    `json:"project_id"`
+	Name            string       `json:"name"`
+	Type            string       `json:"type"`
+	Status          string       `json:"status"`
+	Image           string       `json:"image"`
+	Command         string       `json:"command"`
+	Environment     string       `json:"environment"`
+	GitRepo         string       `json:"git_repo"`
+	GitBranch       string       `json:"git_branch"`
+	BuildPath       string       `json:"build_path"`
+	Cpu             string       `json:"cpu"`
+	Memory          string       `json:"memory"`
+	Replicas        int32        `json:"replicas"`
+	Port            int32        `json:"port"`
+	Domain          string       `json:"domain"`
+	HealthcheckPath string       `json:"healthcheck_path"`
+	RestartPolicy   string       `json:"restart_policy"`
+	Builder         string       `json:"builder"`
+	CpuReserve      string       `json:"cpu_reserve"`
+	MemoryReserve   string       `json:"memory_reserve"`
+	StaticBuildCmd  string       `json:"static_build_cmd"`
+	StaticDir       string       `json:"static_dir"`
+	CreatedAt       sql.NullTime `json:"created_at"`
+	UpdatedAt       sql.NullTime `json:"updated_at"`
+	OwnerID         uuid.UUID    `json:"owner_id"`
+}
+
+func (q *Queries) GetServiceRuntimeWithOwner(ctx context.Context, id uuid.UUID) (GetServiceRuntimeWithOwnerRow, error) {
+	row := q.db.QueryRowContext(ctx, getServiceRuntimeWithOwner, id)
+	var i GetServiceRuntimeWithOwnerRow
+	err := row.Scan(
+		&i.ID,
+		&i.ProjectID,
+		&i.Name,
+		&i.Type,
+		&i.Status,
+		&i.Image,
+		&i.Command,
+		&i.Environment,
+		&i.GitRepo,
+		&i.GitBranch,
+		&i.BuildPath,
+		&i.Cpu,
+		&i.Memory,
+		&i.Replicas,
+		&i.Port,
+		&i.Domain,
+		&i.HealthcheckPath,
+		&i.RestartPolicy,
+		&i.Builder,
+		&i.CpuReserve,
+		&i.MemoryReserve,
+		&i.StaticBuildCmd,
+		&i.StaticDir,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.OwnerID,
+	)
+	return i, err
+}
+
+const getServiceVariableValue = `-- name: GetServiceVariableValue :one
+SELECT value FROM environment_variables WHERE service_id = $1 AND key = $2
+`
+
+type GetServiceVariableValueParams struct {
+	ServiceID uuid.UUID `json:"service_id"`
+	Key       string    `json:"key"`
+}
+
+func (q *Queries) GetServiceVariableValue(ctx context.Context, arg GetServiceVariableValueParams) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceVariableValue, arg.ServiceID, arg.Key)
+	var value string
+	err := row.Scan(&value)
+	return value, err
+}
+
+const listNodeAgentsForService = `-- name: ListNodeAgentsForService :many
+SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1
+`
+
+func (q *Queries) ListNodeAgentsForService(ctx context.Context, serviceID string) ([]string, error) {
+	rows, err := q.db.QueryContext(ctx, listNodeAgentsForService, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []string{}
+	for rows.Next() {
+		var node_agent_id string
+		if err := rows.Scan(&node_agent_id); err != nil {
+			return nil, err
+		}
+		items = append(items, node_agent_id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listProjectServiceRefs = `-- name: ListProjectServiceRefs :many
+SELECT id, name FROM services WHERE project_id = $1
+`
+
+type ListProjectServiceRefsRow struct {
+	ID   uuid.UUID `json:"id"`
+	Name string    `json:"name"`
+}
+
+func (q *Queries) ListProjectServiceRefs(ctx context.Context, projectID uuid.UUID) ([]ListProjectServiceRefsRow, error) {
+	rows, err := q.db.QueryContext(ctx, listProjectServiceRefs, projectID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListProjectServiceRefsRow{}
+	for rows.Next() {
+		var i ListProjectServiceRefsRow
+		if err := rows.Scan(&i.ID, &i.Name); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceVariableValues = `-- name: ListServiceVariableValues :many
+SELECT key, value FROM environment_variables WHERE service_id = $1
+`
+
+type ListServiceVariableValuesRow struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}
+
+func (q *Queries) ListServiceVariableValues(ctx context.Context, serviceID uuid.UUID) ([]ListServiceVariableValuesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceVariableValues, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListServiceVariableValuesRow{}
+	for rows.Next() {
+		var i ListServiceVariableValuesRow
+		if err := rows.Scan(&i.Key, &i.Value); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listServiceVariablesWithSecret = `-- name: ListServiceVariablesWithSecret :many
+SELECT key, value, COALESCE(is_secret, false) AS is_secret
+FROM environment_variables WHERE service_id = $1
+`
+
+type ListServiceVariablesWithSecretRow struct {
+	Key      string `json:"key"`
+	Value    string `json:"value"`
+	IsSecret bool   `json:"is_secret"`
+}
+
+func (q *Queries) ListServiceVariablesWithSecret(ctx context.Context, serviceID uuid.UUID) ([]ListServiceVariablesWithSecretRow, error) {
+	rows, err := q.db.QueryContext(ctx, listServiceVariablesWithSecret, serviceID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListServiceVariablesWithSecretRow{}
+	for rows.Next() {
+		var i ListServiceVariablesWithSecretRow
+		if err := rows.Scan(&i.Key, &i.Value, &i.IsSecret); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const setServicePublishedPort = `-- name: SetServicePublishedPort :exec
+UPDATE services SET published_port = $1 WHERE id = $2 AND published_port <> $1
+`
+
+type SetServicePublishedPortParams struct {
+	PublishedPort int32     `json:"published_port"`
+	ID            uuid.UUID `json:"id"`
+}
+
+func (q *Queries) SetServicePublishedPort(ctx context.Context, arg SetServicePublishedPortParams) error {
+	_, err := q.db.ExecContext(ctx, setServicePublishedPort, arg.PublishedPort, arg.ID)
+	return err
+}
+
+const setServiceReplicas = `-- name: SetServiceReplicas :exec
+UPDATE services SET replicas = $1, updated_at = $2 WHERE id = $3
+`
+
+type SetServiceReplicasParams struct {
+	Replicas  int32        `json:"replicas"`
+	UpdatedAt sql.NullTime `json:"updated_at"`
+	ID        uuid.UUID    `json:"id"`
+}
+
+func (q *Queries) SetServiceReplicas(ctx context.Context, arg SetServiceReplicasParams) error {
+	_, err := q.db.ExecContext(ctx, setServiceReplicas, arg.Replicas, arg.UpdatedAt, arg.ID)
+	return err
+}

app/backend/internal/database/sqlcdb/service_ops.sql.go

@@ -0,0 +1,158 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: service_ops.sql
+
+package sqlcdb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/google/uuid"
+)
+
+const cloneServiceDomains = `-- name: CloneServiceDomains :exec
+INSERT INTO service_domains (service_id, domain, is_default, cert_type)
+SELECT $1, domain, is_default, cert_type FROM service_domains sd WHERE sd.service_id = $2
+`
+
+type CloneServiceDomainsParams struct {
+	ServiceID   uuid.UUID `json:"service_id"`
+	ServiceID_2 uuid.UUID `json:"service_id_2"`
+}
+
+func (q *Queries) CloneServiceDomains(ctx context.Context, arg CloneServiceDomainsParams) error {
+	_, err := q.db.ExecContext(ctx, cloneServiceDomains, arg.ServiceID, arg.ServiceID_2)
+	return err
+}
+
+const cloneServiceRow = `-- name: CloneServiceRow :exec
+INSERT INTO services
+    (id, project_id, name, environment_id, service_type, source_type, source_url, image_name,
+     build_command, start_command, type, status, image, command, environment,
+     git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
+     healthcheck_path, restart_policy, volumes, maintenance_mode, basic_auth_users,
+     builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
+     traefik_labels, created_at, updated_at)
+SELECT $1, $2, $3, $4, service_type, source_type, source_url, image_name,
+     build_command, start_command, type, 'stopped', image, command, $5,
+     git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
+     healthcheck_path, restart_policy, volumes, $6, $7,
+     builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
+     traefik_labels, $8, $8
+FROM services s WHERE s.id = $9
+`
+
+type CloneServiceRowParams struct {
+	ID              uuid.UUID      `json:"id"`
+	ProjectID       uuid.UUID      `json:"project_id"`
+	Name            string         `json:"name"`
+	EnvironmentID   uuid.UUID      `json:"environment_id"`
+	Environment     sql.NullString `json:"environment"`
+	MaintenanceMode bool           `json:"maintenance_mode"`
+	BasicAuthUsers  string         `json:"basic_auth_users"`
+	CreatedAt       sql.NullTime   `json:"created_at"`
+	ID_2            uuid.UUID      `json:"id_2"`
+}
+
+func (q *Queries) CloneServiceRow(ctx context.Context, arg CloneServiceRowParams) error {
+	_, err := q.db.ExecContext(ctx, cloneServiceRow,
+		arg.ID,
+		arg.ProjectID,
+		arg.Name,
+		arg.EnvironmentID,
+		arg.Environment,
+		arg.MaintenanceMode,
+		arg.BasicAuthUsers,
+		arg.CreatedAt,
+		arg.ID_2,
+	)
+	return err
+}
+
+const cloneServiceVariables = `-- name: CloneServiceVariables :exec
+INSERT INTO environment_variables (id, service_id, key, value, is_secret)
+SELECT gen_random_uuid(), $1, key, value, is_secret FROM environment_variables ev WHERE ev.service_id = $2
+`
+
+type CloneServiceVariablesParams struct {
+	ServiceID   uuid.UUID `json:"service_id"`
+	ServiceID_2 uuid.UUID `json:"service_id_2"`
+}
+
+func (q *Queries) CloneServiceVariables(ctx context.Context, arg CloneServiceVariablesParams) error {
+	_, err := q.db.ExecContext(ctx, cloneServiceVariables, arg.ServiceID, arg.ServiceID_2)
+	return err
+}
+
+const countServicesByName = `-- name: CountServicesByName :one
+SELECT COUNT(*) FROM services WHERE project_id = $1 AND name = $2
+`
+
+type CountServicesByNameParams struct {
+	ProjectID uuid.UUID `json:"project_id"`
+	Name      string    `json:"name"`
+}
+
+func (q *Queries) CountServicesByName(ctx context.Context, arg CountServicesByNameParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countServicesByName, arg.ProjectID, arg.Name)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const deleteServiceByID = `-- name: DeleteServiceByID :exec
+DELETE FROM services WHERE id = $1
+`
+
+func (q *Queries) DeleteServiceByID(ctx context.Context, id uuid.UUID) error {
+	_, err := q.db.ExecContext(ctx, deleteServiceByID, id)
+	return err
+}
+
+const getProjectOwner = `-- name: GetProjectOwner :one
+SELECT owner_id FROM projects WHERE id = $1
+`
+
+func (q *Queries) GetProjectOwner(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
+	row := q.db.QueryRowContext(ctx, getProjectOwner, id)
+	var owner_id uuid.UUID
+	err := row.Scan(&owner_id)
+	return owner_id, err
+}
+
+const getServiceEnvironment = `-- name: GetServiceEnvironment :one
+SELECT COALESCE(environment, '') FROM services WHERE id = $1
+`
+
+func (q *Queries) GetServiceEnvironment(ctx context.Context, id uuid.UUID) (string, error) {
+	row := q.db.QueryRowContext(ctx, getServiceEnvironment, id)
+	var environment string
+	err := row.Scan(&environment)
+	return environment, err
+}
+
+const moveServiceProject = `-- name: MoveServiceProject :execrows
+UPDATE services SET project_id = $1, environment_id = $2, updated_at = $3 WHERE id = $4
+`
+
+type MoveServiceProjectParams struct {
+	ProjectID     uuid.UUID    `json:"project_id"`
+	EnvironmentID uuid.UUID    `json:"environment_id"`
+	UpdatedAt     sql.NullTime `json:"updated_at"`
+	ID            uuid.UUID    `json:"id"`
+}
+
+func (q *Queries) MoveServiceProject(ctx context.Context, arg MoveServiceProjectParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, moveServiceProject,
+		arg.ProjectID,
+		arg.EnvironmentID,
+		arg.UpdatedAt,
+		arg.ID,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}

app/backend/internal/deployment/edge_labels_test.go

@@ -0,0 +1,60 @@
+package deployment
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestEdgeLabelsCustomMiddlewares(t *testing.T) {
+	spec := RuntimeSpec{
+		ServiceID: "01234567-89ab-cdef-0123-456789abcdef",
+		Port:      8080,
+		Domains:   []string{"app.example.com"},
+		TraefikLabels: map[string]string{
+			"middlewares.rl.ratelimit.average":                              "100",
+			"middlewares.rl.ratelimit.period":                               "1m",
+			"middlewares.sec.headers.customresponseheaders.X-Frame-Options": "DENY",
+		},
+	}
+	labels := edgeLabels(spec, "containr-edge")
+
+	if got := labels["traefik.http.middlewares.svc-01234567-rl.ratelimit.average"]; got != "100" {
+		t.Fatalf("ratelimit label missing: %v", labels)
+	}
+	if got := labels["traefik.http.middlewares.svc-01234567-sec.headers.customresponseheaders.X-Frame-Options"]; got != "DENY" {
+		t.Fatalf("headers label missing: %v", labels)
+	}
+	chain := labels["traefik.http.routers.svc-01234567.middlewares"]
+	if chain != "svc-01234567-rl,svc-01234567-sec" {
+		t.Fatalf("middleware chain wrong: %q", chain)
+	}
+}
+
+func TestEdgeLabelsCustomAfterBuiltins(t *testing.T) {
+	spec := RuntimeSpec{
+		ServiceID:      "01234567-89ab-cdef-0123-456789abcdef",
+		Port:           8080,
+		Domains:        []string{"app.example.com"},
+		BasicAuthUsers: "u:$apr1$x",
+		TraefikLabels: map[string]string{
+			"middlewares.rl.ratelimit.average": "10",
+		},
+	}
+	labels := edgeLabels(spec, "containr-edge")
+	chain := labels["traefik.http.routers.svc-01234567.middlewares"]
+	if !strings.HasPrefix(chain, "svc-01234567-auth,") || !strings.HasSuffix(chain, "svc-01234567-rl") {
+		t.Fatalf("builtin should precede custom: %q", chain)
+	}
+}
+
+func TestEdgeLabelsNoCustom(t *testing.T) {
+	spec := RuntimeSpec{
+		ServiceID: "01234567-89ab-cdef-0123-456789abcdef",
+		Port:      8080,
+		Domains:   []string{"app.example.com"},
+	}
+	labels := edgeLabels(spec, "containr-edge")
+	if _, ok := labels["traefik.http.routers.svc-01234567.middlewares"]; ok {
+		t.Fatal("middleware chain should be absent with no middlewares")
+	}
+}

app/backend/internal/deployment/engine.go

@@ -20,6 +20,10 @@ type NodeRunner interface {
 	// ReconcileSpread distributes the service's replicas across every online,
 	// schedulable agent — replica i lands on agents[i % len].
 	ReconcileSpread(ctx context.Context, spec RuntimeSpec) (*RuntimeState, error)
+	// ReconcileAuto picks the least-loaded online agent carrying every tag in
+	// spec.PlacementTags and reconciles all replicas onto it. Re-resolved on
+	// every reconcile — the service follows the tag, not a stored node.
+	ReconcileAuto(ctx context.Context, spec RuntimeSpec) (*RuntimeState, error)
 	// ControlService fans a lifecycle action ("start"|"stop"|"restart"|"remove")
 	// out to every replica of the service on the agent.
 	ControlService(ctx context.Context, serviceID, agentID, action string) error
@@ -28,6 +32,9 @@ type NodeRunner interface {
 	// RemoteRuntimeState reads the service's remote replicas from inventory
 	// across all agents. nil/empty means nothing runs remotely.
 	RemoteRuntimeState(ctx context.Context, serviceID string) (*RuntimeState, error)
+	// RetireService removes every remote replica of the service across all
+	// agents — used when a service returns to local placement.
+	RetireService(ctx context.Context, serviceID string) error
 }
 
 type DeploymentEngine struct {
@@ -88,12 +95,29 @@ type ServiceConfig struct {
 	// reuses it so public URLs survive restarts. 0 = pick ephemeral.
 	PublishedPort int32 `json:"published_port,omitempty"`
 	// NodeID pins the service to a registered node agent; "" = local Docker
-	// host. Remote placement requires a registry-pullable image — builds stay
-	// on the local host (build-on-node is not yet supported).
+	// host.
 	NodeID string `json:"node_id,omitempty"`
 	// Spread distributes replicas across every online, schedulable agent.
-	// Same registry-image constraint as NodeID.
 	Spread bool `json:"spread,omitempty"`
+	// RemoteBuild, when set, makes each target node docker-build the image
+	// itself from a packaged context artifact instead of pulling a registry
+	// tag. The image name comes from the deployment, not the spec.
+	RemoteBuild *RemoteBuildSpec `json:"remote_build,omitempty"`
+	// RemoteLoad ships a docker-save tarball to each target node — used for
+	// rollbacks of locally-built tags that no registry can serve.
+	RemoteLoad *RemoteLoadSpec `json:"remote_load,omitempty"`
+}
+
+// RemoteBuildSpec is the agent-side docker build request.
+type RemoteBuildSpec struct {
+	ArtifactID string            `json:"artifact_id"`
+	BuildArgs  map[string]string `json:"build_args,omitempty"`
+	NoCache    bool              `json:"no_cache,omitempty"`
+}
+
+// RemoteLoadSpec asks the agent to docker-load an image tarball artifact.
+type RemoteLoadSpec struct {
+	ArtifactID string `json:"artifact_id"`
 }
 
 type PortMapping struct {
@@ -204,6 +228,12 @@ func (de *DeploymentEngine) DockerClient() *docker.Client {
 	return de.dockerClient
 }
 
+// BuildManager exposes the engine's builders for context packaging — remote
+// nodes build the tar this produces themselves.
+func (de *DeploymentEngine) BuildManager() *build.BuildManager {
+	return de.buildManager
+}
+
 // SetNodeRunner wires remote-node dispatch for services pinned to an agent.
 func (de *DeploymentEngine) SetNodeRunner(r NodeRunner) {
 	de.nodeRunner = r
@@ -319,11 +349,19 @@ func (de *DeploymentEngine) executeDeployment(ctx context.Context, deployment *D
 	})
 }
 
-// buildImage builds the container image
+// buildImage builds the container image. "remote" build types produce no
+// local image — the target node builds or loads it from an artifact; the
+// deployment still needs a deterministic tag so every node names it alike.
 func (de *DeploymentEngine) buildImage(ctx context.Context, deployment *Deployment, buildConfig *BuildConfig) (string, error) {
 	if buildConfig == nil {
 		return "", fmt.Errorf("build config is required")
 	}
+	if buildConfig.BuildType == "remote" {
+		if buildConfig.PrebuiltImage != "" {
+			return buildConfig.PrebuiltImage, nil
+		}
+		return fmt.Sprintf("containr-%s-%s:%s", deployment.ServiceID, deployment.Environment, deployment.ID), nil
+	}
 
 	buildReq := &types.BuildRequest{
 		BuildType:     buildConfig.BuildType,
@@ -386,6 +424,8 @@ func (de *DeploymentEngine) deployService(ctx context.Context, deployment *Deplo
 		BasicAuthUsers: cfg.BasicAuthUsers,
 		NodeID:         cfg.NodeID,
 		Spread:         cfg.Spread,
+		RemoteBuild:    cfg.RemoteBuild,
+		RemoteLoad:     cfg.RemoteLoad,
 	}
 	for _, pm := range cfg.PortMappings {
 		if spec.Port == 0 {

app/backend/internal/deployment/runtime.go

@@ -55,11 +55,24 @@ type RuntimeSpec struct {
 	Maintenance    bool          // redirect traffic to MaintenanceURL
 	MaintenanceURL string        // absolute URL; empty = serve empty response
 	BasicAuthUsers string        // htpasswd-format user:hash pairs, comma-separated
+	// TraefikLabels defines extra middlewares for this service's router —
+	// keys "middlewares.<name>.<type>[.<field>]" (API-validated against an
+	// allowlist). Defined middlewares attach to the router after builtins.
+	TraefikLabels map[string]string
 	// NodeID pins the service to a node agent; "" runs on the local host.
 	NodeID string
 	// Spread distributes replicas across all online, schedulable agents
 	// instead of a single node. Mutually exclusive with NodeID.
 	Spread bool
+	// PlacementTags restricts auto/spread candidates to agents carrying
+	// every listed tag. An explicit NodeID pin bypasses tag filtering.
+	PlacementTags []string
+	// RemoteBuild makes target nodes docker-build Image from a packaged
+	// context artifact before replicas start (git-sourced remote deploys).
+	RemoteBuild *RemoteBuildSpec
+	// RemoteLoad makes target nodes docker-load a saved image tarball —
+	// remote rollbacks of locally-built tags.
+	RemoteLoad *RemoteLoadSpec
 }
 
 // RuntimeContainer describes one live replica.
@@ -171,6 +184,20 @@ func (de *DeploymentEngine) ReconcileService(ctx context.Context, spec RuntimeSp
 		}
 		return de.nodeRunner.ReconcileOnNode(ctx, spec)
 	}
+	// Placement tags without a pin/spread resolve to the least-loaded
+	// matching agent on every reconcile — soft affinity, re-evaluated.
+	if len(spec.PlacementTags) > 0 {
+		if de.nodeRunner == nil {
+			return nil, fmt.Errorf("service has placement tags but remote dispatch is unavailable")
+		}
+		return de.nodeRunner.ReconcileAuto(ctx, spec)
+	}
+	// Local placement: retire any remote leftovers from a previous pin,
+	// spread, or tag affinity before reconciling local replicas.
+	if de.nodeRunner != nil {
+		_ = de.nodeRunner.RetireService(ctx, spec.ServiceID)
+	}
+
 	if spec.Replicas < 1 {
 		spec.Replicas = 1
 	}
@@ -251,44 +278,9 @@ func (de *DeploymentEngine) createReplica(ctx context.Context, spec RuntimeSpec,
 		projectNet: {Aliases: []string{spec.Name}},
 	}
 	if edgeNet != "" {
-		router := "svc-" + spec.ServiceID[:8]
-		domains := spec.Domains
-		if len(domains) == 0 && spec.Domain != "" {
-			domains = []string{spec.Domain}
-		}
-		sort.Strings(domains)
-		rules := make([]string, 0, len(domains))
-		for _, d := range domains {
-			rules = append(rules, "Host(`"+d+"`)")
-		}
 		endpoints[edgeNet] = &network.EndpointSettings{}
-		labels["traefik.enable"] = "true"
-		labels["traefik.docker.network"] = edgeNet
-		labels["traefik.http.routers."+router+".rule"] = strings.Join(rules, " || ")
-		labels["traefik.http.routers."+router+".entrypoints"] = "web"
-		labels["traefik.http.services."+router+".loadbalancer.server.port"] = fmt.Sprintf("%d", spec.Port)
-
-		var middlewares []string
-		if spec.Maintenance {
-			if spec.MaintenanceURL != "" {
-				mw := router + "-maint"
-				labels["traefik.http.middlewares."+mw+".redirectregex.regex"] = "^https?://[^/]+/.*"
-				labels["traefik.http.middlewares."+mw+".redirectregex.replacement"] = spec.MaintenanceURL
-				labels["traefik.http.middlewares."+mw+".redirectregex.permanent"] = "false"
-				middlewares = append(middlewares, mw)
-			} else {
-				// No redirect target configured — take the site offline with
-				// empty responses instead of leaking traffic to the app.
-				labels["traefik.http.routers."+router+".service"] = "noop@internal"
-			}
-		}
-		if spec.BasicAuthUsers != "" {
-			mw := router + "-auth"
-			labels["traefik.http.middlewares."+mw+".basicauth.users"] = spec.BasicAuthUsers
-			middlewares = append(middlewares, mw)
-		}
-		if len(middlewares) > 0 {
-			labels["traefik.http.routers."+router+".middlewares"] = strings.Join(middlewares, ",")
+		for k, v := range edgeLabels(spec, edgeNet) {
+			labels[k] = v
 		}
 	}
 
@@ -376,6 +368,81 @@ func (de *DeploymentEngine) createReplica(ctx context.Context, spec RuntimeSpec,
 // vpnkit drops a conflicting binding).
 var errPortNotBound = errors.New("requested host port not bound")
 
+// edgeLabels builds the Traefik router/service/middleware labels for a
+// replica on the edge network: host rules, load balancer port, builtin
+// maintenance/basic-auth middlewares, then operator-defined overrides.
+func edgeLabels(spec RuntimeSpec, edgeNet string) map[string]string {
+	router := "svc-" + spec.ServiceID[:8]
+	domains := spec.Domains
+	if len(domains) == 0 && spec.Domain != "" {
+		domains = []string{spec.Domain}
+	}
+	sort.Strings(domains)
+	rules := make([]string, 0, len(domains))
+	for _, d := range domains {
+		rules = append(rules, "Host(`"+d+"`)")
+	}
+
+	labels := map[string]string{
+		"traefik.enable":                                                "true",
+		"traefik.docker.network":                                        edgeNet,
+		"traefik.http.routers." + router + ".rule":                      strings.Join(rules, " || "),
+		"traefik.http.routers." + router + ".entrypoints":               "web",
+		"traefik.http.services." + router + ".loadbalancer.server.port": fmt.Sprintf("%d", spec.Port),
+	}
+
+	var middlewares []string
+	if spec.Maintenance {
+		if spec.MaintenanceURL != "" {
+			mw := router + "-maint"
+			labels["traefik.http.middlewares."+mw+".redirectregex.regex"] = "^https?://[^/]+/.*"
+			labels["traefik.http.middlewares."+mw+".redirectregex.replacement"] = spec.MaintenanceURL
+			labels["traefik.http.middlewares."+mw+".redirectregex.permanent"] = "false"
+			middlewares = append(middlewares, mw)
+		} else {
+			// No redirect target configured — take the site offline with
+			// empty responses instead of leaking traffic to the app.
+			labels["traefik.http.routers."+router+".service"] = "noop@internal"
+		}
+	}
+	if spec.BasicAuthUsers != "" {
+		mw := router + "-auth"
+		labels["traefik.http.middlewares."+mw+".basicauth.users"] = spec.BasicAuthUsers
+		middlewares = append(middlewares, mw)
+	}
+	// Operator-defined middlewares: "middlewares.<name>.<rest>" becomes
+	// "<router>-<name>.<rest>", and every defined name joins the router's
+	// chain after builtins. Names sort for a deterministic chain order.
+	customMWs := map[string][]string{}
+	for k, v := range spec.TraefikLabels {
+		rest := strings.TrimPrefix(k, "middlewares.")
+		dot := strings.Index(rest, ".")
+		if dot <= 0 {
+			continue
+		}
+		customMWs[rest[:dot]] = append(customMWs[rest[:dot]], rest[dot+1:]+"="+v)
+	}
+	mwNames := make([]string, 0, len(customMWs))
+	for name := range customMWs {
+		mwNames = append(mwNames, name)
+	}
+	sort.Strings(mwNames)
+	for _, name := range mwNames {
+		mw := router + "-" + name
+		sort.Strings(customMWs[name])
+		for _, kv := range customMWs[name] {
+			if i := strings.Index(kv, "="); i > 0 {
+				labels["traefik.http.middlewares."+mw+"."+kv[:i]] = kv[i+1:]
+			}
+		}
+		middlewares = append(middlewares, mw)
+	}
+	if len(middlewares) > 0 {
+		labels["traefik.http.routers."+router+".middlewares"] = strings.Join(middlewares, ",")
+	}
+	return labels
+}
+
 // isPortConflict reports whether a container create failed because the
 // requested host port was already bound.
 func isPortConflict(err error) bool {

app/backend/internal/docker/client.go

@@ -336,6 +336,13 @@ func (c *Client) BuildImage(ctx context.Context, buildContext io.Reader, options
 	return resp, nil
 }
 
+// SaveImage streams refs as a docker-save tarball. Remote nodes receive
+// these through the artifact endpoint and docker load them — that is how
+// locally-built rollback tags reach nodes without a registry.
+func (c *Client) SaveImage(ctx context.Context, refs ...string) (io.ReadCloser, error) {
+	return c.cli.ImageSave(ctx, refs)
+}
+
 // RemoveImage removes an image
 func (c *Client) RemoveImage(ctx context.Context, imageID string, force bool) ([]image.DeleteResponse, error) {
 	return c.cli.ImageRemove(ctx, imageID, image.RemoveOptions{

app/backend/internal/gateway/proxy_test.go

@@ -0,0 +1,64 @@
+package gateway
+
+import "testing"
+
+func TestBuildTargetURL(t *testing.T) {
+	cases := []struct {
+		name                                       string
+		upstream, prefix, path, query, want        string
+	}{
+		{
+			name:     "strips route prefix",
+			upstream: "https://api.internal:8080",
+			prefix:   "/g/weather",
+			path:     "/g/weather/v1/current",
+			query:    "city=oslo",
+			want:     "https://api.internal:8080/v1/current?city=oslo",
+		},
+		{
+			name:     "prefix root maps to upstream root",
+			upstream: "https://api.internal",
+			prefix:   "/g/weather",
+			path:     "/g/weather",
+			want:     "https://api.internal/",
+		},
+		{
+			name:     "upstream base path is preserved",
+			upstream: "https://api.internal/base",
+			prefix:   "/g/x",
+			path:     "/g/x/ping",
+			want:     "https://api.internal/base/ping",
+		},
+		{
+			name:     "root prefix leaves path untouched",
+			upstream: "https://api.internal",
+			prefix:   "/",
+			path:     "/g/raw",
+			want:     "https://api.internal/g/raw",
+		},
+		{
+			name:     "path without prefix is still proxied",
+			upstream: "https://api.internal",
+			prefix:   "/g/x",
+			path:     "/other",
+			want:     "https://api.internal/other",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := BuildTargetURL(tc.upstream, tc.prefix, tc.path, tc.query)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tc.want {
+				t.Fatalf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestBuildTargetURL_InvalidUpstream(t *testing.T) {
+	if _, err := BuildTargetURL("://bad", "/g/x", "/g/x/y", ""); err == nil {
+		t.Fatal("expected error for unparsable upstream")
+	}
+}

app/backend/internal/mcpserver/server.go

@@ -50,10 +50,15 @@ func init() {
 	register(spec{"containr_projects_create", "Create a project. Args: name (required), description.", "POST", "/projects", nil, []string{"name", "description"}, false})
 	register(spec{"containr_projects_delete", "Delete a project and all its services. Requires confirm:true.", "DELETE", "/projects/{id}", []string{"id"}, nil, true})
 
+	// Environments
+	register(spec{"containr_environments_list", "List environments in a project with service counts", "GET", "/projects/{id}/environments", []string{"id"}, nil, false})
+	register(spec{"containr_environments_create", "Create an environment. Args: name (required — lowercase alphanumeric with dashes, 1-50 chars).", "POST", "/projects/{id}/environments", []string{"id"}, []string{"name"}, false})
+	register(spec{"containr_environments_delete", "Delete an empty environment. Requires confirm:true.", "DELETE", "/environments/{id}", []string{"id"}, nil, true})
+
 	// Services
 	register(spec{"containr_services_list", "List services in a project", "GET", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
 	register(spec{"containr_services_get", "Get a service by id", "GET", "/services/{id}", []string{"id"}, nil, false})
-	register(spec{"containr_services_create", "Create a service in a project. Args: name (required), type, image, git_repo, git_branch, environment, port, domain, replicas, volumes = [{type: volume|bind, source, target, read_only}], builder = auto|railpack|nixpacks|dockerfile|static, cpu, memory, cpu_reserve, memory_reserve, static_build_cmd, static_dir, node_id (agent id | 'auto' = least-loaded online node; image services only — remote nodes can't run git builds), spread (bool — distribute replicas across every online schedulable node; mutually exclusive with a node pin).", "POST", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
+	register(spec{"containr_services_create", "Create a service in a project. Args: name (required), type, image, git_repo, git_branch, environment, port, domain, replicas, volumes = [{type: volume|bind, source, target, read_only}], builder = auto|railpack|nixpacks|dockerfile|static, cpu, memory, cpu_reserve, memory_reserve, static_build_cmd, static_dir, sleep_enabled (bool — scale to zero on idle), sleep_idle_minutes (1-1440, default 15), node_id (agent id | 'auto' = least-loaded online node; git services build on the node itself), spread (bool — distribute replicas across every online schedulable node; mutually exclusive with a node pin), placement_tags (string array — remote placement only onto nodes carrying every tag; re-resolved per reconcile, pin overrides), traefik_labels (object — extra Traefik middlewares for this service's router; keys 'middlewares.<name>.<type>[.<field>]', allowlist-validated; defined middlewares attach to the router automatically).", "POST", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
 	register(spec{"containr_services_delete", "Delete a service. Requires confirm:true.", "DELETE", "/services/{id}", []string{"id"}, nil, true})
 	register(spec{"containr_services_start", "Start a service", "POST", "/services/{id}/start", []string{"id"}, nil, false})
 	register(spec{"containr_services_stop", "Stop a service", "POST", "/services/{id}/stop", []string{"id"}, nil, false})
@@ -66,7 +71,7 @@ func init() {
 	register(spec{"containr_services_move", "Move a service to another project the caller owns. Args: id, project_id (required).", "POST", "/services/{id}/move", []string{"id"}, []string{"project_id"}, false})
 	register(spec{"containr_services_logs", "Get service runtime logs. Args: id, tail (default 100).", "GET", "/services/{id}/logs", []string{"id"}, nil, false})
 	register(spec{"containr_services_exec", "Run a one-off command in the service container (30s ceiling). Args: id, command (required).", "POST", "/services/{id}/exec", []string{"id"}, []string{"command"}, false})
-	register(spec{"containr_services_update", "Update a service. Args: id, name, image, command, domain, restart_policy, healthcheck_path, cpu, memory, replicas, port, volumes = [{type: volume|bind, source, target, read_only}] — volumes replaces the whole mount list; pass [] to clear. maintenance_mode (bool), basic_auth = [{username, password}] — replaces all creds; [] clears. builder = auto|railpack|nixpacks|dockerfile|static, cpu_reserve, memory_reserve, static_build_cmd, static_dir (empty string clears reserves/static fields). sleep_enabled (bool) + sleep_idle_minutes (1-1440) enable scale-to-zero on idle; a wake placeholder answers traffic while the service resumes. node_id pins placement to a node agent ('auto' = least-loaded, 'local' = run on the Containr host). spread (bool) distributes replicas across every online schedulable node; mutually exclusive with a pin — clear node_id to 'local' first if pinned.", "PUT", "/services/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_services_update", "Update a service. Args: id, name, image, command, domain, restart_policy, healthcheck_path, cpu, memory, replicas, port, volumes = [{type: volume|bind, source, target, read_only}] — volumes replaces the whole mount list; pass [] to clear. maintenance_mode (bool), basic_auth = [{username, password}] — replaces all creds; [] clears. builder = auto|railpack|nixpacks|dockerfile|static, cpu_reserve, memory_reserve, static_build_cmd, static_dir (empty string clears reserves/static fields). sleep_enabled (bool) + sleep_idle_minutes (1-1440) enable scale-to-zero on idle; a wake placeholder answers traffic while the service resumes. node_id pins placement to a node agent ('auto' = least-loaded, 'local' = run on the Containr host). spread (bool) distributes replicas across every online schedulable node; mutually exclusive with a pin — clear node_id to 'local' first if pinned. placement_tags (string array; [] clears) restricts auto/spread placement to nodes carrying every tag; mutually exclusive with an explicit pin — clear the pin first. traefik_labels (object; {} clears) replaces the service's Traefik middleware overrides — keys 'middlewares.<name>.<type>[.<field>]', e.g. {'middlewares.rl.ratelimit.average': '100'}.", "PUT", "/services/{id}", []string{"id"}, nil, false})
 
 	// Domains
 	register(spec{"containr_domains_list", "List domains attached to a service", "GET", "/services/{id}/domains", []string{"id"}, nil, false})
@@ -133,12 +138,17 @@ func init() {
 	register(spec{"containr_templates_deploy", "Deploy a template into a project. Args: id (template), project_id.", "POST", "/templates/{id}/deploy", []string{"id"}, []string{"project_id"}, false})
 	register(spec{"containr_templates_plan", "Dry-resolve a template: expanded expressions, service refs, missing variables. Args: id, variables (object).", "POST", "/templates/{id}/plan", []string{"id"}, nil, false})
 	register(spec{"containr_templates_import_compose", "Convert docker-compose YAML into a v2 template graph config. Args: compose_yaml.", "POST", "/templates/import/compose", nil, []string{"compose_yaml"}, false})
+	register(spec{"containr_templates_import_git", "Fetch a compose file from a git repo (clone URL, ssh remote, or owner/repo via connected providers) and convert it into a v2 template graph config. Args: repo (required), path (default: compose.yaml/yml or docker-compose.yml/yaml), ref (branch or commit).", "POST", "/templates/import/git", nil, []string{"repo", "path", "ref"}, false})
 	register(spec{"containr_templates_deploy_graph", "Deploy an ad-hoc service graph without a stored template. Args: project_id, config ({services:[...]}), variables, plan, region.", "POST", "/templates/deploy", nil, []string{"project_id", "config", "variables", "plan", "region"}, false})
 	register(spec{"containr_projects_import_compose", "Deploy a docker-compose file straight into a project. Args: id (project), compose_yaml, variables, plan, region.", "POST", "/projects/{id}/import-compose", []string{"id"}, []string{"compose_yaml", "variables", "plan", "region"}, false})
 
 	// Notifications
 	register(spec{"containr_notifications_list", "List notifications", "GET", "/notifications", nil, nil, false})
 	register(spec{"containr_notifications_read", "Mark a notification read, or all notifications with id=all", "POST", "/notifications/{id}/read", []string{"id"}, nil, false})
+	register(spec{"containr_notification_channels_list", "List push notification channels (ntfy/Gotify)", "GET", "/notifications/channels", nil, nil, false})
+	register(spec{"containr_notification_channels_create", "Add a push notification channel. Args: kind (ntfy|gotify), endpoint (full URL incl. ntfy topic or Gotify base), token (ntfy access token or Gotify app token).", "POST", "/notifications/channels", nil, []string{"kind", "endpoint", "token"}, false})
+	register(spec{"containr_notification_channels_test", "Send a test notification through a push channel. Args: id.", "POST", "/notifications/channels/{id}/test", []string{"id"}, nil, false})
+	register(spec{"containr_notification_channels_delete", "Delete a push notification channel. Args: id. Requires confirm=true.", "DELETE", "/notifications/channels/{id}", []string{"id"}, nil, true})
 
 	register(spec{"containr_webhooks_list", "List outbound webhooks", "GET", "/webhooks", nil, nil, false})
 	register(spec{"containr_webhooks_create", "Create an outbound webhook. Args: name, url, events (list, e.g. [\"service.*\",\"*\"]), secret (auto-generated if omitted), headers, enabled.", "POST", "/webhooks", nil, []string{"name", "url", "events", "secret", "headers", "enabled"}, false})
@@ -173,11 +183,12 @@ func init() {
 	register(spec{"containr_nodes_get", "Get a node agent (admin)", "GET", "/agents/{id}", []string{"id"}, nil, false})
 	register(spec{"containr_agent_tokens_issue", "Issue an agent onboarding token (admin). Args: label.", "POST", "/agent-tokens", nil, []string{"label"}, false})
 	register(spec{"containr_agent_tokens_list", "List agent onboarding tokens (admin)", "GET", "/agent-tokens", nil, nil, false})
-	register(spec{"containr_nodes_update", "Update a node agent (admin). Args: id; optional auto_prune, name.", "PUT", "/agents/{id}", []string{"id"}, []string{"auto_prune", "name"}, false})
+	register(spec{"containr_nodes_update", "Update a node agent (admin). Args: id; optional auto_prune, name, tags (string array — placement labels services can require via placement_tags; [] clears), default_domain (base domain — services placed on this node with no explicit domains get <name>.<default_domain>; empty clears).", "PUT", "/agents/{id}", []string{"id"}, []string{"auto_prune", "name", "tags", "default_domain"}, false})
 	register(spec{"containr_nodes_cordon", "Cordon a node: blocks new pins and 'auto' placements; running replicas stay (admin). Args: id.", "POST", "/agents/{id}/cordon", []string{"id"}, nil, false})
 	register(spec{"containr_nodes_uncordon", "Re-open a node for placement (admin). Args: id.", "POST", "/agents/{id}/uncordon", []string{"id"}, nil, false})
 	register(spec{"containr_nodes_drain", "Drain a node: cordon + remove all service containers via the agent + unpin affected services so they redeploy locally. Requires the node online (admin). Args: id.", "POST", "/agents/{id}/drain", []string{"id"}, nil, true})
 	register(spec{"containr_nodes_prune", "Enqueue a bounded docker system prune on a node (admin). Args: id; optional until (e.g. 168h), volumes (danger, off by default).", "POST", "/agents/{id}/prune", []string{"id"}, []string{"until", "volumes"}, true})
+	register(spec{"containr_nodes_upgrade", "Upgrade a node's agent to the server's bundled binary: downloads over the API, verifies sha256, swaps atomically, re-execs. Node must be online (admin). Args: id.", "POST", "/agents/{id}/upgrade", []string{"id"}, nil, true})
 	register(spec{"containr_nodes_commands", "List recent commands sent to a node agent (admin). Args: id.", "GET", "/agents/{id}/commands", []string{"id"}, nil, false})
 
 	// Scaling / HA / security

app/backend/internal/metrics/storage.go

@@ -4,293 +4,286 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
+	"strconv"
 	"sync"
 	"time"
 
+	"containr/internal/database/sqlcdb"
+
 	_ "github.com/lib/pq"
 )
 
 // PostgreSQLMetricsStorage implements MetricsStorage using PostgreSQL
+// through sqlc-generated queries (sqlc/queries/metrics.sql).
+//
+// Per-container node metrics are deliberately not persisted: the
+// container_metrics table belongs to the container_instances model and
+// has no place for the node/container samples collected here. Node and
+// service/instance rows map cleanly, so those are stored.
 type PostgreSQLMetricsStorage struct {
-	db *sql.DB
+	q *sqlcdb.Queries
 }
 
 // NewPostgreSQLMetricsStorage creates a new PostgreSQL metrics storage
 func NewPostgreSQLMetricsStorage(db *sql.DB) *PostgreSQLMetricsStorage {
-	return &PostgreSQLMetricsStorage{db: db}
+	return &PostgreSQLMetricsStorage{q: sqlcdb.New(db)}
 }
 
+func numStr(v float64) sql.NullString {
+	return sql.NullString{String: strconv.FormatFloat(v, 'f', -1, 64), Valid: true}
+}
+
+func int64N(v int64) sql.NullInt64 {
+	return sql.NullInt64{Int64: v, Valid: true}
+}
+
+func int32N(v int64) sql.NullInt32 {
+	return sql.NullInt32{Int32: int32(v), Valid: true}
+}
+
+func strN(v string) sql.NullString {
+	return sql.NullString{String: v, Valid: v != ""}
+}
+
+func timeN(t time.Time) sql.NullTime {
+	return sql.NullTime{Time: t, Valid: !t.IsZero()}
+}
+
+func f64v(n sql.NullString) float64 {
+	f, _ := strconv.ParseFloat(n.String, 64)
+	return f
+}
+
+func i64v(n sql.NullInt64) int64 { return n.Int64 }
+
+func i32v(n sql.NullInt32) int64 { return int64(n.Int32) }
+
 // StoreNodeMetrics stores node metrics in the database
 func (s *PostgreSQLMetricsStorage) StoreNodeMetrics(ctx context.Context, metrics *NodeMetrics) error {
-	query := `
-		INSERT INTO node_metrics (
-			node_id, timestamp, cpu_usage, cpu_cores, load_avg_1, load_avg_5, load_avg_15,
-			memory_total, memory_used, memory_available, memory_usage_percent,
-			storage_total, storage_used, storage_available, storage_usage_percent,
-			network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
-			network_connections_in, network_connections_out, network_errors_in, network_errors_out,
-			uptime, processes, os, kernel, architecture
-		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28)
-		ON CONFLICT (node_id, timestamp) DO UPDATE SET
-			cpu_usage = EXCLUDED.cpu_usage,
-			cpu_cores = EXCLUDED.cpu_cores,
-			load_avg_1 = EXCLUDED.load_avg_1,
-			load_avg_5 = EXCLUDED.load_avg_5,
-			load_avg_15 = EXCLUDED.load_avg_15,
-			memory_total = EXCLUDED.memory_total,
-			memory_used = EXCLUDED.memory_used,
-			memory_available = EXCLUDED.memory_available,
-			memory_usage_percent = EXCLUDED.memory_usage_percent,
-			storage_total = EXCLUDED.storage_total,
-			storage_used = EXCLUDED.storage_used,
-			storage_available = EXCLUDED.storage_available,
-			storage_usage_percent = EXCLUDED.storage_usage_percent,
-			network_bytes_in = EXCLUDED.network_bytes_in,
-			network_bytes_out = EXCLUDED.network_bytes_out,
-			network_packets_in = EXCLUDED.network_packets_in,
-			network_packets_out = EXCLUDED.network_packets_out,
-			network_connections_in = EXCLUDED.network_connections_in,
-			network_connections_out = EXCLUDED.network_connections_out,
-			network_errors_in = EXCLUDED.network_errors_in,
-			network_errors_out = EXCLUDED.network_errors_out,
-			uptime = EXCLUDED.uptime,
-			processes = EXCLUDED.processes,
-			os = EXCLUDED.os,
-			kernel = EXCLUDED.kernel,
-			architecture = EXCLUDED.architecture
-	`
-
-	_, err := s.db.ExecContext(ctx, query,
-		metrics.NodeID, metrics.Timestamp, metrics.CPU.UsagePercent, metrics.CPU.UsageCores,
-		metrics.CPU.LoadAverage1, metrics.CPU.LoadAverage5, metrics.CPU.LoadAverage15,
-		metrics.Memory.Total, metrics.Memory.Used, metrics.Memory.Available, metrics.Memory.UsagePercent,
-		metrics.Storage.Total, metrics.Storage.Used, metrics.Storage.Available, metrics.Storage.UsagePercent,
-		metrics.Network.BytesIn, metrics.Network.BytesOut, metrics.Network.PacketsIn, metrics.Network.PacketsOut,
-		metrics.Network.ConnectionsIn, metrics.Network.ConnectionsOut, metrics.Network.ErrorsIn, metrics.Network.ErrorsOut,
-		metrics.System.Uptime, metrics.System.Processes, metrics.System.OS, metrics.System.Kernel, metrics.System.Architecture,
-	)
-
+	err := s.q.UpsertNodeMetrics(ctx, sqlcdb.UpsertNodeMetricsParams{
+		NodeID:                metrics.NodeID,
+		Timestamp:             metrics.Timestamp,
+		CpuUsage:              numStr(metrics.CPU.UsagePercent),
+		CpuCores:              numStr(metrics.CPU.UsageCores),
+		LoadAvg1:              numStr(metrics.CPU.LoadAverage1),
+		LoadAvg5:              numStr(metrics.CPU.LoadAverage5),
+		LoadAvg15:             numStr(metrics.CPU.LoadAverage15),
+		MemoryTotal:           int64N(metrics.Memory.Total),
+		MemoryUsed:            int64N(metrics.Memory.Used),
+		MemoryAvailable:       int64N(metrics.Memory.Available),
+		MemoryUsagePercent:    numStr(metrics.Memory.UsagePercent),
+		StorageTotal:          int64N(metrics.Storage.Total),
+		StorageUsed:           int64N(metrics.Storage.Used),
+		StorageAvailable:      int64N(metrics.Storage.Available),
+		StorageUsagePercent:   numStr(metrics.Storage.UsagePercent),
+		NetworkBytesIn:        int64N(metrics.Network.BytesIn),
+		NetworkBytesOut:       int64N(metrics.Network.BytesOut),
+		NetworkPacketsIn:      int64N(metrics.Network.PacketsIn),
+		NetworkPacketsOut:     int64N(metrics.Network.PacketsOut),
+		NetworkConnectionsIn:  int32N(metrics.Network.ConnectionsIn),
+		NetworkConnectionsOut: int32N(metrics.Network.ConnectionsOut),
+		NetworkErrorsIn:       int64N(metrics.Network.ErrorsIn),
+		NetworkErrorsOut:      int64N(metrics.Network.ErrorsOut),
+		// INTERVAL param — Postgres casts the bigint as seconds.
+		Uptime:       int64N(int64(metrics.System.Uptime.Seconds())),
+		Processes:    sql.NullInt32{Int32: int32(metrics.System.Processes), Valid: true},
+		Os:           strN(metrics.System.OS),
+		Kernel:       strN(metrics.System.Kernel),
+		Architecture: strN(metrics.System.Architecture),
+	})
 	if err != nil {
 		return fmt.Errorf("failed to store node metrics: %w", err)
 	}
-
-	// Store container metrics
-	for _, container := range metrics.Containers {
-		if err := s.storeContainerMetrics(ctx, metrics.NodeID, metrics.Timestamp, container); err != nil {
-			return fmt.Errorf("failed to store container metrics: %w", err)
-		}
-	}
-
 	return nil
 }
 
 // StoreServiceMetrics stores service metrics in the database
 func (s *PostgreSQLMetricsStorage) StoreServiceMetrics(ctx context.Context, metrics *ServiceMetrics) error {
-	query := `
-		INSERT INTO service_metrics (
-			service_id, service_name, project_id, timestamp,
-			requests_total, requests_success, requests_errors, requests_avg_latency,
-			requests_p95_latency, requests_p99_latency, requests_throughput,
-			errors_total, errors_rate, performance_response_time, performance_throughput,
-			performance_concurrency, performance_saturation, performance_utilization,
-			resource_cpu_usage, resource_memory_usage, resource_storage_usage,
-			resource_network_usage, resource_score
-		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23)
-		ON CONFLICT (service_id, timestamp) DO UPDATE SET
-			requests_total = EXCLUDED.requests_total,
-			requests_success = EXCLUDED.requests_success,
-			requests_errors = EXCLUDED.requests_errors,
-			requests_avg_latency = EXCLUDED.requests_avg_latency,
-			requests_p95_latency = EXCLUDED.requests_p95_latency,
-			requests_p99_latency = EXCLUDED.requests_p99_latency,
-			requests_throughput = EXCLUDED.requests_throughput,
-			errors_total = EXCLUDED.errors_total,
-			errors_rate = EXCLUDED.errors_rate,
-			performance_response_time = EXCLUDED.performance_response_time,
-			performance_throughput = EXCLUDED.performance_throughput,
-			performance_concurrency = EXCLUDED.performance_concurrency,
-			performance_saturation = EXCLUDED.performance_saturation,
-			performance_utilization = EXCLUDED.performance_utilization,
-			resource_cpu_usage = EXCLUDED.resource_cpu_usage,
-			resource_memory_usage = EXCLUDED.resource_memory_usage,
-			resource_storage_usage = EXCLUDED.resource_storage_usage,
-			resource_network_usage = EXCLUDED.resource_network_usage,
-			resource_score = EXCLUDED.resource_score
-	`
-
-	_, err := s.db.ExecContext(ctx, query,
-		metrics.ServiceID, metrics.ServiceName, metrics.ProjectID, metrics.Timestamp,
-		metrics.Requests.Total, metrics.Requests.Success, metrics.Requests.Errors,
-		metrics.Requests.AvgLatency, metrics.Requests.P95Latency, metrics.Requests.P99Latency,
-		metrics.Requests.Throughput, metrics.Errors.Total, metrics.Errors.Rate,
-		metrics.Performance.ResponseTime, metrics.Performance.Throughput,
-		metrics.Performance.Concurrency, metrics.Performance.Saturation, metrics.Performance.Utilization,
-		metrics.Resources.CPUUsage, metrics.Resources.MemoryUsage, metrics.Resources.StorageUsage,
-		metrics.Resources.NetworkUsage, metrics.Resources.ResourceScore,
-	)
-
+	err := s.q.UpsertServiceMetrics(ctx, sqlcdb.UpsertServiceMetricsParams{
+		ServiceID:               metrics.ServiceID,
+		ServiceName:             metrics.ServiceName,
+		ProjectID:               metrics.ProjectID,
+		Timestamp:               metrics.Timestamp,
+		RequestsTotal:           int64N(metrics.Requests.Total),
+		RequestsSuccess:         int64N(metrics.Requests.Success),
+		RequestsErrors:          int64N(metrics.Requests.Errors),
+		RequestsAvgLatency:      numStr(metrics.Requests.AvgLatency),
+		RequestsP95Latency:      numStr(metrics.Requests.P95Latency),
+		RequestsP99Latency:      numStr(metrics.Requests.P99Latency),
+		RequestsThroughput:      numStr(metrics.Requests.Throughput),
+		ErrorsTotal:             int64N(metrics.Errors.Total),
+		ErrorsRate:              numStr(metrics.Errors.Rate),
+		PerformanceResponseTime: numStr(metrics.Performance.ResponseTime),
+		PerformanceThroughput:   numStr(metrics.Performance.Throughput),
+		PerformanceConcurrency:  int64N(metrics.Performance.Concurrency),
+		PerformanceSaturation:   numStr(metrics.Performance.Saturation),
+		PerformanceUtilization:  numStr(metrics.Performance.Utilization),
+		ResourceCpuUsage:        numStr(metrics.Resources.CPUUsage),
+		ResourceMemoryUsage:     int64N(metrics.Resources.MemoryUsage),
+		ResourceStorageUsage:    int64N(metrics.Resources.StorageUsage),
+		ResourceNetworkUsage:    int64N(metrics.Resources.NetworkUsage),
+		ResourceScore:           numStr(metrics.Resources.ResourceScore),
+	})
 	if err != nil {
 		return fmt.Errorf("failed to store service metrics: %w", err)
 	}
 
-	// Store instance metrics
+	// The service row must land first — instance_metrics references
+	// service_metrics(service_id, timestamp).
 	for _, instance := range metrics.Instances {
 		if err := s.storeInstanceMetrics(ctx, metrics.ServiceID, metrics.Timestamp, instance); err != nil {
 			return fmt.Errorf("failed to store instance metrics: %w", err)
 		}
 	}
-
 	return nil
 }
 
 // GetNodeMetrics retrieves node metrics from the database
 func (s *PostgreSQLMetricsStorage) GetNodeMetrics(ctx context.Context, nodeID string, from, to time.Time) ([]*NodeMetrics, error) {
-	query := `
-		SELECT node_id, timestamp, cpu_usage, cpu_cores, load_avg_1, load_avg_5, load_avg_15,
-			   memory_total, memory_used, memory_available, memory_usage_percent,
-			   storage_total, storage_used, storage_available, storage_usage_percent,
-			   network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
-			   network_connections_in, network_connections_out, network_errors_in, network_errors_out,
-			   uptime, processes, os, kernel, architecture
-		FROM node_metrics
-		WHERE node_id = $1 AND timestamp BETWEEN $2 AND $3
-		ORDER BY timestamp ASC
-	`
-
-	rows, err := s.db.QueryContext(ctx, query, nodeID, from, to)
+	rows, err := s.q.ListNodeMetrics(ctx, sqlcdb.ListNodeMetricsParams{
+		NodeID:      nodeID,
+		Timestamp:   from,
+		Timestamp_2: to,
+	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to query node metrics: %w", err)
 	}
-	defer rows.Close()
 
 	var metrics []*NodeMetrics
-	for rows.Next() {
-		var m NodeMetrics
-		err := rows.Scan(
-			&m.NodeID, &m.Timestamp, &m.CPU.UsagePercent, &m.CPU.UsageCores,
-			&m.CPU.LoadAverage1, &m.CPU.LoadAverage5, &m.CPU.LoadAverage15,
-			&m.Memory.Total, &m.Memory.Used, &m.Memory.Available, &m.Memory.UsagePercent,
-			&m.Storage.Total, &m.Storage.Used, &m.Storage.Available, &m.Storage.UsagePercent,
-			&m.Network.BytesIn, &m.Network.BytesOut, &m.Network.PacketsIn, &m.Network.PacketsOut,
-			&m.Network.ConnectionsIn, &m.Network.ConnectionsOut, &m.Network.ErrorsIn, &m.Network.ErrorsOut,
-			&m.System.Uptime, &m.System.Processes, &m.System.OS, &m.System.Kernel, &m.System.Architecture,
-		)
-		if err != nil {
-			return nil, fmt.Errorf("failed to scan node metrics: %w", err)
+	for _, r := range rows {
+		metrics = append(metrics, &NodeMetrics{
+			NodeID:    r.NodeID,
+			Timestamp: r.Timestamp,
+			CPU: CPUMetrics{
+				UsagePercent:  f64v(r.CpuUsage),
+				UsageCores:    f64v(r.CpuCores),
+				LoadAverage1:  f64v(r.LoadAvg1),
+				LoadAverage5:  f64v(r.LoadAvg5),
+				LoadAverage15: f64v(r.LoadAvg15),
+			},
+			Memory: MemoryMetrics{
+				Total:        i64v(r.MemoryTotal),
+				Used:         i64v(r.MemoryUsed),
+				Available:    i64v(r.MemoryAvailable),
+				UsagePercent: f64v(r.MemoryUsagePercent),
+			},
+			Storage: StorageMetrics{
+				Total:        i64v(r.StorageTotal),
+				Used:         i64v(r.StorageUsed),
+				Available:    i64v(r.StorageAvailable),
+				UsagePercent: f64v(r.StorageUsagePercent),
+			},
+			Network: NetworkMetrics{
+				BytesIn:        i64v(r.NetworkBytesIn),
+				BytesOut:       i64v(r.NetworkBytesOut),
+				PacketsIn:      i64v(r.NetworkPacketsIn),
+				PacketsOut:     i64v(r.NetworkPacketsOut),
+				ConnectionsIn:  i32v(r.NetworkConnectionsIn),
+				ConnectionsOut: i32v(r.NetworkConnectionsOut),
+				ErrorsIn:       i64v(r.NetworkErrorsIn),
+				ErrorsOut:      i64v(r.NetworkErrorsOut),
+			},
+			System: SystemMetrics{
+				Uptime:       time.Duration(r.UptimeSeconds) * time.Second,
+				Processes:    int(r.Processes.Int32),
+				OS:           r.Os.String,
+				Kernel:       r.Kernel.String,
+				Architecture: r.Architecture.String,
+			},
+		})
 	}
-
-		// Get container metrics for this timestamp
-		containers, err := s.getContainerMetrics(ctx, nodeID, m.Timestamp)
-		if err != nil {
-			return nil, fmt.Errorf("failed to get container metrics: %w", err)
-		}
-		m.Containers = containers
-
-		metrics = append(metrics, &m)
-	}
-
 	return metrics, nil
 }
 
 // GetServiceMetrics retrieves service metrics from the database
 func (s *PostgreSQLMetricsStorage) GetServiceMetrics(ctx context.Context, serviceID string, from, to time.Time) ([]*ServiceMetrics, error) {
-	query := `
-		SELECT service_id, service_name, project_id, timestamp,
-			   requests_total, requests_success, requests_errors, requests_avg_latency,
-			   requests_p95_latency, requests_p99_latency, requests_throughput,
-			   errors_total, errors_rate, performance_response_time, performance_throughput,
-			   performance_concurrency, performance_saturation, performance_utilization,
-			   resource_cpu_usage, resource_memory_usage, resource_storage_usage,
-			   resource_network_usage, resource_score
-		FROM service_metrics
-		WHERE service_id = $1 AND timestamp BETWEEN $2 AND $3
-		ORDER BY timestamp ASC
-	`
-
-	rows, err := s.db.QueryContext(ctx, query, serviceID, from, to)
+	rows, err := s.q.ListServiceMetrics(ctx, sqlcdb.ListServiceMetricsParams{
+		ServiceID:   serviceID,
+		Timestamp:   from,
+		Timestamp_2: to,
+	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to query service metrics: %w", err)
 	}
-	defer rows.Close()
 
 	var metrics []*ServiceMetrics
-	for rows.Next() {
-		var m ServiceMetrics
-		err := rows.Scan(
-			&m.ServiceID, &m.ServiceName, &m.ProjectID, &m.Timestamp,
-			&m.Requests.Total, &m.Requests.Success, &m.Requests.Errors,
-			&m.Requests.AvgLatency, &m.Requests.P95Latency, &m.Requests.P99Latency,
-			&m.Requests.Throughput, &m.Errors.Total, &m.Errors.Rate,
-			&m.Performance.ResponseTime, &m.Performance.Throughput,
-			&m.Performance.Concurrency, &m.Performance.Saturation, &m.Performance.Utilization,
-			&m.Resources.CPUUsage, &m.Resources.MemoryUsage, &m.Resources.StorageUsage,
-			&m.Resources.NetworkUsage, &m.Resources.ResourceScore,
-		)
-		if err != nil {
-			return nil, fmt.Errorf("failed to scan service metrics: %w", err)
+	for _, r := range rows {
+		m := &ServiceMetrics{
+			ServiceID:   r.ServiceID,
+			ServiceName: r.ServiceName,
+			ProjectID:   r.ProjectID,
+			Timestamp:   r.Timestamp,
+			Requests: RequestMetrics{
+				Total:      i64v(r.RequestsTotal),
+				Success:    i64v(r.RequestsSuccess),
+				Errors:     i64v(r.RequestsErrors),
+				AvgLatency: f64v(r.RequestsAvgLatency),
+				P95Latency: f64v(r.RequestsP95Latency),
+				P99Latency: f64v(r.RequestsP99Latency),
+				Throughput: f64v(r.RequestsThroughput),
+			},
+			Errors: ErrorMetrics{
+				Total: i64v(r.ErrorsTotal),
+				Rate:  f64v(r.ErrorsRate),
+			},
+			Performance: PerformanceMetrics{
+				ResponseTime: f64v(r.PerformanceResponseTime),
+				Throughput:   f64v(r.PerformanceThroughput),
+				Concurrency:  i64v(r.PerformanceConcurrency),
+				Saturation:   f64v(r.PerformanceSaturation),
+				Utilization:  f64v(r.PerformanceUtilization),
+			},
+			Resources: ResourceMetrics{
+				CPUUsage:      f64v(r.ResourceCpuUsage),
+				MemoryUsage:   i64v(r.ResourceMemoryUsage),
+				StorageUsage:  i64v(r.ResourceStorageUsage),
+				NetworkUsage:  i64v(r.ResourceNetworkUsage),
+				ResourceScore: f64v(r.ResourceScore),
+			},
 		}
 
-		// Get instance metrics for this timestamp
-		instances, err := s.getInstanceMetrics(ctx, serviceID, m.Timestamp)
+		instances, err := s.getInstanceMetrics(ctx, serviceID, r.Timestamp)
 		if err != nil {
 			return nil, fmt.Errorf("failed to get instance metrics: %w", err)
 		}
 		m.Instances = instances
-
-		metrics = append(metrics, &m)
+		metrics = append(metrics, m)
 	}
-
 	return metrics, nil
 }
 
-// GetAggregatedMetrics retrieves aggregated metrics based on a query
+// GetAggregatedMetrics retrieves aggregated metrics based on a query.
+// Bucketing uses date_bin (PostgreSQL 14+) — no TimescaleDB needed.
 func (s *PostgreSQLMetricsStorage) GetAggregatedMetrics(ctx context.Context, query MetricsQuery) (*AggregatedMetrics, error) {
-	// This is a simplified implementation
-	// In a real system, you'd build dynamic SQL based on the query
-
 	var timeSeries []TimeSeriesPoint
 	var summary map[string]MetricSummary
 
 	switch query.Type {
 	case "node":
-		// Aggregate node metrics
-		nodeQuery := `
-			SELECT 
-				time_bucket($1, timestamp) AS bucket,
-				AVG(cpu_usage) as avg_cpu,
-				AVG(memory_usage_percent) as avg_memory,
-				AVG(storage_usage_percent) as avg_storage
-			FROM node_metrics
-			WHERE node_id = $2 AND timestamp BETWEEN $3 AND $4
-			GROUP BY bucket
-			ORDER BY bucket ASC
-		`
-
-		rows, err := s.db.QueryContext(ctx, nodeQuery, query.Interval, query.ID, query.From, query.To)
+		seconds := int64(query.Interval.Seconds())
+		if seconds <= 0 {
+			seconds = 300
+		}
+		rows, err := s.q.AggregateNodeMetrics(ctx, sqlcdb.AggregateNodeMetricsParams{
+			Column1:     seconds,
+			NodeID:      query.ID,
+			Timestamp:   query.From,
+			Timestamp_2: query.To,
+		})
 		if err != nil {
 			return nil, fmt.Errorf("failed to query aggregated node metrics: %w", err)
 		}
-		defer rows.Close()
-
-		for rows.Next() {
-			var bucket time.Time
-			var avgCPU, avgMemory, avgStorage float64
-			if err := rows.Scan(&bucket, &avgCPU, &avgMemory, &avgStorage); err != nil {
-				return nil, fmt.Errorf("failed to scan aggregated metrics: %w", err)
-			}
-
-			point := TimeSeriesPoint{
+		for _, r := range rows {
+			bucket, _ := r.Bucket.(time.Time)
+			timeSeries = append(timeSeries, TimeSeriesPoint{
 				Timestamp: bucket,
 				Values: map[string]float64{
-					"cpu_usage":     avgCPU,
-					"memory_usage":  avgMemory,
-					"storage_usage": avgStorage,
+					"cpu_usage":     r.AvgCpu,
+					"memory_usage":  r.AvgMemory,
+					"storage_usage": r.AvgStorage,
 				},
+			})
 		}
-			timeSeries = append(timeSeries, point)
-		}
-
-		// Calculate summary statistics
 		summary = map[string]MetricSummary{
 			"cpu_usage":     calculateSummary(timeSeries, "cpu_usage"),
 			"memory_usage":  calculateSummary(timeSeries, "memory_usage"),
@@ -305,137 +298,69 @@ func (s *PostgreSQLMetricsStorage) GetAggregatedMetrics(ctx context.Context, que
 	}, nil
 }
 
-// Helper methods
-
-func (s *PostgreSQLMetricsStorage) storeContainerMetrics(ctx context.Context, nodeID string, timestamp time.Time, container ContainerMetrics) error {
-	query := `
-		INSERT INTO container_metrics (
-			node_id, timestamp, container_id, name, state, cpu, memory,
-			network_bytes_in, network_bytes_out, network_packets_in, network_packets_out, start_time
-		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
-		ON CONFLICT (node_id, timestamp, container_id) DO UPDATE SET
-			name = EXCLUDED.name,
-			state = EXCLUDED.state,
-			cpu = EXCLUDED.cpu,
-			memory = EXCLUDED.memory,
-			network_bytes_in = EXCLUDED.network_bytes_in,
-			network_bytes_out = EXCLUDED.network_bytes_out,
-			network_packets_in = EXCLUDED.network_packets_in,
-			network_packets_out = EXCLUDED.network_packets_out,
-			start_time = EXCLUDED.start_time
-	`
-
-	_, err := s.db.ExecContext(ctx, query,
-		nodeID, timestamp, container.ContainerID, container.Name, container.State,
-		container.CPU, container.Memory, container.Network.BytesIn, container.Network.BytesOut,
-		container.Network.PacketsIn, container.Network.PacketsOut, container.StartTime,
-	)
-
-	return err
-}
-
 func (s *PostgreSQLMetricsStorage) storeInstanceMetrics(ctx context.Context, serviceID string, timestamp time.Time, instance InstanceMetrics) error {
-	query := `
-		INSERT INTO instance_metrics (
-			service_id, timestamp, instance_id, node_id, status, cpu, memory,
-			network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
-			network_connections_in, network_connections_out, network_errors_in, network_errors_out,
-			start_time, last_seen, health_status, health_last_check, health_check_count, health_failure_count
-		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21)
-		ON CONFLICT (service_id, timestamp, instance_id) DO UPDATE SET
-			node_id = EXCLUDED.node_id,
-			status = EXCLUDED.status,
-			cpu = EXCLUDED.cpu,
-			memory = EXCLUDED.memory,
-			network_bytes_in = EXCLUDED.network_bytes_in,
-			network_bytes_out = EXCLUDED.network_bytes_out,
-			network_packets_in = EXCLUDED.network_packets_in,
-			network_packets_out = EXCLUDED.network_packets_out,
-			network_connections_in = EXCLUDED.network_connections_in,
-			network_connections_out = EXCLUDED.network_connections_out,
-			network_errors_in = EXCLUDED.network_errors_in,
-			network_errors_out = EXCLUDED.network_errors_out,
-			start_time = EXCLUDED.start_time,
-			last_seen = EXCLUDED.last_seen,
-			health_status = EXCLUDED.health_status,
-			health_last_check = EXCLUDED.health_last_check,
-			health_check_count = EXCLUDED.health_check_count,
-			health_failure_count = EXCLUDED.health_failure_count
-	`
-
-	_, err := s.db.ExecContext(ctx, query,
-		serviceID, timestamp, instance.InstanceID, instance.NodeID, instance.Status,
-		instance.CPU, instance.Memory, instance.Network.BytesIn, instance.Network.BytesOut,
-		instance.Network.PacketsIn, instance.Network.PacketsOut, instance.Network.ConnectionsIn,
-		instance.Network.ConnectionsOut, instance.Network.ErrorsIn, instance.Network.ErrorsOut,
-		instance.StartTime, instance.LastSeen, instance.Health.Status, instance.Health.LastCheck,
-		instance.Health.CheckCount, instance.Health.FailureCount,
-	)
-
-	return err
-}
-
-func (s *PostgreSQLMetricsStorage) getContainerMetrics(ctx context.Context, nodeID string, timestamp time.Time) ([]ContainerMetrics, error) {
-	query := `
-		SELECT container_id, name, state, cpu, memory,
-			   network_bytes_in, network_bytes_out, network_packets_in, network_packets_out, start_time
-		FROM container_metrics
-		WHERE node_id = $1 AND timestamp = $2
-	`
-
-	rows, err := s.db.QueryContext(ctx, query, nodeID, timestamp)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-
-	var containers []ContainerMetrics
-	for rows.Next() {
-		var c ContainerMetrics
-		err := rows.Scan(
-			&c.ContainerID, &c.Name, &c.State, &c.CPU, &c.Memory,
-			&c.Network.BytesIn, &c.Network.BytesOut, &c.Network.PacketsIn, &c.Network.PacketsOut, &c.StartTime,
-		)
-		if err != nil {
-			return nil, err
-		}
-		containers = append(containers, c)
-	}
-
-	return containers, nil
+	return s.q.UpsertInstanceMetrics(ctx, sqlcdb.UpsertInstanceMetricsParams{
+		ServiceID:             serviceID,
+		Timestamp:             timestamp,
+		InstanceID:            instance.InstanceID,
+		NodeID:                strN(instance.NodeID),
+		Status:                strN(instance.Status),
+		Cpu:                   numStr(instance.CPU),
+		Memory:                int64N(instance.Memory),
+		NetworkBytesIn:        int64N(instance.Network.BytesIn),
+		NetworkBytesOut:       int64N(instance.Network.BytesOut),
+		NetworkPacketsIn:      int64N(instance.Network.PacketsIn),
+		NetworkPacketsOut:     int64N(instance.Network.PacketsOut),
+		NetworkConnectionsIn:  int32N(instance.Network.ConnectionsIn),
+		NetworkConnectionsOut: int32N(instance.Network.ConnectionsOut),
+		NetworkErrorsIn:       int64N(instance.Network.ErrorsIn),
+		NetworkErrorsOut:      int64N(instance.Network.ErrorsOut),
+		StartTime:             timeN(instance.StartTime),
+		LastSeen:              timeN(instance.LastSeen),
+		HealthStatus:          strN(instance.Health.Status),
+		HealthLastCheck:       timeN(instance.Health.LastCheck),
+		HealthCheckCount:      sql.NullInt32{Int32: int32(instance.Health.CheckCount), Valid: true},
+		HealthFailureCount:    sql.NullInt32{Int32: int32(instance.Health.FailureCount), Valid: true},
+	})
 }
 
 func (s *PostgreSQLMetricsStorage) getInstanceMetrics(ctx context.Context, serviceID string, timestamp time.Time) ([]InstanceMetrics, error) {
-	query := `
-		SELECT instance_id, node_id, status, cpu, memory,
-			   network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
-			   network_connections_in, network_connections_out, network_errors_in, network_errors_out,
-			   start_time, last_seen, health_status, health_last_check, health_check_count, health_failure_count
-		FROM instance_metrics
-		WHERE service_id = $1 AND timestamp = $2
-	`
-
-	rows, err := s.db.QueryContext(ctx, query, serviceID, timestamp)
+	rows, err := s.q.ListInstanceMetrics(ctx, sqlcdb.ListInstanceMetricsParams{
+		ServiceID: serviceID,
+		Timestamp: timestamp,
+	})
 	if err != nil {
 		return nil, err
 	}
-	defer rows.Close()
 
 	var instances []InstanceMetrics
-	for rows.Next() {
-		var i InstanceMetrics
-		err := rows.Scan(
-			&i.InstanceID, &i.NodeID, &i.Status, &i.CPU, &i.Memory,
-			&i.Network.BytesIn, &i.Network.BytesOut, &i.Network.PacketsIn, &i.Network.PacketsOut,
-			&i.Network.ConnectionsIn, &i.Network.ConnectionsOut, &i.Network.ErrorsIn, &i.Network.ErrorsOut,
-			&i.StartTime, &i.LastSeen, &i.Health.Status, &i.Health.LastCheck, &i.Health.CheckCount, &i.Health.FailureCount,
-		)
-		if err != nil {
-			return nil, err
+	for _, r := range rows {
+		instances = append(instances, InstanceMetrics{
+			InstanceID: r.InstanceID,
+			NodeID:     r.NodeID.String,
+			Status:     r.Status.String,
+			CPU:        f64v(r.Cpu),
+			Memory:     i64v(r.Memory),
+			Network: NetworkMetrics{
+				BytesIn:        i64v(r.NetworkBytesIn),
+				BytesOut:       i64v(r.NetworkBytesOut),
+				PacketsIn:      i64v(r.NetworkPacketsIn),
+				PacketsOut:     i64v(r.NetworkPacketsOut),
+				ConnectionsIn:  i32v(r.NetworkConnectionsIn),
+				ConnectionsOut: i32v(r.NetworkConnectionsOut),
+				ErrorsIn:       i64v(r.NetworkErrorsIn),
+				ErrorsOut:      i64v(r.NetworkErrorsOut),
+			},
+			StartTime: r.StartTime.Time,
+			LastSeen:  r.LastSeen.Time,
+			Health: HealthMetrics{
+				Status:       r.HealthStatus.String,
+				LastCheck:    r.HealthLastCheck.Time,
+				CheckCount:   int(r.HealthCheckCount.Int32),
+				FailureCount: int(r.HealthFailureCount.Int32),
+			},
+		})
 	}
-		instances = append(instances, i)
-	}
-
 	return instances, nil
 }
 
@@ -544,7 +469,9 @@ func (s *InMemoryMetricsStorage) GetServiceMetrics(ctx context.Context, serviceI
 }
 
 func (s *InMemoryMetricsStorage) GetAggregatedMetrics(ctx context.Context, query MetricsQuery) (*AggregatedMetrics, error) {
-	// Simplified implementation
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
 	return &AggregatedMetrics{
 		Query:      query,
 		TimeSeries: []TimeSeriesPoint{},

app/backend/internal/metrics/storage_test.go

@@ -0,0 +1,130 @@
+package metrics
+
+import (
+	"context"
+	"database/sql"
+	"os"
+	"testing"
+	"time"
+)
+
+// Live round-trip against a real Postgres — set METRICS_TEST_DSN (or
+// DATABASE_URL) to enable. Skipped by default so unit runs stay hermetic.
+func testDSN(t *testing.T) *sql.DB {
+	t.Helper()
+	dsn := os.Getenv("METRICS_TEST_DSN")
+	if dsn == "" {
+		dsn = os.Getenv("DATABASE_URL")
+	}
+	if dsn == "" {
+		t.Skip("METRICS_TEST_DSN not set")
+	}
+	db, err := sql.Open("postgres", dsn)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	if err := db.PingContext(context.Background()); err != nil {
+		t.Fatalf("ping: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+	return db
+}
+
+func TestPostgresStorageRoundTrip(t *testing.T) {
+	db := testDSN(t)
+	s := NewPostgreSQLMetricsStorage(db)
+	ctx := context.Background()
+
+	ts := time.Now().UTC().Truncate(time.Second)
+	nodeID := "test-node-" + ts.Format("150405")
+	svcID := "test-svc-" + ts.Format("150405")
+
+	// Clean slate + teardown
+	db.ExecContext(ctx, `DELETE FROM instance_metrics WHERE service_id = $1`, svcID)
+	db.ExecContext(ctx, `DELETE FROM service_metrics WHERE service_id = $1`, svcID)
+	db.ExecContext(ctx, `DELETE FROM node_metrics WHERE node_id = $1`, nodeID)
+	t.Cleanup(func() {
+		db.ExecContext(ctx, `DELETE FROM instance_metrics WHERE service_id = $1`, svcID)
+		db.ExecContext(ctx, `DELETE FROM service_metrics WHERE service_id = $1`, svcID)
+		db.ExecContext(ctx, `DELETE FROM node_metrics WHERE node_id = $1`, nodeID)
+	})
+
+	node := &NodeMetrics{
+		NodeID:    nodeID,
+		Timestamp: ts,
+		CPU:       CPUMetrics{UsagePercent: 42.5, UsageCores: 1.7, LoadAverage1: 0.5, LoadAverage5: 0.4, LoadAverage15: 0.3},
+		Memory:    MemoryMetrics{Total: 16 << 30, Used: 8 << 30, Available: 8 << 30, UsagePercent: 50.0},
+		Storage:   StorageMetrics{Total: 100 << 30, Used: 40 << 30, Available: 60 << 30, UsagePercent: 40.0},
+		Network:   NetworkMetrics{BytesIn: 1000, BytesOut: 2000, PacketsIn: 10, PacketsOut: 20, ConnectionsIn: 3, ConnectionsOut: 4, ErrorsIn: 0, ErrorsOut: 1},
+		System:    SystemMetrics{Uptime: 3600 * time.Second, Processes: 120, OS: "linux", Kernel: "6.8", Architecture: "amd64"},
+	}
+	if err := s.StoreNodeMetrics(ctx, node); err != nil {
+		t.Fatalf("store node: %v", err)
+	}
+	// Upsert idempotent on the same key.
+	if err := s.StoreNodeMetrics(ctx, node); err != nil {
+		t.Fatalf("store node (repeat): %v", err)
+	}
+
+	svc := &ServiceMetrics{
+		ServiceID:   svcID,
+		ServiceName: "svc",
+		ProjectID:   "proj",
+		Timestamp:   ts,
+		Requests:    RequestMetrics{Total: 100, Success: 95, Errors: 5, AvgLatency: 12.5, P95Latency: 80, P99Latency: 120, Throughput: 3.3},
+		Errors:      ErrorMetrics{Total: 5, Rate: 0.05},
+		Performance: PerformanceMetrics{ResponseTime: 12.5, Throughput: 3.3, Concurrency: 2, Saturation: 0.4, Utilization: 0.55},
+		Resources:   ResourceMetrics{CPUUsage: 42.5, MemoryUsage: 512 << 20, StorageUsage: 1 << 30, NetworkUsage: 3000, ResourceScore: 0.7},
+		Instances: []InstanceMetrics{{
+			InstanceID: "inst-1",
+			NodeID:     nodeID,
+			Status:     "running",
+			CPU:        42.5,
+			Memory:     512 << 20,
+			Network:    NetworkMetrics{BytesIn: 1000, BytesOut: 2000},
+			StartTime:  ts.Add(-time.Hour),
+			LastSeen:   ts,
+			Health:     HealthMetrics{Status: "healthy", LastCheck: ts, CheckCount: 10, FailureCount: 0},
+		}},
+	}
+	if err := s.StoreServiceMetrics(ctx, svc); err != nil {
+		t.Fatalf("store service: %v", err)
+	}
+
+	from, to := ts.Add(-time.Minute), ts.Add(time.Minute)
+	gotNodes, err := s.GetNodeMetrics(ctx, nodeID, from, to)
+	if err != nil {
+		t.Fatalf("get nodes: %v", err)
+	}
+	if len(gotNodes) != 1 {
+		t.Fatalf("want 1 node row, got %d", len(gotNodes))
+	}
+	if got := gotNodes[0]; got.CPU.UsagePercent != 42.5 || got.System.Processes != 120 || got.System.Uptime != time.Hour {
+		t.Errorf("node round-trip mismatch: %+v", got)
+	}
+
+	gotSvcs, err := s.GetServiceMetrics(ctx, svcID, from, to)
+	if err != nil {
+		t.Fatalf("get services: %v", err)
+	}
+	if len(gotSvcs) != 1 {
+		t.Fatalf("want 1 service row, got %d", len(gotSvcs))
+	}
+	if gotSvcs[0].Requests.P99Latency != 120 {
+		t.Errorf("p99 mismatch: %v", gotSvcs[0].Requests.P99Latency)
+	}
+	if len(gotSvcs[0].Instances) != 1 || gotSvcs[0].Instances[0].Health.Status != "healthy" {
+		t.Errorf("instance join mismatch: %+v", gotSvcs[0].Instances)
+	}
+
+	agg, err := s.GetAggregatedMetrics(ctx, MetricsQuery{Type: "node", ID: nodeID, From: from, To: to, Interval: 5 * time.Minute})
+	if err != nil {
+		t.Fatalf("aggregate: %v", err)
+	}
+	if len(agg.TimeSeries) != 1 || agg.TimeSeries[0].Values["cpu_usage"] != 42.5 {
+		t.Errorf("aggregate mismatch: %+v", agg.TimeSeries)
+	}
+	if agg.Summary["cpu_usage"].Avg != 42.5 {
+		t.Errorf("summary mismatch: %+v", agg.Summary)
+	}
+}

app/backend/internal/source/source.go

@@ -0,0 +1,190 @@
+// Package source materializes git checkouts for builds. Services reference
+// a repository by URL (or owner/repo); deployments fetch the exact branch or
+// commit into an isolated workdir, then point the builders at build_path
+// inside it. Credentials travel through GIT_ASKPASS so tokens never land in
+// argv, .git/config, logs, or the build context.
+package source
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+// Spec describes one checkout.
+type Spec struct {
+	CloneURL  string // https URL (NormalizeCloneURL output); local paths allowed for tests
+	Branch    string // ref to fetch when Commit is empty
+	Commit    string // optional SHA pinned over Branch
+	BuildPath string // subdirectory inside the repo; "" or "." = repo root
+	Token     string // optional http credential
+	User      string // credential username; defaults per provider in ResolveUser
+}
+
+// NormalizeCloneURL converts the forms services store into an https clone
+// URL: ssh remotes (git@host:org/repo, ssh://git@host/org/repo) map onto
+// https so token auth works uniformly. A bare "owner/repo" is returned
+// unchanged — the caller resolves the host through git_repositories.
+func NormalizeCloneURL(raw string) (string, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return "", fmt.Errorf("empty repository reference")
+	}
+	// scp-style ssh remote: [email protected]:org/repo(.git)
+	if strings.HasPrefix(raw, "git@") && strings.Contains(raw, ":") {
+		host := raw[len("git@"):strings.Index(raw, ":")]
+		path := strings.TrimPrefix(raw[strings.Index(raw, ":")+1:], "/")
+		return "https://" + host + "/" + path, nil
+	}
+	if strings.HasPrefix(raw, "ssh://") {
+		u, err := url.Parse(raw)
+		if err != nil {
+			return "", fmt.Errorf("invalid ssh remote %q", raw)
+		}
+		return "https://" + u.Host + u.Path, nil
+	}
+	if strings.HasPrefix(raw, "http://") || strings.HasPrefix(raw, "https://") {
+		return raw, nil
+	}
+	if strings.Contains(raw, "://") {
+		return "", fmt.Errorf("unsupported repository scheme in %q", raw)
+	}
+	if strings.Count(raw, "/") == 1 && !strings.ContainsAny(raw, " @:") {
+		return raw, nil // owner/repo — resolved against git_repositories upstream
+	}
+	return "", fmt.Errorf("unsupported repository reference %q", raw)
+}
+
+// ValidateRemoteURL rejects non-http(s) clones before a deploy accepts them.
+// Local checkouts (tests, mounted workspaces) bypass this via Checkout.
+func ValidateRemoteURL(cloneURL string) error {
+	if strings.HasPrefix(cloneURL, "http://") || strings.HasPrefix(cloneURL, "https://") {
+		return nil
+	}
+	return fmt.Errorf("clone URL must be http(s), got %q", cloneURL)
+}
+
+// Checkout fetches spec into destDir/repo and returns the directory the
+// builders should consume (checkout root + build_path). Callers
+// RemoveAll(destDir) — the checkout is a per-deployment workspace, never
+// shared. The askpass helper lives outside repo so it can't leak into the
+// build context.
+func Checkout(ctx context.Context, destDir string, spec Spec) (string, error) {
+	repoDir := filepath.Join(destDir, "repo")
+	if err := os.MkdirAll(repoDir, 0o755); err != nil {
+		return "", err
+	}
+
+	env := append(os.Environ(), "GIT_TERMINAL_PROMPT=0")
+	if spec.Token != "" {
+		// Askpass keeps the token out of argv and .git/config.
+		askpass := filepath.Join(destDir, ".git-askpass")
+		script := "#!/bin/sh\ncase \"$1\" in\n*sername*) printf '%s' \"$CONTAINR_GIT_USER\" ;;\n*) printf '%s' \"$CONTAINR_GIT_TOKEN\" ;;\nesac\n"
+		if err := os.WriteFile(askpass, []byte(script), 0o700); err != nil {
+			return "", fmt.Errorf("write askpass: %w", err)
+		}
+		user := spec.User
+		if user == "" {
+			user = "x-access-token"
+		}
+		env = append(env,
+			"GIT_ASKPASS="+askpass,
+			"CONTAINR_GIT_USER="+user,
+			"CONTAINR_GIT_TOKEN="+spec.Token,
+		)
+	}
+
+	run := func(args ...string) error {
+		cmd := exec.CommandContext(ctx, "git", args...)
+		cmd.Dir = repoDir
+		cmd.Env = env
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("git %s: %s", args[0], strings.TrimSpace(string(out)))
+		}
+		return nil
+	}
+
+	if err := run("init", "-q"); err != nil {
+		return "", err
+	}
+	if err := run("remote", "add", "origin", spec.CloneURL); err != nil {
+		return "", err
+	}
+
+	ref := spec.Commit
+	if ref == "" {
+		ref = spec.Branch
+	}
+	if ref == "" {
+		ref = "HEAD"
+	}
+	// Cheap path first, widening on failure: dumb transports reject
+	// --depth outright, and some hosts refuse direct SHA fetches so a
+	// pinned commit may only be reachable through its branch.
+	attempts := [][]string{
+		{"fetch", "--depth", "1", "origin", ref},
+		{"fetch", "origin", ref},
+	}
+	if spec.Commit != "" {
+		branchRef := spec.Branch
+		if branchRef == "" {
+			branchRef = "HEAD"
+		}
+		attempts = append(attempts,
+			[]string{"fetch", "--depth", "100", "origin", branchRef},
+			[]string{"fetch", "origin", branchRef},
+		)
+	}
+	var fetchErr error
+	for _, args := range attempts {
+		if fetchErr = run(args...); fetchErr == nil {
+			break
+		}
+	}
+	if fetchErr != nil {
+		return "", fetchErr
+	}
+	if err := run("checkout", "-q", spec.CommitOrFetchHead()); err != nil {
+		return "", err
+	}
+
+	return ResolveBuildPath(repoDir, spec.BuildPath)
+}
+
+// CommitOrFetchHead is the checkout target: the pinned commit or FETCH_HEAD.
+func (s Spec) CommitOrFetchHead() string {
+	if s.Commit != "" {
+		return s.Commit
+	}
+	return "FETCH_HEAD"
+}
+
+// ResolveBuildPath maps build_path onto the checkout and rejects escapes —
+// a path like ../../etc must never leave the workspace.
+func ResolveBuildPath(checkoutDir, buildPath string) (string, error) {
+	bp := strings.TrimSpace(buildPath)
+	if bp == "" || bp == "." {
+		return checkoutDir, nil
+	}
+	if filepath.IsAbs(bp) {
+		return "", fmt.Errorf("build_path must be relative, got %q", bp)
+	}
+	clean := filepath.Clean(bp)
+	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("build_path escapes the checkout: %q", bp)
+	}
+	resolved := filepath.Join(checkoutDir, clean)
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "", fmt.Errorf("build_path %q not found in checkout", bp)
+	}
+	if !info.IsDir() {
+		return "", fmt.Errorf("build_path %q is not a directory", bp)
+	}
+	return resolved, nil
+}

app/backend/internal/source/source_test.go

@@ -0,0 +1,152 @@
+package source
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+)
+
+func TestNormalizeCloneURL(t *testing.T) {
+	cases := []struct {
+		in, want string
+		err      bool
+	}{
+		{"https://github.com/org/repo.git", "https://github.com/org/repo.git", false},
+		{"[email protected]:org/repo.git", "https://github.com/org/repo.git", false},
+		{"ssh://[email protected]/org/repo.git", "https://gitlab.example.com/org/repo.git", false},
+		{"org/repo", "org/repo", false},
+		{"  https://gitlab.com/a/b.git  ", "https://gitlab.com/a/b.git", false},
+		{"", "", true},
+		{"ftp://example.com/repo", "", true},
+		{"weird string", "", true},
+	}
+	for _, c := range cases {
+		got, err := NormalizeCloneURL(c.in)
+		if c.err {
+			if err == nil {
+				t.Errorf("%q: expected error, got %q", c.in, got)
+			}
+			continue
+		}
+		if err != nil {
+			t.Errorf("%q: unexpected error %v", c.in, err)
+			continue
+		}
+		if got != c.want {
+			t.Errorf("%q: got %q, want %q", c.in, got, c.want)
+		}
+	}
+}
+
+func TestValidateRemoteURL(t *testing.T) {
+	if err := ValidateRemoteURL("https://github.com/o/r.git"); err != nil {
+		t.Errorf("https should pass: %v", err)
+	}
+	if err := ValidateRemoteURL("file:///tmp/repo"); err == nil {
+		t.Error("file:// should be rejected")
+	}
+	if err := ValidateRemoteURL("/tmp/repo"); err == nil {
+		t.Error("local path should be rejected")
+	}
+}
+
+// initRepo creates a small git repo with a branch and returns its path.
+func initRepo(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	run := func(args ...string) {
+		t.Helper()
+		cmd := exec.Command("git", args...)
+		cmd.Dir = dir
+		cmd.Env = append(os.Environ(),
+			"GIT_AUTHOR_NAME=t", "GIT_AUTHOR_EMAIL=t@t",
+			"GIT_COMMITTER_NAME=t", "GIT_COMMITTER_EMAIL=t@t")
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %v: %s", args, out)
+		}
+	}
+	run("init", "-q", "-b", "main")
+	if err := os.WriteFile(filepath.Join(dir, "app.txt"), []byte("v1"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(dir, "sub"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "sub", "inner.txt"), []byte("sub"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	run("add", ".")
+	run("commit", "-q", "-m", "first")
+	return dir
+}
+
+func TestCheckoutBranch(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	repo := initRepo(t)
+	dest := t.TempDir()
+	dir, err := Checkout(context.Background(), dest, Spec{CloneURL: repo, Branch: "main"})
+	if err != nil {
+		t.Fatalf("checkout: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "app.txt")); err != nil {
+		t.Errorf("expected app.txt in checkout: %v", err)
+	}
+}
+
+func TestCheckoutBuildPath(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	repo := initRepo(t)
+	dest := t.TempDir()
+	dir, err := Checkout(context.Background(), dest, Spec{CloneURL: repo, Branch: "main", BuildPath: "sub"})
+	if err != nil {
+		t.Fatalf("checkout: %v", err)
+	}
+	if filepath.Base(dir) != "sub" {
+		t.Errorf("expected sub build path, got %s", dir)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "inner.txt")); err != nil {
+		t.Errorf("expected inner.txt under build path: %v", err)
+	}
+}
+
+func TestCheckoutCommit(t *testing.T) {
+	if _, err := exec.LookPath("git"); err != nil {
+		t.Skip("git not available")
+	}
+	repo := initRepo(t)
+	out, err := exec.Command("git", "-C", repo, "rev-parse", "HEAD").Output()
+	if err != nil {
+		t.Fatal(err)
+	}
+	sha := string(out[:len(out)-1])
+	dest := t.TempDir()
+	dir, err := Checkout(context.Background(), dest, Spec{CloneURL: repo, Commit: sha, Branch: "main"})
+	if err != nil {
+		t.Fatalf("checkout commit: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "app.txt")); err != nil {
+		t.Errorf("expected app.txt in pinned checkout: %v", err)
+	}
+}
+
+func TestResolveBuildPathEscapes(t *testing.T) {
+	root := t.TempDir()
+	if _, err := ResolveBuildPath(root, "../../etc"); err == nil {
+		t.Error("escape should be rejected")
+	}
+	if _, err := ResolveBuildPath(root, "/abs/path"); err == nil {
+		t.Error("absolute path should be rejected")
+	}
+	if _, err := ResolveBuildPath(root, "missing"); err == nil {
+		t.Error("missing dir should be rejected")
+	}
+	if got, err := ResolveBuildPath(root, "."); err != nil || got != root {
+		t.Errorf("dot should resolve to root, got %q err=%v", got, err)
+	}
+}

app/backend/migrations_goose/20261112000000_placement_tags.sql

@@ -0,0 +1,11 @@
+-- +goose Up
+-- Placement tags: operators label node_agents (tags jsonb array of strings),
+-- services require a tag set (placement_tags). "auto" and spread placement
+-- only consider online schedulable agents carrying every required tag.
+-- Explicit node_id pins bypass tag filtering — the pin is an operator override.
+ALTER TABLE services ADD COLUMN IF NOT EXISTS placement_tags jsonb NOT NULL DEFAULT '[]';
+ALTER TABLE node_agents ADD COLUMN IF NOT EXISTS tags jsonb NOT NULL DEFAULT '[]';
+
+-- +goose Down
+ALTER TABLE services DROP COLUMN IF EXISTS placement_tags;
+ALTER TABLE node_agents DROP COLUMN IF EXISTS tags;

app/backend/migrations_goose/20261113000000_service_traefik_labels.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+-- Routing overrides: per-service Traefik middleware definitions stored as
+-- { "middlewares.<name>.<type>.<field>": "value" }. Validated against an
+-- allowlist; applied to the service's router and auto-attached to its
+-- middleware chain at reconcile time.
+ALTER TABLE services ADD COLUMN IF NOT EXISTS traefik_labels jsonb NOT NULL DEFAULT '{}';
+
+-- +goose Down
+ALTER TABLE services DROP COLUMN IF EXISTS traefik_labels;

app/backend/migrations_goose/20261114000000_node_default_domain.sql

@@ -0,0 +1,8 @@
+-- +goose Up
+-- Per-node base domain: services pinned/spread onto an agent with
+-- default_domain get auto-generated hostnames (<service>.<domain>) when
+-- they have no explicit service_domains rows.
+ALTER TABLE node_agents ADD COLUMN IF NOT EXISTS default_domain VARCHAR(255) NOT NULL DEFAULT '';
+
+-- +goose Down
+ALTER TABLE node_agents DROP COLUMN IF EXISTS default_domain;

app/backend/migrations_goose/20261115000000_preview_environments_runtime.sql

@@ -0,0 +1,11 @@
+-- +goose Up
+ALTER TABLE public.preview_environments
+    ADD COLUMN IF NOT EXISTS preview_service_id uuid REFERENCES public.services(id) ON DELETE SET NULL;
+
+CREATE INDEX IF NOT EXISTS idx_preview_environments_expiry
+    ON public.preview_environments (expires_at)
+    WHERE status NOT IN ('expired', 'stopped');
+
+-- +goose Down
+DROP INDEX IF EXISTS public.idx_preview_environments_expiry;
+ALTER TABLE public.preview_environments DROP COLUMN IF EXISTS preview_service_id;

app/backend/migrations_goose/20261116000000_notification_channels.sql

@@ -0,0 +1,16 @@
+-- +goose Up
+CREATE TABLE IF NOT EXISTS public.notification_channels (
+    id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id uuid NOT NULL REFERENCES public.users(id) ON DELETE CASCADE,
+    kind varchar(20) NOT NULL CHECK (kind IN ('ntfy', 'gotify')),
+    endpoint text NOT NULL,
+    token varchar(255),
+    enabled boolean NOT NULL DEFAULT true,
+    created_at timestamptz DEFAULT now(),
+    updated_at timestamptz DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_notification_channels_user ON public.notification_channels (user_id);
+
+-- +goose Down
+DROP TABLE IF EXISTS public.notification_channels;

app/backend/sqlc/queries/agents.sql

@@ -110,6 +110,12 @@ RETURNING *;
 UPDATE container_instances SET status = $2, updated_at = NOW()
 WHERE id = $1;
 
+-- name: UpdateContainerPorts :exec
+-- Agent reports the real host bindings after create — persist them with
+-- the status flip so ingress can route to the assigned port.
+UPDATE container_instances SET status = $2, ports = $3, updated_at = NOW()
+WHERE id = $1;
+
 -- name: GetLastAgentCommandByType :one
 SELECT * FROM agent_commands
 WHERE node_agent_id = $1 AND type = $2
@@ -141,8 +147,52 @@ SELECT id, name FROM node_agents
 WHERE status = 'online' AND schedulable
 ORDER BY id;
 
+-- name: ListSchedulableAgentsMatching :many
+-- Only agents carrying every required placement tag (jsonb array containment).
+SELECT id, name FROM node_agents
+WHERE status = 'online' AND schedulable
+  AND tags @> $1::jsonb
+ORDER BY id;
+
+-- name: PickLeastLoadedAgentMatching :one
+-- Same resource-aware ordering as PickLeastLoadedAgent, restricted to agents
+-- carrying every required placement tag.
+SELECT a.id FROM node_agents a
+LEFT JOIN LATERAL (
+    SELECT h.container_count FROM agent_heartbeats h
+    WHERE h.node_agent_id = a.id
+    ORDER BY h.timestamp DESC LIMIT 1
+) h ON true
+WHERE a.status = 'online' AND a.schedulable
+  AND a.tags @> $1::jsonb
+ORDER BY
+    COALESCE(
+        (a.resources->'memory'->>'used')::double precision
+        / NULLIF((a.resources->'memory'->>'total')::double precision, 0),
+        1.0
+    ) ASC,
+    COALESCE((a.resources->'cpu'->>'usage')::double precision, 100.0) ASC,
+    COALESCE(h.container_count, 0) ASC,
+    a.created_at ASC
+LIMIT 1;
+
+-- name: SetAgentTags :exec
+UPDATE node_agents SET tags = $2::jsonb, updated_at = NOW() WHERE id = $1;
+
+-- name: SetAgentDefaultDomain :exec
+UPDATE node_agents SET default_domain = $2, updated_at = NOW() WHERE id = $1;
+
+-- name: ListSchedulableAgentDomains :many
+-- Base domains of every online, schedulable agent carrying the required
+-- placement tags — auto-domain candidates for spread services.
+SELECT DISTINCT default_domain FROM node_agents
+WHERE status = 'online' AND schedulable
+  AND default_domain <> ''
+  AND tags @> $1::jsonb
+ORDER BY default_domain;
+
 -- name: ListServiceContainers :many
-SELECT id, name, node_agent_id, status FROM container_instances
+SELECT id, name, node_agent_id, status, ports, resources FROM container_instances
 WHERE service_id = $1;
 
 -- name: SetAgentSchedulable :exec
@@ -165,5 +215,20 @@ ON CONFLICT (id) DO UPDATE SET
 -- name: DeleteServiceContainersOnAgent :exec
 DELETE FROM container_instances WHERE node_agent_id = $1 AND service_id = $2;
 
+-- name: UpdateContainerStateByName :exec
+-- Agent heartbeat reports real docker state + net counters; reconcile
+-- inventory for rows this node owns. Tombstones win — never resurrect a
+-- removed replica. $4 is the cumulative rx+tx byte counter.
+UPDATE container_instances SET
+    status = jsonb_set(status, '{state}', $3::jsonb),
+    resources = jsonb_set(COALESCE(resources, '{}'::jsonb), '{net_bytes}', $4::jsonb),
+    updated_at = NOW()
+WHERE name = $1 AND node_agent_id = $2
+  AND status->>'state' IS DISTINCT FROM 'removed';
+
+-- name: ListServiceAgents :many
+-- Distinct agents holding inventory rows for a service.
+SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1;
+
 -- name: ScrubCommandPayload :exec
 UPDATE agent_commands SET payload = $2, updated_at = NOW() WHERE id = $1;

app/backend/sqlc/queries/deployments.sql

@@ -0,0 +1,105 @@
+-- name: CountDeploymentsForService :one
+SELECT COUNT(*) FROM deployments WHERE service_id = $1;
+
+-- name: ListDeploymentsForService :many
+SELECT id, service_id, commit_hash, status, image_name, image_tag,
+       build_log, runtime_log, error, started_at, completed_at, created_at, updated_at
+FROM deployments
+WHERE service_id = $1
+ORDER BY created_at DESC
+LIMIT $2 OFFSET $3;
+
+-- name: CountAccessibleDeployments :one
+SELECT COUNT(*)
+FROM deployments d
+JOIN services s ON s.id = d.service_id
+JOIN projects p ON p.id = s.project_id
+WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
+   OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1);
+
+-- name: ListRecentAccessibleDeployments :many
+SELECT d.id, d.service_id, s.name AS service_name, p.name AS project_name, d.status,
+       COALESCE(d.image_name, '') AS image_name, d.started_at, d.completed_at, d.created_at
+FROM deployments d
+JOIN services s ON s.id = d.service_id
+JOIN projects p ON p.id = s.project_id
+WHERE p.is_approved OR p.owner_id = $1 OR $2::bool
+   OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $1)
+ORDER BY d.created_at DESC
+LIMIT $3 OFFSET $4;
+
+-- name: GetServiceForDeployWithOwner :one
+SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
+       s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at, p.owner_id
+FROM services s
+JOIN projects p ON s.project_id = p.id
+WHERE s.id = $1;
+
+-- name: InsertDeployment :exec
+INSERT INTO deployments
+    (id, service_id, version, commit_hash, status, image_name, image_tag, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9);
+
+-- name: FailDeployment :exec
+UPDATE deployments
+SET status = 'failed', error = $1, completed_at = $2, updated_at = $2
+WHERE id = $3;
+
+-- name: CompleteDeployment :exec
+UPDATE deployments
+SET status = $1, error = $2, completed_at = $3, updated_at = $3
+WHERE id = $4;
+
+-- name: SetDeploymentStatus :exec
+UPDATE deployments SET status = $1, updated_at = $2 WHERE id = $3;
+
+-- name: SetServiceStatus :exec
+UPDATE services SET status = $1, updated_at = $2 WHERE id = $3;
+
+-- name: SyncDeploymentProgress :exec
+UPDATE deployments
+SET status = $1,
+    image_name = $2,
+    image_tag = $3,
+    build_log = $4,
+    runtime_log = $5,
+    error = $6,
+    started_at = $7,
+    completed_at = $8,
+    updated_at = $9
+WHERE id = $10;
+
+-- name: GetDeploymentAccess :one
+SELECT d.status, d.service_id, p.owner_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1;
+
+-- name: GetDeploymentWithProject :one
+SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
+       d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
+       d.created_at, d.updated_at, p.id AS project_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1;
+
+-- name: GetDeploymentForRollback :one
+SELECT d.id, d.service_id, d.commit_hash, d.status, d.image_name, d.image_tag,
+       d.build_log, d.runtime_log, d.error, d.started_at, d.completed_at,
+       d.created_at, d.updated_at, p.owner_id
+FROM deployments d
+JOIN services s ON d.service_id = s.id
+JOIN projects p ON s.project_id = p.id
+WHERE d.id = $1;
+
+-- name: GetServicePublishedPort :one
+SELECT published_port FROM services WHERE id = $1;

app/backend/sqlc/queries/domains.sql

@@ -0,0 +1,46 @@
+-- name: ListServiceDomains :many
+SELECT id, service_id, domain, is_default, cert_type, cert_status, last_checked_at, created_at
+FROM service_domains
+WHERE service_id = $1
+ORDER BY is_default DESC, created_at ASC;
+
+-- name: CountServiceDomains :one
+SELECT COUNT(*) FROM service_domains WHERE service_id = $1;
+
+-- name: ClearServiceDomainDefault :exec
+UPDATE service_domains SET is_default = false WHERE service_id = $1;
+
+-- name: CreateServiceDomain :one
+INSERT INTO service_domains (service_id, domain, is_default)
+VALUES ($1, $2, $3)
+RETURNING id, service_id, domain, is_default, cert_type, cert_status, created_at;
+
+-- name: DeleteServiceDomain :execrows
+DELETE FROM service_domains WHERE id = $1 AND service_id = $2;
+
+-- name: SetServiceDomainDefault :execrows
+UPDATE service_domains SET is_default = (id = $1) WHERE service_id = $2;
+
+-- name: TouchServiceDomainChecked :exec
+UPDATE service_domains SET last_checked_at = NOW() WHERE id = $1;
+
+-- name: GetServiceDomainDefault :one
+SELECT domain FROM service_domains WHERE service_id = $1 AND is_default;
+
+-- name: GetServiceDomainFirst :one
+SELECT domain FROM service_domains WHERE service_id = $1 ORDER BY created_at ASC LIMIT 1;
+
+-- name: SetServiceLegacyDomain :exec
+UPDATE services SET domain = $1 WHERE id = $2;
+
+-- name: GetServicePlacementBrief :one
+SELECT name, node_id, COALESCE(spread, false) AS spread FROM services WHERE id = $1;
+
+-- name: GetServiceAccess :one
+SELECT maintenance_mode, basic_auth_users FROM services WHERE id = $1;
+
+-- name: ServiceWriteAccess :one
+SELECT EXISTS(
+    SELECT 1 FROM services s JOIN projects p ON s.project_id = p.id
+    WHERE s.id = $1 AND (p.owner_id = $2 OR $3::bool)
+) AS allowed;

app/backend/sqlc/queries/metrics.sql

@@ -0,0 +1,147 @@
+-- name: UpsertNodeMetrics :exec
+INSERT INTO node_metrics (
+    node_id, timestamp, cpu_usage, cpu_cores, load_avg_1, load_avg_5, load_avg_15,
+    memory_total, memory_used, memory_available, memory_usage_percent,
+    storage_total, storage_used, storage_available, storage_usage_percent,
+    network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+    network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+    uptime, processes, os, kernel, architecture
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28
+)
+ON CONFLICT (node_id, timestamp) DO UPDATE SET
+    cpu_usage = EXCLUDED.cpu_usage,
+    cpu_cores = EXCLUDED.cpu_cores,
+    load_avg_1 = EXCLUDED.load_avg_1,
+    load_avg_5 = EXCLUDED.load_avg_5,
+    load_avg_15 = EXCLUDED.load_avg_15,
+    memory_total = EXCLUDED.memory_total,
+    memory_used = EXCLUDED.memory_used,
+    memory_available = EXCLUDED.memory_available,
+    memory_usage_percent = EXCLUDED.memory_usage_percent,
+    storage_total = EXCLUDED.storage_total,
+    storage_used = EXCLUDED.storage_used,
+    storage_available = EXCLUDED.storage_available,
+    storage_usage_percent = EXCLUDED.storage_usage_percent,
+    network_bytes_in = EXCLUDED.network_bytes_in,
+    network_bytes_out = EXCLUDED.network_bytes_out,
+    network_packets_in = EXCLUDED.network_packets_in,
+    network_packets_out = EXCLUDED.network_packets_out,
+    network_connections_in = EXCLUDED.network_connections_in,
+    network_connections_out = EXCLUDED.network_connections_out,
+    network_errors_in = EXCLUDED.network_errors_in,
+    network_errors_out = EXCLUDED.network_errors_out,
+    uptime = EXCLUDED.uptime,
+    processes = EXCLUDED.processes,
+    os = EXCLUDED.os,
+    kernel = EXCLUDED.kernel,
+    architecture = EXCLUDED.architecture;
+
+-- name: UpsertServiceMetrics :exec
+INSERT INTO service_metrics (
+    service_id, service_name, project_id, timestamp,
+    requests_total, requests_success, requests_errors, requests_avg_latency,
+    requests_p95_latency, requests_p99_latency, requests_throughput,
+    errors_total, errors_rate, performance_response_time, performance_throughput,
+    performance_concurrency, performance_saturation, performance_utilization,
+    resource_cpu_usage, resource_memory_usage, resource_storage_usage,
+    resource_network_usage, resource_score
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21, $22, $23
+)
+ON CONFLICT (service_id, timestamp) DO UPDATE SET
+    requests_total = EXCLUDED.requests_total,
+    requests_success = EXCLUDED.requests_success,
+    requests_errors = EXCLUDED.requests_errors,
+    requests_avg_latency = EXCLUDED.requests_avg_latency,
+    requests_p95_latency = EXCLUDED.requests_p95_latency,
+    requests_p99_latency = EXCLUDED.requests_p99_latency,
+    requests_throughput = EXCLUDED.requests_throughput,
+    errors_total = EXCLUDED.errors_total,
+    errors_rate = EXCLUDED.errors_rate,
+    performance_response_time = EXCLUDED.performance_response_time,
+    performance_throughput = EXCLUDED.performance_throughput,
+    performance_concurrency = EXCLUDED.performance_concurrency,
+    performance_saturation = EXCLUDED.performance_saturation,
+    performance_utilization = EXCLUDED.performance_utilization,
+    resource_cpu_usage = EXCLUDED.resource_cpu_usage,
+    resource_memory_usage = EXCLUDED.resource_memory_usage,
+    resource_storage_usage = EXCLUDED.resource_storage_usage,
+    resource_network_usage = EXCLUDED.resource_network_usage,
+    resource_score = EXCLUDED.resource_score;
+
+-- name: UpsertInstanceMetrics :exec
+INSERT INTO instance_metrics (
+    service_id, timestamp, instance_id, node_id, status, cpu, memory,
+    network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+    network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+    start_time, last_seen, health_status, health_last_check, health_check_count, health_failure_count
+) VALUES (
+    $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15,
+    $16, $17, $18, $19, $20, $21
+)
+ON CONFLICT (service_id, timestamp, instance_id) DO UPDATE SET
+    node_id = EXCLUDED.node_id,
+    status = EXCLUDED.status,
+    cpu = EXCLUDED.cpu,
+    memory = EXCLUDED.memory,
+    network_bytes_in = EXCLUDED.network_bytes_in,
+    network_bytes_out = EXCLUDED.network_bytes_out,
+    network_packets_in = EXCLUDED.network_packets_in,
+    network_packets_out = EXCLUDED.network_packets_out,
+    network_connections_in = EXCLUDED.network_connections_in,
+    network_connections_out = EXCLUDED.network_connections_out,
+    network_errors_in = EXCLUDED.network_errors_in,
+    network_errors_out = EXCLUDED.network_errors_out,
+    start_time = EXCLUDED.start_time,
+    last_seen = EXCLUDED.last_seen,
+    health_status = EXCLUDED.health_status,
+    health_last_check = EXCLUDED.health_last_check,
+    health_check_count = EXCLUDED.health_check_count,
+    health_failure_count = EXCLUDED.health_failure_count;
+
+-- name: ListNodeMetrics :many
+SELECT node_id, timestamp, cpu_usage, cpu_cores, load_avg_1, load_avg_5, load_avg_15,
+       memory_total, memory_used, memory_available, memory_usage_percent,
+       storage_total, storage_used, storage_available, storage_usage_percent,
+       network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+       network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+       coalesce(extract(epoch from uptime), 0)::bigint AS uptime_seconds,
+       processes, os, kernel, architecture
+FROM node_metrics
+WHERE node_id = $1 AND timestamp BETWEEN $2 AND $3
+ORDER BY timestamp ASC;
+
+-- name: ListServiceMetrics :many
+SELECT service_id, service_name, project_id, timestamp,
+       requests_total, requests_success, requests_errors, requests_avg_latency,
+       requests_p95_latency, requests_p99_latency, requests_throughput,
+       errors_total, errors_rate, performance_response_time, performance_throughput,
+       performance_concurrency, performance_saturation, performance_utilization,
+       resource_cpu_usage, resource_memory_usage, resource_storage_usage,
+       resource_network_usage, resource_score
+FROM service_metrics
+WHERE service_id = $1 AND timestamp BETWEEN $2 AND $3
+ORDER BY timestamp ASC;
+
+-- name: ListInstanceMetrics :many
+SELECT instance_id, node_id, status, cpu, memory,
+       network_bytes_in, network_bytes_out, network_packets_in, network_packets_out,
+       network_connections_in, network_connections_out, network_errors_in, network_errors_out,
+       start_time, last_seen, health_status, health_last_check, health_check_count, health_failure_count
+FROM instance_metrics
+WHERE service_id = $1 AND timestamp = $2;
+
+-- name: AggregateNodeMetrics :many
+-- Portable bucket bucketing (no TimescaleDB): floor epoch seconds into
+-- bucket-sized buckets, then back to timestamptz.
+SELECT date_bin($1::interval, timestamp, '2000-01-01'::timestamptz) AS bucket,
+       AVG(cpu_usage)::float8 AS avg_cpu,
+       AVG(memory_usage_percent)::float8 AS avg_memory,
+       AVG(storage_usage_percent)::float8 AS avg_storage
+FROM node_metrics
+WHERE node_id = $2 AND timestamp BETWEEN $3 AND $4
+GROUP BY bucket
+ORDER BY bucket ASC;

app/backend/sqlc/queries/notifications.sql

@@ -17,3 +17,23 @@ UPDATE notifications SET read_at = $3 WHERE id = $1 AND user_id = $2 AND read_at
 
 -- name: MarkAllNotificationsReadByUser :exec
 UPDATE notifications SET read_at = $2 WHERE user_id = $1 AND read_at IS NULL;
+
+-- name: ListNotificationChannelsByUser :many
+SELECT id, user_id, kind, endpoint, token, enabled, created_at, updated_at
+FROM notification_channels
+WHERE user_id = $1 AND enabled
+ORDER BY created_at;
+
+-- name: ListAllNotificationChannelsByUser :many
+SELECT id, user_id, kind, endpoint, token, enabled, created_at, updated_at
+FROM notification_channels
+WHERE user_id = $1
+ORDER BY created_at;
+
+-- name: InsertNotificationChannel :one
+INSERT INTO notification_channels (user_id, kind, endpoint, token)
+VALUES ($1, $2, $3, $4)
+RETURNING id, user_id, kind, endpoint, token, enabled, created_at, updated_at;
+
+-- name: DeleteNotificationChannel :execrows
+DELETE FROM notification_channels WHERE id = $1 AND user_id = $2;

app/backend/sqlc/queries/preview_environments.sql

@@ -0,0 +1,121 @@
+-- name: ListPreviewEnvironmentsForProject :many
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
+       s.id AS svc_id, s.name AS service_name, s.type AS service_type
+FROM preview_environments pe
+LEFT JOIN services s ON pe.service_id = s.id
+WHERE pe.project_id = $1
+ORDER BY pe.created_at DESC;
+
+-- name: GetPreviewEnvironment :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at,
+       s.id AS svc_id, s.name AS service_name, s.type AS service_type
+FROM preview_environments pe
+LEFT JOIN services s ON pe.service_id = s.id
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.is_approved OR p.owner_id = $2 OR $3::bool
+    OR EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = $2));
+
+-- name: GetPreviewEnvironmentForWrite :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.branch_name, pe.pr_number,
+       pe.environment, pe.status, pe.url, pe.expires_at, pe.created_at, pe.updated_at
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool);
+
+-- name: GetPreviewEnvironmentForPromote :one
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.environment, pe.status
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1 AND (p.owner_id = $2 OR $3::bool);
+
+-- name: GetPreviewEnvironmentOwner :one
+SELECT p.owner_id
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE pe.id = $1;
+
+-- name: GetPreviewServiceID :one
+SELECT preview_service_id FROM preview_environments WHERE id = $1;
+
+-- name: UpdatePreviewEnvironment :exec
+UPDATE preview_environments
+SET status = $1, url = $2, expires_at = $3, updated_at = $4
+WHERE id = $5;
+
+-- name: MarkPreviewEnvironmentStatus :exec
+UPDATE preview_environments SET status = $1, updated_at = NOW() WHERE id = $2;
+
+-- name: DeletePreviewEnvironment :exec
+DELETE FROM preview_environments WHERE id = $1;
+
+-- name: CountActivePreviewsForBranch :one
+SELECT COUNT(*) FROM preview_environments
+WHERE service_id = $1 AND branch_name = $2 AND status NOT IN ('expired', 'stopped');
+
+-- name: CreatePreviewEnvironment :exec
+INSERT INTO preview_environments
+    (id, project_id, service_id, preview_service_id, branch_name, pr_number, environment,
+     status, url, expires_at, created_at, updated_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12);
+
+-- name: UpdateServicePreviewBranch :exec
+UPDATE services SET git_branch = $1, domain = '', updated_at = NOW() WHERE id = $2;
+
+-- name: DeleteAllServiceDomains :exec
+DELETE FROM service_domains WHERE service_id = $1;
+
+-- name: CreatePreviewDomain :exec
+INSERT INTO service_domains (service_id, domain, is_default, cert_type) VALUES ($1, $2, true, 'tls');
+
+-- name: InsertPendingDeployment :exec
+INSERT INTO deployments (id, service_id, version, commit_hash, status, created_at, updated_at)
+VALUES ($1, $2, $3, $4, 'pending', NOW(), NOW());
+
+-- name: ListExpiredPreviewsForUser :many
+SELECT pe.id, pe.project_id, pe.service_id, pe.preview_service_id, pe.branch_name, pe.environment
+FROM preview_environments pe
+JOIN projects p ON pe.project_id = p.id
+WHERE (p.owner_id = $1 OR $2::bool) AND pe.expires_at < NOW() AND pe.status != 'expired';
+
+-- name: ListSweepablePreviews :many
+SELECT id, preview_service_id FROM preview_environments
+WHERE expires_at < NOW() AND status NOT IN ('expired', 'stopped');
+
+-- name: SyncPreviewStatuses :exec
+UPDATE preview_environments pe
+SET status = derived.st, updated_at = NOW()
+FROM (
+    SELECT pe2.id,
+        CASE
+            WHEN s.status IN ('running', 'deployed') THEN 'running'
+            WHEN s.status IN ('failed', 'error') THEN 'failed'
+            WHEN s.status IN ('building', 'deploying', 'queued', 'pending', 'cloning') THEN 'building'
+            ELSE pe2.status
+        END AS st
+    FROM preview_environments pe2
+    JOIN services s ON pe2.preview_service_id = s.id
+) derived
+WHERE pe.id = derived.id
+  AND pe.status IN ('building', 'running', 'failed')
+  AND pe.status <> derived.st;
+
+-- name: GetProjectBrief :one
+SELECT id, name, owner_id FROM projects WHERE id = $1;
+
+-- name: GetServiceTypeBrief :one
+SELECT id, name, COALESCE(type, service_type, '') AS service_type FROM services WHERE id = $1 AND project_id = $2;
+
+-- name: GetServiceForDeploy :one
+SELECT s.id, s.project_id, s.name, s.type, s.status, s.image, s.command,
+       s.environment, s.git_repo, s.git_branch, s.build_path, s.cpu, s.memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at
+FROM services s
+WHERE s.id = $1;

app/backend/sqlc/queries/projects.sql

@@ -125,3 +125,21 @@ SELECT p.id, p.name, p.description, p.owner_id, p.is_approved, p.created_at, p.u
 FROM projects p
 WHERE p.is_approved = false
 ORDER BY p.created_at DESC;
+
+-- name: ListProjectEnvironments :many
+SELECT e.id, e.name, e.project_id, e.created_at, e.updated_at,
+       (SELECT COUNT(*) FROM services s WHERE s.environment_id = e.id) AS service_count
+FROM environments e
+WHERE e.project_id = $1
+ORDER BY e.created_at;
+
+-- name: GetProjectEnvironmentByName :one
+SELECT id, name, project_id, created_at, updated_at
+FROM environments
+WHERE project_id = $1 AND name = $2;
+
+-- name: DeleteProjectEnvironment :exec
+DELETE FROM environments WHERE id = $1 AND project_id = $2;
+
+-- name: CountEnvironmentServices :one
+SELECT COUNT(*) FROM services WHERE environment_id = $1;

app/backend/sqlc/queries/runtime.sql

@@ -0,0 +1,47 @@
+-- name: ListNodeAgentsForService :many
+SELECT DISTINCT node_agent_id FROM container_instances WHERE service_id = $1;
+
+-- name: ListServiceVariableValues :many
+SELECT key, value FROM environment_variables WHERE service_id = $1;
+
+-- name: ListServiceVariablesWithSecret :many
+SELECT key, value, COALESCE(is_secret, false) AS is_secret
+FROM environment_variables WHERE service_id = $1;
+
+-- name: ListProjectServiceRefs :many
+SELECT id, name FROM services WHERE project_id = $1;
+
+-- name: GetServicePort :one
+SELECT COALESCE(port, 0) AS port FROM services WHERE id = $1;
+
+-- name: GetServiceVariableValue :one
+SELECT value FROM environment_variables WHERE service_id = $1 AND key = $2;
+
+-- name: GetServiceRuntimeWithOwner :one
+SELECT s.id, s.project_id, s.name,
+       COALESCE(s.type, s.service_type, '') AS type, COALESCE(s.status, '') AS status,
+       COALESCE(s.image, s.image_name, '') AS image, COALESCE(s.command, s.start_command, '') AS command,
+       COALESCE(s.environment, '') AS environment, COALESCE(s.git_repo, s.source_url, '') AS git_repo,
+       COALESCE(s.git_branch, '') AS git_branch, COALESCE(s.build_path, '') AS build_path,
+       COALESCE(s.cpu, '') AS cpu, COALESCE(s.memory, '') AS memory,
+       COALESCE(s.replicas, 1) AS replicas, COALESCE(s.port, 0) AS port,
+       COALESCE(s.domain, '') AS domain, COALESCE(s.healthcheck_path, '') AS healthcheck_path,
+       COALESCE(s.restart_policy, 'unless-stopped') AS restart_policy,
+       COALESCE(s.builder, 'auto') AS builder, COALESCE(s.cpu_reserve, '') AS cpu_reserve,
+       COALESCE(s.memory_reserve, '') AS memory_reserve, COALESCE(s.static_build_cmd, '') AS static_build_cmd,
+       COALESCE(s.static_dir, '') AS static_dir,
+       s.created_at, s.updated_at, p.owner_id
+FROM services s
+JOIN projects p ON s.project_id = p.id
+WHERE s.id = $1;
+
+-- name: GetLastDeployedImage :one
+SELECT (image_name || ':' || image_tag)::text AS image FROM deployments
+WHERE service_id = $1 AND status = 'deployed' AND image_name <> ''
+ORDER BY created_at DESC LIMIT 1;
+
+-- name: SetServicePublishedPort :exec
+UPDATE services SET published_port = $1 WHERE id = $2 AND published_port <> $1;
+
+-- name: SetServiceReplicas :exec
+UPDATE services SET replicas = $1, updated_at = $2 WHERE id = $3;

app/backend/sqlc/queries/service_ops.sql

@@ -0,0 +1,38 @@
+-- name: CountServicesByName :one
+SELECT COUNT(*) FROM services WHERE project_id = $1 AND name = $2;
+
+-- name: GetServiceEnvironment :one
+SELECT COALESCE(environment, '') FROM services WHERE id = $1;
+
+-- name: CloneServiceRow :exec
+INSERT INTO services
+    (id, project_id, name, environment_id, service_type, source_type, source_url, image_name,
+     build_command, start_command, type, status, image, command, environment,
+     git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
+     healthcheck_path, restart_policy, volumes, maintenance_mode, basic_auth_users,
+     builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
+     traefik_labels, created_at, updated_at)
+SELECT $1, $2, $3, $4, service_type, source_type, source_url, image_name,
+     build_command, start_command, type, 'stopped', image, command, $5,
+     git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
+     healthcheck_path, restart_policy, volumes, $6, $7,
+     builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
+     traefik_labels, $8, $8
+FROM services s WHERE s.id = $9;
+
+-- name: CloneServiceDomains :exec
+INSERT INTO service_domains (service_id, domain, is_default, cert_type)
+SELECT $1, domain, is_default, cert_type FROM service_domains sd WHERE sd.service_id = $2;
+
+-- name: CloneServiceVariables :exec
+INSERT INTO environment_variables (id, service_id, key, value, is_secret)
+SELECT gen_random_uuid(), $1, key, value, is_secret FROM environment_variables ev WHERE ev.service_id = $2;
+
+-- name: DeleteServiceByID :exec
+DELETE FROM services WHERE id = $1;
+
+-- name: MoveServiceProject :execrows
+UPDATE services SET project_id = $1, environment_id = $2, updated_at = $3 WHERE id = $4;
+
+-- name: GetProjectOwner :one
+SELECT owner_id FROM projects WHERE id = $1;

app/backend/sqlc/schema.sql

@@ -68,7 +68,9 @@ CREATE TABLE services (
     static_build_cmd VARCHAR(255) NOT NULL DEFAULT '',
     static_dir VARCHAR(255) NOT NULL DEFAULT '',
     node_id VARCHAR(255),
-    spread BOOLEAN NOT NULL DEFAULT false
+    spread BOOLEAN NOT NULL DEFAULT false,
+    placement_tags JSONB NOT NULL DEFAULT '[]',
+    traefik_labels JSONB NOT NULL DEFAULT '{}'
 );
 
 CREATE TABLE registries (
@@ -96,11 +98,37 @@ CREATE TABLE service_domains (
 );
 
 CREATE TABLE deployments (
-    id UUID PRIMARY KEY,
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     service_id UUID NOT NULL REFERENCES services(id) ON DELETE CASCADE,
-    status VARCHAR(50),
+    version VARCHAR(255) NOT NULL,
+    commit_hash VARCHAR(255),
+    image_digest VARCHAR(255),
+    status VARCHAR(50) DEFAULT 'created',
+    build_log TEXT,
+    deployment_log TEXT,
+    started_at TIMESTAMPTZ,
+    completed_at TIMESTAMPTZ,
     created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    image_name VARCHAR(255),
+    image_tag VARCHAR(255),
+    runtime_log TEXT,
+    error TEXT
+);
+
+CREATE TABLE preview_environments (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    project_id UUID NOT NULL,
+    service_id UUID NOT NULL,
+    branch_name VARCHAR(255) NOT NULL,
+    pr_number INTEGER,
+    environment VARCHAR(255) NOT NULL,
+    status VARCHAR(50) NOT NULL DEFAULT 'building',
+    url TEXT,
+    expires_at TIMESTAMPTZ NOT NULL,
+    created_at TIMESTAMPTZ DEFAULT now(),
+    updated_at TIMESTAMPTZ DEFAULT now(),
+    preview_service_id UUID
 );
 
 CREATE TABLE environment_variables (
@@ -196,7 +224,9 @@ CREATE TABLE node_agents (
     updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
     metadata JSONB,
     auto_prune BOOLEAN NOT NULL DEFAULT false,
-    schedulable BOOLEAN NOT NULL DEFAULT true
+    schedulable BOOLEAN NOT NULL DEFAULT true,
+    tags JSONB NOT NULL DEFAULT '[]',
+    default_domain VARCHAR(255) NOT NULL DEFAULT ''
 );
 
 CREATE TABLE container_instances (
@@ -331,3 +361,101 @@ CREATE TABLE user_invites (
     used_at TIMESTAMP WITH TIME ZONE,
     created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
 );
+
+CREATE TABLE notification_channels (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    kind VARCHAR(20) NOT NULL CHECK (kind IN ('ntfy', 'gotify')),
+    endpoint TEXT NOT NULL,
+    token VARCHAR(255),
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+);
+
+CREATE TABLE node_metrics (
+    node_id VARCHAR(255) NOT NULL,
+    timestamp TIMESTAMP WITH TIME ZONE NOT NULL,
+    cpu_usage NUMERIC(5,2),
+    cpu_cores NUMERIC(10,2),
+    load_avg_1 NUMERIC(5,2),
+    load_avg_5 NUMERIC(5,2),
+    load_avg_15 NUMERIC(5,2),
+    memory_total BIGINT,
+    memory_used BIGINT,
+    memory_available BIGINT,
+    memory_usage_percent NUMERIC(5,2),
+    storage_total BIGINT,
+    storage_used BIGINT,
+    storage_available BIGINT,
+    storage_usage_percent NUMERIC(5,2),
+    network_bytes_in BIGINT,
+    network_bytes_out BIGINT,
+    network_packets_in BIGINT,
+    network_packets_out BIGINT,
+    network_connections_in INTEGER,
+    network_connections_out INTEGER,
+    network_errors_in BIGINT,
+    network_errors_out BIGINT,
+    uptime INTERVAL,
+    processes INTEGER,
+    os VARCHAR(50),
+    kernel VARCHAR(50),
+    architecture VARCHAR(20),
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    PRIMARY KEY (node_id, timestamp)
+);
+
+CREATE TABLE service_metrics (
+    service_id VARCHAR(255) NOT NULL,
+    service_name VARCHAR(255) NOT NULL,
+    project_id VARCHAR(255) NOT NULL,
+    timestamp TIMESTAMP WITH TIME ZONE NOT NULL,
+    requests_total BIGINT DEFAULT 0,
+    requests_success BIGINT DEFAULT 0,
+    requests_errors BIGINT DEFAULT 0,
+    requests_avg_latency NUMERIC(10,3),
+    requests_p95_latency NUMERIC(10,3),
+    requests_p99_latency NUMERIC(10,3),
+    requests_throughput NUMERIC(10,3),
+    errors_total BIGINT DEFAULT 0,
+    errors_rate NUMERIC(5,4),
+    performance_response_time NUMERIC(10,3),
+    performance_throughput NUMERIC(10,3),
+    performance_concurrency BIGINT,
+    performance_saturation NUMERIC(5,2),
+    performance_utilization NUMERIC(5,2),
+    resource_cpu_usage NUMERIC(5,2),
+    resource_memory_usage BIGINT,
+    resource_storage_usage BIGINT,
+    resource_network_usage BIGINT,
+    resource_score NUMERIC(5,2),
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    PRIMARY KEY (service_id, timestamp)
+);
+
+CREATE TABLE instance_metrics (
+    service_id VARCHAR(255) NOT NULL,
+    timestamp TIMESTAMP WITH TIME ZONE NOT NULL,
+    instance_id VARCHAR(255) NOT NULL,
+    node_id VARCHAR(255),
+    status VARCHAR(50),
+    cpu NUMERIC(5,2),
+    memory BIGINT,
+    network_bytes_in BIGINT,
+    network_bytes_out BIGINT,
+    network_packets_in BIGINT,
+    network_packets_out BIGINT,
+    network_connections_in INTEGER,
+    network_connections_out INTEGER,
+    network_errors_in BIGINT,
+    network_errors_out BIGINT,
+    start_time TIMESTAMP WITH TIME ZONE,
+    last_seen TIMESTAMP WITH TIME ZONE,
+    health_status VARCHAR(20),
+    health_last_check TIMESTAMP WITH TIME ZONE,
+    health_check_count INTEGER DEFAULT 0,
+    health_failure_count INTEGER DEFAULT 0,
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+    PRIMARY KEY (service_id, timestamp, instance_id)
+);

app/frontend/Dockerfile

@@ -1,5 +1,7 @@
 # Build stage
-FROM node:22-alpine AS builder
+ARG NODE_IMAGE=node:22-alpine
+ARG NGINX_IMAGE=nginx:alpine
+FROM ${NODE_IMAGE} AS builder
 
 # Set working directory
 WORKDIR /app
@@ -24,7 +26,7 @@ ENV VITE_AUTH_URL=${VITE_AUTH_URL}
 RUN npm run build
 
 # Production stage
-FROM nginx:alpine
+FROM ${NGINX_IMAGE}
 
 # Copy custom nginx config
 COPY nginx.conf /etc/nginx/nginx.conf

app/frontend/package-lock.json

@@ -31,7 +31,9 @@
         "@tabler/icons-react": "^3.37.1",
         "@tailwindcss/postcss": "^4.1.18",
         "@tailwindcss/typography": "^0.5.19",
+        "@tanstack/query-sync-storage-persister": "^5.104.1",
         "@tanstack/react-query": "^5.66.0",
+        "@tanstack/react-query-persist-client": "^5.104.1",
         "@types/dompurify": "^3.0.5",
         "@xterm/addon-fit": "^0.11.0",
         "@xterm/xterm": "^6.0.0",
@@ -3441,22 +3443,49 @@
       }
     },
     "node_modules/@tanstack/query-core": {
-      "version": "5.90.20",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.90.20.tgz",
-      "integrity": "sha512-OMD2HLpNouXEfZJWcKeVKUgQ5n+n3A2JFmBaScpNDUqSrQSjiveC7dKMe53uJUg1nDG16ttFPz2xfilz6i2uVg==",
+      "version": "5.104.1",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.104.1.tgz",
+      "integrity": "sha512-TiRghcrGkUTE+M4JBxvpPSpBhxvIzQairw+cksrHYGr+2uwC77yW1SY9nYxnYRYOppvucf8rEg6b5byoz4rTpw==",
       "license": "MIT",
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/tannerlinsley"
       }
     },
-    "node_modules/@tanstack/react-query": {
-      "version": "5.90.21",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.90.21.tgz",
-      "integrity": "sha512-0Lu6y5t+tvlTJMTO7oh5NSpJfpg/5D41LlThfepTixPYkJ0sE2Jj0m0f6yYqujBwIXlId87e234+MxG3D3g7kg==",
+    "node_modules/@tanstack/query-persist-client-core": {
+      "version": "5.104.1",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-persist-client-core/-/query-persist-client-core-5.104.1.tgz",
+      "integrity": "sha512-ONiadXqe56iNrw6RESqKILpTIVG9ZMI/DageTQnrBDt/nZ6WiP4G13iIiMwJEsiO12gQ3Gychx8tcFIPw4k25g==",
       "license": "MIT",
       "dependencies": {
-        "@tanstack/query-core": "5.90.20"
+        "@tanstack/query-core": "5.104.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@tanstack/query-sync-storage-persister": {
+      "version": "5.104.1",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-sync-storage-persister/-/query-sync-storage-persister-5.104.1.tgz",
+      "integrity": "sha512-eDsBMNds48+sjXILn0dQKu+uYwfh9tGIB+Rb0cKRdoxD22HHBMzJes5DJOhJVLUhBQbxtoFq+Hpha/Vohh14NQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/query-core": "5.104.1",
+        "@tanstack/query-persist-client-core": "5.104.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@tanstack/react-query": {
+      "version": "5.104.1",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.104.1.tgz",
+      "integrity": "sha512-Zz70EgjahNI7aCz8BZxM3vUGU44ycxEAzMuCUjLeA7SVhhOkg3ZgPjPJPvHjs6Rmky/dtmnu1WzjGHNHmhCoZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/query-core": "5.104.1"
       },
       "funding": {
         "type": "github",
@@ -3466,6 +3495,23 @@
         "react": "^18 || ^19"
       }
     },
+    "node_modules/@tanstack/react-query-persist-client": {
+      "version": "5.104.1",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query-persist-client/-/react-query-persist-client-5.104.1.tgz",
+      "integrity": "sha512-kU3YaqjkwEUzUUfPF0JVg56d6gJKWHaFVqOlQztwc4C2IT0P5sv/23orrSoQqjxKaUe6Ejw5IIQtA/G12uNmow==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/query-persist-client-core": "5.104.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "@tanstack/react-query": "^5.104.1",
+        "react": "^18 || ^19"
+      }
+    },
     "node_modules/@testing-library/dom": {
       "version": "10.4.1",
       "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz",

app/frontend/package.json

@@ -42,7 +42,9 @@
     "@tabler/icons-react": "^3.37.1",
     "@tailwindcss/postcss": "^4.1.18",
     "@tailwindcss/typography": "^0.5.19",
+    "@tanstack/query-sync-storage-persister": "^5.104.1",
     "@tanstack/react-query": "^5.66.0",
+    "@tanstack/react-query-persist-client": "^5.104.1",
     "@types/dompurify": "^3.0.5",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",

app/frontend/src/app/App.tsx

@@ -28,6 +28,7 @@ import {
 } from '@/features/secondary/pages';
 import { NodeDetailPage } from '@/features/nodes/NodeDetailPage';
 import { AcceptInvitePage, SignInPage, SignUpPage } from '@/features/auth/pages';
+import { SetupWizardPage } from '@/features/setup/SetupWizardPage';
 import { useAuthSession } from '@/lib/use-auth-session';
 import { useDemoMode } from '@/lib/demo-mode';
 import { getCurrentUserProfile } from '@/lib/api-client';
@@ -138,6 +139,7 @@ export default function App() {
         <Route path="/auth/sign-in" element={<SignInPage />} />
         <Route path="/auth/sign-up" element={<SignUpPage />} />
         <Route path="/auth/accept-invite" element={<AcceptInvitePage />} />
+        <Route path="/setup" element={<SetupWizardPage />} />
 
         {/* Public browsing — approved projects, templates, docs. */}
         {/* Project workspace renders outside the shell — fullscreen canvas, no nav chrome */}

app/frontend/src/app/layout/PlatformShell.tsx

@@ -1,4 +1,4 @@
-import { NavLink, Outlet, useLocation, useNavigate } from 'react-router-dom';
+import { NavLink, Navigate, Outlet, useLocation, useNavigate } from 'react-router-dom';
 import { useEffect, useState } from 'react';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import * as DropdownMenu from '@radix-ui/react-dropdown-menu';
@@ -30,10 +30,13 @@ import {
   User,
   Users,
   Webhook,
+  WifiOff,
 } from 'lucide-react';
 import {
   getCurrentUserProfile,
   getUpgradeStatus,
+  pingServer,
+  getSetupStatus,
   listNotifications,
   markAllNotificationsRead,
   markNotificationRead,
@@ -105,6 +108,42 @@ function getInitialSidebar(): boolean {
   return readStorage('containr.sidebar.expanded') !== '0';
 }
 
+// ConnectivityBanner pings /health every 15s and listens for browser
+// online/offline events — when the instance is unreachable it shows a
+// slim bar so the persisted last-known data doesn't masquerade as live.
+function ConnectivityBanner() {
+  const [offline, setOffline] = useState(() => !navigator.onLine);
+  useEffect(() => {
+    const up = () => setOffline(false);
+    const down = () => setOffline(true);
+    window.addEventListener('online', up);
+    window.addEventListener('offline', down);
+    return () => {
+      window.removeEventListener('online', up);
+      window.removeEventListener('offline', down);
+    };
+  }, []);
+  const ping = useQuery({
+    queryKey: ['connectivity'],
+    queryFn: pingServer,
+    refetchInterval: 15_000,
+    retry: 0,
+    networkMode: 'always',
+    staleTime: 0,
+  });
+  if (!offline && !ping.isError) {
+    return null;
+  }
+  return (
+    <div className="flex items-center justify-center gap-2 border-b border-[var(--warning,var(--border-subtle))] bg-[var(--surface-muted)] px-4 py-1.5 text-xs text-[var(--text-secondary)]">
+      <WifiOff size={13} className="text-[var(--warning,#f59e0b)]" />
+      {offline
+        ? 'No network connection — showing last-known data.'
+        : 'Cannot reach this Containr instance — showing last-known data. Retrying…'}
+    </div>
+  );
+}
+
 export function PlatformShell() {
   const location = useLocation();
   const navigate = useNavigate();
@@ -147,6 +186,13 @@ export function PlatformShell() {
     enabled: !isDemoMode && signedIn,
     refetchInterval: 30_000,
   });
+  // Fresh installs get routed through the setup wizard until the flag lands.
+  const setupQuery = useQuery({
+    queryKey: ['setup-status'],
+    queryFn: getSetupStatus,
+    enabled: !isDemoMode && signedIn,
+    staleTime: 60_000,
+  });
   const markReadMutation = useMutation({
     mutationFn: (id: string) => markNotificationRead(id),
     onSuccess: () => queryClient.invalidateQueries({ queryKey: ['shell-notifications'] }),
@@ -209,6 +255,10 @@ export function PlatformShell() {
     </div>
   );
 
+  if (!isDemoMode && signedIn && setupQuery.data?.needs_setup) {
+    return <Navigate to="/setup" replace />;
+  }
+
   return (
     <div className="app-shell min-h-screen">
       <div className="ambient-glow" />
@@ -557,6 +607,7 @@ export function PlatformShell() {
             </nav>
           </header>
 
+          <ConnectivityBanner />
           <main className="flex-1 overflow-y-auto">
             <Outlet />
           </main>

app/frontend/src/features/nodes/NodeDetailPage.tsx

@@ -11,6 +11,7 @@ import {
   listAgentContainers,
   pruneAgent,
   updateAgent,
+  upgradeAgent,
   type AgentMetricPoint,
 } from '@/lib/api-client';
 import { getCurrentUserProfile } from '@/lib/api-client';
@@ -46,6 +47,8 @@ export function NodeDetailPage() {
   const [confirmDelete, setConfirmDelete] = useState(false);
   const [confirmVolumes, setConfirmVolumes] = useState(false);
   const [confirmDrain, setConfirmDrain] = useState(false);
+  const [tagDraft, setTagDraft] = useState<string | null>(null);
+  const [domainDraft, setDomainDraft] = useState<string | null>(null);
 
   const agentQuery = useQuery({
     queryKey: ['node-agent', id],
@@ -78,8 +81,8 @@ export function NodeDetailPage() {
     queryClient.invalidateQueries({ queryKey: ['usage-agents'] });
   };
   const updateMutation = useMutation({
-    mutationFn: (body: { name?: string; auto_prune?: boolean }) => updateAgent(id, body),
-    onSuccess: () => { setRename(null); invalidate(); },
+    mutationFn: (body: { name?: string; auto_prune?: boolean; tags?: string[]; default_domain?: string }) => updateAgent(id, body),
+    onSuccess: () => { setRename(null); setTagDraft(null); setDomainDraft(null); invalidate(); },
   });
   const pruneMutation = useMutation({
     mutationFn: (volumes: boolean) => pruneAgent(id, { volumes }),
@@ -97,6 +100,10 @@ export function NodeDetailPage() {
     mutationFn: () => drainAgent(id),
     onSuccess: () => { setConfirmDrain(false); invalidate(); },
   });
+  const upgradeMutation = useMutation({
+    mutationFn: () => upgradeAgent(id),
+    onSuccess: invalidate,
+  });
 
   const agent = agentQuery.data;
   const metrics = useMemo(() => metricsQuery.data ?? [], [metricsQuery.data]);
@@ -172,6 +179,84 @@ export function NodeDetailPage() {
                   mesh: {meshAddresses(agent).map(([iface, ip]) => `${iface}=${ip}`).join(' · ')}
                 </p>
               )}
+              <p className="v-mono mt-1 text-[11px] text-[var(--text-tertiary)] flex items-center gap-1.5 flex-wrap">
+                tags:
+                {tagDraft === null ? (
+                  <>
+                    {agent.tags.length > 0
+                      ? agent.tags.map((t) => (
+                          <span key={t} className="px-1.5 py-0.5 rounded border border-[var(--border-subtle)] text-[var(--text-secondary)]">{t}</span>
+                        ))
+                      : <span className="text-[var(--text-muted)]">none</span>}
+                    {isAdmin && (
+                      <button
+                        onClick={() => setTagDraft(agent.tags.join(', '))}
+                        className="text-[var(--text-muted)] hover:text-[var(--text-primary)]"
+                        title="Edit placement tags — services can require them via placement_tags"
+                      >
+                        <Pencil size={11} />
+                      </button>
+                    )}
+                  </>
+                ) : (
+                  <>
+                    <input
+                      value={tagDraft}
+                      onChange={(e) => setTagDraft(e.target.value)}
+                      onKeyDown={(e) => {
+                        if (e.key === 'Enter') updateMutation.mutate({ tags: tagDraft.split(',').map((t) => t.trim()).filter(Boolean) });
+                        if (e.key === 'Escape') setTagDraft(null);
+                      }}
+                      autoFocus
+                      placeholder="eu-west, gpu"
+                      className="rounded-md border border-[var(--border-subtle)] bg-[var(--bg-tertiary)] px-2 py-0.5 text-[11px] text-[var(--text-primary)] w-52"
+                    />
+                    <button
+                      onClick={() => updateMutation.mutate({ tags: tagDraft.split(',').map((t) => t.trim()).filter(Boolean) })}
+                      className="text-[var(--accent-primary)] hover:underline"
+                    >save</button>
+                    <button onClick={() => setTagDraft(null)} className="text-[var(--text-muted)] hover:underline">cancel</button>
+                  </>
+                )}
+              </p>
+              <p className="v-mono mt-1 text-[11px] text-[var(--text-tertiary)] flex items-center gap-1.5 flex-wrap">
+                domain:
+                {domainDraft === null ? (
+                  <>
+                    <span className={agent.defaultDomain ? 'text-[var(--text-secondary)]' : 'text-[var(--text-muted)]'}>
+                      {agent.defaultDomain || 'none'}
+                    </span>
+                    {isAdmin && (
+                      <button
+                        onClick={() => setDomainDraft(agent.defaultDomain || '')}
+                        className="text-[var(--text-muted)] hover:text-[var(--text-primary)]"
+                        title="Node base domain — domainless services placed here get <name>.<domain> hostnames"
+                      >
+                        <Pencil size={11} />
+                      </button>
+                    )}
+                  </>
+                ) : (
+                  <>
+                    <input
+                      value={domainDraft}
+                      onChange={(e) => setDomainDraft(e.target.value)}
+                      onKeyDown={(e) => {
+                        if (e.key === 'Enter') updateMutation.mutate({ default_domain: domainDraft.trim().toLowerCase() });
+                        if (e.key === 'Escape') setDomainDraft(null);
+                      }}
+                      autoFocus
+                      placeholder="apps.node1.example.com — empty clears"
+                      className="rounded-md border border-[var(--border-subtle)] bg-[var(--bg-tertiary)] px-2 py-0.5 text-[11px] text-[var(--text-primary)] w-64"
+                    />
+                    <button
+                      onClick={() => updateMutation.mutate({ default_domain: domainDraft.trim().toLowerCase() })}
+                      className="text-[var(--accent-primary)] hover:underline"
+                    >save</button>
+                    <button onClick={() => setDomainDraft(null)} className="text-[var(--text-muted)] hover:underline">cancel</button>
+                  </>
+                )}
+              </p>
             </div>
             <div className="flex items-center gap-3">
               <span className={`v-mono text-[11px] px-2 py-1 rounded-md border ${online
@@ -215,6 +300,16 @@ export function NodeDetailPage() {
                   >
                     drain
                   </button>
+                  <button
+                    onClick={() => upgradeMutation.mutate()}
+                    disabled={upgradeMutation.isPending || !online}
+                    title={online
+                      ? `Upgrade agent to the server's bundled binary (server ${upgradeMutation.data?.version ?? 'build'}) — the agent restarts itself`
+                      : 'Node must be online to upgrade'}
+                    className="v-mono text-[11px] px-3 py-1.5 rounded-md border border-[var(--border-subtle)] text-[var(--text-secondary)] hover:text-[var(--text-primary)] disabled:opacity-50"
+                  >
+                    {upgradeMutation.isPending ? 'upgrading…' : 'upgrade agent'}
+                  </button>
                   <button
                     onClick={() => setConfirmVolumes(true)}
                     disabled={pruneMutation.isPending}

app/frontend/src/features/secondary/pages.tsx

@@ -75,6 +75,11 @@ import {
   type CreateDatabaseInput,
   type DatabaseEntity,
   type FailoverPolicy,
+  listNotificationChannels,
+  createNotificationChannel,
+  deleteNotificationChannel,
+  testNotificationChannel,
+  type NotificationChannel,
 } from '@/lib/api-client';
 import {
   demoBuilds,
@@ -139,6 +144,8 @@ import {
   Cloud,
   ExternalLink,
   Upload,
+  Bell,
+  Send,
 } from 'lucide-react';
 
 function SecondaryPageHeader({ title, description }: { title: string; description: string }) {
@@ -1246,7 +1253,11 @@ export function GitHubAppCallbackPage() {
     mutationFn: (appCode: string) => convertGitHubAppCode(appCode),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ['github-app-status'] });
-      navigate('/settings', { replace: true });
+      // The setup wizard stashes a return marker before submitting the
+      // manifest form — resume there instead of the settings page.
+      const inSetup = sessionStorage.getItem('containr.setup_return') === '1';
+      sessionStorage.removeItem('containr.setup_return');
+      navigate(inSetup ? '/setup' : '/settings', { replace: true });
     },
   });
   const firedRef = useRef(false);
@@ -1908,6 +1919,151 @@ function BackupTargetsSection() {
   );
 }
 
+function NotificationChannelsSection() {
+  const queryClient = useQueryClient();
+  const channelsQuery = useQuery({
+    queryKey: ['notification-channels'],
+    queryFn: listNotificationChannels,
+  });
+  const [kind, setKind] = useState<'ntfy' | 'gotify'>('ntfy');
+  const [endpoint, setEndpoint] = useState('');
+  const [token, setToken] = useState('');
+  const [testResult, setTestResult] = useState<Record<string, 'ok' | string>>({});
+
+  const invalidate = () => queryClient.invalidateQueries({ queryKey: ['notification-channels'] });
+  const createMutation = useMutation({
+    mutationFn: () =>
+      createNotificationChannel({
+        kind,
+        endpoint: endpoint.trim(),
+        token: token.trim() || undefined,
+      }),
+    onSuccess: () => {
+      setEndpoint('');
+      setToken('');
+      invalidate();
+    },
+  });
+  const deleteMutation = useMutation({
+    mutationFn: (id: string) => deleteNotificationChannel(id),
+    onSuccess: invalidate,
+  });
+  const testMutation = useMutation({
+    mutationFn: (id: string) => testNotificationChannel(id),
+    onSuccess: (_d, id) => setTestResult((prev) => ({ ...prev, [id]: 'ok' })),
+    onError: (err, id) =>
+      setTestResult((prev) => ({
+        ...prev,
+        [id]: err instanceof Error ? err.message : 'delivery failed',
+      })),
+  });
+
+  const channels = channelsQuery.data ?? [];
+
+  return (
+    <section className="panel p-6">
+      <div className="flex items-center gap-3 mb-4">
+        <div className="w-10 h-10 rounded-[var(--radius-md)] bg-[var(--accent-primary-soft)] flex items-center justify-center">
+          <Bell size={18} className="text-[var(--accent-primary)]" />
+        </div>
+        <div>
+          <h2 className="text-lg font-semibold text-[var(--text-primary)]">Push notifications</h2>
+          <p className="text-xs text-[var(--text-tertiary)]">Relay notifications to a self-hosted ntfy or Gotify server</p>
+        </div>
+      </div>
+
+      <div className="space-y-3">
+        <div className="flex flex-wrap gap-2">
+          <select
+            value={kind}
+            onChange={(e) => setKind(e.target.value as 'ntfy' | 'gotify')}
+            className="h-9 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-3 text-sm text-[var(--text-primary)] focus:border-[var(--accent-primary)] transition-all"
+          >
+            <option value="ntfy">ntfy</option>
+            <option value="gotify">Gotify</option>
+          </select>
+          <input
+            value={endpoint}
+            onChange={(e) => setEndpoint(e.target.value)}
+            placeholder={kind === 'ntfy' ? 'https://ntfy.example.com/my-alerts' : 'https://gotify.example.com'}
+            className="h-9 flex-1 min-w-[220px] rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-3 text-sm text-[var(--text-primary)] placeholder:text-[var(--text-muted)] focus:border-[var(--accent-primary)] transition-all"
+          />
+          <input
+            type="password"
+            value={token}
+            onChange={(e) => setToken(e.target.value)}
+            placeholder={kind === 'ntfy' ? 'Access token (optional)' : 'App token'}
+            className="h-9 w-48 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] px-3 text-sm text-[var(--text-primary)] placeholder:text-[var(--text-muted)] focus:border-[var(--accent-primary)] transition-all"
+          />
+          <button
+            onClick={() => createMutation.mutate()}
+            disabled={createMutation.isPending || !endpoint.trim()}
+            className="h-9 px-4 rounded-[var(--radius-md)] text-sm font-medium text-[var(--accent-on)] disabled:opacity-50 disabled:cursor-not-allowed transition-all"
+            style={{ background: 'var(--accent-primary)' }}
+          >
+            {createMutation.isPending ? 'Adding…' : 'Add channel'}
+          </button>
+        </div>
+
+        {createMutation.isError ? (
+          <p className="text-xs text-[var(--error)]">
+            {createMutation.error instanceof Error ? createMutation.error.message : 'Failed to add channel'}
+          </p>
+        ) : null}
+
+        {channelsQuery.isLoading ? (
+          <div className="py-4 text-center">
+            <Loader2 size={16} className="animate-spin mx-auto text-[var(--text-tertiary)]" />
+          </div>
+        ) : channels.length === 0 ? (
+          <p className="text-xs text-[var(--text-tertiary)]">
+            No push channels. Notifications stay in-app until you add one.
+          </p>
+        ) : (
+          <div className="space-y-1.5 border-t border-[var(--border-subtle)] pt-3">
+            {channels.map((ch: NotificationChannel) => (
+              <div key={ch.id} className="flex items-center justify-between gap-2 text-xs">
+                <div className="min-w-0">
+                  <span className="rounded px-1.5 py-0.5 bg-[var(--surface-muted)] text-[var(--text-secondary)] uppercase">
+                    {ch.kind}
+                  </span>
+                  <span className="ml-2 mono text-[var(--text-primary)] break-all">{ch.endpoint}</span>
+                  {testResult[ch.id] === 'ok' ? (
+                    <span className="ml-2 text-[var(--success)]">delivered</span>
+                  ) : testResult[ch.id] ? (
+                    <span className="ml-2 text-[var(--error)]">{testResult[ch.id]}</span>
+                  ) : null}
+                </div>
+                <div className="flex items-center gap-3 shrink-0">
+                  <button
+                    onClick={() => testMutation.mutate(ch.id)}
+                    disabled={testMutation.isPending}
+                    className="flex items-center gap-1 text-[var(--text-secondary)] hover:text-[var(--accent-primary)] disabled:opacity-50"
+                  >
+                    <Send size={12} />
+                    Test
+                  </button>
+                  <button
+                    onClick={() => {
+                      if (window.confirm(`Remove ${ch.kind} channel ${ch.endpoint}?`)) {
+                        deleteMutation.mutate(ch.id);
+                      }
+                    }}
+                    disabled={deleteMutation.isPending}
+                    className="text-[var(--error)] hover:underline disabled:opacity-50"
+                  >
+                    Remove
+                  </button>
+                </div>
+              </div>
+            ))}
+          </div>
+        )}
+      </div>
+    </section>
+  );
+}
+
 export function SettingsPage() {
   const navigate = useNavigate();
   const queryClient = useQueryClient();
@@ -2081,6 +2237,7 @@ export function SettingsPage() {
 
           {/* Personal Access Tokens */}
           <UserTokensSection isAdmin={profileQuery.data?.isAdmin ?? false} />
+          <NotificationChannelsSection />
           <RegistriesSection />
           <BackupTargetsSection />
 

app/frontend/src/features/service/pages/ServiceDetailPage.tsx

@@ -485,7 +485,7 @@ export function ServiceDetailPage() {
   const [volumesForm, setVolumesForm] = useState<ServiceVolume[] | null>(null);
   const [domainInput, setDomainInput] = useState('');
   const [domainChecks, setDomainChecks] = useState<Record<string, DomainCheckResult> | null>(null);
-  const [accessForm, setAccessForm] = useState<{ maintenance: boolean; basicAuth: string } | null>(null);
+  const [accessForm, setAccessForm] = useState<{ maintenance: boolean; basicAuth: string; traefikLabels: string } | null>(null);
   const [sleepDraft, setSleepDraft] = useState<{ id: string; enabled: boolean; minutes: string } | null>(null);
   const [nodeDraft, setNodeDraft] = useState<string | null>(null);
   const nodesQuery = useQuery({
@@ -2452,6 +2452,30 @@ export function ServiceDetailPage() {
                     <span className="text-[var(--text-tertiary)]">running on {service.nodeName}</span>
                   )}
                 </div>
+                {!service.nodeId && (
+                  <div className="mt-3 flex items-center gap-2 text-xs">
+                    <label className="text-[var(--text-tertiary)]" htmlFor="placement-tags">
+                      required node tags
+                    </label>
+                    <input
+                      id="placement-tags"
+                      type="text"
+                      placeholder="e.g. eu-west, gpu — empty = any node"
+                      defaultValue={(service.placementTags ?? []).join(', ')}
+                      disabled={updateServiceMutation.isPending}
+                      title="Remote placement only targets nodes carrying every tag. Re-resolved each reconcile — the service follows the tag, not a stored node."
+                      onBlur={(e) => {
+                        const next = e.target.value.split(',').map((t) => t.trim()).filter(Boolean);
+                        const prev = service.placementTags ?? [];
+                        if (next.join('|') !== prev.join('|')) {
+                          updateServiceMutation.mutate({ placement_tags: next });
+                        }
+                      }}
+                      onKeyDown={(e) => { if (e.key === 'Enter') (e.target as HTMLInputElement).blur(); }}
+                      className="px-2 py-1.5 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm text-[var(--text-primary)] w-72"
+                    />
+                  </div>
+                )}
                 {updateServiceMutation.isError && (
                   <p className="mt-2 text-xs text-[var(--error)]">{(updateServiceMutation.error as Error).message}</p>
                 )}
@@ -2466,7 +2490,13 @@ export function ServiceDetailPage() {
                     <button
                       type="button"
                       onClick={() =>
-                        setAccessForm({ maintenance: Boolean(service.maintenanceMode), basicAuth: '' })
+                        setAccessForm({
+                          maintenance: Boolean(service.maintenanceMode),
+                          basicAuth: '',
+                          traefikLabels: Object.entries(service.traefikLabels ?? {})
+                            .map(([k, v]) => `${k}=${v}`)
+                            .join('\n'),
+                        })
                       }
                       className="px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-xs font-medium hover:border-[var(--border-default)] transition-colors"
                     >
@@ -2487,6 +2517,14 @@ export function ServiceDetailPage() {
                         {(service.basicAuth ?? []).length > 0 ? (service.basicAuth ?? []).join(', ') : 'off'}
                       </p>
                     </div>
+                    <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
+                      <p className="text-[var(--text-tertiary)] uppercase tracking-wide">Routing overrides</p>
+                      <p className="mt-1 text-sm font-medium text-[var(--text-primary)]">
+                        {Object.keys(service.traefikLabels ?? {}).length > 0
+                          ? `${Object.keys(service.traefikLabels ?? {}).length} label(s)`
+                          : 'off'}
+                      </p>
+                    </div>
                   </div>
                 ) : (
                   <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-4 space-y-4">
@@ -2508,6 +2546,16 @@ export function ServiceDetailPage() {
                         className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm mono text-[var(--text-primary)]"
                       />
                     </div>
+                    <div>
+                      <label className="block text-xs text-[var(--text-tertiary)] mb-1">Routing overrides — Traefik middleware labels, key=value per line; empty clears</label>
+                      <textarea
+                        value={accessForm.traefikLabels}
+                        onChange={(e) => setAccessForm({ ...accessForm, traefikLabels: e.target.value })}
+                        rows={3}
+                        placeholder={"middlewares.rl.ratelimit.average=100\nmiddlewares.sec.headers.customresponseheaders.X-Frame-Options=DENY"}
+                        className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm mono text-[var(--text-primary)]"
+                      />
+                    </div>
                     <div className="flex items-center gap-2">
                       <button
                         type="button"
@@ -2522,8 +2570,17 @@ export function ServiceDetailPage() {
                               return i > 0 ? { username: l.slice(0, i), password: l.slice(i + 1) } : null;
                             })
                             .filter((x): x is { username: string; password: string } => x !== null);
+                          const labels: Record<string, string> = {};
+                          accessForm.traefikLabels
+                            .split('\n')
+                            .map((l) => l.trim())
+                            .filter(Boolean)
+                            .forEach((l) => {
+                              const i = l.indexOf('=');
+                              if (i > 0) labels[l.slice(0, i).trim()] = l.slice(i + 1).trim();
+                            });
                           updateServiceMutation.mutate(
-                            { maintenance_mode: accessForm.maintenance, basic_auth: creds },
+                            { maintenance_mode: accessForm.maintenance, basic_auth: creds, traefik_labels: labels },
                             { onSuccess: () => setAccessForm(null) },
                           );
                         }}

app/frontend/src/features/setup/SetupWizardPage.test.tsx

@@ -0,0 +1,92 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { render, screen } from '@testing-library/react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { MemoryRouter } from 'react-router-dom';
+import { SetupWizardPage } from './SetupWizardPage';
+import type { SetupStatus } from '@/lib/api-client';
+
+const mockStatus = vi.fn<() => Promise<SetupStatus>>();
+const mockSession = vi.fn();
+
+vi.mock('@/lib/api-client', async (importOriginal) => {
+  const mod = await importOriginal<typeof import('@/lib/api-client')>();
+  return {
+    ...mod,
+    getSetupStatus: () => mockStatus(),
+    completeSetup: vi.fn().mockResolvedValue(undefined),
+  };
+});
+
+vi.mock('@/lib/use-auth-session', () => ({
+  useAuthSession: () => mockSession(),
+}));
+
+function renderWizard() {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  return render(
+    <QueryClientProvider client={queryClient}>
+      <MemoryRouter initialEntries={['/setup']}>
+        <SetupWizardPage />
+      </MemoryRouter>
+    </QueryClientProvider>,
+  );
+}
+
+const base: SetupStatus = {
+  has_users: false,
+  setup_completed: false,
+  needs_setup: true,
+  has_github_app: false,
+  has_tunnel: false,
+  signup_enabled: false,
+};
+
+describe('SetupWizardPage', () => {
+  beforeEach(() => {
+    mockSession.mockReturnValue({ data: null });
+  });
+
+  it('prompts for the admin account on a fresh install', async () => {
+    mockStatus.mockResolvedValue({ ...base });
+    renderWizard();
+    expect(await screen.findByText(/welcome to containr/i)).toBeInTheDocument();
+    expect(screen.getByText(/create admin account/i)).toBeInTheDocument();
+  });
+
+  it('offers sign-in when users exist but nobody is signed in', async () => {
+    mockStatus.mockResolvedValue({ ...base, has_users: true });
+    renderWizard();
+    expect(await screen.findByText(/sign in to continue setup/i)).toBeInTheDocument();
+  });
+
+  it('shows the git provider step for a signed-in admin without GitHub App', async () => {
+    mockStatus.mockResolvedValue({ ...base, has_users: true });
+    mockSession.mockReturnValue({ data: { user: { id: 'u1' } } });
+    renderWizard();
+    expect(await screen.findByText(/connect a git provider/i)).toBeInTheDocument();
+    expect(screen.getByText(/set up github app/i)).toBeInTheDocument();
+  });
+
+  it('shows the tunnel step when git is already wired', async () => {
+    mockStatus.mockResolvedValue({ ...base, has_users: true, has_github_app: true });
+    mockSession.mockReturnValue({ data: { user: { id: 'u1' } } });
+    renderWizard();
+    expect(
+      await screen.findByRole('heading', { name: /public access/i }),
+    ).toBeInTheDocument();
+  });
+
+  it('lands on the finish step when everything is configured', async () => {
+    mockStatus.mockResolvedValue({
+      ...base,
+      has_users: true,
+      has_github_app: true,
+      has_tunnel: true,
+    });
+    mockSession.mockReturnValue({ data: { user: { id: 'u1' } } });
+    renderWizard();
+    expect(await screen.findByText(/enter containr/i)).toBeInTheDocument();
+  });
+});

app/frontend/src/features/setup/SetupWizardPage.tsx

@@ -0,0 +1,279 @@
+import { useMemo, useState } from 'react';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { Link, Navigate, useNavigate } from 'react-router-dom';
+import { Check, ChevronRight, Github, Loader2, Rocket, ShieldCheck } from 'lucide-react';
+import { useAuthSession } from '@/lib/use-auth-session';
+import {
+  completeSetup,
+  createGitHubAppManifest,
+  getSetupStatus,
+  updatePlatformSettings,
+} from '@/lib/api-client';
+
+// Marker the GitHub App callback reads so the wizard flow resumes here
+// instead of the settings page.
+const SETUP_RETURN_KEY = 'containr.setup_return';
+
+type Step = 'account' | 'github' | 'tunnel' | 'done';
+
+export function SetupWizardPage() {
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+  const sessionQuery = useAuthSession();
+  const statusQuery = useQuery({ queryKey: ['setup-status'], queryFn: getSetupStatus });
+  const [override, setOverride] = useState<Step | null>(null);
+
+  const status = statusQuery.data;
+  const signedIn = Boolean(sessionQuery.data);
+
+  const step: Step = useMemo(() => {
+    if (override) return override;
+    if (!status) return 'account';
+    if (!status.has_users || !signedIn) return 'account';
+    if (!status.has_github_app) return 'github';
+    if (!status.has_tunnel) return 'tunnel';
+    return 'done';
+  }, [override, status, signedIn]);
+
+  const completeMutation = useMutation({
+    mutationFn: completeSetup,
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['setup-status'] });
+      navigate('/projects', { replace: true });
+    },
+  });
+
+  if (statusQuery.isLoading) {
+    return (
+      <div className="min-h-screen flex items-center justify-center bg-[var(--bg-primary)]">
+        <Loader2 size={22} className="animate-spin text-[var(--accent-primary)]" />
+      </div>
+    );
+  }
+
+  // Wizard is optional once the instance is already configured.
+  if (status && !status.needs_setup && !override) {
+    return <Navigate to="/projects" replace />;
+  }
+
+  const steps: { key: Step; label: string }[] = [
+    { key: 'account', label: 'Admin account' },
+    { key: 'github', label: 'Git provider' },
+    { key: 'tunnel', label: 'Public access' },
+    { key: 'done', label: 'Done' },
+  ];
+  const activeIdx = steps.findIndex((s) => s.key === step);
+
+  return (
+    <div className="min-h-screen bg-[var(--bg-primary)] flex flex-col items-center px-5 py-16">
+      <div className="w-full max-w-lg">
+        <div className="flex items-center gap-2 mb-8">
+          {steps.map((s, i) => (
+            <div key={s.key} className="flex items-center gap-2">
+              <div
+                className={`w-6 h-6 rounded-full flex items-center justify-center text-[11px] font-semibold border ${
+                  i < activeIdx
+                    ? 'bg-[var(--accent-primary)] border-[var(--accent-primary)] text-[var(--accent-on)]'
+                    : i === activeIdx
+                      ? 'border-[var(--accent-primary)] text-[var(--accent-primary)]'
+                      : 'border-[var(--border-subtle)] text-[var(--text-muted)]'
+                }`}
+              >
+                {i < activeIdx ? <Check size={12} /> : i + 1}
+              </div>
+              <span
+                className={`text-xs ${i === activeIdx ? 'text-[var(--text-primary)] font-medium' : 'text-[var(--text-muted)]'}`}
+              >
+                {s.label}
+              </span>
+              {i < steps.length - 1 ? <div className="w-6 h-px bg-[var(--border-subtle)]" /> : null}
+            </div>
+          ))}
+        </div>
+
+        {step === 'account' ? (
+          <section className="panel p-6">
+            <h1 className="text-xl font-bold text-[var(--text-primary)]">Welcome to Containr</h1>
+            <p className="mt-2 text-sm text-[var(--text-secondary)]">
+              First boot detected. Create the admin account — registration closes to the public
+              right after, so this account owns the instance.
+            </p>
+            {status?.has_users && !signedIn ? (
+              <div className="mt-4">
+                <p className="text-sm text-[var(--text-secondary)]">
+                  An account already exists — sign in to continue setup.
+                </p>
+                <Link
+                  to="/auth/sign-in?redirect=/setup"
+                  className="mt-4 inline-flex items-center gap-2 h-9 px-4 rounded-[var(--radius-md)] text-sm font-medium text-[var(--accent-on)]"
+                  style={{ background: 'var(--accent-primary)' }}
+                >
+                  Sign in <ChevronRight size={14} />
+                </Link>
+              </div>
+            ) : !status?.has_users ? (
+              <Link
+                to="/auth/sign-up?redirect=/setup"
+                className="mt-4 inline-flex items-center gap-2 h-9 px-4 rounded-[var(--radius-md)] text-sm font-medium text-[var(--accent-on)]"
+                style={{ background: 'var(--accent-primary)' }}
+              >
+                Create admin account <ChevronRight size={14} />
+              </Link>
+            ) : null}
+          </section>
+        ) : null}
+
+        {step === 'github' ? <GitHubStep onNext={() => setOverride('tunnel')} /> : null}
+        {step === 'tunnel' ? <TunnelStep onNext={() => setOverride('done')} /> : null}
+
+        {step === 'done' ? (
+          <section className="panel p-6 text-center">
+            <Rocket size={28} className="mx-auto text-[var(--accent-primary)]" />
+            <h1 className="mt-4 text-xl font-bold text-[var(--text-primary)]">All set</h1>
+            <p className="mt-2 text-sm text-[var(--text-secondary)]">
+              Deploy your first service from a git repo, an image, or a template — the dashboard is
+              ready.
+            </p>
+            {completeMutation.isError ? (
+              <p className="mt-3 text-xs text-[var(--error)]">
+                {completeMutation.error instanceof Error
+                  ? completeMutation.error.message
+                  : 'Failed to save setup state'}
+              </p>
+            ) : null}
+            <button
+              type="button"
+              onClick={() => completeMutation.mutate()}
+              disabled={completeMutation.isPending}
+              className="mt-5 inline-flex items-center gap-2 h-10 px-6 rounded-[var(--radius-md)] text-sm font-semibold text-[var(--accent-on)] disabled:opacity-50"
+              style={{ background: 'var(--accent-primary)' }}
+            >
+              {completeMutation.isPending ? (
+                <Loader2 size={14} className="animate-spin" />
+              ) : (
+                <ShieldCheck size={15} />
+              )}
+              Enter Containr
+            </button>
+          </section>
+        ) : null}
+      </div>
+    </div>
+  );
+}
+
+function GitHubStep({ onNext }: { onNext: () => void }) {
+  const queryClient = useQueryClient();
+  const provisionMutation = useMutation({
+    mutationFn: async () => {
+      const { url, manifest } = await createGitHubAppManifest({
+        base_url: window.location.origin,
+      });
+      sessionStorage.setItem(SETUP_RETURN_KEY, '1');
+      const form = document.createElement('form');
+      form.method = 'POST';
+      form.action = url;
+      const input = document.createElement('input');
+      input.type = 'hidden';
+      input.name = 'manifest';
+      input.value = manifest;
+      form.appendChild(input);
+      document.body.appendChild(form);
+      form.submit();
+    },
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ['setup-status'] }),
+  });
+
+  return (
+    <section className="panel p-6">
+      <div className="flex items-center gap-3 mb-3">
+        <Github size={20} className="text-[var(--text-primary)]" />
+        <h1 className="text-xl font-bold text-[var(--text-primary)]">Connect a git provider</h1>
+      </div>
+      <p className="text-sm text-[var(--text-secondary)]">
+        Provision the instance GitHub App — repo push events then trigger deployments and preview
+        environments automatically. Self-hosted GitLab/Gitea can be added later in Settings.
+      </p>
+      {provisionMutation.isError ? (
+        <p className="mt-3 text-xs text-[var(--error)]">
+          {provisionMutation.error instanceof Error
+            ? provisionMutation.error.message
+            : 'Could not start GitHub App provisioning'}
+        </p>
+      ) : null}
+      <div className="mt-5 flex items-center gap-3">
+        <button
+          type="button"
+          onClick={() => provisionMutation.mutate()}
+          disabled={provisionMutation.isPending}
+          className="inline-flex items-center gap-2 h-9 px-4 rounded-[var(--radius-md)] text-sm font-medium text-[var(--accent-on)] disabled:opacity-50"
+          style={{ background: 'var(--accent-primary)' }}
+        >
+          {provisionMutation.isPending ? <Loader2 size={14} className="animate-spin" /> : null}
+          Set up GitHub App
+        </button>
+        <button
+          type="button"
+          onClick={onNext}
+          className="h-9 px-4 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-sm text-[var(--text-secondary)] hover:text-[var(--text-primary)] transition-colors"
+        >
+          Skip for now
+        </button>
+      </div>
+    </section>
+  );
+}
+
+function TunnelStep({ onNext }: { onNext: () => void }) {
+  const queryClient = useQueryClient();
+  const [token, setToken] = useState('');
+  const saveMutation = useMutation({
+    mutationFn: () =>
+      updatePlatformSettings({ cloudflareTunnelToken: token.trim() || undefined }),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['setup-status'] });
+      onNext();
+    },
+  });
+
+  return (
+    <section className="panel p-6">
+      <h1 className="text-xl font-bold text-[var(--text-primary)]">Public access (optional)</h1>
+      <p className="mt-2 text-sm text-[var(--text-secondary)]">
+        Paste a Cloudflare Tunnel token to expose this instance on the internet. Without one,
+        Containr stays reachable on this network — you can add it later in Settings.
+      </p>
+      <input
+        type="password"
+        value={token}
+        onChange={(e) => setToken(e.target.value)}
+        placeholder="eyJhIjo… tunnel token"
+        className="mt-4 w-full h-10 px-3 rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--surface-muted)] text-sm text-[var(--text-primary)] placeholder:text-[var(--text-muted)] focus:border-[var(--accent-primary)] transition-colors"
+      />
+      {saveMutation.isError ? (
+        <p className="mt-3 text-xs text-[var(--error)]">
+          {saveMutation.error instanceof Error ? saveMutation.error.message : 'Failed to save token'}
+        </p>
+      ) : null}
+      <div className="mt-5 flex items-center gap-3">
+        <button
+          type="button"
+          onClick={() => (token.trim() ? saveMutation.mutate() : onNext())}
+          disabled={saveMutation.isPending}
+          className="inline-flex items-center gap-2 h-9 px-4 rounded-[var(--radius-md)] text-sm font-medium text-[var(--accent-on)] disabled:opacity-50"
+          style={{ background: 'var(--accent-primary)' }}
+        >
+          {saveMutation.isPending ? <Loader2 size={14} className="animate-spin" /> : null}
+          {token.trim() ? 'Save tunnel token' : 'Continue'}
+        </button>
+        <button
+          type="button"
+          onClick={onNext}
+          className="h-9 px-4 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-sm text-[var(--text-secondary)] hover:text-[var(--text-primary)] transition-colors"
+        >
+          Skip
+        </button>
+      </div>
+    </section>
+  );
+}

app/frontend/src/features/templates/builder/TemplateBuilder.tsx

@@ -0,0 +1,467 @@
+import { useCallback, useMemo, useState } from 'react';
+import {
+  Background,
+  BackgroundVariant,
+  Handle,
+  MarkerType,
+  Position,
+  ReactFlow,
+  ReactFlowProvider,
+  useReactFlow,
+  type Connection,
+  type Edge,
+  type EdgeChange,
+  type Node,
+  type NodeChange,
+  type NodeProps,
+} from '@xyflow/react';
+import '@xyflow/react/dist/style.css';
+import { Database, GitBranch, Package, Timer, Trash2, X } from 'lucide-react';
+import {
+  canvasFromConfig,
+  configFromCanvas,
+  newServiceKey,
+  validateGraph,
+  type BuilderNode,
+  type BuilderService,
+  type BuilderServiceType,
+} from './builder-model';
+
+type ServiceBuilderNode = Node<{ svc: BuilderService }, 'tplService'>;
+
+const TYPE_META: Record<BuilderServiceType, { label: string; icon: typeof Package; cls: string }> = {
+  web: { label: 'Web', icon: Package, cls: 'text-[var(--accent-primary)]' },
+  worker: { label: 'Worker', icon: GitBranch, cls: 'text-[var(--info,#5eb3f6)]' },
+  cron: { label: 'Cron', icon: Timer, cls: 'text-[var(--warning)]' },
+  database: { label: 'Database', icon: Database, cls: 'text-[var(--success,#7bd88a)]' },
+};
+
+const DATABASE_ENGINES = ['postgresql', 'mysql', 'mariadb', 'mongodb', 'redis', 'dragonfly', 'clickhouse'];
+
+function ServiceBuilderNodeView({ data, selected }: NodeProps<ServiceBuilderNode>) {
+  const meta = TYPE_META[data.svc.type] ?? TYPE_META.web;
+  const Icon = meta.icon;
+  return (
+    <div
+      className={`relative w-[210px] rounded-[var(--radius-md)] border bg-[var(--bg-elevated)] px-3 py-2.5 shadow-sm transition-colors ${
+        selected ? 'border-[var(--accent-primary)]' : 'border-[var(--border-subtle)]'
+      }`}
+    >
+      <Handle type="target" position={Position.Left} className="!h-2.5 !w-2.5 !border-[var(--border-default)] !bg-[var(--bg-base)]" />
+      <Handle type="source" position={Position.Right} className="!h-2.5 !w-2.5 !border-[var(--border-default)] !bg-[var(--bg-base)]" />
+      <div className="flex items-center gap-2">
+        <Icon size={14} className={meta.cls} />
+        <span className="truncate text-[12.5px] font-semibold text-[var(--text-primary)]">
+          {data.svc.name || data.svc.key}
+        </span>
+      </div>
+      <div className="mt-1 flex items-center justify-between gap-2">
+        <span className="text-[10.5px] uppercase tracking-wide text-[var(--text-tertiary)]">{meta.label}</span>
+        <span className="mono max-w-[120px] truncate text-[10.5px] text-[var(--text-secondary)]">
+          {data.svc.runtime || data.svc.repo || '—'}
+        </span>
+      </div>
+    </div>
+  );
+}
+
+const nodeTypes = { tplService: ServiceBuilderNodeView };
+
+// Edges run dependency → dependent: connecting A → B means "B depends_on A".
+export function TemplateBuilder(props: {
+  config: Record<string, unknown>;
+  onApply: (config: Record<string, unknown>) => void;
+  onCancel: () => void;
+}) {
+  return (
+    <ReactFlowProvider>
+      <BuilderInner {...props} />
+    </ReactFlowProvider>
+  );
+}
+
+function BuilderInner({
+  config,
+  onApply,
+  onCancel,
+}: {
+  config: Record<string, unknown>;
+  onApply: (config: Record<string, unknown>) => void;
+  onCancel: () => void;
+}) {
+  const { screenToFlowPosition } = useReactFlow();
+  const initial = useMemo(() => canvasFromConfig(config), [config]);
+  const [services, setServices] = useState<Map<string, BuilderService>>(
+    () => new Map(initial.map((n) => [n.key, { ...n.service }])),
+  );
+  const [positions, setPositions] = useState<Record<string, { x: number; y: number }>>(
+    () => Object.fromEntries(initial.map((n) => [n.key, n.position])),
+  );
+  const [selectedKey, setSelectedKey] = useState<string | null>(null);
+
+  const flowNodes: ServiceBuilderNode[] = useMemo(
+    () =>
+      [...services.values()].map((svc) => ({
+        id: svc.key,
+        type: 'tplService' as const,
+        position: positions[svc.key] ?? { x: 0, y: 0 },
+        data: { svc },
+        selected: svc.key === selectedKey,
+      })),
+    [services, positions, selectedKey],
+  );
+
+  const flowEdges: Edge[] = useMemo(
+    () =>
+      [...services.values()].flatMap((svc) =>
+        (svc.depends_on ?? [])
+          .filter((dep) => services.has(dep))
+          .map((dep) => ({
+            id: `${dep}->${svc.key}`,
+            source: dep,
+            target: svc.key,
+            markerEnd: { type: MarkerType.ArrowClosed, width: 14, height: 14, color: 'rgba(180,227,74,0.55)' },
+            style: { stroke: 'rgba(180,227,74,0.42)', strokeWidth: 1.6 },
+            className: 'edge-premium',
+          })),
+      ),
+    [services],
+  );
+
+  const builderNodes: BuilderNode[] = useMemo(
+    () =>
+      [...services.values()].map((svc) => ({
+        key: svc.key,
+        service: svc,
+        position: positions[svc.key] ?? { x: 0, y: 0 },
+      })),
+    [services, positions],
+  );
+  const errors = useMemo(() => validateGraph(builderNodes), [builderNodes]);
+
+  const patchService = useCallback((key: string, patch: Partial<BuilderService>) => {
+    setServices((prev) => {
+      const svc = prev.get(key);
+      if (!svc) return prev;
+      const next = new Map(prev);
+      next.set(key, { ...svc, ...patch });
+      return next;
+    });
+  }, []);
+
+  const addService = useCallback((type: BuilderServiceType, position?: { x: number; y: number }) => {
+    setServices((prev) => {
+      const key = newServiceKey(type, new Set(prev.keys()));
+      const next = new Map(prev);
+      next.set(key, {
+        key,
+        type,
+        runtime: type === 'database' ? 'postgresql' : undefined,
+      });
+      setPositions((pos) => ({ ...pos, [key]: position ?? { x: 80, y: 40 + (next.size - 1) * 150 } }));
+      setSelectedKey(key);
+      return next;
+    });
+  }, []);
+
+  const removeService = useCallback((key: string) => {
+    setServices((prev) => {
+      const next = new Map(prev);
+      next.delete(key);
+      for (const svc of next.values()) {
+        svc.depends_on = svc.depends_on?.filter((d) => d !== key);
+      }
+      return next;
+    });
+    setPositions((prev) => {
+      const next = { ...prev };
+      delete next[key];
+      return next;
+    });
+    setSelectedKey((cur) => (cur === key ? null : cur));
+  }, []);
+
+  const onConnect = useCallback(
+    (conn: Connection) => {
+      if (!conn.source || !conn.target || conn.source === conn.target) return;
+      const target = services.get(conn.target);
+      if (!target) return;
+      patchService(conn.target, {
+        depends_on: [...new Set([...(target.depends_on ?? []), conn.source])],
+      });
+    },
+    [patchService, services],
+  );
+
+  const onNodesChange = useCallback(
+    (changes: NodeChange<ServiceBuilderNode>[]) => {
+      for (const ch of changes) {
+        if (ch.type === 'position' && ch.position) {
+          setPositions((prev) => ({ ...prev, [ch.id]: ch.position! }));
+        } else if (ch.type === 'remove') {
+          removeService(ch.id);
+        } else if (ch.type === 'select') {
+          if (ch.selected) setSelectedKey(ch.id);
+        }
+      }
+    },
+    [removeService],
+  );
+
+  const onEdgesChange = useCallback(
+    (changes: EdgeChange<Edge>[]) => {
+      for (const ch of changes) {
+        if (ch.type !== 'remove') continue;
+        const edge = flowEdges.find((e) => e.id === ch.id);
+        if (!edge) continue;
+        const svc = services.get(edge.target);
+        if (svc) {
+          patchService(edge.target, {
+            depends_on: (svc.depends_on ?? []).filter((d) => d !== edge.source),
+          });
+        }
+      }
+    },
+    [flowEdges, patchService, services],
+  );
+
+  const selected = selectedKey ? services.get(selectedKey) : null;
+
+  return (
+    <div className="flex min-h-0 flex-1">
+      <div className="relative flex-1">
+        <div className="absolute left-3 top-3 z-10 flex gap-1.5">
+          {(['web', 'database', 'cron', 'worker'] as const).map((t) => {
+            const meta = TYPE_META[t];
+            const Icon = meta.icon;
+            return (
+              <button
+                key={t}
+                type="button"
+                onClick={() => addService(t)}
+                className="canvas-pill inline-flex items-center gap-1.5 px-2.5 py-1.5 text-[11px] font-medium text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
+              >
+                <Icon size={12} className={meta.cls} />
+                {meta.label}
+              </button>
+            );
+          })}
+        </div>
+        <ReactFlow
+          nodes={flowNodes}
+          edges={flowEdges}
+          nodeTypes={nodeTypes}
+          onNodesChange={onNodesChange}
+          onEdgesChange={onEdgesChange}
+          onConnect={onConnect}
+          onPaneClick={() => setSelectedKey(null)}
+          onDoubleClick={(e) => {
+            if ((e.target as HTMLElement).closest('.react-flow__node')) return;
+            addService('web', screenToFlowPosition({ x: e.clientX, y: e.clientY }));
+          }}
+          fitView
+          deleteKeyCode={['Backspace', 'Delete']}
+          proOptions={{ hideAttribution: true }}
+        >
+          <Background variant={BackgroundVariant.Dots} gap={22} size={1.2} color="rgba(255,255,255,0.07)" />
+        </ReactFlow>
+        <div className="canvas-pill absolute bottom-3 left-3 z-10 px-3 py-1.5 text-[10.5px] text-[var(--text-tertiary)]">
+          drag = move · connect handles = depends_on · double-click = add web · Del = remove
+        </div>
+      </div>
+
+      <div className="flex w-[290px] shrink-0 flex-col border-l border-[var(--border-subtle)]">
+        {selected ? (
+          <Inspector
+            key={selected.key}
+            svc={selected}
+            onPatch={(patch) => patchService(selected.key, patch)}
+            onRemove={() => removeService(selected.key)}
+          />
+        ) : (
+          <div className="flex flex-1 flex-col items-center justify-center gap-2 px-6 text-center">
+            <Package size={22} className="text-[var(--text-tertiary)]" />
+            <p className="text-xs text-[var(--text-tertiary)]">
+              Select a node to edit it, or add one from the toolbar.
+            </p>
+          </div>
+        )}
+        <div className="border-t border-[var(--border-subtle)] p-3">
+          {errors.length > 0 ? (
+            <div className="mb-2 max-h-[90px] overflow-y-auto rounded-[var(--radius-sm)] bg-[var(--error-soft)] px-3 py-2">
+              {errors.map((e) => (
+                <p key={e} className="text-[11px] text-[var(--error)]">• {e}</p>
+              ))}
+            </div>
+          ) : null}
+          <div className="flex gap-2">
+            <button
+              type="button"
+              onClick={onCancel}
+              className="flex-1 rounded-[var(--radius-md)] px-3 py-2 text-xs font-medium text-[var(--text-secondary)] hover:bg-[var(--surface-muted)]"
+            >
+              Back to JSON
+            </button>
+            <button
+              type="button"
+              disabled={errors.length > 0 || services.size === 0}
+              onClick={() => onApply(configFromCanvas(builderNodes, config))}
+              className="flex-1 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-3 py-2 text-xs font-semibold text-[var(--accent-on)] disabled:opacity-50"
+            >
+              Apply to JSON
+            </button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+const FIELD_CLS =
+  'w-full rounded-[var(--radius-sm)] border border-[var(--border-default)] bg-[var(--bg-void)] px-2.5 py-1.5 text-[12px] text-[var(--text-primary)] outline-none focus:border-[var(--accent-primary)]';
+const LABEL_CLS = 'mb-1 block text-[10.5px] font-medium uppercase tracking-wide text-[var(--text-tertiary)]';
+
+function Inspector({
+  svc,
+  onPatch,
+  onRemove,
+}: {
+  svc: BuilderService;
+  onPatch: (patch: Partial<BuilderService>) => void;
+  onRemove: () => void;
+}) {
+  const envText = Object.entries(svc.environment ?? {})
+    .map(([k, v]) => `${k}=${v}`)
+    .join('\n');
+  const volText = (svc.volumes ?? []).map((v) => `${v.source}:${v.target}${v.read_only ? ':ro' : ''}`).join('\n');
+  return (
+    <div className="flex-1 overflow-y-auto p-4">
+      <div className="mb-3 flex items-center justify-between">
+        <span className="text-[12px] font-semibold text-[var(--text-primary)]">{svc.key}</span>
+        <button
+          type="button"
+          onClick={onRemove}
+          className="flex items-center gap-1 rounded-[var(--radius-sm)] px-2 py-1 text-[11px] text-[var(--error)] hover:bg-[var(--error-soft)]"
+        >
+          <Trash2 size={12} /> Remove
+        </button>
+      </div>
+
+      <label className={LABEL_CLS}>Key</label>
+      <input className={FIELD_CLS} value={svc.key} disabled title="Key is the node id — cannot be renamed" />
+
+      <label className={`${LABEL_CLS} mt-3`}>Display name</label>
+      <input className={FIELD_CLS} value={svc.name ?? ''} onChange={(e) => onPatch({ name: e.target.value || undefined })} placeholder="optional" />
+
+      <label className={`${LABEL_CLS} mt-3`}>Type</label>
+      <select
+        className={FIELD_CLS}
+        value={svc.type}
+        onChange={(e) => onPatch({ type: e.target.value as BuilderServiceType })}
+      >
+        <option value="web">Web</option>
+        <option value="worker">Worker</option>
+        <option value="cron">Cron</option>
+        <option value="database">Database</option>
+      </select>
+
+      {svc.type === 'database' ? (
+        <>
+          <label className={`${LABEL_CLS} mt-3`}>Engine</label>
+          <select className={FIELD_CLS} value={svc.runtime ?? 'postgresql'} onChange={(e) => onPatch({ runtime: e.target.value })}>
+            {DATABASE_ENGINES.map((eng) => (
+              <option key={eng} value={eng}>{eng}</option>
+            ))}
+          </select>
+        </>
+      ) : (
+        <>
+          <label className={`${LABEL_CLS} mt-3`}>Image (runtime)</label>
+          <input className={FIELD_CLS} value={svc.runtime ?? ''} onChange={(e) => onPatch({ runtime: e.target.value || undefined })} placeholder="nginx:latest" />
+          <label className={`${LABEL_CLS} mt-3`}>Git repo</label>
+          <input className={FIELD_CLS} value={svc.repo ?? ''} onChange={(e) => onPatch({ repo: e.target.value || undefined })} placeholder="owner/repo or clone URL" />
+          {svc.repo ? (
+            <>
+              <label className={`${LABEL_CLS} mt-3`}>Branch</label>
+              <input className={FIELD_CLS} value={svc.branch ?? ''} onChange={(e) => onPatch({ branch: e.target.value || undefined })} placeholder="main" />
+              <label className={`${LABEL_CLS} mt-3`}>Build command</label>
+              <input className={FIELD_CLS} value={svc.build_command ?? ''} onChange={(e) => onPatch({ build_command: e.target.value || undefined })} />
+            </>
+          ) : null}
+          <label className={`${LABEL_CLS} mt-3`}>Start command</label>
+          <input className={FIELD_CLS} value={svc.start_command ?? ''} onChange={(e) => onPatch({ start_command: e.target.value || undefined })} />
+        </>
+      )}
+
+      {svc.type === 'web' ? (
+        <>
+          <label className={`${LABEL_CLS} mt-3`}>Port</label>
+          <input
+            className={FIELD_CLS}
+            type="number"
+            value={svc.port ?? ''}
+            onChange={(e) => onPatch({ port: e.target.value ? Number(e.target.value) : undefined })}
+          />
+          <label className={`${LABEL_CLS} mt-3`}>Health check path</label>
+          <input className={FIELD_CLS} value={svc.health_check ?? ''} onChange={(e) => onPatch({ health_check: e.target.value || undefined })} placeholder="/health" />
+        </>
+      ) : null}
+
+      <label className={`${LABEL_CLS} mt-3`}>Environment (KEY=value, one per line)</label>
+      <textarea
+        className={`${FIELD_CLS} mono min-h-[70px] resize-y`}
+        defaultValue={envText}
+        spellCheck={false}
+        onBlur={(e) => {
+          const env: Record<string, string> = {};
+          for (const line of e.target.value.split('\n')) {
+            const idx = line.indexOf('=');
+            if (idx > 0) env[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();
+          }
+          onPatch({ environment: Object.keys(env).length ? env : undefined });
+        }}
+        placeholder={'DATABASE_URL={{service.db.url}}\nSECRET={{secret}}'}
+      />
+
+      <label className={`${LABEL_CLS} mt-3`}>Volumes (source:target[:ro], one per line)</label>
+      <textarea
+        className={`${FIELD_CLS} mono min-h-[50px] resize-y`}
+        defaultValue={volText}
+        spellCheck={false}
+        onBlur={(e) => {
+          const vols = e.target.value
+            .split('\n')
+            .map((l) => l.trim())
+            .filter(Boolean)
+            .map((l) => {
+              const [source, target, ro] = l.split(':');
+              return { source, target, read_only: ro === 'ro' || undefined };
+            })
+            .filter((v) => v.source && v.target);
+          onPatch({ volumes: vols.length ? vols : undefined });
+        }}
+        placeholder={'data:/var/lib/app\n./config:/etc/app:ro'}
+      />
+
+      {(svc.depends_on ?? []).length > 0 ? (
+        <div className="mt-3">
+          <span className={LABEL_CLS}>Depends on</span>
+          <div className="flex flex-wrap gap-1">
+            {svc.depends_on!.map((dep) => (
+              <span key={dep} className="inline-flex items-center gap-1 rounded-full bg-[var(--surface-muted)] px-2 py-0.5 text-[11px] text-[var(--text-secondary)]">
+                {dep}
+                <button
+                  type="button"
+                  onClick={() => onPatch({ depends_on: (svc.depends_on ?? []).filter((d) => d !== dep) })}
+                  className="text-[var(--text-tertiary)] hover:text-[var(--error)]"
+                >
+                  <X size={10} />
+                </button>
+              </span>
+            ))}
+          </div>
+        </div>
+      ) : null}
+    </div>
+  );
+}

app/frontend/src/features/templates/builder/builder-model.test.ts

@@ -0,0 +1,160 @@
+import { describe, expect, it } from 'vitest';
+import {
+  canvasFromConfig,
+  configFromCanvas,
+  layoutPositions,
+  newServiceKey,
+  validateGraph,
+  type BuilderNode,
+} from './builder-model';
+
+const plausibleConfig = {
+  version: 2,
+  services: [
+    { key: 'db', type: 'database', runtime: 'postgresql', environment: { POSTGRES_DB: 'plausible' } },
+    { key: 'events', type: 'database', runtime: 'clickhouse' },
+    {
+      key: 'web',
+      name: 'plausible',
+      type: 'web',
+      runtime: 'ghcr.io/plausible/community-edition:v2',
+      port: 8000,
+      health_check: '/api/health',
+      depends_on: ['db', 'events'],
+      environment: { DATABASE_URL: '{{service.db.url}}' },
+    },
+  ],
+};
+
+describe('canvasFromConfig', () => {
+  it('parses graph services into nodes with auto-layout', () => {
+    const nodes = canvasFromConfig(plausibleConfig);
+    expect(nodes.map((n) => n.key)).toEqual(['db', 'events', 'web']);
+    // databases are roots (depth 0), web depends on both (depth 1)
+    expect(nodes[0].position.x).toBeLessThan(nodes[2].position.x);
+    expect(nodes[1].position.y).toBeGreaterThan(nodes[0].position.y);
+  });
+
+  it('restores saved canvas positions', () => {
+    const nodes = canvasFromConfig({
+      ...plausibleConfig,
+      canvas: { positions: { db: { x: 500, y: 500 } } },
+    });
+    expect(nodes[0].position).toEqual({ x: 500, y: 500 });
+  });
+
+  it('migrates flat legacy configs to a single node', () => {
+    const nodes = canvasFromConfig({
+      type: 'web',
+      runtime: 'nginx:latest',
+      port: 80,
+      environment: { FOO: 'bar' },
+    });
+    expect(nodes).toHaveLength(1);
+    expect(nodes[0].service).toMatchObject({ key: 'app', type: 'web', runtime: 'nginx:latest', port: 80 });
+  });
+
+  it('drops entries without a key', () => {
+    const nodes = canvasFromConfig({ version: 2, services: [{ type: 'web', runtime: 'x' }, { key: 'ok', type: 'web', runtime: 'y' }] });
+    expect(nodes.map((n) => n.key)).toEqual(['ok']);
+  });
+});
+
+describe('configFromCanvas', () => {
+  it('round-trips a graph config', () => {
+    const nodes = canvasFromConfig(plausibleConfig);
+    const config = configFromCanvas(nodes, plausibleConfig);
+    const services = config.services as Record<string, unknown>[];
+    expect(config.version).toBe(2);
+    expect(services).toHaveLength(3);
+    const web = services.find((s) => s.key === 'web')!;
+    expect(web.depends_on).toEqual(['db', 'events']);
+    expect(web.port).toBe(8000);
+    expect((web.environment as Record<string, string>).DATABASE_URL).toBe('{{service.db.url}}');
+  });
+
+  it('persists node positions under config.canvas', () => {
+    const nodes = canvasFromConfig(plausibleConfig);
+    nodes[0].position = { x: 321, y: 123 };
+    const config = configFromCanvas(nodes, {});
+    expect((config.canvas as { positions: Record<string, { x: number; y: number }> }).positions.db).toEqual({ x: 321, y: 123 });
+    // and parses back to the same spot
+    expect(canvasFromConfig(config)[0].position).toEqual({ x: 321, y: 123 });
+  });
+
+  it('strips flat fields when converting a legacy config', () => {
+    const nodes = canvasFromConfig({ type: 'web', runtime: 'nginx:latest', port: 80 });
+    const config = configFromCanvas(nodes, { type: 'web', runtime: 'nginx:latest', port: 80 });
+    expect(config.type).toBeUndefined();
+    expect(config.runtime).toBeUndefined();
+    expect((config.services as unknown[]).length).toBe(1);
+  });
+});
+
+describe('layoutPositions', () => {
+  it('depths follow the depends_on chain', () => {
+    const pos = layoutPositions([
+      { key: 'a', type: 'database', runtime: 'postgresql' },
+      { key: 'b', type: 'web', runtime: 'img', depends_on: ['a'] },
+      { key: 'c', type: 'web', runtime: 'img', depends_on: ['b'] },
+    ]);
+    expect(pos.a.x).toBeLessThan(pos.b.x);
+    expect(pos.b.x).toBeLessThan(pos.c.x);
+  });
+
+  it('a dependency cycle does not hang', () => {
+    const pos = layoutPositions([
+      { key: 'a', type: 'web', runtime: 'x', depends_on: ['b'] },
+      { key: 'b', type: 'web', runtime: 'x', depends_on: ['a'] },
+    ]);
+    expect(pos.a).toBeDefined();
+    expect(pos.b).toBeDefined();
+  });
+});
+
+describe('validateGraph', () => {
+  const node = (key: string, extra: Partial<BuilderNode['service']> = {}): BuilderNode => ({
+    key,
+    position: { x: 0, y: 0 },
+    service: { key, type: 'web', runtime: 'img:1', ...extra },
+  });
+
+  it('accepts a valid graph', () => {
+    expect(validateGraph([node('db', { type: 'database', runtime: 'postgresql' }), node('web', { depends_on: ['db'] })])).toEqual([]);
+  });
+
+  it('rejects duplicate keys', () => {
+    expect(validateGraph([node('a'), node('a')])).toContain('duplicate key "a"');
+  });
+
+  it('rejects bad keys and self-deps', () => {
+    const errs = validateGraph([node('BAD KEY'), node('x', { depends_on: ['x'] })]);
+    expect(errs.some((e) => e.includes('not a valid key'))).toBe(true);
+    expect(errs).toContain('"x" depends on itself');
+  });
+
+  it('rejects deps on missing services', () => {
+    expect(validateGraph([node('web', { depends_on: ['ghost'] })])).toContain(
+      '"web" depends on unknown service "ghost"',
+    );
+  });
+
+  it('rejects database without engine and web without source', () => {
+    const errs = validateGraph([node('db', { type: 'database', runtime: undefined }), node('web', { runtime: undefined })]);
+    expect(errs).toContain('"db" is a database with no engine selected');
+    expect(errs).toContain('"web" needs an image (runtime) or a git repo');
+  });
+
+  it('reports dependency cycles', () => {
+    const errs = validateGraph([node('a', { depends_on: ['b'] }), node('b', { depends_on: ['a'] })]);
+    expect(errs.some((e) => e.startsWith('dependency cycle'))).toBe(true);
+  });
+});
+
+describe('newServiceKey', () => {
+  it('picks unused keys', () => {
+    expect(newServiceKey('database', new Set())).toBe('db');
+    expect(newServiceKey('database', new Set(['db']))).toBe('db2');
+    expect(newServiceKey('web', new Set(['web', 'web2']))).toBe('web3');
+  });
+});

app/frontend/src/features/templates/builder/builder-model.ts

@@ -0,0 +1,241 @@
+// Pure model for the visual template builder: converts between the
+// template `config` JSON (version 2 service graph, or a legacy flat
+// single-service config) and canvas state (nodes + positions), and
+// validates the graph before save. No React, no DOM — directly testable.
+
+export type BuilderServiceType = 'web' | 'worker' | 'cron' | 'database';
+
+export type BuilderService = {
+  key: string;
+  name?: string;
+  type: BuilderServiceType;
+  runtime?: string;
+  repo?: string;
+  branch?: string;
+  build_command?: string;
+  start_command?: string;
+  port?: number;
+  health_check?: string;
+  builder?: string;
+  environment?: Record<string, string>;
+  volumes?: { type?: string; source: string; target: string; read_only?: boolean }[];
+  depends_on?: string[];
+};
+
+export type BuilderCanvas = {
+  positions: Record<string, { x: number; y: number }>;
+};
+
+export type BuilderNode = {
+  key: string;
+  service: BuilderService;
+  position: { x: number; y: number };
+};
+
+const KEY_RE = /^[a-z][a-z0-9_-]*$/;
+const COL_X = 60;
+const ROW_Y = 200;
+
+function asService(raw: unknown): BuilderService | null {
+  if (!raw || typeof raw !== 'object') return null;
+  const s = raw as Record<string, unknown>;
+  const key = typeof s.key === 'string' ? s.key : '';
+  if (!key) return null;
+  const type = typeof s.type === 'string' ? s.type : 'web';
+  return {
+    key,
+    name: typeof s.name === 'string' ? s.name : undefined,
+    type: (['web', 'worker', 'cron', 'database'] as const).includes(type as BuilderServiceType)
+      ? (type as BuilderServiceType)
+      : 'web',
+    runtime: typeof s.runtime === 'string' ? s.runtime : undefined,
+    repo: typeof s.repo === 'string' ? s.repo : undefined,
+    branch: typeof s.branch === 'string' ? s.branch : undefined,
+    build_command: typeof s.build_command === 'string' ? s.build_command : undefined,
+    start_command: typeof s.start_command === 'string' ? s.start_command : undefined,
+    port: typeof s.port === 'number' ? s.port : undefined,
+    health_check: typeof s.health_check === 'string' ? s.health_check : undefined,
+    builder: typeof s.builder === 'string' ? s.builder : undefined,
+    environment:
+      s.environment && typeof s.environment === 'object' && !Array.isArray(s.environment)
+        ? Object.fromEntries(
+            Object.entries(s.environment as Record<string, unknown>).map(([k, v]) => [k, String(v)]),
+          )
+        : undefined,
+    volumes: Array.isArray(s.volumes)
+      ? (s.volumes
+          .map((v) => {
+            if (!v || typeof v !== 'object') return null;
+            const vol = v as Record<string, unknown>;
+            if (typeof vol.target !== 'string' || !vol.target) return null;
+            return {
+              type: typeof vol.type === 'string' ? vol.type : undefined,
+              source: typeof vol.source === 'string' ? vol.source : '',
+              target: vol.target,
+              read_only: typeof vol.read_only === 'boolean' ? vol.read_only : undefined,
+            };
+          })
+          .filter((v): v is NonNullable<typeof v> => v !== null)
+        )
+      : undefined,
+    depends_on: Array.isArray(s.depends_on)
+      ? s.depends_on.filter((d): d is string => typeof d === 'string')
+      : undefined,
+  };
+}
+
+// Flat legacy configs ({type, runtime, port, …} with no services array)
+// map to a single service node so the builder can edit them without
+// losing fields the round-trip would drop.
+function flatToService(config: Record<string, unknown>): BuilderService | null {
+  const type = typeof config.type === 'string' ? config.type : '';
+  const runtime = typeof config.runtime === 'string' ? config.runtime : '';
+  if (!type && !runtime) return null;
+  const svc = asService({
+    key: 'app',
+    type: type || 'web',
+    runtime,
+    port: config.port,
+    health_check: config.health_check,
+    build_command: config.build_command,
+    start_command: config.start_command,
+    environment: config.environment,
+  });
+  return svc;
+}
+
+// Layered auto-layout: depth = longest depends_on chain; column per
+// depth, row per member. Deterministic so tests can assert positions.
+export function layoutPositions(services: BuilderService[]): Record<string, { x: number; y: number }> {
+  const depth = new Map<string, number>();
+  const visiting = new Set<string>();
+  const byKey = new Map(services.map((s) => [s.key, s]));
+  const depthOf = (key: string): number => {
+    const memo = depth.get(key);
+    if (memo !== undefined) return memo;
+    if (visiting.has(key)) return 0; // cycle guard
+    visiting.add(key);
+    const deps = byKey.get(key)?.depends_on ?? [];
+    let d = 0;
+    for (const dep of deps) {
+      if (byKey.has(dep)) d = Math.max(d, depthOf(dep) + 1);
+    }
+    visiting.delete(key);
+    depth.set(key, d);
+    return d;
+  };
+  const rows = new Map<number, number>();
+  const positions: Record<string, { x: number; y: number }> = {};
+  for (const svc of services) {
+    const d = depthOf(svc.key);
+    const row = rows.get(d) ?? 0;
+    rows.set(d, row + 1);
+    positions[svc.key] = { x: COL_X + d * 300, y: 40 + row * ROW_Y };
+  }
+  return positions;
+}
+
+export function canvasFromConfig(config: Record<string, unknown>): BuilderNode[] {
+  const canvas = (config.canvas ?? {}) as Partial<BuilderCanvas>;
+  const saved = canvas.positions ?? {};
+  const rawServices = Array.isArray(config.services) ? config.services : null;
+  const services = rawServices
+    ? rawServices.map(asService).filter((s): s is BuilderService => s !== null)
+    : [];
+  if (services.length === 0) {
+    const flat = flatToService(config);
+    if (flat) services.push(flat);
+  }
+  const auto = layoutPositions(services);
+  return services.map((service) => ({
+    key: service.key,
+    service,
+    position: saved[service.key] ?? auto[service.key] ?? { x: COL_X, y: 40 },
+  }));
+}
+
+export function configFromCanvas(
+  nodes: BuilderNode[],
+  rest: Record<string, unknown>,
+): Record<string, unknown> {
+  const services = nodes.map((node) => {
+    const svc = node.service;
+    const out: Record<string, unknown> = { key: svc.key, type: svc.type };
+    if (svc.name) out.name = svc.name;
+    if (svc.runtime) out.runtime = svc.runtime;
+    if (svc.repo) out.repo = svc.repo;
+    if (svc.branch) out.branch = svc.branch;
+    if (svc.build_command) out.build_command = svc.build_command;
+    if (svc.builder) out.builder = svc.builder;
+    if (svc.start_command) out.start_command = svc.start_command;
+    if (svc.port) out.port = svc.port;
+    if (svc.health_check) out.health_check = svc.health_check;
+    if (svc.environment && Object.keys(svc.environment).length > 0) out.environment = svc.environment;
+    if (svc.volumes && svc.volumes.length > 0) out.volumes = svc.volumes;
+    if (svc.depends_on && svc.depends_on.length > 0) out.depends_on = svc.depends_on;
+    return out;
+  });
+  const positions: Record<string, { x: number; y: number }> = {};
+  for (const node of nodes) positions[node.key] = node.position;
+  const restConfig = { ...rest };
+  // Flat (v1) fields and stale graph keys are dropped — the graph wins.
+  for (const k of ['type', 'runtime', 'build_command', 'start_command', 'port', 'health_check', 'environment', 'dockerfile', 'nixpacks_config', 'services', 'canvas']) {
+    delete restConfig[k];
+  }
+  return {
+    version: 2,
+    ...restConfig,
+    services,
+    canvas: { positions },
+  };
+}
+
+export function validateGraph(nodes: BuilderNode[]): string[] {
+  const errors: string[] = [];
+  const keys = new Set<string>();
+  for (const node of nodes) {
+    if (!KEY_RE.test(node.service.key)) {
+      errors.push(`"${node.service.key || '(empty)'}" is not a valid key (lowercase, digits, - or _)`);
+    }
+    if (keys.has(node.service.key)) errors.push(`duplicate key "${node.service.key}"`);
+    keys.add(node.service.key);
+    if (node.service.type === 'database' && !node.service.runtime) {
+      errors.push(`"${node.service.key}" is a database with no engine selected`);
+    }
+    if (node.service.type !== 'database' && !node.service.runtime && !node.service.repo) {
+      errors.push(`"${node.service.key}" needs an image (runtime) or a git repo`);
+    }
+  }
+  for (const node of nodes) {
+    for (const dep of node.service.depends_on ?? []) {
+      if (dep === node.service.key) errors.push(`"${dep}" depends on itself`);
+      else if (!keys.has(dep)) errors.push(`"${node.service.key}" depends on unknown service "${dep}"`);
+    }
+  }
+  // Cycle detection — a cycle makes topo sort fail at deploy time.
+  const state = new Map<string, 0 | 1 | 2>();
+  const byKey = new Map(nodes.map((n) => [n.service.key, n]));
+  const visit = (key: string, trail: string[]): void => {
+    const s = state.get(key) ?? 0;
+    if (s === 2) return;
+    if (s === 1) {
+      errors.push(`dependency cycle: ${[...trail, key].join(' → ')}`);
+      return;
+    }
+    state.set(key, 1);
+    for (const dep of byKey.get(key)?.service.depends_on ?? []) {
+      if (byKey.has(dep)) visit(dep, [...trail, key]);
+    }
+    state.set(key, 2);
+  };
+  for (const node of nodes) visit(node.service.key, []);
+  return errors;
+}
+
+export function newServiceKey(type: BuilderServiceType, existing: Set<string>): string {
+  const base = type === 'database' ? 'db' : type;
+  if (!existing.has(base)) return base;
+  let i = 2;
+  while (existing.has(`${base}${i}`)) i += 1;
+  return `${base}${i}`;
+}

app/frontend/src/features/templates/pages/TemplatesPage.tsx

@@ -1,4 +1,4 @@
-import { useMemo, useState } from 'react';
+import { lazy, Suspense, useMemo, useState } from 'react';
 import { Link, useSearchParams } from 'react-router-dom';
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
 import {
@@ -8,6 +8,7 @@ import {
   getCurrentUserProfile,
   getTemplateById,
   importComposeTemplate,
+  importGitComposeTemplate,
   listProjects,
   listTemplates,
   updateTemplate,
@@ -41,6 +42,10 @@ import {
   Network,
 } from 'lucide-react';
 
+const TemplateBuilder = lazy(() =>
+  import('@/features/templates/builder/TemplateBuilder').then((m) => ({ default: m.TemplateBuilder })),
+);
+
 function toServiceName(value: string): string {
   const normalized = value
     .toLowerCase()
@@ -126,6 +131,7 @@ export function TemplatesPage() {
   const isAdmin = Boolean(profileQuery.data?.isAdmin);
 
   const [editorOpen, setEditorOpen] = useState(false);
+  const [editorMode, setEditorMode] = useState<'json' | 'visual'>('json');
   const [editorJson, setEditorJson] = useState(EMPTY_TEMPLATE_JSON);
   const [editingTemplate, setEditingTemplate] = useState<TemplateEntity | null>(null);
   const [editorIsPublic, setEditorIsPublic] = useState(false);
@@ -154,6 +160,10 @@ export function TemplatesPage() {
   const [composeYaml, setComposeYaml] = useState('');
   const [composeWarnings, setComposeWarnings] = useState<string[]>([]);
   const [composeError, setComposeError] = useState<string | null>(null);
+  const [composeMode, setComposeMode] = useState<'paste' | 'git'>('paste');
+  const [gitRepo, setGitRepo] = useState('');
+  const [gitPath, setGitPath] = useState('');
+  const [gitRef, setGitRef] = useState('');
 
   const [lastDeployment, setLastDeployment] = useState<{
     projectId: string;
@@ -364,7 +374,10 @@ export function TemplatesPage() {
   });
 
   const composeImportMutation = useMutation({
-    mutationFn: (yaml: string) => importComposeTemplate(yaml),
+    mutationFn: () =>
+      composeMode === 'git'
+        ? importGitComposeTemplate(gitRepo.trim(), gitPath.trim(), gitRef.trim())
+        : importComposeTemplate(composeYaml),
     onSuccess: (result) => {
       setComposeWarnings(result.warnings);
       setComposeError(null);
@@ -1014,17 +1027,50 @@ export function TemplatesPage() {
       {/* Template editor — JSON only */}
       {editorOpen ? (
         <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4 backdrop-blur-sm">
-          <div className="flex max-h-[90vh] w-full max-w-2xl flex-col overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--bg-base)] shadow-2xl">
+          <div className={`flex max-h-[92vh] w-full flex-col overflow-hidden rounded-[var(--radius-lg)] border border-[var(--border-subtle)] bg-[var(--bg-base)] shadow-2xl ${editorMode === 'visual' ? 'max-w-6xl' : 'max-w-2xl'}`}>
             <div className="flex items-center justify-between border-b border-[var(--border-subtle)] px-5 py-4">
               <div>
                 <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">
                   {editingTemplate ? `Edit ${editingTemplate.name}` : 'New template'}
                 </h2>
                 <p className="text-xs text-[var(--text-tertiary)]">
-                  JSON definition — name, category, config and variables.
+                  {editorMode === 'visual'
+                    ? 'Visual builder — drop service nodes, wire depends_on edges, apply back to JSON.'
+                    : 'JSON definition — name, category, config and variables.'}
                 </p>
               </div>
               <div className="flex items-center gap-2">
+                <div className="mr-1 inline-flex overflow-hidden rounded-[var(--radius-md)] border border-[var(--border-default)]">
+                  {(['json', 'visual'] as const).map((mode) => (
+                    <button
+                      key={mode}
+                      type="button"
+                      onClick={() => {
+                        if (mode === 'visual' && editorMode === 'json') {
+                          try {
+                            const parsed = JSON.parse(editorJson);
+                            if (!parsed || typeof parsed.config !== 'object') {
+                              setEditorError('Visual mode needs a valid JSON body with a "config" object first.');
+                              return;
+                            }
+                          } catch {
+                            setEditorError('Fix the JSON before switching to visual mode.');
+                            return;
+                          }
+                          setEditorError(null);
+                        }
+                        setEditorMode(mode);
+                      }}
+                      className={`px-3 py-1.5 text-[11px] font-medium capitalize ${
+                        editorMode === mode
+                          ? 'bg-[var(--surface-muted)] text-[var(--text-primary)]'
+                          : 'text-[var(--text-tertiary)] hover:text-[var(--text-primary)]'
+                      }`}
+                    >
+                      {mode}
+                    </button>
+                  ))}
+                </div>
                 <label className="inline-flex cursor-pointer items-center gap-1.5 rounded-[var(--radius-md)] border border-[var(--border-default)] px-3 py-1.5 text-xs font-medium text-[var(--text-secondary)] hover:text-[var(--text-primary)]">
                   <Upload size={12} /> Upload .json
                   <input
@@ -1047,12 +1093,49 @@ export function TemplatesPage() {
                 </button>
               </div>
             </div>
+            {editorMode === 'visual' ? (
+              <div className="flex min-h-[520px] flex-1 flex-col">
+                <Suspense
+                  fallback={
+                    <div className="flex flex-1 items-center justify-center text-[var(--text-tertiary)]">
+                      <Loader2 size={20} className="animate-spin" />
+                    </div>
+                  }
+                >
+                  {(() => {
+                    let cfg: Record<string, unknown> = {};
+                    try {
+                      const parsed = JSON.parse(editorJson) as { config?: Record<string, unknown> };
+                      cfg = parsed?.config ?? {};
+                    } catch {
+                      cfg = {};
+                    }
+                    return (
+                      <TemplateBuilder
+                        config={cfg}
+                        onCancel={() => setEditorMode('json')}
+                        onApply={(newConfig) => {
+                          try {
+                            const parsed = JSON.parse(editorJson) as Record<string, unknown>;
+                            setEditorJson(JSON.stringify({ ...parsed, config: newConfig }, null, 2));
+                          } catch {
+                            setEditorJson(JSON.stringify({ config: newConfig }, null, 2));
+                          }
+                          setEditorMode('json');
+                        }}
+                      />
+                    );
+                  })()}
+                </Suspense>
+              </div>
+            ) : (
               <textarea
                 value={editorJson}
                 onChange={(e) => setEditorJson(e.target.value)}
                 spellCheck={false}
                 className="mono min-h-[380px] flex-1 resize-none bg-[var(--bg-void)] p-4 text-[12.5px] leading-relaxed text-[var(--text-secondary)] outline-none"
               />
+            )}
             {composeWarnings.length > 0 ? (
               <div className="border-t border-[var(--border-subtle)] bg-[var(--warning-soft)]/60 px-5 py-2.5 text-xs text-[var(--warning)]">
                 <p className="font-medium mb-1">Compose import notes</p>
@@ -1066,7 +1149,7 @@ export function TemplatesPage() {
                 {editorError}
               </div>
             ) : null}
-            <div className="flex items-center justify-between border-t border-[var(--border-subtle)] px-5 py-3.5">
+            <div className={`flex items-center justify-between border-t border-[var(--border-subtle)] px-5 py-3.5 ${editorMode === 'visual' ? 'hidden' : ''}`}>
               <label className="inline-flex cursor-pointer items-center gap-2 text-[11px] text-[var(--text-secondary)]">
                 <input
                   type="checkbox"
@@ -1107,7 +1190,7 @@ export function TemplatesPage() {
               <div>
                 <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">Import docker-compose</h2>
                 <p className="text-xs text-[var(--text-tertiary)]">
-                  Paste a compose file — known database images become managed databases, everything else becomes services.
+                  Paste a compose file or pull one from a git repo — known database images become managed databases.
                 </p>
               </div>
               <button
@@ -1118,6 +1201,23 @@ export function TemplatesPage() {
                 <X size={15} />
               </button>
             </div>
+            <div className="flex gap-1 border-b border-[var(--border-subtle)] px-5 pt-3">
+              {(['paste', 'git'] as const).map((m) => (
+                <button
+                  key={m}
+                  type="button"
+                  onClick={() => setComposeMode(m)}
+                  className={`rounded-t-[var(--radius-md)] px-3 py-1.5 text-xs font-medium ${
+                    composeMode === m
+                      ? 'bg-[var(--surface-muted)] text-[var(--text-primary)]'
+                      : 'text-[var(--text-tertiary)] hover:text-[var(--text-secondary)]'
+                  }`}
+                >
+                  {m === 'paste' ? 'Paste YAML' : 'From git repo'}
+                </button>
+              ))}
+            </div>
+            {composeMode === 'paste' ? (
               <textarea
                 value={composeYaml}
                 onChange={(e) => setComposeYaml(e.target.value)}
@@ -1125,6 +1225,43 @@ export function TemplatesPage() {
                 placeholder={'services:\n  db:\n    image: postgres:16\n  web:\n    image: myapp:latest\n    depends_on: [db]'}
                 className="mono min-h-[320px] flex-1 resize-none bg-[var(--bg-void)] p-4 text-[12.5px] leading-relaxed text-[var(--text-secondary)] outline-none"
               />
+            ) : (
+              <div className="flex min-h-[320px] flex-1 flex-col gap-3 bg-[var(--bg-void)] p-4">
+                <label className="text-xs text-[var(--text-tertiary)]">
+                  Repository
+                  <input
+                    value={gitRepo}
+                    onChange={(e) => setGitRepo(e.target.value)}
+                    spellCheck={false}
+                    placeholder="owner/repo or https://github.com/owner/repo.git"
+                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
+                  />
+                </label>
+                <label className="text-xs text-[var(--text-tertiary)]">
+                  Compose file path <span className="opacity-60">(optional — compose.yaml / docker-compose.yml searched)</span>
+                  <input
+                    value={gitPath}
+                    onChange={(e) => setGitPath(e.target.value)}
+                    spellCheck={false}
+                    placeholder="deploy/compose.yml"
+                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
+                  />
+                </label>
+                <label className="text-xs text-[var(--text-tertiary)]">
+                  Branch or commit <span className="opacity-60">(optional)</span>
+                  <input
+                    value={gitRef}
+                    onChange={(e) => setGitRef(e.target.value)}
+                    spellCheck={false}
+                    placeholder="main"
+                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
+                  />
+                </label>
+                <p className="text-[11px] text-[var(--text-tertiary)]">
+                  Private repos use your connected git providers for credentials.
+                </p>
+              </div>
+            )}
             {composeError ? (
               <div className="border-t border-[var(--border-subtle)] bg-[var(--error-soft)] px-5 py-2.5 text-xs text-[var(--error)]">
                 {composeError}
@@ -1140,8 +1277,8 @@ export function TemplatesPage() {
               </button>
               <button
                 type="button"
-                onClick={() => composeImportMutation.mutate(composeYaml)}
-                disabled={!composeYaml.trim() || composeImportMutation.isPending}
+                onClick={() => composeImportMutation.mutate()}
+                disabled={(composeMode === 'paste' ? !composeYaml.trim() : !gitRepo.trim()) || composeImportMutation.isPending}
                 className="inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-xs font-semibold text-[var(--accent-on)] disabled:opacity-50"
               >
                 {composeImportMutation.isPending ? <Loader2 size={13} className="animate-spin" /> : <FileCode size={13} />}

app/frontend/src/features/workspace/canvas/ProjectCanvas.tsx

@@ -25,14 +25,22 @@ import {
 } from '@/lib/api-client';
 import { useToast } from '@/shared/hooks/use-toast';
 import { inferAutoConnections, type ServiceVariable } from '../auto-connections';
-import {
-  DEFAULT_VIEWPORT,
-  type CanvasGroup,
-  type CanvasNodeLayout,
-  type ProjectCanvasMetadata,
-} from '../model';
+import { DEFAULT_VIEWPORT, type ProjectCanvasMetadata } from '../model';
 import { hasCanvasMetadata, loadCanvasMetadata, saveCanvasMetadata } from '../storage';
 import { computeLayeredLayout, layoutFromVariables, NODE_HEIGHT, NODE_WIDTH } from './auto-layout';
+import {
+  buildMetadataFromFlow,
+  GROUP_DEFAULT_HEIGHT,
+  GROUP_DEFAULT_WIDTH,
+  GROUP_PAD_BOTTOM,
+  GROUP_PAD_TOP,
+  GROUP_PAD_X,
+  GRID_STEP,
+  groupSlot,
+  resolveFreeSpot,
+  type CanvasNode,
+  type Rect,
+} from './layout';
 import { GroupNode, ServiceNode, type GroupNodeData, type ServiceNodeData } from './nodes';
 import { ServiceInspector, type InspectorGroup } from './inspector';
 import { serviceAccent } from './service-visuals';
@@ -65,11 +73,7 @@ type CanvasProps = {
 
 type ServiceCanvasNode = Node<ServiceNodeData, 'serviceNode'>;
 type GroupCanvasNode = Node<GroupNodeData, 'groupNode'>;
-type CanvasNode = ServiceCanvasNode | GroupCanvasNode;
 type CanvasEdge = Edge<{ reasons: string[] }>;
-
-const GROUP_DEFAULT_WIDTH = 340;
-const GROUP_DEFAULT_HEIGHT = 230;
 const TRANSIENT_STATUSES = new Set(['building', 'deploying', 'pending', 'rolling_back']);
 
 const nodeTypes: NodeTypes = {
@@ -176,155 +180,6 @@ function toFlowEdges(
   });
 }
 
-const GROUP_PAD_X = 28;
-const GROUP_PAD_TOP = 56;
-const GROUP_PAD_BOTTOM = 24;
-const GROUP_ROW_GAP = 16;
-const GRID_STEP = 26;
-const NODE_GAP = 14;
-
-type Rect = { x: number; y: number; w: number; h: number };
-
-function rectsOverlap(a: Rect, b: Rect): boolean {
-  return (
-    a.x < b.x + b.w + NODE_GAP &&
-    a.x + a.w + NODE_GAP > b.x &&
-    a.y < b.y + b.h + NODE_GAP &&
-    a.y + a.h + NODE_GAP > b.y
-  );
-}
-
-// Nearest grid-aligned position where a node fits without touching any
-// occupied rect. Spiral-searches outward on the canvas lattice; falls back to
-// the given position when the neighbourhood is fully boxed in.
-function resolveFreeSpot(
-  desired: { x: number; y: number },
-  occupied: Rect[],
-  fallback: { x: number; y: number },
-  bounds?: Rect,
-): { x: number; y: number } {
-  const snap = (v: number) => Math.round(v / GRID_STEP) * GRID_STEP;
-  const base = { x: snap(desired.x), y: snap(desired.y) };
-  const fits = (x: number, y: number) => {
-    if (bounds && (x < bounds.x || y < bounds.y || x + NODE_WIDTH > bounds.x + bounds.w || y + NODE_HEIGHT > bounds.y + bounds.h)) {
-      return false;
-    }
-    return !occupied.some((rect) => rectsOverlap({ x, y, w: NODE_WIDTH, h: NODE_HEIGHT }, rect));
-  };
-
-  if (fits(base.x, base.y)) {
-    return base;
-  }
-
-  for (let ring = 1; ring <= 12; ring++) {
-    for (let dx = -ring; dx <= ring; dx++) {
-      for (let dy = -ring; dy <= ring; dy++) {
-        if (Math.max(Math.abs(dx), Math.abs(dy)) !== ring) {
-          continue;
-        }
-        const x = base.x + dx * GRID_STEP;
-        const y = base.y + dy * GRID_STEP;
-        if (fits(x, y)) {
-          return { x, y };
-        }
-      }
-    }
-  }
-
-  return fallback;
-}
-
-// Where an incoming service lands inside a group frame. If the point already
-// fits inside the padded area, honour it. Otherwise append beneath the lowest
-// member and grow the frame just enough — keeps groups compact instead of
-// ballooning the frame to wherever the node used to sit.
-function groupSlot(
-  nodes: CanvasNode[],
-  groupId: string,
-  group: CanvasNode,
-  desiredX: number,
-  desiredY: number,
-  ignoreServiceId?: string,
-): { x: number; y: number; width: number; height: number } {
-  const width = typeof group.style?.width === 'number' ? group.style.width : GROUP_DEFAULT_WIDTH;
-  const height = typeof group.style?.height === 'number' ? group.style.height : GROUP_DEFAULT_HEIGHT;
-
-  const members = nodes.filter(
-    (node) => node.type === 'serviceNode' && node.parentId === groupId && node.id !== ignoreServiceId,
-  );
-  const memberRects: Rect[] = members.map((node) => ({
-    x: node.position.x,
-    y: node.position.y,
-    w: NODE_WIDTH,
-    h: NODE_HEIGHT,
-  }));
-  const snap = (v: number) => Math.round(v / GRID_STEP) * GRID_STEP;
-  const snappedX = snap(desiredX);
-  const snappedY = snap(desiredY);
-  const snappedFits =
-    snappedX >= GROUP_PAD_X &&
-    snappedY >= GROUP_PAD_TOP &&
-    snappedX + NODE_WIDTH <= width - GROUP_PAD_X &&
-    snappedY + NODE_HEIGHT <= height - GROUP_PAD_BOTTOM;
-  const collides = memberRects.some((rect) =>
-    rectsOverlap({ x: snappedX, y: snappedY, w: NODE_WIDTH, h: NODE_HEIGHT }, rect),
-  );
-
-  if (snappedFits && !collides) {
-    return { x: snappedX, y: snappedY, width, height };
-  }
-
-  let bottom = GROUP_PAD_TOP - GROUP_ROW_GAP;
-  for (const node of nodes) {
-    if (node.type === 'serviceNode' && node.parentId === groupId && node.id !== ignoreServiceId) {
-      bottom = Math.max(bottom, node.position.y + NODE_HEIGHT);
-    }
-  }
-
-  const x = GROUP_PAD_X;
-  const y = bottom + GROUP_ROW_GAP;
-  return {
-    x,
-    y,
-    width: Math.max(width, x + NODE_WIDTH + GROUP_PAD_X),
-    height: Math.max(height, y + NODE_HEIGHT + GROUP_PAD_BOTTOM),
-  };
-}
-
-function buildMetadataFromFlow(nodes: CanvasNode[], viewport: { x: number; y: number; zoom: number }): ProjectCanvasMetadata {
-  const groups: CanvasGroup[] = [];
-  const layouts: CanvasNodeLayout[] = [];
-
-  for (const node of nodes) {
-    if (node.type === 'groupNode') {
-      const width = typeof node.style?.width === 'number' ? node.style.width : GROUP_DEFAULT_WIDTH;
-      const height = typeof node.style?.height === 'number' ? node.style.height : GROUP_DEFAULT_HEIGHT;
-      groups.push({
-        id: node.id,
-        title: node.data.title,
-        position: node.position,
-        width,
-        height,
-      });
-      continue;
-    }
-
-    if (node.type === 'serviceNode') {
-      layouts.push({
-        serviceId: node.id,
-        position: node.position,
-        groupId: node.parentId,
-      });
-    }
-  }
-
-  return {
-    groups,
-    nodes: layouts,
-    edges: [],
-    viewport,
-  };
-}
 
 function ZoomControls({ onTidy }: { onTidy: () => void }) {
   const { zoom } = useViewport();

app/frontend/src/features/workspace/canvas/canvas-layout.test.ts

@@ -0,0 +1,142 @@
+import { describe, expect, it } from 'vitest';
+import {
+  buildMetadataFromFlow,
+  groupSlot,
+  rectsOverlap,
+  resolveFreeSpot,
+} from './layout';
+import { NODE_HEIGHT, NODE_WIDTH } from './auto-layout';
+import type { GroupNodeType, ServiceNodeType } from './nodes';
+
+const GRID_STEP = 26;
+const NODE_GAP = 14;
+
+function serviceNode(
+  id: string,
+  position: { x: number; y: number },
+  parentId?: string,
+): ServiceNodeType {
+  return { id, type: 'serviceNode', position, parentId } as ServiceNodeType;
+}
+
+function groupNode(
+  id: string,
+  width = 340,
+  height = 230,
+): GroupNodeType {
+  return {
+    id,
+    type: 'groupNode',
+    position: { x: 0, y: 0 },
+    style: { width, height },
+    data: { title: `Group ${id}` },
+  } as GroupNodeType;
+}
+
+describe('rectsOverlap', () => {
+  const a = { x: 0, y: 0, w: 100, h: 100 };
+
+  it('detects intersection', () => {
+    expect(rectsOverlap(a, { x: 50, y: 50, w: 100, h: 100 })).toBe(true);
+    expect(rectsOverlap(a, { x: -50, y: -50, w: 100, h: 100 })).toBe(true);
+  });
+
+  it('returns false for fully disjoint rects', () => {
+    expect(rectsOverlap(a, { x: 500, y: 500, w: 100, h: 100 })).toBe(false);
+  });
+
+  it('treats the node gap as a collision zone', () => {
+    // b sits just inside NODE_GAP to the right of a.
+    expect(rectsOverlap(a, { x: 100 + NODE_GAP - 1, y: 0, w: 50, h: 50 })).toBe(true);
+    // Beyond the gap there is no overlap.
+    expect(rectsOverlap(a, { x: 100 + NODE_GAP + 1, y: 0, w: 50, h: 50 })).toBe(false);
+  });
+});
+
+describe('resolveFreeSpot', () => {
+  it('snaps the desired position to the grid when free', () => {
+    const spot = resolveFreeSpot({ x: 40, y: 70 }, [], { x: 0, y: 0 });
+    expect(spot).toEqual({ x: 52, y: 78 });
+    expect(spot.x % GRID_STEP).toBe(0);
+    expect(spot.y % GRID_STEP).toBe(0);
+  });
+
+  it('finds a neighbouring free grid point when occupied', () => {
+    const occupied = [{ x: 0, y: 0, w: NODE_WIDTH, h: NODE_HEIGHT }];
+    const spot = resolveFreeSpot({ x: 0, y: 0 }, occupied, { x: -1, y: -1 });
+    expect(spot).not.toEqual({ x: -1, y: -1 });
+    expect(Number.isInteger(spot.x / GRID_STEP)).toBe(true);
+    expect(Number.isInteger(spot.y / GRID_STEP)).toBe(true);
+    expect(
+      rectsOverlap({ x: spot.x, y: spot.y, w: NODE_WIDTH, h: NODE_HEIGHT }, occupied[0]),
+    ).toBe(false);
+  });
+
+  it('falls back when bounds reject every candidate', () => {
+    // Node is wider than the bounds, so nothing can fit.
+    const bounds = { x: 0, y: 0, w: 10, h: 10 };
+    const fallback = { x: 999, y: 888 };
+    expect(resolveFreeSpot({ x: 0, y: 0 }, [], fallback, bounds)).toEqual(fallback);
+  });
+});
+
+describe('groupSlot', () => {
+  it('honours a point that fits inside the padded frame', () => {
+    const group = groupNode('g1');
+    const slot = groupSlot([group], 'g1', group, 40, 70);
+    expect(slot).toEqual({ x: 52, y: 78, width: 340, height: 230 });
+  });
+
+  it('appends below the lowest member and grows the frame on collision', () => {
+    const group = groupNode('g1');
+    const member = serviceNode('s1', { x: 52, y: 78 }, 'g1');
+    const slot = groupSlot([group, member], 'g1', group, 40, 70);
+    // bottom = 78 + 104 = 182; y = 182 + 16 = 198; grows height to 326.
+    expect(slot.x).toBe(28);
+    expect(slot.y).toBe(198);
+    expect(slot.height).toBe(326);
+    expect(slot.width).toBe(340);
+  });
+
+  it('appends under the padding when the desired point is outside', () => {
+    const group = groupNode('g1');
+    const slot = groupSlot([group], 'g1', group, 5000, 5000);
+    expect(slot).toEqual({ x: 28, y: 56, width: 340, height: 230 });
+  });
+
+  it('ignores the dragged node when checking collisions', () => {
+    const group = groupNode('g1');
+    const dragged = serviceNode('s1', { x: 52, y: 78 }, 'g1');
+    const slot = groupSlot([group, dragged], 'g1', group, 40, 70, 's1');
+    expect(slot).toEqual({ x: 52, y: 78, width: 340, height: 230 });
+  });
+});
+
+describe('buildMetadataFromFlow', () => {
+  it('serializes groups and service layouts', () => {
+    const nodes = [
+      { ...groupNode('g1', 400, 300), position: { x: 10, y: 20 } },
+      serviceNode('s1', { x: 5, y: 6 }, 'g1'),
+      serviceNode('s2', { x: 100, y: 200 }),
+    ];
+    const viewport = { x: 1, y: 2, zoom: 0.5 };
+    const meta = buildMetadataFromFlow(nodes, viewport);
+
+    expect(meta.groups).toEqual([
+      { id: 'g1', title: 'Group g1', position: { x: 10, y: 20 }, width: 400, height: 300 },
+    ]);
+    expect(meta.nodes).toEqual([
+      { serviceId: 's1', position: { x: 5, y: 6 }, groupId: 'g1' },
+      { serviceId: 's2', position: { x: 100, y: 200 }, groupId: undefined },
+    ]);
+    expect(meta.edges).toEqual([]);
+    expect(meta.viewport).toEqual(viewport);
+  });
+
+  it('uses default group dimensions when style is missing', () => {
+    const bare = { id: 'g2', type: 'groupNode', position: { x: 0, y: 0 }, data: { title: 'bare' } } as GroupNodeType;
+    const meta = buildMetadataFromFlow([bare], { x: 0, y: 0, zoom: 1 });
+    expect(meta.groups[0].width).toBe(340);
+    expect(meta.groups[0].height).toBe(230);
+  });
+});

app/frontend/src/features/workspace/canvas/layout.ts

@@ -0,0 +1,156 @@
+import type { CanvasGroup, CanvasNodeLayout, ProjectCanvasMetadata } from '../model';
+import { NODE_HEIGHT, NODE_WIDTH } from './auto-layout';
+import type { GroupNodeType, ServiceNodeType } from './nodes';
+
+export type CanvasNode = ServiceNodeType | GroupNodeType;
+export type Rect = { x: number; y: number; w: number; h: number };
+
+export const GROUP_DEFAULT_WIDTH = 340;
+export const GROUP_DEFAULT_HEIGHT = 230;
+export const GROUP_PAD_X = 28;
+export const GROUP_PAD_TOP = 56;
+export const GROUP_PAD_BOTTOM = 24;
+export const GROUP_ROW_GAP = 16;
+export const GRID_STEP = 26;
+export const NODE_GAP = 14;
+
+export function rectsOverlap(a: Rect, b: Rect): boolean {
+  return (
+    a.x < b.x + b.w + NODE_GAP &&
+    a.x + a.w + NODE_GAP > b.x &&
+    a.y < b.y + b.h + NODE_GAP &&
+    a.y + a.h + NODE_GAP > b.y
+  );
+}
+
+// Nearest grid-aligned position where a node fits without touching any
+// occupied rect. Spiral-searches outward on the canvas lattice; falls back to
+// the given position when the neighbourhood is fully boxed in.
+export function resolveFreeSpot(
+  desired: { x: number; y: number },
+  occupied: Rect[],
+  fallback: { x: number; y: number },
+  bounds?: Rect,
+): { x: number; y: number } {
+  const snap = (v: number) => Math.round(v / GRID_STEP) * GRID_STEP;
+  const base = { x: snap(desired.x), y: snap(desired.y) };
+  const fits = (x: number, y: number) => {
+    if (bounds && (x < bounds.x || y < bounds.y || x + NODE_WIDTH > bounds.x + bounds.w || y + NODE_HEIGHT > bounds.y + bounds.h)) {
+      return false;
+    }
+    return !occupied.some((rect) => rectsOverlap({ x, y, w: NODE_WIDTH, h: NODE_HEIGHT }, rect));
+  };
+
+  if (fits(base.x, base.y)) {
+    return base;
+  }
+
+  for (let ring = 1; ring <= 12; ring++) {
+    for (let dx = -ring; dx <= ring; dx++) {
+      for (let dy = -ring; dy <= ring; dy++) {
+        if (Math.max(Math.abs(dx), Math.abs(dy)) !== ring) {
+          continue;
+        }
+        const x = base.x + dx * GRID_STEP;
+        const y = base.y + dy * GRID_STEP;
+        if (fits(x, y)) {
+          return { x, y };
+        }
+      }
+    }
+  }
+
+  return fallback;
+}
+
+// Where an incoming service lands inside a group frame. If the point already
+// fits inside the padded area, honour it. Otherwise append beneath the lowest
+// member and grow the frame just enough — keeps groups compact instead of
+// ballooning the frame to wherever the node used to sit.
+export function groupSlot(
+  nodes: CanvasNode[],
+  groupId: string,
+  group: CanvasNode,
+  desiredX: number,
+  desiredY: number,
+  ignoreServiceId?: string,
+): { x: number; y: number; width: number; height: number } {
+  const width = typeof group.style?.width === 'number' ? group.style.width : GROUP_DEFAULT_WIDTH;
+  const height = typeof group.style?.height === 'number' ? group.style.height : GROUP_DEFAULT_HEIGHT;
+
+  const members = nodes.filter(
+    (node) => node.type === 'serviceNode' && node.parentId === groupId && node.id !== ignoreServiceId,
+  );
+  const memberRects: Rect[] = members.map((node) => ({
+    x: node.position.x,
+    y: node.position.y,
+    w: NODE_WIDTH,
+    h: NODE_HEIGHT,
+  }));
+  const snap = (v: number) => Math.round(v / GRID_STEP) * GRID_STEP;
+  const snappedX = snap(desiredX);
+  const snappedY = snap(desiredY);
+  const snappedFits =
+    snappedX >= GROUP_PAD_X &&
+    snappedY >= GROUP_PAD_TOP &&
+    snappedX + NODE_WIDTH <= width - GROUP_PAD_X &&
+    snappedY + NODE_HEIGHT <= height - GROUP_PAD_BOTTOM;
+  const collides = memberRects.some((rect) =>
+    rectsOverlap({ x: snappedX, y: snappedY, w: NODE_WIDTH, h: NODE_HEIGHT }, rect),
+  );
+
+  if (snappedFits && !collides) {
+    return { x: snappedX, y: snappedY, width, height };
+  }
+
+  let bottom = GROUP_PAD_TOP - GROUP_ROW_GAP;
+  for (const node of nodes) {
+    if (node.type === 'serviceNode' && node.parentId === groupId && node.id !== ignoreServiceId) {
+      bottom = Math.max(bottom, node.position.y + NODE_HEIGHT);
+    }
+  }
+
+  const x = GROUP_PAD_X;
+  const y = bottom + GROUP_ROW_GAP;
+  return {
+    x,
+    y,
+    width: Math.max(width, x + NODE_WIDTH + GROUP_PAD_X),
+    height: Math.max(height, y + NODE_HEIGHT + GROUP_PAD_BOTTOM),
+  };
+}
+
+export function buildMetadataFromFlow(nodes: CanvasNode[], viewport: { x: number; y: number; zoom: number }): ProjectCanvasMetadata {
+  const groups: CanvasGroup[] = [];
+  const layouts: CanvasNodeLayout[] = [];
+
+  for (const node of nodes) {
+    if (node.type === 'groupNode') {
+      const width = typeof node.style?.width === 'number' ? node.style.width : GROUP_DEFAULT_WIDTH;
+      const height = typeof node.style?.height === 'number' ? node.style.height : GROUP_DEFAULT_HEIGHT;
+      groups.push({
+        id: node.id,
+        title: node.data.title,
+        position: node.position,
+        width,
+        height,
+      });
+      continue;
+    }
+
+    if (node.type === 'serviceNode') {
+      layouts.push({
+        serviceId: node.id,
+        position: node.position,
+        groupId: node.parentId,
+      });
+    }
+  }
+
+  return {
+    groups,
+    nodes: layouts,
+    edges: [],
+    viewport,
+  };
+}

app/frontend/src/features/workspace/pages/ProjectWorkspacePage.tsx

@@ -8,12 +8,14 @@ import {
   createManagedDatabase,
   createService,
   getProjectById,
+  createProjectEnvironment,
   importComposeIntoProject,
   listConnectedGitRepositories,
   listGitBranches,
   listGitProviders,
   listGitRepositories,
   listProjectActivity,
+  listProjectEnvironments,
   listServiceLogs,
   listServiceVariables,
   listServicesByProject,
@@ -589,6 +591,22 @@ export function ProjectWorkspacePage() {
     () => (isDemoMode ? getDemoServicesByProject(projectId) : servicesQuery.data ?? []),
     [isDemoMode, projectId, servicesQuery.data],
   );
+  const environmentsQuery = useQuery({
+    queryKey: ['project-environments', projectId],
+    queryFn: () => listProjectEnvironments(projectId!),
+    enabled: !!projectId && !isDemoMode,
+  });
+  const [envFilter, setEnvFilter] = useState<string | null>(null);
+  const environments = environmentsQuery.data ?? [];
+  const visibleServices = useMemo(
+    () => (envFilter ? services.filter((s) => (s.environment ?? 'production') === envFilter) : services),
+    [services, envFilter],
+  );
+  const createEnvMutation = useMutation({
+    mutationFn: (name: string) => createProjectEnvironment(projectId!, name),
+    onSuccess: () => queryClient.invalidateQueries({ queryKey: ['project-environments', projectId] }),
+    onError: (err) => toast.showToast(err instanceof ApiError ? err.message : 'Failed to create environment', 'error'),
+  });
   const serviceIdFingerprint = services.map((service) => service.id).sort().join('|');
 
   const variablesQuery = useQuery({
@@ -850,18 +868,50 @@ export function ProjectWorkspacePage() {
 
                 {/* Service List */}
                 <div className="panel p-6">
-                  <h3 className="text-sm font-medium text-[var(--text-secondary)] mb-3">Services</h3>
+                  <div className="flex items-center justify-between mb-3">
+                    <h3 className="text-sm font-medium text-[var(--text-secondary)]">Services</h3>
+                    {!isDemoMode && environments.length > 0 && (
+                      <div className="flex items-center gap-1.5 flex-wrap">
+                        <button
+                          onClick={() => setEnvFilter(null)}
+                          className={`px-2.5 py-1 rounded-full text-xs font-medium transition-colors ${
+                            envFilter === null
+                              ? 'bg-[var(--accent-primary)] text-white'
+                              : 'bg-[var(--surface-muted)] text-[var(--text-secondary)] hover:bg-[var(--surface-card)]'
+                          }`}
+                        >
+                          All
+                        </button>
+                        {environments.map((env) => (
+                          <button
+                            key={env.id}
+                            onClick={() => setEnvFilter(envFilter === env.name ? null : env.name)}
+                            className={`px-2.5 py-1 rounded-full text-xs font-medium transition-colors ${
+                              envFilter === env.name
+                                ? 'bg-[var(--accent-primary)] text-white'
+                                : 'bg-[var(--surface-muted)] text-[var(--text-secondary)] hover:bg-[var(--surface-card)]'
+                            }`}
+                          >
+                            {env.name} ({env.service_count})
+                          </button>
+                        ))}
+                        <EnvCreateButton onCreate={(name) => createEnvMutation.mutate(name)} pending={createEnvMutation.isPending} />
+                      </div>
+                    )}
+                  </div>
                   <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] overflow-hidden divide-y divide-[var(--border-subtle)]">
-                    {services.length === 0 ? (
+                    {visibleServices.length === 0 ? (
                       <div className="p-8 text-center">
                         <div className="w-12 h-12 mx-auto mb-3 rounded-full bg-[var(--surface-muted)] flex items-center justify-center">
                           <Layers size={20} className="text-[var(--text-tertiary)]" />
                         </div>
-                        <p className="text-sm text-[var(--text-secondary)]">No services deployed yet</p>
-                        <p className="text-xs text-[var(--text-muted)] mt-1">Add services from the Canvas view</p>
+                        <p className="text-sm text-[var(--text-secondary)]">
+                          {envFilter ? `No services in ${envFilter}` : 'No services deployed yet'}
+                        </p>
+                        {!envFilter && <p className="text-xs text-[var(--text-muted)] mt-1">Add services from the Canvas view</p>}
                       </div>
                     ) : (
-                      services.map((service) => (
+                      visibleServices.map((service) => (
                         <button
                           key={service.id}
                           onClick={() => navigate(serviceHref(service.id))}
@@ -1124,3 +1174,39 @@ export function ProjectWorkspacePage() {
     </div>
   );
 }
+
+// EnvCreateButton expands into an inline name input for a new environment.
+function EnvCreateButton({ onCreate, pending }: { onCreate: (name: string) => void; pending: boolean }) {
+  const [open, setOpen] = useState(false);
+  const [name, setName] = useState('');
+  if (!open) {
+    return (
+      <button
+        onClick={() => setOpen(true)}
+        className="px-2.5 py-1 rounded-full text-xs font-medium border border-dashed border-[var(--border-subtle)] text-[var(--text-muted)] hover:text-[var(--text-secondary)] transition-colors"
+      >
+        + env
+      </button>
+    );
+  }
+  return (
+    <span className="inline-flex items-center gap-1">
+      <input
+        autoFocus
+        value={name}
+        onChange={(e) => setName(e.target.value)}
+        onKeyDown={(e) => {
+          if (e.key === 'Enter' && name.trim()) {
+            onCreate(name.trim());
+            setName('');
+            setOpen(false);
+          }
+          if (e.key === 'Escape') setOpen(false);
+        }}
+        placeholder="staging"
+        className="w-24 px-2 py-1 rounded-full text-xs bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-[var(--text-primary)] outline-none"
+      />
+      {pending && <Loader2 size={12} className="animate-spin text-[var(--text-muted)]" />}
+    </span>
+  );
+}