updates

# Conflicts:
#	agent/connection_manager.go

agent/agent.go

@@ -48,6 +48,7 @@ type Agent struct {
 	keys                      []gossh.PublicKey                                     // SSH public keys
 	smartManager              *SmartManager                                         // Manages SMART data
 	systemdManager            *systemdManager                                       // Manages systemd services
+	probeManager              *ProbeManager                                         // Manages network probes
 }
 
 // NewAgent creates a new agent with the given data directory for persisting data.
@@ -121,6 +122,9 @@ func NewAgent(dataDir ...string) (agent *Agent, err error) {
 	// initialize handler registry
 	agent.handlerRegistry = NewHandlerRegistry()
 
+	// initialize probe manager
+	agent.probeManager = newProbeManager()
+
 	// initialize disk info
 	agent.initializeDiskInfo()
 
@@ -178,6 +182,11 @@ func (a *Agent) gatherStats(options common.DataRequestOptions) *system.CombinedD
 		}
 	}
 
+	if a.probeManager != nil {
+		data.Probes = a.probeManager.GetResults(cacheTimeMs)
+		slog.Debug("Probes", "data", data.Probes)
+	}
+
 	// skip updating systemd services if cache time is not the default 60sec interval
 	if a.systemdManager != nil && cacheTimeMs == defaultDataCacheTimeMs {
 		totalCount := uint16(a.systemdManager.getServiceStatsCount())

agent/battery/battery_linux.go

@@ -82,6 +82,9 @@ func GetBatteryStats() (batteryPercent uint8, batteryState uint8, err error) {
 		return batteryPercent, batteryState, errors.ErrUnsupported
 	}
 	paths, err := getBatteryPaths()
+	if err != nil {
+		return batteryPercent, batteryState, err
+	}
 	if len(paths) == 0 {
 		return batteryPercent, batteryState, errors.New("no batteries")
 	}

agent/client.go

@@ -20,6 +20,7 @@ import (
 	"github.com/fxamacker/cbor/v2"
 	"github.com/lxzan/gws"
 	"golang.org/x/crypto/ssh"
+	"golang.org/x/net/proxy"
 )
 
 const (
@@ -104,6 +105,11 @@ func (client *WebSocketClient) getOptions() *gws.ClientOption {
 	}
 	client.hubURL.Path = path.Join(client.hubURL.Path, "api/beszel/agent-connect")
 
+	// make sure BESZEL_AGENT_ALL_PROXY works (GWS only checks ALL_PROXY)
+	if val := os.Getenv("BESZEL_AGENT_ALL_PROXY"); val != "" {
+		os.Setenv("ALL_PROXY", val)
+	}
+
 	client.options = &gws.ClientOption{
 		Addr:      client.hubURL.String(),
 		TlsConfig: &tls.Config{InsecureSkipVerify: true},
@@ -112,6 +118,9 @@ func (client *WebSocketClient) getOptions() *gws.ClientOption {
 			"X-Token":    []string{client.token},
 			"X-Beszel":   []string{beszel.Version},
 		},
+		NewDialer: func() (gws.Dialer, error) {
+			return proxy.FromEnvironment(), nil
+		},
 	}
 	return client.options
 }

agent/connection_manager.go

@@ -4,11 +4,15 @@ import (
 	"context"
 	"errors"
 	"log/slog"
+	"net"
+	"os"
 	"os/signal"
+	"strings"
 	"syscall"
 	"time"
 
 	"github.com/henrygd/beszel/agent/health"
+	"github.com/henrygd/beszel/agent/utils"
 	"github.com/henrygd/beszel/internal/entities/system"
 )
 
@@ -111,12 +115,36 @@ func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
 			_ = health.Update()
 		case <-sigCtx.Done():
 			slog.Info("Shutting down", "cause", context.Cause(sigCtx))
+			return c.stop()
+		}
+	}
+}
+
+// stop does not stop the connection manager itself, just any active connections. The manager will attempt to reconnect after stopping, so this should only be called immediately before shutting down the entire agent.
+//
+// If we need or want to expose a graceful Stop method in the future, do something like this to actually stop the manager:
+//
+//	func (c *ConnectionManager) Start(serverOptions ServerOptions) error {
+//		ctx, cancel := context.WithCancel(context.Background())
+//		c.cancel = cancel
+//
+//		for {
+//			select {
+//			case <-ctx.Done():
+//				return c.stop()
+//			}
+//		}
+//	}
+//
+//	func (c *ConnectionManager) Stop() {
+//		c.cancel()
+//	}
+func (c *ConnectionManager) stop() error {
 	_ = c.agent.StopServer()
+	c.agent.probeManager.Stop()
 	c.closeWebSocket()
 	return health.CleanUp()
 }
-	}
-}
 
 // handleEvent processes connection events and updates the connection state accordingly.
 func (c *ConnectionManager) handleEvent(event ConnectionEvent) {
@@ -185,11 +213,18 @@ func (c *ConnectionManager) connect() {
 
 	// Try WebSocket first, if it fails, start SSH server
 	err := c.startWebSocketConnection()
-	if err != nil && c.State == Disconnected {
+	if err != nil {
+		if shouldExitOnErr(err) {
+			time.Sleep(2 * time.Second) // prevent tight restart loop
+			_ = c.stop()
+			os.Exit(1)
+		}
+		if c.State == Disconnected {
 			c.startSSHServer()
 			c.startWsTicker()
 		}
 	}
+}
 
 // startWebSocketConnection attempts to establish a WebSocket connection to the hub.
 func (c *ConnectionManager) startWebSocketConnection() error {
@@ -224,3 +259,14 @@ func (c *ConnectionManager) closeWebSocket() {
 		c.wsClient.Close()
 	}
 }
+
+// shouldExitOnErr checks if the error is a DNS resolution failure and if the
+// EXIT_ON_DNS_ERROR env var is set. https://github.com/henrygd/beszel/issues/1924.
+func shouldExitOnErr(err error) bool {
+	if val, _ := utils.GetEnv("EXIT_ON_DNS_ERROR"); val == "true" {
+		if opErr, ok := errors.AsType[*net.OpError](err); ok {
+			return strings.Contains(opErr.Err.Error(), "lookup")
+		}
+	}
+	return false
+}

agent/connection_manager_test.go

@@ -4,6 +4,7 @@ package agent
 
 import (
 	"crypto/ed25519"
+	"errors"
 	"fmt"
 	"net"
 	"net/url"
@@ -298,3 +299,65 @@ func TestConnectionManager_ConnectFlow(t *testing.T) {
 		cm.connect()
 	}, "Connect should not panic without WebSocket client")
 }
+
+func TestShouldExitOnErr(t *testing.T) {
+	createDialErr := func(msg string) error {
+		return &net.OpError{
+			Op:  "dial",
+			Net: "tcp",
+			Err: errors.New(msg),
+		}
+	}
+
+	tests := []struct {
+		name     string
+		err      error
+		envValue string
+		expected bool
+	}{
+		{
+			name:     "no env var",
+			err:      createDialErr("lookup lkahsdfasdf: no such host"),
+			envValue: "",
+			expected: false,
+		},
+		{
+			name:     "env var false",
+			err:      createDialErr("lookup lkahsdfasdf: no such host"),
+			envValue: "false",
+			expected: false,
+		},
+		{
+			name:     "env var true, matching error",
+			err:      createDialErr("lookup lkahsdfasdf: no such host"),
+			envValue: "true",
+			expected: true,
+		},
+		{
+			name:     "env var true, matching error with extra context",
+			err:      createDialErr("lookup beszel.server.lan on [::1]:53: read udp [::1]:44557->[::1]:53: read: connection refused"),
+			envValue: "true",
+			expected: true,
+		},
+		{
+			name:     "env var true, non-matching error",
+			err:      errors.New("connection refused"),
+			envValue: "true",
+			expected: false,
+		},
+		{
+			name:     "env var true, dial but not lookup",
+			err:      createDialErr("connection timeout"),
+			envValue: "true",
+			expected: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Setenv("EXIT_ON_DNS_ERROR", tt.envValue)
+			result := shouldExitOnErr(tt.err)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}

agent/gpu_amd_linux.go

@@ -156,6 +156,7 @@ func (gm *GPUManager) updateAmdGpuData(cardPath string) bool {
 func readSysfsFloat(path string) (float64, error) {
 	val, err := utils.ReadStringFileLimited(path, 64)
 	if err != nil {
+		slog.Debug("Failed to read sysfs value", "path", path, "error", err)
 		return 0, err
 	}
 	return strconv.ParseFloat(val, 64)

agent/handlers.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/fxamacker/cbor/v2"
 	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/smart"
 
 	"log/slog"
@@ -51,6 +52,7 @@ func NewHandlerRegistry() *HandlerRegistry {
 	registry.Register(common.GetContainerInfo, &GetContainerInfoHandler{})
 	registry.Register(common.GetSmartData, &GetSmartDataHandler{})
 	registry.Register(common.GetSystemdInfo, &GetSystemdInfoHandler{})
+	registry.Register(common.SyncNetworkProbes, &SyncNetworkProbesHandler{})
 
 	return registry
 }
@@ -203,3 +205,19 @@ func (h *GetSystemdInfoHandler) Handle(hctx *HandlerContext) error {
 
 	return hctx.SendResponse(details, hctx.RequestID)
 }
+
+////////////////////////////////////////////////////////////////////////////
+////////////////////////////////////////////////////////////////////////////
+
+// SyncNetworkProbesHandler handles probe configuration sync from hub
+type SyncNetworkProbesHandler struct{}
+
+func (h *SyncNetworkProbesHandler) Handle(hctx *HandlerContext) error {
+	var configs []probe.Config
+	if err := cbor.Unmarshal(hctx.Request.Data, &configs); err != nil {
+		return err
+	}
+	hctx.Agent.probeManager.SyncProbes(configs)
+	slog.Info("network probes synced", "count", len(configs))
+	return hctx.SendResponse("ok", hctx.RequestID)
+}

agent/probe.go

@@ -0,0 +1,237 @@
+package agent
+
+import (
+	"fmt"
+	"math"
+	"net"
+	"net/http"
+	"sync"
+	"time"
+
+	"log/slog"
+
+	"github.com/henrygd/beszel/internal/entities/probe"
+)
+
+// ProbeManager manages network probe tasks.
+type ProbeManager struct {
+	mu         sync.RWMutex
+	probes     map[string]*probeTask // key = probe.Config.Key()
+	httpClient *http.Client
+}
+
+type probeTask struct {
+	config  probe.Config
+	cancel  chan struct{}
+	mu      sync.Mutex
+	samples []probeSample
+}
+
+type probeSample struct {
+	latencyMs float64 // -1 means loss
+	timestamp time.Time
+}
+
+func newProbeManager() *ProbeManager {
+	return &ProbeManager{
+		probes:     make(map[string]*probeTask),
+		httpClient: &http.Client{Timeout: 10 * time.Second},
+	}
+}
+
+// SyncProbes replaces all probe tasks with the given configs.
+func (pm *ProbeManager) SyncProbes(configs []probe.Config) {
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+
+	// Build set of new keys
+	newKeys := make(map[string]probe.Config, len(configs))
+	for _, cfg := range configs {
+		newKeys[cfg.Key()] = cfg
+	}
+
+	// Stop removed probes
+	for key, task := range pm.probes {
+		if _, exists := newKeys[key]; !exists {
+			close(task.cancel)
+			delete(pm.probes, key)
+		}
+	}
+
+	// Start new probes (skip existing ones with same key)
+	for key, cfg := range newKeys {
+		if _, exists := pm.probes[key]; exists {
+			continue
+		}
+		task := &probeTask{
+			config:  cfg,
+			cancel:  make(chan struct{}),
+			samples: make([]probeSample, 0, 64),
+		}
+		pm.probes[key] = task
+		go pm.runProbe(task)
+	}
+}
+
+// GetResults returns aggregated results for all probes over the last supplied duration in ms.
+func (pm *ProbeManager) GetResults(durationMs uint16) map[string]probe.Result {
+	pm.mu.RLock()
+	defer pm.mu.RUnlock()
+
+	results := make(map[string]probe.Result, len(pm.probes))
+	cutoff := time.Now().Add(-time.Duration(durationMs) * time.Millisecond)
+
+	for key, task := range pm.probes {
+		task.mu.Lock()
+		var sum, minMs, maxMs float64
+		var count, lossCount int
+		minMs = math.MaxFloat64
+
+		for _, s := range task.samples {
+			if s.timestamp.Before(cutoff) {
+				continue
+			}
+			count++
+			if s.latencyMs < 0 {
+				lossCount++
+				continue
+			}
+			sum += s.latencyMs
+			if s.latencyMs < minMs {
+				minMs = s.latencyMs
+			}
+			if s.latencyMs > maxMs {
+				maxMs = s.latencyMs
+			}
+		}
+		task.mu.Unlock()
+
+		if count == 0 {
+			continue
+		}
+
+		successCount := count - lossCount
+		var avg float64
+		if successCount > 0 {
+			avg = math.Round(sum/float64(successCount)*100) / 100
+		}
+		if minMs == math.MaxFloat64 {
+			minMs = 0
+		}
+
+		results[key] = probe.Result{
+			avg,                         // average latency in ms
+			math.Round(minMs*100) / 100, // min latency in ms
+			math.Round(maxMs*100) / 100, // max latency in ms
+			math.Round(float64(lossCount)/float64(count)*10000) / 100, // packet loss percentage
+		}
+	}
+
+	return results
+}
+
+// Stop stops all probe tasks.
+func (pm *ProbeManager) Stop() {
+	pm.mu.Lock()
+	defer pm.mu.Unlock()
+	for key, task := range pm.probes {
+		close(task.cancel)
+		delete(pm.probes, key)
+	}
+}
+
+// runProbe executes a single probe task in a loop.
+func (pm *ProbeManager) runProbe(task *probeTask) {
+	interval := time.Duration(task.config.Interval) * time.Second
+	if interval < time.Second {
+		interval = 10 * time.Second
+	}
+	ticker := time.Tick(interval)
+
+	// Run immediately on start
+	pm.executeProbe(task)
+
+	for {
+		select {
+		case <-task.cancel:
+			return
+		case <-ticker:
+			pm.executeProbe(task)
+		}
+	}
+}
+
+func (pm *ProbeManager) executeProbe(task *probeTask) {
+	var latencyMs float64
+
+	switch task.config.Protocol {
+	case "icmp":
+		latencyMs = probeICMP(task.config.Target)
+	case "tcp":
+		latencyMs = probeTCP(task.config.Target, task.config.Port)
+	case "http":
+		latencyMs = probeHTTP(pm.httpClient, task.config.Target)
+	default:
+		slog.Warn("unknown probe protocol", "protocol", task.config.Protocol)
+		return
+	}
+
+	sample := probeSample{
+		latencyMs: latencyMs,
+		timestamp: time.Now(),
+	}
+
+	task.mu.Lock()
+	// Trim old samples beyond 120s to bound memory
+	cutoff := time.Now().Add(-120 * time.Second)
+	start := 0
+	for i := range task.samples {
+		if task.samples[i].timestamp.After(cutoff) {
+			start = i
+			break
+		}
+		if i == len(task.samples)-1 {
+			start = len(task.samples)
+		}
+	}
+	if start > 0 {
+		size := copy(task.samples, task.samples[start:])
+		task.samples = task.samples[:size]
+	}
+	task.samples = append(task.samples, sample)
+	task.mu.Unlock()
+}
+
+// probeTCP measures pure TCP handshake latency (excluding DNS resolution).
+// Returns -1 on failure.
+func probeTCP(target string, port uint16) float64 {
+	// Resolve DNS first, outside the timing window
+	ips, err := net.LookupHost(target)
+	if err != nil || len(ips) == 0 {
+		return -1
+	}
+	addr := net.JoinHostPort(ips[0], fmt.Sprintf("%d", port))
+
+	// Measure only the TCP handshake
+	start := time.Now()
+	conn, err := net.DialTimeout("tcp", addr, 3*time.Second)
+	if err != nil {
+		return -1
+	}
+	conn.Close()
+	return float64(time.Since(start).Microseconds()) / 1000.0
+}
+
+// probeHTTP measures HTTP GET request latency. Returns -1 on failure.
+func probeHTTP(client *http.Client, url string) float64 {
+	start := time.Now()
+	resp, err := client.Get(url)
+	if err != nil {
+		return -1
+	}
+	resp.Body.Close()
+	if resp.StatusCode >= 400 {
+		return -1
+	}
+	return float64(time.Since(start).Microseconds()) / 1000.0
+}

agent/probe_ping.go

@@ -0,0 +1,242 @@
+package agent
+
+import (
+	"net"
+	"os"
+	"os/exec"
+	"regexp"
+	"runtime"
+	"strconv"
+	"sync"
+	"time"
+
+	"golang.org/x/net/icmp"
+	"golang.org/x/net/ipv4"
+	"golang.org/x/net/ipv6"
+
+	"log/slog"
+)
+
+var pingTimeRegex = regexp.MustCompile(`time[=<]([\d.]+)\s*ms`)
+
+type icmpPacketConn interface {
+	Close() error
+}
+
+// icmpMethod tracks which ICMP approach to use. Once a method succeeds or
+// all native methods fail, the choice is cached so subsequent probes skip
+// the trial-and-error overhead.
+type icmpMethod int
+
+const (
+	icmpUntried      icmpMethod = iota // haven't tried yet
+	icmpRaw                            // privileged raw socket
+	icmpDatagram                       // unprivileged datagram socket
+	icmpExecFallback                   // shell out to system ping command
+)
+
+// icmpFamily holds the network parameters and cached detection result for one address family.
+type icmpFamily struct {
+	rawNetwork   string    // e.g. "ip4:icmp" or "ip6:ipv6-icmp"
+	dgramNetwork string    // e.g. "udp4" or "udp6"
+	listenAddr   string    // "0.0.0.0" or "::"
+	echoType     icmp.Type // outgoing echo request type
+	replyType    icmp.Type // expected echo reply type
+	proto        int       // IANA protocol number for parsing replies
+	isIPv6       bool
+	mode         icmpMethod // cached detection result (guarded by icmpModeMu)
+}
+
+var (
+	icmpV4 = icmpFamily{
+		rawNetwork:   "ip4:icmp",
+		dgramNetwork: "udp4",
+		listenAddr:   "0.0.0.0",
+		echoType:     ipv4.ICMPTypeEcho,
+		replyType:    ipv4.ICMPTypeEchoReply,
+		proto:        1,
+	}
+	icmpV6 = icmpFamily{
+		rawNetwork:   "ip6:ipv6-icmp",
+		dgramNetwork: "udp6",
+		listenAddr:   "::",
+		echoType:     ipv6.ICMPTypeEchoRequest,
+		replyType:    ipv6.ICMPTypeEchoReply,
+		proto:        58,
+		isIPv6:       true,
+	}
+	icmpModeMu sync.Mutex
+	icmpListen = func(network, listenAddr string) (icmpPacketConn, error) {
+		return icmp.ListenPacket(network, listenAddr)
+	}
+)
+
+// probeICMP sends an ICMP echo request and measures round-trip latency.
+// Supports both IPv4 and IPv6 targets. The ICMP method (raw socket,
+// unprivileged datagram, or exec fallback) is detected once per address
+// family and cached for subsequent probes.
+// Returns latency in milliseconds, or -1 on failure.
+func probeICMP(target string) float64 {
+	family, ip := resolveICMPTarget(target)
+	if family == nil {
+		return -1
+	}
+
+	icmpModeMu.Lock()
+	if family.mode == icmpUntried {
+		family.mode = detectICMPMode(family, icmpListen)
+	}
+	mode := family.mode
+	icmpModeMu.Unlock()
+
+	switch mode {
+	case icmpRaw:
+		return probeICMPNative(family.rawNetwork, family, &net.IPAddr{IP: ip})
+	case icmpDatagram:
+		return probeICMPNative(family.dgramNetwork, family, &net.UDPAddr{IP: ip})
+	case icmpExecFallback:
+		return probeICMPExec(target, family.isIPv6)
+	default:
+		return -1
+	}
+}
+
+// resolveICMPTarget resolves a target hostname or IP to determine the address
+// family and concrete IP address. Prefers IPv4 for dual-stack hostnames.
+func resolveICMPTarget(target string) (*icmpFamily, net.IP) {
+	if ip := net.ParseIP(target); ip != nil {
+		if ip.To4() != nil {
+			return &icmpV4, ip.To4()
+		}
+		return &icmpV6, ip
+	}
+
+	ips, err := net.LookupIP(target)
+	if err != nil || len(ips) == 0 {
+		return nil, nil
+	}
+	for _, ip := range ips {
+		if v4 := ip.To4(); v4 != nil {
+			return &icmpV4, v4
+		}
+	}
+	return &icmpV6, ips[0]
+}
+
+func detectICMPMode(family *icmpFamily, listen func(network, listenAddr string) (icmpPacketConn, error)) icmpMethod {
+	label := "IPv4"
+	if family.isIPv6 {
+		label = "IPv6"
+	}
+
+	if conn, err := listen(family.rawNetwork, family.listenAddr); err == nil {
+		conn.Close()
+		slog.Info("ICMP probe using raw socket", "family", label)
+		return icmpRaw
+	} else {
+		slog.Debug("ICMP raw socket unavailable", "family", label, "err", err)
+	}
+
+	if conn, err := listen(family.dgramNetwork, family.listenAddr); err == nil {
+		conn.Close()
+		slog.Info("ICMP probe using unprivileged datagram socket", "family", label)
+		return icmpDatagram
+	} else {
+		slog.Debug("ICMP datagram socket unavailable", "family", label, "err", err)
+	}
+
+	slog.Info("ICMP probe falling back to system ping command", "family", label)
+	return icmpExecFallback
+}
+
+// probeICMPNative sends an ICMP echo request using Go's x/net/icmp package.
+func probeICMPNative(network string, family *icmpFamily, dst net.Addr) float64 {
+	conn, err := icmp.ListenPacket(network, family.listenAddr)
+	if err != nil {
+		return -1
+	}
+	defer conn.Close()
+
+	// Build ICMP echo request
+	msg := &icmp.Message{
+		Type: family.echoType,
+		Code: 0,
+		Body: &icmp.Echo{
+			ID:   os.Getpid() & 0xffff,
+			Seq:  1,
+			Data: []byte("beszel-probe"),
+		},
+	}
+	msgBytes, err := msg.Marshal(nil)
+	if err != nil {
+		return -1
+	}
+
+	// Set deadline before sending
+	conn.SetDeadline(time.Now().Add(3 * time.Second))
+
+	start := time.Now()
+	if _, err := conn.WriteTo(msgBytes, dst); err != nil {
+		return -1
+	}
+
+	// Read reply
+	buf := make([]byte, 1500)
+	for {
+		n, _, err := conn.ReadFrom(buf)
+		if err != nil {
+			return -1
+		}
+
+		reply, err := icmp.ParseMessage(family.proto, buf[:n])
+		if err != nil {
+			return -1
+		}
+
+		if reply.Type == family.replyType {
+			return float64(time.Since(start).Microseconds()) / 1000.0
+		}
+		// Ignore non-echo-reply messages (e.g. destination unreachable) and keep reading
+	}
+}
+
+// probeICMPExec falls back to the system ping command. Returns -1 on failure.
+func probeICMPExec(target string, isIPv6 bool) float64 {
+	var cmd *exec.Cmd
+	switch runtime.GOOS {
+	case "windows":
+		if isIPv6 {
+			cmd = exec.Command("ping", "-6", "-n", "1", "-w", "3000", target)
+		} else {
+			cmd = exec.Command("ping", "-n", "1", "-w", "3000", target)
+		}
+	default: // linux, darwin, freebsd
+		if isIPv6 {
+			cmd = exec.Command("ping", "-6", "-c", "1", "-W", "3", target)
+		} else {
+			cmd = exec.Command("ping", "-c", "1", "-W", "3", target)
+		}
+	}
+
+	start := time.Now()
+	output, err := cmd.Output()
+	if err != nil {
+		// If ping fails but we got output, still try to parse
+		if len(output) == 0 {
+			return -1
+		}
+	}
+
+	matches := pingTimeRegex.FindSubmatch(output)
+	if len(matches) >= 2 {
+		if ms, err := strconv.ParseFloat(string(matches[1]), 64); err == nil {
+			return ms
+		}
+	}
+
+	// Fallback: use wall clock time if ping succeeded but parsing failed
+	if err == nil {
+		return float64(time.Since(start).Microseconds()) / 1000.0
+	}
+	return -1
+}

agent/probe_ping_test.go

@@ -0,0 +1,118 @@
+//go:build testing
+
+package agent
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testICMPPacketConn struct{}
+
+func (testICMPPacketConn) Close() error { return nil }
+
+func TestDetectICMPMode(t *testing.T) {
+	tests := []struct {
+		name         string
+		family       *icmpFamily
+		rawErr       error
+		udpErr       error
+		want         icmpMethod
+		wantNetworks []string
+	}{
+		{
+			name:         "IPv4 prefers raw socket when available",
+			family:       &icmpV4,
+			want:         icmpRaw,
+			wantNetworks: []string{"ip4:icmp"},
+		},
+		{
+			name:         "IPv4 uses datagram when raw unavailable",
+			family:       &icmpV4,
+			rawErr:       errors.New("operation not permitted"),
+			want:         icmpDatagram,
+			wantNetworks: []string{"ip4:icmp", "udp4"},
+		},
+		{
+			name:         "IPv4 falls back to exec when both unavailable",
+			family:       &icmpV4,
+			rawErr:       errors.New("operation not permitted"),
+			udpErr:       errors.New("protocol not supported"),
+			want:         icmpExecFallback,
+			wantNetworks: []string{"ip4:icmp", "udp4"},
+		},
+		{
+			name:         "IPv6 prefers raw socket when available",
+			family:       &icmpV6,
+			want:         icmpRaw,
+			wantNetworks: []string{"ip6:ipv6-icmp"},
+		},
+		{
+			name:         "IPv6 uses datagram when raw unavailable",
+			family:       &icmpV6,
+			rawErr:       errors.New("operation not permitted"),
+			want:         icmpDatagram,
+			wantNetworks: []string{"ip6:ipv6-icmp", "udp6"},
+		},
+		{
+			name:         "IPv6 falls back to exec when both unavailable",
+			family:       &icmpV6,
+			rawErr:       errors.New("operation not permitted"),
+			udpErr:       errors.New("protocol not supported"),
+			want:         icmpExecFallback,
+			wantNetworks: []string{"ip6:ipv6-icmp", "udp6"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			calls := make([]string, 0, 2)
+			listen := func(network, listenAddr string) (icmpPacketConn, error) {
+				require.Equal(t, tt.family.listenAddr, listenAddr)
+				calls = append(calls, network)
+				switch network {
+				case tt.family.rawNetwork:
+					if tt.rawErr != nil {
+						return nil, tt.rawErr
+					}
+				case tt.family.dgramNetwork:
+					if tt.udpErr != nil {
+						return nil, tt.udpErr
+					}
+				default:
+					t.Fatalf("unexpected network %q", network)
+				}
+				return testICMPPacketConn{}, nil
+			}
+
+			assert.Equal(t, tt.want, detectICMPMode(tt.family, listen))
+			assert.Equal(t, tt.wantNetworks, calls)
+		})
+	}
+}
+
+func TestResolveICMPTarget(t *testing.T) {
+	t.Run("IPv4 literal", func(t *testing.T) {
+		family, ip := resolveICMPTarget("127.0.0.1")
+		require.NotNil(t, family)
+		assert.False(t, family.isIPv6)
+		assert.Equal(t, "127.0.0.1", ip.String())
+	})
+
+	t.Run("IPv6 literal", func(t *testing.T) {
+		family, ip := resolveICMPTarget("::1")
+		require.NotNil(t, family)
+		assert.True(t, family.isIPv6)
+		assert.Equal(t, "::1", ip.String())
+	})
+
+	t.Run("IPv4-mapped IPv6 resolves as IPv4", func(t *testing.T) {
+		family, ip := resolveICMPTarget("::ffff:127.0.0.1")
+		require.NotNil(t, family)
+		assert.False(t, family.isIPv6)
+		assert.Equal(t, "127.0.0.1", ip.String())
+	})
+}

agent/smart.go

@@ -1118,6 +1118,9 @@ func (sm *SmartManager) parseSmartForNvme(output []byte) (bool, int) {
 	smartData.SerialNumber = data.SerialNumber
 	smartData.FirmwareVersion = data.FirmwareVersion
 	smartData.Capacity = data.UserCapacity.Bytes
+	if smartData.Capacity == 0 {
+		smartData.Capacity = data.NVMeTotalCapacity
+	}
 	if smartData.Capacity == 0 && (runtime.GOOS == "darwin" || sm.darwinNvmeProvider != nil) {
 		smartData.Capacity = sm.lookupDarwinNvmeCapacity(data.SerialNumber)
 	}

agent/utils/utils.go

@@ -1,6 +1,8 @@
+// Package utils provides utility functions for the agent.
 package utils
 
 import (
+	"fmt"
 	"io"
 	"math"
 	"os"
@@ -68,6 +70,9 @@ func ReadStringFileLimited(path string, maxSize int) (string, error) {
 	if err != nil && err != io.EOF {
 		return "", err
 	}
+	if n < 0 {
+		return "", fmt.Errorf("%s returned negative bytes: %d", path, n)
+	}
 	return strings.TrimSpace(string(buf[:n])), nil
 }
 

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/google/uuid v1.6.0
 	github.com/lxzan/gws v1.9.1
-	github.com/nicholas-fedor/shoutrrr v0.14.1
+	github.com/nicholas-fedor/shoutrrr v0.14.3
 	github.com/pocketbase/dbx v1.12.0
 	github.com/pocketbase/pocketbase v0.36.8
 	github.com/shirou/gopsutil/v4 v4.26.3
@@ -20,6 +20,7 @@ require (
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/crypto v0.49.0
 	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90
+	golang.org/x/net v0.52.0
 	golang.org/x/sys v0.42.0
 	gopkg.in/yaml.v3 v3.0.1
 	howett.net/plist v1.0.1
@@ -56,7 +57,6 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	golang.org/x/image v0.38.0 // indirect
-	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/term v0.41.0 // indirect

go.sum

@@ -85,8 +85,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/nicholas-fedor/shoutrrr v0.14.1 h1:6sx4cJNfNuUtD6ygGlB0dqcCQ+abfsUh+b+6jgujf6A=
+github.com/nicholas-fedor/shoutrrr v0.14.3 h1:aBX2iw9a7jl5wfHd3bi9LnS5ucoYIy6KcLH9XVF+gig=
-github.com/nicholas-fedor/shoutrrr v0.14.1/go.mod h1:U7IywBkLpBV7rgn8iLbQ9/LklJG1gm24bFv5cXXsDKs=
+github.com/nicholas-fedor/shoutrrr v0.14.3/go.mod h1:U7IywBkLpBV7rgn8iLbQ9/LklJG1gm24bFv5cXXsDKs=
 github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI=
 github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
 github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=

internal/alerts/alerts.go

@@ -302,21 +302,6 @@ func (am *AlertManager) SendShoutrrrAlert(notificationUrl, title, message, link,
 	return nil
 }
 
-func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
-	var data struct {
-		URL string `json:"url"`
-	}
-	err := e.BindBody(&data)
-	if err != nil || data.URL == "" {
-		return e.BadRequestError("URL is required", err)
-	}
-	err = am.SendShoutrrrAlert(data.URL, "Test Alert", "This is a notification from Beszel.", am.hub.Settings().Meta.AppURL, "View Beszel")
-	if err != nil {
-		return e.JSON(200, map[string]string{"err": err.Error()})
-	}
-	return e.JSON(200, map[string]bool{"err": false})
-}
-
 // setAlertTriggered updates the "triggered" status of an alert record in the database
 func (am *AlertManager) setAlertTriggered(alert CachedAlertData, triggered bool) error {
 	alertRecord, err := am.hub.FindRecordById("alerts", alert.Id)

internal/alerts/alerts_api.go

@@ -3,7 +3,11 @@ package alerts
 import (
 	"database/sql"
 	"errors"
+	"net"
 	"net/http"
+	"net/url"
+	"slices"
+	"strings"
 
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
@@ -117,3 +121,72 @@ func DeleteUserAlerts(e *core.RequestEvent) error {
 
 	return e.JSON(http.StatusOK, map[string]any{"success": true, "count": numDeleted})
 }
+
+// SendTestNotification handles API request to send a test notification to a specified Shoutrrr URL
+func (am *AlertManager) SendTestNotification(e *core.RequestEvent) error {
+	var data struct {
+		URL string `json:"url"`
+	}
+	err := e.BindBody(&data)
+	if err != nil || data.URL == "" {
+		return e.BadRequestError("URL is required", err)
+	}
+	// Only allow admins to send test notifications to internal URLs
+	if !e.Auth.IsSuperuser() && e.Auth.GetString("role") != "admin" {
+		internalURL, err := isInternalURL(data.URL)
+		if err != nil {
+			return e.BadRequestError(err.Error(), nil)
+		}
+		if internalURL {
+			return e.ForbiddenError("Only admins can send to internal destinations", nil)
+		}
+	}
+	err = am.SendShoutrrrAlert(data.URL, "Test Alert", "This is a notification from Beszel.", am.hub.Settings().Meta.AppURL, "View Beszel")
+	if err != nil {
+		return e.JSON(200, map[string]string{"err": err.Error()})
+	}
+	return e.JSON(200, map[string]bool{"err": false})
+}
+
+// isInternalURL checks if the given shoutrrr URL points to an internal destination (localhost or private IP)
+func isInternalURL(rawURL string) (bool, error) {
+	parsedURL, err := url.Parse(rawURL)
+	if err != nil {
+		return false, err
+	}
+
+	host := parsedURL.Hostname()
+	if host == "" {
+		return false, nil
+	}
+
+	if strings.EqualFold(host, "localhost") {
+		return true, nil
+	}
+
+	if ip := net.ParseIP(host); ip != nil {
+		return isInternalIP(ip), nil
+	}
+
+	// Some Shoutrrr URLs use the host position for service identifiers rather than a
+	// network hostname (for example, discord://token@webhookid). Restrict DNS lookups
+	// to names that look like actual hostnames so valid service URLs keep working.
+	if !strings.Contains(host, ".") {
+		return false, nil
+	}
+
+	ips, err := net.LookupIP(host)
+	if err != nil {
+		return false, nil
+	}
+
+	if slices.ContainsFunc(ips, isInternalIP) {
+		return true, nil
+	}
+
+	return false, nil
+}
+
+func isInternalIP(ip net.IP) bool {
+	return ip.IsPrivate() || ip.IsLoopback() || ip.IsUnspecified()
+}

internal/alerts/alerts_api_test.go

@@ -0,0 +1,501 @@
+//go:build testing
+
+package alerts_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/alerts"
+	beszelTests "github.com/henrygd/beszel/internal/tests"
+	pbTests "github.com/pocketbase/pocketbase/tests"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// marshal to json and return an io.Reader (for use in ApiScenario.Body)
+func jsonReader(v any) io.Reader {
+	data, err := json.Marshal(v)
+	if err != nil {
+		panic(err)
+	}
+	return bytes.NewReader(data)
+}
+
+func TestIsInternalURL(t *testing.T) {
+	testCases := []struct {
+		name     string
+		url      string
+		internal bool
+	}{
+		{name: "loopback ipv4", url: "generic://127.0.0.1", internal: true},
+		{name: "localhost hostname", url: "generic://localhost", internal: true},
+		{name: "localhost hostname", url: "generic+http://localhost/api/v1/postStuff", internal: true},
+		{name: "localhost hostname", url: "generic+http://127.0.0.1:8080/api/v1/postStuff", internal: true},
+		{name: "localhost hostname", url: "generic+https://beszel.dev/api/v1/postStuff", internal: false},
+		{name: "public ipv4", url: "generic://8.8.8.8", internal: false},
+		{name: "token style service url", url: "discord://abc123@123456789", internal: false},
+		{name: "single label service url", url: "slack://token@team/channel", internal: false},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			internal, err := alerts.IsInternalURL(testCase.url)
+			assert.NoError(t, err)
+			assert.Equal(t, testCase.internal, internal)
+		})
+	}
+}
+
+func TestUserAlertsApi(t *testing.T) {
+	hub, _ := beszelTests.NewTestHub(t.TempDir())
+	defer hub.Cleanup()
+
+	hub.StartHub()
+
+	user1, _ := beszelTests.CreateUser(hub, "alertstest@example.com", "password")
+	user1Token, _ := user1.NewAuthToken()
+
+	user2, _ := beszelTests.CreateUser(hub, "alertstest2@example.com", "password")
+	user2Token, _ := user2.NewAuthToken()
+
+	system1, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "system1",
+		"users": []string{user1.Id},
+		"host":  "127.0.0.1",
+	})
+
+	system2, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "system2",
+		"users": []string{user1.Id, user2.Id},
+		"host":  "127.0.0.2",
+	})
+
+	userRecords, _ := hub.CountRecords("users")
+	assert.EqualValues(t, 2, userRecords, "all users should be created")
+
+	systemRecords, _ := hub.CountRecords("systems")
+	assert.EqualValues(t, 2, systemRecords, "all systems should be created")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		// {
+		// 	Name:            "GET not implemented - returns index",
+		// 	Method:          http.MethodGet,
+		// 	URL:             "/api/beszel/user-alerts",
+		// 	ExpectedStatus:  200,
+		// 	ExpectedContent: []string{"<html ", "globalThis.BESZEL"},
+		// 	TestAppFactory:  testAppFactory,
+		// },
+		{
+			Name:            "POST no auth",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST no body",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+		},
+		{
+			Name:   "POST bad data",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"invalidField": "this should cause validation error",
+				"threshold":    "not a number",
+			}),
+		},
+		{
+			Name:   "POST malformed JSON",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  400,
+			ExpectedContent: []string{"Bad data"},
+			TestAppFactory:  testAppFactory,
+			Body:            strings.NewReader(`{"alertType": "cpu", "threshold": 80, "enabled": true,}`),
+		},
+		{
+			Name:   "POST valid alert data multiple systems",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     69,
+				"min":       9,
+				"systems":   []string{system1.Id, system2.Id},
+				"overwrite": false,
+			}),
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				// check total alerts
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+				// check alert has correct values
+				matchingAlerts, _ := app.CountRecords("alerts", dbx.HashExp{"name": "CPU", "user": user1.Id, "system": system1.Id, "value": 69, "min": 9})
+				assert.EqualValues(t, 1, matchingAlerts, "should have 1 alert")
+			},
+		},
+		{
+			Name:   "POST valid alert data single system",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "Memory",
+				"systems": []string{system1.Id},
+				"value":   90,
+				"min":     10,
+			}),
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				user1Alerts, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
+			},
+		},
+		{
+			Name:   "Overwrite: false, should not overwrite existing alert",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     45,
+				"min":       5,
+				"systems":   []string{system1.Id},
+				"overwrite": false,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user1.Id})
+				assert.EqualValues(t, 80, alert.Get("value"), "should have 80 as value")
+			},
+		},
+		{
+			Name:   "Overwrite: true, should overwrite existing alert",
+			Method: http.MethodPost,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":      "CPU",
+				"value":     45,
+				"min":       5,
+				"systems":   []string{system2.Id},
+				"overwrite": true,
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system2.Id,
+					"user":   user2.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user2.Id})
+				assert.EqualValues(t, 45, alert.Get("value"), "should have 45 as value")
+			},
+		},
+		{
+			Name:            "DELETE no auth",
+			Method:          http.MethodDelete,
+			URL:             "/api/beszel/user-alerts",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 1, alerts, "should have 1 alert")
+			},
+		},
+		{
+			Name:   "DELETE alert",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system1.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				beszelTests.CreateRecord(app, "alerts", map[string]any{
+					"name":   "CPU",
+					"system": system1.Id,
+					"user":   user1.Id,
+					"value":  80,
+					"min":    10,
+				})
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts, "should have 0 alerts")
+			},
+		},
+		{
+			Name:   "DELETE alert multiple systems",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user1Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":2", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "Memory",
+				"systems": []string{system1.Id, system2.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				for _, systemId := range []string{system1.Id, system2.Id} {
+					_, err := beszelTests.CreateRecord(app, "alerts", map[string]any{
+						"name":   "Memory",
+						"system": systemId,
+						"user":   user1.Id,
+						"value":  90,
+						"min":    10,
+					})
+					assert.NoError(t, err, "should create alert")
+				}
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				alerts, _ := app.CountRecords("alerts")
+				assert.Zero(t, alerts, "should have 0 alerts")
+			},
+		},
+		{
+			Name:   "User 2 should not be able to delete alert of user 1",
+			Method: http.MethodDelete,
+			URL:    "/api/beszel/user-alerts",
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"name":    "CPU",
+				"systems": []string{system2.Id},
+			}),
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				beszelTests.ClearCollection(t, app, "alerts")
+				for _, user := range []string{user1.Id, user2.Id} {
+					beszelTests.CreateRecord(app, "alerts", map[string]any{
+						"name":   "CPU",
+						"system": system2.Id,
+						"user":   user,
+						"value":  80,
+						"min":    10,
+					})
+				}
+				alerts, _ := app.CountRecords("alerts")
+				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
+				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
+				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
+				assert.EqualValues(t, 1, user2AlertCount, "should have 1 alert")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
+				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
+				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
+				assert.Zero(t, user2AlertCount, "should have 0 alerts")
+			},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}
+func TestSendTestNotification(t *testing.T) {
+	hub, user := beszelTests.GetHubWithUser(t)
+	defer hub.Cleanup()
+
+	userToken, err := user.NewAuthToken()
+
+	adminUser, err := beszelTests.CreateUserWithRole(hub, "admin@example.com", "password123", "admin")
+	assert.NoError(t, err, "Failed to create admin user")
+	adminUserToken, err := adminUser.NewAuthToken()
+
+	superuser, err := beszelTests.CreateSuperuser(hub, "superuser@example.com", "password123")
+	assert.NoError(t, err, "Failed to create superuser")
+	superuserToken, err := superuser.NewAuthToken()
+	assert.NoError(t, err, "Failed to create superuser auth token")
+
+	testAppFactory := func(t testing.TB) *pbTests.TestApp {
+		return hub.TestApp
+	}
+
+	scenarios := []beszelTests.ApiScenario{
+		{
+			Name:            "POST /test-notification - no auth should fail",
+			Method:          http.MethodPost,
+			URL:             "/api/beszel/test-notification",
+			ExpectedStatus:  401,
+			ExpectedContent: []string{"requires valid"},
+			TestAppFactory:  testAppFactory,
+			Body: jsonReader(map[string]any{
+				"url": "generic://127.0.0.1",
+			}),
+		},
+		{
+			Name:           "POST /test-notification - with external auth should succeed",
+			Method:         http.MethodPost,
+			URL:            "/api/beszel/test-notification",
+			TestAppFactory: testAppFactory,
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			Body: jsonReader(map[string]any{
+				"url": "generic://8.8.8.8",
+			}),
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"err\":"},
+		},
+		{
+			Name:           "POST /test-notification - local url with user auth should fail",
+			Method:         http.MethodPost,
+			URL:            "/api/beszel/test-notification",
+			TestAppFactory: testAppFactory,
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			Body: jsonReader(map[string]any{
+				"url": "generic://localhost:8010",
+			}),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"Only admins"},
+		},
+		{
+			Name:           "POST /test-notification - internal url with user auth should fail",
+			Method:         http.MethodPost,
+			URL:            "/api/beszel/test-notification",
+			TestAppFactory: testAppFactory,
+			Headers: map[string]string{
+				"Authorization": userToken,
+			},
+			Body: jsonReader(map[string]any{
+				"url": "generic+http://192.168.0.5",
+			}),
+			ExpectedStatus:  403,
+			ExpectedContent: []string{"Only admins"},
+		},
+		{
+			Name:           "POST /test-notification - internal url with admin auth should succeed",
+			Method:         http.MethodPost,
+			URL:            "/api/beszel/test-notification",
+			TestAppFactory: testAppFactory,
+			Headers: map[string]string{
+				"Authorization": adminUserToken,
+			},
+			Body: jsonReader(map[string]any{
+				"url": "generic://127.0.0.1",
+			}),
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"err\":"},
+		},
+		{
+			Name:           "POST /test-notification - internal url with superuser auth should succeed",
+			Method:         http.MethodPost,
+			URL:            "/api/beszel/test-notification",
+			TestAppFactory: testAppFactory,
+			Headers: map[string]string{
+				"Authorization": superuserToken,
+			},
+			Body: jsonReader(map[string]any{
+				"url": "generic://127.0.0.1",
+			}),
+			ExpectedStatus:  200,
+			ExpectedContent: []string{"\"err\":"},
+		},
+	}
+
+	for _, scenario := range scenarios {
+		scenario.Test(t)
+	}
+}

internal/alerts/alerts_test.go

@@ -3,11 +3,6 @@
 package alerts_test
 
 import (
-	"bytes"
-	"encoding/json"
-	"io"
-	"net/http"
-	"strings"
 	"testing"
 	"testing/synctest"
 	"time"
@@ -16,359 +11,9 @@ import (
 
 	"github.com/henrygd/beszel/internal/alerts"
 	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	pbTests "github.com/pocketbase/pocketbase/tests"
 	"github.com/stretchr/testify/assert"
 )
 
-// marshal to json and return an io.Reader (for use in ApiScenario.Body)
-func jsonReader(v any) io.Reader {
-	data, err := json.Marshal(v)
-	if err != nil {
-		panic(err)
-	}
-	return bytes.NewReader(data)
-}
-
-func TestUserAlertsApi(t *testing.T) {
-	hub, _ := beszelTests.NewTestHub(t.TempDir())
-	defer hub.Cleanup()
-
-	hub.StartHub()
-
-	user1, _ := beszelTests.CreateUser(hub, "alertstest@example.com", "password")
-	user1Token, _ := user1.NewAuthToken()
-
-	user2, _ := beszelTests.CreateUser(hub, "alertstest2@example.com", "password")
-	user2Token, _ := user2.NewAuthToken()
-
-	system1, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system1",
-		"users": []string{user1.Id},
-		"host":  "127.0.0.1",
-	})
-
-	system2, _ := beszelTests.CreateRecord(hub, "systems", map[string]any{
-		"name":  "system2",
-		"users": []string{user1.Id, user2.Id},
-		"host":  "127.0.0.2",
-	})
-
-	userRecords, _ := hub.CountRecords("users")
-	assert.EqualValues(t, 2, userRecords, "all users should be created")
-
-	systemRecords, _ := hub.CountRecords("systems")
-	assert.EqualValues(t, 2, systemRecords, "all systems should be created")
-
-	testAppFactory := func(t testing.TB) *pbTests.TestApp {
-		return hub.TestApp
-	}
-
-	scenarios := []beszelTests.ApiScenario{
-		// {
-		// 	Name:            "GET not implemented - returns index",
-		// 	Method:          http.MethodGet,
-		// 	URL:             "/api/beszel/user-alerts",
-		// 	ExpectedStatus:  200,
-		// 	ExpectedContent: []string{"<html ", "globalThis.BESZEL"},
-		// 	TestAppFactory:  testAppFactory,
-		// },
-		{
-			Name:            "POST no auth",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST no body",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-		},
-		{
-			Name:   "POST bad data",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"invalidField": "this should cause validation error",
-				"threshold":    "not a number",
-			}),
-		},
-		{
-			Name:   "POST malformed JSON",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  400,
-			ExpectedContent: []string{"Bad data"},
-			TestAppFactory:  testAppFactory,
-			Body:            strings.NewReader(`{"alertType": "cpu", "threshold": 80, "enabled": true,}`),
-		},
-		{
-			Name:   "POST valid alert data multiple systems",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     69,
-				"min":       9,
-				"systems":   []string{system1.Id, system2.Id},
-				"overwrite": false,
-			}),
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				// check total alerts
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-				// check alert has correct values
-				matchingAlerts, _ := app.CountRecords("alerts", dbx.HashExp{"name": "CPU", "user": user1.Id, "system": system1.Id, "value": 69, "min": 9})
-				assert.EqualValues(t, 1, matchingAlerts, "should have 1 alert")
-			},
-		},
-		{
-			Name:   "POST valid alert data single system",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "Memory",
-				"systems": []string{system1.Id},
-				"value":   90,
-				"min":     10,
-			}),
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				user1Alerts, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 3, user1Alerts, "should have 3 alerts")
-			},
-		},
-		{
-			Name:   "Overwrite: false, should not overwrite existing alert",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     45,
-				"min":       5,
-				"systems":   []string{system1.Id},
-				"overwrite": false,
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user1.Id})
-				assert.EqualValues(t, 80, alert.Get("value"), "should have 80 as value")
-			},
-		},
-		{
-			Name:   "Overwrite: true, should overwrite existing alert",
-			Method: http.MethodPost,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":      "CPU",
-				"value":     45,
-				"min":       5,
-				"systems":   []string{system2.Id},
-				"overwrite": true,
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system2.Id,
-					"user":   user2.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-				alert, _ := app.FindFirstRecordByFilter("alerts", "name = 'CPU' && user = {:user}", dbx.Params{"user": user2.Id})
-				assert.EqualValues(t, 45, alert.Get("value"), "should have 45 as value")
-			},
-		},
-		{
-			Name:            "DELETE no auth",
-			Method:          http.MethodDelete,
-			URL:             "/api/beszel/user-alerts",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system1.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 1, alerts, "should have 1 alert")
-			},
-		},
-		{
-			Name:   "DELETE alert",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system1.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				beszelTests.CreateRecord(app, "alerts", map[string]any{
-					"name":   "CPU",
-					"system": system1.Id,
-					"user":   user1.Id,
-					"value":  80,
-					"min":    10,
-				})
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.Zero(t, alerts, "should have 0 alerts")
-			},
-		},
-		{
-			Name:   "DELETE alert multiple systems",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user1Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":2", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "Memory",
-				"systems": []string{system1.Id, system2.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				for _, systemId := range []string{system1.Id, system2.Id} {
-					_, err := beszelTests.CreateRecord(app, "alerts", map[string]any{
-						"name":   "Memory",
-						"system": systemId,
-						"user":   user1.Id,
-						"value":  90,
-						"min":    10,
-					})
-					assert.NoError(t, err, "should create alert")
-				}
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				alerts, _ := app.CountRecords("alerts")
-				assert.Zero(t, alerts, "should have 0 alerts")
-			},
-		},
-		{
-			Name:   "User 2 should not be able to delete alert of user 1",
-			Method: http.MethodDelete,
-			URL:    "/api/beszel/user-alerts",
-			Headers: map[string]string{
-				"Authorization": user2Token,
-			},
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"\"count\":1", "\"success\":true"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"name":    "CPU",
-				"systems": []string{system2.Id},
-			}),
-			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
-				beszelTests.ClearCollection(t, app, "alerts")
-				for _, user := range []string{user1.Id, user2.Id} {
-					beszelTests.CreateRecord(app, "alerts", map[string]any{
-						"name":   "CPU",
-						"system": system2.Id,
-						"user":   user,
-						"value":  80,
-						"min":    10,
-					})
-				}
-				alerts, _ := app.CountRecords("alerts")
-				assert.EqualValues(t, 2, alerts, "should have 2 alerts")
-				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
-				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
-				assert.EqualValues(t, 1, user2AlertCount, "should have 1 alert")
-			},
-			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
-				user1AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user1.Id})
-				assert.EqualValues(t, 1, user1AlertCount, "should have 1 alert")
-				user2AlertCount, _ := app.CountRecords("alerts", dbx.HashExp{"user": user2.Id})
-				assert.Zero(t, user2AlertCount, "should have 0 alerts")
-			},
-		},
-	}
-
-	for _, scenario := range scenarios {
-		scenario.Test(t)
-	}
-}
-
 func TestAlertsHistory(t *testing.T) {
 	synctest.Test(t, func(t *testing.T) {
 		hub, user := beszelTests.GetHubWithUser(t)

internal/alerts/alerts_test_helpers.go

@@ -95,3 +95,7 @@ func (am *AlertManager) RestorePendingStatusAlerts() error {
 func (am *AlertManager) SetAlertTriggered(alert CachedAlertData, triggered bool) error {
 	return am.setAlertTriggered(alert, triggered)
 }
+
+func IsInternalURL(rawURL string) (bool, error) {
+	return isInternalURL(rawURL)
+}

internal/cmd/agent/agent.go

@@ -195,6 +195,6 @@ func main() {
 	}
 
 	if err := a.Start(serverConfig); err != nil {
-		log.Fatal("Failed to start server: ", err)
+		log.Fatal("Failed to start: ", err)
 	}
 }

internal/common/common-ws.go

@@ -22,6 +22,8 @@ const (
 	GetSmartData
 	// Request detailed systemd service info from agent
 	GetSystemdInfo
+	// Sync network probe configuration to agent
+	SyncNetworkProbes
 	// Add new actions here...
 )
 

internal/entities/probe/probe.go

@@ -0,0 +1,32 @@
+package probe
+
+import "strconv"
+
+// Config defines a network probe task sent from hub to agent.
+type Config struct {
+	Target   string `cbor:"0,keyasint" json:"target"`
+	Protocol string `cbor:"1,keyasint" json:"protocol"` // "icmp", "tcp", or "http"
+	Port     uint16 `cbor:"2,keyasint,omitempty" json:"port,omitempty"`
+	Interval uint16 `cbor:"3,keyasint" json:"interval"` // seconds
+}
+
+// Result holds aggregated probe results for a single target.
+//
+// 0: avg latency in ms
+//
+// 1: min latency in ms
+//
+// 2: max latency in ms
+//
+// 3: packet loss percentage (0-100)
+type Result []float64
+
+// Key returns the map key used for this probe config (e.g. "icmp:1.1.1.1", "tcp:host:443", "http:https://example.com").
+func (c Config) Key() string {
+	switch c.Protocol {
+	case "tcp":
+		return c.Protocol + ":" + c.Target + ":" + strconv.FormatUint(uint64(c.Port), 10)
+	default:
+		return c.Protocol + ":" + c.Target
+	}
+}

internal/entities/smart/smart.go

@@ -494,7 +494,7 @@ type SmartInfoForNvme struct {
 	FirmwareVersion string           `json:"firmware_version"`
 	// NVMePCIVendor                 NVMePCIVendor                 `json:"nvme_pci_vendor"`
 	// NVMeIEEEOUIIdentifier         uint32                        `json:"nvme_ieee_oui_identifier"`
-	// NVMeTotalCapacity             uint64                        `json:"nvme_total_capacity"`
+	NVMeTotalCapacity             uint64                        `json:"nvme_total_capacity"`
 	// NVMeUnallocatedCapacity       uint64                        `json:"nvme_unallocated_capacity"`
 	// NVMeControllerID              uint16                        `json:"nvme_controller_id"`
 	// NVMeVersion                   VersionStringInfo             `json:"nvme_version"`

internal/entities/system/system.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/systemd"
 )
 
@@ -179,4 +180,5 @@ type CombinedData struct {
 	Containers      []*container.Stats      `json:"container" cbor:"2,keyasint"`
 	SystemdServices []*systemd.Service      `json:"systemd,omitempty" cbor:"3,keyasint,omitempty"`
 	Details         *Details                `cbor:"4,keyasint,omitempty"`
+	Probes          map[string]probe.Result `cbor:"5,keyasint,omitempty"`
 }

internal/hub/api.go

@@ -14,6 +14,7 @@ import (
 	"github.com/henrygd/beszel/internal/ghupdate"
 	"github.com/henrygd/beszel/internal/hub/config"
 	"github.com/henrygd/beszel/internal/hub/systems"
+	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/apis"
 	"github.com/pocketbase/pocketbase/core"
@@ -70,13 +71,13 @@ func (h *Hub) registerMiddlewares(se *core.ServeEvent) {
 		return e.Next()
 	}
 	// authenticate with trusted header
-	if autoLogin, _ := GetEnv("AUTO_LOGIN"); autoLogin != "" {
+	if autoLogin, _ := utils.GetEnv("AUTO_LOGIN"); autoLogin != "" {
 		se.Router.BindFunc(func(e *core.RequestEvent) error {
 			return authorizeRequestWithEmail(e, autoLogin)
 		})
 	}
 	// authenticate with trusted header
-	if trustedHeader, _ := GetEnv("TRUSTED_AUTH_HEADER"); trustedHeader != "" {
+	if trustedHeader, _ := utils.GetEnv("TRUSTED_AUTH_HEADER"); trustedHeader != "" {
 		se.Router.BindFunc(func(e *core.RequestEvent) error {
 			return authorizeRequestWithEmail(e, e.Request.Header.Get(trustedHeader))
 		})
@@ -104,7 +105,7 @@ func (h *Hub) registerApiRoutes(se *core.ServeEvent) error {
 	apiAuth.GET("/info", h.getInfo)
 	apiAuth.GET("/getkey", h.getInfo) // deprecated - keep for compatibility w/ integrations
 	// check for updates
-	if optIn, _ := GetEnv("CHECK_UPDATES"); optIn == "true" {
+	if optIn, _ := utils.GetEnv("CHECK_UPDATES"); optIn == "true" {
 		var updateInfo UpdateInfo
 		apiAuth.GET("/update", updateInfo.getUpdate)
 	}
@@ -127,7 +128,7 @@ func (h *Hub) registerApiRoutes(se *core.ServeEvent) error {
 	// get systemd service details
 	apiAuth.GET("/systemd/info", h.getSystemdInfo)
 	// /containers routes
-	if enabled, _ := GetEnv("CONTAINER_DETAILS"); enabled != "false" {
+	if enabled, _ := utils.GetEnv("CONTAINER_DETAILS"); enabled != "false" {
 		// get container logs
 		apiAuth.GET("/containers/logs", h.getContainerLogs)
 		// get container info
@@ -147,7 +148,7 @@ func (h *Hub) getInfo(e *core.RequestEvent) error {
 		Key:     h.pubKey,
 		Version: beszel.Version,
 	}
-	if optIn, _ := GetEnv("CHECK_UPDATES"); optIn == "true" {
+	if optIn, _ := utils.GetEnv("CHECK_UPDATES"); optIn == "true" {
 		info.CheckUpdate = true
 	}
 	return e.JSON(http.StatusOK, info)
@@ -315,7 +316,7 @@ func (h *Hub) containerRequestHandler(e *core.RequestEvent, fetchFunc func(*syst
 	}
 
 	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth.Id) {
+	if err != nil || !system.HasUser(e.App, e.Auth) {
 		return e.NotFoundError("", nil)
 	}
 
@@ -350,7 +351,7 @@ func (h *Hub) getSystemdInfo(e *core.RequestEvent) error {
 		return e.BadRequestError("Invalid system or service parameter", nil)
 	}
 	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth.Id) {
+	if err != nil || !system.HasUser(e.App, e.Auth) {
 		return e.NotFoundError("", nil)
 	}
 	// verify service exists before fetching details
@@ -378,7 +379,7 @@ func (h *Hub) refreshSmartData(e *core.RequestEvent) error {
 	}
 
 	system, err := h.sm.GetSystem(systemID)
-	if err != nil || !system.HasUser(e.App, e.Auth.Id) {
+	if err != nil || !system.HasUser(e.App, e.Auth) {
 		return e.NotFoundError("", nil)
 	}
 

internal/hub/api_test.go

@@ -66,31 +66,6 @@ func TestApiRoutesAuthentication(t *testing.T) {
 
 	scenarios := []beszelTests.ApiScenario{
 		// Auth Protected Routes - Should require authentication
-		{
-			Name:            "POST /test-notification - no auth should fail",
-			Method:          http.MethodPost,
-			URL:             "/api/beszel/test-notification",
-			ExpectedStatus:  401,
-			ExpectedContent: []string{"requires valid"},
-			TestAppFactory:  testAppFactory,
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-		},
-		{
-			Name:           "POST /test-notification - with auth should succeed",
-			Method:         http.MethodPost,
-			URL:            "/api/beszel/test-notification",
-			TestAppFactory: testAppFactory,
-			Headers: map[string]string{
-				"Authorization": userToken,
-			},
-			Body: jsonReader(map[string]any{
-				"url": "generic://127.0.0.1",
-			}),
-			ExpectedStatus:  200,
-			ExpectedContent: []string{"sending message"},
-		},
 		{
 			Name:            "GET /config-yaml - no auth should fail",
 			Method:          http.MethodGet,
@@ -369,6 +344,23 @@ func TestApiRoutesAuthentication(t *testing.T) {
 				"Authorization": user2Token,
 			},
 		},
+		{
+			Name:            "GET /containers/info - SHARE_ALL_SYSTEMS allows non-member user",
+			Method:          http.MethodGet,
+			URL:             fmt.Sprintf("/api/beszel/containers/info?system=%s&container=abababababab", system.Id),
+			ExpectedStatus:  500,
+			ExpectedContent: []string{"Something went wrong while processing your request."},
+			TestAppFactory:  testAppFactory,
+			Headers: map[string]string{
+				"Authorization": user2Token,
+			},
+			BeforeTestFunc: func(t testing.TB, app *pbTests.TestApp, e *core.ServeEvent) {
+				t.Setenv("SHARE_ALL_SYSTEMS", "true")
+			},
+			AfterTestFunc: func(t testing.TB, app *pbTests.TestApp, res *http.Response) {
+				t.Setenv("SHARE_ALL_SYSTEMS", "")
+			},
+		},
 		{
 			Name:   "GET /containers/logs - with auth but missing system param should fail",
 			Method: http.MethodGet,

internal/hub/collections.go

@@ -1,6 +1,9 @@
 package hub
 
-import "github.com/pocketbase/pocketbase/core"
+import (
+	"github.com/henrygd/beszel/internal/hub/utils"
+	"github.com/pocketbase/pocketbase/core"
+)
 
 type collectionRules struct {
 	list   *string
@@ -22,11 +25,11 @@ func setCollectionAuthSettings(app core.App) error {
 	}
 
 	// disable email auth if DISABLE_PASSWORD_AUTH env var is set
-	disablePasswordAuth, _ := GetEnv("DISABLE_PASSWORD_AUTH")
+	disablePasswordAuth, _ := utils.GetEnv("DISABLE_PASSWORD_AUTH")
 	usersCollection.PasswordAuth.Enabled = disablePasswordAuth != "true"
 	usersCollection.PasswordAuth.IdentityFields = []string{"email"}
 	// allow oauth user creation if USER_CREATION is set
-	if userCreation, _ := GetEnv("USER_CREATION"); userCreation == "true" {
+	if userCreation, _ := utils.GetEnv("USER_CREATION"); userCreation == "true" {
 		cr := "@request.context = 'oauth2'"
 		usersCollection.CreateRule = &cr
 	} else {
@@ -34,7 +37,7 @@ func setCollectionAuthSettings(app core.App) error {
 	}
 
 	// enable mfaOtp mfa if MFA_OTP env var is set
-	mfaOtp, _ := GetEnv("MFA_OTP")
+	mfaOtp, _ := utils.GetEnv("MFA_OTP")
 	usersCollection.OTP.Length = 6
 	superusersCollection.OTP.Length = 6
 	usersCollection.OTP.Enabled = mfaOtp == "true"
@@ -50,7 +53,7 @@ func setCollectionAuthSettings(app core.App) error {
 
 	// When SHARE_ALL_SYSTEMS is enabled, any authenticated user can read
 	// system-scoped data. Write rules continue to block readonly users.
-	shareAllSystems, _ := GetEnv("SHARE_ALL_SYSTEMS")
+	shareAllSystems, _ := utils.GetEnv("SHARE_ALL_SYSTEMS")
 
 	authenticatedRule := "@request.auth.id != \"\""
 	systemsMemberRule := authenticatedRule + " && users.id ?= @request.auth.id"
@@ -75,7 +78,7 @@ func setCollectionAuthSettings(app core.App) error {
 		return err
 	}
 
-	if err := applyCollectionRules(app, []string{"containers", "container_stats", "system_stats", "systemd_services"}, collectionRules{
+	if err := applyCollectionRules(app, []string{"containers", "container_stats", "system_stats", "systemd_services", "network_probe_stats"}, collectionRules{
 		list: &systemScopedReadRule,
 	}); err != nil {
 		return err
@@ -89,7 +92,7 @@ func setCollectionAuthSettings(app core.App) error {
 		return err
 	}
 
-	if err := applyCollectionRules(app, []string{"fingerprints"}, collectionRules{
+	if err := applyCollectionRules(app, []string{"fingerprints", "network_probes"}, collectionRules{
 		list:   &systemScopedReadRule,
 		view:   &systemScopedReadRule,
 		create: &systemScopedWriteRule,

internal/hub/hub.go

@@ -15,6 +15,7 @@ import (
 	"github.com/henrygd/beszel/internal/hub/config"
 	"github.com/henrygd/beszel/internal/hub/heartbeat"
 	"github.com/henrygd/beszel/internal/hub/systems"
+	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/henrygd/beszel/internal/records"
 	"github.com/henrygd/beszel/internal/users"
 
@@ -44,7 +45,7 @@ func NewHub(app core.App) *Hub {
 	hub.um = users.NewUserManager(hub)
 	hub.rm = records.NewRecordManager(hub)
 	hub.sm = systems.NewSystemManager(hub)
-	hub.hb = heartbeat.New(app, GetEnv)
+	hub.hb = heartbeat.New(app, utils.GetEnv)
 	if hub.hb != nil {
 		hub.hbStop = make(chan struct{})
 	}
@@ -52,15 +53,6 @@ func NewHub(app core.App) *Hub {
 	return hub
 }
 
-// GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
-func GetEnv(key string) (value string, exists bool) {
-	if value, exists = os.LookupEnv("BESZEL_HUB_" + key); exists {
-		return value, exists
-	}
-	// Fallback to the old unprefixed key
-	return os.LookupEnv(key)
-}
-
 // onAfterBootstrapAndMigrations ensures the provided function runs after the database is set up and migrations are applied.
 // This is a workaround for behavior in PocketBase where onBootstrap runs before migrations, forcing use of onServe for this purpose.
 // However, PB's tests.TestApp is already bootstrapped, generally doesn't serve, but does handle migrations.
@@ -89,6 +81,7 @@ func (h *Hub) StartHub() error {
 		}
 		// register middlewares
 		h.registerMiddlewares(e)
+		// bind events that aren't set up in different
 		// register api routes
 		if err := h.registerApiRoutes(e); err != nil {
 			return err
@@ -117,6 +110,8 @@ func (h *Hub) StartHub() error {
 	h.App.OnRecordCreate("users").BindFunc(h.um.InitializeUserRole)
 	h.App.OnRecordCreate("user_settings").BindFunc(h.um.InitializeUserSettings)
 
+	bindNetworkProbesEvents(h)
+
 	pb, ok := h.App.(*pocketbase.PocketBase)
 	if !ok {
 		return errors.New("not a pocketbase app")
@@ -131,7 +126,7 @@ func (h *Hub) initialize(app core.App) error {
 	// batch requests (for alerts)
 	settings.Batch.Enabled = true
 	// set URL if APP_URL env is set
-	if appURL, isSet := GetEnv("APP_URL"); isSet {
+	if appURL, isSet := utils.GetEnv("APP_URL"); isSet {
 		h.appURL = appURL
 		settings.Meta.AppURL = appURL
 	}

internal/hub/probes.go

@@ -0,0 +1,54 @@
+package hub
+
+import (
+	"github.com/henrygd/beszel/internal/entities/probe"
+	"github.com/henrygd/beszel/internal/hub/systems"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+func bindNetworkProbesEvents(h *Hub) {
+	// on create, make sure the id is set to a stable hash
+	h.OnRecordCreate("network_probes").BindFunc(func(e *core.RecordEvent) error {
+		systemID := e.Record.GetString("system")
+		config := &probe.Config{
+			Target:   e.Record.GetString("target"),
+			Protocol: e.Record.GetString("protocol"),
+			Port:     uint16(e.Record.GetInt("port")),
+			Interval: uint16(e.Record.GetInt("interval")),
+		}
+		key := config.Key()
+		id := systems.MakeStableHashId(systemID, key)
+		e.Record.Set("id", id)
+		return e.Next()
+	})
+
+	// sync probe to agent on creation
+	h.OnRecordAfterCreateSuccess("network_probes").BindFunc(func(e *core.RecordEvent) error {
+		systemID := e.Record.GetString("system")
+		h.syncProbesToAgent(systemID)
+		return e.Next()
+	})
+	// sync probe to agent on delete
+	h.OnRecordAfterDeleteSuccess("network_probes").BindFunc(func(e *core.RecordEvent) error {
+		systemID := e.Record.GetString("system")
+		h.syncProbesToAgent(systemID)
+		return e.Next()
+	})
+	// TODO: if enabled changes, sync to agent
+}
+
+// syncProbesToAgent fetches enabled probes for a system and sends them to the agent.
+func (h *Hub) syncProbesToAgent(systemID string) {
+	system, err := h.sm.GetSystem(systemID)
+	if err != nil {
+		return
+	}
+
+	configs := h.sm.GetProbeConfigsForSystem(systemID)
+
+	go func() {
+		if err := system.SyncNetworkProbes(configs); err != nil {
+			h.Logger().Warn("failed to sync probes to agent", "system", systemID, "err", err)
+		}
+	}()
+}

internal/hub/server.go

@@ -0,0 +1,42 @@
+package hub
+
+import (
+	"encoding/json"
+	"net/url"
+	"strings"
+
+	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/hub/utils"
+)
+
+// PublicAppInfo defines the structure of the public app information that will be injected into the HTML
+type PublicAppInfo struct {
+	BASE_PATH           string
+	HUB_VERSION         string
+	HUB_URL             string
+	OAUTH_DISABLE_POPUP bool `json:"OAUTH_DISABLE_POPUP,omitempty"`
+}
+
+// modifyIndexHTML injects the public app information into the index.html content
+func modifyIndexHTML(hub *Hub, html []byte) string {
+	info := getPublicAppInfo(hub)
+	content, err := json.Marshal(info)
+	if err != nil {
+		return string(html)
+	}
+	htmlContent := strings.ReplaceAll(string(html), "./", info.BASE_PATH)
+	return strings.Replace(htmlContent, "\"{info}\"", string(content), 1)
+}
+
+func getPublicAppInfo(hub *Hub) PublicAppInfo {
+	parsedURL, _ := url.Parse(hub.appURL)
+	info := PublicAppInfo{
+		BASE_PATH:   strings.TrimSuffix(parsedURL.Path, "/") + "/",
+		HUB_VERSION: beszel.Version,
+		HUB_URL:     hub.appURL,
+	}
+	if val, _ := utils.GetEnv("OAUTH_DISABLE_POPUP"); val == "true" {
+		info.OAUTH_DISABLE_POPUP = true
+	}
+	return info
+}

internal/hub/server_development.go

@@ -10,8 +10,6 @@ import (
 	"net/url"
 	"strings"
 
-	"github.com/henrygd/beszel"
-
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/osutils"
 )
@@ -38,7 +36,7 @@ func (rm *responseModifier) RoundTrip(req *http.Request) (*http.Response, error)
 	}
 	resp.Body.Close()
 	// Create a new response with the modified body
-	modifiedBody := rm.modifyHTML(string(body))
+	modifiedBody := modifyIndexHTML(rm.hub, body)
 	resp.Body = io.NopCloser(strings.NewReader(modifiedBody))
 	resp.ContentLength = int64(len(modifiedBody))
 	resp.Header.Set("Content-Length", fmt.Sprintf("%d", len(modifiedBody)))
@@ -46,19 +44,6 @@ func (rm *responseModifier) RoundTrip(req *http.Request) (*http.Response, error)
 	return resp, nil
 }
 
-func (rm *responseModifier) modifyHTML(html string) string {
-	parsedURL, err := url.Parse(rm.hub.appURL)
-	if err != nil {
-		return html
-	}
-	// fix base paths in html if using subpath
-	basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
-	html = strings.ReplaceAll(html, "./", basePath)
-	html = strings.Replace(html, "{{V}}", beszel.Version, 1)
-	html = strings.Replace(html, "{{HUB_URL}}", rm.hub.appURL, 1)
-	return html
-}
-
 // startServer sets up the development server for Beszel
 func (h *Hub) startServer(se *core.ServeEvent) error {
 	proxy := httputil.NewSingleHostReverseProxy(&url.URL{

internal/hub/server_production.go

@@ -5,10 +5,9 @@ package hub
 import (
 	"io/fs"
 	"net/http"
-	"net/url"
 	"strings"
 
-	"github.com/henrygd/beszel"
+	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/henrygd/beszel/internal/site"
 
 	"github.com/pocketbase/pocketbase/apis"
@@ -17,22 +16,13 @@ import (
 
 // startServer sets up the production server for Beszel
 func (h *Hub) startServer(se *core.ServeEvent) error {
-	// parse app url
-	parsedURL, err := url.Parse(h.appURL)
-	if err != nil {
-		return err
-	}
-	// fix base paths in html if using subpath
-	basePath := strings.TrimSuffix(parsedURL.Path, "/") + "/"
 	indexFile, _ := fs.ReadFile(site.DistDirFS, "index.html")
-	html := strings.ReplaceAll(string(indexFile), "./", basePath)
+	html := modifyIndexHTML(h, indexFile)
-	html = strings.Replace(html, "{{V}}", beszel.Version, 1)
-	html = strings.Replace(html, "{{HUB_URL}}", h.appURL, 1)
 	// set up static asset serving
 	staticPaths := [2]string{"/static/", "/assets/"}
 	serveStatic := apis.Static(site.DistDirFS, false)
 	// get CSP configuration
-	csp, cspExists := GetEnv("CSP")
+	csp, cspExists := utils.GetEnv("CSP")
 	// add route
 	se.Router.GET("/{path...}", func(e *core.RequestEvent) error {
 		// serve static assets if path is in staticPaths

internal/hub/systems/system.go

@@ -6,18 +6,20 @@ import (
 	"errors"
 	"fmt"
 	"hash/fnv"
+	"log/slog"
 	"math/rand"
 	"net"
-	"slices"
 	"strings"
 	"sync/atomic"
 	"time"
 
 	"github.com/henrygd/beszel/internal/common"
 	"github.com/henrygd/beszel/internal/hub/transport"
+	"github.com/henrygd/beszel/internal/hub/utils"
 	"github.com/henrygd/beszel/internal/hub/ws"
 
 	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/smart"
 	"github.com/henrygd/beszel/internal/entities/system"
 	"github.com/henrygd/beszel/internal/entities/systemd"
@@ -29,6 +31,7 @@ import (
 	"github.com/lxzan/gws"
 	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/types"
 	"golang.org/x/crypto/ssh"
 )
 
@@ -238,6 +241,12 @@ func (sys *System) createRecords(data *system.CombinedData) (*core.Record, error
 			}
 		}
 
+		if data.Probes != nil {
+			if err := updateNetworkProbesRecords(txApp, data.Probes, sys.Id); err != nil {
+				return err
+			}
+		}
+
 		// update system record (do this last because it triggers alerts and we need above records to be inserted first)
 		systemRecord.Set("status", up)
 		systemRecord.Set("info", data.Info)
@@ -289,7 +298,7 @@ func createSystemdStatsRecords(app core.App, data []*systemd.Service, systemId s
 	for i, service := range data {
 		suffix := fmt.Sprintf("%d", i)
 		valueStrings = append(valueStrings, fmt.Sprintf("({:id%[1]s}, {:system}, {:name%[1]s}, {:state%[1]s}, {:sub%[1]s}, {:cpu%[1]s}, {:cpuPeak%[1]s}, {:memory%[1]s}, {:memPeak%[1]s}, {:updated})", suffix))
-		params["id"+suffix] = makeStableHashId(systemId, service.Name)
+		params["id"+suffix] = MakeStableHashId(systemId, service.Name)
 		params["name"+suffix] = service.Name
 		params["state"+suffix] = service.State
 		params["sub"+suffix] = service.Sub
@@ -306,6 +315,84 @@ func createSystemdStatsRecords(app core.App, data []*systemd.Service, systemId s
 	return err
 }
 
+func updateNetworkProbesRecords(app core.App, data map[string]probe.Result, systemId string) error {
+	if len(data) == 0 {
+		return nil
+	}
+	var err error
+	collectionName := "network_probes"
+
+	// If realtime updates are active, we save via PocketBase records to trigger realtime events.
+	// Otherwise we can do a more efficient direct update via SQL
+	realtimeActive := utils.RealtimeActiveForCollection(app, collectionName, func(filterQuery string) bool {
+		slog.Info("Checking realtime subscription filter for network probes", "filterQuery", filterQuery)
+		return !strings.Contains(filterQuery, "system") || strings.Contains(filterQuery, systemId)
+	})
+
+	var db dbx.Builder
+	var nowString string
+	var updateQuery *dbx.Query
+	if !realtimeActive {
+		db = app.DB()
+		nowString = time.Now().UTC().Format(types.DefaultDateLayout)
+		sql := fmt.Sprintf("UPDATE %s SET latency={:latency}, loss={:loss}, updated={:updated} WHERE id={:id}", collectionName)
+		updateQuery = db.NewQuery(sql)
+	}
+
+	// insert network probe stats records
+	switch realtimeActive {
+	case true:
+		collection, _ := app.FindCachedCollectionByNameOrId("network_probe_stats")
+		record := core.NewRecord(collection)
+		record.Set("system", systemId)
+		record.Set("stats", data)
+		record.Set("type", "1m")
+		err = app.SaveNoValidate(record)
+	default:
+		if dataJson, e := json.Marshal(data); e == nil {
+			sql := "INSERT INTO network_probe_stats (system, stats, type, created) VALUES ({:system}, {:stats}, {:type}, {:created})"
+			insertQuery := db.NewQuery(sql)
+			_, err = insertQuery.Bind(dbx.Params{
+				"system":  systemId,
+				"stats":   dataJson,
+				"type":    "1m",
+				"created": nowString,
+			}).Execute()
+		}
+	}
+	if err != nil {
+		app.Logger().Error("Failed to update probe stats", "system", systemId, "err", err)
+	}
+
+	// update network_probes records
+	for key := range data {
+		probe := data[key]
+		id := MakeStableHashId(systemId, key)
+		switch realtimeActive {
+		case true:
+			var record *core.Record
+			record, err = app.FindRecordById(collectionName, id)
+			if err == nil {
+				record.Set("latency", probe[0])
+				record.Set("loss", probe[3])
+				err = app.SaveNoValidate(record)
+			}
+		default:
+			_, err = updateQuery.Bind(dbx.Params{
+				"id":      id,
+				"latency": probe[0],
+				"loss":    probe[3],
+				"updated": nowString,
+			}).Execute()
+		}
+		if err != nil {
+			app.Logger().Warn("Failed to update probe", "system", systemId, "probe", key, "err", err)
+		}
+	}
+
+	return nil
+}
+
 // createContainerRecords creates container records
 func createContainerRecords(app core.App, data []*container.Stats, systemId string) error {
 	if len(data) == 0 {
@@ -353,14 +440,25 @@ func (sys *System) getRecord(app core.App) (*core.Record, error) {
 	return record, nil
 }
 
-// HasUser checks if the given user ID is in the system's users list.
+// HasUser checks if the given user is in the system's users list.
-func (sys *System) HasUser(app core.App, userID string) bool {
+// Returns true if SHARE_ALL_SYSTEMS is enabled (any authenticated user can access any system).
-	record, err := sys.getRecord(app)
+func (sys *System) HasUser(app core.App, user *core.Record) bool {
-	if err != nil {
+	if user == nil {
 		return false
 	}
-	users := record.GetStringSlice("users")
+	if v, _ := utils.GetEnv("SHARE_ALL_SYSTEMS"); v == "true" {
-	return slices.Contains(users, userID)
+		return true
+	}
+	var recordData = struct {
+		Users string
+	}{}
+	err := app.DB().NewQuery("SELECT users FROM systems WHERE id={:id}").
+		Bind(dbx.Params{"id": sys.Id}).
+		One(&recordData)
+	if err != nil || recordData.Users == "" {
+		return false
+	}
+	return strings.Contains(recordData.Users, user.Id)
 }
 
 // setDown marks a system as down in the database.
@@ -529,7 +627,7 @@ func (sys *System) FetchSmartDataFromAgent() (map[string]smart.SmartData, error)
 	return result, err
 }
 
-func makeStableHashId(strings ...string) string {
+func MakeStableHashId(strings ...string) string {
 	hash := fnv.New32a()
 	for _, str := range strings {
 		hash.Write([]byte(str))

internal/hub/systems/system_manager.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/henrygd/beszel/internal/hub/ws"
 
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/system"
 	"github.com/henrygd/beszel/internal/hub/expirymap"
 
@@ -15,6 +16,7 @@ import (
 	"github.com/henrygd/beszel"
 
 	"github.com/blang/semver"
+	"github.com/pocketbase/dbx"
 	"github.com/pocketbase/pocketbase/core"
 	"github.com/pocketbase/pocketbase/tools/store"
 	"golang.org/x/crypto/ssh"
@@ -317,6 +319,17 @@ func (sm *SystemManager) AddWebSocketSystem(systemId string, agentVersion semver
 	if err := sm.AddRecord(systemRecord, system); err != nil {
 		return err
 	}
+
+	// Sync network probes to the newly connected agent
+	go func() {
+		configs := sm.GetProbeConfigsForSystem(systemId)
+		if len(configs) > 0 {
+			if err := system.SyncNetworkProbes(configs); err != nil {
+				sm.hub.Logger().Warn("failed to sync probes on connect", "system", systemId, "err", err)
+			}
+		}
+	}()
+
 	return nil
 }
 
@@ -329,6 +342,31 @@ func (sm *SystemManager) resetFailedSmartFetchState(systemID string) {
 	}
 }
 
+// GetProbeConfigsForSystem returns all enabled probe configs for a system.
+func (sm *SystemManager) GetProbeConfigsForSystem(systemID string) []probe.Config {
+	records, err := sm.hub.FindRecordsByFilter(
+		"network_probes",
+		"system = {:system} && enabled = true",
+		"",
+		0, 0,
+		dbx.Params{"system": systemID},
+	)
+	if err != nil || len(records) == 0 {
+		return nil
+	}
+
+	configs := make([]probe.Config, 0, len(records))
+	for _, r := range records {
+		configs = append(configs, probe.Config{
+			Target:   r.GetString("target"),
+			Protocol: r.GetString("protocol"),
+			Port:     uint16(r.GetInt("port")),
+			Interval: uint16(r.GetInt("interval")),
+		})
+	}
+	return configs
+}
+
 // createSSHClientConfig initializes the SSH client configuration for connecting to an agent's server
 func (sm *SystemManager) createSSHClientConfig() error {
 	privateKey, err := sm.hub.GetSSHKey("")

internal/hub/systems/system_probes.go

@@ -0,0 +1,57 @@
+package systems
+
+import (
+	"context"
+	"time"
+
+	"github.com/henrygd/beszel/internal/common"
+	"github.com/henrygd/beszel/internal/entities/probe"
+)
+
+// SyncNetworkProbes sends probe configurations to the agent.
+func (sys *System) SyncNetworkProbes(configs []probe.Config) error {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var result string
+	return sys.request(ctx, common.SyncNetworkProbes, configs, &result)
+}
+
+// FetchNetworkProbeResults fetches probe results from the agent.
+// func (sys *System) FetchNetworkProbeResults() (map[string]probe.Result, error) {
+// 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+// 	defer cancel()
+// 	var results map[string]probe.Result
+// 	err := sys.request(ctx, common.GetNetworkProbeResults, nil, &results)
+// 	return results, err
+// }
+
+// hasEnabledProbes returns true if this system has any enabled network probes.
+// func (sys *System) hasEnabledProbes() bool {
+// 	count, err := sys.manager.hub.CountRecords("network_probes",
+// 		dbx.NewExp("system = {:system} AND enabled = true", dbx.Params{"system": sys.Id}))
+// 	return err == nil && count > 0
+// }
+
+// fetchAndSaveProbeResults fetches probe results and saves them to the database.
+// func (sys *System) fetchAndSaveProbeResults() {
+// 	hub := sys.manager.hub
+
+// 	results, err := sys.FetchNetworkProbeResults()
+// 	if err != nil || len(results) == 0 {
+// 		return
+// 	}
+
+// 	collection, err := hub.FindCachedCollectionByNameOrId("network_probe_stats")
+// 	if err != nil {
+// 		return
+// 	}
+
+// 	record := core.NewRecord(collection)
+// 	record.Set("system", sys.Id)
+// 	record.Set("stats", results)
+// 	record.Set("type", "1m")
+
+// 	if err := hub.SaveNoValidate(record); err != nil {
+// 		hub.Logger().Warn("failed to save probe stats", "system", sys.Id, "err", err)
+// 	}
+// }

internal/hub/systems/system_smart.go

@@ -84,7 +84,7 @@ func (sys *System) saveSmartDevices(smartData map[string]smart.SmartData) error
 
 func (sys *System) upsertSmartDeviceRecord(collection *core.Collection, deviceKey string, device smart.SmartData) error {
 	hub := sys.manager.hub
-	recordID := makeStableHashId(sys.Id, deviceKey)
+	recordID := MakeStableHashId(sys.Id, deviceKey)
 
 	record, err := hub.FindRecordById(collection, recordID)
 	if err != nil {

internal/hub/systems/system_systemd_test.go

@@ -14,9 +14,9 @@ func TestGetSystemdServiceId(t *testing.T) {
 		serviceName := "nginx.service"
 
 		// Call multiple times and ensure same result
-		id1 := makeStableHashId(systemId, serviceName)
+		id1 := MakeStableHashId(systemId, serviceName)
-		id2 := makeStableHashId(systemId, serviceName)
+		id2 := MakeStableHashId(systemId, serviceName)
-		id3 := makeStableHashId(systemId, serviceName)
+		id3 := MakeStableHashId(systemId, serviceName)
 
 		assert.Equal(t, id1, id2)
 		assert.Equal(t, id2, id3)
@@ -29,10 +29,10 @@ func TestGetSystemdServiceId(t *testing.T) {
 		serviceName1 := "nginx.service"
 		serviceName2 := "apache.service"
 
-		id1 := makeStableHashId(systemId1, serviceName1)
+		id1 := MakeStableHashId(systemId1, serviceName1)
-		id2 := makeStableHashId(systemId2, serviceName1)
+		id2 := MakeStableHashId(systemId2, serviceName1)
-		id3 := makeStableHashId(systemId1, serviceName2)
+		id3 := MakeStableHashId(systemId1, serviceName2)
-		id4 := makeStableHashId(systemId2, serviceName2)
+		id4 := MakeStableHashId(systemId2, serviceName2)
 
 		// All IDs should be different
 		assert.NotEqual(t, id1, id2)
@@ -56,14 +56,14 @@ func TestGetSystemdServiceId(t *testing.T) {
 		}
 
 		for _, tc := range testCases {
-			id := makeStableHashId(tc.systemId, tc.serviceName)
+			id := MakeStableHashId(tc.systemId, tc.serviceName)
 			// FNV-32 produces 8 hex characters
 			assert.Len(t, id, 8, "ID should be 8 characters for systemId='%s', serviceName='%s'", tc.systemId, tc.serviceName)
 		}
 	})
 
 	t.Run("hexadecimal output", func(t *testing.T) {
-		id := makeStableHashId("test-system", "test-service")
+		id := MakeStableHashId("test-system", "test-service")
 		assert.NotEmpty(t, id)
 
 		// Should only contain hexadecimal characters

internal/hub/systems/systems_test.go

@@ -421,3 +421,60 @@ func testOld(t *testing.T, hub *tests.TestHub) {
 		assert.NoError(t, err)
 	})
 }
+
+func TestHasUser(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	sm := hub.GetSystemManager()
+	err = sm.Initialize()
+	require.NoError(t, err)
+
+	user1, err := tests.CreateUser(hub, "user1@test.com", "password123")
+	require.NoError(t, err)
+	user2, err := tests.CreateUser(hub, "user2@test.com", "password123")
+	require.NoError(t, err)
+
+	systemRecord, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":  "has-user-test",
+		"host":  "127.0.0.1",
+		"port":  "33914",
+		"users": []string{user1.Id},
+	})
+	require.NoError(t, err)
+
+	sys, err := sm.GetSystemFromStore(systemRecord.Id)
+	require.NoError(t, err)
+
+	t.Run("user in list returns true", func(t *testing.T) {
+		assert.True(t, sys.HasUser(hub, user1))
+	})
+
+	t.Run("user not in list returns false", func(t *testing.T) {
+		assert.False(t, sys.HasUser(hub, user2))
+	})
+
+	t.Run("unknown user ID returns false", func(t *testing.T) {
+		assert.False(t, sys.HasUser(hub, nil))
+	})
+
+	t.Run("SHARE_ALL_SYSTEMS=true grants access to non-member", func(t *testing.T) {
+		t.Setenv("SHARE_ALL_SYSTEMS", "true")
+		assert.True(t, sys.HasUser(hub, user2))
+	})
+
+	t.Run("BESZEL_HUB_SHARE_ALL_SYSTEMS=true grants access to non-member", func(t *testing.T) {
+		t.Setenv("BESZEL_HUB_SHARE_ALL_SYSTEMS", "true")
+		assert.True(t, sys.HasUser(hub, user2))
+	})
+
+	t.Run("additional user works", func(t *testing.T) {
+		assert.False(t, sys.HasUser(hub, user2))
+		systemRecord.Set("users", []string{user1.Id, user2.Id})
+		err = hub.Save(systemRecord)
+		require.NoError(t, err)
+		assert.True(t, sys.HasUser(hub, user1))
+		assert.True(t, sys.HasUser(hub, user2))
+	})
+}

internal/hub/utils/utils.go

@@ -0,0 +1,39 @@
+// Package utils provides utility functions for the hub.
+package utils
+
+import (
+	"os"
+
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// GetEnv retrieves an environment variable with a "BESZEL_HUB_" prefix, or falls back to the unprefixed key.
+func GetEnv(key string) (value string, exists bool) {
+	if value, exists = os.LookupEnv("BESZEL_HUB_" + key); exists {
+		return value, exists
+	}
+	return os.LookupEnv(key)
+}
+
+// realtimeActiveForCollection checks if there are active WebSocket subscriptions for the given collection.
+func RealtimeActiveForCollection(app core.App, collectionName string, validateFn func(filterQuery string) bool) bool {
+	broker := app.SubscriptionsBroker()
+	if broker.TotalClients() == 0 {
+		return false
+	}
+	for _, client := range broker.Clients() {
+		subs := client.Subscriptions(collectionName)
+		if len(subs) > 0 {
+			if validateFn == nil {
+				return true
+			}
+			for k := range subs {
+				filter := subs[k].Query["filter"]
+				if validateFn(filter) {
+					return true
+				}
+			}
+		}
+	}
+	return false
+}

internal/migrations/0_collections_snapshot_0_19_0_dev_1.go

@@ -1699,6 +1699,223 @@ func init() {
 		"type": "base",
 		"updateRule": null,
 		"viewRule": null
+	},
+	{
+		"id": "np_probes_001",
+		"listRule": null,
+		"viewRule": null,
+		"createRule": null,
+		"updateRule": null,
+		"deleteRule": null,
+		"name": "network_probes",
+		"type": "base",
+		"fields": [
+			{
+				"autogeneratePattern": "[a-z0-9]{15}",
+				"hidden": false,
+				"id": "text3208210256",
+				"max": 15,
+				"min": 15,
+				"name": "id",
+				"pattern": "^[a-z0-9]+$",
+				"presentable": false,
+				"primaryKey": true,
+				"required": true,
+				"system": true,
+				"type": "text"
+			},
+			{
+				"cascadeDelete": true,
+				"collectionId": "2hz5ncl8tizk5nx",
+				"hidden": false,
+				"id": "np_system",
+				"maxSelect": 1,
+				"minSelect": 0,
+				"name": "system",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "relation"
+			},
+			{
+				"hidden": false,
+				"id": "np_name",
+				"max": 200,
+				"min": 0,
+				"name": "name",
+				"pattern": "",
+				"presentable": false,
+				"primaryKey": false,
+				"required": false,
+				"system": false,
+				"type": "text"
+			},
+			{
+				"hidden": false,
+				"id": "np_target",
+				"max": 500,
+				"min": 1,
+				"name": "target",
+				"pattern": "",
+				"presentable": false,
+				"primaryKey": false,
+				"required": true,
+				"system": false,
+				"type": "text"
+			},
+			{
+				"hidden": false,
+				"id": "np_protocol",
+				"maxSelect": 1,
+				"name": "protocol",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "select",
+				"values": ["icmp", "tcp", "http"]
+			},
+			{
+				"hidden": false,
+				"id": "np_port",
+				"max": 65535,
+				"min": 0,
+				"name": "port",
+				"onlyInt": true,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "np_interval",
+				"max": 3600,
+				"min": 1,
+				"name": "interval",
+				"onlyInt": true,
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "np_enabled",
+				"name": "enabled",
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "bool"
+			},
+			{
+				"hidden": false,
+				"id": "autodate2990389176",
+				"name": "created",
+				"onCreate": true,
+				"onUpdate": false,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			},
+			{
+				"hidden": false,
+				"id": "autodate3332085495",
+				"name": "updated",
+				"onCreate": true,
+				"onUpdate": true,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			}
+		],
+		"indexes": [
+			"CREATE INDEX ` + "`" + `idx_np_system_enabled` + "`" + ` ON ` + "`" + `network_probes` + "`" + ` (\n  ` + "`" + `system` + "`" + `,\n  ` + "`" + `enabled` + "`" + `\n)"
+		],
+		"system": false
+	},
+	{
+		"id": "np_stats_001",
+		"listRule": null,
+		"viewRule": null,
+		"createRule": null,
+		"updateRule": null,
+		"deleteRule": null,
+		"name": "network_probe_stats",
+		"type": "base",
+		"fields": [
+			{
+				"autogeneratePattern": "[a-z0-9]{15}",
+				"hidden": false,
+				"id": "text3208210256",
+				"max": 15,
+				"min": 15,
+				"name": "id",
+				"pattern": "^[a-z0-9]+$",
+				"presentable": false,
+				"primaryKey": true,
+				"required": true,
+				"system": true,
+				"type": "text"
+			},
+			{
+				"cascadeDelete": true,
+				"collectionId": "2hz5ncl8tizk5nx",
+				"hidden": false,
+				"id": "nps_system",
+				"maxSelect": 1,
+				"minSelect": 0,
+				"name": "system",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "relation"
+			},
+			{
+				"hidden": false,
+				"id": "nps_stats",
+				"maxSize": 2000000,
+				"name": "stats",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "json"
+			},
+			{
+				"hidden": false,
+				"id": "nps_type",
+				"maxSelect": 1,
+				"name": "type",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "select",
+				"values": ["1m", "10m", "20m", "120m", "480m"]
+			},
+			{
+				"hidden": false,
+				"id": "autodate2990389176",
+				"name": "created",
+				"onCreate": true,
+				"onUpdate": false,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			},
+			{
+				"hidden": false,
+				"id": "autodate3332085495",
+				"name": "updated",
+				"onCreate": true,
+				"onUpdate": true,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			}
+		],
+		"indexes": [
+			"CREATE INDEX ` + "`" + `idx_nps_system_type_created` + "`" + ` ON ` + "`" + `network_probe_stats` + "`" + ` (\n  ` + "`" + `system` + "`" + `,\n  ` + "`" + `type` + "`" + `,\n  ` + "`" + `created` + "`" + `\n)"
+		],
+		"system": false
 	}
 ]`
 

internal/migrations/1776632983_updated_network_probes.go

@@ -0,0 +1,62 @@
+package migrations
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId("np_probes_001")
+		if err != nil {
+			return err
+		}
+
+		// add field
+		if err := collection.Fields.AddMarshaledJSONAt(7, []byte(`{
+			"hidden": false,
+			"id": "number926446584",
+			"max": null,
+			"min": null,
+			"name": "latency",
+			"onlyInt": false,
+			"presentable": false,
+			"required": false,
+			"system": false,
+			"type": "number"
+		}`)); err != nil {
+			return err
+		}
+
+		// add field
+		if err := collection.Fields.AddMarshaledJSONAt(8, []byte(`{
+			"hidden": false,
+			"id": "number3726709001",
+			"max": null,
+			"min": null,
+			"name": "loss",
+			"onlyInt": false,
+			"presentable": false,
+			"required": false,
+			"system": false,
+			"type": "number"
+		}`)); err != nil {
+			return err
+		}
+
+		return app.Save(collection)
+	}, func(app core.App) error {
+		collection, err := app.FindCollectionByNameOrId("np_probes_001")
+		if err != nil {
+			return err
+		}
+
+		// remove field
+		collection.Fields.RemoveById("number926446584")
+
+		// remove field
+		collection.Fields.RemoveById("number3726709001")
+
+		return app.Save(collection)
+	})
+}

internal/migrations/1_add_network_probes.go

@@ -0,0 +1,245 @@
+package migrations
+
+import (
+	"github.com/pocketbase/pocketbase/core"
+	m "github.com/pocketbase/pocketbase/migrations"
+)
+
+func init() {
+	m.Register(func(app core.App) error {
+		jsonData := `[
+	{
+		"id": "np_probes_001",
+		"listRule": null,
+		"viewRule": null,
+		"createRule": null,
+		"updateRule": null,
+		"deleteRule": null,
+		"name": "network_probes",
+		"type": "base",
+		"fields": [
+			{
+				"autogeneratePattern": "[a-z0-9]{15}",
+				"hidden": false,
+				"id": "text3208210256",
+				"max": 15,
+				"min": 15,
+				"name": "id",
+				"pattern": "^[a-z0-9]+$",
+				"presentable": false,
+				"primaryKey": true,
+				"required": true,
+				"system": true,
+				"type": "text"
+			},
+			{
+				"cascadeDelete": true,
+				"collectionId": "2hz5ncl8tizk5nx",
+				"hidden": false,
+				"id": "np_system",
+				"maxSelect": 1,
+				"minSelect": 0,
+				"name": "system",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "relation"
+			},
+			{
+				"hidden": false,
+				"id": "np_name",
+				"max": 200,
+				"min": 0,
+				"name": "name",
+				"pattern": "",
+				"presentable": false,
+				"primaryKey": false,
+				"required": false,
+				"system": false,
+				"type": "text"
+			},
+			{
+				"hidden": false,
+				"id": "np_target",
+				"max": 500,
+				"min": 1,
+				"name": "target",
+				"pattern": "",
+				"presentable": false,
+				"primaryKey": false,
+				"required": true,
+				"system": false,
+				"type": "text"
+			},
+			{
+				"hidden": false,
+				"id": "np_protocol",
+				"maxSelect": 1,
+				"name": "protocol",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "select",
+				"values": ["icmp", "tcp", "http"]
+			},
+			{
+				"hidden": false,
+				"id": "np_port",
+				"max": 65535,
+				"min": 0,
+				"name": "port",
+				"onlyInt": true,
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "np_interval",
+				"max": 3600,
+				"min": 1,
+				"name": "interval",
+				"onlyInt": true,
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "number"
+			},
+			{
+				"hidden": false,
+				"id": "np_enabled",
+				"name": "enabled",
+				"presentable": false,
+				"required": false,
+				"system": false,
+				"type": "bool"
+			},
+			{
+				"hidden": false,
+				"id": "autodate2990389176",
+				"name": "created",
+				"onCreate": true,
+				"onUpdate": false,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			},
+			{
+				"hidden": false,
+				"id": "autodate3332085495",
+				"name": "updated",
+				"onCreate": true,
+				"onUpdate": true,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			}
+		],
+		"indexes": [
+			"CREATE INDEX ` + "`" + `idx_np_system_enabled` + "`" + ` ON ` + "`" + `network_probes` + "`" + ` (\n  ` + "`" + `system` + "`" + `,\n  ` + "`" + `enabled` + "`" + `\n)"
+		],
+		"system": false
+	},
+	{
+		"id": "np_stats_001",
+		"listRule": null,
+		"viewRule": null,
+		"createRule": null,
+		"updateRule": null,
+		"deleteRule": null,
+		"name": "network_probe_stats",
+		"type": "base",
+		"fields": [
+			{
+				"autogeneratePattern": "[a-z0-9]{15}",
+				"hidden": false,
+				"id": "text3208210256",
+				"max": 15,
+				"min": 15,
+				"name": "id",
+				"pattern": "^[a-z0-9]+$",
+				"presentable": false,
+				"primaryKey": true,
+				"required": true,
+				"system": true,
+				"type": "text"
+			},
+			{
+				"cascadeDelete": true,
+				"collectionId": "2hz5ncl8tizk5nx",
+				"hidden": false,
+				"id": "nps_system",
+				"maxSelect": 1,
+				"minSelect": 0,
+				"name": "system",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "relation"
+			},
+			{
+				"hidden": false,
+				"id": "nps_stats",
+				"maxSize": 2000000,
+				"name": "stats",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "json"
+			},
+			{
+				"hidden": false,
+				"id": "nps_type",
+				"maxSelect": 1,
+				"name": "type",
+				"presentable": false,
+				"required": true,
+				"system": false,
+				"type": "select",
+				"values": ["1m", "10m", "20m", "120m", "480m"]
+			},
+			{
+				"hidden": false,
+				"id": "autodate2990389176",
+				"name": "created",
+				"onCreate": true,
+				"onUpdate": false,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			},
+			{
+				"hidden": false,
+				"id": "autodate3332085495",
+				"name": "updated",
+				"onCreate": true,
+				"onUpdate": true,
+				"presentable": false,
+				"system": false,
+				"type": "autodate"
+			}
+		],
+		"indexes": [
+			"CREATE INDEX ` + "`" + `idx_nps_system_type_created` + "`" + ` ON ` + "`" + `network_probe_stats` + "`" + ` (\n  ` + "`" + `system` + "`" + `,\n  ` + "`" + `type` + "`" + `,\n  ` + "`" + `created` + "`" + `\n)"
+		],
+		"system": false
+	}
+]`
+
+		return app.ImportCollectionsByMarshaledJSON([]byte(jsonData), false)
+	}, func(app core.App) error {
+		// down: remove the network probe collections
+		if c, err := app.FindCollectionByNameOrId("network_probes"); err == nil {
+			if err := app.Delete(c); err != nil {
+				return err
+			}
+		}
+		if c, err := app.FindCollectionByNameOrId("network_probe_stats"); err == nil {
+			if err := app.Delete(c); err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+}

internal/records/records.go

@@ -3,13 +3,12 @@ package records
 
 import (
 	"encoding/json"
-	"fmt"
 	"log"
 	"math"
-	"strings"
 	"time"
 
 	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/probe"
 	"github.com/henrygd/beszel/internal/entities/system"
 
 	"github.com/pocketbase/dbx"
@@ -39,16 +38,6 @@ type StatsRecord struct {
 	Stats []byte `db:"stats"`
 }
 
-// global variables for reusing allocations
-var (
-	statsRecord    StatsRecord
-	containerStats []container.Stats
-	sumStats       system.Stats
-	tempStats      system.Stats
-	queryParams    = make(dbx.Params, 1)
-	containerSums  = make(map[string]*container.Stats)
-)
-
 // Create longer records by averaging shorter records
 func (rm *RecordManager) CreateLongerRecords() {
 	// start := time.Now()
@@ -82,7 +71,7 @@ func (rm *RecordManager) CreateLongerRecords() {
 	// wrap the operations in a transaction
 	rm.app.RunInTransaction(func(txApp core.App) error {
 		var err error
-		collections := [2]*core.Collection{}
+		collections := [3]*core.Collection{}
 		collections[0], err = txApp.FindCachedCollectionByNameOrId("system_stats")
 		if err != nil {
 			return err
@@ -91,6 +80,10 @@ func (rm *RecordManager) CreateLongerRecords() {
 		if err != nil {
 			return err
 		}
+		collections[2], err = txApp.FindCachedCollectionByNameOrId("network_probe_stats")
+		if err != nil {
+			return err
+		}
 		var systems RecordIds
 		db := txApp.DB()
 
@@ -150,8 +143,9 @@ func (rm *RecordManager) CreateLongerRecords() {
 					case "system_stats":
 						longerRecord.Set("stats", rm.AverageSystemStats(db, recordIds))
 					case "container_stats":
-
 						longerRecord.Set("stats", rm.AverageContainerStats(db, recordIds))
+					case "network_probe_stats":
+						longerRecord.Set("stats", rm.AverageProbeStats(db, recordIds))
 					}
 					if err := txApp.SaveNoValidate(longerRecord); err != nil {
 						log.Println("failed to save longer record", "err", err)
@@ -163,41 +157,47 @@ func (rm *RecordManager) CreateLongerRecords() {
 		return nil
 	})
 
-	statsRecord.Stats = statsRecord.Stats[:0]
-
 	// log.Println("finished creating longer records", "time (ms)", time.Since(start).Milliseconds())
 }
 
 // Calculate the average stats of a list of system_stats records without reflect
 func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *system.Stats {
-	// Clear/reset global structs for reuse
+	stats := make([]system.Stats, 0, len(records))
-	sumStats = system.Stats{}
+	var row StatsRecord
-	tempStats = system.Stats{}
+	params := make(dbx.Params, 1)
-	sum := &sumStats
+	for _, rec := range records {
-	stats := &tempStats
+		row.Stats = row.Stats[:0]
+		params["id"] = rec.Id
+		db.NewQuery("SELECT stats FROM system_stats WHERE id = {:id}").Bind(params).One(&row)
+		var s system.Stats
+		if err := json.Unmarshal(row.Stats, &s); err != nil {
+			continue
+		}
+		stats = append(stats, s)
+	}
+	result := AverageSystemStatsSlice(stats)
+	return &result
+}
+
+// AverageSystemStatsSlice computes the average of a slice of system stats.
+func AverageSystemStatsSlice(records []system.Stats) system.Stats {
+	var sum system.Stats
+	count := float64(len(records))
+	if count == 0 {
+		return sum
+	}
+
 	// necessary because uint8 is not big enough for the sum
 	batterySum := 0
 	// accumulate per-core usage across records
 	var cpuCoresSums []uint64
 	// accumulate cpu breakdown [user, system, iowait, steal, idle]
 	var cpuBreakdownSums []float64
-
-	count := float64(len(records))
 	tempCount := float64(0)
 
 	// Accumulate totals
-	for _, record := range records {
+	for i := range records {
-		id := record.Id
+		stats := &records[i]
-		// clear global statsRecord for reuse
-		statsRecord.Stats = statsRecord.Stats[:0]
-		// reset tempStats each iteration to avoid omitzero fields retaining stale values
-		*stats = system.Stats{}
-
-		queryParams["id"] = id
-		db.NewQuery("SELECT stats FROM system_stats WHERE id = {:id}").Bind(queryParams).One(&statsRecord)
-		if err := json.Unmarshal(statsRecord.Stats, stats); err != nil {
-			continue
-		}
 
 		sum.Cpu += stats.Cpu
 		// accumulate cpu time breakdowns if present
@@ -205,8 +205,8 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 			if len(cpuBreakdownSums) < len(stats.CpuBreakdown) {
 				cpuBreakdownSums = append(cpuBreakdownSums, make([]float64, len(stats.CpuBreakdown)-len(cpuBreakdownSums))...)
 			}
-			for i, v := range stats.CpuBreakdown {
+			for j, v := range stats.CpuBreakdown {
-				cpuBreakdownSums[i] += v
+				cpuBreakdownSums[j] += v
 			}
 		}
 		sum.Mem += stats.Mem
@@ -242,8 +242,8 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 				// extend slices to accommodate core count
 				cpuCoresSums = append(cpuCoresSums, make([]uint64, len(stats.CpuCoresUsage)-len(cpuCoresSums))...)
 			}
-			for i, v := range stats.CpuCoresUsage {
+			for j, v := range stats.CpuCoresUsage {
-				cpuCoresSums[i] += uint64(v)
+				cpuCoresSums[j] += uint64(v)
 			}
 		}
 		// Set peak values
@@ -343,8 +343,7 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 		}
 	}
 
-	// Compute averages in place
+	// Compute averages
-	if count > 0 {
 	sum.Cpu = twoDecimals(sum.Cpu / count)
 	sum.Mem = twoDecimals(sum.Mem / count)
 	sum.MemUsed = twoDecimals(sum.MemUsed / count)
@@ -446,36 +445,39 @@ func (rm *RecordManager) AverageSystemStats(db dbx.Builder, records RecordIds) *
 		}
 		sum.CpuBreakdown = avg
 	}
-	}
 
 	return sum
 }
 
 // Calculate the average stats of a list of container_stats records
 func (rm *RecordManager) AverageContainerStats(db dbx.Builder, records RecordIds) []container.Stats {
-	// Clear global map for reuse
+	allStats := make([][]container.Stats, 0, len(records))
-	for k := range containerSums {
+	var row StatsRecord
-		delete(containerSums, k)
+	params := make(dbx.Params, 1)
-	}
+	for _, rec := range records {
-	sums := containerSums
+		row.Stats = row.Stats[:0]
-	count := float64(len(records))
+		params["id"] = rec.Id
-
+		db.NewQuery("SELECT stats FROM container_stats WHERE id = {:id}").Bind(params).One(&row)
-	for i := range records {
+		var cs []container.Stats
-		id := records[i].Id
+		if err := json.Unmarshal(row.Stats, &cs); err != nil {
-		// clear global statsRecord for reuse
-		statsRecord.Stats = statsRecord.Stats[:0]
-		// must set to nil (not [:0]) to avoid json.Unmarshal reusing backing array
-		// which causes omitzero fields to inherit stale values from previous iterations
-		containerStats = nil
-
-		queryParams["id"] = id
-		db.NewQuery("SELECT stats FROM container_stats WHERE id = {:id}").Bind(queryParams).One(&statsRecord)
-
-		if err := json.Unmarshal(statsRecord.Stats, &containerStats); err != nil {
 			return []container.Stats{}
 		}
+		allStats = append(allStats, cs)
+	}
+	return AverageContainerStatsSlice(allStats)
+}
+
+// AverageContainerStatsSlice computes the average of container stats across multiple time periods.
+func AverageContainerStatsSlice(records [][]container.Stats) []container.Stats {
+	if len(records) == 0 {
+		return []container.Stats{}
+	}
+	sums := make(map[string]*container.Stats)
+	count := float64(len(records))
+
+	for _, containerStats := range records {
 		for i := range containerStats {
-			stat := containerStats[i]
+			stat := &containerStats[i]
 			if _, ok := sums[stat.Name]; !ok {
 				sums[stat.Name] = &container.Stats{Name: stat.Name}
 			}
@@ -504,131 +506,61 @@ func (rm *RecordManager) AverageContainerStats(db dbx.Builder, records RecordIds
 	return result
 }
 
-// Delete old records
+// AverageProbeStats averages probe stats across multiple records.
-func (rm *RecordManager) DeleteOldRecords() {
+// For each probe key: avg of avgs, min of mins, max of maxes, avg of losses.
-	rm.app.RunInTransaction(func(txApp core.App) error {
+func (rm *RecordManager) AverageProbeStats(db dbx.Builder, records RecordIds) map[string]probe.Result {
-		err := deleteOldSystemStats(txApp)
+	type probeValues struct {
-		if err != nil {
+		sums  probe.Result
-			return err
+		count float64
-		}
-		err = deleteOldContainerRecords(txApp)
-		if err != nil {
-			return err
-		}
-		err = deleteOldSystemdServiceRecords(txApp)
-		if err != nil {
-			return err
-		}
-		err = deleteOldAlertsHistory(txApp, 200, 250)
-		if err != nil {
-			return err
-		}
-		err = deleteOldQuietHours(txApp)
-		if err != nil {
-			return err
-		}
-		return nil
-	})
 	}
 
-// Delete old alerts history records
+	query := db.NewQuery("SELECT stats FROM network_probe_stats WHERE id = {:id}")
-func deleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int) error {
+
-	db := app.DB()
+	// accumulate sums for each probe key across records
-	var users []struct {
+	sums := make(map[string]*probeValues)
-		Id string `db:"user"`
+	var row StatsRecord
+	for _, rec := range records {
+		row.Stats = row.Stats[:0]
+		query.Bind(dbx.Params{"id": rec.Id}).One(&row)
+		var rawStats map[string]probe.Result
+		if err := json.Unmarshal(row.Stats, &rawStats); err != nil {
+			continue
 		}
-	err := db.NewQuery("SELECT user, COUNT(*) as count FROM alerts_history GROUP BY user HAVING count > {:countBeforeDeletion}").Bind(dbx.Params{"countBeforeDeletion": countBeforeDeletion}).All(&users)
+		for key, vals := range rawStats {
-	if err != nil {
+			s, ok := sums[key]
-		return err
+			if !ok {
+				s = &probeValues{sums: make(probe.Result, len(vals))}
+				sums[key] = s
 			}
-	for _, user := range users {
+			for i := range vals {
-		_, err = db.NewQuery("DELETE FROM alerts_history WHERE user = {:user} AND id NOT IN (SELECT id FROM alerts_history WHERE user = {:user} ORDER BY created DESC LIMIT {:countToKeep})").Bind(dbx.Params{"user": user.Id, "countToKeep": countToKeep}).Execute()
+				switch i {
-		if err != nil {
+				case 1: // min fields
-			return err
+					if s.count == 0 || vals[i] < s.sums[i] {
+						s.sums[i] = vals[i]
+					}
+				case 2: // max fields
+					if vals[i] > s.sums[i] {
+						s.sums[i] = vals[i]
+					}
+				default: // average fields
+					s.sums[i] += vals[i]
 				}
 			}
-	return nil
+			s.count++
+		}
 	}
 
-// Deletes system_stats records older than what is displayed in the UI
+	// compute final averages
-func deleteOldSystemStats(app core.App) error {
+	result := make(map[string]probe.Result, len(sums))
-	// Collections to process
+	for key, s := range sums {
-	collections := [2]string{"system_stats", "container_stats"}
+		if s.count == 0 {
-
+			continue
-	// Record types and their retention periods
-	type RecordDeletionData struct {
-		recordType string
-		retention  time.Duration
 		}
-	recordData := []RecordDeletionData{
+		s.sums[0] = twoDecimals(s.sums[0] / s.count) // avg latency
-		{recordType: "1m", retention: time.Hour},             // 1 hour
+		s.sums[3] = twoDecimals(s.sums[3] / s.count) // packet loss
-		{recordType: "10m", retention: 12 * time.Hour},       // 12 hours
+		result[key] = s.sums
-		{recordType: "20m", retention: 24 * time.Hour},       // 1 day
-		{recordType: "120m", retention: 7 * 24 * time.Hour},  // 7 days
-		{recordType: "480m", retention: 30 * 24 * time.Hour}, // 30 days
 	}
-
+	return result
-	now := time.Now().UTC()
-
-	for _, collection := range collections {
-		// Build the WHERE clause
-		var conditionParts []string
-		var params dbx.Params = make(map[string]any)
-		for i := range recordData {
-			rd := recordData[i]
-			// Create parameterized condition for this record type
-			dateParam := fmt.Sprintf("date%d", i)
-			conditionParts = append(conditionParts, fmt.Sprintf("(type = '%s' AND created < {:%s})", rd.recordType, dateParam))
-			params[dateParam] = now.Add(-rd.retention)
-		}
-		// Combine conditions with OR
-		conditionStr := strings.Join(conditionParts, " OR ")
-		// Construct and execute the full raw query
-		rawQuery := fmt.Sprintf("DELETE FROM %s WHERE %s", collection, conditionStr)
-		if _, err := app.DB().NewQuery(rawQuery).Bind(params).Execute(); err != nil {
-			return fmt.Errorf("failed to delete from %s: %v", collection, err)
-		}
-	}
-	return nil
-}
-
-// Deletes systemd service records that haven't been updated in the last 20 minutes
-func deleteOldSystemdServiceRecords(app core.App) error {
-	now := time.Now().UTC()
-	twentyMinutesAgo := now.Add(-20 * time.Minute)
-
-	// Delete systemd service records where updated < twentyMinutesAgo
-	_, err := app.DB().NewQuery("DELETE FROM systemd_services WHERE updated < {:updated}").Bind(dbx.Params{"updated": twentyMinutesAgo.UnixMilli()}).Execute()
-	if err != nil {
-		return fmt.Errorf("failed to delete old systemd service records: %v", err)
-	}
-
-	return nil
-}
-
-// Deletes container records that haven't been updated in the last 10 minutes
-func deleteOldContainerRecords(app core.App) error {
-	now := time.Now().UTC()
-	tenMinutesAgo := now.Add(-10 * time.Minute)
-
-	// Delete container records where updated < tenMinutesAgo
-	_, err := app.DB().NewQuery("DELETE FROM containers WHERE updated < {:updated}").Bind(dbx.Params{"updated": tenMinutesAgo.UnixMilli()}).Execute()
-	if err != nil {
-		return fmt.Errorf("failed to delete old container records: %v", err)
-	}
-
-	return nil
-}
-
-// Deletes old quiet hours records where end date has passed
-func deleteOldQuietHours(app core.App) error {
-	now := time.Now().UTC()
-	_, err := app.DB().NewQuery("DELETE FROM quiet_hours WHERE type = 'one-time' AND end < {:now}").Bind(dbx.Params{"now": now}).Execute()
-	if err != nil {
-		return err
-	}
-
-	return nil
 }
 
 /* Round float to two decimals */

internal/records/records_averaging_test.go

@@ -0,0 +1,820 @@
+//go:build testing
+
+package records_test
+
+import (
+	"sort"
+	"testing"
+
+	"github.com/henrygd/beszel/internal/entities/container"
+	"github.com/henrygd/beszel/internal/entities/system"
+	"github.com/henrygd/beszel/internal/records"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAverageSystemStatsSlice_Empty(t *testing.T) {
+	result := records.AverageSystemStatsSlice(nil)
+	assert.Equal(t, system.Stats{}, result)
+
+	result = records.AverageSystemStatsSlice([]system.Stats{})
+	assert.Equal(t, system.Stats{}, result)
+}
+
+func TestAverageSystemStatsSlice_SingleRecord(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu:          45.67,
+			Mem:          16.0,
+			MemUsed:      8.5,
+			MemPct:       53.12,
+			MemBuffCache: 2.0,
+			Swap:         4.0,
+			SwapUsed:     1.0,
+			DiskTotal:    500.0,
+			DiskUsed:     250.0,
+			DiskPct:      50.0,
+			DiskReadPs:   100.5,
+			DiskWritePs:  200.75,
+			NetworkSent:  10.5,
+			NetworkRecv:  20.25,
+			LoadAvg:      [3]float64{1.5, 2.0, 3.5},
+			Bandwidth:    [2]uint64{1000, 2000},
+			DiskIO:       [2]uint64{500, 600},
+			Battery:      [2]uint8{80, 1},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	assert.Equal(t, 45.67, result.Cpu)
+	assert.Equal(t, 16.0, result.Mem)
+	assert.Equal(t, 8.5, result.MemUsed)
+	assert.Equal(t, 53.12, result.MemPct)
+	assert.Equal(t, 2.0, result.MemBuffCache)
+	assert.Equal(t, 4.0, result.Swap)
+	assert.Equal(t, 1.0, result.SwapUsed)
+	assert.Equal(t, 500.0, result.DiskTotal)
+	assert.Equal(t, 250.0, result.DiskUsed)
+	assert.Equal(t, 50.0, result.DiskPct)
+	assert.Equal(t, 100.5, result.DiskReadPs)
+	assert.Equal(t, 200.75, result.DiskWritePs)
+	assert.Equal(t, 10.5, result.NetworkSent)
+	assert.Equal(t, 20.25, result.NetworkRecv)
+	assert.Equal(t, [3]float64{1.5, 2.0, 3.5}, result.LoadAvg)
+	assert.Equal(t, [2]uint64{1000, 2000}, result.Bandwidth)
+	assert.Equal(t, [2]uint64{500, 600}, result.DiskIO)
+	assert.Equal(t, uint8(80), result.Battery[0])
+	assert.Equal(t, uint8(1), result.Battery[1])
+}
+
+func TestAverageSystemStatsSlice_BasicAveraging(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu:          20.0,
+			Mem:          16.0,
+			MemUsed:      6.0,
+			MemPct:       37.5,
+			MemBuffCache: 1.0,
+			MemZfsArc:    0.5,
+			Swap:         4.0,
+			SwapUsed:     1.0,
+			DiskTotal:    500.0,
+			DiskUsed:     200.0,
+			DiskPct:      40.0,
+			DiskReadPs:   100.0,
+			DiskWritePs:  200.0,
+			NetworkSent:  10.0,
+			NetworkRecv:  20.0,
+			LoadAvg:      [3]float64{1.0, 2.0, 3.0},
+			Bandwidth:    [2]uint64{1000, 2000},
+			DiskIO:       [2]uint64{400, 600},
+			Battery:      [2]uint8{80, 1},
+		},
+		{
+			Cpu:          40.0,
+			Mem:          16.0,
+			MemUsed:      10.0,
+			MemPct:       62.5,
+			MemBuffCache: 3.0,
+			MemZfsArc:    1.5,
+			Swap:         4.0,
+			SwapUsed:     3.0,
+			DiskTotal:    500.0,
+			DiskUsed:     300.0,
+			DiskPct:      60.0,
+			DiskReadPs:   200.0,
+			DiskWritePs:  400.0,
+			NetworkSent:  30.0,
+			NetworkRecv:  40.0,
+			LoadAvg:      [3]float64{3.0, 4.0, 5.0},
+			Bandwidth:    [2]uint64{3000, 4000},
+			DiskIO:       [2]uint64{600, 800},
+			Battery:      [2]uint8{60, 1},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	assert.Equal(t, 30.0, result.Cpu)
+	assert.Equal(t, 16.0, result.Mem)
+	assert.Equal(t, 8.0, result.MemUsed)
+	assert.Equal(t, 50.0, result.MemPct)
+	assert.Equal(t, 2.0, result.MemBuffCache)
+	assert.Equal(t, 1.0, result.MemZfsArc)
+	assert.Equal(t, 4.0, result.Swap)
+	assert.Equal(t, 2.0, result.SwapUsed)
+	assert.Equal(t, 500.0, result.DiskTotal)
+	assert.Equal(t, 250.0, result.DiskUsed)
+	assert.Equal(t, 50.0, result.DiskPct)
+	assert.Equal(t, 150.0, result.DiskReadPs)
+	assert.Equal(t, 300.0, result.DiskWritePs)
+	assert.Equal(t, 20.0, result.NetworkSent)
+	assert.Equal(t, 30.0, result.NetworkRecv)
+	assert.Equal(t, [3]float64{2.0, 3.0, 4.0}, result.LoadAvg)
+	assert.Equal(t, [2]uint64{2000, 3000}, result.Bandwidth)
+	assert.Equal(t, [2]uint64{500, 700}, result.DiskIO)
+	assert.Equal(t, uint8(70), result.Battery[0])
+	assert.Equal(t, uint8(1), result.Battery[1])
+}
+
+func TestAverageSystemStatsSlice_PeakValues(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu:            20.0,
+			MaxCpu:         25.0,
+			MemUsed:        6.0,
+			MaxMem:         7.0,
+			NetworkSent:    10.0,
+			MaxNetworkSent: 15.0,
+			NetworkRecv:    20.0,
+			MaxNetworkRecv: 25.0,
+			DiskReadPs:     100.0,
+			MaxDiskReadPs:  120.0,
+			DiskWritePs:    200.0,
+			MaxDiskWritePs: 220.0,
+			Bandwidth:      [2]uint64{1000, 2000},
+			MaxBandwidth:   [2]uint64{1500, 2500},
+			DiskIO:         [2]uint64{400, 600},
+			MaxDiskIO:      [2]uint64{500, 700},
+			DiskIoStats:    [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
+			MaxDiskIoStats: [6]float64{15.0, 25.0, 35.0, 6.0, 9.0, 14.0},
+		},
+		{
+			Cpu:            40.0,
+			MaxCpu:         50.0,
+			MemUsed:        10.0,
+			MaxMem:         12.0,
+			NetworkSent:    30.0,
+			MaxNetworkSent: 35.0,
+			NetworkRecv:    40.0,
+			MaxNetworkRecv: 45.0,
+			DiskReadPs:     200.0,
+			MaxDiskReadPs:  210.0,
+			DiskWritePs:    400.0,
+			MaxDiskWritePs: 410.0,
+			Bandwidth:      [2]uint64{3000, 4000},
+			MaxBandwidth:   [2]uint64{3500, 4500},
+			DiskIO:         [2]uint64{600, 800},
+			MaxDiskIO:      [2]uint64{650, 850},
+			DiskIoStats:    [6]float64{50.0, 60.0, 70.0, 15.0, 18.0, 22.0},
+			MaxDiskIoStats: [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	assert.Equal(t, 50.0, result.MaxCpu)
+	assert.Equal(t, 12.0, result.MaxMem)
+	assert.Equal(t, 35.0, result.MaxNetworkSent)
+	assert.Equal(t, 45.0, result.MaxNetworkRecv)
+	assert.Equal(t, 210.0, result.MaxDiskReadPs)
+	assert.Equal(t, 410.0, result.MaxDiskWritePs)
+	assert.Equal(t, [2]uint64{3500, 4500}, result.MaxBandwidth)
+	assert.Equal(t, [2]uint64{650, 850}, result.MaxDiskIO)
+	assert.Equal(t, [6]float64{30.0, 40.0, 50.0, 10.0, 13.0, 17.0}, result.DiskIoStats)
+	assert.Equal(t, [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0}, result.MaxDiskIoStats)
+}
+
+func TestAverageSystemStatsSlice_DiskIoStats(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu:            10.0,
+			DiskIoStats:    [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
+			MaxDiskIoStats: [6]float64{12.0, 22.0, 32.0, 6.0, 9.0, 13.0},
+		},
+		{
+			Cpu:            20.0,
+			DiskIoStats:    [6]float64{30.0, 40.0, 50.0, 15.0, 18.0, 22.0},
+			MaxDiskIoStats: [6]float64{28.0, 38.0, 48.0, 14.0, 17.0, 21.0},
+		},
+		{
+			Cpu:            30.0,
+			DiskIoStats:    [6]float64{20.0, 30.0, 40.0, 10.0, 12.0, 16.0},
+			MaxDiskIoStats: [6]float64{25.0, 35.0, 45.0, 11.0, 13.0, 17.0},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	// Average: (10+30+20)/3=20, (20+40+30)/3=30, (30+50+40)/3=40, (5+15+10)/3=10, (8+18+12)/3≈12.67, (12+22+16)/3≈16.67
+	assert.Equal(t, 20.0, result.DiskIoStats[0])
+	assert.Equal(t, 30.0, result.DiskIoStats[1])
+	assert.Equal(t, 40.0, result.DiskIoStats[2])
+	assert.Equal(t, 10.0, result.DiskIoStats[3])
+	assert.Equal(t, 12.67, result.DiskIoStats[4])
+	assert.Equal(t, 16.67, result.DiskIoStats[5])
+	// Max: current DiskIoStats[0] wins for record 2 (30 > MaxDiskIoStats 28)
+	assert.Equal(t, 30.0, result.MaxDiskIoStats[0])
+	assert.Equal(t, 40.0, result.MaxDiskIoStats[1])
+	assert.Equal(t, 50.0, result.MaxDiskIoStats[2])
+	assert.Equal(t, 15.0, result.MaxDiskIoStats[3])
+	assert.Equal(t, 18.0, result.MaxDiskIoStats[4])
+	assert.Equal(t, 22.0, result.MaxDiskIoStats[5])
+}
+
+// Tests that current DiskIoStats values are considered when computing MaxDiskIoStats.
+func TestAverageSystemStatsSlice_DiskIoStatsPeakFromCurrentValues(t *testing.T) {
+	input := []system.Stats{
+		{Cpu: 10.0, DiskIoStats: [6]float64{95.0, 90.0, 85.0, 50.0, 60.0, 80.0}, MaxDiskIoStats: [6]float64{80.0, 80.0, 80.0, 40.0, 50.0, 70.0}},
+		{Cpu: 20.0, DiskIoStats: [6]float64{10.0, 10.0, 10.0, 5.0, 6.0, 8.0}, MaxDiskIoStats: [6]float64{20.0, 20.0, 20.0, 10.0, 12.0, 16.0}},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	// Current value from first record (95, 90, 85, 50, 60, 80) beats MaxDiskIoStats in both records
+	assert.Equal(t, 95.0, result.MaxDiskIoStats[0])
+	assert.Equal(t, 90.0, result.MaxDiskIoStats[1])
+	assert.Equal(t, 85.0, result.MaxDiskIoStats[2])
+	assert.Equal(t, 50.0, result.MaxDiskIoStats[3])
+	assert.Equal(t, 60.0, result.MaxDiskIoStats[4])
+	assert.Equal(t, 80.0, result.MaxDiskIoStats[5])
+}
+
+// Tests that current values are considered when computing peaks
+// (i.e., current cpu > MaxCpu should still win).
+func TestAverageSystemStatsSlice_PeakFromCurrentValues(t *testing.T) {
+	input := []system.Stats{
+		{Cpu: 95.0, MaxCpu: 80.0, MemUsed: 15.0, MaxMem: 10.0},
+		{Cpu: 10.0, MaxCpu: 20.0, MemUsed: 5.0, MaxMem: 8.0},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	assert.Equal(t, 95.0, result.MaxCpu)
+	assert.Equal(t, 15.0, result.MaxMem)
+}
+
+// Tests that records without temperature data are excluded from the temperature average.
+func TestAverageSystemStatsSlice_Temperatures(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu:          10.0,
+			Temperatures: map[string]float64{"cpu": 60.0, "gpu": 70.0},
+		},
+		{
+			Cpu:          20.0,
+			Temperatures: map[string]float64{"cpu": 80.0, "gpu": 90.0},
+		},
+		{
+			// No temperatures - should not affect temp averaging
+			Cpu: 30.0,
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.Temperatures)
+	// Average over 2 records that had temps, not 3
+	assert.Equal(t, 70.0, result.Temperatures["cpu"])
+	assert.Equal(t, 80.0, result.Temperatures["gpu"])
+}
+
+func TestAverageSystemStatsSlice_NetworkInterfaces(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu: 10.0,
+			NetworkInterfaces: map[string][4]uint64{
+				"eth0": {100, 200, 150, 250},
+				"eth1": {50, 60, 70, 80},
+			},
+		},
+		{
+			Cpu: 20.0,
+			NetworkInterfaces: map[string][4]uint64{
+				"eth0": {200, 400, 300, 500},
+				"eth1": {150, 160, 170, 180},
+			},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.NetworkInterfaces)
+	// [0] and [1] are averaged, [2] and [3] are max
+	assert.Equal(t, [4]uint64{150, 300, 300, 500}, result.NetworkInterfaces["eth0"])
+	assert.Equal(t, [4]uint64{100, 110, 170, 180}, result.NetworkInterfaces["eth1"])
+}
+
+func TestAverageSystemStatsSlice_ExtraFs(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu: 10.0,
+			ExtraFs: map[string]*system.FsStats{
+				"/data": {
+					DiskTotal:         1000.0,
+					DiskUsed:          400.0,
+					DiskReadPs:        50.0,
+					DiskWritePs:       100.0,
+					MaxDiskReadPS:     60.0,
+					MaxDiskWritePS:    110.0,
+					DiskReadBytes:     5000,
+					DiskWriteBytes:    10000,
+					MaxDiskReadBytes:  6000,
+					MaxDiskWriteBytes: 11000,
+					DiskIoStats:       [6]float64{10.0, 20.0, 30.0, 5.0, 8.0, 12.0},
+					MaxDiskIoStats:    [6]float64{12.0, 22.0, 32.0, 6.0, 9.0, 13.0},
+				},
+			},
+		},
+		{
+			Cpu: 20.0,
+			ExtraFs: map[string]*system.FsStats{
+				"/data": {
+					DiskTotal:         1000.0,
+					DiskUsed:          600.0,
+					DiskReadPs:        150.0,
+					DiskWritePs:       200.0,
+					MaxDiskReadPS:     160.0,
+					MaxDiskWritePS:    210.0,
+					DiskReadBytes:     15000,
+					DiskWriteBytes:    20000,
+					MaxDiskReadBytes:  16000,
+					MaxDiskWriteBytes: 21000,
+					DiskIoStats:       [6]float64{50.0, 60.0, 70.0, 15.0, 18.0, 22.0},
+					MaxDiskIoStats:    [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0},
+				},
+			},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.ExtraFs)
+	require.NotNil(t, result.ExtraFs["/data"])
+	fs := result.ExtraFs["/data"]
+	assert.Equal(t, 1000.0, fs.DiskTotal)
+	assert.Equal(t, 500.0, fs.DiskUsed)
+	assert.Equal(t, 100.0, fs.DiskReadPs)
+	assert.Equal(t, 150.0, fs.DiskWritePs)
+	assert.Equal(t, 160.0, fs.MaxDiskReadPS)
+	assert.Equal(t, 210.0, fs.MaxDiskWritePS)
+	assert.Equal(t, uint64(10000), fs.DiskReadBytes)
+	assert.Equal(t, uint64(15000), fs.DiskWriteBytes)
+	assert.Equal(t, uint64(16000), fs.MaxDiskReadBytes)
+	assert.Equal(t, uint64(21000), fs.MaxDiskWriteBytes)
+	assert.Equal(t, [6]float64{30.0, 40.0, 50.0, 10.0, 13.0, 17.0}, fs.DiskIoStats)
+	assert.Equal(t, [6]float64{55.0, 65.0, 75.0, 16.0, 19.0, 23.0}, fs.MaxDiskIoStats)
+}
+
+// Tests that ExtraFs DiskIoStats peak considers current values, not just previous peaks.
+func TestAverageSystemStatsSlice_ExtraFsDiskIoStatsPeakFromCurrentValues(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu: 10.0,
+			ExtraFs: map[string]*system.FsStats{
+				"/data": {
+					DiskIoStats:    [6]float64{95.0, 90.0, 85.0, 50.0, 60.0, 80.0}, // exceeds MaxDiskIoStats
+					MaxDiskIoStats: [6]float64{80.0, 80.0, 80.0, 40.0, 50.0, 70.0},
+				},
+			},
+		},
+		{
+			Cpu: 20.0,
+			ExtraFs: map[string]*system.FsStats{
+				"/data": {
+					DiskIoStats:    [6]float64{10.0, 10.0, 10.0, 5.0, 6.0, 8.0},
+					MaxDiskIoStats: [6]float64{20.0, 20.0, 20.0, 10.0, 12.0, 16.0},
+				},
+			},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	fs := result.ExtraFs["/data"]
+	assert.Equal(t, 95.0, fs.MaxDiskIoStats[0])
+	assert.Equal(t, 90.0, fs.MaxDiskIoStats[1])
+	assert.Equal(t, 85.0, fs.MaxDiskIoStats[2])
+	assert.Equal(t, 50.0, fs.MaxDiskIoStats[3])
+	assert.Equal(t, 60.0, fs.MaxDiskIoStats[4])
+	assert.Equal(t, 80.0, fs.MaxDiskIoStats[5])
+}
+
+// Tests that extra FS peak values consider current values, not just previous peaks.
+func TestAverageSystemStatsSlice_ExtraFsPeaksFromCurrentValues(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu: 10.0,
+			ExtraFs: map[string]*system.FsStats{
+				"/data": {
+					DiskReadPs:       500.0, // exceeds MaxDiskReadPS
+					MaxDiskReadPS:    100.0,
+					DiskReadBytes:    50000,
+					MaxDiskReadBytes: 10000,
+				},
+			},
+		},
+		{
+			Cpu: 20.0,
+			ExtraFs: map[string]*system.FsStats{
+				"/data": {
+					DiskReadPs:       50.0,
+					MaxDiskReadPS:    200.0,
+					DiskReadBytes:    5000,
+					MaxDiskReadBytes: 20000,
+				},
+			},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	fs := result.ExtraFs["/data"]
+	assert.Equal(t, 500.0, fs.MaxDiskReadPS)
+	assert.Equal(t, uint64(50000), fs.MaxDiskReadBytes)
+}
+
+func TestAverageSystemStatsSlice_GPUData(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu: 10.0,
+			GPUData: map[string]system.GPUData{
+				"gpu0": {
+					Name:        "RTX 4090",
+					Temperature: 60.0,
+					MemoryUsed:  4.0,
+					MemoryTotal: 24.0,
+					Usage:       30.0,
+					Power:       200.0,
+					Count:       1.0,
+					Engines: map[string]float64{
+						"3D":    50.0,
+						"Video": 10.0,
+					},
+				},
+			},
+		},
+		{
+			Cpu: 20.0,
+			GPUData: map[string]system.GPUData{
+				"gpu0": {
+					Name:        "RTX 4090",
+					Temperature: 80.0,
+					MemoryUsed:  8.0,
+					MemoryTotal: 24.0,
+					Usage:       70.0,
+					Power:       300.0,
+					Count:       1.0,
+					Engines: map[string]float64{
+						"3D":    90.0,
+						"Video": 30.0,
+					},
+				},
+			},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.GPUData)
+	gpu := result.GPUData["gpu0"]
+	assert.Equal(t, "RTX 4090", gpu.Name)
+	assert.Equal(t, 70.0, gpu.Temperature)
+	assert.Equal(t, 6.0, gpu.MemoryUsed)
+	assert.Equal(t, 24.0, gpu.MemoryTotal)
+	assert.Equal(t, 50.0, gpu.Usage)
+	assert.Equal(t, 250.0, gpu.Power)
+	assert.Equal(t, 1.0, gpu.Count)
+	require.NotNil(t, gpu.Engines)
+	assert.Equal(t, 70.0, gpu.Engines["3D"])
+	assert.Equal(t, 20.0, gpu.Engines["Video"])
+}
+
+func TestAverageSystemStatsSlice_MultipleGPUs(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu: 10.0,
+			GPUData: map[string]system.GPUData{
+				"gpu0": {Name: "GPU A", Usage: 20.0, Temperature: 50.0},
+				"gpu1": {Name: "GPU B", Usage: 60.0, Temperature: 70.0},
+			},
+		},
+		{
+			Cpu: 20.0,
+			GPUData: map[string]system.GPUData{
+				"gpu0": {Name: "GPU A", Usage: 40.0, Temperature: 60.0},
+				"gpu1": {Name: "GPU B", Usage: 80.0, Temperature: 80.0},
+			},
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.GPUData)
+	assert.Equal(t, 30.0, result.GPUData["gpu0"].Usage)
+	assert.Equal(t, 55.0, result.GPUData["gpu0"].Temperature)
+	assert.Equal(t, 70.0, result.GPUData["gpu1"].Usage)
+	assert.Equal(t, 75.0, result.GPUData["gpu1"].Temperature)
+}
+
+func TestAverageSystemStatsSlice_CpuCoresUsage(t *testing.T) {
+	input := []system.Stats{
+		{Cpu: 10.0, CpuCoresUsage: system.Uint8Slice{10, 20, 30, 40}},
+		{Cpu: 20.0, CpuCoresUsage: system.Uint8Slice{30, 40, 50, 60}},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.CpuCoresUsage)
+	assert.Equal(t, system.Uint8Slice{20, 30, 40, 50}, result.CpuCoresUsage)
+}
+
+// Tests that per-core usage rounds correctly (e.g., 15.5 -> 16 via math.Round).
+func TestAverageSystemStatsSlice_CpuCoresUsageRounding(t *testing.T) {
+	input := []system.Stats{
+		{Cpu: 10.0, CpuCoresUsage: system.Uint8Slice{11}},
+		{Cpu: 20.0, CpuCoresUsage: system.Uint8Slice{20}},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.CpuCoresUsage)
+	// (11+20)/2 = 15.5, rounds to 16
+	assert.Equal(t, uint8(16), result.CpuCoresUsage[0])
+}
+
+func TestAverageSystemStatsSlice_CpuBreakdown(t *testing.T) {
+	input := []system.Stats{
+		{Cpu: 10.0, CpuBreakdown: []float64{5.0, 3.0, 1.0, 0.5, 90.5}},
+		{Cpu: 20.0, CpuBreakdown: []float64{15.0, 7.0, 3.0, 1.5, 73.5}},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	require.NotNil(t, result.CpuBreakdown)
+	assert.Equal(t, []float64{10.0, 5.0, 2.0, 1.0, 82.0}, result.CpuBreakdown)
+}
+
+// Tests that Battery[1] (charge state) uses the last record's value.
+func TestAverageSystemStatsSlice_BatteryLastChargeState(t *testing.T) {
+	input := []system.Stats{
+		{Cpu: 10.0, Battery: [2]uint8{100, 1}}, // charging
+		{Cpu: 20.0, Battery: [2]uint8{90, 0}},  // not charging
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	assert.Equal(t, uint8(95), result.Battery[0])
+	assert.Equal(t, uint8(0), result.Battery[1]) // last record's charge state
+}
+
+func TestAverageSystemStatsSlice_ThreeRecordsRounding(t *testing.T) {
+	input := []system.Stats{
+		{Cpu: 10.0, Mem: 8.0},
+		{Cpu: 20.0, Mem: 8.0},
+		{Cpu: 30.0, Mem: 8.0},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	assert.Equal(t, 20.0, result.Cpu)
+	assert.Equal(t, 8.0, result.Mem)
+}
+
+// Tests records where some have optional fields and others don't.
+func TestAverageSystemStatsSlice_MixedOptionalFields(t *testing.T) {
+	input := []system.Stats{
+		{
+			Cpu:           10.0,
+			CpuCoresUsage: system.Uint8Slice{50, 60},
+			CpuBreakdown:  []float64{5.0, 3.0, 1.0, 0.5, 90.5},
+			GPUData: map[string]system.GPUData{
+				"gpu0": {Name: "GPU", Usage: 40.0},
+			},
+		},
+		{
+			Cpu: 20.0,
+			// No CpuCoresUsage, CpuBreakdown, or GPUData
+		},
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	assert.Equal(t, 15.0, result.Cpu)
+	// CpuCoresUsage: only 1 record had it, so sum/2
+	require.NotNil(t, result.CpuCoresUsage)
+	assert.Equal(t, uint8(25), result.CpuCoresUsage[0])
+	assert.Equal(t, uint8(30), result.CpuCoresUsage[1])
+	// CpuBreakdown: only 1 record had it, so sum/2
+	require.NotNil(t, result.CpuBreakdown)
+	assert.Equal(t, 2.5, result.CpuBreakdown[0])
+	// GPUData: only 1 record had it, so sum/2
+	require.NotNil(t, result.GPUData)
+	assert.Equal(t, 20.0, result.GPUData["gpu0"].Usage)
+}
+
+// Tests with 10 records matching the common real-world case (10 x 1m -> 1 x 10m).
+func TestAverageSystemStatsSlice_TenRecords(t *testing.T) {
+	input := make([]system.Stats, 10)
+	for i := range input {
+		input[i] = system.Stats{
+			Cpu:         float64(i * 10), // 0, 10, 20, ..., 90
+			Mem:         16.0,
+			MemUsed:     float64(4 + i),  // 4, 5, 6, ..., 13
+			MemPct:      float64(25 + i), // 25, 26, ..., 34
+			DiskTotal:   500.0,
+			DiskUsed:    250.0,
+			DiskPct:     50.0,
+			NetworkSent: float64(i),
+			NetworkRecv: float64(i * 2),
+			Bandwidth:   [2]uint64{uint64(i * 1000), uint64(i * 2000)},
+			LoadAvg:     [3]float64{float64(i), float64(i) * 0.5, float64(i) * 0.25},
+		}
+	}
+
+	result := records.AverageSystemStatsSlice(input)
+
+	assert.Equal(t, 45.0, result.Cpu)    // avg of 0..90
+	assert.Equal(t, 16.0, result.Mem)    // constant
+	assert.Equal(t, 8.5, result.MemUsed) // avg of 4..13
+	assert.Equal(t, 29.5, result.MemPct) // avg of 25..34
+	assert.Equal(t, 500.0, result.DiskTotal)
+	assert.Equal(t, 250.0, result.DiskUsed)
+	assert.Equal(t, 50.0, result.DiskPct)
+	assert.Equal(t, 4.5, result.NetworkSent)
+	assert.Equal(t, 9.0, result.NetworkRecv)
+	assert.Equal(t, [2]uint64{4500, 9000}, result.Bandwidth)
+}
+
+// --- Container Stats Tests ---
+
+func TestAverageContainerStatsSlice_Empty(t *testing.T) {
+	result := records.AverageContainerStatsSlice(nil)
+	assert.Equal(t, []container.Stats{}, result)
+
+	result = records.AverageContainerStatsSlice([][]container.Stats{})
+	assert.Equal(t, []container.Stats{}, result)
+}
+
+func TestAverageContainerStatsSlice_SingleRecord(t *testing.T) {
+	input := [][]container.Stats{
+		{
+			{Name: "nginx", Cpu: 5.0, Mem: 128.0, Bandwidth: [2]uint64{1000, 2000}},
+		},
+	}
+
+	result := records.AverageContainerStatsSlice(input)
+
+	require.Len(t, result, 1)
+	assert.Equal(t, "nginx", result[0].Name)
+	assert.Equal(t, 5.0, result[0].Cpu)
+	assert.Equal(t, 128.0, result[0].Mem)
+	assert.Equal(t, [2]uint64{1000, 2000}, result[0].Bandwidth)
+}
+
+func TestAverageContainerStatsSlice_BasicAveraging(t *testing.T) {
+	input := [][]container.Stats{
+		{
+			{Name: "nginx", Cpu: 10.0, Mem: 100.0, Bandwidth: [2]uint64{1000, 2000}},
+			{Name: "redis", Cpu: 5.0, Mem: 64.0, Bandwidth: [2]uint64{500, 1000}},
+		},
+		{
+			{Name: "nginx", Cpu: 20.0, Mem: 200.0, Bandwidth: [2]uint64{3000, 4000}},
+			{Name: "redis", Cpu: 15.0, Mem: 128.0, Bandwidth: [2]uint64{1500, 2000}},
+		},
+	}
+
+	result := records.AverageContainerStatsSlice(input)
+	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
+
+	require.Len(t, result, 2)
+
+	assert.Equal(t, "nginx", result[0].Name)
+	assert.Equal(t, 15.0, result[0].Cpu)
+	assert.Equal(t, 150.0, result[0].Mem)
+	assert.Equal(t, [2]uint64{2000, 3000}, result[0].Bandwidth)
+
+	assert.Equal(t, "redis", result[1].Name)
+	assert.Equal(t, 10.0, result[1].Cpu)
+	assert.Equal(t, 96.0, result[1].Mem)
+	assert.Equal(t, [2]uint64{1000, 1500}, result[1].Bandwidth)
+}
+
+// Tests containers that appear in some records but not all.
+func TestAverageContainerStatsSlice_ContainerAppearsInSomeRecords(t *testing.T) {
+	input := [][]container.Stats{
+		{
+			{Name: "nginx", Cpu: 10.0, Mem: 100.0},
+			{Name: "redis", Cpu: 5.0, Mem: 64.0},
+		},
+		{
+			{Name: "nginx", Cpu: 20.0, Mem: 200.0},
+			// redis not present
+		},
+	}
+
+	result := records.AverageContainerStatsSlice(input)
+	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
+
+	require.Len(t, result, 2)
+
+	assert.Equal(t, "nginx", result[0].Name)
+	assert.Equal(t, 15.0, result[0].Cpu)
+	assert.Equal(t, 150.0, result[0].Mem)
+
+	// redis: sum / count where count = total records (2), not records containing redis
+	assert.Equal(t, "redis", result[1].Name)
+	assert.Equal(t, 2.5, result[1].Cpu)
+	assert.Equal(t, 32.0, result[1].Mem)
+}
+
+// Tests backward compatibility with deprecated NetworkSent/NetworkRecv (MB) when Bandwidth is zero.
+func TestAverageContainerStatsSlice_DeprecatedNetworkFields(t *testing.T) {
+	input := [][]container.Stats{
+		{
+			{Name: "nginx", Cpu: 10.0, Mem: 100.0, NetworkSent: 1.0, NetworkRecv: 2.0}, // 1 MB, 2 MB
+		},
+		{
+			{Name: "nginx", Cpu: 20.0, Mem: 200.0, NetworkSent: 3.0, NetworkRecv: 4.0}, // 3 MB, 4 MB
+		},
+	}
+
+	result := records.AverageContainerStatsSlice(input)
+
+	require.Len(t, result, 1)
+	assert.Equal(t, "nginx", result[0].Name)
+	// avg sent = (1*1048576 + 3*1048576) / 2 = 2*1048576
+	assert.Equal(t, uint64(2*1048576), result[0].Bandwidth[0])
+	// avg recv = (2*1048576 + 4*1048576) / 2 = 3*1048576
+	assert.Equal(t, uint64(3*1048576), result[0].Bandwidth[1])
+}
+
+// Tests that when Bandwidth is set, deprecated NetworkSent/NetworkRecv are ignored.
+func TestAverageContainerStatsSlice_MixedBandwidthAndDeprecated(t *testing.T) {
+	input := [][]container.Stats{
+		{
+			{Name: "nginx", Cpu: 10.0, Mem: 100.0, Bandwidth: [2]uint64{5000, 6000}, NetworkSent: 99.0, NetworkRecv: 99.0},
+		},
+		{
+			{Name: "nginx", Cpu: 20.0, Mem: 200.0, Bandwidth: [2]uint64{7000, 8000}},
+		},
+	}
+
+	result := records.AverageContainerStatsSlice(input)
+
+	require.Len(t, result, 1)
+	assert.Equal(t, uint64(6000), result[0].Bandwidth[0])
+	assert.Equal(t, uint64(7000), result[0].Bandwidth[1])
+}
+
+func TestAverageContainerStatsSlice_ThreeRecords(t *testing.T) {
+	input := [][]container.Stats{
+		{{Name: "app", Cpu: 1.0, Mem: 100.0}},
+		{{Name: "app", Cpu: 2.0, Mem: 200.0}},
+		{{Name: "app", Cpu: 3.0, Mem: 300.0}},
+	}
+
+	result := records.AverageContainerStatsSlice(input)
+
+	require.Len(t, result, 1)
+	assert.Equal(t, 2.0, result[0].Cpu)
+	assert.Equal(t, 200.0, result[0].Mem)
+}
+
+func TestAverageContainerStatsSlice_ManyContainers(t *testing.T) {
+	input := [][]container.Stats{
+		{
+			{Name: "a", Cpu: 10.0, Mem: 100.0},
+			{Name: "b", Cpu: 20.0, Mem: 200.0},
+			{Name: "c", Cpu: 30.0, Mem: 300.0},
+			{Name: "d", Cpu: 40.0, Mem: 400.0},
+		},
+		{
+			{Name: "a", Cpu: 20.0, Mem: 200.0},
+			{Name: "b", Cpu: 30.0, Mem: 300.0},
+			{Name: "c", Cpu: 40.0, Mem: 400.0},
+			{Name: "d", Cpu: 50.0, Mem: 500.0},
+		},
+	}
+
+	result := records.AverageContainerStatsSlice(input)
+	sort.Slice(result, func(i, j int) bool { return result[i].Name < result[j].Name })
+
+	require.Len(t, result, 4)
+	assert.Equal(t, 15.0, result[0].Cpu)
+	assert.Equal(t, 25.0, result[1].Cpu)
+	assert.Equal(t, 35.0, result[2].Cpu)
+	assert.Equal(t, 45.0, result[3].Cpu)
+}

internal/records/records_deletion.go

@@ -0,0 +1,138 @@
+package records
+
+import (
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+)
+
+// Delete old records
+func (rm *RecordManager) DeleteOldRecords() {
+	rm.app.RunInTransaction(func(txApp core.App) error {
+		err := deleteOldSystemStats(txApp)
+		if err != nil {
+			slog.Error("Error deleting old system stats", "err", err)
+		}
+		err = deleteOldContainerRecords(txApp)
+		if err != nil {
+			slog.Error("Error deleting old container records", "err", err)
+		}
+		err = deleteOldSystemdServiceRecords(txApp)
+		if err != nil {
+			slog.Error("Error deleting old systemd service records", "err", err)
+		}
+		err = deleteOldAlertsHistory(txApp, 200, 250)
+		if err != nil {
+			slog.Error("Error deleting old alerts history", "err", err)
+		}
+		err = deleteOldQuietHours(txApp)
+		if err != nil {
+			slog.Error("Error deleting old quiet hours", "err", err)
+		}
+		return nil
+	})
+}
+
+// Delete old alerts history records
+func deleteOldAlertsHistory(app core.App, countToKeep, countBeforeDeletion int) error {
+	db := app.DB()
+	var users []struct {
+		Id string `db:"user"`
+	}
+	err := db.NewQuery("SELECT user, COUNT(*) as count FROM alerts_history GROUP BY user HAVING count > {:countBeforeDeletion}").Bind(dbx.Params{"countBeforeDeletion": countBeforeDeletion}).All(&users)
+	if err != nil {
+		return err
+	}
+	for _, user := range users {
+		_, err = db.NewQuery("DELETE FROM alerts_history WHERE user = {:user} AND id NOT IN (SELECT id FROM alerts_history WHERE user = {:user} ORDER BY created DESC LIMIT {:countToKeep})").Bind(dbx.Params{"user": user.Id, "countToKeep": countToKeep}).Execute()
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Deletes system_stats records older than what is displayed in the UI
+func deleteOldSystemStats(app core.App) error {
+	// Collections to process
+	collections := [3]string{"system_stats", "container_stats", "network_probe_stats"}
+
+	// Record types and their retention periods
+	type RecordDeletionData struct {
+		recordType string
+		retention  time.Duration
+	}
+	recordData := []RecordDeletionData{
+		{recordType: "1m", retention: time.Hour},             // 1 hour
+		{recordType: "10m", retention: 12 * time.Hour},       // 12 hours
+		{recordType: "20m", retention: 24 * time.Hour},       // 1 day
+		{recordType: "120m", retention: 7 * 24 * time.Hour},  // 7 days
+		{recordType: "480m", retention: 30 * 24 * time.Hour}, // 30 days
+	}
+
+	now := time.Now().UTC()
+
+	for _, collection := range collections {
+		// Build the WHERE clause
+		var conditionParts []string
+		var params dbx.Params = make(map[string]any)
+		for i := range recordData {
+			rd := recordData[i]
+			// Create parameterized condition for this record type
+			dateParam := fmt.Sprintf("date%d", i)
+			conditionParts = append(conditionParts, fmt.Sprintf("(type = '%s' AND created < {:%s})", rd.recordType, dateParam))
+			params[dateParam] = now.Add(-rd.retention)
+		}
+		// Combine conditions with OR
+		conditionStr := strings.Join(conditionParts, " OR ")
+		// Construct and execute the full raw query
+		rawQuery := fmt.Sprintf("DELETE FROM %s WHERE %s", collection, conditionStr)
+		if _, err := app.DB().NewQuery(rawQuery).Bind(params).Execute(); err != nil {
+			return fmt.Errorf("failed to delete from %s: %v", collection, err)
+		}
+	}
+	return nil
+}
+
+// Deletes systemd service records that haven't been updated in the last 20 minutes
+func deleteOldSystemdServiceRecords(app core.App) error {
+	now := time.Now().UTC()
+	twentyMinutesAgo := now.Add(-20 * time.Minute)
+
+	// Delete systemd service records where updated < twentyMinutesAgo
+	_, err := app.DB().NewQuery("DELETE FROM systemd_services WHERE updated < {:updated}").Bind(dbx.Params{"updated": twentyMinutesAgo.UnixMilli()}).Execute()
+	if err != nil {
+		return fmt.Errorf("failed to delete old systemd service records: %v", err)
+	}
+
+	return nil
+}
+
+// Deletes container records that haven't been updated in the last 10 minutes
+func deleteOldContainerRecords(app core.App) error {
+	now := time.Now().UTC()
+	tenMinutesAgo := now.Add(-10 * time.Minute)
+
+	// Delete container records where updated < tenMinutesAgo
+	_, err := app.DB().NewQuery("DELETE FROM containers WHERE updated < {:updated}").Bind(dbx.Params{"updated": tenMinutesAgo.UnixMilli()}).Execute()
+	if err != nil {
+		return fmt.Errorf("failed to delete old container records: %v", err)
+	}
+
+	return nil
+}
+
+// Deletes old quiet hours records where end date has passed
+func deleteOldQuietHours(app core.App) error {
+	now := time.Now().UTC()
+	_, err := app.DB().NewQuery("DELETE FROM quiet_hours WHERE type = 'one-time' AND end < {:now}").Bind(dbx.Params{"now": now}).Execute()
+	if err != nil {
+		return err
+	}
+
+	return nil
+}

internal/records/records_deletion_test.go

@@ -0,0 +1,428 @@
+//go:build testing
+
+package records_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/henrygd/beszel/internal/records"
+	"github.com/henrygd/beszel/internal/tests"
+
+	"github.com/pocketbase/dbx"
+	"github.com/pocketbase/pocketbase/core"
+	"github.com/pocketbase/pocketbase/tools/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDeleteOldRecords tests the main DeleteOldRecords function
+func TestDeleteOldRecords(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	rm := records.NewRecordManager(hub)
+
+	// Create test user for alerts history
+	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	// Create test system
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user.Id},
+	})
+	require.NoError(t, err)
+
+	now := time.Now()
+
+	// Create old system_stats records that should be deleted
+	var record *core.Record
+	record, err = tests.CreateRecord(hub, "system_stats", map[string]any{
+		"system": system.Id,
+		"type":   "1m",
+		"stats":  `{"cpu": 50.0, "mem": 1024}`,
+	})
+	require.NoError(t, err)
+	// created is autodate field, so we need to set it manually
+	record.SetRaw("created", now.UTC().Add(-2*time.Hour).Format(types.DefaultDateLayout))
+	err = hub.SaveNoValidate(record)
+	require.NoError(t, err)
+	require.NotNil(t, record)
+	require.InDelta(t, record.GetDateTime("created").Time().UTC().Unix(), now.UTC().Add(-2*time.Hour).Unix(), 1)
+	require.Equal(t, record.Get("system"), system.Id)
+	require.Equal(t, record.Get("type"), "1m")
+
+	// Create recent system_stats record that should be kept
+	_, err = tests.CreateRecord(hub, "system_stats", map[string]any{
+		"system":  system.Id,
+		"type":    "1m",
+		"stats":   `{"cpu": 30.0, "mem": 512}`,
+		"created": now.Add(-30 * time.Minute), // 30 minutes old, should be kept
+	})
+	require.NoError(t, err)
+
+	// Create many alerts history records to trigger deletion
+	for i := range 260 { // More than countBeforeDeletion (250)
+		_, err = tests.CreateRecord(hub, "alerts_history", map[string]any{
+			"user":    user.Id,
+			"name":    "CPU",
+			"value":   i + 1,
+			"system":  system.Id,
+			"created": now.Add(-time.Duration(i) * time.Minute),
+		})
+		require.NoError(t, err)
+	}
+
+	// Count records before deletion
+	systemStatsCountBefore, err := hub.CountRecords("system_stats")
+	require.NoError(t, err)
+	alertsCountBefore, err := hub.CountRecords("alerts_history")
+	require.NoError(t, err)
+
+	// Run deletion
+	rm.DeleteOldRecords()
+
+	// Count records after deletion
+	systemStatsCountAfter, err := hub.CountRecords("system_stats")
+	require.NoError(t, err)
+	alertsCountAfter, err := hub.CountRecords("alerts_history")
+	require.NoError(t, err)
+
+	// Verify old system stats were deleted
+	assert.Less(t, systemStatsCountAfter, systemStatsCountBefore, "Old system stats should be deleted")
+
+	// Verify alerts history was trimmed
+	assert.Less(t, alertsCountAfter, alertsCountBefore, "Excessive alerts history should be deleted")
+	assert.Equal(t, alertsCountAfter, int64(200), "Alerts count should be equal to countToKeep (200)")
+}
+
+// TestDeleteOldSystemStats tests the deleteOldSystemStats function
+func TestDeleteOldSystemStats(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	// Create test system
+	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user.Id},
+	})
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+
+	// Test data for different record types and their retention periods
+	testCases := []struct {
+		recordType   string
+		retention    time.Duration
+		shouldBeKept bool
+		ageFromNow   time.Duration
+		description  string
+	}{
+		{"1m", time.Hour, true, 30 * time.Minute, "1m record within 1 hour should be kept"},
+		{"1m", time.Hour, false, 2 * time.Hour, "1m record older than 1 hour should be deleted"},
+		{"10m", 12 * time.Hour, true, 6 * time.Hour, "10m record within 12 hours should be kept"},
+		{"10m", 12 * time.Hour, false, 24 * time.Hour, "10m record older than 12 hours should be deleted"},
+		{"20m", 24 * time.Hour, true, 12 * time.Hour, "20m record within 24 hours should be kept"},
+		{"20m", 24 * time.Hour, false, 48 * time.Hour, "20m record older than 24 hours should be deleted"},
+		{"120m", 7 * 24 * time.Hour, true, 3 * 24 * time.Hour, "120m record within 7 days should be kept"},
+		{"120m", 7 * 24 * time.Hour, false, 10 * 24 * time.Hour, "120m record older than 7 days should be deleted"},
+		{"480m", 30 * 24 * time.Hour, true, 15 * 24 * time.Hour, "480m record within 30 days should be kept"},
+		{"480m", 30 * 24 * time.Hour, false, 45 * 24 * time.Hour, "480m record older than 30 days should be deleted"},
+	}
+
+	// Create test records for both system_stats and container_stats
+	collections := []string{"system_stats", "container_stats"}
+	recordIds := make(map[string][]string)
+
+	for _, collection := range collections {
+		recordIds[collection] = make([]string, 0)
+
+		for i, tc := range testCases {
+			recordTime := now.Add(-tc.ageFromNow)
+
+			var stats string
+			if collection == "system_stats" {
+				stats = fmt.Sprintf(`{"cpu": %d.0, "mem": %d}`, i*10, i*100)
+			} else {
+				stats = fmt.Sprintf(`[{"name": "container%d", "cpu": %d.0, "mem": %d}]`, i, i*5, i*50)
+			}
+
+			record, err := tests.CreateRecord(hub, collection, map[string]any{
+				"system": system.Id,
+				"type":   tc.recordType,
+				"stats":  stats,
+			})
+			require.NoError(t, err)
+			record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
+			err = hub.SaveNoValidate(record)
+			require.NoError(t, err)
+			recordIds[collection] = append(recordIds[collection], record.Id)
+		}
+	}
+
+	// Run deletion
+	err = records.DeleteOldSystemStats(hub)
+	require.NoError(t, err)
+
+	// Verify results
+	for _, collection := range collections {
+		for i, tc := range testCases {
+			recordId := recordIds[collection][i]
+
+			// Try to find the record
+			_, err := hub.FindRecordById(collection, recordId)
+
+			if tc.shouldBeKept {
+				assert.NoError(t, err, "Record should exist: %s", tc.description)
+			} else {
+				assert.Error(t, err, "Record should be deleted: %s", tc.description)
+			}
+		}
+	}
+}
+
+// TestDeleteOldAlertsHistory tests the deleteOldAlertsHistory function
+func TestDeleteOldAlertsHistory(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	// Create test users
+	user1, err := tests.CreateUser(hub, "user1@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	user2, err := tests.CreateUser(hub, "user2@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user1.Id, user2.Id},
+	})
+	require.NoError(t, err)
+	now := time.Now().UTC()
+
+	testCases := []struct {
+		name                  string
+		user                  *core.Record
+		alertCount            int
+		countToKeep           int
+		countBeforeDeletion   int
+		expectedAfterDeletion int
+		description           string
+	}{
+		{
+			name:                  "User with few alerts (below threshold)",
+			user:                  user1,
+			alertCount:            100,
+			countToKeep:           50,
+			countBeforeDeletion:   150,
+			expectedAfterDeletion: 100, // No deletion because below threshold
+			description:           "User with alerts below countBeforeDeletion should not have any deleted",
+		},
+		{
+			name:                  "User with many alerts (above threshold)",
+			user:                  user2,
+			alertCount:            300,
+			countToKeep:           100,
+			countBeforeDeletion:   200,
+			expectedAfterDeletion: 100, // Should be trimmed to countToKeep
+			description:           "User with alerts above countBeforeDeletion should be trimmed to countToKeep",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create alerts for this user
+			for i := 0; i < tc.alertCount; i++ {
+				_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
+					"user":    tc.user.Id,
+					"name":    "CPU",
+					"value":   i + 1,
+					"system":  system.Id,
+					"created": now.Add(-time.Duration(i) * time.Minute),
+				})
+				require.NoError(t, err)
+			}
+
+			// Count before deletion
+			countBefore, err := hub.CountRecords("alerts_history",
+				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
+			require.NoError(t, err)
+			assert.Equal(t, int64(tc.alertCount), countBefore, "Initial count should match")
+
+			// Run deletion
+			err = records.DeleteOldAlertsHistory(hub, tc.countToKeep, tc.countBeforeDeletion)
+			require.NoError(t, err)
+
+			// Count after deletion
+			countAfter, err := hub.CountRecords("alerts_history",
+				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
+			require.NoError(t, err)
+
+			assert.Equal(t, int64(tc.expectedAfterDeletion), countAfter, tc.description)
+
+			// If deletion occurred, verify the most recent records were kept
+			if tc.expectedAfterDeletion < tc.alertCount {
+				records, err := hub.FindRecordsByFilter("alerts_history",
+					"user = {:user}",
+					"-created", // Order by created DESC
+					tc.countToKeep,
+					0,
+					map[string]any{"user": tc.user.Id})
+				require.NoError(t, err)
+				assert.Len(t, records, tc.expectedAfterDeletion, "Should have exactly countToKeep records")
+
+				// Verify records are in descending order by created time
+				for i := 1; i < len(records); i++ {
+					prev := records[i-1].GetDateTime("created").Time()
+					curr := records[i].GetDateTime("created").Time()
+					assert.True(t, prev.After(curr) || prev.Equal(curr),
+						"Records should be ordered by created time (newest first)")
+				}
+			}
+		})
+	}
+}
+
+// TestDeleteOldAlertsHistoryEdgeCases tests edge cases for alerts history deletion
+func TestDeleteOldAlertsHistoryEdgeCases(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	t.Run("No users with excessive alerts", func(t *testing.T) {
+		// Create user with few alerts
+		user, err := tests.CreateUser(hub, "few@example.com", "testtesttest")
+		require.NoError(t, err)
+
+		system, err := tests.CreateRecord(hub, "systems", map[string]any{
+			"name":   "test-system",
+			"host":   "localhost",
+			"port":   "45876",
+			"status": "up",
+			"users":  []string{user.Id},
+		})
+
+		// Create only 5 alerts (well below threshold)
+		for i := range 5 {
+			_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
+				"user":   user.Id,
+				"name":   "CPU",
+				"value":  i + 1,
+				"system": system.Id,
+			})
+			require.NoError(t, err)
+		}
+
+		// Should not error and should not delete anything
+		err = records.DeleteOldAlertsHistory(hub, 10, 20)
+		require.NoError(t, err)
+
+		count, err := hub.CountRecords("alerts_history")
+		require.NoError(t, err)
+		assert.Equal(t, int64(5), count, "All alerts should remain")
+	})
+
+	t.Run("Empty alerts_history table", func(t *testing.T) {
+		// Clear any existing alerts
+		_, err := hub.DB().NewQuery("DELETE FROM alerts_history").Execute()
+		require.NoError(t, err)
+
+		// Should not error with empty table
+		err = records.DeleteOldAlertsHistory(hub, 10, 20)
+		require.NoError(t, err)
+	})
+}
+
+// TestDeleteOldSystemdServiceRecords tests systemd service cleanup via DeleteOldRecords
+func TestDeleteOldSystemdServiceRecords(t *testing.T) {
+	hub, err := tests.NewTestHub(t.TempDir())
+	require.NoError(t, err)
+	defer hub.Cleanup()
+
+	rm := records.NewRecordManager(hub)
+
+	// Create test user and system
+	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
+	require.NoError(t, err)
+
+	system, err := tests.CreateRecord(hub, "systems", map[string]any{
+		"name":   "test-system",
+		"host":   "localhost",
+		"port":   "45876",
+		"status": "up",
+		"users":  []string{user.Id},
+	})
+	require.NoError(t, err)
+
+	now := time.Now().UTC()
+
+	// Create old systemd service records that should be deleted (older than 20 minutes)
+	oldRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
+		"system":  system.Id,
+		"name":    "nginx.service",
+		"state":   0, // Active
+		"sub":     1, // Running
+		"cpu":     5.0,
+		"cpuPeak": 10.0,
+		"memory":  1024000,
+		"memPeak": 2048000,
+	})
+	require.NoError(t, err)
+	// Set updated time to 25 minutes ago (should be deleted)
+	oldRecord.SetRaw("updated", now.Add(-25*time.Minute).UnixMilli())
+	err = hub.SaveNoValidate(oldRecord)
+	require.NoError(t, err)
+
+	// Create recent systemd service record that should be kept (within 20 minutes)
+	recentRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
+		"system":  system.Id,
+		"name":    "apache.service",
+		"state":   1, // Inactive
+		"sub":     0, // Dead
+		"cpu":     2.0,
+		"cpuPeak": 3.0,
+		"memory":  512000,
+		"memPeak": 1024000,
+	})
+	require.NoError(t, err)
+	// Set updated time to 10 minutes ago (should be kept)
+	recentRecord.SetRaw("updated", now.Add(-10*time.Minute).UnixMilli())
+	err = hub.SaveNoValidate(recentRecord)
+	require.NoError(t, err)
+
+	// Count records before deletion
+	countBefore, err := hub.CountRecords("systemd_services")
+	require.NoError(t, err)
+	assert.Equal(t, int64(2), countBefore, "Should have 2 systemd service records initially")
+
+	// Run deletion via RecordManager
+	rm.DeleteOldRecords()
+
+	// Count records after deletion
+	countAfter, err := hub.CountRecords("systemd_services")
+	require.NoError(t, err)
+	assert.Equal(t, int64(1), countAfter, "Should have 1 systemd service record after deletion")
+
+	// Verify the correct record was kept
+	remainingRecords, err := hub.FindRecordsByFilter("systemd_services", "", "", 10, 0, nil)
+	require.NoError(t, err)
+	assert.Len(t, remainingRecords, 1, "Should have exactly 1 record remaining")
+	assert.Equal(t, "apache.service", remainingRecords[0].Get("name"), "The recent record should be kept")
+}

internal/records/records_test.go

@@ -3,430 +3,15 @@
 package records_test
 
 import (
-	"fmt"
 	"testing"
-	"time"
 
 	"github.com/henrygd/beszel/internal/records"
 	"github.com/henrygd/beszel/internal/tests"
 
-	"github.com/pocketbase/dbx"
-	"github.com/pocketbase/pocketbase/core"
-	"github.com/pocketbase/pocketbase/tools/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
-// TestDeleteOldRecords tests the main DeleteOldRecords function
-func TestDeleteOldRecords(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	rm := records.NewRecordManager(hub)
-
-	// Create test user for alerts history
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	// Create test system
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now()
-
-	// Create old system_stats records that should be deleted
-	var record *core.Record
-	record, err = tests.CreateRecord(hub, "system_stats", map[string]any{
-		"system": system.Id,
-		"type":   "1m",
-		"stats":  `{"cpu": 50.0, "mem": 1024}`,
-	})
-	require.NoError(t, err)
-	// created is autodate field, so we need to set it manually
-	record.SetRaw("created", now.UTC().Add(-2*time.Hour).Format(types.DefaultDateLayout))
-	err = hub.SaveNoValidate(record)
-	require.NoError(t, err)
-	require.NotNil(t, record)
-	require.InDelta(t, record.GetDateTime("created").Time().UTC().Unix(), now.UTC().Add(-2*time.Hour).Unix(), 1)
-	require.Equal(t, record.Get("system"), system.Id)
-	require.Equal(t, record.Get("type"), "1m")
-
-	// Create recent system_stats record that should be kept
-	_, err = tests.CreateRecord(hub, "system_stats", map[string]any{
-		"system":  system.Id,
-		"type":    "1m",
-		"stats":   `{"cpu": 30.0, "mem": 512}`,
-		"created": now.Add(-30 * time.Minute), // 30 minutes old, should be kept
-	})
-	require.NoError(t, err)
-
-	// Create many alerts history records to trigger deletion
-	for i := range 260 { // More than countBeforeDeletion (250)
-		_, err = tests.CreateRecord(hub, "alerts_history", map[string]any{
-			"user":    user.Id,
-			"name":    "CPU",
-			"value":   i + 1,
-			"system":  system.Id,
-			"created": now.Add(-time.Duration(i) * time.Minute),
-		})
-		require.NoError(t, err)
-	}
-
-	// Count records before deletion
-	systemStatsCountBefore, err := hub.CountRecords("system_stats")
-	require.NoError(t, err)
-	alertsCountBefore, err := hub.CountRecords("alerts_history")
-	require.NoError(t, err)
-
-	// Run deletion
-	rm.DeleteOldRecords()
-
-	// Count records after deletion
-	systemStatsCountAfter, err := hub.CountRecords("system_stats")
-	require.NoError(t, err)
-	alertsCountAfter, err := hub.CountRecords("alerts_history")
-	require.NoError(t, err)
-
-	// Verify old system stats were deleted
-	assert.Less(t, systemStatsCountAfter, systemStatsCountBefore, "Old system stats should be deleted")
-
-	// Verify alerts history was trimmed
-	assert.Less(t, alertsCountAfter, alertsCountBefore, "Excessive alerts history should be deleted")
-	assert.Equal(t, alertsCountAfter, int64(200), "Alerts count should be equal to countToKeep (200)")
-}
-
-// TestDeleteOldSystemStats tests the deleteOldSystemStats function
-func TestDeleteOldSystemStats(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	// Create test system
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-
-	// Test data for different record types and their retention periods
-	testCases := []struct {
-		recordType   string
-		retention    time.Duration
-		shouldBeKept bool
-		ageFromNow   time.Duration
-		description  string
-	}{
-		{"1m", time.Hour, true, 30 * time.Minute, "1m record within 1 hour should be kept"},
-		{"1m", time.Hour, false, 2 * time.Hour, "1m record older than 1 hour should be deleted"},
-		{"10m", 12 * time.Hour, true, 6 * time.Hour, "10m record within 12 hours should be kept"},
-		{"10m", 12 * time.Hour, false, 24 * time.Hour, "10m record older than 12 hours should be deleted"},
-		{"20m", 24 * time.Hour, true, 12 * time.Hour, "20m record within 24 hours should be kept"},
-		{"20m", 24 * time.Hour, false, 48 * time.Hour, "20m record older than 24 hours should be deleted"},
-		{"120m", 7 * 24 * time.Hour, true, 3 * 24 * time.Hour, "120m record within 7 days should be kept"},
-		{"120m", 7 * 24 * time.Hour, false, 10 * 24 * time.Hour, "120m record older than 7 days should be deleted"},
-		{"480m", 30 * 24 * time.Hour, true, 15 * 24 * time.Hour, "480m record within 30 days should be kept"},
-		{"480m", 30 * 24 * time.Hour, false, 45 * 24 * time.Hour, "480m record older than 30 days should be deleted"},
-	}
-
-	// Create test records for both system_stats and container_stats
-	collections := []string{"system_stats", "container_stats"}
-	recordIds := make(map[string][]string)
-
-	for _, collection := range collections {
-		recordIds[collection] = make([]string, 0)
-
-		for i, tc := range testCases {
-			recordTime := now.Add(-tc.ageFromNow)
-
-			var stats string
-			if collection == "system_stats" {
-				stats = fmt.Sprintf(`{"cpu": %d.0, "mem": %d}`, i*10, i*100)
-			} else {
-				stats = fmt.Sprintf(`[{"name": "container%d", "cpu": %d.0, "mem": %d}]`, i, i*5, i*50)
-			}
-
-			record, err := tests.CreateRecord(hub, collection, map[string]any{
-				"system": system.Id,
-				"type":   tc.recordType,
-				"stats":  stats,
-			})
-			require.NoError(t, err)
-			record.SetRaw("created", recordTime.Format(types.DefaultDateLayout))
-			err = hub.SaveNoValidate(record)
-			require.NoError(t, err)
-			recordIds[collection] = append(recordIds[collection], record.Id)
-		}
-	}
-
-	// Run deletion
-	err = records.DeleteOldSystemStats(hub)
-	require.NoError(t, err)
-
-	// Verify results
-	for _, collection := range collections {
-		for i, tc := range testCases {
-			recordId := recordIds[collection][i]
-
-			// Try to find the record
-			_, err := hub.FindRecordById(collection, recordId)
-
-			if tc.shouldBeKept {
-				assert.NoError(t, err, "Record should exist: %s", tc.description)
-			} else {
-				assert.Error(t, err, "Record should be deleted: %s", tc.description)
-			}
-		}
-	}
-}
-
-// TestDeleteOldAlertsHistory tests the deleteOldAlertsHistory function
-func TestDeleteOldAlertsHistory(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	// Create test users
-	user1, err := tests.CreateUser(hub, "user1@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	user2, err := tests.CreateUser(hub, "user2@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user1.Id, user2.Id},
-	})
-	require.NoError(t, err)
-	now := time.Now().UTC()
-
-	testCases := []struct {
-		name                  string
-		user                  *core.Record
-		alertCount            int
-		countToKeep           int
-		countBeforeDeletion   int
-		expectedAfterDeletion int
-		description           string
-	}{
-		{
-			name:                  "User with few alerts (below threshold)",
-			user:                  user1,
-			alertCount:            100,
-			countToKeep:           50,
-			countBeforeDeletion:   150,
-			expectedAfterDeletion: 100, // No deletion because below threshold
-			description:           "User with alerts below countBeforeDeletion should not have any deleted",
-		},
-		{
-			name:                  "User with many alerts (above threshold)",
-			user:                  user2,
-			alertCount:            300,
-			countToKeep:           100,
-			countBeforeDeletion:   200,
-			expectedAfterDeletion: 100, // Should be trimmed to countToKeep
-			description:           "User with alerts above countBeforeDeletion should be trimmed to countToKeep",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			// Create alerts for this user
-			for i := 0; i < tc.alertCount; i++ {
-				_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
-					"user":    tc.user.Id,
-					"name":    "CPU",
-					"value":   i + 1,
-					"system":  system.Id,
-					"created": now.Add(-time.Duration(i) * time.Minute),
-				})
-				require.NoError(t, err)
-			}
-
-			// Count before deletion
-			countBefore, err := hub.CountRecords("alerts_history",
-				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
-			require.NoError(t, err)
-			assert.Equal(t, int64(tc.alertCount), countBefore, "Initial count should match")
-
-			// Run deletion
-			err = records.DeleteOldAlertsHistory(hub, tc.countToKeep, tc.countBeforeDeletion)
-			require.NoError(t, err)
-
-			// Count after deletion
-			countAfter, err := hub.CountRecords("alerts_history",
-				dbx.NewExp("user = {:user}", dbx.Params{"user": tc.user.Id}))
-			require.NoError(t, err)
-
-			assert.Equal(t, int64(tc.expectedAfterDeletion), countAfter, tc.description)
-
-			// If deletion occurred, verify the most recent records were kept
-			if tc.expectedAfterDeletion < tc.alertCount {
-				records, err := hub.FindRecordsByFilter("alerts_history",
-					"user = {:user}",
-					"-created", // Order by created DESC
-					tc.countToKeep,
-					0,
-					map[string]any{"user": tc.user.Id})
-				require.NoError(t, err)
-				assert.Len(t, records, tc.expectedAfterDeletion, "Should have exactly countToKeep records")
-
-				// Verify records are in descending order by created time
-				for i := 1; i < len(records); i++ {
-					prev := records[i-1].GetDateTime("created").Time()
-					curr := records[i].GetDateTime("created").Time()
-					assert.True(t, prev.After(curr) || prev.Equal(curr),
-						"Records should be ordered by created time (newest first)")
-				}
-			}
-		})
-	}
-}
-
-// TestDeleteOldAlertsHistoryEdgeCases tests edge cases for alerts history deletion
-func TestDeleteOldAlertsHistoryEdgeCases(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	t.Run("No users with excessive alerts", func(t *testing.T) {
-		// Create user with few alerts
-		user, err := tests.CreateUser(hub, "few@example.com", "testtesttest")
-		require.NoError(t, err)
-
-		system, err := tests.CreateRecord(hub, "systems", map[string]any{
-			"name":   "test-system",
-			"host":   "localhost",
-			"port":   "45876",
-			"status": "up",
-			"users":  []string{user.Id},
-		})
-
-		// Create only 5 alerts (well below threshold)
-		for i := range 5 {
-			_, err := tests.CreateRecord(hub, "alerts_history", map[string]any{
-				"user":   user.Id,
-				"name":   "CPU",
-				"value":  i + 1,
-				"system": system.Id,
-			})
-			require.NoError(t, err)
-		}
-
-		// Should not error and should not delete anything
-		err = records.DeleteOldAlertsHistory(hub, 10, 20)
-		require.NoError(t, err)
-
-		count, err := hub.CountRecords("alerts_history")
-		require.NoError(t, err)
-		assert.Equal(t, int64(5), count, "All alerts should remain")
-	})
-
-	t.Run("Empty alerts_history table", func(t *testing.T) {
-		// Clear any existing alerts
-		_, err := hub.DB().NewQuery("DELETE FROM alerts_history").Execute()
-		require.NoError(t, err)
-
-		// Should not error with empty table
-		err = records.DeleteOldAlertsHistory(hub, 10, 20)
-		require.NoError(t, err)
-	})
-}
-
-// TestDeleteOldSystemdServiceRecords tests systemd service cleanup via DeleteOldRecords
-func TestDeleteOldSystemdServiceRecords(t *testing.T) {
-	hub, err := tests.NewTestHub(t.TempDir())
-	require.NoError(t, err)
-	defer hub.Cleanup()
-
-	rm := records.NewRecordManager(hub)
-
-	// Create test user and system
-	user, err := tests.CreateUser(hub, "test@example.com", "testtesttest")
-	require.NoError(t, err)
-
-	system, err := tests.CreateRecord(hub, "systems", map[string]any{
-		"name":   "test-system",
-		"host":   "localhost",
-		"port":   "45876",
-		"status": "up",
-		"users":  []string{user.Id},
-	})
-	require.NoError(t, err)
-
-	now := time.Now().UTC()
-
-	// Create old systemd service records that should be deleted (older than 20 minutes)
-	oldRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
-		"system":  system.Id,
-		"name":    "nginx.service",
-		"state":   0, // Active
-		"sub":     1, // Running
-		"cpu":     5.0,
-		"cpuPeak": 10.0,
-		"memory":  1024000,
-		"memPeak": 2048000,
-	})
-	require.NoError(t, err)
-	// Set updated time to 25 minutes ago (should be deleted)
-	oldRecord.SetRaw("updated", now.Add(-25*time.Minute).UnixMilli())
-	err = hub.SaveNoValidate(oldRecord)
-	require.NoError(t, err)
-
-	// Create recent systemd service record that should be kept (within 20 minutes)
-	recentRecord, err := tests.CreateRecord(hub, "systemd_services", map[string]any{
-		"system":  system.Id,
-		"name":    "apache.service",
-		"state":   1, // Inactive
-		"sub":     0, // Dead
-		"cpu":     2.0,
-		"cpuPeak": 3.0,
-		"memory":  512000,
-		"memPeak": 1024000,
-	})
-	require.NoError(t, err)
-	// Set updated time to 10 minutes ago (should be kept)
-	recentRecord.SetRaw("updated", now.Add(-10*time.Minute).UnixMilli())
-	err = hub.SaveNoValidate(recentRecord)
-	require.NoError(t, err)
-
-	// Count records before deletion
-	countBefore, err := hub.CountRecords("systemd_services")
-	require.NoError(t, err)
-	assert.Equal(t, int64(2), countBefore, "Should have 2 systemd service records initially")
-
-	// Run deletion via RecordManager
-	rm.DeleteOldRecords()
-
-	// Count records after deletion
-	countAfter, err := hub.CountRecords("systemd_services")
-	require.NoError(t, err)
-	assert.Equal(t, int64(1), countAfter, "Should have 1 systemd service record after deletion")
-
-	// Verify the correct record was kept
-	remainingRecords, err := hub.FindRecordsByFilter("systemd_services", "", "", 10, 0, nil)
-	require.NoError(t, err)
-	assert.Len(t, remainingRecords, 1, "Should have exactly 1 record remaining")
-	assert.Equal(t, "apache.service", remainingRecords[0].Get("name"), "The recent record should be kept")
-}
-
 // TestRecordManagerCreation tests RecordManager creation
 func TestRecordManagerCreation(t *testing.T) {
 	hub, err := tests.NewTestHub(t.TempDir())

internal/site/index.html

@@ -22,11 +22,7 @@
 			})();
 		</script>
 		<script>
-			globalThis.BESZEL = {
+			globalThis.BESZEL = "{info}"
-				BASE_PATH: "%BASE_URL%",
-				HUB_VERSION: "{{V}}",
-				HUB_URL: "{{HUB_URL}}"
-			}
 		</script>
 	</head>
 	<body>

internal/site/src/components/charts/area-chart.tsx

@@ -146,7 +146,7 @@ export default function AreaChartDefault({
 							axisLine={false}
 						/>
 					)}
-					{xAxis(chartData)}
+					{xAxis(chartData.chartTime, displayData.at(-1)?.created as number)}
 					<ChartTooltip
 						animationEasing="ease-out"
 						animationDuration={150}

internal/site/src/components/charts/line-chart.tsx

@@ -41,6 +41,7 @@ export default function LineChartDefault({
 	filter,
 	truncate = false,
 	chartProps,
+	connectNulls,
 }: {
 	chartData: ChartData
 	// biome-ignore lint/suspicious/noExplicitAny: accepts different data source types (systemStats or containerData)
@@ -62,6 +63,7 @@ export default function LineChartDefault({
 	filter?: string
 	truncate?: boolean
 	chartProps?: Omit<React.ComponentProps<typeof LineChart>, "data" | "margin">
+	connectNulls?: boolean
 }) {
 	const { yAxisWidth, updateYAxisWidth } = useYAxisWidth()
 	const { isIntersecting, ref } = useIntersectionObserver({ freeze: false })
@@ -104,7 +106,8 @@ export default function LineChartDefault({
 					isAnimationActive={false}
 					// stackId={dataPoint.stackId}
 					order={dataPoint.order || i}
-					// activeDot={dataPoint.activeDot ?? true}
+					activeDot={dataPoint.activeDot ?? true}
+					connectNulls={connectNulls}
 				/>
 			)
 		})
@@ -145,7 +148,7 @@ export default function LineChartDefault({
 							axisLine={false}
 						/>
 					)}
-					{xAxis(chartData)}
+					{xAxis(chartData.chartTime, displayData.at(-1)?.created as number)}
 					<ChartTooltip
 						animationEasing="ease-out"
 						animationDuration={150}

internal/site/src/components/login/auth-form.tsx

@@ -12,7 +12,7 @@ import { Label } from "@/components/ui/label"
 import { pb } from "@/lib/api"
 import { $authenticated } from "@/lib/stores"
 import { cn } from "@/lib/utils"
-import { $router, Link, prependBasePath } from "../router"
+import { $router, Link, basePath, prependBasePath } from "../router"
 import { toast } from "../ui/use-toast"
 import { OtpInputForm } from "./otp-forms"
 
@@ -37,8 +37,7 @@ const RegisterSchema = v.looseObject({
 	passwordConfirm: passwordSchema,
 })
 
-export const showLoginFaliedToast = (description?: string) => {
+export const showLoginFaliedToast = (description = t`Please check your credentials and try again`) => {
-	description ||= t`Please check your credentials and try again`
 	toast({
 		title: t`Login attempt failed`,
 		description,
@@ -130,10 +129,6 @@ export function UserAuthForm({
 		[isFirstRun]
 	)
 
-	if (!authMethods) {
-		return null
-	}
-
 	const authProviders = authMethods.oauth2.providers ?? []
 	const oauthEnabled = authMethods.oauth2.enabled && authProviders.length > 0
 	const passwordEnabled = authMethods.password.enabled
@@ -142,6 +137,12 @@ export function UserAuthForm({
 
 	function loginWithOauth(provider: AuthProviderInfo, forcePopup = false) {
 		setIsOauthLoading(true)
+
+		if (globalThis.BESZEL.OAUTH_DISABLE_POPUP) {
+			redirectToOauthProvider(provider)
+			return
+		}
+
 		const oAuthOpts: OAuth2AuthConfig = {
 			provider: provider.name,
 		}
@@ -150,10 +151,7 @@ export function UserAuthForm({
 			const authWindow = window.open()
 			if (!authWindow) {
 				setIsOauthLoading(false)
-				toast({
+				showLoginFaliedToast(t`Please enable pop-ups for this site`)
-					title: t`Error`,
-					description: t`Please enable pop-ups for this site`,
-				})
 				return
 			}
 			oAuthOpts.urlCallback = (url) => {
@@ -171,16 +169,57 @@ export function UserAuthForm({
 			})
 	}
 
-	useEffect(() => {
+	/**
-		// auto login if password disabled and only one auth provider
+	 * Redirects the user to the OAuth provider's authentication page in the same window.
-		if (!passwordEnabled && authProviders.length === 1 && !sessionStorage.getItem("lo")) {
+	 * Requires the app's base URL to be registered as a redirect URI with the OAuth provider.
-			// Add a small timeout to ensure browser is ready to handle popups
+	 */
-			setTimeout(() => {
+	function redirectToOauthProvider(provider: AuthProviderInfo) {
-				loginWithOauth(authProviders[0], true)
+		const url = new URL(provider.authURL)
-			}, 300)
+		// url.searchParams.set("redirect_uri", `${window.location.origin}${basePath}`)
+		sessionStorage.setItem("provider", JSON.stringify(provider))
+		window.location.href = url.toString()
 	}
+
+	useEffect(() => {
+		// handle redirect-based OAuth callback if we have a code
+		const params = new URLSearchParams(window.location.search)
+		const code = params.get("code")
+		if (code) {
+			const state = params.get("state")
+			const provider: AuthProviderInfo = JSON.parse(sessionStorage.getItem("provider") ?? "{}")
+			if (!state || provider.state !== state) {
+				showLoginFaliedToast()
+			} else {
+				setIsOauthLoading(true)
+				window.history.replaceState({}, "", window.location.pathname)
+				pb.collection("users")
+					.authWithOAuth2Code(provider.name, code, provider.codeVerifier, `${window.location.origin}${basePath}`)
+					.then(() => $authenticated.set(pb.authStore.isValid))
+					.catch((e: unknown) => showLoginFaliedToast((e as Error).message))
+					.finally(() => setIsOauthLoading(false))
+			}
+		}
+
+		// auto login if password disabled and only one auth provider
+		if (!code && !passwordEnabled && authProviders.length === 1 && !sessionStorage.getItem("lo")) {
+			// Add a small timeout to ensure browser is ready to handle popups
+			setTimeout(() => loginWithOauth(authProviders[0], false), 300)
+			return
+		}
+
+		// refresh auth if not in above states (required for trusted auth header)
+		pb.collection("users")
+			.authRefresh()
+			.then((res) => {
+				pb.authStore.save(res.token, res.record)
+				$authenticated.set(!!pb.authStore.isValid)
+			})
 	}, [])
 
+	if (!authMethods) {
+		return null
+	}
+
 	if (otpId && mfaId) {
 		return <OtpInputForm otpId={otpId} mfaId={mfaId} />
 	}
@@ -248,7 +287,7 @@ export function UserAuthForm({
 							)}
 							<div className="sr-only">
 								{/* honeypot */}
-								<label htmlFor="website"></label>
+								<label htmlFor="website">Website</label>
 								<input
 									id="website"
 									type="text"

internal/site/src/components/mode-toggle.tsx

@@ -1,28 +1,39 @@
 import { t } from "@lingui/core/macro"
-import { MoonStarIcon, SunIcon } from "lucide-react"
+import { MoonStarIcon, SunIcon, SunMoonIcon } from "lucide-react"
 import { useTheme } from "@/components/theme-provider"
 import { Button } from "@/components/ui/button"
 import { Tooltip, TooltipContent, TooltipTrigger } from "./ui/tooltip"
 import { Trans } from "@lingui/react/macro"
+import { cn } from "@/lib/utils"
+
+const themes = ["light", "dark", "system"] as const
+const icons = [SunIcon, MoonStarIcon, SunMoonIcon] as const
 
 export function ModeToggle() {
 	const { theme, setTheme } = useTheme()
 
+	const currentIndex = themes.indexOf(theme)
+	const Icon = icons[currentIndex]
+
 	return (
 		<Tooltip>
 			<TooltipTrigger asChild>
 				<Button
 					variant={"ghost"}
 					size="icon"
-					aria-label={t`Toggle theme`}
+					aria-label={t`Switch theme`}
-					onClick={() => setTheme(theme === "dark" ? "light" : "dark")}
+					onClick={() => setTheme(themes[(currentIndex + 1) % themes.length])}
 				>
-					<SunIcon className="h-[1.2rem] w-[1.2rem] transition-all -rotate-90 dark:opacity-0 dark:rotate-0" />
+					<Icon
-					<MoonStarIcon className="absolute h-[1.2rem] w-[1.2rem] transition-all opacity-0 -rotate-90 dark:opacity-100 dark:rotate-0" />
+						className={cn(
+							"animate-in fade-in spin-in-[-30deg] duration-200",
+							currentIndex === 2 ? "size-[1.35rem]" : "size-[1.2rem]"
+						)}
+					/>
 				</Button>
 			</TooltipTrigger>
 			<TooltipContent>
-				<Trans>Toggle theme</Trans>
+				<Trans>Switch theme</Trans>
 			</TooltipContent>
 		</Tooltip>
 	)

internal/site/src/components/navbar.tsx

@@ -8,6 +8,7 @@ import {
 	LogOutIcon,
 	LogsIcon,
 	MenuIcon,
+	NetworkIcon,
 	PlusIcon,
 	SearchIcon,
 	ServerIcon,
@@ -109,6 +110,10 @@ export default function Navbar() {
 								<HardDriveIcon className="h-4 w-4 me-2.5" strokeWidth={1.5} />
 								<span>S.M.A.R.T.</span>
 							</DropdownMenuItem>
+							<DropdownMenuItem onClick={() => navigate(getPagePath($router, "probes"))} className="flex items-center">
+								<NetworkIcon className="h-4 w-4 me-2.5" strokeWidth={1.5} />
+								<Trans>Network Probes</Trans>
+							</DropdownMenuItem>
 							<DropdownMenuItem
 								onClick={() => navigate(getPagePath($router, "settings", { name: "general" }))}
 								className="flex items-center"
@@ -180,6 +185,21 @@ export default function Navbar() {
 					</TooltipTrigger>
 					<TooltipContent>S.M.A.R.T.</TooltipContent>
 				</Tooltip>
+				<Tooltip>
+					<TooltipTrigger asChild>
+						<Link
+							href={getPagePath($router, "probes")}
+							className={cn("hidden md:grid", buttonVariants({ variant: "ghost", size: "icon" }))}
+							aria-label="Network Probes"
+							onMouseEnter={() => import("@/components/routes/probes")}
+						>
+							<NetworkIcon className="h-[1.2rem] w-[1.2rem]" strokeWidth={1.5} />
+						</Link>
+					</TooltipTrigger>
+					<TooltipContent>
+						<Trans>Network Probes</Trans>
+					</TooltipContent>
+				</Tooltip>
 				<LangToggle />
 				<ModeToggle />
 				<Tooltip>

internal/site/src/components/network-probes-table/network-probes-columns.tsx

@@ -0,0 +1,216 @@
+import type { Column, ColumnDef } from "@tanstack/react-table"
+import { Button } from "@/components/ui/button"
+import { cn, decimalString, hourWithSeconds } from "@/lib/utils"
+import {
+	GlobeIcon,
+	TimerIcon,
+	ActivityIcon,
+	WifiOffIcon,
+	Trash2Icon,
+	ArrowLeftRightIcon,
+	MoreHorizontalIcon,
+	ServerIcon,
+	ClockIcon,
+	NetworkIcon,
+} from "lucide-react"
+import { t } from "@lingui/core/macro"
+import type { NetworkProbeRecord } from "@/types"
+import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuTrigger } from "@/components/ui/dropdown-menu"
+import { Trans } from "@lingui/react/macro"
+import { pb } from "@/lib/api"
+import { toast } from "../ui/use-toast"
+import { $allSystemsById } from "@/lib/stores"
+import { useStore } from "@nanostores/react"
+
+const protocolColors: Record<string, string> = {
+	icmp: "bg-blue-500/15 text-blue-400",
+	tcp: "bg-purple-500/15 text-purple-400",
+	http: "bg-green-500/15 text-green-400",
+}
+
+async function deleteProbe(id: string) {
+	try {
+		await pb.collection("network_probes").delete(id)
+	} catch (err: unknown) {
+		toast({ variant: "destructive", title: t`Error`, description: (err as Error)?.message })
+	}
+}
+
+export function getProbeColumns(longestName = 0, longestTarget = 0): ColumnDef<NetworkProbeRecord>[] {
+	return [
+		{
+			id: "name",
+			sortingFn: (a, b) => (a.original.name || a.original.target).localeCompare(b.original.name || b.original.target),
+			accessorFn: (record) => record.name || record.target,
+			header: ({ column }) => <HeaderButton column={column} name={t`Name`} Icon={NetworkIcon} />,
+			cell: ({ getValue }) => (
+				<div className="ms-1.5 max-w-40 block truncate tabular-nums" style={{ width: `${longestName / 1.05}ch` }}>
+					{getValue() as string}
+				</div>
+			),
+		},
+		{
+			id: "system",
+			accessorFn: (record) => record.system,
+			sortingFn: (a, b) => {
+				const allSystems = $allSystemsById.get()
+				const systemNameA = allSystems[a.original.system]?.name ?? ""
+				const systemNameB = allSystems[b.original.system]?.name ?? ""
+				return systemNameA.localeCompare(systemNameB)
+			},
+			header: ({ column }) => <HeaderButton column={column} name={t`System`} Icon={ServerIcon} />,
+			cell: ({ getValue }) => {
+				const allSystems = useStore($allSystemsById)
+				return <span className="ms-1.5 xl:w-34 block truncate">{allSystems[getValue() as string]?.name ?? ""}</span>
+			},
+		},
+		{
+			id: "target",
+			sortingFn: (a, b) => a.original.target.localeCompare(b.original.target),
+			accessorFn: (record) => record.target,
+			header: ({ column }) => <HeaderButton column={column} name={t`Target`} Icon={GlobeIcon} />,
+			cell: ({ getValue }) => (
+				<div className="ms-1.5 tabular-nums block truncate max-w-44" style={{ width: `${longestTarget / 1.05}ch` }}>
+					{getValue() as string}
+				</div>
+			),
+		},
+		{
+			id: "protocol",
+			accessorFn: (record) => record.protocol,
+			header: ({ column }) => <HeaderButton column={column} name={t`Protocol`} Icon={ArrowLeftRightIcon} />,
+			cell: ({ getValue }) => {
+				const protocol = getValue() as string
+				return (
+					<span className={cn("ms-1.5 px-2 py-0.5 rounded text-xs font-medium uppercase", protocolColors[protocol])}>
+						{protocol}
+					</span>
+				)
+			},
+		},
+		{
+			id: "interval",
+			accessorFn: (record) => record.interval,
+			header: ({ column }) => <HeaderButton column={column} name={t`Interval`} Icon={TimerIcon} />,
+			cell: ({ getValue }) => <span className="ms-1.5 tabular-nums">{getValue() as number}s</span>,
+		},
+		{
+			id: "latency",
+			accessorFn: (record) => record.latency,
+			invertSorting: true,
+			header: ({ column }) => <HeaderButton column={column} name={t`Latency`} Icon={ActivityIcon} />,
+			cell: ({ row }) => {
+				const val = row.original.latency
+				if (!val) {
+					return <span className="ms-1.5 text-muted-foreground">-</span>
+				}
+				let color = "bg-green-500"
+				if (val > 200) {
+					color = "bg-yellow-500"
+				}
+				if (val > 2000) {
+					color = "bg-red-500"
+				}
+				return (
+					<span className="ms-1.5 tabular-nums flex gap-2 items-center">
+						<span className={cn("shrink-0 size-2 rounded-full", color)} />
+						{decimalString(val, val < 100 ? 2 : 1).toLocaleString()} ms
+					</span>
+				)
+			},
+		},
+		{
+			id: "loss",
+			accessorFn: (record) => record.loss,
+			invertSorting: true,
+			header: ({ column }) => <HeaderButton column={column} name={t`Loss`} Icon={WifiOffIcon} />,
+			cell: ({ row }) => {
+				const { loss, latency } = row.original
+				if (loss === undefined || (!latency && !loss)) {
+					return <span className="ms-1.5 text-muted-foreground">-</span>
+				}
+				let color = "bg-green-500"
+				if (loss) {
+					color = loss > 20 ? "bg-red-500" : "bg-yellow-500"
+				}
+				return (
+					<span className="ms-1.5 tabular-nums flex gap-2 items-center">
+						<span className={cn("shrink-0 size-2 rounded-full", color)} />
+						{loss}%
+					</span>
+				)
+			},
+		},
+		{
+			id: "updated",
+			invertSorting: true,
+			accessorFn: (record) => record.updated,
+			header: ({ column }) => <HeaderButton column={column} name={t`Updated`} Icon={ClockIcon} />,
+			cell: ({ getValue }) => {
+				const timestamp = getValue() as number
+				return <span className="ms-1.5 tabular-nums">{hourWithSeconds(new Date(timestamp).toISOString())}</span>
+			},
+		},
+		{
+			id: "actions",
+			enableSorting: false,
+			header: () => null,
+			size: 40,
+			cell: ({ row }) => (
+				<DropdownMenu>
+					<DropdownMenuTrigger asChild>
+						<Button
+							variant="ghost"
+							size="icon"
+							className="size-10"
+							onClick={(event) => event.stopPropagation()}
+							onMouseDown={(event) => event.stopPropagation()}
+						>
+							<span className="sr-only">
+								<Trans>Open menu</Trans>
+							</span>
+							<MoreHorizontalIcon className="w-5" />
+						</Button>
+					</DropdownMenuTrigger>
+					<DropdownMenuContent align="end" onClick={(event) => event.stopPropagation()}>
+						<DropdownMenuItem
+							onClick={(event) => {
+								event.stopPropagation()
+								deleteProbe(row.original.id)
+							}}
+						>
+							<Trash2Icon className="me-2.5 size-4" />
+							<Trans>Delete</Trans>
+						</DropdownMenuItem>
+					</DropdownMenuContent>
+				</DropdownMenu>
+			),
+		},
+	]
+}
+
+function HeaderButton({
+	column,
+	name,
+	Icon,
+}: {
+	column: Column<NetworkProbeRecord>
+	name: string
+	Icon: React.ElementType
+}) {
+	const isSorted = column.getIsSorted()
+	return (
+		<Button
+			className={cn(
+				"h-9 px-3 flex items-center gap-2 duration-50",
+				isSorted && "bg-accent/70 light:bg-accent text-accent-foreground/90"
+			)}
+			variant="ghost"
+			onClick={() => column.toggleSorting(column.getIsSorted() === "asc")}
+		>
+			{Icon && <Icon className="size-4" />}
+			{name}
+			{/* <ArrowUpDownIcon className="size-4" /> */}
+		</Button>
+	)
+}

internal/site/src/components/network-probes-table/network-probes-table.tsx

@@ -0,0 +1,225 @@
+import { t } from "@lingui/core/macro"
+import { Trans } from "@lingui/react/macro"
+import {
+	type ColumnFiltersState,
+	flexRender,
+	getCoreRowModel,
+	getFilteredRowModel,
+	getSortedRowModel,
+	type Row,
+	type SortingState,
+	type Table as TableType,
+	useReactTable,
+	type VisibilityState,
+} from "@tanstack/react-table"
+import { useVirtualizer, type VirtualItem } from "@tanstack/react-virtual"
+import { memo, useMemo, useRef, useState } from "react"
+import { getProbeColumns } from "@/components/network-probes-table/network-probes-columns"
+import { Card, CardHeader, CardTitle } from "@/components/ui/card"
+import { Input } from "@/components/ui/input"
+import { TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table"
+import { isReadOnlyUser } from "@/lib/api"
+import { $allSystemsById } from "@/lib/stores"
+import { cn, getVisualStringWidth, useBrowserStorage } from "@/lib/utils"
+import type { NetworkProbeRecord } from "@/types"
+import { AddProbeDialog } from "./probe-dialog"
+
+export default function NetworkProbesTableNew({
+	systemId,
+	probes,
+}: {
+	systemId?: string
+	probes: NetworkProbeRecord[]
+}) {
+	const [sorting, setSorting] = useBrowserStorage<SortingState>(
+		`sort-np-${systemId ? 1 : 0}`,
+		[{ id: systemId ? "name" : "system", desc: false }],
+		sessionStorage
+	)
+	const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([])
+	const [columnVisibility, setColumnVisibility] = useState<VisibilityState>({})
+	const [globalFilter, setGlobalFilter] = useState("")
+
+	const { longestName, longestTarget } = useMemo(() => {
+		let longestName = 0
+		let longestTarget = 0
+		for (const p of probes) {
+			longestName = Math.max(longestName, getVisualStringWidth(p.name || p.target))
+			longestTarget = Math.max(longestTarget, getVisualStringWidth(p.target))
+		}
+		return { longestName, longestTarget }
+	}, [probes])
+
+	// Filter columns based on whether systemId is provided
+	const columns = useMemo(() => {
+		let columns = getProbeColumns(longestName, longestTarget)
+		columns = systemId ? columns.filter((col) => col.id !== "system") : columns
+		columns = isReadOnlyUser() ? columns.filter((col) => col.id !== "actions") : columns
+		return columns
+	}, [systemId, longestName, longestTarget])
+
+	const table = useReactTable({
+		data: probes,
+		columns,
+		getCoreRowModel: getCoreRowModel(),
+		getSortedRowModel: getSortedRowModel(),
+		getFilteredRowModel: getFilteredRowModel(),
+		onSortingChange: setSorting,
+		onColumnFiltersChange: setColumnFilters,
+		onColumnVisibilityChange: setColumnVisibility,
+		defaultColumn: {
+			sortUndefined: "last",
+			size: 900,
+			minSize: 0,
+		},
+		state: {
+			sorting,
+			columnFilters,
+			columnVisibility,
+			globalFilter,
+		},
+		onGlobalFilterChange: setGlobalFilter,
+		globalFilterFn: (row, _columnId, filterValue) => {
+			const probe = row.original
+			const systemName = $allSystemsById.get()[probe.system]?.name ?? ""
+			const searchString = `${probe.name}${probe.target}${probe.protocol}${systemName}`.toLocaleLowerCase()
+			return (filterValue as string)
+				.toLowerCase()
+				.split(" ")
+				.every((term) => searchString.includes(term))
+		},
+	})
+
+	const rows = table.getRowModel().rows
+	const visibleColumns = table.getVisibleLeafColumns()
+
+	return (
+		<Card className="@container w-full px-3 py-5 sm:py-6 sm:px-6">
+			<CardHeader className="p-0 mb-3 sm:mb-4">
+				<div className="grid md:flex gap-x-5 gap-y-3 w-full items-end">
+					<div className="px-2 sm:px-1">
+						<CardTitle className="mb-2">
+							<Trans>Network Probes</Trans>
+						</CardTitle>
+						<div className="text-sm text-muted-foreground flex items-center flex-wrap">
+							<Trans>ICMP/TCP/HTTP latency monitoring from agents</Trans>
+						</div>
+					</div>
+					<div className="md:ms-auto flex items-center gap-2">
+						{probes.length > 0 && (
+							<Input
+								placeholder={t`Filter...`}
+								value={globalFilter}
+								onChange={(e) => setGlobalFilter(e.target.value)}
+								className="ms-auto px-4 w-full max-w-full md:w-64"
+							/>
+						)}
+						{!isReadOnlyUser() ? <AddProbeDialog systemId={systemId} /> : null}
+					</div>
+				</div>
+			</CardHeader>
+			<div className="rounded-md">
+				<NetworkProbesTable table={table} rows={rows} colLength={visibleColumns.length} />
+			</div>
+		</Card>
+	)
+}
+
+const NetworkProbesTable = memo(function NetworkProbeTable({
+	table,
+	rows,
+	colLength,
+}: {
+	table: TableType<NetworkProbeRecord>
+	rows: Row<NetworkProbeRecord>[]
+	colLength: number
+}) {
+	// The virtualizer will need a reference to the scrollable container element
+	const scrollRef = useRef<HTMLDivElement>(null)
+
+	const virtualizer = useVirtualizer<HTMLDivElement, HTMLTableRowElement>({
+		count: rows.length,
+		estimateSize: () => 54,
+		getScrollElement: () => scrollRef.current,
+		overscan: 5,
+	})
+	const virtualRows = virtualizer.getVirtualItems()
+
+	const paddingTop = Math.max(0, virtualRows[0]?.start ?? 0 - virtualizer.options.scrollMargin)
+	const paddingBottom = Math.max(0, virtualizer.getTotalSize() - (virtualRows[virtualRows.length - 1]?.end ?? 0))
+
+	return (
+		<div
+			className={cn(
+				"h-min max-h-[calc(100dvh-17rem)] max-w-full relative overflow-auto border rounded-md",
+				// don't set min height if there are less than 2 rows, do set if we need to display the empty state
+				(!rows.length || rows.length > 2) && "min-h-50"
+			)}
+			ref={scrollRef}
+		>
+			{/* add header height to table size */}
+			<div style={{ height: `${virtualizer.getTotalSize() + 48}px`, paddingTop, paddingBottom }}>
+				<table className="text-sm w-full h-full text-nowrap">
+					<NetworkProbeTableHead table={table} />
+					<TableBody>
+						{rows.length ? (
+							virtualRows.map((virtualRow) => {
+								const row = rows[virtualRow.index]
+								return <NetworkProbeTableRow key={row.id} row={row} virtualRow={virtualRow} />
+							})
+						) : (
+							<TableRow>
+								<TableCell colSpan={colLength} className="h-37 text-center pointer-events-none">
+									<Trans>No results.</Trans>
+								</TableCell>
+							</TableRow>
+						)}
+					</TableBody>
+				</table>
+			</div>
+		</div>
+	)
+})
+
+function NetworkProbeTableHead({ table }: { table: TableType<NetworkProbeRecord> }) {
+	return (
+		<TableHeader className="sticky top-0 z-50 w-full border-b-2">
+			{table.getHeaderGroups().map((headerGroup) => (
+				<tr key={headerGroup.id}>
+					{headerGroup.headers.map((header) => {
+						return (
+							<TableHead className="px-2" key={header.id}>
+								{header.isPlaceholder ? null : flexRender(header.column.columnDef.header, header.getContext())}
+							</TableHead>
+						)
+					})}
+				</tr>
+			))}
+		</TableHeader>
+	)
+}
+
+const NetworkProbeTableRow = memo(function NetworkProbeTableRow({
+	row,
+	virtualRow,
+}: {
+	row: Row<NetworkProbeRecord>
+	virtualRow: VirtualItem
+}) {
+	return (
+		<TableRow data-state={row.getIsSelected() && "selected"} className="transition-opacity">
+			{row.getVisibleCells().map((cell) => (
+				<TableCell
+					key={cell.id}
+					className="py-0"
+					style={{
+						width: `${cell.column.getSize()}px`,
+						height: virtualRow.size,
+					}}
+				>
+					{flexRender(cell.column.columnDef.cell, cell.getContext())}
+				</TableCell>
+			))}
+		</TableRow>
+	)
+})

internal/site/src/components/network-probes-table/probe-dialog.tsx

@@ -0,0 +1,178 @@
+import { useState } from "react"
+import { Trans, useLingui } from "@lingui/react/macro"
+import { useStore } from "@nanostores/react"
+import { pb } from "@/lib/api"
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+	DialogTrigger,
+} from "@/components/ui/dialog"
+import { Button } from "@/components/ui/button"
+import { Input } from "@/components/ui/input"
+import { Label } from "@/components/ui/label"
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select"
+import { PlusIcon } from "lucide-react"
+import { useToast } from "@/components/ui/use-toast"
+import { $systems } from "@/lib/stores"
+
+export function AddProbeDialog({ systemId }: { systemId?: string }) {
+	const [open, setOpen] = useState(false)
+	const [protocol, setProtocol] = useState<string>("icmp")
+	const [target, setTarget] = useState("")
+	const [port, setPort] = useState("")
+	const [probeInterval, setProbeInterval] = useState("30")
+	const [name, setName] = useState("")
+	const [loading, setLoading] = useState(false)
+	const [selectedSystemId, setSelectedSystemId] = useState("")
+	const systems = useStore($systems)
+	const { toast } = useToast()
+	const { t } = useLingui()
+	const targetName = target.replace(/^https?:\/\//, "")
+
+	const resetForm = () => {
+		setProtocol("icmp")
+		setTarget("")
+		setPort("")
+		setProbeInterval("30")
+		setName("")
+		setSelectedSystemId("")
+	}
+
+	const handleSubmit = async (e: React.FormEvent) => {
+		e.preventDefault()
+		setLoading(true)
+		try {
+			await pb.collection("network_probes").create({
+				system: systemId ?? selectedSystemId,
+				name: name || targetName,
+				target,
+				protocol,
+				port: protocol === "tcp" ? Number(port) : 0,
+				interval: Number(probeInterval),
+				enabled: true,
+			})
+			resetForm()
+			setOpen(false)
+		} catch (err: unknown) {
+			toast({ variant: "destructive", title: t`Error`, description: (err as Error)?.message })
+		} finally {
+			setLoading(false)
+		}
+	}
+
+	return (
+		<Dialog open={open} onOpenChange={setOpen}>
+			<DialogTrigger asChild>
+				<Button variant="outline">
+					<PlusIcon className="size-4 me-1" />
+					<Trans>Add {{ foo: t`Probe` }}</Trans>
+				</Button>
+			</DialogTrigger>
+			<DialogContent className="max-w-md">
+				<DialogHeader>
+					<DialogTitle>
+						<Trans>Add {{ foo: t`Network Probe` }}</Trans>
+					</DialogTitle>
+					<DialogDescription>
+						<Trans>Configure latency monitoring from this agent.</Trans>
+					</DialogDescription>
+				</DialogHeader>
+				<form onSubmit={handleSubmit} className="grid gap-4 tabular-nums">
+					{!systemId && (
+						<div className="grid gap-2">
+							<Label>
+								<Trans>System</Trans>
+							</Label>
+							<Select value={selectedSystemId} onValueChange={setSelectedSystemId} required>
+								<SelectTrigger>
+									<SelectValue placeholder={t`Select a system`} />
+								</SelectTrigger>
+								<SelectContent>
+									{systems.map((sys) => (
+										<SelectItem key={sys.id} value={sys.id}>
+											{sys.name}
+										</SelectItem>
+									))}
+								</SelectContent>
+							</Select>
+						</div>
+					)}
+					<div className="grid gap-2">
+						<Label>
+							<Trans>Target</Trans>
+						</Label>
+						<Input
+							value={target}
+							onChange={(e) => setTarget(e.target.value)}
+							placeholder={protocol === "http" ? "https://example.com" : "1.1.1.1"}
+							required
+						/>
+					</div>
+					<div className="grid gap-2">
+						<Label>
+							<Trans>Protocol</Trans>
+						</Label>
+						<Select value={protocol} onValueChange={setProtocol}>
+							<SelectTrigger>
+								<SelectValue />
+							</SelectTrigger>
+							<SelectContent>
+								<SelectItem value="icmp">ICMP</SelectItem>
+								<SelectItem value="tcp">TCP</SelectItem>
+								<SelectItem value="http">HTTP</SelectItem>
+							</SelectContent>
+						</Select>
+					</div>
+					{protocol === "tcp" && (
+						<div className="grid gap-2">
+							<Label>
+								<Trans>Port</Trans>
+							</Label>
+							<Input
+								type="number"
+								value={port}
+								onChange={(e) => setPort(e.target.value)}
+								placeholder="443"
+								min={1}
+								max={65535}
+								required
+							/>
+						</div>
+					)}
+					<div className="grid gap-2">
+						<Label>
+							<Trans>Interval (seconds)</Trans>
+						</Label>
+						<Input
+							type="number"
+							value={probeInterval}
+							onChange={(e) => setProbeInterval(e.target.value)}
+							min={1}
+							max={3600}
+							required
+						/>
+					</div>
+					<div className="grid gap-2">
+						<Label>
+							<Trans>Name (optional)</Trans>
+						</Label>
+						<Input
+							value={name}
+							onChange={(e) => setName(e.target.value)}
+							placeholder={targetName || t`e.g. Cloudflare DNS`}
+						/>
+					</div>
+					<DialogFooter>
+						<Button type="submit" disabled={loading || (!systemId && !selectedSystemId)}>
+							{loading ? <Trans>Creating...</Trans> : <Trans>Add {{ foo: t`Probe` }}</Trans>}
+						</Button>
+					</DialogFooter>
+				</form>
+			</DialogContent>
+		</Dialog>
+	)
+}

internal/site/src/components/router.tsx

@@ -4,6 +4,7 @@ const routes = {
 	home: "/",
 	containers: "/containers",
 	smart: "/smart",
+	probes: "/probes",
 	system: `/system/:id`,
 	settings: `/settings/:name?`,
 	forgot_password: `/forgot-password`,

internal/site/src/components/routes/probes.tsx

@@ -0,0 +1,25 @@
+import { useLingui } from "@lingui/react/macro"
+import { memo, useEffect } from "react"
+import NetworkProbesTableNew from "@/components/network-probes-table/network-probes-table"
+import { ActiveAlerts } from "@/components/active-alerts"
+import { FooterRepoLink } from "@/components/footer-repo-link"
+import { useNetworkProbesData } from "@/lib/use-network-probes"
+
+export default memo(() => {
+	const { t } = useLingui()
+	const { probes } = useNetworkProbesData({})
+
+	useEffect(() => {
+		document.title = `${t`Network Probes`} / Beszel`
+	}, [t])
+
+	return (
+		<>
+			<div className="grid gap-4">
+				<ActiveAlerts />
+				<NetworkProbesTableNew probes={probes} />
+			</div>
+			<FooterRepoLink />
+		</>
+	)
+})

internal/site/src/components/routes/settings/notifications.tsx

@@ -15,6 +15,7 @@ import { isAdmin, pb } from "@/lib/api"
 import type { UserSettings } from "@/types"
 import { saveSettings } from "./layout"
 import { QuietHours } from "./quiet-hours"
+import type { ClientResponseError } from "pocketbase"
 
 interface ShoutrrrUrlCardProps {
 	url: string
@@ -59,10 +60,10 @@ const SettingsNotificationsPage = ({ userSettings }: { userSettings: UserSetting
 		try {
 			const parsedData = v.parse(NotificationSchema, { emails, webhooks })
 			await saveSettings(parsedData)
-		} catch (e: any) {
+		} catch (e: unknown) {
 			toast({
 				title: t`Failed to save settings`,
-				description: e.message,
+				description: (e as Error).message,
 				variant: "destructive",
 			})
 		}
@@ -136,12 +137,7 @@ const SettingsNotificationsPage = ({ userSettings }: { userSettings: UserSetting
 								</Trans>
 							</p>
 						</div>
-						<Button
+						<Button type="button" variant="outline" className="h-10 shrink-0" onClick={addWebhook}>
-							type="button"
-							variant="outline"
-							className="h-10 shrink-0"
-							onClick={addWebhook}
-						>
 							<PlusIcon className="size-4" />
 							<span className="ms-1">
 								<Trans>Add URL</Trans>
@@ -180,11 +176,20 @@ const SettingsNotificationsPage = ({ userSettings }: { userSettings: UserSetting
 	)
 }
 
+function showTestNotificationError(msg: string) {
+	toast({
+		title: t`Error`,
+		description: msg ?? t`Failed to send test notification`,
+		variant: "destructive",
+	})
+}
+
 const ShoutrrrUrlCard = ({ url, onUrlChange, onRemove }: ShoutrrrUrlCardProps) => {
 	const [isLoading, setIsLoading] = useState(false)
 
 	const sendTestNotification = async () => {
 		setIsLoading(true)
+		try {
 			const res = await pb.send("/api/beszel/test-notification", { method: "POST", body: { url } })
 			if ("err" in res && !res.err) {
 				toast({
@@ -192,14 +197,14 @@ const ShoutrrrUrlCard = ({ url, onUrlChange, onRemove }: ShoutrrrUrlCardProps) =
 					description: t`Check your notification service`,
 				})
 			} else {
-			toast({
+				showTestNotificationError(res.err)
-				title: t`Error`,
-				description: res.err ?? t`Failed to send test notification`,
-				variant: "destructive",
-			})
 			}
+		} catch (e: unknown) {
+			showTestNotificationError((e as ClientResponseError).data?.message)
+		} finally {
 			setIsLoading(false)
 		}
+	}
 
 	return (
 		<Card className="bg-table-header p-2 md:p-3">

internal/site/src/components/routes/system.tsx

@@ -11,9 +11,9 @@ import { RootDiskCharts, ExtraFsCharts } from "./system/charts/disk-charts"
 import { BandwidthChart, ContainerNetworkChart } from "./system/charts/network-charts"
 import { TemperatureChart, BatteryChart } from "./system/charts/sensor-charts"
 import { GpuPowerChart, GpuDetailCharts } from "./system/charts/gpu-charts"
-import { LazyContainersTable, LazySmartTable, LazySystemdTable } from "./system/lazy-tables"
+import { LazyContainersTable, LazySmartTable, LazySystemdTable, LazyNetworkProbesTable } from "./system/lazy-tables"
 import { LoadAverageChart } from "./system/charts/load-average-chart"
-import { ContainerIcon, CpuIcon, HardDriveIcon, TerminalSquareIcon } from "lucide-react"
+import { ContainerIcon, CpuIcon, HardDriveIcon, NetworkIcon, TerminalSquareIcon } from "lucide-react"
 import { GpuIcon } from "../ui/icons"
 import SystemdTable from "../systemd-table/systemd-table"
 import ContainersTable from "../containers-table/containers-table"
@@ -65,7 +65,7 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 	const hasGpu = hasGpuData || hasGpuPowerData
 
 	// keep tabsRef in sync for keyboard navigation
-	const tabs = ["core", "disk"]
+	const tabs = ["core", "network", "disk"]
 	if (hasGpu) tabs.push("gpu")
 	if (hasContainers) tabs.push("containers")
 	if (hasSystemd) tabs.push("services")
@@ -145,6 +145,8 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 				{hasContainersTable && <LazyContainersTable systemId={system.id} />}
 
 				{hasSystemd && <LazySystemdTable systemId={system.id} />}
+
+				<LazyNetworkProbesTable systemId={system.id} systemData={systemData} />
 			</>
 		)
 	}
@@ -157,6 +159,10 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 						<CpuIcon className="size-3.5" />
 						<Trans context="Core system metrics">Core</Trans>
 					</TabsTrigger>
+					<TabsTrigger value="network" className="w-full flex items-center gap-1.5">
+						<NetworkIcon className="size-3.5" />
+						<Trans>Network</Trans>
+					</TabsTrigger>
 					<TabsTrigger value="disk" className="w-full flex items-center gap-1.5">
 						<HardDriveIcon className="size-3.5" />
 						<Trans>Disk</Trans>
@@ -184,16 +190,26 @@ export default memo(function SystemDetail({ id }: { id: string }) {
 				<TabsContent value="core" forceMount className={activeTab === "core" ? "contents" : "hidden"}>
 					<div className="grid xl:grid-cols-2 gap-4">
 						<CpuChart {...coreProps} />
-						<MemoryChart {...coreProps} />
 						<LoadAverageChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} />
-						<BandwidthChart {...coreProps} systemStats={systemStats} />
+						<MemoryChart {...coreProps} />
+						<SwapChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} systemStats={systemStats} />
 						<TemperatureChart {...coreProps} setPageBottomExtraMargin={setPageBottomExtraMargin} />
 						<BatteryChart {...coreProps} />
-						<SwapChart chartData={chartData} grid={grid} dataEmpty={dataEmpty} systemStats={systemStats} />
 						{pageBottomExtraMargin > 0 && <div style={{ marginBottom: pageBottomExtraMargin }}></div>}
 					</div>
 				</TabsContent>
 
+				<TabsContent value="network" forceMount className={activeTab === "network" ? "contents" : "hidden"}>
+					{mountedTabs.has("network") && (
+						<>
+							<div className="grid xl:grid-cols-2 gap-4">
+								<BandwidthChart {...coreProps} systemStats={systemStats} />
+							</div>
+							<LazyNetworkProbesTable systemId={system.id} systemData={systemData} />
+						</>
+					)}
+				</TabsContent>
+
 				<TabsContent value="disk" forceMount className={activeTab === "disk" ? "contents" : "hidden"}>
 					{mountedTabs.has("disk") && (
 						<>

internal/site/src/components/routes/system/chart-data.ts

@@ -1,7 +1,6 @@
-import { timeTicks } from "d3-time"
 import { getPbTimestamp, pb } from "@/lib/api"
 import { chartTimeData } from "@/lib/utils"
-import type { ChartData, ChartTimes, ContainerStatsRecord, SystemStatsRecord } from "@/types"
+import type { ChartData, ChartTimes, ContainerStatsRecord, NetworkProbeStatsRecord, SystemStatsRecord } from "@/types"
 
 type ChartTimeData = {
 	time: number
@@ -17,27 +16,6 @@ export const cache = new Map<
 	ChartTimeData | SystemStatsRecord[] | ContainerStatsRecord[] | ChartData["containerData"]
 >()
 
-// create ticks and domain for charts
-export function getTimeData(chartTime: ChartTimes, lastCreated: number) {
-	const cached = cache.get("td") as ChartTimeData | undefined
-	if (cached && cached.chartTime === chartTime) {
-		if (!lastCreated || cached.time >= lastCreated) {
-			return cached.data
-		}
-	}
-
-	// const buffer = chartTime === "1m" ? 400 : 20_000
-	const now = new Date(Date.now())
-	const startTime = chartTimeData[chartTime].getOffset(now)
-	const ticks = timeTicks(startTime, now, chartTimeData[chartTime].ticks ?? 12).map((date) => date.getTime())
-	const data = {
-		ticks,
-		domain: [chartTimeData[chartTime].getOffset(now).getTime(), now.getTime()],
-	}
-	cache.set("td", { time: now.getTime(), data, chartTime })
-	return data
-}
-
 /** Append new records onto prev with gap detection. Converts string `created` values to ms timestamps in place.
  * Pass `maxLen` to cap the result length in one copy instead of slicing again after the call. */
 export function appendData<T extends { created: string | number | null }>(
@@ -66,12 +44,12 @@ export function appendData<T extends { created: string | number | null }>(
 	return result
 }
 
-export async function getStats<T extends SystemStatsRecord | ContainerStatsRecord>(
+export async function getStats<T extends SystemStatsRecord | ContainerStatsRecord | NetworkProbeStatsRecord>(
 	collection: string,
 	systemId: string,
-	chartTime: ChartTimes
+	chartTime: ChartTimes,
+	cachedStats?: { created: string | number | null }[]
 ): Promise<T[]> {
-	const cachedStats = cache.get(`${systemId}_${chartTime}_${collection}`) as T[] | undefined
 	const lastCached = cachedStats?.at(-1)?.created as number
 	return await pb.collection<T>(collection).getFullList({
 		filter: pb.filter("system={:id} && created > {:created} && type={:type}", {

internal/site/src/components/routes/system/charts/probes-charts.tsx

@@ -0,0 +1,153 @@
+import LineChartDefault from "@/components/charts/line-chart"
+import type { DataPoint } from "@/components/charts/line-chart"
+import { toFixedFloat, decimalString } from "@/lib/utils"
+import { useLingui } from "@lingui/react/macro"
+import { ChartCard, FilterBar } from "../chart-card"
+import type { ChartData, NetworkProbeRecord, NetworkProbeStatsRecord } from "@/types"
+import { useMemo } from "react"
+import { atom } from "nanostores"
+import { useStore } from "@nanostores/react"
+import { probeKey } from "@/lib/use-network-probes"
+
+const $filter = atom("")
+
+type ProbeChartProps = {
+	probeStats: NetworkProbeStatsRecord[]
+	grid?: boolean
+	probes: NetworkProbeRecord[]
+	chartData: ChartData
+	empty: boolean
+}
+
+type ProbeChartBaseProps = ProbeChartProps & {
+	valueIndex: number
+	title: string
+	description: string
+	tickFormatter: (value: number) => string
+	contentFormatter: ({ value }: { value: number | string }) => string | number
+	domain?: [number | "auto", number | "auto"]
+}
+
+function ProbeChart({
+	probeStats,
+	grid,
+	probes,
+	chartData,
+	empty,
+	valueIndex,
+	title,
+	description,
+	tickFormatter,
+	contentFormatter,
+	domain,
+}: ProbeChartBaseProps) {
+	const filter = useStore($filter)
+
+	const { dataPoints, visibleKeys } = useMemo(() => {
+		const sortedProbes = [...probes].sort((a, b) => b.latency - a.latency)
+		const count = sortedProbes.length
+		const points: DataPoint<NetworkProbeStatsRecord>[] = []
+		const visibleKeys: string[] = []
+		const filterTerms = filter
+			? filter
+					.toLowerCase()
+					.split(" ")
+					.filter((term) => term.length > 0)
+			: []
+		for (let i = 0; i < count; i++) {
+			const p = sortedProbes[i]
+			const key = probeKey(p)
+			const filtered = filterTerms.length > 0 && !filterTerms.some((term) => key.toLowerCase().includes(term))
+			if (filtered) {
+				continue
+			}
+			visibleKeys.push(key)
+			points.push({
+				order: i,
+				label: p.name || p.target,
+				dataKey: (record: NetworkProbeStatsRecord) => record.stats?.[key]?.[valueIndex] ?? "-",
+				color: count <= 5 ? i + 1 : `hsl(${(i * 360) / count}, var(--chart-saturation), var(--chart-lightness))`,
+			})
+		}
+		return { dataPoints: points, visibleKeys }
+	}, [probes, filter, valueIndex])
+
+	const filteredProbeStats = useMemo(() => {
+		if (!visibleKeys.length) return probeStats
+		return probeStats.filter((record) => visibleKeys.some((key) => record.stats?.[key] != null))
+	}, [probeStats, visibleKeys])
+
+	const legend = dataPoints.length < 10
+
+	return (
+		<ChartCard
+			legend={legend}
+			cornerEl={<FilterBar store={$filter} />}
+			empty={empty}
+			title={title}
+			description={description}
+			grid={grid}
+		>
+			<LineChartDefault
+				chartData={chartData}
+				customData={filteredProbeStats}
+				dataPoints={dataPoints}
+				domain={domain ?? ["auto", "auto"]}
+				connectNulls
+				tickFormatter={tickFormatter}
+				contentFormatter={contentFormatter}
+				legend={legend}
+				filter={filter}
+			/>
+		</ChartCard>
+	)
+}
+
+export function LatencyChart({ probeStats, grid, probes, chartData, empty }: ProbeChartProps) {
+	const { t } = useLingui()
+
+	return (
+		<ProbeChart
+			probeStats={probeStats}
+			grid={grid}
+			probes={probes}
+			chartData={chartData}
+			empty={empty}
+			valueIndex={0}
+			title={t`Latency`}
+			description={t`Average round-trip time (ms)`}
+			tickFormatter={(value) => `${toFixedFloat(value, value >= 10 ? 0 : 1)} ms`}
+			contentFormatter={({ value }) => {
+				if (typeof value !== "number") {
+					return value
+				}
+				return `${decimalString(value, 2)} ms`
+			}}
+		/>
+	)
+}
+
+export function LossChart({ probeStats, grid, probes, chartData, empty }: ProbeChartProps) {
+	const { t } = useLingui()
+
+	return (
+		<ProbeChart
+			probeStats={probeStats}
+			grid={grid}
+			probes={probes}
+			chartData={chartData}
+			empty={empty}
+			valueIndex={3}
+			title={t`Loss`}
+			description={t`Packet loss (%)`}
+			domain={[0, 100]}
+			tickFormatter={(value) => `${toFixedFloat(value, value >= 10 ? 0 : 1)}%`}
+			contentFormatter={({ value }) => {
+				if (typeof value !== "number") {
+					return value
+				}
+				return `${decimalString(value, 2)}%`
+			}}
+		/>
+	)
+}

internal/site/src/components/routes/system/lazy-tables.tsx

@@ -1,6 +1,11 @@
 import { lazy } from "react"
 import { useIntersectionObserver } from "@/lib/use-intersection-observer"
 import { cn } from "@/lib/utils"
+import { LatencyChart, LossChart } from "./charts/probes-charts"
+import type { SystemData } from "./use-system-data"
+import { $chartTime } from "@/lib/stores"
+import { useStore } from "@nanostores/react"
+import { useNetworkProbesData } from "@/lib/use-network-probes"
 
 const ContainersTable = lazy(() => import("../../containers-table/containers-table"))
 
@@ -34,3 +39,46 @@ export function LazySystemdTable({ systemId }: { systemId: string }) {
 		</div>
 	)
 }
+
+const NetworkProbesTable = lazy(() => import("@/components/network-probes-table/network-probes-table"))
+
+export function LazyNetworkProbesTable({ systemId, systemData }: { systemId: string; systemData: SystemData }) {
+	const { isIntersecting, ref } = useIntersectionObserver()
+
+	return (
+		<div ref={ref} className={cn(isIntersecting && "contents")}>
+			{isIntersecting && <ProbesTable systemId={systemId} systemData={systemData} />}
+		</div>
+	)
+}
+
+function ProbesTable({ systemId, systemData }: { systemId: string; systemData: SystemData }) {
+	const { grid, chartData } = systemData ?? {}
+	const chartTime = useStore($chartTime)
+
+	const { probes, probeStats } = useNetworkProbesData({ systemId, loadStats: !!chartData, chartTime })
+
+	return (
+		<>
+			<NetworkProbesTable systemId={systemId} probes={probes} />
+			{!!chartData && !!probes.length && (
+				<div className="grid xl:grid-cols-2 gap-4">
+					<LatencyChart
+						probeStats={probeStats}
+						grid={grid}
+						probes={probes}
+						chartData={chartData}
+						empty={!probeStats.length}
+					/>
+					<LossChart
+						probeStats={probeStats}
+						grid={grid}
+						probes={probes}
+						chartData={chartData}
+						empty={!probeStats.length}
+					/>
+				</div>
+			)}
+		</>
+	)
+}

internal/site/src/components/routes/system/use-system-data.ts

@@ -26,7 +26,7 @@ import type {
 	SystemStatsRecord,
 } from "@/types"
 import { $router, navigate } from "../../router"
-import { appendData, cache, getStats, getTimeData, makeContainerData, makeContainerPoint } from "./chart-data"
+import { appendData, cache, getStats, makeContainerData, makeContainerPoint } from "./chart-data"
 
 export type SystemData = ReturnType<typeof useSystemData>
 
@@ -151,16 +151,11 @@ export function useSystemData(id: string) {
 	const agentVersion = useMemo(() => parseSemVer(system?.info?.v), [system?.info?.v])
 
 	const chartData: ChartData = useMemo(() => {
-		const lastCreated = Math.max(
-			(systemStats.at(-1)?.created as number) ?? 0,
-			(containerData.at(-1)?.created as number) ?? 0
-		)
 		return {
 			systemStats,
 			containerData,
 			chartTime,
 			orientation: direction === "rtl" ? "right" : "left",
-			...getTimeData(chartTime, lastCreated),
 			agentVersion,
 		}
 	}, [systemStats, containerData, direction])
@@ -200,8 +195,8 @@ export function useSystemData(id: string) {
 		}
 
 		Promise.allSettled([
-			getStats<SystemStatsRecord>("system_stats", systemId, chartTime),
+			getStats<SystemStatsRecord>("system_stats", systemId, chartTime, cachedSystemStats),
-			getStats<ContainerStatsRecord>("container_stats", systemId, chartTime),
+			getStats<ContainerStatsRecord>("container_stats", systemId, chartTime, cachedContainerData),
 		]).then(([systemStats, containerStats]) => {
 			// If another request has been made since this one, ignore the results
 			if (requestId !== statsRequestId.current) {

internal/site/src/components/systems-table/systems-table-columns.tsx

@@ -110,20 +110,23 @@ export function SystemsTableColumns(viewMode: "table" | "grid"): ColumnDef<Syste
 
 				// match filter value against name or translated status
 				return (row, _, newFilterInput) => {
-					const { name, status } = row.original
+					const sys = row.original
+					if (sys.host.includes(newFilterInput) || sys.info.v?.includes(newFilterInput)) {
+						return true
+					}
 					if (newFilterInput !== filterInput) {
 						filterInput = newFilterInput
 						filterInputLower = newFilterInput.toLowerCase()
 					}
-					let nameLower = nameCache.get(name)
+					let nameLower = nameCache.get(sys.name)
 					if (nameLower === undefined) {
-						nameLower = name.toLowerCase()
+						nameLower = sys.name.toLowerCase()
-						nameCache.set(name, nameLower)
+						nameCache.set(sys.name, nameLower)
 					}
 					if (nameLower.includes(filterInputLower)) {
 						return true
 					}
-					const statusLower = statusTranslations[status as keyof typeof statusTranslations]
+					const statusLower = statusTranslations[sys.status as keyof typeof statusTranslations]
 					return statusLower?.includes(filterInputLower) || false
 				}
 			})(),

internal/site/src/components/ui/chart.tsx

@@ -3,9 +3,10 @@ import { useLingui } from "@lingui/react/macro"
 import * as React from "react"
 import * as RechartsPrimitive from "recharts"
 import { chartTimeData, cn } from "@/lib/utils"
-import type { ChartData } from "@/types"
+import type { ChartTimes } from "@/types"
 import { Separator } from "./separator"
 import { AxisDomain } from "recharts/types/util/types"
+import { timeTicks } from "d3-time"
 
 // Format: { THEME_NAME: CSS_SELECTOR }
 const THEMES = { light: "", dark: ".dark" } as const
@@ -400,12 +401,22 @@ function getPayloadConfigFromPayload(config: ChartConfig, payload: unknown, key:
 	return configLabelKey in config ? config[configLabelKey] : config[key as keyof typeof config]
 }
 
-let cachedAxis: JSX.Element
+let cachedAxis: {
-const xAxis = ({ domain, ticks, chartTime }: ChartData) => {
+	time: number
-	if (cachedAxis && domain[0] === cachedAxis.props.domain[0]) {
+	el: JSX.Element
-		return cachedAxis
 }
-	cachedAxis = (
+
+const xAxis = (chartTime: ChartTimes, lastCreationTime: number) => {
+	if (Math.abs(lastCreationTime - cachedAxis?.time) < 1000) {
+		return cachedAxis.el
+	}
+	const now = new Date(lastCreationTime + 1000)
+	const startTime = chartTimeData[chartTime].getOffset(now)
+	const ticks = timeTicks(startTime, now, chartTimeData[chartTime].ticks ?? 12).map((date) => date.getTime())
+	const domain = [chartTimeData[chartTime].getOffset(now).getTime(), now.getTime()]
+	cachedAxis = {
+		time: lastCreationTime,
+		el: (
 			<RechartsPrimitive.XAxis
 				dataKey="created"
 				domain={domain}
@@ -418,8 +429,9 @@ const xAxis = ({ domain, ticks, chartTime }: ChartData) => {
 				axisLine={false}
 				tickFormatter={chartTimeData[chartTime].format}
 			/>
-	)
+		),
-	return cachedAxis
+	}
+	return cachedAxis.el
 }
 
 export {

internal/site/src/lib/use-network-probes.ts

@@ -0,0 +1,319 @@
+import { chartTimeData } from "@/lib/utils"
+import type { ChartTimes, NetworkProbeRecord, NetworkProbeStatsRecord } from "@/types"
+import { useEffect, useRef, useState } from "react"
+import { getStats, appendData } from "@/components/routes/system/chart-data"
+import { pb } from "@/lib/api"
+import { toast } from "@/components/ui/use-toast"
+import type { RecordListOptions, RecordSubscription } from "pocketbase"
+
+const cache = new Map<string, NetworkProbeStatsRecord[]>()
+
+function getCacheValue(systemId: string, chartTime: ChartTimes | "rt") {
+	return cache.get(`${systemId}${chartTime}`) || []
+}
+
+function appendCacheValue(
+	systemId: string,
+	chartTime: ChartTimes | "rt",
+	newStats: NetworkProbeStatsRecord[],
+	maxPoints = 100
+) {
+	const cache_key = `${systemId}${chartTime}`
+	const existingStats = getCacheValue(systemId, chartTime)
+	if (existingStats) {
+		const { expectedInterval } = chartTimeData[chartTime]
+		const updatedStats = appendData(existingStats, newStats, expectedInterval, maxPoints)
+		cache.set(cache_key, updatedStats)
+		return updatedStats
+	} else {
+		cache.set(cache_key, newStats)
+		return newStats
+	}
+}
+
+const NETWORK_PROBE_FIELDS = "id,name,system,target,protocol,port,interval,latency,loss,enabled,updated"
+
+interface UseNetworkProbesProps {
+	systemId?: string
+	loadStats?: boolean
+	chartTime?: ChartTimes
+	existingProbes?: NetworkProbeRecord[]
+}
+
+export function useNetworkProbesData(props: UseNetworkProbesProps) {
+	const { systemId, loadStats, chartTime, existingProbes } = props
+
+	const [p, setProbes] = useState<NetworkProbeRecord[]>([])
+	const [probeStats, setProbeStats] = useState<NetworkProbeStatsRecord[]>([])
+	const statsRequestId = useRef(0)
+	const pendingProbeEvents = useRef(new Map<string, RecordSubscription<NetworkProbeRecord>>())
+	const probeBatchTimeout = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+	const probes = existingProbes ?? p
+
+	// clear old data when systemId changes
+	// useEffect(() => {
+	// 	return setProbes([])
+	// }, [systemId])
+
+	// initial load - fetch probes if not provided by caller
+	useEffect(() => {
+		if (!existingProbes) {
+			fetchProbes(systemId).then((probes) => setProbes(probes))
+		}
+	}, [systemId])
+
+	// Subscribe to updates if probes not provided by caller
+	useEffect(() => {
+		if (existingProbes) {
+			return
+		}
+		let unsubscribe: (() => void) | undefined
+
+		function flushPendingProbeEvents() {
+			probeBatchTimeout.current = null
+			if (!pendingProbeEvents.current.size) {
+				return
+			}
+			const events = pendingProbeEvents.current
+			pendingProbeEvents.current = new Map()
+			setProbes((currentProbes) => {
+				return applyProbeEvents(currentProbes ?? [], events.values(), systemId)
+			})
+		}
+
+		const pbOptions: RecordListOptions = { fields: NETWORK_PROBE_FIELDS }
+		if (systemId) {
+			pbOptions.filter = pb.filter("system = {:system}", { system: systemId })
+		}
+
+		;(async () => {
+			try {
+				unsubscribe = await pb.collection<NetworkProbeRecord>("network_probes").subscribe(
+					"*",
+					(event) => {
+						pendingProbeEvents.current.set(event.record.id, event)
+						if (!probeBatchTimeout.current) {
+							probeBatchTimeout.current = setTimeout(flushPendingProbeEvents, 50)
+						}
+					},
+					pbOptions
+				)
+			} catch (error) {
+				console.error("Failed to subscribe to probes", error)
+			}
+		})()
+
+		return () => {
+			if (probeBatchTimeout.current !== null) {
+				clearTimeout(probeBatchTimeout.current)
+				probeBatchTimeout.current = null
+			}
+			pendingProbeEvents.current.clear()
+			unsubscribe?.()
+		}
+	}, [systemId])
+
+	// Subscribe to new probe stats
+	useEffect(() => {
+		if (!loadStats || !systemId) {
+			return
+		}
+		let unsubscribe: (() => void) | undefined
+		const pbOptions = {
+			fields: "stats,created,type",
+			filter: pb.filter("system = {:system}", { system: systemId }),
+		}
+
+		;(async () => {
+			try {
+				unsubscribe = await pb.collection<NetworkProbeStatsRecord>("network_probe_stats").subscribe(
+					"*",
+					(event) => {
+						if (!chartTime || event.action !== "create") {
+							return
+						}
+						// if (typeof event.record.created === "string") {
+						// 	event.record.created = new Date(event.record.created).getTime()
+						// }
+						// return if not current chart time
+						// we could append to other chart times, but we would need to check the timestamps
+						// to make sure they fit in correctly, so for simplicity just ignore non-chart-time updates
+						// and fetch them via API when the user switches to that chart time
+						const chartTimeRecordType = chartTimeData[chartTime].type as ChartTimes
+						if (event.record.type !== chartTimeRecordType) {
+							// const lastCreated = getCacheValue(systemId, chartTime)?.at(-1)?.created ?? 0
+							// if (lastCreated) {
+							// 	// if the new record is close enough to the last cached record, append it to the cache so it's available immediately if the user switches to that chart time
+							// 	const { expectedInterval } = chartTimeData[chartTime]
+							// 	if (event.record.created - lastCreated < expectedInterval * 1.5) {
+							// 		console.log(
+							// 			`Caching out-of-chart-time probe stats record for chart time ${chartTime} (record type: ${event.record.type})`
+							// 		)
+							// 		const newStats = appendCacheValue(systemId, chartTime, [event.record])
+							// 		cache.set(`${systemId}${chartTime}`, newStats)
+							// 	}
+							// }
+							// console.log(`Received probe stats for non-current chart time (${event.record.type}), ignoring for now`)
+							return
+						}
+
+						// console.log("Appending new probe stats to chart:", event.record)
+						const newStats = appendCacheValue(systemId, chartTime, [event.record])
+						setProbeStats(newStats)
+					},
+					pbOptions
+				)
+			} catch (error) {
+				console.error("Failed to subscribe to probe stats:", error)
+			}
+		})()
+
+		return () => unsubscribe?.()
+	}, [systemId])
+
+	// fetch missing probe stats on load and when chart time changes
+	useEffect(() => {
+		if (!loadStats || !systemId || !chartTime || chartTime === "1m") {
+			return
+		}
+
+		const { expectedInterval } = chartTimeData[chartTime]
+		const requestId = ++statsRequestId.current
+
+		const cachedProbeStats = getCacheValue(systemId, chartTime)
+
+		// Render from cache immediately if available
+		if (cachedProbeStats.length) {
+			setProbeStats(cachedProbeStats)
+
+			// Skip the fetch if the latest cached point is recent enough that no new point is expected yet
+			const lastCreated = cachedProbeStats.at(-1)?.created
+			if (lastCreated && Date.now() - lastCreated < expectedInterval * 0.9) {
+				console.log("Using cached probe stats, skipping fetch")
+				return
+			}
+		}
+
+		getStats<NetworkProbeStatsRecord>("network_probe_stats", systemId, chartTime, cachedProbeStats).then(
+			(probeStats) => {
+				// If another request has been made since this one, ignore the results
+				if (requestId !== statsRequestId.current) {
+					return
+				}
+				const newStats = appendCacheValue(systemId, chartTime, probeStats)
+				setProbeStats(newStats)
+			}
+		)
+	}, [chartTime])
+
+	// subscribe to realtime metrics if chart time is 1m
+	useEffect(() => {
+		if (!loadStats || !systemId || chartTime !== "1m") {
+			return
+		}
+		let unsubscribe: (() => void) | undefined
+		const cache_key = `${systemId}rt`
+		pb.realtime
+			.subscribe(
+				`rt_metrics`,
+				(data: { Probes: NetworkProbeStatsRecord["stats"] }) => {
+					let prev = getCacheValue(systemId, "rt")
+					const now = Date.now()
+					// if no previous data or the last data point is older than 1min,
+					// create a new data set starting with a point 1 second ago to seed the chart data
+					if (!prev || (prev.at(-1)?.created ?? 0) < now - 60_000) {
+						prev = [{ created: now - 1000, stats: probesToStats(probes) }]
+					}
+					const stats = { created: now, stats: data.Probes } as NetworkProbeStatsRecord
+					const newStats = appendData(prev, [stats], 1000, 120)
+					setProbeStats(() => newStats)
+					cache.set(cache_key, newStats)
+				},
+				{ query: { system: systemId } }
+			)
+			.then((us) => {
+				unsubscribe = us
+			})
+		return () => unsubscribe?.()
+	}, [chartTime, systemId])
+
+	return {
+		probes,
+		probeStats,
+	}
+}
+
+export function probeKey(p: NetworkProbeRecord) {
+	if (p.protocol === "tcp") return `${p.protocol}:${p.target}:${p.port}`
+	return `${p.protocol}:${p.target}`
+}
+
+function probesToStats(probes: NetworkProbeRecord[]): NetworkProbeStatsRecord["stats"] {
+	const stats: NetworkProbeStatsRecord["stats"] = {}
+	for (const probe of probes) {
+		const key = probeKey(probe)
+		stats[key] = [probe.latency, 0, 0, probe.loss]
+	}
+	return stats
+}
+
+async function fetchProbes(systemId?: string) {
+	try {
+		const res = await pb.collection<NetworkProbeRecord>("network_probes").getList(0, 2000, {
+			fields: NETWORK_PROBE_FIELDS,
+			filter: systemId ? pb.filter("system={:system}", { system: systemId }) : undefined,
+		})
+		return res.items
+	} catch (error) {
+		toast({
+			title: "Error",
+			description: (error as Error)?.message,
+			variant: "destructive",
+		})
+		return []
+	}
+}
+
+function applyProbeEvents(
+	probes: NetworkProbeRecord[],
+	events: Iterable<RecordSubscription<NetworkProbeRecord>>,
+	systemId?: string
+) {
+	// Use a map to handle updates/deletes in constant time
+	const probeById = new Map(probes.map((probe) => [probe.id, probe]))
+	const createdProbes: NetworkProbeRecord[] = []
+
+	for (const { action, record } of events) {
+		const matchesSystemScope = !systemId || record.system === systemId
+
+		if (action === "delete" || !matchesSystemScope) {
+			probeById.delete(record.id)
+			continue
+		}
+
+		if (!probeById.has(record.id)) {
+			createdProbes.push(record)
+		}
+
+		probeById.set(record.id, record)
+	}
+
+	const nextProbes: NetworkProbeRecord[] = []
+	// Prepend brand new probes (matching previous behavior)
+	for (let index = createdProbes.length - 1; index >= 0; index -= 1) {
+		nextProbes.push(createdProbes[index])
+	}
+
+	// Rebuild the final list while preserving original order for existing probes
+	for (const probe of probes) {
+		const nextProbe = probeById.get(probe.id)
+		if (!nextProbe) {
+			continue
+		}
+		nextProbes.push(nextProbe)
+		probeById.delete(probe.id)
+	}
+
+	return nextProbes
+}

internal/site/src/main.tsx

@@ -30,6 +30,7 @@ const LoginPage = lazy(() => import("@/components/login/login.tsx"))
 const Home = lazy(() => import("@/components/routes/home.tsx"))
 const Containers = lazy(() => import("@/components/routes/containers.tsx"))
 const Smart = lazy(() => import("@/components/routes/smart.tsx"))
+const Probes = lazy(() => import("@/components/routes/probes.tsx"))
 const SystemDetail = lazy(() => import("@/components/routes/system.tsx"))
 const CopyToClipboardDialog = lazy(() => import("@/components/copy-to-clipboard.tsx"))
 
@@ -79,6 +80,8 @@ const App = memo(() => {
 		return <Containers />
 	} else if (page.route === "smart") {
 		return <Smart />
+	} else if (page.route === "probes") {
+		return <Probes />
 	} else if (page.route === "settings") {
 		return <Settings />
 	}
@@ -94,18 +97,6 @@ const Layout = () => {
 		document.documentElement.dir = direction
 	}, [direction])
 
-	useEffect(() => {
-		// refresh auth if not authenticated (required for trusted auth header)
-		if (!authenticated) {
-			pb.collection("users")
-				.authRefresh()
-				.then((res) => {
-					pb.authStore.save(res.token, res.record)
-					$authenticated.set(!!pb.authStore.isValid)
-				})
-		}
-	}, [])
-
 	return (
 		<DirectionProvider dir={direction}>
 			{!authenticated ? (

internal/site/src/types.d.ts

@@ -7,6 +7,7 @@ declare global {
 		BASE_PATH: string
 		HUB_VERSION: string
 		HUB_URL: string
+		OAUTH_DISABLE_POPUP: boolean
 	}
 }
 
@@ -315,8 +316,6 @@ export interface ChartData {
 	systemStats: SystemStatsRecord[]
 	containerData: ChartDataContainer[]
 	orientation: "right" | "left"
-	ticks: number[]
-	domain: number[]
 	chartTime: ChartTimes
 }
 
@@ -545,3 +544,35 @@ export interface UpdateInfo {
 	v: string // new version
 	url: string // url to new version
 }
+
+export interface NetworkProbeRecord {
+	id: string
+	system: string
+	name: string
+	target: string
+	protocol: "icmp" | "tcp" | "http"
+	port: number
+	latency: number
+	loss: number
+	interval: number
+	enabled: boolean
+	updated: string
+}
+
+/**
+ * 0: avg latency in ms
+ *
+ * 1: min latency in ms
+ *
+ * 2: max latency in ms
+ *
+ * 3: packet loss in %
+ */
+type ProbeResult = number[]
+
+export interface NetworkProbeStatsRecord {
+	id?: string
+	type?: string
+	stats: Record<string, ProbeResult>
+	created: number // unix timestamp (ms) for Recharts xAxis
+}

internal/site/tsconfig.app.json

@@ -7,7 +7,7 @@
 		"module": "ESNext",
 		"lib": ["ES2022", "DOM", "DOM.Iterable"],
 		"skipLibCheck": true,
-		"baseUrl": ".",
+		// "baseUrl": ".",
 		"paths": {
 			"@/*": ["./src/*"]
 		},