Adds integration tests for per path access lists, fixes ipv6 jsv,

and enforces host-wide access list when location access list is not set

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,31 @@
+<!-- WARNING: Any PR without a description will be closed. The title is not enough! -->
+
+<!-- ANOTHER WARNING: Don't go creating a duplicate PR! Check that someone hasn't already created something that tackles your fix and if so, help them first -->
+
+## Why
+
+<!-- Provide a brief description of WHY you are making your changes -->
+
+<!-- Consider if you are changing the API, then go in to detail why and/or if
+you change will break API for existing users -->
+
+## Type of Change
+
+<!-- Mark the relevant options with an "x" -->
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Documentation update
+- [ ] Code refactoring
+- [ ] API changes
+- [ ] Performance improvement
+- [ ] Test addition or update
+
+## AI Usage
+
+<!-- Mark the relevant options with an "x" -->
+
+- [ ] AI was used to write this
+- [ ] AI was used to review this
+

.github/dependabot.yml

@@ -0,0 +1,104 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/backend"
+    schedule:
+      interval: "weekly"
+    groups:
+      dev-patch-updates:
+        dependency-type: "development"
+        update-types:
+          - "patch"
+      dev-minor-updates:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+      prod-patch-updates:
+        dependency-type: "production"
+        update-types:
+          - "patch"
+      prod-minor-updates:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+    groups:
+      dev-patch-updates:
+        dependency-type: "development"
+        update-types:
+          - "patch"
+      dev-minor-updates:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+      prod-patch-updates:
+        dependency-type: "production"
+        update-types:
+          - "patch"
+      prod-minor-updates:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+    groups:
+      dev-patch-updates:
+        dependency-type: "development"
+        update-types:
+          - "patch"
+      dev-minor-updates:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+      prod-patch-updates:
+        dependency-type: "production"
+        update-types:
+          - "patch"
+      prod-minor-updates:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+
+  - package-ecosystem: "npm"
+    directory: "/test"
+    schedule:
+      interval: "weekly"
+    groups:
+      dev-patch-updates:
+        dependency-type: "development"
+        update-types:
+          - "patch"
+      dev-minor-updates:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+      prod-patch-updates:
+        dependency-type: "production"
+        update-types:
+          - "patch"
+      prod-minor-updates:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+    groups:
+      updates:
+        update-types:
+          - "patch"
+          - "minor"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/stale.yml

@@ -8,7 +8,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v11
         with:
           stale-issue-label: 'stale'
           stale-pr-label: 'stale'

.gitignore

@@ -8,3 +8,5 @@ test/node_modules
 */node_modules
 docker/dev/dnsrouter-config.json.tmp
 docker/dev/resolv.conf
+.claude
+

.version

@@ -1 +1 @@
-2.13.1
+2.16.0

Jenkinsfile

@@ -1,285 +0,0 @@
-import groovy.transform.Field
-
-@Field
-def shOutput = ""
-def buildxPushTags = ""
-
-pipeline {
-	agent {
-		label 'docker-multiarch'
-	}
-	options {
-		buildDiscarder(logRotator(numToKeepStr: '5'))
-		disableConcurrentBuilds()
-		ansiColor('xterm')
-	}
-	environment {
-		IMAGE                      = 'nginx-proxy-manager'
-		BUILD_VERSION              = getVersion()
-		MAJOR_VERSION              = '2'
-		BRANCH_LOWER               = "${BRANCH_NAME.toLowerCase().replaceAll('\\\\', '-').replaceAll('/', '-').replaceAll('\\.', '-')}"
-		BUILDX_NAME                = "npm_${BRANCH_LOWER}_${BUILD_NUMBER}"
-		COMPOSE_INTERACTIVE_NO_CLI = 1
-	}
-	stages {
-		stage('Environment') {
-			parallel {
-				stage('Master') {
-					when {
-						branch 'master'
-					}
-					steps {
-						script {
-							buildxPushTags = "-t docker.io/jc21/${IMAGE}:${BUILD_VERSION} -t docker.io/jc21/${IMAGE}:${MAJOR_VERSION} -t docker.io/jc21/${IMAGE}:latest"
-						}
-					}
-				}
-				stage('Other') {
-					when {
-						not {
-							branch 'master'
-						}
-					}
-					steps {
-						script {
-							// Defaults to the Branch name, which is applies to all branches AND pr's
-							buildxPushTags = "-t docker.io/nginxproxymanager/${IMAGE}-dev:${BRANCH_LOWER}"
-						}
-					}
-				}
-				stage('Versions') {
-					steps {
-						sh 'cat frontend/package.json | jq --arg BUILD_VERSION "${BUILD_VERSION}" \'.version = $BUILD_VERSION\' | sponge frontend/package.json'
-						sh 'echo -e "\\E[1;36mFrontend Version is:\\E[1;33m $(cat frontend/package.json | jq -r .version)\\E[0m"'
-						sh 'cat backend/package.json | jq --arg BUILD_VERSION "${BUILD_VERSION}" \'.version = $BUILD_VERSION\' | sponge backend/package.json'
-						sh 'echo -e "\\E[1;36mBackend Version is:\\E[1;33m  $(cat backend/package.json | jq -r .version)\\E[0m"'
-						sh 'sed -i -E "s/(version-)[0-9]+\\.[0-9]+\\.[0-9]+(-green)/\\1${BUILD_VERSION}\\2/" README.md'
-					}
-				}
-				stage('Docker Login') {
-					steps {
-						withCredentials([usernamePassword(credentialsId: 'jc21-dockerhub', passwordVariable: 'dpass', usernameVariable: 'duser')]) {
-							sh 'docker login -u "${duser}" -p "${dpass}"'
-						}
-					}
-				}
-			}
-		}
-		stage('Builds') {
-			parallel {
-				stage('Project') {
-					steps {
-						script {
-							// Frontend and Backend
-							def shStatusCode = sh(label: 'Checking and Building', returnStatus: true, script: '''
-								set -e
-								./scripts/ci/frontend-build > ${WORKSPACE}/tmp-sh-build 2>&1
-								./scripts/ci/test-and-build > ${WORKSPACE}/tmp-sh-build 2>&1
-							''')
-							shOutput = readFile "${env.WORKSPACE}/tmp-sh-build"
-							if (shStatusCode != 0) {
-								error "${shOutput}"
-							}
-						}
-					}
-					post {
-						always {
-							sh 'rm -f ${WORKSPACE}/tmp-sh-build'
-						}
-						failure {
-							npmGithubPrComment("CI Error:\n\n```\n${shOutput}\n```", true)
-						}
-					}
-				}
-				stage('Docs') {
-					steps {
-						dir(path: 'docs') {
-							sh 'yarn install'
-							sh 'yarn build'
-						}
-					}
-				}
-			}
-		}
-		stage('Test Sqlite') {
-			environment {
-				COMPOSE_PROJECT_NAME = "npm_${BRANCH_LOWER}_${BUILD_NUMBER}_sqlite"
-				COMPOSE_FILE         = 'docker/docker-compose.ci.yml:docker/docker-compose.ci.sqlite.yml'
-			}
-			when {
-				not {
-					equals expected: 'UNSTABLE', actual: currentBuild.result
-				}
-			}
-			steps {
-				sh 'rm -rf ./test/results/junit/*'
-				sh './scripts/ci/fulltest-cypress'
-			}
-			post {
-				always {
-					// Dumps to analyze later
-					sh 'mkdir -p debug/sqlite'
-					sh 'docker logs $(docker compose ps --all -q fullstack) > debug/sqlite/docker_fullstack.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q stepca) > debug/sqlite/docker_stepca.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q pdns) > debug/sqlite/docker_pdns.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q pdns-db) > debug/sqlite/docker_pdns-db.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q dnsrouter) > debug/sqlite/docker_dnsrouter.log 2>&1'
-					junit 'test/results/junit/*'
-					sh 'docker compose down --remove-orphans --volumes -t 30 || true'
-				}
-				unstable {
-					dir(path: 'test/results') {
-						archiveArtifacts(allowEmptyArchive: true, artifacts: '**/*', excludes: '**/*.xml')
-					}
-				}
-			}
-		}
-		stage('Test Mysql') {
-			environment {
-				COMPOSE_PROJECT_NAME = "npm_${BRANCH_LOWER}_${BUILD_NUMBER}_mysql"
-				COMPOSE_FILE         = 'docker/docker-compose.ci.yml:docker/docker-compose.ci.mysql.yml'
-			}
-			when {
-				not {
-					equals expected: 'UNSTABLE', actual: currentBuild.result
-				}
-			}
-			steps {
-				sh 'rm -rf ./test/results/junit/*'
-				sh './scripts/ci/fulltest-cypress'
-			}
-			post {
-				always {
-					// Dumps to analyze later
-					sh 'mkdir -p debug/mysql'
-					sh 'docker logs $(docker compose ps --all -q fullstack) > debug/mysql/docker_fullstack.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q stepca) > debug/mysql/docker_stepca.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q pdns) > debug/mysql/docker_pdns.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q pdns-db) > debug/mysql/docker_pdns-db.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q dnsrouter) > debug/mysql/docker_dnsrouter.log 2>&1'
-					junit 'test/results/junit/*'
-					sh 'docker compose down --remove-orphans --volumes -t 30 || true'
-				}
-				unstable {
-					dir(path: 'test/results') {
-						archiveArtifacts(allowEmptyArchive: true, artifacts: '**/*', excludes: '**/*.xml')
-					}
-				}
-			}
-		}
-		stage('Test Postgres') {
-			environment {
-				COMPOSE_PROJECT_NAME = "npm_${BRANCH_LOWER}_${BUILD_NUMBER}_postgres"
-				COMPOSE_FILE         = 'docker/docker-compose.ci.yml:docker/docker-compose.ci.postgres.yml'
-			}
-			when {
-				not {
-					equals expected: 'UNSTABLE', actual: currentBuild.result
-				}
-			}
-			steps {
-				sh 'rm -rf ./test/results/junit/*'
-				sh './scripts/ci/fulltest-cypress'
-			}
-			post {
-				always {
-					// Dumps to analyze later
-					sh 'mkdir -p debug/postgres'
-					sh 'docker logs $(docker compose ps --all -q fullstack) > debug/postgres/docker_fullstack.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q stepca) > debug/postgres/docker_stepca.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q pdns) > debug/postgres/docker_pdns.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q pdns-db) > debug/postgres/docker_pdns-db.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q dnsrouter) > debug/postgres/docker_dnsrouter.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q db-postgres) > debug/postgres/docker_db-postgres.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q authentik) > debug/postgres/docker_authentik.log 2>&1'
-					sh 'docker logs $(docker compose ps --all -q authentik-redis) > debug/postgres/docker_authentik-redis.log 2>&1'
-					sh 'docker logs $(docke rcompose ps --all -q authentik-ldap) > debug/postgres/docker_authentik-ldap.log 2>&1'
-
-					junit 'test/results/junit/*'
-					sh 'docker compose down --remove-orphans --volumes -t 30 || true'
-				}
-				unstable {
-					dir(path: 'test/results') {
-						archiveArtifacts(allowEmptyArchive: true, artifacts: '**/*', excludes: '**/*.xml')
-					}
-				}
-			}
-		}
-		stage('MultiArch Build') {
-			when {
-				not {
-					equals expected: 'UNSTABLE', actual: currentBuild.result
-				}
-			}
-			steps {
-				sh "./scripts/buildx --push ${buildxPushTags}"
-			}
-		}
-		stage('Docs / Comment') {
-			parallel {
-				stage('Docs Job') {
-					when {
-						allOf {
-							branch pattern: "^(develop|master)\$", comparator: "REGEXP"
-							not {
-								equals expected: 'UNSTABLE', actual: currentBuild.result
-							}
-						}
-					}
-					steps {
-						build wait: false, job: 'nginx-proxy-manager-docs', parameters: [string(name: 'docs_branch', value: "$BRANCH_NAME")]
-					}
-				}
-				stage('PR Comment') {
-					when {
-						allOf {
-							changeRequest()
-							not {
-								equals expected: 'UNSTABLE', actual: currentBuild.result
-							}
-						}
-					}
-					steps {
-						script {
-							npmGithubPrComment("""Docker Image for build ${BUILD_NUMBER} is available on [DockerHub](https://cloud.docker.com/repository/docker/nginxproxymanager/${IMAGE}-dev):
-```
-nginxproxymanager/${IMAGE}-dev:${BRANCH_LOWER}
-```
-
-> [!NOTE]
-> Ensure you backup your NPM instance before testing this image! Especially if there are database changes.
-> This is a different docker image namespace than the official image.
-
-> [!WARNING]
-> Changes and additions to DNS Providers require verification by at least 2 members of the community!
-""", true)
-						}
-					}
-				}
-			}
-		}
-	}
-	post {
-		always {
-			sh 'echo Reverting ownership'
-			sh 'docker run --rm -v "$(pwd):/data" jc21/ci-tools chown -R "$(id -u):$(id -g)" /data'
-			printResult(true)
-		}
-		failure {
-			archiveArtifacts(artifacts: 'debug/**/*.*', allowEmptyArchive: true)
-		}
-		unstable {
-			archiveArtifacts(artifacts: 'debug/**/*.*', allowEmptyArchive: true)
-		}
-	}
-}
-
-def getVersion() {
-	ver = sh(script: 'cat .version', returnStdout: true)
-	return ver.trim()
-}
-
-def getCommit() {
-	ver = sh(script: 'git log -n 1 --format=%h', returnStdout: true)
-	return ver.trim()
-}

README.md

@@ -1,7 +1,7 @@
 <p align="center">
 	<img src="https://nginxproxymanager.com/github.png">
 	<br><br>
-	<img src="https://img.shields.io/badge/version-2.13.1-green.svg?style=for-the-badge">
+	<img src="https://img.shields.io/badge/version-2.16.0-green.svg?style=for-the-badge">
 	<a href="https://hub.docker.com/repository/docker/jc21/nginx-proxy-manager">
 		<img src="https://img.shields.io/docker/stars/jc21/nginx-proxy-manager.svg?style=for-the-badge">
 	</a>
@@ -10,7 +10,7 @@
 	</a>
 </p>
 
-This project comes as a pre-built docker image that enables you to easily forward to your websites
+This project comes as a pre-built Docker image that enables you to easily forward to your websites
 running at home or otherwise, including free SSL, without having to know too much about Nginx or Letsencrypt.
 
 - [Quick Setup](#quick-setup)
@@ -20,9 +20,9 @@ running at home or otherwise, including free SSL, without having to know too muc
 ## Project Goal
 
 I created this project to fill a personal need to provide users with an easy way to accomplish reverse
-proxying hosts with SSL termination and it had to be so easy that a monkey could do it. This goal hasn't changed.
-While there might be advanced options they are optional and the project should be as simple as possible
-so that the barrier for entry here is low.
+proxying hosts with SSL termination, and it had to be so easy that a monkey could do it. This goal hasn't changed.
+While there might be advanced options, they are optional, and the project should be as simple as possible
+so that the barrier to entry here is low.
 
 <a href="https://www.buymeacoffee.com/jc21" target="_blank"><img src="http://public.jc21.com/github/by-me-a-coffee.png" alt="Buy Me A Coffee" style="height: 51px !important;width: 217px !important;" ></a>
 
@@ -30,29 +30,32 @@ so that the barrier for entry here is low.
 ## Features
 
 - Beautiful and Secure Admin Interface based on [Tabler](https://tabler.github.io/)
-- Easily create forwarding domains, redirections, streams and 404 hosts without knowing anything about Nginx
+- Easily create forwarding domains, redirections, streams, and 404 hosts without knowing anything about Nginx
 - Free SSL using Let's Encrypt or provide your own custom SSL certificates
 - Access Lists and basic HTTP Authentication for your hosts
 - Advanced Nginx configuration available for super users
-- User management, permissions and audit log
+- User management, permissions, and audit log
 
+::: warning
+`armv7` is no longer supported in version 2.14+. This is due to Nodejs dropping support for armhf. Please
+use the `2.13.7` image tag if this applies to you.
+:::
 
 ## Hosting your home network
 
-I won't go in to too much detail here but here are the basics for someone new to this self-hosted world.
+I won't go into too much detail here, but here are the basics for someone new to this self-hosted world.
 
 1. Your home router will have a Port Forwarding section somewhere. Log in and find it
-2. Add port forwarding for port 80 and 443 to the server hosting this project
-3. Configure your domain name details to point to your home, either with a static ip or a service like DuckDNS or [Amazon Route53](https://github.com/jc21/route53-ddns)
-4. Use the Nginx Proxy Manager as your gateway to forward to your other web based services
+2. Add port forwarding for ports 80 and 443 to the server hosting this project
+3. Configure your domain name details to point to your home, either with a static ip or a service like
+   - DuckDNS
+   - [Amazon Route53](https://github.com/jc21/route53-ddns)
+   - [Cloudflare](https://github.com/jc21/cloudflare-ddns)
+4. Use the Nginx Proxy Manager as your gateway to forward to your other web-based services
 
 ## Quick Setup
 
-1. Install Docker and Docker-Compose
-
-- [Docker Install documentation](https://docs.docker.com/install/)
-- [Docker-Compose Install documentation](https://docs.docker.com/compose/install/)
-
+1. [Install Docker](https://docs.docker.com/install/)
 2. Create a docker-compose.yml file similar to this:
 
 ```yml

SECURITY.md

@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest stable release receives security updates.
+Older versions are not actively maintained.
+
+| Version | Supported |
+| ------- | --------- |
+| 2.16.x (latest) | :white_check_mark: |
+| < 2.16.0 | :x: |
+
+Docker images: `jc21/nginx-proxy-manager:latest`, `jc21/nginx-proxy-manager:2`
+
+See all releases: https://github.com/NginxProxyManager/nginx-proxy-manager/releases
+
+## Reporting a Vulnerability
+
+**Do NOT open a public GitHub Issue to report a security vulnerability.**
+
+Use GitHub's private vulnerability reporting:
+https://github.com/NginxProxyManager/nginx-proxy-manager/security/advisories/new
+
+Please include:
+- Affected version (Docker image tag or release)
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+
+Once a fix is available, a public GitHub Security Advisory will be published.

backend/app.js

@@ -62,7 +62,7 @@ app.use("/", mainRoutes);
 app.use((err, req, res, _) => {
 	const payload = {
 		error: {
-			code: err.status,
+			code: err.status || 500,
 			message: err.public ? err.message : "Internal Error",
 		},
 	};

backend/biome.json

@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.3.2/schema.json",
+	"$schema": "https://biomejs.dev/schemas/2.5.10/schema.json",
 	"vcs": {
 		"enabled": true,
 		"clientKind": "git",
@@ -7,13 +7,7 @@
 	},
 	"files": {
 		"ignoreUnknown": false,
-        "includes": [
-            "**/*.ts",
-            "**/*.tsx",
-            "**/*.js",
-            "**/*.jsx",
-            "!**/dist/**/*"
-        ]
+		"includes": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx", "!**/dist/**/*"]
 	},
 	"formatter": {
 		"enabled": true,
@@ -31,24 +25,13 @@
 						"groups": [
 							":BUN:",
 							":NODE:",
-                            [
-                                "npm:*",
-                                "npm:*/**"
-                            ],
+							["npm:*", "npm:*/**"],
 							":PACKAGE_WITH_PROTOCOL:",
 							":URL:",
 							":PACKAGE:",
-                            [
-                                "/src/*",
-                                "/src/**"
-                            ],
-                            [
-                                "/**"
-                            ],
-                            [
-                                "#*",
-                                "#*/**"
-                            ],
+							["/src/*", "/src/**"],
+							["/**"],
+							["#*", "#*/**"],
 							":PATH:"
 						]
 					}
@@ -59,7 +42,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-            "recommended": true,
+			"preset": "recommended",
 			"correctness": {
 				"useUniqueElementIds": "off"
 			},

backend/config/sqlite-test-db.json

@@ -2,7 +2,7 @@
   "database": {
       "engine": "knex-native",
       "knex": {
-        "client": "sqlite3",
+        "client": "better-sqlite3",
         "connection": {
           "filename": "/app/config/mydb.sqlite"
         },

backend/db.js

@@ -1,6 +1,8 @@
 import knex from "knex";
 import { configGet, configHas } from "./lib/config.js";
 
+let instance = null;
+
 const generateDbConfig = () => {
 	if (!configHas("database")) {
 		throw new Error(
@@ -22,7 +24,7 @@ const generateDbConfig = () => {
 			password: cfg.password,
 			database: cfg.name,
 			port: cfg.port,
-			...(cfg.ssl ? { ssl: cfg.ssl } : {})
+			...(cfg.ssl ? { ssl: cfg.ssl } : {}),
 		},
 		migrations: {
 			tableName: "migrations",
@@ -30,4 +32,11 @@ const generateDbConfig = () => {
 	};
 };
 
-export default knex(generateDbConfig());
+const getInstance = () => {
+	if (!instance) {
+		instance = knex(generateDbConfig());
+	}
+	return instance;
+};
+
+export default getInstance;

backend/internal/2fa.js

@@ -0,0 +1,301 @@
+import crypto from "node:crypto";
+import bcrypt from "bcrypt";
+import { createGuardrails, generateSecret, generateURI, verify } from "otplib";
+import errs from "../lib/error.js";
+import authModel from "../models/auth.js";
+import internalUser from "./user.js";
+
+const APP_NAME = "Nginx Proxy Manager";
+const BACKUP_CODE_COUNT = 8;
+
+/**
+ * Generate backup codes
+ * @returns {Promise<{plain: string[], hashed: string[]}>}
+ */
+const generateBackupCodes = async () => {
+	const plain = [];
+	const hashed = [];
+
+	for (let i = 0; i < BACKUP_CODE_COUNT; i++) {
+		const code = crypto.randomBytes(4).toString("hex").toUpperCase();
+		plain.push(code);
+		const hash = await bcrypt.hash(code, 10);
+		hashed.push(hash);
+	}
+
+	return { plain, hashed };
+};
+
+const internal2fa = {
+	/**
+	 * Check if user has 2FA enabled
+	 * @param {number} userId
+	 * @returns {Promise<boolean>}
+	 */
+	isEnabled: async (userId) => {
+		const auth = await internal2fa.getUserPasswordAuth(userId);
+		return auth?.meta?.totp_enabled === true;
+	},
+
+	/**
+	 * Get 2FA status for user
+	 * @param   {Access}  access
+	 * @param   {number}  userId
+	 * @returns {Promise<{enabled: boolean, backup_codes_remaining: number}>}
+	 */
+	getStatus: async (access, userId) => {
+		await access.can("users:password", userId);
+		await internalUser.get(access, { id: userId });
+		const auth = await internal2fa.getUserPasswordAuth(userId);
+		const enabled = auth?.meta?.totp_enabled === true;
+		let backup_codes_remaining = 0;
+
+		if (enabled) {
+			const backupCodes = auth.meta.backup_codes || [];
+			backup_codes_remaining = backupCodes.length;
+		}
+
+		return {
+			enabled,
+			backup_codes_remaining,
+		};
+	},
+
+	/**
+	 * Start 2FA setup - store pending secret
+	 *
+	 * @param   {Access}  access
+	 * @param   {number} userId
+	 * @returns {Promise<{secret: string, otpauth_url: string}>}
+	 */
+	startSetup: async (access, userId) => {
+		await access.can("users:password", userId);
+		const user = await internalUser.get(access, { id: userId });
+		const secret = generateSecret();
+		const otpauth_url = generateURI({
+			issuer: APP_NAME,
+			label: user.email,
+			secret: secret,
+		});
+		const auth = await internal2fa.getUserPasswordAuth(userId);
+
+		// ensure user isn't already setup for 2fa
+		const enabled = auth?.meta?.totp_enabled === true;
+		if (enabled) {
+			throw new errs.ValidationError("2FA is already enabled");
+		}
+
+		const meta = auth.meta || {};
+		meta.totp_pending_secret = secret;
+
+		await authModel
+			.query()
+			.where("id", auth.id)
+			.andWhere("user_id", userId)
+			.andWhere("type", "password")
+			.patch({ meta });
+
+		return { secret, otpauth_url };
+	},
+
+	/**
+	 * Enable 2FA after verifying code
+	 *
+	 * @param   {Access}  access
+	 * @param   {number}  userId
+	 * @param   {string}  code
+	 * @returns {Promise<{backup_codes: string[]}>}
+	 */
+	enable: async (access, userId, code) => {
+		await access.can("users:password", userId);
+		await internalUser.get(access, { id: userId });
+		const auth = await internal2fa.getUserPasswordAuth(userId);
+		const secret = auth?.meta?.totp_pending_secret || false;
+
+		if (!secret) {
+			throw new errs.ValidationError("No pending 2FA setup found");
+		}
+
+		const result = await verify({ token: code, secret });
+		if (!result.valid) {
+			throw new errs.ValidationError("Invalid verification code");
+		}
+
+		const { plain, hashed } = await generateBackupCodes();
+
+		const meta = {
+			...auth.meta,
+			totp_secret: secret,
+			totp_enabled: true,
+			totp_enabled_at: new Date().toISOString(),
+			backup_codes: hashed,
+		};
+		delete meta.totp_pending_secret;
+
+		await authModel
+			.query()
+			.where("id", auth.id)
+			.andWhere("user_id", userId)
+			.andWhere("type", "password")
+			.patch({ meta });
+
+		return { backup_codes: plain };
+	},
+
+	/**
+	 * Disable 2FA
+	 *
+	 * @param   {Access}  access
+	 * @param   {number} userId
+	 * @param   {string} code
+	 * @returns {Promise<void>}
+	 */
+	disable: async (access, userId, code) => {
+		await access.can("users:password", userId);
+		await internalUser.get(access, { id: userId });
+		const auth = await internal2fa.getUserPasswordAuth(userId);
+
+		const enabled = auth?.meta?.totp_enabled === true;
+		if (!enabled) {
+			throw new errs.ValidationError("2FA is not enabled");
+		}
+
+		const result = await verify({
+			token: code,
+			secret: auth.meta.totp_secret,
+			guardrails: createGuardrails({
+				MIN_SECRET_BYTES: 10,
+			}),
+		});
+
+		if (!result.valid) {
+			throw new errs.AuthError("Invalid verification code");
+		}
+
+		const meta = { ...auth.meta };
+		delete meta.totp_secret;
+		delete meta.totp_enabled;
+		delete meta.totp_enabled_at;
+		delete meta.backup_codes;
+
+		await authModel
+			.query()
+			.where("id", auth.id)
+			.andWhere("user_id", userId)
+			.andWhere("type", "password")
+			.patch({ meta });
+	},
+
+	/**
+	 * Verify 2FA code for login
+	 *
+	 * @param   {number} userId
+	 * @param   {string} token
+	 * @returns {Promise<boolean>}
+	 */
+	verifyForLogin: async (userId, token) => {
+		const auth = await internal2fa.getUserPasswordAuth(userId);
+		const secret = auth?.meta?.totp_secret || false;
+
+		if (!secret) {
+			return false;
+		}
+
+		// Try TOTP code first, if it's 6 chars. it will throw errors if it's not 6 chars
+		// and the backup codes are 8 chars.
+		if (token.length === 6) {
+			const result = await verify({
+				token,
+				secret,
+				// These guardrails lower the minimum length requirement for secrets.
+				// In v12 of otplib the default minimum length is 10 and in v13 it is 16.
+				// Since there are 2fa secrets in the wild generated with v12 we need to allow shorter secrets
+				// so people won't be locked out when upgrading.
+				guardrails: createGuardrails({
+					MIN_SECRET_BYTES: 10,
+				}),
+			});
+
+			if (result.valid) {
+				return true;
+			}
+		}
+
+		// Try backup codes
+		const backupCodes = auth?.meta?.backup_codes || [];
+		for (let i = 0; i < backupCodes.length; i++) {
+			const match = await bcrypt.compare(token.toUpperCase(), backupCodes[i]);
+			if (match) {
+				// Remove used backup code
+				const updatedCodes = [...backupCodes];
+				updatedCodes.splice(i, 1);
+				const meta = { ...auth.meta, backup_codes: updatedCodes };
+				await authModel
+					.query()
+					.where("id", auth.id)
+					.andWhere("user_id", userId)
+					.andWhere("type", "password")
+					.patch({ meta });
+				return true;
+			}
+		}
+
+		return false;
+	},
+
+	/**
+	 * Regenerate backup codes
+	 *
+	 * @param   {Access}  access
+	 * @param   {number}  userId
+	 * @param   {string}  token
+	 * @returns {Promise<{backup_codes: string[]}>}
+	 */
+	regenerateBackupCodes: async (access, userId, token) => {
+		await access.can("users:password", userId);
+		await internalUser.get(access, { id: userId });
+		const auth = await internal2fa.getUserPasswordAuth(userId);
+		const enabled = auth?.meta?.totp_enabled === true;
+		const secret = auth?.meta?.totp_secret || false;
+
+		if (!enabled) {
+			throw new errs.ValidationError("2FA is not enabled");
+		}
+		if (!secret) {
+			throw new errs.ValidationError("No 2FA secret found");
+		}
+
+		const result = await verify({
+			token,
+			secret,
+		});
+
+		if (!result.valid) {
+			throw new errs.ValidationError("Invalid verification code");
+		}
+
+		const { plain, hashed } = await generateBackupCodes();
+
+		const meta = { ...auth.meta, backup_codes: hashed };
+		await authModel
+			.query()
+			.where("id", auth.id)
+			.andWhere("user_id", userId)
+			.andWhere("type", "password")
+			.patch({ meta });
+
+		return { backup_codes: plain };
+	},
+
+	getUserPasswordAuth: async (userId) => {
+		const auth = await authModel.query().where("user_id", userId).andWhere("type", "password").first();
+
+		if (!auth) {
+			throw new errs.ItemNotFoundError("Auth not found");
+		}
+
+		return auth;
+	},
+};
+
+export default internal2fa;

backend/internal/access-list.js

@@ -2,7 +2,9 @@ import fs from "node:fs";
 import batchflow from "batchflow";
 import _ from "lodash";
 import errs from "../lib/error.js";
+import { isMysql, isPostgres } from "../lib/config.js";
 import utils from "../lib/utils.js";
+import db from "../db.js";
 import { access as logger } from "../logger.js";
 import accessListModel from "../models/access_list.js";
 import accessListAuthModel from "../models/access_list_auth.js";
@@ -15,6 +17,38 @@ const omissions = () => {
 	return ["is_deleted"];
 };
 
+/**
+ * Find proxy hosts that reference an access list in their locations JSON.
+ *
+ * @param   {Integer}  accessListId
+ * @returns {Promise<Array>}
+ */
+const getProxyHostsUsingAccessListInLocations = async (accessListId) => {
+	let result;
+	if (isMysql()) {
+		const searchObj = JSON.stringify([{ access_list_id: accessListId }]);
+		result = await db().raw(
+			"SELECT id FROM proxy_host WHERE is_deleted = 0 AND JSON_CONTAINS(locations, ?, ?)",
+			[searchObj, "$"],
+		);
+	} else if (isPostgres()) {
+		result = await db().raw(
+			"SELECT id FROM proxy_host WHERE is_deleted = 0 AND locations::jsonb @> ?::jsonb",
+			[JSON.stringify([{ access_list_id: accessListId }])],
+		);
+	} else {
+		result = await db().raw(
+			"SELECT id FROM proxy_host WHERE is_deleted = 0 AND locations LIKE ?",
+			[`%"access_list_id":${accessListId}%`],
+		);
+	}
+	// knex raw() returns [rows, metadata] for MySQL, { rows } for Postgres and rows for SQLite
+	if (!Array.isArray(result)) {
+		return result?.rows || [];
+	}
+	return (Array.isArray(result[0]) ? result[0] : result) || [];
+};
+
 const internalAccessList = {
 	/**
 	 * @param   {Access}  access
@@ -48,19 +82,16 @@ const internalAccessList = {
 			return true;
 		});
 
+		await Promise.all(promises);
+
 		// Clients
-		data.clients?.map((client) => {
-			promises.push(
-				accessListClientModel.query().insert({
+		for (const client of data.clients ?? []) {
+			await accessListClientModel.query().insert({
 				access_list_id: row.id,
 				address: client.address,
 				directive: client.directive,
-				}),
-			);
-			return true;
 			});
-
-		await Promise.all(promises);
+		}
 
 		// re-fetch with expansions
 		const freshRow = await internalAccessList.get(
@@ -69,7 +100,7 @@ const internalAccessList = {
 				id: data.id,
 				expand: ["owner", "items", "clients", "proxy_hosts.access_list.[clients,items]"],
 			},
-			true // skip masking
+			true, // skip masking
 		);
 
 		// Audit log
@@ -154,25 +185,17 @@ const internalAccessList = {
 
 		// Check for clients and add/update/remove them
 		if (typeof data.clients !== "undefined" && data.clients) {
-			const clientPromises = [];
-			data.clients.map((client) => {
+			const query = accessListClientModel.query().delete().where("access_list_id", data.id);
+			await query;
+
+			for (const client of data.clients) {
 				if (client.address) {
-					clientPromises.push(
-						accessListClientModel.query().insert({
+					await accessListClientModel.query().insert({
 						access_list_id: data.id,
 						address: client.address,
 						directive: client.directive,
-						}),
-					);
-				}
-				return true;
 					});
-
-			const query = accessListClientModel.query().delete().where("access_list_id", data.id);
-			await query;
-			// Add new clitens
-			if (clientPromises.length) {
-				await Promise.all(clientPromises);
+				}
 			}
 		}
 
@@ -191,13 +214,31 @@ const internalAccessList = {
 				id: data.id,
 				expand: ["owner", "items", "clients", "proxy_hosts.[certificate,access_list.[clients,items]]"],
 			},
-			true // skip masking
+			true, // skip masking
 		);
 
-		await internalAccessList.build(freshRow)
+		await internalAccessList.build(freshRow);
 		if (Number.parseInt(freshRow.proxy_host_count, 10)) {
 			await internalNginx.bulkGenerateConfigs("proxy_host", freshRow.proxy_hosts);
 		}
+
+		// Also regenerate configs for proxy hosts that reference this access list in their locations
+		const locationHostRows = await getProxyHostsUsingAccessListInLocations(data.id);
+		if (locationHostRows?.length) {
+			const locationHostIds = locationHostRows.map((r) => r.id).filter((id) => {
+				// Exclude hosts already regenerated above
+				return !freshRow.proxy_hosts?.find((h) => h.id === id);
+			});
+			if (locationHostIds.length) {
+				const locationHosts = await proxyHostModel.query()
+					.where("is_deleted", 0)
+					.whereIn("id", locationHostIds)
+					.allowGraph(proxyHostModel.defaultAllowGraph)
+					.withGraphFetched("[owner, certificate, access_list.[clients,items]]");
+				await internalNginx.bulkGenerateConfigs("proxy_host", locationHosts);
+			}
+		}
+
 		await internalNginx.reload();
 		return internalAccessList.maskItems(freshRow);
 	},
@@ -213,17 +254,13 @@ const internalAccessList = {
 	 */
 	get: async (access, data, skipMasking) => {
 		const thisData = data || {};
-		const accessData = await access.can("access_lists:get", thisData.id)
+		const accessData = await access.can("access_lists:get", thisData.id);
 
 		const query = accessListModel
 			.query()
 			.select("access_list.*", accessListModel.raw("COUNT(proxy_host.id) as proxy_host_count"))
 			.leftJoin("proxy_host", function () {
-				this.on("proxy_host.access_list_id", "=", "access_list.id").andOn(
-					"proxy_host.is_deleted",
-					"=",
-					0,
-				);
+				this.on("proxy_host.access_list_id", "=", "access_list.id").andOn("proxy_host.is_deleted", "=", 0);
 			})
 			.where("access_list.is_deleted", 0)
 			.andWhere("access_list.id", thisData.id)
@@ -241,7 +278,7 @@ const internalAccessList = {
 
 		let row = await query.then(utils.omitRow(omissions()));
 
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(thisData.id);
 		}
 		if (!skipMasking && typeof row.items !== "undefined" && row.items) {
@@ -268,7 +305,7 @@ const internalAccessList = {
 			expand: ["proxy_hosts", "items", "clients"],
 		});
 
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}
 
@@ -278,28 +315,41 @@ const internalAccessList = {
 		// 4. audit log
 
 		// 1. update row to be deleted
-		await accessListModel
-			.query()
-			.where("id", row.id)
-			.patch({
+		await accessListModel.query().where("id", row.id).patch({
 			is_deleted: 1,
 		});
 
 		// 2. update any proxy hosts that were using it (ignoring permissions)
-		if (row.proxy_hosts) {
-			await proxyHostModel
-				.query()
-				.where("access_list_id", "=", row.id)
-				.patch({ access_list_id: 0 });
+		const affectedHostIds = new Set((row.proxy_hosts || []).map((h) => h.id));
+		if (affectedHostIds.size) {
+			await proxyHostModel.query().where("access_list_id", "=", row.id).patch({ access_list_id: 0 });
+		}
 
-			// 3. reconfigure those hosts, then reload nginx
-			// set the access_list_id to zero for these items
-			row.proxy_hosts.map((_val, idx) => {
-				row.proxy_hosts[idx].access_list_id = 0;
-				return true;
+		// Also clear it from any proxy host locations using it, these will then inherit the host's access list
+		const locationHostRows = await getProxyHostsUsingAccessListInLocations(row.id);
+		for (const { id: hostId } of locationHostRows) {
+			const host = await proxyHostModel.query().where("id", hostId).first();
+			if (host?.locations?.some((loc) => loc.access_list_id === row.id)) {
+				const updatedLocations = host.locations.map((loc) => {
+					if (loc.access_list_id === row.id) {
+						return { ...loc, access_list_id: 0 };
+					}
+					return loc;
 				});
+				await proxyHostModel.query().where("id", hostId).patch({ locations: updatedLocations });
+				affectedHostIds.add(hostId);
+			}
+		}
 
-			await internalNginx.bulkGenerateConfigs("proxy_host", row.proxy_hosts);
+		// 3. reconfigure those hosts from fresh rows, then reload nginx
+		if (affectedHostIds.size) {
+			const affectedHosts = await proxyHostModel
+				.query()
+				.where("is_deleted", 0)
+				.whereIn("id", [...affectedHostIds])
+				.allowGraph(proxyHostModel.defaultAllowGraph)
+				.withGraphFetched("[owner, certificate, access_list.[clients,items]]");
+			await internalNginx.bulkGenerateConfigs("proxy_host", affectedHosts);
 		}
 
 		await internalNginx.reload();
@@ -336,11 +386,7 @@ const internalAccessList = {
 			.query()
 			.select("access_list.*", accessListModel.raw("COUNT(proxy_host.id) as proxy_host_count"))
 			.leftJoin("proxy_host", function () {
-				this.on("proxy_host.access_list_id", "=", "access_list.id").andOn(
-					"proxy_host.is_deleted",
-					"=",
-					0,
-				);
+				this.on("proxy_host.access_list_id", "=", "access_list.id").andOn("proxy_host.is_deleted", "=", 0);
 			})
 			.where("access_list.is_deleted", 0)
 			.groupBy("access_list.id")
@@ -382,10 +428,7 @@ const internalAccessList = {
 	 * @returns {Promise}
 	 */
 	getCount: async (userId, visibility) => {
-		const query = accessListModel
-			.query()
-			.count("id as count")
-			.where("is_deleted", 0);
+		const query = accessListModel.query().count("id as count").where("is_deleted", 0);
 
 		if (visibility !== "all") {
 			query.andWhere("owner_user_id", userId);
@@ -447,20 +490,24 @@ const internalAccessList = {
 		}
 
 		// 2. create empty access file
-		fs.writeFileSync(htpasswdFile, '', {encoding: 'utf8'});
+		fs.writeFileSync(htpasswdFile, "", { encoding: "utf8" });
 
 		// 3. generate password for each user
 		if (list.items.length) {
 			await new Promise((resolve, reject) => {
-				batchflow(list.items).sequential()
+				batchflow(list.items)
+					.sequential()
 					.each((_i, item, next) => {
 						if (item.password?.length) {
 							logger.info(`Adding: ${item.username}`);
 
-							utils.execFile('openssl', ['passwd', '-apr1', item.password])
+							utils
+								.execFile("openssl", ["passwd", "-apr1", item.password])
 								.then((res) => {
 									try {
-										fs.appendFileSync(htpasswdFile, `${item.username}:${res}\n`, {encoding: 'utf8'});
+										fs.appendFileSync(htpasswdFile, `${item.username}:${res}\n`, {
+											encoding: "utf8",
+										});
 									} catch (err) {
 										reject(err);
 									}
@@ -482,7 +529,7 @@ const internalAccessList = {
 					});
 			});
 		}
-	}
-}
+	},
+};
 
 export default internalAccessList;

backend/internal/audit-log.js

@@ -3,7 +3,6 @@ import { castJsonIfNeed } from "../lib/helpers.js";
 import auditLogModel from "../models/audit-log.js";
 
 const internalAuditLog = {
-
 	/**
 	 * All logs
 	 *
@@ -46,11 +45,7 @@ const internalAuditLog = {
 	get: async (access, data) => {
 		await access.can("auditlog:list");
 
-		const query = auditLogModel
-			.query()
-			.andWhere("id", data.id)
-			.allowGraph("[user]")
-			.first();
+		const query = auditLogModel.query().andWhere("id", data.id).allowGraph("[user]").first();
 
 		if (typeof data.expand !== "undefined" && data.expand !== null) {
 			query.withGraphFetched(`[${data.expand.join(", ")}]`);

backend/internal/certificate.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import https from "node:https";
 import path from "path";
-import archiver from "archiver";
+import { ZipArchive } from "archiver";
 import _ from "lodash";
 import moment from "moment";
 import { ProxyAgent } from "proxy-agent";
@@ -66,7 +66,7 @@ const internalCertificate = {
 				.andWhere("provider", "letsencrypt")
 				.andWhere("expires_on", "<", expirationThreshold)
 				.then((certificates) => {
-					if (!certificates || !certificates.length) {
+					if (!certificates?.length) {
 						return null;
 					}
 
@@ -143,7 +143,7 @@ const internalCertificate = {
 				await internalCertificate.disableInUseHosts(inUseResult);
 
 				const user = await userModel.query().where("is_deleted", 0).andWhere("id", data.owner_user_id).first();
-				if (!user || !user.email) {
+				if (!user?.email) {
 					throw new error.ValidationError(
 						"A valid email address must be set on your user account to use Let's Encrypt",
 					);
@@ -305,7 +305,7 @@ const internalCertificate = {
 		}
 
 		const row = await query.then(utils.omitRow(omissions()));
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new error.ItemNotFoundError(data.id);
 		}
 		// Custom omissions
@@ -370,7 +370,7 @@ const internalCertificate = {
 	 * @returns {Promise}
 	 */
 	zipFiles: async (source, out) => {
-		const archive = archiver("zip", { zlib: { level: 9 } });
+		const archive = new ZipArchive({ zlib: { level: 9 } });
 		const stream = fs.createWriteStream(out);
 
 		return new Promise((resolve, reject) => {
@@ -397,7 +397,7 @@ const internalCertificate = {
 		await access.can("certificates:delete", data.id);
 		const row = await internalCertificate.get(access, { id: data.id });
 
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new error.ItemNotFoundError(data.id);
 		}
 
@@ -614,7 +614,7 @@ const internalCertificate = {
 		const certificate = await internalCertificate.update(access, {
 			id: data.id,
 			expires_on: moment(validations.certificate.dates.to, "X").format("YYYY-MM-DD HH:mm:ss"),
-			domain_names: [validations.certificate.cn],
+			domain_names: validations.certificate.cn ? [validations.certificate.cn] : [],
 			meta: _.clone(row.meta), // Prevent the update method from changing this value that we'll use later
 		});
 
@@ -630,7 +630,7 @@ const internalCertificate = {
 	 * @param {String}  privateKey    This is the entire key contents as a string
 	 */
 	checkPrivateKey: async (privateKey) => {
-		const filepath = await tempWrite(privateKey, "/tmp");
+		const filepath = await tempWrite(privateKey);
 		const failTimeout = setTimeout(() => {
 			throw new error.ValidationError(
 				"Result Validation Error: Validation timed out. This could be due to the key being passphrase-protected.",
@@ -660,8 +660,8 @@ const internalCertificate = {
 	 * @param {Boolean} [throwExpired]  Throw when the certificate is out of date
 	 */
 	getCertificateInfo: async (certificate, throwExpired) => {
+		const filepath = await tempWrite(certificate);
 		try {
-			const filepath = await tempWrite(certificate, "/tmp");
 			const certData = await internalCertificate.getCertificateInfoFromFile(filepath, throwExpired);
 			fs.unlinkSync(filepath);
 			return certData;
@@ -683,13 +683,15 @@ const internalCertificate = {
 
 		try {
 			const result = await utils.execFile("openssl", ["x509", "-in", certificateFile, "-subject", "-noout"]);
+
 			// Examples:
 			// subject=CN = *.jc21.com
 			// subject=CN = something.example.com
-			const regex = /(?:subject=)?[^=]+=\s+(\S+)/gim;
+			// subject=CN=*.jc21.com
+			const regex = /(?:subject=)?[^=]+=\s*(\S+)/gim;
 			const match = regex.exec(result);
 			if (match && typeof match[1] !== "undefined") {
-				certData.cn = match[1];
+				certData.cn = match[1].trim();
 			}
 
 			const result2 = await utils.execFile("openssl", ["x509", "-in", certificateFile, "-issuer", "-noout"]);
@@ -779,6 +781,7 @@ const internalCertificate = {
 
 		const args = [
 			"certonly",
+			"-n", // non-interactive
 			"--config",
 			letsencryptConfig,
 			"--work-dir",
@@ -798,6 +801,11 @@ const internalCertificate = {
 			certificate.domain_names.join(","),
 		];
 
+		// Add key-type parameter if specified
+		if (certificate.meta?.key_type) {
+			args.push("--key-type", certificate.meta.key_type);
+		}
+
 		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id);
 		args.push(...adds.args);
 
@@ -829,6 +837,7 @@ const internalCertificate = {
 
 		const args = [
 			"certonly",
+			"-n", // non-interactive
 			"--config",
 			letsencryptConfig,
 			"--work-dir",
@@ -858,6 +867,11 @@ const internalCertificate = {
 			);
 		}
 
+		// Add key-type parameter if specified
+		if (certificate.meta?.key_type) {
+			args.push("--key-type", certificate.meta.key_type);
+		}
+
 		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id, certificate.meta.dns_provider);
 		args.push(...adds.args);
 
@@ -867,10 +881,20 @@ const internalCertificate = {
 			const result = await utils.execFile(certbotCommand, args, adds.opts);
 			logger.info(result);
 			return result;
-		} catch (err) {
-			// Don't fail if file does not exist, so no need for action in the callback
+		} finally {
+			// Remove the credentials file whether certbot succeeded or failed.
+			//
+			// This cleanup used to sit in a catch block, so it only ran when issuance FAILED.
+			// A certificate that issued successfully left its DNS provider API credentials in
+			// /etc/letsencrypt/credentials for the entire life of that certificate. Nothing
+			// reads the file between certbot runs, so there is no reason to keep it:
+			// renewLetsEncryptSslWithDnsChallenge() writes it again immediately before each
+			// renewal.
+			//
+			// unlink is fire-and-forget with an empty callback. If the file is already gone
+			// that is the end state we wanted anyway, and a missing file must never turn a
+			// successful issuance into a failure.
 			fs.unlink(credentialsLocation, () => {});
-			throw err;
 		}
 	},
 
@@ -938,6 +962,11 @@ const internalCertificate = {
 			"--disable-hook-validation",
 		];
 
+		// Add key-type parameter if specified
+		if (certificate.meta?.key_type) {
+			args.push("--key-type", certificate.meta.key_type);
+		}
+
 		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id, certificate.meta.dns_provider);
 		args.push(...adds.args);
 
@@ -962,6 +991,43 @@ const internalCertificate = {
 			`Renewing LetsEncrypt certificates via ${dnsPlugin.name} for Cert #${certificate.id}: ${certificate.domain_names.join(", ")}`,
 		);
 
+		// certbot reads the DNS credentials back from the path recorded in the renewal config
+		// it wrote at issuance time, for example:
+		//
+		//     authenticator = dns-cloudflare
+		//     dns_cloudflare_credentials = /etc/letsencrypt/credentials/credentials-27
+		//
+		// so the file has to be present for the duration of this run. Write it here and remove
+		// it again below rather than leaving it on disk between renewals.
+		//
+		// Leaving it is an avoidable exposure. Anything running as root - a compromised
+		// process, a script, malware - can read the token and use it to issue valid Let's
+		// Encrypt certificates for the domain. Those certificates are genuinely trusted, so
+		// traffic presented with them passes TLS inspection, IDS/IPS and DLP that would
+		// otherwise flag it, and an exfiltration path built on them looks like ordinary
+		// HTTPS. The exposure window should be one certbot run, not the life of the
+		// certificate.
+		//
+		// The value is not on the certificate object we were handed: renew() sources that from
+		// internalCertificate.get(), which pipes the row through utils.omitRow(omissions()) so
+		// meta.dns_provider_credentials can never travel out over the API. Read the row from
+		// the model directly to get at it.
+		const row = await certificateModel.query().where("id", certificate.id).first();
+		const credentials = row?.meta?.dns_provider_credentials;
+		const credentialsLocation = `/etc/letsencrypt/credentials/credentials-${certificate.id}`;
+
+		if (credentials) {
+			fs.mkdirSync("/etc/letsencrypt/credentials", { recursive: true });
+			fs.writeFileSync(credentialsLocation, credentials, { mode: 0o600 });
+		} else {
+			// Nothing stored to write. A certificate issued under the previous behaviour may
+			// still have its file on disk; leave it be and let certbot decide. Throwing here
+			// would break a renewal that would otherwise have succeeded.
+			logger.warn(
+				`No stored DNS credentials for Cert #${certificate.id}; relying on any existing ${credentialsLocation}`,
+			);
+		}
+
 		const args = [
 			"renew",
 			"--force-renewal",
@@ -979,14 +1045,29 @@ const internalCertificate = {
 			"--no-random-sleep-on-renew",
 		];
 
+		// Add key-type parameter if specified
+		if (certificate.meta?.key_type) {
+			args.push("--key-type", certificate.meta.key_type);
+		}
+
 		const adds = internalCertificate.getAdditionalCertbotArgs(certificate.id, certificate.meta.dns_provider);
 		args.push(...adds.args);
 
 		logger.info(`Command: ${certbotCommand} ${args ? args.join(" ") : ""}`);
 
+		try {
 			const result = await utils.execFile(certbotCommand, args, adds.opts);
 			logger.info(result);
 			return result;
+		} finally {
+			// Only clean up a file we put there ourselves. If `credentials` came back empty we
+			// wrote nothing, and an older file left on disk by the previous behaviour is the
+			// only thing keeping that certificate renewable - deleting it would break the next
+			// run for no gain.
+			if (credentials) {
+				fs.unlink(credentialsLocation, () => {});
+			}
+		}
 	},
 
 	/**

backend/internal/dead-host.js

@@ -54,9 +54,7 @@ const internalDeadHost = {
 			thisData.advanced_config = "";
 		}
 
-		const row = await deadHostModel.query()
-			.insertAndFetch(thisData)
-			.then(utils.omitRow(omissions()));
+		const row = await deadHostModel.query().insertAndFetch(thisData).then(utils.omitRow(omissions()));
 
 		// Add to audit log
 		await internalAuditLog.add(access, {
@@ -153,12 +151,8 @@ const internalDeadHost = {
 
 		thisData = internalHost.cleanSslHstsData(thisData, row);
 
-
 		// do the row update
-		await deadHostModel
-			.query()
-			.where({id: data.id})
-			.patch(data);
+		await deadHostModel.query().where({ id: data.id }).patch(data);
 
 		// Add to audit log
 		await internalAuditLog.add(access, {
@@ -168,15 +162,18 @@ const internalDeadHost = {
 			meta: thisData,
 		});
 
-		const thisRow = await internalDeadHost
-			.get(access, {
+		const thisRow = await internalDeadHost.get(access, {
 			id: thisData.id,
 			expand: ["owner", "certificate"],
 		});
 
 		// Configure nginx
-		const newMeta = await internalNginx.configure(deadHostModel, "dead_host", row);
-		row.meta = newMeta;
+		if (!thisRow.enabled) {
+			// No need to add nginx config if host is disabled
+			return _.omit(internalHost.cleanRowCertificateMeta(thisRow), omissions());
+		}
+		const newMeta = await internalNginx.configure(deadHostModel, "dead_host", thisRow);
+		thisRow.meta = newMeta;
 		return _.omit(internalHost.cleanRowCertificateMeta(thisRow), omissions());
 	},
 
@@ -194,7 +191,7 @@ const internalDeadHost = {
 			.query()
 			.where("is_deleted", 0)
 			.andWhere("id", data.id)
-			.allowGraph("[owner,certificate]")
+			.allowGraph(deadHostModel.defaultAllowGraph)
 			.first();
 
 		if (accessData.permission_visibility !== "all") {
@@ -206,7 +203,7 @@ const internalDeadHost = {
 		}
 
 		const row = await query.then(utils.omitRow(omissions()));
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}
 		// Custom omissions
@@ -224,16 +221,13 @@ const internalDeadHost = {
 	 * @returns {Promise}
 	 */
 	delete: async (access, data) => {
-		await access.can("dead_hosts:delete", data.id)
+		await access.can("dead_hosts:delete", data.id);
 		const row = await internalDeadHost.get(access, { id: data.id });
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}
 
-		await deadHostModel
-			.query()
-			.where("id", row.id)
-			.patch({
+		await deadHostModel.query().where("id", row.id).patch({
 			is_deleted: 1,
 		});
 
@@ -259,12 +253,12 @@ const internalDeadHost = {
 	 * @returns {Promise}
 	 */
 	enable: async (access, data) => {
-		await access.can("dead_hosts:update", data.id)
+		await access.can("dead_hosts:update", data.id);
 		const row = await internalDeadHost.get(access, {
 			id: data.id,
 			expand: ["certificate", "owner"],
 		});
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}
 		if (row.enabled) {
@@ -273,10 +267,7 @@ const internalDeadHost = {
 
 		row.enabled = 1;
 
-		await deadHostModel
-			.query()
-			.where("id", row.id)
-			.patch({
+		await deadHostModel.query().where("id", row.id).patch({
 			enabled: 1,
 		});
 
@@ -301,9 +292,9 @@ const internalDeadHost = {
 	 * @returns {Promise}
 	 */
 	disable: async (access, data) => {
-		await access.can("dead_hosts:update", data.id)
+		await access.can("dead_hosts:update", data.id);
 		const row = await internalDeadHost.get(access, { id: data.id });
-		if (!row || !row.id) {
+		if (!row?.id) {
 			throw new errs.ItemNotFoundError(data.id);
 		}
 		if (!row.enabled) {
@@ -312,10 +303,7 @@ const internalDeadHost = {
 
 		row.enabled = 0;
 
-		await deadHostModel
-			.query()
-			.where("id", row.id)
-			.patch({
+		await deadHostModel.query().where("id", row.id).patch({
 			enabled: 0,
 		});
 
@@ -342,12 +330,12 @@ const internalDeadHost = {
 	 * @returns {Promise}
 	 */
 	getAll: async (access, expand, searchQuery) => {
-		const accessData = await access.can("dead_hosts:list")
+		const accessData = await access.can("dead_hosts:list");
 		const query = deadHostModel
 			.query()
 			.where("is_deleted", 0)
 			.groupBy("id")
-			.allowGraph("[owner,certificate]")
+			.allowGraph(deadHostModel.defaultAllowGraph)
 			.orderBy(castJsonIfNeed("domain_names"), "ASC");
 
 		if (accessData.permission_visibility !== "all") {

backend/internal/log-viewer.js

@@ -0,0 +1,229 @@
+import fs from "node:fs";
+import errs from "../lib/error.js";
+import internalDeadHost from "./dead-host.js";
+import internalProxyHost from "./proxy-host.js";
+import internalRedirectionHost from "./redirection-host.js";
+import internalStream from "./stream.js";
+
+const SYSTEM_LOG_FILE = "/data/logs/backend.log";
+const LETSENCRYPT_LOG_FILE = "/data/logs/letsencrypt.log";
+
+// Matches the access_log/error_log paths written by the nginx templates
+// (see backend/templates/{proxy_host,redirection_host,dead_host,stream}.conf).
+// This is a fixed, server-side lookup table - a host log path is always derived
+// from a validated `host_type` enum + numeric `host_id`, never from a client-supplied
+// path or filename, so there is no path-traversal surface here.
+const HOST_FILE_PREFIX = {
+	proxy: "proxy-host",
+	redirection: "redirection-host",
+	dead: "dead-host",
+	stream: "stream",
+};
+
+const DEFAULT_LINES = 200;
+const MAX_LINES = 1000;
+const CHUNK_SIZE = 64 * 1024;
+// Never scan further back than this, regardless of how many lines were requested,
+// so a huge or pathological log file can't turn a single request into unbounded I/O.
+const MAX_SCAN_BYTES = 5 * 1024 * 1024;
+
+/**
+ * Reads at most `maxLines` lines from the end of a file, without loading the
+ * whole file into memory. Reads backwards in fixed-size chunks until enough
+ * newlines have been seen, the start of the file is reached, or the hard
+ * MAX_SCAN_BYTES ceiling is hit.
+ *
+ * @param   {String} filePath
+ * @param   {Number} maxLines
+ * @returns {Promise<{lines: String[], size: Number, truncated: Boolean}>}
+ */
+const readLastLines = async (filePath, maxLines) => {
+	let handle;
+	try {
+		handle = await fs.promises.open(filePath, "r");
+		const stat = await handle.stat();
+		const { size } = stat;
+
+		if (size === 0) {
+			return { lines: [], size: 0, truncated: false };
+		}
+
+		let position = size;
+		let scanned = 0;
+		let newlineCount = 0;
+		const chunks = [];
+
+		while (position > 0 && newlineCount <= maxLines && scanned < MAX_SCAN_BYTES) {
+			const readSize = Math.min(CHUNK_SIZE, position);
+			position -= readSize;
+			const buffer = Buffer.alloc(readSize);
+			await handle.read(buffer, 0, readSize, position);
+			scanned += readSize;
+			for (let i = buffer.length - 1; i >= 0; i--) {
+				if (buffer[i] === 0x0a) newlineCount++;
+			}
+			chunks.unshift(buffer);
+		}
+
+		const truncated = position > 0 && scanned >= MAX_SCAN_BYTES;
+
+		// If we didn't start reading from byte 0, the first line in our buffer is only
+		// partial *unless* it happens that `position` landed exactly on a line boundary
+		// (the byte right before it is a newline) - check that one byte to avoid
+		// silently dropping a perfectly valid line.
+		let startsOnLineBoundary = position === 0;
+		if (position > 0) {
+			const boundaryByte = Buffer.alloc(1);
+			await handle.read(boundaryByte, 0, 1, position - 1);
+			startsOnLineBoundary = boundaryByte[0] === 0x0a;
+		}
+
+		const text = Buffer.concat(chunks).toString("utf8");
+		const allLines = text.split("\n");
+
+		if (!startsOnLineBoundary && allLines.length > 0) {
+			allLines.shift();
+		}
+		// Drop the trailing empty element caused by a final trailing newline.
+		if (allLines.length > 0 && allLines[allLines.length - 1] === "") {
+			allLines.pop();
+		}
+
+		return { lines: allLines.slice(-maxLines), size, truncated };
+	} finally {
+		if (handle) {
+			await handle.close();
+		}
+	}
+};
+
+/**
+ * Resolves a validated {type, host_type, host_id, channel} selection to the
+ * fixed, absolute path of the log file on disk. Throws if the combination
+ * isn't a recognised source.
+ *
+ * `channel` ("access" | "error") picks which of the two log files nginx writes
+ * per host - it's deliberately not named "stream" to avoid confusion with the
+ * "stream" host_type (TCP/UDP stream hosts).
+ *
+ * @param   {Object} data
+ * @returns {String}
+ */
+const resolveFilePath = (data) => {
+	switch (data.type) {
+		case "system":
+			return SYSTEM_LOG_FILE;
+		case "letsencrypt":
+			return LETSENCRYPT_LOG_FILE;
+		case "host": {
+			const prefix = HOST_FILE_PREFIX[data.host_type];
+			if (!prefix || !data.host_id || !["access", "error"].includes(data.channel)) {
+				throw new errs.ValidationError("Invalid host log source");
+			}
+			return `/data/logs/${prefix}-${data.host_id}_${data.channel}.log`;
+		}
+		default:
+			throw new errs.ItemNotFoundError(data.type);
+	}
+};
+
+/**
+ * @param   {Array} rows
+ * @returns {Array}
+ */
+const toHostOptions = (rows) =>
+	rows.map((row) => ({
+		id: row.id,
+		label: Array.isArray(row.domain_names) ? row.domain_names.join(", ") : `Host #${row.id}`,
+	}));
+
+const internalLogViewer = {
+	/**
+	 * Lists the log sources available for the log viewer: the system (backend)
+	 * log, the Let's Encrypt (certbot) log, and one entry per host the caller
+	 * can see, for each host type.
+	 *
+	 * @param   {Access} access
+	 * @returns {Promise}
+	 */
+	listSources: async (access) => {
+		await access.can("logs:list");
+
+		const [proxyHosts, redirectionHosts, deadHosts, streams] = await Promise.all([
+			internalProxyHost.getAll(access),
+			internalRedirectionHost.getAll(access),
+			internalDeadHost.getAll(access),
+			internalStream.getAll(access),
+		]);
+
+		return {
+			system: { label: "System" },
+			letsencrypt: { label: "Let's Encrypt" },
+			hosts: {
+				proxy: toHostOptions(proxyHosts),
+				redirection: toHostOptions(redirectionHosts),
+				dead: toHostOptions(deadHosts),
+				stream: streams.map((row) => ({
+					id: row.id,
+					label: `Port ${row.incoming_port} → ${row.forwarding_host}:${row.forwarding_port}`,
+				})),
+			},
+		};
+	},
+
+	/**
+	 * Returns the last N lines of the requested log source, optionally
+	 * filtered by level and/or a plain-text search term.
+	 *
+	 * @param   {Access} access
+	 * @param   {Object} data
+	 * @param   {String} data.type        "system" | "letsencrypt" | "host"
+	 * @param   {String} [data.host_type] "proxy" | "redirection" | "dead" | "stream"
+	 * @param   {Number} [data.host_id]
+	 * @param   {String} [data.channel]   "access" | "error"
+	 * @param   {Number} [data.lines]
+	 * @param   {String} [data.level]
+	 * @param   {String} [data.search]
+	 * @returns {Promise}
+	 */
+	tail: async (access, data) => {
+		await access.can("logs:list");
+
+		const filePath = resolveFilePath(data);
+		const lines = Math.min(Math.max(data.lines || DEFAULT_LINES, 1), MAX_LINES);
+
+		let result;
+		try {
+			result = await readLastLines(filePath, lines);
+		} catch (err) {
+			if (err.code === "ENOENT") {
+				return { lines: [], size: 0, truncated: false, exists: false };
+			}
+			throw err;
+		}
+
+		let outputLines = result.lines;
+
+		// Only the system log is written in our own "LEVEL   [scope]" format - level
+		// filtering on nginx/certbot lines would just match nothing and look like an
+		// empty log, so the filter is a no-op for any other source.
+		if (data.type === "system" && data.level) {
+			const needle = ` ${data.level.toUpperCase().padEnd(7)} `;
+			outputLines = outputLines.filter((line) => line.includes(needle));
+		}
+
+		if (data.search) {
+			const needle = data.search.toLowerCase();
+			outputLines = outputLines.filter((line) => line.toLowerCase().includes(needle));
+		}
+
+		return {
+			lines: outputLines,
+			size: result.size,
+			truncated: result.truncated,
+			exists: true,
+		};
+	},
+};
+
+export default internalLogViewer;

backend/internal/nginx.js

@@ -1,10 +1,12 @@
 import fs from "node:fs";
+import net from "node:net";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import _ from "lodash";
 import errs from "../lib/error.js";
 import utils from "../lib/utils.js";
 import { debug, nginx as logger } from "../logger.js";
+import accessListModel from "../models/access_list.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -34,7 +36,7 @@ const internalNginx = {
 				// We're deleting this config regardless.
 				// Don't throw errors, as the file may not exist at all
 				// Delete the .err file too
-				return internalNginx.deleteConfig(host_type, host, false, true);
+				return internalNginx.deleteConfig(host_type, host, true);
 			})
 			.then(() => {
 				return internalNginx.generateConfig(host_type, host);
@@ -83,10 +85,12 @@ const internalNginx = {
 								meta: combined_meta,
 							})
 							.then(() => {
-								internalNginx.renameConfigAsError(host_type, host);
+								// Keep the failed config as a .err file for inspection
+								return internalNginx.renameConfigAsError(host_type, host);
 							})
 							.then(() => {
-								return internalNginx.deleteConfig(host_type, host, true);
+								// The rename removed the live config already, don't touch the .err file
+								return internalNginx.deleteConfig(host_type, host, false);
 							});
 					});
 			})
@@ -165,6 +169,24 @@ const internalNginx = {
 						host.locations[i],
 					);
 
+					// A location with its own access list overrides the host's,
+					// otherwise it inherits the host's access list
+					let locationAccessList = null;
+					if (locationCopy.access_list_id > 0 && locationCopy.access_list_id !== host.access_list?.id) {
+						locationAccessList = await accessListModel
+							.query()
+							.where("is_deleted", 0)
+							.andWhere("id", locationCopy.access_list_id)
+							.withGraphFetched("[clients,items]")
+							.first();
+					}
+					if (locationAccessList) {
+						locationCopy.access_list = locationAccessList;
+					} else {
+						locationCopy.access_list_id = host.access_list_id;
+						locationCopy.access_list = host.access_list;
+					}
+
 					if (locationCopy.forward_host.indexOf("/") > -1) {
 						const splitted = locationCopy.forward_host.split("/");
 
@@ -176,7 +198,9 @@ const internalNginx = {
 				}
 			};
 
-			locationRendering().then(() => resolve(renderedLocations));
+			locationRendering()
+				.then(() => resolve(renderedLocations))
+				.catch(reject);
 		});
 	},
 
@@ -216,6 +240,22 @@ const internalNginx = {
 				}
 			}
 
+			// For redirection hosts, if the scheme is not http or https, set it to $scheme
+			if (
+				nice_host_type === "redirection_host" &&
+				["http", "https"].indexOf(host.forward_scheme.toLowerCase()) === -1
+			) {
+				host.forward_scheme = "$scheme";
+			}
+
+			// A stream forwarding to an IPv6 literal must have the address wrapped in
+			// square brackets before nginx appends ":<port>". Without the brackets nginx
+			// reads the trailing ":<port>" as part of the address and rejects the upstream
+			// ("invalid port in upstream"), so the stream saves but never activates (#5740).
+			if (nice_host_type === "stream" && net.isIPv6(host.forwarding_host)) {
+				host.forwarding_host = `[${host.forwarding_host}]`;
+			}
+
 			if (host.locations) {
 				//logger.info ('host.locations = ' + JSON.stringify(host.locations, null, 2));
 				origLocations = [].concat(host.locations);
@@ -252,6 +292,9 @@ const internalNginx = {
 						debug(logger, `Could not write ${filename}:`, err.message);
 						reject(new errs.ConfigurationError(err.message));
 					});
+			}).catch((err) => {
+				debug(logger, `Could not render locations for ${filename}:`, err.message);
+				reject(new errs.ConfigurationError(err.message));
 			});
 		});
 	},
@@ -370,8 +413,8 @@ const internalNginx = {
 		const config_file_err = `${config_file}.err`;
 
 		return new Promise((resolve /*, reject*/) => {
-			fs.unlink(config_file, () => {
-				// ignore result, continue
+			fs.unlink(config_file_err, () => {
+				// ignore result, a previous .err file may not exist
 				fs.rename(config_file, config_file_err, () => {
 					// also ignore result, as this is a debugging informative file anyway
 					resolve();

backend/internal/proxy-host.js

@@ -83,7 +83,7 @@ const internalProxyHost = {
 					expand: ["certificate", "owner", "access_list.[clients,items]"],
 				});
 			})
-			.then((row) => {
+		.then(async (row) => {
 			// Configure nginx
 			return internalNginx.configure(proxyHostModel, "proxy_host", row).then(() => {
 				return row;
@@ -115,9 +115,9 @@ const internalProxyHost = {
 	 */
 	update: (access, data) => {
 		let thisData = data;
-		const create_certificate = thisData.certificate_id === "new";
+		const createCertificate = thisData.certificate_id === "new";
 
-		if (create_certificate) {
+		if (createCertificate) {
 			delete thisData.certificate_id;
 		}
 
@@ -155,7 +155,7 @@ const internalProxyHost = {
 					);
 				}
 
-				if (create_certificate) {
+				if (createCertificate) {
 					return internalCertificate
 						.createQuickCertificate(access, {
 							domain_names: thisData.domain_names || row.domain_names,
@@ -208,7 +208,7 @@ const internalProxyHost = {
 					id: thisData.id,
 					expand: ["owner", "certificate", "access_list.[clients,items]"],
 				})
-					.then((row) => {
+				.then(async (row) => {
 					if (!row.enabled) {
 						// No need to add nginx config if host is disabled
 						return row;
@@ -232,7 +232,6 @@ const internalProxyHost = {
 	 */
 	get: (access, data) => {
 		const thisData = data || {};
-
 		return access
 			.can("proxy_hosts:get", thisData.id)
 			.then((access_data) => {
@@ -240,7 +239,7 @@ const internalProxyHost = {
 					.query()
 					.where("is_deleted", 0)
 					.andWhere("id", thisData.id)
-					.allowGraph("[owner,access_list.[clients,items],certificate]")
+					.allowGraph(proxyHostModel.defaultAllowGraph)
 					.first();
 
 				if (access_data.permission_visibility !== "all") {
@@ -254,7 +253,7 @@ const internalProxyHost = {
 				return query.then(utils.omitRow(omissions()));
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(thisData.id);
 				}
 				const thisRow = internalHost.cleanRowCertificateMeta(row);
@@ -280,7 +279,7 @@ const internalProxyHost = {
 				return internalProxyHost.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 
@@ -327,8 +326,8 @@ const internalProxyHost = {
 					expand: ["certificate", "owner", "access_list"],
 				});
 			})
-			.then((row) => {
-				if (!row || !row.id) {
+		.then(async (row) => {
+			if (!row?.id) {
 				throw new errs.ItemNotFoundError(data.id);
 			}
 			if (row.enabled) {
@@ -337,27 +336,24 @@ const internalProxyHost = {
 
 			row.enabled = 1;
 
-				return proxyHostModel
+			await proxyHostModel
 				.query()
 				.where("id", row.id)
 				.patch({
 					enabled: 1,
-					})
-					.then(() => {
+				});
+
 			// Configure nginx
-						return internalNginx.configure(proxyHostModel, "proxy_host", row);
-					})
-					.then(() => {
+			await internalNginx.configure(proxyHostModel, "proxy_host", row);
+
 			// Add to audit log
-						return internalAuditLog.add(access, {
+			await internalAuditLog.add(access, {
 				action: "enabled",
 				object_type: "proxy-host",
 				object_id: row.id,
 				meta: _.omit(row, omissions()),
 			});
-					});
-			})
-			.then(() => {
+
 			return true;
 		});
 	},
@@ -376,7 +372,7 @@ const internalProxyHost = {
 				return internalProxyHost.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (!row.enabled) {
@@ -422,11 +418,12 @@ const internalProxyHost = {
 	 */
 	getAll: async (access, expand, searchQuery) => {
 		const accessData = await access.can("proxy_hosts:list");
+
 		const query = proxyHostModel
 			.query()
 			.where("is_deleted", 0)
 			.groupBy("id")
-			.allowGraph("[owner,access_list,certificate]")
+			.allowGraph(proxyHostModel.defaultAllowGraph)
 			.orderBy(castJsonIfNeed("domain_names"), "ASC");
 
 		if (accessData.permission_visibility !== "all") {

backend/internal/redirection-host.js

@@ -229,7 +229,6 @@ const internalRedirectionHost = {
 	 */
 	get: (access, data) => {
 		const thisData = data || {};
-
 		return access
 			.can("redirection_hosts:get", thisData.id)
 			.then((access_data) => {
@@ -237,7 +236,7 @@ const internalRedirectionHost = {
 					.query()
 					.where("is_deleted", 0)
 					.andWhere("id", thisData.id)
-					.allowGraph("[owner,certificate]")
+					.allowGraph(redirectionHostModel.defaultAllowGraph)
 					.first();
 
 				if (access_data.permission_visibility !== "all") {
@@ -252,7 +251,7 @@ const internalRedirectionHost = {
 			})
 			.then((row) => {
 				let thisRow = row;
-				if (!thisRow || !thisRow.id) {
+				if (!thisRow?.id) {
 					throw new errs.ItemNotFoundError(thisData.id);
 				}
 				thisRow = internalHost.cleanRowCertificateMeta(thisRow);
@@ -278,7 +277,7 @@ const internalRedirectionHost = {
 				return internalRedirectionHost.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 
@@ -326,7 +325,7 @@ const internalRedirectionHost = {
 				});
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (row.enabled) {
@@ -374,7 +373,7 @@ const internalRedirectionHost = {
 				return internalRedirectionHost.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (!row.enabled) {
@@ -426,7 +425,7 @@ const internalRedirectionHost = {
 					.query()
 					.where("is_deleted", 0)
 					.groupBy("id")
-					.allowGraph("[owner,certificate]")
+					.allowGraph(redirectionHostModel.defaultAllowGraph)
 					.orderBy(castJsonIfNeed("domain_names"), "ASC");
 
 				if (access_data.permission_visibility !== "all") {

backend/internal/remote-version.js

@@ -0,0 +1,84 @@
+import https from "node:https";
+import { ProxyAgent } from "proxy-agent";
+import { debug, remoteVersion as logger } from "../logger.js";
+import pjson from "../package.json" with { type: "json" };
+
+const VERSION_URL = "https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/releases/latest";
+
+const internalRemoteVersion = {
+	cache_timeout: 1000 * 60 * 15, // 15 minutes
+	last_result: null,
+	last_fetch_time: null,
+
+	/**
+	 * Fetch the latest version info, using a cached result if within the cache timeout period.
+	 * @return {Promise<{current: string, latest: string, update_available: boolean}>} Version info
+	 */
+	get: async () => {
+		if (
+			!internalRemoteVersion.last_result ||
+			!internalRemoteVersion.last_fetch_time ||
+			Date.now() - internalRemoteVersion.last_fetch_time > internalRemoteVersion.cache_timeout
+		) {
+			const raw = await internalRemoteVersion.fetchUrl(VERSION_URL);
+			const data = JSON.parse(raw);
+			internalRemoteVersion.last_result = data;
+			internalRemoteVersion.last_fetch_time = Date.now();
+		} else {
+			debug(logger, "Using cached remote version result");
+		}
+
+		const latestVersion = internalRemoteVersion.last_result.tag_name;
+		const version = pjson.version.split("-").shift().split(".");
+		const currentVersion = `v${version[0]}.${version[1]}.${version[2]}`;
+		return {
+			current: currentVersion,
+			latest: latestVersion,
+			update_available: internalRemoteVersion.compareVersions(currentVersion, latestVersion),
+		};
+	},
+
+	fetchUrl: (url) => {
+		const agent = new ProxyAgent();
+		const headers = {
+			"User-Agent": `NginxProxyManager v${pjson.version}`,
+		};
+
+		return new Promise((resolve, reject) => {
+			logger.info(`Fetching ${url}`);
+			return https
+				.get(url, { agent, headers }, (res) => {
+					res.setEncoding("utf8");
+					let raw_data = "";
+					res.on("data", (chunk) => {
+						raw_data += chunk;
+					});
+					res.on("end", () => {
+						resolve(raw_data);
+					});
+				})
+				.on("error", (err) => {
+					reject(err);
+				});
+		});
+	},
+
+	compareVersions: (current, latest) => {
+		const cleanCurrent = current.replace(/^v/, "");
+		const cleanLatest = latest.replace(/^v/, "");
+
+		const currentParts = cleanCurrent.split(".").map(Number);
+		const latestParts = cleanLatest.split(".").map(Number);
+
+		for (let i = 0; i < Math.max(currentParts.length, latestParts.length); i++) {
+			const curr = currentParts[i] || 0;
+			const lat = latestParts[i] || 0;
+
+			if (lat > curr) return true;
+			if (lat < curr) return false;
+		}
+		return false;
+	},
+};
+
+export default internalRemoteVersion;

backend/internal/report.js

@@ -15,10 +15,10 @@ const internalReport = {
 				const userId = access.token.getUserId(1);
 
 				const promises = [
-					internalProxyHost.getCount(userId, access_data.visibility),
-					internalRedirectionHost.getCount(userId, access_data.visibility),
-					internalStream.getCount(userId, access_data.visibility),
-					internalDeadHost.getCount(userId, access_data.visibility),
+					internalProxyHost.getCount(userId, access_data.permission_visibility),
+					internalRedirectionHost.getCount(userId, access_data.permission_visibility),
+					internalStream.getCount(userId, access_data.permission_visibility),
+					internalDeadHost.getCount(userId, access_data.permission_visibility),
 				];
 
 				return Promise.all(promises);

backend/internal/stream.js

@@ -178,7 +178,6 @@ const internalStream = {
 	 */
 	get: (access, data) => {
 		const thisData = data || {};
-
 		return access
 			.can("streams:get", thisData.id)
 			.then((access_data) => {
@@ -186,7 +185,7 @@ const internalStream = {
 					.query()
 					.where("is_deleted", 0)
 					.andWhere("id", thisData.id)
-					.allowGraph("[owner,certificate]")
+					.allowGraph(streamModel.defaultAllowGraph)
 					.first();
 
 				if (access_data.permission_visibility !== "all") {
@@ -201,7 +200,7 @@ const internalStream = {
 			})
 			.then((row) => {
 				let thisRow = row;
-				if (!thisRow || !thisRow.id) {
+				if (!thisRow?.id) {
 					throw new errs.ItemNotFoundError(thisData.id);
 				}
 				thisRow = internalHost.cleanRowCertificateMeta(thisRow);
@@ -227,7 +226,7 @@ const internalStream = {
 				return internalStream.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 
@@ -275,7 +274,7 @@ const internalStream = {
 				});
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (row.enabled) {
@@ -323,7 +322,7 @@ const internalStream = {
 				return internalStream.get(access, { id: data.id });
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(data.id);
 				}
 				if (!row.enabled) {
@@ -375,7 +374,7 @@ const internalStream = {
 					.query()
 					.where("is_deleted", 0)
 					.groupBy("id")
-					.allowGraph("[owner,certificate]")
+					.allowGraph(streamModel.defaultAllowGraph)
 					.orderBy("incoming_port", "ASC");
 
 				if (access_data.permission_visibility !== "all") {

backend/internal/token.js

@@ -4,9 +4,12 @@ import { parseDatePeriod } from "../lib/helpers.js";
 import authModel from "../models/auth.js";
 import TokenModel from "../models/token.js";
 import userModel from "../models/user.js";
+import twoFactor from "./2fa.js";
 
 const ERROR_MESSAGE_INVALID_AUTH = "Invalid email or password";
 const ERROR_MESSAGE_INVALID_AUTH_I18N = "error.invalid-auth";
+const ERROR_MESSAGE_INVALID_2FA = "Invalid verification code";
+const ERROR_MESSAGE_INVALID_2FA_I18N = "error.invalid-2fa";
 
 export default {
 	/**
@@ -35,11 +38,7 @@ export default {
 			throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH);
 		}
 
-		const auth = await authModel
-			.query()
-			.where("user_id", "=", user.id)
-			.where("type", "=", "password")
-			.first();
+		const auth = await authModel.query().where("user_id", "=", user.id).where("type", "=", "password").first();
 
 		if (!auth) {
 			throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH);
@@ -47,10 +46,7 @@ export default {
 
 		const valid = await auth.verifyPassword(data.secret);
 		if (!valid) {
-			throw new errs.AuthError(
-				ERROR_MESSAGE_INVALID_AUTH,
-				ERROR_MESSAGE_INVALID_AUTH_I18N,
-			);
+			throw new errs.AuthError(ERROR_MESSAGE_INVALID_AUTH, ERROR_MESSAGE_INVALID_AUTH_I18N);
 		}
 
 		if (data.scope !== "user" && _.indexOf(user.roles, data.scope) === -1) {
@@ -59,6 +55,25 @@ export default {
 			throw new errs.AuthError(`Invalid scope: ${data.scope}`);
 		}
 
+		// Check if 2FA is enabled
+		const has2FA = await twoFactor.isEnabled(user.id);
+		if (has2FA) {
+			// Return challenge token instead of full token
+			const challengeToken = await Token.create({
+				iss: issuer || "api",
+				attrs: {
+					id: user.id,
+				},
+				scope: ["2fa-challenge"],
+				expiresIn: "5m",
+			});
+
+			return {
+				requires_2fa: true,
+				challenge_token: challengeToken.token,
+			};
+		}
+
 		// Create a moment of the expiry expression
 		const expiry = parseDatePeriod(data.expiry);
 		if (expiry === null) {
@@ -129,6 +144,62 @@ export default {
 		throw new error.AssertionFailedError("Existing token contained invalid user data");
 	},
 
+	/**
+	 * Verify 2FA code and return full token
+	 * @param {string} challengeToken
+	 * @param {string} code
+	 * @param {string} [expiry]
+	 * @returns {Promise}
+	 */
+	verify2FA: async (challengeToken, code, expiry) => {
+		const Token = TokenModel();
+		const tokenExpiry = expiry || "1d";
+
+		// Verify challenge token
+		let tokenData;
+		try {
+			tokenData = await Token.load(challengeToken);
+		} catch {
+			throw new errs.AuthError("Invalid or expired challenge token");
+		}
+
+		// Check scope
+		if (tokenData.scope?.[0] !== "2fa-challenge") {
+			throw new errs.AuthError("Invalid challenge token");
+		}
+
+		const userId = tokenData.attrs?.id;
+		if (!userId) {
+			throw new errs.AuthError("Invalid challenge token");
+		}
+
+		// Verify 2FA code
+		const valid = await twoFactor.verifyForLogin(userId, code);
+		if (!valid) {
+			throw new errs.AuthError(ERROR_MESSAGE_INVALID_2FA, ERROR_MESSAGE_INVALID_2FA_I18N);
+		}
+
+		// Create full token
+		const expiryDate = parseDatePeriod(tokenExpiry);
+		if (expiryDate === null) {
+			throw new errs.AuthError(`Invalid expiry time: ${tokenExpiry}`);
+		}
+
+		const signed = await Token.create({
+			iss: "api",
+			attrs: {
+				id: userId,
+			},
+			scope: ["user"],
+			expiresIn: tokenExpiry,
+		});
+
+		return {
+			token: signed.token,
+			expires: expiryDate.toISOString(),
+		};
+	},
+
 	/**
 	 * @param   {Object} user
 	 * @returns {Promise}

backend/internal/user.js

@@ -87,7 +87,13 @@ const internalUser = {
 		}
 
 		return access
-			.can("users:update", data.id)
+			.can("users:permissions", data.id)
+			.catch(() => {
+				delete data.roles;
+			})
+			.then(() => {
+				return access.can("users:update", data.id);
+			})
 			.then(() => {
 				// Make sure that the user being updated doesn't change their email to another user that is already using it
 				// 1. get user we want to update
@@ -171,7 +177,7 @@ const internalUser = {
 				return query.then(utils.omitRow(omissions()));
 			})
 			.then((row) => {
-				if (!row || !row.id) {
+				if (!row?.id) {
 					throw new errs.ItemNotFoundError(thisData.id);
 				}
 				// Custom omissions
@@ -251,9 +257,7 @@ const internalUser = {
 	},
 
 	deleteAll: async () => {
-		await userModel
-			.query()
-			.patch({
+		await userModel.query().patch({
 			is_deleted: 1,
 		});
 	},
@@ -384,11 +388,21 @@ const internalUser = {
 					.andWhere("type", data.type)
 					.first()
 					.then((existing_auth) => {
+						// Stamped here rather than read off modified_on, because it is compared against a
+						// token's `iat` and the two only line up when the same clock writes both. The
+						// database clock is a different one: with the app on one timezone and the database
+						// on another, its timestamps come back hours away from where Node thinks it is.
+						const password_changed_at = Math.floor(Date.now() / 1000);
+
 						if (existing_auth) {
 							// patch
+							const meta = existing_auth.meta || {};
+							meta.password_changed_at = password_changed_at;
+
 							return authModel.query().where("user_id", user.id).andWhere("type", data.type).patch({
 								type: data.type, // This is required for the model to encrypt on save
 								secret: data.secret,
+								meta,
 							});
 						}
 						// insert
@@ -396,7 +410,7 @@ const internalUser = {
 							user_id: user.id,
 							type: data.type,
 							secret: data.secret,
-							meta: {},
+							meta: { password_changed_at },
 						});
 					})
 					.then(() => {

backend/knexfile.js

@@ -1,19 +1,19 @@
 module.exports = {
 	development: {
-		client:     'mysql2',
+		client: "mysql2",
 		migrations: {
-			tableName: 'migrations',
-			stub:      'lib/migrate_template.js',
-			directory: 'migrations'
-		}
+			tableName: "migrations",
+			stub: "lib/migrate_template.js",
+			directory: "migrations",
+		},
 	},
 
 	production: {
-		client:     'mysql2',
+		client: "mysql2",
 		migrations: {
-			tableName: 'migrations',
-			stub:      'lib/migrate_template.js',
-			directory: 'migrations'
-		}
-	}
+			tableName: "migrations",
+			stub: "lib/migrate_template.js",
+			directory: "migrations",
+		},
+	},
 };

backend/lib/access.js

@@ -12,6 +12,7 @@ import { fileURLToPath } from "node:url";
 import Ajv from "ajv/dist/2020.js";
 import _ from "lodash";
 import { access as logger } from "../logger.js";
+import authModel from "../models/auth.js";
 import proxyHostModel from "../models/proxy_host.js";
 import TokenModel from "../models/token.js";
 import userModel from "../models/user.js";
@@ -80,6 +81,22 @@ export default function (tokenString) {
 				if (!ok) {
 					throw new errs.AuthError("Invalid token scope for User");
 				}
+
+				// A token issued before the password was last changed is no longer valid: taking an account
+				// back from whoever has the old password has to end the sessions that password opened.
+				const auth = await authModel
+					.query()
+					.where("user_id", "=", user.id)
+					.where("type", "=", "password")
+					.first();
+
+				// Both sides come from the same clock and in the same unit, whole seconds since
+				// the epoch: `setPassword` stamps the marker and `jsonwebtoken` stamps `iat`.
+				const changedAt = auth?.meta?.password_changed_at;
+				if (changedAt && typeof tokenData.iat === "number" && tokenData.iat < changedAt) {
+					throw new errs.TokenRevokedError("Token was issued before the password was changed");
+				}
+
 				initialised = true;
 				userRoles = user.roles;
 				permissions = user.permissions;
@@ -119,10 +136,7 @@ export default function (tokenString) {
 
 					// Proxy Hosts
 					case "proxy_hosts": {
-						const query = proxyHostModel
-							.query()
-							.select("id")
-							.andWhere("is_deleted", 0);
+						const query = proxyHostModel.query().select("id").andWhere("is_deleted", 0);
 
 						if (permissions.visibility === "user") {
 							query.andWhere("owner_user_id", tokenUserId);
@@ -271,7 +285,12 @@ export default function (tokenString) {
 				err.permission = permission;
 				err.permission_data = data;
 				logger.error(permission, data, err.message);
-				throw errs.PermissionError("Permission Denied", err);
+				// A revoked token is not a permission problem, and the client can tell: the frontend
+				// clears the session on a 401 and on nothing else.
+				if (err instanceof errs.TokenRevokedError) {
+					throw err;
+				}
+				throw new errs.PermissionError("Permission Denied", err);
 			}
 		},
 	};

backend/lib/access/logs-list.json

@@ -0,0 +1,7 @@
+{
+	"anyOf": [
+		{
+			"$ref": "roles#/definitions/admin"
+		}
+	]
+}

backend/lib/certbot.js

@@ -4,8 +4,6 @@ import { certbot as logger } from "../logger.js";
 import errs from "./error.js";
 import utils from "./utils.js";
 
-const CERTBOT_VERSION_REPLACEMENT = "$(certbot --version | grep -Eo '[0-9](\\.[0-9]+)+')";
-
 /**
  * Installs a cerbot plugin given the key for the object from
  * ../certbot/dns-plugins.json
@@ -15,24 +13,32 @@ const CERTBOT_VERSION_REPLACEMENT = "$(certbot --version | grep -Eo '[0-9](\\.[0
  */
 const installPlugin = async (pluginKey) => {
 	if (typeof dnsPlugins[pluginKey] === "undefined") {
-		// throw Error(`Certbot plugin ${pluginKey} not found`);
 		throw new errs.ItemNotFoundError(pluginKey);
 	}
 
 	const plugin = dnsPlugins[pluginKey];
 	logger.start(`Installing ${pluginKey}...`);
 
-	plugin.version = plugin.version.replace(/{{certbot-version}}/g, CERTBOT_VERSION_REPLACEMENT);
-	plugin.dependencies = plugin.dependencies.replace(/{{certbot-version}}/g, CERTBOT_VERSION_REPLACEMENT);
+	plugin.version = plugin.version.replace(/{{certbot-version}}/g, process.env.CERTBOT_VERSION);
+	plugin.dependencies = plugin.dependencies.replace(/{{certbot-version}}/g, process.env.CERTBOT_VERSION);
 
-	// SETUPTOOLS_USE_DISTUTILS is required for certbot plugins to install correctly
-	// in new versions of Python
-	let env = Object.assign({}, process.env, { SETUPTOOLS_USE_DISTUTILS: "stdlib" });
+	// SETUPTOOLS_USE_DISTUTILS=local uses setuptools' own bundled distutils.
+	// "stdlib" breaks Python 3.13+ where distutils was removed from the standard library.
+	let env = Object.assign({}, process.env, { SETUPTOOLS_USE_DISTUTILS: "local" });
 	if (typeof plugin.env === "object") {
 		env = Object.assign(env, plugin.env);
 	}
 
-	const cmd = `. /opt/certbot/bin/activate && pip install --no-cache-dir ${plugin.dependencies} ${plugin.package_name}${plugin.version}  && deactivate`;
+	const quotedDeps = plugin.dependencies.trim()
+		? plugin.dependencies
+				.trim()
+				.split(/\s+/)
+				.filter(Boolean)
+				.map((d) => `'${d}'`)
+				.join(" ")
+		: "";
+
+	const cmd = `. /opt/certbot/bin/activate && pip install --no-cache-dir ${quotedDeps} '${plugin.package_name}${plugin.version}' && deactivate`;
 	return utils
 		.exec(cmd, { env })
 		.then((result) => {
@@ -73,9 +79,7 @@ const installPlugins = async (pluginKeys) => {
 			})
 			.end(() => {
 				if (hasErrors) {
-					reject(
-						new errs.CommandError("Some plugins failed to install. Please check the logs above", 1),
-					);
+					reject(new errs.CommandError("Some plugins failed to install. Please check the logs above", 1));
 				} else {
 					resolve();
 				}
@@ -83,4 +87,4 @@ const installPlugins = async (pluginKeys) => {
 	});
 };
 
-export { installPlugins, installPlugin };
+export { installPlugin, installPlugins };

backend/lib/config.js

@@ -2,10 +2,13 @@ import fs from "node:fs";
 import NodeRSA from "node-rsa";
 import { global as logger } from "../logger.js";
 
-const keysFile         = '/data/keys.json';
-const mysqlEngine      = 'mysql2';
-const postgresEngine   = 'pg';
-const sqliteClientName = 'sqlite3';
+const keysFile = "/data/keys.json";
+const mysqlEngine = "mysql2";
+const postgresEngine = "pg";
+const sqliteClientName = "better-sqlite3";
+
+// Not used for new setups anymore but may exist in legacy setups
+const legacySqliteClientName = "sqlite3";
 
 let instance = null;
 
@@ -37,14 +40,20 @@ const configure = () => {
 		}
 	}
 
-	const toBool = (v) => /^(1|true|yes|on)$/i.test((v || '').trim());
+	const toBool = (v) => /^(1|true|yes|on)$/i.test((v || "").trim());
 
 	const envMysqlHost = process.env.DB_MYSQL_HOST || null;
 	const envMysqlUser = process.env.DB_MYSQL_USER || null;
 	const envMysqlName = process.env.DB_MYSQL_NAME || null;
 	const envMysqlSSL = toBool(process.env.DB_MYSQL_SSL);
-	const envMysqlSSLRejectUnauthorized	= process.env.DB_MYSQL_SSL_REJECT_UNAUTHORIZED === undefined ? true : toBool(process.env.DB_MYSQL_SSL_REJECT_UNAUTHORIZED);
-	const envMysqlSSLVerifyIdentity		= process.env.DB_MYSQL_SSL_VERIFY_IDENTITY === undefined ? true : toBool(process.env.DB_MYSQL_SSL_VERIFY_IDENTITY);
+	const envMysqlSSLRejectUnauthorized =
+		process.env.DB_MYSQL_SSL_REJECT_UNAUTHORIZED === undefined
+			? true
+			: toBool(process.env.DB_MYSQL_SSL_REJECT_UNAUTHORIZED);
+	const envMysqlSSLVerifyIdentity =
+		process.env.DB_MYSQL_SSL_VERIFY_IDENTITY === undefined
+			? true
+			: toBool(process.env.DB_MYSQL_SSL_VERIFY_IDENTITY);
 	if (envMysqlHost && envMysqlUser && envMysqlName) {
 		// we have enough mysql creds to go with mysql
 		logger.info("Using MySQL configuration");
@@ -56,7 +65,9 @@ const configure = () => {
 				user: envMysqlUser,
 				password: process.env.DB_MYSQL_PASSWORD,
 				name: envMysqlName,
-				ssl:      envMysqlSSL ? { rejectUnauthorized: envMysqlSSLRejectUnauthorized, verifyIdentity: envMysqlSSLVerifyIdentity } : false,
+				ssl: envMysqlSSL
+					? { rejectUnauthorized: envMysqlSSLRejectUnauthorized, verifyIdentity: envMysqlSSLVerifyIdentity }
+					: false,
 			},
 			keys: getKeys(),
 		};
@@ -84,6 +95,7 @@ const configure = () => {
 	}
 
 	const envSqliteFile = process.env.DB_SQLITE_FILE || "/data/database.sqlite";
+
 	logger.info(`Using Sqlite: ${envSqliteFile}`);
 	instance = {
 		database: {
@@ -133,7 +145,7 @@ const generateKeys = () => {
 
 	// Write keys config
 	try {
-		fs.writeFileSync(keysFile, JSON.stringify(keys, null, 2));
+		fs.writeFileSync(keysFile, JSON.stringify(keys, null, 2), { mode: 0o600 });
 	} catch (err) {
 		logger.error(`Could not write JWT key pair to config file: ${keysFile}: ${err.message}`);
 		process.exit(1);
@@ -183,7 +195,7 @@ const configGet = (key) => {
  */
 const isSqlite = () => {
 	instance === null && configure();
-	return instance.database.knex && instance.database.knex.client === sqliteClientName;
+	return instance.database.knex && [sqliteClientName, legacySqliteClientName].includes(instance.database.knex.client);
 };
 
 /**
@@ -207,7 +219,7 @@ const isPostgres = () => {
 };
 
 /**
- * Are we running in debug mdoe?
+ * Are we running in debug mode?
  *
  * @returns {boolean}
  */
@@ -218,7 +230,7 @@ const isDebugMode = () => !!process.env.DEBUG;
  *
  * @returns {boolean}
  */
-const isCI = () => process.env.CI === 'true' && process.env.DEBUG === 'true';
+const isCI = () => process.env.CI === "true" && process.env.DEBUG === "true";
 
 /**
  * Returns a public key
@@ -255,4 +267,16 @@ const useLetsencryptServer = () => {
 	return null;
 };
 
-export { isCI, configHas, configGet, isSqlite, isMysql, isPostgres, isDebugMode, getPrivateKey, getPublicKey, useLetsencryptStaging, useLetsencryptServer };
+export {
+	isCI,
+	configHas,
+	configGet,
+	isSqlite,
+	isMysql,
+	isPostgres,
+	isDebugMode,
+	getPrivateKey,
+	getPublicKey,
+	useLetsencryptStaging,
+	useLetsencryptServer,
+};

backend/lib/error.js

@@ -22,6 +22,15 @@ const errs = {
 		this.status = 404;
 	},
 
+	TokenRevokedError: function (message, previous) {
+		Error.captureStackTrace(this, this.constructor);
+		this.name = this.constructor.name;
+		this.previous = previous;
+		this.message = message;
+		this.public = true;
+		this.status = 401;
+	},
+
 	AuthError: function (message, messageI18n, previous) {
 		Error.captureStackTrace(this, this.constructor);
 		this.name = this.constructor.name;

backend/lib/express/cors.js

@@ -3,7 +3,7 @@ export default (req, res, next) => {
 		res.set({
 			"Access-Control-Allow-Origin": req.headers.origin,
 			"Access-Control-Allow-Credentials": true,
-			"Access-Control-Allow-Methods": "OPTIONS, GET, POST",
+			"Access-Control-Allow-Methods": "OPTIONS, GET, POST, PUT, DELETE",
 			"Access-Control-Allow-Headers":
 				"Content-Type, Cache-Control, Pragma, Expires, Authorization, X-Dataset-Total, X-Dataset-Offset, X-Dataset-Limit",
 			"Access-Control-Max-Age": 5 * 60,

backend/lib/express/log-request.js

@@ -0,0 +1,7 @@
+import chalk from "chalk";
+import { debug, express as logger } from "../../logger.js";
+
+export default (req, _res, next) => {
+	debug(logger, `[${chalk.yellow(req.method.toUpperCase())}] ${chalk.green(req.path)}`);
+	next();
+};

backend/lib/express/user-id-from-me.js

@@ -1,6 +1,6 @@
 export default (req, res, next) => {
-	if (req.params.user_id === 'me' && res.locals.access) {
-		req.params.user_id = res.locals.access.token.get('attrs').id;
+	if (req.params.user_id === "me" && res.locals.access) {
+		req.params.user_id = res.locals.access.token.get("attrs").id;
 	} else {
 		req.params.user_id = Number.parseInt(req.params.user_id, 10);
 	}

backend/lib/utils.js

@@ -3,14 +3,12 @@ import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Liquid } from "liquidjs";
 import _ from "lodash";
-import { debug, global as logger } from "../logger.js";
 import errs from "./error.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
 const exec = async (cmd, options = {}) => {
-	debug(logger, "CMD:", cmd);
 	const { stdout, stderr } = await new Promise((resolve, reject) => {
 		const child = nodeExec(cmd, options, (isError, stdout, stderr) => {
 			if (isError) {
@@ -34,7 +32,6 @@ const exec = async (cmd, options = {}) => {
  * @returns {Promise}
  */
 const execFile = (cmd, args, options) => {
-	debug(logger, `CMD: ${cmd} ${args ? args.join(" ") : ""}`);
 	const opts = options || {};
 
 	return new Promise((resolve, reject) => {

backend/lib/validator/api.js

@@ -1,3 +1,4 @@
+import net from "node:net";
 import Ajv from "ajv/dist/2020.js";
 import errs from "../error.js";
 
@@ -9,6 +10,8 @@ const ajv = new Ajv({
 	coerceTypes: true,
 });
 
+ajv.addFormat("ipv6", { type: "string", validate: (value) => net.isIPv6(value) });
+
 /**
  * @param {Object} schema
  * @param {Object} payload
@@ -24,18 +27,14 @@ const apiValidator = async (schema, payload /*, description*/) => {
 		throw new errs.ValidationError("Payload is undefined");
 	}
 
-
 	const validate = ajv.compile(schema);
 
 	const valid = validate(payload);
 
-
 	if (valid && !validate.errors) {
 		return payload;
 	}
 
-
-
 	const message = ajv.errorsText(validate.errors);
 	const err = new errs.ValidationError(message);
 	err.debug = { validationErrors: validate.errors, payload };

backend/lib/validator/index.js

@@ -1,4 +1,5 @@
-import Ajv from 'ajv/dist/2020.js';
+import net from "node:net";
+import Ajv from "ajv/dist/2020.js";
 import _ from "lodash";
 import commonDefinitions from "../../schema/common.json" with { type: "json" };
 import errs from "../error.js";
@@ -14,6 +15,8 @@ const ajv = new Ajv({
 	schemas: [commonDefinitions],
 });
 
+ajv.addFormat("ipv6", { type: "string", validate: (value) => net.isIPv6(value) });
+
 /**
  *
  * @param   {Object} schema

backend/logger.js

@@ -1,3 +1,5 @@
+import fs from "node:fs";
+import path from "node:path";
 import signale from "signale";
 import { isDebugMode } from "./lib/config.js";
 
@@ -5,16 +7,115 @@ const opts = {
 	logLevel: "info",
 };
 
-const global = new signale.Signale({ scope: "Global   ", ...opts });
-const migrate = new signale.Signale({ scope: "Migrate  ", ...opts });
-const express = new signale.Signale({ scope: "Express  ", ...opts });
-const access = new signale.Signale({ scope: "Access   ", ...opts });
-const nginx = new signale.Signale({ scope: "Nginx    ", ...opts });
-const ssl = new signale.Signale({ scope: "SSL      ", ...opts });
-const certbot = new signale.Signale({ scope: "Certbot  ", ...opts });
-const importer = new signale.Signale({ scope: "Importer ", ...opts });
-const setup = new signale.Signale({ scope: "Setup    ", ...opts });
-const ipRanges = new signale.Signale({ scope: "IP Ranges", ...opts });
+// Methods that are actually used across the codebase (see grep of `.info(`, `.warn(`, etc).
+// Only these are mirrored to the log file - decorative signale methods (star, note, watch, ...)
+// are left console-only since they carry no diagnostic value worth persisting.
+const PERSISTED_METHODS = ["info", "warn", "error", "debug", "success", "fatal", "complete"];
+
+const LOG_FILE = "/data/logs/backend.log";
+// biome-ignore lint/suspicious/noControlCharactersInRegex: stripping ANSI colour codes before writing to disk
+const ANSI_PATTERN = /\x1b\[[0-9;]*m/g;
+
+let fileStream = null;
+let lastOpenAttempt = 0;
+// If the file can't be opened (eg. running outside the standard Docker image, or in
+// CI without /data), don't retry on every single log call - but do retry periodically
+// so a transient issue (disk full, permissions fixed later) recovers without a restart.
+const REOPEN_COOLDOWN_MS = 30 * 1000;
+
+/**
+ * Lazily opens the backend log file for appending. If the directory isn't writable,
+ * file logging is silently disabled and console logging continues unaffected.
+ *
+ * @returns {import('node:fs').WriteStream|null}
+ */
+const getFileStream = () => {
+	if (fileStream) {
+		return fileStream;
+	}
+
+	const now = Date.now();
+	if (now - lastOpenAttempt < REOPEN_COOLDOWN_MS) {
+		return null;
+	}
+	lastOpenAttempt = now;
+
+	try {
+		fs.mkdirSync(path.dirname(LOG_FILE), { recursive: true });
+		const stream = fs.createWriteStream(LOG_FILE, { flags: "a" });
+		stream.on("error", () => {
+			fileStream = null;
+		});
+		fileStream = stream;
+	} catch (_err) {
+		fileStream = null;
+	}
+	return fileStream;
+};
+
+/**
+ * Formats and appends a single log line to the backend log file.
+ * Never throws - a failure here must never take down the application.
+ *
+ * @param {String} level
+ * @param {String} scope
+ * @param {Array}  args
+ */
+const writeToFile = (level, scope, args) => {
+	const stream = getFileStream();
+	if (!stream) {
+		return;
+	}
+
+	const message = args
+		.map((arg) => {
+			if (typeof arg === "string") return arg;
+			if (arg instanceof Error) return arg.stack || arg.message;
+			try {
+				return JSON.stringify(arg);
+			} catch (_err) {
+				return String(arg);
+			}
+		})
+		.join(" ")
+		.replace(ANSI_PATTERN, "");
+
+	const line = `${new Date().toISOString()} ${level.toUpperCase().padEnd(7)} [${scope.trim()}] ${message}\n`;
+	stream.write(line);
+};
+
+/**
+ * Wraps a Signale instance so that every call to one of PERSISTED_METHODS is also
+ * appended to the backend log file, in addition to its normal console output.
+ *
+ * @param   {Signale} instance
+ * @param   {String}  scope
+ * @returns {Signale}
+ */
+const withFileSink = (instance, scope) => {
+	for (const method of PERSISTED_METHODS) {
+		const original = instance[method].bind(instance);
+		instance[method] = (...args) => {
+			writeToFile(method, scope, args);
+			return original(...args);
+		};
+	}
+	return instance;
+};
+
+const createLogger = (scope) => withFileSink(new signale.Signale({ scope, ...opts }), scope);
+
+const global = createLogger("Global   ");
+const migrate = createLogger("Migrate  ");
+const express = createLogger("Express  ");
+const access = createLogger("Access   ");
+const nginx = createLogger("Nginx    ");
+const ssl = createLogger("SSL      ");
+const certbot = createLogger("Certbot  ");
+const importer = createLogger("Importer ");
+const setup = createLogger("Setup    ");
+const ipRanges = createLogger("IP Ranges");
+const remoteVersion = createLogger("Remote Version");
 
 const debug = (logger, ...args) => {
 	if (isDebugMode()) {
@@ -22,4 +123,4 @@ const debug = (logger, ...args) => {
 	}
 };
 
-export { debug, global, migrate, express, access, nginx, ssl, certbot, importer, setup, ipRanges };
+export { debug, global, migrate, express, access, nginx, ssl, certbot, importer, setup, ipRanges, remoteVersion };

backend/migrate.js

@@ -2,9 +2,9 @@ import db from "./db.js";
 import { migrate as logger } from "./logger.js";
 
 const migrateUp = async () => {
-	const version = await db.migrate.currentVersion();
+	const version = await db().migrate.currentVersion();
 	logger.info("Current database version:", version);
-	return await db.migrate.latest({
+	return await db().migrate.latest({
 		tableName: "migrations",
 		directory: "migrations",
 	});

backend/migrations/20190227065017_settings.js

@@ -13,12 +13,13 @@ const migrateName = "settings";
 const up = (knex) => {
 	logger.info(`[${migrateName}] Migrating Up...`);
 
-	return knex.schema.createTable('setting', (table) => {
-		table.string('id').notNull().primary();
-		table.string('name', 100).notNull();
-		table.string('description', 255).notNull();
-		table.string('value', 255).notNull();
-		table.json('meta').notNull();
+	return knex.schema
+		.createTable("setting", (table) => {
+			table.string("id").notNull().primary();
+			table.string("name", 100).notNull();
+			table.string("description", 255).notNull();
+			table.string("value", 255).notNull();
+			table.json("meta").notNull();
 		})
 		.then(() => {
 			logger.info(`[${migrateName}] setting Table created`);

backend/migrations/20251111090000_redirect_auto_scheme.js

@@ -0,0 +1,46 @@
+import { migrate as logger } from "../logger.js";
+
+const migrateName = "redirect_auto_scheme";
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object} knex
+ * @returns {Promise}
+ */
+const up = (knex) => {
+	logger.info(`[${migrateName}] Migrating Up...`);
+
+	return knex.schema
+		.table("redirection_host", async (table) => {
+			// change the column default from $scheme to auto
+			await table.string("forward_scheme").notNull().defaultTo("auto").alter();
+			await knex("redirection_host").where("forward_scheme", "$scheme").update({ forward_scheme: "auto" });
+		})
+		.then(() => {
+			logger.info(`[${migrateName}] redirection_host Table altered`);
+		});
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object} knex
+ * @returns {Promise}
+ */
+const down = (knex) => {
+	logger.info(`[${migrateName}] Migrating Down...`);
+
+	return knex.schema
+		.table("redirection_host", async (table) => {
+			await table.string("forward_scheme").notNull().defaultTo("$scheme").alter();
+			await knex("redirection_host").where("forward_scheme", "auto").update({ forward_scheme: "$scheme" });
+		})
+		.then(() => {
+			logger.info(`[${migrateName}] redirection_host Table altered`);
+		});
+};
+
+export { up, down };

backend/migrations/20260131163528_trust_forwarded_proto.js

@@ -0,0 +1,43 @@
+import { migrate as logger } from "../logger.js";
+
+const migrateName = "trust_forwarded_proto";
+
+/**
+ * Migrate
+ *
+ * @see http://knexjs.org/#Schema
+ *
+ * @param   {Object} knex
+ * @returns {Promise}
+ */
+const up = (knex) => {
+	logger.info(`[${migrateName}] Migrating Up...`);
+
+	return knex.schema
+		.alterTable("proxy_host", (table) => {
+			table.tinyint("trust_forwarded_proto").notNullable().defaultTo(0);
+		})
+		.then(() => {
+			logger.info(`[${migrateName}] proxy_host Table altered`);
+		});
+};
+
+/**
+ * Undo Migrate
+ *
+ * @param   {Object} knex
+ * @returns {Promise}
+ */
+const down = (knex) => {
+	logger.info(`[${migrateName}] Migrating Down...`);
+
+	return knex.schema
+		.alterTable("proxy_host", (table) => {
+			table.dropColumn("trust_forwarded_proto");
+		})
+		.then(() => {
+			logger.info(`[${migrateName}] proxy_host Table altered`);
+		});
+};
+
+export { up, down };

backend/models/access_list.js

@@ -10,7 +10,7 @@ import now from "./now_helper.js";
 import ProxyHostModel from "./proxy_host.js";
 import User from "./user.js";
 
-Model.knex(db);
+Model.knex(db());
 
 const boolFields = ["is_deleted", "satisfy_any", "pass_auth"];
 
@@ -31,6 +31,10 @@ class AccessList extends Model {
 
 	$parseDatabaseJson(json) {
 		const thisJson = super.$parseDatabaseJson(json);
+		// Postgres returns COUNT() as a string
+		if (typeof thisJson.proxy_host_count === "string") {
+			thisJson.proxy_host_count = Number.parseInt(thisJson.proxy_host_count, 10);
+		}
 		return convertIntFieldsToBool(thisJson, boolFields);
 	}
 

backend/models/access_list_auth.js

@@ -6,7 +6,7 @@ import db from "../db.js";
 import accessListModel from "./access_list.js";
 import now from "./now_helper.js";
 
-Model.knex(db);
+Model.knex(db());
 
 class AccessListAuth extends Model {
 	$beforeInsert() {

backend/models/access_list_client.js

@@ -6,7 +6,7 @@ import db from "../db.js";
 import accessListModel from "./access_list.js";
 import now from "./now_helper.js";
 
-Model.knex(db);
+Model.knex(db());
 
 class AccessListClient extends Model {
 	$beforeInsert() {

backend/models/audit-log.js

@@ -6,7 +6,7 @@ import db from "../db.js";
 import now from "./now_helper.js";
 import User from "./user.js";
 
-Model.knex(db);
+Model.knex(db());
 
 class AuditLog extends Model {
 	$beforeInsert() {

backend/models/auth.js

@@ -8,7 +8,7 @@ import { convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.j
 import now from "./now_helper.js";
 import User from "./user.js";
 
-Model.knex(db);
+Model.knex(db());
 
 const boolFields = ["is_deleted"];
 

backend/models/certificate.js

@@ -11,10 +11,20 @@ import redirectionHostModel from "./redirection_host.js";
 import streamModel from "./stream.js";
 import userModel from "./user.js";
 
-Model.knex(db);
+Model.knex(db());
 
 const boolFields = ["is_deleted"];
 
+const cleanDomainNames = (domainNames) => {
+	// Sort domain_names
+	if (typeof domainNames !== "undefined") {
+		const newDomainNames = domainNames.filter((name) => name != null);
+		newDomainNames.sort();
+		return newDomainNames;
+	}
+	return [];
+};
+
 class Certificate extends Model {
 	$beforeInsert() {
 		this.created_on = now();
@@ -26,7 +36,9 @@ class Certificate extends Model {
 		}
 
 		// Default for domain_names
-		if (typeof this.domain_names === "undefined") {
+		if (typeof this.domain_names !== "undefined") {
+			this.domain_names = cleanDomainNames(this.domain_names);
+		} else {
 			this.domain_names = [];
 		}
 
@@ -34,16 +46,12 @@ class Certificate extends Model {
 		if (typeof this.meta === "undefined") {
 			this.meta = {};
 		}
-
-		this.domain_names.sort();
 	}
 
 	$beforeUpdate() {
 		this.modified_on = now();
-
-		// Sort domain_names
 		if (typeof this.domain_names !== "undefined") {
-			this.domain_names.sort();
+			this.domain_names = cleanDomainNames(this.domain_names);
 		}
 	}
 

backend/models/dead_host.js

@@ -3,12 +3,12 @@
 
 import { Model } from "objection";
 import db from "../db.js";
-import { convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.js";
+import { castJsonIfNeed, convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.js";
 import Certificate from "./certificate.js";
 import now from "./now_helper.js";
 import User from "./user.js";
 
-Model.knex(db);
+Model.knex(db());
 
 const boolFields = ["is_deleted", "ssl_forced", "http2_support", "enabled", "hsts_enabled", "hsts_subdomains"];
 
@@ -61,6 +61,18 @@ class DeadHost extends Model {
 		return ["domain_names", "meta"];
 	}
 
+	static get defaultAllowGraph() {
+		return "[owner,certificate]";
+	}
+
+	static get defaultExpand() {
+		return ["certificate", "owner"];
+	}
+
+	static get defaultOrder() {
+		return [castJsonIfNeed("domain_names"), "ASC"];
+	}
+
 	static get relationMappings() {
 		return {
 			owner: {

backend/models/now_helper.js

@@ -2,7 +2,7 @@ import { Model } from "objection";
 import db from "../db.js";
 import { isSqlite } from "../lib/config.js";
 
-Model.knex(db);
+Model.knex(db());
 
 export default () => {
 	if (isSqlite()) {

backend/models/proxy_host.js

@@ -3,13 +3,13 @@
 
 import { Model } from "objection";
 import db from "../db.js";
-import { convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.js";
+import { castJsonIfNeed, convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.js";
 import AccessList from "./access_list.js";
 import Certificate from "./certificate.js";
 import now from "./now_helper.js";
 import User from "./user.js";
 
-Model.knex(db);
+Model.knex(db());
 
 const boolFields = [
 	"is_deleted",
@@ -21,6 +21,7 @@ const boolFields = [
 	"enabled",
 	"hsts_enabled",
 	"hsts_subdomains",
+	"trust_forwarded_proto",
 ];
 
 class ProxyHost extends Model {
@@ -72,6 +73,18 @@ class ProxyHost extends Model {
 		return ["domain_names", "meta", "locations"];
 	}
 
+	static get defaultAllowGraph() {
+		return "[owner,access_list.[clients,items],certificate]";
+	}
+
+	static get defaultExpand() {
+		return ["owner", "certificate", "access_list.[clients,items]"];
+	}
+
+	static get defaultOrder() {
+		return [castJsonIfNeed("domain_names"), "ASC"];
+	}
+
 	static get relationMappings() {
 		return {
 			owner: {

backend/models/redirection_host.js

@@ -3,12 +3,12 @@
 
 import { Model } from "objection";
 import db from "../db.js";
-import { convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.js";
+import { castJsonIfNeed, convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.js";
 import Certificate from "./certificate.js";
 import now from "./now_helper.js";
 import User from "./user.js";
 
-Model.knex(db);
+Model.knex(db());
 
 const boolFields = [
 	"is_deleted",
@@ -70,6 +70,18 @@ class RedirectionHost extends Model {
 		return ["domain_names", "meta"];
 	}
 
+	static get defaultAllowGraph() {
+		return "[owner,certificate]";
+	}
+
+	static get defaultExpand() {
+		return ["certificate", "owner"];
+	}
+
+	static get defaultOrder() {
+		return [castJsonIfNeed("domain_names"), "ASC"];
+	}
+
 	static get relationMappings() {
 		return {
 			owner: {

backend/models/setting.js

@@ -4,26 +4,26 @@
 import { Model } from "objection";
 import db from "../db.js";
 
-Model.knex(db);
+Model.knex(db());
 
 class Setting extends Model {
 	$beforeInsert() {
 		// Default for meta
-		if (typeof this.meta === 'undefined') {
+		if (typeof this.meta === "undefined") {
 			this.meta = {};
 		}
 	}
 
 	static get name() {
-		return 'Setting';
+		return "Setting";
 	}
 
 	static get tableName() {
-		return 'setting';
+		return "setting";
 	}
 
 	static get jsonAttributes() {
-		return ['meta'];
+		return ["meta"];
 	}
 }
 

backend/models/stream.js

@@ -1,11 +1,11 @@
 import { Model } from "objection";
 import db from "../db.js";
-import { convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.js";
+import { castJsonIfNeed, convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.js";
 import Certificate from "./certificate.js";
 import now from "./now_helper.js";
 import User from "./user.js";
 
-Model.knex(db);
+Model.knex(db());
 
 const boolFields = ["is_deleted", "enabled", "tcp_forwarding", "udp_forwarding"];
 
@@ -46,6 +46,18 @@ class Stream extends Model {
 		return ["meta"];
 	}
 
+	static get defaultAllowGraph() {
+		return "[owner,certificate]";
+	}
+
+	static get defaultExpand() {
+		return ["certificate", "owner"];
+	}
+
+	static get defaultOrder() {
+		return [castJsonIfNeed("incoming_port"), "ASC"];
+	}
+
 	static get relationMappings() {
 		return {
 			owner: {

backend/models/user.js

@@ -7,7 +7,7 @@ import { convertBoolFieldsToInt, convertIntFieldsToBool } from "../lib/helpers.j
 import now from "./now_helper.js";
 import UserPermission from "./user_permission.js";
 
-Model.knex(db);
+Model.knex(db());
 
 const boolFields = ["is_deleted", "is_disabled"];
 

backend/models/user_permission.js

@@ -5,7 +5,7 @@ import { Model } from "objection";
 import db from "../db.js";
 import now from "./now_helper.js";
 
-Model.knex(db);
+Model.knex(db());
 
 class UserPermission extends Model {
 	$beforeInsert() {
@@ -18,11 +18,11 @@ class UserPermission extends Model {
 	}
 
 	static get name() {
-		return 'UserPermission';
+		return "UserPermission";
 	}
 
 	static get tableName() {
-		return 'user_permission';
+		return "user_permission";
 	}
 }
 

backend/package.json

@@ -9,39 +9,42 @@
 	"scripts": {
 		"lint": "biome lint",
 		"prettier": "biome format --write .",
-		"validate-schema": "node validate-schema.js"
+		"validate-schema": "node validate-schema.js",
+		"regenerate-config": "node scripts/regenerate-config"
 	},
 	"dependencies": {
-		"@apidevtools/json-schema-ref-parser": "^11.7.0",
-		"ajv": "^8.17.1",
-		"archiver": "^5.3.0",
+		"@apidevtools/json-schema-ref-parser": "^16.0.2",
+		"ajv": "^8.20.0",
+		"archiver": "^8.0.0",
 		"batchflow": "^0.4.0",
-		"bcrypt": "^5.0.0",
-		"body-parser": "^1.20.3",
-		"compression": "^1.7.4",
-		"express": "^4.20.0",
+		"bcrypt": "^6.0.0",
+		"better-sqlite3": "^13.0.3",
+		"body-parser": "^2.3.0",
+		"chalk": "5.6.2",
+		"compression": "^1.8.2",
+		"express": "^5.2.1",
 		"express-fileupload": "^1.5.2",
 		"gravatar": "^1.8.2",
-		"jsonwebtoken": "^9.0.2",
-		"knex": "2.4.2",
-		"liquidjs": "10.6.1",
-		"lodash": "^4.17.21",
-		"moment": "^2.30.1",
-		"mysql2": "^3.15.3",
-		"node-rsa": "^1.1.1",
-		"objection": "3.0.1",
+		"jsonwebtoken": "^9.0.3",
+		"knex": "3.3.0",
+		"liquidjs": "10.29.0",
+		"lodash": "^4.18.1",
+		"moment": "^2.31.0",
+		"mysql2": "^3.24.4",
+		"node-rsa": "^2.0.0",
+		"objection": "3.1.5",
+		"otplib": "^13.5.0",
 		"path": "^0.12.7",
-		"pg": "^8.16.3",
-		"proxy-agent": "^6.5.0",
+		"pg": "^8.23.0",
+		"proxy-agent": "^8.0.2",
 		"signale": "1.4.0",
-		"sqlite3": "^5.1.7",
-		"temp-write": "^4.0.0"
+		"sqlite3": "^6.0.1",
+		"temp-write": "^6.0.1"
 	},
 	"devDependencies": {
-		"@apidevtools/swagger-parser": "^10.1.0",
-		"@biomejs/biome": "^2.3.2",
-		"chalk": "4.1.2",
-		"nodemon": "^2.0.2"
+		"@apidevtools/swagger-parser": "^13.0.0",
+		"@biomejs/biome": "^2.5.10",
+		"nodemon": "^3.1.14"
 	},
 	"signale": {
 		"displayDate": true,

backend/routes/audit-log.js

@@ -86,10 +86,7 @@ router
 				},
 				{
 					event_id: req.params.event_id,
-					expand:
-						typeof req.query.expand === "string"
-							? req.query.expand.split(",")
-							: null,
+					expand: typeof req.query.expand === "string" ? req.query.expand.split(",") : null,
 				},
 			);
 

backend/routes/ci.js

@@ -0,0 +1,59 @@
+import express from "express";
+import dnsPlugins from "../certbot/dns-plugins.json" with { type: "json" };
+import { installPlugin } from "../lib/certbot.js";
+import { debug, express as logger } from "../logger.js";
+
+const router = express.Router({
+	caseSensitive: true,
+	strict: true,
+	mergeParams: true,
+});
+
+/**
+ * ONLY AVAILABLE IN CI ENVIRONMENT!
+ */
+
+/**
+ * /api/ci/certbot-plugins
+ */
+router
+	.route("/certbot-plugins")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+
+	// Return all certbot plugins
+	.get(async (_req, res, _next) => {
+		res.status(200).send(dnsPlugins);
+	});
+
+/**
+ * /api/ci/certbot-plugins/{plugin}
+ */
+router
+	.route("/certbot-plugins/:plugin")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+
+	// Install a certbot plugin
+	.post(async (req, res, next) => {
+		try {
+			const pluginName = req.params.plugin;
+			// check if plugin exists
+			if (!dnsPlugins[pluginName]) {
+				return res.status(404).send({
+					error: "Plugin not found",
+				});
+			}
+
+			await installPlugin(pluginName);
+			res.status(200).send(true);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+		return;
+	});
+
+export default router;

backend/routes/logs.js

@@ -0,0 +1,106 @@
+import express from "express";
+import internalLogViewer from "../internal/log-viewer.js";
+import jwtdecode from "../lib/express/jwt-decode.js";
+import validator from "../lib/validator/index.js";
+import { debug, express as logger } from "../logger.js";
+
+const router = express.Router({
+	caseSensitive: true,
+	strict: true,
+	mergeParams: true,
+});
+
+/**
+ * /api/logs/sources
+ */
+router
+	.route("/sources")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+	.all(jwtdecode())
+
+	/**
+	 * GET /api/logs/sources
+	 *
+	 * Lists the log sources available for the log viewer
+	 */
+	.get(async (req, res, next) => {
+		try {
+			const data = await internalLogViewer.listSources(res.locals.access);
+			res.status(200).send(data);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	});
+
+/**
+ * /api/logs/tail
+ */
+router
+	.route("/tail")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+	.all(jwtdecode())
+
+	/**
+	 * GET /api/logs/tail
+	 *
+	 * Retrieve the last N lines of a log source
+	 */
+	.get(async (req, res, next) => {
+		try {
+			const data = await validator(
+				{
+					required: ["type"],
+					additionalProperties: false,
+					properties: {
+						type: {
+							type: "string",
+							enum: ["system", "letsencrypt", "host"],
+						},
+						host_type: {
+							anyOf: [{ type: "null" }, { type: "string", enum: ["proxy", "redirection", "dead", "stream"] }],
+						},
+						host_id: {
+							anyOf: [{ type: "null" }, { type: "integer", minimum: 1 }],
+						},
+						channel: {
+							anyOf: [{ type: "null" }, { type: "string", enum: ["access", "error"] }],
+						},
+						lines: {
+							anyOf: [{ type: "null" }, { type: "integer", minimum: 1, maximum: 1000 }],
+						},
+						level: {
+							anyOf: [
+								{ type: "null" },
+								{ type: "string", enum: ["INFO", "WARN", "ERROR", "DEBUG", "SUCCESS", "FATAL", "COMPLETE"] },
+							],
+						},
+						search: {
+							anyOf: [{ type: "null" }, { type: "string", minLength: 1, maxLength: 200 }],
+						},
+					},
+				},
+				{
+					type: req.query.type,
+					host_type: typeof req.query.host_type === "string" ? req.query.host_type : null,
+					host_id: typeof req.query.host_id !== "undefined" ? req.query.host_id : null,
+					channel: typeof req.query.channel === "string" ? req.query.channel : null,
+					lines: typeof req.query.lines !== "undefined" ? req.query.lines : null,
+					level: typeof req.query.level === "string" ? req.query.level : null,
+					search: typeof req.query.search === "string" ? req.query.search : null,
+				},
+			);
+
+			const result = await internalLogViewer.tail(res.locals.access, data);
+			res.status(200).send(result);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	});
+
+export default router;

backend/routes/main.js

@@ -1,8 +1,12 @@
 import express from "express";
+import { isCI } from "../lib/config.js";
 import errs from "../lib/error.js";
+import logRequest from "../lib/express/log-request.js";
 import pjson from "../package.json" with { type: "json" };
 import { isSetup } from "../setup.js";
 import auditLogRoutes from "./audit-log.js";
+import ciRoutes from "./ci.js";
+import logsRoutes from "./logs.js";
 import accessListsRoutes from "./nginx/access_lists.js";
 import certificatesHostsRoutes from "./nginx/certificates.js";
 import deadHostsRoutes from "./nginx/dead_hosts.js";
@@ -14,6 +18,7 @@ import schemaRoutes from "./schema.js";
 import settingsRoutes from "./settings.js";
 import tokensRoutes from "./tokens.js";
 import usersRoutes from "./users.js";
+import versionRoutes from "./version.js";
 
 const router = express.Router({
 	caseSensitive: true,
@@ -21,6 +26,8 @@ const router = express.Router({
 	mergeParams: true,
 });
 
+router.use(logRequest);
+
 /**
  * Health Check
  * GET /api
@@ -44,8 +51,10 @@ router.use("/schema", schemaRoutes);
 router.use("/tokens", tokensRoutes);
 router.use("/users", usersRoutes);
 router.use("/audit-log", auditLogRoutes);
+router.use("/logs", logsRoutes);
 router.use("/reports", reportsRoutes);
 router.use("/settings", settingsRoutes);
+router.use("/version", versionRoutes);
 router.use("/nginx/proxy-hosts", proxyHostsRoutes);
 router.use("/nginx/redirection-hosts", redirectionHostsRoutes);
 router.use("/nginx/dead-hosts", deadHostsRoutes);
@@ -53,6 +62,11 @@ router.use("/nginx/streams", streamsRoutes);
 router.use("/nginx/access-lists", accessListsRoutes);
 router.use("/nginx/certificates", certificatesHostsRoutes);
 
+// Only include CI routes if we're in a CI environment
+if (isCI()) {
+	router.use("/ci", ciRoutes);
+}
+
 /**
  * API 404 for all other routes
  *

backend/routes/nginx/certificates.js

@@ -44,18 +44,11 @@ router
 					},
 				},
 				{
-					expand:
-						typeof req.query.expand === "string"
-							? req.query.expand.split(",")
-							: null,
+					expand: typeof req.query.expand === "string" ? req.query.expand.split(",") : null,
 					query: typeof req.query.query === "string" ? req.query.query : null,
 				},
 			);
-			const rows = await internalCertificate.getAll(
-				res.locals.access,
-				data.expand,
-				data.query,
-			);
+			const rows = await internalCertificate.getAll(res.locals.access, data.expand, data.query);
 			res.status(200).send(rows);
 		} catch (err) {
 			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
@@ -70,15 +63,9 @@ router
 	 */
 	.post(async (req, res, next) => {
 		try {
-			const payload = await apiValidator(
-				getValidationSchema("/nginx/certificates", "post"),
-				req.body,
-			);
+			const payload = await apiValidator(getValidationSchema("/nginx/certificates", "post"), req.body);
 			req.setTimeout(900000); // 15 minutes timeout
-			const result = await internalCertificate.create(
-				res.locals.access,
-				payload,
-			);
+			const result = await internalCertificate.create(res.locals.access, payload);
 			res.status(201).send(result);
 		} catch (err) {
 			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
@@ -139,16 +126,10 @@ router
 	 */
 	.post(async (req, res, next) => {
 		try {
-			const payload = await apiValidator(
-				getValidationSchema("/nginx/certificates/test-http", "post"),
-				req.body,
-			);
+			const payload = await apiValidator(getValidationSchema("/nginx/certificates/test-http", "post"), req.body);
 			req.setTimeout(60000); // 1 minute timeout
 
-			const result = await internalCertificate.testHttpsChallenge(
-				res.locals.access,
-				payload,
-			);
+			const result = await internalCertificate.testHttpsChallenge(res.locals.access, payload);
 			res.status(200).send(result);
 		} catch (err) {
 			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
@@ -224,10 +205,7 @@ router
 				},
 				{
 					certificate_id: req.params.certificate_id,
-					expand:
-						typeof req.query.expand === "string"
-							? req.query.expand.split(",")
-							: null,
+					expand: typeof req.query.expand === "string" ? req.query.expand.split(",") : null,
 				},
 			);
 			const row = await internalCertificate.get(res.locals.access, {

backend/routes/nginx/dead_hosts.js

@@ -194,9 +194,11 @@ router
 	/**
 	 * POST /api/nginx/dead-hosts/123/disable
 	 */
-	.post((req, res, next) => {
+	.post(async (req, res, next) => {
 		try {
-			const result = internalDeadHost.disable(res.locals.access, { id: Number.parseInt(req.params.host_id, 10) });
+			const result = await internalDeadHost.disable(res.locals.access, {
+				id: Number.parseInt(req.params.host_id, 10),
+			});
 			res.status(200).send(result);
 		} catch (err) {
 			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);

backend/routes/nginx/proxy_hosts.js

@@ -1,4 +1,5 @@
 import express from "express";
+import fs from "node:fs";
 import internalProxyHost from "../../internal/proxy-host.js";
 import jwtdecode from "../../lib/express/jwt-decode.js";
 import apiValidator from "../../lib/validator/api.js";
@@ -206,4 +207,70 @@ router
 		}
 	});
 
+/**
+ * Proxy-host logs
+ *
+ * /api/nginx/proxy-hosts/123/logs
+ */
+router
+	.route("/:host_id/logs")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+	.all(jwtdecode())
+
+	/**
+	 * GET /api/nginx/proxy-hosts/123/logs
+	 *
+	 * Retrieve logs for a specific proxy-host
+	 */
+	.get(async (req, res, next) => {
+		try {
+			const data = await validator(
+				{
+					required: ["host_id"],
+					additionalProperties: false,
+					properties: {
+						host_id: {
+							$ref: "common#/properties/id",
+						},
+						type: {
+							type: "string",
+							enum: ["access", "error"],
+						},
+					},
+				},
+				{
+					host_id: req.params.host_id,
+					type: req.query.type || "access",
+				},
+			);
+
+			const hostId = Number.parseInt(data.host_id, 10);
+			const logType = data.type === "error" ? "error" : "access";
+			const logFile = `/data/logs/proxy-host-${hostId}_${logType}.log`;
+
+			// Check access permission
+			await res.locals.access.can("proxy_hosts:get", hostId);
+
+			let logs = "";
+			if (fs.existsSync(logFile)) {
+				const content = fs.readFileSync(logFile, { encoding: "utf8" });
+				const lines = content.split("\n");
+				// Return last 1000 lines to avoid huge payloads
+				const maxLines = 1000;
+				if (lines.length > maxLines) {
+					logs = lines.slice(-maxLines).join("\n");
+				} else {
+					logs = content;
+				}
+			}
+
+			res.status(200).send({ logs });
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	});
+
 export default router;

backend/routes/schema.js

@@ -18,7 +18,7 @@ router
 	/**
 	 * GET /schema
 	 */
-	.get(async (req, res) => {
+	.get(async (req, res, next) => {
 		try {
 			const swaggerJSON = await getCompiledSchema();
 

backend/routes/tokens.js

@@ -53,4 +53,26 @@ router
 		}
 	});
 
+router
+	.route("/2fa")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+
+	/**
+	 * POST /tokens/2fa
+	 *
+	 * Verify 2FA code and get full token
+	 */
+	.post(async (req, res, next) => {
+		try {
+			const { challenge_token, code } = await apiValidator(getValidationSchema("/tokens/2fa", "post"), req.body);
+			const result = await internalToken.verify2FA(challenge_token, code);
+			res.status(200).send(result);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	});
+
 export default router;

backend/routes/users.js

@@ -1,4 +1,5 @@
 import express from "express";
+import internal2FA from "../internal/2fa.js";
 import internalUser from "../internal/user.js";
 import Access from "../lib/access.js";
 import { isCI } from "../lib/config.js";
@@ -47,18 +48,11 @@ router
 					},
 				},
 				{
-					expand:
-						typeof req.query.expand === "string"
-							? req.query.expand.split(",")
-							: null,
+					expand: typeof req.query.expand === "string" ? req.query.expand.split(",") : null,
 					query: typeof req.query.query === "string" ? req.query.query : null,
 				},
 			);
-			const users = await internalUser.getAll(
-				res.locals.access,
-				data.expand,
-				data.query,
-			);
+			const users = await internalUser.getAll(res.locals.access, data.expand, data.query);
 			res.status(200).send(users);
 		} catch (err) {
 			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
@@ -94,10 +88,7 @@ router
 				}
 			}
 
-			const payload = await apiValidator(
-				getValidationSchema("/users", "post"),
-				body,
-			);
+			const payload = await apiValidator(getValidationSchema("/users", "post"), body);
 			const user = await internalUser.create(res.locals.access, payload);
 			res.status(201).send(user);
 		} catch (err) {
@@ -168,20 +159,14 @@ router
 				},
 				{
 					user_id: req.params.user_id,
-					expand:
-						typeof req.query.expand === "string"
-							? req.query.expand.split(",")
-							: null,
+					expand: typeof req.query.expand === "string" ? req.query.expand.split(",") : null,
 				},
 			);
 
 			const user = await internalUser.get(res.locals.access, {
 				id: data.user_id,
 				expand: data.expand,
-				omit: internalUser.getUserOmisionsByAccess(
-					res.locals.access,
-					data.user_id,
-				),
+				omit: internalUser.getUserOmisionsByAccess(res.locals.access, data.user_id),
 			});
 			res.status(200).send(user);
 		} catch (err) {
@@ -197,10 +182,7 @@ router
 	 */
 	.put(async (req, res, next) => {
 		try {
-			const payload = await apiValidator(
-				getValidationSchema("/users/{userID}", "put"),
-				req.body,
-			);
+			const payload = await apiValidator(getValidationSchema("/users/{userID}", "put"), req.body);
 			payload.id = req.params.user_id;
 			const result = await internalUser.update(res.locals.access, payload);
 			res.status(200).send(result);
@@ -247,10 +229,7 @@ router
 	 */
 	.put(async (req, res, next) => {
 		try {
-			const payload = await apiValidator(
-				getValidationSchema("/users/{userID}/auth", "put"),
-				req.body,
-			);
+			const payload = await apiValidator(getValidationSchema("/users/{userID}/auth", "put"), req.body);
 			payload.id = req.params.user_id;
 			const result = await internalUser.setPassword(res.locals.access, payload);
 			res.status(200).send(result);
@@ -280,15 +259,9 @@ router
 	 */
 	.put(async (req, res, next) => {
 		try {
-			const payload = await apiValidator(
-				getValidationSchema("/users/{userID}/permissions", "put"),
-				req.body,
-			);
+			const payload = await apiValidator(getValidationSchema("/users/{userID}/permissions", "put"), req.body);
 			payload.id = req.params.user_id;
-			const result = await internalUser.setPermissions(
-				res.locals.access,
-				payload,
-			);
+			const result = await internalUser.setPermissions(res.locals.access, payload);
 			res.status(200).send(result);
 		} catch (err) {
 			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
@@ -325,4 +298,127 @@ router
 		}
 	});
 
+/**
+ * User 2FA status
+ *
+ * /api/users/123/2fa
+ */
+router
+	.route("/:user_id/2fa")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+	.all(jwtdecode())
+	.all(userIdFromMe)
+
+	/**
+	 * POST /api/users/123/2fa
+	 *
+	 * Start 2FA setup, returns QR code URL
+	 */
+	.post(async (req, res, next) => {
+		try {
+			const result = await internal2FA.startSetup(res.locals.access, req.params.user_id);
+			res.status(200).send(result);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	})
+
+	/**
+	 * GET /api/users/123/2fa
+	 *
+	 * Get 2FA status for a user
+	 */
+	.get(async (req, res, next) => {
+		try {
+			const status = await internal2FA.getStatus(res.locals.access, req.params.user_id);
+			res.status(200).send(status);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	})
+
+	/**
+	 * DELETE /api/users/123/2fa?code=XXXXXX
+	 *
+	 * Disable 2FA for a user
+	 */
+	.delete(async (req, res, next) => {
+		try {
+			const code = typeof req.query.code === "string" ? req.query.code : null;
+			if (!code) {
+				throw new errs.ValidationError("Missing required parameter: code");
+			}
+			await internal2FA.disable(res.locals.access, req.params.user_id, code);
+			res.status(200).send(true);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	});
+
+/**
+ * User 2FA enable
+ *
+ * /api/users/123/2fa/enable
+ */
+router
+	.route("/:user_id/2fa/enable")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+	.all(jwtdecode())
+	.all(userIdFromMe)
+
+	/**
+	 * POST /api/users/123/2fa/enable
+	 *
+	 * Verify code and enable 2FA
+	 */
+	.post(async (req, res, next) => {
+		try {
+			const { code } = await apiValidator(getValidationSchema("/users/{userID}/2fa/enable", "post"), req.body);
+			const result = await internal2FA.enable(res.locals.access, req.params.user_id, code);
+			res.status(200).send(result);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	});
+
+/**
+ * User 2FA backup codes
+ *
+ * /api/users/123/2fa/backup-codes
+ */
+router
+	.route("/:user_id/2fa/backup-codes")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+	.all(jwtdecode())
+	.all(userIdFromMe)
+
+	/**
+	 * POST /api/users/123/2fa/backup-codes
+	 *
+	 * Regenerate backup codes
+	 */
+	.post(async (req, res, next) => {
+		try {
+			const { code } = await apiValidator(
+				getValidationSchema("/users/{userID}/2fa/backup-codes", "post"),
+				req.body,
+			);
+			const result = await internal2FA.regenerateBackupCodes(res.locals.access, req.params.user_id, code);
+			res.status(200).send(result);
+		} catch (err) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${err}`);
+			next(err);
+		}
+	});
+
 export default router;

backend/routes/version.js

@@ -0,0 +1,40 @@
+import express from "express";
+import internalRemoteVersion from "../internal/remote-version.js";
+import { debug, express as logger } from "../logger.js";
+
+const router = express.Router({
+	caseSensitive: true,
+	strict: true,
+	mergeParams: true,
+});
+
+/**
+ * /api/version/check
+ */
+router
+	.route("/check")
+	.options((_, res) => {
+		res.sendStatus(204);
+	})
+
+	/**
+	 * GET /api/version/check
+	 *
+	 * Check for available updates
+	 */
+	.get(async (req, res, _next) => {
+		try {
+			const data = await internalRemoteVersion.get();
+			res.status(200).send(data);
+		} catch (error) {
+			debug(logger, `${req.method.toUpperCase()} ${req.path}: ${error}`);
+			// Send 200 even though there's an error to avoid triggering update checks repeatedly
+			res.status(200).send({
+				current: null,
+				latest: null,
+				update_available: false,
+			});
+		}
+	});
+
+export default router;

backend/schema/components/certificate-object.json

@@ -71,6 +71,11 @@
 				"propagation_seconds": {
 					"type": "integer",
 					"minimum": 0
+				},
+				"key_type": {
+					"type": "string",
+					"enum": ["rsa", "ecdsa"],
+					"default": "rsa"
 				}
 			},
 			"example": {

backend/schema/components/check-version-object.json

@@ -0,0 +1,23 @@
+{
+	"type": "object",
+	"description": "Check Version object",
+	"additionalProperties": false,
+	"required": ["current", "latest", "update_available"],
+	"properties": {
+		"current": {
+			"type": ["string", "null"],
+			"description": "Current version string",
+			"example": "v2.10.1"
+		},
+		"latest": {
+			"type": ["string", "null"],
+			"description": "Latest version string",
+			"example": "v2.13.4"
+		},
+		"update_available": {
+			"type": "boolean",
+			"description": "Whether there's an update available",
+			"example": true
+		}
+	}
+}

backend/schema/components/log-sources-object.json

@@ -0,0 +1,69 @@
+{
+	"type": "object",
+	"description": "Available log sources for the log viewer",
+	"required": ["system", "letsencrypt", "hosts"],
+	"additionalProperties": false,
+	"properties": {
+		"system": {
+			"type": "object",
+			"properties": {
+				"label": {
+					"type": "string",
+					"example": "System"
+				}
+			}
+		},
+		"letsencrypt": {
+			"type": "object",
+			"properties": {
+				"label": {
+					"type": "string",
+					"example": "Let's Encrypt"
+				}
+			}
+		},
+		"hosts": {
+			"type": "object",
+			"required": ["proxy", "redirection", "dead", "stream"],
+			"additionalProperties": false,
+			"properties": {
+				"proxy": {
+					"$ref": "#/$defs/host-option-list"
+				},
+				"redirection": {
+					"$ref": "#/$defs/host-option-list"
+				},
+				"dead": {
+					"$ref": "#/$defs/host-option-list"
+				},
+				"stream": {
+					"$ref": "#/$defs/host-option-list"
+				}
+			},
+			"example": {
+				"proxy": [{ "id": 1, "label": "example.com" }],
+				"redirection": [],
+				"dead": [],
+				"stream": [{ "id": 1, "label": "Port 5432 → 10.0.0.5:5432" }]
+			}
+		}
+	},
+	"$defs": {
+		"host-option-list": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"required": ["id", "label"],
+				"properties": {
+					"id": {
+						"$ref": "../common.json#/properties/id"
+					},
+					"label": {
+						"type": "string",
+						"example": "example.com"
+					}
+				}
+			}
+		}
+	}
+}

backend/schema/components/log-tail-object.json

@@ -0,0 +1,30 @@
+{
+	"type": "object",
+	"description": "The last N lines of a log source",
+	"required": ["lines", "size", "truncated", "exists"],
+	"additionalProperties": false,
+	"properties": {
+		"lines": {
+			"type": "array",
+			"items": {
+				"type": "string"
+			},
+			"example": ["2026-01-01T00:00:00.000Z INFO    [Global   ] Backend PID 1 listening on port 3000 ..."]
+		},
+		"size": {
+			"type": "integer",
+			"description": "Size in bytes of the underlying log file",
+			"example": 4096
+		},
+		"truncated": {
+			"type": "boolean",
+			"description": "True when the file is larger than the maximum amount of data scanned per request",
+			"example": false
+		},
+		"exists": {
+			"type": "boolean",
+			"description": "False when the underlying log file does not exist yet",
+			"example": true
+		}
+	}
+}

backend/schema/components/proxy-host-object.json

@@ -22,7 +22,8 @@
 		"enabled",
 		"locations",
 		"hsts_enabled",
-		"hsts_subdomains"
+		"hsts_subdomains",
+		"trust_forwarded_proto"
 	],
 	"properties": {
 		"id": {
@@ -123,6 +124,9 @@
 					},
 					"advanced_config": {
 						"type": "string"
+					},
+					"access_list_id": {
+						"$ref": "../common.json#/properties/access_list_id"
 					}
 				}
 			},
@@ -131,7 +135,8 @@
 					"path": "/app",
 					"forward_scheme": "http",
 					"forward_host": "example.com",
-					"forward_port": 80
+					"forward_port": 80,
+					"access_list_id": 0
 				}
 			]
 		},
@@ -141,6 +146,11 @@
 		"hsts_subdomains": {
 			"$ref": "../common.json#/properties/hsts_subdomains"
 		},
+		"trust_forwarded_proto":{
+			"type": "boolean",
+			"description": "Trust the forwarded headers",
+			"example": false
+		},
 		"certificate": {
 			"oneOf": [
 				{

backend/schema/components/stream-object.json

@@ -44,7 +44,7 @@
 				},
 				{
 					"type": "string",
-					"format": "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}$"
+					"pattern": "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}$"
 				},
 				{
 					"type": "string",

backend/schema/components/token-challenge.json

@@ -0,0 +1,18 @@
+{
+	"type": "object",
+	"description": "Token object",
+	"required": ["requires_2fa", "challenge_token"],
+	"additionalProperties": false,
+	"properties": {
+		"requires_2fa": {
+			"description": "Whether this token request requires two-factor authentication",
+			"example": true,
+			"type": "boolean"
+		},
+		"challenge_token": {
+			"description": "Challenge Token used in subsequent 2FA verification",
+			"example": "eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.ey...xaHKYr3Kk6MvkUjcC4",
+			"type": "string"
+		}
+	}
+}

backend/schema/paths/logs/sources/get.json

@@ -0,0 +1,36 @@
+{
+	"operationId": "getLogSources",
+	"summary": "Get available log sources",
+	"tags": ["logs"],
+	"security": [
+		{
+			"bearerAuth": ["admin"]
+		}
+	],
+	"responses": {
+		"200": {
+			"description": "200 response",
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": {
+								"system": { "label": "System" },
+								"letsencrypt": { "label": "Let's Encrypt" },
+								"hosts": {
+									"proxy": [{ "id": 1, "label": "example.com" }],
+									"redirection": [],
+									"dead": [],
+									"stream": [{ "id": 1, "label": "Port 5432 → 10.0.0.5:5432" }]
+								}
+							}
+						}
+					},
+					"schema": {
+						"$ref": "../../../components/log-sources-object.json"
+					}
+				}
+			}
+		}
+	}
+}

backend/schema/paths/logs/tail/get.json

@@ -0,0 +1,100 @@
+{
+	"operationId": "getLogTail",
+	"summary": "Get the last N lines of a log source",
+	"tags": ["logs"],
+	"security": [
+		{
+			"bearerAuth": ["admin"]
+		}
+	],
+	"parameters": [
+		{
+			"in": "query",
+			"name": "type",
+			"required": true,
+			"description": "Which log source to read",
+			"schema": {
+				"type": "string",
+				"enum": ["system", "letsencrypt", "host"]
+			}
+		},
+		{
+			"in": "query",
+			"name": "host_type",
+			"description": "Required when type=host",
+			"schema": {
+				"type": "string",
+				"enum": ["proxy", "redirection", "dead", "stream"]
+			}
+		},
+		{
+			"in": "query",
+			"name": "host_id",
+			"description": "Required when type=host",
+			"schema": {
+				"type": "integer",
+				"minimum": 1
+			}
+		},
+		{
+			"in": "query",
+			"name": "channel",
+			"description": "Required when type=host - which log file to read (not to be confused with host_type=stream)",
+			"schema": {
+				"type": "string",
+				"enum": ["access", "error"]
+			}
+		},
+		{
+			"in": "query",
+			"name": "lines",
+			"description": "Number of lines to return from the end of the file",
+			"schema": {
+				"type": "integer",
+				"minimum": 1,
+				"maximum": 1000,
+				"default": 200
+			}
+		},
+		{
+			"in": "query",
+			"name": "level",
+			"description": "Only applicable to type=system",
+			"schema": {
+				"type": "string",
+				"enum": ["INFO", "WARN", "ERROR", "DEBUG", "SUCCESS", "FATAL", "COMPLETE"]
+			}
+		},
+		{
+			"in": "query",
+			"name": "search",
+			"description": "Case-insensitive plain-text search",
+			"schema": {
+				"type": "string",
+				"maxLength": 200
+			}
+		}
+	],
+	"responses": {
+		"200": {
+			"description": "200 response",
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": {
+								"lines": ["2026-01-01T00:00:00.000Z INFO    [Global   ] Backend PID 1 listening on port 3000 ..."],
+								"size": 4096,
+								"truncated": false,
+								"exists": true
+							}
+						}
+					},
+					"schema": {
+						"$ref": "../../../components/log-tail-object.json"
+					}
+				}
+			}
+		}
+	}
+}

backend/schema/paths/nginx/proxy-hosts/get.json

@@ -58,7 +58,8 @@
 									"enabled": true,
 									"locations": [],
 									"hsts_enabled": false,
-									"hsts_subdomains": false
+									"hsts_subdomains": false,
+									"trust_forwarded_proto": false
 								}
 							]
 						}

backend/schema/paths/nginx/proxy-hosts/hostID/get.json

@@ -56,6 +56,7 @@
 								"locations": [],
 								"hsts_enabled": false,
 								"hsts_subdomains": false,
+								"trust_forwarded_proto": false,
 								"owner": {
 									"id": 1,
 									"created_on": "2025-10-28T00:50:24.000Z",

backend/schema/paths/nginx/proxy-hosts/hostID/put.json

@@ -56,6 +56,9 @@
 						"hsts_subdomains": {
 							"$ref": "../../../../components/proxy-host-object.json#/properties/hsts_subdomains"
 						},
+						"trust_forwarded_proto": {
+    						"$ref": "../../../../components/proxy-host-object.json#/properties/trust_forwarded_proto"
+						},
 						"http2_support": {
 							"$ref": "../../../../components/proxy-host-object.json#/properties/http2_support"
 						},
@@ -122,6 +125,7 @@
 								"locations": [],
 								"hsts_enabled": false,
 								"hsts_subdomains": false,
+								"trust_forwarded_proto": false,
 								"owner": {
 									"id": 1,
 									"created_on": "2025-10-28T00:50:24.000Z",

backend/schema/paths/nginx/proxy-hosts/post.json

@@ -48,6 +48,9 @@
 						"hsts_subdomains": {
 							"$ref": "../../../components/proxy-host-object.json#/properties/hsts_subdomains"
 						},
+						"trust_forwarded_proto": {
+    						"$ref": "../../../components/proxy-host-object.json#/properties/trust_forwarded_proto"
+						},
 						"http2_support": {
 							"$ref": "../../../components/proxy-host-object.json#/properties/http2_support"
 						},
@@ -119,6 +122,7 @@
 								"locations": [],
 								"hsts_enabled": false,
 								"hsts_subdomains": false,
+								"trust_forwarded_proto": false,
 								"certificate": null,
 								"owner": {
 									"id": 1,

backend/schema/paths/tokens/2fa/post.json

@@ -0,0 +1,55 @@
+{
+	"operationId": "loginWith2FA",
+	"summary": "Verify 2FA code and get full token",
+	"tags": ["tokens"],
+	"requestBody": {
+		"description": "2fa Challenge Payload",
+		"required": true,
+		"content": {
+			"application/json": {
+				"schema": {
+					"additionalProperties": false,
+					"properties": {
+						"challenge_token": {
+							"minLength": 1,
+							"type": "string",
+							"example": "eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.ey...xaHKYr3Kk6MvkUjcC4"
+						},
+						"code": {
+							"minLength": 6,
+							"maxLength": 8,
+							"type": "string",
+							"example": "012345"
+						}
+					},
+					"required": ["challenge_token", "code"],
+					"type": "object"
+				},
+				"example": {
+					"challenge_token": "eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.ey...xaHKYr3Kk6MvkUjcC4",
+					"code": "012345"
+				}
+			}
+		}
+	},
+	"responses": {
+		"200": {
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": {
+								"expires": "2025-02-04T20:40:46.340Z",
+								"token": "eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.ey...xaHKYr3Kk6MvkUjcC4"
+							}
+						}
+					},
+					"schema": {
+						"$ref": "../../../components/token-object.json"
+					}
+				}
+			},
+			"description": "200 response"
+		}
+	}
+}

backend/schema/paths/tokens/post.json

@@ -50,7 +50,14 @@
 						}
 					},
 					"schema": {
+						"oneOf": [
+							{
 								"$ref": "../../components/token-object.json"
+							},
+							{
+								"$ref": "../../components/token-challenge.json"
+							}
+						]
 					}
 				}
 			},

backend/schema/paths/users/userID/2fa/backup-codes/post.json

@@ -0,0 +1,92 @@
+{
+	"operationId": "regenUser2faCodes",
+	"summary": "Regenerate 2FA backup codes",
+	"tags": ["users"],
+	"parameters": [
+		{
+			"in": "path",
+			"name": "userID",
+			"schema": {
+				"type": "integer",
+				"minimum": 1
+			},
+			"required": true,
+			"description": "User ID",
+			"example": 2
+		}
+	],
+	"requestBody": {
+		"description": "Verification Payload",
+		"required": true,
+		"content": {
+			"application/json": {
+				"schema": {
+					"additionalProperties": false,
+					"properties": {
+						"code": {
+							"minLength": 6,
+							"maxLength": 8,
+							"type": "string",
+							"example": "123456"
+						}
+					},
+					"required": ["code"],
+					"type": "object"
+				},
+				"example": {
+					"code": "123456"
+				}
+			}
+		}
+	},
+	"responses": {
+		"200": {
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": {
+								"backup_codes": [
+									"6CD7CB06",
+									"495302F3",
+									"D8037852",
+									"A6FFC956",
+									"BC1A1851",
+									"A05E644F",
+									"A406D2E8",
+									"0AE3C522"
+								]
+							}
+						}
+					},
+					"schema": {
+						"type": "object",
+						"required": ["backup_codes"],
+						"additionalProperties": false,
+						"properties": {
+							"backup_codes": {
+								"description": "Backup codes",
+								"example": [
+									"6CD7CB06",
+									"495302F3",
+									"D8037852",
+									"A6FFC956",
+									"BC1A1851",
+									"A05E644F",
+									"A406D2E8",
+									"0AE3C522"
+								],
+								"type": "array",
+								"items": {
+									"type": "string",
+									"example": "6CD7CB06"
+								}
+							}
+						}
+					}
+				}
+			},
+			"description": "200 response"
+		}
+	}
+}

backend/schema/paths/users/userID/2fa/delete.json

@@ -0,0 +1,48 @@
+{
+	"operationId": "disableUser2fa",
+	"summary": "Disable 2fa for user",
+	"tags": ["users"],
+	"parameters": [
+		{
+			"in": "path",
+			"name": "userID",
+			"schema": {
+				"type": "integer",
+				"minimum": 1
+			},
+			"required": true,
+			"description": "User ID",
+			"example": 2
+		},
+		{
+			"in": "query",
+			"name": "code",
+			"schema": {
+				"type": "string",
+				"minLength": 6,
+				"maxLength": 6,
+				"example": "012345"
+			},
+			"required": true,
+			"description": "2fa Code",
+			"example": "012345"
+		}
+	],
+	"responses": {
+		"200": {
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": true
+						}
+					},
+					"schema": {
+						"type": "boolean"
+					}
+				}
+			},
+			"description": "200 response"
+		}
+	}
+}

backend/schema/paths/users/userID/2fa/enable/post.json

@@ -0,0 +1,92 @@
+{
+	"operationId": "enableUser2fa",
+	"summary": "Verify code and enable 2FA",
+	"tags": ["users"],
+	"parameters": [
+		{
+			"in": "path",
+			"name": "userID",
+			"schema": {
+				"type": "integer",
+				"minimum": 1
+			},
+			"required": true,
+			"description": "User ID",
+			"example": 2
+		}
+	],
+	"requestBody": {
+		"description": "Verification Payload",
+		"required": true,
+		"content": {
+			"application/json": {
+				"schema": {
+					"additionalProperties": false,
+					"properties": {
+						"code": {
+							"minLength": 6,
+							"maxLength": 8,
+							"type": "string",
+							"example": "123456"
+						}
+					},
+					"required": ["code"],
+					"type": "object"
+				},
+				"example": {
+					"code": "123456"
+				}
+			}
+		}
+	},
+	"responses": {
+		"200": {
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": {
+								"backup_codes": [
+									"6CD7CB06",
+									"495302F3",
+									"D8037852",
+									"A6FFC956",
+									"BC1A1851",
+									"A05E644F",
+									"A406D2E8",
+									"0AE3C522"
+								]
+							}
+						}
+					},
+					"schema": {
+						"type": "object",
+						"required": ["backup_codes"],
+						"additionalProperties": false,
+						"properties": {
+							"backup_codes": {
+								"description": "Backup codes",
+								"example": [
+									"6CD7CB06",
+									"495302F3",
+									"D8037852",
+									"A6FFC956",
+									"BC1A1851",
+									"A05E644F",
+									"A406D2E8",
+									"0AE3C522"
+								],
+								"type": "array",
+								"items": {
+									"type": "string",
+									"example": "6CD7CB06"
+								}
+							}
+						}
+					}
+				}
+			},
+			"description": "200 response"
+		}
+	}
+}

backend/schema/paths/users/userID/2fa/get.json

@@ -0,0 +1,57 @@
+{
+	"operationId": "getUser2faStatus",
+	"summary": "Get user 2fa Status",
+	"tags": ["users"],
+	"security": [
+		{
+			"bearerAuth": []
+		}
+	],
+	"parameters": [
+		{
+			"in": "path",
+			"name": "userID",
+			"schema": {
+				"type": "integer",
+				"minimum": 1
+			},
+			"required": true,
+			"description": "User ID",
+			"example": 2
+		}
+	],
+	"responses": {
+		"200": {
+			"description": "200 response",
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": {
+								"enabled": false,
+								"backup_codes_remaining": 0
+							}
+						}
+					},
+					"schema": {
+						"type": "object",
+						"additionalProperties": false,
+						"required": ["enabled", "backup_codes_remaining"],
+						"properties": {
+							"enabled": {
+								"type": "boolean",
+								"description": "Is 2FA enabled for this user",
+								"example": true
+							},
+							"backup_codes_remaining": {
+								"type": "integer",
+								"description": "Number of remaining backup codes for this user",
+								"example": 5
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+}

backend/schema/paths/users/userID/2fa/post.json

@@ -0,0 +1,52 @@
+{
+	"operationId": "setupUser2fa",
+	"summary": "Start 2FA setup, returns QR code URL",
+	"tags": ["users"],
+	"parameters": [
+		{
+			"in": "path",
+			"name": "userID",
+			"schema": {
+				"type": "integer",
+				"minimum": 1
+			},
+			"required": true,
+			"description": "User ID",
+			"example": 2
+		}
+	],
+	"responses": {
+		"200": {
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": {
+								"secret": "JZYCEBIEEJYUGPQM",
+								"otpauth_url": "otpauth://totp/Nginx%20Proxy%20Manager:jc%40jc21.com?secret=JZYCEBIEEJYUGPQM&period=30&digits=6&algorithm=SHA1&issuer=Nginx%20Proxy%20Manager"
+							}
+						}
+					},
+					"schema": {
+						"type": "object",
+						"required": ["secret", "otpauth_url"],
+						"additionalProperties": false,
+						"properties": {
+							"secret": {
+								"description": "TOTP Secret",
+								"example": "JZYCEBIEEJYUGPQM",
+								"type": "string"
+							},
+							"otpauth_url": {
+								"description": "OTP Auth URL for QR Code generation",
+								"example": "otpauth://totp/Nginx%20Proxy%20Manager:jc%40jc21.com?secret=JZYCEBIEEJYUGPQM&period=30&digits=6&algorithm=SHA1&issuer=Nginx%20Proxy%20Manager",
+								"type": "string"
+							}
+						}
+					}
+				}
+			},
+			"description": "200 response"
+		}
+	}
+}

backend/schema/paths/version/check/get.json

@@ -0,0 +1,26 @@
+{
+	"operationId": "checkVersion",
+	"summary": "Returns any new version data from github",
+	"tags": ["public"],
+	"responses": {
+		"200": {
+			"description": "200 response",
+			"content": {
+				"application/json": {
+					"examples": {
+						"default": {
+							"value": {
+								"current": "v2.12.0",
+								"latest": "v2.13.4",
+								"update_available": true
+							}
+						}
+					},
+					"schema": {
+						"$ref": "../../../components/check-version-object.json"
+					}
+				}
+			}
+		}
+	}
+}

backend/schema/swagger.json

@@ -24,6 +24,10 @@
 			"name": "audit-log",
 			"description": "Endpoints related to Audit Logs"
 		},
+		{
+			"name": "logs",
+			"description": "Endpoints for viewing system, Let's Encrypt and per-host logs"
+		},
 		{
 			"name": "access-lists",
 			"description": "Endpoints related to Access Lists"
@@ -81,6 +85,16 @@
 				"$ref": "./paths/audit-log/id/get.json"
 			}
 		},
+		"/logs/sources": {
+			"get": {
+				"$ref": "./paths/logs/sources/get.json"
+			}
+		},
+		"/logs/tail": {
+			"get": {
+				"$ref": "./paths/logs/tail/get.json"
+			}
+		},
 		"/nginx/access-lists": {
 			"get": {
 				"$ref": "./paths/nginx/access-lists/get.json"
@@ -293,6 +307,16 @@
 				"$ref": "./paths/tokens/post.json"
 			}
 		},
+		"/tokens/2fa": {
+			"post": {
+				"$ref": "./paths/tokens/2fa/post.json"
+			}
+		},
+		"/version/check": {
+			"get": {
+				"$ref": "./paths/version/check/get.json"
+			}
+		},
 		"/users": {
 			"get": {
 				"$ref": "./paths/users/get.json"
@@ -312,6 +336,27 @@
 				"$ref": "./paths/users/userID/delete.json"
 			}
 		},
+		"/users/{userID}/2fa": {
+			"post": {
+				"$ref": "./paths/users/userID/2fa/post.json"
+			},
+			"get": {
+				"$ref": "./paths/users/userID/2fa/get.json"
+			},
+			"delete": {
+				"$ref": "./paths/users/userID/2fa/delete.json"
+			}
+		},
+		"/users/{userID}/2fa/enable": {
+			"post": {
+				"$ref": "./paths/users/userID/2fa/enable/post.json"
+			}
+		},
+		"/users/{userID}/2fa/backup-codes": {
+			"post": {
+				"$ref": "./paths/users/userID/2fa/backup-codes/post.json"
+			}
+		},
 		"/users/{userID}/auth": {
 			"put": {
 				"$ref": "./paths/users/userID/auth/put.json"

backend/scripts/regenerate-config

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+
+import * as process from "node:process"; // Use the node: protocol for built-ins
+import internalNginx from "../internal/nginx.js";
+import { global as logger } from "../logger.js";
+import deadHostModel from "../models/dead_host.js";
+import proxyHostModel from "../models/proxy_host.js";
+import redirectionHostModel from "../models/redirection_host.js";
+import streamModel from "../models/stream.js";
+
+const args = process.argv.slice(2);
+const UNATTENDED = args.includes("-y") || args.includes("--yes");
+const DRY_RUN = args.includes("--dry-run");
+
+if (args.includes("--help") || args.includes("-h")) {
+	console.log("\nThis will iterate over all Hosts and regnerate their Nginx configs.\n")
+	console.log("Usage: ./regenerate-config [-h|--help] [-y|--yes] [--dry-run]\n");
+	process.exit(0);
+}
+
+// ask for the user to confirm the action if not in unattended mode
+if (!UNATTENDED && !DRY_RUN) {
+	const readline = await import("node:readline");
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout,
+	});
+
+	const question = (query) =>
+		new Promise((resolve) => rl.question(query, resolve));
+
+	const answer = await question(
+		"This will iterate over all Hosts and regnerate their Nginx configs.\n\nAre you sure you want to proceed? (y/N) ",
+	);
+	rl.close();
+
+	if (answer.toLowerCase() !== "y") {
+		console.log("Aborting.");
+		process.exit(0);
+	}
+}
+
+const logIt = (msg, type = "info") => logger[type](
+	`${DRY_RUN ? '[DRY RUN] ' : ''}${msg}`,
+);
+
+// Let's do it.
+
+const processItems = async (model, type, hostType) => {
+	const rows = await model
+		.query()
+		.where("is_deleted", 0)
+		.andWhere("enabled", 1)
+		.groupBy("id")
+		.allowGraph(model.defaultAllowGraph)
+		.withGraphFetched(`[${model.defaultExpand.join(", ")}]`)
+		.orderBy(...model.defaultOrder);
+
+	logIt(`[${type}] Found ${rows.length} rows to process...`);
+	for (const row of rows) {
+		if (!DRY_RUN) {
+			logIt(`[${type}] Regenerating config #${row.id}: ${row.domain_names ? row.domain_names.join(", ") : 'port ' + row.incoming_port}`);
+			await internalNginx.configure(model, hostType, row);
+		} else {
+			logIt(`[${type}] Skipping generation of config #${row.id}: ${row.domain_names ? row.domain_names.join(", ") : 'port ' + row.incoming_port}`);
+		}
+	}
+};
+
+await processItems(proxyHostModel, "Proxy Host", "proxy_host");
+await processItems(redirectionHostModel, "Redirection Host", "redirection_host");
+await processItems(deadHostModel, "404 Host", "dead_host");
+await processItems(streamModel, "Stream", "stream");
+
+logIt("Completed", "success");
+process.exit(0);

backend/setup.js

@@ -6,11 +6,12 @@ import certificateModel from "./models/certificate.js";
 import settingModel from "./models/setting.js";
 import userModel from "./models/user.js";
 import userPermissionModel from "./models/user_permission.js";
+import fs from "node:fs/promises";
 
 export const isSetup = async () => {
 	const row = await userModel.query().select("id").where("is_deleted", 0).first();
 	return row?.id > 0;
-}
+};
 
 /**
  * Creates a default admin users if one doesn't already exist in the database
@@ -37,23 +38,19 @@ const setupDefaultUser = async () => {
 
 		const data = {
 			is_deleted: 0,
-			email: email,
+			email: initialAdminEmail,
 			name: "Administrator",
 			nickname: "Admin",
 			avatar: "",
 			roles: ["admin"],
 		};
 
-		const user = await userModel
-			.query()
-			.insertAndFetch(data);
+		const user = await userModel.query().insertAndFetch(data);
 
-		await authModel
-			.query()
-			.insert({
+		await authModel.query().insert({
 			user_id: user.id,
 			type: "password",
-				secret: password,
+			secret: initialAdminPassword,
 			meta: {},
 		});
 
@@ -77,16 +74,10 @@ const setupDefaultUser = async () => {
  * @returns {Promise}
  */
 const setupDefaultSettings = async () => {
-	const row = await settingModel
-		.query()
-		.select("id")
-		.where({ id: "default-site" })
-		.first();
+	const row = await settingModel.query().select("id").where({ id: "default-site" }).first();
 
 	if (!row?.id) {
-		await settingModel
-			.query()
-			.insert({
+		await settingModel.query().insert({
 			id: "default-site",
 			name: "Default Site",
 			description: "What to show when Nginx is hit with an unknown Host",
@@ -103,14 +94,10 @@ const setupDefaultSettings = async () => {
  * @returns {Promise}
  */
 const setupCertbotPlugins = async () => {
-	const certificates = await certificateModel
-		.query()
-		.where("is_deleted", 0)
-		.andWhere("provider", "letsencrypt");
+	const certificates = await certificateModel.query().where("is_deleted", 0).andWhere("provider", "letsencrypt");
 
 	if (certificates?.length) {
 		const plugins = [];
-		const promises = [];
 
 		certificates.map((certificate) => {
 			if (certificate.meta && certificate.meta.dns_challenge === true) {
@@ -118,24 +105,23 @@ const setupCertbotPlugins = async () => {
 					plugins.push(certificate.meta.dns_provider);
 				}
 
-				// Make sure credentials file exists
-				const credentials_loc = `/etc/letsencrypt/credentials/credentials-${certificate.id}`;
-				// Escape single quotes and backslashes
-				if (typeof certificate.meta.dns_provider_credentials === "string") {
-					const escapedCredentials = certificate.meta.dns_provider_credentials
-						.replaceAll("'", "\\'")
-						.replaceAll("\\", "\\\\");
-					const credentials_cmd = `[ -f '${credentials_loc}' ] || { mkdir -p /etc/letsencrypt/credentials 2> /dev/null; echo '${escapedCredentials}' > '${credentials_loc}' && chmod 600 '${credentials_loc}'; }`;
-					promises.push(utils.exec(credentials_cmd));
-				}
+				// Deliberately does NOT write the DNS credentials file here any more.
+				//
+				// It used to, so that a later `certbot renew` would find the path recorded in its
+				// renewal config. The effect was that every backend restart rewrote a plaintext
+				// DNS provider API token for every DNS-01 certificate, and left it there.
+				//
+				// internalCertificate now writes that file immediately before it runs certbot and
+				// removes it again afterwards, so there is exactly one writer and the credential
+				// is on disk only for the length of a certbot run. Recreating the files at boot
+				// would put every one of them straight back.
 			}
 			return true;
 		});
 
 		await installPlugins(plugins);
 
-		if (promises.length) {
-			await Promise.all(promises);
+		if (plugins.length) {
 			logger.info(`Added Certbot plugins ${plugins.join(", ")}`);
 		}
 	}

backend/templates/_access.conf

@@ -4,17 +4,19 @@
     auth_basic            "Authorization required";
     auth_basic_user_file  /data/access/{{ access_list_id }};
 
-    {% if access_list.pass_auth == 0 or access_list.pass_auth == true %}
+    {% if access_list.pass_auth == 0 or access_list.pass_auth == false %}
     proxy_set_header Authorization "";
     {% endif %}
 
     {% endif %}
 
+    {% if access_list.clients.length > 0 %}
     # Access Rules: {{ access_list.clients | size }} total
     {% for client in access_list.clients %}
     {{client | nginxAccessRule}}
     {% endfor %}
     deny all;
+    {% endif %}
 
     # Access checks must...
     {% if access_list.satisfy_any == 1 or access_list.satisfy_any == true %}

backend/templates/_forced_ssl.conf

@@ -1,6 +1,11 @@
 {% if certificate and certificate_id > 0 -%}
 {% if ssl_forced == 1 or ssl_forced == true %}
     # Force SSL
+    {% if trust_forwarded_proto == true %}
+    set $trust_forwarded_proto "T";
+    {% else %}
+    set $trust_forwarded_proto "F";
+    {% endif %}
     include conf.d/include/force-ssl.conf;
 {% endif %}
 {% endif %}

backend/templates/stream.conf

@@ -5,13 +5,16 @@
 {% if enabled %}
 {% if tcp_forwarding == 1 or tcp_forwarding == true -%}
 server {
-  listen {{ incoming_port }} {%- if certificate %} ssl {%- endif %};
-  {% unless ipv6 -%} # {%- endunless -%} listen [::]:{{ incoming_port }} {%- if certificate %} ssl {%- endif %};
+  listen {{ incoming_port }} reuseport {%- if certificate %} ssl {%- endif %};
+  {% unless ipv6 -%} # {%- endunless -%} listen [::]:{{ incoming_port }} reuseport {%- if certificate %} ssl {%- endif %};
 
   {%- include "_certificates_stream.conf" %}
 
   proxy_pass {{ forwarding_host }}:{{ forwarding_port }};
 
+  access_log /data/logs/stream-{{ id }}_access.log stream;
+  error_log /data/logs/stream-{{ id }}_error.log warn;
+
   # Custom
   include /data/nginx/custom/server_stream[.]conf;
   include /data/nginx/custom/server_stream_tcp[.]conf;
@@ -20,11 +23,14 @@ server {
 
 {% if udp_forwarding == 1 or udp_forwarding == true -%}
 server {
-  listen {{ incoming_port }} udp;
-  {% unless ipv6 -%} # {%- endunless -%} listen [::]:{{ incoming_port }} udp;
+  listen {{ incoming_port }} udp reuseport;
+  {% unless ipv6 -%} # {%- endunless -%} listen [::]:{{ incoming_port }} udp reuseport;
 
   proxy_pass {{ forwarding_host }}:{{ forwarding_port }};
 
+  access_log /data/logs/stream-{{ id }}_access.log stream;
+  error_log /data/logs/stream-{{ id }}_error.log warn;
+
   # Custom
   include /data/nginx/custom/server_stream[.]conf;
   include /data/nginx/custom/server_stream_udp[.]conf;

docker/Dockerfile

@@ -3,9 +3,9 @@
 
 # This file assumes that the frontend has been built using ./scripts/frontend-build
 
+ARG BASE_IMAGE=nginxproxymanager/nginx-full:certbot-node
 FROM nginxproxymanager/testca AS testca
-FROM letsencrypt/pebble AS pebbleca
-FROM nginxproxymanager/nginx-full:certbot-node
+FROM $BASE_IMAGE
 
 ARG TARGETPLATFORM
 ARG BUILD_VERSION
@@ -39,16 +39,17 @@ EXPOSE 80 81 443
 
 COPY backend       /app
 COPY frontend/dist /app/frontend
+COPY docker/rootfs /
+
+# Copy test CA cert for use in container and add to trusted certs from a self-signed CA
+COPY --from=testca /home/step/certs/root_ca.crt /etc/ssl/certs/NginxProxyManager.crt
+WORKDIR /etc/ssl/certs
+RUN ln -s NginxProxyManager.crt 1d0e3f10.0 && update-ca-certificates
 
 WORKDIR /app
 RUN yarn install \
 	&& yarn cache clean
 
-# add late to limit cache-busting by modifications
-COPY docker/rootfs /
-COPY --from=pebbleca /test/certs/pebble.minica.pem /etc/ssl/certs/pebble.minica.pem
-COPY --from=testca /home/step/certs/root_ca.crt /etc/ssl/certs/NginxProxyManager.crt
-
 # Remove frontend service not required for prod, dev nginx config as well
 RUN rm -rf /etc/s6-overlay/s6-rc.d/user/contents.d/frontend /etc/nginx/conf.d/dev.conf \
 	&& chmod 644 /etc/logrotate.d/nginx-proxy-manager

docker/ci.env

@@ -1,6 +1,6 @@
 AUTHENTIK_SECRET_KEY=gl8woZe8L6IIX8SC0c5Ocsj0xPkX5uJo5DVZCFl+L/QGbzuplfutYuua2ODNLEiDD3aFd9H2ylJmrke0
 AUTHENTIK_REDIS__HOST=authentik-redis
-AUTHENTIK_POSTGRESQL__HOST=db-postgres
+AUTHENTIK_POSTGRESQL__HOST=pgdb.internal
 AUTHENTIK_POSTGRESQL__USER=authentik
 AUTHENTIK_POSTGRESQL__NAME=authentik
 AUTHENTIK_POSTGRESQL__PASSWORD=07EKS5NLI6Tpv68tbdvrxfvj