updates

.github/workflows/vulncheck.yml

@@ -19,11 +19,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.26.x
+          go-version: 1.25.x
           # cached: false
       - name: Get official govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest

agent/agent.go

@@ -6,6 +6,7 @@ package agent
 
 import (
 	"log/slog"
+	"os"
 	"strings"
 	"sync"
 	"time"
@@ -13,14 +14,11 @@ import (
 	"github.com/gliderlabs/ssh"
 	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/agent/deltatracker"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/entities/system"
 	gossh "golang.org/x/crypto/ssh"
 )
 
-const defaultDataCacheTimeMs uint16 = 60_000
-
 type Agent struct {
 	sync.Mutex                                                                      // Used to lock agent while collecting data
 	debug                     bool                                                  // true if LOG_LEVEL is set to debug
@@ -35,10 +33,10 @@ type Agent struct {
 	netIoStats                map[uint16]system.NetIoStats                          // Keeps track of bandwidth usage per cache interval
 	netInterfaceDeltaTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64] // Per-cache-time NIC delta trackers
 	dockerManager             *dockerManager                                        // Manages Docker API requests
+	pveManager                *pveManager                                           // Manages Proxmox VE API requests
 	sensorConfig              *SensorConfig                                         // Sensors config
 	systemInfo                system.Info                                           // Host system info (dynamic)
 	systemDetails             system.Details                                        // Host system details (static, once-per-connection)
-	detailsDirty              bool                                                  // Whether system details have changed and need to be resent
 	gpuManager                *GPUManager                                           // Manages GPU data
 	cache                     *systemDataCache                                      // Cache for system stats based on cache time
 	connectionManager         *ConnectionManager                                    // Channel to signal connection events
@@ -71,11 +69,11 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 		slog.Info("Data directory", "path", agent.dataDir)
 	}
 
-	agent.memCalc, _ = utils.GetEnv("MEM_CALC")
+	agent.memCalc, _ = GetEnv("MEM_CALC")
 	agent.sensorConfig = agent.newSensorConfig()
 
 	// Parse disk usage cache duration (e.g., "15m", "1h") to avoid waking sleeping disks
-	if diskUsageCache, exists := utils.GetEnv("DISK_USAGE_CACHE"); exists {
+	if diskUsageCache, exists := GetEnv("DISK_USAGE_CACHE"); exists {
 		if duration, err := time.ParseDuration(diskUsageCache); err == nil {
 			agent.diskUsageCacheDuration = duration
 			slog.Info("DISK_USAGE_CACHE", "duration", duration)
@@ -85,7 +83,7 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 	}
 
 	// Set up slog with a log level determined by the LOG_LEVEL env var
-	if logLevelStr, exists := utils.GetEnv("LOG_LEVEL"); exists {
+	if logLevelStr, exists := GetEnv("LOG_LEVEL"); exists {
 		switch strings.ToLower(logLevelStr) {
 		case "debug":
 			agent.debug = true
@@ -100,13 +98,16 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 	slog.Debug(beszel.Version)
 
 	// initialize docker manager
-	agent.dockerManager = newDockerManager(agent)
+	agent.dockerManager = newDockerManager()
+
+	// initialize pve manager
+	agent.pveManager = newPVEManager()
 
 	// initialize system info
 	agent.refreshSystemDetails()
 
 	// SMART_INTERVAL env var to update smart data at this interval
-	if smartIntervalEnv, exists := utils.GetEnv("SMART_INTERVAL"); exists {
+	if smartIntervalEnv, exists := GetEnv("SMART_INTERVAL"); exists {
 		if duration, err := time.ParseDuration(smartIntervalEnv); err == nil && duration > 0 {
 			agent.systemDetails.SmartInterval = duration
 			slog.Info("SMART_INTERVAL", "duration", duration)
@@ -145,12 +146,21 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 
 	// if debugging, print stats
 	if agent.debug {
-		slog.Debug("Stats", "data", agent.gatherStats(common.DataRequestOptions{CacheTimeMs: defaultDataCacheTimeMs, IncludeDetails: true}))
+		slog.Debug("Stats", "data", agent.gatherStats(common.DataRequestOptions{CacheTimeMs: 60_000, IncludeDetails: true}))
 	}
 
 	return agent, nil
 }
 
+// GetEnv retrieves an environment variable with a "BESZEL_AGENT_" prefix, or falls back to the unprefixed key.
+func GetEnv(key string) (value string, exists bool) {
+	if value, exists = os.LookupEnv("BESZEL_AGENT_" + key); exists {
+		return value, exists
+	}
+	// Fallback to the old unprefixed key
+	return os.LookupEnv(key)
+}
+
 func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedData {
 	a.Lock()
 	defer a.Unlock()
@@ -167,6 +177,11 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 		Info:  a.systemInfo,
 	}
 
+	// Include static system details only when requested
+	if options.IncludeDetails {
+		data.Details = &a.systemDetails
+	}
+
 	// slog.Info("System data", "data", data, "cacheTimeMs", cacheTimeMs)
 
 	if a.dockerManager != nil {
@@ -178,8 +193,17 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 		}
 	}
 
+	if a.pveManager != nil {
+		if pveStats, err := a.pveManager.getPVEStats(); err == nil {
+			data.PVEStats = pveStats
+			slog.Debug("PVE", "data", data.PVEStats)
+		} else {
+			slog.Debug("PVE", "err", err)
+		}
+	}
+
 	// skip updating systemd services if cache time is not the default 60sec interval
-	if a.systemdManager != nil && cacheTimeMs == defaultDataCacheTimeMs {
+	if a.systemdManager != nil && cacheTimeMs == 60_000 {
 		totalCount := uint16(a.systemdManager.getServiceStatsCount())
 		if totalCount > 0 {
 			numFailed := a.systemdManager.getFailedServiceCount()
@@ -202,7 +226,7 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 			data.Stats.ExtraFs[key] = stats
 			// Add percentages to Info struct for dashboard
 			if stats.DiskTotal > 0 {
-				pct := utils.TwoDecimals((stats.DiskUsed / stats.DiskTotal) * 100)
+				pct := twoDecimals((stats.DiskUsed / stats.DiskTotal) * 100)
 				data.Info.ExtraFsPct[key] = pct
 			}
 		}
@@ -210,8 +234,7 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 	slog.Debug("Extra FS", "data", data.Stats.ExtraFs)
 
 	a.cache.Set(data, cacheTimeMs)
-
-	return a.attachSystemDetails(data, cacheTimeMs, options.IncludeDetails)
+	return data
 }
 
 // Start initializes and starts the agent with optional WebSocket connection

agent/agent_cache_test.go

@@ -14,6 +14,10 @@ import (
 )
 
 func createTestCacheData() *system.CombinedData {
+	var stats = container.Stats{}
+	stats.Name = "test-container"
+	stats.Cpu = 10.5
+	stats.Mem = 1073741824 // 1GB
 	return &system.CombinedData{
 		Stats: system.Stats{
 			Cpu:       50.5,
@@ -24,10 +28,7 @@ func createTestCacheData() *system.CombinedData {
 			AgentVersion: "0.12.0",
 		},
 		Containers: []*container.Stats{
-			{
-				Name: "test-container",
-				Cpu:  25.0,
-			},
+			&stats,
 		},
 	}
 }

agent/battery/battery.go

@@ -1,11 +1,84 @@
-// Package battery provides functions to check if the system has a battery and return the charge state and percentage.
+//go:build !freebsd
+
+// Package battery provides functions to check if the system has a battery and to get the battery stats.
 package battery
 
-const (
-	stateUnknown uint8 = iota
-	stateEmpty
-	stateFull
-	stateCharging
-	stateDischarging
-	stateIdle
+import (
+	"errors"
+	"log/slog"
+	"math"
+
+	"github.com/distatus/battery"
 )
+
+var (
+	systemHasBattery   = false
+	haveCheckedBattery = false
+)
+
+// HasReadableBattery checks if the system has a battery and returns true if it does.
+func HasReadableBattery() bool {
+	if haveCheckedBattery {
+		return systemHasBattery
+	}
+	haveCheckedBattery = true
+	batteries, err := battery.GetAll()
+	for _, bat := range batteries {
+		if bat != nil && (bat.Full > 0 || bat.Design > 0) {
+			systemHasBattery = true
+			break
+		}
+	}
+	if !systemHasBattery {
+		slog.Debug("No battery found", "err", err)
+	}
+	return systemHasBattery
+}
+
+// GetBatteryStats returns the current battery percent and charge state
+// percent = (current charge of all batteries) / (sum of designed/full capacity of all batteries)
+func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
+	if !HasReadableBattery() {
+		return batteryPercent, batteryState, errors.ErrUnsupported
+	}
+	batteries, err := battery.GetAll()
+	// we'll handle errors later by skipping batteries with errors, rather
+	// than skipping everything because of the presence of some errors.
+	if len(batteries) == 0 {
+		return batteryPercent, batteryState, errors.New("no batteries")
+	}
+
+	totalCapacity := float64(0)
+	totalCharge := float64(0)
+	errs, partialErrs := err.(battery.Errors)
+
+	batteryState = math.MaxUint8
+
+	for i, bat := range batteries {
+		if partialErrs && errs[i] != nil {
+			// if there were some errors, like missing data, skip it
+			continue
+		}
+		if bat == nil || bat.Full == 0 {
+			// skip batteries with no capacity. Charge is unlikely to ever be zero, but
+			// we can't guarantee that, so don't skip based on charge.
+			continue
+		}
+		totalCapacity += bat.Full
+		totalCharge += min(bat.Current, bat.Full)
+		if bat.State.Raw >= 0 {
+			batteryState = uint8(bat.State.Raw)
+		}
+	}
+
+	if totalCapacity == 0 || batteryState == math.MaxUint8 {
+		// for macs there's sometimes a ghost battery with 0 capacity
+		// https://github.com/distatus/battery/issues/34
+		// Instead of skipping over those batteries, we'll check for total 0 capacity
+		// and return an error. This also prevents a divide by zero.
+		return batteryPercent, batteryState, errors.New("no battery capacity")
+	}
+
+	batteryPercent = uint8(totalCharge / totalCapacity * 100)
+	return batteryPercent, batteryState, nil
+}

agent/battery/battery_darwin.go

@@ -1,96 +0,0 @@
-//go:build darwin
-
-package battery
-
-import (
-	"errors"
-	"log/slog"
-	"math"
-	"os/exec"
-	"sync"
-
-	"howett.net/plist"
-)
-
-type macBattery struct {
-	CurrentCapacity   int  `plist:"CurrentCapacity"`
-	MaxCapacity       int  `plist:"MaxCapacity"`
-	FullyCharged      bool `plist:"FullyCharged"`
-	IsCharging        bool `plist:"IsCharging"`
-	ExternalConnected bool `plist:"ExternalConnected"`
-}
-
-func readMacBatteries() ([]macBattery, error) {
-	out, err := exec.Command("ioreg", "-n", "AppleSmartBattery", "-r", "-a").Output()
-	if err != nil {
-		return nil, err
-	}
-	if len(out) == 0 {
-		return nil, nil
-	}
-	var batteries []macBattery
-	if _, err := plist.Unmarshal(out, &batteries); err != nil {
-		return nil, err
-	}
-	return batteries, nil
-}
-
-// HasReadableBattery checks if the system has a battery and returns true if it does.
-var HasReadableBattery = sync.OnceValue(func() bool {
-	systemHasBattery := false
-	batteries, err := readMacBatteries()
-	slog.Debug("Batteries", "batteries", batteries, "err", err)
-	for _, bat := range batteries {
-		if bat.MaxCapacity > 0 {
-			systemHasBattery = true
-			break
-		}
-	}
-	return systemHasBattery
-})
-
-// GetBatteryStats returns the current battery percent and charge state.
-// Uses CurrentCapacity/MaxCapacity to match the value macOS displays.
-func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	if !HasReadableBattery() {
-		return batteryPercent, batteryState, errors.ErrUnsupported
-	}
-	batteries, err := readMacBatteries()
-	if len(batteries) == 0 {
-		return batteryPercent, batteryState, errors.New("no batteries")
-	}
-
-	totalCapacity := 0
-	totalCharge := 0
-	batteryState = math.MaxUint8
-
-	for _, bat := range batteries {
-		if bat.MaxCapacity == 0 {
-			// skip ghost batteries with 0 capacity
-			// https://github.com/distatus/battery/issues/34
-			continue
-		}
-		totalCapacity += bat.MaxCapacity
-		totalCharge += min(bat.CurrentCapacity, bat.MaxCapacity)
-
-		switch {
-		case !bat.ExternalConnected:
-			batteryState = stateDischarging
-		case bat.IsCharging:
-			batteryState = stateCharging
-		case bat.CurrentCapacity == 0:
-			batteryState = stateEmpty
-		case !bat.FullyCharged:
-			batteryState = stateIdle
-		default:
-			batteryState = stateFull
-		}
-	}
-
-	if totalCapacity == 0 || batteryState == math.MaxUint8 {
-		return batteryPercent, batteryState, errors.New("no battery capacity")
-	}
-
-	batteryPercent = uint8(float64(totalCharge) / float64(totalCapacity) * 100)
-	return batteryPercent, batteryState, nil
-}

agent/battery/battery_freebsd.go

@@ -1,4 +1,4 @@
-//go:build !darwin && !linux && !windows
+//go:build freebsd
 
 package battery
 

agent/battery/battery_linux.go

@@ -1,120 +0,0 @@
-//go:build linux
-
-package battery
-
-import (
-	"errors"
-	"log/slog"
-	"math"
-	"os"
-	"path/filepath"
-	"strconv"
-	"sync"
-
-	"github.com/henrygd/beszel/agent/utils"
-)
-
-// getBatteryPaths returns the paths of all batteries in /sys/class/power_supply
-var getBatteryPaths func() ([]string, error)
-
-// HasReadableBattery checks if the system has a battery and returns true if it does.
-var HasReadableBattery func() bool
-
-func init() {
-	resetBatteryState("/sys/class/power_supply")
-}
-
-// resetBatteryState resets the sync.Once functions to a fresh state.
-// Tests call this after swapping sysfsPowerSupply so the new path is picked up.
-func resetBatteryState(sysfsPowerSupplyPath string) {
-	getBatteryPaths = sync.OnceValues(func() ([]string, error) {
-		entries, err := os.ReadDir(sysfsPowerSupplyPath)
-		if err != nil {
-			return nil, err
-		}
-		var paths []string
-		for _, e := range entries {
-			path := filepath.Join(sysfsPowerSupplyPath, e.Name())
-			if utils.ReadStringFile(filepath.Join(path, "type")) == "Battery" {
-				paths = append(paths, path)
-			}
-		}
-		return paths, nil
-	})
-	HasReadableBattery = sync.OnceValue(func() bool {
-		systemHasBattery := false
-		paths, err := getBatteryPaths()
-		for _, path := range paths {
-			if _, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity")); ok {
-				systemHasBattery = true
-				break
-			}
-		}
-		if !systemHasBattery {
-			slog.Debug("No battery found", "err", err)
-		}
-		return systemHasBattery
-	})
-}
-
-func parseSysfsState(status string) uint8 {
-	switch status {
-	case "Empty":
-		return stateEmpty
-	case "Full":
-		return stateFull
-	case "Charging":
-		return stateCharging
-	case "Discharging":
-		return stateDischarging
-	case "Not charging":
-		return stateIdle
-	default:
-		return stateUnknown
-	}
-}
-
-// GetBatteryStats returns the current battery percent and charge state.
-// Reads /sys/class/power_supply/*/capacity directly so the kernel-reported
-// value is used, which is always 0-100 and matches what the OS displays.
-func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	if !HasReadableBattery() {
-		return batteryPercent, batteryState, errors.ErrUnsupported
-	}
-	paths, err := getBatteryPaths()
-	if err != nil {
-		return batteryPercent, batteryState, err
-	}
-	if len(paths) == 0 {
-		return batteryPercent, batteryState, errors.New("no batteries")
-	}
-
-	batteryState = math.MaxUint8
-	totalPercent := 0
-	count := 0
-
-	for _, path := range paths {
-		capStr, ok := utils.ReadStringFileOK(filepath.Join(path, "capacity"))
-		if !ok {
-			continue
-		}
-		cap, parseErr := strconv.Atoi(capStr)
-		if parseErr != nil {
-			continue
-		}
-		totalPercent += cap
-		count++
-
-		state := parseSysfsState(utils.ReadStringFile(filepath.Join(path, "status")))
-		if state != stateUnknown {
-			batteryState = state
-		}
-	}
-
-	if count == 0 || batteryState == math.MaxUint8 {
-		return batteryPercent, batteryState, errors.New("no battery capacity")
-	}
-
-	batteryPercent = uint8(totalPercent / count)
-	return batteryPercent, batteryState, nil
-}

agent/battery/battery_linux_test.go

@@ -1,201 +0,0 @@
-//go:build testing && linux
-
-package battery
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// setupFakeSysfs creates a temporary sysfs-like tree under t.TempDir(),
-// swaps sysfsPowerSupply, resets the sync.Once caches, and restores
-// everything on cleanup. Returns a helper to create battery directories.
-func setupFakeSysfs(t *testing.T) (tmpDir string, addBattery func(name, capacity, status string)) {
-	t.Helper()
-
-	tmp := t.TempDir()
-	resetBatteryState(tmp)
-
-	write := func(path, content string) {
-		t.Helper()
-		dir := filepath.Dir(path)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	addBattery = func(name, capacity, status string) {
-		t.Helper()
-		batDir := filepath.Join(tmp, name)
-		write(filepath.Join(batDir, "type"), "Battery")
-		write(filepath.Join(batDir, "capacity"), capacity)
-		write(filepath.Join(batDir, "status"), status)
-	}
-
-	return tmp, addBattery
-}
-
-func TestParseSysfsState(t *testing.T) {
-	tests := []struct {
-		input string
-		want  uint8
-	}{
-		{"Empty", stateEmpty},
-		{"Full", stateFull},
-		{"Charging", stateCharging},
-		{"Discharging", stateDischarging},
-		{"Not charging", stateIdle},
-		{"", stateUnknown},
-		{"SomethingElse", stateUnknown},
-	}
-	for _, tt := range tests {
-		assert.Equal(t, tt.want, parseSysfsState(tt.input), "parseSysfsState(%q)", tt.input)
-	}
-}
-
-func TestGetBatteryStats_SingleBattery(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "72", "Discharging")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(72), pct)
-	assert.Equal(t, stateDischarging, state)
-}
-
-func TestGetBatteryStats_MultipleBatteries(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "80", "Charging")
-	addBattery("BAT1", "40", "Charging")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	// average of 80 and 40 = 60
-	assert.EqualValues(t, 60, pct)
-	assert.Equal(t, stateCharging, state)
-}
-
-func TestGetBatteryStats_FullBattery(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "100", "Full")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(100), pct)
-	assert.Equal(t, stateFull, state)
-}
-
-func TestGetBatteryStats_EmptyBattery(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "0", "Empty")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(0), pct)
-	assert.Equal(t, stateEmpty, state)
-}
-
-func TestGetBatteryStats_NotCharging(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "80", "Not charging")
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(80), pct)
-	assert.Equal(t, stateIdle, state)
-}
-
-func TestGetBatteryStats_NoBatteries(t *testing.T) {
-	setupFakeSysfs(t) // empty directory, no batteries
-
-	_, _, err := GetBatteryStats()
-	assert.Error(t, err)
-}
-
-func TestGetBatteryStats_NonBatterySupplyIgnored(t *testing.T) {
-	tmp, addBattery := setupFakeSysfs(t)
-
-	// Add a real battery
-	addBattery("BAT0", "55", "Charging")
-
-	// Add an AC adapter (type != Battery) - should be ignored
-	acDir := filepath.Join(tmp, "AC0")
-	if err := os.MkdirAll(acDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(acDir, "type"), []byte("Mains"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	pct, state, err := GetBatteryStats()
-	assert.NoError(t, err)
-	assert.Equal(t, uint8(55), pct)
-	assert.Equal(t, stateCharging, state)
-}
-
-func TestGetBatteryStats_InvalidCapacitySkipped(t *testing.T) {
-	tmp, addBattery := setupFakeSysfs(t)
-
-	// One battery with valid capacity
-	addBattery("BAT0", "90", "Discharging")
-
-	// Another with invalid capacity text
-	badDir := filepath.Join(tmp, "BAT1")
-	if err := os.MkdirAll(badDir, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(badDir, "type"), []byte("Battery"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(badDir, "capacity"), []byte("not-a-number"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(badDir, "status"), []byte("Discharging"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-
-	pct, _, err := GetBatteryStats()
-	assert.NoError(t, err)
-	// Only BAT0 counted
-	assert.Equal(t, uint8(90), pct)
-}
-
-func TestGetBatteryStats_UnknownStatusOnly(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "50", "SomethingWeird")
-
-	_, _, err := GetBatteryStats()
-	assert.Error(t, err)
-}
-
-func TestHasReadableBattery_True(t *testing.T) {
-	_, addBattery := setupFakeSysfs(t)
-	addBattery("BAT0", "50", "Charging")
-
-	assert.True(t, HasReadableBattery())
-}
-
-func TestHasReadableBattery_False(t *testing.T) {
-	setupFakeSysfs(t) // no batteries
-
-	assert.False(t, HasReadableBattery())
-}
-
-func TestHasReadableBattery_NoCapacityFile(t *testing.T) {
-	tmp, _ := setupFakeSysfs(t)
-
-	// Battery dir with type file but no capacity file
-	batDir := filepath.Join(tmp, "BAT0")
-	err := os.MkdirAll(batDir, 0o755)
-	assert.NoError(t, err)
-	err = os.WriteFile(filepath.Join(batDir, "type"), []byte("Battery"), 0o644)
-	assert.NoError(t, err)
-
-	assert.False(t, HasReadableBattery())
-}

agent/battery/battery_windows.go

@@ -1,298 +0,0 @@
-//go:build windows
-
-// Most of the Windows battery code is based on
-// distatus/battery by Karol 'Kenji Takahashi' Woźniak
-
-package battery
-
-import (
-	"errors"
-	"log/slog"
-	"math"
-	"sync"
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/windows"
-)
-
-type batteryQueryInformation struct {
-	BatteryTag       uint32
-	InformationLevel int32
-	AtRate           int32
-}
-
-type batteryInformation struct {
-	Capabilities        uint32
-	Technology          uint8
-	Reserved            [3]uint8
-	Chemistry           [4]uint8
-	DesignedCapacity    uint32
-	FullChargedCapacity uint32
-	DefaultAlert1       uint32
-	DefaultAlert2       uint32
-	CriticalBias        uint32
-	CycleCount          uint32
-}
-
-type batteryWaitStatus struct {
-	BatteryTag   uint32
-	Timeout      uint32
-	PowerState   uint32
-	LowCapacity  uint32
-	HighCapacity uint32
-}
-
-type batteryStatus struct {
-	PowerState uint32
-	Capacity   uint32
-	Voltage    uint32
-	Rate       int32
-}
-
-type winGUID struct {
-	Data1 uint32
-	Data2 uint16
-	Data3 uint16
-	Data4 [8]byte
-}
-
-type spDeviceInterfaceData struct {
-	cbSize             uint32
-	InterfaceClassGuid winGUID
-	Flags              uint32
-	Reserved           uint
-}
-
-var guidDeviceBattery = winGUID{
-	0x72631e54,
-	0x78A4,
-	0x11d0,
-	[8]byte{0xbc, 0xf7, 0x00, 0xaa, 0x00, 0xb7, 0xb3, 0x2a},
-}
-
-var (
-	setupapi                         = &windows.LazyDLL{Name: "setupapi.dll", System: true}
-	setupDiGetClassDevsW             = setupapi.NewProc("SetupDiGetClassDevsW")
-	setupDiEnumDeviceInterfaces      = setupapi.NewProc("SetupDiEnumDeviceInterfaces")
-	setupDiGetDeviceInterfaceDetailW = setupapi.NewProc("SetupDiGetDeviceInterfaceDetailW")
-	setupDiDestroyDeviceInfoList     = setupapi.NewProc("SetupDiDestroyDeviceInfoList")
-)
-
-// winBatteryGet reads one battery by index. Returns (fullCapacity, currentCapacity, state, error).
-// Returns error == errNotFound when there are no more batteries.
-var errNotFound = errors.New("no more batteries")
-
-func setupDiSetup(proc *windows.LazyProc, nargs, a1, a2, a3, a4, a5, a6 uintptr) (uintptr, error) {
-	_ = nargs
-	r1, _, errno := syscall.SyscallN(proc.Addr(), a1, a2, a3, a4, a5, a6)
-	if windows.Handle(r1) == windows.InvalidHandle {
-		if errno != 0 {
-			return 0, error(errno)
-		}
-		return 0, syscall.EINVAL
-	}
-	return r1, nil
-}
-
-func setupDiCall(proc *windows.LazyProc, nargs, a1, a2, a3, a4, a5, a6 uintptr) syscall.Errno {
-	_ = nargs
-	r1, _, errno := syscall.SyscallN(proc.Addr(), a1, a2, a3, a4, a5, a6)
-	if r1 == 0 {
-		if errno != 0 {
-			return errno
-		}
-		return syscall.EINVAL
-	}
-	return 0
-}
-
-func readWinBatteryState(powerState uint32) uint8 {
-	switch {
-	case powerState&0x00000004 != 0:
-		return stateCharging
-	case powerState&0x00000008 != 0:
-		return stateEmpty
-	case powerState&0x00000002 != 0:
-		return stateDischarging
-	case powerState&0x00000001 != 0:
-		return stateFull
-	default:
-		return stateUnknown
-	}
-}
-
-func winBatteryGet(idx int) (full, current uint32, state uint8, err error) {
-	hdev, err := setupDiSetup(
-		setupDiGetClassDevsW,
-		4,
-		uintptr(unsafe.Pointer(&guidDeviceBattery)),
-		0, 0,
-		2|16, // DIGCF_PRESENT|DIGCF_DEVICEINTERFACE
-		0, 0,
-	)
-	if err != nil {
-		return 0, 0, stateUnknown, err
-	}
-	defer syscall.SyscallN(setupDiDestroyDeviceInfoList.Addr(), hdev)
-
-	var did spDeviceInterfaceData
-	did.cbSize = uint32(unsafe.Sizeof(did))
-	errno := setupDiCall(
-		setupDiEnumDeviceInterfaces,
-		5,
-		hdev, 0,
-		uintptr(unsafe.Pointer(&guidDeviceBattery)),
-		uintptr(idx),
-		uintptr(unsafe.Pointer(&did)),
-		0,
-	)
-	if errno == 259 { // ERROR_NO_MORE_ITEMS
-		return 0, 0, stateUnknown, errNotFound
-	}
-	if errno != 0 {
-		return 0, 0, stateUnknown, errno
-	}
-
-	var cbRequired uint32
-	errno = setupDiCall(
-		setupDiGetDeviceInterfaceDetailW,
-		6,
-		hdev,
-		uintptr(unsafe.Pointer(&did)),
-		0, 0,
-		uintptr(unsafe.Pointer(&cbRequired)),
-		0,
-	)
-	if errno != 0 && errno != 122 { // ERROR_INSUFFICIENT_BUFFER
-		return 0, 0, stateUnknown, errno
-	}
-	didd := make([]uint16, cbRequired/2)
-	cbSize := (*uint32)(unsafe.Pointer(&didd[0]))
-	if unsafe.Sizeof(uint(0)) == 8 {
-		*cbSize = 8
-	} else {
-		*cbSize = 6
-	}
-	errno = setupDiCall(
-		setupDiGetDeviceInterfaceDetailW,
-		6,
-		hdev,
-		uintptr(unsafe.Pointer(&did)),
-		uintptr(unsafe.Pointer(&didd[0])),
-		uintptr(cbRequired),
-		uintptr(unsafe.Pointer(&cbRequired)),
-		0,
-	)
-	if errno != 0 {
-		return 0, 0, stateUnknown, errno
-	}
-	devicePath := &didd[2:][0]
-
-	handle, err := windows.CreateFile(
-		devicePath,
-		windows.GENERIC_READ|windows.GENERIC_WRITE,
-		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE,
-		nil,
-		windows.OPEN_EXISTING,
-		windows.FILE_ATTRIBUTE_NORMAL,
-		0,
-	)
-	if err != nil {
-		return 0, 0, stateUnknown, err
-	}
-	defer windows.CloseHandle(handle)
-
-	var dwOut uint32
-	var dwWait uint32
-	var bqi batteryQueryInformation
-	err = windows.DeviceIoControl(
-		handle,
-		2703424, // IOCTL_BATTERY_QUERY_TAG
-		(*byte)(unsafe.Pointer(&dwWait)),
-		uint32(unsafe.Sizeof(dwWait)),
-		(*byte)(unsafe.Pointer(&bqi.BatteryTag)),
-		uint32(unsafe.Sizeof(bqi.BatteryTag)),
-		&dwOut, nil,
-	)
-	if err != nil || bqi.BatteryTag == 0 {
-		return 0, 0, stateUnknown, errors.New("battery tag not returned")
-	}
-
-	var bi batteryInformation
-	if err = windows.DeviceIoControl(
-		handle,
-		2703428, // IOCTL_BATTERY_QUERY_INFORMATION
-		(*byte)(unsafe.Pointer(&bqi)),
-		uint32(unsafe.Sizeof(bqi)),
-		(*byte)(unsafe.Pointer(&bi)),
-		uint32(unsafe.Sizeof(bi)),
-		&dwOut, nil,
-	); err != nil {
-		return 0, 0, stateUnknown, err
-	}
-
-	bws := batteryWaitStatus{BatteryTag: bqi.BatteryTag}
-	var bs batteryStatus
-	if err = windows.DeviceIoControl(
-		handle,
-		2703436, // IOCTL_BATTERY_QUERY_STATUS
-		(*byte)(unsafe.Pointer(&bws)),
-		uint32(unsafe.Sizeof(bws)),
-		(*byte)(unsafe.Pointer(&bs)),
-		uint32(unsafe.Sizeof(bs)),
-		&dwOut, nil,
-	); err != nil {
-		return 0, 0, stateUnknown, err
-	}
-
-	if bs.Capacity == 0xffffffff { // BATTERY_UNKNOWN_CAPACITY
-		return 0, 0, stateUnknown, errors.New("battery capacity unknown")
-	}
-
-	return bi.FullChargedCapacity, bs.Capacity, readWinBatteryState(bs.PowerState), nil
-}
-
-// HasReadableBattery checks if the system has a battery and returns true if it does.
-var HasReadableBattery = sync.OnceValue(func() bool {
-	systemHasBattery := false
-	full, _, _, err := winBatteryGet(0)
-	if err == nil && full > 0 {
-		systemHasBattery = true
-	}
-	if !systemHasBattery {
-		slog.Debug("No battery found", "err", err)
-	}
-	return systemHasBattery
-})
-
-// GetBatteryStats returns the current battery percent and charge state.
-func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
-	if !HasReadableBattery() {
-		return batteryPercent, batteryState, errors.ErrUnsupported
-	}
-
-	totalFull := uint32(0)
-	totalCurrent := uint32(0)
-	batteryState = math.MaxUint8
-
-	for i := 0; ; i++ {
-		full, current, state, bErr := winBatteryGet(i)
-		if errors.Is(bErr, errNotFound) {
-			break
-		}
-		if bErr != nil || full == 0 {
-			continue
-		}
-		totalFull += full
-		totalCurrent += min(current, full)
-		batteryState = state
-	}
-
-	if totalFull == 0 || batteryState == math.MaxUint8 {
-		return batteryPercent, batteryState, errors.New("no battery capacity")
-	}
-
-	batteryPercent = uint8(float64(totalCurrent) / float64(totalFull) * 100)
-	return batteryPercent, batteryState, nil
-}

agent/client.go

@@ -14,13 +14,11 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/common"
 
 	"github.com/fxamacker/cbor/v2"
 	"github.com/lxzan/gws"
 	"golang.org/x/crypto/ssh"
-	"golang.org/x/net/proxy"
 )
 
 const (
@@ -45,7 +43,7 @@ type WebSocketClient struct {
 // newWebSocketClient creates a new WebSocket client for the given agent.
 // It reads configuration from environment variables and validates the hub URL.
 func newWebSocketClient(agent *Agent) (client *WebSocketClient, err error) {
-	hubURLStr, exists := utils.GetEnv("HUB_URL")
+	hubURLStr, exists := GetEnv("HUB_URL")
 	if !exists {
 		return nil, errors.New("HUB_URL environment variable not set")
 	}
@@ -74,12 +72,12 @@ func newWebSocketClient(agent *Agent) (client *WebSocketClient, err error) {
 // If neither is set, it returns an error.
 func getToken() (string, error) {
 	// get token from env var
-	token, _ := utils.GetEnv("TOKEN")
+	token, _ := GetEnv("TOKEN")
 	if token != "" {
 		return token, nil
 	}
 	// get token from file
-	tokenFile, _ := utils.GetEnv("TOKEN_FILE")
+	tokenFile, _ := GetEnv("TOKEN_FILE")
 	if tokenFile == "" {
 		return "", errors.New("must set TOKEN or TOKEN_FILE")
 	}
@@ -105,11 +103,6 @@ func (client *WebSocketClient) getOptions() *gws.ClientOption {
 	}
 	client.hubURL.Path = path.Join(client.hubURL.Path, "api/beszel/agent-connect")
 
-	// make sure BESZEL_AGENT_ALL_PROXY works (GWS only checks ALL_PROXY)
-	if val := os.Getenv("BESZEL_AGENT_ALL_PROXY"); val != "" {
-		os.Setenv("ALL_PROXY", val)
-	}
-
 	client.options = &gws.ClientOption{
 		Addr:      client.hubURL.String(),
 		TlsConfig: &tls.Config{InsecureSkipVerify: true},
@@ -118,9 +111,6 @@ func (client *WebSocketClient) getOptions() *gws.ClientOption {
 			"X-Token":    []string{client.token},
 			"X-Beszel":   []string{beszel.Version},
 		},
-		NewDialer: func() (gws.Dialer, error) {
-			return proxy.FromEnvironment(), nil
-		},
 	}
 	return client.options
 }
@@ -207,7 +197,7 @@ func (client *WebSocketClient) handleAuthChallenge(msg *common.HubRequest[cbor.R
 	}
 
 	if authRequest.NeedSysInfo {
-		response.Name, _ = utils.GetEnv("SYSTEM_NAME")
+		response.Name, _ = GetEnv("SYSTEM_NAME")
 		response.Hostname = client.agent.systemDetails.Hostname
 		serverAddr := client.agent.connectionManager.serverOptions.Addr
 		_, response.Port, _ = net.SplitHostPort(serverAddr)

agent/client_test.go

@@ -70,11 +70,19 @@ func TestNewWebSocketClient(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			// Set up environment
 			if tc.hubURL != "" {
-				t.Setenv("BESZEL_AGENT_HUB_URL", tc.hubURL)
+				os.Setenv("BESZEL_AGENT_HUB_URL", tc.hubURL)
+			} else {
+				os.Unsetenv("BESZEL_AGENT_HUB_URL")
 			}
 			if tc.token != "" {
-				t.Setenv("BESZEL_AGENT_TOKEN", tc.token)
+				os.Setenv("BESZEL_AGENT_TOKEN", tc.token)
+			} else {
+				os.Unsetenv("BESZEL_AGENT_TOKEN")
 			}
+			defer func() {
+				os.Unsetenv("BESZEL_AGENT_HUB_URL")
+				os.Unsetenv("BESZEL_AGENT_TOKEN")
+			}()
 
 			client, err := newWebSocketClient(agent)
 
@@ -130,8 +138,12 @@ func TestWebSocketClient_GetOptions(t *testing.T) {
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
 			// Set up environment
-			t.Setenv("BESZEL_AGENT_HUB_URL", tc.inputURL)
-			t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+			os.Setenv("BESZEL_AGENT_HUB_URL", tc.inputURL)
+			os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+			defer func() {
+				os.Unsetenv("BESZEL_AGENT_HUB_URL")
+				os.Unsetenv("BESZEL_AGENT_TOKEN")
+			}()
 
 			client, err := newWebSocketClient(agent)
 			require.NoError(t, err)
@@ -173,8 +185,12 @@ func TestWebSocketClient_VerifySignature(t *testing.T) {
 	require.NoError(t, err)
 
 	// Set up environment
-	t.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
-	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
 
 	client, err := newWebSocketClient(agent)
 	require.NoError(t, err)
@@ -242,8 +258,12 @@ func TestWebSocketClient_HandleHubRequest(t *testing.T) {
 	agent := createTestAgent(t)
 
 	// Set up environment
-	t.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
-	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
 
 	client, err := newWebSocketClient(agent)
 	require.NoError(t, err)
@@ -330,8 +350,13 @@ func TestGetUserAgent(t *testing.T) {
 func TestWebSocketClient_Close(t *testing.T) {
 	agent := createTestAgent(t)
 
-	t.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
-	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	// Set up environment
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
 
 	client, err := newWebSocketClient(agent)
 	require.NoError(t, err)
@@ -346,8 +371,13 @@ func TestWebSocketClient_Close(t *testing.T) {
 func TestWebSocketClient_ConnectRateLimit(t *testing.T) {
 	agent := createTestAgent(t)
 
-	t.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
-	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	// Set up environment
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
 
 	client, err := newWebSocketClient(agent)
 	require.NoError(t, err)
@@ -363,10 +393,20 @@ func TestWebSocketClient_ConnectRateLimit(t *testing.T) {
 
 // TestGetToken tests the getToken function with various scenarios
 func TestGetToken(t *testing.T) {
+	unsetEnvVars := func() {
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+		os.Unsetenv("TOKEN")
+		os.Unsetenv("BESZEL_AGENT_TOKEN_FILE")
+		os.Unsetenv("TOKEN_FILE")
+	}
+
 	t.Run("token from TOKEN environment variable", func(t *testing.T) {
+		unsetEnvVars()
+
 		// Set TOKEN env var
 		expectedToken := "test-token-from-env"
-		t.Setenv("TOKEN", expectedToken)
+		os.Setenv("TOKEN", expectedToken)
+		defer os.Unsetenv("TOKEN")
 
 		token, err := getToken()
 		assert.NoError(t, err)
@@ -374,9 +414,12 @@ func TestGetToken(t *testing.T) {
 	})
 
 	t.Run("token from BESZEL_AGENT_TOKEN environment variable", func(t *testing.T) {
+		unsetEnvVars()
+
 		// Set BESZEL_AGENT_TOKEN env var (should take precedence)
 		expectedToken := "test-token-from-beszel-env"
-		t.Setenv("BESZEL_AGENT_TOKEN", expectedToken)
+		os.Setenv("BESZEL_AGENT_TOKEN", expectedToken)
+		defer os.Unsetenv("BESZEL_AGENT_TOKEN")
 
 		token, err := getToken()
 		assert.NoError(t, err)
@@ -384,6 +427,8 @@ func TestGetToken(t *testing.T) {
 	})
 
 	t.Run("token from TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
 		// Create a temporary token file
 		expectedToken := "test-token-from-file"
 		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
@@ -395,7 +440,8 @@ func TestGetToken(t *testing.T) {
 		tokenFile.Close()
 
 		// Set TOKEN_FILE env var
-		t.Setenv("TOKEN_FILE", tokenFile.Name())
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("TOKEN_FILE")
 
 		token, err := getToken()
 		assert.NoError(t, err)
@@ -403,6 +449,8 @@ func TestGetToken(t *testing.T) {
 	})
 
 	t.Run("token from BESZEL_AGENT_TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
 		// Create a temporary token file
 		expectedToken := "test-token-from-beszel-file"
 		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
@@ -414,7 +462,8 @@ func TestGetToken(t *testing.T) {
 		tokenFile.Close()
 
 		// Set BESZEL_AGENT_TOKEN_FILE env var (should take precedence)
-		t.Setenv("BESZEL_AGENT_TOKEN_FILE", tokenFile.Name())
+		os.Setenv("BESZEL_AGENT_TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("BESZEL_AGENT_TOKEN_FILE")
 
 		token, err := getToken()
 		assert.NoError(t, err)
@@ -422,6 +471,8 @@ func TestGetToken(t *testing.T) {
 	})
 
 	t.Run("TOKEN takes precedence over TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
 		// Create a temporary token file
 		fileToken := "token-from-file"
 		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
@@ -434,8 +485,12 @@ func TestGetToken(t *testing.T) {
 
 		// Set both TOKEN and TOKEN_FILE
 		envToken := "token-from-env"
-		t.Setenv("TOKEN", envToken)
-		t.Setenv("TOKEN_FILE", tokenFile.Name())
+		os.Setenv("TOKEN", envToken)
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer func() {
+			os.Unsetenv("TOKEN")
+			os.Unsetenv("TOKEN_FILE")
+		}()
 
 		token, err := getToken()
 		assert.NoError(t, err)
@@ -443,10 +498,7 @@ func TestGetToken(t *testing.T) {
 	})
 
 	t.Run("error when neither TOKEN nor TOKEN_FILE is set", func(t *testing.T) {
-		t.Setenv("BESZEL_AGENT_TOKEN", "")
-		t.Setenv("TOKEN", "")
-		t.Setenv("BESZEL_AGENT_TOKEN_FILE", "")
-		t.Setenv("TOKEN_FILE", "")
+		unsetEnvVars()
 
 		token, err := getToken()
 		assert.Error(t, err)
@@ -455,8 +507,11 @@ func TestGetToken(t *testing.T) {
 	})
 
 	t.Run("error when TOKEN_FILE points to non-existent file", func(t *testing.T) {
+		unsetEnvVars()
+
 		// Set TOKEN_FILE to a non-existent file
-		t.Setenv("TOKEN_FILE", "/non/existent/file.txt")
+		os.Setenv("TOKEN_FILE", "/non/existent/file.txt")
+		defer os.Unsetenv("TOKEN_FILE")
 
 		token, err := getToken()
 		assert.Error(t, err)
@@ -465,6 +520,8 @@ func TestGetToken(t *testing.T) {
 	})
 
 	t.Run("handles empty token file", func(t *testing.T) {
+		unsetEnvVars()
+
 		// Create an empty token file
 		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
 		require.NoError(t, err)
@@ -472,7 +529,8 @@ func TestGetToken(t *testing.T) {
 		tokenFile.Close()
 
 		// Set TOKEN_FILE env var
-		t.Setenv("TOKEN_FILE", tokenFile.Name())
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("TOKEN_FILE")
 
 		token, err := getToken()
 		assert.NoError(t, err)
@@ -480,6 +538,8 @@ func TestGetToken(t *testing.T) {
 	})
 
 	t.Run("strips whitespace from TOKEN_FILE", func(t *testing.T) {
+		unsetEnvVars()
+
 		tokenWithWhitespace := "  test-token-with-whitespace  \n\t"
 		expectedToken := "test-token-with-whitespace"
 		tokenFile, err := os.CreateTemp("", "token-test-*.txt")
@@ -490,7 +550,8 @@ func TestGetToken(t *testing.T) {
 		require.NoError(t, err)
 		tokenFile.Close()
 
-		t.Setenv("TOKEN_FILE", tokenFile.Name())
+		os.Setenv("TOKEN_FILE", tokenFile.Name())
+		defer os.Unsetenv("TOKEN_FILE")
 
 		token, err := getToken()
 		assert.NoError(t, err)

agent/connection_manager.go

@@ -4,15 +4,11 @@ import (
 	"context"
 	"errors"
 	"log/slog"
-	"net"
-	"os"
 	"os/signal"
-	"strings"
 	"syscall"
 	"time"
 
 	"github.com/henrygd/beszel/agent/health"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
@@ -115,34 +111,11 @@ func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
 			_ = health.Update()
 		case <-sigCtx.Done():
 			slog.Info("Shutting down", "cause", context.Cause(sigCtx))
-			return c.stop()
-		}
-	}
-}
-
-// stop does not stop the connection manager itself, just any active connections. The manager will attempt to reconnect after stopping, so this should only be called immediately before shutting down the entire agent.
-//
-// If we need or want to expose a graceful Stop method in the future, do something like this to actually stop the manager:
-//
-//	func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
-//		ctx, cancel := context.WithCancel(context.Background())
-//		c.cancel = cancel
-//
-//		for {
-//			select {
-//			case <-ctx.Done():
-//				return c.stop()
-//			}
-//		}
-//	}
-//
-//	func (c *ConnectionManager) Stop() {
-//		c.cancel()
-//	}
-func (c *ConnectionManager) stop() error {
 			_ = c.agent.StopServer()
 			c.closeWebSocket()
 			return health.CleanUp()
+		}
+	}
 }
 
 // handleEvent processes connection events and updates the connection state accordingly.
@@ -212,17 +185,10 @@ func (c *ConnectionManager) connect() {
 
 	// Try WebSocket first, if it fails, start SSH server
 	err := c.startWebSocketConnection()
-	if err != nil {
-		if shouldExitOnErr(err) {
-			time.Sleep(2 * time.Second) // prevent tight restart loop
-			_ = c.stop()
-			os.Exit(1)
-		}
-		if c.State == Disconnected {
+	if err != nil && c.State == Disconnected {
 		c.startSSHServer()
 		c.startWsTicker()
 	}
-	}
 }
 
 // startWebSocketConnection attempts to establish a WebSocket connection to the hub.
@@ -258,14 +224,3 @@ func (c *ConnectionManager) closeWebSocket() {
 		c.wsClient.Close()
 	}
 }
-
-// shouldExitOnErr checks if the error is a DNS resolution failure and if the
-// EXIT_ON_DNS_ERROR env var is set. https://github.com/henrygd/beszel/issues/1924.
-func shouldExitOnErr(err error) bool {
-	if val, _ := utils.GetEnv("EXIT_ON_DNS_ERROR"); val == "true" {
-		if opErr, ok := errors.AsType[*net.OpError](err); ok {
-			return strings.Contains(opErr.Err.Error(), "lookup")
-		}
-	}
-	return false
-}

agent/connection_manager_test.go

@@ -4,10 +4,10 @@ package agent
 
 import (
 	"crypto/ed25519"
-	"errors"
 	"fmt"
 	"net"
 	"net/url"
+	"os"
 	"testing"
 	"time"
 
@@ -183,6 +183,10 @@ func TestConnectionManager_TickerManagement(t *testing.T) {
 
 // TestConnectionManager_WebSocketConnectionFlow tests WebSocket connection logic
 func TestConnectionManager_WebSocketConnectionFlow(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping WebSocket connection test in short mode")
+	}
+
 	agent := createTestAgent(t)
 	cm := agent.connectionManager
 
@@ -192,18 +196,19 @@ func TestConnectionManager_WebSocketConnectionFlow(t *testing.T) {
 	assert.Equal(t, Disconnected, cm.State, "State should remain Disconnected after failed connection")
 
 	// Test with invalid URL
-	t.Setenv("BESZEL_AGENT_HUB_URL", "1,33%")
-	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
-
-	_, err2 := newWebSocketClient(agent)
-	assert.Error(t, err2, "WebSocket client creation should fail with invalid URL")
+	os.Setenv("BESZEL_AGENT_HUB_URL", "invalid-url")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
 
 	// Test with missing token
-	t.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
-	t.Setenv("BESZEL_AGENT_TOKEN", "")
+	os.Setenv("BESZEL_AGENT_HUB_URL", "http://localhost:8080")
+	os.Unsetenv("BESZEL_AGENT_TOKEN")
 
-	_, err3 := newWebSocketClient(agent)
-	assert.Error(t, err3, "WebSocket client creation should fail without token")
+	_, err2 := newWebSocketClient(agent)
+	assert.Error(t, err2, "WebSocket client creation should fail without token")
 }
 
 // TestConnectionManager_ReconnectionLogic tests reconnection prevention logic
@@ -229,8 +234,12 @@ func TestConnectionManager_ConnectWithRateLimit(t *testing.T) {
 	cm := agent.connectionManager
 
 	// Set up environment for WebSocket client creation
-	t.Setenv("BESZEL_AGENT_HUB_URL", "ws://localhost:8080")
-	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	os.Setenv("BESZEL_AGENT_HUB_URL", "ws://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
 
 	// Create WebSocket client
 	wsClient, err := newWebSocketClient(agent)
@@ -276,8 +285,12 @@ func TestConnectionManager_CloseWebSocket(t *testing.T) {
 	}, "Should not panic when closing nil WebSocket client")
 
 	// Set up environment and create WebSocket client
-	t.Setenv("BESZEL_AGENT_HUB_URL", "ws://localhost:8080")
-	t.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	os.Setenv("BESZEL_AGENT_HUB_URL", "ws://localhost:8080")
+	os.Setenv("BESZEL_AGENT_TOKEN", "test-token")
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
 
 	wsClient, err := newWebSocketClient(agent)
 	require.NoError(t, err)
@@ -299,65 +312,3 @@ func TestConnectionManager_ConnectFlow(t *testing.T) {
 		cm.connect()
 	}, "Connect should not panic without WebSocket client")
 }
-
-func TestShouldExitOnErr(t *testing.T) {
-	createDialErr := func(msg string) error {
-		return &net.OpError{
-			Op:  "dial",
-			Net: "tcp",
-			Err: errors.New(msg),
-		}
-	}
-
-	tests := []struct {
-		name     string
-		err      error
-		envValue string
-		expected bool
-	}{
-		{
-			name:     "no env var",
-			err:      createDialErr("lookup lkahsdfasdf: no such host"),
-			envValue: "",
-			expected: false,
-		},
-		{
-			name:     "env var false",
-			err:      createDialErr("lookup lkahsdfasdf: no such host"),
-			envValue: "false",
-			expected: false,
-		},
-		{
-			name:     "env var true, matching error",
-			err:      createDialErr("lookup lkahsdfasdf: no such host"),
-			envValue: "true",
-			expected: true,
-		},
-		{
-			name:     "env var true, matching error with extra context",
-			err:      createDialErr("lookup beszel.server.lan on [::1]:53: read udp [::1]:44557->[::1]:53: read: connection refused"),
-			envValue: "true",
-			expected: true,
-		},
-		{
-			name:     "env var true, non-matching error",
-			err:      errors.New("connection refused"),
-			envValue: "true",
-			expected: false,
-		},
-		{
-			name:     "env var true, dial but not lookup",
-			err:      createDialErr("connection timeout"),
-			envValue: "true",
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Setenv("EXIT_ON_DNS_ERROR", tt.envValue)
-			result := shouldExitOnErr(tt.err)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}

agent/data_dir.go

@@ -6,8 +6,6 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
-
-	"github.com/henrygd/beszel/agent/utils"
 )
 
 // GetDataDir returns the path to the data directory for the agent and an error
@@ -18,7 +16,7 @@ func GetDataDir(dataDirs ...string) (string, error) {
 		return testDataDirs(dataDirs)
 	}
 
-	dataDir, _ := utils.GetEnv("DATA_DIR")
+	dataDir, _ := GetEnv("DATA_DIR")
 	if dataDir != "" {
 		dataDirs = append(dataDirs, dataDir)
 	}

agent/data_dir_test.go

@@ -39,7 +39,17 @@ func TestGetDataDir(t *testing.T) {
 	t.Run("DATA_DIR environment variable", func(t *testing.T) {
 		tempDir := t.TempDir()
 
-		t.Setenv("BESZEL_AGENT_DATA_DIR", tempDir)
+		// Set environment variable
+		oldValue := os.Getenv("DATA_DIR")
+		defer func() {
+			if oldValue == "" {
+				os.Unsetenv("BESZEL_AGENT_DATA_DIR")
+			} else {
+				os.Setenv("BESZEL_AGENT_DATA_DIR", oldValue)
+			}
+		}()
+
+		os.Setenv("BESZEL_AGENT_DATA_DIR", tempDir)
 
 		result, err := GetDataDir()
 		require.NoError(t, err)
@@ -55,6 +65,17 @@ func TestGetDataDir(t *testing.T) {
 
 	// Test fallback behavior (empty dataDir, no env var)
 	t.Run("fallback to default directories", func(t *testing.T) {
+		// Clear DATA_DIR environment variable
+		oldValue := os.Getenv("DATA_DIR")
+		defer func() {
+			if oldValue == "" {
+				os.Unsetenv("DATA_DIR")
+			} else {
+				os.Setenv("DATA_DIR", oldValue)
+			}
+		}()
+		os.Unsetenv("DATA_DIR")
+
 		// This will try platform-specific defaults, which may or may not work
 		// We're mainly testing that it doesn't panic and returns some result
 		result, err := GetDataDir()

agent/disk.go

@@ -1,7 +1,6 @@
 package agent
 
 import (
-	"context"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -9,59 +8,11 @@ import (
 	"strings"
 	"time"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/shirou/gopsutil/v4/disk"
 )
 
-// fsRegistrationContext holds the shared lookup state needed to resolve a
-// filesystem into the tracked fsStats key and metadata.
-type fsRegistrationContext struct {
-	filesystem     string // value of optional FILESYSTEM env var
-	isWindows      bool
-	efPath         string // path to extra filesystems (default "/extra-filesystems")
-	diskIoCounters map[string]disk.IOCountersStat
-}
-
-// diskDiscovery groups the transient state for a single initializeDiskInfo run so
-// helper methods can share the same partitions, mount paths, and lookup functions
-type diskDiscovery struct {
-	agent          *Agent
-	rootMountPoint string
-	partitions     []disk.PartitionStat
-	usageFn        func(string) (*disk.UsageStat, error)
-	ctx            fsRegistrationContext
-}
-
-// prevDisk stores previous per-device disk counters for a given cache interval
-type prevDisk struct {
-	readBytes  uint64
-	writeBytes uint64
-	readTime   uint64 // cumulative ms spent on reads (from ReadTime)
-	writeTime  uint64 // cumulative ms spent on writes (from WriteTime)
-	ioTime     uint64 // cumulative ms spent doing I/O (from IoTime)
-	weightedIO uint64 // cumulative weighted ms (queue-depth × ms, from WeightedIO)
-	readCount  uint64 // cumulative read operation count
-	writeCount uint64 // cumulative write operation count
-	at         time.Time
-}
-
-// prevDiskFromCounter creates a prevDisk snapshot from a disk.IOCountersStat at time t.
-func prevDiskFromCounter(d disk.IOCountersStat, t time.Time) prevDisk {
-	return prevDisk{
-		readBytes:  d.ReadBytes,
-		writeBytes: d.WriteBytes,
-		readTime:   d.ReadTime,
-		writeTime:  d.WriteTime,
-		ioTime:     d.IoTime,
-		weightedIO: d.WeightedIO,
-		readCount:  d.ReadCount,
-		writeCount: d.WriteCount,
-		at:         t,
-	}
-}
-
 // parseFilesystemEntry parses a filesystem entry in the format "device__customname"
 // Returns the device/filesystem part and the custom name part
 func parseFilesystemEntry(entry string) (device, customName string) {
@@ -75,236 +26,23 @@ func parseFilesystemEntry(entry string) (device, customName string) {
 	return device, customName
 }
 
-// extraFilesystemPartitionInfo derives the I/O device and optional display name
-// for a mounted /extra-filesystems partition. Prefer the partition device reported
-// by the system and only use the folder name for custom naming metadata.
-func extraFilesystemPartitionInfo(p disk.PartitionStat) (device, customName string) {
-	device = strings.TrimSpace(p.Device)
-	folderDevice, customName := parseFilesystemEntry(filepath.Base(p.Mountpoint))
-	if device == "" {
-		device = folderDevice
-	}
-	return device, customName
-}
-
 func isDockerSpecialMountpoint(mountpoint string) bool {
 	switch mountpoint {
 	case "/etc/hosts", "/etc/resolv.conf", "/etc/hostname":
 		return true
-	}
+	default:
 		return false
-}
-
-// registerFilesystemStats resolves the tracked key and stats payload for a
-// filesystem before it is inserted into fsStats.
-func registerFilesystemStats(existing map[string]*system.FsStats, device, mountpoint string, root bool, customName string, ctx fsRegistrationContext) (string, *system.FsStats, bool) {
-	key := device
-	if !ctx.isWindows {
-		key = filepath.Base(device)
-	}
-
-	if root {
-		// Try to map root device to a diskIoCounters entry. First checks for an
-		// exact key match, then uses findIoDevice for normalized / prefix-based
-		// matching (e.g. nda0p2 -> nda0), and finally falls back to FILESYSTEM.
-		if _, ioMatch := ctx.diskIoCounters[key]; !ioMatch {
-			if matchedKey, match := findIoDevice(key, ctx.diskIoCounters); match {
-				key = matchedKey
-			} else if ctx.filesystem != "" {
-				if matchedKey, match := findIoDevice(ctx.filesystem, ctx.diskIoCounters); match {
-					key = matchedKey
-				}
-			}
-			if _, ioMatch = ctx.diskIoCounters[key]; !ioMatch {
-				slog.Warn("Root I/O unmapped; set FILESYSTEM", "device", device, "mountpoint", mountpoint)
-			}
-		}
-	} else {
-		// Check if non-root has diskstats and prefer the folder device for
-		// /extra-filesystems mounts when the discovered partition device is a
-		// mapper path (e.g. luks UUID) that obscures the underlying block device.
-		if _, ioMatch := ctx.diskIoCounters[key]; !ioMatch {
-			if strings.HasPrefix(mountpoint, ctx.efPath) {
-				folderDevice, _ := parseFilesystemEntry(filepath.Base(mountpoint))
-				if folderDevice != "" {
-					if matchedKey, match := findIoDevice(folderDevice, ctx.diskIoCounters); match {
-						key = matchedKey
-					}
-				}
-			}
-			if _, ioMatch = ctx.diskIoCounters[key]; !ioMatch {
-				if matchedKey, match := findIoDevice(key, ctx.diskIoCounters); match {
-					key = matchedKey
-				}
-			}
-		}
-	}
-
-	if _, exists := existing[key]; exists {
-		return "", nil, false
-	}
-
-	fsStats := &system.FsStats{Root: root, Mountpoint: mountpoint}
-	if customName != "" {
-		fsStats.Name = customName
-	}
-	return key, fsStats, true
-}
-
-// addFsStat inserts a discovered filesystem if it resolves to a new tracking
-// key. The key selection itself lives in buildFsStatRegistration so that logic
-// can stay directly unit-tested.
-func (d *diskDiscovery) addFsStat(device, mountpoint string, root bool, customName string) {
-	key, fsStats, ok := registerFilesystemStats(d.agent.fsStats, device, mountpoint, root, customName, d.ctx)
-	if !ok {
-		return
-	}
-	d.agent.fsStats[key] = fsStats
-	name := key
-	if customName != "" {
-		name = customName
-	}
-	slog.Info("Detected disk", "name", name, "device", device, "mount", mountpoint, "io", key, "root", root)
-}
-
-// addConfiguredRootFs resolves FILESYSTEM against partitions first, then falls
-// back to direct diskstats matching for setups like ZFS where partitions do not
-// expose the physical device name.
-func (d *diskDiscovery) addConfiguredRootFs() bool {
-	if d.ctx.filesystem == "" {
-		return false
-	}
-
-	for _, p := range d.partitions {
-		if filesystemMatchesPartitionSetting(d.ctx.filesystem, p) {
-			d.addFsStat(p.Device, p.Mountpoint, true, "")
-			return true
-		}
-	}
-
-	// FILESYSTEM may name a physical disk absent from partitions (e.g. ZFS lists
-	// dataset paths like zroot/ROOT/default, not block devices).
-	if ioKey, match := findIoDevice(d.ctx.filesystem, d.ctx.diskIoCounters); match {
-		d.agent.fsStats[ioKey] = &system.FsStats{Root: true, Mountpoint: d.rootMountPoint}
-		return true
-	}
-
-	slog.Warn("Partition details not found", "filesystem", d.ctx.filesystem)
-	return false
-}
-
-func isRootFallbackPartition(p disk.PartitionStat, rootMountPoint string) bool {
-	return p.Mountpoint == rootMountPoint ||
-		(isDockerSpecialMountpoint(p.Mountpoint) && strings.HasPrefix(p.Device, "/dev"))
-}
-
-// addPartitionRootFs handles the non-configured root fallback path when a
-// partition looks like the active root mount but still needs translating to an
-// I/O device key.
-func (d *diskDiscovery) addPartitionRootFs(device, mountpoint string) bool {
-	fs, match := findIoDevice(filepath.Base(device), d.ctx.diskIoCounters)
-	if !match {
-		return false
-	}
-	// The resolved I/O device is already known here, so use it directly to avoid
-	// a second fallback search inside buildFsStatRegistration.
-	d.addFsStat(fs, mountpoint, true, "")
-	return true
-}
-
-// addLastResortRootFs is only used when neither FILESYSTEM nor partition-based
-// heuristics can identify root, so it picks the busiest I/O device as a final
-// fallback and preserves the root mountpoint for usage collection.
-func (d *diskDiscovery) addLastResortRootFs() {
-	rootKey := mostActiveIoDevice(d.ctx.diskIoCounters)
-	if rootKey != "" {
-		slog.Warn("Using most active device for root I/O; set FILESYSTEM to override", "device", rootKey)
-	} else {
-		rootKey = filepath.Base(d.rootMountPoint)
-		if _, exists := d.agent.fsStats[rootKey]; exists {
-			rootKey = "root"
-		}
-		slog.Warn("Root I/O device not detected; set FILESYSTEM to override")
-	}
-	d.agent.fsStats[rootKey] = &system.FsStats{Root: true, Mountpoint: d.rootMountPoint}
-}
-
-// findPartitionByFilesystemSetting matches an EXTRA_FILESYSTEMS entry against a
-// discovered partition either by mountpoint or by device suffix.
-func findPartitionByFilesystemSetting(filesystem string, partitions []disk.PartitionStat) (disk.PartitionStat, bool) {
-	for _, p := range partitions {
-		if strings.HasSuffix(p.Device, filesystem) || p.Mountpoint == filesystem {
-			return p, true
-		}
-	}
-	return disk.PartitionStat{}, false
-}
-
-// addConfiguredExtraFsEntry resolves one EXTRA_FILESYSTEMS entry, preferring a
-// discovered partition and falling back to any path that disk.Usage accepts.
-func (d *diskDiscovery) addConfiguredExtraFsEntry(filesystem, customName string) {
-	if p, found := findPartitionByFilesystemSetting(filesystem, d.partitions); found {
-		d.addFsStat(p.Device, p.Mountpoint, false, customName)
-		return
-	}
-
-	if _, err := d.usageFn(filesystem); err == nil {
-		d.addFsStat(filepath.Base(filesystem), filesystem, false, customName)
-		return
-	} else {
-		slog.Error("Invalid filesystem", "name", filesystem, "err", err)
-	}
-}
-
-// addConfiguredExtraFilesystems parses and registers the comma-separated
-// EXTRA_FILESYSTEMS env var entries.
-func (d *diskDiscovery) addConfiguredExtraFilesystems(extraFilesystems string) {
-	for fsEntry := range strings.SplitSeq(extraFilesystems, ",") {
-		filesystem, customName := parseFilesystemEntry(fsEntry)
-		d.addConfiguredExtraFsEntry(filesystem, customName)
-	}
-}
-
-// addPartitionExtraFs registers partitions mounted under /extra-filesystems so
-// their display names can come from the folder name while their I/O keys still
-// prefer the underlying partition device. Only direct children are matched to
-// avoid registering nested virtual mounts (e.g. /proc, /sys) that are returned by
-// disk.Partitions(true) when the host root is bind-mounted in /extra-filesystems.
-func (d *diskDiscovery) addPartitionExtraFs(p disk.PartitionStat) {
-	if filepath.Dir(p.Mountpoint) != d.ctx.efPath {
-		return
-	}
-	device, customName := extraFilesystemPartitionInfo(p)
-	d.addFsStat(device, p.Mountpoint, false, customName)
-}
-
-// addExtraFilesystemFolders handles bare directories under /extra-filesystems
-// that may not appear in partition discovery, while skipping mountpoints that
-// were already registered from higher-fidelity sources.
-func (d *diskDiscovery) addExtraFilesystemFolders(folderNames []string) {
-	existingMountpoints := make(map[string]bool, len(d.agent.fsStats))
-	for _, stats := range d.agent.fsStats {
-		existingMountpoints[stats.Mountpoint] = true
-	}
-
-	for _, folderName := range folderNames {
-		mountpoint := filepath.Join(d.ctx.efPath, folderName)
-		slog.Debug("/extra-filesystems", "mountpoint", mountpoint)
-		if existingMountpoints[mountpoint] {
-			continue
-		}
-		device, customName := parseFilesystemEntry(folderName)
-		d.addFsStat(device, mountpoint, false, customName)
 	}
 }
 
 // Sets up the filesystems to monitor for disk usage and I/O.
 func (a *Agent) initializeDiskInfo() {
-	filesystem, _ := utils.GetEnv("FILESYSTEM")
+	filesystem, _ := GetEnv("FILESYSTEM")
+	efPath := "/extra-filesystems"
 	hasRoot := false
 	isWindows := runtime.GOOS == "windows"
 
-	partitions, err := disk.PartitionsWithContext(context.Background(), true)
+	partitions, err := disk.Partitions(false)
 	if err != nil {
 		slog.Error("Error getting disk partitions", "err", err)
 	}
@@ -317,57 +55,167 @@ func (a *Agent) initializeDiskInfo() {
 		}
 	}
 
+	// ioContext := context.WithValue(a.sensorsContext,
+	// 	common.EnvKey, common.EnvMap{common.HostProcEnvKey: "/tmp/testproc"},
+	// )
+	// diskIoCounters, err := disk.IOCountersWithContext(ioContext)
+
 	diskIoCounters, err := disk.IOCounters()
 	if err != nil {
 		slog.Error("Error getting diskstats", "err", err)
 	}
 	slog.Debug("Disk I/O", "diskstats", diskIoCounters)
-	ctx := fsRegistrationContext{
-		filesystem:     filesystem,
-		isWindows:      isWindows,
-		diskIoCounters: diskIoCounters,
-		efPath:         "/extra-filesystems",
+
+	// Helper function to add a filesystem to fsStats if it doesn't exist
+	addFsStat := func(device, mountpoint string, root bool, customName ...string) {
+		var key string
+		if isWindows {
+			key = device
+		} else {
+			key = filepath.Base(device)
+		}
+		var ioMatch bool
+		if _, exists := a.fsStats[key]; !exists {
+			if root {
+				slog.Info("Detected root device", "name", key)
+				// Try to map root device to a diskIoCounters entry. First
+				// checks for an exact key match, then uses findIoDevice for
+				// normalized / prefix-based matching (e.g. nda0p2 → nda0),
+				// and finally falls back to the FILESYSTEM env var.
+				if _, ioMatch = diskIoCounters[key]; !ioMatch {
+					if matchedKey, match := findIoDevice(key, diskIoCounters); match {
+						key = matchedKey
+						ioMatch = true
+					} else if filesystem != "" {
+						if matchedKey, match := findIoDevice(filesystem, diskIoCounters); match {
+							key = matchedKey
+							ioMatch = true
+						}
+					}
+					if !ioMatch {
+						slog.Warn("Root I/O unmapped; set FILESYSTEM", "device", device, "mountpoint", mountpoint)
+					}
+				}
+			} else {
+				// Check if non-root has diskstats and fall back to folder name if not
+				// Scenario: device is encrypted and named luks-2bcb02be-999d-4417-8d18-5c61e660fb6e - not in /proc/diskstats.
+				// However, the device can be specified by mounting folder from luks device at /extra-filesystems/sda1
+				if _, ioMatch = diskIoCounters[key]; !ioMatch {
+					efBase := filepath.Base(mountpoint)
+					if _, ioMatch = diskIoCounters[efBase]; ioMatch {
+						key = efBase
+					}
+				}
+			}
+			fsStats := &system.FsStats{Root: root, Mountpoint: mountpoint}
+			if len(customName) > 0 && customName[0] != "" {
+				fsStats.Name = customName[0]
+			}
+			a.fsStats[key] = fsStats
+		}
 	}
 
 	// Get the appropriate root mount point for this system
-	discovery := diskDiscovery{
-		agent:          a,
-		rootMountPoint: a.getRootMountPoint(),
-		partitions:     partitions,
-		usageFn:        disk.Usage,
-		ctx:            ctx,
+	rootMountPoint := a.getRootMountPoint()
+
+	// Use FILESYSTEM env var to find root filesystem
+	if filesystem != "" {
+		for _, p := range partitions {
+			if filesystemMatchesPartitionSetting(filesystem, p) {
+				addFsStat(p.Device, p.Mountpoint, true)
+				hasRoot = true
+				break
+			}
+		}
+		if !hasRoot {
+			// FILESYSTEM may name a physical disk absent from partitions (e.g.
+			// ZFS lists dataset paths like zroot/ROOT/default, not block devices).
+			// Try matching directly against diskIoCounters.
+			if ioKey, match := findIoDevice(filesystem, diskIoCounters); match {
+				a.fsStats[ioKey] = &system.FsStats{Root: true, Mountpoint: rootMountPoint}
+				hasRoot = true
+			} else {
+				slog.Warn("Partition details not found", "filesystem", filesystem)
+			}
+		}
 	}
 
-	hasRoot = discovery.addConfiguredRootFs()
-
 	// Add EXTRA_FILESYSTEMS env var values to fsStats
-	if extraFilesystems, exists := utils.GetEnv("EXTRA_FILESYSTEMS"); exists {
-		discovery.addConfiguredExtraFilesystems(extraFilesystems)
+	if extraFilesystems, exists := GetEnv("EXTRA_FILESYSTEMS"); exists {
+		for fsEntry := range strings.SplitSeq(extraFilesystems, ",") {
+			// Parse custom name from format: device__customname
+			fs, customName := parseFilesystemEntry(fsEntry)
+
+			found := false
+			for _, p := range partitions {
+				if strings.HasSuffix(p.Device, fs) || p.Mountpoint == fs {
+					addFsStat(p.Device, p.Mountpoint, false, customName)
+					found = true
+					break
+				}
+			}
+			// if not in partitions, test if we can get disk usage
+			if !found {
+				if _, err := disk.Usage(fs); err == nil {
+					addFsStat(filepath.Base(fs), fs, false, customName)
+				} else {
+					slog.Error("Invalid filesystem", "name", fs, "err", err)
+				}
+			}
+		}
 	}
 
 	// Process partitions for various mount points
 	for _, p := range partitions {
-		if !hasRoot && isRootFallbackPartition(p, discovery.rootMountPoint) {
-			hasRoot = discovery.addPartitionRootFs(p.Device, p.Mountpoint)
+		// fmt.Println(p.Device, p.Mountpoint)
+		// Binary root fallback or docker root fallback
+		if !hasRoot && (p.Mountpoint == rootMountPoint || (isDockerSpecialMountpoint(p.Mountpoint) && strings.HasPrefix(p.Device, "/dev"))) {
+			fs, match := findIoDevice(filepath.Base(p.Device), diskIoCounters)
+			if match {
+				addFsStat(fs, p.Mountpoint, true)
+				hasRoot = true
+			}
+		}
+
+		// Check if device is in /extra-filesystems
+		if strings.HasPrefix(p.Mountpoint, efPath) {
+			device, customName := parseFilesystemEntry(p.Mountpoint)
+			addFsStat(device, p.Mountpoint, false, customName)
 		}
-		discovery.addPartitionExtraFs(p)
 	}
 
 	// Check all folders in /extra-filesystems and add them if not already present
-	if folders, err := os.ReadDir(discovery.ctx.efPath); err == nil {
-		folderNames := make([]string, 0, len(folders))
+	if folders, err := os.ReadDir(efPath); err == nil {
+		existingMountpoints := make(map[string]bool)
+		for _, stats := range a.fsStats {
+			existingMountpoints[stats.Mountpoint] = true
+		}
 		for _, folder := range folders {
 			if folder.IsDir() {
-				folderNames = append(folderNames, folder.Name())
+				mountpoint := filepath.Join(efPath, folder.Name())
+				slog.Debug("/extra-filesystems", "mountpoint", mountpoint)
+				if !existingMountpoints[mountpoint] {
+					device, customName := parseFilesystemEntry(folder.Name())
+					addFsStat(device, mountpoint, false, customName)
+				}
 			}
 		}
-		discovery.addExtraFilesystemFolders(folderNames)
 	}
 
 	// If no root filesystem set, try the most active I/O device as a last
 	// resort (e.g. ZFS where dataset names are unrelated to disk names).
 	if !hasRoot {
-		discovery.addLastResortRootFs()
+		rootKey := mostActiveIoDevice(diskIoCounters)
+		if rootKey != "" {
+			slog.Warn("Using most active device for root I/O; set FILESYSTEM to override", "device", rootKey)
+		} else {
+			rootKey = filepath.Base(rootMountPoint)
+			if _, exists := a.fsStats[rootKey]; exists {
+				rootKey = "root"
+			}
+			slog.Warn("Root I/O device not detected; set FILESYSTEM to override")
+		}
+		a.fsStats[rootKey] = &system.FsStats{Root: true, Mountpoint: rootMountPoint}
 	}
 
 	a.pruneDuplicateRootExtraFilesystems()
@@ -532,8 +380,6 @@ func normalizeDeviceName(value string) string {
 
 // Sets start values for disk I/O stats.
 func (a *Agent) initializeDiskIoStats(diskIoCounters map[string]disk.IOCountersStat) {
-	a.fsNames = a.fsNames[:0]
-	now := time.Now()
 	for device, stats := range a.fsStats {
 		// skip if not in diskIoCounters
 		d, exists := diskIoCounters[device]
@@ -542,7 +388,7 @@ func (a *Agent) initializeDiskIoStats(diskIoCounters map[string]disk.IOCountersS
 			continue
 		}
 		// populate initial values
-		stats.Time = now
+		stats.Time = time.Now()
 		stats.TotalRead = d.ReadBytes
 		stats.TotalWrite = d.WriteBytes
 		// add to list of valid io device names
@@ -566,12 +412,12 @@ func (a *Agent) updateDiskUsage(systemStats *system.Stats) {
 			continue
 		}
 		if d, err := disk.Usage(stats.Mountpoint); err == nil {
-			stats.DiskTotal = utils.BytesToGigabytes(d.Total)
-			stats.DiskUsed = utils.BytesToGigabytes(d.Used)
+			stats.DiskTotal = bytesToGigabytes(d.Total)
+			stats.DiskUsed = bytesToGigabytes(d.Used)
 			if stats.Root {
-				systemStats.DiskTotal = utils.BytesToGigabytes(d.Total)
-				systemStats.DiskUsed = utils.BytesToGigabytes(d.Used)
-				systemStats.DiskPct = utils.TwoDecimals(d.UsedPercent)
+				systemStats.DiskTotal = bytesToGigabytes(d.Total)
+				systemStats.DiskUsed = bytesToGigabytes(d.Used)
+				systemStats.DiskPct = twoDecimals(d.UsedPercent)
 			}
 		} else {
 			// reset stats if error (likely unmounted)
@@ -609,72 +455,36 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 			prev, hasPrev := a.diskPrev[cacheTimeMs][name]
 			if !hasPrev {
 				// Seed from agent-level fsStats if present, else seed from current
-				prev = prevDisk{
-					readBytes:  stats.TotalRead,
-					writeBytes: stats.TotalWrite,
-					readTime:   d.ReadTime,
-					writeTime:  d.WriteTime,
-					ioTime:     d.IoTime,
-					weightedIO: d.WeightedIO,
-					readCount:  d.ReadCount,
-					writeCount: d.WriteCount,
-					at:         stats.Time,
-				}
+				prev = prevDisk{readBytes: stats.TotalRead, writeBytes: stats.TotalWrite, at: stats.Time}
 				if prev.at.IsZero() {
-					prev = prevDiskFromCounter(d, now)
+					prev = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 				}
 			}
 
 			msElapsed := uint64(now.Sub(prev.at).Milliseconds())
-
-			// Update per-interval snapshot
-			a.diskPrev[cacheTimeMs][name] = prevDiskFromCounter(d, now)
-
-			// Avoid division by zero or clock issues
 			if msElapsed < 100 {
+				// Avoid division by zero or clock issues; update snapshot and continue
+				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 				continue
 			}
 
 			diskIORead := (d.ReadBytes - prev.readBytes) * 1000 / msElapsed
 			diskIOWrite := (d.WriteBytes - prev.writeBytes) * 1000 / msElapsed
-			readMbPerSecond := utils.BytesToMegabytes(float64(diskIORead))
-			writeMbPerSecond := utils.BytesToMegabytes(float64(diskIOWrite))
+			readMbPerSecond := bytesToMegabytes(float64(diskIORead))
+			writeMbPerSecond := bytesToMegabytes(float64(diskIOWrite))
 
 			// validate values
 			if readMbPerSecond > 50_000 || writeMbPerSecond > 50_000 {
 				slog.Warn("Invalid disk I/O. Resetting.", "name", d.Name, "read", readMbPerSecond, "write", writeMbPerSecond)
+				// Reset interval snapshot and seed from current
+				a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 				// also refresh agent baseline to avoid future negatives
 				a.initializeDiskIoStats(ioCounters)
 				continue
 			}
 
-			// These properties are calculated differently on different platforms,
-			// but generally represent cumulative time spent doing reads/writes on the device.
-			// This can surpass 100% if there are multiple concurrent I/O operations.
-			// Linux kernel docs:
-			// This is the total number of milliseconds spent by all reads (as
-			// measured from __make_request() to end_that_request_last()).
-			// https://www.kernel.org/doc/Documentation/iostats.txt (fields 4, 8)
-			diskReadTime := utils.TwoDecimals(float64(d.ReadTime-prev.readTime) / float64(msElapsed) * 100)
-			diskWriteTime := utils.TwoDecimals(float64(d.WriteTime-prev.writeTime) / float64(msElapsed) * 100)
-
-			// I/O utilization %: fraction of wall time the device had any I/O in progress (0-100).
-			diskIoUtilPct := utils.TwoDecimals(float64(d.IoTime-prev.ioTime) / float64(msElapsed) * 100)
-
-			// Weighted I/O: queue-depth weighted I/O time, normalized to interval (can exceed 100%).
-			// Linux kernel field 11: incremented by iops_in_progress × ms_since_last_update.
-			// Used to display queue depth. Multipled by 100 to increase accuracy of digit truncation (divided by 100 in UI).
-			diskWeightedIO := utils.TwoDecimals(float64(d.WeightedIO-prev.weightedIO) / float64(msElapsed) * 100)
-
-			// r_await / w_await: average time per read/write operation in milliseconds.
-			// Equivalent to r_await and w_await in iostat.
-			var rAwait, wAwait float64
-			if deltaReadCount := d.ReadCount - prev.readCount; deltaReadCount > 0 {
-				rAwait = utils.TwoDecimals(float64(d.ReadTime-prev.readTime) / float64(deltaReadCount))
-			}
-			if deltaWriteCount := d.WriteCount - prev.writeCount; deltaWriteCount > 0 {
-				wAwait = utils.TwoDecimals(float64(d.WriteTime-prev.writeTime) / float64(deltaWriteCount))
-			}
+			// Update per-interval snapshot
+			a.diskPrev[cacheTimeMs][name] = prevDisk{readBytes: d.ReadBytes, writeBytes: d.WriteBytes, at: now}
 
 			// Update global fsStats baseline for cross-interval correctness
 			stats.Time = now
@@ -684,40 +494,20 @@ func (a *Agent) updateDiskIo(cacheTimeMs uint16, systemStats *system.Stats) {
 			stats.DiskWritePs = writeMbPerSecond
 			stats.DiskReadBytes = diskIORead
 			stats.DiskWriteBytes = diskIOWrite
-			stats.DiskIoStats[0] = diskReadTime
-			stats.DiskIoStats[1] = diskWriteTime
-			stats.DiskIoStats[2] = diskIoUtilPct
-			stats.DiskIoStats[3] = rAwait
-			stats.DiskIoStats[4] = wAwait
-			stats.DiskIoStats[5] = diskWeightedIO
 
 			if stats.Root {
 				systemStats.DiskReadPs = stats.DiskReadPs
 				systemStats.DiskWritePs = stats.DiskWritePs
 				systemStats.DiskIO[0] = diskIORead
 				systemStats.DiskIO[1] = diskIOWrite
-				systemStats.DiskIoStats[0] = diskReadTime
-				systemStats.DiskIoStats[1] = diskWriteTime
-				systemStats.DiskIoStats[2] = diskIoUtilPct
-				systemStats.DiskIoStats[3] = rAwait
-				systemStats.DiskIoStats[4] = wAwait
-				systemStats.DiskIoStats[5] = diskWeightedIO
 			}
 		}
 	}
 }
 
-// getRootMountPoint returns the appropriate root mount point for the system.
-// On Windows it returns the system drive (e.g. "C:").
+// getRootMountPoint returns the appropriate root mount point for the system
 // For immutable systems like Fedora Silverblue, it returns /sysroot instead of /
 func (a *Agent) getRootMountPoint() string {
-	if runtime.GOOS == "windows" {
-		if sd := os.Getenv("SystemDrive"); sd != "" {
-			return sd
-		}
-		return "C:"
-	}
-
 	// 1. Check if /etc/os-release contains indicators of an immutable system
 	if osReleaseContent, err := os.ReadFile("/etc/os-release"); err == nil {
 		content := string(osReleaseContent)

agent/disk_test.go

@@ -93,524 +93,6 @@ func TestParseFilesystemEntry(t *testing.T) {
 	}
 }
 
-func TestExtraFilesystemPartitionInfo(t *testing.T) {
-	t.Run("uses partition device for label-only mountpoint", func(t *testing.T) {
-		device, customName := extraFilesystemPartitionInfo(disk.PartitionStat{
-			Device:     "/dev/sdc",
-			Mountpoint: "/extra-filesystems/Share",
-		})
-
-		assert.Equal(t, "/dev/sdc", device)
-		assert.Equal(t, "", customName)
-	})
-
-	t.Run("uses custom name from mountpoint suffix", func(t *testing.T) {
-		device, customName := extraFilesystemPartitionInfo(disk.PartitionStat{
-			Device:     "/dev/sdc",
-			Mountpoint: "/extra-filesystems/sdc__Share",
-		})
-
-		assert.Equal(t, "/dev/sdc", device)
-		assert.Equal(t, "Share", customName)
-	})
-
-	t.Run("falls back to folder device when partition device is unavailable", func(t *testing.T) {
-		device, customName := extraFilesystemPartitionInfo(disk.PartitionStat{
-			Mountpoint: "/extra-filesystems/sdc__Share",
-		})
-
-		assert.Equal(t, "sdc", device)
-		assert.Equal(t, "Share", customName)
-	})
-
-	t.Run("supports custom name without folder device prefix", func(t *testing.T) {
-		device, customName := extraFilesystemPartitionInfo(disk.PartitionStat{
-			Device:     "/dev/sdc",
-			Mountpoint: "/extra-filesystems/__Share",
-		})
-
-		assert.Equal(t, "/dev/sdc", device)
-		assert.Equal(t, "Share", customName)
-	})
-}
-
-func TestBuildFsStatRegistration(t *testing.T) {
-	t.Run("uses basename for non-windows exact io match", func(t *testing.T) {
-		key, stats, ok := registerFilesystemStats(
-			map[string]*system.FsStats{},
-			"/dev/sda1",
-			"/mnt/data",
-			false,
-			"archive",
-			fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"sda1": {Name: "sda1"},
-				},
-			},
-		)
-
-		assert.True(t, ok)
-		assert.Equal(t, "sda1", key)
-		assert.Equal(t, "/mnt/data", stats.Mountpoint)
-		assert.Equal(t, "archive", stats.Name)
-		assert.False(t, stats.Root)
-	})
-
-	t.Run("maps root partition to io device by prefix", func(t *testing.T) {
-		key, stats, ok := registerFilesystemStats(
-			map[string]*system.FsStats{},
-			"/dev/ada0p2",
-			"/",
-			true,
-			"",
-			fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"ada0": {Name: "ada0", ReadBytes: 1000, WriteBytes: 1000},
-				},
-			},
-		)
-
-		assert.True(t, ok)
-		assert.Equal(t, "ada0", key)
-		assert.True(t, stats.Root)
-		assert.Equal(t, "/", stats.Mountpoint)
-	})
-
-	t.Run("uses filesystem setting as root fallback", func(t *testing.T) {
-		key, _, ok := registerFilesystemStats(
-			map[string]*system.FsStats{},
-			"overlay",
-			"/",
-			true,
-			"",
-			fsRegistrationContext{
-				filesystem: "nvme0n1p2",
-				isWindows:  false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"nvme0n1": {Name: "nvme0n1", ReadBytes: 1000, WriteBytes: 1000},
-				},
-			},
-		)
-
-		assert.True(t, ok)
-		assert.Equal(t, "nvme0n1", key)
-	})
-
-	t.Run("prefers parsed extra-filesystems device over mapper device", func(t *testing.T) {
-		key, stats, ok := registerFilesystemStats(
-			map[string]*system.FsStats{},
-			"/dev/mapper/luks-2bcb02be-999d-4417-8d18-5c61e660fb6e",
-			"/extra-filesystems/nvme0n1p2__Archive",
-			false,
-			"Archive",
-			fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"dm-1":      {Name: "dm-1", Label: "luks-2bcb02be-999d-4417-8d18-5c61e660fb6e"},
-					"nvme0n1p2": {Name: "nvme0n1p2"},
-				},
-			},
-		)
-
-		assert.True(t, ok)
-		assert.Equal(t, "nvme0n1p2", key)
-		assert.Equal(t, "Archive", stats.Name)
-	})
-
-	t.Run("falls back to mapper io device when folder device cannot be resolved", func(t *testing.T) {
-		key, stats, ok := registerFilesystemStats(
-			map[string]*system.FsStats{},
-			"/dev/mapper/luks-2bcb02be-999d-4417-8d18-5c61e660fb6e",
-			"/extra-filesystems/Archive",
-			false,
-			"Archive",
-			fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"dm-1": {Name: "dm-1", Label: "luks-2bcb02be-999d-4417-8d18-5c61e660fb6e"},
-				},
-			},
-		)
-
-		assert.True(t, ok)
-		assert.Equal(t, "dm-1", key)
-		assert.Equal(t, "Archive", stats.Name)
-	})
-
-	t.Run("uses full device name on windows", func(t *testing.T) {
-		key, _, ok := registerFilesystemStats(
-			map[string]*system.FsStats{},
-			`C:`,
-			`C:\\`,
-			false,
-			"",
-			fsRegistrationContext{
-				isWindows: true,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					`C:`: {Name: `C:`},
-				},
-			},
-		)
-
-		assert.True(t, ok)
-		assert.Equal(t, `C:`, key)
-	})
-
-	t.Run("skips existing key", func(t *testing.T) {
-		key, stats, ok := registerFilesystemStats(
-			map[string]*system.FsStats{"sda1": {Mountpoint: "/existing"}},
-			"/dev/sda1",
-			"/mnt/data",
-			false,
-			"",
-			fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"sda1": {Name: "sda1"},
-				},
-			},
-		)
-
-		assert.False(t, ok)
-		assert.Empty(t, key)
-		assert.Nil(t, stats)
-	})
-}
-
-func TestAddConfiguredRootFs(t *testing.T) {
-	t.Run("adds root from matching partition", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{
-			agent:          agent,
-			rootMountPoint: "/",
-			partitions:     []disk.PartitionStat{{Device: "/dev/ada0p2", Mountpoint: "/"}},
-			ctx: fsRegistrationContext{
-				filesystem: "/dev/ada0p2",
-				isWindows:  false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"ada0": {Name: "ada0", ReadBytes: 1000, WriteBytes: 1000},
-				},
-			},
-		}
-
-		ok := discovery.addConfiguredRootFs()
-
-		assert.True(t, ok)
-		stats, exists := agent.fsStats["ada0"]
-		assert.True(t, exists)
-		assert.True(t, stats.Root)
-		assert.Equal(t, "/", stats.Mountpoint)
-	})
-
-	t.Run("adds root from io device when partition is missing", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{
-			agent:          agent,
-			rootMountPoint: "/sysroot",
-			ctx: fsRegistrationContext{
-				filesystem: "zroot",
-				isWindows:  false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"nda0": {Name: "nda0", Label: "zroot", ReadBytes: 1000, WriteBytes: 1000},
-				},
-			},
-		}
-
-		ok := discovery.addConfiguredRootFs()
-
-		assert.True(t, ok)
-		stats, exists := agent.fsStats["nda0"]
-		assert.True(t, exists)
-		assert.True(t, stats.Root)
-		assert.Equal(t, "/sysroot", stats.Mountpoint)
-	})
-
-	t.Run("returns false when filesystem cannot be resolved", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{
-			agent:          agent,
-			rootMountPoint: "/",
-			ctx: fsRegistrationContext{
-				filesystem:     "missing-disk",
-				isWindows:      false,
-				diskIoCounters: map[string]disk.IOCountersStat{},
-			},
-		}
-
-		ok := discovery.addConfiguredRootFs()
-
-		assert.False(t, ok)
-		assert.Empty(t, agent.fsStats)
-	})
-}
-
-func TestAddPartitionRootFs(t *testing.T) {
-	t.Run("adds root from fallback partition candidate", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{
-			agent: agent,
-			ctx: fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"nvme0n1": {Name: "nvme0n1", ReadBytes: 1000, WriteBytes: 1000},
-				},
-			},
-		}
-
-		ok := discovery.addPartitionRootFs("/dev/nvme0n1p2", "/")
-
-		assert.True(t, ok)
-		stats, exists := agent.fsStats["nvme0n1"]
-		assert.True(t, exists)
-		assert.True(t, stats.Root)
-		assert.Equal(t, "/", stats.Mountpoint)
-	})
-
-	t.Run("returns false when no io device matches", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{agent: agent, ctx: fsRegistrationContext{diskIoCounters: map[string]disk.IOCountersStat{}}}
-
-		ok := discovery.addPartitionRootFs("/dev/mapper/root", "/")
-
-		assert.False(t, ok)
-		assert.Empty(t, agent.fsStats)
-	})
-}
-
-func TestAddLastResortRootFs(t *testing.T) {
-	t.Run("uses most active io device when available", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{agent: agent, rootMountPoint: "/", ctx: fsRegistrationContext{diskIoCounters: map[string]disk.IOCountersStat{
-			"sda": {Name: "sda", ReadBytes: 5000, WriteBytes: 5000},
-			"sdb": {Name: "sdb", ReadBytes: 1000, WriteBytes: 1000},
-		}}}
-
-		discovery.addLastResortRootFs()
-
-		stats, exists := agent.fsStats["sda"]
-		assert.True(t, exists)
-		assert.True(t, stats.Root)
-	})
-
-	t.Run("falls back to root key when mountpoint basename collides", func(t *testing.T) {
-		agent := &Agent{fsStats: map[string]*system.FsStats{
-			"sysroot": {Mountpoint: "/extra-filesystems/sysroot"},
-		}}
-		discovery := diskDiscovery{agent: agent, rootMountPoint: "/sysroot", ctx: fsRegistrationContext{diskIoCounters: map[string]disk.IOCountersStat{}}}
-
-		discovery.addLastResortRootFs()
-
-		stats, exists := agent.fsStats["root"]
-		assert.True(t, exists)
-		assert.True(t, stats.Root)
-		assert.Equal(t, "/sysroot", stats.Mountpoint)
-	})
-}
-
-func TestAddConfiguredExtraFsEntry(t *testing.T) {
-	t.Run("uses matching partition when present", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{
-			agent:      agent,
-			partitions: []disk.PartitionStat{{Device: "/dev/sdb1", Mountpoint: "/mnt/backup"}},
-			usageFn: func(string) (*disk.UsageStat, error) {
-				t.Fatal("usage fallback should not be called when partition matches")
-				return nil, nil
-			},
-			ctx: fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"sdb1": {Name: "sdb1"},
-				},
-			},
-		}
-
-		discovery.addConfiguredExtraFsEntry("sdb1", "backup")
-
-		stats, exists := agent.fsStats["sdb1"]
-		assert.True(t, exists)
-		assert.Equal(t, "/mnt/backup", stats.Mountpoint)
-		assert.Equal(t, "backup", stats.Name)
-	})
-
-	t.Run("falls back to usage-validated path", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{
-			agent: agent,
-			usageFn: func(path string) (*disk.UsageStat, error) {
-				assert.Equal(t, "/srv/archive", path)
-				return &disk.UsageStat{}, nil
-			},
-			ctx: fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"archive": {Name: "archive"},
-				},
-			},
-		}
-
-		discovery.addConfiguredExtraFsEntry("/srv/archive", "archive")
-
-		stats, exists := agent.fsStats["archive"]
-		assert.True(t, exists)
-		assert.Equal(t, "/srv/archive", stats.Mountpoint)
-		assert.Equal(t, "archive", stats.Name)
-	})
-
-	t.Run("ignores invalid filesystem entry", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{
-			agent: agent,
-			usageFn: func(string) (*disk.UsageStat, error) {
-				return nil, os.ErrNotExist
-			},
-		}
-
-		discovery.addConfiguredExtraFsEntry("/missing/archive", "")
-
-		assert.Empty(t, agent.fsStats)
-	})
-}
-
-func TestAddConfiguredExtraFilesystems(t *testing.T) {
-	t.Run("parses and registers multiple configured filesystems", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		discovery := diskDiscovery{
-			agent:      agent,
-			partitions: []disk.PartitionStat{{Device: "/dev/sda1", Mountpoint: "/mnt/fast"}},
-			usageFn: func(path string) (*disk.UsageStat, error) {
-				if path == "/srv/archive" {
-					return &disk.UsageStat{}, nil
-				}
-				return nil, os.ErrNotExist
-			},
-			ctx: fsRegistrationContext{
-				isWindows: false,
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"sda1":    {Name: "sda1"},
-					"archive": {Name: "archive"},
-				},
-			},
-		}
-
-		discovery.addConfiguredExtraFilesystems("sda1__fast,/srv/archive__cold")
-
-		assert.Contains(t, agent.fsStats, "sda1")
-		assert.Equal(t, "fast", agent.fsStats["sda1"].Name)
-		assert.Contains(t, agent.fsStats, "archive")
-		assert.Equal(t, "cold", agent.fsStats["archive"].Name)
-	})
-}
-
-func TestAddExtraFilesystemFolders(t *testing.T) {
-	t.Run("adds missing folders and skips existing mountpoints", func(t *testing.T) {
-		agent := &Agent{fsStats: map[string]*system.FsStats{
-			"existing": {Mountpoint: "/extra-filesystems/existing"},
-		}}
-		discovery := diskDiscovery{
-			agent: agent,
-			ctx: fsRegistrationContext{
-				isWindows: false,
-				efPath:    "/extra-filesystems",
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"newdisk": {Name: "newdisk"},
-				},
-			},
-		}
-
-		discovery.addExtraFilesystemFolders([]string{"existing", "newdisk__Archive"})
-
-		assert.Len(t, agent.fsStats, 2)
-		stats, exists := agent.fsStats["newdisk"]
-		assert.True(t, exists)
-		assert.Equal(t, "/extra-filesystems/newdisk__Archive", stats.Mountpoint)
-		assert.Equal(t, "Archive", stats.Name)
-	})
-}
-
-func TestAddPartitionExtraFs(t *testing.T) {
-	makeDiscovery := func(agent *Agent) diskDiscovery {
-		return diskDiscovery{
-			agent: agent,
-			ctx: fsRegistrationContext{
-				isWindows: false,
-				efPath:    "/extra-filesystems",
-				diskIoCounters: map[string]disk.IOCountersStat{
-					"nvme0n1p1": {Name: "nvme0n1p1"},
-					"nvme1n1":   {Name: "nvme1n1"},
-				},
-			},
-		}
-	}
-
-	t.Run("registers direct child of extra-filesystems", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		d := makeDiscovery(agent)
-
-		d.addPartitionExtraFs(disk.PartitionStat{
-			Device:     "/dev/nvme0n1p1",
-			Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root",
-		})
-
-		stats, exists := agent.fsStats["nvme0n1p1"]
-		assert.True(t, exists)
-		assert.Equal(t, "/extra-filesystems/nvme0n1p1__caddy1-root", stats.Mountpoint)
-		assert.Equal(t, "caddy1-root", stats.Name)
-	})
-
-	t.Run("skips nested mount under extra-filesystem bind mount", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		d := makeDiscovery(agent)
-
-		// These simulate the virtual mounts that appear when host / is bind-mounted
-		// with disk.Partitions(all=true) — e.g. /proc, /sys, /dev visible under the mount.
-		for _, nested := range []string{
-			"/extra-filesystems/nvme0n1p1__caddy1-root/proc",
-			"/extra-filesystems/nvme0n1p1__caddy1-root/sys",
-			"/extra-filesystems/nvme0n1p1__caddy1-root/dev",
-			"/extra-filesystems/nvme0n1p1__caddy1-root/run",
-		} {
-			d.addPartitionExtraFs(disk.PartitionStat{Device: "tmpfs", Mountpoint: nested})
-		}
-
-		assert.Empty(t, agent.fsStats)
-	})
-
-	t.Run("registers both direct children, skips their nested mounts", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		d := makeDiscovery(agent)
-
-		partitions := []disk.PartitionStat{
-			{Device: "/dev/nvme0n1p1", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root"},
-			{Device: "/dev/nvme1n1", Mountpoint: "/extra-filesystems/nvme1n1__caddy1-docker"},
-			{Device: "proc", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/proc"},
-			{Device: "sysfs", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/sys"},
-			{Device: "overlay", Mountpoint: "/extra-filesystems/nvme0n1p1__caddy1-root/var/lib/docker"},
-		}
-		for _, p := range partitions {
-			d.addPartitionExtraFs(p)
-		}
-
-		assert.Len(t, agent.fsStats, 2)
-		assert.Equal(t, "caddy1-root", agent.fsStats["nvme0n1p1"].Name)
-		assert.Equal(t, "caddy1-docker", agent.fsStats["nvme1n1"].Name)
-	})
-
-	t.Run("skips partition not under extra-filesystems", func(t *testing.T) {
-		agent := &Agent{fsStats: make(map[string]*system.FsStats)}
-		d := makeDiscovery(agent)
-
-		d.addPartitionExtraFs(disk.PartitionStat{
-			Device:     "/dev/nvme0n1p1",
-			Mountpoint: "/",
-		})
-
-		assert.Empty(t, agent.fsStats)
-	})
-}
-
 func TestFindIoDevice(t *testing.T) {
 	t.Run("matches by device name", func(t *testing.T) {
 		ioCounters := map[string]disk.IOCountersStat{
@@ -768,8 +250,18 @@ func TestIsDockerSpecialMountpoint(t *testing.T) {
 }
 
 func TestInitializeDiskInfoWithCustomNames(t *testing.T) {
+	// Set up environment variables
+	oldEnv := os.Getenv("EXTRA_FILESYSTEMS")
+	defer func() {
+		if oldEnv != "" {
+			os.Setenv("EXTRA_FILESYSTEMS", oldEnv)
+		} else {
+			os.Unsetenv("EXTRA_FILESYSTEMS")
+		}
+	}()
+
 	// Test with custom names
-	t.Setenv("EXTRA_FILESYSTEMS", "sda1__my-storage,/dev/sdb1__backup-drive,nvme0n1p2")
+	os.Setenv("EXTRA_FILESYSTEMS", "sda1__my-storage,/dev/sdb1__backup-drive,nvme0n1p2")
 
 	// Mock disk partitions (we'll just test the parsing logic)
 	// Since the actual disk operations are system-dependent, we'll focus on the parsing
@@ -797,7 +289,7 @@ func TestInitializeDiskInfoWithCustomNames(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run("env_"+tc.envValue, func(t *testing.T) {
-			t.Setenv("EXTRA_FILESYSTEMS", tc.envValue)
+			os.Setenv("EXTRA_FILESYSTEMS", tc.envValue)
 
 			// Create mock partitions that would match our test cases
 			partitions := []disk.PartitionStat{}
@@ -818,7 +310,7 @@ func TestInitializeDiskInfoWithCustomNames(t *testing.T) {
 			// Test the parsing logic by calling the relevant part
 			// We'll create a simplified version to test just the parsing
 			extraFilesystems := tc.envValue
-			for fsEntry := range strings.SplitSeq(extraFilesystems, ",") {
+			for _, fsEntry := range strings.Split(extraFilesystems, ",") {
 				// Parse the entry
 				fsEntry = strings.TrimSpace(fsEntry)
 				var fs, customName string
@@ -1014,33 +506,3 @@ func TestHasSameDiskUsage(t *testing.T) {
 		assert.False(t, hasSameDiskUsage(&disk.UsageStat{Total: 0, Used: 0}, &disk.UsageStat{Total: 1, Used: 1}))
 	})
 }
-
-func TestInitializeDiskIoStatsResetsTrackedDevices(t *testing.T) {
-	agent := &Agent{
-		fsStats: map[string]*system.FsStats{
-			"sda": {},
-			"sdb": {},
-		},
-		fsNames: []string{"stale", "sda"},
-	}
-
-	agent.initializeDiskIoStats(map[string]disk.IOCountersStat{
-		"sda": {Name: "sda", ReadBytes: 10, WriteBytes: 20},
-		"sdb": {Name: "sdb", ReadBytes: 30, WriteBytes: 40},
-	})
-
-	assert.ElementsMatch(t, []string{"sda", "sdb"}, agent.fsNames)
-	assert.Len(t, agent.fsNames, 2)
-	assert.Equal(t, uint64(10), agent.fsStats["sda"].TotalRead)
-	assert.Equal(t, uint64(20), agent.fsStats["sda"].TotalWrite)
-	assert.False(t, agent.fsStats["sda"].Time.IsZero())
-	assert.False(t, agent.fsStats["sdb"].Time.IsZero())
-
-	agent.initializeDiskIoStats(map[string]disk.IOCountersStat{
-		"sdb": {Name: "sdb", ReadBytes: 50, WriteBytes: 60},
-	})
-
-	assert.Equal(t, []string{"sdb"}, agent.fsNames)
-	assert.Equal(t, uint64(50), agent.fsStats["sdb"].TotalRead)
-	assert.Equal(t, uint64(60), agent.fsStats["sdb"].TotalWrite)
-}

agent/docker.go

@@ -16,24 +16,22 @@ import (
 	"os"
 	"path"
 	"regexp"
-	"sort"
-	"strconv"
 	"strings"
 	"sync"
 	"time"
 
 	"github.com/henrygd/beszel/agent/deltatracker"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/container"
-	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/blang/semver"
 )
 
 // ansiEscapePattern matches ANSI escape sequences (colors, cursor movement, etc.)
 // This includes CSI sequences like \x1b[...m and simple escapes like \x1b[K
-var ansiEscapePattern = regexp.MustCompile(`\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[@-Z\\-_]`)
-var dockerContainerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
+var (
+	ansiEscapePattern        = regexp.MustCompile(`\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07]*\x07|\x1b[@-Z\\-_]`)
+	dockerContainerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
+)
 
 const (
 	// Docker API timeout in milliseconds
@@ -53,7 +51,6 @@ const (
 )
 
 type dockerManager struct {
-	agent                *Agent                      // Used to propagate system detail changes back to the agent
 	client              *http.Client                // Client to query Docker API
 	wg                  sync.WaitGroup              // WaitGroup to wait for all goroutines to finish
 	sem                 chan struct{}               // Semaphore to limit concurrent container requests
@@ -62,7 +59,6 @@ type dockerManager struct {
 	containerStatsMap   map[string]*container.Stats // Keeps track of container stats
 	validIds            map[string]struct{}         // Map of valid container ids, used to prune invalid containers from containerStatsMap
 	goodDockerVersion   bool                        // Whether docker version is at least 25.0.0 (one-shot works correctly)
-	dockerVersionChecked bool                        // Whether a version probe has completed successfully
 	isWindows           bool                        // Whether the Docker Engine API is running on Windows
 	buf                 *bytes.Buffer               // Buffer to store and read response bodies
 	decoder             *json.Decoder               // Reusable JSON decoder that reads from buf
@@ -80,7 +76,7 @@ type dockerManager struct {
 	// cacheTimeMs -> DeltaTracker for network bytes sent/received
 	networkSentTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
 	networkRecvTrackers map[uint16]*deltatracker.DeltaTracker[string, uint64]
-	lastNetworkReadTime map[uint16]map[string]time.Time // cacheTimeMs -> containerId -> last network read time
+	retrySleep          func(time.Duration)
 }
 
 // userAgentRoundTripper is a custom http.RoundTripper that adds a User-Agent header to all requests
@@ -89,14 +85,6 @@ type userAgentRoundTripper struct {
 	userAgent string
 }
 
-// dockerVersionResponse contains the /version fields used for engine checks.
-type dockerVersionResponse struct {
-	Version    string `json:"Version"`
-	Components []struct {
-		Name string `json:"Name"`
-	} `json:"Components"`
-}
-
 // RoundTrip implements the http.RoundTripper interface
 func (u *userAgentRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	req.Header.Set("User-Agent", u.userAgent)
@@ -144,14 +132,7 @@ func (dm *dockerManager) getDockerStats(cacheTimeMs uint16) ([]*container.Stats,
 		return nil, err
 	}
 
-	// Detect Podman and Windows from Server header
-	serverHeader := resp.Header.Get("Server")
-	if !dm.usingPodman && detectPodmanFromHeader(serverHeader) {
-		dm.setIsPodman()
-	}
-	dm.isWindows = strings.Contains(serverHeader, "windows")
-
-	dm.ensureDockerVersionChecked()
+	dm.isWindows = strings.Contains(resp.Header.Get("Server"), "windows")
 
 	containersLength := len(dm.apiContainerList)
 
@@ -303,7 +284,7 @@ func (dm *dockerManager) cycleNetworkDeltasForCacheTime(cacheTimeMs uint16) {
 }
 
 // calculateNetworkStats calculates network sent/receive deltas using DeltaTracker
-func (dm *dockerManager) calculateNetworkStats(ctr *container.ApiInfo, apiStats *container.ApiStats, name string, cacheTimeMs uint16) (uint64, uint64) {
+func (dm *dockerManager) calculateNetworkStats(ctr *container.ApiInfo, apiStats *container.ApiStats, stats *container.Stats, initialized bool, name string, cacheTimeMs uint16) (uint64, uint64) {
 	var total_sent, total_recv uint64
 	for _, v := range apiStats.Networks {
 		total_sent += v.TxBytes
@@ -322,11 +303,10 @@ func (dm *dockerManager) calculateNetworkStats(ctr *container.ApiInfo, apiStats
 	sent_delta_raw := sentTracker.Delta(ctr.IdShort)
 	recv_delta_raw := recvTracker.Delta(ctr.IdShort)
 
-	// Calculate bytes per second using per-cache-time read time to avoid
-	// interference between different cache intervals (e.g. 1000ms vs 60000ms)
+	// Calculate bytes per second independently for Tx and Rx if we have previous data
 	var sent_delta, recv_delta uint64
-	if prevReadTime, ok := dm.lastNetworkReadTime[cacheTimeMs][ctr.IdShort]; ok {
-		millisecondsElapsed := uint64(time.Since(prevReadTime).Milliseconds())
+	if initialized {
+		millisecondsElapsed := uint64(time.Since(stats.PrevReadTime).Milliseconds())
 		if millisecondsElapsed > 0 {
 			if sent_delta_raw > 0 {
 				sent_delta = sent_delta_raw * 1000 / millisecondsElapsed
@@ -358,48 +338,15 @@ func validateCpuPercentage(cpuPct float64, containerName string) error {
 
 // updateContainerStatsValues updates the final stats values
 func updateContainerStatsValues(stats *container.Stats, cpuPct float64, usedMemory uint64, sent_delta, recv_delta uint64, readTime time.Time) {
-	stats.Cpu = utils.TwoDecimals(cpuPct)
-	stats.Mem = utils.BytesToMegabytes(float64(usedMemory))
+	stats.Cpu = twoDecimals(cpuPct)
+	stats.Mem = bytesToMegabytes(float64(usedMemory))
 	stats.Bandwidth = [2]uint64{sent_delta, recv_delta}
 	// TODO(0.19+): stop populating NetworkSent/NetworkRecv (deprecated in 0.18.3)
-	stats.NetworkSent = utils.BytesToMegabytes(float64(sent_delta))
-	stats.NetworkRecv = utils.BytesToMegabytes(float64(recv_delta))
+	stats.NetworkSent = bytesToMegabytes(float64(sent_delta))
+	stats.NetworkRecv = bytesToMegabytes(float64(recv_delta))
 	stats.PrevReadTime = readTime
 }
 
-// convertContainerPortsToString formats the ports of a container into a sorted, deduplicated string.
-// ctr.Ports is nilled out after processing so the slice is not accidentally reused.
-func convertContainerPortsToString(ctr *container.ApiInfo) string {
-	if len(ctr.Ports) == 0 {
-		return ""
-	}
-	sort.Slice(ctr.Ports, func(i, j int) bool {
-		return ctr.Ports[i].PublicPort < ctr.Ports[j].PublicPort
-	})
-	var builder strings.Builder
-	seenPorts := make(map[uint16]struct{})
-	for _, p := range ctr.Ports {
-		_, ok := seenPorts[p.PublicPort]
-		if p.PublicPort == 0 || ok {
-			continue
-		}
-		seenPorts[p.PublicPort] = struct{}{}
-		if builder.Len() > 0 {
-			builder.WriteString(", ")
-		}
-		switch p.IP {
-		case "0.0.0.0", "::":
-		default:
-			builder.WriteString(p.IP)
-			builder.WriteByte(':')
-		}
-		builder.WriteString(strconv.Itoa(int(p.PublicPort)))
-	}
-	// clear ports slice so it doesn't get reused and blend into next response
-	ctr.Ports = nil
-	return builder.String()
-}
-
 func parseDockerStatus(status string) (string, container.DockerHealth) {
 	trimmed := strings.TrimSpace(status)
 	if trimmed == "" {
@@ -419,60 +366,22 @@ func parseDockerStatus(status string) (string, container.DockerHealth) {
 		statusText = trimmed
 	}
 
-	healthText := strings.TrimSpace(strings.TrimSuffix(trimmed[openIdx+1:], ")"))
+	healthText := strings.ToLower(strings.TrimSpace(strings.TrimSuffix(trimmed[openIdx+1:], ")")))
 	// Some Docker statuses include a "health:" prefix inside the parentheses.
 	// Strip it so it maps correctly to the known health states.
 	if colonIdx := strings.IndexRune(healthText, ':'); colonIdx != -1 {
-		prefix := strings.ToLower(strings.TrimSpace(healthText[:colonIdx]))
+		prefix := strings.TrimSpace(healthText[:colonIdx])
 		if prefix == "health" || prefix == "health status" {
 			healthText = strings.TrimSpace(healthText[colonIdx+1:])
 		}
 	}
-	if health, ok := parseDockerHealthStatus(healthText); ok {
+	if health, ok := container.DockerHealthStrings[healthText]; ok {
 		return statusText, health
 	}
 
 	return trimmed, container.DockerHealthNone
 }
 
-// parseDockerHealthStatus maps Docker health status strings to container.DockerHealth values
-func parseDockerHealthStatus(status string) (container.DockerHealth, bool) {
-	health, ok := container.DockerHealthStrings[strings.ToLower(strings.TrimSpace(status))]
-	return health, ok
-}
-
-// getPodmanContainerHealth fetches container health status from the container inspect endpoint.
-// Used for Podman which doesn't provide health status in the /containers/json endpoint as of March 2026.
-// https://github.com/containers/podman/issues/27786
-func (dm *dockerManager) getPodmanContainerHealth(containerID string) (container.DockerHealth, error) {
-	resp, err := dm.client.Get(fmt.Sprintf("http://localhost/containers/%s/json", url.PathEscape(containerID)))
-	if err != nil {
-		return container.DockerHealthNone, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return container.DockerHealthNone, fmt.Errorf("container inspect request failed: %s", resp.Status)
-	}
-
-	var inspectInfo struct {
-		State struct {
-			Health struct {
-				Status string
-			}
-		}
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&inspectInfo); err != nil {
-		return container.DockerHealthNone, err
-	}
-
-	if health, ok := parseDockerHealthStatus(inspectInfo.State.Health.Status); ok {
-		return health, nil
-	}
-
-	return container.DockerHealthNone, nil
-}
-
 // Updates stats for individual container with cache-time-aware delta tracking
 func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo, cacheTimeMs uint16) error {
 	name := ctr.Names[0][1:]
@@ -482,39 +391,23 @@ func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo, cacheTimeM
 		return err
 	}
 
-	statusText, health := parseDockerStatus(ctr.Status)
-
-	// Docker exposes Health.Status on /containers/json in API 1.52+.
-	// Podman currently requires falling back to the inspect endpoint as of March 2026.
-	// https://github.com/containers/podman/issues/27786
-	if ctr.Health.Status != "" {
-		if h, ok := parseDockerHealthStatus(ctr.Health.Status); ok {
-			health = h
-		}
-	} else if dm.usingPodman {
-		if podmanHealth, err := dm.getPodmanContainerHealth(ctr.IdShort); err == nil {
-			health = podmanHealth
-		}
-	}
-
 	dm.containerStatsMutex.Lock()
 	defer dm.containerStatsMutex.Unlock()
 
 	// add empty values if they doesn't exist in map
 	stats, initialized := dm.containerStatsMap[ctr.IdShort]
 	if !initialized {
-		stats = &container.Stats{Name: name, Id: ctr.IdShort, Image: ctr.Image}
+		stats = &container.Stats{Image: ctr.Image}
 		dm.containerStatsMap[ctr.IdShort] = stats
 	}
 
 	stats.Id = ctr.IdShort
+	stats.Name = name
+
+	statusText, health := parseDockerStatus(ctr.Status)
 	stats.Status = statusText
 	stats.Health = health
 
-	if len(ctr.Ports) > 0 {
-		stats.Ports = convertContainerPortsToString(ctr)
-	}
-
 	// reset current stats
 	stats.Cpu = 0
 	stats.Mem = 0
@@ -561,13 +454,7 @@ func (dm *dockerManager) updateContainerStats(ctr *container.ApiInfo, cacheTimeM
 	}
 
 	// Calculate network stats using DeltaTracker
-	sent_delta, recv_delta := dm.calculateNetworkStats(ctr, res, name, cacheTimeMs)
-
-	// Store per-cache-time network read time for next rate calculation
-	if dm.lastNetworkReadTime[cacheTimeMs] == nil {
-		dm.lastNetworkReadTime[cacheTimeMs] = make(map[string]time.Time)
-	}
-	dm.lastNetworkReadTime[cacheTimeMs][ctr.IdShort] = time.Now()
+	sent_delta, recv_delta := dm.calculateNetworkStats(ctr, res, stats, initialized, name, cacheTimeMs)
 
 	// Store current network values for legacy compatibility
 	var total_sent, total_recv uint64
@@ -599,14 +486,11 @@ func (dm *dockerManager) deleteContainerStatsSync(id string) {
 	for ct := range dm.lastCpuReadTime {
 		delete(dm.lastCpuReadTime[ct], id)
 	}
-	for ct := range dm.lastNetworkReadTime {
-		delete(dm.lastNetworkReadTime[ct], id)
-	}
 }
 
 // Creates a new http client for Docker or Podman API
-func newDockerManager(agent *Agent) *dockerManager {
-	dockerHost, exists := utils.GetEnv("DOCKER_HOST")
+func newDockerManager() *dockerManager {
+	dockerHost, exists := GetEnv("DOCKER_HOST")
 	if exists {
 		// return nil if set to empty string
 		if dockerHost == "" {
@@ -642,7 +526,7 @@ func newDockerManager(agent *Agent) *dockerManager {
 
 	// configurable timeout
 	timeout := time.Millisecond * time.Duration(dockerTimeoutMs)
-	if t, set := utils.GetEnv("DOCKER_TIMEOUT"); set {
+	if t, set := GetEnv("DOCKER_TIMEOUT"); set {
 		timeout, err = time.ParseDuration(t)
 		if err != nil {
 			slog.Error(err.Error())
@@ -659,7 +543,7 @@ func newDockerManager(agent *Agent) *dockerManager {
 
 	// Read container exclusion patterns from environment variable
 	var excludeContainers []string
-	if excludeStr, set := utils.GetEnv("EXCLUDE_CONTAINERS"); set && excludeStr != "" {
+	if excludeStr, set := GetEnv("EXCLUDE_CONTAINERS"); set && excludeStr != "" {
 		parts := strings.SplitSeq(excludeStr, ",")
 		for part := range parts {
 			trimmed := strings.TrimSpace(part)
@@ -671,7 +555,6 @@ func newDockerManager(agent *Agent) *dockerManager {
 	}
 
 	manager := &dockerManager{
-		agent: agent,
 		client: &http.Client{
 			Timeout:   timeout,
 			Transport: userAgentTransport,
@@ -688,55 +571,51 @@ func newDockerManager(agent *Agent) *dockerManager {
 		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
 		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
+		retrySleep:          time.Sleep,
 	}
 
-	// Best-effort startup probe. If the engine is not ready yet, getDockerStats will
-	// retry after the first successful /containers/json request.
-	_, _ = manager.checkDockerVersion()
+	// If using podman, return client
+	if strings.Contains(dockerHost, "podman") {
+		manager.usingPodman = true
+		manager.goodDockerVersion = true
+		return manager
+	}
+
+	// run version check in goroutine to avoid blocking (server may not be ready and requires retries)
+	go manager.checkDockerVersion()
+
+	// give version check a chance to complete before returning
+	time.Sleep(50 * time.Millisecond)
 
 	return manager
 }
 
 // checkDockerVersion checks Docker version and sets goodDockerVersion if at least 25.0.0.
 // Versions before 25.0.0 have a bug with one-shot which requires all requests to be made in one batch.
-func (dm *dockerManager) checkDockerVersion() (bool, error) {
-	resp, err := dm.client.Get("http://localhost/version")
-	if err != nil {
-		return false, err
+func (dm *dockerManager) checkDockerVersion() {
+	var err error
+	var resp *http.Response
+	var versionInfo struct {
+		Version string `json:"Version"`
 	}
-	if resp.StatusCode != http.StatusOK {
-		status := resp.Status
+	const versionMaxTries = 2
+	for i := 1; i <= versionMaxTries; i++ {
+		resp, err = dm.client.Get("http://localhost/version")
+		if err == nil && resp.StatusCode == http.StatusOK {
+			break
+		}
+		if resp != nil {
 			resp.Body.Close()
-		return false, fmt.Errorf("docker version request failed: %s", status)
 		}
-
-	var versionInfo dockerVersionResponse
-	serverHeader := resp.Header.Get("Server")
-	if err := dm.decode(resp, &versionInfo); err != nil {
-		return false, err
+		if i < versionMaxTries {
+			slog.Debug("Failed to get Docker version; retrying", "attempt", i, "err", err, "response", resp)
+			dm.retrySleep(5 * time.Second)
 		}
-
-	dm.applyDockerVersionInfo(serverHeader, &versionInfo)
-	dm.dockerVersionChecked = true
-	return true, nil
-}
-
-// ensureDockerVersionChecked retries the version probe after a successful
-// container list request.
-func (dm *dockerManager) ensureDockerVersionChecked() {
-	if dm.dockerVersionChecked {
+	}
+	if err != nil || resp.StatusCode != http.StatusOK {
 		return
 	}
-	if _, err := dm.checkDockerVersion(); err != nil {
-		slog.Debug("Failed to get Docker version", "err", err)
-	}
-}
-
-// applyDockerVersionInfo updates version-dependent behavior from engine metadata.
-func (dm *dockerManager) applyDockerVersionInfo(serverHeader string, versionInfo *dockerVersionResponse) {
-	if detectPodmanEngine(serverHeader, versionInfo) {
-		dm.setIsPodman()
+	if err := dm.decode(resp, &versionInfo); err != nil {
 		return
 	}
 	// if version > 24, one-shot works correctly and we can limit concurrent operations
@@ -962,46 +841,3 @@ func (dm *dockerManager) GetHostInfo() (info container.HostInfo, err error) {
 func (dm *dockerManager) IsPodman() bool {
 	return dm.usingPodman
 }
-
-// setIsPodman sets the manager to Podman mode and updates system details accordingly.
-func (dm *dockerManager) setIsPodman() {
-	if dm.usingPodman {
-		return
-	}
-	dm.usingPodman = true
-	dm.goodDockerVersion = true
-	dm.dockerVersionChecked = true
-	// keep system details updated - this may be detected late if server isn't ready when
-	// agent starts, so make sure we notify the hub if this happens later.
-	if dm.agent != nil {
-		dm.agent.updateSystemDetails(func(details *system.Details) {
-			details.Podman = true
-		})
-	}
-}
-
-// detectPodmanFromHeader identifies Podman from the Docker API server header.
-func detectPodmanFromHeader(server string) bool {
-	return strings.HasPrefix(server, "Libpod")
-}
-
-// detectPodmanFromVersion identifies Podman from the version payload.
-func detectPodmanFromVersion(versionInfo *dockerVersionResponse) bool {
-	if versionInfo == nil {
-		return false
-	}
-	for _, component := range versionInfo.Components {
-		if strings.HasPrefix(component.Name, "Podman") {
-			return true
-		}
-	}
-	return false
-}
-
-// detectPodmanEngine checks both header and version metadata for Podman.
-func detectPodmanEngine(serverHeader string, versionInfo *dockerVersionResponse) bool {
-	if detectPodmanFromHeader(serverHeader) {
-		return true
-	}
-	return detectPodmanFromVersion(versionInfo)
-}

agent/docker_test.go

@@ -18,7 +18,6 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel/agent/deltatracker"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/container"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -35,12 +34,6 @@ type recordingRoundTripper struct {
 	lastQuery   map[string]string
 }
 
-type roundTripFunc func(*http.Request) (*http.Response, error)
-
-func (fn roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
-	return fn(req)
-}
-
 func (rt *recordingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	rt.called = true
 	rt.lastPath = req.URL.EscapedPath()
@@ -220,28 +213,6 @@ func TestContainerDetailsRequestsUseExpectedDockerPaths(t *testing.T) {
 	})
 }
 
-func TestGetPodmanContainerHealth(t *testing.T) {
-	called := false
-	dm := &dockerManager{
-		client: &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
-			called = true
-			assert.Equal(t, "/containers/0123456789ab/json", req.URL.EscapedPath())
-			return &http.Response{
-				StatusCode: http.StatusOK,
-				Status:     "200 OK",
-				Header:     make(http.Header),
-				Body:       io.NopCloser(strings.NewReader(`{"State":{"Health":{"Status":"healthy"}}}`)),
-				Request:    req,
-			}, nil
-		})},
-	}
-
-	health, err := dm.getPodmanContainerHealth("0123456789ab")
-	require.NoError(t, err)
-	assert.True(t, called)
-	assert.Equal(t, container.DockerHealthHealthy, health)
-}
-
 func TestValidateCpuPercentage(t *testing.T) {
 	tests := []struct {
 		name          string
@@ -298,17 +269,16 @@ func TestValidateCpuPercentage(t *testing.T) {
 }
 
 func TestUpdateContainerStatsValues(t *testing.T) {
-	stats := &container.Stats{
-		Name:         "test-container",
-		Cpu:          0.0,
-		Mem:          0.0,
-		NetworkSent:  0.0,
-		NetworkRecv:  0.0,
-		PrevReadTime: time.Time{},
-	}
+	var stats = container.Stats{}
+	stats.Name = "test-container"
+	stats.Cpu = 0.0
+	stats.Mem = 0.0
+	stats.NetworkSent = 0.0
+	stats.NetworkRecv = 0.0
+	stats.PrevReadTime = time.Time{}
 
 	testTime := time.Now()
-	updateContainerStatsValues(stats, 75.5, 1048576, 524288, 262144, testTime)
+	updateContainerStatsValues(&stats, 75.5, 1048576, 524288, 262144, testTime)
 
 	// Check CPU percentage (should be rounded to 2 decimals)
 	assert.Equal(t, 75.5, stats.Cpu)
@@ -327,6 +297,48 @@ func TestUpdateContainerStatsValues(t *testing.T) {
 	assert.Equal(t, testTime, stats.PrevReadTime)
 }
 
+func TestTwoDecimals(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    float64
+		expected float64
+	}{
+		{"round down", 1.234, 1.23},
+		{"round half up", 1.235, 1.24}, // math.Round rounds half up
+		{"no rounding needed", 1.23, 1.23},
+		{"negative number", -1.235, -1.24}, // math.Round rounds half up (more negative)
+		{"zero", 0.0, 0.0},
+		{"large number", 123.456, 123.46}, // rounds 5 up
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := twoDecimals(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestBytesToMegabytes(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    float64
+		expected float64
+	}{
+		{"1 MB", 1048576, 1.0},
+		{"512 KB", 524288, 0.5},
+		{"zero", 0, 0},
+		{"large value", 1073741824, 1024}, // 1 GB = 1024 MB
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := bytesToMegabytes(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
 func TestInitializeCpuTracking(t *testing.T) {
 	dm := &dockerManager{
 		lastCpuContainer: make(map[uint16]map[string]uint64),
@@ -408,7 +420,6 @@ func TestCalculateNetworkStats(t *testing.T) {
 	dm := &dockerManager{
 		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
 	}
 
 	cacheTimeMs := uint16(30000)
@@ -424,11 +435,6 @@ func TestCalculateNetworkStats(t *testing.T) {
 	dm.networkSentTrackers[cacheTimeMs] = sentTracker
 	dm.networkRecvTrackers[cacheTimeMs] = recvTracker
 
-	// Set per-cache-time network read time (1 second ago)
-	dm.lastNetworkReadTime[cacheTimeMs] = map[string]time.Time{
-		"container1": time.Now().Add(-time.Second),
-	}
-
 	ctr := &container.ApiInfo{
 		IdShort: "container1",
 	}
@@ -439,8 +445,11 @@ func TestCalculateNetworkStats(t *testing.T) {
 		},
 	}
 
+	var stats = container.Stats{}
+	stats.PrevReadTime = time.Now().Add(-time.Second) // 1 second ago
+
 	// Test with initialized container
-	sent, recv := dm.calculateNetworkStats(ctr, apiStats, "test-container", cacheTimeMs)
+	sent, recv := dm.calculateNetworkStats(ctr, apiStats, &stats, true, "test-container", cacheTimeMs)
 
 	// Should return calculated byte rates per second
 	assert.GreaterOrEqual(t, sent, uint64(0))
@@ -448,76 +457,12 @@ func TestCalculateNetworkStats(t *testing.T) {
 
 	// Cycle and test one-direction change (Tx only) is reflected independently
 	dm.cycleNetworkDeltasForCacheTime(cacheTimeMs)
-	dm.lastNetworkReadTime[cacheTimeMs]["container1"] = time.Now().Add(-time.Second)
 	apiStats.Networks["eth0"] = container.NetworkStats{TxBytes: 2500, RxBytes: 1800} // +500 Tx only
-	sent, recv = dm.calculateNetworkStats(ctr, apiStats, "test-container", cacheTimeMs)
+	sent, recv = dm.calculateNetworkStats(ctr, apiStats, &stats, true, "test-container", cacheTimeMs)
 	assert.Greater(t, sent, uint64(0))
 	assert.Equal(t, uint64(0), recv)
 }
 
-// TestNetworkStatsCacheTimeIsolation verifies that frequent collections at one cache time
-// (e.g. 1000ms) don't cause inflated rates at another cache time (e.g. 60000ms).
-// This was a bug where PrevReadTime was shared, so the 60000ms tracker would see a
-// large byte delta divided by a tiny elapsed time (set by the 1000ms path).
-func TestNetworkStatsCacheTimeIsolation(t *testing.T) {
-	dm := &dockerManager{
-		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
-	}
-
-	ctr := &container.ApiInfo{IdShort: "container1"}
-	fastCache := uint16(1000)
-	slowCache := uint16(60000)
-
-	// Baseline for both cache times at T=0 with 100 bytes total
-	baseline := &container.ApiStats{
-		Networks: map[string]container.NetworkStats{
-			"eth0": {TxBytes: 100, RxBytes: 100},
-		},
-	}
-	dm.calculateNetworkStats(ctr, baseline, "test", fastCache)
-	dm.calculateNetworkStats(ctr, baseline, "test", slowCache)
-
-	// Record read times and cycle both
-	now := time.Now()
-	dm.lastNetworkReadTime[fastCache] = map[string]time.Time{"container1": now}
-	dm.lastNetworkReadTime[slowCache] = map[string]time.Time{"container1": now}
-	dm.cycleNetworkDeltasForCacheTime(fastCache)
-	dm.cycleNetworkDeltasForCacheTime(slowCache)
-
-	// Simulate many fast (1000ms) collections over ~5 seconds, each adding 10 bytes
-	totalBytes := uint64(100)
-	for i := 0; i < 5; i++ {
-		totalBytes += 10
-		stats := &container.ApiStats{
-			Networks: map[string]container.NetworkStats{
-				"eth0": {TxBytes: totalBytes, RxBytes: totalBytes},
-			},
-		}
-		// Set fast cache read time to 1 second ago
-		dm.lastNetworkReadTime[fastCache]["container1"] = time.Now().Add(-time.Second)
-		sent, _ := dm.calculateNetworkStats(ctr, stats, "test", fastCache)
-		// Fast cache should see ~10 bytes/sec per interval
-		assert.LessOrEqual(t, sent, uint64(100), "fast cache rate should be reasonable")
-		dm.cycleNetworkDeltasForCacheTime(fastCache)
-	}
-
-	// Now do slow cache collection — total delta is 50 bytes over ~5 seconds
-	// Set slow cache read time to 5 seconds ago (the actual elapsed time)
-	dm.lastNetworkReadTime[slowCache]["container1"] = time.Now().Add(-5 * time.Second)
-	finalStats := &container.ApiStats{
-		Networks: map[string]container.NetworkStats{
-			"eth0": {TxBytes: totalBytes, RxBytes: totalBytes},
-		},
-	}
-	sent, _ := dm.calculateNetworkStats(ctr, finalStats, "test", slowCache)
-
-	// Slow cache rate should be ~10 bytes/sec (50 bytes / 5 seconds), NOT 100x inflated
-	assert.LessOrEqual(t, sent, uint64(100), "slow cache rate should NOT be inflated by fast cache collections")
-	assert.GreaterOrEqual(t, sent, uint64(1), "slow cache should still report some traffic")
-}
-
 func TestDockerManagerCreation(t *testing.T) {
 	// Test that dockerManager can be created without panicking
 	dm := &dockerManager{
@@ -526,7 +471,6 @@ func TestDockerManagerCreation(t *testing.T) {
 		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
 		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
 	}
 
 	assert.NotNil(t, dm)
@@ -534,58 +478,63 @@ func TestDockerManagerCreation(t *testing.T) {
 	assert.NotNil(t, dm.lastCpuSystem)
 	assert.NotNil(t, dm.networkSentTrackers)
 	assert.NotNil(t, dm.networkRecvTrackers)
-	assert.NotNil(t, dm.lastNetworkReadTime)
 }
 
 func TestCheckDockerVersion(t *testing.T) {
 	tests := []struct {
 		name      string
+		responses []struct {
 			statusCode int
 			body       string
-		server          string
-		expectSuccess   bool
+		}
 		expectedGood     bool
-		expectedPodman  bool
-		expectError     bool
-		expectedRequest string
+		expectedRequests int
 	}{
 		{
-			name:            "good docker version",
-			statusCode:      http.StatusOK,
-			body:            `{"Version":"25.0.1"}`,
-			expectSuccess:   true,
+			name: "200 with good version on first try",
+			responses: []struct {
+				statusCode int
+				body       string
+			}{
+				{http.StatusOK, `{"Version":"25.0.1"}`},
+			},
 			expectedGood:     true,
-			expectedPodman:  false,
-			expectedRequest: "/version",
+			expectedRequests: 1,
 		},
 		{
-			name:            "old docker version",
-			statusCode:      http.StatusOK,
-			body:            `{"Version":"24.0.7"}`,
-			expectSuccess:   true,
+			name: "200 with old version on first try",
+			responses: []struct {
+				statusCode int
+				body       string
+			}{
+				{http.StatusOK, `{"Version":"24.0.7"}`},
+			},
 			expectedGood:     false,
-			expectedPodman:  false,
-			expectedRequest: "/version",
+			expectedRequests: 1,
 		},
 		{
-			name:            "podman from server header",
-			statusCode:      http.StatusOK,
-			body:            `{"Version":"5.5.0"}`,
-			server:          "Libpod/5.5.0",
-			expectSuccess:   true,
+			name: "non-200 then 200 with good version",
+			responses: []struct {
+				statusCode int
+				body       string
+			}{
+				{http.StatusServiceUnavailable, `"not ready"`},
+				{http.StatusOK, `{"Version":"25.1.0"}`},
+			},
 			expectedGood:     true,
-			expectedPodman:  true,
-			expectedRequest: "/version",
+			expectedRequests: 2,
 		},
 		{
-			name:            "non-200 response",
-			statusCode:      http.StatusServiceUnavailable,
-			body:            `"not ready"`,
-			expectSuccess:   false,
+			name: "non-200 on all retries",
+			responses: []struct {
+				statusCode int
+				body       string
+			}{
+				{http.StatusInternalServerError, `"error"`},
+				{http.StatusUnauthorized, `"error"`},
+			},
 			expectedGood:     false,
-			expectedPodman:  false,
-			expectError:     true,
-			expectedRequest: "/version",
+			expectedRequests: 2,
 		},
 	}
 
@@ -593,13 +542,13 @@ func TestCheckDockerVersion(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			requestCount := 0
 			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				idx := requestCount
 				requestCount++
-				assert.Equal(t, tt.expectedRequest, r.URL.EscapedPath())
-				if tt.server != "" {
-					w.Header().Set("Server", tt.server)
+				if idx >= len(tt.responses) {
+					idx = len(tt.responses) - 1
 				}
-				w.WriteHeader(tt.statusCode)
-				fmt.Fprint(w, tt.body)
+				w.WriteHeader(tt.responses[idx].statusCode)
+				fmt.Fprint(w, tt.responses[idx].body)
 			}))
 			defer server.Close()
 
@@ -611,24 +560,17 @@ func TestCheckDockerVersion(t *testing.T) {
 						},
 					},
 				},
+				retrySleep: func(time.Duration) {},
 			}
 
-			success, err := dm.checkDockerVersion()
+			dm.checkDockerVersion()
 
-			assert.Equal(t, tt.expectSuccess, success)
-			assert.Equal(t, tt.expectSuccess, dm.dockerVersionChecked)
 			assert.Equal(t, tt.expectedGood, dm.goodDockerVersion)
-			assert.Equal(t, tt.expectedPodman, dm.usingPodman)
-			assert.Equal(t, 1, requestCount)
-			if tt.expectError {
-				require.Error(t, err)
-			} else {
-				require.NoError(t, err)
-			}
+			assert.Equal(t, tt.expectedRequests, requestCount)
 		})
 	}
 
-	t.Run("request error", func(t *testing.T) {
+	t.Run("request error on all retries", func(t *testing.T) {
 		requestCount := 0
 		dm := &dockerManager{
 			client: &http.Client{
@@ -639,171 +581,16 @@ func TestCheckDockerVersion(t *testing.T) {
 					},
 				},
 			},
+			retrySleep: func(time.Duration) {},
 		}
 
-		success, err := dm.checkDockerVersion()
+		dm.checkDockerVersion()
 
-		assert.False(t, success)
-		require.Error(t, err)
-		assert.False(t, dm.dockerVersionChecked)
 		assert.False(t, dm.goodDockerVersion)
-		assert.False(t, dm.usingPodman)
-		assert.Equal(t, 1, requestCount)
+		assert.Equal(t, 2, requestCount)
 	})
 }
 
-// newDockerManagerForVersionTest creates a dockerManager wired to a test server.
-func newDockerManagerForVersionTest(server *httptest.Server) *dockerManager {
-	return &dockerManager{
-		client: &http.Client{
-			Transport: &http.Transport{
-				DialContext: func(_ context.Context, network, _ string) (net.Conn, error) {
-					return net.Dial(network, server.Listener.Addr().String())
-				},
-			},
-		},
-		containerStatsMap:   make(map[string]*container.Stats),
-		lastCpuContainer:    make(map[uint16]map[string]uint64),
-		lastCpuSystem:       make(map[uint16]map[string]uint64),
-		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
-		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
-	}
-}
-
-func TestGetDockerStatsChecksDockerVersionAfterContainerList(t *testing.T) {
-	tests := []struct {
-		name            string
-		containerServer string
-		versionServer   string
-		versionBody     string
-		expectedGood    bool
-		expectedPodman  bool
-	}{
-		{
-			name:           "200 with good version on first try",
-			versionBody:    `{"Version":"25.0.1"}`,
-			expectedGood:   true,
-			expectedPodman: false,
-		},
-		{
-			name:           "200 with old version on first try",
-			versionBody:    `{"Version":"24.0.7"}`,
-			expectedGood:   false,
-			expectedPodman: false,
-		},
-		{
-			name:            "podman detected from server header",
-			containerServer: "Libpod/5.5.0",
-			expectedGood:    true,
-			expectedPodman:  true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			requestCounts := map[string]int{}
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				requestCounts[r.URL.EscapedPath()]++
-				switch r.URL.EscapedPath() {
-				case "/containers/json":
-					if tt.containerServer != "" {
-						w.Header().Set("Server", tt.containerServer)
-					}
-					w.WriteHeader(http.StatusOK)
-					fmt.Fprint(w, `[]`)
-				case "/version":
-					if tt.versionServer != "" {
-						w.Header().Set("Server", tt.versionServer)
-					}
-					w.WriteHeader(http.StatusOK)
-					fmt.Fprint(w, tt.versionBody)
-				default:
-					t.Fatalf("unexpected path: %s", r.URL.EscapedPath())
-				}
-			}))
-			defer server.Close()
-
-			dm := newDockerManagerForVersionTest(server)
-
-			stats, err := dm.getDockerStats(defaultCacheTimeMs)
-			require.NoError(t, err)
-			assert.Empty(t, stats)
-			assert.True(t, dm.dockerVersionChecked)
-			assert.Equal(t, tt.expectedGood, dm.goodDockerVersion)
-			assert.Equal(t, tt.expectedPodman, dm.usingPodman)
-			assert.Equal(t, 1, requestCounts["/containers/json"])
-			if tt.expectedPodman {
-				assert.Equal(t, 0, requestCounts["/version"])
-			} else {
-				assert.Equal(t, 1, requestCounts["/version"])
-			}
-
-			stats, err = dm.getDockerStats(defaultCacheTimeMs)
-			require.NoError(t, err)
-			assert.Empty(t, stats)
-			assert.Equal(t, tt.expectedGood, dm.goodDockerVersion)
-			assert.Equal(t, tt.expectedPodman, dm.usingPodman)
-			assert.Equal(t, 2, requestCounts["/containers/json"])
-			if tt.expectedPodman {
-				assert.Equal(t, 0, requestCounts["/version"])
-			} else {
-				assert.Equal(t, 1, requestCounts["/version"])
-			}
-		})
-	}
-
-}
-
-func TestGetDockerStatsRetriesVersionCheckUntilSuccess(t *testing.T) {
-	requestCounts := map[string]int{}
-	versionStatuses := []int{http.StatusServiceUnavailable, http.StatusOK}
-	versionBodies := []string{`"not ready"`, `{"Version":"25.1.0"}`}
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		requestCounts[r.URL.EscapedPath()]++
-		switch r.URL.EscapedPath() {
-		case "/containers/json":
-			w.WriteHeader(http.StatusOK)
-			fmt.Fprint(w, `[]`)
-		case "/version":
-			idx := requestCounts["/version"] - 1
-			if idx >= len(versionStatuses) {
-				idx = len(versionStatuses) - 1
-			}
-			w.WriteHeader(versionStatuses[idx])
-			fmt.Fprint(w, versionBodies[idx])
-		default:
-			t.Fatalf("unexpected path: %s", r.URL.EscapedPath())
-		}
-	}))
-	defer server.Close()
-
-	dm := newDockerManagerForVersionTest(server)
-
-	stats, err := dm.getDockerStats(defaultCacheTimeMs)
-	require.NoError(t, err)
-	assert.Empty(t, stats)
-	assert.False(t, dm.dockerVersionChecked)
-	assert.False(t, dm.goodDockerVersion)
-	assert.Equal(t, 1, requestCounts["/version"])
-
-	stats, err = dm.getDockerStats(defaultCacheTimeMs)
-	require.NoError(t, err)
-	assert.Empty(t, stats)
-	assert.True(t, dm.dockerVersionChecked)
-	assert.True(t, dm.goodDockerVersion)
-	assert.Equal(t, 2, requestCounts["/containers/json"])
-	assert.Equal(t, 2, requestCounts["/version"])
-
-	stats, err = dm.getDockerStats(defaultCacheTimeMs)
-	require.NoError(t, err)
-	assert.Empty(t, stats)
-	assert.Equal(t, 3, requestCounts["/containers/json"])
-	assert.Equal(t, 2, requestCounts["/version"])
-}
-
 func TestCycleCpuDeltas(t *testing.T) {
 	dm := &dockerManager{
 		lastCpuContainer: map[uint16]map[string]uint64{
@@ -875,7 +662,6 @@ func TestDockerStatsWithMockData(t *testing.T) {
 		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
 		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
 		containerStatsMap:   make(map[string]*container.Stats),
 	}
 
@@ -938,7 +724,8 @@ func TestMemoryStatsEdgeCases(t *testing.T) {
 }
 
 func TestContainerStatsInitialization(t *testing.T) {
-	stats := &container.Stats{Name: "test-container"}
+	var stats = container.Stats{}
+	stats.Name = "test-container"
 
 	// Verify initial values
 	assert.Equal(t, "test-container", stats.Name)
@@ -950,7 +737,7 @@ func TestContainerStatsInitialization(t *testing.T) {
 
 	// Test updating values
 	testTime := time.Now()
-	updateContainerStatsValues(stats, 45.67, 2097152, 1048576, 524288, testTime)
+	updateContainerStatsValues(&stats, 45.67, 2097152, 1048576, 524288, testTime)
 
 	assert.Equal(t, 45.67, stats.Cpu)
 	assert.Equal(t, 2.0, stats.Mem)
@@ -1021,22 +808,22 @@ func TestNetworkStatsCalculationWithRealData(t *testing.T) {
 	dm := &dockerManager{
 		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
 	}
 
 	ctr := &container.ApiInfo{IdShort: "test-container"}
 	cacheTimeMs := uint16(30000) // Test with 30 second cache
 
-	// First call sets baseline (no previous read time, so rates should be 0)
-	sent1, recv1 := dm.calculateNetworkStats(ctr, apiStats1, "test", cacheTimeMs)
+	// Use exact timing for deterministic results
+	exactly1000msAgo := time.Now().Add(-1000 * time.Millisecond)
+	var stats = container.Stats{}
+	stats.PrevReadTime = exactly1000msAgo
+
+	// First call sets baseline
+	sent1, recv1 := dm.calculateNetworkStats(ctr, apiStats1, &stats, true, "test", cacheTimeMs)
 	assert.Equal(t, uint64(0), sent1)
 	assert.Equal(t, uint64(0), recv1)
 
-	// Record read time and cycle to establish baseline for this cache time
-	exactly1000msAgo := time.Now().Add(-1000 * time.Millisecond)
-	dm.lastNetworkReadTime[cacheTimeMs] = map[string]time.Time{
-		"test-container": exactly1000msAgo,
-	}
+	// Cycle to establish baseline for this cache time
 	dm.cycleNetworkDeltasForCacheTime(cacheTimeMs)
 
 	// Calculate expected results precisely
@@ -1047,7 +834,7 @@ func TestNetworkStatsCalculationWithRealData(t *testing.T) {
 	expectedRecvRate := deltaRecv * 1000 / expectedElapsedMs // Should be exactly 1000000
 
 	// Second call with changed data
-	sent2, recv2 := dm.calculateNetworkStats(ctr, apiStats2, "test", cacheTimeMs)
+	sent2, recv2 := dm.calculateNetworkStats(ctr, apiStats2, &stats, true, "test", cacheTimeMs)
 
 	// Should be exactly the expected rates (no tolerance needed)
 	assert.Equal(t, expectedSentRate, sent2)
@@ -1055,13 +842,12 @@ func TestNetworkStatsCalculationWithRealData(t *testing.T) {
 
 	// Bad speed cap: set absurd delta over 1ms and expect 0 due to cap
 	dm.cycleNetworkDeltasForCacheTime(cacheTimeMs)
-	dm.lastNetworkReadTime[cacheTimeMs]["test-container"] = time.Now().Add(-1 * time.Millisecond)
+	stats.PrevReadTime = time.Now().Add(-1 * time.Millisecond)
 	apiStats1.Networks["eth0"] = container.NetworkStats{TxBytes: 0, RxBytes: 0}
 	apiStats2.Networks["eth0"] = container.NetworkStats{TxBytes: 10 * 1024 * 1024 * 1024, RxBytes: 0} // 10GB delta
-	_, _ = dm.calculateNetworkStats(ctr, apiStats1, "test", cacheTimeMs)                              // baseline
+	_, _ = dm.calculateNetworkStats(ctr, apiStats1, &stats, true, "test", cacheTimeMs)                // baseline
 	dm.cycleNetworkDeltasForCacheTime(cacheTimeMs)
-	dm.lastNetworkReadTime[cacheTimeMs]["test-container"] = time.Now().Add(-1 * time.Millisecond)
-	sent3, recv3 := dm.calculateNetworkStats(ctr, apiStats2, "test", cacheTimeMs)
+	sent3, recv3 := dm.calculateNetworkStats(ctr, apiStats2, &stats, true, "test", cacheTimeMs)
 	assert.Equal(t, uint64(0), sent3)
 	assert.Equal(t, uint64(0), recv3)
 }
@@ -1082,7 +868,6 @@ func TestContainerStatsEndToEndWithRealData(t *testing.T) {
 		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
 		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
 		containerStatsMap:   make(map[string]*container.Stats),
 	}
 
@@ -1096,8 +881,9 @@ func TestContainerStatsEndToEndWithRealData(t *testing.T) {
 	}
 
 	// Initialize container stats
-	stats := &container.Stats{Name: "jellyfin"}
-	dm.containerStatsMap[ctr.IdShort] = stats
+	var stats = container.Stats{}
+	stats.Name = "jellyfin"
+	dm.containerStatsMap[ctr.IdShort] = &stats
 
 	// Test individual components that we can verify
 	usedMemory, memErr := calculateMemoryUsage(&apiStats, false)
@@ -1118,11 +904,11 @@ func TestContainerStatsEndToEndWithRealData(t *testing.T) {
 	updateContainerStatsValues(testStats, cpuPct, usedMemory, 1000000, 500000, testTime)
 
 	assert.Equal(t, cpuPct, testStats.Cpu)
-	assert.Equal(t, utils.BytesToMegabytes(float64(usedMemory)), testStats.Mem)
+	assert.Equal(t, bytesToMegabytes(float64(usedMemory)), testStats.Mem)
 	assert.Equal(t, [2]uint64{1000000, 500000}, testStats.Bandwidth)
 	// Deprecated fields still populated for backward compatibility with older hubs
-	assert.Equal(t, utils.BytesToMegabytes(1000000), testStats.NetworkSent)
-	assert.Equal(t, utils.BytesToMegabytes(500000), testStats.NetworkRecv)
+	assert.Equal(t, bytesToMegabytes(1000000), testStats.NetworkSent)
+	assert.Equal(t, bytesToMegabytes(500000), testStats.NetworkRecv)
 	assert.Equal(t, testTime, testStats.PrevReadTime)
 }
 
@@ -1204,7 +990,6 @@ func TestDockerStatsWorkflow(t *testing.T) {
 		lastCpuSystem:       make(map[uint16]map[string]uint64),
 		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
 		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
 		containerStatsMap:   make(map[string]*container.Stats),
 	}
 
@@ -1384,18 +1169,6 @@ func TestParseDockerStatus(t *testing.T) {
 			expectedStatus: "",
 			expectedHealth: container.DockerHealthNone,
 		},
-		{
-			name:           "status health with health: prefix",
-			input:          "Up 5 minutes (health: starting)",
-			expectedStatus: "Up 5 minutes",
-			expectedHealth: container.DockerHealthStarting,
-		},
-		{
-			name:           "status health with health status: prefix",
-			input:          "Up 10 minutes (health status: unhealthy)",
-			expectedStatus: "Up 10 minutes",
-			expectedHealth: container.DockerHealthUnhealthy,
-		},
 	}
 
 	for _, tt := range tests {
@@ -1407,85 +1180,6 @@ func TestParseDockerStatus(t *testing.T) {
 	}
 }
 
-func TestParseDockerHealthStatus(t *testing.T) {
-	tests := []struct {
-		input          string
-		expectedHealth container.DockerHealth
-		expectedOk     bool
-	}{
-		{"healthy", container.DockerHealthHealthy, true},
-		{"unhealthy", container.DockerHealthUnhealthy, true},
-		{"starting", container.DockerHealthStarting, true},
-		{"none", container.DockerHealthNone, true},
-		{" Healthy ", container.DockerHealthHealthy, true},
-		{"unknown", container.DockerHealthNone, false},
-		{"", container.DockerHealthNone, false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.input, func(t *testing.T) {
-			health, ok := parseDockerHealthStatus(tt.input)
-			assert.Equal(t, tt.expectedHealth, health)
-			assert.Equal(t, tt.expectedOk, ok)
-		})
-	}
-}
-
-func TestUpdateContainerStatsUsesPodmanInspectHealthFallback(t *testing.T) {
-	var requestedPaths []string
-	dm := &dockerManager{
-		client: &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
-			requestedPaths = append(requestedPaths, req.URL.EscapedPath())
-			switch req.URL.EscapedPath() {
-			case "/containers/0123456789ab/stats":
-				return &http.Response{
-					StatusCode: http.StatusOK,
-					Status:     "200 OK",
-					Header:     make(http.Header),
-					Body: io.NopCloser(strings.NewReader(`{
-						"read":"2026-03-15T21:26:59Z",
-						"cpu_stats":{"cpu_usage":{"total_usage":1000},"system_cpu_usage":2000},
-						"memory_stats":{"usage":1048576,"stats":{"inactive_file":262144}},
-						"networks":{"eth0":{"rx_bytes":0,"tx_bytes":0}}
-					}`)),
-					Request: req,
-				}, nil
-			case "/containers/0123456789ab/json":
-				return &http.Response{
-					StatusCode: http.StatusOK,
-					Status:     "200 OK",
-					Header:     make(http.Header),
-					Body:       io.NopCloser(strings.NewReader(`{"State":{"Health":{"Status":"healthy"}}}`)),
-					Request:    req,
-				}, nil
-			default:
-				return nil, fmt.Errorf("unexpected path: %s", req.URL.EscapedPath())
-			}
-		})},
-		containerStatsMap:   make(map[string]*container.Stats),
-		apiStats:            &container.ApiStats{},
-		usingPodman:         true,
-		lastCpuContainer:    make(map[uint16]map[string]uint64),
-		lastCpuSystem:       make(map[uint16]map[string]uint64),
-		lastCpuReadTime:     make(map[uint16]map[string]time.Time),
-		networkSentTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		networkRecvTrackers: make(map[uint16]*deltatracker.DeltaTracker[string, uint64]),
-		lastNetworkReadTime: make(map[uint16]map[string]time.Time),
-	}
-
-	ctr := &container.ApiInfo{
-		IdShort: "0123456789ab",
-		Names:   []string{"/beszel"},
-		Status:  "Up 2 minutes",
-		Image:   "beszel:latest",
-	}
-
-	err := dm.updateContainerStats(ctr, defaultCacheTimeMs)
-	require.NoError(t, err)
-	assert.Equal(t, []string{"/containers/0123456789ab/stats", "/containers/0123456789ab/json"}, requestedPaths)
-	assert.Equal(t, container.DockerHealthHealthy, dm.containerStatsMap[ctr.IdShort].Health)
-	assert.Equal(t, "Up 2 minutes", dm.containerStatsMap[ctr.IdShort].Status)
-}
-
 func TestConstantsAndUtilityFunctions(t *testing.T) {
 	// Test constants are properly defined
 	assert.Equal(t, uint16(60000), defaultCacheTimeMs)
@@ -1495,13 +1189,13 @@ func TestConstantsAndUtilityFunctions(t *testing.T) {
 	assert.Equal(t, 5*1024*1024, maxTotalLogSize)               // 5MB
 
 	// Test utility functions
-	assert.Equal(t, 1.5, utils.TwoDecimals(1.499))
-	assert.Equal(t, 1.5, utils.TwoDecimals(1.5))
-	assert.Equal(t, 1.5, utils.TwoDecimals(1.501))
+	assert.Equal(t, 1.5, twoDecimals(1.499))
+	assert.Equal(t, 1.5, twoDecimals(1.5))
+	assert.Equal(t, 1.5, twoDecimals(1.501))
 
-	assert.Equal(t, 1.0, utils.BytesToMegabytes(1048576)) // 1 MB
-	assert.Equal(t, 0.5, utils.BytesToMegabytes(524288))  // 512 KB
-	assert.Equal(t, 0.0, utils.BytesToMegabytes(0))
+	assert.Equal(t, 1.0, bytesToMegabytes(1048576)) // 1 MB
+	assert.Equal(t, 0.5, bytesToMegabytes(524288))  // 512 KB
+	assert.Equal(t, 0.0, bytesToMegabytes(0))
 }
 
 func TestDecodeDockerLogStream(t *testing.T) {
@@ -1801,99 +1495,3 @@ func TestAnsiEscapePattern(t *testing.T) {
 		})
 	}
 }
-
-func TestConvertContainerPortsToString(t *testing.T) {
-	type port = struct {
-		PublicPort uint16
-		IP         string
-	}
-	tests := []struct {
-		name     string
-		ports    []port
-		expected string
-	}{
-		{
-			name:     "empty ports",
-			ports:    nil,
-			expected: "",
-		},
-		{
-			name: "single port",
-			ports: []port{
-				{PublicPort: 80, IP: "0.0.0.0"},
-			},
-			expected: "80",
-		},
-		{
-			name: "single port with non-default IP",
-			ports: []port{
-				{PublicPort: 80, IP: "1.2.3.4"},
-			},
-			expected: "1.2.3.4:80",
-		},
-		{
-			name: "ipv6 default ip",
-			ports: []port{
-				{PublicPort: 80, IP: "::"},
-			},
-			expected: "80",
-		},
-		{
-			name: "zero PublicPort is skipped",
-			ports: []port{
-				{PublicPort: 0, IP: "0.0.0.0"},
-				{PublicPort: 80, IP: "0.0.0.0"},
-			},
-			expected: "80",
-		},
-		{
-			name: "ports sorted ascending by PublicPort",
-			ports: []port{
-				{PublicPort: 443, IP: "0.0.0.0"},
-				{PublicPort: 80, IP: "0.0.0.0"},
-				{PublicPort: 8080, IP: "0.0.0.0"},
-			},
-			expected: "80, 443, 8080",
-		},
-		{
-			name: "duplicates are deduplicated",
-			ports: []port{
-				{PublicPort: 80, IP: "0.0.0.0"},
-				{PublicPort: 80, IP: "0.0.0.0"},
-				{PublicPort: 443, IP: "0.0.0.0"},
-			},
-			expected: "80, 443",
-		},
-		{
-			name: "multiple ports with different IPs",
-			ports: []port{
-				{PublicPort: 80, IP: "0.0.0.0"},
-				{PublicPort: 443, IP: "1.2.3.4"},
-			},
-			expected: "80, 1.2.3.4:443",
-		},
-		{
-			name: "ports slice is nilled after call",
-			ports: []port{
-				{PublicPort: 8080, IP: "0.0.0.0"},
-			},
-			expected: "8080",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			ctr := &container.ApiInfo{}
-			for _, p := range tt.ports {
-				ctr.Ports = append(ctr.Ports, struct {
-					PublicPort uint16
-					IP         string
-				}{PublicPort: p.PublicPort, IP: p.IP})
-			}
-			result := convertContainerPortsToString(ctr)
-			assert.Equal(t, tt.expected, result)
-			// Ports slice must be cleared to prevent bleed-over into the next response
-			assert.Nil(t, ctr.Ports, "ctr.Ports should be nil after formatContainerPorts")
-		})
-	}
-}

agent/emmc_linux.go

@@ -8,7 +8,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/smart"
 )
 
@@ -142,9 +141,9 @@ func readEmmcHealth(blockName string) (emmcHealth, bool) {
 	out.lifeA = lifeA
 	out.lifeB = lifeB
 
-	out.model = utils.ReadStringFile(filepath.Join(deviceDir, "name"))
-	out.serial = utils.ReadStringFile(filepath.Join(deviceDir, "serial"))
-	out.revision = utils.ReadStringFile(filepath.Join(deviceDir, "prv"))
+	out.model = readStringFile(filepath.Join(deviceDir, "name"))
+	out.serial = readStringFile(filepath.Join(deviceDir, "serial"))
+	out.revision = readStringFile(filepath.Join(deviceDir, "prv"))
 
 	if capBytes, ok := readBlockCapacityBytes(blockName); ok {
 		out.capacity = capBytes
@@ -154,7 +153,7 @@ func readEmmcHealth(blockName string) (emmcHealth, bool) {
 }
 
 func readLifeTime(deviceDir string) (uint8, uint8, bool) {
-	if content, ok := utils.ReadStringFileOK(filepath.Join(deviceDir, "life_time")); ok {
+	if content, ok := readStringFileOK(filepath.Join(deviceDir, "life_time")); ok {
 		a, b, ok := parseHexBytePair(content)
 		return a, b, ok
 	}
@@ -171,7 +170,7 @@ func readBlockCapacityBytes(blockName string) (uint64, bool) {
 	sizePath := filepath.Join(emmcSysfsRoot, "class", "block", blockName, "size")
 	lbsPath := filepath.Join(emmcSysfsRoot, "class", "block", blockName, "queue", "logical_block_size")
 
-	sizeStr, ok := utils.ReadStringFileOK(sizePath)
+	sizeStr, ok := readStringFileOK(sizePath)
 	if !ok {
 		return 0, false
 	}
@@ -180,7 +179,7 @@ func readBlockCapacityBytes(blockName string) (uint64, bool) {
 		return 0, false
 	}
 
-	lbsStr, ok := utils.ReadStringFileOK(lbsPath)
+	lbsStr, ok := readStringFileOK(lbsPath)
 	logicalBlockSize := uint64(512)
 	if ok {
 		if parsed, err := strconv.ParseUint(lbsStr, 10, 64); err == nil && parsed > 0 {
@@ -192,7 +191,7 @@ func readBlockCapacityBytes(blockName string) (uint64, bool) {
 }
 
 func readHexByteFile(path string) (uint8, bool) {
-	content, ok := utils.ReadStringFileOK(path)
+	content, ok := readStringFileOK(path)
 	if !ok {
 		return 0, false
 	}

agent/fs_utils.go

@@ -0,0 +1,41 @@
+package agent
+
+import (
+	"os"
+	"strconv"
+	"strings"
+)
+
+// readStringFile returns trimmed file contents or empty string on error.
+func readStringFile(path string) string {
+	content, _ := readStringFileOK(path)
+	return content
+}
+
+// readStringFileOK returns trimmed file contents and read success.
+func readStringFileOK(path string) (string, bool) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", false
+	}
+	return strings.TrimSpace(string(b)), true
+}
+
+// fileExists reports whether the given path exists.
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}
+
+// readUintFile parses a decimal uint64 value from a file.
+func readUintFile(path string) (uint64, bool) {
+	raw, ok := readStringFileOK(path)
+	if !ok {
+		return 0, false
+	}
+	parsed, err := strconv.ParseUint(raw, 10, 64)
+	if err != nil {
+		return 0, false
+	}
+	return parsed, true
+}

agent/gpu.go

@@ -15,7 +15,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
@@ -292,8 +291,8 @@ func (gm *GPUManager) parseAmdData(output []byte) bool {
 		}
 		gpu := gm.GpuDataMap[id]
 		gpu.Temperature, _ = strconv.ParseFloat(v.Temperature, 64)
-		gpu.MemoryUsed = utils.BytesToMegabytes(memoryUsage)
-		gpu.MemoryTotal = utils.BytesToMegabytes(totalMemory)
+		gpu.MemoryUsed = bytesToMegabytes(memoryUsage)
+		gpu.MemoryTotal = bytesToMegabytes(totalMemory)
 		gpu.Usage += usage
 		gpu.Power += power
 		gpu.Count++
@@ -367,16 +366,16 @@ func (gm *GPUManager) calculateGPUAverage(id string, gpu *system.GPUData, cacheK
 	gpuAvg := *gpu
 	deltaUsage, deltaPower, deltaPowerPkg := gm.calculateDeltas(gpu, lastSnapshot)
 
-	gpuAvg.Power = utils.TwoDecimals(deltaPower / float64(deltaCount))
+	gpuAvg.Power = twoDecimals(deltaPower / float64(deltaCount))
 
 	if gpu.Engines != nil {
 		// make fresh map for averaged engine metrics to avoid mutating
 		// the accumulator map stored in gm.GpuDataMap
 		gpuAvg.Engines = make(map[string]float64, len(gpu.Engines))
 		gpuAvg.Usage = gm.calculateIntelGPUUsage(&gpuAvg, gpu, lastSnapshot, deltaCount)
-		gpuAvg.PowerPkg = utils.TwoDecimals(deltaPowerPkg / float64(deltaCount))
+		gpuAvg.PowerPkg = twoDecimals(deltaPowerPkg / float64(deltaCount))
 	} else {
-		gpuAvg.Usage = utils.TwoDecimals(deltaUsage / float64(deltaCount))
+		gpuAvg.Usage = twoDecimals(deltaUsage / float64(deltaCount))
 	}
 
 	gm.lastAvgData[id] = gpuAvg
@@ -411,17 +410,17 @@ func (gm *GPUManager) calculateIntelGPUUsage(gpuAvg, gpu *system.GPUData, lastSn
 		} else {
 			deltaEngine = engine
 		}
-		gpuAvg.Engines[name] = utils.TwoDecimals(deltaEngine / float64(deltaCount))
+		gpuAvg.Engines[name] = twoDecimals(deltaEngine / float64(deltaCount))
 		maxEngineUsage = max(maxEngineUsage, deltaEngine/float64(deltaCount))
 	}
-	return utils.TwoDecimals(maxEngineUsage)
+	return twoDecimals(maxEngineUsage)
 }
 
 // updateInstantaneousValues updates values that should reflect current state, not averages
 func (gm *GPUManager) updateInstantaneousValues(gpuAvg *system.GPUData, gpu *system.GPUData) {
-	gpuAvg.Temperature = utils.TwoDecimals(gpu.Temperature)
-	gpuAvg.MemoryUsed = utils.TwoDecimals(gpu.MemoryUsed)
-	gpuAvg.MemoryTotal = utils.TwoDecimals(gpu.MemoryTotal)
+	gpuAvg.Temperature = twoDecimals(gpu.Temperature)
+	gpuAvg.MemoryUsed = twoDecimals(gpu.MemoryUsed)
+	gpuAvg.MemoryTotal = twoDecimals(gpu.MemoryTotal)
 }
 
 // storeSnapshot saves the current GPU state for this cache key
@@ -461,7 +460,7 @@ func (gm *GPUManager) discoverGpuCapabilities() gpuCapabilities {
 		caps.hasNvtop = true
 	}
 	if runtime.GOOS == "darwin" {
-		if _, err := utils.LookPathHomebrew(macmonCmd); err == nil {
+		if _, err := exec.LookPath(macmonCmd); err == nil {
 			caps.hasMacmon = true
 		}
 		if _, err := exec.LookPath(powermetricsCmd); err == nil {
@@ -542,7 +541,7 @@ func (gm *GPUManager) collectorDefinitions(caps gpuCapabilities) map[collectorSo
 	return map[collectorSource]collectorDefinition{
 		collectorSourceNVML: {
 			group:     collectorGroupNvidia,
-			available: true,
+			available: caps.hasNvidiaSmi,
 			start: func(_ func()) bool {
 				return gm.startNvmlCollector()
 			},
@@ -688,7 +687,7 @@ func (gm *GPUManager) resolveLegacyCollectorPriority(caps gpuCapabilities) []col
 	priorities := make([]collectorSource, 0, 4)
 
 	if caps.hasNvidiaSmi && !caps.hasTegrastats {
-		if nvml, _ := utils.GetEnv("NVML"); nvml == "true" {
+		if nvml, _ := GetEnv("NVML"); nvml == "true" {
 			priorities = append(priorities, collectorSourceNVML, collectorSourceNvidiaSMI)
 		} else {
 			priorities = append(priorities, collectorSourceNvidiaSMI)
@@ -696,7 +695,7 @@ func (gm *GPUManager) resolveLegacyCollectorPriority(caps gpuCapabilities) []col
 	}
 
 	if caps.hasRocmSmi {
-		if val, _ := utils.GetEnv("AMD_SYSFS"); val == "true" {
+		if val, _ := GetEnv("AMD_SYSFS"); val == "true" {
 			priorities = append(priorities, collectorSourceAmdSysfs)
 		} else {
 			priorities = append(priorities, collectorSourceRocmSMI)
@@ -729,11 +728,14 @@ func (gm *GPUManager) resolveLegacyCollectorPriority(caps gpuCapabilities) []col
 
 // NewGPUManager creates and initializes a new GPUManager
 func NewGPUManager() (*GPUManager, error) {
-	if skipGPU, _ := utils.GetEnv("SKIP_GPU"); skipGPU == "true" {
+	if skipGPU, _ := GetEnv("SKIP_GPU"); skipGPU == "true" {
 		return nil, nil
 	}
 	var gm GPUManager
 	caps := gm.discoverGpuCapabilities()
+	if !hasAnyGpuCollector(caps) {
+		return nil, fmt.Errorf(noGPUFoundMsg)
+	}
 	gm.GpuDataMap = make(map[string]*system.GPUData)
 
 	// Jetson devices should always use tegrastats (ignore GPU_COLLECTOR).
@@ -742,8 +744,8 @@ func NewGPUManager() (*GPUManager, error) {
 		return &gm, nil
 	}
 
-	// Respect explicit collector selection before capability auto-detection.
-	if collectorConfig, ok := utils.GetEnv("GPU_COLLECTOR"); ok && strings.TrimSpace(collectorConfig) != "" {
+	// if GPU_COLLECTOR is set, start user-defined collectors.
+	if collectorConfig, ok := GetEnv("GPU_COLLECTOR"); ok && strings.TrimSpace(collectorConfig) != "" {
 		priorities := parseCollectorPriority(collectorConfig)
 		if gm.startCollectorsByPriority(priorities, caps) == 0 {
 			return nil, fmt.Errorf("no configured GPU collectors are available")
@@ -751,10 +753,6 @@ func NewGPUManager() (*GPUManager, error) {
 		return &gm, nil
 	}
 
-	if !hasAnyGpuCollector(caps) {
-		return nil, fmt.Errorf(noGPUFoundMsg)
-	}
-
 	// auto-detect and start collectors when GPU_COLLECTOR is unset.
 	if gm.startCollectorsByPriority(gm.resolveLegacyCollectorPriority(caps), caps) == 0 {
 		return nil, fmt.Errorf(noGPUFoundMsg)

agent/gpu_amd_linux.go

@@ -13,7 +13,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
@@ -33,8 +32,8 @@ func (gm *GPUManager) hasAmdSysfs() bool {
 		return false
 	}
 	for _, vendorPath := range cards {
-		vendor, err := utils.ReadStringFileLimited(vendorPath, 64)
-		if err == nil && vendor == "0x1002" {
+		vendor, err := os.ReadFile(vendorPath)
+		if err == nil && strings.TrimSpace(string(vendor)) == "0x1002" {
 			return true
 		}
 	}
@@ -88,11 +87,12 @@ func (gm *GPUManager) collectAmdStats() error {
 
 // isAmdGpu checks whether a DRM card path belongs to AMD vendor ID 0x1002.
 func isAmdGpu(cardPath string) bool {
-	vendor, err := utils.ReadStringFileLimited(filepath.Join(cardPath, "device/vendor"), 64)
+	vendorPath := filepath.Join(cardPath, "device/vendor")
+	vendor, err := os.ReadFile(vendorPath)
 	if err != nil {
 		return false
 	}
-	return vendor == "0x1002"
+	return strings.TrimSpace(string(vendor)) == "0x1002"
 }
 
 // updateAmdGpuData reads GPU metrics from sysfs and updates the GPU data map.
@@ -144,8 +144,8 @@ func (gm *GPUManager) updateAmdGpuData(cardPath string) bool {
 	if usageErr == nil {
 		gpu.Usage += usage
 	}
-	gpu.MemoryUsed = utils.BytesToMegabytes(memUsed)
-	gpu.MemoryTotal = utils.BytesToMegabytes(memTotal)
+	gpu.MemoryUsed = bytesToMegabytes(memUsed)
+	gpu.MemoryTotal = bytesToMegabytes(memTotal)
 	gpu.Temperature = temp
 	gpu.Power += power
 	gpu.Count++
@@ -154,12 +154,11 @@ func (gm *GPUManager) updateAmdGpuData(cardPath string) bool {
 
 // readSysfsFloat reads and parses a numeric value from a sysfs file.
 func readSysfsFloat(path string) (float64, error) {
-	val, err := utils.ReadStringFileLimited(path, 64)
+	val, err := os.ReadFile(path)
 	if err != nil {
-		slog.Debug("Failed to read sysfs value", "path", path, "error", err)
 		return 0, err
 	}
-	return strconv.ParseFloat(val, 64)
+	return strconv.ParseFloat(strings.TrimSpace(string(val)), 64)
 }
 
 // normalizeHexID normalizes hex IDs by trimming spaces, lowercasing, and dropping 0x.
@@ -274,16 +273,16 @@ func cacheMissingAmdgpuName(deviceID, revisionID string) {
 // Falls back to showing the raw device ID if not found in the lookup table.
 func getAmdGpuName(devicePath string) string {
 	// Try product_name first (works for some enterprise GPUs)
-	if prod, err := utils.ReadStringFileLimited(filepath.Join(devicePath, "product_name"), 128); err == nil {
-		return prod
+	if prod, err := os.ReadFile(filepath.Join(devicePath, "product_name")); err == nil {
+		return strings.TrimSpace(string(prod))
 	}
 
 	// Read PCI device ID and look it up
-	if deviceID, err := utils.ReadStringFileLimited(filepath.Join(devicePath, "device"), 64); err == nil {
-		id := normalizeHexID(deviceID)
+	if deviceID, err := os.ReadFile(filepath.Join(devicePath, "device")); err == nil {
+		id := normalizeHexID(string(deviceID))
 		revision := ""
-		if rev, revErr := utils.ReadStringFileLimited(filepath.Join(devicePath, "revision"), 64); revErr == nil {
-			revision = normalizeHexID(rev)
+		if revBytes, revErr := os.ReadFile(filepath.Join(devicePath, "revision")); revErr == nil {
+			revision = normalizeHexID(string(revBytes))
 		}
 
 		if name, found, done := getCachedAmdgpuName(id, revision); found {

agent/gpu_amd_linux_test.go

@@ -7,7 +7,6 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -129,14 +128,14 @@ func TestUpdateAmdGpuDataWithFakeSysfs(t *testing.T) {
 		{
 			name:            "sums vram and gtt when gtt is present",
 			writeGTT:        true,
-			wantMemoryUsed:  utils.BytesToMegabytes(1073741824 + 536870912),
-			wantMemoryTotal: utils.BytesToMegabytes(2147483648 + 4294967296),
+			wantMemoryUsed:  bytesToMegabytes(1073741824 + 536870912),
+			wantMemoryTotal: bytesToMegabytes(2147483648 + 4294967296),
 		},
 		{
 			name:            "falls back to vram when gtt is missing",
 			writeGTT:        false,
-			wantMemoryUsed:  utils.BytesToMegabytes(1073741824),
-			wantMemoryTotal: utils.BytesToMegabytes(2147483648),
+			wantMemoryUsed:  bytesToMegabytes(1073741824),
+			wantMemoryTotal: bytesToMegabytes(2147483648),
 		},
 	}
 

agent/gpu_darwin.go

@@ -13,7 +13,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
@@ -172,11 +171,7 @@ type macmonSample struct {
 }
 
 func (gm *GPUManager) collectMacmonPipe() (err error) {
-	macmonPath, err := utils.LookPathHomebrew(macmonCmd)
-	if err != nil {
-		return err
-	}
-	cmd := exec.Command(macmonPath, "pipe", "-i", strconv.Itoa(macmonIntervalMs))
+	cmd := exec.Command(macmonCmd, "pipe", "-i", strconv.Itoa(macmonIntervalMs))
 	// Avoid blocking if macmon writes to stderr.
 	cmd.Stderr = io.Discard
 	stdout, err := cmd.StdoutPipe()

agent/gpu_intel.go

@@ -7,7 +7,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
@@ -53,7 +52,7 @@ func (gm *GPUManager) updateIntelFromStats(sample *intelGpuStats) bool {
 func (gm *GPUManager) collectIntelStats() (err error) {
 	// Build command arguments, optionally selecting a device via -d
 	args := []string{"-s", intelGpuStatsInterval, "-l"}
-	if dev, ok := utils.GetEnv("INTEL_GPU_DEVICE"); ok && dev != "" {
+	if dev, ok := GetEnv("INTEL_GPU_DEVICE"); ok && dev != "" {
 		args = append(args, "-d", dev)
 	}
 	cmd := exec.Command(intelGpuStatsCmd, args...)

agent/gpu_nvtop.go

@@ -9,7 +9,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
@@ -81,10 +80,10 @@ func (gm *GPUManager) updateNvtopSnapshots(snapshots []nvtopSnapshot) bool {
 			gpu.Temperature = parseNvtopNumber(*sample.Temp)
 		}
 		if sample.MemUsed != nil {
-			gpu.MemoryUsed = utils.BytesToMegabytes(parseNvtopNumber(*sample.MemUsed))
+			gpu.MemoryUsed = bytesToMegabytes(parseNvtopNumber(*sample.MemUsed))
 		}
 		if sample.MemTotal != nil {
-			gpu.MemoryTotal = utils.BytesToMegabytes(parseNvtopNumber(*sample.MemTotal))
+			gpu.MemoryTotal = bytesToMegabytes(parseNvtopNumber(*sample.MemTotal))
 		}
 		if sample.GpuUtil != nil {
 			gpu.Usage += parseNvtopNumber(*sample.GpuUtil)

agent/gpu_test.go

@@ -10,7 +10,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/stretchr/testify/assert"
@@ -266,8 +265,8 @@ func TestParseNvtopData(t *testing.T) {
 	assert.Equal(t, 48.0, g0.Temperature)
 	assert.Equal(t, 5.0, g0.Usage)
 	assert.Equal(t, 13.0, g0.Power)
-	assert.Equal(t, utils.BytesToMegabytes(349372416), g0.MemoryUsed)
-	assert.Equal(t, utils.BytesToMegabytes(4294967296), g0.MemoryTotal)
+	assert.Equal(t, bytesToMegabytes(349372416), g0.MemoryUsed)
+	assert.Equal(t, bytesToMegabytes(4294967296), g0.MemoryTotal)
 	assert.Equal(t, 1.0, g0.Count)
 
 	g1, ok := gm.GpuDataMap["n1"]
@@ -276,8 +275,8 @@ func TestParseNvtopData(t *testing.T) {
 	assert.Equal(t, 48.0, g1.Temperature)
 	assert.Equal(t, 12.0, g1.Usage)
 	assert.Equal(t, 9.0, g1.Power)
-	assert.Equal(t, utils.BytesToMegabytes(1213784064), g1.MemoryUsed)
-	assert.Equal(t, utils.BytesToMegabytes(16929173504), g1.MemoryTotal)
+	assert.Equal(t, bytesToMegabytes(1213784064), g1.MemoryUsed)
+	assert.Equal(t, bytesToMegabytes(16929173504), g1.MemoryTotal)
 	assert.Equal(t, 1.0, g1.Count)
 }
 
@@ -1083,6 +1082,8 @@ func TestCalculateGPUAverage(t *testing.T) {
 
 func TestGPUCapabilitiesAndLegacyPriority(t *testing.T) {
 	// Save original PATH
+	origPath := os.Getenv("PATH")
+	defer os.Setenv("PATH", origPath)
 	hasAmdSysfs := (&GPUManager{}).hasAmdSysfs()
 
 	tests := []struct {
@@ -1176,7 +1177,7 @@ echo "[]"`
 		{
 			name: "no gpu tools available",
 			setupCommands: func(_ string) error {
-				t.Setenv("PATH", "")
+				os.Setenv("PATH", "")
 				return nil
 			},
 			wantErr: true,
@@ -1186,7 +1187,7 @@ echo "[]"`
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			tempDir := t.TempDir()
-			t.Setenv("PATH", tempDir)
+			os.Setenv("PATH", tempDir)
 			if err := tt.setupCommands(tempDir); err != nil {
 				t.Fatal(err)
 			}
@@ -1232,9 +1233,13 @@ echo "[]"`
 }
 
 func TestCollectorStartHelpers(t *testing.T) {
+	// Save original PATH
+	origPath := os.Getenv("PATH")
+	defer os.Setenv("PATH", origPath)
+
 	// Set up temp dir with the commands
 	dir := t.TempDir()
-	t.Setenv("PATH", dir)
+	os.Setenv("PATH", dir)
 
 	tests := []struct {
 		name     string
@@ -1364,8 +1369,11 @@ echo '[{"device_name":"NVIDIA Test GPU","temp":"52C","power_draw":"31W","gpu_uti
 }
 
 func TestNewGPUManagerPriorityNvtopFallback(t *testing.T) {
+	origPath := os.Getenv("PATH")
+	defer os.Setenv("PATH", origPath)
+
 	dir := t.TempDir()
-	t.Setenv("PATH", dir)
+	os.Setenv("PATH", dir)
 	t.Setenv("BESZEL_AGENT_GPU_COLLECTOR", "nvtop,nvidia-smi")
 
 	nvtopPath := filepath.Join(dir, "nvtop")
@@ -1390,8 +1398,11 @@ echo "0, NVIDIA Priority GPU, 45, 512, 2048, 12, 25"`
 }
 
 func TestNewGPUManagerPriorityMixedCollectors(t *testing.T) {
+	origPath := os.Getenv("PATH")
+	defer os.Setenv("PATH", origPath)
+
 	dir := t.TempDir()
-	t.Setenv("PATH", dir)
+	os.Setenv("PATH", dir)
 	t.Setenv("BESZEL_AGENT_GPU_COLLECTOR", "intel_gpu_top,rocm-smi")
 
 	intelPath := filepath.Join(dir, "intel_gpu_top")
@@ -1421,8 +1432,11 @@ echo '{"card0": {"Temperature (Sensor edge) (C)": "49.0", "Current Socket Graphi
 }
 
 func TestNewGPUManagerPriorityNvmlFallbackToNvidiaSmi(t *testing.T) {
+	origPath := os.Getenv("PATH")
+	defer os.Setenv("PATH", origPath)
+
 	dir := t.TempDir()
-	t.Setenv("PATH", dir)
+	os.Setenv("PATH", dir)
 	t.Setenv("BESZEL_AGENT_GPU_COLLECTOR", "nvml,nvidia-smi")
 
 	nvidiaPath := filepath.Join(dir, "nvidia-smi")
@@ -1441,8 +1455,11 @@ echo "0, NVIDIA Fallback GPU, 41, 256, 1024, 8, 14"`
 }
 
 func TestNewGPUManagerConfiguredCollectorsMustStart(t *testing.T) {
+	origPath := os.Getenv("PATH")
+	defer os.Setenv("PATH", origPath)
+
 	dir := t.TempDir()
-	t.Setenv("PATH", dir)
+	os.Setenv("PATH", dir)
 
 	t.Run("configured valid collector unavailable", func(t *testing.T) {
 		t.Setenv("BESZEL_AGENT_GPU_COLLECTOR", "nvidia-smi")
@@ -1461,28 +1478,12 @@ func TestNewGPUManagerConfiguredCollectorsMustStart(t *testing.T) {
 	})
 }
 
-func TestCollectorDefinitionsNvmlDoesNotRequireNvidiaSmi(t *testing.T) {
-	gm := &GPUManager{}
-	definitions := gm.collectorDefinitions(gpuCapabilities{})
-	require.Contains(t, definitions, collectorSourceNVML)
-	assert.True(t, definitions[collectorSourceNVML].available)
-}
-
-func TestNewGPUManagerConfiguredNvmlBypassesCapabilityGate(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("PATH", dir)
-	t.Setenv("BESZEL_AGENT_GPU_COLLECTOR", "nvml")
-
-	gm, err := NewGPUManager()
-	require.Nil(t, gm)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "no configured GPU collectors are available")
-	assert.NotContains(t, err.Error(), noGPUFoundMsg)
-}
-
 func TestNewGPUManagerJetsonIgnoresCollectorConfig(t *testing.T) {
+	origPath := os.Getenv("PATH")
+	defer os.Setenv("PATH", origPath)
+
 	dir := t.TempDir()
-	t.Setenv("PATH", dir)
+	os.Setenv("PATH", dir)
 	t.Setenv("BESZEL_AGENT_GPU_COLLECTOR", "nvidia-smi")
 
 	tegraPath := filepath.Join(dir, "tegrastats")
@@ -1717,8 +1718,12 @@ func TestIntelUpdateFromStats(t *testing.T) {
 }
 
 func TestIntelCollectorStreaming(t *testing.T) {
+	// Save and override PATH
+	origPath := os.Getenv("PATH")
+	defer os.Setenv("PATH", origPath)
+
 	dir := t.TempDir()
-	t.Setenv("PATH", dir)
+	os.Setenv("PATH", dir)
 
 	// Create a fake intel_gpu_top that prints -l format with four samples (first will be skipped) and exits
 	scriptPath := filepath.Join(dir, "intel_gpu_top")

agent/lhm/beszel_lhm.csproj

@@ -8,6 +8,6 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.6" />
+    <PackageReference Include="LibreHardwareMonitorLib" Version="0.9.5" />
   </ItemGroup>
 </Project>

agent/mdraid_linux.go

@@ -9,7 +9,6 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/smart"
 )
 
@@ -43,7 +42,7 @@ func scanMdraidDevices() []*DeviceInfo {
 			continue
 		}
 		mdDir := filepath.Join(blockDir, name, "md")
-		if !utils.FileExists(filepath.Join(mdDir, "array_state")) {
+		if !fileExists(filepath.Join(mdDir, "array_state")) {
 			continue
 		}
 
@@ -135,24 +134,24 @@ func readMdraidHealth(blockName string) (mdraidHealth, bool) {
 	}
 
 	mdDir := filepath.Join(mdraidSysfsRoot, "block", blockName, "md")
-	arrayState, okState := utils.ReadStringFileOK(filepath.Join(mdDir, "array_state"))
+	arrayState, okState := readStringFileOK(filepath.Join(mdDir, "array_state"))
 	if !okState {
 		return out, false
 	}
 
 	out.arrayState = arrayState
-	out.level = utils.ReadStringFile(filepath.Join(mdDir, "level"))
-	out.syncAction = utils.ReadStringFile(filepath.Join(mdDir, "sync_action"))
-	out.syncCompleted = utils.ReadStringFile(filepath.Join(mdDir, "sync_completed"))
-	out.syncSpeed = utils.ReadStringFile(filepath.Join(mdDir, "sync_speed"))
+	out.level = readStringFile(filepath.Join(mdDir, "level"))
+	out.syncAction = readStringFile(filepath.Join(mdDir, "sync_action"))
+	out.syncCompleted = readStringFile(filepath.Join(mdDir, "sync_completed"))
+	out.syncSpeed = readStringFile(filepath.Join(mdDir, "sync_speed"))
 
-	if val, ok := utils.ReadUintFile(filepath.Join(mdDir, "raid_disks")); ok {
+	if val, ok := readUintFile(filepath.Join(mdDir, "raid_disks")); ok {
 		out.raidDisks = val
 	}
-	if val, ok := utils.ReadUintFile(filepath.Join(mdDir, "degraded")); ok {
+	if val, ok := readUintFile(filepath.Join(mdDir, "degraded")); ok {
 		out.degraded = val
 	}
-	if val, ok := utils.ReadUintFile(filepath.Join(mdDir, "mismatch_cnt")); ok {
+	if val, ok := readUintFile(filepath.Join(mdDir, "mismatch_cnt")); ok {
 		out.mismatchCnt = val
 	}
 
@@ -170,18 +169,11 @@ func mdraidSmartStatus(health mdraidHealth) string {
 	case "inactive", "faulty", "broken", "stopped":
 		return "FAILED"
 	}
-	// During rebuild/recovery, arrays are often temporarily degraded; report as
-	// warning instead of hard failure while synchronization is in progress.
-	syncAction := strings.ToLower(strings.TrimSpace(health.syncAction))
-	switch syncAction {
-	case "resync", "recover", "reshape":
-		return "WARNING"
-	}
 	if health.degraded > 0 {
 		return "FAILED"
 	}
-	switch syncAction {
-	case "check", "repair":
+	switch strings.ToLower(strings.TrimSpace(health.syncAction)) {
+	case "resync", "recover", "reshape", "check", "repair":
 		return "WARNING"
 	}
 	switch state {
@@ -213,7 +205,7 @@ func readMdraidBlockCapacityBytes(blockName, root string) (uint64, bool) {
 	sizePath := filepath.Join(root, "block", blockName, "size")
 	lbsPath := filepath.Join(root, "block", blockName, "queue", "logical_block_size")
 
-	sizeStr, ok := utils.ReadStringFileOK(sizePath)
+	sizeStr, ok := readStringFileOK(sizePath)
 	if !ok {
 		return 0, false
 	}
@@ -223,7 +215,7 @@ func readMdraidBlockCapacityBytes(blockName, root string) (uint64, bool) {
 	}
 
 	logicalBlockSize := uint64(512)
-	if lbsStr, ok := utils.ReadStringFileOK(lbsPath); ok {
+	if lbsStr, ok := readStringFileOK(lbsPath); ok {
 		if parsed, err := strconv.ParseUint(lbsStr, 10, 64); err == nil && parsed > 0 {
 			logicalBlockSize = parsed
 		}

agent/mdraid_linux_test.go

@@ -85,9 +85,6 @@ func TestMdraidSmartStatus(t *testing.T) {
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "inactive"}); got != "FAILED" {
 		t.Fatalf("mdraidSmartStatus(inactive) = %q, want FAILED", got)
 	}
-	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", degraded: 1, syncAction: "recover"}); got != "WARNING" {
-		t.Fatalf("mdraidSmartStatus(degraded+recover) = %q, want WARNING", got)
-	}
 	if got := mdraidSmartStatus(mdraidHealth{arrayState: "active", degraded: 1}); got != "FAILED" {
 		t.Fatalf("mdraidSmartStatus(degraded) = %q, want FAILED", got)
 	}

agent/network.go

@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel/agent/deltatracker"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 	psutilNet "github.com/shirou/gopsutil/v4/net"
 )
@@ -95,7 +94,7 @@ func (a *Agent) initializeNetIoStats() {
 	a.netInterfaces = make(map[string]struct{}, 0)
 
 	// parse NICS env var for whitelist / blacklist
-	nicsEnvVal, nicsEnvExists := utils.GetEnv("NICS")
+	nicsEnvVal, nicsEnvExists := GetEnv("NICS")
 	var nicCfg *NicConfig
 	if nicsEnvExists {
 		nicCfg = newNicConfig(nicsEnvVal)
@@ -104,7 +103,10 @@ func (a *Agent) initializeNetIoStats() {
 	// get current network I/O stats and record valid interfaces
 	if netIO, err := psutilNet.IOCounters(true); err == nil {
 		for _, v := range netIO {
-			if skipNetworkInterface(v, nicCfg) {
+			if nicsEnvExists && !isValidNic(v.Name, nicCfg) {
+				continue
+			}
+			if a.skipNetworkInterface(v) {
 				continue
 			}
 			slog.Info("Detected network interface", "name", v.Name, "sent", v.BytesSent, "recv", v.BytesRecv)
@@ -213,8 +215,10 @@ func (a *Agent) applyNetworkTotals(
 	totalBytesSent, totalBytesRecv uint64,
 	bytesSentPerSecond, bytesRecvPerSecond uint64,
 ) {
-	if bytesSentPerSecond > 10_000_000_000 || bytesRecvPerSecond > 10_000_000_000 {
-		slog.Warn("Invalid net stats. Resetting.", "sent", bytesSentPerSecond, "recv", bytesRecvPerSecond)
+	networkSentPs := bytesToMegabytes(float64(bytesSentPerSecond))
+	networkRecvPs := bytesToMegabytes(float64(bytesRecvPerSecond))
+	if networkSentPs > 10_000 || networkRecvPs > 10_000 {
+		slog.Warn("Invalid net stats. Resetting.", "sent", networkSentPs, "recv", networkRecvPs)
 		for _, v := range netIO {
 			if _, exists := a.netInterfaces[v.Name]; !exists {
 				continue
@@ -224,29 +228,21 @@ func (a *Agent) applyNetworkTotals(
 		a.initializeNetIoStats()
 		delete(a.netIoStats, cacheTimeMs)
 		delete(a.netInterfaceDeltaTrackers, cacheTimeMs)
+		systemStats.NetworkSent = 0
+		systemStats.NetworkRecv = 0
 		systemStats.Bandwidth[0], systemStats.Bandwidth[1] = 0, 0
 		return
 	}
 
+	systemStats.NetworkSent = networkSentPs
+	systemStats.NetworkRecv = networkRecvPs
 	systemStats.Bandwidth[0], systemStats.Bandwidth[1] = bytesSentPerSecond, bytesRecvPerSecond
 	nis.BytesSent = totalBytesSent
 	nis.BytesRecv = totalBytesRecv
 	a.netIoStats[cacheTimeMs] = nis
 }
 
-// skipNetworkInterface returns true if the network interface should be ignored.
-func skipNetworkInterface(v psutilNet.IOCountersStat, nicCfg *NicConfig) bool {
-	if nicCfg != nil {
-		if !isValidNic(v.Name, nicCfg) {
-			return true
-		}
-		// In whitelist mode, we honor explicit inclusion without auto-filtering.
-		if !nicCfg.isBlacklist {
-			return false
-		}
-		// In blacklist mode, still apply the auto-filter below.
-	}
-
+func (a *Agent) skipNetworkInterface(v psutilNet.IOCountersStat) bool {
 	switch {
 	case strings.HasPrefix(v.Name, "lo"),
 		strings.HasPrefix(v.Name, "docker"),

agent/network_test.go

@@ -261,39 +261,6 @@ func TestNewNicConfig(t *testing.T) {
 		})
 	}
 }
-func TestSkipNetworkInterface(t *testing.T) {
-	tests := []struct {
-		name       string
-		nic        psutilNet.IOCountersStat
-		nicCfg     *NicConfig
-		expectSkip bool
-	}{
-		{"loopback lo", psutilNet.IOCountersStat{Name: "lo", BytesSent: 100, BytesRecv: 100}, nil, true},
-		{"loopback lo0", psutilNet.IOCountersStat{Name: "lo0", BytesSent: 100, BytesRecv: 100}, nil, true},
-		{"docker prefix", psutilNet.IOCountersStat{Name: "docker0", BytesSent: 100, BytesRecv: 100}, nil, true},
-		{"br- prefix", psutilNet.IOCountersStat{Name: "br-lan", BytesSent: 100, BytesRecv: 100}, nil, true},
-		{"veth prefix", psutilNet.IOCountersStat{Name: "veth0abc", BytesSent: 100, BytesRecv: 100}, nil, true},
-		{"bond prefix", psutilNet.IOCountersStat{Name: "bond0", BytesSent: 100, BytesRecv: 100}, nil, true},
-		{"cali prefix", psutilNet.IOCountersStat{Name: "cali1234", BytesSent: 100, BytesRecv: 100}, nil, true},
-		{"zero BytesRecv", psutilNet.IOCountersStat{Name: "eth0", BytesSent: 100, BytesRecv: 0}, nil, true},
-		{"zero BytesSent", psutilNet.IOCountersStat{Name: "eth0", BytesSent: 0, BytesRecv: 100}, nil, true},
-		{"both zero", psutilNet.IOCountersStat{Name: "eth0", BytesSent: 0, BytesRecv: 0}, nil, true},
-		{"normal eth0", psutilNet.IOCountersStat{Name: "eth0", BytesSent: 100, BytesRecv: 200}, nil, false},
-		{"normal wlan0", psutilNet.IOCountersStat{Name: "wlan0", BytesSent: 1, BytesRecv: 1}, nil, false},
-		{"whitelist overrides skip (docker)", psutilNet.IOCountersStat{Name: "docker0", BytesSent: 100, BytesRecv: 100}, newNicConfig("docker0"), false},
-		{"whitelist overrides skip (lo)", psutilNet.IOCountersStat{Name: "lo", BytesSent: 100, BytesRecv: 100}, newNicConfig("lo"), false},
-		{"whitelist exclusion", psutilNet.IOCountersStat{Name: "eth1", BytesSent: 100, BytesRecv: 100}, newNicConfig("eth0"), true},
-		{"blacklist skip lo", psutilNet.IOCountersStat{Name: "lo", BytesSent: 100, BytesRecv: 100}, newNicConfig("-eth0"), true},
-		{"blacklist explicit eth0", psutilNet.IOCountersStat{Name: "eth0", BytesSent: 100, BytesRecv: 100}, newNicConfig("-eth0"), true},
-		{"blacklist allow eth1", psutilNet.IOCountersStat{Name: "eth1", BytesSent: 100, BytesRecv: 100}, newNicConfig("-eth0"), false},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.expectSkip, skipNetworkInterface(tt.nic, tt.nicCfg))
-		})
-	}
-}
-
 func TestEnsureNetworkInterfacesMap(t *testing.T) {
 	var a Agent
 	var stats system.Stats
@@ -416,6 +383,8 @@ func TestApplyNetworkTotals(t *testing.T) {
 		totalBytesSent        uint64
 		totalBytesRecv        uint64
 		expectReset           bool
+		expectedNetworkSent   float64
+		expectedNetworkRecv   float64
 		expectedBandwidthSent uint64
 		expectedBandwidthRecv uint64
 	}{
@@ -426,6 +395,8 @@ func TestApplyNetworkTotals(t *testing.T) {
 			totalBytesSent:        10000000,
 			totalBytesRecv:        20000000,
 			expectReset:           false,
+			expectedNetworkSent:   0.95, // ~1 MB/s rounded to 2 decimals
+			expectedNetworkRecv:   1.91, // ~2 MB/s rounded to 2 decimals
 			expectedBandwidthSent: 1000000,
 			expectedBandwidthRecv: 2000000,
 		},
@@ -453,6 +424,18 @@ func TestApplyNetworkTotals(t *testing.T) {
 			totalBytesRecv:     20000000,
 			expectReset:        true,
 		},
+		{
+			name:                  "Valid network stats - at threshold boundary",
+			bytesSentPerSecond:    10485750000, // ~9999.99 MB/s (rounds to 9999.99)
+			bytesRecvPerSecond:    10485750000, // ~9999.99 MB/s (rounds to 9999.99)
+			totalBytesSent:        10000000,
+			totalBytesRecv:        20000000,
+			expectReset:           false,
+			expectedNetworkSent:   9999.99,
+			expectedNetworkRecv:   9999.99,
+			expectedBandwidthSent: 10485750000,
+			expectedBandwidthRecv: 10485750000,
+		},
 		{
 			name:                  "Zero values",
 			bytesSentPerSecond:    0,
@@ -460,6 +443,8 @@ func TestApplyNetworkTotals(t *testing.T) {
 			totalBytesSent:        0,
 			totalBytesRecv:        0,
 			expectReset:           false,
+			expectedNetworkSent:   0.0,
+			expectedNetworkRecv:   0.0,
 			expectedBandwidthSent: 0,
 			expectedBandwidthRecv: 0,
 		},
@@ -496,10 +481,14 @@ func TestApplyNetworkTotals(t *testing.T) {
 				// Should have reset network tracking state - maps cleared and stats zeroed
 				assert.NotContains(t, a.netIoStats, cacheTimeMs, "cache entry should be cleared after reset")
 				assert.NotContains(t, a.netInterfaceDeltaTrackers, cacheTimeMs, "tracker should be cleared on reset")
+				assert.Zero(t, systemStats.NetworkSent)
+				assert.Zero(t, systemStats.NetworkRecv)
 				assert.Zero(t, systemStats.Bandwidth[0])
 				assert.Zero(t, systemStats.Bandwidth[1])
 			} else {
 				// Should have applied stats
+				assert.Equal(t, tt.expectedNetworkSent, systemStats.NetworkSent)
+				assert.Equal(t, tt.expectedNetworkRecv, systemStats.NetworkRecv)
 				assert.Equal(t, tt.expectedBandwidthSent, systemStats.Bandwidth[0])
 				assert.Equal(t, tt.expectedBandwidthRecv, systemStats.Bandwidth[1])
 

agent/pve.go

@@ -0,0 +1,177 @@
+package agent
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/container"
+
+	"github.com/luthermonson/go-proxmox"
+)
+
+type pveManager struct {
+	client       *proxmox.Client                    // Client to query PVE API
+	nodeName     string                             // Cluster node name
+	cpuCount     int                                // CPU count on node
+	nodeStatsMap map[string]*container.PveNodeStats // Keeps track of pve node stats
+	lastInitTry  time.Time                          // Last time node initialization was attempted
+}
+
+// newPVEManager creates a new PVE manager - may return nil if required environment variables
+// are not set or if there is an error connecting to the API
+func newPVEManager() *pveManager {
+	url, exists := GetEnv("PROXMOX_URL")
+	if !exists {
+		url = "https://localhost:8006/api2/json"
+	}
+	const nodeEnvVar = "PROXMOX_NODE"
+	const tokenIDEnvVar = "PROXMOX_TOKENID"
+	const secretEnvVar = "PROXMOX_SECRET"
+
+	nodeName, nodeNameExists := GetEnv(nodeEnvVar)
+	tokenID, tokenIDExists := GetEnv(tokenIDEnvVar)
+	secret, secretExists := GetEnv(secretEnvVar)
+
+	if !nodeNameExists || !tokenIDExists || !secretExists {
+		slog.Debug("Proxmox env vars unset", nodeEnvVar, nodeNameExists, tokenIDEnvVar, tokenIDExists, secretEnvVar, secretExists)
+		return nil
+	}
+
+	// PROXMOX_INSECURE_TLS defaults to true; set to "false" to enable TLS verification
+	insecureTLS := true
+	if val, exists := GetEnv("PROXMOX_INSECURE_TLS"); exists {
+		insecureTLS = val != "false"
+	}
+
+	httpClient := http.Client{
+		Transport: &http.Transport{
+			TLSClientConfig: &tls.Config{
+				InsecureSkipVerify: insecureTLS,
+			},
+		},
+	}
+	client := proxmox.NewClient(url,
+		proxmox.WithHTTPClient(&httpClient),
+		proxmox.WithAPIToken(tokenID, secret),
+	)
+
+	pveManager := pveManager{
+		client:       client,
+		nodeName:     nodeName,
+		nodeStatsMap: make(map[string]*container.PveNodeStats),
+	}
+
+	return &pveManager
+}
+
+// ensureInitialized checks if the PVE manager is initialized and attempts to initialize it if not.
+// It returns an error if initialization fails or if a retry is pending.
+func (pm *pveManager) ensureInitialized(ctx context.Context) error {
+	if pm.client == nil {
+		return errors.New("PVE client not configured")
+	}
+	if pm.cpuCount > 0 {
+		return nil
+	}
+
+	if time.Since(pm.lastInitTry) < 30*time.Second {
+		return errors.New("PVE initialization retry pending")
+	}
+	pm.lastInitTry = time.Now()
+
+	node, err := pm.client.Node(ctx, pm.nodeName)
+	if err != nil {
+		return err
+	}
+	if node.CPUInfo.CPUs <= 0 {
+		return errors.New("node returned zero CPUs")
+	}
+
+	pm.cpuCount = node.CPUInfo.CPUs
+	return nil
+}
+
+// getPVEStats returns stats for all running VMs/LXCs
+func (pm *pveManager) getPVEStats() ([]*container.PveNodeStats, error) {
+	if err := pm.ensureInitialized(context.Background()); err != nil {
+		slog.Warn("Proxmox API unavailable", "err", err)
+		return nil, err
+	}
+	cluster, err := pm.client.Cluster(context.Background())
+	if err != nil {
+		slog.Error("Error getting cluster", "err", err)
+		return nil, err
+	}
+	resources, err := cluster.Resources(context.Background(), "vm")
+	if err != nil {
+		slog.Error("Error getting resources", "err", err, "resources", resources)
+		return nil, err
+	}
+	containersLength := len(resources)
+	resourceIds := make(map[string]struct{}, containersLength)
+
+	// only include running vms and lxcs on selected node
+	for _, resource := range resources {
+		if resource.Node == pm.nodeName && resource.Status == "running" {
+			resourceIds[resource.ID] = struct{}{}
+		}
+	}
+	// remove invalid container stats
+	for id := range pm.nodeStatsMap {
+		if _, exists := resourceIds[id]; !exists {
+			delete(pm.nodeStatsMap, id)
+		}
+	}
+
+	// populate stats
+	stats := make([]*container.PveNodeStats, 0, len(resourceIds))
+	for _, resource := range resources {
+		if _, exists := resourceIds[resource.ID]; !exists {
+			continue
+		}
+		resourceStats, initialized := pm.nodeStatsMap[resource.ID]
+		if !initialized {
+			resourceStats = &container.PveNodeStats{}
+			pm.nodeStatsMap[resource.ID] = resourceStats
+		}
+		resourceStats.Name = resource.Name
+		resourceStats.Id = resource.ID
+		resourceStats.Type = resource.Type
+		resourceStats.MaxCPU = resource.MaxCPU
+		resourceStats.MaxMem = resource.MaxMem
+		resourceStats.Uptime = resource.Uptime
+		resourceStats.DiskRead = resource.DiskRead
+		resourceStats.DiskWrite = resource.DiskWrite
+		resourceStats.Disk = resource.MaxDisk
+
+		// prevent first run from sending all prev sent/recv bytes
+		total_sent := resource.NetOut
+		total_recv := resource.NetIn
+		var sent_delta, recv_delta float64
+		if initialized {
+			secondsElapsed := time.Since(resourceStats.PrevReadTime).Seconds()
+			if secondsElapsed > 0 {
+				sent_delta = float64(total_sent-resourceStats.PrevNet.Sent) / secondsElapsed
+				recv_delta = float64(total_recv-resourceStats.PrevNet.Recv) / secondsElapsed
+			}
+		}
+		resourceStats.PrevNet.Sent = total_sent
+		resourceStats.PrevNet.Recv = total_recv
+		resourceStats.PrevReadTime = time.Now()
+
+		// Update final stats values
+		resourceStats.Cpu = twoDecimals(100.0 * resource.CPU * float64(resource.MaxCPU) / float64(pm.cpuCount))
+		resourceStats.Mem = bytesToMegabytes(float64(resource.Mem))
+		resourceStats.Bandwidth = [2]uint64{uint64(sent_delta), uint64(recv_delta)}
+		resourceStats.NetOut = total_sent
+		resourceStats.NetIn = total_recv
+
+		stats = append(stats, resourceStats)
+	}
+
+	return stats, nil
+}

agent/pve_test.go

@@ -0,0 +1,92 @@
+package agent
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/luthermonson/go-proxmox"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewPVEManagerDoesNotConnectAtStartup(t *testing.T) {
+	t.Setenv("BESZEL_AGENT_PROXMOX_URL", "https://127.0.0.1:1/api2/json")
+	t.Setenv("BESZEL_AGENT_PROXMOX_NODE", "pve")
+	t.Setenv("BESZEL_AGENT_PROXMOX_TOKENID", "root@pam!test")
+	t.Setenv("BESZEL_AGENT_PROXMOX_SECRET", "secret")
+
+	pm := newPVEManager()
+	require.NotNil(t, pm)
+	assert.Zero(t, pm.cpuCount)
+}
+
+func TestPVEManagerRetriesInitialization(t *testing.T) {
+	var nodeRequests atomic.Int32
+	var clusterRequests atomic.Int32
+
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.URL.Path {
+		case "/api2/json/nodes/pve/status":
+			nodeRequests.Add(1)
+			fmt.Fprint(w, `{"data":{"cpuinfo":{"cpus":8}}}`)
+		case "/api2/json/cluster/status":
+			fmt.Fprint(w, `{"data":[{"type":"cluster","name":"test-cluster","id":"test-cluster","version":1,"quorate":1}]}`)
+		case "/api2/json/cluster/resources":
+			clusterRequests.Add(1)
+			fmt.Fprint(w, `{"data":[{"id":"qemu/101","type":"qemu","node":"pve","status":"running","name":"vm-101","cpu":0.5,"maxcpu":4,"maxmem":4096,"mem":2048,"netin":1024,"netout":2048,"diskread":10,"diskwrite":20,"maxdisk":8192,"uptime":60}]}`)
+		default:
+			t.Fatalf("unexpected path: %s", r.URL.Path)
+		}
+	}))
+	defer server.Close()
+
+	pm := &pveManager{
+		client: proxmox.NewClient(server.URL+"/api2/json",
+			proxmox.WithHTTPClient(&http.Client{
+				Transport: &failOnceRoundTripper{
+					base: server.Client().Transport,
+				},
+			}),
+			proxmox.WithAPIToken("root@pam!test", "secret"),
+		),
+		nodeName:     "pve",
+		nodeStatsMap: make(map[string]*container.PveNodeStats),
+	}
+
+	stats, err := pm.getPVEStats()
+	require.Error(t, err)
+	assert.Nil(t, stats)
+	assert.Zero(t, pm.cpuCount)
+
+	pm.lastInitTry = time.Now().Add(-31 * time.Second)
+	stats, err = pm.getPVEStats()
+	require.NoError(t, err)
+	require.Len(t, stats, 1)
+	assert.Equal(t, int32(1), nodeRequests.Load())
+	assert.Equal(t, int32(1), clusterRequests.Load())
+	assert.Equal(t, 8, pm.cpuCount)
+	assert.Equal(t, "qemu/101", stats[0].Id)
+	assert.Equal(t, 25.0, stats[0].Cpu)
+	assert.Equal(t, uint64(1024), stats[0].NetIn)
+	assert.Equal(t, uint64(2048), stats[0].NetOut)
+}
+
+type failOnceRoundTripper struct {
+	base   http.RoundTripper
+	failed atomic.Bool
+}
+
+func (rt *failOnceRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	if req.URL.Path == "/api2/json/nodes/pve/status" && !rt.failed.Swap(true) {
+		return nil, errors.New("dial tcp 127.0.0.1:8006: connect: connection refused")
+	}
+	return rt.base.RoundTrip(req)
+}
+
+var _ http.RoundTripper = (*failOnceRoundTripper)(nil)

agent/sensors.go

@@ -2,67 +2,48 @@ package agent
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"log/slog"
 	"path"
 	"runtime"
 	"strconv"
 	"strings"
-	"time"
 	"unicode/utf8"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/shirou/gopsutil/v4/common"
 	"github.com/shirou/gopsutil/v4/sensors"
 )
 
-var errTemperatureFetchTimeout = errors.New("temperature collection timed out")
-
-// Matches sensors.TemperaturesWithContext to allow for panic recovery (gopsutil/issues/1832)
-type getTempsFn func(ctx context.Context) ([]sensors.TemperatureStat, error)
-
 type SensorConfig struct {
 	context        context.Context
 	sensors        map[string]struct{}
 	primarySensor  string
-	timeout        time.Duration
 	isBlacklist    bool
 	hasWildcards   bool
 	skipCollection bool
-	firstRun       bool
 }
 
 func (a *Agent) newSensorConfig() *SensorConfig {
-	primarySensor, _ := utils.GetEnv("PRIMARY_SENSOR")
-	sysSensors, _ := utils.GetEnv("SYS_SENSORS")
-	sensorsEnvVal, sensorsSet := utils.GetEnv("SENSORS")
+	primarySensor, _ := GetEnv("PRIMARY_SENSOR")
+	sysSensors, _ := GetEnv("SYS_SENSORS")
+	sensorsEnvVal, sensorsSet := GetEnv("SENSORS")
 	skipCollection := sensorsSet && sensorsEnvVal == ""
-	sensorsTimeout, _ := utils.GetEnv("SENSORS_TIMEOUT")
 
-	return a.newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, sensorsTimeout, skipCollection)
+	return a.newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, skipCollection)
 }
 
+// Matches sensors.TemperaturesWithContext to allow for panic recovery (gopsutil/issues/1832)
+type getTempsFn func(ctx context.Context) ([]sensors.TemperatureStat, error)
+
 // newSensorConfigWithEnv creates a SensorConfig with the provided environment variables
 // sensorsSet indicates if the SENSORS environment variable was explicitly set (even to empty string)
-func (a *Agent) newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal, sensorsTimeout string, skipCollection bool) *SensorConfig {
-	timeout := 2 * time.Second
-	if sensorsTimeout != "" {
-		if d, err := time.ParseDuration(sensorsTimeout); err == nil {
-			timeout = d
-		} else {
-			slog.Warn("Invalid SENSORS_TIMEOUT", "value", sensorsTimeout)
-		}
-	}
-
+func (a *Agent) newSensorConfigWithEnv(primarySensor, sysSensors, sensorsEnvVal string, skipCollection bool) *SensorConfig {
 	config := &SensorConfig{
 		context:        context.Background(),
 		primarySensor:  primarySensor,
-		timeout:        timeout,
 		skipCollection: skipCollection,
-		firstRun:       true,
 		sensors:        make(map[string]struct{}),
 	}
 
@@ -104,12 +85,10 @@ func (a *Agent) updateTemperatures(systemStats *system.Stats) {
 	// reset high temp
 	a.systemInfo.DashboardTemp = 0
 
-	temps, err := a.getTempsWithTimeout(getSensorTemps)
+	temps, err := a.getTempsWithPanicRecovery(getSensorTemps)
 	if err != nil {
 		// retry once on panic (gopsutil/issues/1832)
-		if !errors.Is(err, errTemperatureFetchTimeout) {
-			temps, err = a.getTempsWithTimeout(getSensorTemps)
-		}
+		temps, err = a.getTempsWithPanicRecovery(getSensorTemps)
 		if err != nil {
 			slog.Warn("Error updating temperatures", "err", err)
 			if len(systemStats.Temperatures) > 0 {
@@ -156,7 +135,7 @@ func (a *Agent) updateTemperatures(systemStats *system.Stats) {
 		case sensorName:
 			a.systemInfo.DashboardTemp = sensor.Temperature
 		}
-		systemStats.Temperatures[sensorName] = utils.TwoDecimals(sensor.Temperature)
+		systemStats.Temperatures[sensorName] = twoDecimals(sensor.Temperature)
 	}
 }
 
@@ -172,34 +151,6 @@ func (a *Agent) getTempsWithPanicRecovery(getTemps getTempsFn) (temps []sensors.
 	return
 }
 
-func (a *Agent) getTempsWithTimeout(getTemps getTempsFn) ([]sensors.TemperatureStat, error) {
-	type result struct {
-		temps []sensors.TemperatureStat
-		err   error
-	}
-
-	// Use a longer timeout on the first run to allow for initialization
-	// (e.g. Windows LHM subprocess startup)
-	timeout := a.sensorConfig.timeout
-	if a.sensorConfig.firstRun {
-		a.sensorConfig.firstRun = false
-		timeout = 10 * time.Second
-	}
-
-	resultCh := make(chan result, 1)
-	go func() {
-		temps, err := a.getTempsWithPanicRecovery(getTemps)
-		resultCh <- result{temps: temps, err: err}
-	}()
-
-	select {
-	case res := <-resultCh:
-		return res.temps, res.err
-	case <-time.After(timeout):
-		return nil, errTemperatureFetchTimeout
-	}
-}
-
 // isValidSensor checks if a sensor is valid based on the sensor name and the sensor config
 func isValidSensor(sensorName string, config *SensorConfig) bool {
 	// if no sensors configured, everything is valid

agent/sensors_test.go

@@ -5,8 +5,8 @@ package agent
 import (
 	"context"
 	"fmt"
+	"os"
 	"testing"
-	"time"
 
 	"github.com/henrygd/beszel/internal/entities/system"
 
@@ -168,7 +168,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 		primarySensor  string
 		sysSensors     string
 		sensors        string
-		sensorsTimeout string
 		skipCollection bool
 		expectedConfig *SensorConfig
 	}{
@@ -180,37 +179,12 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:        context.Background(),
 				primarySensor:  "",
-				timeout:        2 * time.Second,
 				sensors:        map[string]struct{}{},
 				isBlacklist:    false,
 				hasWildcards:   false,
 				skipCollection: false,
 			},
 		},
-		{
-			name:           "Custom timeout",
-			primarySensor:  "",
-			sysSensors:     "",
-			sensors:        "",
-			sensorsTimeout: "5s",
-			expectedConfig: &SensorConfig{
-				context: context.Background(),
-				timeout: 5 * time.Second,
-				sensors: map[string]struct{}{},
-			},
-		},
-		{
-			name:           "Invalid timeout falls back to default",
-			primarySensor:  "",
-			sysSensors:     "",
-			sensors:        "",
-			sensorsTimeout: "notaduration",
-			expectedConfig: &SensorConfig{
-				context: context.Background(),
-				timeout: 2 * time.Second,
-				sensors: map[string]struct{}{},
-			},
-		},
 		{
 			name:           "Explicitly set to empty string",
 			primarySensor:  "",
@@ -220,7 +194,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:        context.Background(),
 				primarySensor:  "",
-				timeout:        2 * time.Second,
 				sensors:        map[string]struct{}{},
 				isBlacklist:    false,
 				hasWildcards:   false,
@@ -235,7 +208,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors:       map[string]struct{}{},
 				isBlacklist:   false,
 				hasWildcards:  false,
@@ -249,7 +221,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 					"gpu_temp": {},
@@ -266,7 +237,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 					"gpu_temp": {},
@@ -283,7 +253,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_*":    {},
 					"gpu_temp": {},
@@ -300,7 +269,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			expectedConfig: &SensorConfig{
 				context:       context.Background(),
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_*":    {},
 					"gpu_temp": {},
@@ -316,7 +284,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			sensors:       "cpu_temp",
 			expectedConfig: &SensorConfig{
 				primarySensor: "cpu_temp",
-				timeout:       2 * time.Second,
 				sensors: map[string]struct{}{
 					"cpu_temp": {},
 				},
@@ -328,7 +295,7 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := agent.newSensorConfigWithEnv(tt.primarySensor, tt.sysSensors, tt.sensors, tt.sensorsTimeout, tt.skipCollection)
+			result := agent.newSensorConfigWithEnv(tt.primarySensor, tt.sysSensors, tt.sensors, tt.skipCollection)
 
 			// Check primary sensor
 			assert.Equal(t, tt.expectedConfig.primarySensor, result.primarySensor)
@@ -347,7 +314,6 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 			// Check flags
 			assert.Equal(t, tt.expectedConfig.isBlacklist, result.isBlacklist)
 			assert.Equal(t, tt.expectedConfig.hasWildcards, result.hasWildcards)
-			assert.Equal(t, tt.expectedConfig.timeout, result.timeout)
 
 			// Check context
 			if tt.sysSensors != "" {
@@ -363,18 +329,40 @@ func TestNewSensorConfigWithEnv(t *testing.T) {
 }
 
 func TestNewSensorConfig(t *testing.T) {
+	// Save original environment variables
+	originalPrimary, hasPrimary := os.LookupEnv("BESZEL_AGENT_PRIMARY_SENSOR")
+	originalSys, hasSys := os.LookupEnv("BESZEL_AGENT_SYS_SENSORS")
+	originalSensors, hasSensors := os.LookupEnv("BESZEL_AGENT_SENSORS")
+
+	// Restore environment variables after the test
+	defer func() {
+		// Clean up test environment variables
+		os.Unsetenv("BESZEL_AGENT_PRIMARY_SENSOR")
+		os.Unsetenv("BESZEL_AGENT_SYS_SENSORS")
+		os.Unsetenv("BESZEL_AGENT_SENSORS")
+
+		// Restore original values if they existed
+		if hasPrimary {
+			os.Setenv("BESZEL_AGENT_PRIMARY_SENSOR", originalPrimary)
+		}
+		if hasSys {
+			os.Setenv("BESZEL_AGENT_SYS_SENSORS", originalSys)
+		}
+		if hasSensors {
+			os.Setenv("BESZEL_AGENT_SENSORS", originalSensors)
+		}
+	}()
+
 	// Set test environment variables
-	t.Setenv("BESZEL_AGENT_PRIMARY_SENSOR", "test_primary")
-	t.Setenv("BESZEL_AGENT_SYS_SENSORS", "/test/path")
-	t.Setenv("BESZEL_AGENT_SENSORS", "test_sensor1,test_*,test_sensor3")
-	t.Setenv("BESZEL_AGENT_SENSORS_TIMEOUT", "7s")
+	os.Setenv("BESZEL_AGENT_PRIMARY_SENSOR", "test_primary")
+	os.Setenv("BESZEL_AGENT_SYS_SENSORS", "/test/path")
+	os.Setenv("BESZEL_AGENT_SENSORS", "test_sensor1,test_*,test_sensor3")
 
 	agent := &Agent{}
 	result := agent.newSensorConfig()
 
 	// Verify results
 	assert.Equal(t, "test_primary", result.primarySensor)
-	assert.Equal(t, 7*time.Second, result.timeout)
 	assert.NotNil(t, result.sensors)
 	assert.Equal(t, 3, len(result.sensors))
 	assert.True(t, result.hasWildcards)
@@ -563,59 +551,3 @@ func TestGetTempsWithPanicRecovery(t *testing.T) {
 		})
 	}
 }
-
-func TestGetTempsWithTimeout(t *testing.T) {
-	agent := &Agent{
-		sensorConfig: &SensorConfig{
-			context: context.Background(),
-			timeout: 10 * time.Millisecond,
-		},
-	}
-
-	t.Run("returns temperatures before timeout", func(t *testing.T) {
-		temps, err := agent.getTempsWithTimeout(func(ctx context.Context) ([]sensors.TemperatureStat, error) {
-			return []sensors.TemperatureStat{{SensorKey: "cpu_temp", Temperature: 42}}, nil
-		})
-
-		require.NoError(t, err)
-		require.Len(t, temps, 1)
-		assert.Equal(t, "cpu_temp", temps[0].SensorKey)
-	})
-
-	t.Run("returns timeout error when collector hangs", func(t *testing.T) {
-		temps, err := agent.getTempsWithTimeout(func(ctx context.Context) ([]sensors.TemperatureStat, error) {
-			time.Sleep(50 * time.Millisecond)
-			return []sensors.TemperatureStat{{SensorKey: "cpu_temp", Temperature: 42}}, nil
-		})
-
-		assert.Nil(t, temps)
-		assert.ErrorIs(t, err, errTemperatureFetchTimeout)
-	})
-}
-
-func TestUpdateTemperaturesSkipsOnTimeout(t *testing.T) {
-	agent := &Agent{
-		systemInfo: system.Info{DashboardTemp: 99},
-		sensorConfig: &SensorConfig{
-			context: context.Background(),
-			timeout: 10 * time.Millisecond,
-		},
-	}
-
-	t.Cleanup(func() {
-		getSensorTemps = sensors.TemperaturesWithContext
-	})
-	getSensorTemps = func(ctx context.Context) ([]sensors.TemperatureStat, error) {
-		time.Sleep(50 * time.Millisecond)
-		return nil, nil
-	}
-
-	stats := &system.Stats{
-		Temperatures: map[string]float64{"stale": 50},
-	}
-
-	agent.updateTemperatures(stats)
-
-	assert.Equal(t, 0.0, agent.systemInfo.DashboardTemp)
-	assert.Equal(t, map[string]float64{}, stats.Temperatures)
-}

agent/server.go

@@ -12,7 +12,6 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/entities/system"
 
@@ -37,7 +36,7 @@ var hubVersions map[string]semver.Version
 // and begins listening for connections. Returns an error if the server
 // is already running or if there's an issue starting the server.
 func (a *Agent) StartServer(opts ServerOptions) error {
-	if disableSSH, _ := utils.GetEnv("DISABLE_SSH"); disableSSH == "true" {
+	if disableSSH, _ := GetEnv("DISABLE_SSH"); disableSSH == "true" {
 		return errors.New("SSH disabled")
 	}
 	if a.server != nil {
@@ -193,7 +192,7 @@ func (a *Agent) handleSSHRequest(w io.Writer, req *common.HubRequest[cbor.RawMes
 
 // handleLegacyStats serves the legacy one-shot stats payload for older hubs
 func (a *Agent) handleLegacyStats(w io.Writer, hubVersion semver.Version) error {
-	stats := a.gatherStats(common.DataRequestOptions{CacheTimeMs: defaultDataCacheTimeMs})
+	stats := a.gatherStats(common.DataRequestOptions{CacheTimeMs: 60_000})
 	return a.writeToSession(w, stats, hubVersion)
 }
 
@@ -239,11 +238,11 @@ func ParseKeys(input string) ([]gossh.PublicKey, error) {
 // and finally defaults to ":45876".
 func GetAddress(addr string) string {
 	if addr == "" {
-		addr, _ = utils.GetEnv("LISTEN")
+		addr, _ = GetEnv("LISTEN")
 	}
 	if addr == "" {
 		// Legacy PORT environment variable support
-		addr, _ = utils.GetEnv("PORT")
+		addr, _ = GetEnv("PORT")
 	}
 	if addr == "" {
 		return ":45876"
@@ -259,7 +258,7 @@ func GetAddress(addr string) string {
 // It checks the NETWORK environment variable first, then infers from
 // the address format: addresses starting with "/" are "unix", others are "tcp".
 func GetNetwork(addr string) string {
-	if network, ok := utils.GetEnv("NETWORK"); ok && network != "" {
+	if network, ok := GetEnv("NETWORK"); ok && network != "" {
 		return network
 	}
 	if strings.HasPrefix(addr, "/") {

agent/server_test.go

@@ -183,7 +183,8 @@ func TestStartServer(t *testing.T) {
 }
 
 func TestStartServerDisableSSH(t *testing.T) {
-	t.Setenv("BESZEL_AGENT_DISABLE_SSH", "true")
+	os.Setenv("BESZEL_AGENT_DISABLE_SSH", "true")
+	defer os.Unsetenv("BESZEL_AGENT_DISABLE_SSH")
 
 	agent, err := NewAgent("")
 	require.NoError(t, err)
@@ -558,6 +559,10 @@ func TestWriteToSessionEncoding(t *testing.T) {
 
 // Helper function to create test data for encoding tests
 func createTestCombinedData() *system.CombinedData {
+	var stats = container.Stats{}
+	stats.Name = "test-container"
+	stats.Cpu = 10.5
+	stats.Mem = 1073741824 // 1GB
 	return &system.CombinedData{
 		Stats: system.Stats{
 			Cpu:       25.5,
@@ -576,11 +581,7 @@ func createTestCombinedData() *system.CombinedData {
 			AgentVersion: "0.12.0",
 		},
 		Containers: []*container.Stats{
-			{
-				Name: "test-container",
-				Cpu:  10.5,
-				Mem:  1073741824, // 1GB
-			},
+			&stats,
 		},
 	}
 }

agent/smart.go

@@ -18,7 +18,6 @@ import (
 	"sync"
 	"time"
 
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/smart"
 )
 
@@ -31,9 +30,6 @@ type SmartManager struct {
 	lastScanTime    time.Time
 	smartctlPath    string
 	excludedDevices map[string]struct{}
-	darwinNvmeOnce     sync.Once
-	darwinNvmeCapacity map[string]uint64      // serial → bytes cache, written once via darwinNvmeOnce
-	darwinNvmeProvider func() ([]byte, error) // overridable for testing
 }
 
 type scanOutput struct {
@@ -160,7 +156,7 @@ func (sm *SmartManager) ScanDevices(force bool) error {
 	currentDevices := sm.devicesSnapshot()
 
 	var configuredDevices []*DeviceInfo
-	if configuredRaw, ok := utils.GetEnv("SMART_DEVICES"); ok {
+	if configuredRaw, ok := GetEnv("SMART_DEVICES"); ok {
 		slog.Info("SMART_DEVICES", "value", configuredRaw)
 		config := strings.TrimSpace(configuredRaw)
 		if config == "" {
@@ -226,7 +222,7 @@ func (sm *SmartManager) ScanDevices(force bool) error {
 }
 
 func (sm *SmartManager) parseConfiguredDevices(config string) ([]*DeviceInfo, error) {
-	splitChar, _ := utils.GetEnv("SMART_DEVICES_SEPARATOR")
+	splitChar := os.Getenv("SMART_DEVICES_SEPARATOR")
 	if splitChar == "" {
 		splitChar = ","
 	}
@@ -264,7 +260,7 @@ func (sm *SmartManager) parseConfiguredDevices(config string) ([]*DeviceInfo, er
 }
 
 func (sm *SmartManager) refreshExcludedDevices() {
-	rawValue, _ := utils.GetEnv("EXCLUDE_SMART")
+	rawValue, _ := GetEnv("EXCLUDE_SMART")
 	sm.excludedDevices = make(map[string]struct{})
 
 	for entry := range strings.SplitSeq(rawValue, ",") {
@@ -874,18 +870,15 @@ func (sm *SmartManager) parseSmartForSata(output []byte) (bool, int) {
 	smartData.FirmwareVersion = data.FirmwareVersion
 	smartData.Capacity = data.UserCapacity.Bytes
 	smartData.Temperature = data.Temperature.Current
+	if smartData.Temperature == 0 {
+		if temp, ok := temperatureFromAtaDeviceStatistics(data.AtaDeviceStatistics); ok {
+			smartData.Temperature = temp
+		}
+	}
 	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
 	smartData.DiskName = data.Device.Name
 	smartData.DiskType = data.Device.Type
 
-	// get values from ata_device_statistics if necessary
-	var ataDeviceStats smart.AtaDeviceStatistics
-	if smartData.Temperature == 0 {
-		if temp := findAtaDeviceStatisticsValue(&data, &ataDeviceStats, 5, "Current Temperature", 0, 255); temp != nil {
-			smartData.Temperature = uint8(*temp)
-		}
-	}
-
 	// update SmartAttributes
 	smartData.Attributes = make([]*smart.SmartAttribute, 0, len(data.AtaSmartAttributes.Table))
 	for _, attr := range data.AtaSmartAttributes.Table {
@@ -920,20 +913,23 @@ func getSmartStatus(temperature uint8, passed bool) string {
 	}
 }
 
+func temperatureFromAtaDeviceStatistics(stats smart.AtaDeviceStatistics) (uint8, bool) {
+	entry := findAtaDeviceStatisticsEntry(stats, 5, "Current Temperature")
+	if entry == nil || entry.Value == nil {
+		return 0, false
+	}
+	if *entry.Value > 255 {
+		return 0, false
+	}
+	return uint8(*entry.Value), true
+}
+
 // findAtaDeviceStatisticsEntry centralizes ATA devstat lookups so additional
 // metrics can be pulled from the same structure in the future.
-func findAtaDeviceStatisticsValue(data *smart.SmartInfoForSata, ataDeviceStats *smart.AtaDeviceStatistics, entryNumber uint8, entryName string, minValue, maxValue int64) *int64 {
-	if len(ataDeviceStats.Pages) == 0 {
-		if len(data.AtaDeviceStatistics) == 0 {
-			return nil
-		}
-		if err := json.Unmarshal(data.AtaDeviceStatistics, ataDeviceStats); err != nil {
-			return nil
-		}
-	}
-	for pageIdx := range ataDeviceStats.Pages {
-		page := &ataDeviceStats.Pages[pageIdx]
-		if page.Number != entryNumber {
+func findAtaDeviceStatisticsEntry(stats smart.AtaDeviceStatistics, pageNumber uint8, entryName string) *smart.AtaDeviceStatisticsEntry {
+	for pageIdx := range stats.Pages {
+		page := &stats.Pages[pageIdx]
+		if page.Number != pageNumber {
 			continue
 		}
 		for entryIdx := range page.Table {
@@ -941,10 +937,7 @@ func findAtaDeviceStatisticsValue(data *smart.SmartInfoForSata, ataDeviceStats *
 			if !strings.EqualFold(entry.Name, entryName) {
 				continue
 			}
-			if entry.Value == nil || *entry.Value < minValue || *entry.Value > maxValue {
-				return nil
-			}
-			return entry.Value
+			return entry
 		}
 	}
 	return nil
@@ -1036,52 +1029,6 @@ func parseScsiGigabytesProcessed(value string) int64 {
 	return parsed
 }
 
-// lookupDarwinNvmeCapacity returns the capacity in bytes for a given NVMe serial number on Darwin.
-// It uses system_profiler SPNVMeDataType to get capacity since Apple SSDs don't report user_capacity
-// via smartctl. Results are cached after the first call via sync.Once.
-func (sm *SmartManager) lookupDarwinNvmeCapacity(serial string) uint64 {
-	sm.darwinNvmeOnce.Do(func() {
-		sm.darwinNvmeCapacity = make(map[string]uint64)
-
-		provider := sm.darwinNvmeProvider
-		if provider == nil {
-			provider = func() ([]byte, error) {
-				ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-				defer cancel()
-				return exec.CommandContext(ctx, "system_profiler", "SPNVMeDataType", "-json").Output()
-			}
-		}
-
-		out, err := provider()
-		if err != nil {
-			slog.Debug("system_profiler NVMe lookup failed", "err", err)
-			return
-		}
-
-		var result struct {
-			SPNVMeDataType []struct {
-				Items []struct {
-					DeviceSerial string `json:"device_serial"`
-					SizeInBytes  uint64 `json:"size_in_bytes"`
-				} `json:"_items"`
-			} `json:"SPNVMeDataType"`
-		}
-		if err := json.Unmarshal(out, &result); err != nil {
-			slog.Debug("system_profiler NVMe parse failed", "err", err)
-			return
-		}
-
-		for _, controller := range result.SPNVMeDataType {
-			for _, item := range controller.Items {
-				if item.DeviceSerial != "" && item.SizeInBytes > 0 {
-					sm.darwinNvmeCapacity[item.DeviceSerial] = item.SizeInBytes
-				}
-			}
-		}
-	})
-	return sm.darwinNvmeCapacity[serial]
-}
-
 // parseSmartForNvme parses the output of smartctl --all -j /dev/nvmeX and updates the SmartDataMap
 // Returns hasValidData and exitStatus
 func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
@@ -1118,12 +1065,6 @@ func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
 	smartData.SerialNumber = data.SerialNumber
 	smartData.FirmwareVersion = data.FirmwareVersion
 	smartData.Capacity = data.UserCapacity.Bytes
-	if smartData.Capacity == 0 {
-		smartData.Capacity = data.NVMeTotalCapacity
-	}
-	if smartData.Capacity == 0 && (runtime.GOOS == "darwin" || sm.darwinNvmeProvider != nil) {
-		smartData.Capacity = sm.lookupDarwinNvmeCapacity(data.SerialNumber)
-	}
 	smartData.Temperature = data.NVMeSmartHealthInformationLog.Temperature
 	smartData.SmartStatus = getSmartStatus(smartData.Temperature, data.SmartStatus.Passed)
 	smartData.DiskName = data.Device.Name
@@ -1159,21 +1100,32 @@ func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
 
 // detectSmartctl checks if smartctl is installed, returns an error if not
 func (sm *SmartManager) detectSmartctl() (string, error) {
-	if runtime.GOOS == "windows" {
+	isWindows := runtime.GOOS == "windows"
+
 	// Load embedded smartctl.exe for Windows amd64 builds.
-		if runtime.GOARCH == "amd64" {
+	if isWindows && runtime.GOARCH == "amd64" {
 		if path, err := ensureEmbeddedSmartctl(); err == nil {
 			return path, nil
 		}
 	}
-		// Try to find smartctl in the default installation location
-		const location = "C:\\Program Files\\smartmontools\\bin\\smartctl.exe"
+
+	if path, err := exec.LookPath("smartctl"); err == nil {
+		return path, nil
+	}
+	locations := []string{}
+	if isWindows {
+		locations = append(locations,
+			"C:\\Program Files\\smartmontools\\bin\\smartctl.exe",
+		)
+	} else {
+		locations = append(locations, "/opt/homebrew/bin/smartctl")
+	}
+	for _, location := range locations {
 		if _, err := os.Stat(location); err == nil {
 			return location, nil
 		}
 	}
-
-	return utils.LookPathHomebrew("smartctl")
+	return "", errors.New("smartctl not found")
 }
 
 // isNvmeControllerPath checks if the path matches an NVMe controller pattern

agent/smart_test.go

@@ -121,78 +121,6 @@ func TestParseSmartForSataDeviceStatisticsTemperature(t *testing.T) {
 	assert.Equal(t, uint8(22), deviceData.Temperature)
 }
 
-func TestParseSmartForSataAtaDeviceStatistics(t *testing.T) {
-	// tests that ata_device_statistics values are parsed correctly
-	jsonPayload := []byte(`{
-		"smartctl": {"exit_status": 0},
-		"device": {"name": "/dev/sdb", "type": "sat"},
-		"model_name": "SanDisk SSD U110 16GB",
-		"serial_number": "lksjfh23lhj",
-		"firmware_version": "U21B001",
-		"user_capacity": {"bytes": 16013942784},
-		"smart_status": {"passed": true},
-		"ata_smart_attributes": {"table": []},
-		"ata_device_statistics": {
-			"pages": [
-				{
-					"number": 5,
-					"name": "Temperature Statistics",
-					"table": [
-						{"name": "Current Temperature", "value": 43, "flags": {"valid": true}},
-						{"name": "Specified Minimum Operating Temperature", "value": -20, "flags": {"valid": true}}
-					]
-				}
-			]
-		}
-	}`)
-
-	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
-	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
-	require.True(t, hasData)
-	assert.Equal(t, 0, exitStatus)
-
-	deviceData, ok := sm.SmartDataMap["lksjfh23lhj"]
-	require.True(t, ok, "expected smart data entry for serial lksjfh23lhj")
-	assert.Equal(t, uint8(43), deviceData.Temperature)
-}
-
-func TestParseSmartForSataNegativeDeviceStatistics(t *testing.T) {
-	// Tests that negative values in ata_device_statistics (e.g. min operating temp)
-	// do not cause the entire SAT parser to fail.
-	jsonPayload := []byte(`{
-		"smartctl": {"exit_status": 0},
-		"device": {"name": "/dev/sdb", "type": "sat"},
-		"model_name": "SanDisk SSD U110 16GB",
-		"serial_number": "NEGATIVE123",
-		"firmware_version": "U21B001",
-		"user_capacity": {"bytes": 16013942784},
-		"smart_status": {"passed": true},
-		"temperature": {"current": 38},
-		"ata_smart_attributes": {"table": []},
-		"ata_device_statistics": {
-			"pages": [
-				{
-					"number": 5,
-					"name": "Temperature Statistics",
-					"table": [
-						{"name": "Current Temperature", "value": 38, "flags": {"valid": true}},
-						{"name": "Specified Minimum Operating Temperature", "value": -20, "flags": {"valid": true}}
-					]
-				}
-			]
-		}
-	}`)
-
-	sm := &SmartManager{SmartDataMap: make(map[string]*smart.SmartData)}
-	hasData, exitStatus := sm.parseSmartForSata(jsonPayload)
-	require.True(t, hasData)
-	assert.Equal(t, 0, exitStatus)
-
-	deviceData, ok := sm.SmartDataMap["NEGATIVE123"]
-	require.True(t, ok, "expected smart data entry for serial NEGATIVE123")
-	assert.Equal(t, uint8(38), deviceData.Temperature)
-}
-
 func TestParseSmartForSataParentheticalRawValue(t *testing.T) {
 	jsonPayload := []byte(`{
 		"smartctl": {"exit_status": 0},
@@ -799,182 +727,6 @@ func TestIsVirtualDeviceScsi(t *testing.T) {
 	}
 }
 
-func TestFindAtaDeviceStatisticsValue(t *testing.T) {
-	val42 := int64(42)
-	val100 := int64(100)
-	valMinus20 := int64(-20)
-
-	tests := []struct {
-		name           string
-		data           smart.SmartInfoForSata
-		ataDeviceStats smart.AtaDeviceStatistics
-		entryNumber    uint8
-		entryName      string
-		minValue       int64
-		maxValue       int64
-		expectedValue  *int64
-	}{
-		{
-			name: "value in ataDeviceStats",
-			ataDeviceStats: smart.AtaDeviceStatistics{
-				Pages: []smart.AtaDeviceStatisticsPage{
-					{
-						Number: 5,
-						Table: []smart.AtaDeviceStatisticsEntry{
-							{Name: "Current Temperature", Value: &val42},
-						},
-					},
-				},
-			},
-			entryNumber:   5,
-			entryName:     "Current Temperature",
-			minValue:      0,
-			maxValue:      100,
-			expectedValue: &val42,
-		},
-		{
-			name: "value unmarshaled from data",
-			data: smart.SmartInfoForSata{
-				AtaDeviceStatistics: []byte(`{"pages":[{"number":5,"table":[{"name":"Current Temperature","value":100}]}]}`),
-			},
-			entryNumber:   5,
-			entryName:     "Current Temperature",
-			minValue:      0,
-			maxValue:      255,
-			expectedValue: &val100,
-		},
-		{
-			name: "value out of range (too high)",
-			ataDeviceStats: smart.AtaDeviceStatistics{
-				Pages: []smart.AtaDeviceStatisticsPage{
-					{
-						Number: 5,
-						Table: []smart.AtaDeviceStatisticsEntry{
-							{Name: "Current Temperature", Value: &val100},
-						},
-					},
-				},
-			},
-			entryNumber:   5,
-			entryName:     "Current Temperature",
-			minValue:      0,
-			maxValue:      50,
-			expectedValue: nil,
-		},
-		{
-			name: "value out of range (too low)",
-			ataDeviceStats: smart.AtaDeviceStatistics{
-				Pages: []smart.AtaDeviceStatisticsPage{
-					{
-						Number: 5,
-						Table: []smart.AtaDeviceStatisticsEntry{
-							{Name: "Min Temp", Value: &valMinus20},
-						},
-					},
-				},
-			},
-			entryNumber:   5,
-			entryName:     "Min Temp",
-			minValue:      0,
-			maxValue:      100,
-			expectedValue: nil,
-		},
-		{
-			name:          "no statistics available",
-			data:          smart.SmartInfoForSata{},
-			entryNumber:   5,
-			entryName:     "Current Temperature",
-			minValue:      0,
-			maxValue:      255,
-			expectedValue: nil,
-		},
-		{
-			name: "wrong page number",
-			ataDeviceStats: smart.AtaDeviceStatistics{
-				Pages: []smart.AtaDeviceStatisticsPage{
-					{
-						Number: 1,
-						Table: []smart.AtaDeviceStatisticsEntry{
-							{Name: "Current Temperature", Value: &val42},
-						},
-					},
-				},
-			},
-			entryNumber:   5,
-			entryName:     "Current Temperature",
-			minValue:      0,
-			maxValue:      100,
-			expectedValue: nil,
-		},
-		{
-			name: "wrong entry name",
-			ataDeviceStats: smart.AtaDeviceStatistics{
-				Pages: []smart.AtaDeviceStatisticsPage{
-					{
-						Number: 5,
-						Table: []smart.AtaDeviceStatisticsEntry{
-							{Name: "Other Stat", Value: &val42},
-						},
-					},
-				},
-			},
-			entryNumber:   5,
-			entryName:     "Current Temperature",
-			minValue:      0,
-			maxValue:      100,
-			expectedValue: nil,
-		},
-		{
-			name: "case insensitive name match",
-			ataDeviceStats: smart.AtaDeviceStatistics{
-				Pages: []smart.AtaDeviceStatisticsPage{
-					{
-						Number: 5,
-						Table: []smart.AtaDeviceStatisticsEntry{
-							{Name: "CURRENT TEMPERATURE", Value: &val42},
-						},
-					},
-				},
-			},
-			entryNumber:   5,
-			entryName:     "Current Temperature",
-			minValue:      0,
-			maxValue:      100,
-			expectedValue: &val42,
-		},
-		{
-			name: "entry value is nil",
-			ataDeviceStats: smart.AtaDeviceStatistics{
-				Pages: []smart.AtaDeviceStatisticsPage{
-					{
-						Number: 5,
-						Table: []smart.AtaDeviceStatisticsEntry{
-							{Name: "Current Temperature", Value: nil},
-						},
-					},
-				},
-			},
-			entryNumber:   5,
-			entryName:     "Current Temperature",
-			minValue:      0,
-			maxValue:      100,
-			expectedValue: nil,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := findAtaDeviceStatisticsValue(&tt.data, &tt.ataDeviceStats, tt.entryNumber, tt.entryName, tt.minValue, tt.maxValue)
-			if tt.expectedValue == nil {
-				assert.Nil(t, result)
-			} else {
-				require.NotNil(t, result)
-				assert.Equal(t, *tt.expectedValue, *result)
-			}
-		})
-	}
-}
-
 func TestRefreshExcludedDevices(t *testing.T) {
 	tests := []struct {
 		name         string
@@ -1035,7 +787,7 @@ func TestRefreshExcludedDevices(t *testing.T) {
 				t.Setenv("EXCLUDE_SMART", tt.envValue)
 			} else {
 				// Ensure env var is not set for empty test
-				t.Setenv("EXCLUDE_SMART", "")
+				os.Unsetenv("EXCLUDE_SMART")
 			}
 
 			sm := &SmartManager{}
@@ -1199,81 +951,3 @@ func TestIsNvmeControllerPath(t *testing.T) {
 		})
 	}
 }
-
-func TestParseSmartForNvmeAppleSSD(t *testing.T) {
-	// Apple SSDs don't report user_capacity via smartctl; capacity should be fetched
-	// from system_profiler via the darwinNvmeProvider fallback.
-	fixturePath := filepath.Join("test-data", "smart", "apple_nvme.json")
-	data, err := os.ReadFile(fixturePath)
-	require.NoError(t, err)
-
-	providerCalls := 0
-	fakeProvider := func() ([]byte, error) {
-		providerCalls++
-		return []byte(`{
-			"SPNVMeDataType": [{
-				"_items": [{
-					"device_serial": "0ba0147940253c15",
-					"size_in_bytes": 251000193024
-				}]
-			}]
-		}`), nil
-	}
-
-	sm := &SmartManager{
-		SmartDataMap:       make(map[string]*smart.SmartData),
-		darwinNvmeProvider: fakeProvider,
-	}
-
-	hasData, _ := sm.parseSmartForNvme(data)
-	require.True(t, hasData)
-
-	deviceData, ok := sm.SmartDataMap["0ba0147940253c15"]
-	require.True(t, ok)
-	assert.Equal(t, "APPLE SSD AP0256Q", deviceData.ModelName)
-	assert.Equal(t, uint64(251000193024), deviceData.Capacity)
-	assert.Equal(t, uint8(42), deviceData.Temperature)
-	assert.Equal(t, "PASSED", deviceData.SmartStatus)
-	assert.Equal(t, 1, providerCalls, "system_profiler should be called once")
-
-	// Second parse: provider should NOT be called again (cache hit)
-	_, _ = sm.parseSmartForNvme(data)
-	assert.Equal(t, 1, providerCalls, "system_profiler should not be called again after caching")
-}
-
-func TestLookupDarwinNvmeCapacityMultipleDisks(t *testing.T) {
-	fakeProvider := func() ([]byte, error) {
-		return []byte(`{
-			"SPNVMeDataType": [
-				{
-					"_items": [
-						{"device_serial": "serial-disk0", "size_in_bytes": 251000193024},
-						{"device_serial": "serial-disk1", "size_in_bytes": 1000204886016}
-					]
-				},
-				{
-					"_items": [
-						{"device_serial": "serial-disk2", "size_in_bytes": 512110190592}
-					]
-				}
-			]
-		}`), nil
-	}
-
-	sm := &SmartManager{darwinNvmeProvider: fakeProvider}
-	assert.Equal(t, uint64(251000193024), sm.lookupDarwinNvmeCapacity("serial-disk0"))
-	assert.Equal(t, uint64(1000204886016), sm.lookupDarwinNvmeCapacity("serial-disk1"))
-	assert.Equal(t, uint64(512110190592), sm.lookupDarwinNvmeCapacity("serial-disk2"))
-	assert.Equal(t, uint64(0), sm.lookupDarwinNvmeCapacity("unknown-serial"))
-}
-
-func TestLookupDarwinNvmeCapacityProviderError(t *testing.T) {
-	fakeProvider := func() ([]byte, error) {
-		return nil, errors.New("system_profiler not found")
-	}
-
-	sm := &SmartManager{darwinNvmeProvider: fakeProvider}
-	assert.Equal(t, uint64(0), sm.lookupDarwinNvmeCapacity("any-serial"))
-	// Cache should be initialized even on error so we don't retry (Once already fired)
-	assert.NotNil(t, sm.darwinNvmeCapacity)
-}

agent/system.go

@@ -8,10 +8,10 @@ import (
 	"os"
 	"runtime"
 	"strings"
+	"time"
 
 	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/agent/battery"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/agent/zfs"
 	"github.com/henrygd/beszel/internal/entities/container"
 	"github.com/henrygd/beszel/internal/entities/system"
@@ -22,6 +22,13 @@ import (
 	"github.com/shirou/gopsutil/v4/mem"
 )
 
+// prevDisk stores previous per-device disk counters for a given cache interval
+type prevDisk struct {
+	readBytes  uint64
+	writeBytes uint64
+	at         time.Time
+}
+
 // Sets initial / non-changing values about the host system
 func (a *Agent) refreshSystemDetails() {
 	a.systemInfo.AgentVersion = beszel.Version
@@ -107,26 +114,6 @@ func (a *Agent) refreshSystemDetails() {
 	}
 }
 
-// attachSystemDetails returns details only for fresh default-interval responses.
-func (a *Agent) attachSystemDetails(data *system.CombinedData, cacheTimeMs uint16, includeRequested bool) *system.CombinedData {
-	if cacheTimeMs != defaultDataCacheTimeMs || (!includeRequested && !a.detailsDirty) {
-		return data
-	}
-
-	// copy data to avoid adding details to the original cached struct
-	response := *data
-	response.Details = &a.systemDetails
-	a.detailsDirty = false
-	return &response
-}
-
-// updateSystemDetails applies a mutation to the static details payload and marks
-// it for inclusion on the next fresh default-interval response.
-func (a *Agent) updateSystemDetails(updateFunc func(details *system.Details)) {
-	updateFunc(&a.systemDetails)
-	a.detailsDirty = true
-}
-
 // Returns current info, stats about the host system
 func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	var systemStats system.Stats
@@ -140,13 +127,13 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	// cpu metrics
 	cpuMetrics, err := getCpuMetrics(cacheTimeMs)
 	if err == nil {
-		systemStats.Cpu = utils.TwoDecimals(cpuMetrics.Total)
+		systemStats.Cpu = twoDecimals(cpuMetrics.Total)
 		systemStats.CpuBreakdown = []float64{
-			utils.TwoDecimals(cpuMetrics.User),
-			utils.TwoDecimals(cpuMetrics.System),
-			utils.TwoDecimals(cpuMetrics.Iowait),
-			utils.TwoDecimals(cpuMetrics.Steal),
-			utils.TwoDecimals(cpuMetrics.Idle),
+			twoDecimals(cpuMetrics.User),
+			twoDecimals(cpuMetrics.System),
+			twoDecimals(cpuMetrics.Iowait),
+			twoDecimals(cpuMetrics.Steal),
+			twoDecimals(cpuMetrics.Idle),
 		}
 	} else {
 		slog.Error("Error getting cpu metrics", "err", err)
@@ -170,8 +157,8 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 	// memory
 	if v, err := mem.VirtualMemory(); err == nil {
 		// swap
-		systemStats.Swap = utils.BytesToGigabytes(v.SwapTotal)
-		systemStats.SwapUsed = utils.BytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
+		systemStats.Swap = bytesToGigabytes(v.SwapTotal)
+		systemStats.SwapUsed = bytesToGigabytes(v.SwapTotal - v.SwapFree - v.SwapCached)
 		// cache + buffers value for default mem calculation
 		// note: gopsutil automatically adds SReclaimable to v.Cached
 		cacheBuff := v.Cached + v.Buffers - v.Shared
@@ -194,13 +181,13 @@ func (a *Agent) getSystemStats(cacheTimeMs uint16) system.Stats {
 			if arcSize, _ := zfs.ARCSize(); arcSize > 0 && arcSize < v.Used {
 				v.Used = v.Used - arcSize
 				v.UsedPercent = float64(v.Used) / float64(v.Total) * 100.0
-				systemStats.MemZfsArc = utils.BytesToGigabytes(arcSize)
+				systemStats.MemZfsArc = bytesToGigabytes(arcSize)
 			}
 		}
-		systemStats.Mem = utils.BytesToGigabytes(v.Total)
-		systemStats.MemBuffCache = utils.BytesToGigabytes(cacheBuff)
-		systemStats.MemUsed = utils.BytesToGigabytes(v.Used)
-		systemStats.MemPct = utils.TwoDecimals(v.UsedPercent)
+		systemStats.Mem = bytesToGigabytes(v.Total)
+		systemStats.MemBuffCache = bytesToGigabytes(cacheBuff)
+		systemStats.MemUsed = bytesToGigabytes(v.Used)
+		systemStats.MemPct = twoDecimals(v.UsedPercent)
 	}
 
 	// disk usage

agent/system_test.go

@@ -1,61 +0,0 @@
-package agent
-
-import (
-	"testing"
-
-	"github.com/henrygd/beszel/internal/common"
-	"github.com/henrygd/beszel/internal/entities/system"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestGatherStatsDoesNotAttachDetailsToCachedRequests(t *testing.T) {
-	agent := &Agent{
-		cache:         NewSystemDataCache(),
-		systemDetails: system.Details{Hostname: "updated-host", Podman: true},
-		detailsDirty:  true,
-	}
-	cached := &system.CombinedData{
-		Info: system.Info{Hostname: "cached-host"},
-	}
-	agent.cache.Set(cached, defaultDataCacheTimeMs)
-
-	response := agent.gatherStats(common.DataRequestOptions{CacheTimeMs: defaultDataCacheTimeMs})
-
-	assert.Same(t, cached, response)
-	assert.Nil(t, response.Details)
-	assert.True(t, agent.detailsDirty)
-	assert.Equal(t, "cached-host", response.Info.Hostname)
-	assert.Nil(t, cached.Details)
-
-	secondResponse := agent.gatherStats(common.DataRequestOptions{CacheTimeMs: defaultDataCacheTimeMs})
-	assert.Same(t, cached, secondResponse)
-	assert.Nil(t, secondResponse.Details)
-}
-
-func TestUpdateSystemDetailsMarksDetailsDirty(t *testing.T) {
-	agent := &Agent{}
-
-	agent.updateSystemDetails(func(details *system.Details) {
-		details.Hostname = "updated-host"
-		details.Podman = true
-	})
-
-	assert.True(t, agent.detailsDirty)
-	assert.Equal(t, "updated-host", agent.systemDetails.Hostname)
-	assert.True(t, agent.systemDetails.Podman)
-
-	original := &system.CombinedData{}
-	realTimeResponse := agent.attachSystemDetails(original, 1000, true)
-	assert.Same(t, original, realTimeResponse)
-	assert.Nil(t, realTimeResponse.Details)
-	assert.True(t, agent.detailsDirty)
-
-	response := agent.attachSystemDetails(original, defaultDataCacheTimeMs, false)
-	require.NotNil(t, response.Details)
-	assert.NotSame(t, original, response)
-	assert.Equal(t, "updated-host", response.Details.Hostname)
-	assert.True(t, response.Details.Podman)
-	assert.False(t, agent.detailsDirty)
-	assert.Nil(t, original.Details)
-}

agent/systemd.go

@@ -15,7 +15,6 @@ import (
 	"time"
 
 	"github.com/coreos/go-systemd/v22/dbus"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/systemd"
 )
 
@@ -50,7 +49,7 @@ func isSystemdAvailable() bool {
 
 // newSystemdManager creates a new systemdManager.
 func newSystemdManager() (*systemdManager, error) {
-	if skipSystemd, _ := utils.GetEnv("SKIP_SYSTEMD"); skipSystemd == "true" {
+	if skipSystemd, _ := GetEnv("SKIP_SYSTEMD"); skipSystemd == "true" {
 		return nil, nil
 	}
 
@@ -295,13 +294,13 @@ func unescapeServiceName(name string) string {
 // otherwise defaults to "*service".
 func getServicePatterns() []string {
 	patterns := []string{}
-	if envPatterns, _ := utils.GetEnv("SERVICE_PATTERNS"); envPatterns != "" {
+	if envPatterns, _ := GetEnv("SERVICE_PATTERNS"); envPatterns != "" {
 		for pattern := range strings.SplitSeq(envPatterns, ",") {
 			pattern = strings.TrimSpace(pattern)
 			if pattern == "" {
 				continue
 			}
-			if !strings.HasSuffix(pattern, "timer") && !strings.HasSuffix(pattern, ".service") {
+			if !strings.HasSuffix(pattern, ".service") {
 				pattern += ".service"
 			}
 			patterns = append(patterns, pattern)

agent/systemd_test.go

@@ -156,23 +156,20 @@ func TestGetServicePatterns(t *testing.T) {
 			expected:       []string{"*nginx*.service", "*apache*.service"},
 			cleanupEnvVars: true,
 		},
-		{
-			name:           "opt into timer monitoring",
-			prefixedEnv:    "nginx.service,docker,apache.timer",
-			unprefixedEnv:  "",
-			expected:       []string{"nginx.service", "docker.service", "apache.timer"},
-			cleanupEnvVars: true,
-		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
+			// Clean up any existing env vars
+			os.Unsetenv("BESZEL_AGENT_SERVICE_PATTERNS")
+			os.Unsetenv("SERVICE_PATTERNS")
+
 			// Set up environment variables
 			if tt.prefixedEnv != "" {
-				t.Setenv("BESZEL_AGENT_SERVICE_PATTERNS", tt.prefixedEnv)
+				os.Setenv("BESZEL_AGENT_SERVICE_PATTERNS", tt.prefixedEnv)
 			}
 			if tt.unprefixedEnv != "" {
-				t.Setenv("SERVICE_PATTERNS", tt.unprefixedEnv)
+				os.Setenv("SERVICE_PATTERNS", tt.unprefixedEnv)
 			}
 
 			// Run the function
@@ -180,6 +177,12 @@ func TestGetServicePatterns(t *testing.T) {
 
 			// Verify results
 			assert.Equal(t, tt.expected, result, "Patterns should match expected values")
+
+			// Cleanup
+			if tt.cleanupEnvVars {
+				os.Unsetenv("BESZEL_AGENT_SERVICE_PATTERNS")
+				os.Unsetenv("SERVICE_PATTERNS")
+			}
 		})
 	}
 }

agent/test-data/smart/apple_nvme.json

@@ -1,51 +0,0 @@
-{
-  "json_format_version": [1, 0],
-  "smartctl": {
-    "version": [7, 4],
-    "argv": ["smartctl", "-aix", "-j", "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1"],
-    "exit_status": 4
-  },
-  "device": {
-    "name": "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1",
-    "info_name": "IOService:/AppleARMPE/arm-io@10F00000/AppleT810xIO/ans@77400000/AppleASCWrapV4/iop-ans-nub/RTBuddy(ANS2)/RTBuddyService/AppleANS3NVMeController/NS_01@1",
-    "type": "nvme",
-    "protocol": "NVMe"
-  },
-  "model_name": "APPLE SSD AP0256Q",
-  "serial_number": "0ba0147940253c15",
-  "firmware_version": "555",
-  "smart_support": {
-    "available": true,
-    "enabled": true
-  },
-  "smart_status": {
-    "passed": true,
-    "nvme": {
-      "value": 0
-    }
-  },
-  "nvme_smart_health_information_log": {
-    "critical_warning": 0,
-    "temperature": 42,
-    "available_spare": 100,
-    "available_spare_threshold": 99,
-    "percentage_used": 1,
-    "data_units_read": 270189386,
-    "data_units_written": 166753862,
-    "host_reads": 7543766995,
-    "host_writes": 3761621926,
-    "controller_busy_time": 0,
-    "power_cycles": 366,
-    "power_on_hours": 2850,
-    "unsafe_shutdowns": 195,
-    "media_errors": 0,
-    "num_err_log_entries": 0
-  },
-  "temperature": {
-    "current": 42
-  },
-  "power_cycle_count": 366,
-  "power_on_time": {
-    "hours": 2850
-  }
-}

agent/utils.go

@@ -0,0 +1,15 @@
+package agent
+
+import "math"
+
+func bytesToMegabytes(b float64) float64 {
+	return twoDecimals(b / 1048576)
+}
+
+func bytesToGigabytes(b uint64) float64 {
+	return twoDecimals(float64(b) / 1073741824)
+}
+
+func twoDecimals(value float64) float64 {
+	return math.Round(value*100) / 100
+}

agent/utils/utils.go

@@ -1,117 +0,0 @@
-// Package utils provides utility functions for the agent.
-package utils
-
-import (
-	"fmt"
-	"io"
-	"math"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-)
-
-// GetEnv retrieves an environment variable with a "BESZEL_AGENT_" prefix, or falls back to the unprefixed key.
-func GetEnv(key string) (value string, exists bool) {
-	if value, exists = os.LookupEnv("BESZEL_AGENT_" + key); exists {
-		return value, exists
-	}
-	return os.LookupEnv(key)
-}
-
-// BytesToMegabytes converts bytes to megabytes and rounds to two decimal places.
-func BytesToMegabytes(b float64) float64 {
-	return TwoDecimals(b / 1048576)
-}
-
-// BytesToGigabytes converts bytes to gigabytes and rounds to two decimal places.
-func BytesToGigabytes(b uint64) float64 {
-	return TwoDecimals(float64(b) / 1073741824)
-}
-
-// TwoDecimals rounds a float64 value to two decimal places.
-func TwoDecimals(value float64) float64 {
-	return math.Round(value*100) / 100
-}
-
-// func RoundFloat(val float64, precision uint) float64 {
-//     ratio := math.Pow(10, float64(precision))
-//     return math.Round(val*ratio) / ratio
-// }
-
-// ReadStringFile returns trimmed file contents or empty string on error.
-func ReadStringFile(path string) string {
-	content, _ := ReadStringFileOK(path)
-	return content
-}
-
-// ReadStringFileOK returns trimmed file contents and read success.
-func ReadStringFileOK(path string) (string, bool) {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return "", false
-	}
-	return strings.TrimSpace(string(b)), true
-}
-
-// ReadStringFileLimited reads a file into a string with a maximum size (in bytes) to avoid
-// allocating large buffers and potential panics with pseudo-files when the size is misreported.
-func ReadStringFileLimited(path string, maxSize int) (string, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return "", err
-	}
-	defer f.Close()
-
-	buf := make([]byte, maxSize)
-	n, err := f.Read(buf)
-	if err != nil && err != io.EOF {
-		return "", err
-	}
-	if n < 0 {
-		return "", fmt.Errorf("%s returned negative bytes: %d", path, n)
-	}
-	return strings.TrimSpace(string(buf[:n])), nil
-}
-
-// FileExists reports whether the given path exists.
-func FileExists(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}
-
-// ReadUintFile parses a decimal uint64 value from a file.
-func ReadUintFile(path string) (uint64, bool) {
-	raw, ok := ReadStringFileOK(path)
-	if !ok {
-		return 0, false
-	}
-	parsed, err := strconv.ParseUint(raw, 10, 64)
-	if err != nil {
-		return 0, false
-	}
-	return parsed, true
-}
-
-// LookPathHomebrew is like exec.LookPath but also checks Homebrew paths.
-func LookPathHomebrew(file string) (string, error) {
-	foundPath, lookPathErr := exec.LookPath(file)
-	if lookPathErr == nil {
-		return foundPath, nil
-	}
-	var homebrewPath string
-	switch runtime.GOOS {
-	case "darwin":
-		homebrewPath = filepath.Join("/opt", "homebrew", "bin", file)
-	case "linux":
-		homebrewPath = filepath.Join("/home", "linuxbrew", ".linuxbrew", "bin", file)
-	}
-	if homebrewPath != "" {
-		if _, err := os.Stat(homebrewPath); err == nil {
-			return homebrewPath, nil
-		}
-	}
-	return "", lookPathErr
-}

agent/utils/utils_test.go

@@ -1,158 +0,0 @@
-package utils
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestTwoDecimals(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    float64
-		expected float64
-	}{
-		{"round down", 1.234, 1.23},
-		{"round half up", 1.235, 1.24}, // math.Round rounds half up
-		{"no rounding needed", 1.23, 1.23},
-		{"negative number", -1.235, -1.24}, // math.Round rounds half up (more negative)
-		{"zero", 0.0, 0.0},
-		{"large number", 123.456, 123.46}, // rounds 5 up
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := TwoDecimals(tt.input)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestBytesToMegabytes(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    float64
-		expected float64
-	}{
-		{"1 MB", 1048576, 1.0},
-		{"512 KB", 524288, 0.5},
-		{"zero", 0, 0},
-		{"large value", 1073741824, 1024}, // 1 GB = 1024 MB
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := BytesToMegabytes(tt.input)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestBytesToGigabytes(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    uint64
-		expected float64
-	}{
-		{"1 GB", 1073741824, 1.0},
-		{"512 MB", 536870912, 0.5},
-		{"0 GB", 0, 0},
-		{"2 GB", 2147483648, 2.0},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := BytesToGigabytes(tt.input)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestFileFunctions(t *testing.T) {
-	tmpDir := t.TempDir()
-	testFilePath := filepath.Join(tmpDir, "test.txt")
-	testContent := "hello world"
-
-	// Test FileExists (false)
-	assert.False(t, FileExists(testFilePath))
-
-	// Test ReadStringFileOK (false)
-	content, ok := ReadStringFileOK(testFilePath)
-	assert.False(t, ok)
-	assert.Empty(t, content)
-
-	// Test ReadStringFile (empty)
-	assert.Empty(t, ReadStringFile(testFilePath))
-
-	// Write file
-	err := os.WriteFile(testFilePath, []byte(testContent+"\n "), 0644)
-	assert.NoError(t, err)
-
-	// Test FileExists (true)
-	assert.True(t, FileExists(testFilePath))
-
-	// Test ReadStringFileOK (true)
-	content, ok = ReadStringFileOK(testFilePath)
-	assert.True(t, ok)
-	assert.Equal(t, testContent, content)
-
-	// Test ReadStringFile (content)
-	assert.Equal(t, testContent, ReadStringFile(testFilePath))
-}
-
-func TestReadUintFile(t *testing.T) {
-	tmpDir := t.TempDir()
-
-	t.Run("valid uint", func(t *testing.T) {
-		path := filepath.Join(tmpDir, "uint.txt")
-		os.WriteFile(path, []byte(" 12345\n"), 0644)
-		val, ok := ReadUintFile(path)
-		assert.True(t, ok)
-		assert.Equal(t, uint64(12345), val)
-	})
-
-	t.Run("invalid uint", func(t *testing.T) {
-		path := filepath.Join(tmpDir, "invalid.txt")
-		os.WriteFile(path, []byte("abc"), 0644)
-		val, ok := ReadUintFile(path)
-		assert.False(t, ok)
-		assert.Equal(t, uint64(0), val)
-	})
-
-	t.Run("missing file", func(t *testing.T) {
-		path := filepath.Join(tmpDir, "missing.txt")
-		val, ok := ReadUintFile(path)
-		assert.False(t, ok)
-		assert.Equal(t, uint64(0), val)
-	})
-}
-
-func TestGetEnv(t *testing.T) {
-	key := "TEST_VAR"
-	prefixedKey := "BESZEL_AGENT_" + key
-
-	t.Run("prefixed variable exists", func(t *testing.T) {
-		t.Setenv(prefixedKey, "prefixed_val")
-		t.Setenv(key, "unprefixed_val")
-
-		val, exists := GetEnv(key)
-		assert.True(t, exists)
-		assert.Equal(t, "prefixed_val", val)
-	})
-
-	t.Run("only unprefixed variable exists", func(t *testing.T) {
-		t.Setenv(key, "unprefixed_val")
-
-		val, exists := GetEnv(key)
-		assert.True(t, exists)
-		assert.Equal(t, "unprefixed_val", val)
-	})
-
-	t.Run("neither variable exists", func(t *testing.T) {
-		val, exists := GetEnv(key)
-		assert.False(t, exists)
-		assert.Empty(t, val)
-	})
-}

beszel.go

@@ -6,7 +6,7 @@ import "github.com/blang/semver"
 
 const (
 	// Version is the current version of the application.
-	Version = "0.18.7"
+	Version = "0.18.4"
 	// AppName is the name of the application.
 	AppName = "beszel"
 )

go.mod

@@ -1,39 +1,43 @@
 module github.com/henrygd/beszel
 
-go 1.26.1
+go 1.26.0
 
 require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/coreos/go-systemd/v22 v22.7.0
-	github.com/ebitengine/purego v0.10.0
+	github.com/distatus/battery v0.11.0
+	github.com/ebitengine/purego v0.9.1
 	github.com/fxamacker/cbor/v2 v2.9.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/google/uuid v1.6.0
-	github.com/lxzan/gws v1.9.1
-	github.com/nicholas-fedor/shoutrrr v0.14.3
+	github.com/luthermonson/go-proxmox v0.4.0
+	github.com/lxzan/gws v1.8.9
+	github.com/nicholas-fedor/shoutrrr v0.13.2
 	github.com/pocketbase/dbx v1.12.0
-	github.com/pocketbase/pocketbase v0.36.8
-	github.com/shirou/gopsutil/v4 v4.26.3
+	github.com/pocketbase/pocketbase v0.36.4
+	github.com/shirou/gopsutil/v4 v4.26.1
 	github.com/spf13/cast v1.10.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
-	golang.org/x/crypto v0.49.0
-	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
-	golang.org/x/sys v0.42.0
+	golang.org/x/crypto v0.48.0
+	golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa
+	golang.org/x/sys v0.41.0
 	gopkg.in/yaml.v3 v3.0.1
-	howett.net/plist v1.0.1
 )
 
 require (
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/buger/goterm v1.0.4 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/disintegration/imaging v1.6.2 // indirect
+	github.com/diskfs/go-diskfs v1.7.0 // indirect
+	github.com/djherbis/times v1.6.0 // indirect
+	github.com/dolthub/maphash v0.1.0 // indirect
 	github.com/domodwyer/mailyak/v3 v3.6.2 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/eclipse/paho.golang v0.23.0 // indirect
-	github.com/fatih/color v1.19.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/ganigeorgiev/fexpr v0.5.0 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
@@ -41,10 +45,12 @@ require (
 	github.com/go-sql-driver/mysql v1.9.1 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
-	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.18.5 // indirect
-	github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 // indirect
+	github.com/jinzhu/copier v0.3.4 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
+	github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect
+	github.com/magefile/mage v1.14.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
@@ -55,14 +61,15 @@ require (
 	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
-	golang.org/x/image v0.38.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/term v0.41.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
-	modernc.org/libc v1.70.0 // indirect
+	golang.org/x/image v0.36.0 // indirect
+	golang.org/x/net v0.50.0 // indirect
+	golang.org/x/oauth2 v0.35.0 // indirect
+	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	howett.net/plist v1.0.1 // indirect
+	modernc.org/libc v1.67.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
-	modernc.org/sqlite v1.48.0 // indirect
+	modernc.org/sqlite v1.45.0 // indirect
 )

go.sum

@@ -2,6 +2,8 @@ filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
 filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
 github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
+github.com/anchore/go-lzo v0.1.0 h1:NgAacnzqPeGH49Ky19QKLBZEuFRqtTG9cdaucc3Vncs=
+github.com/anchore/go-lzo v0.1.0/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496/go.mod h1:oGkLhpf+kjZl6xBf758TQhh5XrAeiJv/7FRz/2spLIg=
@@ -9,6 +11,8 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
 github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/buger/goterm v1.0.4 h1:Z9YvGmOih81P0FbVtEYTFF6YsSgxSUKEhf/f9bTMXbY=
+github.com/buger/goterm v1.0.4/go.mod h1:HiFWV3xnkolgrBV3mY8m0X0Pumt4zg4QhbdOzQtB8tE=
 github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
 github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -17,16 +21,24 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/disintegration/imaging v1.6.2 h1:w1LecBlG2Lnp8B3jk5zSuNqd7b4DXhcjwek1ei82L+c=
 github.com/disintegration/imaging v1.6.2/go.mod h1:44/5580QXChDfwIclfc/PCwrr44amcmDAg8hxG0Ewe4=
+github.com/diskfs/go-diskfs v1.7.0 h1:vonWmt5CMowXwUc79jWyGrf2DIMeoOjkLlMnQYGVOs8=
+github.com/diskfs/go-diskfs v1.7.0/go.mod h1:LhQyXqOugWFRahYUSw47NyZJPezFzB9UELwhpszLP/k=
+github.com/distatus/battery v0.11.0 h1:KJk89gz90Iq/wJtbjjM9yUzBXV+ASV/EG2WOOL7N8lc=
+github.com/distatus/battery v0.11.0/go.mod h1:KmVkE8A8hpIX4T78QRdMktYpEp35QfOL8A8dwZBxq2k=
+github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c=
+github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0=
+github.com/dolthub/maphash v0.1.0 h1:bsQ7JsF4FkkWyrP3oCnFJgrCUAFbFf3kOl4L/QxPDyQ=
+github.com/dolthub/maphash v0.1.0/go.mod h1:gkg4Ch4CdCDu5h6PMriVLawB7koZ+5ijb9puGMV50a4=
 github.com/domodwyer/mailyak/v3 v3.6.2 h1:x3tGMsyFhTCaxp6ycgR0FE/bu5QiNp+hetUuCOBXMn8=
 github.com/domodwyer/mailyak/v3 v3.6.2/go.mod h1:lOm/u9CyCVWHeaAmHIdF4RiKVxKUT/H5XX10lIKAL6c=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
-github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
-github.com/eclipse/paho.golang v0.23.0 h1:KHgl2wz6EJo7cMBmkuhpt7C576vP+kpPv7jjvSyR6Mk=
-github.com/eclipse/paho.golang v0.23.0/go.mod h1:nQRhTkoZv8EAiNs5UU0/WdQIx2NrnWUpL9nsGJTQN04=
-github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
-github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
+github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab h1:h1UgjJdAAhj+uPL68n7XASS6bU+07ZX1WJvVS2eyoeY=
+github.com/elliotwutingfeng/asciiset v0.0.0-20230602022725-51bbb787efab/go.mod h1:GLo/8fDswSAniFG+BFIaiSPcK610jyzgEhWYPQwuQdw=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
@@ -49,6 +61,8 @@ github.com/go-sql-driver/mysql v1.9.1 h1:FrjNGn/BsJQjVRuSa8CBrM5BWA9BWoXXat3KrtS
 github.com/go-sql-driver/mysql v1.9.1/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
+github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
+github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
@@ -56,12 +70,16 @@ github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArs
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc h1:VBbFa1lDYWEeV5FZKUiYKYT0VxCp9twUmmaq9eb8sXw=
-github.com/google/pprof v0.0.0-20260302011040-a15ffb7f9dcc/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
+github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
-github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/h2non/gock v1.2.0 h1:K6ol8rfrRkUOefooBC8elXoaNGYkpp7y2qcxGG6BzUE=
+github.com/h2non/gock v1.2.0/go.mod h1:tNhoxHYW2W42cYkYb1WqzdbYIieALC99kpYr7rH/BQk=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -69,35 +87,45 @@ github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLf
 github.com/jarcoal/httpmock v1.4.1 h1:0Ju+VCFuARfFlhVXFc2HxlcQkfB+Xq12/EotHko+x2A=
 github.com/jarcoal/httpmock v1.4.1/go.mod h1:ftW1xULwo+j0R0JJkJIIi7UKigZUXCLLanykgjwBXL0=
 github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
-github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
-github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/jinzhu/copier v0.3.4 h1:mfU6jI9PtCeUjkjQ322dlff9ELjGDu975C2p/nrubVI=
+github.com/jinzhu/copier v0.3.4/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
+github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c=
+github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749 h1:Qj3hTcdWH8uMZDI41HNuTuJN525C7NBrbtH5kSO6fPk=
-github.com/lufia/plan9stats v0.0.0-20260324052639-156f7da3f749/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
-github.com/lxzan/gws v1.9.1 h1:4lbIp4cW0hOLP3ejFHR/uWRy741AURx7oKkNNi2OT9o=
-github.com/lxzan/gws v1.9.1/go.mod h1:gXHSCPmTGryWJ4icuqy8Yho32E4YIMHH0fkDRYJRbdc=
+github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 h1:PTw+yKnXcOFCR6+8hHTyWBeQ/P4Nb7dd4/0ohEcWQuM=
+github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/luthermonson/go-proxmox v0.4.0 h1:LKXpG9d64zTaQF79wV0kfOnnSwIcdG39m7sc4ga+XZs=
+github.com/luthermonson/go-proxmox v0.4.0/go.mod h1:U6dAkJ+iiwaeb1g/LMWpWuWN4nmvWeXhmoMuYJMumS4=
+github.com/lxzan/gws v1.8.9 h1:VU3SGUeWlQrEwfUSfokcZep8mdg/BrUF+y73YYshdBM=
+github.com/lxzan/gws v1.8.9/go.mod h1:d9yHaR1eDTBHagQC6KY7ycUOaz5KWeqQtP3xu7aMK8Y=
+github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo=
+github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/nicholas-fedor/shoutrrr v0.14.3 h1:aBX2iw9a7jl5wfHd3bi9LnS5ucoYIy6KcLH9XVF+gig=
-github.com/nicholas-fedor/shoutrrr v0.14.3/go.mod h1:U7IywBkLpBV7rgn8iLbQ9/LklJG1gm24bFv5cXXsDKs=
+github.com/nicholas-fedor/shoutrrr v0.13.2 h1:hfsYBIqSFYGg92pZP5CXk/g7/OJIkLYmiUnRl+AD1IA=
+github.com/nicholas-fedor/shoutrrr v0.13.2/go.mod h1:ZqzV3gY/Wj6AvWs1etlO7+yKbh4iptSbeL8avBpMQbA=
 github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
 github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
 github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
 github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/pierrec/lz4/v4 v4.1.17 h1:kV4Ip+/hUBC+8T6+2EgburRtkE9ef4nbY3f4dFhGjMc=
+github.com/pierrec/lz4/v4 v4.1.17/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pkg/xattr v0.4.9 h1:5883YPCtkSd8LFbs13nXplj9g9tlrwoJRjgpgMu1/fE=
+github.com/pkg/xattr v0.4.9/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pocketbase/dbx v1.12.0 h1:/oLErM+A0b4xI0PWTGPqSDVjzix48PqI/bng2l0PzoA=
 github.com/pocketbase/dbx v1.12.0/go.mod h1:xXRCIAKTHMgUCyCKZm55pUOdvFziJjQfXaWKhu2vhMs=
-github.com/pocketbase/pocketbase v0.36.8 h1:gCNqoesZ44saYOD3J7edhi5nDwUWKyQG7boM/kVwz2c=
-github.com/pocketbase/pocketbase v0.36.8/go.mod h1:OY4WaXbP0WnF/EXoBbboWJK+ZSZ1A85tiA0sjrTKxTA=
+github.com/pocketbase/pocketbase v0.36.4 h1:zTjRZbp2WfTOJJfb+pFRWa200UaQwxZYt8RzkFMlAZ4=
+github.com/pocketbase/pocketbase v0.36.4/go.mod h1:9CiezhRudd9FZGa5xZa53QZBTNxc5vvw/FGG+diAECI=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
@@ -105,8 +133,10 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qq
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
-github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
+github.com/shirou/gopsutil/v4 v4.26.1 h1:TOkEyriIXk2HX9d4isZJtbjXbEjf5qyKPAzbzY0JWSo=
+github.com/shirou/gopsutil/v4 v4.26.1/go.mod h1:medLI9/UNAb0dOI9Q3/7yWSqKkj00u+1tgY8nvv41pc=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af h1:Sp5TG9f7K39yfB+If0vjp97vuT74F72r8hfRpP8jLU0=
+github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
@@ -115,8 +145,6 @@ github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
-github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
@@ -124,48 +152,52 @@ github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYI
 github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
 github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
 github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
+github.com/ulikunitz/xz v0.5.11 h1:kpFauv27b6ynzBNT/Xy+1k+fK4WswhN/6PN5WhFAGw8=
+github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
-go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
-golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa h1:Zt3DZoOFFYkKhDT3v7Lm9FDMEV06GpzjG2jrqW+QTE0=
+golang.org/x/exp v0.0.0-20260218203240-3dfff04db8fa/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
 golang.org/x/image v0.0.0-20191009234506-e7c1f5e7dbb8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.38.0 h1:5l+q+Y9JDC7mBOMjo4/aPhMDcxEptsX+Tt3GgRQRPuE=
-golang.org/x/image v0.38.0/go.mod h1:/3f6vaXC+6CEanU4KJxbcUZyEePbyKbaLoDOe4ehFYY=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/image v0.36.0 h1:Iknbfm1afbgtwPTmHnS2gTM/6PPZfH+z2EFuOkSbqwc=
+golang.org/x/image v0.36.0/go.mod h1:YsWD2TyyGKiIX1kZlu9QfKIsQ4nAAK9bdgdrIsE7xy4=
+golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
+golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ=
+golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210331175145-43e1dd70ce54/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
+golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
@@ -177,18 +209,18 @@ howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
 howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=
 modernc.org/cc/v4 v4.27.1 h1:9W30zRlYrefrDV2JE2O8VDtJ1yPGownxciz5rrbQZis=
 modernc.org/cc/v4 v4.27.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
-modernc.org/ccgo/v4 v4.32.0 h1:hjG66bI/kqIPX1b2yT6fr/jt+QedtP2fqojG2VrFuVw=
-modernc.org/ccgo/v4 v4.32.0/go.mod h1:6F08EBCx5uQc38kMGl+0Nm0oWczoo1c7cgpzEry7Uc0=
-modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
-modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
+modernc.org/ccgo/v4 v4.30.1 h1:4r4U1J6Fhj98NKfSjnPUN7Ze2c6MnAdL0hWw6+LrJpc=
+modernc.org/ccgo/v4 v4.30.1/go.mod h1:bIOeI1JL54Utlxn+LwrFyjCx2n2RDiYEaJVSrgdrRfM=
+modernc.org/fileutil v1.3.40 h1:ZGMswMNc9JOCrcrakF1HrvmergNLAmxOPjizirpfqBA=
+modernc.org/fileutil v1.3.40/go.mod h1:HxmghZSZVAz/LXcMNwZPA/DRrQZEVP9VX0V4LQGQFOc=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.2 h1:ZtDCnhonXSZexk/AYsegNRV1lJGgaNZJuKjJSWKyEqo=
-modernc.org/gc/v3 v3.1.2/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.1 h1:k8T3gkXWY9sEiytKhcgyiZ2L0DTyCQ/nvX+LoCljoRE=
+modernc.org/gc/v3 v3.1.1/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.70.0 h1:U58NawXqXbgpZ/dcdS9kMshu08aiA6b7gusEusqzNkw=
-modernc.org/libc v1.70.0/go.mod h1:OVmxFGP1CI/Z4L3E0Q3Mf1PDE0BucwMkcXjjLntvHJo=
+modernc.org/libc v1.67.6 h1:eVOQvpModVLKOdT+LvBPjdQqfrZq+pC39BygcT+E7OI=
+modernc.org/libc v1.67.6/go.mod h1:JAhxUVlolfYDErnwiqaLvUqc8nfb2r6S6slAgZOnaiE=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -197,8 +229,8 @@ modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
 modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.48.0 h1:ElZyLop3Q2mHYk5IFPPXADejZrlHu7APbpB0sF78bq4=
-modernc.org/sqlite v1.48.0/go.mod h1:hWjRO6Tj/5Ik8ieqxQybiEOUXy0NJFNp2tpvVpKlvig=
+modernc.org/sqlite v1.45.0 h1:r51cSGzKpbptxnby+EIIz5fop4VuE4qFoVEjNvWoObs=
+modernc.org/sqlite v1.45.0/go.mod h1:CzbrU2lSB1DKUusvwGz7rqEKIq+NUd8GWuBBZDs9/nA=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=

internal/alerts/alerts.go

@@ -21,9 +21,9 @@ type hubLike interface {
 
 type AlertManager struct {
 	hub           hubLike
-	stopOnce      sync.Once
+	alertQueue    chan alertTask
+	stopChan      chan struct{}
 	pendingAlerts sync.Map
-	alertsCache   *AlertsCache
 }
 
 type AlertMessageData struct {
@@ -40,22 +40,16 @@ type UserNotificationSettings struct {
 	Webhooks []string `json:"webhooks"`
 }
 
-type SystemAlertFsStats struct {
-	DiskTotal float64 `json:"d"`
-	DiskUsed  float64 `json:"du"`
-}
-
-// Values pulled from system_stats.stats that are relevant to alerts.
 type SystemAlertStats struct {
 	Cpu          float64                       `json:"cpu"`
 	Mem          float64                       `json:"mp"`
 	Disk         float64                       `json:"dp"`
-	Bandwidth    [2]uint64                     `json:"b"`
+	NetSent      float64                       `json:"ns"`
+	NetRecv      float64                       `json:"nr"`
 	GPU          map[string]SystemAlertGPUData `json:"g"`
 	Temperatures map[string]float32            `json:"t"`
 	LoadAvg      [3]float64                    `json:"la"`
 	Battery      [2]uint8                      `json:"bat"`
-	ExtraFs      map[string]SystemAlertFsStats `json:"efs"`
 }
 
 type SystemAlertGPUData struct {
@@ -64,7 +58,7 @@ type SystemAlertGPUData struct {
 
 type SystemAlertData struct {
 	systemRecord *core.Record
-	alertData    CachedAlertData
+	alertRecord  *core.Record
 	name         string
 	unit         string
 	val          float64
@@ -99,9 +93,11 @@ var supportsTitle = map[string]struct{}{
 func NewAlertManager(app hubLike) *AlertManager {
 	am := &AlertManager{
 		hub:        app,
-		alertsCache: NewAlertsCache(app),
+		alertQueue: make(chan alertTask, 5),
+		stopChan:   make(chan struct{}),
 	}
 	am.bindEvents()
+	go am.startWorker()
 	return am
 }
 
@@ -110,19 +106,6 @@ func (am *AlertManager) bindEvents() {
 	am.hub.OnRecordAfterUpdateSuccess("alerts").BindFunc(updateHistoryOnAlertUpdate)
 	am.hub.OnRecordAfterDeleteSuccess("alerts").BindFunc(resolveHistoryOnAlertDelete)
 	am.hub.OnRecordAfterUpdateSuccess("smart_devices").BindFunc(am.handleSmartDeviceAlert)
-
-	am.hub.OnServe().BindFunc(func(e *core.ServeEvent) error {
-		// Populate all alerts into cache on startup
-		_ = am.alertsCache.PopulateFromDB(true)
-
-		if err := resolveStatusAlerts(e.App); err != nil {
-			e.App.Logger().Error("Failed to resolve stale status alerts", "err", err)
-		}
-		if err := am.restorePendingStatusAlerts(); err != nil {
-			e.App.Logger().Error("Failed to restore pending status alerts", "err", err)
-		}
-		return e.Next()
-	})
 }
 
 // IsNotificationSilenced checks if a notification should be silenced based on configured quiet hours
@@ -276,14 +259,13 @@ func (am *AlertManager) SendShoutrrrAlert(notificationUrl, title, message, link,
 	}
 
 	// Add link
-	switch scheme {
-	case "ntfy":
+	if scheme == "ntfy" {
 		queryParams.Add("Actions", fmt.Sprintf("view, %s, %s", linkText, link))
-	case "lark":
+	} else if scheme == "lark" {
 		queryParams.Add("link", link)
-	case "bark":
+	} else if scheme == "bark" {
 		queryParams.Add("url", link)
-	default:
+	} else {
 		message += "\n\n" + link
 	}
 
@@ -302,12 +284,17 @@ func (am *AlertManager) SendShoutrrrAlert(notificationUrl, title, message, link,
 	return nil
 }
 
-// setAlertTriggered updates the "triggered" status of an alert record in the database
-func (am *AlertManager) setAlertTriggered(alert CachedAlertData, triggered bool) error {
-	alertRecord, err := am.hub.FindRecordById("alerts", alert.Id)
-	if err != nil {
-		return err
+func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
+	var data struct {
+		URL string `json:"url"`
 	}
-	alertRecord.Set("triggered", triggered)
-	return am.hub.Save(alertRecord)
+	err := e.BindBody(&data)
+	if err != nil || data.URL == "" {
+		return e.BadRequestError("URL is required", err)
+	}
+	err = am.SendShoutrrrAlert(data.URL, "Test Alert", "This is a notification from Beszel.", am.hub.Settings().Meta.AppURL, "View Beszel")
+	if err != nil {
+		return e.JSON(200, map[string]string{"err": err.Error()})
+	}
+	return e.JSON(200, map[string]bool{"err": false})
 }

internal/alerts/alerts_api.go

@@ -3,11 +3,7 @@ package alerts
 import (
 	"database/sql"
 	"errors"
-	"net"
 	"net/http"
-	"net/url"
-	"slices"
-	"strings"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
@@ -121,72 +117,3 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 
 	return e.JSON(http.StatusOK, map[string]any{"success": true, "count": numDeleted})
 }
-
-// SendTestNotification handles API request to send a test notification to a specified Shoutrrr URL
-func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
-	var data struct {
-		URL string `json:"url"`
-	}
-	err := e.BindBody(&data)
-	if err != nil || data.URL == "" {
-		return e.BadRequestError("URL is required", err)
-	}
-	// Only allow admins to send test notifications to internal URLs
-	if !e.Auth.IsSuperuser() && e.Auth.GetString("role") != "admin" {
-		internalURL, err := isInternalURL(data.URL)
-		if err != nil {
-			return e.BadRequestError(err.Error(), nil)
-		}
-		if internalURL {
-			return e.ForbiddenError("Only admins can send to internal destinations", nil)
-		}
-	}
-	err = am.SendShoutrrrAlert(data.URL, "Test Alert", "This is a notification from Beszel.", am.hub.Settings().Meta.AppURL, "View Beszel")
-	if err != nil {
-		return e.JSON(200, map[string]string{"err": err.Error()})
-	}
-	return e.JSON(200, map[string]bool{"err": false})
-}
-
-// isInternalURL checks if the given shoutrrr URL points to an internal destination (localhost or private IP)
-func isInternalURL(rawURL string) (bool, error) {
-	parsedURL, err := url.Parse(rawURL)
-	if err != nil {
-		return false, err
-	}
-
-	host := parsedURL.Hostname()
-	if host == "" {
-		return false, nil
-	}
-
-	if strings.EqualFold(host, "localhost") {
-		return true, nil
-	}
-
-	if ip := net.ParseIP(host); ip != nil {
-		return isInternalIP(ip), nil
-	}
-
-	// Some Shoutrrr URLs use the host position for service identifiers rather than a
-	// network hostname (for example, discord://token@webhookid). Restrict DNS lookups
-	// to names that look like actual hostnames so valid service URLs keep working.
-	if !strings.Contains(host, ".") {
-		return false, nil
-	}
-
-	ips, err := net.LookupIP(host)
-	if err != nil {
-		return false, nil
-	}
-
-	if slices.ContainsFunc(ips, isInternalIP) {
-		return true, nil
-	}
-
-	return false, nil
-}
-
-func isInternalIP(ip net.IP) bool {
-	return ip.IsPrivate() || ip.IsLoopback() || ip.IsUnspecified()
-}

internal/alerts/alerts_api_test.go

@@ -1,501 +0,0 @@
-//go:build testing
-
-package alerts_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/henrygd/beszel/internal/alerts"
-	beszelTests "github.com/henrygd/beszel/internal/tests"
-	pbTests "github.com/pocketbase/pocketbase/tests"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// marshal to json and return an io.Reader (for use in ApiScenario.Body)
-func jsonReader(v any) io.Reader {
-	data, err := json.Marshal(v)
-	if err != nil {
-		panic(err)
-	}
-	return bytes.NewReader(data)
-}
-
-func TestIsInternalURL(t *testing.T) {
-	testCases := []struct {
-		name     string
-		url      string
-		internal bool
-	}{
-		{name: "loopback ipv4", url: "generic://127.0.0.1", internal: true},
-		{name: "localhost hostname", url: "generic://localhost", internal: true},
-		{name: "localhost hostname", url: "generic+http://localhost/api/v1/postStuff", internal: true},
-		{name: "localhost hostname", url: "generic+http://127.0.0.1:8080/api/v1/postStuff", internal: true},
-		{name: "localhost hostname", url: "generic+https://beszel.dev/api/v1/postStuff", internal: false},
-		{name: "public ipv4", url: "generic://8.8.8.8", internal: false},
-		{name: "token style service url", url: "discord://abc123@123456789", internal: false},
-		{name: "single label service url", url: "slack://token@team/channel", internal: false},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			internal, err := alerts.IsInternalURL(testCase.url)
-			assert.NoError(t, err)
-			assert.Equal(t, testCase.internal, internal)
-		})
-	}
-}
-
-func TestUserAlertsApi(t *testing.T) {
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	hub.StartHub()
-
-	user1, _ := beszelTests.CreateUser(hub, "alertstest@example.com", "password")
-	user1Token, _ := user1.NewAuthToken()
-
-	user2, _ := beszelTests.CreateUser(hub, "alertstest2@example.com", "password")
-	user2Token, _ := user2.NewAuthToken()
-
-	system1, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system1",
-		"users": []string{user1.Id},
-		"host":  "127.0.0.1",
-	})
-
-	system2, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system2",
-		"users": []string{user1.Id, user2.Id},
-		"host":  "127.0.0.2",
-	})
-
-	userRecords, _ := hub.CountRecords("users")
-	assert.EqualValues(t, 2, userRecords, "all users should be created")
-
-	systemRecords, _ := hub.CountRecords("systems")
-	assert.EqualValues(t, 2, systemRecords, "all systems should be created")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		// {
-		// 	Name:            "GET not implemented - returns index",
-		// 	Method:          http.MethodGet,
-		// 	URL:             "/api/beszel/user-alerts",
-		// 	ExpectedStatus:  200,
-		// 	ExpectedContent: []string{"<html ", "globalThis.BESZEL"},
-		// 	TestAppFactory:  testAppFactory,
-		// },
-		{
-			Name:            "POST no auth",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST no body",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST bad data",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"invalidField": "this should cause validation error",
-				"threshold":    "not a number",
-			}),
-		},
-		{
-			Name:   "POST malformed JSON",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-			Body:            strings.NewReader(`{"alertType": "cpu", "threshold": 80, "enabled": true,}`),
-		},
-		{
-			Name:   "POST valid alert data multiple systems",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     69,
-				"min":       9,
-				"systems":   []string{system1.Id, system2.Id},
-				"overwrite": false,
-			}),
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				// check total alerts
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-				// check alert has correct values
-				matchingAlerts, _ := app.CountRecords("alerts", dbx.HashExp{"name": "CPU", "user": user1.Id, "system": system1.Id, "value": 69, "min": 9})
-				assert.EqualValues(t, 1, matchingAlerts, "should have 1 alert")
-			},
-		},
-		{
-			Name:   "POST valid alert data single system",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "Memory",
-				"systems": []string{system1.Id},
-				"value":   90,
-				"min":     10,
-			}),
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				user1Alerts, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
-			},
-		},
-		{
-			Name:   "Overwrite: false, should not overwrite existing alert",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     45,
-				"min":       5,
-				"systems":   []string{system1.Id},
-				"overwrite": false,
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user1.Id})
-				assert.EqualValues(t, 80, alert.Get("value"), "should have 80 as value")
-			},
-		},
-		{
-			Name:   "Overwrite: true, should overwrite existing alert",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     45,
-				"min":       5,
-				"systems":   []string{system2.Id},
-				"overwrite": true,
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system2.Id,
-					"user":   user2.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user2.Id})
-				assert.EqualValues(t, 45, alert.Get("value"), "should have 45 as value")
-			},
-		},
-		{
-			Name:            "DELETE no auth",
-			Method:          http.MethodDelete,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system1.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-			},
-		},
-		{
-			Name:   "DELETE alert",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system1.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.Zero(t, alerts, "should have 0 alerts")
-			},
-		},
-		{
-			Name:   "DELETE alert multiple systems",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":2", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "Memory",
-				"systems": []string{system1.Id, system2.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				for _, systemId := range []string{system1.Id, system2.Id} {
-					_, err := beszelTests.CreateRecord(app, "alerts", map[string]any{
-						"name":   "Memory",
-						"system": systemId,
-						"user":   user1.Id,
-						"value":  90,
-						"min":    10,
-					})
-					assert.NoError(t, err, "should create alert")
-				}
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.Zero(t, alerts, "should have 0 alerts")
-			},
-		},
-		{
-			Name:   "User 2 should not be able to delete alert of user 1",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system2.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				for _, user := range []string{user1.Id, user2.Id} {
-					beszelTests.CreateRecord(app, "alerts", map[string]any{
-						"name":   "CPU",
-						"system": system2.Id,
-						"user":   user,
-						"value":  80,
-						"min":    10,
-					})
-				}
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
-				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
-				assert.EqualValues(t, 1, user2AlertCount, "should have 1 alert")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
-				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
-				assert.Zero(t, user2AlertCount, "should have 0 alerts")
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-func TestSendTestNotification(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	userToken, err := user.NewAuthToken()
-
-	adminUser, err := beszelTests.CreateUserWithRole(hub, "admin@example.com", "password123", "admin")
-	assert.NoError(t, err, "Failed to create admin user")
-	adminUserToken, err := adminUser.NewAuthToken()
-
-	superuser, err := beszelTests.CreateSuperuser(hub, "superuser@example.com", "password123")
-	assert.NoError(t, err, "Failed to create superuser")
-	superuserToken, err := superuser.NewAuthToken()
-	assert.NoError(t, err, "Failed to create superuser auth token")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		{
-			Name:            "POST /test-notification - no auth should fail",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/test-notification",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-		},
-		{
-			Name:           "POST /test-notification - with external auth should succeed",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://8.8.8.8",
-			}),
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"err\":"},
-		},
-		{
-			Name:           "POST /test-notification - local url with user auth should fail",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://localhost:8010",
-			}),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"Only admins"},
-		},
-		{
-			Name:           "POST /test-notification - internal url with user auth should fail",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic+http://192.168.0.5",
-			}),
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"Only admins"},
-		},
-		{
-			Name:           "POST /test-notification - internal url with admin auth should succeed",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": adminUserToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"err\":"},
-		},
-		{
-			Name:           "POST /test-notification - internal url with superuser auth should succeed",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": superuserToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"err\":"},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

internal/alerts/alerts_cache.go

@@ -1,177 +0,0 @@
-package alerts
-
-import (
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/store"
-)
-
-// CachedAlertData represents the relevant fields of an alert record for status checking and updates.
-type CachedAlertData struct {
-	Id        string
-	SystemID  string
-	UserID    string
-	Name      string
-	Value     float64
-	Triggered bool
-	Min       uint8
-	// Created   types.DateTime
-}
-
-func (a *CachedAlertData) PopulateFromRecord(record *core.Record) {
-	a.Id = record.Id
-	a.SystemID = record.GetString("system")
-	a.UserID = record.GetString("user")
-	a.Name = record.GetString("name")
-	a.Value = record.GetFloat("value")
-	a.Triggered = record.GetBool("triggered")
-	a.Min = uint8(record.GetInt("min"))
-	// a.Created = record.GetDateTime("created")
-}
-
-// AlertsCache provides an in-memory cache for system alerts.
-type AlertsCache struct {
-	app       core.App
-	store     *store.Store[string, *store.Store[string, CachedAlertData]]
-	populated bool
-}
-
-// NewAlertsCache creates a new instance of SystemAlertsCache.
-func NewAlertsCache(app core.App) *AlertsCache {
-	c := AlertsCache{
-		app:   app,
-		store: store.New(map[string]*store.Store[string, CachedAlertData]{}),
-	}
-	return c.bindEvents()
-}
-
-// bindEvents sets up event listeners to keep the cache in sync with database changes.
-func (c *AlertsCache) bindEvents() *AlertsCache {
-	c.app.OnRecordAfterUpdateSuccess("alerts").BindFunc(func(e *core.RecordEvent) error {
-		// c.Delete(e.Record.Original()) // this would be needed if the system field on an existing alert was changed, however we don't currently allow that in the UI so we'll leave it commented out
-		c.Update(e.Record)
-		return e.Next()
-	})
-	c.app.OnRecordAfterDeleteSuccess("alerts").BindFunc(func(e *core.RecordEvent) error {
-		c.Delete(e.Record)
-		return e.Next()
-	})
-	c.app.OnRecordAfterCreateSuccess("alerts").BindFunc(func(e *core.RecordEvent) error {
-		c.Update(e.Record)
-		return e.Next()
-	})
-	return c
-}
-
-// PopulateFromDB clears current entries and loads all alerts from the database into the cache.
-func (c *AlertsCache) PopulateFromDB(force bool) error {
-	if !force && c.populated {
-		return nil
-	}
-	records, err := c.app.FindAllRecords("alerts")
-	if err != nil {
-		return err
-	}
-	c.store.RemoveAll()
-	for _, record := range records {
-		c.Update(record)
-	}
-	c.populated = true
-	return nil
-}
-
-// Update adds or updates an alert record in the cache.
-func (c *AlertsCache) Update(record *core.Record) {
-	systemID := record.GetString("system")
-	if systemID == "" {
-		return
-	}
-	systemStore, ok := c.store.GetOk(systemID)
-	if !ok {
-		systemStore = store.New(map[string]CachedAlertData{})
-		c.store.Set(systemID, systemStore)
-	}
-	var ca CachedAlertData
-	ca.PopulateFromRecord(record)
-	systemStore.Set(record.Id, ca)
-}
-
-// Delete removes an alert record from the cache.
-func (c *AlertsCache) Delete(record *core.Record) {
-	systemID := record.GetString("system")
-	if systemID == "" {
-		return
-	}
-	if systemStore, ok := c.store.GetOk(systemID); ok {
-		systemStore.Remove(record.Id)
-	}
-}
-
-// GetSystemAlerts returns all alerts for the specified system, lazy-loading if necessary.
-func (c *AlertsCache) GetSystemAlerts(systemID string) []CachedAlertData {
-	systemStore, ok := c.store.GetOk(systemID)
-	if !ok {
-		// Populate cache for this system
-		records, err := c.app.FindAllRecords("alerts", dbx.NewExp("system={:system}", dbx.Params{"system": systemID}))
-		if err != nil {
-			return nil
-		}
-		systemStore = store.New(map[string]CachedAlertData{})
-		for _, record := range records {
-			var ca CachedAlertData
-			ca.PopulateFromRecord(record)
-			systemStore.Set(record.Id, ca)
-		}
-		c.store.Set(systemID, systemStore)
-	}
-	all := systemStore.GetAll()
-	alerts := make([]CachedAlertData, 0, len(all))
-	for _, alert := range all {
-		alerts = append(alerts, alert)
-	}
-	return alerts
-}
-
-// GetAlert returns a specific alert by its ID from the cache.
-func (c *AlertsCache) GetAlert(systemID, alertID string) (CachedAlertData, bool) {
-	if systemStore, ok := c.store.GetOk(systemID); ok {
-		return systemStore.GetOk(alertID)
-	}
-	return CachedAlertData{}, false
-}
-
-// GetAlertsByName returns all alerts of a specific type for the specified system.
-func (c *AlertsCache) GetAlertsByName(systemID, alertName string) []CachedAlertData {
-	allAlerts := c.GetSystemAlerts(systemID)
-	var alerts []CachedAlertData
-	for _, record := range allAlerts {
-		if record.Name == alertName {
-			alerts = append(alerts, record)
-		}
-	}
-	return alerts
-}
-
-// GetAlertsExcludingNames returns all alerts for the specified system excluding the given types.
-func (c *AlertsCache) GetAlertsExcludingNames(systemID string, excludedNames ...string) []CachedAlertData {
-	excludeMap := make(map[string]struct{})
-	for _, name := range excludedNames {
-		excludeMap[name] = struct{}{}
-	}
-	allAlerts := c.GetSystemAlerts(systemID)
-	var alerts []CachedAlertData
-	for _, record := range allAlerts {
-		if _, excluded := excludeMap[record.Name]; !excluded {
-			alerts = append(alerts, record)
-		}
-	}
-	return alerts
-}
-
-// Refresh returns the latest cached copy for an alert snapshot if it still exists.
-func (c *AlertsCache) Refresh(alert CachedAlertData) (CachedAlertData, bool) {
-	if alert.Id == "" {
-		return CachedAlertData{}, false
-	}
-	return c.GetAlert(alert.SystemID, alert.Id)
-}

internal/alerts/alerts_cache_test.go

@@ -1,215 +0,0 @@
-//go:build testing
-
-package alerts_test
-
-import (
-	"testing"
-
-	"github.com/henrygd/beszel/internal/alerts"
-	beszelTests "github.com/henrygd/beszel/internal/tests"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestSystemAlertsCachePopulateAndFilter(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	systems, err := beszelTests.CreateSystems(hub, 2, user.Id, "up")
-	require.NoError(t, err)
-	system1 := systems[0]
-	system2 := systems[1]
-
-	statusAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":   "Status",
-		"system": system1.Id,
-		"user":   user.Id,
-		"min":    1,
-	})
-	require.NoError(t, err)
-
-	cpuAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":   "CPU",
-		"system": system1.Id,
-		"user":   user.Id,
-		"value":  80,
-		"min":    1,
-	})
-	require.NoError(t, err)
-
-	memoryAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":   "Memory",
-		"system": system2.Id,
-		"user":   user.Id,
-		"value":  90,
-		"min":    1,
-	})
-	require.NoError(t, err)
-
-	cache := alerts.NewAlertsCache(hub)
-	cache.PopulateFromDB(false)
-
-	statusAlerts := cache.GetAlertsByName(system1.Id, "Status")
-	require.Len(t, statusAlerts, 1)
-	assert.Equal(t, statusAlert.Id, statusAlerts[0].Id)
-
-	nonStatusAlerts := cache.GetAlertsExcludingNames(system1.Id, "Status")
-	require.Len(t, nonStatusAlerts, 1)
-	assert.Equal(t, cpuAlert.Id, nonStatusAlerts[0].Id)
-
-	system2Alerts := cache.GetSystemAlerts(system2.Id)
-	require.Len(t, system2Alerts, 1)
-	assert.Equal(t, memoryAlert.Id, system2Alerts[0].Id)
-}
-
-func TestSystemAlertsCacheLazyLoadUpdateAndDelete(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
-	require.NoError(t, err)
-	systemRecord := systems[0]
-
-	statusAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":   "Status",
-		"system": systemRecord.Id,
-		"user":   user.Id,
-		"min":    1,
-	})
-	require.NoError(t, err)
-
-	cache := alerts.NewAlertsCache(hub)
-	require.Len(t, cache.GetSystemAlerts(systemRecord.Id), 1, "first lookup should lazy-load alerts for the system")
-
-	cpuAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":   "CPU",
-		"system": systemRecord.Id,
-		"user":   user.Id,
-		"value":  80,
-		"min":    1,
-	})
-	require.NoError(t, err)
-
-	cache.Update(cpuAlert)
-
-	nonStatusAlerts := cache.GetAlertsExcludingNames(systemRecord.Id, "Status")
-	require.Len(t, nonStatusAlerts, 1)
-	assert.Equal(t, cpuAlert.Id, nonStatusAlerts[0].Id)
-
-	cache.Delete(statusAlert)
-	assert.Empty(t, cache.GetAlertsByName(systemRecord.Id, "Status"), "deleted alerts should be removed from the in-memory cache")
-}
-
-func TestSystemAlertsCacheRefreshReturnsLatestCopy(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
-	require.NoError(t, err)
-	system := systems[0]
-
-	alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":      "Status",
-		"system":    system.Id,
-		"user":      user.Id,
-		"min":       1,
-		"triggered": false,
-	})
-	require.NoError(t, err)
-
-	cache := alerts.NewAlertsCache(hub)
-	snapshot := cache.GetSystemAlerts(system.Id)[0]
-	assert.False(t, snapshot.Triggered)
-
-	alert.Set("triggered", true)
-	require.NoError(t, hub.Save(alert))
-
-	refreshed, ok := cache.Refresh(snapshot)
-	require.True(t, ok)
-	assert.Equal(t, snapshot.Id, refreshed.Id)
-	assert.True(t, refreshed.Triggered, "refresh should return the updated cached value rather than the stale snapshot")
-
-	require.NoError(t, hub.Delete(alert))
-	_, ok = cache.Refresh(snapshot)
-	assert.False(t, ok, "refresh should report false when the cached alert no longer exists")
-}
-
-func TestAlertManagerCacheLifecycle(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
-	require.NoError(t, err)
-	system := systems[0]
-
-	// Create an alert
-	alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":   "CPU",
-		"system": system.Id,
-		"user":   user.Id,
-		"value":  80,
-		"min":    1,
-	})
-	require.NoError(t, err)
-
-	am := hub.AlertManager
-	cache := am.GetSystemAlertsCache()
-
-	// Verify it's in cache (it should be since CreateRecord triggers the event)
-	assert.Len(t, cache.GetSystemAlerts(system.Id), 1)
-	assert.Equal(t, alert.Id, cache.GetSystemAlerts(system.Id)[0].Id)
-	assert.EqualValues(t, 80, cache.GetSystemAlerts(system.Id)[0].Value)
-
-	// Update the alert through PocketBase to trigger events
-	alert.Set("value", 85)
-	require.NoError(t, hub.Save(alert))
-
-	// Check if updated value is reflected (or at least that it's still there)
-	cachedAlerts := cache.GetSystemAlerts(system.Id)
-	assert.Len(t, cachedAlerts, 1)
-	assert.EqualValues(t, 85, cachedAlerts[0].Value)
-
-	// Delete the alert through PocketBase to trigger events
-	require.NoError(t, hub.Delete(alert))
-
-	// Verify it's removed from cache
-	assert.Empty(t, cache.GetSystemAlerts(system.Id), "alert should be removed from cache after PocketBase delete")
-}
-
-// func TestAlertManagerCacheMovesAlertToNewSystemOnUpdate(t *testing.T) {
-// 	hub, user := beszelTests.GetHubWithUser(t)
-// 	defer hub.Cleanup()
-
-// 	systems, err := beszelTests.CreateSystems(hub, 2, user.Id, "up")
-// 	require.NoError(t, err)
-// 	system1 := systems[0]
-// 	system2 := systems[1]
-
-// 	alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-// 		"name":   "CPU",
-// 		"system": system1.Id,
-// 		"user":   user.Id,
-// 		"value":  80,
-// 		"min":    1,
-// 	})
-// 	require.NoError(t, err)
-
-// 	am := hub.AlertManager
-// 	cache := am.GetSystemAlertsCache()
-
-// 	// Initially in system1 cache
-// 	assert.Len(t, cache.Get(system1.Id), 1)
-// 	assert.Empty(t, cache.Get(system2.Id))
-
-// 	// Move alert to system2
-// 	alert.Set("system", system2.Id)
-// 	require.NoError(t, hub.Save(alert))
-
-// 	// DEBUG: print if it is found
-// 	// fmt.Printf("system1 alerts after update: %v\n", cache.Get(system1.Id))
-
-// 	// Should be removed from system1 and present in system2
-// 	assert.Empty(t, cache.GetType(system1.Id, "CPU"), "updated alerts should be evicted from the previous system cache")
-// 	require.Len(t, cache.Get(system2.Id), 1)
-// 	assert.Equal(t, alert.Id, cache.Get(system2.Id)[0].Id)
-// }

internal/alerts/alerts_disk_test.go

@@ -1,155 +0,0 @@
-//go:build testing
-
-package alerts_test
-
-import (
-	"encoding/json"
-	"testing"
-	"time"
-
-	"github.com/henrygd/beszel/internal/entities/system"
-	beszelTests "github.com/henrygd/beszel/internal/tests"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/tools/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestDiskAlertExtraFsMultiMinute tests that multi-minute disk alerts correctly use
-// historical per-minute values for extra (non-root) filesystems, not the current live snapshot.
-func TestDiskAlertExtraFsMultiMinute(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
-	require.NoError(t, err)
-	systemRecord := systems[0]
-
-	// Disk alert: threshold 80%, min=2 (requires historical averaging)
-	diskAlert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":   "Disk",
-		"system": systemRecord.Id,
-		"user":   user.Id,
-		"value":  80, // threshold: 80%
-		"min":    2,  // 2 minutes - requires historical averaging
-	})
-	require.NoError(t, err)
-	assert.False(t, diskAlert.GetBool("triggered"), "Alert should not be triggered initially")
-
-	am := hub.GetAlertManager()
-	now := time.Now().UTC()
-
-	extraFsHigh := map[string]*system.FsStats{
-		"/mnt/data": {DiskTotal: 1000, DiskUsed: 920}, // 92% - above threshold
-	}
-
-	// Insert 4 historical records spread over 3 minutes (same pattern as battery tests).
-	// The oldest record must predate (now - 2min) so the alert time window is valid.
-	recordTimes := []time.Duration{
-		-180 * time.Second, // 3 min ago - anchors oldest record before alert.time
-		-90 * time.Second,
-		-60 * time.Second,
-		-30 * time.Second,
-	}
-
-	for _, offset := range recordTimes {
-		stats := system.Stats{
-			DiskPct: 30, // root disk at 30% - below threshold
-			ExtraFs: extraFsHigh,
-		}
-		statsJSON, _ := json.Marshal(stats)
-
-		recordTime := now.Add(offset)
-		record, err := beszelTests.CreateRecord(hub, "system_stats", map[string]any{
-			"system": systemRecord.Id,
-			"type":   "1m",
-			"stats":  string(statsJSON),
-		})
-		require.NoError(t, err)
-		record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
-		err = hub.SaveNoValidate(record)
-		require.NoError(t, err)
-	}
-
-	combinedDataHigh := &system.CombinedData{
-		Stats: system.Stats{
-			DiskPct: 30,
-			ExtraFs: extraFsHigh,
-		},
-		Info: system.Info{
-			DiskPct: 30,
-		},
-	}
-
-	systemRecord.Set("updated", now)
-	err = hub.SaveNoValidate(systemRecord)
-	require.NoError(t, err)
-
-	err = am.HandleSystemAlerts(systemRecord, combinedDataHigh)
-	require.NoError(t, err)
-
-	time.Sleep(20 * time.Millisecond)
-
-	diskAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": diskAlert.Id})
-	require.NoError(t, err)
-	assert.True(t, diskAlert.GetBool("triggered"),
-		"Alert SHOULD be triggered when extra disk average (92%%) exceeds threshold (80%%)")
-
-	// --- Resolution: extra disk drops to 50%, alert should resolve ---
-
-	extraFsLow := map[string]*system.FsStats{
-		"/mnt/data": {DiskTotal: 1000, DiskUsed: 500}, // 50% - below threshold
-	}
-
-	newNow := now.Add(2 * time.Minute)
-	recordTimesLow := []time.Duration{
-		-180 * time.Second,
-		-90 * time.Second,
-		-60 * time.Second,
-		-30 * time.Second,
-	}
-
-	for _, offset := range recordTimesLow {
-		stats := system.Stats{
-			DiskPct: 30,
-			ExtraFs: extraFsLow,
-		}
-		statsJSON, _ := json.Marshal(stats)
-
-		recordTime := newNow.Add(offset)
-		record, err := beszelTests.CreateRecord(hub, "system_stats", map[string]any{
-			"system": systemRecord.Id,
-			"type":   "1m",
-			"stats":  string(statsJSON),
-		})
-		require.NoError(t, err)
-		record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
-		err = hub.SaveNoValidate(record)
-		require.NoError(t, err)
-	}
-
-	combinedDataLow := &system.CombinedData{
-		Stats: system.Stats{
-			DiskPct: 30,
-			ExtraFs: extraFsLow,
-		},
-		Info: system.Info{
-			DiskPct: 30,
-		},
-	}
-
-	systemRecord.Set("updated", newNow)
-	err = hub.SaveNoValidate(systemRecord)
-	require.NoError(t, err)
-
-	err = am.HandleSystemAlerts(systemRecord, combinedDataLow)
-	require.NoError(t, err)
-
-	time.Sleep(20 * time.Millisecond)
-
-	diskAlert, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": diskAlert.Id})
-	require.NoError(t, err)
-	assert.False(t, diskAlert.GetBool("triggered"),
-		"Alert should be resolved when extra disk average (50%%) drops below threshold (80%%)")
-}

internal/alerts/alerts_quiet_hours_test.go

@@ -49,7 +49,7 @@ func TestAlertSilencedOneTime(t *testing.T) {
 
 	// Get alert manager
 	am := alerts.NewAlertManager(hub)
-	defer am.Stop()
+	defer am.StopWorker()
 
 	// Test that alert is silenced
 	silenced := am.IsNotificationSilenced(user.Id, system.Id)
@@ -106,7 +106,7 @@ func TestAlertSilencedDaily(t *testing.T) {
 
 	// Get alert manager
 	am := alerts.NewAlertManager(hub)
-	defer am.Stop()
+	defer am.StopWorker()
 
 	// Get current hour and create a window that includes current time
 	now := time.Now().UTC()
@@ -170,7 +170,7 @@ func TestAlertSilencedDailyMidnightCrossing(t *testing.T) {
 
 	// Get alert manager
 	am := alerts.NewAlertManager(hub)
-	defer am.Stop()
+	defer am.StopWorker()
 
 	// Create a window that crosses midnight: 22:00 - 02:00
 	startTime := time.Date(2000, 1, 1, 22, 0, 0, 0, time.UTC)
@@ -211,7 +211,7 @@ func TestAlertSilencedGlobal(t *testing.T) {
 
 	// Get alert manager
 	am := alerts.NewAlertManager(hub)
-	defer am.Stop()
+	defer am.StopWorker()
 
 	// Create a global quiet hours window (no system specified)
 	now := time.Now().UTC()
@@ -250,7 +250,7 @@ func TestAlertSilencedSystemSpecific(t *testing.T) {
 
 	// Get alert manager
 	am := alerts.NewAlertManager(hub)
-	defer am.Stop()
+	defer am.StopWorker()
 
 	// Create a system-specific quiet hours window for system1 only
 	now := time.Now().UTC()
@@ -296,7 +296,7 @@ func TestAlertSilencedMultiUser(t *testing.T) {
 
 	// Get alert manager
 	am := alerts.NewAlertManager(hub)
-	defer am.Stop()
+	defer am.StopWorker()
 
 	// Create a quiet hours window for user1 only
 	now := time.Now().UTC()
@@ -417,7 +417,7 @@ func TestAlertSilencedNoWindows(t *testing.T) {
 
 	// Get alert manager
 	am := alerts.NewAlertManager(hub)
-	defer am.Stop()
+	defer am.StopWorker()
 
 	// Without any quiet hours windows, alert should NOT be silenced
 	silenced := am.IsNotificationSilenced(user.Id, system.Id)

internal/alerts/alerts_status.go

@@ -5,28 +5,67 @@ import (
 	"strings"
 	"time"
 
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 )
 
-type alertInfo struct {
+type alertTask struct {
+	action      string // "schedule" or "cancel"
 	systemName  string
-	alertData  CachedAlertData
-	expireTime time.Time
-	timer      *time.Timer
+	alertRecord *core.Record
+	delay       time.Duration
 }
 
-// Stop cancels all pending status alert timers.
-func (am *AlertManager) Stop() {
-	am.stopOnce.Do(func() {
-		am.pendingAlerts.Range(func(key, value any) bool {
-			info := value.(*alertInfo)
-			if info.timer != nil {
-				info.timer.Stop()
+type alertInfo struct {
+	systemName  string
+	alertRecord *core.Record
+	expireTime  time.Time
+}
+
+// startWorker is a long-running goroutine that processes alert tasks
+// every x seconds. It must be running to process status alerts.
+func (am *AlertManager) startWorker() {
+	processPendingAlerts := time.Tick(15 * time.Second)
+
+	// check for status alerts that are not resolved when system comes up
+	// (can be removed if we figure out core bug in #1052)
+	checkStatusAlerts := time.Tick(561 * time.Second)
+
+	for {
+		select {
+		case <-am.stopChan:
+			return
+		case task := <-am.alertQueue:
+			switch task.action {
+			case "schedule":
+				am.pendingAlerts.Store(task.alertRecord.Id, &alertInfo{
+					systemName:  task.systemName,
+					alertRecord: task.alertRecord,
+					expireTime:  time.Now().Add(task.delay),
+				})
+			case "cancel":
+				am.pendingAlerts.Delete(task.alertRecord.Id)
 			}
+		case <-checkStatusAlerts:
+			resolveStatusAlerts(am.hub)
+		case <-processPendingAlerts:
+			// Check for expired alerts every tick
+			now := time.Now()
+			for key, value := range am.pendingAlerts.Range {
+				info := value.(*alertInfo)
+				if now.After(info.expireTime) {
+					// Downtime delay has passed, process alert
+					am.sendStatusAlert("down", info.systemName, info.alertRecord)
 					am.pendingAlerts.Delete(key)
-			return true
-		})
-	})
+				}
+			}
+		}
+	}
+}
+
+// StopWorker shuts down the AlertManager.worker goroutine
+func (am *AlertManager) StopWorker() {
+	close(am.stopChan)
 }
 
 // HandleStatusAlerts manages the logic when system status changes.
@@ -35,116 +74,82 @@ func (am *AlertManager) HandleStatusAlerts(newStatus string, systemRecord *core.
 		return nil
 	}
 
-	alerts := am.alertsCache.GetAlertsByName(systemRecord.Id, "Status")
-	if len(alerts) == 0 {
+	alertRecords, err := am.getSystemStatusAlerts(systemRecord.Id)
+	if err != nil {
+		return err
+	}
+	if len(alertRecords) == 0 {
 		return nil
 	}
 
 	systemName := systemRecord.GetString("name")
 	if newStatus == "down" {
-		am.handleSystemDown(systemName, alerts)
+		am.handleSystemDown(systemName, alertRecords)
 	} else {
-		am.handleSystemUp(systemName, alerts)
+		am.handleSystemUp(systemName, alertRecords)
 	}
 	return nil
 }
 
-// handleSystemDown manages the logic when a system status changes to "down". It schedules pending alerts for each alert record.
-func (am *AlertManager) handleSystemDown(systemName string, alerts []CachedAlertData) {
-	for _, alertData := range alerts {
-		min := max(1, int(alertData.Min))
-		am.schedulePendingStatusAlert(systemName, alertData, time.Duration(min)*time.Minute)
+// getSystemStatusAlerts retrieves all "Status" alert records for a given system ID.
+func (am *AlertManager) getSystemStatusAlerts(systemID string) ([]*core.Record, error) {
+	alertRecords, err := am.hub.FindAllRecords("alerts", dbx.HashExp{
+		"system": systemID,
+		"name":   "Status",
+	})
+	if err != nil {
+		return nil, err
 	}
+	return alertRecords, nil
 }
 
-// schedulePendingStatusAlert sets up a timer to send a "down" alert after the specified delay if the system is still down.
-// It returns true if the alert was scheduled, or false if an alert was already pending for the given alert record.
-func (am *AlertManager) schedulePendingStatusAlert(systemName string, alertData CachedAlertData, delay time.Duration) bool {
-	alert := &alertInfo{
+// Schedules delayed "down" alerts for each alert record.
+func (am *AlertManager) handleSystemDown(systemName string, alertRecords []*core.Record) {
+	for _, alertRecord := range alertRecords {
+		// Continue if alert is already scheduled
+		if _, exists := am.pendingAlerts.Load(alertRecord.Id); exists {
+			continue
+		}
+		// Schedule by adding to queue
+		min := max(1, alertRecord.GetInt("min"))
+		am.alertQueue <- alertTask{
+			action:      "schedule",
 			systemName:  systemName,
-		alertData:  alertData,
-		expireTime: time.Now().Add(delay),
+			alertRecord: alertRecord,
+			delay:       time.Duration(min) * time.Minute,
 		}
-
-	storedAlert, loaded := am.pendingAlerts.LoadOrStore(alertData.Id, alert)
-	if loaded {
-		return false
 	}
-
-	stored := storedAlert.(*alertInfo)
-	stored.timer = time.AfterFunc(time.Until(stored.expireTime), func() {
-		am.processPendingAlert(alertData.Id)
-	})
-	return true
 }
 
 // handleSystemUp manages the logic when a system status changes to "up".
 // It cancels any pending alerts and sends "up" alerts.
-func (am *AlertManager) handleSystemUp(systemName string, alerts []CachedAlertData) {
-	for _, alertData := range alerts {
+func (am *AlertManager) handleSystemUp(systemName string, alertRecords []*core.Record) {
+	for _, alertRecord := range alertRecords {
+		alertRecordID := alertRecord.Id
 		// If alert exists for record, delete and continue (down alert not sent)
-		if am.cancelPendingAlert(alertData.Id) {
+		if _, exists := am.pendingAlerts.Load(alertRecordID); exists {
+			am.alertQueue <- alertTask{
+				action:      "cancel",
+				alertRecord: alertRecord,
+			}
 			continue
 		}
-		if !alertData.Triggered {
-			continue
-		}
-		if err := am.sendStatusAlert("up", systemName, alertData); err != nil {
+		// No alert scheduled for this record, send "up" alert
+		if err := am.sendStatusAlert("up", systemName, alertRecord); err != nil {
 			am.hub.Logger().Error("Failed to send alert", "err", err)
 		}
 	}
 }
 
-// cancelPendingAlert stops the timer and removes the pending alert for the given alert ID. Returns true if a pending alert was found and cancelled.
-func (am *AlertManager) cancelPendingAlert(alertID string) bool {
-	value, loaded := am.pendingAlerts.LoadAndDelete(alertID)
-	if !loaded {
-		return false
-	}
-
-	info := value.(*alertInfo)
-	if info.timer != nil {
-		info.timer.Stop()
-	}
-	return true
-}
-
-// CancelPendingStatusAlerts cancels all pending status alert timers for a given system.
-// This is called when a system is paused to prevent delayed alerts from firing.
-func (am *AlertManager) CancelPendingStatusAlerts(systemID string) {
-	am.pendingAlerts.Range(func(key, value any) bool {
-		info := value.(*alertInfo)
-		if info.alertData.SystemID == systemID {
-			am.cancelPendingAlert(key.(string))
-		}
-		return true
-	})
-}
-
-// processPendingAlert sends a "down" alert if the pending alert has expired and the system is still down.
-func (am *AlertManager) processPendingAlert(alertID string) {
-	value, loaded := am.pendingAlerts.LoadAndDelete(alertID)
-	if !loaded {
-		return
-	}
-
-	info := value.(*alertInfo)
-	refreshedAlertData, ok := am.alertsCache.Refresh(info.alertData)
-	if !ok || refreshedAlertData.Triggered {
-		return
-	}
-	if err := am.sendStatusAlert("down", info.systemName, refreshedAlertData); err != nil {
-		am.hub.Logger().Error("Failed to send alert", "err", err)
-	}
-}
-
 // sendStatusAlert sends a status alert ("up" or "down") to the users associated with the alert records.
-func (am *AlertManager) sendStatusAlert(alertStatus string, systemName string, alertData CachedAlertData) error {
-	// Update trigger state for alert record before sending alert
-	triggered := alertStatus == "down"
-	if err := am.setAlertTriggered(alertData, triggered); err != nil {
-		return err
+func (am *AlertManager) sendStatusAlert(alertStatus string, systemName string, alertRecord *core.Record) error {
+	switch alertStatus {
+	case "up":
+		alertRecord.Set("triggered", false)
+	case "down":
+		alertRecord.Set("triggered", true)
 	}
+	am.hub.Save(alertRecord)
 
 	var emoji string
 	if alertStatus == "up" {
@@ -157,10 +162,10 @@ func (am *AlertManager) sendStatusAlert(alertStatus string, systemName string, a
 	message := strings.TrimSuffix(title, emoji)
 
 	// Get system ID for the link
-	systemID := alertData.SystemID
+	systemID := alertRecord.GetString("system")
 
 	return am.SendAlert(AlertMessageData{
-		UserID:   alertData.UserID,
+		UserID:   alertRecord.GetString("user"),
 		SystemID: systemID,
 		Title:    title,
 		Message:  message,
@@ -169,8 +174,8 @@ func (am *AlertManager) sendStatusAlert(alertStatus string, systemName string, a
 	})
 }
 
-// resolveStatusAlerts resolves any triggered status alerts that weren't resolved
-// when system came up (https://github.com/henrygd/beszel/issues/1052).
+// resolveStatusAlerts resolves any status alerts that weren't resolved
+// when system came up (https://github.com/henrygd/beszel/issues/1052)
 func resolveStatusAlerts(app core.App) error {
 	db := app.DB()
 	// Find all active status alerts where the system is actually up
@@ -200,40 +205,3 @@ func resolveStatusAlerts(app core.App) error {
 	}
 	return nil
 }
-
-// restorePendingStatusAlerts re-queues untriggered status alerts for systems that
-// are still down after a hub restart. This rebuilds the lost in-memory timer state.
-func (am *AlertManager) restorePendingStatusAlerts() error {
-	type pendingStatusAlert struct {
-		AlertID    string `db:"alert_id"`
-		SystemID   string `db:"system_id"`
-		SystemName string `db:"system_name"`
-	}
-
-	var pending []pendingStatusAlert
-	err := am.hub.DB().NewQuery(`
-		SELECT a.id AS alert_id, a.system AS system_id, s.name AS system_name
-		FROM alerts a
-		JOIN systems s ON a.system = s.id
-		WHERE a.name = 'Status'
-		AND a.triggered = false
-		AND s.status = 'down'
-	`).All(&pending)
-	if err != nil {
-		return err
-	}
-
-	// Make sure cache is populated before trying to restore pending alerts
-	_ = am.alertsCache.PopulateFromDB(false)
-
-	for _, item := range pending {
-		alertData, ok := am.alertsCache.GetAlert(item.SystemID, item.AlertID)
-		if !ok {
-			continue
-		}
-		min := max(1, int(alertData.Min))
-		am.schedulePendingStatusAlert(item.SystemName, alertData, time.Duration(min)*time.Minute)
-	}
-
-	return nil
-}

internal/alerts/alerts_system.go

@@ -11,11 +11,15 @@ import (
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/spf13/cast"
 )
 
 func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *system.CombinedData) error {
-	alerts := am.alertsCache.GetAlertsExcludingNames(systemRecord.Id, "Status")
-	if len(alerts) == 0 {
+	alertRecords, err := am.hub.FindAllRecords("alerts",
+		dbx.NewExp("system={:system} AND name!='Status'", dbx.Params{"system": systemRecord.Id}),
+	)
+	if err != nil || len(alertRecords) == 0 {
+		// log.Println("no alerts found for system")
 		return nil
 	}
 
@@ -23,8 +27,8 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 	now := systemRecord.GetDateTime("updated").Time().UTC()
 	oldestTime := now
 
-	for _, alertData := range alerts {
-		name := alertData.Name
+	for _, alertRecord := range alertRecords {
+		name := alertRecord.GetString("name")
 		var val float64
 		unit := "%"
 
@@ -69,8 +73,8 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 			val = float64(data.Stats.Battery[0])
 		}
 
-		triggered := alertData.Triggered
-		threshold := alertData.Value
+		triggered := alertRecord.GetBool("triggered")
+		threshold := alertRecord.GetFloat("value")
 
 		// Battery alert has inverted logic: trigger when value is BELOW threshold
 		lowAlert := isLowAlert(name)
@@ -88,11 +92,11 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 			}
 		}
 
-		min := max(1, alertData.Min)
+		min := max(1, cast.ToUint8(alertRecord.Get("min")))
 
 		alert := SystemAlertData{
 			systemRecord: systemRecord,
-			alertData:    alertData,
+			alertRecord:  alertRecord,
 			name:         name,
 			unit:         unit,
 			val:          val,
@@ -125,7 +129,7 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 		Created types.DateTime `db:"created"`
 	}{}
 
-	err := am.hub.DB().
+	err = am.hub.DB().
 		Select("stats", "created").
 		From("system_stats").
 		Where(dbx.NewExp(
@@ -188,25 +192,23 @@ func (am *AlertManager) HandleSystemAlerts(systemRecord *core.Record, data *syst
 			case "Memory":
 				alert.val += stats.Mem
 			case "Bandwidth":
-				alert.val += float64(stats.Bandwidth[0]+stats.Bandwidth[1]) / (1024 * 1024)
+				alert.val += stats.NetSent + stats.NetRecv
 			case "Disk":
 				if alert.mapSums == nil {
-					alert.mapSums = make(map[string]float32, len(stats.ExtraFs)+1)
+					alert.mapSums = make(map[string]float32, len(data.Stats.ExtraFs)+1)
 				}
 				// add root disk
 				if _, ok := alert.mapSums["root"]; !ok {
 					alert.mapSums["root"] = 0.0
 				}
 				alert.mapSums["root"] += float32(stats.Disk)
-				// add extra disks from historical record
-				for key, fs := range stats.ExtraFs {
-					if fs.DiskTotal > 0 {
+				// add extra disks
+				for key, fs := range data.Stats.ExtraFs {
 					if _, ok := alert.mapSums[key]; !ok {
 						alert.mapSums[key] = 0.0
 					}
 					alert.mapSums[key] += float32(fs.DiskUsed / fs.DiskTotal * 100)
 				}
-				}
 			case "Temperature":
 				if alert.mapSums == nil {
 					alert.mapSums = make(map[string]float32, len(stats.Temperatures))
@@ -340,12 +342,13 @@ func (am *AlertManager) sendSystemAlert(alert SystemAlertData) {
 	}
 	body := fmt.Sprintf("%s averaged %.2f%s for the previous %v %s.", alert.descriptor, alert.val, alert.unit, alert.min, minutesLabel)
 
-	if err := am.setAlertTriggered(alert.alertData, alert.triggered); err != nil {
+	alert.alertRecord.Set("triggered", alert.triggered)
+	if err := am.hub.Save(alert.alertRecord); err != nil {
 		// app.Logger().Error("failed to save alert record", "err", err)
 		return
 	}
 	am.SendAlert(AlertMessageData{
-		UserID:   alert.alertData.UserID,
+		UserID:   alert.alertRecord.GetString("user"),
 		SystemID: alert.systemRecord.Id,
 		Title:    subject,
 		Message:  body,

internal/alerts/alerts_system_test.go

@@ -1,218 +0,0 @@
-//go:build testing
-
-package alerts_test
-
-import (
-	"testing"
-	"testing/synctest"
-	"time"
-
-	"github.com/henrygd/beszel/internal/entities/system"
-	beszelTests "github.com/henrygd/beszel/internal/tests"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type systemAlertValueSetter[T any] func(info *system.Info, stats *system.Stats, value T)
-
-type systemAlertTestFixture struct {
-	hub     *beszelTests.TestHub
-	alertID string
-	submit  func(*system.CombinedData) error
-}
-
-func createCombinedData[T any](value T, setValue systemAlertValueSetter[T]) *system.CombinedData {
-	var data system.CombinedData
-	setValue(&data.Info, &data.Stats, value)
-	return &data
-}
-
-func newSystemAlertTestFixture(t *testing.T, alertName string, min int, threshold float64) *systemAlertTestFixture {
-	t.Helper()
-
-	hub, user := beszelTests.GetHubWithUser(t)
-
-	systems, err := beszelTests.CreateSystems(hub, 1, user.Id, "up")
-	require.NoError(t, err)
-	systemRecord := systems[0]
-
-	sysManagerSystem, err := hub.GetSystemManager().GetSystemFromStore(systemRecord.Id)
-	require.NoError(t, err)
-	require.NotNil(t, sysManagerSystem)
-	sysManagerSystem.StopUpdater()
-
-	userSettings, err := hub.FindFirstRecordByFilter("user_settings", "user={:user}", map[string]any{"user": user.Id})
-	require.NoError(t, err)
-	userSettings.Set("settings", `{"emails":["test@example.com"],"webhooks":[]}`)
-	require.NoError(t, hub.Save(userSettings))
-
-	alertRecord, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":   alertName,
-		"system": systemRecord.Id,
-		"user":   user.Id,
-		"min":    min,
-		"value":  threshold,
-	})
-	require.NoError(t, err)
-
-	assert.False(t, alertRecord.GetBool("triggered"), "Alert should not be triggered initially")
-
-	alertsCache := hub.GetAlertManager().GetSystemAlertsCache()
-	cachedAlerts := alertsCache.GetAlertsExcludingNames(systemRecord.Id, "Status")
-	assert.Len(t, cachedAlerts, 1, "Alert should be in cache")
-
-	return &systemAlertTestFixture{
-		hub:     hub,
-		alertID: alertRecord.Id,
-		submit: func(data *system.CombinedData) error {
-			_, err := sysManagerSystem.CreateRecords(data)
-			return err
-		},
-	}
-}
-
-func (fixture *systemAlertTestFixture) cleanup() {
-	fixture.hub.Cleanup()
-}
-
-func submitValue[T any](fixture *systemAlertTestFixture, t *testing.T, value T, setValue systemAlertValueSetter[T]) {
-	t.Helper()
-	require.NoError(t, fixture.submit(createCombinedData(value, setValue)))
-}
-
-func (fixture *systemAlertTestFixture) assertTriggered(t *testing.T, triggered bool, message string) {
-	t.Helper()
-
-	alertRecord, err := fixture.hub.FindRecordById("alerts", fixture.alertID)
-	require.NoError(t, err)
-	assert.Equal(t, triggered, alertRecord.GetBool("triggered"), message)
-}
-
-func waitForSystemAlert(d time.Duration) {
-	time.Sleep(d)
-	synctest.Wait()
-}
-
-func testOneMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, setValue systemAlertValueSetter[T], triggerValue, resolveValue T) {
-	t.Helper()
-
-	synctest.Test(t, func(t *testing.T) {
-		fixture := newSystemAlertTestFixture(t, alertName, 1, threshold)
-		defer fixture.cleanup()
-
-		submitValue(fixture, t, triggerValue, setValue)
-		waitForSystemAlert(time.Second)
-
-		fixture.assertTriggered(t, true, "Alert should be triggered")
-		assert.Equal(t, 1, fixture.hub.TestMailer.TotalSend(), "An email should have been sent")
-
-		submitValue(fixture, t, resolveValue, setValue)
-		waitForSystemAlert(time.Second)
-
-		fixture.assertTriggered(t, false, "Alert should be untriggered")
-		assert.Equal(t, 2, fixture.hub.TestMailer.TotalSend(), "A second email should have been sent for untriggering the alert")
-
-		waitForSystemAlert(time.Minute)
-	})
-}
-
-func testMultiMinuteSystemAlert[T any](t *testing.T, alertName string, threshold float64, min int, setValue systemAlertValueSetter[T], baselineValue, triggerValue, resolveValue T) {
-	t.Helper()
-
-	synctest.Test(t, func(t *testing.T) {
-		fixture := newSystemAlertTestFixture(t, alertName, min, threshold)
-		defer fixture.cleanup()
-
-		submitValue(fixture, t, baselineValue, setValue)
-		waitForSystemAlert(time.Minute + time.Second)
-		fixture.assertTriggered(t, false, "Alert should not be triggered yet")
-
-		submitValue(fixture, t, triggerValue, setValue)
-		waitForSystemAlert(time.Minute)
-		fixture.assertTriggered(t, false, "Alert should not be triggered until the history window is full")
-
-		submitValue(fixture, t, triggerValue, setValue)
-		waitForSystemAlert(time.Second)
-		fixture.assertTriggered(t, true, "Alert should be triggered")
-		assert.Equal(t, 1, fixture.hub.TestMailer.TotalSend(), "An email should have been sent")
-
-		submitValue(fixture, t, resolveValue, setValue)
-		waitForSystemAlert(time.Second)
-		fixture.assertTriggered(t, false, "Alert should be untriggered")
-		assert.Equal(t, 2, fixture.hub.TestMailer.TotalSend(), "A second email should have been sent for untriggering the alert")
-	})
-}
-
-func setCPUAlertValue(info *system.Info, stats *system.Stats, value float64) {
-	info.Cpu = value
-	stats.Cpu = value
-}
-
-func setMemoryAlertValue(info *system.Info, stats *system.Stats, value float64) {
-	info.MemPct = value
-	stats.MemPct = value
-}
-
-func setDiskAlertValue(info *system.Info, stats *system.Stats, value float64) {
-	info.DiskPct = value
-	stats.DiskPct = value
-}
-
-func setBandwidthAlertValue(info *system.Info, stats *system.Stats, value [2]uint64) {
-	info.BandwidthBytes = value[0] + value[1]
-	stats.Bandwidth = value
-}
-
-func megabytesToBytes(mb uint64) uint64 {
-	return mb * 1024 * 1024
-}
-
-func setGPUAlertValue(info *system.Info, stats *system.Stats, value float64) {
-	info.GpuPct = value
-	stats.GPUData = map[string]system.GPUData{
-		"GPU0": {Usage: value},
-	}
-}
-
-func setTemperatureAlertValue(info *system.Info, stats *system.Stats, value float64) {
-	info.DashboardTemp = value
-	stats.Temperatures = map[string]float64{
-		"Temp0": value,
-	}
-}
-
-func setLoadAvgAlertValue(info *system.Info, stats *system.Stats, value [3]float64) {
-	info.LoadAvg = value
-	stats.LoadAvg = value
-}
-
-func setBatteryAlertValue(info *system.Info, stats *system.Stats, value [2]uint8) {
-	info.Battery = value
-	stats.Battery = value
-}
-
-func TestSystemAlertsOneMin(t *testing.T) {
-	testOneMinuteSystemAlert(t, "CPU", 50, setCPUAlertValue, 51, 49)
-	testOneMinuteSystemAlert(t, "Memory", 50, setMemoryAlertValue, 51, 49)
-	testOneMinuteSystemAlert(t, "Disk", 50, setDiskAlertValue, 51, 49)
-	testOneMinuteSystemAlert(t, "Bandwidth", 50, setBandwidthAlertValue, [2]uint64{megabytesToBytes(26), megabytesToBytes(25)}, [2]uint64{megabytesToBytes(25), megabytesToBytes(24)})
-	testOneMinuteSystemAlert(t, "GPU", 50, setGPUAlertValue, 51, 49)
-	testOneMinuteSystemAlert(t, "Temperature", 70, setTemperatureAlertValue, 71, 69)
-	testOneMinuteSystemAlert(t, "LoadAvg1", 4, setLoadAvgAlertValue, [3]float64{4.1, 0, 0}, [3]float64{3.9, 0, 0})
-	testOneMinuteSystemAlert(t, "LoadAvg5", 4, setLoadAvgAlertValue, [3]float64{0, 4.1, 0}, [3]float64{0, 3.9, 0})
-	testOneMinuteSystemAlert(t, "LoadAvg15", 4, setLoadAvgAlertValue, [3]float64{0, 0, 4.1}, [3]float64{0, 0, 3.9})
-	testOneMinuteSystemAlert(t, "Battery", 20, setBatteryAlertValue, [2]uint8{19, 0}, [2]uint8{21, 0})
-}
-
-func TestSystemAlertsTwoMin(t *testing.T) {
-	testMultiMinuteSystemAlert(t, "CPU", 50, 2, setCPUAlertValue, 10, 51, 48)
-	testMultiMinuteSystemAlert(t, "Memory", 50, 2, setMemoryAlertValue, 10, 51, 48)
-	testMultiMinuteSystemAlert(t, "Disk", 50, 2, setDiskAlertValue, 10, 51, 48)
-	testMultiMinuteSystemAlert(t, "Bandwidth", 50, 2, setBandwidthAlertValue, [2]uint64{megabytesToBytes(10), megabytesToBytes(10)}, [2]uint64{megabytesToBytes(26), megabytesToBytes(25)}, [2]uint64{megabytesToBytes(10), megabytesToBytes(10)})
-	testMultiMinuteSystemAlert(t, "GPU", 50, 2, setGPUAlertValue, 10, 51, 48)
-	testMultiMinuteSystemAlert(t, "Temperature", 70, 2, setTemperatureAlertValue, 10, 71, 67)
-	testMultiMinuteSystemAlert(t, "LoadAvg1", 4, 2, setLoadAvgAlertValue, [3]float64{0, 0, 0}, [3]float64{4.1, 0, 0}, [3]float64{3.5, 0, 0})
-	testMultiMinuteSystemAlert(t, "LoadAvg5", 4, 2, setLoadAvgAlertValue, [3]float64{0, 2, 0}, [3]float64{0, 4.1, 0}, [3]float64{0, 3.5, 0})
-	testMultiMinuteSystemAlert(t, "LoadAvg15", 4, 2, setLoadAvgAlertValue, [3]float64{0, 0, 2}, [3]float64{0, 0, 4.1}, [3]float64{0, 0, 3.5})
-	testMultiMinuteSystemAlert(t, "Battery", 20, 2, setBatteryAlertValue, [2]uint8{21, 0}, [2]uint8{19, 0}, [2]uint8{25, 1})
-}

internal/alerts/alerts_test.go

@@ -3,17 +3,453 @@
 package alerts_test
 
 import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
 	"testing"
 	"testing/synctest"
 	"time"
 
+	"github.com/henrygd/beszel/internal/alerts"
 	beszelTests "github.com/henrygd/beszel/internal/tests"
 
-	"github.com/henrygd/beszel/internal/alerts"
 	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	pbTests "github.com/pocketbase/pocketbase/tests"
 	"github.com/stretchr/testify/assert"
 )
 
+// marshal to json and return an io.Reader (for use in ApiScenario.Body)
+func jsonReader(v any) io.Reader {
+	data, err := json.Marshal(v)
+	if err != nil {
+		panic(err)
+	}
+	return bytes.NewReader(data)
+}
+
+func TestUserAlertsApi(t *testing.T) {
+	hub, _ := beszelTests.NewTestHub(t.TempDir())
+	defer hub.Cleanup()
+
+	hub.StartHub()
+
+	user1, _ := beszelTests.CreateUser(hub, "alertstest@example.com", "password")
+	user1Token, _ := user1.NewAuthToken()
+
+	user2, _ := beszelTests.CreateUser(hub, "alertstest2@example.com", "password")
+	user2Token, _ := user2.NewAuthToken()
+
+	system1, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "system1",
+		"users": []string{user1.Id},
+		"host":  "127.0.0.1",
+	})
+
+	system2, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "system2",
+		"users": []string{user1.Id, user2.Id},
+		"host":  "127.0.0.2",
+	})
+
+	userRecords, _ := hub.CountRecords("users")
+	assert.EqualValues(t, 2, userRecords, "all users should be created")
+
+	systemRecords, _ := hub.CountRecords("systems")
+	assert.EqualValues(t, 2, systemRecords, "all systems should be created")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		// {
+		// 	Name:            "GET not implemented - returns index",
+		// 	Method:          http.MethodGet,
+		// 	URL:             "/api/beszel/user-alerts",
+		// 	ExpectedStatus:  200,
+		// 	ExpectedContent: []string{"<html ", "globalThis.BESZEL"},
+		// 	TestAppFactory:  testAppFactory,
+		// },
+		{
+			Name:            "POST no auth",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST no body",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST bad data",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"invalidField": "this should cause validation error",
+				"threshold":    "not a number",
+			}),
+		},
+		{
+			Name:   "POST malformed JSON",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+			Body:            strings.NewReader(`{"alertType": "cpu", "threshold": 80, "enabled": true,}`),
+		},
+		{
+			Name:   "POST valid alert data multiple systems",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     69,
+				"min":       9,
+				"systems":   []string{system1.Id, system2.Id},
+				"overwrite": false,
+			}),
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				// check total alerts
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+				// check alert has correct values
+				matchingAlerts, _ := app.CountRecords("alerts", dbx.HashExp{"name": "CPU", "user": user1.Id, "system": system1.Id, "value": 69, "min": 9})
+				assert.EqualValues(t, 1, matchingAlerts, "should have 1 alert")
+			},
+		},
+		{
+			Name:   "POST valid alert data single system",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "Memory",
+				"systems": []string{system1.Id},
+				"value":   90,
+				"min":     10,
+			}),
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				user1Alerts, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
+			},
+		},
+		{
+			Name:   "Overwrite: false, should not overwrite existing alert",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     45,
+				"min":       5,
+				"systems":   []string{system1.Id},
+				"overwrite": false,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user1.Id})
+				assert.EqualValues(t, 80, alert.Get("value"), "should have 80 as value")
+			},
+		},
+		{
+			Name:   "Overwrite: true, should overwrite existing alert",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     45,
+				"min":       5,
+				"systems":   []string{system2.Id},
+				"overwrite": true,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system2.Id,
+					"user":   user2.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user2.Id})
+				assert.EqualValues(t, 45, alert.Get("value"), "should have 45 as value")
+			},
+		},
+		{
+			Name:            "DELETE no auth",
+			Method:          http.MethodDelete,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+			},
+		},
+		{
+			Name:   "DELETE alert",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts, "should have 0 alerts")
+			},
+		},
+		{
+			Name:   "DELETE alert multiple systems",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":2", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "Memory",
+				"systems": []string{system1.Id, system2.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				for _, systemId := range []string{system1.Id, system2.Id} {
+					_, err := beszelTests.CreateRecord(app, "alerts", map[string]any{
+						"name":   "Memory",
+						"system": systemId,
+						"user":   user1.Id,
+						"value":  90,
+						"min":    10,
+					})
+					assert.NoError(t, err, "should create alert")
+				}
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts, "should have 0 alerts")
+			},
+		},
+		{
+			Name:   "User 2 should not be able to delete alert of user 1",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system2.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				for _, user := range []string{user1.Id, user2.Id} {
+					beszelTests.CreateRecord(app, "alerts", map[string]any{
+						"name":   "CPU",
+						"system": system2.Id,
+						"user":   user,
+						"value":  80,
+						"min":    10,
+					})
+				}
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
+				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
+				assert.EqualValues(t, 1, user2AlertCount, "should have 1 alert")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
+				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
+				assert.Zero(t, user2AlertCount, "should have 0 alerts")
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestStatusAlerts(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		hub, user := beszelTests.GetHubWithUser(t)
+		defer hub.Cleanup()
+
+		systems, err := beszelTests.CreateSystems(hub, 4, user.Id, "paused")
+		assert.NoError(t, err)
+
+		var alerts []*core.Record
+		for i, system := range systems {
+			alert, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+				"name":   "Status",
+				"system": system.Id,
+				"user":   user.Id,
+				"min":    i + 1,
+			})
+			assert.NoError(t, err)
+			alerts = append(alerts, alert)
+		}
+
+		time.Sleep(10 * time.Millisecond)
+
+		for _, alert := range alerts {
+			assert.False(t, alert.GetBool("triggered"), "Alert should not be triggered immediately")
+		}
+		if hub.TestMailer.TotalSend() != 0 {
+			assert.Zero(t, hub.TestMailer.TotalSend(), "Expected 0 messages, got %d", hub.TestMailer.TotalSend())
+		}
+		for _, system := range systems {
+			assert.EqualValues(t, "paused", system.GetString("status"), "System should be paused")
+		}
+		for _, system := range systems {
+			system.Set("status", "up")
+			err = hub.SaveNoValidate(system)
+			assert.NoError(t, err)
+		}
+		time.Sleep(time.Second)
+		assert.EqualValues(t, 0, hub.GetPendingAlertsCount(), "should have 0 alerts in the pendingAlerts map")
+		for _, system := range systems {
+			system.Set("status", "down")
+			err = hub.SaveNoValidate(system)
+			assert.NoError(t, err)
+		}
+		// after 30 seconds, should have 4 alerts in the pendingAlerts map, no triggered alerts
+		time.Sleep(time.Second * 30)
+		assert.EqualValues(t, 4, hub.GetPendingAlertsCount(), "should have 4 alerts in the pendingAlerts map")
+		triggeredCount, err := hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 0, triggeredCount, "should have 0 alert triggered")
+		assert.EqualValues(t, 0, hub.TestMailer.TotalSend(), "should have 0 messages sent")
+		// after 1:30 seconds, should have 1 triggered alert and 3 pending alerts
+		time.Sleep(time.Second * 60)
+		assert.EqualValues(t, 3, hub.GetPendingAlertsCount(), "should have 3 alerts in the pendingAlerts map")
+		triggeredCount, err = hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 1, triggeredCount, "should have 1 alert triggered")
+		assert.EqualValues(t, 1, hub.TestMailer.TotalSend(), "should have 1 messages sent")
+		// after 2:30 seconds, should have 2 triggered alerts and 2 pending alerts
+		time.Sleep(time.Second * 60)
+		assert.EqualValues(t, 2, hub.GetPendingAlertsCount(), "should have 2 alerts in the pendingAlerts map")
+		triggeredCount, err = hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+		assert.NoError(t, err)
+		assert.EqualValues(t, 2, triggeredCount, "should have 2 alert triggered")
+		assert.EqualValues(t, 2, hub.TestMailer.TotalSend(), "should have 2 messages sent")
+		// now we will bring the remaning systems back up
+		for _, system := range systems {
+			system.Set("status", "up")
+			err = hub.SaveNoValidate(system)
+			assert.NoError(t, err)
+		}
+		time.Sleep(time.Second)
+		// should have 0 alerts in the pendingAlerts map and 0 alerts triggered
+		assert.EqualValues(t, 0, hub.GetPendingAlertsCount(), "should have 0 alerts in the pendingAlerts map")
+		triggeredCount, err = hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+		assert.NoError(t, err)
+		assert.Zero(t, triggeredCount, "should have 0 alert triggered")
+		// 4 messages sent, 2 down alerts and 2 up alerts for first 2 systems
+		assert.EqualValues(t, 4, hub.TestMailer.TotalSend(), "should have 4 messages sent")
+	})
+}
+
 func TestAlertsHistory(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
 		hub, user := beszelTests.GetHubWithUser(t)
@@ -142,46 +578,102 @@ func TestAlertsHistory(t *testing.T) {
 		assert.EqualValues(t, 2, totalHistoryCount, "Should have 2 total alert history records")
 	})
 }
-
-func TestSetAlertTriggered(t *testing.T) {
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
+func TestResolveStatusAlerts(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
 	defer hub.Cleanup()
 
-	hub.StartHub()
-
-	user, _ := beszelTests.CreateUser(hub, "test@example.com", "password")
-	system, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+	// Create a systemUp
+	systemUp, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
 		"name":   "test-system",
 		"users":  []string{user.Id},
 		"host":   "127.0.0.1",
+		"status": "up",
 	})
+	assert.NoError(t, err)
 
-	alertRecord, _ := beszelTests.CreateRecord(hub, "alerts", map[string]any{
-		"name":      "CPU",
-		"system":    system.Id,
+	systemDown, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system-2",
+		"users":  []string{user.Id},
+		"host":   "127.0.0.2",
+		"status": "up",
+	})
+	assert.NoError(t, err)
+
+	// Create a status alertUp for the system
+	alertUp, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "Status",
+		"system": systemUp.Id,
 		"user":   user.Id,
-		"value":     80,
-		"triggered": false,
+		"min":    1,
 	})
-
-	am := alerts.NewAlertManager(hub)
-
-	var alert alerts.CachedAlertData
-	alert.PopulateFromRecord(alertRecord)
-
-	// Test triggering the alert
-	err := am.SetAlertTriggered(alert, true)
 	assert.NoError(t, err)
 
-	updatedRecord, err := hub.FindRecordById("alerts", alert.Id)
-	assert.NoError(t, err)
-	assert.True(t, updatedRecord.GetBool("triggered"))
-
-	// Test un-triggering the alert
-	err = am.SetAlertTriggered(alert, false)
+	alertDown, err := beszelTests.CreateRecord(hub, "alerts", map[string]any{
+		"name":   "Status",
+		"system": systemDown.Id,
+		"user":   user.Id,
+		"min":    1,
+	})
 	assert.NoError(t, err)
 
-	updatedRecord, err = hub.FindRecordById("alerts", alert.Id)
+	// Verify alert is not triggered initially
+	assert.False(t, alertUp.GetBool("triggered"), "Alert should not be triggered initially")
+
+	// Set the system to 'up' (this should not trigger the alert)
+	systemUp.Set("status", "up")
+	err = hub.SaveNoValidate(systemUp)
 	assert.NoError(t, err)
-	assert.False(t, updatedRecord.GetBool("triggered"))
+
+	systemDown.Set("status", "down")
+	err = hub.SaveNoValidate(systemDown)
+	assert.NoError(t, err)
+
+	// Wait a moment for any processing
+	time.Sleep(10 * time.Millisecond)
+
+	// Verify alertUp is still not triggered after setting system to up
+	alertUp, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alertUp.Id})
+	assert.NoError(t, err)
+	assert.False(t, alertUp.GetBool("triggered"), "Alert should not be triggered when system is up")
+
+	// Manually set both alerts triggered to true
+	alertUp.Set("triggered", true)
+	err = hub.SaveNoValidate(alertUp)
+	assert.NoError(t, err)
+	alertDown.Set("triggered", true)
+	err = hub.SaveNoValidate(alertDown)
+	assert.NoError(t, err)
+
+	// Verify we have exactly one alert with triggered true
+	triggeredCount, err := hub.CountRecords("alerts", dbx.HashExp{"triggered": true})
+	assert.NoError(t, err)
+	assert.EqualValues(t, 2, triggeredCount, "Should have exactly two alerts with triggered true")
+
+	// Verify the specific alertUp is triggered
+	alertUp, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alertUp.Id})
+	assert.NoError(t, err)
+	assert.True(t, alertUp.GetBool("triggered"), "Alert should be triggered")
+
+	// Verify we have two unresolved alert history records
+	alertHistoryCount, err := hub.CountRecords("alerts_history", dbx.HashExp{"resolved": ""})
+	assert.NoError(t, err)
+	assert.EqualValues(t, 2, alertHistoryCount, "Should have exactly two unresolved alert history records")
+
+	err = alerts.ResolveStatusAlerts(hub)
+	assert.NoError(t, err)
+
+	// Verify alertUp is not triggered after resolving
+	alertUp, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alertUp.Id})
+	assert.NoError(t, err)
+	assert.False(t, alertUp.GetBool("triggered"), "Alert should not be triggered after resolving")
+	// Verify alertDown is still triggered
+	alertDown, err = hub.FindFirstRecordByFilter("alerts", "id={:id}", dbx.Params{"id": alertDown.Id})
+	assert.NoError(t, err)
+	assert.True(t, alertDown.GetBool("triggered"), "Alert should still be triggered after resolving")
+
+	// Verify we have one unresolved alert history record
+	alertHistoryCount, err = hub.CountRecords("alerts_history", dbx.HashExp{"resolved": ""})
+	assert.NoError(t, err)
+	assert.EqualValues(t, 1, alertHistoryCount, "Should have exactly one unresolved alert history record")
+
 }

internal/alerts/alerts_test_helpers.go

@@ -9,18 +9,6 @@ import (
 	"github.com/pocketbase/pocketbase/core"
 )
 
-func NewTestAlertManagerWithoutWorker(app hubLike) *AlertManager {
-	return &AlertManager{
-		hub:         app,
-		alertsCache: NewAlertsCache(app),
-	}
-}
-
-// GetSystemAlertsCache returns the internal system alerts cache.
-func (am *AlertManager) GetSystemAlertsCache() *AlertsCache {
-	return am.alertsCache
-}
-
 func (am *AlertManager) GetAlertManager() *AlertManager {
 	return am
 }
@@ -39,18 +27,19 @@ func (am *AlertManager) GetPendingAlertsCount() int {
 }
 
 // ProcessPendingAlerts manually processes all expired alerts (for testing)
-func (am *AlertManager) ProcessPendingAlerts() ([]CachedAlertData, error) {
+func (am *AlertManager) ProcessPendingAlerts() ([]*core.Record, error) {
 	now := time.Now()
 	var lastErr error
-	var processedAlerts []CachedAlertData
+	var processedAlerts []*core.Record
 	am.pendingAlerts.Range(func(key, value any) bool {
 		info := value.(*alertInfo)
 		if now.After(info.expireTime) {
-			if info.timer != nil {
-				info.timer.Stop()
+			// Downtime delay has passed, process alert
+			if err := am.sendStatusAlert("down", info.systemName, info.alertRecord); err != nil {
+				lastErr = err
 			}
-			am.processPendingAlert(key.(string))
-			processedAlerts = append(processedAlerts, info.alertData)
+			processedAlerts = append(processedAlerts, info.alertRecord)
+			am.pendingAlerts.Delete(key)
 		}
 		return true
 	})
@@ -67,35 +56,6 @@ func (am *AlertManager) ForceExpirePendingAlerts() {
 	})
 }
 
-func (am *AlertManager) ResetPendingAlertTimer(alertID string, delay time.Duration) bool {
-	value, loaded := am.pendingAlerts.Load(alertID)
-	if !loaded {
-		return false
-	}
-
-	info := value.(*alertInfo)
-	if info.timer != nil {
-		info.timer.Stop()
-	}
-	info.expireTime = time.Now().Add(delay)
-	info.timer = time.AfterFunc(delay, func() {
-		am.processPendingAlert(alertID)
-	})
-	return true
-}
-
 func ResolveStatusAlerts(app core.App) error {
 	return resolveStatusAlerts(app)
 }
-
-func (am *AlertManager) RestorePendingStatusAlerts() error {
-	return am.restorePendingStatusAlerts()
-}
-
-func (am *AlertManager) SetAlertTriggered(alert CachedAlertData, triggered bool) error {
-	return am.setAlertTriggered(alert, triggered)
-}
-
-func IsInternalURL(rawURL string) (bool, error) {
-	return isInternalURL(rawURL)
-}

internal/cmd/agent/agent.go

@@ -9,7 +9,6 @@ import (
 	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/agent"
 	"github.com/henrygd/beszel/agent/health"
-	"github.com/henrygd/beszel/agent/utils"
 	"github.com/spf13/pflag"
 	"golang.org/x/crypto/ssh"
 )
@@ -117,12 +116,12 @@ func (opts *cmdOptions) loadPublicKeys() ([]ssh.PublicKey, error) {
 	}
 
 	// Try environment variable
-	if key, ok := utils.GetEnv("KEY"); ok && key != "" {
+	if key, ok := agent.GetEnv("KEY"); ok && key != "" {
 		return agent.ParseKeys(key)
 	}
 
 	// Try key file
-	keyFile, ok := utils.GetEnv("KEY_FILE")
+	keyFile, ok := agent.GetEnv("KEY_FILE")
 	if !ok {
 		return nil, fmt.Errorf("no key provided: must set -key flag, KEY env var, or KEY_FILE env var. Use 'beszel-agent help' for usage")
 	}
@@ -195,6 +194,6 @@ func main() {
 	}
 
 	if err := a.Start(serverConfig); err != nil {
-		log.Fatal("Failed to start: ", err)
+		log.Fatal("Failed to start server: ", err)
 	}
 }

internal/cmd/hub/hub.go

@@ -28,8 +28,8 @@ func main() {
 	}
 
 	baseApp := getBaseApp()
-	hub := hub.NewHub(baseApp)
-	if err := hub.StartHub(); err != nil {
+	h := hub.NewHub(baseApp)
+	if err := h.StartHub(); err != nil {
 		log.Fatal(err)
 	}
 }

internal/entities/container/container.go

@@ -10,19 +10,10 @@ type ApiInfo struct {
 	Status  string
 	State   string
 	Image   string
-	Health  struct {
-		Status string
-		// FailingStreak int
-	}
-	Ports []struct {
-		// PrivatePort uint16
-		PublicPort uint16
-		IP         string
-		// Type        string
-	}
 	// ImageID string
 	// Command string
 	// Created int64
+	// Ports      []Port
 	// SizeRw     int64 `json:",omitempty"`
 	// SizeRootFs int64 `json:",omitempty"`
 	// Labels     map[string]string
@@ -136,23 +127,43 @@ var DockerHealthStrings = map[string]DockerHealth{
 	"unhealthy": DockerHealthUnhealthy,
 }
 
-// Docker container stats
-type Stats struct {
+// SharedCoreMetrics contains fields that are common to both container Stats and PveNodeStats
+type SharedCoreMetrics struct {
 	Name         string       `json:"n" cbor:"0,keyasint"`
 	Cpu          float64      `json:"c" cbor:"1,keyasint"`
 	Mem          float64      `json:"m" cbor:"2,keyasint"`
 	NetworkSent  float64      `json:"ns,omitzero" cbor:"3,keyasint,omitzero"` // deprecated 0.18.3 (MB) - keep field for old agents/records
 	NetworkRecv  float64      `json:"nr,omitzero" cbor:"4,keyasint,omitzero"` // deprecated 0.18.3 (MB) - keep field for old agents/records
-	Bandwidth   [2]uint64 `json:"b,omitzero" cbor:"9,keyasint,omitzero"`  // [sent bytes, recv bytes]
-
-	Health DockerHealth `json:"-" cbor:"5,keyasint"`
-	Status string       `json:"-" cbor:"6,keyasint"`
 	Id           string       `json:"-" cbor:"7,keyasint"`
-	Image  string       `json:"-" cbor:"8,keyasint"`
-	Ports  string       `json:"-" cbor:"10,keyasint"`
-	// PrevCpu     [2]uint64    `json:"-"`
-	CpuSystem    uint64       `json:"-"`
-	CpuContainer uint64       `json:"-"`
+	Bandwidth    [2]uint64    `json:"b,omitzero" cbor:"9,keyasint,omitzero"` // [sent bytes, recv bytes]
 	PrevNet      prevNetStats `json:"-"`
 	PrevReadTime time.Time    `json:"-"`
 }
+
+// Stats holds data specific to docker containers for the containers table
+type Stats struct {
+	SharedCoreMetrics // used to populate stats field in container_stats
+
+	// fields used for containers table
+
+	Health DockerHealth `json:"-" cbor:"5,keyasint"`
+	Status string       `json:"-" cbor:"6,keyasint"`
+	Image  string       `json:"-" cbor:"8,keyasint"`
+}
+
+// PveNodeStats holds data specific to PVE nodes for the pve_vms table
+type PveNodeStats struct {
+	SharedCoreMetrics // used to populate stats field in pve_stats
+
+	// fields used for pve_vms table
+
+	MaxCPU    uint64 `json:"-" cbor:"10,keyasint,omitzero"` // PVE: max vCPU count
+	MaxMem    uint64 `json:"-" cbor:"11,keyasint,omitzero"` // PVE: max memory bytes
+	Uptime    uint64 `json:"-" cbor:"12,keyasint,omitzero"` // PVE: uptime in seconds
+	Type      string `json:"-" cbor:"13,keyasint,omitzero"` // PVE: resource type (e.g. "qemu" or "lxc")
+	DiskRead  uint64 `json:"-" cbor:"14,keyasint,omitzero"` // PVE: cumulative disk read bytes
+	DiskWrite uint64 `json:"-" cbor:"15,keyasint,omitzero"` // PVE: cumulative disk write bytes
+	Disk      uint64 `json:"-" cbor:"16,keyasint,omitzero"` // PVE: allocated disk size in bytes
+	NetOut    uint64 `json:"-" cbor:"17,keyasint,omitzero"` // PVE: cumulative bytes sent by VM
+	NetIn     uint64 `json:"-" cbor:"18,keyasint,omitzero"` // PVE: cumulative bytes received by VM
+}

internal/entities/smart/smart.go

@@ -144,7 +144,7 @@ type AtaDeviceStatisticsPage struct {
 
 type AtaDeviceStatisticsEntry struct {
 	Name  string  `json:"name"`
-	Value *int64 `json:"value,omitempty"`
+	Value *uint64 `json:"value,omitempty"`
 }
 
 type AtaSmartAttribute struct {
@@ -357,7 +357,7 @@ type SmartInfoForSata struct {
 	// AtaSmartData                 AtaSmartData                 `json:"ata_smart_data"`
 	// AtaSctCapabilities           AtaSctCapabilities           `json:"ata_sct_capabilities"`
 	AtaSmartAttributes  AtaSmartAttributes  `json:"ata_smart_attributes"`
-	AtaDeviceStatistics json.RawMessage    `json:"ata_device_statistics"`
+	AtaDeviceStatistics AtaDeviceStatistics `json:"ata_device_statistics"`
 	// PowerOnTime                  PowerOnTimeInfo              `json:"power_on_time"`
 	// PowerCycleCount              uint16                       `json:"power_cycle_count"`
 	Temperature TemperatureInfo `json:"temperature"`
@@ -494,7 +494,7 @@ type SmartInfoForNvme struct {
 	FirmwareVersion string           `json:"firmware_version"`
 	// NVMePCIVendor                 NVMePCIVendor                 `json:"nvme_pci_vendor"`
 	// NVMeIEEEOUIIdentifier         uint32                        `json:"nvme_ieee_oui_identifier"`
-	NVMeTotalCapacity             uint64                        `json:"nvme_total_capacity"`
+	// NVMeTotalCapacity             uint64                        `json:"nvme_total_capacity"`
 	// NVMeUnallocatedCapacity       uint64                        `json:"nvme_unallocated_capacity"`
 	// NVMeControllerID              uint16                        `json:"nvme_controller_id"`
 	// NVMeVersion                   VersionStringInfo             `json:"nvme_version"`

internal/entities/system/system.go

@@ -12,9 +12,8 @@ import (
 
 type Stats struct {
 	Cpu            float64             `json:"cpu" cbor:"0,keyasint"`
-	MaxCpu         float64             `json:"cpum,omitempty" cbor:"-"`
+	MaxCpu         float64             `json:"cpum,omitempty" cbor:"1,keyasint,omitempty"`
 	Mem            float64             `json:"m" cbor:"2,keyasint"`
-	MaxMem         float64             `json:"mm,omitempty" cbor:"-"`
 	MemUsed        float64             `json:"mu" cbor:"3,keyasint"`
 	MemPct         float64             `json:"mp" cbor:"4,keyasint"`
 	MemBuffCache   float64             `json:"mb" cbor:"5,keyasint"`
@@ -24,32 +23,31 @@ type Stats struct {
 	DiskTotal      float64             `json:"d" cbor:"9,keyasint"`
 	DiskUsed       float64             `json:"du" cbor:"10,keyasint"`
 	DiskPct        float64             `json:"dp" cbor:"11,keyasint"`
-	DiskReadPs     float64             `json:"dr,omitzero" cbor:"12,keyasint,omitzero"`
-	DiskWritePs    float64             `json:"dw,omitzero" cbor:"13,keyasint,omitzero"`
-	MaxDiskReadPs  float64             `json:"drm,omitempty" cbor:"-"`
-	MaxDiskWritePs float64             `json:"dwm,omitempty" cbor:"-"`
+	DiskReadPs     float64             `json:"dr" cbor:"12,keyasint"`
+	DiskWritePs    float64             `json:"dw" cbor:"13,keyasint"`
+	MaxDiskReadPs  float64             `json:"drm,omitempty" cbor:"14,keyasint,omitempty"`
+	MaxDiskWritePs float64             `json:"dwm,omitempty" cbor:"15,keyasint,omitempty"`
 	NetworkSent    float64             `json:"ns,omitzero" cbor:"16,keyasint,omitzero"`
 	NetworkRecv    float64             `json:"nr,omitzero" cbor:"17,keyasint,omitzero"`
-	MaxNetworkSent float64             `json:"nsm,omitempty" cbor:"-"`
-	MaxNetworkRecv float64             `json:"nrm,omitempty" cbor:"-"`
+	MaxNetworkSent float64             `json:"nsm,omitempty" cbor:"18,keyasint,omitempty"`
+	MaxNetworkRecv float64             `json:"nrm,omitempty" cbor:"19,keyasint,omitempty"`
 	Temperatures   map[string]float64  `json:"t,omitempty" cbor:"20,keyasint,omitempty"`
 	ExtraFs        map[string]*FsStats `json:"efs,omitempty" cbor:"21,keyasint,omitempty"`
 	GPUData        map[string]GPUData  `json:"g,omitempty" cbor:"22,keyasint,omitempty"`
-	// LoadAvg1       float64             `json:"l1,omitempty" cbor:"23,keyasint,omitempty"`
-	// LoadAvg5       float64             `json:"l5,omitempty" cbor:"24,keyasint,omitempty"`
-	// LoadAvg15      float64             `json:"l15,omitempty" cbor:"25,keyasint,omitempty"`
+	LoadAvg1       float64             `json:"l1,omitempty" cbor:"23,keyasint,omitempty"`
+	LoadAvg5       float64             `json:"l5,omitempty" cbor:"24,keyasint,omitempty"`
+	LoadAvg15      float64             `json:"l15,omitempty" cbor:"25,keyasint,omitempty"`
 	Bandwidth      [2]uint64           `json:"b,omitzero" cbor:"26,keyasint,omitzero"`  // [sent bytes, recv bytes]
-	MaxBandwidth [2]uint64 `json:"bm,omitzero" cbor:"-"`                   // [sent bytes, recv bytes]
+	MaxBandwidth   [2]uint64           `json:"bm,omitzero" cbor:"27,keyasint,omitzero"` // [sent bytes, recv bytes]
 	// TODO: remove other load fields in future release in favor of load avg array
 	LoadAvg           [3]float64           `json:"la,omitempty" cbor:"28,keyasint"`
 	Battery           [2]uint8             `json:"bat,omitzero" cbor:"29,keyasint,omitzero"` // [percent, charge state, current]
+	MaxMem            float64              `json:"mm,omitempty" cbor:"30,keyasint,omitempty"`
 	NetworkInterfaces map[string][4]uint64 `json:"ni,omitempty" cbor:"31,keyasint,omitempty"`   // [upload bytes, download bytes, total upload, total download]
 	DiskIO            [2]uint64            `json:"dio,omitzero" cbor:"32,keyasint,omitzero"`    // [read bytes, write bytes]
 	MaxDiskIO         [2]uint64            `json:"diom,omitzero" cbor:"-"`                      // [max read bytes, max write bytes]
 	CpuBreakdown      []float64            `json:"cpub,omitempty" cbor:"33,keyasint,omitempty"` // [user, system, iowait, steal, idle]
 	CpuCoresUsage     Uint8Slice           `json:"cpus,omitempty" cbor:"34,keyasint,omitempty"` // per-core busy usage [CPU0..]
-	DiskIoStats       [6]float64           `json:"dios,omitzero" cbor:"35,keyasint,omitzero"`   // [read time %, write time %, io utilization %, r_await ms, w_await ms, weighted io %]
-	MaxDiskIoStats    [6]float64           `json:"diosm,omitzero" cbor:"-"`                     // max values for DiskIoStats
 }
 
 // Uint8Slice wraps []uint8 to customize JSON encoding while keeping CBOR efficient.
@@ -92,15 +90,13 @@ type FsStats struct {
 	TotalWrite     uint64    `json:"-"`
 	DiskReadPs     float64   `json:"r" cbor:"2,keyasint"`
 	DiskWritePs    float64   `json:"w" cbor:"3,keyasint"`
-	MaxDiskReadPS  float64   `json:"rm,omitempty" cbor:"-"`
-	MaxDiskWritePS float64   `json:"wm,omitempty" cbor:"-"`
+	MaxDiskReadPS  float64   `json:"rm,omitempty" cbor:"4,keyasint,omitempty"`
+	MaxDiskWritePS float64   `json:"wm,omitempty" cbor:"5,keyasint,omitempty"`
 	// TODO: remove DiskReadPs and DiskWritePs in future release in favor of DiskReadBytes and DiskWriteBytes
 	DiskReadBytes     uint64 `json:"rb" cbor:"6,keyasint,omitempty"`
 	DiskWriteBytes    uint64 `json:"wb" cbor:"7,keyasint,omitempty"`
 	MaxDiskReadBytes  uint64 `json:"rbm,omitempty" cbor:"-"`
 	MaxDiskWriteBytes uint64 `json:"wbm,omitempty" cbor:"-"`
-	DiskIoStats       [6]float64 `json:"dios,omitzero" cbor:"8,keyasint,omitzero"` // [read time %, write time %, io utilization %, r_await ms, w_await ms, weighted io %]
-	MaxDiskIoStats    [6]float64 `json:"diosm,omitzero" cbor:"-"`                  // max values for DiskIoStats
 }
 
 type NetIoStats struct {
@@ -139,17 +135,17 @@ type Info struct {
 	Cpu            float64 `json:"cpu" cbor:"6,keyasint"`
 	MemPct         float64 `json:"mp" cbor:"7,keyasint"`
 	DiskPct        float64 `json:"dp" cbor:"8,keyasint"`
-	Bandwidth     float64 `json:"b,omitzero" cbor:"9,keyasint"` // deprecated in favor of BandwidthBytes
+	Bandwidth      float64 `json:"b" cbor:"9,keyasint"`
 	AgentVersion   string  `json:"v" cbor:"10,keyasint"`
 	Podman         bool    `json:"p,omitempty" cbor:"11,keyasint,omitempty"` // deprecated - moved to Details struct
 	GpuPct         float64 `json:"g,omitempty" cbor:"12,keyasint,omitempty"`
 	DashboardTemp  float64 `json:"dt,omitempty" cbor:"13,keyasint,omitempty"`
 	Os             Os      `json:"os,omitempty" cbor:"14,keyasint,omitempty"`  // deprecated - moved to Details struct
-	// LoadAvg1       float64 `json:"l1,omitempty" cbor:"15,keyasint,omitempty"`  // deprecated - use `la` array instead
-	// LoadAvg5       float64 `json:"l5,omitempty" cbor:"16,keyasint,omitempty"`  // deprecated - use `la` array instead
-	// LoadAvg15      float64 `json:"l15,omitempty" cbor:"17,keyasint,omitempty"` // deprecated - use `la` array instead
-
+	LoadAvg1       float64 `json:"l1,omitempty" cbor:"15,keyasint,omitempty"`  // deprecated - use `la` array instead
+	LoadAvg5       float64 `json:"l5,omitempty" cbor:"16,keyasint,omitempty"`  // deprecated - use `la` array instead
+	LoadAvg15      float64 `json:"l15,omitempty" cbor:"17,keyasint,omitempty"` // deprecated - use `la` array instead
 	BandwidthBytes uint64  `json:"bb" cbor:"18,keyasint"`
+
 	LoadAvg        [3]float64         `json:"la,omitempty" cbor:"19,keyasint"`
 	ConnectionType ConnectionType     `json:"ct,omitempty" cbor:"20,keyasint,omitempty,omitzero"`
 	ExtraFsPct     map[string]float64 `json:"efs,omitempty" cbor:"21,keyasint,omitempty"`
@@ -179,4 +175,5 @@ type CombinedData struct {
 	Containers      []*container.Stats        `json:"container" cbor:"2,keyasint"`
 	SystemdServices []*systemd.Service        `json:"systemd,omitempty" cbor:"3,keyasint,omitempty"`
 	Details         *Details                  `cbor:"4,keyasint,omitempty"`
+	PVEStats        []*container.PveNodeStats `json:"pve,omitempty" cbor:"5,keyasint,omitempty"`
 }

internal/ghupdate/ghupdate.go

@@ -110,13 +110,21 @@ func (p *updater) update() (updated bool, err error) {
 	}
 
 	var latest *release
+	var useMirror bool
 
-	apiURL := getApiURL(p.config.UseMirror, p.config.Owner, p.config.Repo)
+	// Determine the API endpoint based on UseMirror flag
+	apiURL := fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", p.config.Owner, p.config.Repo)
 	if p.config.UseMirror {
+		useMirror = true
+		apiURL = fmt.Sprintf("https://gh.beszel.dev/repos/%s/%s/releases/latest?api=true", p.config.Owner, p.config.Repo)
 		ColorPrint(ColorYellow, "Using mirror for update.")
 	}
 
-	latest, err = FetchLatestRelease(p.config.Context, p.config.HttpClient, apiURL)
+	latest, err = fetchLatestRelease(
+		p.config.Context,
+		p.config.HttpClient,
+		apiURL,
+	)
 	if err != nil {
 		return false, err
 	}
@@ -142,7 +150,7 @@ func (p *updater) update() (updated bool, err error) {
 
 	// download the release asset
 	assetPath := filepath.Join(releaseDir, asset.Name)
-	if err := downloadFile(p.config.Context, p.config.HttpClient, asset.DownloadUrl, assetPath, p.config.UseMirror); err != nil {
+	if err := downloadFile(p.config.Context, p.config.HttpClient, asset.DownloadUrl, assetPath, useMirror); err != nil {
 		return false, err
 	}
 
@@ -218,11 +226,11 @@ func (p *updater) update() (updated bool, err error) {
 	return true, nil
 }
 
-func FetchLatestRelease(ctx context.Context, client HttpClient, url string) (*release, error) {
-	if url == "" {
-		url = getApiURL(false, "henrygd", "beszel")
-	}
-
+func fetchLatestRelease(
+	ctx context.Context,
+	client HttpClient,
+	url string,
+) (*release, error) {
 	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
 	if err != nil {
 		return nil, err
@@ -367,10 +375,3 @@ func isGlibc() bool {
 	}
 	return false
 }
-
-func getApiURL(useMirror bool, owner, repo string) string {
-	if useMirror {
-		return fmt.Sprintf("https://gh.beszel.dev/repos/%s/%s/releases/latest?api=true", owner, repo)
-	}
-	return fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", owner, repo)
-}

internal/hub/agent_connect_test.go

@@ -32,7 +32,7 @@ func createTestHub(t testing.TB) (*Hub, *pbtests.TestApp, error) {
 	if err != nil {
 		return nil, nil, err
 	}
-	return NewHub(testApp), testApp, err
+	return NewHub(testApp), testApp, nil
 }
 
 // cleanupTestHub stops background system goroutines before tearing down the app.
@@ -897,8 +897,12 @@ func TestAgentWebSocketIntegration(t *testing.T) {
 			require.NoError(t, err)
 
 			// Set up environment variables for the agent
-			t.Setenv("BESZEL_AGENT_HUB_URL", ts.URL)
-			t.Setenv("BESZEL_AGENT_TOKEN", tc.agentToken)
+			os.Setenv("BESZEL_AGENT_HUB_URL", ts.URL)
+			os.Setenv("BESZEL_AGENT_TOKEN", tc.agentToken)
+			defer func() {
+				os.Unsetenv("BESZEL_AGENT_HUB_URL")
+				os.Unsetenv("BESZEL_AGENT_TOKEN")
+			}()
 
 			// Start agent in background
 			done := make(chan error, 1)
@@ -913,7 +917,7 @@ func TestAgentWebSocketIntegration(t *testing.T) {
 
 			// Wait for connection result
 			maxWait := 2 * time.Second
-			time.Sleep(40 * time.Millisecond)
+			time.Sleep(20 * time.Millisecond)
 			checkInterval := 20 * time.Millisecond
 			timeout := time.After(maxWait)
 			ticker := time.Tick(checkInterval)
@@ -1076,8 +1080,12 @@ func TestMultipleSystemsWithSameUniversalToken(t *testing.T) {
 			require.NoError(t, err)
 
 			// Set up environment variables for the agent
-			t.Setenv("BESZEL_AGENT_HUB_URL", ts.URL)
-			t.Setenv("BESZEL_AGENT_TOKEN", universalToken)
+			os.Setenv("BESZEL_AGENT_HUB_URL", ts.URL)
+			os.Setenv("BESZEL_AGENT_TOKEN", universalToken)
+			defer func() {
+				os.Unsetenv("BESZEL_AGENT_HUB_URL")
+				os.Unsetenv("BESZEL_AGENT_TOKEN")
+			}()
 
 			// Count systems before connection
 			systemsBefore, err := testApp.FindRecordsByFilter("systems", "users ~ {:userId}", "", -1, 0, map[string]any{"userId": userRecord.Id})
@@ -1235,8 +1243,12 @@ func TestPermanentUniversalTokenFromDB(t *testing.T) {
 	require.NoError(t, err)
 
 	// Set up environment variables for the agent
-	t.Setenv("BESZEL_AGENT_HUB_URL", ts.URL)
-	t.Setenv("BESZEL_AGENT_TOKEN", universalToken)
+	os.Setenv("BESZEL_AGENT_HUB_URL", ts.URL)
+	os.Setenv("BESZEL_AGENT_TOKEN", universalToken)
+	defer func() {
+		os.Unsetenv("BESZEL_AGENT_HUB_URL")
+		os.Unsetenv("BESZEL_AGENT_TOKEN")
+	}()
 
 	// Start agent in background
 	done := make(chan error, 1)

internal/hub/api.go

@@ -1,391 +0,0 @@
-package hub
-
-import (
-	"context"
-	"net/http"
-	"regexp"
-	"strings"
-	"time"
-
-	"github.com/blang/semver"
-	"github.com/google/uuid"
-	"github.com/henrygd/beszel"
-	"github.com/henrygd/beszel/internal/alerts"
-	"github.com/henrygd/beszel/internal/ghupdate"
-	"github.com/henrygd/beszel/internal/hub/config"
-	"github.com/henrygd/beszel/internal/hub/systems"
-	"github.com/henrygd/beszel/internal/hub/utils"
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/apis"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-// UpdateInfo holds information about the latest update check
-type UpdateInfo struct {
-	lastCheck time.Time
-	Version   string `json:"v"`
-	Url       string `json:"url"`
-}
-
-var containerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
-
-// Middleware to allow only admin role users
-var requireAdminRole = customAuthMiddleware(func(e *core.RequestEvent) bool {
-	return e.Auth.GetString("role") == "admin"
-})
-
-// Middleware to exclude readonly users
-var excludeReadOnlyRole = customAuthMiddleware(func(e *core.RequestEvent) bool {
-	return e.Auth.GetString("role") != "readonly"
-})
-
-// customAuthMiddleware handles boilerplate for custom authentication middlewares. fn should
-// return true if the request is allowed, false otherwise. e.Auth is guaranteed to be non-nil.
-func customAuthMiddleware(fn func(*core.RequestEvent) bool) func(*core.RequestEvent) error {
-	return func(e *core.RequestEvent) error {
-		if e.Auth == nil {
-			return e.UnauthorizedError("The request requires valid record authorization token.", nil)
-		}
-		if !fn(e) {
-			return e.ForbiddenError("The authorized record is not allowed to perform this action.", nil)
-		}
-		return e.Next()
-	}
-}
-
-// registerMiddlewares registers custom middlewares
-func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
-	// authorizes request with user matching the provided email
-	authorizeRequestWithEmail := func(e *core.RequestEvent, email string) (err error) {
-		if e.Auth != nil || email == "" {
-			return e.Next()
-		}
-		isAuthRefresh := e.Request.URL.Path == "/api/collections/users/auth-refresh" && e.Request.Method == http.MethodPost
-		e.Auth, err = e.App.FindAuthRecordByEmail("users", email)
-		if err != nil || !isAuthRefresh {
-			return e.Next()
-		}
-		// auth refresh endpoint, make sure token is set in header
-		token, _ := e.Auth.NewAuthToken()
-		e.Request.Header.Set("Authorization", token)
-		return e.Next()
-	}
-	// authenticate with trusted header
-	if autoLogin, _ := utils.GetEnv("AUTO_LOGIN"); autoLogin != "" {
-		se.Router.BindFunc(func(e *core.RequestEvent) error {
-			return authorizeRequestWithEmail(e, autoLogin)
-		})
-	}
-	// authenticate with trusted header
-	if trustedHeader, _ := utils.GetEnv("TRUSTED_AUTH_HEADER"); trustedHeader != "" {
-		se.Router.BindFunc(func(e *core.RequestEvent) error {
-			return authorizeRequestWithEmail(e, e.Request.Header.Get(trustedHeader))
-		})
-	}
-}
-
-// registerApiRoutes registers custom API routes
-func (h *Hub) registerApiRoutes(se *core.ServeEvent) error {
-	// auth protected routes
-	apiAuth := se.Router.Group("/api/beszel")
-	apiAuth.Bind(apis.RequireAuth())
-	// auth optional routes
-	apiNoAuth := se.Router.Group("/api/beszel")
-
-	// create first user endpoint only needed if no users exist
-	if totalUsers, _ := se.App.CountRecords("users"); totalUsers == 0 {
-		apiNoAuth.POST("/create-user", h.um.CreateFirstUser)
-	}
-	// check if first time setup on login page
-	apiNoAuth.GET("/first-run", func(e *core.RequestEvent) error {
-		total, err := e.App.CountRecords("users")
-		return e.JSON(http.StatusOK, map[string]bool{"firstRun": err == nil && total == 0})
-	})
-	// get public key and version
-	apiAuth.GET("/info", h.getInfo)
-	apiAuth.GET("/getkey", h.getInfo) // deprecated - keep for compatibility w/ integrations
-	// check for updates
-	if optIn, _ := utils.GetEnv("CHECK_UPDATES"); optIn == "true" {
-		var updateInfo UpdateInfo
-		apiAuth.GET("/update", updateInfo.getUpdate)
-	}
-	// send test notification
-	apiAuth.POST("/test-notification", h.SendTestNotification)
-	// heartbeat status and test
-	apiAuth.GET("/heartbeat-status", h.getHeartbeatStatus).BindFunc(requireAdminRole)
-	apiAuth.POST("/test-heartbeat", h.testHeartbeat).BindFunc(requireAdminRole)
-	// get config.yml content
-	apiAuth.GET("/config-yaml", config.GetYamlConfig).BindFunc(requireAdminRole)
-	// handle agent websocket connection
-	apiNoAuth.GET("/agent-connect", h.handleAgentConnect)
-	// get or create universal tokens
-	apiAuth.GET("/universal-token", h.getUniversalToken).BindFunc(excludeReadOnlyRole)
-	// update / delete user alerts
-	apiAuth.POST("/user-alerts", alerts.UpsertUserAlerts)
-	apiAuth.DELETE("/user-alerts", alerts.DeleteUserAlerts)
-	// refresh SMART devices for a system
-	apiAuth.POST("/smart/refresh", h.refreshSmartData).BindFunc(excludeReadOnlyRole)
-	// get systemd service details
-	apiAuth.GET("/systemd/info", h.getSystemdInfo)
-	// /containers routes
-	if enabled, _ := utils.GetEnv("CONTAINER_DETAILS"); enabled != "false" {
-		// get container logs
-		apiAuth.GET("/containers/logs", h.getContainerLogs)
-		// get container info
-		apiAuth.GET("/containers/info", h.getContainerInfo)
-	}
-	return nil
-}
-
-// getInfo returns data needed by authenticated users, such as the public key and current version
-func (h *Hub) getInfo(e *core.RequestEvent) error {
-	type infoResponse struct {
-		Key         string `json:"key"`
-		Version     string `json:"v"`
-		CheckUpdate bool   `json:"cu"`
-	}
-	info := infoResponse{
-		Key:     h.pubKey,
-		Version: beszel.Version,
-	}
-	if optIn, _ := utils.GetEnv("CHECK_UPDATES"); optIn == "true" {
-		info.CheckUpdate = true
-	}
-	return e.JSON(http.StatusOK, info)
-}
-
-// getUpdate checks for the latest release on GitHub and returns update info if a newer version is available
-func (info *UpdateInfo) getUpdate(e *core.RequestEvent) error {
-	if time.Since(info.lastCheck) < 6*time.Hour {
-		return e.JSON(http.StatusOK, info)
-	}
-	info.lastCheck = time.Now()
-	latestRelease, err := ghupdate.FetchLatestRelease(context.Background(), http.DefaultClient, "")
-	if err != nil {
-		return err
-	}
-	currentVersion, err := semver.Parse(strings.TrimPrefix(beszel.Version, "v"))
-	if err != nil {
-		return err
-	}
-	latestVersion, err := semver.Parse(strings.TrimPrefix(latestRelease.Tag, "v"))
-	if err != nil {
-		return err
-	}
-	if latestVersion.GT(currentVersion) {
-		info.Version = strings.TrimPrefix(latestRelease.Tag, "v")
-		info.Url = latestRelease.Url
-	}
-	return e.JSON(http.StatusOK, info)
-}
-
-// GetUniversalToken handles the universal token API endpoint (create, read, delete)
-func (h *Hub) getUniversalToken(e *core.RequestEvent) error {
-	if e.Auth.IsSuperuser() {
-		return e.ForbiddenError("Superusers cannot use universal tokens", nil)
-	}
-
-	tokenMap := universalTokenMap.GetMap()
-	userID := e.Auth.Id
-	query := e.Request.URL.Query()
-	token := query.Get("token")
-	enable := query.Get("enable")
-	permanent := query.Get("permanent")
-
-	// helper for deleting any existing permanent token record for this user
-	deletePermanent := func() error {
-		rec, err := h.FindFirstRecordByFilter("universal_tokens", "user = {:user}", dbx.Params{"user": userID})
-		if err != nil {
-			return nil // no record
-		}
-		return h.Delete(rec)
-	}
-
-	// helper for upserting a permanent token record for this user
-	upsertPermanent := func(token string) error {
-		rec, err := h.FindFirstRecordByFilter("universal_tokens", "user = {:user}", dbx.Params{"user": userID})
-		if err == nil {
-			rec.Set("token", token)
-			return h.Save(rec)
-		}
-
-		col, err := h.FindCachedCollectionByNameOrId("universal_tokens")
-		if err != nil {
-			return err
-		}
-		newRec := core.NewRecord(col)
-		newRec.Set("user", userID)
-		newRec.Set("token", token)
-		return h.Save(newRec)
-	}
-
-	// Disable universal tokens (both ephemeral and permanent)
-	if enable == "0" {
-		tokenMap.RemovebyValue(userID)
-		_ = deletePermanent()
-		return e.JSON(http.StatusOK, map[string]any{"token": token, "active": false, "permanent": false})
-	}
-
-	// Enable universal token (ephemeral or permanent)
-	if enable == "1" {
-		if token == "" {
-			token = uuid.New().String()
-		}
-
-		if permanent == "1" {
-			// make token permanent (persist across restarts)
-			tokenMap.RemovebyValue(userID)
-			if err := upsertPermanent(token); err != nil {
-				return err
-			}
-			return e.JSON(http.StatusOK, map[string]any{"token": token, "active": true, "permanent": true})
-		}
-
-		// default: ephemeral mode (1 hour)
-		_ = deletePermanent()
-		tokenMap.Set(token, userID, time.Hour)
-		return e.JSON(http.StatusOK, map[string]any{"token": token, "active": true, "permanent": false})
-	}
-
-	// Read current state
-	// Prefer permanent token if it exists.
-	if rec, err := h.FindFirstRecordByFilter("universal_tokens", "user = {:user}", dbx.Params{"user": userID}); err == nil {
-		dbToken := rec.GetString("token")
-		// If no token was provided, or the caller is asking about their permanent token, return it.
-		if token == "" || token == dbToken {
-			return e.JSON(http.StatusOK, map[string]any{"token": dbToken, "active": true, "permanent": true})
-		}
-		// Token doesn't match their permanent token (avoid leaking other info)
-		return e.JSON(http.StatusOK, map[string]any{"token": token, "active": false, "permanent": false})
-	}
-
-	// No permanent token; fall back to ephemeral token map.
-	if token == "" {
-		// return existing token if it exists
-		if token, _, ok := tokenMap.GetByValue(userID); ok {
-			return e.JSON(http.StatusOK, map[string]any{"token": token, "active": true, "permanent": false})
-		}
-		// if no token is provided, generate a new one
-		token = uuid.New().String()
-	}
-
-	// Token is considered active only if it belongs to the current user.
-	activeUser, ok := tokenMap.GetOk(token)
-	active := ok && activeUser == userID
-	response := map[string]any{"token": token, "active": active, "permanent": false}
-	return e.JSON(http.StatusOK, response)
-}
-
-// getHeartbeatStatus returns current heartbeat configuration and whether it's enabled
-func (h *Hub) getHeartbeatStatus(e *core.RequestEvent) error {
-	if h.hb == nil {
-		return e.JSON(http.StatusOK, map[string]any{
-			"enabled": false,
-			"msg":     "Set HEARTBEAT_URL to enable outbound heartbeat monitoring",
-		})
-	}
-	cfg := h.hb.GetConfig()
-	return e.JSON(http.StatusOK, map[string]any{
-		"enabled":  true,
-		"url":      cfg.URL,
-		"interval": cfg.Interval,
-		"method":   cfg.Method,
-	})
-}
-
-// testHeartbeat triggers a single heartbeat ping and returns the result
-func (h *Hub) testHeartbeat(e *core.RequestEvent) error {
-	if h.hb == nil {
-		return e.JSON(http.StatusOK, map[string]any{
-			"err": "Heartbeat not configured. Set HEARTBEAT_URL environment variable.",
-		})
-	}
-	if err := h.hb.Send(); err != nil {
-		return e.JSON(http.StatusOK, map[string]any{"err": err.Error()})
-	}
-	return e.JSON(http.StatusOK, map[string]any{"err": false})
-}
-
-// containerRequestHandler handles both container logs and info requests
-func (h *Hub) containerRequestHandler(e *core.RequestEvent, fetchFunc func(*systems.System, string) (string, error), responseKey string) error {
-	systemID := e.Request.URL.Query().Get("system")
-	containerID := e.Request.URL.Query().Get("container")
-
-	if systemID == "" || containerID == "" || !containerIDPattern.MatchString(containerID) {
-		return e.BadRequestError("Invalid system or container parameter", nil)
-	}
-
-	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth) {
-		return e.NotFoundError("", nil)
-	}
-
-	data, err := fetchFunc(system, containerID)
-	if err != nil {
-		return e.InternalServerError("", err)
-	}
-
-	return e.JSON(http.StatusOK, map[string]string{responseKey: data})
-}
-
-// getContainerLogs handles GET /api/beszel/containers/logs requests
-func (h *Hub) getContainerLogs(e *core.RequestEvent) error {
-	return h.containerRequestHandler(e, func(system *systems.System, containerID string) (string, error) {
-		return system.FetchContainerLogsFromAgent(containerID)
-	}, "logs")
-}
-
-func (h *Hub) getContainerInfo(e *core.RequestEvent) error {
-	return h.containerRequestHandler(e, func(system *systems.System, containerID string) (string, error) {
-		return system.FetchContainerInfoFromAgent(containerID)
-	}, "info")
-}
-
-// getSystemdInfo handles GET /api/beszel/systemd/info requests
-func (h *Hub) getSystemdInfo(e *core.RequestEvent) error {
-	query := e.Request.URL.Query()
-	systemID := query.Get("system")
-	serviceName := query.Get("service")
-
-	if systemID == "" || serviceName == "" {
-		return e.BadRequestError("Invalid system or service parameter", nil)
-	}
-	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth) {
-		return e.NotFoundError("", nil)
-	}
-	// verify service exists before fetching details
-	_, err = e.App.FindFirstRecordByFilter("systemd_services", "system = {:system} && name = {:name}", dbx.Params{
-		"system": systemID,
-		"name":   serviceName,
-	})
-	if err != nil {
-		return e.NotFoundError("", err)
-	}
-	details, err := system.FetchSystemdInfoFromAgent(serviceName)
-	if err != nil {
-		return e.InternalServerError("", err)
-	}
-	e.Response.Header().Set("Cache-Control", "public, max-age=60")
-	return e.JSON(http.StatusOK, map[string]any{"details": details})
-}
-
-// refreshSmartData handles POST /api/beszel/smart/refresh requests
-// Fetches fresh SMART data from the agent and updates the collection
-func (h *Hub) refreshSmartData(e *core.RequestEvent) error {
-	systemID := e.Request.URL.Query().Get("system")
-	if systemID == "" {
-		return e.BadRequestError("Invalid system parameter", nil)
-	}
-
-	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth) {
-		return e.NotFoundError("", nil)
-	}
-
-	if err := system.FetchAndSaveSmartDevices(); err != nil {
-		return e.InternalServerError("", err)
-	}
-
-	return e.JSON(http.StatusOK, map[string]string{"status": "ok"})
-}

internal/hub/api_test.go

@@ -1,972 +0,0 @@
-package hub_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"testing"
-
-	beszelTests "github.com/henrygd/beszel/internal/tests"
-
-	"github.com/henrygd/beszel/internal/migrations"
-	"github.com/pocketbase/pocketbase/core"
-	pbTests "github.com/pocketbase/pocketbase/tests"
-	"github.com/stretchr/testify/require"
-)
-
-// marshal to json and return an io.Reader (for use in ApiScenario.Body)
-func jsonReader(v any) io.Reader {
-	data, err := json.Marshal(v)
-	if err != nil {
-		panic(err)
-	}
-	return bytes.NewReader(data)
-}
-
-func TestApiRoutesAuthentication(t *testing.T) {
-	hub, user := beszelTests.GetHubWithUser(t)
-	defer hub.Cleanup()
-
-	userToken, err := user.NewAuthToken()
-	require.NoError(t, err, "Failed to create auth token")
-
-	// Create test user and get auth token
-	user2, err := beszelTests.CreateUser(hub, "testuser@example.com", "password123")
-	require.NoError(t, err, "Failed to create test user")
-	user2Token, err := user2.NewAuthToken()
-	require.NoError(t, err, "Failed to create user2 auth token")
-
-	adminUser, err := beszelTests.CreateUserWithRole(hub, "admin@example.com", "password123", "admin")
-	require.NoError(t, err, "Failed to create admin user")
-	adminUserToken, err := adminUser.NewAuthToken()
-
-	readOnlyUser, err := beszelTests.CreateUserWithRole(hub, "readonly@example.com", "password123", "readonly")
-	require.NoError(t, err, "Failed to create readonly user")
-	readOnlyUserToken, err := readOnlyUser.NewAuthToken()
-	require.NoError(t, err, "Failed to create readonly user auth token")
-
-	superuser, err := beszelTests.CreateSuperuser(hub, "superuser@example.com", "password123")
-	require.NoError(t, err, "Failed to create superuser")
-	superuserToken, err := superuser.NewAuthToken()
-	require.NoError(t, err, "Failed to create superuser auth token")
-
-	// Create test system
-	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "test-system",
-		"users": []string{user.Id},
-		"host":  "127.0.0.1",
-	})
-	require.NoError(t, err, "Failed to create test system")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		// Auth Protected Routes - Should require authentication
-		{
-			Name:            "GET /config-yaml - no auth should fail",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/config-yaml",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /config-yaml - with user auth should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/config-yaml",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /config-yaml - with admin auth should succeed",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/config-yaml",
-			Headers: map[string]string{
-				"Authorization": adminUserToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"test-system"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /heartbeat-status - no auth should fail",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/heartbeat-status",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /heartbeat-status - with user auth should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/heartbeat-status",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /heartbeat-status - with admin auth should succeed",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/heartbeat-status",
-			Headers: map[string]string{
-				"Authorization": adminUserToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{`"enabled":false`},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /test-heartbeat - with user auth should fail",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/test-heartbeat",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /test-heartbeat - with admin auth should report disabled state",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/test-heartbeat",
-			Headers: map[string]string{
-				"Authorization": adminUserToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"Heartbeat not configured"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /universal-token - no auth should fail",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/universal-token",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /universal-token - with auth should succeed",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/universal-token",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"active", "token", "permanent"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /universal-token - enable permanent should succeed",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/universal-token?enable=1&permanent=1&token=permanent-token-123",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"permanent\":true", "permanent-token-123"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /universal-token - superuser should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/universal-token",
-			Headers: map[string]string{
-				"Authorization": superuserToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"Superusers cannot use universal tokens"},
-			TestAppFactory: func(t testing.TB) *pbTests.TestApp {
-				return hub.TestApp
-			},
-		},
-		{
-			Name:   "GET /universal-token - with readonly auth should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/universal-token",
-			Headers: map[string]string{
-				"Authorization": readOnlyUserToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /smart/refresh - missing system should fail 400 with user auth",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/smart/refresh",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "system", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /smart/refresh - with readonly auth should fail",
-			Method: http.MethodPost,
-			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
-			Headers: map[string]string{
-				"Authorization": readOnlyUserToken,
-			},
-			ExpectedStatus:  403,
-			ExpectedContent: []string{"The authorized record is not allowed to perform this action."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /smart/refresh - non-user system should fail",
-			Method: http.MethodPost,
-			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /smart/refresh - good user should pass validation",
-			Method: http.MethodPost,
-			URL:    fmt.Sprintf("/api/beszel/smart/refresh?system=%s", system.Id),
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "POST /user-alerts - no auth should fail",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"value":   80,
-				"min":     10,
-				"systems": []string{system.Id},
-			}),
-		},
-		{
-			Name:   "POST /user-alerts - with auth should succeed",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"value":   80,
-				"min":     10,
-				"systems": []string{system.Id},
-			}),
-		},
-		{
-			Name:            "DELETE /user-alerts - no auth should fail",
-			Method:          http.MethodDelete,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system.Id},
-			}),
-		},
-		{
-			Name:   "DELETE /user-alerts - with auth should succeed",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				// Create an alert to delete
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system.Id,
-					"user":   user.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-		},
-		{
-			Name:            "GET /containers/logs - no auth should fail",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/containers/logs?system=test-system&container=abababababab",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /containers/logs - request for valid non-user system should fail",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/containers/logs?system=%s&container=abababababab", system.Id),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-		},
-		{
-			Name:            "GET /containers/info - request for valid non-user system should fail",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/containers/info?system=%s&container=abababababab", system.Id),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-		},
-		{
-			Name:            "GET /containers/info - SHARE_ALL_SYSTEMS allows non-member user",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/containers/info?system=%s&container=abababababab", system.Id),
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "true")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "")
-			},
-		},
-		{
-			Name:   "GET /containers/logs - with auth but missing system param should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/logs?container=abababababab",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /containers/logs - with auth but missing container param should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/logs?system=test-system",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /containers/logs - with auth but invalid system should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/logs?system=invalid-system&container=0123456789ab",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /containers/logs - traversal container should fail validation",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/logs?system=" + system.Id + "&container=..%2F..%2Fversion",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /containers/info - traversal container should fail validation",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/info?system=" + system.Id + "&container=../../version?x=",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /containers/info - non-hex container should fail validation",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/info?system=" + system.Id + "&container=container_name",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /containers/logs - good user should pass validation",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/logs?system=" + system.Id + "&container=0123456789ab",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /containers/info - good user should pass validation",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/containers/info?system=" + system.Id + "&container=0123456789ab",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-		},
-		// /systemd routes
-		{
-			Name:            "GET /systemd/info - no auth should fail",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /systemd/info - request for valid non-user system should fail",
-			Method:          http.MethodGet,
-			URL:             fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-		},
-		{
-			Name:   "GET /systemd/info - with auth but missing system param should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/systemd/info?service=nginx.service",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /systemd/info - with auth but missing service param should fail",
-			Method: http.MethodGet,
-			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s", system.Id),
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Invalid", "parameter"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /systemd/info - with auth but invalid system should fail",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/systemd/info?system=invalid-system&service=nginx.service",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /systemd/info - service not in systemd_services collection should fail",
-			Method: http.MethodGet,
-			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=notregistered.service", system.Id),
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"The requested resource wasn't found."},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /systemd/info - with auth and existing service record should pass validation",
-			Method: http.MethodGet,
-			URL:    fmt.Sprintf("/api/beszel/systemd/info?system=%s&service=nginx.service", system.Id),
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  500,
-			ExpectedContent: []string{"Something went wrong while processing your request."},
-			TestAppFactory:  testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.CreateRecord(app, "systemd_services", map[string]any{
-					"system": system.Id,
-					"name":   "nginx.service",
-					"state":  0,
-					"sub":    1,
-				})
-			},
-		},
-
-		// Auth Optional Routes - Should work without authentication
-		{
-			Name:            "GET /getkey - no auth should fail",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/getkey",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /getkey - with auth should also succeed",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/getkey",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"key\":", "\"v\":"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /info - should return the same as /getkey",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/info",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"key\":", "\"v\":"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /first-run - no auth should succeed",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/first-run",
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"firstRun\":false"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /first-run - with auth should also succeed",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/first-run",
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"firstRun\":false"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /agent-connect - no auth should succeed (websocket upgrade fails but route is accessible)",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/agent-connect",
-			ExpectedStatus:  400,
-			ExpectedContent: []string{},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /test-notification - invalid auth token should fail",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/test-notification",
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-			Headers: map[string]string{
-				"Authorization": "invalid-token",
-			},
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST /user-alerts - invalid auth token should fail",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": "invalid-token",
-			},
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"value":   80,
-				"min":     10,
-				"systems": []string{system.Id},
-			}),
-		},
-		// this works but diff behavior on prod vs dev.
-		// dev returns 502; prod returns 200 with static html page 404
-		// TODO: align dev and prod behavior and re-enable this test
-		// {
-		// 	Name:               "GET /update - shouldn't exist without CHECK_UPDATES env var",
-		// 	Method:             http.MethodGet,
-		// 	URL:                "/api/beszel/update",
-		// 	NotExpectedContent: []string{"v:", "\"v\":"},
-		// 	ExpectedStatus: 502,
-		// 	TestAppFactory: testAppFactory,
-		// },
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestFirstUserCreation(t *testing.T) {
-	t.Run("CreateUserEndpoint available when no users exist", func(t *testing.T) {
-		hub, _ := beszelTests.NewTestHub(t.TempDir())
-		defer hub.Cleanup()
-
-		hub.StartHub()
-
-		testAppFactoryExisting := func(t testing.TB) *pbTests.TestApp {
-			return hub.TestApp
-		}
-
-		scenarios := []beszelTests.ApiScenario{
-			{
-				Name:   "POST /create-user - should be available when no users exist",
-				Method: http.MethodPost,
-				URL:    "/api/beszel/create-user",
-				Body: jsonReader(map[string]any{
-					"email":    "firstuser@example.com",
-					"password": "password123",
-				}),
-				ExpectedStatus:  200,
-				ExpectedContent: []string{"User created"},
-				TestAppFactory:  testAppFactoryExisting,
-				BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-					userCount, err := hub.CountRecords("users")
-					require.NoError(t, err)
-					require.Zero(t, userCount, "Should start with no users")
-					superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
-					require.NoError(t, err)
-					require.EqualValues(t, 1, len(superusers), "Should start with one temporary superuser")
-					require.EqualValues(t, migrations.TempAdminEmail, superusers[0].GetString("email"), "Should have created one temporary superuser")
-				},
-				AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-					userCount, err := hub.CountRecords("users")
-					require.NoError(t, err)
-					require.EqualValues(t, 1, userCount, "Should have created one user")
-					superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
-					require.NoError(t, err)
-					require.EqualValues(t, 1, len(superusers), "Should have created one superuser")
-					require.EqualValues(t, "firstuser@example.com", superusers[0].GetString("email"), "Should have created one superuser")
-				},
-			},
-			{
-				Name:   "POST /create-user - should not be available when users exist",
-				Method: http.MethodPost,
-				URL:    "/api/beszel/create-user",
-				Body: jsonReader(map[string]any{
-					"email":    "firstuser@example.com",
-					"password": "password123",
-				}),
-				ExpectedStatus:  404,
-				ExpectedContent: []string{"wasn't found"},
-				TestAppFactory:  testAppFactoryExisting,
-			},
-		}
-
-		for _, scenario := range scenarios {
-			scenario.Test(t)
-		}
-	})
-
-	t.Run("CreateUserEndpoint not available when USER_EMAIL, USER_PASSWORD are set", func(t *testing.T) {
-		t.Setenv("BESZEL_HUB_USER_EMAIL", "me@example.com")
-		t.Setenv("BESZEL_HUB_USER_PASSWORD", "password123")
-
-		hub, _ := beszelTests.NewTestHub(t.TempDir())
-		defer hub.Cleanup()
-
-		hub.StartHub()
-
-		testAppFactory := func(t testing.TB) *pbTests.TestApp {
-			return hub.TestApp
-		}
-
-		scenario := beszelTests.ApiScenario{
-			Name:            "POST /create-user - should not be available when USER_EMAIL, USER_PASSWORD are set",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/create-user",
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"wasn't found"},
-			TestAppFactory:  testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				users, err := hub.FindAllRecords("users")
-				require.NoError(t, err)
-				require.EqualValues(t, 1, len(users), "Should start with one user")
-				require.EqualValues(t, "me@example.com", users[0].GetString("email"), "Should have created one user")
-				superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
-				require.NoError(t, err)
-				require.EqualValues(t, 1, len(superusers), "Should start with one superuser")
-				require.EqualValues(t, "me@example.com", superusers[0].GetString("email"), "Should have created one superuser")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				users, err := hub.FindAllRecords("users")
-				require.NoError(t, err)
-				require.EqualValues(t, 1, len(users), "Should still have one user")
-				require.EqualValues(t, "me@example.com", users[0].GetString("email"), "Should have created one user")
-				superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
-				require.NoError(t, err)
-				require.EqualValues(t, 1, len(superusers), "Should still have one superuser")
-				require.EqualValues(t, "me@example.com", superusers[0].GetString("email"), "Should have created one superuser")
-			},
-		}
-
-		scenario.Test(t)
-	})
-}
-
-func TestCreateUserEndpointAvailability(t *testing.T) {
-	t.Run("CreateUserEndpoint available when no users exist", func(t *testing.T) {
-		hub, _ := beszelTests.NewTestHub(t.TempDir())
-		defer hub.Cleanup()
-
-		// Ensure no users exist
-		userCount, err := hub.CountRecords("users")
-		require.NoError(t, err)
-		require.Zero(t, userCount, "Should start with no users")
-
-		hub.StartHub()
-
-		testAppFactory := func(t testing.TB) *pbTests.TestApp {
-			return hub.TestApp
-		}
-
-		scenario := beszelTests.ApiScenario{
-			Name:   "POST /create-user - should be available when no users exist",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/create-user",
-			Body: jsonReader(map[string]any{
-				"email":    "firstuser@example.com",
-				"password": "password123",
-			}),
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"User created"},
-			TestAppFactory:  testAppFactory,
-		}
-
-		scenario.Test(t)
-
-		// Verify user was created
-		userCount, err = hub.CountRecords("users")
-		require.NoError(t, err)
-		require.EqualValues(t, 1, userCount, "Should have created one user")
-	})
-
-	t.Run("CreateUserEndpoint not available when users exist", func(t *testing.T) {
-		hub, _ := beszelTests.NewTestHub(t.TempDir())
-		defer hub.Cleanup()
-
-		// Create a user first
-		_, err := beszelTests.CreateUser(hub, "existing@example.com", "password")
-		require.NoError(t, err)
-
-		hub.StartHub()
-
-		testAppFactory := func(t testing.TB) *pbTests.TestApp {
-			return hub.TestApp
-		}
-
-		scenario := beszelTests.ApiScenario{
-			Name:   "POST /create-user - should not be available when users exist",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/create-user",
-			Body: jsonReader(map[string]any{
-				"email":    "another@example.com",
-				"password": "password123",
-			}),
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"wasn't found"},
-			TestAppFactory:  testAppFactory,
-		}
-
-		scenario.Test(t)
-	})
-}
-
-func TestAutoLoginMiddleware(t *testing.T) {
-	var hubs []*beszelTests.TestHub
-
-	defer func() {
-		for _, hub := range hubs {
-			hub.Cleanup()
-		}
-	}()
-
-	t.Setenv("AUTO_LOGIN", "user@test.com")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		hub, _ := beszelTests.NewTestHub(t.TempDir())
-		hubs = append(hubs, hub)
-		hub.StartHub()
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		{
-			Name:            "GET /getkey - without auto login should fail",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/getkey",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /getkey - with auto login should fail if no matching user",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/getkey",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:            "GET /getkey - with auto login should succeed",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/getkey",
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"key\":", "\"v\":"},
-			TestAppFactory:  testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.CreateUser(app, "user@test.com", "password123")
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestTrustedHeaderMiddleware(t *testing.T) {
-	var hubs []*beszelTests.TestHub
-
-	defer func() {
-		for _, hub := range hubs {
-			hub.Cleanup()
-		}
-	}()
-
-	t.Setenv("TRUSTED_AUTH_HEADER", "X-Beszel-Trusted")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		hub, _ := beszelTests.NewTestHub(t.TempDir())
-		hubs = append(hubs, hub)
-		hub.StartHub()
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		{
-			Name:            "GET /getkey - without trusted header should fail",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/getkey",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /getkey - with trusted header should fail if no matching user",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/getkey",
-			Headers: map[string]string{
-				"X-Beszel-Trusted": "user@test.com",
-			},
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "GET /getkey - with trusted header should succeed",
-			Method: http.MethodGet,
-			URL:    "/api/beszel/getkey",
-			Headers: map[string]string{
-				"X-Beszel-Trusted": "user@test.com",
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"key\":", "\"v\":"},
-			TestAppFactory:  testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.CreateUser(app, "user@test.com", "password123")
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
-func TestUpdateEndpoint(t *testing.T) {
-	t.Setenv("CHECK_UPDATES", "true")
-
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-	hub.StartHub()
-
-	// Create test user and get auth token
-	// user, err := beszelTests.CreateUser(hub, "testuser@example.com", "password123")
-	// require.NoError(t, err, "Failed to create test user")
-	// userToken, err := user.NewAuthToken()
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		{
-			Name:            "update endpoint shouldn't work without auth",
-			Method:          http.MethodGet,
-			URL:             "/api/beszel/update",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		// leave this out for now since it actually makes a request to github
-		// {
-		// 	Name:   "GET /update - with valid auth should succeed",
-		// 	Method: http.MethodGet,
-		// 	URL:    "/api/beszel/update",
-		// 	Headers: map[string]string{
-		// 		"Authorization": userToken,
-		// 	},
-		// 	ExpectedStatus:  200,
-		// 	ExpectedContent: []string{`"v":`},
-		// 	TestAppFactory:  testAppFactory,
-		// },
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

internal/hub/collections.go

@@ -1,131 +0,0 @@
-package hub
-
-import (
-	"github.com/henrygd/beszel/internal/hub/utils"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-type collectionRules struct {
-	list   *string
-	view   *string
-	create *string
-	update *string
-	delete *string
-}
-
-// setCollectionAuthSettings applies Beszel's collection auth settings.
-func setCollectionAuthSettings(app core.App) error {
-	usersCollection, err := app.FindCollectionByNameOrId("users")
-	if err != nil {
-		return err
-	}
-	superusersCollection, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
-	if err != nil {
-		return err
-	}
-
-	// disable email auth if DISABLE_PASSWORD_AUTH env var is set
-	disablePasswordAuth, _ := utils.GetEnv("DISABLE_PASSWORD_AUTH")
-	usersCollection.PasswordAuth.Enabled = disablePasswordAuth != "true"
-	usersCollection.PasswordAuth.IdentityFields = []string{"email"}
-	// allow oauth user creation if USER_CREATION is set
-	if userCreation, _ := utils.GetEnv("USER_CREATION"); userCreation == "true" {
-		cr := "@request.context = 'oauth2'"
-		usersCollection.CreateRule = &cr
-	} else {
-		usersCollection.CreateRule = nil
-	}
-
-	// enable mfaOtp mfa if MFA_OTP env var is set
-	mfaOtp, _ := utils.GetEnv("MFA_OTP")
-	usersCollection.OTP.Length = 6
-	superusersCollection.OTP.Length = 6
-	usersCollection.OTP.Enabled = mfaOtp == "true"
-	usersCollection.MFA.Enabled = mfaOtp == "true"
-	superusersCollection.OTP.Enabled = mfaOtp == "true" || mfaOtp == "superusers"
-	superusersCollection.MFA.Enabled = mfaOtp == "true" || mfaOtp == "superusers"
-	if err := app.Save(superusersCollection); err != nil {
-		return err
-	}
-	if err := app.Save(usersCollection); err != nil {
-		return err
-	}
-
-	// When SHARE_ALL_SYSTEMS is enabled, any authenticated user can read
-	// system-scoped data. Write rules continue to block readonly users.
-	shareAllSystems, _ := utils.GetEnv("SHARE_ALL_SYSTEMS")
-
-	authenticatedRule := "@request.auth.id != \"\""
-	systemsMemberRule := authenticatedRule + " && users.id ?= @request.auth.id"
-	systemMemberRule := authenticatedRule + " && system.users.id ?= @request.auth.id"
-
-	systemsReadRule := systemsMemberRule
-	systemScopedReadRule := systemMemberRule
-	if shareAllSystems == "true" {
-		systemsReadRule = authenticatedRule
-		systemScopedReadRule = authenticatedRule
-	}
-	systemsWriteRule := systemsReadRule + " && @request.auth.role != \"readonly\""
-	systemScopedWriteRule := systemScopedReadRule + " && @request.auth.role != \"readonly\""
-
-	if err := applyCollectionRules(app, []string{"systems"}, collectionRules{
-		list:   &systemsReadRule,
-		view:   &systemsReadRule,
-		create: &systemsWriteRule,
-		update: &systemsWriteRule,
-		delete: &systemsWriteRule,
-	}); err != nil {
-		return err
-	}
-
-	if err := applyCollectionRules(app, []string{"containers", "container_stats", "system_stats", "systemd_services"}, collectionRules{
-		list: &systemScopedReadRule,
-	}); err != nil {
-		return err
-	}
-
-	if err := applyCollectionRules(app, []string{"smart_devices"}, collectionRules{
-		list:   &systemScopedReadRule,
-		view:   &systemScopedReadRule,
-		delete: &systemScopedWriteRule,
-	}); err != nil {
-		return err
-	}
-
-	if err := applyCollectionRules(app, []string{"fingerprints"}, collectionRules{
-		list:   &systemScopedReadRule,
-		view:   &systemScopedReadRule,
-		create: &systemScopedWriteRule,
-		update: &systemScopedWriteRule,
-		delete: &systemScopedWriteRule,
-	}); err != nil {
-		return err
-	}
-
-	if err := applyCollectionRules(app, []string{"system_details"}, collectionRules{
-		list: &systemScopedReadRule,
-		view: &systemScopedReadRule,
-	}); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func applyCollectionRules(app core.App, collectionNames []string, rules collectionRules) error {
-	for _, collectionName := range collectionNames {
-		collection, err := app.FindCollectionByNameOrId(collectionName)
-		if err != nil {
-			return err
-		}
-		collection.ListRule = rules.list
-		collection.ViewRule = rules.view
-		collection.CreateRule = rules.create
-		collection.UpdateRule = rules.update
-		collection.DeleteRule = rules.delete
-		if err := app.Save(collection); err != nil {
-			return err
-		}
-	}
-	return nil
-}

internal/hub/collections_test.go

@@ -1,527 +0,0 @@
-//go:build testing
-
-package hub_test
-
-import (
-	"fmt"
-	"net/http"
-	"testing"
-
-	beszelTests "github.com/henrygd/beszel/internal/tests"
-	"github.com/pocketbase/pocketbase/core"
-	pbTests "github.com/pocketbase/pocketbase/tests"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestCollectionRulesDefault(t *testing.T) {
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	const isUserMatchesUser = `@request.auth.id != "" && user = @request.auth.id`
-
-	const isUserInUsers = `@request.auth.id != "" && users.id ?= @request.auth.id`
-	const isUserInUsersNotReadonly = `@request.auth.id != "" && users.id ?= @request.auth.id && @request.auth.role != "readonly"`
-
-	const isUserInSystemUsers = `@request.auth.id != "" && system.users.id ?= @request.auth.id`
-	const isUserInSystemUsersNotReadonly = `@request.auth.id != "" && system.users.id ?= @request.auth.id && @request.auth.role != "readonly"`
-
-	// users collection
-	usersCollection, err := hub.FindCollectionByNameOrId("users")
-	assert.NoError(t, err, "Failed to find users collection")
-	assert.True(t, usersCollection.PasswordAuth.Enabled)
-	assert.Equal(t, usersCollection.PasswordAuth.IdentityFields, []string{"email"})
-	assert.Nil(t, usersCollection.CreateRule)
-	assert.False(t, usersCollection.MFA.Enabled)
-
-	// superusers collection
-	superusersCollection, err := hub.FindCollectionByNameOrId(core.CollectionNameSuperusers)
-	assert.NoError(t, err, "Failed to find superusers collection")
-	assert.True(t, superusersCollection.PasswordAuth.Enabled)
-	assert.Equal(t, superusersCollection.PasswordAuth.IdentityFields, []string{"email"})
-	assert.Nil(t, superusersCollection.CreateRule)
-	assert.False(t, superusersCollection.MFA.Enabled)
-
-	// alerts collection
-	alertsCollection, err := hub.FindCollectionByNameOrId("alerts")
-	require.NoError(t, err, "Failed to find alerts collection")
-	assert.Equal(t, isUserMatchesUser, *alertsCollection.ListRule)
-	assert.Nil(t, alertsCollection.ViewRule)
-	assert.Equal(t, isUserMatchesUser, *alertsCollection.CreateRule)
-	assert.Equal(t, isUserMatchesUser, *alertsCollection.UpdateRule)
-	assert.Equal(t, isUserMatchesUser, *alertsCollection.DeleteRule)
-
-	// alerts_history collection
-	alertsHistoryCollection, err := hub.FindCollectionByNameOrId("alerts_history")
-	require.NoError(t, err, "Failed to find alerts_history collection")
-	assert.Equal(t, isUserMatchesUser, *alertsHistoryCollection.ListRule)
-	assert.Nil(t, alertsHistoryCollection.ViewRule)
-	assert.Nil(t, alertsHistoryCollection.CreateRule)
-	assert.Nil(t, alertsHistoryCollection.UpdateRule)
-	assert.Equal(t, isUserMatchesUser, *alertsHistoryCollection.DeleteRule)
-
-	// containers collection
-	containersCollection, err := hub.FindCollectionByNameOrId("containers")
-	require.NoError(t, err, "Failed to find containers collection")
-	assert.Equal(t, isUserInSystemUsers, *containersCollection.ListRule)
-	assert.Nil(t, containersCollection.ViewRule)
-	assert.Nil(t, containersCollection.CreateRule)
-	assert.Nil(t, containersCollection.UpdateRule)
-	assert.Nil(t, containersCollection.DeleteRule)
-
-	// container_stats collection
-	containerStatsCollection, err := hub.FindCollectionByNameOrId("container_stats")
-	require.NoError(t, err, "Failed to find container_stats collection")
-	assert.Equal(t, isUserInSystemUsers, *containerStatsCollection.ListRule)
-	assert.Nil(t, containerStatsCollection.ViewRule)
-	assert.Nil(t, containerStatsCollection.CreateRule)
-	assert.Nil(t, containerStatsCollection.UpdateRule)
-	assert.Nil(t, containerStatsCollection.DeleteRule)
-
-	// fingerprints collection
-	fingerprintsCollection, err := hub.FindCollectionByNameOrId("fingerprints")
-	require.NoError(t, err, "Failed to find fingerprints collection")
-	assert.Equal(t, isUserInSystemUsers, *fingerprintsCollection.ListRule)
-	assert.Equal(t, isUserInSystemUsers, *fingerprintsCollection.ViewRule)
-	assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.CreateRule)
-	assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.UpdateRule)
-	assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.DeleteRule)
-
-	// quiet_hours collection
-	quietHoursCollection, err := hub.FindCollectionByNameOrId("quiet_hours")
-	require.NoError(t, err, "Failed to find quiet_hours collection")
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.ListRule)
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.ViewRule)
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.CreateRule)
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.UpdateRule)
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.DeleteRule)
-
-	// smart_devices collection
-	smartDevicesCollection, err := hub.FindCollectionByNameOrId("smart_devices")
-	require.NoError(t, err, "Failed to find smart_devices collection")
-	assert.Equal(t, isUserInSystemUsers, *smartDevicesCollection.ListRule)
-	assert.Equal(t, isUserInSystemUsers, *smartDevicesCollection.ViewRule)
-	assert.Nil(t, smartDevicesCollection.CreateRule)
-	assert.Nil(t, smartDevicesCollection.UpdateRule)
-	assert.Equal(t, isUserInSystemUsersNotReadonly, *smartDevicesCollection.DeleteRule)
-
-	// system_details collection
-	systemDetailsCollection, err := hub.FindCollectionByNameOrId("system_details")
-	require.NoError(t, err, "Failed to find system_details collection")
-	assert.Equal(t, isUserInSystemUsers, *systemDetailsCollection.ListRule)
-	assert.Equal(t, isUserInSystemUsers, *systemDetailsCollection.ViewRule)
-	assert.Nil(t, systemDetailsCollection.CreateRule)
-	assert.Nil(t, systemDetailsCollection.UpdateRule)
-	assert.Nil(t, systemDetailsCollection.DeleteRule)
-
-	// system_stats collection
-	systemStatsCollection, err := hub.FindCollectionByNameOrId("system_stats")
-	require.NoError(t, err, "Failed to find system_stats collection")
-	assert.Equal(t, isUserInSystemUsers, *systemStatsCollection.ListRule)
-	assert.Nil(t, systemStatsCollection.ViewRule)
-	assert.Nil(t, systemStatsCollection.CreateRule)
-	assert.Nil(t, systemStatsCollection.UpdateRule)
-	assert.Nil(t, systemStatsCollection.DeleteRule)
-
-	// systemd_services collection
-	systemdServicesCollection, err := hub.FindCollectionByNameOrId("systemd_services")
-	require.NoError(t, err, "Failed to find systemd_services collection")
-	assert.Equal(t, isUserInSystemUsers, *systemdServicesCollection.ListRule)
-	assert.Nil(t, systemdServicesCollection.ViewRule)
-	assert.Nil(t, systemdServicesCollection.CreateRule)
-	assert.Nil(t, systemdServicesCollection.UpdateRule)
-	assert.Nil(t, systemdServicesCollection.DeleteRule)
-
-	// systems collection
-	systemsCollection, err := hub.FindCollectionByNameOrId("systems")
-	require.NoError(t, err, "Failed to find systems collection")
-	assert.Equal(t, isUserInUsers, *systemsCollection.ListRule)
-	assert.Equal(t, isUserInUsers, *systemsCollection.ViewRule)
-	assert.Equal(t, isUserInUsersNotReadonly, *systemsCollection.CreateRule)
-	assert.Equal(t, isUserInUsersNotReadonly, *systemsCollection.UpdateRule)
-	assert.Equal(t, isUserInUsersNotReadonly, *systemsCollection.DeleteRule)
-
-	// universal_tokens collection
-	universalTokensCollection, err := hub.FindCollectionByNameOrId("universal_tokens")
-	require.NoError(t, err, "Failed to find universal_tokens collection")
-	assert.Nil(t, universalTokensCollection.ListRule)
-	assert.Nil(t, universalTokensCollection.ViewRule)
-	assert.Nil(t, universalTokensCollection.CreateRule)
-	assert.Nil(t, universalTokensCollection.UpdateRule)
-	assert.Nil(t, universalTokensCollection.DeleteRule)
-
-	// user_settings collection
-	userSettingsCollection, err := hub.FindCollectionByNameOrId("user_settings")
-	require.NoError(t, err, "Failed to find user_settings collection")
-	assert.Equal(t, isUserMatchesUser, *userSettingsCollection.ListRule)
-	assert.Nil(t, userSettingsCollection.ViewRule)
-	assert.Equal(t, isUserMatchesUser, *userSettingsCollection.CreateRule)
-	assert.Equal(t, isUserMatchesUser, *userSettingsCollection.UpdateRule)
-	assert.Nil(t, userSettingsCollection.DeleteRule)
-}
-
-func TestCollectionRulesShareAllSystems(t *testing.T) {
-	t.Setenv("SHARE_ALL_SYSTEMS", "true")
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	const isUser = `@request.auth.id != ""`
-	const isUserNotReadonly = `@request.auth.id != "" && @request.auth.role != "readonly"`
-
-	const isUserMatchesUser = `@request.auth.id != "" && user = @request.auth.id`
-
-	// alerts collection
-	alertsCollection, err := hub.FindCollectionByNameOrId("alerts")
-	require.NoError(t, err, "Failed to find alerts collection")
-	assert.Equal(t, isUserMatchesUser, *alertsCollection.ListRule)
-	assert.Nil(t, alertsCollection.ViewRule)
-	assert.Equal(t, isUserMatchesUser, *alertsCollection.CreateRule)
-	assert.Equal(t, isUserMatchesUser, *alertsCollection.UpdateRule)
-	assert.Equal(t, isUserMatchesUser, *alertsCollection.DeleteRule)
-
-	// alerts_history collection
-	alertsHistoryCollection, err := hub.FindCollectionByNameOrId("alerts_history")
-	require.NoError(t, err, "Failed to find alerts_history collection")
-	assert.Equal(t, isUserMatchesUser, *alertsHistoryCollection.ListRule)
-	assert.Nil(t, alertsHistoryCollection.ViewRule)
-	assert.Nil(t, alertsHistoryCollection.CreateRule)
-	assert.Nil(t, alertsHistoryCollection.UpdateRule)
-	assert.Equal(t, isUserMatchesUser, *alertsHistoryCollection.DeleteRule)
-
-	// containers collection
-	containersCollection, err := hub.FindCollectionByNameOrId("containers")
-	require.NoError(t, err, "Failed to find containers collection")
-	assert.Equal(t, isUser, *containersCollection.ListRule)
-	assert.Nil(t, containersCollection.ViewRule)
-	assert.Nil(t, containersCollection.CreateRule)
-	assert.Nil(t, containersCollection.UpdateRule)
-	assert.Nil(t, containersCollection.DeleteRule)
-
-	// container_stats collection
-	containerStatsCollection, err := hub.FindCollectionByNameOrId("container_stats")
-	require.NoError(t, err, "Failed to find container_stats collection")
-	assert.Equal(t, isUser, *containerStatsCollection.ListRule)
-	assert.Nil(t, containerStatsCollection.ViewRule)
-	assert.Nil(t, containerStatsCollection.CreateRule)
-	assert.Nil(t, containerStatsCollection.UpdateRule)
-	assert.Nil(t, containerStatsCollection.DeleteRule)
-
-	// fingerprints collection
-	fingerprintsCollection, err := hub.FindCollectionByNameOrId("fingerprints")
-	require.NoError(t, err, "Failed to find fingerprints collection")
-	assert.Equal(t, isUser, *fingerprintsCollection.ListRule)
-	assert.Equal(t, isUser, *fingerprintsCollection.ViewRule)
-	assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.CreateRule)
-	assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.UpdateRule)
-	assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.DeleteRule)
-
-	// quiet_hours collection
-	quietHoursCollection, err := hub.FindCollectionByNameOrId("quiet_hours")
-	require.NoError(t, err, "Failed to find quiet_hours collection")
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.ListRule)
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.ViewRule)
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.CreateRule)
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.UpdateRule)
-	assert.Equal(t, isUserMatchesUser, *quietHoursCollection.DeleteRule)
-
-	// smart_devices collection
-	smartDevicesCollection, err := hub.FindCollectionByNameOrId("smart_devices")
-	require.NoError(t, err, "Failed to find smart_devices collection")
-	assert.Equal(t, isUser, *smartDevicesCollection.ListRule)
-	assert.Equal(t, isUser, *smartDevicesCollection.ViewRule)
-	assert.Nil(t, smartDevicesCollection.CreateRule)
-	assert.Nil(t, smartDevicesCollection.UpdateRule)
-	assert.Equal(t, isUserNotReadonly, *smartDevicesCollection.DeleteRule)
-
-	// system_details collection
-	systemDetailsCollection, err := hub.FindCollectionByNameOrId("system_details")
-	require.NoError(t, err, "Failed to find system_details collection")
-	assert.Equal(t, isUser, *systemDetailsCollection.ListRule)
-	assert.Equal(t, isUser, *systemDetailsCollection.ViewRule)
-	assert.Nil(t, systemDetailsCollection.CreateRule)
-	assert.Nil(t, systemDetailsCollection.UpdateRule)
-	assert.Nil(t, systemDetailsCollection.DeleteRule)
-
-	// system_stats collection
-	systemStatsCollection, err := hub.FindCollectionByNameOrId("system_stats")
-	require.NoError(t, err, "Failed to find system_stats collection")
-	assert.Equal(t, isUser, *systemStatsCollection.ListRule)
-	assert.Nil(t, systemStatsCollection.ViewRule)
-	assert.Nil(t, systemStatsCollection.CreateRule)
-	assert.Nil(t, systemStatsCollection.UpdateRule)
-	assert.Nil(t, systemStatsCollection.DeleteRule)
-
-	// systemd_services collection
-	systemdServicesCollection, err := hub.FindCollectionByNameOrId("systemd_services")
-	require.NoError(t, err, "Failed to find systemd_services collection")
-	assert.Equal(t, isUser, *systemdServicesCollection.ListRule)
-	assert.Nil(t, systemdServicesCollection.ViewRule)
-	assert.Nil(t, systemdServicesCollection.CreateRule)
-	assert.Nil(t, systemdServicesCollection.UpdateRule)
-	assert.Nil(t, systemdServicesCollection.DeleteRule)
-
-	// systems collection
-	systemsCollection, err := hub.FindCollectionByNameOrId("systems")
-	require.NoError(t, err, "Failed to find systems collection")
-	assert.Equal(t, isUser, *systemsCollection.ListRule)
-	assert.Equal(t, isUser, *systemsCollection.ViewRule)
-	assert.Equal(t, isUserNotReadonly, *systemsCollection.CreateRule)
-	assert.Equal(t, isUserNotReadonly, *systemsCollection.UpdateRule)
-	assert.Equal(t, isUserNotReadonly, *systemsCollection.DeleteRule)
-
-	// universal_tokens collection
-	universalTokensCollection, err := hub.FindCollectionByNameOrId("universal_tokens")
-	require.NoError(t, err, "Failed to find universal_tokens collection")
-	assert.Nil(t, universalTokensCollection.ListRule)
-	assert.Nil(t, universalTokensCollection.ViewRule)
-	assert.Nil(t, universalTokensCollection.CreateRule)
-	assert.Nil(t, universalTokensCollection.UpdateRule)
-	assert.Nil(t, universalTokensCollection.DeleteRule)
-
-	// user_settings collection
-	userSettingsCollection, err := hub.FindCollectionByNameOrId("user_settings")
-	require.NoError(t, err, "Failed to find user_settings collection")
-	assert.Equal(t, isUserMatchesUser, *userSettingsCollection.ListRule)
-	assert.Nil(t, userSettingsCollection.ViewRule)
-	assert.Equal(t, isUserMatchesUser, *userSettingsCollection.CreateRule)
-	assert.Equal(t, isUserMatchesUser, *userSettingsCollection.UpdateRule)
-	assert.Nil(t, userSettingsCollection.DeleteRule)
-}
-
-func TestDisablePasswordAuth(t *testing.T) {
-	t.Setenv("DISABLE_PASSWORD_AUTH", "true")
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	usersCollection, err := hub.FindCollectionByNameOrId("users")
-	assert.NoError(t, err)
-	assert.False(t, usersCollection.PasswordAuth.Enabled)
-}
-
-func TestUserCreation(t *testing.T) {
-	t.Setenv("USER_CREATION", "true")
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	usersCollection, err := hub.FindCollectionByNameOrId("users")
-	assert.NoError(t, err)
-	assert.Equal(t, "@request.context = 'oauth2'", *usersCollection.CreateRule)
-}
-
-func TestMFAOtp(t *testing.T) {
-	t.Setenv("MFA_OTP", "true")
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	usersCollection, err := hub.FindCollectionByNameOrId("users")
-	assert.NoError(t, err)
-	assert.True(t, usersCollection.OTP.Enabled)
-	assert.True(t, usersCollection.MFA.Enabled)
-
-	superusersCollection, err := hub.FindCollectionByNameOrId(core.CollectionNameSuperusers)
-	assert.NoError(t, err)
-	assert.True(t, superusersCollection.OTP.Enabled)
-	assert.True(t, superusersCollection.MFA.Enabled)
-}
-
-func TestApiCollectionsAuthRules(t *testing.T) {
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	hub.StartHub()
-
-	user1, _ := beszelTests.CreateUser(hub, "user1@example.com", "password")
-	user1Token, _ := user1.NewAuthToken()
-
-	user2, _ := beszelTests.CreateUser(hub, "user2@example.com", "password")
-	// user2Token, _ := user2.NewAuthToken()
-
-	userReadonly, _ := beszelTests.CreateUserWithRole(hub, "userreadonly@example.com", "password", "readonly")
-	userReadonlyToken, _ := userReadonly.NewAuthToken()
-
-	userOneSystem, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system1",
-		"users": []string{user1.Id},
-		"host":  "127.0.0.1",
-	})
-
-	sharedSystem, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system2",
-		"users": []string{user1.Id, user2.Id},
-		"host":  "127.0.0.2",
-	})
-
-	userTwoSystem, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system3",
-		"users": []string{user2.Id},
-		"host":  "127.0.0.2",
-	})
-
-	userRecords, _ := hub.CountRecords("users")
-	assert.EqualValues(t, 3, userRecords, "all users should be created")
-
-	systemRecords, _ := hub.CountRecords("systems")
-	assert.EqualValues(t, 3, systemRecords, "all systems should be created")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		{
-			Name:               "Unauthorized user cannot list systems",
-			Method:             http.MethodGet,
-			URL:                "/api/collections/systems/records",
-			ExpectedStatus:     200, // https://github.com/pocketbase/pocketbase/discussions/1570
-			TestAppFactory:     testAppFactory,
-			ExpectedContent:    []string{`"items":[]`, `"totalItems":0`},
-			NotExpectedContent: []string{userOneSystem.Id, sharedSystem.Id, userTwoSystem.Id},
-		},
-		{
-			Name:               "Unauthorized user cannot delete a system",
-			Method:             http.MethodDelete,
-			URL:                fmt.Sprintf("/api/collections/systems/records/%s", userOneSystem.Id),
-			ExpectedStatus:     404,
-			TestAppFactory:     testAppFactory,
-			ExpectedContent:    []string{"resource wasn't found"},
-			NotExpectedContent: []string{userOneSystem.Id},
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 3, systemsCount, "should have 3 systems before deletion")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 3, systemsCount, "should still have 3 systems after failed deletion")
-			},
-		},
-		{
-			Name:   "User 1 can list their own systems",
-			Method: http.MethodGet,
-			URL:    "/api/collections/systems/records",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:     200,
-			ExpectedContent:    []string{userOneSystem.Id, sharedSystem.Id},
-			NotExpectedContent: []string{userTwoSystem.Id},
-			TestAppFactory:     testAppFactory,
-		},
-		{
-			Name:   "User 1 cannot list user 2's system",
-			Method: http.MethodGet,
-			URL:    "/api/collections/systems/records",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:     200,
-			ExpectedContent:    []string{userOneSystem.Id, sharedSystem.Id},
-			NotExpectedContent: []string{userTwoSystem.Id},
-			TestAppFactory:     testAppFactory,
-		},
-		{
-			Name:   "User 1 can see user 2's system if SHARE_ALL_SYSTEMS is enabled",
-			Method: http.MethodGet,
-			URL:    "/api/collections/systems/records",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{userOneSystem.Id, sharedSystem.Id, userTwoSystem.Id},
-			TestAppFactory:  testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "true")
-				hub.SetCollectionAuthSettings()
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "")
-				hub.SetCollectionAuthSettings()
-			},
-		},
-		{
-			Name:   "User 1 can delete their own system",
-			Method: http.MethodDelete,
-			URL:    fmt.Sprintf("/api/collections/systems/records/%s", userOneSystem.Id),
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus: 204,
-			TestAppFactory: testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 3, systemsCount, "should have 3 systems before deletion")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 2, systemsCount, "should have 2 systems after deletion")
-			},
-		},
-		{
-			Name:   "User 1 cannot delete user 2's system",
-			Method: http.MethodDelete,
-			URL:    fmt.Sprintf("/api/collections/systems/records/%s", userTwoSystem.Id),
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  404,
-			TestAppFactory:  testAppFactory,
-			ExpectedContent: []string{"resource wasn't found"},
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 2, systemsCount)
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 2, systemsCount)
-			},
-		},
-		{
-			Name:   "Readonly cannot delete a system even if SHARE_ALL_SYSTEMS is enabled",
-			Method: http.MethodDelete,
-			URL:    fmt.Sprintf("/api/collections/systems/records/%s", sharedSystem.Id),
-			Headers: map[string]string{
-				"Authorization": userReadonlyToken,
-			},
-			ExpectedStatus:  404,
-			ExpectedContent: []string{"resource wasn't found"},
-			TestAppFactory:  testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "true")
-				hub.SetCollectionAuthSettings()
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 2, systemsCount)
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "")
-				hub.SetCollectionAuthSettings()
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 2, systemsCount)
-			},
-		},
-		{
-			Name:   "User 1 can delete user 2's system if SHARE_ALL_SYSTEMS is enabled",
-			Method: http.MethodDelete,
-			URL:    fmt.Sprintf("/api/collections/systems/records/%s", userTwoSystem.Id),
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus: 204,
-			TestAppFactory: testAppFactory,
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "true")
-				hub.SetCollectionAuthSettings()
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 2, systemsCount)
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				t.Setenv("SHARE_ALL_SYSTEMS", "")
-				hub.SetCollectionAuthSettings()
-				systemsCount, _ := app.CountRecords("systems")
-				assert.EqualValues(t, 1, systemsCount)
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}

internal/hub/config/config.go

@@ -279,6 +279,9 @@ func createFingerprintRecord(app core.App, systemID, token string) error {
 
 // Returns the current config.yml file as a JSON object
 func GetYamlConfig(e *core.RequestEvent) error {
+	if e.Auth.GetString("role") != "admin" {
+		return e.ForbiddenError("Requires admin role", nil)
+	}
 	configContent, err := generateYAML(e.App)
 	if err != nil {
 		return err

internal/hub/expirymap/expirymap.go

@@ -1,39 +1,35 @@
-// Package expirymap provides a thread-safe map with expiring entries.
-// It supports TTL-based expiration with both lazy cleanup on access
-// and periodic background cleanup.
 package expirymap
 
 import (
-	"sync"
+	"reflect"
 	"time"
 
 	"github.com/pocketbase/pocketbase/tools/store"
 )
 
-type val[T comparable] struct {
+type val[T any] struct {
 	value   T
 	expires time.Time
 }
 
-type ExpiryMap[T comparable] struct {
-	store    *store.Store[string, val[T]]
-	stopChan chan struct{}
-	stopOnce sync.Once
+type ExpiryMap[T any] struct {
+	store           *store.Store[string, *val[T]]
+	cleanupInterval time.Duration
 }
 
 // New creates a new expiry map with custom cleanup interval
-func New[T comparable](cleanupInterval time.Duration) *ExpiryMap[T] {
+func New[T any](cleanupInterval time.Duration) *ExpiryMap[T] {
 	m := &ExpiryMap[T]{
-		store:    store.New(map[string]val[T]{}),
-		stopChan: make(chan struct{}),
+		store:           store.New(map[string]*val[T]{}),
+		cleanupInterval: cleanupInterval,
 	}
-	go m.startCleaner(cleanupInterval)
+	m.startCleaner()
 	return m
 }
 
 // Set stores a value with the given TTL
 func (m *ExpiryMap[T]) Set(key string, value T, ttl time.Duration) {
-	m.store.Set(key, val[T]{
+	m.store.Set(key, &val[T]{
 		value:   value,
 		expires: time.Now().Add(ttl),
 	})
@@ -59,7 +55,7 @@ func (m *ExpiryMap[T]) GetOk(key string) (T, bool) {
 // GetByValue retrieves a value by value
 func (m *ExpiryMap[T]) GetByValue(val T) (key string, value T, ok bool) {
 	for key, v := range m.store.GetAll() {
-		if v.value == val {
+		if reflect.DeepEqual(v.value, val) {
 			// check if expired
 			if v.expires.Before(time.Now()) {
 				m.store.Remove(key)
@@ -79,7 +75,7 @@ func (m *ExpiryMap[T]) Remove(key string) {
 // RemovebyValue removes a value by value
 func (m *ExpiryMap[T]) RemovebyValue(value T) (T, bool) {
 	for key, val := range m.store.GetAll() {
-		if val.value == value {
+		if reflect.DeepEqual(val.value, value) {
 			m.store.Remove(key)
 			return val.value, true
 		}
@@ -88,23 +84,13 @@ func (m *ExpiryMap[T]) RemovebyValue(value T) (T, bool) {
 }
 
 // startCleaner runs the background cleanup process
-func (m *ExpiryMap[T]) startCleaner(interval time.Duration) {
-	tick := time.Tick(interval)
-	for {
-		select {
-		case <-tick:
+func (m *ExpiryMap[T]) startCleaner() {
+	go func() {
+		tick := time.Tick(m.cleanupInterval)
+		for range tick {
 			m.cleanup()
-		case <-m.stopChan:
-			return
 		}
-	}
-}
-
-// StopCleaner stops the background cleanup process
-func (m *ExpiryMap[T]) StopCleaner() {
-	m.stopOnce.Do(func() {
-		close(m.stopChan)
-	})
+	}()
 }
 
 // cleanup removes all expired entries
@@ -116,12 +102,3 @@ func (m *ExpiryMap[T]) cleanup() {
 		}
 	}
 }
-
-// UpdateExpiration updates the expiration time of a key
-func (m *ExpiryMap[T]) UpdateExpiration(key string, ttl time.Duration) {
-	value, ok := m.store.GetOk(key)
-	if ok {
-		value.expires = time.Now().Add(ttl)
-		m.store.Set(key, value)
-	}
-}

internal/hub/expirymap/expirymap_test.go

@@ -4,7 +4,6 @@ package expirymap
 
 import (
 	"testing"
-	"testing/synctest"
 	"time"
 
 	"github.com/stretchr/testify/assert"
@@ -178,33 +177,6 @@ func TestExpiryMap_GenericTypes(t *testing.T) {
 	})
 }
 
-func TestExpiryMap_UpdateExpiration(t *testing.T) {
-	em := New[string](time.Hour)
-
-	// Set a value with short TTL
-	em.Set("key1", "value1", time.Millisecond*50)
-
-	// Verify it exists
-	assert.True(t, em.Has("key1"))
-
-	// Update expiration to a longer TTL
-	em.UpdateExpiration("key1", time.Hour)
-
-	// Wait for the original TTL to pass
-	time.Sleep(time.Millisecond * 100)
-
-	// Should still exist because expiration was updated
-	assert.True(t, em.Has("key1"))
-	value, ok := em.GetOk("key1")
-	assert.True(t, ok)
-	assert.Equal(t, "value1", value)
-
-	// Try updating non-existent key (should not panic)
-	assert.NotPanics(t, func() {
-		em.UpdateExpiration("nonexistent", time.Hour)
-	})
-}
-
 func TestExpiryMap_ZeroValues(t *testing.T) {
 	em := New[string](time.Hour)
 
@@ -501,52 +473,3 @@ func TestExpiryMap_ValueOperations_Integration(t *testing.T) {
 	assert.Equal(t, "unique", value)
 	assert.Equal(t, "key2", key)
 }
-
-func TestExpiryMap_Cleaner(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		em := New[string](time.Second)
-		defer em.StopCleaner()
-
-		em.Set("test", "value", 500*time.Millisecond)
-
-		// Wait 600ms, value is expired but cleaner hasn't run yet (interval is 1s)
-		time.Sleep(600 * time.Millisecond)
-		synctest.Wait()
-
-		// Map should still hold the value in its internal store before lazy access or cleaner
-		assert.Equal(t, 1, len(em.store.GetAll()), "store should still have 1 item before cleaner runs")
-
-		// Wait another 500ms so cleaner (1s interval) runs
-		time.Sleep(500 * time.Millisecond)
-		synctest.Wait() // Wait for background goroutine to process the tick
-
-		assert.Equal(t, 0, len(em.store.GetAll()), "store should be empty after cleaner runs")
-	})
-}
-
-func TestExpiryMap_StopCleaner(t *testing.T) {
-	em := New[string](time.Hour)
-
-	// Initially, stopChan is open, reading would block
-	select {
-	case <-em.stopChan:
-		t.Fatal("stopChan should be open initially")
-	default:
-		// success
-	}
-
-	em.StopCleaner()
-
-	// After StopCleaner, stopChan is closed, reading returns immediately
-	select {
-	case <-em.stopChan:
-		// success
-	default:
-		t.Fatal("stopChan was not closed by StopCleaner")
-	}
-
-	// Calling StopCleaner again should NOT panic thanks to sync.Once
-	assert.NotPanics(t, func() {
-		em.StopCleaner()
-	})
-}

internal/hub/hub.go

@@ -4,27 +4,31 @@ package hub
 import (
 	"crypto/ed25519"
 	"encoding/pem"
-	"errors"
 	"fmt"
+	"net/http"
 	"net/url"
 	"os"
 	"path"
+	"regexp"
 	"strings"
+	"time"
 
+	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/internal/alerts"
 	"github.com/henrygd/beszel/internal/hub/config"
 	"github.com/henrygd/beszel/internal/hub/heartbeat"
 	"github.com/henrygd/beszel/internal/hub/systems"
-	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/henrygd/beszel/internal/records"
 	"github.com/henrygd/beszel/internal/users"
 
+	"github.com/google/uuid"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase"
+	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
 	"golang.org/x/crypto/ssh"
 )
 
-// Hub is the application. It embeds the PocketBase app and keeps references to subcomponents.
 type Hub struct {
 	core.App
 	*alerts.AlertManager
@@ -38,43 +42,40 @@ type Hub struct {
 	appURL string
 }
 
+var containerIDPattern = regexp.MustCompile(`^[a-fA-F0-9]{12,64}$`)
+
 // NewHub creates a new Hub instance with default configuration
 func NewHub(app core.App) *Hub {
-	hub := &Hub{App: app}
+	hub := &Hub{}
+	hub.App = app
+
 	hub.AlertManager = alerts.NewAlertManager(hub)
 	hub.um = users.NewUserManager(hub)
 	hub.rm = records.NewRecordManager(hub)
 	hub.sm = systems.NewSystemManager(hub)
-	hub.hb = heartbeat.New(app, utils.GetEnv)
+	hub.appURL, _ = GetEnv("APP_URL")
+	hub.hb = heartbeat.New(app, GetEnv)
 	if hub.hb != nil {
 		hub.hbStop = make(chan struct{})
 	}
-	_ = onAfterBootstrapAndMigrations(app, hub.initialize)
 	return hub
 }
 
-// onAfterBootstrapAndMigrations ensures the provided function runs after the database is set up and migrations are applied.
-// This is a workaround for behavior in PocketBase where onBootstrap runs before migrations, forcing use of onServe for this purpose.
-// However, PB's tests.TestApp is already bootstrapped, generally doesn't serve, but does handle migrations.
-// So this ensures that the provided function runs at the right time either way, after DB is ready and migrations are done.
-func onAfterBootstrapAndMigrations(app core.App, fn func(app core.App) error) error {
-	// pb tests.TestApp is already bootstrapped and doesn't serve
-	if app.IsBootstrapped() {
-		return fn(app)
+// GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
+func GetEnv(key string) (value string, exists bool) {
+	if value, exists = os.LookupEnv("BESZEL_HUB_" + key); exists {
+		return value, exists
 	}
-	// Must use OnServe because OnBootstrap appears to run before migrations, even if calling e.Next() before anything else
-	app.OnServe().BindFunc(func(e *core.ServeEvent) error {
-		if err := fn(e.App); err != nil {
-			return err
-		}
-		return e.Next()
-	})
-	return nil
+	// Fallback to the old unprefixed key
+	return os.LookupEnv(key)
 }
 
-// StartHub sets up event handlers and starts the PocketBase server
 func (h *Hub) StartHub() error {
 	h.App.OnServe().BindFunc(func(e *core.ServeEvent) error {
+		// initialize settings / collections
+		if err := h.initialize(e); err != nil {
+			return err
+		}
 		// sync systems with config
 		if err := config.SyncSystems(e); err != nil {
 			return err
@@ -109,29 +110,132 @@ func (h *Hub) StartHub() error {
 	h.App.OnRecordCreate("users").BindFunc(h.um.InitializeUserRole)
 	h.App.OnRecordCreate("user_settings").BindFunc(h.um.InitializeUserSettings)
 
-	pb, ok := h.App.(*pocketbase.PocketBase)
-	if !ok {
-		return errors.New("not a pocketbase app")
+	if pb, ok := h.App.(*pocketbase.PocketBase); ok {
+		// log.Println("Starting pocketbase")
+		err := pb.Start()
+		if err != nil {
+			return err
 		}
-	return pb.Start()
+	}
+
+	return nil
 }
 
 // initialize sets up initial configuration (collections, settings, etc.)
-func (h *Hub) initialize(app core.App) error {
+func (h *Hub) initialize(e *core.ServeEvent) error {
 	// set general settings
-	settings := app.Settings()
-	// batch requests (for alerts)
+	settings := e.App.Settings()
+	// batch requests (for global alerts)
 	settings.Batch.Enabled = true
-	// set URL if APP_URL env is set
-	if appURL, isSet := utils.GetEnv("APP_URL"); isSet {
-		h.appURL = appURL
-		settings.Meta.AppURL = appURL
+	// set URL if BASE_URL env is set
+	if h.appURL != "" {
+		settings.Meta.AppURL = h.appURL
 	}
-	if err := app.Save(settings); err != nil {
+	if err := e.App.Save(settings); err != nil {
 		return err
 	}
 	// set auth settings
-	return setCollectionAuthSettings(app)
+	if err := setCollectionAuthSettings(e.App); err != nil {
+		return err
+	}
+	return nil
+}
+
+// setCollectionAuthSettings sets up default authentication settings for the app
+func setCollectionAuthSettings(app core.App) error {
+	usersCollection, err := app.FindCollectionByNameOrId("users")
+	if err != nil {
+		return err
+	}
+	superusersCollection, err := app.FindCollectionByNameOrId(core.CollectionNameSuperusers)
+	if err != nil {
+		return err
+	}
+
+	// disable email auth if DISABLE_PASSWORD_AUTH env var is set
+	disablePasswordAuth, _ := GetEnv("DISABLE_PASSWORD_AUTH")
+	usersCollection.PasswordAuth.Enabled = disablePasswordAuth != "true"
+	usersCollection.PasswordAuth.IdentityFields = []string{"email"}
+	// allow oauth user creation if USER_CREATION is set
+	if userCreation, _ := GetEnv("USER_CREATION"); userCreation == "true" {
+		cr := "@request.context = 'oauth2'"
+		usersCollection.CreateRule = &cr
+	} else {
+		usersCollection.CreateRule = nil
+	}
+
+	// enable mfaOtp mfa if MFA_OTP env var is set
+	mfaOtp, _ := GetEnv("MFA_OTP")
+	usersCollection.OTP.Length = 6
+	superusersCollection.OTP.Length = 6
+	usersCollection.OTP.Enabled = mfaOtp == "true"
+	usersCollection.MFA.Enabled = mfaOtp == "true"
+	superusersCollection.OTP.Enabled = mfaOtp == "true" || mfaOtp == "superusers"
+	superusersCollection.MFA.Enabled = mfaOtp == "true" || mfaOtp == "superusers"
+	if err := app.Save(superusersCollection); err != nil {
+		return err
+	}
+	if err := app.Save(usersCollection); err != nil {
+		return err
+	}
+
+	shareAllSystems, _ := GetEnv("SHARE_ALL_SYSTEMS")
+
+	// allow all users to access systems if SHARE_ALL_SYSTEMS is set
+	systemsCollection, err := app.FindCollectionByNameOrId("systems")
+	if err != nil {
+		return err
+	}
+	var systemsReadRule string
+	if shareAllSystems == "true" {
+		systemsReadRule = "@request.auth.id != \"\""
+	} else {
+		systemsReadRule = "@request.auth.id != \"\" && users.id ?= @request.auth.id"
+	}
+	updateDeleteRule := systemsReadRule + " && @request.auth.role != \"readonly\""
+	systemsCollection.ListRule = &systemsReadRule
+	systemsCollection.ViewRule = &systemsReadRule
+	systemsCollection.UpdateRule = &updateDeleteRule
+	systemsCollection.DeleteRule = &updateDeleteRule
+	if err := app.Save(systemsCollection); err != nil {
+		return err
+	}
+
+	// allow all users to access all containers if SHARE_ALL_SYSTEMS is set
+	containersCollection, err := app.FindCollectionByNameOrId("containers")
+	if err != nil {
+		return err
+	}
+	containersListRule := strings.Replace(systemsReadRule, "users.id", "system.users.id", 1)
+	containersCollection.ListRule = &containersListRule
+	if err := app.Save(containersCollection); err != nil {
+		return err
+	}
+
+	// allow all users to access system-related collections if SHARE_ALL_SYSTEMS is set
+	// these collections all have a "system" relation field
+	systemRelatedCollections := []string{"system_details", "smart_devices", "systemd_services"}
+	for _, collectionName := range systemRelatedCollections {
+		collection, err := app.FindCollectionByNameOrId(collectionName)
+		if err != nil {
+			return err
+		}
+		collection.ListRule = &containersListRule
+		// set viewRule for collections that need it (system_details, smart_devices)
+		if collection.ViewRule != nil {
+			collection.ViewRule = &containersListRule
+		}
+		// set deleteRule for smart_devices (allows user to dismiss disk warnings)
+		if collectionName == "smart_devices" {
+			deleteRule := containersListRule + " && @request.auth.role != \"readonly\""
+			collection.DeleteRule = &deleteRule
+		}
+		if err := app.Save(collection); err != nil {
+			return err
+		}
+	}
+
+	return nil
 }
 
 // registerCronJobs sets up scheduled tasks
@@ -143,7 +247,296 @@ func (h *Hub) registerCronJobs(_ *core.ServeEvent) error {
 	return nil
 }
 
-// GetSSHKey generates key pair if it doesn't exist and returns signer
+// custom middlewares
+func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
+	// authorizes request with user matching the provided email
+	authorizeRequestWithEmail := func(e *core.RequestEvent, email string) (err error) {
+		if e.Auth != nil || email == "" {
+			return e.Next()
+		}
+		isAuthRefresh := e.Request.URL.Path == "/api/collections/users/auth-refresh" && e.Request.Method == http.MethodPost
+		e.Auth, err = e.App.FindFirstRecordByData("users", "email", email)
+		if err != nil || !isAuthRefresh {
+			return e.Next()
+		}
+		// auth refresh endpoint, make sure token is set in header
+		token, _ := e.Auth.NewAuthToken()
+		e.Request.Header.Set("Authorization", token)
+		return e.Next()
+	}
+	// authenticate with trusted header
+	if autoLogin, _ := GetEnv("AUTO_LOGIN"); autoLogin != "" {
+		se.Router.BindFunc(func(e *core.RequestEvent) error {
+			return authorizeRequestWithEmail(e, autoLogin)
+		})
+	}
+	// authenticate with trusted header
+	if trustedHeader, _ := GetEnv("TRUSTED_AUTH_HEADER"); trustedHeader != "" {
+		se.Router.BindFunc(func(e *core.RequestEvent) error {
+			return authorizeRequestWithEmail(e, e.Request.Header.Get(trustedHeader))
+		})
+	}
+}
+
+// custom api routes
+func (h *Hub) registerApiRoutes(se *core.ServeEvent) error {
+	// auth protected routes
+	apiAuth := se.Router.Group("/api/beszel")
+	apiAuth.Bind(apis.RequireAuth())
+	// auth optional routes
+	apiNoAuth := se.Router.Group("/api/beszel")
+
+	// create first user endpoint only needed if no users exist
+	if totalUsers, _ := se.App.CountRecords("users"); totalUsers == 0 {
+		apiNoAuth.POST("/create-user", h.um.CreateFirstUser)
+	}
+	// check if first time setup on login page
+	apiNoAuth.GET("/first-run", func(e *core.RequestEvent) error {
+		total, err := e.App.CountRecords("users")
+		return e.JSON(http.StatusOK, map[string]bool{"firstRun": err == nil && total == 0})
+	})
+	// get public key and version
+	apiAuth.GET("/getkey", func(e *core.RequestEvent) error {
+		return e.JSON(http.StatusOK, map[string]string{"key": h.pubKey, "v": beszel.Version})
+	})
+	// send test notification
+	apiAuth.POST("/test-notification", h.SendTestNotification)
+	// heartbeat status and test
+	apiAuth.GET("/heartbeat-status", h.getHeartbeatStatus)
+	apiAuth.POST("/test-heartbeat", h.testHeartbeat)
+	// get config.yml content
+	apiAuth.GET("/config-yaml", config.GetYamlConfig)
+	// handle agent websocket connection
+	apiNoAuth.GET("/agent-connect", h.handleAgentConnect)
+	// get or create universal tokens
+	apiAuth.GET("/universal-token", h.getUniversalToken)
+	// update / delete user alerts
+	apiAuth.POST("/user-alerts", alerts.UpsertUserAlerts)
+	apiAuth.DELETE("/user-alerts", alerts.DeleteUserAlerts)
+	// refresh SMART devices for a system
+	apiAuth.POST("/smart/refresh", h.refreshSmartData)
+	// get systemd service details
+	apiAuth.GET("/systemd/info", h.getSystemdInfo)
+	// /containers routes
+	if enabled, _ := GetEnv("CONTAINER_DETAILS"); enabled != "false" {
+		// get container logs
+		apiAuth.GET("/containers/logs", h.getContainerLogs)
+		// get container info
+		apiAuth.GET("/containers/info", h.getContainerInfo)
+	}
+	return nil
+}
+
+// Handler for universal token API endpoint (create, read, delete)
+func (h *Hub) getUniversalToken(e *core.RequestEvent) error {
+	tokenMap := universalTokenMap.GetMap()
+	userID := e.Auth.Id
+	query := e.Request.URL.Query()
+	token := query.Get("token")
+	enable := query.Get("enable")
+	permanent := query.Get("permanent")
+
+	// helper for deleting any existing permanent token record for this user
+	deletePermanent := func() error {
+		rec, err := h.FindFirstRecordByFilter("universal_tokens", "user = {:user}", dbx.Params{"user": userID})
+		if err != nil {
+			return nil // no record
+		}
+		return h.Delete(rec)
+	}
+
+	// helper for upserting a permanent token record for this user
+	upsertPermanent := func(token string) error {
+		rec, err := h.FindFirstRecordByFilter("universal_tokens", "user = {:user}", dbx.Params{"user": userID})
+		if err == nil {
+			rec.Set("token", token)
+			return h.Save(rec)
+		}
+
+		col, err := h.FindCachedCollectionByNameOrId("universal_tokens")
+		if err != nil {
+			return err
+		}
+		newRec := core.NewRecord(col)
+		newRec.Set("user", userID)
+		newRec.Set("token", token)
+		return h.Save(newRec)
+	}
+
+	// Disable universal tokens (both ephemeral and permanent)
+	if enable == "0" {
+		tokenMap.RemovebyValue(userID)
+		_ = deletePermanent()
+		return e.JSON(http.StatusOK, map[string]any{"token": token, "active": false, "permanent": false})
+	}
+
+	// Enable universal token (ephemeral or permanent)
+	if enable == "1" {
+		if token == "" {
+			token = uuid.New().String()
+		}
+
+		if permanent == "1" {
+			// make token permanent (persist across restarts)
+			tokenMap.RemovebyValue(userID)
+			if err := upsertPermanent(token); err != nil {
+				return err
+			}
+			return e.JSON(http.StatusOK, map[string]any{"token": token, "active": true, "permanent": true})
+		}
+
+		// default: ephemeral mode (1 hour)
+		_ = deletePermanent()
+		tokenMap.Set(token, userID, time.Hour)
+		return e.JSON(http.StatusOK, map[string]any{"token": token, "active": true, "permanent": false})
+	}
+
+	// Read current state
+	// Prefer permanent token if it exists.
+	if rec, err := h.FindFirstRecordByFilter("universal_tokens", "user = {:user}", dbx.Params{"user": userID}); err == nil {
+		dbToken := rec.GetString("token")
+		// If no token was provided, or the caller is asking about their permanent token, return it.
+		if token == "" || token == dbToken {
+			return e.JSON(http.StatusOK, map[string]any{"token": dbToken, "active": true, "permanent": true})
+		}
+		// Token doesn't match their permanent token (avoid leaking other info)
+		return e.JSON(http.StatusOK, map[string]any{"token": token, "active": false, "permanent": false})
+	}
+
+	// No permanent token; fall back to ephemeral token map.
+	if token == "" {
+		// return existing token if it exists
+		if token, _, ok := tokenMap.GetByValue(userID); ok {
+			return e.JSON(http.StatusOK, map[string]any{"token": token, "active": true, "permanent": false})
+		}
+		// if no token is provided, generate a new one
+		token = uuid.New().String()
+	}
+
+	// Token is considered active only if it belongs to the current user.
+	activeUser, ok := tokenMap.GetOk(token)
+	active := ok && activeUser == userID
+	response := map[string]any{"token": token, "active": active, "permanent": false}
+	return e.JSON(http.StatusOK, response)
+}
+
+// getHeartbeatStatus returns current heartbeat configuration and whether it's enabled
+func (h *Hub) getHeartbeatStatus(e *core.RequestEvent) error {
+	if e.Auth.GetString("role") != "admin" {
+		return e.ForbiddenError("Requires admin role", nil)
+	}
+	if h.hb == nil {
+		return e.JSON(http.StatusOK, map[string]any{
+			"enabled": false,
+			"msg":     "Set HEARTBEAT_URL to enable outbound heartbeat monitoring",
+		})
+	}
+	cfg := h.hb.GetConfig()
+	return e.JSON(http.StatusOK, map[string]any{
+		"enabled":  true,
+		"url":      cfg.URL,
+		"interval": cfg.Interval,
+		"method":   cfg.Method,
+	})
+}
+
+// testHeartbeat triggers a single heartbeat ping and returns the result
+func (h *Hub) testHeartbeat(e *core.RequestEvent) error {
+	if e.Auth.GetString("role") != "admin" {
+		return e.ForbiddenError("Requires admin role", nil)
+	}
+	if h.hb == nil {
+		return e.JSON(http.StatusOK, map[string]any{
+			"err": "Heartbeat not configured. Set HEARTBEAT_URL environment variable.",
+		})
+	}
+	if err := h.hb.Send(); err != nil {
+		return e.JSON(http.StatusOK, map[string]any{"err": err.Error()})
+	}
+	return e.JSON(http.StatusOK, map[string]any{"err": false})
+}
+
+// containerRequestHandler handles both container logs and info requests
+func (h *Hub) containerRequestHandler(e *core.RequestEvent, fetchFunc func(*systems.System, string) (string, error), responseKey string) error {
+	systemID := e.Request.URL.Query().Get("system")
+	containerID := e.Request.URL.Query().Get("container")
+
+	if systemID == "" || containerID == "" {
+		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system and container parameters are required"})
+	}
+	if !containerIDPattern.MatchString(containerID) {
+		return e.JSON(http.StatusBadRequest, map[string]string{"error": "invalid container parameter"})
+	}
+
+	system, err := h.sm.GetSystem(systemID)
+	if err != nil {
+		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
+	}
+
+	data, err := fetchFunc(system, containerID)
+	if err != nil {
+		return e.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
+	}
+
+	return e.JSON(http.StatusOK, map[string]string{responseKey: data})
+}
+
+// getContainerLogs handles GET /api/beszel/containers/logs requests
+func (h *Hub) getContainerLogs(e *core.RequestEvent) error {
+	return h.containerRequestHandler(e, func(system *systems.System, containerID string) (string, error) {
+		return system.FetchContainerLogsFromAgent(containerID)
+	}, "logs")
+}
+
+func (h *Hub) getContainerInfo(e *core.RequestEvent) error {
+	return h.containerRequestHandler(e, func(system *systems.System, containerID string) (string, error) {
+		return system.FetchContainerInfoFromAgent(containerID)
+	}, "info")
+}
+
+// getSystemdInfo handles GET /api/beszel/systemd/info requests
+func (h *Hub) getSystemdInfo(e *core.RequestEvent) error {
+	query := e.Request.URL.Query()
+	systemID := query.Get("system")
+	serviceName := query.Get("service")
+
+	if systemID == "" || serviceName == "" {
+		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system and service parameters are required"})
+	}
+	system, err := h.sm.GetSystem(systemID)
+	if err != nil {
+		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
+	}
+	details, err := system.FetchSystemdInfoFromAgent(serviceName)
+	if err != nil {
+		return e.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
+	}
+	e.Response.Header().Set("Cache-Control", "public, max-age=60")
+	return e.JSON(http.StatusOK, map[string]any{"details": details})
+}
+
+// refreshSmartData handles POST /api/beszel/smart/refresh requests
+// Fetches fresh SMART data from the agent and updates the collection
+func (h *Hub) refreshSmartData(e *core.RequestEvent) error {
+	systemID := e.Request.URL.Query().Get("system")
+	if systemID == "" {
+		return e.JSON(http.StatusBadRequest, map[string]string{"error": "system parameter is required"})
+	}
+
+	system, err := h.sm.GetSystem(systemID)
+	if err != nil {
+		return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
+	}
+
+	// Fetch and save SMART devices
+	if err := system.FetchAndSaveSmartDevices(); err != nil {
+		return e.JSON(http.StatusInternalServerError, map[string]string{"error": err.Error()})
+	}
+
+	return e.JSON(http.StatusOK, map[string]string{"status": "ok"})
+}
+
+// generates key pair if it doesn't exist and returns signer
 func (h *Hub) GetSSHKey(dataDir string) (ssh.Signer, error) {
 	if h.signer != nil {
 		return h.signer, nil

internal/hub/hub_test.go

@@ -3,20 +3,36 @@
 package hub_test
 
 import (
+	"bytes"
 	"crypto/ed25519"
+	"encoding/json"
 	"encoding/pem"
+	"io"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 
+	"github.com/henrygd/beszel/internal/migrations"
 	beszelTests "github.com/henrygd/beszel/internal/tests"
 
+	"github.com/pocketbase/pocketbase/core"
+	pbTests "github.com/pocketbase/pocketbase/tests"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/crypto/ssh"
 )
 
+// marshal to json and return an io.Reader (for use in ApiScenario.Body)
+func jsonReader(v any) io.Reader {
+	data, err := json.Marshal(v)
+	if err != nil {
+		panic(err)
+	}
+	return bytes.NewReader(data)
+}
+
 func TestMakeLink(t *testing.T) {
 	hub, _ := beszelTests.NewTestHub(t.TempDir())
 
@@ -249,20 +265,699 @@ func TestGetSSHKey(t *testing.T) {
 	})
 }
 
-func TestAppUrl(t *testing.T) {
-	t.Run("no APP_URL does't change app url", func(t *testing.T) {
+func TestApiRoutesAuthentication(t *testing.T) {
 	hub, _ := beszelTests.NewTestHub(t.TempDir())
 	defer hub.Cleanup()
 
-		settings := hub.Settings()
-		assert.Equal(t, "http://localhost:8090", settings.Meta.AppURL)
+	hub.StartHub()
+
+	// Create test user and get auth token
+	user, err := beszelTests.CreateUser(hub, "testuser@example.com", "password123")
+	require.NoError(t, err, "Failed to create test user")
+
+	adminUser, err := beszelTests.CreateRecord(hub, "users", map[string]any{
+		"email":    "admin@example.com",
+		"password": "password123",
+		"role":     "admin",
 	})
-	t.Run("APP_URL changes app url", func(t *testing.T) {
-		t.Setenv("APP_URL", "http://example.com/app")
+	require.NoError(t, err, "Failed to create admin user")
+	adminUserToken, err := adminUser.NewAuthToken()
+
+	// superUser, err := beszelTests.CreateRecord(hub, core.CollectionNameSuperusers, map[string]any{
+	// 	"email":    "superuser@example.com",
+	// 	"password": "password123",
+	// })
+	// require.NoError(t, err, "Failed to create superuser")
+
+	userToken, err := user.NewAuthToken()
+	require.NoError(t, err, "Failed to create auth token")
+
+	// Create test system for user-alerts endpoints
+	system, err := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "test-system",
+		"users": []string{user.Id},
+		"host":  "127.0.0.1",
+	})
+	require.NoError(t, err, "Failed to create test system")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		// Auth Protected Routes - Should require authentication
+		{
+			Name:            "POST /test-notification - no auth should fail",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/test-notification",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"url": "generic://127.0.0.1",
+			}),
+		},
+		{
+			Name:           "POST /test-notification - with auth should succeed",
+			Method:         http.MethodPost,
+			URL:            "/api/beszel/test-notification",
+			TestAppFactory: testAppFactory,
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			Body: jsonReader(map[string]any{
+				"url": "generic://127.0.0.1",
+			}),
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"sending message"},
+		},
+		{
+			Name:            "GET /config-yaml - no auth should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/config-yaml",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /config-yaml - with user auth should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/config-yaml",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"Requires admin"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /config-yaml - with admin auth should succeed",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/config-yaml",
+			Headers: map[string]string{
+				"Authorization": adminUserToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"test-system"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /heartbeat-status - no auth should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/heartbeat-status",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /heartbeat-status - with user auth should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/heartbeat-status",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"Requires admin role"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /heartbeat-status - with admin auth should succeed",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/heartbeat-status",
+			Headers: map[string]string{
+				"Authorization": adminUserToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{`"enabled":false`},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST /test-heartbeat - with user auth should fail",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/test-heartbeat",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"Requires admin role"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST /test-heartbeat - with admin auth should report disabled state",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/test-heartbeat",
+			Headers: map[string]string{
+				"Authorization": adminUserToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"Heartbeat not configured"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /universal-token - no auth should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/universal-token",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /universal-token - with auth should succeed",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/universal-token",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"active", "token", "permanent"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /universal-token - enable permanent should succeed",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/universal-token?enable=1&permanent=1&token=permanent-token-123",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"permanent\":true", "permanent-token-123"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "POST /user-alerts - no auth should fail",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"value":   80,
+				"min":     10,
+				"systems": []string{system.Id},
+			}),
+		},
+		{
+			Name:   "POST /user-alerts - with auth should succeed",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"value":   80,
+				"min":     10,
+				"systems": []string{system.Id},
+			}),
+		},
+		{
+			Name:            "DELETE /user-alerts - no auth should fail",
+			Method:          http.MethodDelete,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system.Id},
+			}),
+		},
+		{
+			Name:   "DELETE /user-alerts - with auth should succeed",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				// Create an alert to delete
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system.Id,
+					"user":   user.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+		},
+		{
+			Name:            "GET /containers/logs - no auth should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/containers/logs?system=test-system&container=test-container",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /containers/logs - with auth but missing system param should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/containers/logs?container=test-container",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"system and container parameters are required"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /containers/logs - with auth but missing container param should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/containers/logs?system=test-system",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"system and container parameters are required"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /containers/logs - with auth but invalid system should fail",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/containers/logs?system=invalid-system&container=0123456789ab",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"system not found"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /containers/logs - traversal container should fail validation",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/containers/logs?system=" + system.Id + "&container=..%2F..%2Fversion",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"invalid container parameter"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /containers/info - traversal container should fail validation",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/containers/info?system=" + system.Id + "&container=../../version?x=",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"invalid container parameter"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /containers/info - non-hex container should fail validation",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/containers/info?system=" + system.Id + "&container=container_name",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"invalid container parameter"},
+			TestAppFactory:  testAppFactory,
+		},
+
+		// Auth Optional Routes - Should work without authentication
+		{
+			Name:            "GET /getkey - no auth should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /getkey - with auth should also succeed",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/getkey",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"key\":", "\"v\":"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /first-run - no auth should succeed",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/first-run",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"firstRun\":false"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /first-run - with auth should also succeed",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/first-run",
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"firstRun\":false"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /agent-connect - no auth should succeed (websocket upgrade fails but route is accessible)",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/agent-connect",
+			ExpectedStatus:  400,
+			ExpectedContent: []string{},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST /test-notification - invalid auth token should fail",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/test-notification",
+			Body: jsonReader(map[string]any{
+				"url": "generic://127.0.0.1",
+			}),
+			Headers: map[string]string{
+				"Authorization": "invalid-token",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST /user-alerts - invalid auth token should fail",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": "invalid-token",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"value":   80,
+				"min":     10,
+				"systems": []string{system.Id},
+			}),
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestFirstUserCreation(t *testing.T) {
+	t.Run("CreateUserEndpoint available when no users exist", func(t *testing.T) {
 		hub, _ := beszelTests.NewTestHub(t.TempDir())
 		defer hub.Cleanup()
 
-		settings := hub.Settings()
-		assert.Equal(t, "http://example.com/app", settings.Meta.AppURL)
+		hub.StartHub()
+
+		testAppFactoryExisting := func(t testing.TB) *pbTests.TestApp {
+			return hub.TestApp
+		}
+
+		scenarios := []beszelTests.ApiScenario{
+			{
+				Name:   "POST /create-user - should be available when no users exist",
+				Method: http.MethodPost,
+				URL:    "/api/beszel/create-user",
+				Body: jsonReader(map[string]any{
+					"email":    "firstuser@example.com",
+					"password": "password123",
+				}),
+				ExpectedStatus:  200,
+				ExpectedContent: []string{"User created"},
+				TestAppFactory:  testAppFactoryExisting,
+				BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+					userCount, err := hub.CountRecords("users")
+					require.NoError(t, err)
+					require.Zero(t, userCount, "Should start with no users")
+					superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
+					require.NoError(t, err)
+					require.EqualValues(t, 1, len(superusers), "Should start with one temporary superuser")
+					require.EqualValues(t, migrations.TempAdminEmail, superusers[0].GetString("email"), "Should have created one temporary superuser")
+				},
+				AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+					userCount, err := hub.CountRecords("users")
+					require.NoError(t, err)
+					require.EqualValues(t, 1, userCount, "Should have created one user")
+					superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
+					require.NoError(t, err)
+					require.EqualValues(t, 1, len(superusers), "Should have created one superuser")
+					require.EqualValues(t, "firstuser@example.com", superusers[0].GetString("email"), "Should have created one superuser")
+				},
+			},
+			{
+				Name:   "POST /create-user - should not be available when users exist",
+				Method: http.MethodPost,
+				URL:    "/api/beszel/create-user",
+				Body: jsonReader(map[string]any{
+					"email":    "firstuser@example.com",
+					"password": "password123",
+				}),
+				ExpectedStatus:  404,
+				ExpectedContent: []string{"wasn't found"},
+				TestAppFactory:  testAppFactoryExisting,
+			},
+		}
+
+		for _, scenario := range scenarios {
+			scenario.Test(t)
+		}
+	})
+
+	t.Run("CreateUserEndpoint not available when USER_EMAIL, USER_PASSWORD are set", func(t *testing.T) {
+		os.Setenv("BESZEL_HUB_USER_EMAIL", "me@example.com")
+		os.Setenv("BESZEL_HUB_USER_PASSWORD", "password123")
+		defer os.Unsetenv("BESZEL_HUB_USER_EMAIL")
+		defer os.Unsetenv("BESZEL_HUB_USER_PASSWORD")
+
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		defer hub.Cleanup()
+
+		hub.StartHub()
+
+		testAppFactory := func(t testing.TB) *pbTests.TestApp {
+			return hub.TestApp
+		}
+
+		scenario := beszelTests.ApiScenario{
+			Name:            "POST /create-user - should not be available when USER_EMAIL, USER_PASSWORD are set",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/create-user",
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"wasn't found"},
+			TestAppFactory:  testAppFactory,
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				users, err := hub.FindAllRecords("users")
+				require.NoError(t, err)
+				require.EqualValues(t, 1, len(users), "Should start with one user")
+				require.EqualValues(t, "me@example.com", users[0].GetString("email"), "Should have created one user")
+				superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
+				require.NoError(t, err)
+				require.EqualValues(t, 1, len(superusers), "Should start with one superuser")
+				require.EqualValues(t, "me@example.com", superusers[0].GetString("email"), "Should have created one superuser")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				users, err := hub.FindAllRecords("users")
+				require.NoError(t, err)
+				require.EqualValues(t, 1, len(users), "Should still have one user")
+				require.EqualValues(t, "me@example.com", users[0].GetString("email"), "Should have created one user")
+				superusers, err := hub.FindAllRecords(core.CollectionNameSuperusers)
+				require.NoError(t, err)
+				require.EqualValues(t, 1, len(superusers), "Should still have one superuser")
+				require.EqualValues(t, "me@example.com", superusers[0].GetString("email"), "Should have created one superuser")
+			},
+		}
+
+		scenario.Test(t)
 	})
 }
+
+func TestCreateUserEndpointAvailability(t *testing.T) {
+	t.Run("CreateUserEndpoint available when no users exist", func(t *testing.T) {
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		defer hub.Cleanup()
+
+		// Ensure no users exist
+		userCount, err := hub.CountRecords("users")
+		require.NoError(t, err)
+		require.Zero(t, userCount, "Should start with no users")
+
+		hub.StartHub()
+
+		testAppFactory := func(t testing.TB) *pbTests.TestApp {
+			return hub.TestApp
+		}
+
+		scenario := beszelTests.ApiScenario{
+			Name:   "POST /create-user - should be available when no users exist",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/create-user",
+			Body: jsonReader(map[string]any{
+				"email":    "firstuser@example.com",
+				"password": "password123",
+			}),
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"User created"},
+			TestAppFactory:  testAppFactory,
+		}
+
+		scenario.Test(t)
+
+		// Verify user was created
+		userCount, err = hub.CountRecords("users")
+		require.NoError(t, err)
+		require.EqualValues(t, 1, userCount, "Should have created one user")
+	})
+
+	t.Run("CreateUserEndpoint not available when users exist", func(t *testing.T) {
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		defer hub.Cleanup()
+
+		// Create a user first
+		_, err := beszelTests.CreateUser(hub, "existing@example.com", "password")
+		require.NoError(t, err)
+
+		hub.StartHub()
+
+		testAppFactory := func(t testing.TB) *pbTests.TestApp {
+			return hub.TestApp
+		}
+
+		scenario := beszelTests.ApiScenario{
+			Name:   "POST /create-user - should not be available when users exist",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/create-user",
+			Body: jsonReader(map[string]any{
+				"email":    "another@example.com",
+				"password": "password123",
+			}),
+			ExpectedStatus:  404,
+			ExpectedContent: []string{"wasn't found"},
+			TestAppFactory:  testAppFactory,
+		}
+
+		scenario.Test(t)
+	})
+}
+
+func TestAutoLoginMiddleware(t *testing.T) {
+	var hubs []*beszelTests.TestHub
+
+	defer func() {
+		defer os.Unsetenv("AUTO_LOGIN")
+		for _, hub := range hubs {
+			hub.Cleanup()
+		}
+	}()
+
+	os.Setenv("AUTO_LOGIN", "user@test.com")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		hubs = append(hubs, hub)
+		hub.StartHub()
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		{
+			Name:            "GET /getkey - without auto login should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /getkey - with auto login should fail if no matching user",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:            "GET /getkey - with auto login should succeed",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"key\":", "\"v\":"},
+			TestAppFactory:  testAppFactory,
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.CreateUser(app, "user@test.com", "password123")
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+
+func TestTrustedHeaderMiddleware(t *testing.T) {
+	var hubs []*beszelTests.TestHub
+
+	defer func() {
+		defer os.Unsetenv("TRUSTED_AUTH_HEADER")
+		for _, hub := range hubs {
+			hub.Cleanup()
+		}
+	}()
+
+	os.Setenv("TRUSTED_AUTH_HEADER", "X-Beszel-Trusted")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		hub, _ := beszelTests.NewTestHub(t.TempDir())
+		hubs = append(hubs, hub)
+		hub.StartHub()
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		{
+			Name:            "GET /getkey - without trusted header should fail",
+			Method:          http.MethodGet,
+			URL:             "/api/beszel/getkey",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /getkey - with trusted header should fail if no matching user",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/getkey",
+			Headers: map[string]string{
+				"X-Beszel-Trusted": "user@test.com",
+			},
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "GET /getkey - with trusted header should succeed",
+			Method: http.MethodGet,
+			URL:    "/api/beszel/getkey",
+			Headers: map[string]string{
+				"X-Beszel-Trusted": "user@test.com",
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"key\":", "\"v\":"},
+			TestAppFactory:  testAppFactory,
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.CreateUser(app, "user@test.com", "password123")
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

internal/hub/hub_test_helpers.go

@@ -2,9 +2,7 @@
 
 package hub
 
-import (
-	"github.com/henrygd/beszel/internal/hub/systems"
-)
+import "github.com/henrygd/beszel/internal/hub/systems"
 
 // TESTING ONLY: GetSystemManager returns the system manager
 func (h *Hub) GetSystemManager() *systems.SystemManager {
@@ -20,7 +18,3 @@ func (h *Hub) GetPubkey() string {
 func (h *Hub) SetPubkey(pubkey string) {
 	h.pubKey = pubkey
 }
-
-func (h *Hub) SetCollectionAuthSettings() error {
-	return setCollectionAuthSettings(h)
-}

internal/hub/server.go

@@ -1,42 +0,0 @@
-package hub
-
-import (
-	"encoding/json"
-	"net/url"
-	"strings"
-
-	"github.com/henrygd/beszel"
-	"github.com/henrygd/beszel/internal/hub/utils"
-)
-
-// PublicAppInfo defines the structure of the public app information that will be injected into the HTML
-type PublicAppInfo struct {
-	BASE_PATH           string
-	HUB_VERSION         string
-	HUB_URL             string
-	OAUTH_DISABLE_POPUP bool `json:"OAUTH_DISABLE_POPUP,omitempty"`
-}
-
-// modifyIndexHTML injects the public app information into the index.html content
-func modifyIndexHTML(hub *Hub, html []byte) string {
-	info := getPublicAppInfo(hub)
-	content, err := json.Marshal(info)
-	if err != nil {
-		return string(html)
-	}
-	htmlContent := strings.ReplaceAll(string(html), "./", info.BASE_PATH)
-	return strings.Replace(htmlContent, "\"{info}\"", string(content), 1)
-}
-
-func getPublicAppInfo(hub *Hub) PublicAppInfo {
-	parsedURL, _ := url.Parse(hub.appURL)
-	info := PublicAppInfo{
-		BASE_PATH:   strings.TrimSuffix(parsedURL.Path, "/") + "/",
-		HUB_VERSION: beszel.Version,
-		HUB_URL:     hub.appURL,
-	}
-	if val, _ := utils.GetEnv("OAUTH_DISABLE_POPUP"); val == "true" {
-		info.OAUTH_DISABLE_POPUP = true
-	}
-	return info
-}

internal/hub/server_development.go

@@ -5,11 +5,14 @@ package hub
 import (
 	"fmt"
 	"io"
+	"log/slog"
 	"net/http"
 	"net/http/httputil"
 	"net/url"
 	"strings"
 
+	"github.com/henrygd/beszel"
+
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/osutils"
 )
@@ -36,7 +39,7 @@ func (rm *responseModifier) RoundTrip(req *http.Request) (*http.Response, error)
 	}
 	resp.Body.Close()
 	// Create a new response with the modified body
-	modifiedBody := modifyIndexHTML(rm.hub, body)
+	modifiedBody := rm.modifyHTML(string(body))
 	resp.Body = io.NopCloser(strings.NewReader(modifiedBody))
 	resp.ContentLength = int64(len(modifiedBody))
 	resp.Header.Set("Content-Length", fmt.Sprintf("%d", len(modifiedBody)))
@@ -44,8 +47,22 @@ func (rm *responseModifier) RoundTrip(req *http.Request) (*http.Response, error)
 	return resp, nil
 }
 
+func (rm *responseModifier) modifyHTML(html string) string {
+	parsedURL, err := url.Parse(rm.hub.appURL)
+	if err != nil {
+		return html
+	}
+	// fix base paths in html if using subpath
+	basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
+	html = strings.ReplaceAll(html, "./", basePath)
+	html = strings.Replace(html, "{{V}}", beszel.Version, 1)
+	html = strings.Replace(html, "{{HUB_URL}}", rm.hub.appURL, 1)
+	return html
+}
+
 // startServer sets up the development server for Beszel
 func (h *Hub) startServer(se *core.ServeEvent) error {
+	slog.Info("starting server", "appURL", h.appURL)
 	proxy := httputil.NewSingleHostReverseProxy(&url.URL{
 		Scheme: "http",
 		Host:   "localhost:5173",

internal/hub/server_production.go

@@ -5,9 +5,10 @@ package hub
 import (
 	"io/fs"
 	"net/http"
+	"net/url"
 	"strings"
 
-	"github.com/henrygd/beszel/internal/hub/utils"
+	"github.com/henrygd/beszel"
 	"github.com/henrygd/beszel/internal/site"
 
 	"github.com/pocketbase/pocketbase/apis"
@@ -16,13 +17,22 @@ import (
 
 // startServer sets up the production server for Beszel
 func (h *Hub) startServer(se *core.ServeEvent) error {
+	// parse app url
+	parsedURL, err := url.Parse(h.appURL)
+	if err != nil {
+		return err
+	}
+	// fix base paths in html if using subpath
+	basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
 	indexFile, _ := fs.ReadFile(site.DistDirFS, "index.html")
-	html := modifyIndexHTML(h, indexFile)
+	html := strings.ReplaceAll(string(indexFile), "./", basePath)
+	html = strings.Replace(html, "{{V}}", beszel.Version, 1)
+	html = strings.Replace(html, "{{HUB_URL}}", h.appURL, 1)
 	// set up static asset serving
 	staticPaths := [2]string{"/static/", "/assets/"}
 	serveStatic := apis.Static(site.DistDirFS, false)
 	// get CSP configuration
-	csp, cspExists := utils.GetEnv("CSP")
+	csp, cspExists := GetEnv("CSP")
 	// add route
 	se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
 		// serve static assets if path is in staticPaths

internal/hub/systems/system.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"hash/fnv"
+	"log/slog"
 	"math/rand"
 	"net"
 	"strings"
@@ -14,7 +15,6 @@ import (
 
 	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/hub/transport"
-	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/henrygd/beszel/internal/hub/ws"
 
 	"github.com/henrygd/beszel/internal/entities/container"
@@ -49,6 +49,7 @@ type System struct {
 	detailsFetched atomic.Bool             // True if static system details have been fetched and saved
 	smartFetching  atomic.Bool             // True if SMART devices are currently being fetched
 	smartInterval  time.Duration           // Interval for periodic SMART data updates
+	lastSmartFetch atomic.Int64            // Unix milliseconds of last SMART data fetch
 }
 
 func (sm *SystemManager) NewSystem(systemId string) *System {
@@ -134,34 +135,19 @@ func (sys *System) update() error {
 		return err
 	}
 
-	// ensure deprecated fields from older agents are migrated to current fields
-	migrateDeprecatedFields(data, !sys.detailsFetched.Load())
-
 	// create system records
 	_, err = sys.createRecords(data)
 
-	// if details were included and fetched successfully, mark details as fetched and update smart interval if set by agent
-	if err == nil && data.Details != nil {
-		sys.detailsFetched.Store(true)
-		// update smart interval if it's set on the agent side
-		if data.Details.SmartInterval > 0 {
-			sys.smartInterval = data.Details.SmartInterval
-			sys.manager.hub.Logger().Info("SMART interval updated from agent details", "system", sys.Id, "interval", sys.smartInterval.String())
-			// make sure we reset expiration of lastFetch to remain as long as the new smart interval
-			// to prevent premature expiration leading to new fetch if interval is different.
-			sys.manager.smartFetchMap.UpdateExpiration(sys.Id, sys.smartInterval+time.Minute)
-		}
-	}
-
 	// Fetch and save SMART devices when system first comes online or at intervals
-	if backgroundSmartFetchEnabled() && sys.detailsFetched.Load() {
+	if backgroundSmartFetchEnabled() {
 		if sys.smartInterval <= 0 {
 			sys.smartInterval = time.Hour
 		}
-		if sys.shouldFetchSmart() && sys.smartFetching.CompareAndSwap(false, true) {
-			sys.manager.hub.Logger().Info("SMART fetch", "system", sys.Id, "interval", sys.smartInterval.String())
+		lastFetch := sys.lastSmartFetch.Load()
+		if time.Since(time.UnixMilli(lastFetch)) >= sys.smartInterval && sys.smartFetching.CompareAndSwap(false, true) {
 			go func() {
 				defer sys.smartFetching.Store(false)
+				sys.lastSmartFetch.Store(time.Now().UnixMilli())
 				_ = sys.FetchAndSaveSmartDevices()
 			}()
 		}
@@ -185,7 +171,7 @@ func (sys *System) handlePaused() {
 
 // createRecords updates the system record and adds system_stats and container_stats records
 func (sys *System) createRecords(data *system.CombinedData) (*core.Record, error) {
-	systemRecord, err := sys.getRecord(sys.manager.hub)
+	systemRecord, err := sys.getRecord()
 	if err != nil {
 		return nil, err
 	}
@@ -224,6 +210,28 @@ func (sys *System) createRecords(data *system.CombinedData) (*core.Record, error
 			}
 		}
 
+		// add pve_vms and pve_stats records
+		if len(data.PVEStats) > 0 {
+			if data.PVEStats[0].Id != "" {
+				if err := createPVEVMRecords(txApp, data.PVEStats, sys.Id); err != nil {
+					slog.Error("Error creating PVE VM records", "err", err)
+					return err
+				}
+			}
+			pveStatsCollection, err := txApp.FindCachedCollectionByNameOrId("pve_stats")
+			if err != nil {
+				return err
+			}
+			pveStatsRecord := core.NewRecord(pveStatsCollection)
+			pveStatsRecord.Set("system", systemRecord.Id)
+			pveStatsRecord.Set("stats", data.PVEStats)
+			pveStatsRecord.Set("type", "1m")
+			if err := txApp.SaveNoValidate(pveStatsRecord); err != nil {
+				slog.Error("Error creating PVE stats records", "err", err)
+				return err
+			}
+		}
+
 		// add new systemd_stats record
 		if len(data.SystemdServices) > 0 {
 			if err := createSystemdStatsRecords(txApp, data.SystemdServices, sys.Id); err != nil {
@@ -236,6 +244,11 @@ func (sys *System) createRecords(data *system.CombinedData) (*core.Record, error
 			if err := createSystemDetailsRecord(txApp, data.Details, sys.Id); err != nil {
 				return err
 			}
+			sys.detailsFetched.Store(true)
+			// update smart interval if it's set on the agent side
+			if data.Details.SmartInterval > 0 {
+				sys.smartInterval = data.Details.SmartInterval
+			}
 		}
 
 		// update system record (do this last because it triggers alerts and we need above records to be inserted first)
@@ -319,11 +332,10 @@ func createContainerRecords(app core.App, data []*container.Stats, systemId stri
 	valueStrings := make([]string, 0, len(data))
 	for i, container := range data {
 		suffix := fmt.Sprintf("%d", i)
-		valueStrings = append(valueStrings, fmt.Sprintf("({:id%[1]s}, {:system}, {:name%[1]s}, {:image%[1]s}, {:ports%[1]s}, {:status%[1]s}, {:health%[1]s}, {:cpu%[1]s}, {:memory%[1]s}, {:net%[1]s}, {:updated})", suffix))
+		valueStrings = append(valueStrings, fmt.Sprintf("({:id%[1]s}, {:system}, {:name%[1]s}, {:image%[1]s}, {:status%[1]s}, {:health%[1]s}, {:cpu%[1]s}, {:memory%[1]s}, {:net%[1]s}, {:updated})", suffix))
 		params["id"+suffix] = container.Id
 		params["name"+suffix] = container.Name
 		params["image"+suffix] = container.Image
-		params["ports"+suffix] = container.Ports
 		params["status"+suffix] = container.Status
 		params["health"+suffix] = container.Health
 		params["cpu"+suffix] = container.Cpu
@@ -335,7 +347,43 @@ func createContainerRecords(app core.App, data []*container.Stats, systemId stri
 		params["net"+suffix] = netBytes
 	}
 	queryString := fmt.Sprintf(
-		"INSERT INTO containers (id, system, name, image, ports, status, health, cpu, memory, net, updated) VALUES %s ON CONFLICT(id) DO UPDATE SET system = excluded.system, name = excluded.name, image = excluded.image, ports = excluded.ports, status = excluded.status, health = excluded.health, cpu = excluded.cpu, memory = excluded.memory, net = excluded.net, updated = excluded.updated",
+		"INSERT INTO containers (id, system, name, image, status, health, cpu, memory, net, updated) VALUES %s ON CONFLICT(id) DO UPDATE SET system = excluded.system, name = excluded.name, image = excluded.image, status = excluded.status, health = excluded.health, cpu = excluded.cpu, memory = excluded.memory, net = excluded.net, updated = excluded.updated",
+		strings.Join(valueStrings, ","),
+	)
+	_, err := app.DB().NewQuery(queryString).Bind(params).Execute()
+	return err
+}
+
+// createPVEVMRecords creates or updates pve_vms records
+func createPVEVMRecords(app core.App, data []*container.PveNodeStats, systemId string) error {
+	if len(data) == 0 {
+		return nil
+	}
+	// shared params for all records
+	params := dbx.Params{
+		"system":  systemId,
+		"updated": time.Now().UTC().UnixMilli(),
+	}
+	valueStrings := make([]string, 0, len(data))
+	for i, vm := range data {
+		suffix := fmt.Sprintf("%d", i)
+		valueStrings = append(valueStrings, fmt.Sprintf("({:id%[1]s}, {:system}, {:name%[1]s}, {:type%[1]s}, {:cpu%[1]s}, {:mem%[1]s}, {:netout%[1]s}, {:netin%[1]s}, {:maxcpu%[1]s}, {:maxmem%[1]s}, {:uptime%[1]s}, {:diskread%[1]s}, {:diskwrite%[1]s}, {:disk%[1]s}, {:updated})", suffix))
+		params["id"+suffix] = makeStableHashId(systemId, vm.Id)
+		params["name"+suffix] = vm.Name
+		params["type"+suffix] = vm.Type // "qemu" or "lxc"
+		params["cpu"+suffix] = vm.Cpu
+		params["mem"+suffix] = vm.Mem
+		params["maxcpu"+suffix] = vm.MaxCPU
+		params["maxmem"+suffix] = vm.MaxMem
+		params["uptime"+suffix] = vm.Uptime
+		params["diskread"+suffix] = vm.DiskRead
+		params["diskwrite"+suffix] = vm.DiskWrite
+		params["disk"+suffix] = vm.Disk
+		params["netout"+suffix] = vm.NetOut // cumulative bytes sent by VM
+		params["netin"+suffix] = vm.NetIn   // cumulative bytes received by VM
+	}
+	queryString := fmt.Sprintf(
+		"INSERT INTO pve_vms (id, system, name, type, cpu, mem, netout, netin, maxcpu, maxmem, uptime, diskread, diskwrite, disk, updated) VALUES %s ON CONFLICT(id) DO UPDATE SET system=excluded.system, name=excluded.name, type=excluded.type, cpu=excluded.cpu, mem=excluded.mem, netout=excluded.netout, netin=excluded.netin, maxcpu=excluded.maxcpu, maxmem=excluded.maxmem, uptime=excluded.uptime, diskread=excluded.diskread, diskwrite=excluded.diskwrite, disk=excluded.disk, updated=excluded.updated",
 		strings.Join(valueStrings, ","),
 	)
 	_, err := app.DB().NewQuery(queryString).Bind(params).Execute()
@@ -343,9 +391,8 @@ func createContainerRecords(app core.App, data []*container.Stats, systemId stri
 }
 
 // getRecord retrieves the system record from the database.
-// If the record is not found, it removes the system from the manager.
-func (sys *System) getRecord(app core.App) (*core.Record, error) {
-	record, err := app.FindRecordById("systems", sys.Id)
+func (sys *System) getRecord() (*core.Record, error) {
+	record, err := sys.manager.hub.FindRecordById("systems", sys.Id)
 	if err != nil || record == nil {
 		_ = sys.manager.RemoveSystem(sys.Id)
 		return nil, err
@@ -353,27 +400,6 @@ func (sys *System) getRecord(app core.App) (*core.Record, error) {
 	return record, nil
 }
 
-// HasUser checks if the given user is in the system's users list.
-// Returns true if SHARE_ALL_SYSTEMS is enabled (any authenticated user can access any system).
-func (sys *System) HasUser(app core.App, user *core.Record) bool {
-	if user == nil {
-		return false
-	}
-	if v, _ := utils.GetEnv("SHARE_ALL_SYSTEMS"); v == "true" {
-		return true
-	}
-	var recordData = struct {
-		Users string
-	}{}
-	err := app.DB().NewQuery("SELECT users FROM systems WHERE id={:id}").
-		Bind(dbx.Params{"id": sys.Id}).
-		One(&recordData)
-	if err != nil || recordData.Users == "" {
-		return false
-	}
-	return strings.Contains(recordData.Users, user.Id)
-}
-
 // setDown marks a system as down in the database.
 // It takes the original error that caused the system to go down and returns any error
 // encountered during the process of updating the system status.
@@ -381,7 +407,7 @@ func (sys *System) setDown(originalError error) error {
 	if sys.Status == down || sys.Status == paused {
 		return nil
 	}
-	record, err := sys.getRecord(sys.manager.hub)
+	record, err := sys.getRecord()
 	if err != nil {
 		return err
 	}
@@ -665,7 +691,6 @@ func (s *System) createSSHClient() error {
 		return err
 	}
 	s.agentVersion, _ = extractAgentVersion(string(s.client.Conn.ServerVersion()))
-	s.manager.resetFailedSmartFetchState(s.Id)
 	return nil
 }
 
@@ -736,50 +761,3 @@ func getJitter() <-chan time.Time {
 	msDelay := (interval * minPercent / 100) + rand.Intn(interval*jitterRange/100)
 	return time.After(time.Duration(msDelay) * time.Millisecond)
 }
-
-// migrateDeprecatedFields moves values from deprecated fields to their new locations if the new
-// fields are not already populated. Deprecated fields and refs may be removed at least 30 days
-// and one minor version release after the release that includes the migration.
-//
-// This is run when processing incoming system data from agents, which may be on older versions.
-func migrateDeprecatedFields(cd *system.CombinedData, createDetails bool) {
-	// migration added 0.19.0
-	if cd.Stats.Bandwidth[0] == 0 && cd.Stats.Bandwidth[1] == 0 {
-		cd.Stats.Bandwidth[0] = uint64(cd.Stats.NetworkSent * 1024 * 1024)
-		cd.Stats.Bandwidth[1] = uint64(cd.Stats.NetworkRecv * 1024 * 1024)
-		cd.Stats.NetworkSent, cd.Stats.NetworkRecv = 0, 0
-	}
-	// migration added 0.19.0
-	if cd.Info.BandwidthBytes == 0 {
-		cd.Info.BandwidthBytes = uint64(cd.Info.Bandwidth * 1024 * 1024)
-		cd.Info.Bandwidth = 0
-	}
-	// migration added 0.19.0
-	if cd.Stats.DiskIO[0] == 0 && cd.Stats.DiskIO[1] == 0 {
-		cd.Stats.DiskIO[0] = uint64(cd.Stats.DiskReadPs * 1024 * 1024)
-		cd.Stats.DiskIO[1] = uint64(cd.Stats.DiskWritePs * 1024 * 1024)
-		cd.Stats.DiskReadPs, cd.Stats.DiskWritePs = 0, 0
-	}
-	// migration added 0.19.0 - Move deprecated Info fields to Details struct
-	if cd.Details == nil && cd.Info.Hostname != "" {
-		if createDetails {
-			cd.Details = &system.Details{
-				Hostname:    cd.Info.Hostname,
-				Kernel:      cd.Info.KernelVersion,
-				Cores:       cd.Info.Cores,
-				Threads:     cd.Info.Threads,
-				CpuModel:    cd.Info.CpuModel,
-				Podman:      cd.Info.Podman,
-				Os:          cd.Info.Os,
-				MemoryTotal: uint64(cd.Stats.Mem * 1024 * 1024 * 1024),
-			}
-		}
-		// zero the deprecated fields to prevent saving them in systems.info DB json payload
-		cd.Info.Hostname = ""
-		cd.Info.KernelVersion = ""
-		cd.Info.Cores = 0
-		cd.Info.CpuModel = ""
-		cd.Info.Podman = false
-		cd.Info.Os = 0
-	}
-}

internal/hub/systems/system_manager.go

@@ -8,7 +8,6 @@ import (
 	"github.com/henrygd/beszel/internal/hub/ws"
 
 	"github.com/henrygd/beszel/internal/entities/system"
-	"github.com/henrygd/beszel/internal/hub/expirymap"
 
 	"github.com/henrygd/beszel/internal/common"
 
@@ -44,7 +43,6 @@ type SystemManager struct {
 	hub       hubLike                       // Hub interface for database and alert operations
 	systems   *store.Store[string, *System] // Thread-safe store of active systems
 	sshConfig *ssh.ClientConfig             // SSH client configuration for system connections
-	smartFetchMap *expirymap.ExpiryMap[smartFetchState] // Stores last SMART fetch time/result; TTL is only for cleanup
 }
 
 // hubLike defines the interface requirements for the hub dependency.
@@ -54,7 +52,6 @@ type hubLike interface {
 	GetSSHKey(dataDir string) (ssh.Signer, error)
 	HandleSystemAlerts(systemRecord *core.Record, data *system.CombinedData) error
 	HandleStatusAlerts(status string, systemRecord *core.Record) error
-	CancelPendingStatusAlerts(systemID string)
 }
 
 // NewSystemManager creates a new SystemManager instance with the provided hub.
@@ -63,7 +60,6 @@ func NewSystemManager(hub hubLike) *SystemManager {
 	return &SystemManager{
 		systems: store.New(map[string]*System{}),
 		hub:     hub,
-		smartFetchMap: expirymap.New[smartFetchState](time.Hour),
 	}
 }
 
@@ -190,7 +186,6 @@ func (sm *SystemManager) onRecordAfterUpdateSuccess(e *core.RecordEvent) error {
 			system.closeSSHConnection()
 		}
 		_ = deactivateAlerts(e.App, e.Record.Id)
-		sm.hub.CancelPendingStatusAlerts(e.Record.Id)
 		return e.Next()
 	case pending:
 		// Resume monitoring, preferring existing WebSocket connection
@@ -308,7 +303,6 @@ func (sm *SystemManager) AddWebSocketSystem(systemId string, agentVersion semver
 	if err != nil {
 		return err
 	}
-	sm.resetFailedSmartFetchState(systemId)
 
 	system := sm.NewSystem(systemId)
 	system.WsConn = wsConn
@@ -320,15 +314,6 @@ func (sm *SystemManager) AddWebSocketSystem(systemId string, agentVersion semver
 	return nil
 }
 
-// resetFailedSmartFetchState clears only failed SMART cooldown entries so a fresh
-// agent reconnect retries SMART discovery immediately after configuration changes.
-func (sm *SystemManager) resetFailedSmartFetchState(systemID string) {
-	state, ok := sm.smartFetchMap.GetOk(systemID)
-	if ok && !state.Successful {
-		sm.smartFetchMap.Remove(systemID)
-	}
-}
-
 // createSSHClientConfig initializes the SSH client configuration for connecting to an agent's server
 func (sm *SystemManager) createSSHClientConfig() error {
 	privateKey, err := sm.hub.GetSSHKey("")

internal/hub/systems/system_realtime.go

@@ -19,6 +19,7 @@ type subscriptionInfo struct {
 var (
 	activeSubscriptions = make(map[string]*subscriptionInfo)
 	workerRunning       bool
+	realtimeTicker      *time.Ticker
 	tickerStopChan      chan struct{}
 	realtimeMutex       sync.Mutex
 )
@@ -69,7 +70,7 @@ func (sm *SystemManager) onRealtimeSubscribeRequest(e *core.RealtimeSubscribeReq
 }
 
 // onRealtimeSubscriptionAdded initializes or starts the realtime worker when the first subscription is added.
-// It ensures only one worker runs at a time.
+// It ensures only one worker runs at a time and creates the ticker for periodic data fetching.
 func (sm *SystemManager) onRealtimeSubscriptionAdded() {
 	realtimeMutex.Lock()
 	defer realtimeMutex.Unlock()
@@ -81,6 +82,11 @@ func (sm *SystemManager) onRealtimeSubscriptionAdded() {
 		tickerStopChan = make(chan struct{})
 		go sm.startRealtimeWorker()
 	}
+
+	// If no ticker exists, create one
+	if realtimeTicker == nil {
+		realtimeTicker = time.NewTicker(1 * time.Second)
+	}
 }
 
 // checkSubscriptions stops the realtime worker when there are no active subscriptions.
@@ -101,6 +107,11 @@ func (sm *SystemManager) checkSubscriptions() {
 		}
 	}
 
+	if realtimeTicker != nil {
+		realtimeTicker.Stop()
+		realtimeTicker = nil
+	}
+
 	// Mark worker as stopped (will be reset when next subscription comes in)
 	workerRunning = false
 }
@@ -124,16 +135,17 @@ func (sm *SystemManager) removeRealtimeSubscription(subscription string, options
 // It continuously fetches system data and broadcasts it to subscribed clients via WebSocket.
 func (sm *SystemManager) startRealtimeWorker() {
 	sm.fetchRealtimeDataAndNotify()
-	tick := time.Tick(1 * time.Second)
 
 	for {
 		select {
 		case <-tickerStopChan:
 			return
-		case <-tick:
-			if len(activeSubscriptions) == 0 {
+		case <-realtimeTicker.C:
+			// Check if ticker is still valid (might have been stopped)
+			if realtimeTicker == nil || len(activeSubscriptions) == 0 {
 				return
 			}
+			// slog.Debug("activeSubscriptions", "count", len(activeSubscriptions))
 			sm.fetchRealtimeDataAndNotify()
 		}
 	}

internal/hub/systems/system_smart.go

@@ -4,61 +4,18 @@ import (
 	"database/sql"
 	"errors"
 	"strings"
-	"time"
 
 	"github.com/henrygd/beszel/internal/entities/smart"
 	"github.com/pocketbase/pocketbase/core"
 )
 
-type smartFetchState struct {
-	LastAttempt int64
-	Successful  bool
-}
-
 // FetchAndSaveSmartDevices fetches SMART data from the agent and saves it to the database
 func (sys *System) FetchAndSaveSmartDevices() error {
 	smartData, err := sys.FetchSmartDataFromAgent()
-	if err != nil {
-		sys.recordSmartFetchResult(err, 0)
+	if err != nil || len(smartData) == 0 {
 		return err
 	}
-	err = sys.saveSmartDevices(smartData)
-	sys.recordSmartFetchResult(err, len(smartData))
-	return err
-}
-
-// recordSmartFetchResult stores a cooldown entry for the SMART interval and marks
-// whether the last fetch produced any devices, so failed setup can retry on reconnect.
-func (sys *System) recordSmartFetchResult(err error, deviceCount int) {
-	if sys.manager == nil {
-		return
-	}
-	interval := sys.smartFetchInterval()
-	success := err == nil && deviceCount > 0
-	if sys.manager.hub != nil {
-		sys.manager.hub.Logger().Info("SMART fetch result", "system", sys.Id, "success", success, "devices", deviceCount, "interval", interval.String(), "err", err)
-	}
-	sys.manager.smartFetchMap.Set(sys.Id, smartFetchState{LastAttempt: time.Now().UnixMilli(), Successful: success}, interval+time.Minute)
-}
-
-// shouldFetchSmart returns true when there is no active SMART cooldown entry for this system.
-func (sys *System) shouldFetchSmart() bool {
-	if sys.manager == nil {
-		return true
-	}
-	state, ok := sys.manager.smartFetchMap.GetOk(sys.Id)
-	if !ok {
-		return true
-	}
-	return !time.UnixMilli(state.LastAttempt).Add(sys.smartFetchInterval()).After(time.Now())
-}
-
-// smartFetchInterval returns the agent-provided SMART interval or the default when unset.
-func (sys *System) smartFetchInterval() time.Duration {
-	if sys.smartInterval > 0 {
-		return sys.smartInterval
-	}
-	return time.Hour
+	return sys.saveSmartDevices(smartData)
 }
 
 // saveSmartDevices saves SMART device data to the smart_devices collection

internal/hub/systems/system_smart_test.go

@@ -1,94 +0,0 @@
-//go:build testing
-
-package systems
-
-import (
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/henrygd/beszel/internal/hub/expirymap"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestRecordSmartFetchResult(t *testing.T) {
-	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	sys := &System{
-		Id:            "system-1",
-		manager:       sm,
-		smartInterval: time.Hour,
-	}
-
-	// Successful fetch with devices
-	sys.recordSmartFetchResult(nil, 5)
-	state, ok := sm.smartFetchMap.GetOk(sys.Id)
-	assert.True(t, ok, "expected smart fetch result to be stored")
-	assert.True(t, state.Successful, "expected successful fetch state to be recorded")
-
-	// Failed fetch
-	sys.recordSmartFetchResult(errors.New("failed"), 0)
-	state, ok = sm.smartFetchMap.GetOk(sys.Id)
-	assert.True(t, ok, "expected failed smart fetch state to be stored")
-	assert.False(t, state.Successful, "expected failed smart fetch state to be marked unsuccessful")
-
-	// Successful fetch but no devices
-	sys.recordSmartFetchResult(nil, 0)
-	state, ok = sm.smartFetchMap.GetOk(sys.Id)
-	assert.True(t, ok, "expected fetch with zero devices to be stored")
-	assert.False(t, state.Successful, "expected fetch with zero devices to be marked unsuccessful")
-}
-
-func TestShouldFetchSmart(t *testing.T) {
-	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	sys := &System{
-		Id:            "system-1",
-		manager:       sm,
-		smartInterval: time.Hour,
-	}
-
-	assert.True(t, sys.shouldFetchSmart(), "expected initial smart fetch to be allowed")
-
-	sys.recordSmartFetchResult(errors.New("failed"), 0)
-	assert.False(t, sys.shouldFetchSmart(), "expected smart fetch to be blocked while interval entry exists")
-
-	sm.smartFetchMap.Remove(sys.Id)
-	assert.True(t, sys.shouldFetchSmart(), "expected smart fetch to be allowed after interval entry is cleared")
-}
-
-func TestShouldFetchSmart_IgnoresExtendedTTLWhenFetchIsDue(t *testing.T) {
-	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	sys := &System{
-		Id:            "system-1",
-		manager:       sm,
-		smartInterval: time.Hour,
-	}
-
-	sm.smartFetchMap.Set(sys.Id, smartFetchState{
-		LastAttempt: time.Now().Add(-2 * time.Hour).UnixMilli(),
-		Successful:  true,
-	}, 10*time.Minute)
-	sm.smartFetchMap.UpdateExpiration(sys.Id, 3*time.Hour)
-
-	assert.True(t, sys.shouldFetchSmart(), "expected fetch time to take precedence over updated TTL")
-}
-
-func TestResetFailedSmartFetchState(t *testing.T) {
-	sm := &SystemManager{smartFetchMap: expirymap.New[smartFetchState](time.Hour)}
-	t.Cleanup(sm.smartFetchMap.StopCleaner)
-
-	sm.smartFetchMap.Set("system-1", smartFetchState{LastAttempt: time.Now().UnixMilli(), Successful: false}, time.Hour)
-	sm.resetFailedSmartFetchState("system-1")
-	_, ok := sm.smartFetchMap.GetOk("system-1")
-	assert.False(t, ok, "expected failed smart fetch state to be cleared on reconnect")
-
-	sm.smartFetchMap.Set("system-1", smartFetchState{LastAttempt: time.Now().UnixMilli(), Successful: true}, time.Hour)
-	sm.resetFailedSmartFetchState("system-1")
-	_, ok = sm.smartFetchMap.GetOk("system-1")
-	assert.True(t, ok, "expected successful smart fetch state to be preserved")
-}

internal/hub/systems/system_test.go

@@ -1,159 +0,0 @@
-//go:build testing
-
-package systems
-
-import (
-	"testing"
-
-	"github.com/henrygd/beszel/internal/entities/system"
-)
-
-func TestCombinedData_MigrateDeprecatedFields(t *testing.T) {
-	t.Run("Migrate NetworkSent and NetworkRecv to Bandwidth", func(t *testing.T) {
-		cd := &system.CombinedData{
-			Stats: system.Stats{
-				NetworkSent: 1.5, // 1.5 MB
-				NetworkRecv: 2.5, // 2.5 MB
-			},
-		}
-		migrateDeprecatedFields(cd, true)
-
-		expectedSent := uint64(1.5 * 1024 * 1024)
-		expectedRecv := uint64(2.5 * 1024 * 1024)
-
-		if cd.Stats.Bandwidth[0] != expectedSent {
-			t.Errorf("expected Bandwidth[0] %d, got %d", expectedSent, cd.Stats.Bandwidth[0])
-		}
-		if cd.Stats.Bandwidth[1] != expectedRecv {
-			t.Errorf("expected Bandwidth[1] %d, got %d", expectedRecv, cd.Stats.Bandwidth[1])
-		}
-		if cd.Stats.NetworkSent != 0 || cd.Stats.NetworkRecv != 0 {
-			t.Errorf("expected NetworkSent and NetworkRecv to be reset, got %f, %f", cd.Stats.NetworkSent, cd.Stats.NetworkRecv)
-		}
-	})
-
-	t.Run("Migrate Info.Bandwidth to Info.BandwidthBytes", func(t *testing.T) {
-		cd := &system.CombinedData{
-			Info: system.Info{
-				Bandwidth: 10.0, // 10 MB
-			},
-		}
-		migrateDeprecatedFields(cd, true)
-
-		expected := uint64(10 * 1024 * 1024)
-		if cd.Info.BandwidthBytes != expected {
-			t.Errorf("expected BandwidthBytes %d, got %d", expected, cd.Info.BandwidthBytes)
-		}
-		if cd.Info.Bandwidth != 0 {
-			t.Errorf("expected Info.Bandwidth to be reset, got %f", cd.Info.Bandwidth)
-		}
-	})
-
-	t.Run("Migrate DiskReadPs and DiskWritePs to DiskIO", func(t *testing.T) {
-		cd := &system.CombinedData{
-			Stats: system.Stats{
-				DiskReadPs:  3.0, // 3 MB
-				DiskWritePs: 4.0, // 4 MB
-			},
-		}
-		migrateDeprecatedFields(cd, true)
-
-		expectedRead := uint64(3 * 1024 * 1024)
-		expectedWrite := uint64(4 * 1024 * 1024)
-
-		if cd.Stats.DiskIO[0] != expectedRead {
-			t.Errorf("expected DiskIO[0] %d, got %d", expectedRead, cd.Stats.DiskIO[0])
-		}
-		if cd.Stats.DiskIO[1] != expectedWrite {
-			t.Errorf("expected DiskIO[1] %d, got %d", expectedWrite, cd.Stats.DiskIO[1])
-		}
-		if cd.Stats.DiskReadPs != 0 || cd.Stats.DiskWritePs != 0 {
-			t.Errorf("expected DiskReadPs and DiskWritePs to be reset, got %f, %f", cd.Stats.DiskReadPs, cd.Stats.DiskWritePs)
-		}
-	})
-
-	t.Run("Migrate Info fields to Details struct", func(t *testing.T) {
-		cd := &system.CombinedData{
-			Stats: system.Stats{
-				Mem: 16.0, // 16 GB
-			},
-			Info: system.Info{
-				Hostname:      "test-host",
-				KernelVersion: "6.8.0",
-				Cores:         8,
-				Threads:       16,
-				CpuModel:      "Intel i7",
-				Podman:        true,
-				Os:            system.Linux,
-			},
-		}
-		migrateDeprecatedFields(cd, true)
-
-		if cd.Details == nil {
-			t.Fatal("expected Details struct to be created")
-		}
-		if cd.Details.Hostname != "test-host" {
-			t.Errorf("expected Hostname 'test-host', got '%s'", cd.Details.Hostname)
-		}
-		if cd.Details.Kernel != "6.8.0" {
-			t.Errorf("expected Kernel '6.8.0', got '%s'", cd.Details.Kernel)
-		}
-		if cd.Details.Cores != 8 {
-			t.Errorf("expected Cores 8, got %d", cd.Details.Cores)
-		}
-		if cd.Details.Threads != 16 {
-			t.Errorf("expected Threads 16, got %d", cd.Details.Threads)
-		}
-		if cd.Details.CpuModel != "Intel i7" {
-			t.Errorf("expected CpuModel 'Intel i7', got '%s'", cd.Details.CpuModel)
-		}
-		if cd.Details.Podman != true {
-			t.Errorf("expected Podman true, got %v", cd.Details.Podman)
-		}
-		if cd.Details.Os != system.Linux {
-			t.Errorf("expected Os Linux, got %d", cd.Details.Os)
-		}
-		expectedMem := uint64(16 * 1024 * 1024 * 1024)
-		if cd.Details.MemoryTotal != expectedMem {
-			t.Errorf("expected MemoryTotal %d, got %d", expectedMem, cd.Details.MemoryTotal)
-		}
-
-		if cd.Info.Hostname != "" || cd.Info.KernelVersion != "" || cd.Info.Cores != 0 || cd.Info.CpuModel != "" || cd.Info.Podman != false || cd.Info.Os != 0 {
-			t.Errorf("expected Info fields to be reset, got %+v", cd.Info)
-		}
-	})
-
-	t.Run("Do not migrate if Details already exists", func(t *testing.T) {
-		cd := &system.CombinedData{
-			Details: &system.Details{Hostname: "existing-host"},
-			Info: system.Info{
-				Hostname: "deprecated-host",
-			},
-		}
-		migrateDeprecatedFields(cd, true)
-
-		if cd.Details.Hostname != "existing-host" {
-			t.Errorf("expected Hostname 'existing-host', got '%s'", cd.Details.Hostname)
-		}
-		if cd.Info.Hostname != "deprecated-host" {
-			t.Errorf("expected Info.Hostname to remain 'deprecated-host', got '%s'", cd.Info.Hostname)
-		}
-	})
-
-	t.Run("Do not create details if migrateDetails is false", func(t *testing.T) {
-		cd := &system.CombinedData{
-			Info: system.Info{
-				Hostname: "deprecated-host",
-			},
-		}
-		migrateDeprecatedFields(cd, false)
-
-		if cd.Details != nil {
-			t.Fatal("expected Details struct to not be created")
-		}
-
-		if cd.Info.Hostname != "" {
-			t.Errorf("expected Info.Hostname to be reset, got '%s'", cd.Info.Hostname)
-		}
-	})
-}

internal/hub/systems/systems_test.go

@@ -421,60 +421,3 @@ func testOld(t *testing.T, hub *tests.TestHub) {
 		assert.NoError(t, err)
 	})
 }
-
-func TestHasUser(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	sm := hub.GetSystemManager()
-	err = sm.Initialize()
-	require.NoError(t, err)
-
-	user1, err := tests.CreateUser(hub, "user1@test.com", "password123")
-	require.NoError(t, err)
-	user2, err := tests.CreateUser(hub, "user2@test.com", "password123")
-	require.NoError(t, err)
-
-	systemRecord, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "has-user-test",
-		"host":  "127.0.0.1",
-		"port":  "33914",
-		"users": []string{user1.Id},
-	})
-	require.NoError(t, err)
-
-	sys, err := sm.GetSystemFromStore(systemRecord.Id)
-	require.NoError(t, err)
-
-	t.Run("user in list returns true", func(t *testing.T) {
-		assert.True(t, sys.HasUser(hub, user1))
-	})
-
-	t.Run("user not in list returns false", func(t *testing.T) {
-		assert.False(t, sys.HasUser(hub, user2))
-	})
-
-	t.Run("unknown user ID returns false", func(t *testing.T) {
-		assert.False(t, sys.HasUser(hub, nil))
-	})
-
-	t.Run("SHARE_ALL_SYSTEMS=true grants access to non-member", func(t *testing.T) {
-		t.Setenv("SHARE_ALL_SYSTEMS", "true")
-		assert.True(t, sys.HasUser(hub, user2))
-	})
-
-	t.Run("BESZEL_HUB_SHARE_ALL_SYSTEMS=true grants access to non-member", func(t *testing.T) {
-		t.Setenv("BESZEL_HUB_SHARE_ALL_SYSTEMS", "true")
-		assert.True(t, sys.HasUser(hub, user2))
-	})
-
-	t.Run("additional user works", func(t *testing.T) {
-		assert.False(t, sys.HasUser(hub, user2))
-		systemRecord.Set("users", []string{user1.Id, user2.Id})
-		err = hub.Save(systemRecord)
-		require.NoError(t, err)
-		assert.True(t, sys.HasUser(hub, user1))
-		assert.True(t, sys.HasUser(hub, user2))
-	})
-}

internal/hub/systems/systems_test_helpers.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 
 	entities "github.com/henrygd/beszel/internal/entities/system"
-	"github.com/pocketbase/pocketbase/core"
 )
 
 // The hub integration tests create/replace systems and cleanup the test apps quickly.
@@ -114,14 +113,4 @@ func (sm *SystemManager) RemoveAllSystems() {
 	for _, system := range sm.systems.GetAll() {
 		sm.RemoveSystem(system.Id)
 	}
-	sm.smartFetchMap.StopCleaner()
-}
-
-func (s *System) StopUpdater() {
-	s.cancel()
-}
-
-func (s *System) CreateRecords(data *entities.CombinedData) (*core.Record, error) {
-	s.data = data
-	return s.createRecords(data)
 }

internal/hub/utils/utils.go

@@ -1,12 +0,0 @@
-// Package utils provides utility functions for the hub.
-package utils
-
-import "os"
-
-// GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
-func GetEnv(key string) (value string, exists bool) {
-	if value, exists = os.LookupEnv("BESZEL_HUB_" + key); exists {
-		return value, exists
-	}
-	return os.LookupEnv(key)
-}

internal/hub/ws/ws.go

@@ -111,9 +111,6 @@ func (ws *WsConn) Close(msg []byte) {
 
 // Ping sends a ping frame to keep the connection alive.
 func (ws *WsConn) Ping() error {
-	if ws.conn == nil {
-		return gws.ErrConnClosed
-	}
 	ws.conn.SetDeadline(time.Now().Add(deadline))
 	return ws.conn.WritePing(nil)
 }

internal/migrations/0_collections_snapshot_0_19_0_dev_3.go

@@ -11,11 +11,11 @@ func init() {
 		jsonData := `[
 	{
 		"id": "elngm8x1l60zi2v",
-		"listRule": "@request.auth.id != \"\" && user = @request.auth.id",
-		"viewRule": null,
-		"createRule": "@request.auth.id != \"\" && user = @request.auth.id",
-		"updateRule": "@request.auth.id != \"\" && user = @request.auth.id",
-		"deleteRule": "@request.auth.id != \"\" && user = @request.auth.id",
+		"listRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
+		"viewRule": "",
+		"createRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
+		"updateRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
+		"deleteRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
 		"name": "alerts",
 		"type": "base",
 		"fields": [
@@ -143,11 +143,11 @@ func init() {
 	},
 	{
 		"id": "pbc_1697146157",
-		"listRule": "@request.auth.id != \"\" && user = @request.auth.id",
-		"viewRule": null,
+		"listRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
+		"viewRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
 		"createRule": null,
 		"updateRule": null,
-		"deleteRule": "@request.auth.id != \"\" && user = @request.auth.id",
+		"deleteRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
 		"name": "alerts_history",
 		"type": "base",
 		"fields": [
@@ -261,7 +261,7 @@ func init() {
 	},
 	{
 		"id": "juohu4jipgc13v7",
-		"listRule": null,
+		"listRule": "@request.auth.id != \"\"",
 		"viewRule": null,
 		"createRule": null,
 		"updateRule": null,
@@ -351,10 +351,10 @@ func init() {
 	},
 	{
 		"id": "pbc_3663931638",
-		"listRule": null,
-		"viewRule": null,
-		"createRule": null,
-		"updateRule": null,
+		"listRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
+		"viewRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
+		"createRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id && @request.auth.role != \"readonly\"",
+		"updateRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id && @request.auth.role != \"readonly\"",
 		"deleteRule": null,
 		"name": "fingerprints",
 		"type": "base",
@@ -433,7 +433,7 @@ func init() {
 	},
 	{
 		"id": "ej9oowivz8b2mht",
-		"listRule": null,
+		"listRule": "@request.auth.id != \"\"",
 		"viewRule": null,
 		"createRule": null,
 		"updateRule": null,
@@ -523,10 +523,10 @@ func init() {
 	},
 	{
 		"id": "4afacsdnlu8q8r2",
-		"listRule": "@request.auth.id != \"\" && user = @request.auth.id",
+		"listRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
 		"viewRule": null,
-		"createRule": "@request.auth.id != \"\" && user = @request.auth.id",
-		"updateRule": "@request.auth.id != \"\" && user = @request.auth.id",
+		"createRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
+		"updateRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
 		"deleteRule": null,
 		"name": "user_settings",
 		"type": "base",
@@ -596,11 +596,11 @@ func init() {
 	},
 	{
 		"id": "2hz5ncl8tizk5nx",
-		"listRule": null,
-		"viewRule": null,
-		"createRule": null,
-		"updateRule": null,
-		"deleteRule": null,
+		"listRule": "@request.auth.id != \"\" && users.id ?= @request.auth.id",
+		"viewRule": "@request.auth.id != \"\" && users.id ?= @request.auth.id",
+		"createRule": "@request.auth.id != \"\" && users.id ?= @request.auth.id && @request.auth.role != \"readonly\"",
+		"updateRule": "@request.auth.id != \"\" && users.id ?= @request.auth.id && @request.auth.role != \"readonly\"",
+		"deleteRule": "@request.auth.id != \"\" && users.id ?= @request.auth.id && @request.auth.role != \"readonly\"",
 		"name": "systems",
 		"type": "base",
 		"fields": [
@@ -866,7 +866,7 @@ func init() {
 	},
 	{
 		"id": "pbc_1864144027",
-		"listRule": null,
+		"listRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
 		"viewRule": null,
 		"createRule": null,
 		"updateRule": null,
@@ -977,6 +977,18 @@ func init() {
 					"system": false,
 					"type": "number"
 				},
+				{
+					"hidden": false,
+					"id": "number3332085495",
+					"max": null,
+					"min": null,
+					"name": "updated",
+					"onlyInt": true,
+					"presentable": false,
+					"required": true,
+					"system": false,
+					"type": "number"
+				},
 				{
 					"autogeneratePattern": "",
 					"hidden": false,
@@ -990,32 +1002,6 @@ func init() {
 					"required": false,
 					"system": false,
 					"type": "text"
-				},
-				{
-					"autogeneratePattern": "",
-					"hidden": false,
-					"id": "text2308952269",
-					"max": 0,
-					"min": 0,
-					"name": "ports",
-					"pattern": "",
-					"presentable": false,
-					"primaryKey": false,
-					"required": false,
-					"system": false,
-					"type": "text"
-				},
-				{
-					"hidden": false,
-					"id": "number3332085495",
-					"max": null,
-					"min": null,
-					"name": "updated",
-					"onlyInt": true,
-					"presentable": false,
-					"required": true,
-					"system": false,
-					"type": "number"
 				}
 		],
 		"indexes": [
@@ -1159,7 +1145,7 @@ func init() {
 			"CREATE INDEX ` + "`" + `idx_4Z7LuLNdQb` + "`" + ` ON ` + "`" + `systemd_services` + "`" + ` (` + "`" + `system` + "`" + `)",
 			"CREATE INDEX ` + "`" + `idx_pBp1fF837e` + "`" + ` ON ` + "`" + `systemd_services` + "`" + ` (` + "`" + `updated` + "`" + `)"
 		],
-		"listRule": null,
+		"listRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
 		"name": "systemd_services",
 		"system": false,
 		"type": "base",
@@ -1167,8 +1153,8 @@ func init() {
 		"viewRule": null
 	},
 	{
-		"createRule": "@request.auth.id != \"\" && user = @request.auth.id",
-		"deleteRule": "@request.auth.id != \"\" && user = @request.auth.id",
+		"createRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
+		"deleteRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
 		"fields": [
 			{
 				"autogeneratePattern": "[a-z0-9]{10}",
@@ -1252,16 +1238,16 @@ func init() {
 			"CREATE INDEX ` + "`" + `idx_q0iKnRP9v8` + "`" + ` ON ` + "`" + `quiet_hours` + "`" + ` (\n  ` + "`" + `user` + "`" + `,\n  ` + "`" + `system` + "`" + `\n)",
 			"CREATE INDEX ` + "`" + `idx_6T7ljT7FJd` + "`" + ` ON ` + "`" + `quiet_hours` + "`" + ` (\n  ` + "`" + `type` + "`" + `,\n  ` + "`" + `end` + "`" + `\n)"
 		],
-		"listRule": "@request.auth.id != \"\" && user = @request.auth.id",
+		"listRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
 		"name": "quiet_hours",
 		"system": false,
 		"type": "base",
-		"updateRule": "@request.auth.id != \"\" && user = @request.auth.id",
-		"viewRule": "@request.auth.id != \"\" && user = @request.auth.id"
+		"updateRule": "@request.auth.id != \"\" && user.id = @request.auth.id",
+		"viewRule": "@request.auth.id != \"\" && user.id = @request.auth.id"
 	},
 	{
 		"createRule": null,
-		"deleteRule": null,
+		"deleteRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
 		"fields": [
 			{
 				"autogeneratePattern": "[a-z0-9]{10}",
@@ -1447,16 +1433,16 @@ func init() {
 		"indexes": [
 			"CREATE INDEX ` + "`" + `idx_DZ9yhvgl44` + "`" + ` ON ` + "`" + `smart_devices` + "`" + ` (` + "`" + `system` + "`" + `)"
 		],
-		"listRule": null,
+		"listRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
 		"name": "smart_devices",
 		"system": false,
 		"type": "base",
 		"updateRule": null,
-		"viewRule": null
+		"viewRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id"
 	},
 	{
-		"createRule": null,
-		"deleteRule": null,
+		"createRule": "",
+		"deleteRule": "",
 		"fields": [
 			{
 				"autogeneratePattern": "[a-z0-9]{15}",
@@ -1625,12 +1611,12 @@ func init() {
 		],
 		"id": "pbc_3116237454",
 		"indexes": [],
+		"listRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
 		"name": "system_details",
 		"system": false,
 		"type": "base",
-		"updateRule": null,
-		"listRule": null,
-		"viewRule": null
+		"updateRule": "",
+		"viewRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id"
 	},
 	{
 		"createRule": null,
@@ -1699,6 +1685,300 @@ func init() {
 		"type": "base",
 		"updateRule": null,
 		"viewRule": null
+	},
+	{
+		"createRule": null,
+		"deleteRule": null,
+		"fields": [
+			{
+				"autogeneratePattern": "[a-z0-9]{10}",
+				"hidden": false,
+				"id": "text3208210256",
+				"max": 10,
+				"min": 10,
+				"name": "id",
+				"pattern": "^[a-z0-9]+$",
+				"presentable": false,
+				"primaryKey": true,
+				"required": true,
+				"system": true,
+				"type": "text"
+			},
+			{
+				"cascadeDelete": true,
+				"collectionId": "2hz5ncl8tizk5nx",
+				"hidden": false,
+				"id": "pve_stats_sys01",
+				"maxSelect": 1,
+				"minSelect": 0,
+				"name": "system",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "relation"
+			},
+			{
+				"hidden": false,
+				"id": "pve_stats_json1",
+				"maxSize": 2000000,
+				"name": "stats",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "json"
+			},
+			{
+				"hidden": false,
+				"id": "pve_stats_type1",
+				"maxSelect": 1,
+				"name": "type",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "select",
+				"values": [
+					"1m",
+					"10m",
+					"20m",
+					"120m",
+					"480m"
+				]
+			},
+			{
+				"hidden": false,
+				"id": "pve_stats_crt1",
+				"name": "created",
+				"onCreate": true,
+				"onUpdate": false,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			},
+			{
+				"hidden": false,
+				"id": "pve_stats_upd1",
+				"name": "updated",
+				"onCreate": true,
+				"onUpdate": true,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			}
+		],
+		"id": "pvestats",
+		"indexes": [
+			"CREATE INDEX ` + "`" + `idx_pve_stats_sys_type_created` + "`" + ` ON ` + "`" + `pve_stats` + "`" + ` (\n  ` + "`" + `system` + "`" + `,\n  ` + "`" + `type` + "`" + `,\n  ` + "`" + `created` + "`" + `\n)"
+		],
+		"listRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
+		"name": "pve_stats",
+		"system": false,
+		"type": "base",
+		"updateRule": null,
+		"viewRule": null
+	},
+	{
+		"createRule": null,
+		"deleteRule": null,
+		"fields": [
+			{
+				"autogeneratePattern": "[a-f0-9]{8}",
+				"hidden": false,
+				"id": "text3208210256",
+				"max": 8,
+				"min": 8,
+				"name": "id",
+				"pattern": "^[a-f0-9]+$",
+				"presentable": false,
+				"primaryKey": true,
+				"required": true,
+				"system": true,
+				"type": "text"
+			},
+			{
+				"cascadeDelete": false,
+				"collectionId": "2hz5ncl8tizk5nx",
+				"hidden": false,
+				"id": "pve_vms_sys001",
+				"maxSelect": 1,
+				"minSelect": 0,
+				"name": "system",
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "relation"
+			},
+			{
+				"autogeneratePattern": "",
+				"hidden": false,
+				"id": "pve_vms_name01",
+				"max": 0,
+				"min": 0,
+				"name": "name",
+				"pattern": "",
+				"presentable": false,
+				"primaryKey": false,
+				"required": false,
+				"system": false,
+				"type": "text"
+			},
+			{
+				"autogeneratePattern": "",
+				"hidden": false,
+				"id": "pve_vms_type01",
+				"max": 0,
+				"min": 0,
+				"name": "type",
+				"pattern": "",
+				"presentable": false,
+				"primaryKey": false,
+				"required": false,
+				"system": false,
+				"type": "text"
+			},
+			{
+				"hidden": false,
+				"id": "pve_vms_cpu001",
+				"max": 100,
+				"min": 0,
+				"name": "cpu",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number1253106325",
+				"max": null,
+				"min": null,
+				"name": "maxcpu",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "pve_vms_mem001",
+				"max": null,
+				"min": 0,
+				"name": "mem",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number1693954525",
+				"max": null,
+				"min": null,
+				"name": "maxmem",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number208985346",
+				"max": null,
+				"min": null,
+				"name": "disk",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number4125810518",
+				"max": null,
+				"min": null,
+				"name": "diskread",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number752404475",
+				"max": null,
+				"min": null,
+				"name": "diskwrite",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number1880667380",
+				"max": null,
+				"min": null,
+				"name": "netout",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number2702533949",
+				"max": null,
+				"min": null,
+				"name": "netin",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "number1563400775",
+				"max": null,
+				"min": null,
+				"name": "uptime",
+				"onlyInt": false,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "pve_vms_upd001",
+				"max": null,
+				"min": null,
+				"name": "updated",
+				"onlyInt": true,
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "number"
+			}
+		],
+		"id": "pvevms",
+		"indexes": [
+			"CREATE INDEX ` + "`" + `idx_pve_vms_updated` + "`" + ` ON ` + "`" + `pve_vms` + "`" + ` (` + "`" + `updated` + "`" + `)",
+			"CREATE INDEX ` + "`" + `idx_pve_vms_system` + "`" + ` ON ` + "`" + `pve_vms` + "`" + ` (` + "`" + `system` + "`" + `)"
+		],
+		"listRule": "@request.auth.id != \"\" && system.users.id ?= @request.auth.id",
+		"name": "pve_vms",
+		"system": false,
+		"type": "base",
+		"updateRule": null,
+		"viewRule": null
 	}
 ]`
 

internal/records/records.go

@@ -3,8 +3,10 @@ package records
 
 import (
 	"encoding/json"
+	"fmt"
 	"log"
 	"math"
+	"strings"
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/container"
@@ -37,6 +39,16 @@ type StatsRecord struct {
 	Stats []byte `db:"stats"`
 }
 
+// global variables for reusing allocations
+var (
+	statsRecord    StatsRecord
+	containerStats []container.SharedCoreMetrics
+	sumStats       system.Stats
+	tempStats      system.Stats
+	queryParams    = make(dbx.Params, 1)
+	containerSums  = make(map[string]*container.SharedCoreMetrics)
+)
+
 // Create longer records by averaging shorter records
 func (rm *RecordManager) CreateLongerRecords() {
 	// start := time.Now()
@@ -70,7 +82,7 @@ func (rm *RecordManager) CreateLongerRecords() {
 	// wrap the operations in a transaction
 	rm.app.RunInTransaction(func(txApp core.App) error {
 		var err error
-		collections := [2]*core.Collection{}
+		collections := [3]*core.Collection{}
 		collections[0], err = txApp.FindCachedCollectionByNameOrId("system_stats")
 		if err != nil {
 			return err
@@ -79,6 +91,10 @@ func (rm *RecordManager) CreateLongerRecords() {
 		if err != nil {
 			return err
 		}
+		collections[2], err = txApp.FindCachedCollectionByNameOrId("pve_stats")
+		if err != nil {
+			return err
+		}
 		var systems RecordIds
 		db := txApp.DB()
 
@@ -138,8 +154,9 @@ func (rm *RecordManager) CreateLongerRecords() {
 					case "system_stats":
 						longerRecord.Set("stats", rm.AverageSystemStats(db, recordIds))
 					case "container_stats":
-
-						longerRecord.Set("stats", rm.AverageContainerStats(db, recordIds))
+						longerRecord.Set("stats", rm.AverageContainerStats(db, recordIds, "container_stats"))
+					case "pve_stats":
+						longerRecord.Set("stats", rm.AverageContainerStats(db, recordIds, "pve_stats"))
 					}
 					if err := txApp.SaveNoValidate(longerRecord); err != nil {
 						log.Println("failed to save longer record", "err", err)
@@ -151,47 +168,41 @@ func (rm *RecordManager) CreateLongerRecords() {
 		return nil
 	})
 
+	statsRecord.Stats = statsRecord.Stats[:0]
+
 	// log.Println("finished creating longer records", "time (ms)", time.Since(start).Milliseconds())
 }
 
 // Calculate the average stats of a list of system_stats records without reflect
 func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *system.Stats {
-	stats := make([]system.Stats, 0, len(records))
-	var row StatsRecord
-	params := make(dbx.Params, 1)
-	for _, rec := range records {
-		row.Stats = row.Stats[:0]
-		params["id"] = rec.Id
-		db.NewQuery("SELECT stats FROM system_stats WHERE id = {:id}").Bind(params).One(&row)
-		var s system.Stats
-		if err := json.Unmarshal(row.Stats, &s); err != nil {
-			continue
-		}
-		stats = append(stats, s)
-	}
-	result := AverageSystemStatsSlice(stats)
-	return &result
-}
-
-// AverageSystemStatsSlice computes the average of a slice of system stats.
-func AverageSystemStatsSlice(records []system.Stats) system.Stats {
-	var sum system.Stats
-	count := float64(len(records))
-	if count == 0 {
-		return sum
-	}
-
+	// Clear/reset global structs for reuse
+	sumStats = system.Stats{}
+	tempStats = system.Stats{}
+	sum := &sumStats
+	stats := &tempStats
 	// necessary because uint8 is not big enough for the sum
 	batterySum := 0
 	// accumulate per-core usage across records
 	var cpuCoresSums []uint64
 	// accumulate cpu breakdown [user, system, iowait, steal, idle]
 	var cpuBreakdownSums []float64
+
+	count := float64(len(records))
 	tempCount := float64(0)
 
 	// Accumulate totals
-	for i := range records {
-		stats := &records[i]
+	for _, record := range records {
+		id := record.Id
+		// clear global statsRecord for reuse
+		statsRecord.Stats = statsRecord.Stats[:0]
+		// reset tempStats each iteration to avoid omitzero fields retaining stale values
+		*stats = system.Stats{}
+
+		queryParams["id"] = id
+		db.NewQuery("SELECT stats FROM system_stats WHERE id = {:id}").Bind(queryParams).One(&statsRecord)
+		if err := json.Unmarshal(statsRecord.Stats, stats); err != nil {
+			continue
+		}
 
 		sum.Cpu += stats.Cpu
 		// accumulate cpu time breakdowns if present
@@ -199,8 +210,8 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 			if len(cpuBreakdownSums) < len(stats.CpuBreakdown) {
 				cpuBreakdownSums = append(cpuBreakdownSums, make([]float64, len(stats.CpuBreakdown)-len(cpuBreakdownSums))...)
 			}
-			for j, v := range stats.CpuBreakdown {
-				cpuBreakdownSums[j] += v
+			for i, v := range stats.CpuBreakdown {
+				cpuBreakdownSums[i] += v
 			}
 		}
 		sum.Mem += stats.Mem
@@ -224,9 +235,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		sum.Bandwidth[1] += stats.Bandwidth[1]
 		sum.DiskIO[0] += stats.DiskIO[0]
 		sum.DiskIO[1] += stats.DiskIO[1]
-		for i := range stats.DiskIoStats {
-			sum.DiskIoStats[i] += stats.DiskIoStats[i]
-		}
 		batterySum += int(stats.Battery[0])
 		sum.Battery[1] = stats.Battery[1]
 
@@ -236,8 +244,8 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 				// extend slices to accommodate core count
 				cpuCoresSums = append(cpuCoresSums, make([]uint64, len(stats.CpuCoresUsage)-len(cpuCoresSums))...)
 			}
-			for j, v := range stats.CpuCoresUsage {
-				cpuCoresSums[j] += uint64(v)
+			for i, v := range stats.CpuCoresUsage {
+				cpuCoresSums[i] += uint64(v)
 			}
 		}
 		// Set peak values
@@ -251,9 +259,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		sum.MaxBandwidth[1] = max(sum.MaxBandwidth[1], stats.MaxBandwidth[1], stats.Bandwidth[1])
 		sum.MaxDiskIO[0] = max(sum.MaxDiskIO[0], stats.MaxDiskIO[0], stats.DiskIO[0])
 		sum.MaxDiskIO[1] = max(sum.MaxDiskIO[1], stats.MaxDiskIO[1], stats.DiskIO[1])
-		for i := range stats.DiskIoStats {
-			sum.MaxDiskIoStats[i] = max(sum.MaxDiskIoStats[i], stats.MaxDiskIoStats[i], stats.DiskIoStats[i])
-		}
 
 		// Accumulate network interfaces
 		if sum.NetworkInterfaces == nil {
@@ -299,10 +304,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 				fs.DiskWriteBytes += value.DiskWriteBytes
 				fs.MaxDiskReadBytes = max(fs.MaxDiskReadBytes, value.MaxDiskReadBytes, value.DiskReadBytes)
 				fs.MaxDiskWriteBytes = max(fs.MaxDiskWriteBytes, value.MaxDiskWriteBytes, value.DiskWriteBytes)
-				for i := range value.DiskIoStats {
-					fs.DiskIoStats[i] += value.DiskIoStats[i]
-					fs.MaxDiskIoStats[i] = max(fs.MaxDiskIoStats[i], value.MaxDiskIoStats[i], value.DiskIoStats[i])
-				}
 			}
 		}
 
@@ -337,7 +338,8 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		}
 	}
 
-	// Compute averages
+	// Compute averages in place
+	if count > 0 {
 		sum.Cpu = twoDecimals(sum.Cpu / count)
 		sum.Mem = twoDecimals(sum.Mem / count)
 		sum.MemUsed = twoDecimals(sum.MemUsed / count)
@@ -353,9 +355,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 		sum.DiskWritePs = twoDecimals(sum.DiskWritePs / count)
 		sum.DiskIO[0] = sum.DiskIO[0] / uint64(count)
 		sum.DiskIO[1] = sum.DiskIO[1] / uint64(count)
-	for i := range sum.DiskIoStats {
-		sum.DiskIoStats[i] = twoDecimals(sum.DiskIoStats[i] / count)
-	}
 		sum.NetworkSent = twoDecimals(sum.NetworkSent / count)
 		sum.NetworkRecv = twoDecimals(sum.NetworkRecv / count)
 		sum.LoadAvg[0] = twoDecimals(sum.LoadAvg[0] / count)
@@ -394,9 +393,6 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 				fs.DiskReadPs = twoDecimals(fs.DiskReadPs / count)
 				fs.DiskReadBytes = fs.DiskReadBytes / uint64(count)
 				fs.DiskWriteBytes = fs.DiskWriteBytes / uint64(count)
-			for i := range fs.DiskIoStats {
-				fs.DiskIoStats[i] = twoDecimals(fs.DiskIoStats[i] / count)
-			}
 			}
 		}
 
@@ -439,41 +435,38 @@ func AverageSystemStatsSlice(records []system.Stats) system.Stats {
 			}
 			sum.CpuBreakdown = avg
 		}
+	}
 
 	return sum
 }
 
-// Calculate the average stats of a list of container_stats records
-func (rm *RecordManager) AverageContainerStats(db dbx.Builder, records RecordIds) []container.Stats {
-	allStats := make([][]container.Stats, 0, len(records))
-	var row StatsRecord
-	params := make(dbx.Params, 1)
-	for _, rec := range records {
-		row.Stats = row.Stats[:0]
-		params["id"] = rec.Id
-		db.NewQuery("SELECT stats FROM container_stats WHERE id = {:id}").Bind(params).One(&row)
-		var cs []container.Stats
-		if err := json.Unmarshal(row.Stats, &cs); err != nil {
-			return []container.Stats{}
+// Calculate the average stats of a list of container_stats or pve_stats records
+func (rm *RecordManager) AverageContainerStats(db dbx.Builder, records RecordIds, collectionName string) []container.SharedCoreMetrics {
+	// Clear global map for reuse
+	for k := range containerSums {
+		delete(containerSums, k)
 	}
-		allStats = append(allStats, cs)
-	}
-	return AverageContainerStatsSlice(allStats)
-}
-
-// AverageContainerStatsSlice computes the average of container stats across multiple time periods.
-func AverageContainerStatsSlice(records [][]container.Stats) []container.Stats {
-	if len(records) == 0 {
-		return []container.Stats{}
-	}
-	sums := make(map[string]*container.Stats)
+	sums := containerSums
 	count := float64(len(records))
 
-	for _, containerStats := range records {
+	for i := range records {
+		id := records[i].Id
+		// clear global statsRecord for reuse
+		statsRecord.Stats = statsRecord.Stats[:0]
+		// must set to nil (not [:0]) to avoid json.Unmarshal reusing backing array
+		// which causes omitzero fields to inherit stale values from previous iterations
+		containerStats = nil
+
+		queryParams["id"] = id
+		db.NewQuery(fmt.Sprintf("SELECT stats FROM %s WHERE id = {:id}", collectionName)).Bind(queryParams).One(&statsRecord)
+
+		if err := json.Unmarshal(statsRecord.Stats, &containerStats); err != nil {
+			return []container.SharedCoreMetrics{}
+		}
 		for i := range containerStats {
-			stat := &containerStats[i]
+			stat := containerStats[i]
 			if _, ok := sums[stat.Name]; !ok {
-				sums[stat.Name] = &container.Stats{Name: stat.Name}
+				sums[stat.Name] = &container.SharedCoreMetrics{Name: stat.Name}
 			}
 			sums[stat.Name].Cpu += stat.Cpu
 			sums[stat.Name].Mem += stat.Mem
@@ -488,9 +481,9 @@ func AverageContainerStatsSlice(records [][]container.Stats) []container.Stats {
 		}
 	}
 
-	result := make([]container.Stats, 0, len(sums))
+	result := make([]container.SharedCoreMetrics, 0, len(sums))
 	for _, value := range sums {
-		result = append(result, container.Stats{
+		result = append(result, container.SharedCoreMetrics{
 			Name:      value.Name,
 			Cpu:       twoDecimals(value.Cpu / count),
 			Mem:       twoDecimals(value.Mem / count),
@@ -500,6 +493,150 @@ func AverageContainerStatsSlice(records [][]container.Stats) []container.Stats {
 	return result
 }
 
+// Delete old records
+func (rm *RecordManager) DeleteOldRecords() {
+	rm.app.RunInTransaction(func(txApp core.App) error {
+		err := deleteOldSystemStats(txApp)
+		if err != nil {
+			return err
+		}
+		err = deleteOldContainerRecords(txApp)
+		if err != nil {
+			return err
+		}
+		err = deleteOldPVEVMRecords(txApp)
+		if err != nil {
+			return err
+		}
+		err = deleteOldSystemdServiceRecords(txApp)
+		if err != nil {
+			return err
+		}
+		err = deleteOldAlertsHistory(txApp, 200, 250)
+		if err != nil {
+			return err
+		}
+		err = deleteOldQuietHours(txApp)
+		if err != nil {
+			return err
+		}
+		return nil
+	})
+}
+
+// Delete old alerts history records
+func deleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int) error {
+	db := app.DB()
+	var users []struct {
+		Id string `db:"user"`
+	}
+	err := db.NewQuery("SELECT user, COUNT(*) as count FROM alerts_history GROUP BY user HAVING count > {:countBeforeDeletion}").Bind(dbx.Params{"countBeforeDeletion": countBeforeDeletion}).All(&users)
+	if err != nil {
+		return err
+	}
+	for _, user := range users {
+		_, err = db.NewQuery("DELETE FROM alerts_history WHERE user = {:user} AND id NOT IN (SELECT id FROM alerts_history WHERE user = {:user} ORDER BY created DESC LIMIT {:countToKeep})").Bind(dbx.Params{"user": user.Id, "countToKeep": countToKeep}).Execute()
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Deletes system_stats records older than what is displayed in the UI
+func deleteOldSystemStats(app core.App) error {
+	// Collections to process
+	collections := [3]string{"system_stats", "container_stats", "pve_stats"}
+
+	// Record types and their retention periods
+	type RecordDeletionData struct {
+		recordType string
+		retention  time.Duration
+	}
+	recordData := []RecordDeletionData{
+		{recordType: "1m", retention: time.Hour},             // 1 hour
+		{recordType: "10m", retention: 12 * time.Hour},       // 12 hours
+		{recordType: "20m", retention: 24 * time.Hour},       // 1 day
+		{recordType: "120m", retention: 7 * 24 * time.Hour},  // 7 days
+		{recordType: "480m", retention: 30 * 24 * time.Hour}, // 30 days
+	}
+
+	now := time.Now().UTC()
+
+	for _, collection := range collections {
+		// Build the WHERE clause
+		var conditionParts []string
+		var params dbx.Params = make(map[string]any)
+		for i := range recordData {
+			rd := recordData[i]
+			// Create parameterized condition for this record type
+			dateParam := fmt.Sprintf("date%d", i)
+			conditionParts = append(conditionParts, fmt.Sprintf("(type = '%s' AND created < {:%s})", rd.recordType, dateParam))
+			params[dateParam] = now.Add(-rd.retention)
+		}
+		// Combine conditions with OR
+		conditionStr := strings.Join(conditionParts, " OR ")
+		// Construct and execute the full raw query
+		rawQuery := fmt.Sprintf("DELETE FROM %s WHERE %s", collection, conditionStr)
+		if _, err := app.DB().NewQuery(rawQuery).Bind(params).Execute(); err != nil {
+			return fmt.Errorf("failed to delete from %s: %v", collection, err)
+		}
+	}
+	return nil
+}
+
+// Deletes systemd service records that haven't been updated in the last 20 minutes
+func deleteOldSystemdServiceRecords(app core.App) error {
+	now := time.Now().UTC()
+	twentyMinutesAgo := now.Add(-20 * time.Minute)
+
+	// Delete systemd service records where updated < twentyMinutesAgo
+	_, err := app.DB().NewQuery("DELETE FROM systemd_services WHERE updated < {:updated}").Bind(dbx.Params{"updated": twentyMinutesAgo.UnixMilli()}).Execute()
+	if err != nil {
+		return fmt.Errorf("failed to delete old systemd service records: %v", err)
+	}
+
+	return nil
+}
+
+// Deletes pve_vms records that haven't been updated in the last 10 minutes
+func deleteOldPVEVMRecords(app core.App) error {
+	now := time.Now().UTC()
+	tenMinutesAgo := now.Add(-10 * time.Minute)
+
+	_, err := app.DB().NewQuery("DELETE FROM pve_vms WHERE updated < {:updated}").Bind(dbx.Params{"updated": tenMinutesAgo.UnixMilli()}).Execute()
+	if err != nil {
+		return fmt.Errorf("failed to delete old pve_vms records: %v", err)
+	}
+
+	return nil
+}
+
+// Deletes container records that haven't been updated in the last 10 minutes
+func deleteOldContainerRecords(app core.App) error {
+	now := time.Now().UTC()
+	tenMinutesAgo := now.Add(-10 * time.Minute)
+
+	// Delete container records where updated < tenMinutesAgo
+	_, err := app.DB().NewQuery("DELETE FROM containers WHERE updated < {:updated}").Bind(dbx.Params{"updated": tenMinutesAgo.UnixMilli()}).Execute()
+	if err != nil {
+		return fmt.Errorf("failed to delete old container records: %v", err)
+	}
+
+	return nil
+}
+
+// Deletes old quiet hours records where end date has passed
+func deleteOldQuietHours(app core.App) error {
+	now := time.Now().UTC()
+	_, err := app.DB().NewQuery("DELETE FROM quiet_hours WHERE type = 'one-time' AND end < {:now}").Bind(dbx.Params{"now": now}).Execute()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 /* Round float to two decimals */
 func twoDecimals(value float64) float64 {
 	return math.Round(value*100) / 100

internal/records/records_averaging_test.go

@@ -1,820 +0,0 @@
-//go:build testing
-
-package records_test
-
-import (
-	"sort"
-	"testing"
-
-	"github.com/henrygd/beszel/internal/entities/container"
-	"github.com/henrygd/beszel/internal/entities/system"
-	"github.com/henrygd/beszel/internal/records"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestAverageSystemStatsSlice_Empty(t *testing.T) {
-	result := records.AverageSystemStatsSlice(nil)
-	assert.Equal(t, system.Stats{}, result)
-
-	result = records.AverageSystemStatsSlice([]system.Stats{})
-	assert.Equal(t, system.Stats{}, result)
-}
-
-func TestAverageSystemStatsSlice_SingleRecord(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:          45.67,
-			Mem:          16.0,
-			MemUsed:      8.5,
-			MemPct:       53.12,
-			MemBuffCache: 2.0,
-			Swap:         4.0,
-			SwapUsed:     1.0,
-			DiskTotal:    500.0,
-			DiskUsed:     250.0,
-			DiskPct:      50.0,
-			DiskReadPs:   100.5,
-			DiskWritePs:  200.75,
-			NetworkSent:  10.5,
-			NetworkRecv:  20.25,
-			LoadAvg:      [3]float64{1.5, 2.0, 3.5},
-			Bandwidth:    [2]uint64{1000, 2000},
-			DiskIO:       [2]uint64{500, 600},
-			Battery:      [2]uint8{80, 1},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 45.67, result.Cpu)
-	assert.Equal(t, 16.0, result.Mem)
-	assert.Equal(t, 8.5, result.MemUsed)
-	assert.Equal(t, 53.12, result.MemPct)
-	assert.Equal(t, 2.0, result.MemBuffCache)
-	assert.Equal(t, 4.0, result.Swap)
-	assert.Equal(t, 1.0, result.SwapUsed)
-	assert.Equal(t, 500.0, result.DiskTotal)
-	assert.Equal(t, 250.0, result.DiskUsed)
-	assert.Equal(t, 50.0, result.DiskPct)
-	assert.Equal(t, 100.5, result.DiskReadPs)
-	assert.Equal(t, 200.75, result.DiskWritePs)
-	assert.Equal(t, 10.5, result.NetworkSent)
-	assert.Equal(t, 20.25, result.NetworkRecv)
-	assert.Equal(t, [3]float64{1.5, 2.0, 3.5}, result.LoadAvg)
-	assert.Equal(t, [2]uint64{1000, 2000}, result.Bandwidth)
-	assert.Equal(t, [2]uint64{500, 600}, result.DiskIO)
-	assert.Equal(t, uint8(80), result.Battery[0])
-	assert.Equal(t, uint8(1), result.Battery[1])
-}
-
-func TestAverageSystemStatsSlice_BasicAveraging(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:          20.0,
-			Mem:          16.0,
-			MemUsed:      6.0,
-			MemPct:       37.5,
-			MemBuffCache: 1.0,
-			MemZfsArc:    0.5,
-			Swap:         4.0,
-			SwapUsed:     1.0,
-			DiskTotal:    500.0,
-			DiskUsed:     200.0,
-			DiskPct:      40.0,
-			DiskReadPs:   100.0,
-			DiskWritePs:  200.0,
-			NetworkSent:  10.0,
-			NetworkRecv:  20.0,
-			LoadAvg:      [3]float64{1.0, 2.0, 3.0},
-			Bandwidth:    [2]uint64{1000, 2000},
-			DiskIO:       [2]uint64{400, 600},
-			Battery:      [2]uint8{80, 1},
-		},
-		{
-			Cpu:          40.0,
-			Mem:          16.0,
-			MemUsed:      10.0,
-			MemPct:       62.5,
-			MemBuffCache: 3.0,
-			MemZfsArc:    1.5,
-			Swap:         4.0,
-			SwapUsed:     3.0,
-			DiskTotal:    500.0,
-			DiskUsed:     300.0,
-			DiskPct:      60.0,
-			DiskReadPs:   200.0,
-			DiskWritePs:  400.0,
-			NetworkSent:  30.0,
-			NetworkRecv:  40.0,
-			LoadAvg:      [3]float64{3.0, 4.0, 5.0},
-			Bandwidth:    [2]uint64{3000, 4000},
-			DiskIO:       [2]uint64{600, 800},
-			Battery:      [2]uint8{60, 1},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 30.0, result.Cpu)
-	assert.Equal(t, 16.0, result.Mem)
-	assert.Equal(t, 8.0, result.MemUsed)
-	assert.Equal(t, 50.0, result.MemPct)
-	assert.Equal(t, 2.0, result.MemBuffCache)
-	assert.Equal(t, 1.0, result.MemZfsArc)
-	assert.Equal(t, 4.0, result.Swap)
-	assert.Equal(t, 2.0, result.SwapUsed)
-	assert.Equal(t, 500.0, result.DiskTotal)
-	assert.Equal(t, 250.0, result.DiskUsed)
-	assert.Equal(t, 50.0, result.DiskPct)
-	assert.Equal(t, 150.0, result.DiskReadPs)
-	assert.Equal(t, 300.0, result.DiskWritePs)
-	assert.Equal(t, 20.0, result.NetworkSent)
-	assert.Equal(t, 30.0, result.NetworkRecv)
-	assert.Equal(t, [3]float64{2.0, 3.0, 4.0}, result.LoadAvg)
-	assert.Equal(t, [2]uint64{2000, 3000}, result.Bandwidth)
-	assert.Equal(t, [2]uint64{500, 700}, result.DiskIO)
-	assert.Equal(t, uint8(70), result.Battery[0])
-	assert.Equal(t, uint8(1), result.Battery[1])
-}
-
-func TestAverageSystemStatsSlice_PeakValues(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:            20.0,
-			MaxCpu:         25.0,
-			MemUsed:        6.0,
-			MaxMem:         7.0,
-			NetworkSent:    10.0,
-			MaxNetworkSent: 15.0,
-			NetworkRecv:    20.0,
-			MaxNetworkRecv: 25.0,
-			DiskReadPs:     100.0,
-			MaxDiskReadPs:  120.0,
-			DiskWritePs:    200.0,
-			MaxDiskWritePs: 220.0,
-			Bandwidth:      [2]uint64{1000, 2000},
-			MaxBandwidth:   [2]uint64{1500, 2500},
-			DiskIO:         [2]uint64{400, 600},
-			MaxDiskIO:      [2]uint64{500, 700},
-			DiskIoStats:    [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
-			MaxDiskIoStats: [6]float64{15.0, 25.0, 35.0, 6.0, 9.0, 14.0},
-		},
-		{
-			Cpu:            40.0,
-			MaxCpu:         50.0,
-			MemUsed:        10.0,
-			MaxMem:         12.0,
-			NetworkSent:    30.0,
-			MaxNetworkSent: 35.0,
-			NetworkRecv:    40.0,
-			MaxNetworkRecv: 45.0,
-			DiskReadPs:     200.0,
-			MaxDiskReadPs:  210.0,
-			DiskWritePs:    400.0,
-			MaxDiskWritePs: 410.0,
-			Bandwidth:      [2]uint64{3000, 4000},
-			MaxBandwidth:   [2]uint64{3500, 4500},
-			DiskIO:         [2]uint64{600, 800},
-			MaxDiskIO:      [2]uint64{650, 850},
-			DiskIoStats:    [6]float64{50.0, 60.0, 70.0, 15.0, 18.0, 22.0},
-			MaxDiskIoStats: [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 50.0, result.MaxCpu)
-	assert.Equal(t, 12.0, result.MaxMem)
-	assert.Equal(t, 35.0, result.MaxNetworkSent)
-	assert.Equal(t, 45.0, result.MaxNetworkRecv)
-	assert.Equal(t, 210.0, result.MaxDiskReadPs)
-	assert.Equal(t, 410.0, result.MaxDiskWritePs)
-	assert.Equal(t, [2]uint64{3500, 4500}, result.MaxBandwidth)
-	assert.Equal(t, [2]uint64{650, 850}, result.MaxDiskIO)
-	assert.Equal(t, [6]float64{30.0, 40.0, 50.0, 10.0, 13.0, 17.0}, result.DiskIoStats)
-	assert.Equal(t, [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0}, result.MaxDiskIoStats)
-}
-
-func TestAverageSystemStatsSlice_DiskIoStats(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:            10.0,
-			DiskIoStats:    [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
-			MaxDiskIoStats: [6]float64{12.0, 22.0, 32.0, 6.0, 9.0, 13.0},
-		},
-		{
-			Cpu:            20.0,
-			DiskIoStats:    [6]float64{30.0, 40.0, 50.0, 15.0, 18.0, 22.0},
-			MaxDiskIoStats: [6]float64{28.0, 38.0, 48.0, 14.0, 17.0, 21.0},
-		},
-		{
-			Cpu:            30.0,
-			DiskIoStats:    [6]float64{20.0, 30.0, 40.0, 10.0, 12.0, 16.0},
-			MaxDiskIoStats: [6]float64{25.0, 35.0, 45.0, 11.0, 13.0, 17.0},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	// Average: (10+30+20)/3=20, (20+40+30)/3=30, (30+50+40)/3=40, (5+15+10)/3=10, (8+18+12)/3≈12.67, (12+22+16)/3≈16.67
-	assert.Equal(t, 20.0, result.DiskIoStats[0])
-	assert.Equal(t, 30.0, result.DiskIoStats[1])
-	assert.Equal(t, 40.0, result.DiskIoStats[2])
-	assert.Equal(t, 10.0, result.DiskIoStats[3])
-	assert.Equal(t, 12.67, result.DiskIoStats[4])
-	assert.Equal(t, 16.67, result.DiskIoStats[5])
-	// Max: current DiskIoStats[0] wins for record 2 (30 > MaxDiskIoStats 28)
-	assert.Equal(t, 30.0, result.MaxDiskIoStats[0])
-	assert.Equal(t, 40.0, result.MaxDiskIoStats[1])
-	assert.Equal(t, 50.0, result.MaxDiskIoStats[2])
-	assert.Equal(t, 15.0, result.MaxDiskIoStats[3])
-	assert.Equal(t, 18.0, result.MaxDiskIoStats[4])
-	assert.Equal(t, 22.0, result.MaxDiskIoStats[5])
-}
-
-// Tests that current DiskIoStats values are considered when computing MaxDiskIoStats.
-func TestAverageSystemStatsSlice_DiskIoStatsPeakFromCurrentValues(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, DiskIoStats: [6]float64{95.0, 90.0, 85.0, 50.0, 60.0, 80.0}, MaxDiskIoStats: [6]float64{80.0, 80.0, 80.0, 40.0, 50.0, 70.0}},
-		{Cpu: 20.0, DiskIoStats: [6]float64{10.0, 10.0, 10.0, 5.0, 6.0, 8.0}, MaxDiskIoStats: [6]float64{20.0, 20.0, 20.0, 10.0, 12.0, 16.0}},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	// Current value from first record (95, 90, 85, 50, 60, 80) beats MaxDiskIoStats in both records
-	assert.Equal(t, 95.0, result.MaxDiskIoStats[0])
-	assert.Equal(t, 90.0, result.MaxDiskIoStats[1])
-	assert.Equal(t, 85.0, result.MaxDiskIoStats[2])
-	assert.Equal(t, 50.0, result.MaxDiskIoStats[3])
-	assert.Equal(t, 60.0, result.MaxDiskIoStats[4])
-	assert.Equal(t, 80.0, result.MaxDiskIoStats[5])
-}
-
-// Tests that current values are considered when computing peaks
-// (i.e., current cpu > MaxCpu should still win).
-func TestAverageSystemStatsSlice_PeakFromCurrentValues(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 95.0, MaxCpu: 80.0, MemUsed: 15.0, MaxMem: 10.0},
-		{Cpu: 10.0, MaxCpu: 20.0, MemUsed: 5.0, MaxMem: 8.0},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 95.0, result.MaxCpu)
-	assert.Equal(t, 15.0, result.MaxMem)
-}
-
-// Tests that records without temperature data are excluded from the temperature average.
-func TestAverageSystemStatsSlice_Temperatures(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:          10.0,
-			Temperatures: map[string]float64{"cpu": 60.0, "gpu": 70.0},
-		},
-		{
-			Cpu:          20.0,
-			Temperatures: map[string]float64{"cpu": 80.0, "gpu": 90.0},
-		},
-		{
-			// No temperatures - should not affect temp averaging
-			Cpu: 30.0,
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.Temperatures)
-	// Average over 2 records that had temps, not 3
-	assert.Equal(t, 70.0, result.Temperatures["cpu"])
-	assert.Equal(t, 80.0, result.Temperatures["gpu"])
-}
-
-func TestAverageSystemStatsSlice_NetworkInterfaces(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			NetworkInterfaces: map[string][4]uint64{
-				"eth0": {100, 200, 150, 250},
-				"eth1": {50, 60, 70, 80},
-			},
-		},
-		{
-			Cpu: 20.0,
-			NetworkInterfaces: map[string][4]uint64{
-				"eth0": {200, 400, 300, 500},
-				"eth1": {150, 160, 170, 180},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.NetworkInterfaces)
-	// [0] and [1] are averaged, [2] and [3] are max
-	assert.Equal(t, [4]uint64{150, 300, 300, 500}, result.NetworkInterfaces["eth0"])
-	assert.Equal(t, [4]uint64{100, 110, 170, 180}, result.NetworkInterfaces["eth1"])
-}
-
-func TestAverageSystemStatsSlice_ExtraFs(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskTotal:         1000.0,
-					DiskUsed:          400.0,
-					DiskReadPs:        50.0,
-					DiskWritePs:       100.0,
-					MaxDiskReadPS:     60.0,
-					MaxDiskWritePS:    110.0,
-					DiskReadBytes:     5000,
-					DiskWriteBytes:    10000,
-					MaxDiskReadBytes:  6000,
-					MaxDiskWriteBytes: 11000,
-					DiskIoStats:       [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
-					MaxDiskIoStats:    [6]float64{12.0, 22.0, 32.0, 6.0, 9.0, 13.0},
-				},
-			},
-		},
-		{
-			Cpu: 20.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskTotal:         1000.0,
-					DiskUsed:          600.0,
-					DiskReadPs:        150.0,
-					DiskWritePs:       200.0,
-					MaxDiskReadPS:     160.0,
-					MaxDiskWritePS:    210.0,
-					DiskReadBytes:     15000,
-					DiskWriteBytes:    20000,
-					MaxDiskReadBytes:  16000,
-					MaxDiskWriteBytes: 21000,
-					DiskIoStats:       [6]float64{50.0, 60.0, 70.0, 15.0, 18.0, 22.0},
-					MaxDiskIoStats:    [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0},
-				},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.ExtraFs)
-	require.NotNil(t, result.ExtraFs["/data"])
-	fs := result.ExtraFs["/data"]
-	assert.Equal(t, 1000.0, fs.DiskTotal)
-	assert.Equal(t, 500.0, fs.DiskUsed)
-	assert.Equal(t, 100.0, fs.DiskReadPs)
-	assert.Equal(t, 150.0, fs.DiskWritePs)
-	assert.Equal(t, 160.0, fs.MaxDiskReadPS)
-	assert.Equal(t, 210.0, fs.MaxDiskWritePS)
-	assert.Equal(t, uint64(10000), fs.DiskReadBytes)
-	assert.Equal(t, uint64(15000), fs.DiskWriteBytes)
-	assert.Equal(t, uint64(16000), fs.MaxDiskReadBytes)
-	assert.Equal(t, uint64(21000), fs.MaxDiskWriteBytes)
-	assert.Equal(t, [6]float64{30.0, 40.0, 50.0, 10.0, 13.0, 17.0}, fs.DiskIoStats)
-	assert.Equal(t, [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0}, fs.MaxDiskIoStats)
-}
-
-// Tests that ExtraFs DiskIoStats peak considers current values, not just previous peaks.
-func TestAverageSystemStatsSlice_ExtraFsDiskIoStatsPeakFromCurrentValues(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskIoStats:    [6]float64{95.0, 90.0, 85.0, 50.0, 60.0, 80.0}, // exceeds MaxDiskIoStats
-					MaxDiskIoStats: [6]float64{80.0, 80.0, 80.0, 40.0, 50.0, 70.0},
-				},
-			},
-		},
-		{
-			Cpu: 20.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskIoStats:    [6]float64{10.0, 10.0, 10.0, 5.0, 6.0, 8.0},
-					MaxDiskIoStats: [6]float64{20.0, 20.0, 20.0, 10.0, 12.0, 16.0},
-				},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	fs := result.ExtraFs["/data"]
-	assert.Equal(t, 95.0, fs.MaxDiskIoStats[0])
-	assert.Equal(t, 90.0, fs.MaxDiskIoStats[1])
-	assert.Equal(t, 85.0, fs.MaxDiskIoStats[2])
-	assert.Equal(t, 50.0, fs.MaxDiskIoStats[3])
-	assert.Equal(t, 60.0, fs.MaxDiskIoStats[4])
-	assert.Equal(t, 80.0, fs.MaxDiskIoStats[5])
-}
-
-// Tests that extra FS peak values consider current values, not just previous peaks.
-func TestAverageSystemStatsSlice_ExtraFsPeaksFromCurrentValues(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskReadPs:       500.0, // exceeds MaxDiskReadPS
-					MaxDiskReadPS:    100.0,
-					DiskReadBytes:    50000,
-					MaxDiskReadBytes: 10000,
-				},
-			},
-		},
-		{
-			Cpu: 20.0,
-			ExtraFs: map[string]*system.FsStats{
-				"/data": {
-					DiskReadPs:       50.0,
-					MaxDiskReadPS:    200.0,
-					DiskReadBytes:    5000,
-					MaxDiskReadBytes: 20000,
-				},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	fs := result.ExtraFs["/data"]
-	assert.Equal(t, 500.0, fs.MaxDiskReadPS)
-	assert.Equal(t, uint64(50000), fs.MaxDiskReadBytes)
-}
-
-func TestAverageSystemStatsSlice_GPUData(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			GPUData: map[string]system.GPUData{
-				"gpu0": {
-					Name:        "RTX 4090",
-					Temperature: 60.0,
-					MemoryUsed:  4.0,
-					MemoryTotal: 24.0,
-					Usage:       30.0,
-					Power:       200.0,
-					Count:       1.0,
-					Engines: map[string]float64{
-						"3D":    50.0,
-						"Video": 10.0,
-					},
-				},
-			},
-		},
-		{
-			Cpu: 20.0,
-			GPUData: map[string]system.GPUData{
-				"gpu0": {
-					Name:        "RTX 4090",
-					Temperature: 80.0,
-					MemoryUsed:  8.0,
-					MemoryTotal: 24.0,
-					Usage:       70.0,
-					Power:       300.0,
-					Count:       1.0,
-					Engines: map[string]float64{
-						"3D":    90.0,
-						"Video": 30.0,
-					},
-				},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.GPUData)
-	gpu := result.GPUData["gpu0"]
-	assert.Equal(t, "RTX 4090", gpu.Name)
-	assert.Equal(t, 70.0, gpu.Temperature)
-	assert.Equal(t, 6.0, gpu.MemoryUsed)
-	assert.Equal(t, 24.0, gpu.MemoryTotal)
-	assert.Equal(t, 50.0, gpu.Usage)
-	assert.Equal(t, 250.0, gpu.Power)
-	assert.Equal(t, 1.0, gpu.Count)
-	require.NotNil(t, gpu.Engines)
-	assert.Equal(t, 70.0, gpu.Engines["3D"])
-	assert.Equal(t, 20.0, gpu.Engines["Video"])
-}
-
-func TestAverageSystemStatsSlice_MultipleGPUs(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu: 10.0,
-			GPUData: map[string]system.GPUData{
-				"gpu0": {Name: "GPU A", Usage: 20.0, Temperature: 50.0},
-				"gpu1": {Name: "GPU B", Usage: 60.0, Temperature: 70.0},
-			},
-		},
-		{
-			Cpu: 20.0,
-			GPUData: map[string]system.GPUData{
-				"gpu0": {Name: "GPU A", Usage: 40.0, Temperature: 60.0},
-				"gpu1": {Name: "GPU B", Usage: 80.0, Temperature: 80.0},
-			},
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.GPUData)
-	assert.Equal(t, 30.0, result.GPUData["gpu0"].Usage)
-	assert.Equal(t, 55.0, result.GPUData["gpu0"].Temperature)
-	assert.Equal(t, 70.0, result.GPUData["gpu1"].Usage)
-	assert.Equal(t, 75.0, result.GPUData["gpu1"].Temperature)
-}
-
-func TestAverageSystemStatsSlice_CpuCoresUsage(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, CpuCoresUsage: system.Uint8Slice{10, 20, 30, 40}},
-		{Cpu: 20.0, CpuCoresUsage: system.Uint8Slice{30, 40, 50, 60}},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.CpuCoresUsage)
-	assert.Equal(t, system.Uint8Slice{20, 30, 40, 50}, result.CpuCoresUsage)
-}
-
-// Tests that per-core usage rounds correctly (e.g., 15.5 -> 16 via math.Round).
-func TestAverageSystemStatsSlice_CpuCoresUsageRounding(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, CpuCoresUsage: system.Uint8Slice{11}},
-		{Cpu: 20.0, CpuCoresUsage: system.Uint8Slice{20}},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.CpuCoresUsage)
-	// (11+20)/2 = 15.5, rounds to 16
-	assert.Equal(t, uint8(16), result.CpuCoresUsage[0])
-}
-
-func TestAverageSystemStatsSlice_CpuBreakdown(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, CpuBreakdown: []float64{5.0, 3.0, 1.0, 0.5, 90.5}},
-		{Cpu: 20.0, CpuBreakdown: []float64{15.0, 7.0, 3.0, 1.5, 73.5}},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	require.NotNil(t, result.CpuBreakdown)
-	assert.Equal(t, []float64{10.0, 5.0, 2.0, 1.0, 82.0}, result.CpuBreakdown)
-}
-
-// Tests that Battery[1] (charge state) uses the last record's value.
-func TestAverageSystemStatsSlice_BatteryLastChargeState(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, Battery: [2]uint8{100, 1}}, // charging
-		{Cpu: 20.0, Battery: [2]uint8{90, 0}},  // not charging
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, uint8(95), result.Battery[0])
-	assert.Equal(t, uint8(0), result.Battery[1]) // last record's charge state
-}
-
-func TestAverageSystemStatsSlice_ThreeRecordsRounding(t *testing.T) {
-	input := []system.Stats{
-		{Cpu: 10.0, Mem: 8.0},
-		{Cpu: 20.0, Mem: 8.0},
-		{Cpu: 30.0, Mem: 8.0},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 20.0, result.Cpu)
-	assert.Equal(t, 8.0, result.Mem)
-}
-
-// Tests records where some have optional fields and others don't.
-func TestAverageSystemStatsSlice_MixedOptionalFields(t *testing.T) {
-	input := []system.Stats{
-		{
-			Cpu:           10.0,
-			CpuCoresUsage: system.Uint8Slice{50, 60},
-			CpuBreakdown:  []float64{5.0, 3.0, 1.0, 0.5, 90.5},
-			GPUData: map[string]system.GPUData{
-				"gpu0": {Name: "GPU", Usage: 40.0},
-			},
-		},
-		{
-			Cpu: 20.0,
-			// No CpuCoresUsage, CpuBreakdown, or GPUData
-		},
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 15.0, result.Cpu)
-	// CpuCoresUsage: only 1 record had it, so sum/2
-	require.NotNil(t, result.CpuCoresUsage)
-	assert.Equal(t, uint8(25), result.CpuCoresUsage[0])
-	assert.Equal(t, uint8(30), result.CpuCoresUsage[1])
-	// CpuBreakdown: only 1 record had it, so sum/2
-	require.NotNil(t, result.CpuBreakdown)
-	assert.Equal(t, 2.5, result.CpuBreakdown[0])
-	// GPUData: only 1 record had it, so sum/2
-	require.NotNil(t, result.GPUData)
-	assert.Equal(t, 20.0, result.GPUData["gpu0"].Usage)
-}
-
-// Tests with 10 records matching the common real-world case (10 x 1m -> 1 x 10m).
-func TestAverageSystemStatsSlice_TenRecords(t *testing.T) {
-	input := make([]system.Stats, 10)
-	for i := range input {
-		input[i] = system.Stats{
-			Cpu:         float64(i * 10), // 0, 10, 20, ..., 90
-			Mem:         16.0,
-			MemUsed:     float64(4 + i),  // 4, 5, 6, ..., 13
-			MemPct:      float64(25 + i), // 25, 26, ..., 34
-			DiskTotal:   500.0,
-			DiskUsed:    250.0,
-			DiskPct:     50.0,
-			NetworkSent: float64(i),
-			NetworkRecv: float64(i * 2),
-			Bandwidth:   [2]uint64{uint64(i * 1000), uint64(i * 2000)},
-			LoadAvg:     [3]float64{float64(i), float64(i) * 0.5, float64(i) * 0.25},
-		}
-	}
-
-	result := records.AverageSystemStatsSlice(input)
-
-	assert.Equal(t, 45.0, result.Cpu)    // avg of 0..90
-	assert.Equal(t, 16.0, result.Mem)    // constant
-	assert.Equal(t, 8.5, result.MemUsed) // avg of 4..13
-	assert.Equal(t, 29.5, result.MemPct) // avg of 25..34
-	assert.Equal(t, 500.0, result.DiskTotal)
-	assert.Equal(t, 250.0, result.DiskUsed)
-	assert.Equal(t, 50.0, result.DiskPct)
-	assert.Equal(t, 4.5, result.NetworkSent)
-	assert.Equal(t, 9.0, result.NetworkRecv)
-	assert.Equal(t, [2]uint64{4500, 9000}, result.Bandwidth)
-}
-
-// --- Container Stats Tests ---
-
-func TestAverageContainerStatsSlice_Empty(t *testing.T) {
-	result := records.AverageContainerStatsSlice(nil)
-	assert.Equal(t, []container.Stats{}, result)
-
-	result = records.AverageContainerStatsSlice([][]container.Stats{})
-	assert.Equal(t, []container.Stats{}, result)
-}
-
-func TestAverageContainerStatsSlice_SingleRecord(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 5.0, Mem: 128.0, Bandwidth: [2]uint64{1000, 2000}},
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-
-	require.Len(t, result, 1)
-	assert.Equal(t, "nginx", result[0].Name)
-	assert.Equal(t, 5.0, result[0].Cpu)
-	assert.Equal(t, 128.0, result[0].Mem)
-	assert.Equal(t, [2]uint64{1000, 2000}, result[0].Bandwidth)
-}
-
-func TestAverageContainerStatsSlice_BasicAveraging(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 10.0, Mem: 100.0, Bandwidth: [2]uint64{1000, 2000}},
-			{Name: "redis", Cpu: 5.0, Mem: 64.0, Bandwidth: [2]uint64{500, 1000}},
-		},
-		{
-			{Name: "nginx", Cpu: 20.0, Mem: 200.0, Bandwidth: [2]uint64{3000, 4000}},
-			{Name: "redis", Cpu: 15.0, Mem: 128.0, Bandwidth: [2]uint64{1500, 2000}},
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
-
-	require.Len(t, result, 2)
-
-	assert.Equal(t, "nginx", result[0].Name)
-	assert.Equal(t, 15.0, result[0].Cpu)
-	assert.Equal(t, 150.0, result[0].Mem)
-	assert.Equal(t, [2]uint64{2000, 3000}, result[0].Bandwidth)
-
-	assert.Equal(t, "redis", result[1].Name)
-	assert.Equal(t, 10.0, result[1].Cpu)
-	assert.Equal(t, 96.0, result[1].Mem)
-	assert.Equal(t, [2]uint64{1000, 1500}, result[1].Bandwidth)
-}
-
-// Tests containers that appear in some records but not all.
-func TestAverageContainerStatsSlice_ContainerAppearsInSomeRecords(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 10.0, Mem: 100.0},
-			{Name: "redis", Cpu: 5.0, Mem: 64.0},
-		},
-		{
-			{Name: "nginx", Cpu: 20.0, Mem: 200.0},
-			// redis not present
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
-
-	require.Len(t, result, 2)
-
-	assert.Equal(t, "nginx", result[0].Name)
-	assert.Equal(t, 15.0, result[0].Cpu)
-	assert.Equal(t, 150.0, result[0].Mem)
-
-	// redis: sum / count where count = total records (2), not records containing redis
-	assert.Equal(t, "redis", result[1].Name)
-	assert.Equal(t, 2.5, result[1].Cpu)
-	assert.Equal(t, 32.0, result[1].Mem)
-}
-
-// Tests backward compatibility with deprecated NetworkSent/NetworkRecv (MB) when Bandwidth is zero.
-func TestAverageContainerStatsSlice_DeprecatedNetworkFields(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 10.0, Mem: 100.0, NetworkSent: 1.0, NetworkRecv: 2.0}, // 1 MB, 2 MB
-		},
-		{
-			{Name: "nginx", Cpu: 20.0, Mem: 200.0, NetworkSent: 3.0, NetworkRecv: 4.0}, // 3 MB, 4 MB
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-
-	require.Len(t, result, 1)
-	assert.Equal(t, "nginx", result[0].Name)
-	// avg sent = (1*1048576 + 3*1048576) / 2 = 2*1048576
-	assert.Equal(t, uint64(2*1048576), result[0].Bandwidth[0])
-	// avg recv = (2*1048576 + 4*1048576) / 2 = 3*1048576
-	assert.Equal(t, uint64(3*1048576), result[0].Bandwidth[1])
-}
-
-// Tests that when Bandwidth is set, deprecated NetworkSent/NetworkRecv are ignored.
-func TestAverageContainerStatsSlice_MixedBandwidthAndDeprecated(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "nginx", Cpu: 10.0, Mem: 100.0, Bandwidth: [2]uint64{5000, 6000}, NetworkSent: 99.0, NetworkRecv: 99.0},
-		},
-		{
-			{Name: "nginx", Cpu: 20.0, Mem: 200.0, Bandwidth: [2]uint64{7000, 8000}},
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-
-	require.Len(t, result, 1)
-	assert.Equal(t, uint64(6000), result[0].Bandwidth[0])
-	assert.Equal(t, uint64(7000), result[0].Bandwidth[1])
-}
-
-func TestAverageContainerStatsSlice_ThreeRecords(t *testing.T) {
-	input := [][]container.Stats{
-		{{Name: "app", Cpu: 1.0, Mem: 100.0}},
-		{{Name: "app", Cpu: 2.0, Mem: 200.0}},
-		{{Name: "app", Cpu: 3.0, Mem: 300.0}},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-
-	require.Len(t, result, 1)
-	assert.Equal(t, 2.0, result[0].Cpu)
-	assert.Equal(t, 200.0, result[0].Mem)
-}
-
-func TestAverageContainerStatsSlice_ManyContainers(t *testing.T) {
-	input := [][]container.Stats{
-		{
-			{Name: "a", Cpu: 10.0, Mem: 100.0},
-			{Name: "b", Cpu: 20.0, Mem: 200.0},
-			{Name: "c", Cpu: 30.0, Mem: 300.0},
-			{Name: "d", Cpu: 40.0, Mem: 400.0},
-		},
-		{
-			{Name: "a", Cpu: 20.0, Mem: 200.0},
-			{Name: "b", Cpu: 30.0, Mem: 300.0},
-			{Name: "c", Cpu: 40.0, Mem: 400.0},
-			{Name: "d", Cpu: 50.0, Mem: 500.0},
-		},
-	}
-
-	result := records.AverageContainerStatsSlice(input)
-	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
-
-	require.Len(t, result, 4)
-	assert.Equal(t, 15.0, result[0].Cpu)
-	assert.Equal(t, 25.0, result[1].Cpu)
-	assert.Equal(t, 35.0, result[2].Cpu)
-	assert.Equal(t, 45.0, result[3].Cpu)
-}

internal/records/records_deletion.go

@@ -1,138 +0,0 @@
-package records
-
-import (
-	"fmt"
-	"log/slog"
-	"strings"
-	"time"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-)
-
-// Delete old records
-func (rm *RecordManager) DeleteOldRecords() {
-	rm.app.RunInTransaction(func(txApp core.App) error {
-		err := deleteOldSystemStats(txApp)
-		if err != nil {
-			slog.Error("Error deleting old system stats", "err", err)
-		}
-		err = deleteOldContainerRecords(txApp)
-		if err != nil {
-			slog.Error("Error deleting old container records", "err", err)
-		}
-		err = deleteOldSystemdServiceRecords(txApp)
-		if err != nil {
-			slog.Error("Error deleting old systemd service records", "err", err)
-		}
-		err = deleteOldAlertsHistory(txApp, 200, 250)
-		if err != nil {
-			slog.Error("Error deleting old alerts history", "err", err)
-		}
-		err = deleteOldQuietHours(txApp)
-		if err != nil {
-			slog.Error("Error deleting old quiet hours", "err", err)
-		}
-		return nil
-	})
-}
-
-// Delete old alerts history records
-func deleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int) error {
-	db := app.DB()
-	var users []struct {
-		Id string `db:"user"`
-	}
-	err := db.NewQuery("SELECT user, COUNT(*) as count FROM alerts_history GROUP BY user HAVING count > {:countBeforeDeletion}").Bind(dbx.Params{"countBeforeDeletion": countBeforeDeletion}).All(&users)
-	if err != nil {
-		return err
-	}
-	for _, user := range users {
-		_, err = db.NewQuery("DELETE FROM alerts_history WHERE user = {:user} AND id NOT IN (SELECT id FROM alerts_history WHERE user = {:user} ORDER BY created DESC LIMIT {:countToKeep})").Bind(dbx.Params{"user": user.Id, "countToKeep": countToKeep}).Execute()
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// Deletes system_stats records older than what is displayed in the UI
-func deleteOldSystemStats(app core.App) error {
-	// Collections to process
-	collections := [2]string{"system_stats", "container_stats"}
-
-	// Record types and their retention periods
-	type RecordDeletionData struct {
-		recordType string
-		retention  time.Duration
-	}
-	recordData := []RecordDeletionData{
-		{recordType: "1m", retention: time.Hour},             // 1 hour
-		{recordType: "10m", retention: 12 * time.Hour},       // 12 hours
-		{recordType: "20m", retention: 24 * time.Hour},       // 1 day
-		{recordType: "120m", retention: 7 * 24 * time.Hour},  // 7 days
-		{recordType: "480m", retention: 30 * 24 * time.Hour}, // 30 days
-	}
-
-	now := time.Now().UTC()
-
-	for _, collection := range collections {
-		// Build the WHERE clause
-		var conditionParts []string
-		var params dbx.Params = make(map[string]any)
-		for i := range recordData {
-			rd := recordData[i]
-			// Create parameterized condition for this record type
-			dateParam := fmt.Sprintf("date%d", i)
-			conditionParts = append(conditionParts, fmt.Sprintf("(type = '%s' AND created < {:%s})", rd.recordType, dateParam))
-			params[dateParam] = now.Add(-rd.retention)
-		}
-		// Combine conditions with OR
-		conditionStr := strings.Join(conditionParts, " OR ")
-		// Construct and execute the full raw query
-		rawQuery := fmt.Sprintf("DELETE FROM %s WHERE %s", collection, conditionStr)
-		if _, err := app.DB().NewQuery(rawQuery).Bind(params).Execute(); err != nil {
-			return fmt.Errorf("failed to delete from %s: %v", collection, err)
-		}
-	}
-	return nil
-}
-
-// Deletes systemd service records that haven't been updated in the last 20 minutes
-func deleteOldSystemdServiceRecords(app core.App) error {
-	now := time.Now().UTC()
-	twentyMinutesAgo := now.Add(-20 * time.Minute)
-
-	// Delete systemd service records where updated < twentyMinutesAgo
-	_, err := app.DB().NewQuery("DELETE FROM systemd_services WHERE updated < {:updated}").Bind(dbx.Params{"updated": twentyMinutesAgo.UnixMilli()}).Execute()
-	if err != nil {
-		return fmt.Errorf("failed to delete old systemd service records: %v", err)
-	}
-
-	return nil
-}
-
-// Deletes container records that haven't been updated in the last 10 minutes
-func deleteOldContainerRecords(app core.App) error {
-	now := time.Now().UTC()
-	tenMinutesAgo := now.Add(-10 * time.Minute)
-
-	// Delete container records where updated < tenMinutesAgo
-	_, err := app.DB().NewQuery("DELETE FROM containers WHERE updated < {:updated}").Bind(dbx.Params{"updated": tenMinutesAgo.UnixMilli()}).Execute()
-	if err != nil {
-		return fmt.Errorf("failed to delete old container records: %v", err)
-	}
-
-	return nil
-}
-
-// Deletes old quiet hours records where end date has passed
-func deleteOldQuietHours(app core.App) error {
-	now := time.Now().UTC()
-	_, err := app.DB().NewQuery("DELETE FROM quiet_hours WHERE type = 'one-time' AND end < {:now}").Bind(dbx.Params{"now": now}).Execute()
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

internal/records/records_deletion_test.go

@@ -1,428 +0,0 @@
-//go:build testing
-
-package records_test
-
-import (
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/henrygd/beszel/internal/records"
-	"github.com/henrygd/beszel/internal/tests"
-
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/types"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestDeleteOldRecords tests the main DeleteOldRecords function
-func TestDeleteOldRecords(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	rm := records.NewRecordManager(hub)
-
-	// Create test user for alerts history
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	// Create test system
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now()
-
-	// Create old system_stats records that should be deleted
-	var record *core.Record
-	record, err = tests.CreateRecord(hub, "system_stats", map[string]any{
-		"system": system.Id,
-		"type":   "1m",
-		"stats":  `{"cpu": 50.0, "mem": 1024}`,
-	})
-	require.NoError(t, err)
-	// created is autodate field, so we need to set it manually
-	record.SetRaw("created", now.UTC().Add(-2*time.Hour).Format(types.DefaultDateLayout))
-	err = hub.SaveNoValidate(record)
-	require.NoError(t, err)
-	require.NotNil(t, record)
-	require.InDelta(t, record.GetDateTime("created").Time().UTC().Unix(), now.UTC().Add(-2*time.Hour).Unix(), 1)
-	require.Equal(t, record.Get("system"), system.Id)
-	require.Equal(t, record.Get("type"), "1m")
-
-	// Create recent system_stats record that should be kept
-	_, err = tests.CreateRecord(hub, "system_stats", map[string]any{
-		"system":  system.Id,
-		"type":    "1m",
-		"stats":   `{"cpu": 30.0, "mem": 512}`,
-		"created": now.Add(-30 * time.Minute), // 30 minutes old, should be kept
-	})
-	require.NoError(t, err)
-
-	// Create many alerts history records to trigger deletion
-	for i := range 260 { // More than countBeforeDeletion (250)
-		_, err = tests.CreateRecord(hub, "alerts_history", map[string]any{
-			"user":    user.Id,
-			"name":    "CPU",
-			"value":   i + 1,
-			"system":  system.Id,
-			"created": now.Add(-time.Duration(i) * time.Minute),
-		})
-		require.NoError(t, err)
-	}
-
-	// Count records before deletion
-	systemStatsCountBefore, err := hub.CountRecords("system_stats")
-	require.NoError(t, err)
-	alertsCountBefore, err := hub.CountRecords("alerts_history")
-	require.NoError(t, err)
-
-	// Run deletion
-	rm.DeleteOldRecords()
-
-	// Count records after deletion
-	systemStatsCountAfter, err := hub.CountRecords("system_stats")
-	require.NoError(t, err)
-	alertsCountAfter, err := hub.CountRecords("alerts_history")
-	require.NoError(t, err)
-
-	// Verify old system stats were deleted
-	assert.Less(t, systemStatsCountAfter, systemStatsCountBefore, "Old system stats should be deleted")
-
-	// Verify alerts history was trimmed
-	assert.Less(t, alertsCountAfter, alertsCountBefore, "Excessive alerts history should be deleted")
-	assert.Equal(t, alertsCountAfter, int64(200), "Alerts count should be equal to countToKeep (200)")
-}
-
-// TestDeleteOldSystemStats tests the deleteOldSystemStats function
-func TestDeleteOldSystemStats(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	// Create test system
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-
-	// Test data for different record types and their retention periods
-	testCases := []struct {
-		recordType   string
-		retention    time.Duration
-		shouldBeKept bool
-		ageFromNow   time.Duration
-		description  string
-	}{
-		{"1m", time.Hour, true, 30 * time.Minute, "1m record within 1 hour should be kept"},
-		{"1m", time.Hour, false, 2 * time.Hour, "1m record older than 1 hour should be deleted"},
-		{"10m", 12 * time.Hour, true, 6 * time.Hour, "10m record within 12 hours should be kept"},
-		{"10m", 12 * time.Hour, false, 24 * time.Hour, "10m record older than 12 hours should be deleted"},
-		{"20m", 24 * time.Hour, true, 12 * time.Hour, "20m record within 24 hours should be kept"},
-		{"20m", 24 * time.Hour, false, 48 * time.Hour, "20m record older than 24 hours should be deleted"},
-		{"120m", 7 * 24 * time.Hour, true, 3 * 24 * time.Hour, "120m record within 7 days should be kept"},
-		{"120m", 7 * 24 * time.Hour, false, 10 * 24 * time.Hour, "120m record older than 7 days should be deleted"},
-		{"480m", 30 * 24 * time.Hour, true, 15 * 24 * time.Hour, "480m record within 30 days should be kept"},
-		{"480m", 30 * 24 * time.Hour, false, 45 * 24 * time.Hour, "480m record older than 30 days should be deleted"},
-	}
-
-	// Create test records for both system_stats and container_stats
-	collections := []string{"system_stats", "container_stats"}
-	recordIds := make(map[string][]string)
-
-	for _, collection := range collections {
-		recordIds[collection] = make([]string, 0)
-
-		for i, tc := range testCases {
-			recordTime := now.Add(-tc.ageFromNow)
-
-			var stats string
-			if collection == "system_stats" {
-				stats = fmt.Sprintf(`{"cpu": %d.0, "mem": %d}`, i*10, i*100)
-			} else {
-				stats = fmt.Sprintf(`[{"name": "container%d", "cpu": %d.0, "mem": %d}]`, i, i*5, i*50)
-			}
-
-			record, err := tests.CreateRecord(hub, collection, map[string]any{
-				"system": system.Id,
-				"type":   tc.recordType,
-				"stats":  stats,
-			})
-			require.NoError(t, err)
-			record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
-			err = hub.SaveNoValidate(record)
-			require.NoError(t, err)
-			recordIds[collection] = append(recordIds[collection], record.Id)
-		}
-	}
-
-	// Run deletion
-	err = records.DeleteOldSystemStats(hub)
-	require.NoError(t, err)
-
-	// Verify results
-	for _, collection := range collections {
-		for i, tc := range testCases {
-			recordId := recordIds[collection][i]
-
-			// Try to find the record
-			_, err := hub.FindRecordById(collection, recordId)
-
-			if tc.shouldBeKept {
-				assert.NoError(t, err, "Record should exist: %s", tc.description)
-			} else {
-				assert.Error(t, err, "Record should be deleted: %s", tc.description)
-			}
-		}
-	}
-}
-
-// TestDeleteOldAlertsHistory tests the deleteOldAlertsHistory function
-func TestDeleteOldAlertsHistory(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	// Create test users
-	user1, err := tests.CreateUser(hub, "user1@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	user2, err := tests.CreateUser(hub, "user2@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user1.Id, user2.Id},
-	})
-	require.NoError(t, err)
-	now := time.Now().UTC()
-
-	testCases := []struct {
-		name                  string
-		user                  *core.Record
-		alertCount            int
-		countToKeep           int
-		countBeforeDeletion   int
-		expectedAfterDeletion int
-		description           string
-	}{
-		{
-			name:                  "User with few alerts (below threshold)",
-			user:                  user1,
-			alertCount:            100,
-			countToKeep:           50,
-			countBeforeDeletion:   150,
-			expectedAfterDeletion: 100, // No deletion because below threshold
-			description:           "User with alerts below countBeforeDeletion should not have any deleted",
-		},
-		{
-			name:                  "User with many alerts (above threshold)",
-			user:                  user2,
-			alertCount:            300,
-			countToKeep:           100,
-			countBeforeDeletion:   200,
-			expectedAfterDeletion: 100, // Should be trimmed to countToKeep
-			description:           "User with alerts above countBeforeDeletion should be trimmed to countToKeep",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			// Create alerts for this user
-			for i := 0; i < tc.alertCount; i++ {
-				_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
-					"user":    tc.user.Id,
-					"name":    "CPU",
-					"value":   i + 1,
-					"system":  system.Id,
-					"created": now.Add(-time.Duration(i) * time.Minute),
-				})
-				require.NoError(t, err)
-			}
-
-			// Count before deletion
-			countBefore, err := hub.CountRecords("alerts_history",
-				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
-			require.NoError(t, err)
-			assert.Equal(t, int64(tc.alertCount), countBefore, "Initial count should match")
-
-			// Run deletion
-			err = records.DeleteOldAlertsHistory(hub, tc.countToKeep, tc.countBeforeDeletion)
-			require.NoError(t, err)
-
-			// Count after deletion
-			countAfter, err := hub.CountRecords("alerts_history",
-				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
-			require.NoError(t, err)
-
-			assert.Equal(t, int64(tc.expectedAfterDeletion), countAfter, tc.description)
-
-			// If deletion occurred, verify the most recent records were kept
-			if tc.expectedAfterDeletion < tc.alertCount {
-				records, err := hub.FindRecordsByFilter("alerts_history",
-					"user = {:user}",
-					"-created", // Order by created DESC
-					tc.countToKeep,
-					0,
-					map[string]any{"user": tc.user.Id})
-				require.NoError(t, err)
-				assert.Len(t, records, tc.expectedAfterDeletion, "Should have exactly countToKeep records")
-
-				// Verify records are in descending order by created time
-				for i := 1; i < len(records); i++ {
-					prev := records[i-1].GetDateTime("created").Time()
-					curr := records[i].GetDateTime("created").Time()
-					assert.True(t, prev.After(curr) || prev.Equal(curr),
-						"Records should be ordered by created time (newest first)")
-				}
-			}
-		})
-	}
-}
-
-// TestDeleteOldAlertsHistoryEdgeCases tests edge cases for alerts history deletion
-func TestDeleteOldAlertsHistoryEdgeCases(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	t.Run("No users with excessive alerts", func(t *testing.T) {
-		// Create user with few alerts
-		user, err := tests.CreateUser(hub, "few@example.com", "testtesttest")
-		require.NoError(t, err)
-
-		system, err := tests.CreateRecord(hub, "systems", map[string]any{
-			"name":   "test-system",
-			"host":   "localhost",
-			"port":   "45876",
-			"status": "up",
-			"users":  []string{user.Id},
-		})
-
-		// Create only 5 alerts (well below threshold)
-		for i := range 5 {
-			_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
-				"user":   user.Id,
-				"name":   "CPU",
-				"value":  i + 1,
-				"system": system.Id,
-			})
-			require.NoError(t, err)
-		}
-
-		// Should not error and should not delete anything
-		err = records.DeleteOldAlertsHistory(hub, 10, 20)
-		require.NoError(t, err)
-
-		count, err := hub.CountRecords("alerts_history")
-		require.NoError(t, err)
-		assert.Equal(t, int64(5), count, "All alerts should remain")
-	})
-
-	t.Run("Empty alerts_history table", func(t *testing.T) {
-		// Clear any existing alerts
-		_, err := hub.DB().NewQuery("DELETE FROM alerts_history").Execute()
-		require.NoError(t, err)
-
-		// Should not error with empty table
-		err = records.DeleteOldAlertsHistory(hub, 10, 20)
-		require.NoError(t, err)
-	})
-}
-
-// TestDeleteOldSystemdServiceRecords tests systemd service cleanup via DeleteOldRecords
-func TestDeleteOldSystemdServiceRecords(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	rm := records.NewRecordManager(hub)
-
-	// Create test user and system
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-
-	// Create old systemd service records that should be deleted (older than 20 minutes)
-	oldRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
-		"system":  system.Id,
-		"name":    "nginx.service",
-		"state":   0, // Active
-		"sub":     1, // Running
-		"cpu":     5.0,
-		"cpuPeak": 10.0,
-		"memory":  1024000,
-		"memPeak": 2048000,
-	})
-	require.NoError(t, err)
-	// Set updated time to 25 minutes ago (should be deleted)
-	oldRecord.SetRaw("updated", now.Add(-25*time.Minute).UnixMilli())
-	err = hub.SaveNoValidate(oldRecord)
-	require.NoError(t, err)
-
-	// Create recent systemd service record that should be kept (within 20 minutes)
-	recentRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
-		"system":  system.Id,
-		"name":    "apache.service",
-		"state":   1, // Inactive
-		"sub":     0, // Dead
-		"cpu":     2.0,
-		"cpuPeak": 3.0,
-		"memory":  512000,
-		"memPeak": 1024000,
-	})
-	require.NoError(t, err)
-	// Set updated time to 10 minutes ago (should be kept)
-	recentRecord.SetRaw("updated", now.Add(-10*time.Minute).UnixMilli())
-	err = hub.SaveNoValidate(recentRecord)
-	require.NoError(t, err)
-
-	// Count records before deletion
-	countBefore, err := hub.CountRecords("systemd_services")
-	require.NoError(t, err)
-	assert.Equal(t, int64(2), countBefore, "Should have 2 systemd service records initially")
-
-	// Run deletion via RecordManager
-	rm.DeleteOldRecords()
-
-	// Count records after deletion
-	countAfter, err := hub.CountRecords("systemd_services")
-	require.NoError(t, err)
-	assert.Equal(t, int64(1), countAfter, "Should have 1 systemd service record after deletion")
-
-	// Verify the correct record was kept
-	remainingRecords, err := hub.FindRecordsByFilter("systemd_services", "", "", 10, 0, nil)
-	require.NoError(t, err)
-	assert.Len(t, remainingRecords, 1, "Should have exactly 1 record remaining")
-	assert.Equal(t, "apache.service", remainingRecords[0].Get("name"), "The recent record should be kept")
-}