feat(services): traefik routing overrides via allowlisted middleware labels (#64)

services.traefik_labels (jsonb) holds operator-defined Traefik
middlewares keyed 'middlewares.<name>.<type>[.<field>]', validated
against an allowlist at write time. edgeLabels (extracted from
createReplica) scopes each definition to the service router as
<router>-<name> and auto-attaches it to the router's middleware chain
after builtins. Router/service/provider-level keys are rejected.

Surfaces: create/update API fields, services create/update
--traefik-label (repeatable, key=value), MCP arg docs, OpenAPI +
regenerated types, service-page Access editor (Routing overrides
card + textarea).

Also marks three stale ROADMAP2 items shipped: notification producers
round-out, build-on-node (PR #60), mobile env/domains/scaling (PR #61).

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/compose.ci.yml

@@ -0,0 +1,18 @@
+# CI-only compose overlay: pull and build through mirror.gcr.io so shared
+# runner egress IPs never touch docker.io (anonymous pulls get 429'd).
+# Production refs in infra/docker-compose.yml stay unchanged.
+services:
+  postgres:
+    image: mirror.gcr.io/library/postgres:15-alpine
+  traefik:
+    image: mirror.gcr.io/library/traefik:v3.2
+  backend:
+    build:
+      args:
+        GO_IMAGE: mirror.gcr.io/library/golang:1.26-alpine
+        NODE_IMAGE: mirror.gcr.io/library/node:22-alpine
+  frontend:
+    build:
+      args:
+        NODE_IMAGE: mirror.gcr.io/library/node:22-alpine
+        NGINX_IMAGE: mirror.gcr.io/library/nginx:alpine

.github/workflows/ci.yml

@@ -163,11 +163,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Boot stack
+        # .github/compose.ci.yml swaps every docker.io ref for
+        # mirror.gcr.io — anonymous Hub pulls 429 on shared CI IPs.
         run: |
           BETTER_AUTH_SECRET=$(openssl rand -hex 32)
           BETTER_AUTH_INTERNAL_TOKEN=$(openssl rand -hex 32)
           export BETTER_AUTH_SECRET BETTER_AUTH_INTERNAL_TOKEN
-          docker compose -f infra/docker-compose.yml up -d --build postgres dragonfly backend frontend traefik
+          docker compose -f infra/docker-compose.yml -f .github/compose.ci.yml up -d --build postgres dragonfly backend frontend traefik
 
       - name: Wait for backend health
         run: |
@@ -204,7 +206,13 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Docker Buildx
+        # Mirror docker.io through gcr — shared CI IPs hit anonymous
+        # rate limits on base-image metadata resolution otherwise.
         uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."docker.io"]
+              mirrors = ["mirror.gcr.io"]
 
       - name: Login to GHCR
         if: github.event_name != 'pull_request'

ROADMAP2.md

@@ -192,8 +192,11 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
   compares vs edge IP → `ok|wrong-target|pending`.
 - [x] **Maintenance mode + basic-auth gate** — Traefik middleware labels;
   no proxy code needed.
-- [ ] **Routing overrides** — `services.traefik_labels` jsonb with
-  allowlist validation (middlewares, headers, redirects).
+- [x] **Routing overrides** — `services.traefik_labels` jsonb with
+  allowlist validation. Keys `middlewares.<name>.<type>[.<field>]` scope
+  to the service router (`svc-<id>-<name>`), auto-attach after builtins;
+  router/service/provider-level keys rejected. API + CLI
+  (`--traefik-label`) + MCP + service page Access editor.
 - [x] **Builder override** — `services.builder` enum
   `auto|railpack|nixpacks|dockerfile|static`; static builder = build +
   nginx serve. Fixed hardcoded `nixpacks` + `BuildImage` stream drain bug.
@@ -228,24 +231,31 @@ goroutines; this fixes correctness *and* unlocks the ops surface.
 
 ## 6. Phase E — Templates v2 (absorbs compose-catalog spec + dflow graph templates)
 
-- [ ] **Template = ordered service graph** — `services[]` entries with
+- [x] **Template = ordered service graph** — `services[]` entries with
   `{name, type, source, build, ports, volumes, variables, depends_on}`;
-  deploy order from dependency refs.
-- [ ] **Expressions** — `${{service.KEY}}` (already the runtime ref
-  syntax — reuse), `{{secret(len,"charset")}}`, `{{random:int}}`,
-  `{{VAR:-default}}`; `POST /templates/:id/plan` returns the resolved
-  graph without deploying (agents love this).
-- [ ] **Compose import** — `POST /templates/import/compose` (compose-go
-  parser → graph), `POST /templates/import/github` (compose file from
-  repo path). Implements `docs/superpowers/specs/2026-04-14-*`.
-- [ ] **Graph deploy pipeline** — creates project + services in
-  dependency order, resolves vars, triggers builds; defined
-  partial-failure policy.
+  deploy order from dependency refs. `templategraph.go`,
+  `topoSortServices`.
+- [x] **Expressions** — `{{service.KEY.prop}}` (host/port/user/password/
+  database/url), `{{secret}}`/`{{secret(N)}}`, `{{random:N}}`,
+  `{{VAR:-default}}` (incl. explicitly-empty defaults); `POST
+  /templates/:id/plan` returns the resolved graph without deploying.
+- [x] **Compose import** — `POST /templates/import/compose` (yaml →
+  graph, known DB images become managed databases), `POST
+  /templates/import/git` (compose file fetched from any git repo — clone
+  URL, ssh remote, or owner/repo via connected providers, `ref` selects
+  branch/commit); `templates import-compose|import-git` CLI, MCP tools,
+  paste-or-git toggle in the template UI.
+- [x] **Graph deploy pipeline** — creates services in dependency order,
+  resolves vars/secrets, triggers builds. `deployTemplateGraph`,
+  `POST /templates/deploy` (inline), `POST /projects/:id/import-compose`.
 - [ ] **Visual template builder** — canvas mode: drop git/image/db
   nodes, wire refs, set order, save/publish. Reuses existing canvas
   primitives (dflow's `templates/compose` is exactly this).
-- [ ] **Catalog growth** — convert `templates/*.md` (20 app guides) into
-  real graph templates; screenshots + badges per the old spec.
+- [x] **Catalog growth** — seeded graph stacks for n8n, Gitea,
+  Nextcloud, Vaultwarden, Umami, Immich (Plausible already shipped).
+  `TestSeedTemplatesResolveCleanly` keeps every seed parseable,
+  topo-sortable, and fully resolved. Remaining single-service guides can
+  convert incrementally via the same endpoint.
 
 **Gate**: paste n8n compose → 3-service project with generated secrets
 and wired refs, one click or one CLI call.
@@ -334,14 +344,13 @@ and wired refs, one click or one CLI call.
   CLI, `containr_nodes_upgrade` MCP (confirm-gated), node-detail page
   button (online-gated). Ceilings: linux amd64/arm64 only; agents on
   other platforms get a `NO_BINARY` 409.
-- [🟡] **Build-on-node** — private registry pulls shipped: the dispatch
-  payload carries the project owner's `registries` credentials for the
-  image host; the agent `docker login`s for the pull and logs out after,
-  and command payloads are scrubbed of passwords on completion. Agent
-  also verifies the container is still running ~1.5s after `run` so
-  crash-loops fail the deploy instead of reporting healthy. Remaining:
-  real builds on the node (source checkout + build daemon) — pulls
-  already work.
+- [x] **Build-on-node** — private registry pulls + real builds shipped.
+  Git sources materialize via `internal/source` checkout (branch/commit,
+  `GIT_ASKPASS` credential injection, dumb-transport fallback), package
+  through `BuildManager.PackageContext`, ship as agent-token artifacts,
+  and `docker build` on the node (`build_image` command). Remote rollbacks
+  `docker save` → artifact → `load_image` on the node. Verified end-to-end
+  on a live agent (PR #60).
 - [ ] **IaC provisioning (ROADMAP §2.2, unchanged)** — Terraform/
   OpenTofu, `infra_connections`, Proxmox + AWS modules, + Hetzner module
   (dflow's second provider), cloud-init → auto-enroll.
@@ -419,8 +428,11 @@ and wired refs, one click or one CLI call.
   filters. Applied: audit logs (server-backed), builds (server + client
   date-range), activity (severity server + client category/search).
   Notifications table has no list surface yet — apply when one lands.
-- [ ] **Notification producers round-out** — backups, agent offline,
-  upgrade available, security findings.
+- [x] **Notification producers round-out** — all shipped: deployments
+  (deployments.go), backups (databases.go `createBackupProcess` → owner),
+  agent offline/online sweep (`reconcileAgentHealth` → admins),
+  upgrade-available (`checkForUpgrade`, tag-persisted) and security-scan
+  findings (`scanner.OnScanComplete` → project owner).
 - [x] **Sleep-on-idle / wake-on-traffic** (serverless-lite) —
   `services.sleep_enabled` + `sleep_idle_minutes` (PR #29). Sweeper
   polls container NetworkIO deltas; idle past threshold → workload
@@ -485,8 +497,9 @@ and wired refs, one click or one CLI call.
     a prior deployment, database start/stop/restart/backup-now.
   - **Observe** — polling log tail (300 lines, 5s refresh), per-service
     deployment history, env-doctor issues surfaced on the service view.
-  - [ ] **env var edit + apply-redeploy, domain management, replica
-    scaling, cron execution history** — next iteration.
+  - [x] **env var edit + domain management + replica scaling** (PR #61 —
+    mobile v1.5: variables editor, domains screen, scale + sleep
+    settings, notifications tab). **cron execution history** still open.
   - [ ] **Push notifications** — zero-infra path = self-hosted
     ntfy/Gotify relay (no Firebase dependency), FCM/APNs optional.
   - [ ] **Offline resilience** — cached last-known state + unreachable

app/backend/Dockerfile

@@ -1,5 +1,7 @@
 # Build Go API binary
-FROM golang:1.26-alpine AS go-builder
+ARG GO_IMAGE=golang:1.26-alpine
+ARG NODE_IMAGE=node:22-alpine
+FROM ${GO_IMAGE} AS go-builder
 
 RUN apk add --no-cache git ca-certificates tzdata
 
@@ -18,7 +20,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-X main.version=${V
     CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-X main.version=${VERSION}" -o /agents/containr-agent-linux-arm64 ./cmd/agent
 
 # Build embedded Better Auth runtime dependencies
-FROM node:22-alpine AS auth-builder
+FROM ${NODE_IMAGE} AS auth-builder
 
 WORKDIR /auth
 
@@ -28,7 +30,7 @@ RUN npm ci --omit=dev
 COPY auth/src ./src
 
 # Final runtime image (Go API + Better Auth sidecar in one container)
-FROM node:22-alpine
+FROM ${NODE_IMAGE}
 
 RUN apk --no-cache add ca-certificates tzdata wget git
 

app/backend/internal/api/routes.go

@@ -487,6 +487,7 @@ func SetupRoutes(router *gin.Engine, db *database.DB, redis *database.Redis, cfg
 			authed.POST("/templates/:id/deploy", handleCreateFromTemplate)
 			authed.POST("/templates/:id/plan", handlePlanTemplate)
 			authed.POST("/templates/import/compose", handleImportCompose)
+			authed.POST("/templates/import/git", handleImportGitCompose)
 			authed.POST("/templates/deploy", handleDeployInlineGraph)
 
 			authed.POST("/cron-jobs", handleCreateCronJob)

app/backend/internal/api/runtime.go

@@ -121,6 +121,7 @@ func serviceRuntimeSpec(db *database.DB, service Service) (deployment.RuntimeSpe
 	spec.Volumes = loadServiceVolumes(db, service.ID)
 	spec.Domains = serviceDomainNames(db, service.ID, service.Domain)
 	spec.Maintenance, spec.BasicAuthUsers = serviceAccess(db, service.ID)
+	spec.TraefikLabels = serviceTraefikLabels(db, service.ID)
 	if spec.Maintenance {
 		spec.MaintenanceURL = maintenanceURL(db)
 	}

app/backend/internal/api/services.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"regexp"
 	"strings"
 	"time"
 
@@ -58,9 +59,12 @@ type Service struct {
 	Spread bool `json:"spread" db:"-"`
 	// PlacementTags restrict auto/spread candidates to agents carrying all
 	// listed tags. An explicit pin overrides them — pin + tags is rejected.
-	PlacementTags []string  `json:"placement_tags,omitempty" db:"-"`
-	CreatedAt     time.Time `json:"created_at" db:"created_at"`
-	UpdatedAt     time.Time `json:"updated_at" db:"updated_at"`
+	PlacementTags []string `json:"placement_tags,omitempty" db:"-"`
+	// TraefikLabels holds per-service middleware overrides —
+	// "middlewares.<name>.<type>.<field>" → value. Lazy-read.
+	TraefikLabels map[string]string `json:"traefik_labels,omitempty" db:"-"`
+	CreatedAt     time.Time         `json:"created_at" db:"created_at"`
+	UpdatedAt     time.Time         `json:"updated_at" db:"updated_at"`
 }
 
 // loadServiceSleep fills the sleep-mode columns, which live outside the
@@ -123,6 +127,78 @@ func normalizePlacementTags(tags []string) []string {
 	return out
 }
 
+// traefikLabelKey matches "middlewares.<name>.<type>" with an optional
+// ".<subkey>" tail — e.g. "middlewares.rl.ratelimit.average".
+var traefikLabelKey = regexp.MustCompile(`^middlewares\.([A-Za-z0-9][A-Za-z0-9_-]{0,39})\.([A-Za-z]+)(\.[A-Za-z0-9_.*+-]+)?$`)
+
+// traefikMiddlewareTypes are the Traefik middleware kinds a service may
+// define. Router/service/provider-level keys are never accepted — those
+// would let a tenant hijack someone else's routing.
+var traefikMiddlewareTypes = map[string]bool{
+	"addprefix": true, "basicauth": true, "buffering": true, "chain": true,
+	"circuitbreaker": true, "compress": true, "digestauth": true,
+	"errors": true, "forwardauth": true, "grpcweb": true, "headers": true,
+	"inflightreq": true, "ipallowlist": true, "ipwhitelist": true,
+	"passtlsclientcert": true, "ratelimit": true, "redirectregex": true,
+	"redirectscheme": true, "replacepath": true, "replacepathregex": true,
+	"retry": true, "stripprefix": true, "stripprefixregex": true,
+}
+
+// normalizeTraefikLabels validates a raw override map. Returns the cleaned
+// map (middleware type lowercased — Traefik label keys are canonical-lower)
+// or an error naming the offending key.
+func normalizeTraefikLabels(raw map[string]string) (map[string]string, error) {
+	if len(raw) > 32 {
+		return nil, fmt.Errorf("traefik_labels: at most 32 entries (got %d)", len(raw))
+	}
+	out := make(map[string]string, len(raw))
+	names := map[string]bool{}
+	for k, v := range raw {
+		m := traefikLabelKey.FindStringSubmatch(k)
+		if m == nil {
+			return nil, fmt.Errorf("traefik_labels: invalid key %q — want middlewares.<name>.<type>[.<field>]", k)
+		}
+		mwType := strings.ToLower(m[2])
+		if !traefikMiddlewareTypes[mwType] {
+			return nil, fmt.Errorf("traefik_labels: unsupported middleware type %q", m[2])
+		}
+		if len(v) == 0 {
+			return nil, fmt.Errorf("traefik_labels: %q has an empty value", k)
+		}
+		if len(v) > 512 || strings.ContainsAny(v, "\r\n") {
+			return nil, fmt.Errorf("traefik_labels: %q value must be a single line under 512 chars", k)
+		}
+		out["middlewares."+m[1]+"."+mwType+m[3]] = v
+		names[m[1]] = true
+	}
+	if len(names) > 16 {
+		return nil, fmt.Errorf("traefik_labels: at most 16 middleware names")
+	}
+	return out, nil
+}
+
+// serviceTraefikLabels lazy-reads the traefik_labels column.
+func serviceTraefikLabels(db *database.DB, serviceID uuid.UUID) map[string]string {
+	var raw []byte
+	if err := db.QueryRow(`SELECT traefik_labels FROM services WHERE id = $1`, serviceID).Scan(&raw); err != nil {
+		return nil
+	}
+	var labels map[string]string
+	if err := json.Unmarshal(raw, &labels); err != nil || len(labels) == 0 {
+		return nil
+	}
+	return labels
+}
+
+// traefikLabelsJSON marshals an override map for the jsonb column.
+func traefikLabelsJSON(labels map[string]string) []byte {
+	if len(labels) == 0 {
+		return []byte("{}")
+	}
+	raw, _ := json.Marshal(labels)
+	return raw
+}
+
 // tagsJSON marshals a tag list for a jsonb column; empty stays an array, not null.
 func tagsJSON(tags []string) []byte {
 	if len(tags) == 0 {
@@ -139,6 +215,7 @@ func loadServiceNode(db *database.DB, s *Service) {
 	s.NodeID = serviceNodeID(db, s.ID)
 	s.Spread = serviceSpread(db, s.ID)
 	s.PlacementTags = servicePlacementTags(db, s.ID)
+	s.TraefikLabels = serviceTraefikLabels(db, s.ID)
 	if s.NodeID == "" {
 		return
 	}
@@ -224,6 +301,10 @@ type CreateServiceRequest struct {
 	MemoryReserve   string          `json:"memory_reserve"`
 	StaticBuildCmd  string          `json:"static_build_cmd"`
 	StaticDir       string          `json:"static_dir"`
+	// SleepEnabled/SleepIdleMinutes opt the service into scale-to-zero at
+	// create time — previously update-only, which surprised API/CLI users.
+	SleepEnabled     *bool `json:"sleep_enabled"`
+	SleepIdleMinutes *int  `json:"sleep_idle_minutes"`
 	// NodeID pins placement to a node agent; "auto" picks the least-loaded
 	// online agent, "local"/"" runs on the Containr host.
 	NodeID string `json:"node_id"`
@@ -233,6 +314,10 @@ type CreateServiceRequest struct {
 	// PlacementTags restrict auto/spread candidates to agents carrying all
 	// listed tags. Mutually exclusive with an explicit node pin.
 	PlacementTags []string `json:"placement_tags"`
+	// TraefikLabels defines extra Traefik middlewares for this service's
+	// router — keys "middlewares.<name>.<type>[.<field>]", validated against
+	// an allowlist. Defined middlewares attach to the router automatically.
+	TraefikLabels map[string]string `json:"traefik_labels"`
 }
 
 // UpdateServiceRequest represents a request to update a service
@@ -271,6 +356,9 @@ type UpdateServiceRequest struct {
 	// listed tags; pointer so [] clears the requirement. Mutually exclusive
 	// with an explicit node pin.
 	PlacementTags *[]string `json:"placement_tags"`
+	// TraefikLabels replaces the service's middleware overrides; pointer so
+	// {} clears them and nil leaves them untouched.
+	TraefikLabels *map[string]string `json:"traefik_labels"`
 }
 
 // handleGetServices retrieves all services for a project
@@ -474,6 +562,14 @@ func handleCreateService(c *gin.Context) {
 	if service.Builder == "static" && service.StaticDir == "" {
 		service.StaticDir = "dist"
 	}
+	if len(req.TraefikLabels) > 0 {
+		labels, err := normalizeTraefikLabels(req.TraefikLabels)
+		if err != nil {
+			respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
+			return
+		}
+		service.TraefikLabels = labels
+	}
 	for label, check := range map[string]func(string) error{
 		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
 		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
@@ -511,6 +607,16 @@ func handleCreateService(c *gin.Context) {
 
 	sourceType := inferServiceSourceType(service)
 
+	if req.SleepEnabled != nil {
+		service.SleepEnabled = *req.SleepEnabled
+	}
+	if req.SleepIdleMinutes != nil {
+		if *req.SleepIdleMinutes < 1 || *req.SleepIdleMinutes > 1440 {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "sleep_idle_minutes must be 1-1440", "code": "VALIDATION"})
+			return
+		}
+		service.SleepIdleMinutes = *req.SleepIdleMinutes
+	}
 	if req.Spread != nil {
 		service.Spread = *req.Spread
 	}
@@ -542,9 +648,10 @@ func handleCreateService(c *gin.Context) {
 				 git_repo, git_branch, build_path, cpu, memory, replicas, port, domain,
 				 healthcheck_path, restart_policy, volumes,
 				 builder, cpu_reserve, memory_reserve, static_build_cmd, static_dir,
-				 node_id, spread, placement_tags, created_at, updated_at)
+				 node_id, spread, placement_tags, sleep_enabled, sleep_idle_minutes,
+				 traefik_labels, created_at, updated_at)
 			VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26,
-					$27, $28, $29, $30, $31, $32, $33, $34, $35, $36)`,
+					$27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39)`,
 		service.ID, service.ProjectID, service.Name, environmentID, service.Type,
 		sourceType, firstNonEmpty(service.GitRepo, service.Image), service.Image,
 		"", service.Command, service.Type, service.Status, service.Image, service.Command,
@@ -555,6 +662,9 @@ func handleCreateService(c *gin.Context) {
 		sql.NullString{String: service.NodeID, Valid: service.NodeID != ""},
 		service.Spread,
 		tagsJSON(service.PlacementTags),
+		service.SleepEnabled,
+		sql.NullInt32{Int32: int32(service.SleepIdleMinutes), Valid: service.SleepIdleMinutes > 0},
+		traefikLabelsJSON(service.TraefikLabels),
 		service.CreatedAt, service.UpdatedAt,
 	)
 
@@ -831,6 +941,16 @@ func handleUpdateService(c *gin.Context) {
 		}
 		existingService.SleepIdleMinutes = *req.SleepIdleMinutes
 	}
+	if req.TraefikLabels != nil {
+		labels, err := normalizeTraefikLabels(*req.TraefikLabels)
+		if err != nil {
+			respondError(c, http.StatusBadRequest, "VALIDATION", err.Error())
+			return
+		}
+		existingService.TraefikLabels = labels
+	} else {
+		existingService.TraefikLabels = serviceTraefikLabels(db.(*database.DB), serviceID)
+	}
 	for label, check := range map[string]func(string) error{
 		"cpu": validateCPUSpec, "cpu_reserve": validateCPUSpec,
 		"memory": validateMemorySpec, "memory_reserve": validateMemorySpec,
@@ -907,7 +1027,7 @@ func handleUpdateService(c *gin.Context) {
 				builder = $19, cpu_reserve = $20, memory_reserve = $21,
 				static_build_cmd = $22, static_dir = $23,
 				sleep_enabled = $24, sleep_idle_minutes = $25, node_id = $26, spread = $27,
-				placement_tags = $28::jsonb
+				placement_tags = $28::jsonb, traefik_labels = $29::jsonb
 			WHERE id = $18`,
 		existingService.Name, existingService.Type, existingService.Image, existingService.Command,
 		existingService.Environment, existingService.GitRepo, existingService.GitBranch,
@@ -921,6 +1041,7 @@ func handleUpdateService(c *gin.Context) {
 		sql.NullString{String: existingService.NodeID, Valid: existingService.NodeID != ""},
 		existingService.Spread,
 		tagsJSON(existingService.PlacementTags),
+		traefikLabelsJSON(existingService.TraefikLabels),
 	)
 
 	if err != nil {

app/backend/internal/api/services_routing_test.go

@@ -0,0 +1,64 @@
+package api
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestNormalizeTraefikLabels(t *testing.T) {
+	valid := map[string]string{
+		"middlewares.rl.ratelimit.average":                             "100",
+		"middlewares.rl.ratelimit.period":                              "1m",
+		"middlewares.sec.headers.customrequestheaders.X-Frame-Options": "DENY",
+		"middlewares.gzip.compress":                                    "true",
+	}
+	out, err := normalizeTraefikLabels(valid)
+	if err != nil {
+		t.Fatalf("valid labels rejected: %v", err)
+	}
+	if len(out) != len(valid) {
+		t.Fatalf("expected %d labels, got %d", len(valid), len(out))
+	}
+	if out["middlewares.gzip.compress"] != "true" {
+		t.Fatalf("flag-style middleware missing: %v", out)
+	}
+}
+
+func TestNormalizeTraefikLabelsLowercasesType(t *testing.T) {
+	out, err := normalizeTraefikLabels(map[string]string{
+		"middlewares.rl.RateLimit.average": "10",
+	})
+	if err != nil {
+		t.Fatalf("mixed-case type rejected: %v", err)
+	}
+	if out["middlewares.rl.ratelimit.average"] != "10" {
+		t.Fatalf("type not lowercased: %v", out)
+	}
+}
+
+func TestNormalizeTraefikLabelsRejects(t *testing.T) {
+	cases := map[string]string{
+		"traefik.enable":                                 "true", // provider-level
+		"middlewares..ratelimit.average":                 "1",    // empty name
+		"middlewares.x.evilinject.thing":                 "1",    // unknown type
+		"routers.svc.rule":                               "x",    // router hijack
+		"middlewares.x.ratelimit.average.bad\ninjection": "1",    // control char in key fails regex
+	}
+	for k, v := range cases {
+		if _, err := normalizeTraefikLabels(map[string]string{k: v}); err == nil {
+			t.Fatalf("key %q should have been rejected", k)
+		}
+	}
+}
+
+func TestNormalizeTraefikLabelsRejectsBadValues(t *testing.T) {
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": ""}); err == nil {
+		t.Fatal("empty value accepted")
+	}
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": strings.Repeat("x", 600)}); err == nil {
+		t.Fatal("oversized value accepted")
+	}
+	if _, err := normalizeTraefikLabels(map[string]string{"middlewares.a.ratelimit.average": "1\nmalicious"}); err == nil {
+		t.Fatal("newline value accepted")
+	}
+}

app/backend/internal/api/sleeper.go

@@ -264,9 +264,20 @@ func putToSleep(ctx context.Context, db *database.DB, dc *docker.Client, engine
 	}
 }
 
+// wakeCGIScript is installed as /cgi-bin/wake in the wake container. It
+// fires the wake callback on the first reachable candidate URL, in the
+// background, then serves the reloading placeholder page. Deliberately
+// single-quote-free — the file is written through printf '%s'.
+const wakeCGIScript = `#!/bin/sh
+for u in $WAKE_URLS; do wget -q -O /dev/null --timeout=20 "$u" && break; done >/dev/null 2>&1 &
+printf "Content-Type: text/html\r\n\r\n"
+printf "%s" "$WAKE_PAGE"
+`
+
 // spawnWakeContainer runs a busybox httpd holding the service's Traefik
-// host rule at higher priority. On boot it calls the wake endpoint, then
-// keeps serving a reloading page until the next reconcile removes it.
+// host rule at higher priority. Inbound hits redirect to /cgi-bin/wake,
+// which calls the internal wake endpoint and serves a reloading page
+// until the reconcile removes the placeholder.
 func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client, engine *deployment.DeploymentEngine, svc sleepCandidate, domains []string, apiPort int) error {
 	edgeNet := ""
 	for _, n := range networkList(ctx, dc) {
@@ -296,19 +307,25 @@ func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client,
 		"traefik.http.services." + router + ".loadbalancer.server.port": "80",
 	}
 
-	wakeURL := wakeEndpointURL(ctx, dc, apiPort, svc.ID, edgeNet)
+	wakeURLs := wakeEndpointURLs(ctx, dc, apiPort, svc.ID, edgeNet)
 	page := `<!doctype html><html><head><meta http-equiv="refresh" content="4"><title>Waking up</title>` +
 		`<style>body{font-family:system-ui,sans-serif;background:#0b0d12;color:#dde2ea;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0}` +
 		`.card{text-align:center;max-width:34rem;padding:2rem}h1{font-size:1.25rem;font-weight:600}p{color:#98a2b3}</style></head>` +
 		`<body><div class="card"><h1>Service is waking up</h1><p>This Containr service was sleeping and is resuming now. The page reloads automatically.</p></div></body></html>`
-	// httpd without -f daemonizes, so the sequence is: write page, start
-	// httpd, fire the wake callback, then hold PID1 on sleep infinity.
+	// The wake callback must fire when a request arrives, not at boot —
+	// firing unconditionally makes the service flap sleep→wake forever.
+	// index.html redirects to /cgi-bin/wake; the CGI fires the callback
+	// (first reachable URL wins) and serves the reloading page.
+	indexPage := `<!doctype html><html><head><meta http-equiv="refresh" content="0;url=/cgi-bin/wake"></head><body></body></html>`
+	// httpd without -f daemonizes, so PID1 ends on sleep infinity. URLs
+	// and the page travel via env so the CGI script needs no quoting.
 	cmd := fmt.Sprintf(
-		`mkdir -p /www && printf '%%s' '%s' > /www/index.html && `+
-			`httpd -p 80 -h /www && `+
-			`(sleep 2; wget -q -O /dev/null --timeout=20 '%s' 2>/dev/null || true) && `+
-			`sleep infinity`,
-		strings.ReplaceAll(page, "'", "'\\''"), wakeURL)
+		`mkdir -p /www/cgi-bin && printf '%%s' '%s' > /www/index.html && `+
+			`printf '%%s' '%s' > /www/cgi-bin/wake && chmod +x /www/cgi-bin/wake && `+
+			`printf '%%s\n' 'E404:/cgi-bin/wake' > /www/httpd.conf && `+
+			`httpd -p 80 -h /www && sleep infinity`,
+		strings.ReplaceAll(indexPage, "'", "'\\''"),
+		strings.ReplaceAll(wakeCGIScript, "'", "'\\''"))
 
 	endpoints := map[string]*network.EndpointSettings{edgeNet: {}}
 	if ownNet := dc.OwnNetworkName(ctx); ownNet != "" && ownNet != edgeNet {
@@ -329,9 +346,13 @@ func spawnWakeContainer(ctx context.Context, db *database.DB, dc *docker.Client,
 	}
 
 	id, err := dc.CreateContainer(ctx, docker.ContainerConfig{
-		Name:     name,
-		Image:    wakeImage,
-		Cmd:      []string{"sh", "-c", cmd},
+		Name:  name,
+		Image: wakeImage,
+		Cmd:   []string{"sh", "-c", cmd},
+		Env: []string{
+			"WAKE_URLS=" + strings.Join(wakeURLs, " "),
+			"WAKE_PAGE=" + page,
+		},
 		Labels:   labels,
 		Networks: endpoints,
 	})
@@ -353,25 +374,41 @@ func networkList(ctx context.Context, dc *docker.Client) []string {
 	return names
 }
 
-// wakeEndpointURL builds the internal URL the wake container calls. The
-// edge network's gateway reaches the host's published API port; when the
-// API itself is containerized its own name resolves on the shared network.
-func wakeEndpointURL(ctx context.Context, dc *docker.Client, apiPort int, serviceID uuid.UUID, edgeNet string) string {
+// wakeEndpointURLs builds ordered candidate URLs for the wake container to
+// call, deduplicated. No single address covers every topology: a containerized
+// API resolves by name on the shared network; Docker Desktop containers reach
+// the host via host.docker.internal; on native Docker the edge network's
+// gateway routes to host-published ports. busybox wget walks the chain until
+// one answers.
+func wakeEndpointURLs(ctx context.Context, dc *docker.Client, apiPort int, serviceID uuid.UUID, edgeNet string) []string {
+	var hosts []string
 	if dc.OwnNetworkName(ctx) != "" {
 		if self, err := dc.GetContainer(ctx, selfID()); err == nil {
-			name := strings.TrimPrefix(self.Name, "/")
-			if name != "" {
-				return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", name, apiPort, serviceID)
+			if name := strings.TrimPrefix(self.Name, "/"); name != "" {
+				hosts = append(hosts, name)
 			}
 		}
 	}
+	hosts = append(hosts, "host.docker.internal")
 	if gw := networkGateway(ctx, dc, edgeNet); gw != "" {
-		return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", gw, apiPort, serviceID)
+		hosts = append(hosts, gw)
 	}
 	if probe := dc.HostProbeHost(ctx); probe != "" {
-		return fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", probe, apiPort, serviceID)
+		hosts = append(hosts, probe)
 	}
-	return fmt.Sprintf("http://127.0.0.1:%d/api/v1/internal/wake/%s", apiPort, serviceID)
+	seen := map[string]bool{}
+	var urls []string
+	for _, h := range hosts {
+		if h == "" || seen[h] {
+			continue
+		}
+		seen[h] = true
+		urls = append(urls, fmt.Sprintf("http://%s:%d/api/v1/internal/wake/%s", h, apiPort, serviceID))
+	}
+	if len(urls) == 0 {
+		urls = append(urls, fmt.Sprintf("http://127.0.0.1:%d/api/v1/internal/wake/%s", apiPort, serviceID))
+	}
+	return urls
 }
 
 func networkGateway(ctx context.Context, dc *docker.Client, name string) string {
@@ -490,10 +527,13 @@ func triggerServiceWake(c *gin.Context) (int, gin.H) {
 		defer cancel()
 		spec, err := serviceRuntimeSpec(db, service)
 		if err != nil {
+			log.Printf("wake: runtime spec for %s failed: %v", service.ID, err)
+			_, _ = db.Exec(`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
 			return
 		}
 		state, err := engine.ReconcileService(ctx, spec)
 		if err != nil {
+			log.Printf("wake: reconcile for %s failed: %v", service.ID, err)
 			_, _ = db.Exec(`UPDATE services SET status = 'failed', updated_at = $1 WHERE id = $2`, time.Now(), service.ID)
 			return
 		}

app/backend/internal/api/templategraph.go

@@ -11,6 +11,8 @@ import (
 	"log"
 	"math/big"
 	"net/http"
+	"os"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strconv"
@@ -22,6 +24,7 @@ import (
 	"containr/internal/deployment"
 	"containr/internal/deployqueue"
 	"containr/internal/secrets"
+	"containr/internal/source"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -227,7 +230,9 @@ func resolveStaticExpr(value string, userVars map[string]string, unresolved *[]s
 		if val, ok := userVars[key]; ok {
 			return val
 		}
-		if sub[2] != "" {
+		// {{VAR:-x}} supplies a default; {{VAR:-}} declares an explicitly
+		// empty one. Both resolve — only a bare {{VAR}} is unresolved.
+		if strings.Contains(m, ":-") {
 			return sub[2]
 		}
 		if unresolved != nil {
@@ -1112,6 +1117,130 @@ func handleImportCompose(c *gin.Context) {
 	})
 }
 
+// handleImportGitCompose fetches a compose file out of a git repository and
+// runs it through the same conversion as handleImportCompose. Works with any
+// git remote — connected providers (including GitHub App installs) supply
+// credentials for private repos. Nothing is persisted; the response feeds
+// the template create form or a direct deploy.
+func handleImportGitCompose(c *gin.Context) {
+	userID, ok := requireAuthenticatedUserID(c)
+	if !ok {
+		return
+	}
+	db := c.MustGet("db").(*database.DB)
+
+	var req struct {
+		Repo string `json:"repo" binding:"required"`
+		Path string `json:"path"`
+		Ref  string `json:"ref"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	branch, commit := "", ""
+	if ref := strings.TrimSpace(req.Ref); ref != "" {
+		if isCommitSHA(ref) {
+			commit = ref
+		} else {
+			branch = ref
+		}
+	}
+	spec, err := resolveGitCloneSpec(db, userID, req.Repo, branch, commit, "")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error(), "code": "VALIDATION"})
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 2*time.Minute)
+	defer cancel()
+	checkoutRoot := filepath.Join(containrWorkDir, "repos", "import-"+uuid.NewString())
+	defer os.RemoveAll(checkoutRoot)
+	repoDir, err := source.Checkout(ctx, checkoutRoot, spec)
+	if err != nil {
+		c.JSON(http.StatusBadGateway, gin.H{"error": "git fetch failed: " + err.Error(), "code": "GIT_FETCH"})
+		return
+	}
+
+	// Default search order mirrors common compose conventions.
+	candidates := []string{req.Path}
+	if strings.TrimSpace(req.Path) == "" {
+		candidates = []string{"compose.yaml", "compose.yml", "docker-compose.yml", "docker-compose.yaml"}
+	}
+	var raw []byte
+	for _, rel := range candidates {
+		p, rerr := resolveRepoFile(repoDir, rel)
+		if rerr != nil {
+			continue
+		}
+		raw, err = os.ReadFile(p)
+		if err == nil {
+			break
+		}
+	}
+	if raw == nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "compose file not found in repository", "code": "NOT_FOUND"})
+		return
+	}
+	if len(raw) > 512*1024 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Compose file exceeds 512 KiB"})
+		return
+	}
+
+	var file composeFileDef
+	if err := yaml.Unmarshal(raw, &file); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid compose YAML: " + err.Error()})
+		return
+	}
+	services, warnings, convErr := composeToSpecs(&file)
+	if convErr != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": convErr.Error()})
+		return
+	}
+	config := TemplateConfig{Version: 2, Services: services}
+	configJSON, _ := json.Marshal(config)
+	c.JSON(http.StatusOK, gin.H{
+		"config":    json.RawMessage(configJSON),
+		"variables": []TemplateVariable{},
+		"warnings":  warnings,
+	})
+}
+
+// resolveRepoFile maps a repo-relative file path onto the checkout and
+// rejects escapes — same containment rule as ResolveBuildPath, for files.
+func resolveRepoFile(checkoutDir, rel string) (string, error) {
+	rel = strings.TrimSpace(rel)
+	if rel == "" || filepath.IsAbs(rel) {
+		return "", fmt.Errorf("invalid repo path %q", rel)
+	}
+	clean := filepath.Clean(rel)
+	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("path escapes the checkout: %q", rel)
+	}
+	resolved := filepath.Join(checkoutDir, clean)
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "", fmt.Errorf("path %q not found in checkout", rel)
+	}
+	if !info.Mode().IsRegular() {
+		return "", fmt.Errorf("path %q is not a file", rel)
+	}
+	return resolved, nil
+}
+
+func isCommitSHA(ref string) bool {
+	if len(ref) != 40 {
+		return false
+	}
+	for _, r := range ref {
+		if !('0' <= r && r <= '9') && !('a' <= r && r <= 'f') {
+			return false
+		}
+	}
+	return true
+}
+
 // composeToSpecs converts a parsed compose file into graph service specs.
 // Compose service names become keys; declaration order follows YAML document
 // order — yaml.v3 maps lose order, so sort keys for stability.

app/backend/internal/api/templategraph_compose_test.go

@@ -1,6 +1,8 @@
 package api
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -124,3 +126,42 @@ func TestComposeToSpecsWarnings(t *testing.T) {
 		t.Errorf("missing env warning: %v", warnings)
 	}
 }
+
+func TestResolveRepoFileContainment(t *testing.T) {
+	dir := t.TempDir()
+	inner := filepath.Join(dir, "sub")
+	if err := os.MkdirAll(inner, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(inner, "compose.yml"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	p, err := resolveRepoFile(dir, "sub/compose.yml")
+	if err != nil {
+		t.Fatalf("valid file rejected: %v", err)
+	}
+	if p != filepath.Join(dir, "sub", "compose.yml") {
+		t.Errorf("unexpected path %q", p)
+	}
+
+	for _, bad := range []string{"", "/etc/passwd", "../escape.yml", "..", "sub/../../out.yml"} {
+		if _, err := resolveRepoFile(dir, bad); err == nil {
+			t.Errorf("path %q should have been rejected", bad)
+		}
+	}
+	if _, err := resolveRepoFile(dir, "sub"); err == nil {
+		t.Error("directory accepted as file")
+	}
+}
+
+func TestIsCommitSHA(t *testing.T) {
+	if !isCommitSHA("0123456789abcdef0123456789abcdef01234567") {
+		t.Error("40-hex ref not recognised as a commit")
+	}
+	for _, bad := range []string{"main", "v1.2.3", "0123456789abcdef0123456789abcdef0123456", "0123456789abcdef0123456789abcdef0123456G"} {
+		if isCommitSHA(bad) {
+			t.Errorf("ref %q misclassified as commit SHA", bad)
+		}
+	}
+}

app/backend/internal/api/templates.go

@@ -1102,6 +1102,98 @@ func SeedTemplates() []ServiceTemplate {
 			Variables:  `[{"key":"APP_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
 			IsOfficial: true,
 		},
+		{
+			ID:          "tpl-n8n",
+			Name:        "n8n + PostgreSQL + Redis",
+			Description: "Workflow automation in queue mode with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/n8n",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"n8n","POSTGRES_USER":"n8n"},"volumes":[{"source":"n8n-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"n8n","type":"web","runtime":"docker.n8n.io/n8nio/n8n:latest","port":5678,"health_check":"/healthz","depends_on":["db","redis"],
+				 "environment":{"DB_TYPE":"postgresdb","DB_POSTGRESDB_HOST":"{{service.db.host}}","DB_POSTGRESDB_PORT":"5432","DB_POSTGRESDB_DATABASE":"{{service.db.database}}","DB_POSTGRESDB_USER":"{{service.db.user}}","DB_POSTGRESDB_PASSWORD":"{{service.db.password}}","QUEUE_BULL_REDIS_HOST":"{{service.redis.host}}","QUEUE_BULL_REDIS_PASSWORD":"{{service.redis.password}}","EXECUTIONS_MODE":"queue","N8N_ENCRYPTION_KEY":"{{secret(32)}}","N8N_HOST":"{{APP_URL:-http://localhost:5678}}","N8N_EDITOR_BASE_URL":"{{APP_URL:-http://localhost:5678}}"},
+				 "volumes":[{"source":"n8n-data","target":"/home/node/.n8n"}]},
+				{"key":"worker","name":"n8n-worker","type":"worker","runtime":"docker.n8n.io/n8nio/n8n:latest","start_command":"worker","depends_on":["n8n","db","redis"],
+				 "environment":{"DB_TYPE":"postgresdb","DB_POSTGRESDB_HOST":"{{service.db.host}}","DB_POSTGRESDB_PORT":"5432","DB_POSTGRESDB_DATABASE":"{{service.db.database}}","DB_POSTGRESDB_USER":"{{service.db.user}}","DB_POSTGRESDB_PASSWORD":"{{service.db.password}}","QUEUE_BULL_REDIS_HOST":"{{service.redis.host}}","QUEUE_BULL_REDIS_PASSWORD":"{{service.redis.password}}","EXECUTIONS_MODE":"queue","N8N_ENCRYPTION_KEY":"{{secret(32)}}","QUEUE_HEALTH_CHECK_ACTIVE":"true"},
+				 "volumes":[{"source":"n8n-data","target":"/home/node/.n8n"}]}]}`,
+			Variables:  `[{"key":"APP_URL","label":"Public URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-gitea",
+			Name:        "Gitea + PostgreSQL",
+			Description: "Self-hosted git service with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/gitea",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"gitea","POSTGRES_USER":"gitea"},"volumes":[{"source":"gitea-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"gitea","type":"web","runtime":"gitea/gitea:latest","port":3000,"health_check":"/api/healthz","depends_on":["db"],
+				 "environment":{"GITEA__database__DB_TYPE":"postgres","GITEA__database__HOST":"{{service.db.host}}:{{service.db.port}}","GITEA__database__NAME":"{{service.db.database}}","GITEA__database__USER":"{{service.db.user}}","GITEA__database__PASSWD":"{{service.db.password}}","GITEA__security__INSTALL_LOCK":"true","GITEA__security__SECRET_KEY":"{{secret(32)}}","GITEA__security__INTERNAL_TOKEN":"{{secret(64)}}","GITEA__server__DOMAIN":"{{DOMAIN:-localhost}}","GITEA__server__ROOT_URL":"{{ROOT_URL:-http://localhost:3000}}","GITEA__server__SSH_PORT":"2222","USER_UID":"1000","USER_GID":"1000"},
+				 "volumes":[{"source":"gitea-data","target":"/data"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Public domain","default":"","required":false,"secret":false},{"key":"ROOT_URL","label":"Root URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-nextcloud",
+			Name:        "Nextcloud + PostgreSQL + Redis",
+			Description: "Self-hosted file sync and collaboration with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/nextcloud",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"nextcloud","POSTGRES_USER":"nextcloud"},"volumes":[{"source":"nextcloud-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"nextcloud","type":"web","runtime":"nextcloud:latest","port":80,"depends_on":["db","redis"],
+				 "environment":{"POSTGRES_HOST":"{{service.db.host}}","POSTGRES_DB":"{{service.db.database}}","POSTGRES_USER":"{{service.db.user}}","POSTGRES_PASSWORD":"{{service.db.password}}","REDIS_HOST":"{{service.redis.host}}","REDIS_HOST_PASSWORD":"{{service.redis.password}}","NEXTCLOUD_ADMIN_USER":"admin","NEXTCLOUD_ADMIN_PASSWORD":"{{secret(24)}}","NEXTCLOUD_TRUSTED_DOMAINS":"{{DOMAIN:-localhost}}","OVERWRITEHOST":"{{DOMAIN:-}}","OVERWRITEPROTOCOL":"https"},
+				 "volumes":[{"source":"nextcloud-data","target":"/var/www/html"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Trusted domain","default":"localhost","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-vaultwarden",
+			Name:        "Vaultwarden + PostgreSQL",
+			Description: "Bitwarden-compatible password manager with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/vaultwarden",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"vaultwarden","POSTGRES_USER":"vaultwarden"},"volumes":[{"source":"vaultwarden-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"vaultwarden","type":"web","runtime":"vaultwarden/server:latest","port":80,"health_check":"/alive","depends_on":["db"],
+				 "environment":{"DATABASE_URL":"{{service.db.url}}","ADMIN_TOKEN":"{{secret(48)}}","DOMAIN":"{{DOMAIN:-http://localhost:80}}","SIGNUPS_ALLOWED":"false","WEBSOCKET_ENABLED":"true"},
+				 "volumes":[{"source":"vaultwarden-data","target":"/data"}]}]}`,
+			Variables:  `[{"key":"DOMAIN","label":"Public URL","default":"","required":false,"secret":false}]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-umami",
+			Name:        "Umami + PostgreSQL",
+			Description: "Lightweight privacy-first web analytics with managed PostgreSQL",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/umami",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"umami","POSTGRES_USER":"umami"},"volumes":[{"source":"umami-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"umami","type":"web","runtime":"ghcr.io/umami-software/umami:postgresql-latest","port":3000,"depends_on":["db"],
+				 "environment":{"DATABASE_URL":"{{service.db.url}}","APP_SECRET":"{{secret(32)}}"}}]}`,
+			Variables:  `[]`,
+			IsOfficial: true,
+		},
+		{
+			ID:          "tpl-immich",
+			Name:        "Immich + PostgreSQL + Redis",
+			Description: "Self-hosted photo and video backup with managed PostgreSQL and Redis",
+			Category:    "stack",
+			Logo:        "https://cdn.simpleicons.org/immich",
+			Config: `{"version":2,"services":[
+				{"key":"db","type":"database","runtime":"postgresql","environment":{"POSTGRES_DB":"immich","POSTGRES_USER":"immich"},"volumes":[{"source":"immich-db","target":"/var/lib/postgresql/data"}]},
+				{"key":"redis","type":"database","runtime":"redis"},
+				{"key":"ml","name":"immich-machine-learning","type":"worker","runtime":"ghcr.io/immich-app/immich-machine-learning:release",
+				 "environment":{"DB_DATABASE_NAME":"{{service.db.database}}","DB_HOSTNAME":"{{service.db.host}}","DB_USERNAME":"{{service.db.user}}","DB_PASSWORD":"{{service.db.password}}","REDIS_HOSTNAME":"{{service.redis.host}}","REDIS_PASSWORD":"{{service.redis.password}}"},
+				 "volumes":[{"source":"immich-model-cache","target":"/cache"}]},
+				{"key":"immich","name":"immich-server","type":"web","runtime":"ghcr.io/immich-app/immich-server:release","port":2283,"health_check":"/api/server/ping","depends_on":["db","redis","ml"],
+				 "environment":{"DB_DATABASE_NAME":"{{service.db.database}}","DB_HOSTNAME":"{{service.db.host}}","DB_USERNAME":"{{service.db.user}}","DB_PASSWORD":"{{service.db.password}}","REDIS_HOSTNAME":"{{service.redis.host}}","REDIS_PASSWORD":"{{service.redis.password}}"},
+				 "volumes":[{"source":"immich-upload","target":"/usr/src/app/upload"}]}]}`,
+			Variables:  `[]`,
+			IsOfficial: true,
+		},
 	}
 	return templates
 }

app/backend/internal/api/templates_test.go

@@ -1,6 +1,9 @@
 package api
 
-import "testing"
+import (
+	"encoding/json"
+	"testing"
+)
 
 func TestNormalizeTemplateServiceType(t *testing.T) {
 	valid := []string{"web", "worker", "database", "cron"}
@@ -71,3 +74,32 @@ func TestResolveTemplateRuntimeImage(t *testing.T) {
 		t.Fatalf("expected unknown runtime passthrough, got %q", got)
 	}
 }
+
+func TestSeedTemplatesResolveCleanly(t *testing.T) {
+	for _, tpl := range SeedTemplates() {
+		var config TemplateConfig
+		if err := json.Unmarshal([]byte(tpl.Config), &config); err != nil {
+			t.Fatalf("%s: invalid config JSON: %v", tpl.ID, err)
+		}
+		var variables []TemplateVariable
+		if err := json.Unmarshal([]byte(tpl.Variables), &variables); err != nil {
+			t.Fatalf("%s: invalid variables JSON: %v", tpl.ID, err)
+		}
+		if len(config.Services) == 0 {
+			continue // legacy single-service template
+		}
+		sorted, err := topoSortServices(config.Services)
+		if err != nil {
+			t.Fatalf("%s: topo sort: %v", tpl.ID, err)
+		}
+		if err := validateTemplateGraph(sorted); err != nil {
+			t.Fatalf("%s: graph validation: %v", tpl.ID, err)
+		}
+		// User vars left empty — every expression must still resolve via
+		// defaults, secrets, or service refs.
+		graph := resolveTemplateGraph(sorted, map[string]string{})
+		if len(graph.unresolved) > 0 {
+			t.Fatalf("%s: unresolved expressions: %v", tpl.ID, graph.unresolved)
+		}
+	}
+}

app/backend/internal/cli/commands/services.go

@@ -117,6 +117,14 @@ var servicesCreateCmd = &cobra.Command{
 		if v, _ := cmd.Flags().GetBool("spread"); v {
 			body["spread"] = v
 		}
+		if cmd.Flags().Changed("sleep") {
+			v, _ := cmd.Flags().GetBool("sleep")
+			body["sleep_enabled"] = v
+		}
+		if cmd.Flags().Changed("sleep-idle") {
+			v, _ := cmd.Flags().GetInt("sleep-idle")
+			body["sleep_idle_minutes"] = v
+		}
 		if v, _ := cmd.Flags().GetString("placement-tags"); v != "" {
 			tags := []string{}
 			for _, t := range strings.Split(v, ",") {
@@ -126,6 +134,11 @@ var servicesCreateCmd = &cobra.Command{
 			}
 			body["placement_tags"] = tags
 		}
+		if labels, err := traefikLabelFlag(cmd); err != nil {
+			return err
+		} else if labels != nil {
+			body["traefik_labels"] = labels
+		}
 		data, err := c.Do("POST", "/projects/"+args[0]+"/services", body)
 		if err != nil {
 			return err
@@ -140,6 +153,28 @@ var servicesCreateCmd = &cobra.Command{
 	},
 }
 
+// traefikLabelFlag parses --traefik-label key=value pairs into the API's
+// map shape. Returns nil when the flag was never passed; an empty map when
+// only empty values were given (clears overrides on update).
+func traefikLabelFlag(cmd *cobra.Command) (map[string]string, error) {
+	if !cmd.Flags().Changed("traefik-label") {
+		return nil, nil
+	}
+	pairs, _ := cmd.Flags().GetStringArray("traefik-label")
+	labels := map[string]string{}
+	for _, p := range pairs {
+		if strings.TrimSpace(p) == "" {
+			continue
+		}
+		k, v, ok := strings.Cut(p, "=")
+		if !ok || strings.TrimSpace(k) == "" {
+			return nil, &APIError{Message: fmt.Sprintf("invalid --traefik-label %q — want key=value", p), ExitCode: ExitError}
+		}
+		labels[strings.TrimSpace(k)] = v
+	}
+	return labels, nil
+}
+
 var servicesDeleteCmd = &cobra.Command{
 	Use:   "delete <id>",
 	Short: "Delete a service",
@@ -233,6 +268,11 @@ var servicesUpdateCmd = &cobra.Command{
 			v, _ := cmd.Flags().GetInt("sleep-idle")
 			body["sleep_idle_minutes"] = v
 		}
+		if labels, err := traefikLabelFlag(cmd); err != nil {
+			return err
+		} else if labels != nil {
+			body["traefik_labels"] = labels
+		}
 		if cmd.Flags().Changed("maintenance") {
 			v, _ := cmd.Flags().GetString("maintenance")
 			body["maintenance_mode"] = v == "on" || v == "true"
@@ -520,9 +560,12 @@ func init() {
 	f.String("memory-reserve", "", "soft memory reservation (e.g. 128Mi)")
 	f.String("static-cmd", "", "build command for the static builder")
 	f.String("static-dir", "", "output dir for the static builder (default dist)")
-	f.String("node", "", "pin to a node agent id, or 'auto' for least-loaded (image services only)")
+	f.String("node", "", "pin to a node agent id, or 'auto' for least-loaded")
 	f.Bool("spread", false, "distribute replicas across all online schedulable nodes")
+	f.Bool("sleep", false, "enable scale-to-zero on idle (sleep mode)")
+	f.Int("sleep-idle", 0, "idle minutes before sleeping (1-1440)")
 	f.String("placement-tags", "", "comma-separated node tags required for remote placement (auto/spread only)")
+	f.StringArray("traefik-label", nil, "Traefik middleware override, key=value (e.g. middlewares.rl.ratelimit.average=100); repeatable")
 
 	uf := servicesUpdateCmd.Flags()
 	uf.String("name", "", "service name")
@@ -547,6 +590,7 @@ func init() {
 	uf.String("static-dir", "", "output dir for the static builder (empty clears)")
 	uf.Bool("sleep", false, "enable scale-to-zero on idle (sleep mode)")
 	uf.Int("sleep-idle", 0, "idle minutes before sleeping (1-1440)")
+	uf.StringArray("traefik-label", nil, "Traefik middleware override, key=value; repeatable; empty list clears via --traefik-label ''")
 	uf.String("node", "", "pin to a node agent id, 'auto' for least-loaded, 'local' to clear")
 	uf.Bool("spread", false, "spread replicas across all online schedulable nodes (--spread=false to disable)")
 	uf.String("placement-tags", "", "comma-separated node tags required for remote placement (empty clears)")

app/backend/internal/cli/commands/templates.go

@@ -194,6 +194,32 @@ var templatesImportComposeCmd = &cobra.Command{
 	},
 }
 
+var templatesImportGitCmd = &cobra.Command{
+	Use:   "import-git <repo> [path]",
+	Short: "Fetch a compose file from a git repo and convert it into a template graph config",
+	Long:  "repo accepts a clone URL, ssh remote, or owner/repo shorthand resolved via connected git providers (private repos included). path defaults to compose.yaml/yml or docker-compose.yml/yaml. --ref selects a branch or commit.",
+	Args:  cobra.RangeArgs(1, 2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		body := map[string]string{"repo": args[0]}
+		if len(args) > 1 {
+			body["path"] = args[1]
+		}
+		if v, _ := cmd.Flags().GetString("ref"); v != "" {
+			body["ref"] = v
+		}
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/templates/import/git", body)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
 var templatesDeployGraphCmd = &cobra.Command{
 	Use:   "deploy-graph <project-id> <config.json|->",
 	Short: "Deploy an ad-hoc service graph (v2 config with services[]) without a stored template",
@@ -257,5 +283,6 @@ func init() {
 	templatesDeployCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
 	templatesPlanCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
 	templatesDeployGraphCmd.Flags().StringArrayVar(&tplDeployVars, "var", nil, "Template variable override (KEY=VALUE, repeatable)")
-	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd, templatesPlanCmd, templatesImportComposeCmd, templatesDeployGraphCmd)
+	templatesImportGitCmd.Flags().String("ref", "", "git branch or commit (default: remote HEAD)")
+	TemplatesCmd.AddCommand(templatesListCmd, templatesGetCmd, templatesCreateCmd, templatesDeleteCmd, templatesDeployCmd, templatesPlanCmd, templatesImportComposeCmd, templatesImportGitCmd, templatesDeployGraphCmd)
 }

app/backend/internal/deployment/edge_labels_test.go

@@ -0,0 +1,60 @@
+package deployment
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestEdgeLabelsCustomMiddlewares(t *testing.T) {
+	spec := RuntimeSpec{
+		ServiceID: "01234567-89ab-cdef-0123-456789abcdef",
+		Port:      8080,
+		Domains:   []string{"app.example.com"},
+		TraefikLabels: map[string]string{
+			"middlewares.rl.ratelimit.average":                              "100",
+			"middlewares.rl.ratelimit.period":                               "1m",
+			"middlewares.sec.headers.customresponseheaders.X-Frame-Options": "DENY",
+		},
+	}
+	labels := edgeLabels(spec, "containr-edge")
+
+	if got := labels["traefik.http.middlewares.svc-01234567-rl.ratelimit.average"]; got != "100" {
+		t.Fatalf("ratelimit label missing: %v", labels)
+	}
+	if got := labels["traefik.http.middlewares.svc-01234567-sec.headers.customresponseheaders.X-Frame-Options"]; got != "DENY" {
+		t.Fatalf("headers label missing: %v", labels)
+	}
+	chain := labels["traefik.http.routers.svc-01234567.middlewares"]
+	if chain != "svc-01234567-rl,svc-01234567-sec" {
+		t.Fatalf("middleware chain wrong: %q", chain)
+	}
+}
+
+func TestEdgeLabelsCustomAfterBuiltins(t *testing.T) {
+	spec := RuntimeSpec{
+		ServiceID:      "01234567-89ab-cdef-0123-456789abcdef",
+		Port:           8080,
+		Domains:        []string{"app.example.com"},
+		BasicAuthUsers: "u:$apr1$x",
+		TraefikLabels: map[string]string{
+			"middlewares.rl.ratelimit.average": "10",
+		},
+	}
+	labels := edgeLabels(spec, "containr-edge")
+	chain := labels["traefik.http.routers.svc-01234567.middlewares"]
+	if !strings.HasPrefix(chain, "svc-01234567-auth,") || !strings.HasSuffix(chain, "svc-01234567-rl") {
+		t.Fatalf("builtin should precede custom: %q", chain)
+	}
+}
+
+func TestEdgeLabelsNoCustom(t *testing.T) {
+	spec := RuntimeSpec{
+		ServiceID: "01234567-89ab-cdef-0123-456789abcdef",
+		Port:      8080,
+		Domains:   []string{"app.example.com"},
+	}
+	labels := edgeLabels(spec, "containr-edge")
+	if _, ok := labels["traefik.http.routers.svc-01234567.middlewares"]; ok {
+		t.Fatal("middleware chain should be absent with no middlewares")
+	}
+}

app/backend/internal/deployment/runtime.go

@@ -55,6 +55,10 @@ type RuntimeSpec struct {
 	Maintenance    bool          // redirect traffic to MaintenanceURL
 	MaintenanceURL string        // absolute URL; empty = serve empty response
 	BasicAuthUsers string        // htpasswd-format user:hash pairs, comma-separated
+	// TraefikLabels defines extra middlewares for this service's router —
+	// keys "middlewares.<name>.<type>[.<field>]" (API-validated against an
+	// allowlist). Defined middlewares attach to the router after builtins.
+	TraefikLabels map[string]string
 	// NodeID pins the service to a node agent; "" runs on the local host.
 	NodeID string
 	// Spread distributes replicas across all online, schedulable agents
@@ -274,44 +278,9 @@ func (de *DeploymentEngine) createReplica(ctx context.Context, spec RuntimeSpec,
 		projectNet: {Aliases: []string{spec.Name}},
 	}
 	if edgeNet != "" {
-		router := "svc-" + spec.ServiceID[:8]
-		domains := spec.Domains
-		if len(domains) == 0 && spec.Domain != "" {
-			domains = []string{spec.Domain}
-		}
-		sort.Strings(domains)
-		rules := make([]string, 0, len(domains))
-		for _, d := range domains {
-			rules = append(rules, "Host(`"+d+"`)")
-		}
 		endpoints[edgeNet] = &network.EndpointSettings{}
-		labels["traefik.enable"] = "true"
-		labels["traefik.docker.network"] = edgeNet
-		labels["traefik.http.routers."+router+".rule"] = strings.Join(rules, " || ")
-		labels["traefik.http.routers."+router+".entrypoints"] = "web"
-		labels["traefik.http.services."+router+".loadbalancer.server.port"] = fmt.Sprintf("%d", spec.Port)
-
-		var middlewares []string
-		if spec.Maintenance {
-			if spec.MaintenanceURL != "" {
-				mw := router + "-maint"
-				labels["traefik.http.middlewares."+mw+".redirectregex.regex"] = "^https?://[^/]+/.*"
-				labels["traefik.http.middlewares."+mw+".redirectregex.replacement"] = spec.MaintenanceURL
-				labels["traefik.http.middlewares."+mw+".redirectregex.permanent"] = "false"
-				middlewares = append(middlewares, mw)
-			} else {
-				// No redirect target configured — take the site offline with
-				// empty responses instead of leaking traffic to the app.
-				labels["traefik.http.routers."+router+".service"] = "noop@internal"
-			}
-		}
-		if spec.BasicAuthUsers != "" {
-			mw := router + "-auth"
-			labels["traefik.http.middlewares."+mw+".basicauth.users"] = spec.BasicAuthUsers
-			middlewares = append(middlewares, mw)
-		}
-		if len(middlewares) > 0 {
-			labels["traefik.http.routers."+router+".middlewares"] = strings.Join(middlewares, ",")
+		for k, v := range edgeLabels(spec, edgeNet) {
+			labels[k] = v
 		}
 	}
 
@@ -399,6 +368,81 @@ func (de *DeploymentEngine) createReplica(ctx context.Context, spec RuntimeSpec,
 // vpnkit drops a conflicting binding).
 var errPortNotBound = errors.New("requested host port not bound")
 
+// edgeLabels builds the Traefik router/service/middleware labels for a
+// replica on the edge network: host rules, load balancer port, builtin
+// maintenance/basic-auth middlewares, then operator-defined overrides.
+func edgeLabels(spec RuntimeSpec, edgeNet string) map[string]string {
+	router := "svc-" + spec.ServiceID[:8]
+	domains := spec.Domains
+	if len(domains) == 0 && spec.Domain != "" {
+		domains = []string{spec.Domain}
+	}
+	sort.Strings(domains)
+	rules := make([]string, 0, len(domains))
+	for _, d := range domains {
+		rules = append(rules, "Host(`"+d+"`)")
+	}
+
+	labels := map[string]string{
+		"traefik.enable":                                                "true",
+		"traefik.docker.network":                                        edgeNet,
+		"traefik.http.routers." + router + ".rule":                      strings.Join(rules, " || "),
+		"traefik.http.routers." + router + ".entrypoints":               "web",
+		"traefik.http.services." + router + ".loadbalancer.server.port": fmt.Sprintf("%d", spec.Port),
+	}
+
+	var middlewares []string
+	if spec.Maintenance {
+		if spec.MaintenanceURL != "" {
+			mw := router + "-maint"
+			labels["traefik.http.middlewares."+mw+".redirectregex.regex"] = "^https?://[^/]+/.*"
+			labels["traefik.http.middlewares."+mw+".redirectregex.replacement"] = spec.MaintenanceURL
+			labels["traefik.http.middlewares."+mw+".redirectregex.permanent"] = "false"
+			middlewares = append(middlewares, mw)
+		} else {
+			// No redirect target configured — take the site offline with
+			// empty responses instead of leaking traffic to the app.
+			labels["traefik.http.routers."+router+".service"] = "noop@internal"
+		}
+	}
+	if spec.BasicAuthUsers != "" {
+		mw := router + "-auth"
+		labels["traefik.http.middlewares."+mw+".basicauth.users"] = spec.BasicAuthUsers
+		middlewares = append(middlewares, mw)
+	}
+	// Operator-defined middlewares: "middlewares.<name>.<rest>" becomes
+	// "<router>-<name>.<rest>", and every defined name joins the router's
+	// chain after builtins. Names sort for a deterministic chain order.
+	customMWs := map[string][]string{}
+	for k, v := range spec.TraefikLabels {
+		rest := strings.TrimPrefix(k, "middlewares.")
+		dot := strings.Index(rest, ".")
+		if dot <= 0 {
+			continue
+		}
+		customMWs[rest[:dot]] = append(customMWs[rest[:dot]], rest[dot+1:]+"="+v)
+	}
+	mwNames := make([]string, 0, len(customMWs))
+	for name := range customMWs {
+		mwNames = append(mwNames, name)
+	}
+	sort.Strings(mwNames)
+	for _, name := range mwNames {
+		mw := router + "-" + name
+		sort.Strings(customMWs[name])
+		for _, kv := range customMWs[name] {
+			if i := strings.Index(kv, "="); i > 0 {
+				labels["traefik.http.middlewares."+mw+"."+kv[:i]] = kv[i+1:]
+			}
+		}
+		middlewares = append(middlewares, mw)
+	}
+	if len(middlewares) > 0 {
+		labels["traefik.http.routers."+router+".middlewares"] = strings.Join(middlewares, ",")
+	}
+	return labels
+}
+
 // isPortConflict reports whether a container create failed because the
 // requested host port was already bound.
 func isPortConflict(err error) bool {

app/backend/internal/mcpserver/server.go

@@ -53,7 +53,7 @@ func init() {
 	// Services
 	register(spec{"containr_services_list", "List services in a project", "GET", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
 	register(spec{"containr_services_get", "Get a service by id", "GET", "/services/{id}", []string{"id"}, nil, false})
-	register(spec{"containr_services_create", "Create a service in a project. Args: name (required), type, image, git_repo, git_branch, environment, port, domain, replicas, volumes = [{type: volume|bind, source, target, read_only}], builder = auto|railpack|nixpacks|dockerfile|static, cpu, memory, cpu_reserve, memory_reserve, static_build_cmd, static_dir, node_id (agent id | 'auto' = least-loaded online node; image services only — remote nodes can't run git builds), spread (bool — distribute replicas across every online schedulable node; mutually exclusive with a node pin), placement_tags (string array — remote placement only onto nodes carrying every tag; re-resolved per reconcile, pin overrides).", "POST", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
+	register(spec{"containr_services_create", "Create a service in a project. Args: name (required), type, image, git_repo, git_branch, environment, port, domain, replicas, volumes = [{type: volume|bind, source, target, read_only}], builder = auto|railpack|nixpacks|dockerfile|static, cpu, memory, cpu_reserve, memory_reserve, static_build_cmd, static_dir, sleep_enabled (bool — scale to zero on idle), sleep_idle_minutes (1-1440, default 15), node_id (agent id | 'auto' = least-loaded online node; git services build on the node itself), spread (bool — distribute replicas across every online schedulable node; mutually exclusive with a node pin), placement_tags (string array — remote placement only onto nodes carrying every tag; re-resolved per reconcile, pin overrides), traefik_labels (object — extra Traefik middlewares for this service's router; keys 'middlewares.<name>.<type>[.<field>]', allowlist-validated; defined middlewares attach to the router automatically).", "POST", "/projects/{project_id}/services", []string{"project_id"}, nil, false})
 	register(spec{"containr_services_delete", "Delete a service. Requires confirm:true.", "DELETE", "/services/{id}", []string{"id"}, nil, true})
 	register(spec{"containr_services_start", "Start a service", "POST", "/services/{id}/start", []string{"id"}, nil, false})
 	register(spec{"containr_services_stop", "Stop a service", "POST", "/services/{id}/stop", []string{"id"}, nil, false})
@@ -66,7 +66,7 @@ func init() {
 	register(spec{"containr_services_move", "Move a service to another project the caller owns. Args: id, project_id (required).", "POST", "/services/{id}/move", []string{"id"}, []string{"project_id"}, false})
 	register(spec{"containr_services_logs", "Get service runtime logs. Args: id, tail (default 100).", "GET", "/services/{id}/logs", []string{"id"}, nil, false})
 	register(spec{"containr_services_exec", "Run a one-off command in the service container (30s ceiling). Args: id, command (required).", "POST", "/services/{id}/exec", []string{"id"}, []string{"command"}, false})
-	register(spec{"containr_services_update", "Update a service. Args: id, name, image, command, domain, restart_policy, healthcheck_path, cpu, memory, replicas, port, volumes = [{type: volume|bind, source, target, read_only}] — volumes replaces the whole mount list; pass [] to clear. maintenance_mode (bool), basic_auth = [{username, password}] — replaces all creds; [] clears. builder = auto|railpack|nixpacks|dockerfile|static, cpu_reserve, memory_reserve, static_build_cmd, static_dir (empty string clears reserves/static fields). sleep_enabled (bool) + sleep_idle_minutes (1-1440) enable scale-to-zero on idle; a wake placeholder answers traffic while the service resumes. node_id pins placement to a node agent ('auto' = least-loaded, 'local' = run on the Containr host). spread (bool) distributes replicas across every online schedulable node; mutually exclusive with a pin — clear node_id to 'local' first if pinned. placement_tags (string array; [] clears) restricts auto/spread placement to nodes carrying every tag; mutually exclusive with an explicit pin — clear the pin first.", "PUT", "/services/{id}", []string{"id"}, nil, false})
+	register(spec{"containr_services_update", "Update a service. Args: id, name, image, command, domain, restart_policy, healthcheck_path, cpu, memory, replicas, port, volumes = [{type: volume|bind, source, target, read_only}] — volumes replaces the whole mount list; pass [] to clear. maintenance_mode (bool), basic_auth = [{username, password}] — replaces all creds; [] clears. builder = auto|railpack|nixpacks|dockerfile|static, cpu_reserve, memory_reserve, static_build_cmd, static_dir (empty string clears reserves/static fields). sleep_enabled (bool) + sleep_idle_minutes (1-1440) enable scale-to-zero on idle; a wake placeholder answers traffic while the service resumes. node_id pins placement to a node agent ('auto' = least-loaded, 'local' = run on the Containr host). spread (bool) distributes replicas across every online schedulable node; mutually exclusive with a pin — clear node_id to 'local' first if pinned. placement_tags (string array; [] clears) restricts auto/spread placement to nodes carrying every tag; mutually exclusive with an explicit pin — clear the pin first. traefik_labels (object; {} clears) replaces the service's Traefik middleware overrides — keys 'middlewares.<name>.<type>[.<field>]', e.g. {'middlewares.rl.ratelimit.average': '100'}.", "PUT", "/services/{id}", []string{"id"}, nil, false})
 
 	// Domains
 	register(spec{"containr_domains_list", "List domains attached to a service", "GET", "/services/{id}/domains", []string{"id"}, nil, false})
@@ -133,6 +133,7 @@ func init() {
 	register(spec{"containr_templates_deploy", "Deploy a template into a project. Args: id (template), project_id.", "POST", "/templates/{id}/deploy", []string{"id"}, []string{"project_id"}, false})
 	register(spec{"containr_templates_plan", "Dry-resolve a template: expanded expressions, service refs, missing variables. Args: id, variables (object).", "POST", "/templates/{id}/plan", []string{"id"}, nil, false})
 	register(spec{"containr_templates_import_compose", "Convert docker-compose YAML into a v2 template graph config. Args: compose_yaml.", "POST", "/templates/import/compose", nil, []string{"compose_yaml"}, false})
+	register(spec{"containr_templates_import_git", "Fetch a compose file from a git repo (clone URL, ssh remote, or owner/repo via connected providers) and convert it into a v2 template graph config. Args: repo (required), path (default: compose.yaml/yml or docker-compose.yml/yaml), ref (branch or commit).", "POST", "/templates/import/git", nil, []string{"repo", "path", "ref"}, false})
 	register(spec{"containr_templates_deploy_graph", "Deploy an ad-hoc service graph without a stored template. Args: project_id, config ({services:[...]}), variables, plan, region.", "POST", "/templates/deploy", nil, []string{"project_id", "config", "variables", "plan", "region"}, false})
 	register(spec{"containr_projects_import_compose", "Deploy a docker-compose file straight into a project. Args: id (project), compose_yaml, variables, plan, region.", "POST", "/projects/{id}/import-compose", []string{"id"}, []string{"compose_yaml", "variables", "plan", "region"}, false})
 

app/backend/migrations_goose/20261113000000_service_traefik_labels.sql

@@ -0,0 +1,9 @@
+-- +goose Up
+-- Routing overrides: per-service Traefik middleware definitions stored as
+-- { "middlewares.<name>.<type>.<field>": "value" }. Validated against an
+-- allowlist; applied to the service's router and auto-attached to its
+-- middleware chain at reconcile time.
+ALTER TABLE services ADD COLUMN IF NOT EXISTS traefik_labels jsonb NOT NULL DEFAULT '{}';
+
+-- +goose Down
+ALTER TABLE services DROP COLUMN IF EXISTS traefik_labels;

app/backend/sqlc/schema.sql

@@ -69,7 +69,8 @@ CREATE TABLE services (
     static_dir VARCHAR(255) NOT NULL DEFAULT '',
     node_id VARCHAR(255),
     spread BOOLEAN NOT NULL DEFAULT false,
-    placement_tags JSONB NOT NULL DEFAULT '[]'
+    placement_tags JSONB NOT NULL DEFAULT '[]',
+    traefik_labels JSONB NOT NULL DEFAULT '{}'
 );
 
 CREATE TABLE registries (

app/frontend/Dockerfile

@@ -1,5 +1,7 @@
 # Build stage
-FROM node:22-alpine AS builder
+ARG NODE_IMAGE=node:22-alpine
+ARG NGINX_IMAGE=nginx:alpine
+FROM ${NODE_IMAGE} AS builder
 
 # Set working directory
 WORKDIR /app
@@ -24,7 +26,7 @@ ENV VITE_AUTH_URL=${VITE_AUTH_URL}
 RUN npm run build
 
 # Production stage
-FROM nginx:alpine
+FROM ${NGINX_IMAGE}
 
 # Copy custom nginx config
 COPY nginx.conf /etc/nginx/nginx.conf

app/frontend/src/features/service/pages/ServiceDetailPage.tsx

@@ -485,7 +485,7 @@ export function ServiceDetailPage() {
   const [volumesForm, setVolumesForm] = useState<ServiceVolume[] | null>(null);
   const [domainInput, setDomainInput] = useState('');
   const [domainChecks, setDomainChecks] = useState<Record<string, DomainCheckResult> | null>(null);
-  const [accessForm, setAccessForm] = useState<{ maintenance: boolean; basicAuth: string } | null>(null);
+  const [accessForm, setAccessForm] = useState<{ maintenance: boolean; basicAuth: string; traefikLabels: string } | null>(null);
   const [sleepDraft, setSleepDraft] = useState<{ id: string; enabled: boolean; minutes: string } | null>(null);
   const [nodeDraft, setNodeDraft] = useState<string | null>(null);
   const nodesQuery = useQuery({
@@ -2490,7 +2490,13 @@ export function ServiceDetailPage() {
                     <button
                       type="button"
                       onClick={() =>
-                        setAccessForm({ maintenance: Boolean(service.maintenanceMode), basicAuth: '' })
+                        setAccessForm({
+                          maintenance: Boolean(service.maintenanceMode),
+                          basicAuth: '',
+                          traefikLabels: Object.entries(service.traefikLabels ?? {})
+                            .map(([k, v]) => `${k}=${v}`)
+                            .join('\n'),
+                        })
                       }
                       className="px-3 py-1.5 rounded-[var(--radius-md)] border border-[var(--border-subtle)] text-xs font-medium hover:border-[var(--border-default)] transition-colors"
                     >
@@ -2511,6 +2517,14 @@ export function ServiceDetailPage() {
                         {(service.basicAuth ?? []).length > 0 ? (service.basicAuth ?? []).join(', ') : 'off'}
                       </p>
                     </div>
+                    <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-3">
+                      <p className="text-[var(--text-tertiary)] uppercase tracking-wide">Routing overrides</p>
+                      <p className="mt-1 text-sm font-medium text-[var(--text-primary)]">
+                        {Object.keys(service.traefikLabels ?? {}).length > 0
+                          ? `${Object.keys(service.traefikLabels ?? {}).length} label(s)`
+                          : 'off'}
+                      </p>
+                    </div>
                   </div>
                 ) : (
                   <div className="rounded-[var(--radius-md)] border border-[var(--border-subtle)] p-4 space-y-4">
@@ -2532,6 +2546,16 @@ export function ServiceDetailPage() {
                         className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm mono text-[var(--text-primary)]"
                       />
                     </div>
+                    <div>
+                      <label className="block text-xs text-[var(--text-tertiary)] mb-1">Routing overrides — Traefik middleware labels, key=value per line; empty clears</label>
+                      <textarea
+                        value={accessForm.traefikLabels}
+                        onChange={(e) => setAccessForm({ ...accessForm, traefikLabels: e.target.value })}
+                        rows={3}
+                        placeholder={"middlewares.rl.ratelimit.average=100\nmiddlewares.sec.headers.customresponseheaders.X-Frame-Options=DENY"}
+                        className="w-full px-3 py-2 rounded-[var(--radius-md)] bg-[var(--surface-muted)] border border-[var(--border-subtle)] text-sm mono text-[var(--text-primary)]"
+                      />
+                    </div>
                     <div className="flex items-center gap-2">
                       <button
                         type="button"
@@ -2546,8 +2570,17 @@ export function ServiceDetailPage() {
                               return i > 0 ? { username: l.slice(0, i), password: l.slice(i + 1) } : null;
                             })
                             .filter((x): x is { username: string; password: string } => x !== null);
+                          const labels: Record<string, string> = {};
+                          accessForm.traefikLabels
+                            .split('\n')
+                            .map((l) => l.trim())
+                            .filter(Boolean)
+                            .forEach((l) => {
+                              const i = l.indexOf('=');
+                              if (i > 0) labels[l.slice(0, i).trim()] = l.slice(i + 1).trim();
+                            });
                           updateServiceMutation.mutate(
-                            { maintenance_mode: accessForm.maintenance, basic_auth: creds },
+                            { maintenance_mode: accessForm.maintenance, basic_auth: creds, traefik_labels: labels },
                             { onSuccess: () => setAccessForm(null) },
                           );
                         }}

app/frontend/src/features/templates/pages/TemplatesPage.tsx

@@ -8,6 +8,7 @@ import {
   getCurrentUserProfile,
   getTemplateById,
   importComposeTemplate,
+  importGitComposeTemplate,
   listProjects,
   listTemplates,
   updateTemplate,
@@ -154,6 +155,10 @@ export function TemplatesPage() {
   const [composeYaml, setComposeYaml] = useState('');
   const [composeWarnings, setComposeWarnings] = useState<string[]>([]);
   const [composeError, setComposeError] = useState<string | null>(null);
+  const [composeMode, setComposeMode] = useState<'paste' | 'git'>('paste');
+  const [gitRepo, setGitRepo] = useState('');
+  const [gitPath, setGitPath] = useState('');
+  const [gitRef, setGitRef] = useState('');
 
   const [lastDeployment, setLastDeployment] = useState<{
     projectId: string;
@@ -364,7 +369,10 @@ export function TemplatesPage() {
   });
 
   const composeImportMutation = useMutation({
-    mutationFn: (yaml: string) => importComposeTemplate(yaml),
+    mutationFn: () =>
+      composeMode === 'git'
+        ? importGitComposeTemplate(gitRepo.trim(), gitPath.trim(), gitRef.trim())
+        : importComposeTemplate(composeYaml),
     onSuccess: (result) => {
       setComposeWarnings(result.warnings);
       setComposeError(null);
@@ -1107,7 +1115,7 @@ export function TemplatesPage() {
               <div>
                 <h2 className="text-[15px] font-semibold text-[var(--text-primary)]">Import docker-compose</h2>
                 <p className="text-xs text-[var(--text-tertiary)]">
-                  Paste a compose file — known database images become managed databases, everything else becomes services.
+                  Paste a compose file or pull one from a git repo — known database images become managed databases.
                 </p>
               </div>
               <button
@@ -1118,13 +1126,67 @@ export function TemplatesPage() {
                 <X size={15} />
               </button>
             </div>
-            <textarea
-              value={composeYaml}
-              onChange={(e) => setComposeYaml(e.target.value)}
-              spellCheck={false}
-              placeholder={'services:\n  db:\n    image: postgres:16\n  web:\n    image: myapp:latest\n    depends_on: [db]'}
-              className="mono min-h-[320px] flex-1 resize-none bg-[var(--bg-void)] p-4 text-[12.5px] leading-relaxed text-[var(--text-secondary)] outline-none"
-            />
+            <div className="flex gap-1 border-b border-[var(--border-subtle)] px-5 pt-3">
+              {(['paste', 'git'] as const).map((m) => (
+                <button
+                  key={m}
+                  type="button"
+                  onClick={() => setComposeMode(m)}
+                  className={`rounded-t-[var(--radius-md)] px-3 py-1.5 text-xs font-medium ${
+                    composeMode === m
+                      ? 'bg-[var(--surface-muted)] text-[var(--text-primary)]'
+                      : 'text-[var(--text-tertiary)] hover:text-[var(--text-secondary)]'
+                  }`}
+                >
+                  {m === 'paste' ? 'Paste YAML' : 'From git repo'}
+                </button>
+              ))}
+            </div>
+            {composeMode === 'paste' ? (
+              <textarea
+                value={composeYaml}
+                onChange={(e) => setComposeYaml(e.target.value)}
+                spellCheck={false}
+                placeholder={'services:\n  db:\n    image: postgres:16\n  web:\n    image: myapp:latest\n    depends_on: [db]'}
+                className="mono min-h-[320px] flex-1 resize-none bg-[var(--bg-void)] p-4 text-[12.5px] leading-relaxed text-[var(--text-secondary)] outline-none"
+              />
+            ) : (
+              <div className="flex min-h-[320px] flex-1 flex-col gap-3 bg-[var(--bg-void)] p-4">
+                <label className="text-xs text-[var(--text-tertiary)]">
+                  Repository
+                  <input
+                    value={gitRepo}
+                    onChange={(e) => setGitRepo(e.target.value)}
+                    spellCheck={false}
+                    placeholder="owner/repo or https://github.com/owner/repo.git"
+                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
+                  />
+                </label>
+                <label className="text-xs text-[var(--text-tertiary)]">
+                  Compose file path <span className="opacity-60">(optional — compose.yaml / docker-compose.yml searched)</span>
+                  <input
+                    value={gitPath}
+                    onChange={(e) => setGitPath(e.target.value)}
+                    spellCheck={false}
+                    placeholder="deploy/compose.yml"
+                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
+                  />
+                </label>
+                <label className="text-xs text-[var(--text-tertiary)]">
+                  Branch or commit <span className="opacity-60">(optional)</span>
+                  <input
+                    value={gitRef}
+                    onChange={(e) => setGitRef(e.target.value)}
+                    spellCheck={false}
+                    placeholder="main"
+                    className="mono mt-1 w-full rounded-[var(--radius-md)] border border-[var(--border-subtle)] bg-[var(--bg-base)] px-3 py-2 text-[12.5px] text-[var(--text-secondary)] outline-none focus:border-[var(--accent-primary)]"
+                  />
+                </label>
+                <p className="text-[11px] text-[var(--text-tertiary)]">
+                  Private repos use your connected git providers for credentials.
+                </p>
+              </div>
+            )}
             {composeError ? (
               <div className="border-t border-[var(--border-subtle)] bg-[var(--error-soft)] px-5 py-2.5 text-xs text-[var(--error)]">
                 {composeError}
@@ -1140,8 +1202,8 @@ export function TemplatesPage() {
               </button>
               <button
                 type="button"
-                onClick={() => composeImportMutation.mutate(composeYaml)}
-                disabled={!composeYaml.trim() || composeImportMutation.isPending}
+                onClick={() => composeImportMutation.mutate()}
+                disabled={(composeMode === 'paste' ? !composeYaml.trim() : !gitRepo.trim()) || composeImportMutation.isPending}
                 className="inline-flex items-center gap-1.5 rounded-[var(--radius-md)] bg-[var(--accent-primary)] px-4 py-2 text-xs font-semibold text-[var(--accent-on)] disabled:opacity-50"
               >
                 {composeImportMutation.isPending ? <Loader2 size={13} className="animate-spin" /> : <FileCode size={13} />}

app/frontend/src/generated/api-types.ts

@@ -3243,6 +3243,80 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/templates/import/git": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Import a compose file from a git repository
+         * @description Fetches a compose file out of a git repository and runs it through
+         *     the same conversion as POST /templates/import/compose. `repo`
+         *     accepts a clone URL, ssh remote, or `owner/repo` shorthand —
+         *     connected git providers (including GitHub App installs) supply
+         *     credentials, so private repositories work. `path` defaults to
+         *     `compose.yaml`, `compose.yml`, `docker-compose.yml`, then
+         *     `docker-compose.yaml`; `ref` selects a branch or commit SHA.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        /** @description Clone URL, ssh remote, or owner/repo shorthand */
+                        repo: string;
+                        /** @description Repo-relative compose file path (searched by convention when empty) */
+                        path?: string;
+                        /** @description Branch name or 40-char commit SHA */
+                        ref?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Converted config */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            config?: components["schemas"]["TemplateConfig"];
+                            variables?: Record<string, never>[];
+                            warnings?: string[];
+                        };
+                    };
+                };
+                /** @description Invalid repo reference, compose file missing, or conversion error */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Git fetch failed */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/templates/deploy": {
         parameters: {
             query?: never;
@@ -10939,7 +11013,7 @@ export interface components {
             sleep_enabled?: boolean;
             /** @description Idle timeout in minutes before sleeping (1-1440, default 15) */
             sleep_idle_minutes?: number;
-            /** @description Node agent id this service is pinned to; empty/null = local Docker host. 'auto' on create/update resolves to the least-loaded online agent. Remote nodes run registry-pulled images only (no git builds, no Traefik domains). */
+            /** @description Node agent id this service is pinned to; empty/null = local Docker host. 'auto' on create/update resolves to the least-loaded online agent. Git-sourced services build on the node itself (build context ships as an agent-token artifact); rollbacks of locally-built tags ship the image via docker save/load. */
             node_id?: string;
             /** @description Display name of the pinned node agent (read-only) */
             node_name?: string;
@@ -10947,6 +11021,10 @@ export interface components {
             spread?: boolean;
             /** @description Node tags required for remote placement — auto/spread only consider agents carrying every tag; re-resolved each reconcile. Mutually exclusive with an explicit node_id pin (read-only on responses when a pin is set). */
             placement_tags?: string[];
+            /** @description Extra Traefik middlewares defined for this service's router — keys 'middlewares.<name>.<type>[.<field>]' (e.g. 'middlewares.rl.ratelimit.average'), allowlist-validated; each defined middleware attaches to the router after builtins */
+            traefik_labels?: {
+                [key: string]: string;
+            };
             /** @description Computed public URL (published port or domain) */
             public_url?: string;
             /**
@@ -11023,6 +11101,10 @@ export interface components {
             spread?: boolean;
             /** @description Restrict remote placement to agents carrying every listed tag; mutually exclusive with an explicit pin or 'local' */
             placement_tags?: string[];
+            /** @description Extra Traefik middlewares on the service router — keys 'middlewares.<name>.<type>[.<field>]'; allowlist-validated */
+            traefik_labels?: {
+                [key: string]: string;
+            };
         };
         UpdateServiceRequest: {
             /** @description Service name */
@@ -11090,6 +11172,10 @@ export interface components {
             spread?: boolean;
             /** @description Restrict remote placement to agents carrying every listed tag; [] clears. Mutually exclusive with a pin or 'local' — clear the pin first */
             placement_tags?: string[];
+            /** @description Replace the service's Traefik middleware overrides — keys 'middlewares.<name>.<type>[.<field>]'; {} clears */
+            traefik_labels?: {
+                [key: string]: string;
+            };
         };
         ServiceDomain: {
             /** Format: uuid */

app/frontend/src/lib/api-client.ts

@@ -88,6 +88,7 @@ export type ServiceEntity = {
   nodeName?: string;
   spread?: boolean;
   placementTags?: string[];
+  traefikLabels?: Record<string, string>;
   publicUrl?: string;
 };
 
@@ -702,6 +703,7 @@ function normalizeService(service: RawService): ServiceEntity | null {
     nodeName: service.node_name,
     spread: service.spread,
     placementTags: service.placement_tags,
+    traefikLabels: service.traefik_labels,
     publicUrl: service.public_url,
   };
 }
@@ -1924,6 +1926,21 @@ export async function importComposeTemplate(composeYaml: string): Promise<Compos
   return { config: payload.config, warnings: payload.warnings ?? [] };
 }
 
+export async function importGitComposeTemplate(
+  repo: string,
+  path: string,
+  ref: string,
+): Promise<ComposeImportResult> {
+  const payload = await requestJson<{ config?: Record<string, unknown>; warnings?: string[] }>(
+    '/templates/import/git',
+    { method: 'POST', body: JSON.stringify({ repo, path: path || undefined, ref: ref || undefined }) },
+  );
+  if (!payload.config || typeof payload.config !== 'object') {
+    throw new ApiError('Git import response is invalid', 500);
+  }
+  return { config: payload.config, warnings: payload.warnings ?? [] };
+}
+
 export type ProjectComposeImportResult = {
   created: Array<{ key: string; kind: string; id: string; name: string; deployment_id?: string }>;
   warnings: string[];

app/mobile/src/api.ts

@@ -68,6 +68,36 @@ export interface Template {
   icon?: string;
 }
 
+export interface Variable {
+  id?: string;
+  key: string;
+  value: string;
+  is_secret: boolean;
+}
+
+export interface ServiceDomain {
+  id: string;
+  domain: string;
+  is_default: boolean;
+  cert_type?: string;
+  cert_status?: string;
+}
+
+export interface AppNotification {
+  id: string;
+  kind: string;
+  title: string;
+  body?: string;
+  resource_type?: string;
+  resource_id?: string;
+  read_at?: string | null;
+  created_at?: string;
+}
+
+// Masked value the API returns for secret variables; echoing it back on
+// update preserves the stored ciphertext.
+export const MASKED_SECRET = '********';
+
 export class ApiError extends Error {
   constructor(
     public status: number,
@@ -145,6 +175,69 @@ export class Api {
     return this.req<EnvCheck>('GET', `/services/${id}/env-check`);
   }
 
+  serviceVariables(id: string) {
+    return this.req<{ variables: Variable[] }>('GET', `/services/${id}/variables`).then(
+      (r) => r.variables ?? [],
+    );
+  }
+
+  updateVariables(id: string, variables: { key: string; value: string; is_secret: boolean }[]) {
+    return this.req<unknown>('PUT', `/services/${id}/variables`, { variables });
+  }
+
+  serviceDomains(id: string) {
+    return this.req<{ domains: ServiceDomain[] }>('GET', `/services/${id}/domains`).then(
+      (r) => r.domains ?? [],
+    );
+  }
+
+  addDomain(id: string, domain: string) {
+    return this.req<unknown>('POST', `/services/${id}/domains`, { domain });
+  }
+
+  deleteDomain(id: string, domainId: string) {
+    return this.req<unknown>('DELETE', `/services/${id}/domains/${domainId}`);
+  }
+
+  setDefaultDomain(id: string, domainId: string) {
+    return this.req<unknown>('POST', `/services/${id}/domains/${domainId}/default`);
+  }
+
+  updateService(
+    id: string,
+    patch: Partial<{
+      name: string;
+      command: string;
+      replicas: number;
+      port: number;
+      domain: string;
+      restart_policy: string;
+      healthcheck_path: string;
+      cpu: string;
+      memory: string;
+      sleep_enabled: boolean;
+      sleep_idle_minutes: number;
+      maintenance_mode: boolean;
+    }>,
+  ) {
+    return this.req<unknown>('PUT', `/services/${id}`, patch);
+  }
+
+  notifications() {
+    return this.req<{ notifications: AppNotification[]; unread: number }>(
+      'GET',
+      '/notifications?limit=50',
+    );
+  }
+
+  markNotificationRead(id: string) {
+    return this.req<unknown>('POST', `/notifications/${id}/read`);
+  }
+
+  markAllNotificationsRead() {
+    return this.req<unknown>('POST', '/notifications/read-all');
+  }
+
   serviceDeployments(id: string) {
     return this.req<{ deployments: Deployment[] }>(
       'GET',

app/mobile/src/app/(tabs)/_layout.tsx

@@ -1,9 +1,19 @@
 import React from 'react';
 import { Tabs } from 'expo-router';
 import { Ionicons } from '@expo/vector-icons';
+import { useQuery } from '@tanstack/react-query';
+import { useApi } from '../../session';
 import { colors } from '../../theme';
 
 export default function TabsLayout() {
+  const api = useApi();
+  const notifs = useQuery({
+    queryKey: ['notifications'],
+    queryFn: () => api.notifications(),
+    refetchInterval: 60_000,
+  });
+  const unread = notifs.data?.unread ?? 0;
+
   return (
     <Tabs
       screenOptions={{
@@ -41,6 +51,16 @@ export default function TabsLayout() {
           ),
         }}
       />
+      <Tabs.Screen
+        name="notifications"
+        options={{
+          title: 'Alerts',
+          tabBarBadge: unread > 0 ? unread : undefined,
+          tabBarIcon: ({ color, size }) => (
+            <Ionicons name="notifications-outline" size={size} color={color} />
+          ),
+        }}
+      />
       <Tabs.Screen
         name="settings"
         options={{

app/mobile/src/app/(tabs)/notifications.tsx

@@ -0,0 +1,107 @@
+import React from 'react';
+import { FlatList, RefreshControl, StyleSheet, Text, View } from 'react-native';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useApi } from '../../session';
+import { colors } from '../../theme';
+import { relTime } from '../../time';
+import { ActionButton, Card, Empty, ErrorBox, Loading } from '../../components';
+
+const KIND_COLOR: Record<string, string> = {
+  deployment_failed: colors.err,
+  deployment: colors.accent,
+  alert: colors.warn,
+  scale: colors.info,
+};
+
+export default function Notifications() {
+  const api = useApi();
+  const qc = useQueryClient();
+
+  const notifs = useQuery({
+    queryKey: ['notifications'],
+    queryFn: () => api.notifications(),
+    refetchInterval: 30_000,
+  });
+
+  const markAll = useMutation({
+    mutationFn: () => api.markAllNotificationsRead(),
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['notifications'] }),
+  });
+  const markRead = useMutation({
+    mutationFn: (id: string) => api.markNotificationRead(id),
+    onSuccess: () => qc.invalidateQueries({ queryKey: ['notifications'] }),
+  });
+
+  if (notifs.isLoading) return <Loading />;
+  if (notifs.error) return <ErrorBox error={notifs.error} />;
+
+  const items = notifs.data?.notifications ?? [];
+  const unread = notifs.data?.unread ?? 0;
+
+  return (
+    <FlatList
+      style={styles.root}
+      contentContainerStyle={{ padding: 16 }}
+      refreshControl={
+        <RefreshControl
+          refreshing={notifs.isRefetching}
+          onRefresh={() => notifs.refetch()}
+          tintColor={colors.accent}
+        />
+      }
+      ListHeaderComponent={
+        unread > 0 ? (
+          <ActionButton
+            label={`Mark all read (${unread})`}
+            disabled={markAll.isPending}
+            onPress={() => markAll.mutate()}
+          />
+        ) : null
+      }
+      ListEmptyComponent={<Empty text="No notifications" />}
+      data={items}
+      keyExtractor={(n) => n.id}
+      renderItem={({ item }) => {
+        const isUnread = !item.read_at;
+        const dot = KIND_COLOR[item.kind] ?? colors.accent;
+        return (
+          <Card
+            style={isUnread ? { borderColor: colors.accent } : undefined}
+          >
+            <View style={styles.row}>
+              <View style={[styles.dot, { backgroundColor: isUnread ? dot : colors.border }]} />
+              <View style={{ flex: 1 }}>
+                <Text style={[styles.title, !isUnread && { color: colors.textDim }]}>
+                  {item.title}
+                </Text>
+                {item.body ? <Text style={styles.body}>{item.body}</Text> : null}
+                <Text style={styles.meta}>
+                  {item.kind}
+                  {item.created_at ? ` · ${relTime(item.created_at)}` : ''}
+                </Text>
+              </View>
+              {isUnread ? (
+                <Text
+                  style={styles.markRead}
+                  onPress={() => markRead.mutate(item.id)}
+                >
+                  Mark read
+                </Text>
+              ) : null}
+            </View>
+          </Card>
+        );
+      }}
+    />
+  );
+}
+
+const styles = StyleSheet.create({
+  root: { flex: 1, backgroundColor: colors.bg },
+  row: { flexDirection: 'row', alignItems: 'flex-start' },
+  dot: { width: 8, height: 8, borderRadius: 4, marginTop: 5, marginRight: 10 },
+  title: { color: colors.text, fontSize: 15, fontWeight: '600' },
+  body: { color: colors.textDim, fontSize: 13, marginTop: 4, lineHeight: 18 },
+  meta: { color: colors.textDim, fontSize: 11, marginTop: 6 },
+  markRead: { color: colors.accent, fontSize: 12, fontWeight: '600', marginLeft: 8 },
+});

app/mobile/src/app/_layout.tsx

@@ -37,6 +37,9 @@ function AuthGate() {
         <Stack.Screen name="project/[id]" options={{ title: 'Project' }} />
         <Stack.Screen name="service/[id]" options={{ title: 'Service' }} />
         <Stack.Screen name="service/logs" options={{ title: 'Logs' }} />
+        <Stack.Screen name="service/variables" options={{ title: 'Variables' }} />
+        <Stack.Screen name="service/domains" options={{ title: 'Domains' }} />
+        <Stack.Screen name="service/settings" options={{ title: 'Service settings' }} />
       </Stack.Protected>
       <Stack.Screen name="login" options={{ headerShown: false }} />
     </Stack>

app/mobile/src/app/service/[id].tsx

@@ -11,6 +11,7 @@ import {
   Empty,
   ErrorBox,
   Loading,
+  Row,
   SectionTitle,
   StatusBadge,
 } from '../../components';
@@ -142,6 +143,28 @@ export default function ServiceDetail() {
         />
       </View>
 
+      <SectionTitle>Manage</SectionTitle>
+      <Card>
+        <Row
+          title="Variables"
+          subtitle="Environment and secrets"
+          onPress={() =>
+            router.push(`/service/variables?id=${s.id}&name=${encodeURIComponent(s.name)}`)
+          }
+        />
+        <Row
+          title="Domains"
+          subtitle={s.domain ?? 'Hostnames routed to this service'}
+          onPress={() => router.push(`/service/domains?id=${s.id}`)}
+        />
+        <Row
+          title="Scale & sleep"
+          subtitle={`${s.replicas ?? 1} replica${(s.replicas ?? 1) === 1 ? '' : 's'}` +
+            (s.sleep_enabled ? ` · sleeps after ${s.sleep_idle_minutes}m idle` : '')}
+          onPress={() => router.push(`/service/settings?id=${s.id}`)}
+        />
+      </Card>
+
       {s.sleep_enabled ? (
         <Text style={styles.hint}>
           Sleep enabled — scales to zero after {s.sleep_idle_minutes}m idle, wakes on traffic.

app/mobile/src/app/service/domains.tsx

@@ -0,0 +1,151 @@
+import React, { useState } from 'react';
+import {
+  Alert,
+  ScrollView,
+  StyleSheet,
+  Text,
+  TextInput,
+  TouchableOpacity,
+  View,
+} from 'react-native';
+import { Ionicons } from '@expo/vector-icons';
+import { useLocalSearchParams } from 'expo-router';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useApi } from '../../session';
+import { colors } from '../../theme';
+import { ActionButton, Card, Empty, ErrorBox, Loading } from '../../components';
+
+export default function ServiceDomains() {
+  const { id } = useLocalSearchParams<{ id: string }>();
+  const api = useApi();
+  const qc = useQueryClient();
+  const [newDomain, setNewDomain] = useState('');
+
+  const domains = useQuery({
+    queryKey: ['domains', id],
+    queryFn: () => api.serviceDomains(id!),
+    enabled: !!id,
+  });
+
+  const invalidate = () => {
+    qc.invalidateQueries({ queryKey: ['domains', id] });
+    qc.invalidateQueries({ queryKey: ['service', id] });
+  };
+  const onErr = (e: unknown) =>
+    Alert.alert('Failed', e instanceof Error ? e.message : String(e));
+
+  const add = useMutation({
+    mutationFn: (d: string) => api.addDomain(id!, d),
+    onSuccess: () => {
+      setNewDomain('');
+      invalidate();
+    },
+    onError: onErr,
+  });
+  const del = useMutation({
+    mutationFn: (domainId: string) => api.deleteDomain(id!, domainId),
+    onSuccess: invalidate,
+    onError: onErr,
+  });
+  const makeDefault = useMutation({
+    mutationFn: (domainId: string) => api.setDefaultDomain(id!, domainId),
+    onSuccess: invalidate,
+    onError: onErr,
+  });
+
+  if (domains.isLoading) return <Loading />;
+  if (domains.error) return <ErrorBox error={domains.error} />;
+
+  const submit = () => {
+    const d = newDomain.trim().toLowerCase();
+    if (d) add.mutate(d);
+  };
+
+  return (
+    <ScrollView style={styles.root} contentContainerStyle={{ padding: 16 }}>
+      <Text style={styles.hint}>
+        Hostnames routed to this service. The default domain is the one shown on cards and used
+        for generated links.
+      </Text>
+
+      {domains.data?.length === 0 ? <Empty text="No domains configured" /> : null}
+      {(domains.data ?? []).map((d) => (
+        <Card key={d.id}>
+          <View style={styles.row}>
+            <View style={{ flex: 1 }}>
+              <Text style={styles.domain}>{d.domain}</Text>
+              <Text style={styles.meta}>
+                {d.is_default ? 'default · ' : ''}
+                {d.cert_status ? `tls: ${d.cert_status}` : 'tls pending'}
+              </Text>
+            </View>
+            {!d.is_default ? (
+              <TouchableOpacity
+                onPress={() => makeDefault.mutate(d.id)}
+                hitSlop={8}
+                style={styles.iconBtn}
+              >
+                <Ionicons name="star-outline" size={20} color={colors.accent} />
+              </TouchableOpacity>
+            ) : (
+              <Ionicons name="star" size={20} color={colors.warn} style={styles.iconBtn} />
+            )}
+            <TouchableOpacity
+              onPress={() =>
+                Alert.alert('Remove domain', `Detach ${d.domain} from this service?`, [
+                  { text: 'Cancel', style: 'cancel' },
+                  { text: 'Remove', style: 'destructive', onPress: () => del.mutate(d.id) },
+                ])
+              }
+              hitSlop={8}
+              style={styles.iconBtn}
+            >
+              <Ionicons name="trash-outline" size={18} color={colors.err} />
+            </TouchableOpacity>
+          </View>
+        </Card>
+      ))}
+
+      <View style={styles.addRow}>
+        <TextInput
+          style={styles.input}
+          value={newDomain}
+          onChangeText={setNewDomain}
+          placeholder="app.example.com"
+          placeholderTextColor={colors.textDim}
+          autoCapitalize="none"
+          autoCorrect={false}
+          keyboardType="url"
+          onSubmitEditing={submit}
+        />
+        <ActionButton
+          label={add.isPending ? '…' : 'Add'}
+          kind="primary"
+          disabled={add.isPending || newDomain.trim() === ''}
+          onPress={submit}
+        />
+      </View>
+    </ScrollView>
+  );
+}
+
+const styles = StyleSheet.create({
+  root: { flex: 1, backgroundColor: colors.bg },
+  hint: { color: colors.textDim, fontSize: 12, marginBottom: 12, lineHeight: 17 },
+  row: { flexDirection: 'row', alignItems: 'center' },
+  domain: { color: colors.text, fontSize: 15, fontWeight: '600' },
+  meta: { color: colors.textDim, fontSize: 12, marginTop: 3 },
+  iconBtn: { padding: 6, marginLeft: 10 },
+  addRow: { flexDirection: 'row', alignItems: 'center', marginTop: 8 },
+  input: {
+    flex: 1,
+    color: colors.text,
+    backgroundColor: colors.surface,
+    borderWidth: 1,
+    borderColor: colors.border,
+    borderRadius: 10,
+    padding: 12,
+    marginRight: 8,
+    fontSize: 14,
+  },
+});

app/mobile/src/app/service/settings.tsx

@@ -0,0 +1,174 @@
+import React, { useState } from 'react';
+import {
+  Alert,
+  ScrollView,
+  StyleSheet,
+  Switch,
+  Text,
+  TextInput,
+  TouchableOpacity,
+  View,
+} from 'react-native';
+import { useLocalSearchParams } from 'expo-router';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useApi } from '../../session';
+import { Service } from '../../api';
+import { colors } from '../../theme';
+import { ActionButton, Card, ErrorBox, Loading, SectionTitle } from '../../components';
+
+export default function ServiceSettings() {
+  const { id } = useLocalSearchParams<{ id: string }>();
+  const api = useApi();
+
+  const service = useQuery({
+    queryKey: ['service', id],
+    queryFn: () => api.service(id!),
+    enabled: !!id,
+  });
+
+  if (service.isLoading) return <Loading />;
+  if (service.error || !service.data) {
+    return <ErrorBox error={service.error ?? new Error('Not found')} />;
+  }
+
+  // Form mounts once data exists; its state initializes from the fetch.
+  return <Form serviceId={id!} initial={service.data} />;
+}
+
+function Form({ serviceId, initial }: { serviceId: string; initial: Service }) {
+  const api = useApi();
+  const qc = useQueryClient();
+  const [replicas, setReplicas] = useState(initial.replicas ?? 1);
+  const [port, setPort] = useState(String(initial.port ?? 0));
+  const [sleepEnabled, setSleepEnabled] = useState(!!initial.sleep_enabled);
+  const [sleepMinutes, setSleepMinutes] = useState(
+    String(initial.sleep_idle_minutes || 30),
+  );
+
+  const save = useMutation({
+    mutationFn: () =>
+      api.updateService(serviceId, {
+        replicas,
+        port: parseInt(port, 10) || 0,
+        sleep_enabled: sleepEnabled,
+        sleep_idle_minutes: Math.min(1440, Math.max(1, parseInt(sleepMinutes, 10) || 30)),
+      }),
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['service', serviceId] });
+      qc.invalidateQueries({ queryKey: ['services'] });
+      Alert.alert('Saved', 'Changes apply on the next deploy.');
+    },
+    onError: (e) => Alert.alert('Save failed', e instanceof Error ? e.message : String(e)),
+  });
+
+  const clampReplicas = (n: number) => Math.min(16, Math.max(0, n));
+
+  return (
+    <ScrollView style={styles.root} contentContainerStyle={{ padding: 16 }}>
+      <SectionTitle>Scaling</SectionTitle>
+      <Card>
+        <View style={styles.stepRow}>
+          <View style={{ flex: 1 }}>
+            <Text style={styles.label}>Replicas</Text>
+            <Text style={styles.sub}>Containers run per deploy; 0 parks the service.</Text>
+          </View>
+          <TouchableOpacity
+            style={styles.stepBtn}
+            onPress={() => setReplicas((r) => clampReplicas(r - 1))}
+            disabled={replicas <= 0}
+          >
+            <Text style={styles.stepText}>−</Text>
+          </TouchableOpacity>
+          <Text style={styles.stepValue}>{replicas}</Text>
+          <TouchableOpacity
+            style={styles.stepBtn}
+            onPress={() => setReplicas((r) => clampReplicas(r + 1))}
+            disabled={replicas >= 16}
+          >
+            <Text style={styles.stepText}>+</Text>
+          </TouchableOpacity>
+        </View>
+        <View style={styles.field}>
+          <Text style={styles.label}>Container port</Text>
+          <TextInput
+            style={styles.input}
+            value={port}
+            onChangeText={setPort}
+            keyboardType="number-pad"
+            placeholder="0 = none"
+            placeholderTextColor={colors.textDim}
+          />
+        </View>
+      </Card>
+
+      <SectionTitle>Scale to zero</SectionTitle>
+      <Card>
+        <View style={styles.switchRow}>
+          <View style={{ flex: 1 }}>
+            <Text style={styles.label}>Sleep when idle</Text>
+            <Text style={styles.sub}>Scales to zero after idle; incoming traffic wakes it.</Text>
+          </View>
+          <Switch
+            value={sleepEnabled}
+            onValueChange={setSleepEnabled}
+            trackColor={{ false: colors.border, true: colors.accentDim }}
+            thumbColor={sleepEnabled ? colors.accent : colors.textDim}
+          />
+        </View>
+        {sleepEnabled ? (
+          <View style={styles.field}>
+            <Text style={styles.label}>Idle minutes before sleep (1–1440)</Text>
+            <TextInput
+              style={styles.input}
+              value={sleepMinutes}
+              onChangeText={setSleepMinutes}
+              keyboardType="number-pad"
+              placeholder="30"
+              placeholderTextColor={colors.textDim}
+            />
+          </View>
+        ) : null}
+      </Card>
+
+      <ActionButton
+        label={save.isPending ? 'Saving…' : 'Save settings'}
+        kind="primary"
+        disabled={save.isPending}
+        onPress={() => save.mutate()}
+      />
+    </ScrollView>
+  );
+}
+
+const styles = StyleSheet.create({
+  root: { flex: 1, backgroundColor: colors.bg },
+  label: { color: colors.text, fontSize: 15, fontWeight: '600' },
+  sub: { color: colors.textDim, fontSize: 12, marginTop: 2 },
+  stepRow: { flexDirection: 'row', alignItems: 'center' },
+  stepBtn: {
+    width: 38,
+    height: 38,
+    borderRadius: 8,
+    backgroundColor: colors.surfaceAlt,
+    alignItems: 'center',
+    justifyContent: 'center',
+  },
+  stepText: { color: colors.text, fontSize: 20, fontWeight: '700' },
+  stepValue: {
+    color: colors.text,
+    fontSize: 18,
+    fontWeight: '700',
+    minWidth: 36,
+    textAlign: 'center',
+  },
+  switchRow: { flexDirection: 'row', alignItems: 'center' },
+  field: { marginTop: 12 },
+  input: {
+    color: colors.text,
+    backgroundColor: colors.surfaceAlt,
+    borderRadius: 8,
+    padding: 10,
+    marginTop: 6,
+    fontSize: 14,
+  },
+});

app/mobile/src/app/service/variables.tsx

@@ -0,0 +1,187 @@
+import React, { useState } from 'react';
+import {
+  Alert,
+  KeyboardAvoidingView,
+  Platform,
+  ScrollView,
+  StyleSheet,
+  Text,
+  TextInput,
+  TouchableOpacity,
+  View,
+} from 'react-native';
+import { Ionicons } from '@expo/vector-icons';
+import { useLocalSearchParams } from 'expo-router';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useApi } from '../../session';
+import { MASKED_SECRET, Variable } from '../../api';
+import { colors } from '../../theme';
+import { ActionButton, Card, Empty, ErrorBox, Loading } from '../../components';
+
+interface Row {
+  key: string;
+  value: string;
+  is_secret: boolean;
+  // Secret untouched by the user — submits the masked placeholder so the
+  // server keeps the stored ciphertext.
+  keepSecret: boolean;
+}
+
+export default function ServiceVariables() {
+  const { id, name } = useLocalSearchParams<{ id: string; name?: string }>();
+  const api = useApi();
+
+  const vars = useQuery({
+    queryKey: ['variables', id],
+    queryFn: () => api.serviceVariables(id!),
+    enabled: !!id,
+  });
+
+  if (vars.isLoading) return <Loading />;
+  if (vars.error) return <ErrorBox error={vars.error} />;
+  if (!vars.data) return <ErrorBox error={new Error('Not found')} />;
+
+  // Editor mounts once data exists; its state initializes from the fetch.
+  return <Editor serviceId={id!} name={name} initial={vars.data} />;
+}
+
+function Editor({
+  serviceId,
+  name,
+  initial,
+}: {
+  serviceId: string;
+  name?: string;
+  initial: Variable[];
+}) {
+  const api = useApi();
+  const qc = useQueryClient();
+  const [rows, setRows] = useState<Row[]>(() =>
+    initial.map((v) => ({
+      key: v.key,
+      value: v.is_secret ? '' : v.value,
+      is_secret: v.is_secret,
+      keepSecret: v.is_secret,
+    })),
+  );
+
+  const save = useMutation({
+    mutationFn: () => {
+      const clean = rows
+        .filter((r) => r.key.trim() !== '')
+        .map((r) => ({
+          key: r.key.trim(),
+          value: r.keepSecret ? MASKED_SECRET : r.value,
+          is_secret: r.is_secret,
+        }));
+      return api.updateVariables(serviceId, clean);
+    },
+    onSuccess: () => {
+      qc.invalidateQueries({ queryKey: ['variables', serviceId] });
+      qc.invalidateQueries({ queryKey: ['env-check', serviceId] });
+      Alert.alert('Saved', 'Variables apply on the next deploy/restart.');
+    },
+    onError: (e) => Alert.alert('Save failed', e instanceof Error ? e.message : String(e)),
+  });
+
+  const set = (i: number, patch: Partial<Row>) =>
+    setRows((rs) => rs.map((r, j) => (j === i ? { ...r, ...patch } : r)));
+
+  return (
+    <KeyboardAvoidingView
+      style={styles.root}
+      behavior={Platform.OS === 'ios' ? 'padding' : undefined}
+    >
+      <ScrollView contentContainerStyle={{ padding: 16 }}>
+        <Text style={styles.hint}>
+          Variables for {name ?? 'this service'}. Secret values are stored encrypted — leave a
+          secret blank to keep it, type to replace.
+        </Text>
+
+        {rows.length === 0 ? <Empty text="No variables yet" /> : null}
+        {rows.map((r, i) => (
+          <Card key={i}>
+            <View style={styles.rowHead}>
+              <TextInput
+                style={styles.keyInput}
+                value={r.key}
+                onChangeText={(t) => set(i, { key: t.toUpperCase().replace(/\s/g, '_') })}
+                placeholder="KEY"
+                placeholderTextColor={colors.textDim}
+                autoCapitalize="characters"
+                autoCorrect={false}
+              />
+              <TouchableOpacity
+                onPress={() =>
+                  set(i, r.is_secret ? { is_secret: false, keepSecret: false } : { is_secret: true })
+                }
+                hitSlop={8}
+                style={styles.iconBtn}
+              >
+                <Ionicons
+                  name={r.is_secret ? 'lock-closed' : 'lock-open-outline'}
+                  size={18}
+                  color={r.is_secret ? colors.warn : colors.textDim}
+                />
+              </TouchableOpacity>
+              <TouchableOpacity
+                onPress={() => setRows((rs) => rs.filter((_, j) => j !== i))}
+                hitSlop={8}
+                style={styles.iconBtn}
+              >
+                <Ionicons name="trash-outline" size={18} color={colors.err} />
+              </TouchableOpacity>
+            </View>
+            <TextInput
+              style={styles.valueInput}
+              value={r.value}
+              onChangeText={(t) => set(i, { value: t, keepSecret: false })}
+              placeholder={r.keepSecret ? '••••••••  (unchanged)' : 'value'}
+              placeholderTextColor={colors.textDim}
+              secureTextEntry={r.is_secret && !r.keepSecret}
+              autoCapitalize="none"
+              autoCorrect={false}
+              multiline={false}
+            />
+          </Card>
+        ))}
+
+        <ActionButton
+          label="+ Add variable"
+          onPress={() =>
+            setRows((rs) => [...rs, { key: '', value: '', is_secret: false, keepSecret: false }])
+          }
+        />
+        <ActionButton
+          label={save.isPending ? 'Saving…' : 'Save variables'}
+          kind="primary"
+          disabled={save.isPending}
+          onPress={() => save.mutate()}
+        />
+        <View style={{ height: 40 }} />
+      </ScrollView>
+    </KeyboardAvoidingView>
+  );
+}
+
+const styles = StyleSheet.create({
+  root: { flex: 1, backgroundColor: colors.bg },
+  hint: { color: colors.textDim, fontSize: 12, marginBottom: 12, lineHeight: 17 },
+  rowHead: { flexDirection: 'row', alignItems: 'center', marginBottom: 6 },
+  keyInput: {
+    flex: 1,
+    color: colors.text,
+    fontSize: 14,
+    fontWeight: '700',
+    fontFamily: Platform.OS === 'ios' ? 'Menlo' : 'monospace',
+  },
+  valueInput: {
+    color: colors.text,
+    fontSize: 14,
+    fontFamily: Platform.OS === 'ios' ? 'Menlo' : 'monospace',
+    backgroundColor: colors.surfaceAlt,
+    borderRadius: 8,
+    padding: 10,
+  },
+  iconBtn: { padding: 6, marginLeft: 6 },
+});

docs/api/openapi.yaml

@@ -2156,6 +2156,62 @@ paths:
                     items:
                       type: string
 
+  /templates/import/git:
+    post:
+      tags:
+        - Templates
+      summary: Import a compose file from a git repository
+      description: |
+        Fetches a compose file out of a git repository and runs it through
+        the same conversion as POST /templates/import/compose. `repo`
+        accepts a clone URL, ssh remote, or `owner/repo` shorthand —
+        connected git providers (including GitHub App installs) supply
+        credentials, so private repositories work. `path` defaults to
+        `compose.yaml`, `compose.yml`, `docker-compose.yml`, then
+        `docker-compose.yaml`; `ref` selects a branch or commit SHA.
+      security:
+        - bearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required:
+                - repo
+              properties:
+                repo:
+                  type: string
+                  description: Clone URL, ssh remote, or owner/repo shorthand
+                path:
+                  type: string
+                  description: Repo-relative compose file path (searched by convention when empty)
+                ref:
+                  type: string
+                  description: Branch name or 40-char commit SHA
+      responses:
+        '200':
+          description: Converted config
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  config:
+                    $ref: '#/components/schemas/TemplateConfig'
+                  variables:
+                    type: array
+                    items:
+                      type: object
+                  warnings:
+                    type: array
+                    items:
+                      type: string
+        '400':
+          description: Invalid repo reference, compose file missing, or conversion error
+        '502':
+          description: Git fetch failed
+
   /templates/deploy:
     post:
       tags:
@@ -7013,7 +7069,7 @@ components:
           description: Idle timeout in minutes before sleeping (1-1440, default 15)
         node_id:
           type: string
-          description: Node agent id this service is pinned to; empty/null = local Docker host. 'auto' on create/update resolves to the least-loaded online agent. Remote nodes run registry-pulled images only (no git builds, no Traefik domains).
+          description: Node agent id this service is pinned to; empty/null = local Docker host. 'auto' on create/update resolves to the least-loaded online agent. Git-sourced services build on the node itself (build context ships as an agent-token artifact); rollbacks of locally-built tags ship the image via docker save/load.
         node_name:
           type: string
           description: Display name of the pinned node agent (read-only)
@@ -7024,6 +7080,10 @@ components:
           type: array
           items: { type: string }
           description: Node tags required for remote placement — auto/spread only consider agents carrying every tag; re-resolved each reconcile. Mutually exclusive with an explicit node_id pin (read-only on responses when a pin is set).
+        traefik_labels:
+          type: object
+          additionalProperties: { type: string }
+          description: Extra Traefik middlewares defined for this service's router — keys 'middlewares.<name>.<type>[.<field>]' (e.g. 'middlewares.rl.ratelimit.average'), allowlist-validated; each defined middleware attaches to the router after builtins
         public_url:
           type: string
           description: Computed public URL (published port or domain)
@@ -7125,6 +7185,10 @@ components:
           type: array
           items: { type: string }
           description: Restrict remote placement to agents carrying every listed tag; mutually exclusive with an explicit pin or 'local'
+        traefik_labels:
+          type: object
+          additionalProperties: { type: string }
+          description: Extra Traefik middlewares on the service router — keys 'middlewares.<name>.<type>[.<field>]'; allowlist-validated
 
     UpdateServiceRequest:
       type: object
@@ -7221,6 +7285,10 @@ components:
           type: array
           items: { type: string }
           description: Restrict remote placement to agents carrying every listed tag; [] clears. Mutually exclusive with a pin or 'local' — clear the pin first
+        traefik_labels:
+          type: object
+          additionalProperties: { type: string }
+          description: Replace the service's Traefik middleware overrides — keys 'middlewares.<name>.<type>[.<field>]'; {} clears
 
     ServiceDomain:
       type: object

scripts/build-cli.sh

@@ -38,8 +38,17 @@ for platform in $PLATFORMS; do
         -ldflags "$LDFLAGS" \
         -o "bin/${MCP_NAME}" \
         ./cmd/mcp
+done
 
-    echo "✅ Built bin/${OUTPUT_NAME} + bin/${MCP_NAME}"
+# Node agents are linux-only — the download endpoint serves the same two
+# arches, and install-agent.sh falls back to these GH release assets.
+for arch in amd64 arm64; do
+    echo "📦 Building agent for linux/${arch}..."
+    CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build \
+        -ldflags "-X main.version=${VERSION}" \
+        -o "bin/containr-agent-linux-${arch}" \
+        ./cmd/agent
+    echo "✅ Built bin/containr-agent-linux-${arch}"
 done
 
 echo "🎉 CLI build complete!"

templates/n8n.md

@@ -103,7 +103,8 @@ services:
       - n8n_storage:/home/node/.n8n
     command: worker
     depends_on:
-      - n8n
+      n8n:
+        condition: service_started
       redis:
         condition: service_healthy
       postgres: