feat: rebuild workshop

docs(helm): update chart installation page

.dockerignore

@@ -6,7 +6,14 @@ npm-debug.log
 README.md
 .next
 .turbo
+.pnpm-store
+**/.pnpm-store
+coverage
+**/coverage
+**/.docusaurus
+**/build
 .git
+.github
 dev
 .build
 e2e

.env.example

@@ -66,4 +66,6 @@ UNSAFE_ENABLE_MOCK_INTEGRATION=true
 
 # Whether demo mode is read-only. Defaults to true (the public demo blocks all mutations).
 # Set to false for writable preview deployments so the demo user can modify the dashboard.
-# DEMO_READ_ONLY=false
+# DEMO_READ_ONLY=false
+# Central Homarr Workshop API. Override only when developing the Workshop locally.
+# NEXT_PUBLIC_WORKSHOP_API_URL=http://localhost:8090

.github/act/.gitignore

@@ -0,0 +1,2 @@
+.secrets
+!.secrets.example

.github/act/.secrets.example

@@ -0,0 +1,4 @@
+TURBO_API=
+TURBO_TEAM=
+TURBO_TOKEN=
+TURBO_REMOTE_CACHE_SIGNATURE_KEY=

.github/act/README.md

@@ -0,0 +1,36 @@
+# Running CI locally
+
+Install [Act](https://nektosact.com/installation/index.html) and ensure Docker is running, then use:
+
+```bash
+pnpm ci:act:fast
+pnpm ci:act:docker
+pnpm ci:act:all
+pnpm ci:act:cleanup
+```
+
+`fast` runs the quality gate. `docker` and `all` run the gate followed by the single container build, E2E suite, and memory regression test. `cleanup` validates the manual cleanup path without calling GitHub. The wrapper supports regular clones and Git worktrees, including non-default Docker contexts. Linux dependencies are kept in Docker volumes instead of overwriting host `node_modules`. The first run downloads the Act runner and Playwright browser dependencies.
+
+Remote caching is optional locally. Copy `.github/act/.secrets.example` to `.github/act/.secrets`, populate it with rotated credentials, and run with:
+
+```bash
+ACT_SECRET_FILE=.github/act/.secrets pnpm ci:act:all
+```
+
+Act never publishes or deletes GHCR images. The secret file is ignored by Git.
+
+## PR preview images
+
+Successful non-draft pull requests from this repository publish an amd64 image:
+
+```bash
+docker pull ghcr.io/homarr-labs/homarr-test:pr-<number>
+```
+
+The tag is replaced when the pull request is updated and deleted when it closes. Production Homarr images remain the supported multi-architecture releases. The `homarr-test` package must be configured as public in GHCR for unauthenticated testers.
+
+## Dokploy preview cache
+
+Keep `needs-demo` as the Dokploy preview label. Under the application's **Preview Build-time Secrets**, configure `TURBO_API`, `TURBO_TEAM`, `TURBO_TOKEN`, and `TURBO_REMOTE_CACHE_SIGNATURE_KEY`. Dokploy passes these to the Dockerfile as BuildKit secrets. Do not configure the token or signature key as Docker build arguments.
+
+Rotate any credentials that have appeared in chat, logs, or committed configuration before enabling the cache.

.github/pull_request_template.md

@@ -11,3 +11,11 @@
 - [ ] Commits follow the [conventional commits guideline](https://www.conventionalcommits.org/en/v1.0.0/)
 - [ ] No shorthand variable names are used (eg. `x`, `y`, `i` or any abbrevation)
 - [ ] Documentation is up to date. Create a pull request [here](https://github.com/homarr-labs/documentation/).
+- [ ] When using AI; No temp files are checked in, the code style follows the rest of the project
+
+**When contributing a new integration or widget:**
+
+- [ ] I confirmed manually that the integration or widget is working with a real system and performed basic smoke
+  tests (e.g. what happens if it is offline)
+- [ ] Optional but recommended: I confirm that I am willing to be added to the `CODEOWNERS` of this feature and will
+  provide support and maintain the integration (e.g. in case of breaking or failure)

.github/workflows/autofix.yml

@@ -0,0 +1,48 @@
+name: Auto-fix lint and format
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: ["*"]
+
+permissions:
+  contents: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  autofix:
+    name: Auto-fix
+    if: github.event.pull_request.head.repo.id == github.repository_id
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: ${{ github.head_ref }}
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Get changed files
+        id: changed
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          git diff --name-only --diff-filter=ACMR "origin/${BASE_REF}...HEAD" -- '*.ts' '*.tsx' '*.js' '*.jsx' > /tmp/changed-files
+          echo "count=$(wc -l < /tmp/changed-files | tr -d '[:space:]')" >> $GITHUB_OUTPUT
+
+      - name: Auto-fix lint + format
+        if: steps.changed.outputs.count != '0'
+        run: |
+          xargs -r -a /tmp/changed-files pnpm exec oxlint --fix || true
+          xargs -r -a /tmp/changed-files pnpm exec oxfmt --write
+
+      - name: Commit fixes
+        uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          commit_message: "style: auto-fix lint and format"

.github/workflows/ci.yml

@@ -0,0 +1,347 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: ["*"]
+  pull_request_target:
+    types: [closed]
+    branches: ["*"]
+  push:
+    branches: [main, dev, beta, next]
+  merge_group:
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Operation to run
+        required: true
+        default: validate
+        type: choice
+        options:
+          - validate
+          - publish
+          - cleanup
+      pr_number:
+        description: PR number for publish or cleanup
+        required: false
+        type: number
+      ref:
+        description: Git ref to validate or publish
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || inputs.pr_number || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+env:
+  FORCE_COLOR: 3
+  SKIP_ENV_VALIDATION: true
+  TURBO_TELEMETRY_DISABLED: 1
+  REGISTRY: ghcr.io
+  PREVIEW_IMAGE: ghcr.io/homarr-labs/homarr-test
+
+jobs:
+  fast-gate:
+    name: Fast gate
+    if: github.event_name != 'pull_request_target' && (github.event_name != 'workflow_dispatch' || inputs.operation != 'cleanup')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      TURBO_API: ${{ secrets.TURBO_API }}
+      TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+      TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before || 'HEAD~1' }}
+      TURBO_SCM_HEAD: ${{ github.sha }}
+      TURBO_PLATFORM: linux/amd64
+    steps:
+      - uses: actions/checkout@v7
+        if: '!env.ACT'
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Validate manual inputs
+        if: github.event_name == 'workflow_dispatch' && inputs.operation == 'publish'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+          BUILD_REF: ${{ inputs.ref }}
+        run: |
+          test -n "$PR_NUMBER" || { echo "pr_number is required for publish"; exit 1; }
+          test -n "$BUILD_REF" || { echo "ref is required for publish"; exit 1; }
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Copy environment defaults
+        run: cp .env.example .env
+
+      - name: Check formatting in affected workspaces
+        run: pnpm turbo run format --affected --continue -- --check
+
+      - name: Lint, typecheck, and build affected workspaces
+        run: pnpm turbo run lint typecheck build --affected --continue=dependencies-successful
+
+      - name: Validate workspace configuration
+        run: pnpm lint:ws
+
+      - name: Run unit tests
+        run: pnpm test
+
+      - name: Report coverage
+        if: always() && !env.ACT
+        uses: davelosert/vitest-coverage-report-action@v2
+
+  container:
+    name: Container, E2E, and memory
+    needs: fast-gate
+    if: |
+      github.event_name == 'merge_group' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.draft == false) ||
+      (github.event_name == 'workflow_dispatch' && (inputs.operation == 'validate' || inputs.operation == 'publish'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+        if: '!env.ACT'
+        with:
+          persist-credentials: false
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || '' }}
+
+      - name: Setup
+        uses: ./tooling/github/setup
+
+      - name: Set up Docker Buildx
+        if: '!env.ACT'
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build container once
+        if: '!env.ACT'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          network: host
+          platforms: linux/amd64
+          load: true
+          push: false
+          tags: |
+            homarr-ci
+            homarr-e2e
+          labels: |
+            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.ref.name=pr-${{ github.event.pull_request.number || inputs.pr_number || 'none' }}
+          cache-from: type=gha,scope=homarr-linux-amd64
+          cache-to: type=gha,scope=homarr-linux-amd64,mode=max
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+
+      - name: Build container once with Act
+        if: env.ACT
+        env:
+          TURBO_API: ${{ secrets.TURBO_API }}
+          TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+          TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+          TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
+        run: |
+          secret_args=()
+          for secret in TURBO_API TURBO_TEAM TURBO_TOKEN TURBO_REMOTE_CACHE_SIGNATURE_KEY; do
+            if [ -n "${!secret:-}" ]; then
+              secret_args+=(--secret "id=${secret},env=${secret}")
+            fi
+          done
+          DOCKER_BUILDKIT=1 docker build --platform linux/amd64 \
+            --tag homarr-ci --tag homarr-e2e "${secret_args[@]}" .
+
+      - name: Cache Playwright browsers
+        if: '!env.ACT'
+        id: playwright-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Install Playwright Chromium
+        if: steps.playwright-cache.outputs.cache-hit != 'true' || env.ACT
+        run: pnpm exec playwright install --with-deps chromium
+
+      - name: Install Playwright system deps
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: pnpm exec playwright install-deps chromium
+
+      - name: Run E2E tests
+        run: pnpm test:e2e
+
+      - name: Upload E2E artifacts
+        if: failure() && !env.ACT
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: e2e/test-results/
+          retention-days: 7
+
+      - name: Run memory regression test
+        env:
+          CONTAINER_NAME: homarr-mem-${{ github.run_id }}-${{ github.run_attempt }}
+          SECRET_ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000000
+        run: |
+          docker run -d --name "$CONTAINER_NAME" -p 127.0.0.1::7575 \
+            -e NO_EXTERNAL_CONNECTION=true \
+            -e SECRET_ENCRYPTION_KEY="$SECRET_ENCRYPTION_KEY" \
+            homarr-ci
+          PORT=$(docker port "$CONTAINER_NAME" 7575/tcp | sed 's/.*://')
+          [[ "$PORT" =~ ^[0-9]+$ ]] || { echo "ERROR: invalid port mapping: '$PORT'"; exit 1; }
+          URL="http://127.0.0.1:${PORT}"
+
+          healthy=false
+          for i in $(seq 1 30); do
+            if curl -sf "$URL/api/health/ready" >/dev/null 2>&1; then
+              echo "Container healthy after $((i * 2))s"
+              healthy=true
+              break
+            fi
+            sleep 2
+          done
+
+          if [ "$healthy" != "true" ]; then
+            echo "ERROR: Container never became healthy"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          fi
+
+          warmup_ok=0
+          for _ in $(seq 1 5); do
+            curl -sf "$URL/" >/dev/null 2>&1 && warmup_ok=$((warmup_ok + 1))
+            sleep 2
+          done
+          if [ "$warmup_ok" -eq 0 ]; then
+            echo "ERROR: All warmup requests failed"
+            docker logs "$CONTAINER_NAME" --tail 50
+            exit 1
+          fi
+
+          docker inspect -f '{{.State.Running}}' "$CONTAINER_NAME" | grep -qx true || {
+            echo "ERROR: Container died before memory measurement"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          }
+
+          RAW_MEMORY=$(docker stats --no-stream --format '{{.MemUsage}}' "$CONTAINER_NAME" | sed 's| /.*||')
+          MEMORY_MB=$(echo "$RAW_MEMORY" | awk '
+            /GiB/ { gsub(/GiB/, ""); print $1 * 1024; next }
+            /MiB/ { gsub(/MiB/, ""); print $1; next }
+            /KiB/ { gsub(/KiB/, ""); print $1 / 1024; next }
+            { print $1 / 1048576 }
+          ')
+
+          echo "Memory usage: ${MEMORY_MB} MB (${RAW_MEMORY})"
+          [[ "$MEMORY_MB" =~ ^[0-9]+(\.[0-9]+)?$ ]] || {
+            echo "ERROR: non-numeric memory value: '$MEMORY_MB' (raw: '$RAW_MEMORY')"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          }
+          if awk "BEGIN { exit !($MEMORY_MB < 50) }"; then
+            echo "ERROR: Memory suspiciously low (${MEMORY_MB} MB) — container may have crashed"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          elif awk "BEGIN { exit !($MEMORY_MB > 700) }"; then
+            echo "ERROR: Memory usage ${MEMORY_MB} MB exceeds 700 MB"
+            docker logs "$CONTAINER_NAME" --tail 100
+            exit 1
+          fi
+
+      - name: Clean up memory test container
+        if: always()
+        env:
+          CONTAINER_NAME: homarr-mem-${{ github.run_id }}-${{ github.run_attempt }}
+        run: docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
+
+      - name: Determine preview tag
+        id: preview
+        if: |
+          !env.ACT &&
+          (
+            (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
+            (github.event_name == 'workflow_dispatch' && inputs.operation == 'publish')
+          )
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || inputs.pr_number }}
+        run: echo "tag=pr-${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        if: steps.preview.outputs.tag != ''
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push preview image
+        if: steps.preview.outputs.tag != ''
+        env:
+          PREVIEW_TAG: ${{ steps.preview.outputs.tag }}
+        run: |
+          docker tag homarr-ci "${PREVIEW_IMAGE}:${PREVIEW_TAG}"
+          docker push "${PREVIEW_IMAGE}:${PREVIEW_TAG}"
+
+      - name: Show Act publication result
+        if: env.ACT
+        run: echo "Act validated the publication path; external GHCR writes are disabled locally."
+
+  cleanup:
+    name: Clean up preview image
+    if: github.event_name == 'pull_request_target' || (github.event_name == 'workflow_dispatch' && inputs.operation == 'cleanup')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      packages: write
+    env:
+      IMAGE_TAG: pr-${{ github.event.pull_request.number || inputs.pr_number }}
+    steps:
+      - name: Validate cleanup input
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+        run: test -n "$PR_NUMBER" || { echo "pr_number is required for cleanup"; exit 1; }
+
+      - name: Delete GHCR package version
+        if: '!env.ACT'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const packageName = "homarr-test";
+            const org = context.repo.owner;
+            const tag = process.env.IMAGE_TAG;
+            const versions = await github.paginate(
+              github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg,
+              { package_type: "container", package_name: packageName, org, per_page: 100 },
+            );
+            const target = versions.find((version) =>
+              version.metadata?.container?.tags?.includes(tag),
+            );
+            if (!target) {
+              core.info(`No package version found with tag "${tag}"`);
+              return;
+            }
+            await github.rest.packages.deletePackageVersionForOrg({
+              package_type: "container",
+              package_name: packageName,
+              org,
+              package_version_id: target.id,
+            });
+            core.info(`Deleted package version ${target.id} (${tag})`);
+
+      - name: Show Act cleanup result
+        if: env.ACT
+        run: echo "Act validated cleanup for ${IMAGE_TAG}; external GHCR writes are disabled locally."

.github/workflows/code-quality.yml

@@ -1,165 +0,0 @@
-name: "[Quality] Code Analysis"
-permissions:
-  contents: read
-
-on:
-  pull_request:
-    branches: ["*"]
-  push:
-    branches: ["main"]
-  merge_group:
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.ref }}"
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-env:
-  FORCE_COLOR: 3
-  SKIP_ENV_VALIDATION: true
-  TURBO_API: ${{ secrets.TURBO_API }}
-  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_REMOTE_CACHE_SIGNATURE_KEY: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
-  TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha || github.event.before || 'HEAD~1' }}
-  TURBO_SCM_HEAD: ${{ github.sha }}
-
-jobs:
-  lint-format-autofix:
-    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.id == github.repository_id
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.head_ref }}
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Get changed files
-        id: changed
-        run: |
-          git diff --name-only --diff-filter=ACMR origin/${{ github.base_ref }}...HEAD -- '*.ts' '*.tsx' '*.js' '*.jsx' > /tmp/changed-files
-          echo "count=$(wc -l < /tmp/changed-files | tr -d '[:space:]')" >> $GITHUB_OUTPUT
-
-      - name: Auto-fix lint + format
-        if: steps.changed.outputs.count != '0'
-        run: |
-          xargs -r -a /tmp/changed-files pnpm exec oxlint --fix || true
-          xargs -r -a /tmp/changed-files pnpm exec oxfmt --write
-
-      - name: Commit fixes
-        uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: "style: auto-fix lint and format"
-
-  lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
-
-      - name: Lint
-        run: pnpm turbo lint --affected && pnpm lint:ws
-
-  format:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Format
-        run: pnpm turbo format --affected --continue
-
-  typecheck:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Typecheck
-        run: pnpm turbo typecheck --affected
-
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Setup
-        uses: ./tooling/github/setup
-
-      - name: Test
-        run: pnpm test
-
-      - name: "Report Coverage"
-        # Set if: always() to also generate the report if tests are failing
-        # Only works if you set `reportOnFailure: true` in your vite config as specified above
-        if: always()
-        uses: davelosert/vitest-coverage-report-action@v2
-
-  e2e:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v7
-      - name: Setup
-        uses: ./tooling/github/setup
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-      - name: Build docker image
-        id: build-docker-image
-        uses: docker/build-push-action@v7
-        with:
-          platforms: linux/amd64
-          context: .
-          push: false
-          load: true
-          tags: homarr-e2e
-          network: host
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-        env:
-          SKIP_ENV_VALIDATION: true
-      - name: Install playwright browsers
-        run: pnpm exec playwright install chromium
-      - name: Run E2E Tests
-        shell: bash
-        run: pnpm test:e2e
-
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - name: Setup
-        uses: ./tooling/github/setup
-      - name: Copy env
-        shell: bash
-        run: cp .env.example .env
-      - name: Build
-        run: pnpm turbo build --affected

.github/workflows/deployment-docker-image.yml

@@ -148,6 +148,11 @@ jobs:
           platforms: linux/amd64
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
         env:
           SKIP_ENV_VALIDATION: true
   build-arm64:
@@ -187,6 +192,11 @@ jobs:
           platforms: linux/arm64
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,"name=${{ env.GHCR_REPO }}",push-by-digest=true,name-canonical=true,push=true
+          secrets: |
+            TURBO_API=${{ secrets.TURBO_API }}
+            TURBO_TEAM=${{ secrets.TURBO_TEAM }}
+            TURBO_TOKEN=${{ secrets.TURBO_TOKEN }}
+            TURBO_REMOTE_CACHE_SIGNATURE_KEY=${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
         env:
           SKIP_ENV_VALIDATION: true
   extract-asset-amd64:

Dockerfile

@@ -1,24 +1,31 @@
+# syntax=docker/dockerfile:1.10
+
 FROM node:24.18.0-alpine AS base
 
 FROM base AS builder
-RUN apk add --no-cache libc6-compat
-RUN apk update
-
-# Set working directory
 WORKDIR /app
-RUN apk add --no-cache libc6-compat curl bash
-RUN apk update
+RUN apk add --no-cache libc6-compat curl bash && apk update
+
+RUN corepack enable pnpm
+COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
+COPY patches ./patches
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
+    pnpm config set store-dir /pnpm/store && pnpm fetch
+
 COPY . .
+RUN --mount=type=cache,id=pnpm-store,target=/pnpm/store \
+    pnpm install --recursive --offline --frozen-lockfile
 
-RUN corepack enable pnpm && pnpm install --recursive --frozen-lockfile
-
-# Copy static data as it is not part of the build
-COPY static-data ./static-data
 ARG SKIP_ENV_VALIDATION='true'
 ARG CI='true'
 ARG DISABLE_REDIS_LOGS='true'
+ARG TARGETPLATFORM
 
-RUN corepack enable pnpm && pnpm build
+RUN --mount=type=secret,id=TURBO_API,env=TURBO_API \
+    --mount=type=secret,id=TURBO_TEAM,env=TURBO_TEAM \
+    --mount=type=secret,id=TURBO_TOKEN,env=TURBO_TOKEN \
+    --mount=type=secret,id=TURBO_REMOTE_CACHE_SIGNATURE_KEY,env=TURBO_REMOTE_CACHE_SIGNATURE_KEY \
+    TURBO_PLATFORM="${TARGETPLATFORM:-linux/amd64}" pnpm build
 
 FROM base AS runner
 WORKDIR /app

apps/docs/docs/getting-started/installation/helm.md

@@ -2,9 +2,9 @@
 
 <img src="https://raw.githubusercontent.com/homarr-labs/charts/refs/heads/main/charts/homarr/icon.svg" align="right" width="92" alt="homarr logo">
 
-![Version: 8.21.0](https://img.shields.io/badge/Version-8.21.0-informational?style=flat)
+![Version: 8.22.0](https://img.shields.io/badge/Version-8.22.0-informational?style=flat)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat)
-![AppVersion: v1.69.2](https://img.shields.io/badge/AppVersion-v1.69.2-informational?style=flat)
+![AppVersion: v1.70.0](https://img.shields.io/badge/AppVersion-v1.70.0-informational?style=flat)
 
 A Helm chart to deploy homarr for Kubernetes
 
@@ -429,7 +429,7 @@ All available values are listed on the [artifacthub](https://artifacthub.io/pack
 | httproute.rules[0].matches[0].path.value | string | `"/"` | Path value to match |
 | image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
 | image.repository | string | `"ghcr.io/homarr-labs/homarr"` | Image repository |
-| image.tag | string | `"v1.69.2"` | Overrides the image tag whose default is the chart appVersion |
+| image.tag | string | `"v1.70.0"` | Overrides the image tag whose default is the chart appVersion |
 | imagePullSecrets | list | `[]` | Secrets for Docker registry |
 | ingress.annotations | object | `{}` | Ingress annotations |
 | ingress.enabled | bool | `false` | Enable ingress |

apps/docs/docs/management/custom-widgets/index.mdx

@@ -82,6 +82,10 @@ Custom widgets can be exported and imported as JSON files. To export, select the
 
 The import format uses `"$schema": "homarr-custom-widget-v2"` to identify the widget version.
 
+## Community Workshop
+
+Use **Install widget** on **Management → Workshop** to inspect and import community widgets. Use **Share in Workshop** from a widget's action menu to publish its canonical export without manually copying JSON. Secrets are never included in exports and must be configured on each Homarr instance.
+
 ## Available Mantine Components for Custom JSX
 
 When using the `customJsx` display type, your template has access to a whitelist of [Mantine v9](https://mantine.dev) components. Unrecognized components, event handlers, and dangerous tags are stripped for security.

apps/docs/docs/management/workshop/index.mdx

@@ -0,0 +1,40 @@
+---
+tags:
+  - Workshop
+  - Custom Widgets
+  - Custom CSS
+---
+
+# Community Workshop
+
+The [Workshop](pathname:///workshop) is Homarr's community catalog for custom widgets and CSS themes. You can inspect every creation before downloading it or using it in Homarr.
+
+:::warning Community content
+
+Workshop entries are created by community members. Review widget endpoints, templates, and CSS before using them. Keep a current Homarr backup and never add secrets to an exported widget.
+
+:::
+
+## Discover and install
+
+In Homarr, open **Management → Workshop** to browse, search, filter, inspect, download, and install creations. The custom-widget management page and a board's custom CSS settings also provide contextual Workshop actions.
+
+- Widgets are validated against `homarr-custom-widget-v2` before installation. API keys and other secrets are not included and must be configured locally.
+- CSS is loaded into the board editor for review. It is not saved until you choose **Save changes**.
+- The public website never executes submitted widget templates or CSS.
+
+## Share a creation
+
+Use **Share in Workshop** beside a custom widget or in a board's custom CSS settings. Sign in with GitHub, provide a public title and description, inspect the exported source, and publish it. You can also publish from the Workshop website by pasting an exported widget or CSS source.
+
+Submissions are public immediately. Authors can update or delete their own submissions. Updating content increases its revision and shows the supplied changelog.
+
+## Votes and reports
+
+Signed-in members can vote to help useful creations rank higher. Report malicious content, spam, copyright problems, or inappropriate material from a submission's detail page. Reports are visible only to Workshop staff.
+
+## Accounts and moderation
+
+Workshop accounts use GitHub OAuth and are separate from users in a self-hosted Homarr instance. Workshop moderators can remove submissions, prevent an account from publishing, disable an account, and resolve reports. These actions require a reason and are recorded.
+
+The Workshop is a central service operated by Homarr at `store.homarr.dev`. Running the backend locally is supported for contributors developing or testing this feature, not as a private production marketplace.

apps/docs/docs/widgets/beszel-system-grid/index.mdx

@@ -18,7 +18,9 @@ import beszelSystemGrid from './img/beszel-system-grid.png';
   categories={['System Monitoring']}
 />
 
-This widget displays all your Beszel-monitored systems as a responsive card grid. Each card shows real-time metrics like CPU, memory, disk, network, temperature, and more. Cards adapt their layout based on available space.
+This widget displays all your Beszel-monitored systems as a responsive card grid. Each card shows real-time metrics like CPU, memory, disk, network, temperature, and more. Cards adapt their layout based on available space. If Beszel reports multiple filesystems, the disk bar exposes a hover breakdown for the root disk and each extra mount.
+
+Select a system card to open the complete statistics view, including system, filesystem, Docker, historical, and realtime charts.
 
 ### Screenshots
 

apps/docs/docs/widgets/beszel-system-stats/index.mdx

@@ -1,24 +1,21 @@
 ---
-title: 'Beszel System Stats'
-description: 'Time-series charts for CPU, memory, disk, network, and Docker container metrics from Beszel.'
+title: "Beszel System Stats"
+description: "Time-series charts for CPU, memory, disk, network, and Docker container metrics from Beszel."
 hide_title: true
 ---
 
-import { WidgetHeader } from '@site/src/components/widgets/header';
-import { AddingWidget } from '@site/src/components/widgets/adding';
-import { WidgetConfig } from '@site/src/components/widgets/configuration';
-import { WidgetIntegrations } from '@site/src/components/widgets/integrations';
-import { beszelSystemStatsWidget } from '.';
-import { beszelIntegration } from '@site/docs/integrations/beszel';
+import { WidgetHeader } from "@site/src/components/widgets/header";
+import { AddingWidget } from "@site/src/components/widgets/adding";
+import { WidgetConfig } from "@site/src/components/widgets/configuration";
+import { WidgetIntegrations } from "@site/src/components/widgets/integrations";
+import { beszelSystemStatsWidget } from ".";
+import { beszelIntegration } from "@site/docs/integrations/beszel";
 
-import beszelSystemStats from './img/beszel-system-stats.png';
+import beszelSystemStats from "./img/beszel-system-stats.png";
 
-<WidgetHeader
-  widget={beszelSystemStatsWidget}
-  categories={['System Monitoring', 'Charts']}
-/>
+<WidgetHeader widget={beszelSystemStatsWidget} categories={["System Monitoring", "Charts"]} />
 
-This widget displays time-series charts for a selected Beszel system, including CPU, memory, disk, network, and Docker container metrics. Data is cached and refreshed periodically. You can select a time period ranging from 1 hour to 30 days.
+This widget displays time-series charts for a selected Beszel system, including CPU, memory, disk, network, and Docker container metrics. The Disk Usage chart combines the root disk and every extra filesystem reported by Beszel. You can use the realtime Live view or select a historical period ranging from 1 hour to 30 days. If the live stream drops, the widget now shows the connection failure state immediately and can switch back to historical data.
 
 ### Screenshots
 
@@ -26,14 +23,19 @@ This widget displays time-series charts for a selected Beszel system, including
 
 ### Supported Integrations
 
-<WidgetIntegrations items={[{
-  integration: beszelIntegration,
-  note: "Displays time-series charts for a selected system"
-}]} />
+<WidgetIntegrations
+  items={[
+    {
+      integration: beszelIntegration,
+      note: "Displays time-series charts for a selected system",
+    },
+  ]}
+/>
 
 ### Adding the widget
 
 <AddingWidget />
 
 ### Configuration
+
 <WidgetConfig configuration={beszelSystemStatsWidget.configuration} />

apps/docs/docs/widgets/beszel-system-table/index.mdx

@@ -17,7 +17,9 @@ import { beszelIntegration } from '@site/docs/integrations/beszel';
   categories={['System Monitoring']}
 />
 
-This widget displays all your Beszel-monitored systems in a sortable data table. Each row shows system metrics like CPU, memory, disk, network, temperature, and more. Columns can be toggled on or off, and the table supports sorting by any column.
+This widget displays all your Beszel-monitored systems in a sortable data table. Each row shows system metrics like CPU, memory, disk, network, temperature, and more. Columns can be toggled on or off, and the table supports sorting by any column. When Beszel reports extra filesystems, the disk column adds a hover breakdown for each mount alongside the root disk.
+
+Select a system row to open the complete statistics view, including system, filesystem, Docker, historical, and realtime charts.
 
 ### Supported Integrations
 

apps/docs/docs/widgets/notebook/index.mdx

@@ -1,29 +1,25 @@
 ---
-title: 'Notebook'
-description: 'A simple notebook widget that supports markdown.'
+title: "Notebook"
+description: "A simple notebook widget that supports markdown."
 hide_title: true
 ---
 
-import { AddingWidget } from '@site/src/components/widgets/adding';
-import { WidgetConfig } from '@site/src/components/widgets/configuration';
-import { WidgetHeader } from '@site/src/components/widgets/header';
-import { notebookWidget } from '.';
+import { AddingWidget } from "@site/src/components/widgets/adding";
+import { WidgetConfig } from "@site/src/components/widgets/configuration";
+import { WidgetHeader } from "@site/src/components/widgets/header";
+import { notebookWidget } from ".";
 
+<WidgetHeader widget={notebookWidget} categories={["Notes"]} />
 
-<WidgetHeader
-  widget={notebookWidget}
-  categories={['Notes']}
-/>
-
-The notebook widget focuses on usability and is designed to be as simple as possible to bring a familiar editing experience to regular users. 
+The notebook widget focuses on usability and is designed to be as simple as possible to bring a familiar editing experience to regular users.
 It is based on Tiptap.dev and supports most of its features.
 
 ### Screenshots
 
-import editOff from './img/normal.png';
-import editOn from './img/edit.png';
+import editOff from "./img/normal.png";
+import editOn from "./img/edit.png";
 
-<div className='flex gap-1'>
+<div className="flex gap-1">
   <img src={editOff} alt="notebook edit-off" width={128 * 3} />
   <img src={editOn} alt="notebook edit-on" width={128 * 3} />
 </div>
@@ -33,24 +29,27 @@ import editOn from './img/edit.png';
 <AddingWidget />
 
 ### Configuration
+
 <WidgetConfig configuration={notebookWidget.configuration} />
 
 ### Editing
+
 When the permissions of the user allows it, you can enter the editing of the text by clicking the following button in the top right.
 
 ![](./img/notebook-enter-editing.webp)
 
-
 You can then decide to save your changes or cancel them to exit editing, using the buttons placed in the same location.
 
 ![](./img/notebook-exit-editing.webp)
 
 ### Notebook toolbar functions
-The notebook offers a variaty of functions to edit the text and more.
+
+The notebook offers a variety of functions to edit the text and more.
 
 ![](./img/notebook-toolbar.webp)
 
 #### Common text formatting
+
 | Function               | Description                                                         |
 | ---------------------- | ------------------------------------------------------------------- |
 | Bold                   | Makes the selected text bold                                        |
@@ -62,35 +61,51 @@ The notebook offers a variaty of functions to edit the text and more.
 | Clear formatting       | Erases any of the preceding function's effects on the selected text |
 
 #### Heading
+
 Choose a heading size for the line, making the text bigger. Working like titles and sub-titles.
 
-#### Text Alignement
-Select the alignement on the line. Left, center or right.
+#### Text Alignment
+
+Select the alignment on the line. Left, center or right.
+
+#### Text direction
+
+Set the current paragraph or heading to left-to-right or right-to-left. This is useful when writing right-to-left text while Homarr is using a left-to-right language, or vice versa.
 
 #### Misc functions
+
 ##### Blockquote
+
 Puts the current line in a quoting block.
 
 ##### Horizontal line
+
 Adds a line that goes from the far right to the far left as a separator.
 
 #### Lists
+
 ##### Bullet lists
+
 Simple list with a dot preceding each element.
 
 ##### Ordered lists
+
 List with numbers preceding each element.
 
 ##### Check lists
+
 List with a checkbox on each element.
 
 ##### Indentation changes
+
 ![](./img/notebook-toolbar-lists.webp)
 
 When you are currently in a list of any sort, the last 2 buttons will appear and will allow you to change the indentation of the current list item.
 
 #### Insert functions
+
 ##### Link controls
+
 The first buttons is to insert a link, or edit an existing link. The link will be applied on the selected text.
 
 Pasting a link directly into the text will automatically put the link anchor on it too.
@@ -102,16 +117,20 @@ The second button will remove the link while leaving the text intact.
 This is the modal for the link, The little button in the textbox can be clicked to make the link open in a new tab.
 
 ##### Image controls
+
 ![](./img/notebook-image-modal.webp)
 
 ##### Source
+
 You can use a normal link to an image or you can also use locally stored images.
 
 ##### Width
+
 The aspect ratio will always be respected, so only the width field is necessary.
 You can provide a value in a plain number or you can also use percents to have your image size dynamically change on different screens.
 
 #### Table
+
 This last control allows you to add a table, for which you can determine the number of columns and row before inserting it.
 
 ![](./img/notebook-table-modal.webp)
@@ -119,6 +138,7 @@ This last control allows you to add a table, for which you can determine the num
 Clicking that button while in a table will delete it.
 
 ##### Table controls
+
 ![](./img/notebook-toolbar-table.webp)
 
 While in a table, further controls will appear to help edit the table.
@@ -134,4 +154,4 @@ All the following ones are for editing the wize of the table:
 - Delete Column
 - Add row on top
 - Add row below
-- Delete Row
+- Delete Row

apps/docs/docusaurus.config.ts

@@ -16,6 +16,9 @@ const config: Config = {
     defaultLocale: "en",
     locales: ["en"],
   },
+  customFields: {
+    workshopApiUrl: process.env.NEXT_PUBLIC_WORKSHOP_API_URL ?? "https://store.homarr.dev",
+  },
   onBrokenLinks: "throw",
   onBrokenAnchors: "throw",
   onDuplicateRoutes: "throw",
@@ -124,6 +127,11 @@ const config: Config = {
           position: "left",
           to: "/blog",
         },
+        {
+          label: "Workshop",
+          position: "left",
+          to: "/workshop",
+        },
         {
           label: "About us",
           position: "left",
@@ -309,6 +317,18 @@ const config: Config = {
         },
       };
     },
+    function workshopRoutesPlugin() {
+      return {
+        name: "workshop-routes",
+        async contentLoaded({ actions }) {
+          actions.addRoute({
+            path: "/workshop/:id",
+            component: "@site/src/components/workshop/WorkshopDetailRoutePage",
+            exact: true,
+          });
+        },
+      };
+    },
     "@signalwire/docusaurus-plugin-llms-txt",
     async function tailwindCssPlugin() {
       return {

apps/docs/package.json

@@ -27,6 +27,7 @@
     "@docusaurus/plugin-sitemap": "^3.10.1",
     "@docusaurus/preset-classic": "^3.10.1",
     "@homarr/definitions": "workspace:^",
+    "@homarr/workshop": "workspace:^0.1.0",
     "@mdx-js/react": "^3.1.1",
     "@nivo/line": "^0.99.0",
     "@scalar/api-reference-react": "catalog:",
@@ -43,7 +44,7 @@
     "random-word-slugs": "^0.1.7",
     "react": "catalog:",
     "react-dom": "catalog:",
-    "swiper": "^14.0.1",
+    "swiper": "^14.0.2",
     "tailwindcss": "^4.3.2"
   },
   "devDependencies": {

apps/docs/src/components/workshop/WorkshopAdmin.tsx

@@ -0,0 +1,300 @@
+import React, { useCallback, useEffect, useMemo, useState } from "react";
+import useDocusaurusContext from "@docusaurus/useDocusaurusContext";
+
+import {
+  WORKSHOP_API_URL,
+  WorkshopClient,
+  type WorkshopAccountState,
+  type WorkshopModerationAction,
+  type WorkshopReport,
+  type WorkshopRole,
+  type WorkshopUser,
+} from "@homarr/workshop";
+
+import styles from "./workshop.module.css";
+
+type PendingAction =
+  | { kind: "report"; id: string; status: "resolved" | "dismissed" }
+  | { kind: "state"; id: string; state: WorkshopAccountState }
+  | { kind: "role"; id: string; role: WorkshopRole };
+
+export function WorkshopAdmin() {
+  const { siteConfig } = useDocusaurusContext();
+  const client = useMemo(
+    () => new WorkshopClient((siteConfig.customFields?.workshopApiUrl as string | undefined) ?? WORKSHOP_API_URL),
+    [siteConfig],
+  );
+  const [user, setUser] = useState<WorkshopUser | null>(null);
+  const [reports, setReports] = useState<WorkshopReport[]>([]);
+  const [users, setUsers] = useState<WorkshopUser[]>([]);
+  const [actions, setActions] = useState<WorkshopModerationAction[]>([]);
+  const [pending, setPending] = useState<PendingAction | null>(null);
+  const [error, setError] = useState("");
+
+  const load = useCallback(async () => {
+    const current = await client.refreshAuth();
+    setUser(current);
+    if (!current || (current.role !== "moderator" && current.role !== "admin")) return;
+    try {
+      const [nextReports, nextUsers, nextActions] = await Promise.all([
+        client.listReports(),
+        client.listUsers(),
+        client.listModerationActions(),
+      ]);
+      setReports(nextReports);
+      setUsers(nextUsers);
+      setActions(nextActions);
+    } catch (caught) {
+      setError(caught instanceof Error ? caught.message : "Could not load moderation data");
+    }
+  }, [client]);
+  useEffect(() => client.subscribeToAuth(setUser), [client]);
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  if (!user)
+    return (
+      <main className={styles.page}>
+        <h1>Workshop moderation</h1>
+        <p>Sign in with a promoted GitHub account to continue.</p>
+        <button
+          className="button button--primary"
+          onClick={async () => {
+            await client.signInWithGitHub();
+            await load();
+          }}
+        >
+          Sign in with GitHub
+        </button>
+      </main>
+    );
+  if (user.role === "member")
+    return (
+      <main className={styles.page}>
+        <h1>Workshop moderation</h1>
+        <div className={styles.error} role="alert">
+          Your account does not have moderation access.
+        </div>
+      </main>
+    );
+
+  return (
+    <main className={styles.page}>
+      <header className={styles.hero}>
+        <div>
+          <h1>Workshop moderation</h1>
+          <p>Review reports and apply the smallest action needed. Every action requires a reason and is recorded.</p>
+        </div>
+      </header>
+      {error && (
+        <div className={styles.error} role="alert">
+          {error}
+        </div>
+      )}
+      <section className={styles.adminSection}>
+        <h2>Open reports</h2>
+        {reports.length === 0 ? (
+          <p>No open reports.</p>
+        ) : (
+          <div className={styles.tableWrap}>
+            <table>
+              <thead>
+                <tr>
+                  <th>Category</th>
+                  <th>Submission</th>
+                  <th>Details</th>
+                  <th>Created</th>
+                  <th>Action</th>
+                </tr>
+              </thead>
+              <tbody>
+                {reports.map((report) => (
+                  <tr key={report.id}>
+                    <td>{report.category}</td>
+                    <td>{report.submission}</td>
+                    <td>{report.explanation}</td>
+                    <td>{new Date(report.created).toLocaleString()}</td>
+                    <td aria-label="Report actions">
+                      <div className={styles.rowActions}>
+                        <button onClick={() => setPending({ kind: "report", id: report.id, status: "resolved" })}>
+                          Resolve
+                        </button>
+                        <button onClick={() => setPending({ kind: "report", id: report.id, status: "dismissed" })}>
+                          Dismiss
+                        </button>
+                      </div>
+                    </td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          </div>
+        )}
+      </section>
+      <section className={styles.adminSection}>
+        <h2>Community accounts</h2>
+        <div className={styles.tableWrap}>
+          <table>
+            <thead>
+              <tr>
+                <th>User</th>
+                <th>Role</th>
+                <th>State</th>
+                <th>Moderate</th>
+              </tr>
+            </thead>
+            <tbody>
+              {users.map((account) => (
+                <tr key={account.id}>
+                  <td>{account.displayName}</td>
+                  <td>{account.role}</td>
+                  <td>{account.state}</td>
+                  <td>
+                    {account.id === user.id ? (
+                      "Current account"
+                    ) : (
+                      <div className={styles.rowActions}>
+                        <button
+                          onClick={() =>
+                            setPending({
+                              kind: "state",
+                              id: account.id,
+                              state: account.state === "posting_banned" ? "active" : "posting_banned",
+                            })
+                          }
+                        >
+                          {account.state === "posting_banned" ? "Lift posting ban" : "Posting ban"}
+                        </button>
+                        <button
+                          onClick={() =>
+                            setPending({
+                              kind: "state",
+                              id: account.id,
+                              state: account.state === "disabled" ? "active" : "disabled",
+                            })
+                          }
+                        >
+                          {account.state === "disabled" ? "Restore" : "Disable"}
+                        </button>
+                        {user.role === "admin" && (
+                          <button
+                            onClick={() =>
+                              setPending({
+                                kind: "role",
+                                id: account.id,
+                                role: account.role === "member" ? "moderator" : "member",
+                              })
+                            }
+                          >
+                            {account.role === "member" ? "Promote" : "Set member"}
+                          </button>
+                        )}
+                      </div>
+                    )}
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      </section>
+      <section className={styles.adminSection}>
+        <h2>Recent actions</h2>
+        <div className={styles.tableWrap}>
+          <table>
+            <thead>
+              <tr>
+                <th>Action</th>
+                <th>Target</th>
+                <th>Reason</th>
+                <th>Created</th>
+              </tr>
+            </thead>
+            <tbody>
+              {actions.map((action) => (
+                <tr key={action.id}>
+                  <td>{action.action}</td>
+                  <td>
+                    {action.targetType}:{action.targetId}
+                  </td>
+                  <td>{action.reason}</td>
+                  <td>{new Date(action.created).toLocaleString()}</td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      </section>
+      {pending && (
+        <ReasonDialog
+          action={pending}
+          onClose={() => setPending(null)}
+          onConfirm={async (reason) => {
+            if (pending.kind === "report") await client.resolveReport(pending.id, pending.status, reason);
+            else if (pending.kind === "state") await client.updateAccountState(pending.id, pending.state, reason);
+            else await client.updateRole(pending.id, pending.role, reason);
+            setPending(null);
+            await load();
+          }}
+        />
+      )}
+    </main>
+  );
+}
+
+function ReasonDialog({
+  action,
+  onClose,
+  onConfirm,
+}: {
+  action: PendingAction;
+  onClose: () => void;
+  onConfirm: (reason: string) => Promise<void>;
+}) {
+  const [reason, setReason] = useState("");
+  const [error, setError] = useState("");
+  const [saving, setSaving] = useState(false);
+  return (
+    <div className={styles.overlay}>
+      <dialog className={styles.dialog} open aria-labelledby="moderation-reason-title">
+        <h2 id="moderation-reason-title">Confirm moderation action</h2>
+        <p>
+          This will apply <strong>{action.kind}</strong> to the selected record.
+        </p>
+        <form
+          onSubmit={async (event) => {
+            event.preventDefault();
+            setSaving(true);
+            try {
+              await onConfirm(reason);
+            } catch (caught) {
+              setError(caught instanceof Error ? caught.message : "Action failed");
+              setSaving(false);
+            }
+          }}
+        >
+          <label>
+            Reason
+            <textarea
+              required
+              minLength={3}
+              maxLength={1000}
+              value={reason}
+              onChange={(event) => setReason(event.target.value)}
+            />
+          </label>
+          {error && <p className={styles.error}>{error}</p>}
+          <div className={styles.formActions}>
+            <button type="button" className="button button--secondary" onClick={onClose}>
+              Cancel
+            </button>
+            <button disabled={saving} className="button button--danger">
+              {saving ? "Applying…" : "Apply action"}
+            </button>
+          </div>
+        </form>
+      </dialog>
+    </div>
+  );
+}

apps/docs/src/components/workshop/WorkshopDetailRoutePage.tsx

@@ -0,0 +1,16 @@
+import React from "react";
+import BrowserOnly from "@docusaurus/BrowserOnly";
+import Layout from "@theme/Layout";
+
+export default function WorkshopDetailRoutePage() {
+  return (
+    <Layout title="Workshop submission">
+      <BrowserOnly fallback={<main style={{ minHeight: "70vh" }} />}>
+        {() => {
+          const { WorkshopDetailRoute } = require("./WorkshopPage");
+          return <WorkshopDetailRoute />;
+        }}
+      </BrowserOnly>
+    </Layout>
+  );
+}

apps/docs/src/components/workshop/WorkshopPage.tsx

@@ -0,0 +1,668 @@
+import React, { useCallback, useEffect, useMemo, useState } from "react";
+import Link from "@docusaurus/Link";
+import { useHistory, useLocation } from "@docusaurus/router";
+import useDocusaurusContext from "@docusaurus/useDocusaurusContext";
+import {
+  IconAlertTriangle,
+  IconBrandGithub,
+  IconCopy,
+  IconDownload,
+  IconFlag,
+  IconSearch,
+  IconUpload,
+} from "@tabler/icons-react";
+
+import {
+  WORKSHOP_API_URL,
+  WorkshopClient,
+  type WorkshopSubmissionDetail,
+  type WorkshopSubmissionInput,
+  type WorkshopSubmissionSummary,
+  type WorkshopSubmissionType,
+  type WorkshopUser,
+  workshopExportFilename,
+} from "@homarr/workshop";
+
+import styles from "./workshop.module.css";
+
+const useWorkshop = () => {
+  const { siteConfig } = useDocusaurusContext();
+  const apiUrl = (siteConfig.customFields?.workshopApiUrl as string | undefined) ?? WORKSHOP_API_URL;
+  return useMemo(() => new WorkshopClient(apiUrl), [apiUrl]);
+};
+
+const saveContent = (submission: WorkshopSubmissionDetail) => {
+  const url = URL.createObjectURL(
+    new Blob([submission.content], { type: submission.type === "css" ? "text/css" : "application/json" }),
+  );
+  const link = document.createElement("a");
+  link.href = url;
+  link.download = workshopExportFilename(submission.title, submission.type);
+  link.click();
+  URL.revokeObjectURL(url);
+};
+
+export function WorkshopApp() {
+  const client = useWorkshop();
+  const [user, setUser] = useState<WorkshopUser | null>(null);
+  const [items, setItems] = useState<WorkshopSubmissionSummary[]>([]);
+  const [page, setPage] = useState(1);
+  const [totalPages, setTotalPages] = useState(1);
+  const [type, setType] = useState<WorkshopSubmissionType | "all">("all");
+  const [sort, setSort] = useState<"top" | "newest">("top");
+  const [search, setSearch] = useState("");
+  const [mine, setMine] = useState(false);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState("");
+  const [showForm, setShowForm] = useState(false);
+
+  useEffect(() => client.subscribeToAuth(setUser), [client]);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    setError("");
+    try {
+      await client.refreshAuth();
+      const result = await client.list({ page, type, sort, search, author: mine ? client.currentUser?.id : undefined });
+      setItems(result.items);
+      setTotalPages(result.totalPages);
+    } catch (caught) {
+      setError(caught instanceof Error ? caught.message : "Workshop is unavailable");
+    } finally {
+      setLoading(false);
+    }
+  }, [client, mine, page, search, sort, type]);
+
+  useEffect(() => {
+    const timeout = window.setTimeout(() => void load(), 250);
+    return () => window.clearTimeout(timeout);
+  }, [load]);
+
+  const signIn = async () => {
+    try {
+      await client.signInWithGitHub();
+      await load();
+    } catch (caught) {
+      setError(caught instanceof Error ? caught.message : "Sign-in failed");
+    }
+  };
+
+  return (
+    <main className={styles.page}>
+      <header className={styles.hero}>
+        <div>
+          <h1>Workshop</h1>
+          <p>Community widgets and CSS themes, ready to inspect and use in Homarr.</p>
+        </div>
+        <div className={styles.accountActions}>
+          {user ? (
+            <>
+              {(user.role === "moderator" || user.role === "admin") && (
+                <Link className="button button--secondary" to="/workshop/admin">
+                  Moderate
+                </Link>
+              )}
+              <button className="button button--primary" onClick={() => setShowForm(true)}>
+                <IconUpload size={17} /> Share creation
+              </button>
+              <button className="button button--secondary" onClick={() => client.signOut()}>
+                Sign out
+              </button>
+            </>
+          ) : (
+            <button className="button button--primary" onClick={() => void signIn()}>
+              <IconBrandGithub size={18} /> Sign in with GitHub
+            </button>
+          )}
+        </div>
+      </header>
+
+      <section className={styles.safety} aria-label="Community content warning">
+        <IconAlertTriangle aria-hidden size={20} />
+        <p>
+          Workshop content is community-provided. Inspect source before installing it and keep a current Homarr backup.
+        </p>
+      </section>
+
+      <div className={styles.toolbar}>
+        <label className={styles.search}>
+          <span className="sr-only">Search Workshop</span>
+          <IconSearch aria-hidden size={18} />
+          <input
+            value={search}
+            onChange={(event) => {
+              setSearch(event.target.value);
+              setPage(1);
+            }}
+            placeholder="Search creations"
+          />
+        </label>
+        <label>
+          Type
+          <select
+            value={type}
+            onChange={(event) => {
+              setType(event.target.value as typeof type);
+              setPage(1);
+            }}
+          >
+            <option value="all">All</option>
+            <option value="widget">Widgets</option>
+            <option value="css">CSS themes</option>
+          </select>
+        </label>
+        <label>
+          Sort
+          <select
+            value={sort}
+            onChange={(event) => {
+              setSort(event.target.value as typeof sort);
+              setPage(1);
+            }}
+          >
+            <option value="top">Top rated</option>
+            <option value="newest">Newest</option>
+          </select>
+        </label>
+        {user && (
+          <label className={styles.checkbox}>
+            <input
+              type="checkbox"
+              checked={mine}
+              onChange={(event) => {
+                setMine(event.target.checked);
+                setPage(1);
+              }}
+            />{" "}
+            My submissions
+          </label>
+        )}
+      </div>
+
+      {error && (
+        <div className={styles.error} role="alert">
+          {error} <button onClick={() => void load()}>Try again</button>
+        </div>
+      )}
+      {loading ? (
+        <WorkshopSkeleton />
+      ) : items.length ? (
+        <div className={styles.grid}>
+          {items.map((item) => (
+            <WorkshopCard client={client} item={item} key={item.id} />
+          ))}
+        </div>
+      ) : (
+        <section className={styles.empty}>
+          <h2>No creations found</h2>
+          <p>Adjust the filters, or share the first creation in this category.</p>
+        </section>
+      )}
+
+      {totalPages > 1 && (
+        <nav className={styles.pagination} aria-label="Workshop pages">
+          <button disabled={page === 1} onClick={() => setPage((value) => value - 1)}>
+            Previous
+          </button>
+          <span>
+            Page {page} of {totalPages}
+          </span>
+          <button disabled={page === totalPages} onClick={() => setPage((value) => value + 1)}>
+            Next
+          </button>
+        </nav>
+      )}
+      {showForm && (
+        <SubmissionForm
+          client={client}
+          onClose={() => setShowForm(false)}
+          onSaved={async () => {
+            setShowForm(false);
+            await load();
+          }}
+        />
+      )}
+    </main>
+  );
+}
+
+function WorkshopCard({ client, item }: { client: WorkshopClient; item: WorkshopSubmissionSummary }) {
+  const image = item.screenshots[0];
+  return (
+    <article className={styles.card}>
+      {image ? (
+        <img src={client.fileUrl(item.id, image, "480x320")} alt="" loading="lazy" />
+      ) : (
+        <div className={styles.cardPlaceholder} aria-hidden>
+          {item.type === "widget" ? "{}" : "CSS"}
+        </div>
+      )}
+      <div className={styles.cardBody}>
+        <div className={styles.cardMeta}>
+          <span>{item.type === "widget" ? "Widget" : "CSS theme"}</span>
+          <span>
+            {item.score >= 0 ? "+" : ""}
+            {item.score}
+          </span>
+        </div>
+        <h2>
+          <Link to={`/workshop/${item.id}`}>{item.title}</Link>
+        </h2>
+        <p>{item.description || "No description provided."}</p>
+        <small>
+          By {item.authorName} · revision {item.revision}
+        </small>
+      </div>
+    </article>
+  );
+}
+
+export function WorkshopDetailRoute() {
+  const client = useWorkshop();
+  const location = useLocation();
+  const id = location.pathname.split("/").filter(Boolean).at(-1) ?? "";
+  const history = useHistory();
+  const [user, setUser] = useState<WorkshopUser | null>(null);
+  const [submission, setSubmission] = useState<WorkshopSubmissionDetail | null>(null);
+  const [error, setError] = useState("");
+  const [reporting, setReporting] = useState(false);
+  const [editing, setEditing] = useState(false);
+  const [moderating, setModerating] = useState(false);
+
+  const load = useCallback(async () => {
+    try {
+      setSubmission(await client.get(id));
+    } catch (caught) {
+      setError(caught instanceof Error ? caught.message : "Submission not found");
+    }
+  }, [client, id]);
+  useEffect(() => client.subscribeToAuth(setUser), [client]);
+  useEffect(() => {
+    void client.refreshAuth();
+    void load();
+  }, [client, load]);
+
+  if (error)
+    return (
+      <main className={styles.page}>
+        <div className={styles.error} role="alert">
+          {error}
+        </div>
+        <Link to="/workshop">Back to Workshop</Link>
+      </main>
+    );
+  if (!submission) return <WorkshopSkeleton />;
+
+  const requireAuth = async () => client.currentUser ?? client.signInWithGitHub();
+  return (
+    <main className={styles.page}>
+      <Link to="/workshop">← Back to Workshop</Link>
+      <article className={styles.detail}>
+        <header>
+          <span className={styles.type}>{submission.type === "widget" ? "Widget" : "CSS theme"}</span>
+          <h1>{submission.title}</h1>
+          <p>{submission.description}</p>
+          <small>
+            By {submission.authorName} · revision {submission.revision}
+          </small>
+        </header>
+        {submission.screenshots.length > 0 && (
+          <div className={styles.gallery}>
+            {submission.screenshots.map((image, index) => (
+              <img
+                key={image}
+                src={client.fileUrl(submission.id, image, "960x640")}
+                alt={`${submission.title} screenshot ${index + 1}`}
+              />
+            ))}
+          </div>
+        )}
+        <div className={styles.detailActions}>
+          <button className="button button--primary" onClick={() => saveContent(submission)}>
+            <IconDownload size={17} /> Download {submission.type === "widget" ? "JSON" : "CSS"}
+          </button>
+          <button
+            className="button button--secondary"
+            onClick={() => void navigator.clipboard.writeText(submission.content)}
+          >
+            <IconCopy size={17} /> Copy source
+          </button>
+          <button
+            className="button button--secondary"
+            onClick={async () => {
+              await requireAuth();
+              await client.vote(submission.id, 1);
+              await load();
+            }}
+          >
+            Upvote ({submission.upvotes})
+          </button>
+          <button className="button button--secondary" onClick={() => setReporting(true)}>
+            <IconFlag size={16} /> Report
+          </button>
+          {user?.id === submission.author && (
+            <>
+              <button className="button button--secondary" onClick={() => setEditing(true)}>
+                Edit
+              </button>
+              <button
+                className="button button--danger"
+                onClick={async () => {
+                  if (window.confirm("Delete this submission permanently?")) {
+                    await client.delete(submission.id);
+                    history.push("/workshop");
+                  }
+                }}
+              >
+                Delete
+              </button>
+            </>
+          )}
+          {(user?.role === "moderator" || user?.role === "admin") && user.id !== submission.author && (
+            <button className="button button--danger" onClick={() => setModerating(true)}>
+              Remove submission
+            </button>
+          )}
+        </div>
+        <section>
+          <h2>Source</h2>
+          <p className={styles.sourceHint}>
+            Review this content before using it. Workshop content is never executed on homarr.dev.
+          </p>
+          <pre className={styles.source}>
+            <code>{submission.content}</code>
+          </pre>
+        </section>
+        {submission.changelog && (
+          <section>
+            <h2>Latest changes</h2>
+            <p>{submission.changelog}</p>
+          </section>
+        )}
+      </article>
+      {reporting && <ReportForm client={client} submissionId={submission.id} onClose={() => setReporting(false)} />}
+      {editing && (
+        <SubmissionForm
+          client={client}
+          existing={submission}
+          onClose={() => setEditing(false)}
+          onSaved={async () => {
+            setEditing(false);
+            await load();
+          }}
+        />
+      )}
+      {moderating && (
+        <ModerationRemovalForm
+          client={client}
+          submission={submission}
+          onClose={() => setModerating(false)}
+          onRemoved={() => history.push("/workshop/admin")}
+        />
+      )}
+    </main>
+  );
+}
+
+function ModerationRemovalForm({
+  client,
+  submission,
+  onClose,
+  onRemoved,
+}: {
+  client: WorkshopClient;
+  submission: WorkshopSubmissionDetail;
+  onClose: () => void;
+  onRemoved: () => void;
+}) {
+  const [reason, setReason] = useState("");
+  const [error, setError] = useState("");
+  const [pending, setPending] = useState(false);
+  return (
+    <div className={styles.overlay}>
+      <dialog className={styles.dialog} open aria-labelledby="remove-submission-title">
+        <h2 id="remove-submission-title">Remove {submission.title}</h2>
+        <p>
+          This permanently deletes the submission, files, votes, and reports. A metadata snapshot is retained in
+          moderation history.
+        </p>
+        <form
+          onSubmit={async (event) => {
+            event.preventDefault();
+            setPending(true);
+            try {
+              await client.removeSubmission(submission.id, reason);
+              onRemoved();
+            } catch (caught) {
+              setError(caught instanceof Error ? caught.message : "Removal failed");
+              setPending(false);
+            }
+          }}
+        >
+          <label>
+            Reason
+            <textarea
+              required
+              minLength={3}
+              maxLength={1000}
+              value={reason}
+              onChange={(event) => setReason(event.target.value)}
+            />
+          </label>
+          {error && <p className={styles.error}>{error}</p>}
+          <div className={styles.formActions}>
+            <button type="button" className="button button--secondary" onClick={onClose}>
+              Cancel
+            </button>
+            <button disabled={pending} className="button button--danger">
+              {pending ? "Removing…" : "Remove permanently"}
+            </button>
+          </div>
+        </form>
+      </dialog>
+    </div>
+  );
+}
+
+function SubmissionForm({
+  client,
+  existing,
+  onClose,
+  onSaved,
+}: {
+  client: WorkshopClient;
+  existing?: WorkshopSubmissionDetail;
+  onClose: () => void;
+  onSaved: () => void;
+}) {
+  const [type, setType] = useState<WorkshopSubmissionType>(existing?.type ?? "widget");
+  const [title, setTitle] = useState(existing?.title ?? "");
+  const [description, setDescription] = useState(existing?.description ?? "");
+  const [content, setContent] = useState(existing?.content ?? "");
+  const [changelog, setChangelog] = useState(existing?.changelog ?? "");
+  const [screenshots, setScreenshots] = useState<File[]>([]);
+  const [removedScreenshots, setRemovedScreenshots] = useState<string[]>([]);
+  const [error, setError] = useState("");
+  const [pending, setPending] = useState(false);
+  const submit = async (event: React.FormEvent) => {
+    event.preventDefault();
+    setPending(true);
+    setError("");
+    const input: WorkshopSubmissionInput = { type, title, description, content, changelog };
+    try {
+      if (!client.currentUser) await client.signInWithGitHub();
+      if (existing) {
+        await client.update(existing.id, input, screenshots, removedScreenshots);
+      } else {
+        await client.create(input, screenshots);
+      }
+      await onSaved();
+    } catch (caught) {
+      setError(caught instanceof Error ? caught.message : "Could not save submission");
+    } finally {
+      setPending(false);
+    }
+  };
+  return (
+    <div
+      className={styles.overlay}
+      role="presentation"
+      onMouseDown={(event) => {
+        if (event.target === event.currentTarget) onClose();
+      }}
+    >
+      <dialog className={styles.dialog} open aria-labelledby="submission-form-title">
+        <h2 id="submission-form-title">{existing ? "Update creation" : "Share with the community"}</h2>
+        <form onSubmit={(event) => void submit(event)}>
+          <label>
+            Type
+            <select
+              disabled={Boolean(existing)}
+              value={type}
+              onChange={(event) => setType(event.target.value as WorkshopSubmissionType)}
+            >
+              <option value="widget">Custom widget</option>
+              <option value="css">CSS theme</option>
+            </select>
+          </label>
+          <label>
+            Title
+            <input
+              required
+              minLength={3}
+              maxLength={100}
+              value={title}
+              onChange={(event) => setTitle(event.target.value)}
+            />
+          </label>
+          <label>
+            Description
+            <textarea maxLength={2000} value={description} onChange={(event) => setDescription(event.target.value)} />
+          </label>
+          <label>
+            {type === "widget" ? "Widget JSON" : "CSS source"}
+            <textarea
+              className={styles.editor}
+              required
+              value={content}
+              onChange={(event) => setContent(event.target.value)}
+            />
+          </label>
+          <label>
+            Changelog
+            <textarea maxLength={2000} value={changelog} onChange={(event) => setChangelog(event.target.value)} />
+          </label>
+          <label>
+            Screenshots (PNG, JPG, or WebP, up to 5)
+            <input
+              type="file"
+              accept="image/png,image/jpeg,image/webp"
+              multiple
+              onChange={(event) => setScreenshots(Array.from(event.target.files ?? []).slice(0, 5))}
+            />
+          </label>
+          {existing?.screenshots.map((screenshot) => (
+            <label className={styles.checkbox} key={screenshot}>
+              <input
+                type="checkbox"
+                checked={removedScreenshots.includes(screenshot)}
+                onChange={(event) =>
+                  setRemovedScreenshots((current) =>
+                    event.target.checked
+                      ? [...current, screenshot]
+                      : current.filter((filename) => filename !== screenshot),
+                  )
+                }
+              />
+              Remove existing screenshot {screenshot}
+            </label>
+          ))}
+          {error && (
+            <p className={styles.error} role="alert">
+              {error}
+            </p>
+          )}
+          <div className={styles.formActions}>
+            <button type="button" className="button button--secondary" onClick={onClose}>
+              Cancel
+            </button>
+            <button disabled={pending} className="button button--primary">
+              {pending ? "Saving…" : existing ? "Save update" : "Publish creation"}
+            </button>
+          </div>
+        </form>
+      </dialog>
+    </div>
+  );
+}
+
+function ReportForm({
+  client,
+  submissionId,
+  onClose,
+}: {
+  client: WorkshopClient;
+  submissionId: string;
+  onClose: () => void;
+}) {
+  const [category, setCategory] = useState<"malicious" | "spam" | "copyright" | "inappropriate" | "other">("malicious");
+  const [explanation, setExplanation] = useState("");
+  const [error, setError] = useState("");
+  return (
+    <div className={styles.overlay}>
+      <dialog className={styles.dialog} open aria-labelledby="report-title">
+        <h2 id="report-title">Report submission</h2>
+        <form
+          onSubmit={async (event) => {
+            event.preventDefault();
+            try {
+              if (!client.currentUser) await client.signInWithGitHub();
+              await client.report(submissionId, category, explanation);
+              onClose();
+            } catch (caught) {
+              setError(caught instanceof Error ? caught.message : "Could not send report");
+            }
+          }}
+        >
+          <label>
+            Reason
+            <select value={category} onChange={(event) => setCategory(event.target.value as typeof category)}>
+              <option value="malicious">Malicious</option>
+              <option value="spam">Spam</option>
+              <option value="copyright">Copyright</option>
+              <option value="inappropriate">Inappropriate</option>
+              <option value="other">Other</option>
+            </select>
+          </label>
+          <label>
+            Details
+            <textarea
+              required
+              minLength={3}
+              maxLength={1000}
+              value={explanation}
+              onChange={(event) => setExplanation(event.target.value)}
+            />
+          </label>
+          {error && <p className={styles.error}>{error}</p>}
+          <div className={styles.formActions}>
+            <button type="button" className="button button--secondary" onClick={onClose}>
+              Cancel
+            </button>
+            <button className="button button--primary">Submit report</button>
+          </div>
+        </form>
+      </dialog>
+    </div>
+  );
+}
+
+function WorkshopSkeleton() {
+  return (
+    <div className={styles.grid} aria-label="Loading Workshop">
+      {Array.from({ length: 6 }, (_, index) => (
+        <div className={styles.skeleton} key={index} />
+      ))}
+    </div>
+  );
+}

apps/docs/src/components/workshop/workshop.module.css

@@ -0,0 +1,299 @@
+.page {
+  max-width: 1240px;
+  min-height: 70vh;
+  margin: 0 auto;
+  padding: 2.5rem 1.25rem 5rem;
+}
+.hero {
+  display: flex;
+  align-items: flex-end;
+  justify-content: space-between;
+  gap: 2rem;
+  margin-bottom: 1.5rem;
+}
+.hero h1,
+.detail h1 {
+  margin: 0;
+  font-size: 2.25rem;
+  letter-spacing: -0.025em;
+}
+.hero p {
+  max-width: 65ch;
+  margin: 0.5rem 0 0;
+  color: var(--ifm-color-emphasis-700);
+}
+.accountActions,
+.detailActions,
+.formActions {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.75rem;
+}
+.accountActions :global(.button),
+.detailActions :global(.button) {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+}
+.safety {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.75rem;
+  padding: 0.85rem 1rem;
+  margin-bottom: 1.5rem;
+  border: 1px solid var(--ifm-color-warning-dark);
+  border-radius: 10px;
+  background: color-mix(in srgb, var(--ifm-color-warning) 10%, transparent);
+}
+.safety p {
+  margin: 0;
+}
+.toolbar {
+  display: flex;
+  align-items: end;
+  flex-wrap: wrap;
+  gap: 0.75rem;
+  padding: 0.75rem;
+  margin-bottom: 1.5rem;
+  border: 1px solid var(--ifm-color-emphasis-300);
+  border-radius: 10px;
+}
+.toolbar label,
+.dialog label {
+  display: grid;
+  gap: 0.3rem;
+  font-size: 0.8rem;
+  font-weight: 600;
+}
+.toolbar input,
+.toolbar select,
+.dialog input,
+.dialog select,
+.dialog textarea {
+  min-height: 44px;
+  padding: 0.55rem 0.7rem;
+  border: 1px solid var(--ifm-color-emphasis-400);
+  border-radius: 7px;
+  color: var(--ifm-font-color-base);
+  background: var(--ifm-background-surface-color);
+  font: inherit;
+}
+.search {
+  position: relative;
+  flex: 1 1 280px;
+}
+.search svg {
+  position: absolute;
+  left: 0.75rem;
+  bottom: 0.8rem;
+  color: var(--ifm-color-emphasis-600);
+}
+.search input {
+  width: 100%;
+  padding-left: 2.25rem;
+}
+.checkbox {
+  display: flex !important;
+  grid-auto-flow: column;
+  align-items: center;
+  min-height: 44px;
+}
+.checkbox input {
+  min-height: auto;
+}
+.grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(270px, 1fr));
+  gap: 1rem;
+}
+.card {
+  overflow: hidden;
+  border: 1px solid var(--ifm-color-emphasis-300);
+  border-radius: 12px;
+  background: var(--ifm-background-surface-color);
+}
+.card img,
+.cardPlaceholder {
+  width: 100%;
+  aspect-ratio: 3 / 2;
+  object-fit: cover;
+}
+.cardPlaceholder {
+  display: grid;
+  place-items: center;
+  background: var(--ifm-color-emphasis-100);
+  color: var(--ifm-color-emphasis-600);
+  font: 700 1.5rem var(--ifm-font-family-monospace);
+}
+.cardBody {
+  padding: 1rem;
+}
+.cardBody h2 {
+  margin: 0.4rem 0;
+  font-size: 1.08rem;
+}
+.cardBody p {
+  min-height: 2.7em;
+  margin: 0 0 0.65rem;
+  color: var(--ifm-color-emphasis-700);
+  font-size: 0.9rem;
+}
+.cardMeta {
+  display: flex;
+  justify-content: space-between;
+  color: var(--ifm-color-emphasis-700);
+  font-size: 0.75rem;
+  font-weight: 700;
+}
+.error {
+  padding: 0.85rem 1rem;
+  margin: 1rem 0;
+  border-radius: 8px;
+  color: var(--ifm-color-danger-contrast-foreground);
+  background: var(--ifm-color-danger-contrast-background);
+}
+.empty {
+  padding: 4rem 1rem;
+  text-align: center;
+  border: 1px dashed var(--ifm-color-emphasis-400);
+  border-radius: 12px;
+}
+.pagination {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  gap: 1rem;
+  margin-top: 2rem;
+}
+.pagination button {
+  min-height: 44px;
+  padding: 0.5rem 0.8rem;
+}
+.skeleton {
+  min-height: 310px;
+  border-radius: 12px;
+  background: var(--ifm-color-emphasis-200);
+  animation: pulse 1.5s ease-in-out infinite;
+}
+.detail {
+  margin-top: 1.5rem;
+}
+.detail header {
+  max-width: 75ch;
+}
+.type {
+  display: inline-block;
+  margin-bottom: 0.5rem;
+  color: var(--ifm-color-primary);
+  font-weight: 700;
+}
+.gallery {
+  display: flex;
+  gap: 1rem;
+  overflow-x: auto;
+  margin: 1.5rem 0;
+  scroll-snap-type: x mandatory;
+}
+.gallery img {
+  width: min(720px, 85vw);
+  max-height: 480px;
+  object-fit: contain;
+  border-radius: 10px;
+  background: var(--ifm-color-emphasis-100);
+  scroll-snap-align: start;
+}
+.detailActions {
+  margin: 1.5rem 0 2rem;
+}
+.sourceHint {
+  color: var(--ifm-color-emphasis-700);
+}
+.source {
+  max-height: 560px;
+  overflow: auto;
+  padding: 1rem;
+  border-radius: 8px;
+  font-size: 0.78rem;
+}
+.overlay {
+  position: fixed;
+  z-index: 500;
+  inset: 0;
+  display: grid;
+  place-items: center;
+  padding: 1rem;
+  background: rgb(0 0 0 / 0.7);
+}
+.dialog {
+  width: min(680px, 100%);
+  max-height: 90vh;
+  overflow-y: auto;
+  padding: 1.25rem;
+  border-radius: 12px;
+  background: var(--ifm-background-color);
+}
+.dialog form {
+  display: grid;
+  gap: 1rem;
+}
+.dialog textarea {
+  min-height: 88px;
+  resize: vertical;
+}
+.dialog .editor {
+  min-height: 240px;
+  font-family: var(--ifm-font-family-monospace);
+  font-size: 0.78rem;
+}
+.formActions {
+  justify-content: flex-end;
+}
+@keyframes pulse {
+  50% {
+    opacity: 0.55;
+  }
+}
+@media (max-width: 700px) {
+  .hero {
+    align-items: stretch;
+    flex-direction: column;
+  }
+  .accountActions > * {
+    flex: 1;
+    justify-content: center;
+  }
+  .toolbar > label {
+    flex: 1 1 100%;
+  }
+}
+@media (prefers-reduced-motion: reduce) {
+  .skeleton {
+    animation: none;
+  }
+}
+.adminSection {
+  margin: 2rem 0;
+}
+.tableWrap {
+  overflow-x: auto;
+}
+.tableWrap table {
+  width: 100%;
+  border-collapse: collapse;
+}
+.tableWrap th,
+.tableWrap td {
+  padding: 0.7rem;
+  border-bottom: 1px solid var(--ifm-color-emphasis-300);
+  text-align: left;
+  vertical-align: top;
+}
+.rowActions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.4rem;
+}
+.rowActions button {
+  min-height: 36px;
+}

apps/docs/src/pages/workshop/admin/index.tsx

@@ -0,0 +1,16 @@
+import React from "react";
+import BrowserOnly from "@docusaurus/BrowserOnly";
+import Layout from "@theme/Layout";
+
+export default function WorkshopAdminPage() {
+  return (
+    <Layout title="Workshop moderation" noFooter>
+      <BrowserOnly fallback={<main style={{ minHeight: "70vh" }} />}>
+        {() => {
+          const { WorkshopAdmin } = require("@site/src/components/workshop/WorkshopAdmin");
+          return <WorkshopAdmin />;
+        }}
+      </BrowserOnly>
+    </Layout>
+  );
+}

apps/docs/src/pages/workshop/index.tsx

@@ -0,0 +1,16 @@
+import React from "react";
+import BrowserOnly from "@docusaurus/BrowserOnly";
+import Layout from "@theme/Layout";
+
+export default function WorkshopPage() {
+  return (
+    <Layout title="Workshop" description="Community widgets and CSS themes for Homarr">
+      <BrowserOnly fallback={<main style={{ minHeight: "70vh" }} />}>
+        {() => {
+          const { WorkshopApp } = require("@site/src/components/workshop/WorkshopPage");
+          return <WorkshopApp />;
+        }}
+      </BrowserOnly>
+    </Layout>
+  );
+}

apps/nextjs/package.json

@@ -50,6 +50,7 @@
     "@homarr/validation": "workspace:^0.1.0",
     "@homarr/websocket": "workspace:^0.1.0",
     "@homarr/widgets": "workspace:^0.1.0",
+    "@homarr/workshop": "workspace:^0.1.0",
     "@mantine/colors-generator": "catalog:",
     "@mantine/core": "catalog:",
     "@mantine/dropzone": "catalog:",

apps/nextjs/src/app/[locale]/_client-providers/trpc.tsx

@@ -10,6 +10,7 @@ import {
   createWSClient,
   httpBatchStreamLink,
   httpLink,
+  httpSubscriptionLink,
   isNonJsonSerializable,
   loggerLink,
   splitLink,
@@ -101,9 +102,17 @@ export function TRPCReactProvider(props: PropsWithChildren) {
         }),
         splitLink({
           condition: ({ type }) => type === "subscription",
-          true: wsLink<AppRouter>({
-            client: wsClient,
-            transformer: superjson,
+          true: splitLink({
+            condition: ({ path }) => path === "widget.beszel.subscribeSystemStats",
+            true: httpSubscriptionLink({
+              url: getTrpcUrl(),
+              transformer: superjson,
+              eventSourceOptions: { withCredentials: true },
+            }),
+            false: wsLink<AppRouter>({
+              client: wsClient,
+              transformer: superjson,
+            }),
           }),
           false: splitLink({
             condition: ({ input }) => isNonJsonSerializable(input),

apps/nextjs/src/app/[locale]/boards/(content)/_creator.tsx

@@ -22,6 +22,7 @@ import { getI18n } from "@homarr/translation/server";
 import { prefetchForKindAsync } from "@homarr/widgets/prefetch";
 
 import { createMetaTitle } from "~/metadata";
+import { env } from "~/env";
 import { createBoardLayout } from "../_layout-creator";
 import type { Board, Item } from "../_types";
 import { DynamicClientBoard } from "./_dynamic-client";
@@ -40,7 +41,7 @@ export const createBoardContentPage = <TParams extends Record<string, unknown>>(
 }: Props<TParams>) => {
   return {
     layout: createBoardLayout({
-      headerActions: <BoardContentHeaderActions />,
+      headerActions: <BoardContentHeaderActions demoReadOnly={env.DEMO_MODE && env.DEMO_READ_ONLY} />,
       getInitialBoardAsync: getInitialBoard,
       withTour: true,
     }),

apps/nextjs/src/app/[locale]/boards/(content)/_header-actions.tsx

@@ -41,15 +41,12 @@ import { useDynamicSectionActions } from "~/components/board/sections/dynamic/dy
 import { IntegrationSelectModal } from "~/components/integration/integration-select-modal";
 import { HeaderButton } from "~/components/layout/header/button";
 
-export const BoardContentHeaderActions = () => {
+export const BoardContentHeaderActions = ({ demoReadOnly }: { demoReadOnly: boolean }) => {
   const [isEditMode] = useEditMode();
   const board = useRequiredBoard();
   const { hasChangeAccess } = useBoardPermissions(board);
-  // Fall back to read-only if the query has no data (e.g. errored) so we never expose
-  // edit/save/settings UI that would then fail server-side.
-  const { data: demoReadOnly = true, isLoading } = clientApi.info.isDemoReadOnly.useQuery();
 
-  if (!hasChangeAccess || isLoading) {
+  if (!hasChangeAccess) {
     return <SelectBoardsMenu />;
   }
 

apps/nextjs/src/app/[locale]/boards/[name]/settings/_customCss.tsx

@@ -11,6 +11,9 @@ import { IconInfoCircle } from "@tabler/icons-react";
 import { useForm } from "@homarr/form";
 import { useI18n, useScopedI18n } from "@homarr/translation/client";
 
+import { PublishToWorkshopButton } from "~/components/workshop/workshop-browser";
+import { UseCssFromWorkshopButton } from "~/components/workshop/workshop-actions";
+
 import type { Board } from "../../_types";
 import { useSavePartialSettingsMutation } from "./_shared";
 import classes from "./customcss.module.css";
@@ -45,7 +48,11 @@ export const CustomCssSettingsContent = ({ board }: Props) => {
           {customCssT("customClassesAlert.description")}
         </Alert>
 
-        <Group justify="end">
+        <Group justify="space-between">
+          <Group>
+            <UseCssFromWorkshopButton onUse={(css) => form.setFieldValue("customCss", css)} />
+            <PublishToWorkshopButton type="css" defaultTitle={board.name} getContent={() => form.values.customCss} />
+          </Group>
           <Button type="submit" loading={isPending}>
             {t("common.action.saveChanges")}
           </Button>

apps/nextjs/src/app/[locale]/init/_steps/import/file-info-card.tsx

@@ -2,7 +2,7 @@ import { ActionIcon, Button, Group, Text } from "@mantine/core";
 import type { FileWithPath } from "@mantine/dropzone";
 import { IconPencil } from "@tabler/icons-react";
 
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import { useScopedI18n } from "@homarr/translation/client";
 
 import { InitStepCard } from "../../_components/init-step-card";
@@ -22,7 +22,7 @@ export const FileInfoCard = ({ file, onRemove }: FileInfoCardProps) => {
             {file.name}
           </Text>
           <Text visibleFrom="md" c="gray.6" size="sm">
-            {humanFileSize(file.size)}
+            {formatBytes(file.size)}
           </Text>
         </Group>
         <Button

apps/nextjs/src/app/[locale]/manage/custom-widgets/_custom-widget-actions.tsx

@@ -6,6 +6,7 @@ import {
   IconCopy,
   IconDots,
   IconDownload,
+  IconShare3,
   IconToggleLeft,
   IconToggleRight,
   IconTrash,
@@ -19,6 +20,7 @@ import { showErrorNotification, showSuccessNotification } from "@homarr/notifica
 import { useScopedI18n } from "@homarr/translation/client";
 
 import { MobileAffixButton } from "~/components/manage/mobile-affix-button";
+import { PublishToWorkshopButton } from "~/components/workshop/workshop-browser";
 
 const iconProps = { size: 16, stroke: 1.5 };
 
@@ -30,6 +32,7 @@ interface WidgetRef {
 
 export const CustomWidgetRowActions = ({ widget }: { widget: WidgetRef }) => {
   const t = useScopedI18n("customWidget");
+  const workshopT = useScopedI18n("workshop");
   const { openConfirmModal } = useConfirmModal();
   const deleteMutation = clientApi.customWidget.delete.useMutation();
   const duplicateMutation = clientApi.customWidget.duplicate.useMutation();
@@ -141,6 +144,16 @@ export const CustomWidgetRowActions = ({ widget }: { widget: WidgetRef }) => {
         <Menu.Item onClick={() => void handleExport()} leftSection={<IconDownload {...iconProps} />}>
           {t("action.export")}
         </Menu.Item>
+        <PublishToWorkshopButton
+          type="widget"
+          defaultTitle={widget.name}
+          getContent={async () => JSON.stringify(await utils.customWidget.export.fetch({ id: widget.id }), null, 2)}
+          renderTrigger={(open) => (
+            <Menu.Item onClick={open} leftSection={<IconShare3 {...iconProps} />}>
+              {workshopT("action.share")}
+            </Menu.Item>
+          )}
+        />
         <Menu.Divider />
         <Menu.Item
           color="red"

apps/nextjs/src/app/[locale]/manage/custom-widgets/page.tsx

@@ -9,6 +9,7 @@ import { Link } from "@homarr/ui";
 
 import { ManagePageLayout } from "~/components/manage/manage-page-layout";
 import { MobileAffixButton } from "~/components/manage/mobile-affix-button";
+import { InstallWidgetFromWorkshopButton } from "~/components/workshop/workshop-actions";
 import { CustomWidgetBetaBanner } from "./_beta-banner";
 import { ImportCustomWidgetButton } from "./_custom-widget-actions";
 import { CustomWidgetList } from "./_custom-widget-list";
@@ -28,6 +29,7 @@ export default async function CustomWidgetsPage() {
       title={t("page.list.title")}
       primaryAction={
         <Group gap="xs">
+          <InstallWidgetFromWorkshopButton />
           <ImportCustomWidgetButton />
           <MobileAffixButton component={Link} href="/manage/custom-widgets/new" leftSection={<IconPlus size={16} />}>
             {t("action.create")}

apps/nextjs/src/app/[locale]/manage/layout.tsx

@@ -18,6 +18,7 @@ import {
   IconHomeFilled,
   IconLayoutDashboardFilled,
   IconMailForward,
+  IconBuildingStore,
   IconPhotoFilled,
   IconPointerFilled,
   IconSearch,
@@ -80,6 +81,12 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
       label: t("items.customWidgets"),
       hidden: !session,
     },
+    {
+      icon: IconBuildingStore,
+      href: "/manage/workshop",
+      label: t("items.workshop"),
+      hidden: !session?.user.permissions.includes("admin"),
+    },
     {
       icon: IconSearch,
       href: "/manage/search-engines",

apps/nextjs/src/app/[locale]/manage/medias/page.tsx

@@ -18,7 +18,7 @@ import { z } from "zod/v4";
 import type { RouterOutputs } from "@homarr/api";
 import { api } from "@homarr/api/server";
 import { auth } from "@homarr/auth/next";
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import type { inferSearchParamsFromSchema } from "@homarr/common/types";
 import { createLocalImageUrl } from "@homarr/icons/local";
 import { getI18n } from "@homarr/translation/server";
@@ -125,7 +125,7 @@ const Row = async ({ media }: RowProps) => {
         />
       </TableTd>
       <TableTd>{media.name}</TableTd>
-      <TableTd>{humanFileSize(media.size)}</TableTd>
+      <TableTd>{formatBytes(media.size)}</TableTd>
       <TableTd>
         {media.creator ? (
           <Group gap="sm">

apps/nextjs/src/app/[locale]/manage/tools/docker/docker-table.tsx

@@ -19,7 +19,7 @@ import { MantineReactTable } from "mantine-react-table";
 
 import type { RouterOutputs } from "@homarr/api";
 import { clientApi } from "@homarr/api/client";
-import { humanFileSize, useTimeAgo } from "@homarr/common";
+import { formatBytes, useTimeAgo } from "@homarr/common";
 import type { ContainerState } from "@homarr/docker";
 import { containerStateColorMap, cpuUsageColor, memoryUsageColor, safeValue } from "@homarr/docker/shared";
 import { useModalAction } from "@homarr/modals";
@@ -143,7 +143,7 @@ const createColumns = (t: TranslationFunction): MRT_ColumnDef<DockerContainer>[]
 
       return (
         <Text size="sm" c={memoryUsageColor(bytesUsage, row.original.state)}>
-          {humanFileSize(bytesUsage)}
+          {formatBytes(bytesUsage)}
         </Text>
       );
     },

apps/nextjs/src/app/[locale]/manage/workshop/page.tsx

@@ -0,0 +1,18 @@
+import { redirect } from "next/navigation";
+
+import { auth } from "@homarr/auth/next";
+import { getScopedI18n } from "@homarr/translation/server";
+
+import { ManagePageLayout } from "~/components/manage/manage-page-layout";
+import { WorkshopBrowser } from "~/components/workshop/workshop-browser";
+
+export default async function WorkshopPage() {
+  const session = await auth();
+  if (!session?.user.permissions.includes("admin")) redirect(session ? "/" : "/auth/login");
+  const t = await getScopedI18n("workshop");
+  return (
+    <ManagePageLayout title={t("title")} size="xl">
+      <WorkshopBrowser />
+    </ManagePageLayout>
+  );
+}

apps/nextjs/src/components/board/items/widget-context-menu.tsx

@@ -4,7 +4,7 @@ import type { MutableRefObject, ReactNode } from "react";
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { Group, Loader, Menu, Switch, Text } from "@mantine/core";
 import { IconCopy, IconLayoutKanban, IconRefresh, IconSettings, IconTrash } from "@tabler/icons-react";
-import type { QueryClient } from "@tanstack/react-query";
+import type { QueryClient, QueryKey } from "@tanstack/react-query";
 import { useIsFetching, useQueryClient } from "@tanstack/react-query";
 
 import { clientApi } from "@homarr/api/client";
@@ -49,7 +49,10 @@ export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetCont
   const { gridstack } = useSectionContext().refs;
   const queryClient = useQueryClient();
 
-  const widgetQueryKey = useMemo(() => [["widget", item.kind]], [item.kind]);
+  const widgetQueryKey = useMemo(
+    () => ("queryKey" in currentDefinition ? (currentDefinition.queryKey as QueryKey) : [["widget", item.kind]]),
+    [currentDefinition, item.kind],
+  );
   const isWidgetFetching = useIsFetching({ queryKey: widgetQueryKey }) > 0;
   const handleRefetch = useCallback(() => {
     void queryClient.refetchQueries({ queryKey: widgetQueryKey, type: "all" });
@@ -276,7 +279,7 @@ const WidgetCacheAge = ({
   isFetching,
 }: {
   queryClient: QueryClient;
-  queryKey: unknown[];
+  queryKey: QueryKey;
   isFetching: boolean;
 }) => {
   // 1s tick for "just now" → "1s ago" label transition; isFetching prop handles refetch reactivity
@@ -295,8 +298,8 @@ const WidgetCacheAge = ({
     .filter(Boolean);
   if (timestamps.length === 0) return null;
 
-  const oldest = Math.min(...timestamps);
-  const seconds = Math.floor((Date.now() - oldest) / 1000);
+  const latest = Math.max(...timestamps);
+  const seconds = Math.floor((Date.now() - latest) / 1000);
   if (seconds < 5) return "just now";
   if (seconds < 60) return `${seconds}s ago`;
   return `${Math.floor(seconds / 60)}m ago`;

apps/nextjs/src/components/workshop/workshop-actions.tsx

@@ -0,0 +1,72 @@
+"use client";
+
+import { Button, Modal } from "@mantine/core";
+import { useDisclosure } from "@mantine/hooks";
+import { IconBuildingStore } from "@tabler/icons-react";
+
+import { clientApi } from "@homarr/api/client";
+import { revalidatePathActionAsync } from "@homarr/common/client";
+import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
+import { useScopedI18n } from "@homarr/translation/client";
+import { customWidgetImportSchema } from "@homarr/validation/custom-widget";
+import { validateWorkshopContent } from "@homarr/workshop";
+
+import { WorkshopBrowser } from "./workshop-browser";
+
+export function InstallWidgetFromWorkshopButton() {
+  const t = useScopedI18n("workshop");
+  const [opened, { open, close }] = useDisclosure(false);
+  const utils = clientApi.useUtils();
+  const mutation = clientApi.customWidget.import.useMutation({
+    onSuccess: () => {
+      showSuccessNotification({ title: t("title"), message: t("action.install") });
+      void utils.customWidget.all.invalidate();
+      void revalidatePathActionAsync("/manage/custom-widgets");
+      close();
+    },
+    onError: (error) => showErrorNotification({ title: t("title"), message: error.message }),
+  });
+  return (
+    <>
+      <Button variant="default" leftSection={<IconBuildingStore size={16} />} onClick={open}>
+        {t("action.install")}
+      </Button>
+      <Modal opened={opened} onClose={close} title={t("title")} size="90%" fullScreen={false}>
+        <WorkshopBrowser
+          initialType="widget"
+          lockedType="widget"
+          useLabel={t("action.install")}
+          onUse={async (submission) => {
+            const parsed = customWidgetImportSchema.parse(JSON.parse(submission.content));
+            await mutation.mutateAsync(parsed);
+          }}
+        />
+      </Modal>
+    </>
+  );
+}
+
+export function UseCssFromWorkshopButton({ onUse }: { onUse: (css: string) => void }) {
+  const t = useScopedI18n("workshop");
+  const [opened, { open, close }] = useDisclosure(false);
+  return (
+    <>
+      <Button variant="default" leftSection={<IconBuildingStore size={16} />} onClick={open}>
+        {t("action.useCss")}
+      </Button>
+      <Modal opened={opened} onClose={close} title={t("title")} size="90%">
+        <WorkshopBrowser
+          initialType="css"
+          lockedType="css"
+          useLabel={t("action.useCss")}
+          onUse={(submission) => {
+            const validation = validateWorkshopContent("css", submission.content);
+            if (!validation.success) throw new Error(validation.error);
+            onUse(submission.content);
+            close();
+          }}
+        />
+      </Modal>
+    </>
+  );
+}

apps/nextjs/src/components/workshop/workshop-browser.tsx

@@ -0,0 +1,339 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { useEffect, useMemo, useState } from "react";
+import {
+  Alert,
+  Badge,
+  Box,
+  Button,
+  Card,
+  Code,
+  Group,
+  Image,
+  Modal,
+  Pagination,
+  Select,
+  SimpleGrid,
+  Skeleton,
+  Stack,
+  Text,
+  TextInput,
+  Textarea,
+} from "@mantine/core";
+import { useDebouncedValue, useDisclosure } from "@mantine/hooks";
+import { IconAlertTriangle, IconBrandGithub, IconDownload, IconExternalLink, IconSearch } from "@tabler/icons-react";
+import { useQuery } from "@tanstack/react-query";
+
+import type { WorkshopSubmissionDetail, WorkshopSubmissionType } from "@homarr/workshop";
+
+import { WORKSHOP_API_URL, WORKSHOP_WEB_URL, WorkshopClient, workshopExportFilename } from "@homarr/workshop";
+import { useScopedI18n } from "@homarr/translation/client";
+
+const apiUrl = process.env.NEXT_PUBLIC_WORKSHOP_API_URL ?? WORKSHOP_API_URL;
+
+export interface WorkshopBrowserProps {
+  initialType?: WorkshopSubmissionType | "all";
+  lockedType?: WorkshopSubmissionType;
+  onUse?: (submission: WorkshopSubmissionDetail) => Promise<void> | void;
+  useLabel?: string;
+}
+
+export function WorkshopBrowser({ initialType = "all", lockedType, onUse, useLabel }: WorkshopBrowserProps) {
+  const t = useScopedI18n("workshop");
+  const client = useMemo(() => new WorkshopClient(apiUrl), []);
+  const [page, setPage] = useState(1);
+  const [type, setType] = useState<WorkshopSubmissionType | "all">(initialType);
+  const [sort, setSort] = useState<"top" | "newest">("top");
+  const [search, setSearch] = useState("");
+  const [debouncedSearch] = useDebouncedValue(search, 250);
+  const [selected, setSelected] = useState<WorkshopSubmissionDetail | null>(null);
+  const [detailLoading, setDetailLoading] = useState(false);
+  const [usePending, setUsePending] = useState(false);
+  const [useError, setUseError] = useState("");
+
+  const query = useQuery({
+    queryKey: ["workshop", "list", page, type, sort, debouncedSearch],
+    queryFn: () => client.list({ page, type, sort, search: debouncedSearch, perPage: 12 }),
+  });
+
+  const openDetail = async (id: string) => {
+    setDetailLoading(true);
+    try {
+      setSelected(await client.get(id));
+    } finally {
+      setDetailLoading(false);
+    }
+  };
+
+  const download = (submission: WorkshopSubmissionDetail) => {
+    const url = URL.createObjectURL(
+      new Blob([submission.content], { type: submission.type === "css" ? "text/css" : "application/json" }),
+    );
+    const anchor = document.createElement("a");
+    anchor.href = url;
+    anchor.download = workshopExportFilename(submission.title, submission.type);
+    anchor.click();
+    URL.revokeObjectURL(url);
+  };
+
+  return (
+    <Stack gap="lg">
+      <Alert icon={<IconAlertTriangle size={18} />} color="yellow" title={t("safety.title")}>
+        {t("safety.description")}
+      </Alert>
+      <Group align="end">
+        <TextInput
+          label={t("search.label")}
+          placeholder={t("search.placeholder")}
+          leftSection={<IconSearch size={16} />}
+          value={search}
+          onChange={(event) => {
+            setSearch(event.currentTarget.value);
+            setPage(1);
+          }}
+          style={{ flex: 1 }}
+        />
+        <Select
+          label={t("filter.type")}
+          value={type}
+          disabled={Boolean(lockedType)}
+          onChange={(value) => {
+            setType((value ?? "all") as typeof type);
+            setPage(1);
+          }}
+          data={[
+            { value: "all", label: t("filter.all") },
+            { value: "widget", label: t("filter.widgets") },
+            { value: "css", label: t("filter.css") },
+          ]}
+        />
+        <Select
+          label={t("filter.sort")}
+          value={sort}
+          onChange={(value) => {
+            setSort((value ?? "top") as typeof sort);
+            setPage(1);
+          }}
+          data={[
+            { value: "top", label: t("filter.top") },
+            { value: "newest", label: t("filter.newest") },
+          ]}
+        />
+      </Group>
+      {query.error && (
+        <Alert color="red" title={t("error.loadTitle")}>
+          {query.error.message}
+          <Button variant="subtle" onClick={() => void query.refetch()}>
+            {t("action.retry")}
+          </Button>
+        </Alert>
+      )}
+      {query.isLoading ? (
+        <SimpleGrid cols={{ base: 1, sm: 2, lg: 3 }}>
+          <Skeleton h={280} />
+          <Skeleton h={280} />
+          <Skeleton h={280} />
+        </SimpleGrid>
+      ) : query.data?.items.length ? (
+        <SimpleGrid cols={{ base: 1, sm: 2, lg: 3 }}>
+          {query.data.items.map((item) => (
+            <Card key={item.id} withBorder padding="md">
+              {item.screenshots[0] ? (
+                <Card.Section>
+                  <Image src={client.fileUrl(item.id, item.screenshots[0], "480x320")} h={170} alt="" />
+                </Card.Section>
+              ) : (
+                <Card.Section>
+                  <Box
+                    h={170}
+                    bg="var(--mantine-color-default-hover)"
+                    style={{ display: "grid", placeItems: "center" }}
+                  >
+                    <Text ff="monospace" fw={700}>
+                      {item.type === "widget" ? "{}" : "CSS"}
+                    </Text>
+                  </Box>
+                </Card.Section>
+              )}
+              <Stack gap="xs" mt="md">
+                <Group justify="space-between">
+                  <Badge variant="light">{item.type === "widget" ? t("type.widget") : t("type.css")}</Badge>
+                  <Text size="sm" c="dimmed">
+                    {item.score >= 0 ? "+" : ""}
+                    {item.score}
+                  </Text>
+                </Group>
+                <Text fw={600} lineClamp={1}>
+                  {item.title}
+                </Text>
+                <Text size="sm" c="dimmed" lineClamp={2}>
+                  {item.description || t("empty.description")}
+                </Text>
+                <Text size="xs" c="dimmed">
+                  {t("by", { name: item.authorName, revision: item.revision })}
+                </Text>
+                <Button variant="light" onClick={() => void openDetail(item.id)}>
+                  {t("action.inspect")}
+                </Button>
+              </Stack>
+            </Card>
+          ))}
+        </SimpleGrid>
+      ) : (
+        <Stack align="center" py="xl">
+          <Text fw={600}>{t("empty.title")}</Text>
+          <Text c="dimmed">{t("empty.description")}</Text>
+        </Stack>
+      )}
+      {(query.data?.totalPages ?? 0) > 1 && (
+        <Pagination total={query.data?.totalPages ?? 1} value={page} onChange={setPage} mx="auto" />
+      )}
+      <Modal
+        opened={Boolean(selected) || detailLoading}
+        onClose={() => setSelected(null)}
+        title={selected?.title ?? t("loading")}
+        size="xl"
+      >
+        {detailLoading || !selected ? (
+          <Skeleton h={400} />
+        ) : (
+          <Stack>
+            <Group>
+              <Badge>{selected.type === "widget" ? t("type.widget") : t("type.css")}</Badge>
+              <Text size="sm" c="dimmed">
+                {t("by", { name: selected.authorName, revision: selected.revision })}
+              </Text>
+            </Group>
+            <Text>{selected.description}</Text>
+            <Alert icon={<IconAlertTriangle size={18} />} color="yellow">
+              {t("safety.inspect")}
+            </Alert>
+            <Code block mah={360} style={{ overflow: "auto", whiteSpace: "pre" }}>
+              {selected.content}
+            </Code>
+            <Group justify="space-between">
+              <Group>
+                <Button variant="default" leftSection={<IconDownload size={16} />} onClick={() => download(selected)}>
+                  {t("action.download")}
+                </Button>
+                <Button
+                  component="a"
+                  href={`${WORKSHOP_WEB_URL}/${selected.id}`}
+                  target="_blank"
+                  variant="subtle"
+                  leftSection={<IconExternalLink size={16} />}
+                >
+                  {t("action.website")}
+                </Button>
+              </Group>
+              {onUse && (
+                <Button
+                  loading={usePending}
+                  onClick={async () => {
+                    setUsePending(true);
+                    setUseError("");
+                    try {
+                      if (lockedType && selected.type !== lockedType) throw new Error(t("error.wrongType"));
+                      await onUse(selected);
+                      setSelected(null);
+                    } catch (caught) {
+                      setUseError(caught instanceof Error ? caught.message : t("error.install"));
+                    } finally {
+                      setUsePending(false);
+                    }
+                  }}
+                >
+                  {useLabel ?? t("action.use")}
+                </Button>
+              )}
+            </Group>
+            {useError && <Alert color="red">{useError}</Alert>}
+          </Stack>
+        )}
+      </Modal>
+    </Stack>
+  );
+}
+
+export function PublishToWorkshopButton({
+  type,
+  getContent,
+  defaultTitle,
+  compact = false,
+  renderTrigger,
+}: {
+  type: WorkshopSubmissionType;
+  getContent: () => Promise<string> | string;
+  defaultTitle: string;
+  compact?: boolean;
+  renderTrigger?: (open: () => void) => ReactNode;
+}) {
+  const t = useScopedI18n("workshop");
+  const client = useMemo(() => new WorkshopClient(apiUrl), []);
+  const [opened, { open, close }] = useDisclosure(false);
+  const [title, setTitle] = useState(defaultTitle);
+  const [description, setDescription] = useState("");
+  const [changelog, setChangelog] = useState("");
+  const [error, setError] = useState("");
+  const [pending, setPending] = useState(false);
+  useEffect(() => setTitle(defaultTitle), [defaultTitle]);
+  const publish = async () => {
+    setPending(true);
+    setError("");
+    try {
+      if (!client.currentUser) await client.signInWithGitHub();
+      await client.create({ type, title, description, changelog, content: await getContent() });
+      close();
+    } catch (caught) {
+      setError(caught instanceof Error ? caught.message : t("error.publish"));
+    } finally {
+      setPending(false);
+    }
+  };
+  return (
+    <>
+      {renderTrigger ? (
+        renderTrigger(open)
+      ) : (
+        <Button
+          size={compact ? "xs" : undefined}
+          variant="default"
+          leftSection={<IconBrandGithub size={16} />}
+          onClick={open}
+        >
+          {t("action.share")}
+        </Button>
+      )}
+      <Modal opened={opened} onClose={close} title={t("publish.title")}>
+        <Stack>
+          <TextInput
+            required
+            label={t("publish.name")}
+            value={title}
+            onChange={(event) => setTitle(event.currentTarget.value)}
+          />
+          <Textarea
+            label={t("publish.description")}
+            value={description}
+            onChange={(event) => setDescription(event.currentTarget.value)}
+          />
+          <Textarea
+            label={t("publish.changelog")}
+            value={changelog}
+            onChange={(event) => setChangelog(event.currentTarget.value)}
+          />
+          {error && <Alert color="red">{error}</Alert>}
+          <Group justify="end">
+            <Button variant="default" onClick={close}>
+              {t("action.cancel")}
+            </Button>
+            <Button loading={pending} disabled={title.trim().length < 3} onClick={() => void publish()}>
+              {t("action.publish")}
+            </Button>
+          </Group>
+        </Stack>
+      </Modal>
+    </>
+  );
+}

apps/nextjs/src/env.ts

@@ -4,6 +4,7 @@ export const env = createEnv({
   server: {
     UNSAFE_ENABLE_MOCK_INTEGRATION: createBooleanSchema(false),
     DEMO_MODE: createBooleanSchema(false),
+    DEMO_READ_ONLY: createBooleanSchema(true),
   },
   experimental__runtimeEnv: process.env,
 });

apps/store/.env.example

@@ -0,0 +1,5 @@
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+PB_SUPERUSER_EMAIL=
+PB_SUPERUSER_PASSWORD=
+PB_EXPOSE_PORT=8090

apps/store/.gitignore

@@ -0,0 +1,4 @@
+.env
+.env.*
+!.env.example
+pb_data/

apps/store/Dockerfile

@@ -0,0 +1,31 @@
+FROM alpine:3.22 AS download
+
+ARG TARGETARCH
+ARG POCKETBASE_VERSION=0.39.6
+
+RUN apk add --no-cache ca-certificates curl unzip
+RUN case "${TARGETARCH}" in \
+      amd64) PB_ARCH=amd64 ;; \
+      arm64) PB_ARCH=arm64 ;; \
+      arm) PB_ARCH=armv7 ;; \
+      *) echo "Unsupported architecture: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac && \
+    BASE_URL="https://github.com/pocketbase/pocketbase/releases/download/v${POCKETBASE_VERSION}" && \
+    ARCHIVE="pocketbase_${POCKETBASE_VERSION}_linux_${PB_ARCH}.zip" && \
+    curl --fail --location --silent --show-error "${BASE_URL}/${ARCHIVE}" --output "/tmp/${ARCHIVE}" && \
+    curl --fail --location --silent --show-error "${BASE_URL}/checksums.txt" --output /tmp/checksums.txt && \
+    cd /tmp && grep " ${ARCHIVE}$" checksums.txt | sha256sum -c - && \
+    unzip "/tmp/${ARCHIVE}" pocketbase -d /out
+
+FROM alpine:3.22
+
+RUN apk add --no-cache ca-certificates su-exec tzdata && addgroup -S pocketbase && adduser -S -G pocketbase pocketbase
+COPY --from=download /out/pocketbase /usr/local/bin/pocketbase
+COPY entrypoint.sh /usr/local/bin/workshop-entrypoint
+
+RUN chmod +x /usr/local/bin/workshop-entrypoint && mkdir -p /pb_data /pb_hooks /pb_migrations && chown -R pocketbase:pocketbase /pb_data /pb_hooks /pb_migrations
+
+USER root
+EXPOSE 8090
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD wget -q --spider http://127.0.0.1:8090/api/health || exit 1
+ENTRYPOINT ["workshop-entrypoint"]

apps/store/README.md

@@ -0,0 +1,45 @@
+# Homarr Workshop backend
+
+PocketBase provides the central Workshop API at `store.homarr.dev`. It is not a per-instance Homarr service. Local deployment is for development and integration testing.
+
+## Local startup
+
+1. Copy `.env.example` to `.env` and create a GitHub OAuth app.
+2. Set its callback URL to `http://localhost:8090/api/oauth2-redirect`.
+3. Set `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`, `PB_SUPERUSER_EMAIL`, and `PB_SUPERUSER_PASSWORD`.
+4. Run `docker compose up --build` from this directory.
+
+The API is at `http://localhost:8090`; the emergency PocketBase dashboard is at `http://localhost:8090/_/`. Day-to-day moderation belongs in `/workshop/admin`, not the PocketBase dashboard.
+
+The image downloads the official PocketBase `0.39.6` release and verifies it against that release's `checksums.txt`. Migrations and hooks are mounted read-only.
+
+## Roles and account states
+
+- `member`: publish, update/delete owned submissions, vote, and report.
+- `moderator`: report queue, submission removal, posting bans, and account disable/restore.
+- `admin`: moderator actions plus role changes.
+- `posting_banned`: cannot create or update submissions; can browse, vote, and report.
+- `disabled`: cannot authenticate or write.
+
+Bootstrap the first admin through the PocketBase dashboard by changing a GitHub-authenticated user's role. All later staff actions use the restricted Workshop back office and are recorded in `moderation_actions`.
+
+## Backup and restore
+
+PocketBase stores records and uploads in `/pb_data`. Stop writes or stop the container, then archive the named volume:
+
+```sh
+docker compose stop workshop
+docker run --rm -v store_workshop_data:/data -v "$PWD":/backup alpine tar czf /backup/workshop-backup.tgz -C /data .
+docker compose start workshop
+```
+
+Restore only into the same PocketBase version after preserving the current volume. Extract the archive into an empty `workshop_data` volume, start the service, and verify `/api/health`, collection migrations, a listing request, and an authenticated write.
+
+## Production checklist
+
+- Terminate TLS at the reverse proxy and forward the real client IP.
+- Keep superuser credentials outside Compose and rotate them after bootstrap.
+- Restrict the dashboard path to operators; GitHub users never need it.
+- Review the versioned default rate limits for OAuth, submissions, votes, reports, moderation, and general API traffic against production load before launch.
+- Back up `/pb_data` before every PocketBase or migration upgrade and test restore regularly.
+- Monitor health, authentication failures, 429/5xx responses, moderation actions, disk use, and backup age.

apps/store/docker-compose.yml

@@ -0,0 +1,24 @@
+services:
+  workshop:
+    build:
+      context: .
+      args:
+        POCKETBASE_VERSION: 0.39.6
+    image: homarr/workshop-pocketbase:0.39.6
+    restart: unless-stopped
+    environment:
+      GITHUB_CLIENT_ID: ${GITHUB_CLIENT_ID:-}
+      GITHUB_CLIENT_SECRET: ${GITHUB_CLIENT_SECRET:-}
+      PB_SUPERUSER_EMAIL: ${PB_SUPERUSER_EMAIL:-}
+      PB_SUPERUSER_PASSWORD: ${PB_SUPERUSER_PASSWORD:-}
+    ports:
+      - "${PB_EXPOSE_PORT:-8090}:8090"
+    volumes:
+      - workshop_data:/pb_data
+      - ./pb_hooks:/pb_hooks:ro
+      - ./pb_migrations:/pb_migrations:ro
+    security_opt:
+      - no-new-privileges:true
+
+volumes:
+  workshop_data:

apps/store/entrypoint.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+set -eu
+
+chown -R pocketbase:pocketbase /pb_data
+
+if [ -n "${PB_SUPERUSER_EMAIL:-}" ] && [ -n "${PB_SUPERUSER_PASSWORD:-}" ]; then
+  su-exec pocketbase pocketbase superuser upsert "${PB_SUPERUSER_EMAIL}" "${PB_SUPERUSER_PASSWORD}" --dir=/pb_data
+fi
+
+exec su-exec pocketbase pocketbase serve \
+  --http=0.0.0.0:8090 \
+  --dir=/pb_data \
+  --hooksDir=/pb_hooks \
+  --migrationsDir=/pb_migrations

apps/store/pb_hooks/workshop-utils.js

@@ -0,0 +1,102 @@
+const WIDGET_SCHEMA = "homarr-custom-widget-v2";
+const CSS_SCHEMA = "homarr-custom-css-v1";
+const CSS_LIMIT = 16384;
+const WIDGET_AUTH_TYPES = ["none", "bearer", "basic", "apiKeyHeader", "apiKeyQuery"];
+const WIDGET_METHODS = ["GET", "POST", "PUT", "DELETE", "PATCH"];
+const WIDGET_DISPLAY_TYPES = [
+  "singleValue",
+  "keyValue",
+  "table",
+  "statGrid",
+  "progressBars",
+  "statusIndicator",
+  "countGrid",
+  "raw",
+  "actionButton",
+  "customJsx",
+];
+
+function fail(ErrorType, _code, message) {
+  throw new ErrorType(message);
+}
+
+function requireWritableAccount(app, auth, posting) {
+  if (!auth) fail(UnauthorizedError, "authentication_required", "Authentication is required");
+  const account = app.findRecordById("users", auth.id);
+  if (account.getString("state") === "disabled") fail(ForbiddenError, "account_disabled", "Account is disabled");
+  if (posting && account.getString("state") === "posting_banned")
+    fail(ForbiddenError, "posting_banned", "Account cannot publish submissions");
+  return account;
+}
+
+function validateSubmission(record) {
+  const type = record.getString("type");
+  const content = record.getString("content");
+  if (type === "css") {
+    if (!content.trim()) fail(BadRequestError, "invalid_submission", "CSS cannot be empty");
+    if (content.length > CSS_LIMIT) fail(BadRequestError, "invalid_submission", "CSS is too large");
+    record.set("schemaVersion", CSS_SCHEMA);
+    return;
+  }
+  if (type !== "widget") fail(BadRequestError, "invalid_submission", "Unsupported submission type");
+  let widget;
+  try {
+    widget = JSON.parse(content);
+  } catch {
+    fail(BadRequestError, "invalid_submission", "Widget content is not valid JSON");
+  }
+  if (
+    !widget ||
+    widget.$schema !== WIDGET_SCHEMA ||
+    typeof widget.name !== "string" ||
+    widget.name.length < 1 ||
+    widget.name.length > 128 ||
+    typeof widget.url !== "string" ||
+    widget.url.length < 1 ||
+    !WIDGET_AUTH_TYPES.includes(widget.authType) ||
+    !WIDGET_METHODS.includes(widget.method) ||
+    !WIDGET_DISPLAY_TYPES.includes(widget.displayType) ||
+    typeof widget.displayConfig !== "object" ||
+    Array.isArray(widget.displayConfig) ||
+    Object.prototype.hasOwnProperty.call(widget, "secrets")
+  ) {
+    fail(BadRequestError, "invalid_submission", "Widget does not match homarr-custom-widget-v2");
+  }
+  if (!widget.displayConfig || widget.displayConfig.type !== widget.displayType) {
+    fail(BadRequestError, "invalid_submission", "Widget displayConfig.type must match displayType");
+  }
+  record.set("schemaVersion", WIDGET_SCHEMA);
+}
+
+function snapshot(record) {
+  return JSON.stringify(record.publicExport());
+}
+
+function requireStaff(app, auth) {
+  const account = requireWritableAccount(app, auth, false);
+  const role = account.getString("role");
+  if (role !== "moderator" && role !== "admin") fail(ForbiddenError, "forbidden", "Staff access is required");
+  return role;
+}
+
+function body(e) {
+  const data = new DynamicModel({ reason: "", state: "", role: "", status: "" });
+  e.bindBody(data);
+  if (!data.reason || data.reason.trim().length < 3)
+    fail(BadRequestError, "invalid_submission", "A reason is required");
+  return data;
+}
+
+function audit(app, actor, action, targetType, targetId, reason, targetSnapshot) {
+  const collection = app.findCollectionByNameOrId("moderation_actions");
+  const record = new Record(collection);
+  record.set("actor", actor.id);
+  record.set("action", action);
+  record.set("targetType", targetType);
+  record.set("targetId", targetId);
+  record.set("reason", reason.trim());
+  record.set("snapshot", targetSnapshot || "");
+  app.save(record);
+}
+
+module.exports = { audit, body, fail, requireStaff, requireWritableAccount, snapshot, validateSubmission };

apps/store/pb_hooks/workshop.pb.js

@@ -0,0 +1,168 @@
+/// <reference path="../pb_data/types.d.ts" />
+
+onRecordAuthWithOAuth2Request((e) => {
+  const utils = require(`${__hooks}/workshop-utils.js`);
+  if (e.record && e.record.getString("state") === "disabled")
+    utils.fail(ForbiddenError, "account_disabled", "Account is disabled");
+  if (e.isNewRecord) {
+    e.createData.displayName = e.oAuth2User.name || e.oAuth2User.username || "Community member";
+    e.createData.avatarUrl = e.oAuth2User.avatarUrl || "";
+    e.createData.role = "member";
+    e.createData.state = "active";
+  }
+  e.next();
+}, "users");
+
+onRecordAuthRequest((e) => {
+  const utils = require(`${__hooks}/workshop-utils.js`);
+  if (e.record.getString("state") === "disabled") utils.fail(ForbiddenError, "account_disabled", "Account is disabled");
+  e.next();
+}, "users");
+
+onRecordUpdateRequest((e) => {
+  const original = e.app.findRecordById("users", e.record.id);
+  e.record.set("role", original.get("role"));
+  e.record.set("state", original.get("state"));
+  e.record.set("moderationReason", original.get("moderationReason"));
+  e.next();
+}, "users");
+
+onRecordCreateRequest((e) => {
+  const utils = require(`${__hooks}/workshop-utils.js`);
+  const account = utils.requireWritableAccount(e.app, e.auth, true);
+  utils.validateSubmission(e.record);
+  e.record.set("author", e.auth.id);
+  e.record.set("authorName", account.getString("displayName"));
+  e.record.set("revision", 1);
+  e.next();
+}, "submissions");
+
+onRecordUpdateRequest((e) => {
+  const utils = require(`${__hooks}/workshop-utils.js`);
+  utils.requireWritableAccount(e.app, e.auth, true);
+  const original = e.app.findRecordById("submissions", e.record.id);
+  e.record.set("author", original.get("author"));
+  e.record.set("authorName", original.get("authorName"));
+  e.record.set("type", original.get("type"));
+  e.record.set("schemaVersion", original.get("schemaVersion"));
+  e.record.set(
+    "revision",
+    original.getInt("revision") + (e.record.getString("content") !== original.getString("content") ? 1 : 0),
+  );
+  utils.validateSubmission(e.record);
+  e.next();
+}, "submissions");
+
+onRecordCreateRequest((e) => {
+  const utils = require(`${__hooks}/workshop-utils.js`);
+  utils.requireWritableAccount(e.app, e.auth, false);
+  const value = e.record.getInt("value");
+  if (value !== 1 && value !== -1) throw new BadRequestError("Vote must be 1 or -1");
+  e.record.set("user", e.auth.id);
+  e.next();
+}, "votes");
+
+onRecordUpdateRequest((e) => {
+  const utils = require(`${__hooks}/workshop-utils.js`);
+  utils.requireWritableAccount(e.app, e.auth, false);
+  const original = e.app.findRecordById("votes", e.record.id);
+  const value = e.record.getInt("value");
+  if (value !== 1 && value !== -1) throw new BadRequestError("Vote must be 1 or -1");
+  e.record.set("user", original.get("user"));
+  e.record.set("submission", original.get("submission"));
+  e.next();
+}, "votes");
+
+onRecordCreateRequest((e) => {
+  const utils = require(`${__hooks}/workshop-utils.js`);
+  utils.requireWritableAccount(e.app, e.auth, false);
+  e.record.set("reporter", e.auth.id);
+  e.record.set("status", "open");
+  e.next();
+}, "reports");
+
+routerAdd(
+  "POST",
+  "/api/workshop/moderation/submissions/{id}/remove",
+  (e) => {
+    const utils = require(`${__hooks}/workshop-utils.js`);
+    utils.requireStaff(e.app, e.auth);
+    const data = utils.body(e);
+    const id = e.request.pathValue("id");
+    e.app.runInTransaction((tx) => {
+      const target = tx.findRecordById("submissions", id);
+      utils.audit(tx, e.auth, "remove_submission", "submission", id, data.reason, utils.snapshot(target));
+      tx.delete(target);
+    });
+    return e.json(200, { success: true });
+  },
+  $apis.requireAuth("users"),
+);
+
+routerAdd(
+  "POST",
+  "/api/workshop/moderation/users/{id}/state",
+  (e) => {
+    const utils = require(`${__hooks}/workshop-utils.js`);
+    const actorRole = utils.requireStaff(e.app, e.auth);
+    const data = utils.body(e);
+    if (!["active", "posting_banned", "disabled"].includes(data.state))
+      throw new BadRequestError("Invalid account state");
+    const id = e.request.pathValue("id");
+    if (id === e.auth.id) throw new BadRequestError("You cannot moderate your own account");
+    e.app.runInTransaction((tx) => {
+      const target = tx.findRecordById("users", id);
+      if (target.getString("role") === "admin" && actorRole !== "admin") throw new ForbiddenError("forbidden");
+      const previous = utils.snapshot(target);
+      target.set("state", data.state);
+      target.set("moderationReason", data.reason);
+      tx.save(target);
+      utils.audit(tx, e.auth, "set_account_state", "user", id, data.reason, previous);
+    });
+    return e.json(200, { success: true });
+  },
+  $apis.requireAuth("users"),
+);
+
+routerAdd(
+  "POST",
+  "/api/workshop/moderation/users/{id}/role",
+  (e) => {
+    const utils = require(`${__hooks}/workshop-utils.js`);
+    if (utils.requireStaff(e.app, e.auth) !== "admin") throw new ForbiddenError("forbidden");
+    const data = utils.body(e);
+    if (!["member", "moderator", "admin"].includes(data.role)) throw new BadRequestError("Invalid role");
+    const id = e.request.pathValue("id");
+    if (id === e.auth.id) throw new BadRequestError("You cannot change your own role");
+    e.app.runInTransaction((tx) => {
+      const target = tx.findRecordById("users", id);
+      const previous = utils.snapshot(target);
+      target.set("role", data.role);
+      tx.save(target);
+      utils.audit(tx, e.auth, "set_role", "user", id, data.reason, previous);
+    });
+    return e.json(200, { success: true });
+  },
+  $apis.requireAuth("users"),
+);
+
+routerAdd(
+  "POST",
+  "/api/workshop/moderation/reports/{id}/resolve",
+  (e) => {
+    const utils = require(`${__hooks}/workshop-utils.js`);
+    utils.requireStaff(e.app, e.auth);
+    const data = utils.body(e);
+    if (!["resolved", "dismissed"].includes(data.status)) throw new BadRequestError("Invalid report status");
+    const id = e.request.pathValue("id");
+    e.app.runInTransaction((tx) => {
+      const target = tx.findRecordById("reports", id);
+      const previous = utils.snapshot(target);
+      target.set("status", data.status);
+      tx.save(target);
+      utils.audit(tx, e.auth, "resolve_report", "report", id, data.reason, previous);
+    });
+    return e.json(200, { success: true });
+  },
+  $apis.requireAuth("users"),
+);

apps/store/pb_migrations/1783900000_workshop_v2.js

@@ -0,0 +1,248 @@
+/// <reference path="../pb_data/types.d.ts" />
+
+migrate(
+  (app) => {
+    let users;
+    try {
+      users = app.findCollectionByNameOrId("users");
+    } catch {
+      users = new Collection({
+        type: "auth",
+        name: "users",
+        listRule: "@request.auth.role = 'moderator' || @request.auth.role = 'admin'",
+        viewRule: "id = @request.auth.id || @request.auth.role = 'moderator' || @request.auth.role = 'admin'",
+        updateRule: "id = @request.auth.id && @request.auth.state != 'disabled'",
+        deleteRule: null,
+        passwordAuth: { enabled: false },
+      });
+    }
+    // PocketBase creates a default users auth collection on first boot, so
+    // Workshop fields must be added to the existing collection explicitly.
+    users.fields.add(
+      new TextField({ name: "displayName", required: true, min: 1, max: 100 }),
+      new URLField({ name: "avatarUrl" }),
+      new SelectField({ name: "role", required: true, maxSelect: 1, values: ["member", "moderator", "admin"] }),
+      new SelectField({
+        name: "state",
+        required: true,
+        maxSelect: 1,
+        values: ["active", "posting_banned", "disabled"],
+      }),
+      new TextField({ name: "moderationReason", max: 1000 }),
+    );
+    const githubClientId = $os.getenv("GITHUB_CLIENT_ID");
+    const githubClientSecret = $os.getenv("GITHUB_CLIENT_SECRET");
+    users.oauth2.enabled = Boolean(githubClientId && githubClientSecret);
+    users.oauth2.providers =
+      githubClientId && githubClientSecret
+        ? [{ name: "github", clientId: githubClientId, clientSecret: githubClientSecret }]
+        : [];
+    app.save(users);
+
+    const staffRule = "@request.auth.role = 'moderator' || @request.auth.role = 'admin'";
+    const writableRule = "@request.auth.id != '' && @request.auth.state != 'disabled'";
+    const authorRule = "author = @request.auth.id && @request.auth.state = 'active'";
+
+    const submissions = new Collection({
+      type: "base",
+      name: "submissions",
+      // Full source is intentionally available only through getOne; discovery
+      // must use workshop_listings so list payloads never contain content.
+      listRule: null,
+      viewRule: "",
+      createRule: null,
+      updateRule: null,
+      deleteRule: null,
+      fields: [
+        { type: "select", name: "type", required: true, maxSelect: 1, values: ["widget", "css"] },
+        { type: "text", name: "title", required: true, min: 3, max: 100 },
+        { type: "text", name: "description", max: 2000 },
+        { type: "text", name: "schemaVersion", required: true, max: 100 },
+        { type: "text", name: "content", required: true, max: 1000000 },
+        {
+          type: "file",
+          name: "screenshots",
+          maxSelect: 5,
+          maxSize: 5242880,
+          mimeTypes: ["image/png", "image/jpeg", "image/webp"],
+          thumbs: ["480x320", "960x640"],
+        },
+        {
+          type: "relation",
+          name: "author",
+          required: true,
+          maxSelect: 1,
+          collectionId: users.id,
+          cascadeDelete: true,
+        },
+        { type: "text", name: "authorName", required: true, max: 100 },
+        { type: "number", name: "revision", required: true, onlyInt: true, min: 1 },
+        { type: "text", name: "changelog", max: 2000 },
+        { type: "autodate", name: "created", onCreate: true },
+        { type: "autodate", name: "updated", onCreate: true, onUpdate: true },
+      ],
+    });
+    app.save(submissions);
+    submissions.createRule = "@request.auth.id != ''";
+    submissions.updateRule = authorRule;
+    submissions.deleteRule = authorRule;
+    submissions.addIndex("idx_submissions_author", false, "author", "");
+    submissions.addIndex("idx_submissions_type_created", false, "type, created", "");
+    app.save(submissions);
+
+    const votes = new Collection({
+      type: "base",
+      name: "votes",
+      listRule: null,
+      viewRule: null,
+      createRule: null,
+      updateRule: null,
+      deleteRule: null,
+      fields: [
+        {
+          type: "relation",
+          name: "submission",
+          required: true,
+          maxSelect: 1,
+          collectionId: submissions.id,
+          cascadeDelete: true,
+        },
+        { type: "relation", name: "user", required: true, maxSelect: 1, collectionId: users.id, cascadeDelete: true },
+        { type: "number", name: "value", required: true, onlyInt: true, min: -1, max: 1 },
+        { type: "autodate", name: "created", onCreate: true },
+        { type: "autodate", name: "updated", onCreate: true, onUpdate: true },
+      ],
+    });
+    app.save(votes);
+    votes.listRule = "user = @request.auth.id";
+    votes.viewRule = "user = @request.auth.id";
+    votes.createRule = writableRule;
+    votes.updateRule = "user = @request.auth.id && @request.auth.state != 'disabled'";
+    votes.deleteRule = "user = @request.auth.id && @request.auth.state != 'disabled'";
+    votes.addIndex("idx_votes_user_submission", true, "user, submission", "");
+    votes.addIndex("idx_votes_submission", false, "submission", "");
+    app.save(votes);
+
+    const reports = new Collection({
+      type: "base",
+      name: "reports",
+      listRule: null,
+      viewRule: null,
+      createRule: null,
+      updateRule: null,
+      deleteRule: null,
+      fields: [
+        {
+          type: "relation",
+          name: "submission",
+          required: true,
+          maxSelect: 1,
+          collectionId: submissions.id,
+          cascadeDelete: true,
+        },
+        {
+          type: "relation",
+          name: "reporter",
+          required: true,
+          maxSelect: 1,
+          collectionId: users.id,
+          cascadeDelete: true,
+        },
+        {
+          type: "select",
+          name: "category",
+          required: true,
+          maxSelect: 1,
+          values: ["malicious", "spam", "copyright", "inappropriate", "other"],
+        },
+        { type: "text", name: "explanation", required: true, min: 3, max: 1000 },
+        { type: "select", name: "status", required: true, maxSelect: 1, values: ["open", "resolved", "dismissed"] },
+        { type: "autodate", name: "created", onCreate: true },
+        { type: "autodate", name: "updated", onCreate: true, onUpdate: true },
+      ],
+    });
+    app.save(reports);
+    reports.listRule = staffRule;
+    reports.viewRule = staffRule;
+    reports.createRule = writableRule;
+    reports.addIndex("idx_reports_reporter_submission", true, "reporter, submission", "");
+    reports.addIndex("idx_reports_status_created", false, "status, created", "");
+    app.save(reports);
+
+    const moderationActions = new Collection({
+      type: "base",
+      name: "moderation_actions",
+      listRule: staffRule,
+      viewRule: staffRule,
+      createRule: null,
+      updateRule: null,
+      deleteRule: null,
+      fields: [
+        { type: "relation", name: "actor", required: true, maxSelect: 1, collectionId: users.id },
+        {
+          type: "select",
+          name: "action",
+          required: true,
+          maxSelect: 1,
+          values: ["remove_submission", "set_account_state", "set_role", "resolve_report"],
+        },
+        { type: "text", name: "targetType", required: true, max: 30 },
+        { type: "text", name: "targetId", required: true, max: 30 },
+        { type: "text", name: "reason", required: true, min: 3, max: 1000 },
+        { type: "text", name: "snapshot", max: 100000 },
+        { type: "autodate", name: "created", onCreate: true },
+      ],
+    });
+    app.save(moderationActions);
+    moderationActions.addIndex("idx_moderation_actions_created", false, "created", "");
+    app.save(moderationActions);
+
+    const listings = new Collection({
+      type: "view",
+      name: "workshop_listings",
+      listRule: "",
+      viewRule: "",
+      viewQuery: `
+        SELECT s.id, s.type, s.title, s.description, s.schemaVersion, s.screenshots,
+          s.revision, s.changelog, s.author, s.authorName, s.created, s.updated,
+          COALESCE(SUM(CASE WHEN v.value = 1 THEN 1 ELSE 0 END), 0) AS upvotes,
+          COALESCE(SUM(CASE WHEN v.value = -1 THEN 1 ELSE 0 END), 0) AS downvotes,
+          COALESCE(SUM(v.value), 0) AS score
+        FROM submissions s
+        LEFT JOIN votes v ON v.submission = s.id
+        GROUP BY s.id
+      `,
+    });
+    app.save(listings);
+
+    const settings = app.settings();
+    settings.rateLimits.enabled = true;
+    settings.rateLimits.rules = [
+      { label: "*:auth", audience: "", duration: 60, maxRequests: 10 },
+      { label: "submissions:create", audience: "@auth", duration: 60, maxRequests: 10 },
+      { label: "votes:create", audience: "@auth", duration: 10, maxRequests: 20 },
+      { label: "reports:create", audience: "@auth", duration: 60, maxRequests: 5 },
+      { label: "/api/workshop/moderation/", audience: "@auth", duration: 60, maxRequests: 30 },
+      { label: "/api/", audience: "", duration: 10, maxRequests: 300 },
+    ];
+    settings.logs.maxDays = 30;
+    settings.logs.logAuthId = true;
+    settings.logs.logIP = true;
+    app.save(settings);
+  },
+  (app) => {
+    // PocketBase creates the users auth collection before this migration. Keep
+    // it intact on rollback so reverting Workshop can never delete accounts.
+    for (const name of ["workshop_listings", "moderation_actions", "reports", "votes", "submissions"]) {
+      try {
+        app.delete(app.findCollectionByNameOrId(name));
+      } catch {
+        // Collection was not created or was already removed.
+      }
+    }
+    const settings = app.settings();
+    settings.rateLimits.enabled = false;
+    settings.rateLimits.rules = [];
+    app.save(settings);
+  },
+);

apps/store/tests/run-integration.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+set -eu
+
+project="homarr-workshop-integration"
+port="${WORKSHOP_TEST_PORT:-18091}"
+email="integration@homarr.test"
+password="WorkshopIntegrationPassword123!"
+
+cleanup() {
+  PB_EXPOSE_PORT="$port" docker compose --file apps/store/docker-compose.yml --project-name "$project" down --volumes >/dev/null 2>&1 || true
+}
+trap cleanup EXIT INT TERM
+cleanup
+
+PB_EXPOSE_PORT="$port" \
+PB_SUPERUSER_EMAIL="$email" \
+PB_SUPERUSER_PASSWORD="$password" \
+docker compose --file apps/store/docker-compose.yml --project-name "$project" up --detach --build --wait
+
+if ! WORKSHOP_TEST_URL="http://127.0.0.1:$port" \
+  WORKSHOP_TEST_SUPERUSER_EMAIL="$email" \
+  WORKSHOP_TEST_SUPERUSER_PASSWORD="$password" \
+  node apps/store/tests/workshop.integration.mjs; then
+  docker compose --file apps/store/docker-compose.yml --project-name "$project" logs --no-color workshop
+  exit 1
+fi

apps/store/tests/workshop.integration.mjs

@@ -0,0 +1,165 @@
+import assert from "node:assert/strict";
+
+import PocketBase, { ClientResponseError } from "pocketbase";
+
+const baseUrl = process.env.WORKSHOP_TEST_URL;
+const superuserEmail = process.env.WORKSHOP_TEST_SUPERUSER_EMAIL;
+const superuserPassword = process.env.WORKSHOP_TEST_SUPERUSER_PASSWORD;
+assert(baseUrl && superuserEmail && superuserPassword, "Workshop integration test environment is incomplete");
+
+const root = new PocketBase(baseUrl);
+await root.collection("_superusers").authWithPassword(superuserEmail, superuserPassword);
+
+const createUser = async (name, role = "member", state = "active") => {
+  const password = `Workshop${name}Password123!`;
+  return root.collection("users").create({
+    email: `${name.toLowerCase()}@homarr.test`,
+    password,
+    passwordConfirm: password,
+    verified: true,
+    displayName: name,
+    role,
+    state,
+  });
+};
+
+const expectStatus = async (operation, status) => {
+  const statuses = Array.isArray(status) ? status : [status];
+  await assert.rejects(operation, (error) => error instanceof ClientResponseError && statuses.includes(error.status));
+};
+
+const memberRecord = await createUser("Member");
+const secondMemberRecord = await createUser("SecondMember");
+const bannedRecord = await createUser("Banned", "member", "posting_banned");
+const disabledRecord = await createUser("Disabled");
+const moderatorRecord = await createUser("Moderator", "moderator");
+const adminRecord = await createUser("Admin", "admin");
+
+const member = await root.collection("users").impersonate(memberRecord.id, 3600);
+const secondMember = await root.collection("users").impersonate(secondMemberRecord.id, 3600);
+const banned = await root.collection("users").impersonate(bannedRecord.id, 3600);
+const disabled = await root.collection("users").impersonate(disabledRecord.id, 3600);
+const moderator = await root.collection("users").impersonate(moderatorRecord.id, 3600);
+const admin = await root.collection("users").impersonate(adminRecord.id, 3600);
+
+const forgedMember = await member.collection("users").update(memberRecord.id, {
+  role: "admin",
+  state: "posting_banned",
+  moderationReason: "self escalation",
+});
+assert.equal(forgedMember.role, "member", "members must not change their own role");
+assert.equal(forgedMember.state, "active", "members must not change their own account state");
+assert.equal(forgedMember.moderationReason, "", "members must not change protected moderation fields");
+
+await admin.send(`/api/workshop/moderation/users/${disabledRecord.id}/state`, {
+  method: "POST",
+  body: { state: "disabled", reason: "Integration disable" },
+});
+
+const submission = await member.collection("submissions").create({
+  type: "css",
+  title: "Integration theme",
+  description: "A backend integration fixture",
+  schemaVersion: "forged-version",
+  content: ":root { --homarr-test: #fff; }",
+  author: secondMemberRecord.id,
+  authorName: "Forged",
+  revision: 99,
+});
+assert.equal(submission.author, memberRecord.id, "server must enforce ownership");
+assert.equal(submission.authorName, "Member", "server must snapshot the authenticated author name");
+assert.equal(submission.revision, 1, "server must own the initial revision");
+assert.equal(submission.schemaVersion, "homarr-custom-css-v1", "server must own schemaVersion");
+
+await expectStatus(
+  () => banned.collection("submissions").create({ type: "css", title: "Blocked theme", content: "body {}" }),
+  403,
+);
+await expectStatus(() => disabled.collection("votes").create({ submission: submission.id, value: 1 }), [400, 403]);
+await expectStatus(
+  () =>
+    member.collection("submissions").create({
+      type: "widget",
+      title: "Invalid widget",
+      content: JSON.stringify({ $schema: "homarr-custom-widget-v2", name: "Missing contract" }),
+    }),
+  400,
+);
+
+const vote = await member.collection("votes").create({ submission: submission.id, value: 1 });
+await expectStatus(() => member.collection("votes").create({ submission: submission.id, value: -1 }), 400);
+assert.equal(
+  (await member.collection("votes").update(vote.id, { submission: "forged", user: "forged", value: -1 })).submission,
+  submission.id,
+);
+
+const report = await secondMember.collection("reports").create({
+  submission: submission.id,
+  reporter: memberRecord.id,
+  category: "spam",
+  explanation: "Integration report",
+  status: "dismissed",
+});
+assert.equal(report.reporter, secondMemberRecord.id);
+assert.equal(report.status, "open");
+assert.equal((await member.collection("reports").getList()).totalItems, 0, "reports must remain private from members");
+assert.equal((await moderator.collection("reports").getList()).items.length, 1);
+
+await expectStatus(
+  () =>
+    member.send(`/api/workshop/moderation/users/${secondMemberRecord.id}/state`, {
+      method: "POST",
+      body: { state: "posting_banned", reason: "No permission" },
+    }),
+  403,
+);
+await expectStatus(
+  () =>
+    moderator.send(`/api/workshop/moderation/users/${adminRecord.id}/state`, {
+      method: "POST",
+      body: { state: "disabled", reason: "Cannot alter admin" },
+    }),
+  403,
+);
+await expectStatus(
+  () =>
+    moderator.send(`/api/workshop/moderation/users/${secondMemberRecord.id}/role`, {
+      method: "POST",
+      body: { role: "moderator", reason: "Cannot promote" },
+    }),
+  403,
+);
+
+await admin.send(`/api/workshop/moderation/users/${secondMemberRecord.id}/role`, {
+  method: "POST",
+  body: { role: "moderator", reason: "Integration promotion" },
+});
+assert.equal((await root.collection("users").getOne(secondMemberRecord.id)).role, "moderator");
+
+await moderator.send(`/api/workshop/moderation/reports/${report.id}/resolve`, {
+  method: "POST",
+  body: { status: "resolved", reason: "Integration resolution" },
+});
+assert.equal((await root.collection("reports").getOne(report.id)).status, "resolved");
+
+await moderator.send(`/api/workshop/moderation/submissions/${submission.id}/remove`, {
+  method: "POST",
+  body: { reason: "Integration removal" },
+});
+await expectStatus(() => root.collection("submissions").getOne(submission.id), 404);
+await expectStatus(() => root.collection("votes").getOne(vote.id), 404);
+await expectStatus(() => root.collection("reports").getOne(report.id), 404);
+
+const actions = await root.collection("moderation_actions").getFullList({ sort: "created" });
+assert.deepEqual(
+  actions.map((action) => action.action),
+  ["set_account_state", "set_role", "resolve_report", "remove_submission"],
+);
+assert(actions.at(-1)?.snapshot.includes("Integration theme"), "removal audit must retain a target snapshot");
+
+const anonymous = new PocketBase(baseUrl);
+const listings = await anonymous.collection("workshop_listings").getList();
+assert.equal(listings.totalItems, 0);
+await expectStatus(() => anonymous.collection("submissions").getList(), 403);
+
+console.log("Workshop backend integration matrix passed");

audit.md

@@ -0,0 +1,78 @@
+# Workshop V2 audit
+
+## Purpose
+
+The Workshop is Homarr's central community catalog for custom widgets and CSS themes. It must let people discover, inspect, export, publish, update, report, and install creations from homarr.dev and from Homarr itself without requiring raw copy-and-paste as the default workflow.
+
+### Feature North Star
+
+A Homarr user can move from a useful local creation to a safe community submission, or from a community listing to an installed local creation, in one understandable flow with source visibility and an explicit confirmation boundary.
+
+### Developer-experience North Star
+
+Workshop behavior is defined once: one typed contract, one client, versioned PocketBase migrations, deterministic local startup, shared validation fixtures, typed failures, and UI components that contain presentation rather than PocketBase queries or authorization rules.
+
+## Baseline audit
+
+The abandoned prototype is preserved at `origin/feat/widget-store-prototype-backup` (`89260b875`). This rewrite starts at `dev` commit `ba7718bde`.
+
+| Area          | Severity | Baseline finding                                                                                                                    | V2 resolution                                                                                                      |
+| ------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| Branch health | P0       | PR #5984 was based on an obsolete `dev` commit and conflicted with the current branch.                                              | Rebuild from current `dev`; keep the old head on a backup ref.                                                     |
+| Security      | P0       | Submission validation ran in browsers and could be bypassed with direct PocketBase writes.                                          | Enforce validation, ownership, account state, immutable fields, and upload limits in PocketBase hooks and rules.   |
+| Moderation    | P0       | There were no moderator roles, posting bans, disabled accounts, least-privilege actions, or durable moderation history.             | Add roles, account states, explicit moderation routes, a staff UI, and append-only actions.                        |
+| Architecture  | P1       | Docs and Next.js defined separate record types, queries, mutations, sorting, voting, and error behavior.                            | Add `@homarr/workshop` as the only public contract and API client.                                                 |
+| Performance   | P1       | The browser downloaded every submission and full content, then searched, sorted, and filtered locally.                              | Server-side pagination/filtering/sorting; summary views exclude content.                                           |
+| Product       | P1       | Website and app flows were disconnected and sharing still depended on manual content transfer.                                      | Add contextual install and direct share actions backed by canonical exports.                                       |
+| UX/UI         | P1       | A large bespoke Docusaurus component set and a separate Mantine modal produced inconsistent interaction and state behavior.         | Use each host's native components with shared flows, copy rules, contracts, and states.                            |
+| Accessibility | P1       | Several custom interactive elements bypassed semantic controls and touch targets; focus and reduced-motion behavior was incomplete. | Require semantic controls, visible focus, keyboard operation, 44px touch targets, AA contrast, and reduced motion. |
+| Operations    | P1       | A third-party PocketBase image and incomplete bootstrap docs made builds and recovery non-deterministic.                            | Build a pinned official binary with checksum verification; document health, backup, restore, OAuth, and upgrades.  |
+| Testing       | P1       | Tests covered a narrow client schema and did not exercise API rules, roles, auth states, moderation, or cross-surface flows.        | Add contract, backend permission-matrix, UI, and end-to-end coverage.                                              |
+| Documentation | P2       | Documentation advertised a supported self-hosted Workshop even though V2 is a central Homarr service.                               | Document the central service and local-development overrides only.                                                 |
+
+## Decisions
+
+- Public name: **Workshop**.
+- Launch content: custom widgets (`homarr-custom-widget-v2`) and CSS (`homarr-custom-css-v1`).
+- Identity: GitHub OAuth only.
+- Community features: votes and reports; comments are removed.
+- Hosting: one Homarr-operated service at `store.homarr.dev`; overrides are development-only.
+- Publishing: immediate, with source inspection, reporting, and staff removal.
+- Staff: GitHub-authenticated moderators/admins use `/workshop/admin`; PocketBase superusers are bootstrap/emergency access.
+
+## Launch acceptance
+
+- [x] Anonymous users can browse, search, filter, inspect, copy, and download without receiving full content in listing responses.
+- [x] Members can publish, update, delete, vote, and report; ownership and schemas are enforced server-side.
+- [x] Posting-banned users cannot create or update submissions but can browse, vote, and report.
+- [x] Disabled accounts cannot authenticate or write, including with an existing token.
+- [x] Moderators can resolve reports, remove submissions, posting-ban users, and disable/restore non-admin users.
+- [x] Only admins can change roles; staff actions are append-only and attributable.
+- [x] Homarr can export/share local widgets and CSS and validate/confirm Workshop installs.
+- [x] Website and app implement loading, empty, offline, validation, permission, and destructive-action states.
+- [x] Keyboard semantics, mobile layout, dark mode, reduced motion, and horizontal overflow received a browser smoke test.
+- [x] Clean PocketBase startup, migration, health, backup, and restore procedures are reproducible and documented.
+- [ ] Add automated authenticated cross-surface E2E coverage before changing the PR from draft to ready.
+
+## Deferred after V2
+
+Comments, private Workshop deployments, automated approval queues, follows, collections, notifications, arbitrary package types, historical version installation, and personalized recommendations.
+
+## Exit scorecard
+
+The baseline has three P0, seven P1, and one P2 findings. The rewrite closes every product, security, architecture, moderation, performance, operations, documentation, UX, and DX finding. One P1 release-verification item remains: automated authenticated E2E across both public and in-app surfaces. Keep PR #5984 in draft until it lands.
+
+| Gate                        | Result  | Evidence                                                                                                                                                                                          |
+| --------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Branch ancestry             | Pass    | Rebuilt from `dev` at `ba7718bde`; prototype preserved at `origin/feat/widget-store-prototype-backup`.                                                                                            |
+| Contract                    | Pass    | Five Vitest cases cover widget/CSS fixtures, filenames, limits, screenshot validation, and round trips.                                                                                           |
+| Backend                     | Pass    | Disposable PocketBase integration matrix covers roles, account states, ownership forgery, schema rejection, duplicate votes, private reports, escalation, deletion cascades, and audit snapshots. |
+| Backend operations          | Pass    | PocketBase 0.39.6 image builds with checksum verification; clean migration, health, and listing/detail access boundaries pass.                                                                    |
+| Type safety                 | Pass    | Scoped Turbo typecheck passes for Workshop, Docs, and Next.js.                                                                                                                                    |
+| Lint                        | Pass    | Scoped lint exits clean; remaining warnings predate the rewrite. Workshop has zero warnings.                                                                                                      |
+| Format                      | Pass    | Every changed supported file passes `oxfmt --check`; repository-wide Docs formatting still reports pre-existing drift.                                                                            |
+| Production builds           | Pass    | Docusaurus and Next.js production builds pass under Node 24.18.0.                                                                                                                                 |
+| Browser smoke               | Pass    | Desktop and 390px mobile discovery render without console errors or horizontal overflow; semantic labels, skip link, dark mode, and reduced motion are active.                                    |
+| Automated cross-surface E2E | Open P1 | Authenticated website-to-Homarr publish/install and moderator flows still need browser automation.                                                                                                |
+
+Final implementation scores (10 is best): security 9, architecture/DX 9, moderation 9, performance 9, responsive UI 9, theming 9, accessibility 8, automated testing 7. Accessibility remains below 9 until authenticated dialogs and destructive flows receive a full keyboard/screen-reader pass.

package.json

@@ -6,6 +6,10 @@
     "build": "cross-env CI=true turbo build",
     "clean": "git clean -xdf node_modules",
     "clean:workspaces": "turbo clean",
+    "ci:act:all": "bash scripts/ci/act.sh all",
+    "ci:act:cleanup": "bash scripts/ci/act.sh cleanup",
+    "ci:act:docker": "bash scripts/ci/act.sh docker",
+    "ci:act:fast": "bash scripts/ci/act.sh fast",
     "cli": "pnpm with-env tsx packages/cli/index.ts",
     "db:migration:mysql:generate": "pnpm -F db migration:mysql:generate",
     "db:migration:mysql:run": "pnpm -F db migration:mysql:run",
@@ -17,6 +21,7 @@
     "db:studio": "pnpm -F db studio",
     "dev": "pnpm -F nextjs dev",
     "dev:docs": "pnpm -F @homarr/docs dev",
+    "dev:workshop": "docker compose -f apps/store/docker-compose.yml up --build",
     "docker:dev": "docker compose -f ./development/development.docker-compose.yml up",
     "format": "turbo format --continue -- --check",
     "format:fix": "turbo format --continue",
@@ -29,10 +34,14 @@
     "start": "concurrently \"pnpm with-env node apps/tasks/tasks.cjs\" \"pnpm with-env node apps/websocket/wssServer.cjs\" \"pnpm -F nextjs start\"",
     "test": "cross-env NODE_ENV=development CI=true vitest run --exclude e2e --coverage.enabled ",
     "test:e2e": "cross-env NODE_ENV=development CI=true vitest e2e",
+    "test:workshop-backend": "bash apps/store/tests/run-integration.sh",
     "test:ui": "cross-env NODE_ENV=development CI=true vitest --exclude e2e --ui --coverage.enabled",
     "typecheck": "turbo typecheck",
     "with-env": "dotenv -e .env --"
   },
+  "dependencies": {
+    "jsonpath-plus": "catalog:"
+  },
   "devDependencies": {
     "@playwright/test": "catalog:",
     "@semantic-release/changelog": "catalog:",
@@ -64,8 +73,5 @@
     "node": ">=24.18.0",
     "pnpm": ">=11.10.0"
   },
-  "packageManager": "pnpm@11.10.0",
-  "dependencies": {
-    "jsonpath-plus": "catalog:"
-  }
+  "packageManager": "pnpm@11.10.0"
 }

packages/api/src/query-cache.ts

@@ -16,7 +16,7 @@ export const setActiveQueryCacheBoardId = (boardId: string | null) => {
 export const getActiveQueryCacheBoardId = () => activeQueryCacheBoardId;
 
 const persistableQueryPaths = new Set(["app.byId", "app.byIds", "docker.getContainers", "integration.byIds"]);
-const excludedWidgetPaths = new Set(["widget.app.ping"]);
+const excludedWidgetPaths = new Set(["widget.app.ping", "widget.beszel.getSystemStats"]);
 
 const getTrpcPathFromQueryKey = (queryKey: QueryKey) => {
   const first = queryKey[0];

packages/api/src/router/widgets/beszel.ts

@@ -207,6 +207,13 @@ export const beszelRouter = createTRPCRouter({
       return observable<LiveStatsEvent>((emit) => {
         const controller = new AbortController();
         let isActive = true;
+        let emittedEventCount = 0;
+
+        logger.debug("Beszel realtime subscription started", {
+          userId: ctx.session?.user?.id,
+          integrationIds: ctx.integrations.map((integration) => integration.id),
+          systemId: input.systemId,
+        });
 
         void (async () => {
           const integration = ctx.integrations[0];
@@ -223,7 +230,19 @@ export const beszelRouter = createTRPCRouter({
               await instance.subscribeRealtimeMetrics(
                 input.systemId,
                 (event) => {
-                  if (isActive) emit.next(event);
+                  if (!isActive) return;
+                  emittedEventCount += 1;
+                  if (emittedEventCount <= 2 || emittedEventCount % 60 === 0) {
+                    logger.debug("Forwarding Beszel realtime events", {
+                      userId: ctx.session?.user?.id,
+                      integrationId: integration.id,
+                      systemId: input.systemId,
+                      eventType: event.type,
+                      emittedEventCount,
+                      statsCount: Array.isArray(event.record.stats) ? event.record.stats.length : undefined,
+                    });
+                  }
+                  emit.next(event);
                 },
                 controller.signal,
               );
@@ -237,6 +256,13 @@ export const beszelRouter = createTRPCRouter({
             }
           } catch (error) {
             if (isActive) {
+              logger.warn("Beszel realtime subscription failed", {
+                userId: ctx.session?.user?.id,
+                integrationId: integration.id,
+                systemId: input.systemId,
+                emittedEventCount,
+                error: errorMessage(error),
+              });
               emit.error(
                 error instanceof TRPCError
                   ? error
@@ -249,12 +275,24 @@ export const beszelRouter = createTRPCRouter({
           }
 
           if (isActive) {
+            logger.debug("Beszel realtime subscription completed", {
+              userId: ctx.session?.user?.id,
+              integrationId: integration.id,
+              systemId: input.systemId,
+              emittedEventCount,
+            });
             emit.complete();
           }
         })();
 
         return () => {
           isActive = false;
+          logger.debug("Beszel realtime subscription cancelled", {
+            userId: ctx.session?.user?.id,
+            integrationIds: ctx.integrations.map((integration) => integration.id),
+            systemId: input.systemId,
+            emittedEventCount,
+          });
           controller.abort();
         };
       });

packages/api/src/test/query-cache.spec.ts

@@ -67,6 +67,8 @@ describe("isPersistableWidgetQueryKey", () => {
     [[["docker", "getContainers"], { type: "query" }], true],
     [[["integration", "byIds"], { type: "query" }], true],
     [[["widget", "app", "ping"], { type: "query", input: { id: "abc" } }], false],
+    [[["widget", "beszel", "getSystemStats"], { type: "query" }], false],
+    [[["widget", "beszel", "getSystems"], { type: "query" }], true],
     [[["app", "selectable"], { type: "query" }], false],
     [[["board", "getBoardByName"], { type: "query" }], false],
     [["widget"], false],

packages/common/src/number.ts

@@ -21,11 +21,17 @@ export const randomInt = (min: number, max: number) => {
 };
 
 /**
- *  Number of bytes to si format. (Division by 1024)
- *  Does not accept floats, size in bytes should be an integer.
- *  Will return "NaI" and logs a warning if a float is passed.
- *  Concat as parameters so it is not added if the returned value is "NaI" or "∞".
- *  Returns "∞" if the size is too large to be represented in the current format.
+ *  Number of bytes to a human-readable string using binary (KiB) suffixes.
+ *  Does not accept floats; size in bytes should be an integer.
+ *  Will return "NaI" and log a warning if a float is passed.
+ *  `concat` is appended after the unit so it is omitted when the returned
+ *  value is "NaI" or "∞". Returns "∞" if the size is too large to be
+ *  represented in the current format.
+ *
+ *  @deprecated Use `formatBytes` for single values, `formatBytesPair` for
+ *  paired "used / total" displays, and `formatByteRate` for byte-per-second
+ *  rates. This function is kept for backwards compatibility but should not
+ *  be used in new code.
  */
 export const humanFileSize = (size: number, concat = ""): string => {
   //64bit limit for Number stops at EiB
@@ -48,6 +54,99 @@ export const humanFileSize = (size: number, concat = ""): string => {
   return "∞";
 };
 
+const BINARY_UNITS = ["B", "KiB", "MiB", "GiB", "TiB", "PiB", "EiB"] as const;
+const DECIMAL_UNITS = ["B", "KB", "MB", "GB", "TB", "PB", "EB"] as const;
+
+export type ByteUnitSystem = "binary" | "decimal";
+
+export interface FormatBytesOptions {
+  /**
+   * Unit system to use. "binary" uses 1024 as the base and KiB/MiB/GiB/TiB suffixes,
+   * "decimal" uses 1000 as the base and KB/MB/GB/TB suffixes. Defaults to "binary".
+   */
+  unit?: ByteUnitSystem;
+}
+
+const pickUnitIndex = (bytes: number, base: number, lastIndex: number): number => {
+  if (!Number.isFinite(bytes) || bytes <= 0) return 0;
+  let index = 0;
+  let value = bytes;
+  while (value >= base && index < lastIndex) {
+    value /= base;
+    index++;
+  }
+  return index;
+};
+
+const sanitizeBytes = (bytes: number): number => (Number.isFinite(bytes) && bytes > 0 ? bytes : 0);
+
+const resolveUnitConfig = (options: FormatBytesOptions) => {
+  const { unit = "binary" } = options;
+  return {
+    units: unit === "binary" ? BINARY_UNITS : DECIMAL_UNITS,
+    base: unit === "binary" ? 1024 : 1000,
+  };
+};
+
+/**
+ * Format a byte value as a human-readable string with a unit suffix.
+ *
+ * Picks the largest unit that keeps the scaled value below the base. Use
+ * `formatBytesPair` when two related values (e.g. used and available) should
+ * share a common unit.
+ *
+ * @example
+ * formatBytes(0);                          // "0.0 B"
+ * formatBytes(1024);                       // "1.0 KiB"
+ * formatBytes(985828802560);               // "918.1 GiB"
+ * formatBytes(985828802560, { unit: "decimal" }); // "985.8 GB"
+ */
+export const formatBytes = (bytes: number, options: FormatBytesOptions = {}): string => {
+  const { units, base } = resolveUnitConfig(options);
+  const safe = sanitizeBytes(bytes);
+  const index = pickUnitIndex(safe, base, units.length - 1);
+  const scaled = safe / base ** index;
+  return `${scaled.toFixed(1)} ${units[index]}`;
+};
+
+/**
+ * Format two related byte values (typically `used` and `available`) with a
+ * shared unit. The unit is picked from the sum of the two values so the
+ * combined display stays consistent.
+ *
+ * @example
+ * formatBytesPair(985828802560, 2858736793190);
+ * // { used: "0.9 TiB", available: "2.6 TiB" }
+ */
+export const formatBytesPair = (
+  used: number,
+  available: number,
+  options: FormatBytesOptions = {},
+): { used: string; available: string } => {
+  const { units, base } = resolveUnitConfig(options);
+  const safeUsed = sanitizeBytes(used);
+  const safeAvailable = sanitizeBytes(available);
+  const index = pickUnitIndex(safeUsed + safeAvailable, base, units.length - 1);
+  const suffix = units[index];
+  return {
+    used: `${(safeUsed / base ** index).toFixed(1)} ${suffix}`,
+    available: `${(safeAvailable / base ** index).toFixed(1)} ${suffix}`,
+  };
+};
+
+/**
+ * Format a byte-per-second rate (e.g. network throughput) as a human-readable
+ * string with a `/s` suffix. The value is formatted with the same rules as
+ * `formatBytes` and a trailing `/s` is appended.
+ *
+ * @example
+ * formatByteRate(0);                          // "0.0 B/s"
+ * formatByteRate(1024);                       // "1.0 KiB/s"
+ * formatByteRate(985828802560, { unit: "decimal" }); // "985.8 GB/s"
+ */
+export const formatByteRate = (bytes: number, options: FormatBytesOptions = {}): string =>
+  `${formatBytes(bytes, options)}/s`;
+
 const IMPERIAL_MULTIPLIER = 1.609344;
 
 export const metricToImperial = (metricValue: number) => metricValue / IMPERIAL_MULTIPLIER;

packages/common/src/test/number.spec.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it } from "vitest";
+
+import { formatByteRate, formatBytes, formatBytesPair } from "../number";
+
+describe("formatBytes", () => {
+  it("returns bytes for small values", () => {
+    expect(formatBytes(0)).toBe("0.0 B");
+    expect(formatBytes(1)).toBe("1.0 B");
+    expect(formatBytes(1023)).toBe("1023.0 B");
+  });
+
+  it("scales binary units correctly", () => {
+    expect(formatBytes(1024)).toBe("1.0 KiB");
+    expect(formatBytes(1024 ** 2)).toBe("1.0 MiB");
+    expect(formatBytes(1024 ** 3)).toBe("1.0 GiB");
+    expect(formatBytes(1024 ** 4)).toBe("1.0 TiB");
+  });
+
+  it("scales decimal units when requested", () => {
+    expect(formatBytes(1000, { unit: "decimal" })).toBe("1.0 KB");
+    expect(formatBytes(1000 ** 2, { unit: "decimal" })).toBe("1.0 MB");
+    expect(formatBytes(1000 ** 3, { unit: "decimal" })).toBe("1.0 GB");
+    expect(formatBytes(1000 ** 4, { unit: "decimal" })).toBe("1.0 TB");
+  });
+
+  it("formats a typical storage value with one decimal", () => {
+    expect(formatBytes(985828802560)).toBe("918.1 GiB");
+    expect(formatBytes(985828802560, { unit: "decimal" })).toBe("985.8 GB");
+  });
+
+  it("caps at the largest unit to avoid overflow", () => {
+    expect(formatBytes(Number.MAX_SAFE_INTEGER)).toMatch(/PiB$/);
+  });
+
+  it("returns the zero value for negative or non-finite input", () => {
+    expect(formatBytes(-1)).toBe("0.0 B");
+    expect(formatBytes(Number.NaN)).toBe("0.0 B");
+    expect(formatBytes(Number.POSITIVE_INFINITY)).toBe("0.0 B");
+  });
+});
+
+describe("formatBytesPair", () => {
+  it("picks the unit of the larger total and applies it to both values", () => {
+    const { used, available } = formatBytesPair(985828802560, 2858736793190);
+    expect(used).toBe("0.9 TiB");
+    expect(available).toBe("2.6 TiB");
+  });
+
+  it("uses a smaller unit when both values fit in it", () => {
+    const { used, available } = formatBytesPair(1024 * 1024 * 100, 1024 * 1024 * 200);
+    expect(used).toBe("100.0 MiB");
+    expect(available).toBe("200.0 MiB");
+  });
+
+  it("falls back to zero when both inputs are invalid", () => {
+    const { used, available } = formatBytesPair(Number.NaN, -1);
+    expect(used).toBe("0.0 B");
+    expect(available).toBe("0.0 B");
+  });
+
+  it("uses the same unit across both values when one is invalid", () => {
+    const { used, available } = formatBytesPair(Number.NaN, 1024 ** 4);
+    expect(used).toBe("0.0 TiB");
+    expect(available).toBe("1.0 TiB");
+  });
+
+  it("honours the decimal unit option", () => {
+    const { used, available } = formatBytesPair(500_000_000_000, 1_500_000_000_000, { unit: "decimal" });
+    expect(used).toBe("0.5 TB");
+    expect(available).toBe("1.5 TB");
+  });
+});
+
+describe("formatByteRate", () => {
+  it("appends a /s suffix to the formatted value", () => {
+    expect(formatByteRate(0)).toBe("0.0 B/s");
+    expect(formatByteRate(1024)).toBe("1.0 KiB/s");
+    expect(formatByteRate(1024 ** 3)).toBe("1.0 GiB/s");
+  });
+
+  it("honours the decimal unit option", () => {
+    expect(formatByteRate(1000, { unit: "decimal" })).toBe("1.0 KB/s");
+    expect(formatByteRate(1000 ** 2, { unit: "decimal" })).toBe("1.0 MB/s");
+  });
+
+  it("returns zero for invalid input", () => {
+    expect(formatByteRate(-1)).toBe("0.0 B/s");
+    expect(formatByteRate(Number.NaN)).toBe("0.0 B/s");
+  });
+});

packages/core/src/infrastructure/http/request.ts

@@ -2,7 +2,7 @@ import type { AgentOptions } from "node:https";
 import { Agent as HttpsAgent } from "node:https";
 import { checkServerIdentity } from "node:tls";
 import axios from "axios";
-import type { RequestInfo, RequestInit, Response } from "undici";
+import type { Agent as UndiciAgent, RequestInfo, RequestInit, Response } from "undici";
 import { fetch } from "undici";
 
 import {
@@ -29,11 +29,15 @@ export const createCustomCheckServerIdentity = (
   };
 };
 
-export const createCertificateAgentAsync = async (override?: {
-  ca: string | string[];
-  checkServerIdentity: typeof checkServerIdentity;
-}) => {
+export const createCertificateAgentAsync = async (
+  override?: {
+    ca: string | string[];
+    checkServerIdentity: typeof checkServerIdentity;
+  },
+  agentOptions?: Pick<UndiciAgent.Options, "bodyTimeout">,
+) => {
   return new UndiciHttpAgent({
+    ...agentOptions,
     connect: override ?? {
       ca: await getAllTrustedCertificatesAsync(),
       checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
@@ -61,14 +65,18 @@ export const createAxiosCertificateInstanceAsync = async (
 
 export const fetchWithTrustedCertificatesAsync = async (
   url: RequestInfo,
-  options?: RequestInit & { timeout?: number },
+  options?: RequestInit & { timeout?: number; bodyTimeout?: number },
 ): Promise<Response> => {
-  const agent = await createCertificateAgentAsync(undefined);
+  const agent = await createCertificateAgentAsync(
+    undefined,
+    options?.bodyTimeout !== undefined ? { bodyTimeout: options.bodyTimeout } : undefined,
+  );
   if (options?.timeout) {
+    const { bodyTimeout: _bodyTimeout, ...fetchOptions } = options;
     return await withTimeoutAsync(
       async (signal) =>
         fetch(url, {
-          ...options,
+          ...fetchOptions,
           signal,
           dispatcher: agent,
         }),
@@ -76,8 +84,9 @@ export const fetchWithTrustedCertificatesAsync = async (
     );
   }
 
+  const { bodyTimeout: _bodyTimeout, ...fetchOptions } = options ?? {};
   return fetch(url, {
-    ...options,
+    ...fetchOptions,
     dispatcher: agent,
   });
 };

packages/db/migrations/mysql/meta/_journal.json

@@ -295,6 +295,13 @@
       "when": 1780764500000,
       "tag": "0041_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "5",
+      "when": 1783176100870,
+      "tag": "0042_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/db/migrations/postgresql/meta/_journal.json

@@ -57,6 +57,13 @@
       "when": 1780764500000,
       "tag": "0007_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1783176100870,
+      "tag": "0008_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/db/migrations/sqlite/meta/_journal.json

@@ -281,6 +281,13 @@
       "when": 1780764500000,
       "tag": "0039_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 40,
+      "version": "6",
+      "when": 1783176100870,
+      "tag": "0040_add_widget_secret",
+      "breakpoints": true
     }
   ]
 }

packages/definitions/src/integration.ts

@@ -379,7 +379,7 @@ export const integrationDefs = {
     category: ["healthMonitoring"],
     documentationUrl: createDocumentationLink("/docs/integrations/patchmon"),
     defaultPort: 3413,
-    apiKeySettingsPath: "/settings/api-keys",
+    apiKeySettingsPath: "/settings/integrations",
   },
   tracearr: {
     name: "Tracearr",

packages/definitions/src/test/api-key-url.spec.ts

@@ -15,6 +15,12 @@ describe("getIntegrationApiKeyUrl", () => {
     );
   });
 
+  it("builds URL for patchmon", () => {
+    expect(getIntegrationApiKeyUrl("http://patchmon.local:3413", "patchmon")).toBe(
+      "http://patchmon.local:3413/settings/integrations",
+    );
+  });
+
   it("returns null for integrations without apiKeySettingsPath", () => {
     expect(getIntegrationApiKeyUrl("http://localhost", "plex")).toBeNull();
   });

packages/integrations/src/beszel/beszel-integration.ts

@@ -19,15 +19,66 @@ import type {
   BeszelSystemDetails,
   BeszelSystemdService,
   BeszelSystemStatsRecord,
+  BeszelSystemStats,
+  BeszelContainerStats,
   CreateAlertInput,
   LiveStatsEvent,
   PocketBaseListResponse,
   UpdateAlertInput,
 } from "./beszel-types";
+import { createRealtimeMetricsTopic, PocketBaseSseParser } from "./pocketbase-realtime";
 
 const logger = createLogger({ module: "beszel-integration" });
 
 const escapeFilterValue = (value: string) => value.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+const realtimeRetryDelaysMs = [200, 300, 500, 1_000, 1_500, 2_000] as const;
+
+const supportsRealtimeMetrics = (version: string) => {
+  const [major = 0, minor = 0] = version.replace(/^v/, "").split(".").map(Number);
+  return major > 0 || minor >= 13;
+};
+
+const waitForRetryAsync = async (delayMs: number, signal: AbortSignal) =>
+  await new Promise<void>((resolve) => {
+    if (signal.aborted) return resolve();
+    const timeout = setTimeout(done, delayMs);
+    signal.addEventListener("abort", done, { once: true });
+    function done() {
+      clearTimeout(timeout);
+      signal.removeEventListener("abort", done);
+      resolve();
+    }
+  });
+
+interface BeszelRealtimeSnapshot {
+  stats?: BeszelSystemStats;
+  container?: BeszelContainerStats[];
+}
+
+export const normalizeRealtimeSnapshot = (
+  payload: BeszelRealtimeSnapshot,
+  systemId: string,
+  receivedAt = new Date(),
+): LiveStatsEvent[] => {
+  const created = receivedAt.toISOString();
+  const id = `realtime-${receivedAt.getTime()}`;
+  const events: LiveStatsEvent[] = [];
+
+  if (payload.stats && typeof payload.stats === "object" && !Array.isArray(payload.stats)) {
+    events.push({
+      type: "system_stats",
+      record: { id, system: systemId, stats: payload.stats, type: "1m", created, updated: created },
+    });
+  }
+  if (Array.isArray(payload.container)) {
+    events.push({
+      type: "container_stats",
+      record: { id, system: systemId, stats: payload.container, type: "1m", created, updated: created },
+    });
+  }
+
+  return events;
+};
 
 interface BeszelSession {
   token: string;
@@ -285,123 +336,163 @@ export class BeszelIntegration extends Integration {
     });
   }
 
-  /**
-   * Subscribe to real-time system and container stats via PocketBase SSE.
-   * Connects to the PocketBase Realtime API and parses incoming SSE events,
-   * filtering by systemId. This provides live-updating metrics (≤1s latency
-   * from agent) instead of polling the REST API every 5s.
-   */
+  /** Subscribe to Beszel's custom one-second `rt_metrics` PocketBase topic. */
   public async subscribeRealtimeMetrics(
     systemId: string,
     onMessage: (event: LiveStatsEvent) => void,
     signal: AbortSignal,
   ): Promise<void> {
-    const session = await this.authenticateAsync();
-    const realtimeUrl = this.url("/api/realtime");
-
-    logger.debug("Opening Beszel SSE connection for realtime metrics", {
-      integrationId: this.integration.id,
-      systemId,
-      url: realtimeUrl.pathname,
-    });
-
-    const response = await fetchWithTrustedCertificatesAsync(realtimeUrl, {
-      headers: { Authorization: session.token },
-      signal,
-    });
-
-    if (!response.ok) {
-      logger.warn("Beszel SSE connection failed", {
-        integrationId: this.integration.id,
-        systemId,
-        status: response.status,
-      });
-      throw new ResponseError(response);
+    const systems = await this.getSystemsAsync();
+    const system = systems.find((candidate) => candidate.id === systemId);
+    if (!system) throw new Error("Selected Beszel system was not found");
+    if (system.status !== "up")
+      throw new Error(`Beszel system is ${system.status}; Live mode requires an online system`);
+    if (!supportsRealtimeMetrics(system.info.v)) {
+      throw new Error(`Beszel agent ${system.info.v} does not support Live mode; version 0.13.0 or newer is required`);
     }
 
-    const reader = response.body?.getReader();
-    if (!reader) throw new Error("No response body in SSE stream");
-
-    const decoder = new TextDecoder();
-    let buffer = "";
-    let subscribed = false;
-
-    const processLine = async (line: string) => {
-      if (!line.startsWith("data: ")) return;
+    const realtimeUrl = this.url("/api/realtime");
+    const topic = createRealtimeMetricsTopic(systemId);
+    let retryAttempt = 0;
+    let emittedSnapshotCount = 0;
 
+    while (!signal.aborted) {
       try {
-        const parsed = JSON.parse(line.slice(6)) as Record<string, unknown>;
-
-        // PB_CONNECT delivers the clientId — use it to POST our subscriptions
-        if (!subscribed && typeof parsed.clientId === "string") {
-          subscribed = true;
-          const subscribeResponse = await fetchWithTrustedCertificatesAsync(realtimeUrl, {
-            method: "POST",
+        let session = await this.authenticateAsync();
+        const openStream = async () =>
+          await fetchWithTrustedCertificatesAsync(realtimeUrl, {
             headers: {
+              Accept: "text/event-stream",
               Authorization: session.token,
-              "Content-Type": "application/json",
+              "Cache-Control": "no-cache",
+              Pragma: "no-cache",
             },
-            body: JSON.stringify({
-              clientId: parsed.clientId,
-              subscriptions: ["system_stats", "container_stats"],
-            }),
             signal,
+            bodyTimeout: 0,
           });
 
-          if (!subscribeResponse.ok) {
-            logger.warn("Beszel SSE subscription POST failed", {
+        logger.debug("Opening Beszel rt_metrics SSE connection", {
+          integrationId: this.integration.id,
+          systemId,
+          retryAttempt,
+        });
+        let response = await openStream();
+        if (response.status === 401) {
+          await this.sessionStore.clearAsync();
+          session = await this.authenticateAsync();
+          response = await openStream();
+        }
+        if (!response.ok) throw new ResponseError(response);
+
+        const reader = response.body?.getReader();
+        if (!reader) throw new Error("Beszel realtime response has no body");
+        const decoder = new TextDecoder();
+        const parser = new PocketBaseSseParser();
+        let clientId: string | undefined;
+
+        const processFrameAsync = async (frame: ReturnType<PocketBaseSseParser["push"]>[number]) => {
+          if (frame.event === "PB_CONNECT") {
+            let fallbackClientId: string | undefined;
+            try {
+              const connectData = JSON.parse(frame.data) as { clientId?: string };
+              fallbackClientId = connectData.clientId;
+            } catch {
+              // PocketBase normally provides the client ID in the SSE id field.
+            }
+            clientId = frame.id || fallbackClientId;
+            if (!clientId) throw new Error("PocketBase PB_CONNECT event did not include a client ID");
+
+            const subscribeResponse = await fetchWithTrustedCertificatesAsync(realtimeUrl, {
+              method: "POST",
+              headers: { Authorization: session.token, "Content-Type": "application/json" },
+              body: JSON.stringify({ clientId, subscriptions: [topic] }),
+              signal,
+            });
+            if (subscribeResponse.status === 401) await this.sessionStore.clearAsync();
+            if (!subscribeResponse.ok) throw new ResponseError(subscribeResponse);
+            logger.debug("Subscribed to Beszel rt_metrics topic", {
               integrationId: this.integration.id,
               systemId,
-              status: subscribeResponse.status,
+              clientId,
             });
-            throw new ResponseError(subscribeResponse);
+            return;
           }
 
-          logger.debug("Beszel SSE subscribed to collections", {
+          if (!frame.event.startsWith("rt_metrics")) return;
+          try {
+            const snapshot = JSON.parse(frame.data) as BeszelRealtimeSnapshot;
+            const events = normalizeRealtimeSnapshot(snapshot, systemId);
+            if (events.length === 0) return;
+            emittedSnapshotCount += 1;
+            retryAttempt = 0;
+            for (const event of events) onMessage(event);
+            if (emittedSnapshotCount === 1 || emittedSnapshotCount % 30 === 0) {
+              logger.debug("Forwarded Beszel rt_metrics snapshots", {
+                integrationId: this.integration.id,
+                systemId,
+                emittedSnapshotCount,
+                containerCount: snapshot.container?.length ?? 0,
+              });
+            }
+          } catch (error) {
+            logger.warn("Failed to parse Beszel rt_metrics payload", {
+              integrationId: this.integration.id,
+              systemId,
+              error: error instanceof Error ? error.message : String(error),
+            });
+          }
+        };
+
+        logger.debug("Beszel rt_metrics SSE connection established", {
+          integrationId: this.integration.id,
+          systemId,
+          contentType: response.headers.get("content-type"),
+        });
+        try {
+          while (!signal.aborted) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            for (const frame of parser.push(decoder.decode(value, { stream: true }))) {
+              await processFrameAsync(frame);
+            }
+          }
+          for (const frame of parser.push(decoder.decode())) await processFrameAsync(frame);
+          for (const frame of parser.finish()) await processFrameAsync(frame);
+        } finally {
+          await reader.cancel().catch(() => {});
+          reader.releaseLock();
+        }
+
+        if (!signal.aborted) throw new Error("Beszel rt_metrics SSE stream ended unexpectedly");
+      } catch (error) {
+        if (signal.aborted) break;
+        if (error instanceof ResponseError && error.statusCode === 401 && retryAttempt === 0) {
+          retryAttempt += 1;
+          logger.debug("Retrying Beszel rt_metrics handshake after reauthentication", {
             integrationId: this.integration.id,
             systemId,
-            clientId: parsed.clientId,
           });
-          return;
+          continue;
         }
-
-        const record = parsed.record as Record<string, unknown> | undefined;
-        if (!record || record.system !== systemId) return;
-
-        if (Array.isArray(record.stats)) {
-          onMessage({
-            type: "container_stats",
-            record: record as unknown as BeszelContainerStatsRecord,
-          });
-        } else if (record.stats && typeof record.stats === "object") {
-          onMessage({
-            type: "system_stats",
-            record: record as unknown as BeszelSystemStatsRecord,
-          });
-        }
-      } catch (error) {
-        if (error instanceof ResponseError) throw error;
-        // skip malformed SSE data lines
+        if (error instanceof ResponseError && error.statusCode < 500 && error.statusCode !== 429) throw error;
+        const delayMs = realtimeRetryDelaysMs[Math.min(retryAttempt, realtimeRetryDelaysMs.length - 1)] ?? 2_000;
+        retryAttempt += 1;
+        logger.warn("Beszel rt_metrics connection lost; retrying", {
+          integrationId: this.integration.id,
+          systemId,
+          retryAttempt,
+          delayMs,
+          error: error instanceof Error ? error.message : String(error),
+        });
+        await waitForRetryAsync(delayMs, signal);
       }
-    };
-
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-
-        buffer += decoder.decode(value, { stream: true });
-        const lines = buffer.split("\n");
-        buffer = lines.pop() ?? "";
-
-        for (const line of lines) {
-          await processLine(line);
-        }
-      }
-    } finally {
-      reader.releaseLock();
-      logger.debug("Beszel SSE connection closed", { integrationId: this.integration.id, systemId });
     }
+
+    logger.debug("Beszel rt_metrics subscription stopped", {
+      integrationId: this.integration.id,
+      systemId,
+      emittedSnapshotCount,
+    });
   }
 
   protected async testingAsync(input: IntegrationTestingInput): Promise<TestingResult> {

packages/integrations/src/beszel/beszel-types.ts

@@ -133,9 +133,9 @@ export interface BeszelSystemStats {
   /** disk usage (%) */
   dp: number;
   /** disk read (MB/s) */
-  dr: number;
+  dr?: number;
   /** disk write (MB/s) */
-  dw: number;
+  dw?: number;
   /** disk read max (MB/s) */
   drm?: number;
   /** disk write max (MB/s) */
@@ -145,9 +145,9 @@ export interface BeszelSystemStats {
   /** disk IOPS max [read, write] */
   diom?: [number, number];
   /** network sent — all interfaces (bytes/s) */
-  ns: number;
+  ns?: number;
   /** network received — all interfaces (bytes/s) */
-  nr: number;
+  nr?: number;
   /** bandwidth — public interfaces only (bytes/s) [sent, recv]. Prefer over ns/nr */
   b?: [number, number];
   /** network sent max (bytes/s) */
@@ -169,26 +169,26 @@ export interface BeszelSystemStats {
 }
 
 export interface BeszelExtraFsStats {
-  /** total disk (bytes) */
+  /** total disk (GiB) */
   d: number;
-  /** disk used (bytes) */
+  /** disk used (GiB) */
   du: number;
   /** read (bytes/s) */
   r: number;
   /** write (bytes/s) */
   w: number;
   /** read max (bytes/s) */
-  rm: number;
+  rm?: number;
   /** write max (bytes/s) */
-  wm: number;
+  wm?: number;
   /** read (IOPS) */
-  rb: number;
+  rb?: number;
   /** write (IOPS) */
-  wb: number;
+  wb?: number;
   /** read max (IOPS) */
-  rbm: number;
+  rbm?: number;
   /** write max (IOPS) */
-  wbm: number;
+  wbm?: number;
 }
 
 export interface BeszelGPUData {
@@ -382,6 +382,8 @@ export interface BeszelSystemRow {
   memory: number;
   /** disk usage (%) */
   disk: number;
+  /** extra filesystem usage (%) keyed by mount path */
+  extraFilesystems: Record<string, number>;
   /** GPU usage (%) */
   gpu: number;
   /** load average [1m, 5m, 15m] */

packages/integrations/src/beszel/pocketbase-realtime.ts

@@ -0,0 +1,65 @@
+export interface PocketBaseSseFrame {
+  event: string;
+  id?: string;
+  data: string;
+}
+
+export const createRealtimeMetricsTopic = (systemId: string) =>
+  `rt_metrics?options=${encodeURIComponent(JSON.stringify({ query: { system: systemId } }))}`;
+
+export class PocketBaseSseParser {
+  private buffer = "";
+  private event = "message";
+  private id: string | undefined;
+  private dataLines: string[] = [];
+
+  public push(chunk: string): PocketBaseSseFrame[] {
+    this.buffer += chunk;
+    const frames: PocketBaseSseFrame[] = [];
+    const lines = this.buffer.split(/\r?\n/);
+    this.buffer = lines.pop() ?? "";
+
+    for (const line of lines) {
+      const frame = this.processLine(line);
+      if (frame) frames.push(frame);
+    }
+
+    return frames;
+  }
+
+  public finish(): PocketBaseSseFrame[] {
+    const frames: PocketBaseSseFrame[] = [];
+    if (this.buffer !== "") {
+      const frame = this.processLine(this.buffer);
+      if (frame) frames.push(frame);
+      this.buffer = "";
+    }
+    const trailingFrame = this.dispatch();
+    if (trailingFrame) frames.push(trailingFrame);
+    return frames;
+  }
+
+  private processLine(line: string): PocketBaseSseFrame | null {
+    if (line === "") return this.dispatch();
+    if (line.startsWith(":")) return null;
+
+    const colonIndex = line.indexOf(":");
+    const field = colonIndex === -1 ? line : line.slice(0, colonIndex);
+    let value = colonIndex === -1 ? "" : line.slice(colonIndex + 1);
+    if (value.startsWith(" ")) value = value.slice(1);
+
+    if (field === "event") this.event = value;
+    else if (field === "id") this.id = value;
+    else if (field === "data") this.dataLines.push(value);
+    return null;
+  }
+
+  private dispatch(): PocketBaseSseFrame | null {
+    if (this.dataLines.length === 0 && this.event === "message" && this.id === undefined) return null;
+    const frame = { event: this.event, id: this.id, data: this.dataLines.join("\n") };
+    this.event = "message";
+    this.id = undefined;
+    this.dataLines = [];
+    return frame;
+  }
+}

packages/integrations/src/beszel/test/beszel-integration.spec.ts

@@ -40,7 +40,124 @@ vi.mock("@homarr/core/infrastructure/certificates", () => ({
   getAllTrustedCertificatesAsync: vi.fn().mockResolvedValue([]),
 }));
 
-import { BeszelIntegration } from "../beszel-integration";
+import { BeszelIntegration, normalizeRealtimeSnapshot } from "../beszel-integration";
+import type { LiveStatsEvent } from "../beszel-types";
+import { createRealtimeMetricsTopic } from "../pocketbase-realtime";
+
+describe("normalizeRealtimeSnapshot", () => {
+  test("normalizes current Beszel host and container snapshots", () => {
+    const receivedAt = new Date("2026-07-11T13:51:30.217Z");
+    const events = normalizeRealtimeSnapshot(
+      {
+        stats: {
+          cpu: 18.07,
+          m: 31.09,
+          mu: 16.53,
+          mp: 53.18,
+          mb: 14.32,
+          s: 4,
+          su: 3.9,
+          d: 938.8,
+          du: 455.81,
+          dp: 51.15,
+          efs: { sda: { d: 1906.8, du: 1656.45, r: 25.63, w: 0 } },
+        },
+        container: [{ n: "homarr", c: 1.65, m: 650.56, b: [356066, 19702867] }],
+      },
+      "system-1",
+      receivedAt,
+    );
+
+    expect(events).toHaveLength(2);
+    expect(events[0]).toMatchObject({
+      type: "system_stats",
+      record: { system: "system-1", created: receivedAt.toISOString(), stats: { cpu: 18.07 } },
+    });
+    expect(events[1]).toMatchObject({
+      type: "container_stats",
+      record: { system: "system-1", stats: [{ n: "homarr", m: 650.56 }] },
+    });
+  });
+
+  test("ignores snapshots without metric data", () => {
+    expect(normalizeRealtimeSnapshot({}, "system-1")).toEqual([]);
+  });
+});
+
+describe("subscribeRealtimeMetrics", () => {
+  test("subscribes to Beszel rt_metrics and forwards one-second snapshots", async () => {
+    const originalFetch = globalThis.fetch;
+    const topic = createRealtimeMetricsTopic("system-1");
+    const subscriptionBodies: unknown[] = [];
+    const encoder = new TextEncoder();
+
+    globalThis.fetch = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      if (url.endsWith("/api/collections/users/auth-with-password")) {
+        return Response.json({ token: "test-token", record: { id: "user-1" } });
+      }
+      if (url.includes("/api/collections/systems/records")) {
+        return Response.json({
+          page: 1,
+          perPage: 500,
+          totalItems: 1,
+          totalPages: 1,
+          items: [
+            {
+              id: "system-1",
+              name: "Server",
+              host: "localhost",
+              port: "45876",
+              status: "up",
+              info: { cpu: 1, mp: 2, dp: 3, u: 4, v: "0.18.7" },
+              created: "2026-07-11T00:00:00.000Z",
+              updated: "2026-07-11T00:00:00.000Z",
+            },
+          ],
+        });
+      }
+      if (url.endsWith("/api/realtime") && init?.method === "POST") {
+        subscriptionBodies.push(JSON.parse(String(init.body)));
+        expect(new Headers(init.headers).get("Authorization")).toBe("test-token");
+        return new Response(null, { status: 204 });
+      }
+      if (url.endsWith("/api/realtime")) {
+        const snapshot = JSON.stringify({
+          stats: { cpu: 5, m: 10, mu: 4, mp: 40, mb: 1, s: 0, su: 0, d: 20, du: 8, dp: 40 },
+          container: [{ n: "homarr", c: 1, m: 256 }],
+        });
+        const stream = new ReadableStream<Uint8Array>({
+          start(controller) {
+            controller.enqueue(encoder.encode("event: PB_CONNECT\nid: client-1\ndata: {}\n\n"));
+            controller.enqueue(encoder.encode(`event: ${topic}\ndata: ${snapshot}\n\n`));
+            controller.close();
+          },
+        });
+        return new Response(stream, { headers: { "Content-Type": "text/event-stream" } });
+      }
+      throw new Error(`Unexpected request: ${init?.method ?? "GET"} ${url}`);
+    }) as typeof fetch;
+
+    try {
+      const integration = createBeszelIntegration();
+      const controller = new AbortController();
+      const events: LiveStatsEvent[] = [];
+      await integration.subscribeRealtimeMetrics(
+        "system-1",
+        (event) => {
+          events.push(event);
+          if (events.length === 2) controller.abort();
+        },
+        controller.signal,
+      );
+
+      expect(subscriptionBodies).toEqual([{ clientId: "client-1", subscriptions: [topic] }]);
+      expect(events.map((event) => event.type)).toEqual(["system_stats", "container_stats"]);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+});
 
 function createBeszelIntegration() {
   return new BeszelIntegration({

packages/integrations/src/beszel/test/pocketbase-realtime.spec.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "vitest";
+
+import { createRealtimeMetricsTopic, PocketBaseSseParser } from "../pocketbase-realtime";
+
+describe("PocketBaseSseParser", () => {
+  test("parses PB_CONNECT client IDs and CRLF-delimited frames split across chunks", () => {
+    const parser = new PocketBaseSseParser();
+    expect(parser.push("event: PB_CONNECT\r\nid: client-")).toEqual([]);
+    expect(parser.push("123\r\ndata: {}\r\n\r\n")).toEqual([{ event: "PB_CONNECT", id: "client-123", data: "{}" }]);
+  });
+
+  test("joins multiline data and ignores keepalive comments", () => {
+    const parser = new PocketBaseSseParser();
+    expect(parser.push(': keepalive\n\nevent: rt_metrics\ndata: {"stats":\ndata: {}}\n\n')).toEqual([
+      { event: "rt_metrics", id: undefined, data: '{"stats":\n{}}' },
+    ]);
+  });
+
+  test("flushes a trailing frame when the stream ends without a blank line", () => {
+    const parser = new PocketBaseSseParser();
+    expect(parser.push("event: rt_metrics\ndata: {}")).toEqual([]);
+    expect(parser.finish()).toEqual([{ event: "rt_metrics", id: undefined, data: "{}" }]);
+  });
+});
+
+describe("createRealtimeMetricsTopic", () => {
+  test("matches the PocketBase custom-topic options encoding used by Beszel", () => {
+    const topic = createRealtimeMetricsTopic("system-1");
+    expect(topic).toBe(`rt_metrics?options=${encodeURIComponent(JSON.stringify({ query: { system: "system-1" } }))}`);
+  });
+});

packages/integrations/src/dashdot/dashdot-integration.ts

@@ -1,5 +1,3 @@
-import { humanFileSize } from "@homarr/common";
-
 import "@homarr/redis";
 
 import dayjs from "dayjs";
@@ -48,7 +46,7 @@ export class DashDotIntegration extends Integration implements ISystemHealthMoni
         .map((storage, index) => ({
           deviceName: `Storage ${index + 1}: (${storage.disks.map((disk) => disk.device).join(", ")})`,
           // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-          used: humanFileSize(storageLoad[index]!),
+          used: `${storageLoad[index]!}`,
           available: storageLoad[index] ? `${storage.size - storageLoad[index]}` : `${storage.size}`,
           percentage: storageLoad[index] ? (storageLoad[index] / storage.size) * 100 : 0,
         })),

packages/integrations/src/mock/data/beszel.ts

@@ -226,6 +226,7 @@ export class BeszelMockService {
         u: randInt(86400, 2_000_000),
         mp: clamp(sys.baseMem + rand(-5, 5), 0, 100),
         dp: clamp(sys.baseDisk + rand(-2, 2), 0, 100),
+        efs: i === 0 ? { "/mnt/sda": 86.9, "/mnt/sdb": 70.5, "/mnt/sdc": 42.7 } : undefined,
         bb: rand(200, 3000) * KB,
         v: "0.8.2",
         g: i === 3 ? rand(15, 45) : 0,

packages/integrations/src/unraid/unraid-integration.ts

@@ -1,7 +1,6 @@
 import dayjs from "dayjs";
 import type { fetch as undiciFetch } from "undici/types/fetch";
 
-import { humanFileSize } from "@homarr/common";
 import { ResponseError } from "@homarr/common/server";
 import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
@@ -59,7 +58,7 @@ export class UnraidIntegration extends Integration implements ISystemHealthMonit
       cpuTemp: undefined, // Not implemented, see https://github.com/unraid/api/issues/1597
       fileSystem: systemInfo.array.disks.map((disk) => ({
         deviceName: disk.name,
-        used: humanFileSize(disk.fsUsed * 1024), // API is in KiB (kibibytes), convert to bytes
+        used: `${disk.fsUsed * 1024}`, // API is in KiB (kibibytes), convert to bytes
         available: `${(disk.size - disk.fsUsed) * 1024}`, // free space left on the disk, API is in KiB (kibibytes)
         percentage: (disk.fsUsed / disk.size) * 100, // The units are the same, therefore the actual unit is irrelevant
       })),

packages/request-handler/src/beszel.ts

@@ -34,6 +34,7 @@ function mapToSystemRow(system: BeszelSystem, details: BeszelSystemDetails | nul
     cpu: info.cpu,
     memory: info.mp,
     disk: info.dp,
+    extraFilesystems: info.efs ?? {},
     gpu: info.g ?? 0,
     loadAvg: info.la ?? null,
     // bb = bytes/s (newer), b = Mbps (legacy, multiply to get bytes/s)

packages/translation/src/lang/en.json

@@ -1956,6 +1956,8 @@
         "clear": "Clear formatting",
         "heading": "Heading {level}",
         "align": "Align text: {position}",
+        "directionLtr": "Set text direction left to right",
+        "directionRtl": "Set text direction right to left",
         "blockquote": "Blockquote",
         "horizontalLine": "Horizontal line",
         "bulletList": "Bullet list",
@@ -4031,9 +4033,6 @@
         },
         "showDockerNetwork": {
           "label": "Show Docker network chart"
-        },
-        "showStorage": {
-          "label": "Show storage chart"
         }
       },
       "selectSystem": "Select system",
@@ -4060,8 +4059,8 @@
         },
         "disk": {
           "title": "Disk Usage",
-          "subtitle": "Usage of root partition",
-          "series": "Used"
+          "subtitle": "Usage by filesystem",
+          "series": "Root"
         },
         "diskIO": {
           "title": "Disk I/O",
@@ -4455,6 +4454,61 @@
       }
     }
   },
+  "workshop": {
+    "title": "Workshop",
+    "loading": "Loading submission",
+    "by": "By {name} · revision {revision}",
+    "type": {
+      "widget": "Widget",
+      "css": "CSS theme"
+    },
+    "search": {
+      "label": "Search",
+      "placeholder": "Search community creations"
+    },
+    "filter": {
+      "type": "Type",
+      "sort": "Sort",
+      "all": "All",
+      "widgets": "Widgets",
+      "css": "CSS themes",
+      "top": "Top rated",
+      "newest": "Newest"
+    },
+    "safety": {
+      "title": "Community content",
+      "description": "Workshop content is provided by community members. Inspect it before installing and keep a current backup.",
+      "inspect": "Review this source before using it. Widget endpoints and CSS can change how your instance behaves."
+    },
+    "empty": {
+      "title": "No creations found",
+      "description": "Adjust the filters or check back after the community has shared more."
+    },
+    "error": {
+      "loadTitle": "Workshop could not load",
+      "publish": "The creation could not be published",
+      "install": "The creation could not be used",
+      "wrongType": "This creation does not match the requested type"
+    },
+    "publish": {
+      "title": "Share in Workshop",
+      "name": "Title",
+      "description": "Description",
+      "changelog": "Changelog"
+    },
+    "action": {
+      "retry": "Try again",
+      "inspect": "Inspect source",
+      "download": "Download",
+      "website": "Open website",
+      "use": "Use creation",
+      "share": "Share in Workshop",
+      "cancel": "Cancel",
+      "publish": "Publish creation",
+      "install": "Install widget",
+      "useCss": "Use CSS"
+    }
+  },
   "management": {
     "metaTitle": "Management",
     "title": {
@@ -4478,6 +4532,7 @@
         "apps": "Apps",
         "integrations": "Integrations",
         "customWidgets": "Custom Widgets",
+        "workshop": "Workshop",
         "searchEngies": "Search engines",
         "medias": "Medias",
         "users": {
@@ -5206,6 +5261,9 @@
     "title": "Containers",
     "table": {
       "updated": "Updated {when}",
+      "refresh": {
+        "lastUpdated": "Last refresh {when}"
+      },
       "search": "Seach {count} containers",
       "selected": "{selectCount} of {totalCount} containers selected",
       "footer": "Total {count} containers",

packages/widgets/src/archive-team-warrior/component.tsx

@@ -3,7 +3,7 @@
 import { Avatar, Badge, Card, Group, SimpleGrid, Stack, Text } from "@mantine/core";
 
 import { clientApi } from "@homarr/api/client";
-import { humanFileSize } from "@homarr/common";
+import { formatByteRate } from "@homarr/common";
 import { getIconUrl } from "@homarr/definitions";
 
 import type { WidgetComponentProps } from "../definition";
@@ -84,4 +84,4 @@ const Metric = ({ label, value }: { label: string; value: number | string }) =>
   </Stack>
 );
 
-const formatBandwidth = (value?: number) => humanFileSize(Math.round(value ?? 0), "/s");
+const formatBandwidth = (value?: number) => formatByteRate(Math.round(value ?? 0));

packages/widgets/src/beszel-system-grid/component.tsx

@@ -27,10 +27,18 @@ import classes from "./component.module.css";
 import type { WidgetComponentProps } from "../definition";
 import type { BeszelSystemRow } from "../beszel/_shared/types";
 import { statusColorMap, thresholdColor } from "../beszel/_shared/colors";
-import { formatByteRate, formatLoadAvg, formatPercent, formatTemp, formatUptime } from "../beszel/_shared/format";
+import {
+  formatByteRate,
+  formatLoadAvg,
+  formatPercent,
+  formatTemp,
+  formatUptime,
+  getProgressTrackSize,
+} from "../beszel/_shared/format";
 import { useBeszelFilteredSystems } from "../beszel/_shared/hooks";
 import { BeszelIntegrationErrorIndicator } from "../beszel/_shared/error-indicator";
 import { BeszelSystemStatsModal } from "../beszel/_shared/system-stats-modal";
+import { DiskUsage } from "../beszel/_shared/disk-usage";
 
 interface SizeConfig {
   iconSize: number;
@@ -106,22 +114,14 @@ const getMaxVisibleMetrics = (cellHeight: number, size: SizeConfig): number => {
   return Math.max(1, Math.floor(available / size.rowHeight));
 };
 
-const MIN_CELL_WIDTH = 120;
+const MIN_CELL_WIDTH = 180;
 const MIN_CELL_HEIGHT = 80;
 
-const getColCount = (width: number, itemCount: number): number => {
+const getColCount = (width: number, height: number, itemCount: number): number => {
   if (itemCount <= 1) return 1;
   const maxCols = Math.min(itemCount, Math.max(1, Math.floor(width / MIN_CELL_WIDTH)));
-
-  let best = 1;
-  for (let c = 1; c <= maxCols; c++) {
-    const emptyCells = (c - (itemCount % c)) % c;
-    const bestEmpty = (best - (itemCount % best)) % best;
-    if (emptyCells < bestEmpty || (emptyCells === bestEmpty && c > best)) {
-      best = c;
-    }
-  }
-  return best;
+  const aspectRatio = width / Math.max(height, MIN_CELL_HEIGHT);
+  return Math.min(maxCols, Math.max(1, Math.ceil(Math.sqrt(itemCount * aspectRatio))));
 };
 
 interface MetricRowProps {
@@ -133,20 +133,25 @@ interface MetricRowProps {
 }
 
 const MetricValue = ({ value, progress, size }: Pick<MetricRowProps, "value" | "progress" | "size">) => (
-  <Group gap={6} wrap="nowrap" style={{ flex: 1 }}>
-    <Text size={size.fontSize} fw={500} miw={size.valueMiw} ta="right">
+  <Group gap={6} wrap="nowrap" style={{ flex: 1, minWidth: 0, marginLeft: "auto" }}>
+    <Text size={size.fontSize} fw={500} w={size.valueMiw} ta="left" style={{ whiteSpace: "nowrap", flexShrink: 0 }}>
       {value}
     </Text>
     {progress && (
-      <Progress value={progress.value} color={progress.color} size={size.progressSize} style={{ flex: 1 }} />
+      <Progress
+        value={progress.value}
+        color={progress.color}
+        size={getProgressTrackSize(size.progressSize)}
+        style={{ flex: 1 }}
+      />
     )}
   </Group>
 );
 
 const MetricRow = ({ icon, label, value, progress, size }: MetricRowProps) => (
-  <Group gap="xs" wrap="nowrap" style={{ minHeight: size.rowHeight }}>
+  <Group gap="xs" wrap="nowrap" justify="space-between" style={{ minHeight: size.rowHeight }}>
     {icon}
-    <Text size={size.fontSize} c="dimmed" miw={size.labelMiw}>
+    <Text size={size.fontSize} c="dimmed" w={size.labelMiw} style={{ whiteSpace: "nowrap", flexShrink: 0 }}>
       {label}
     </Text>
     <MetricValue value={value} progress={progress} size={size} />
@@ -195,14 +200,13 @@ const metricRenderers = [
   {
     key: "showDisk",
     render: (s: BeszelSystemRow, t: SystemCardProps["t"], sz: SizeConfig) => (
-      <MetricRow
-        key="disk"
-        icon={<HardDrive size={sz.iconSize} />}
-        label={t("metric.disk")}
-        value={formatPercent(s.disk)}
-        progress={{ value: s.disk, color: thresholdColor(s.disk) }}
-        size={sz}
-      />
+      <Group key="disk" gap="xs" wrap="nowrap" justify="space-between" style={{ minHeight: sz.rowHeight }}>
+        <HardDrive size={sz.iconSize} />
+        <Text size={sz.fontSize} c="dimmed" w={sz.labelMiw} style={{ whiteSpace: "nowrap", flexShrink: 0 }}>
+          {t("metric.disk")}
+        </Text>
+        <DiskUsage system={s} fontSize={sz.fontSize} progressSize={sz.progressSize} valueMiw={sz.valueMiw} />
+      </Group>
     ),
     visible: (s: BeszelSystemRow, o: SystemCardProps["options"]) => o.showDisk,
   },
@@ -399,7 +403,7 @@ export default function BeszelSystemGridWidget({
     );
   }
 
-  const cols = getColCount(width, filteredSystems.length);
+  const cols = getColCount(width, height, filteredSystems.length);
   const rows = Math.ceil(filteredSystems.length / cols) || 1;
   const rawCellHeight = height / rows;
   const scrollEnabled = rawCellHeight < MIN_CELL_HEIGHT;

packages/widgets/src/beszel-system-grid/index.ts

@@ -6,6 +6,7 @@ import { optionsBuilder } from "../options";
 
 export const { definition, componentLoader } = createWidgetDefinition("beszelSystemGrid", {
   icon: IconLayoutGrid,
+  queryKey: [["widget", "beszel"]],
   supportedIntegrations: ["beszel", "mock"],
   integrationsRequired: true,
   createOptions() {

packages/widgets/src/beszel-system-stats/component.tsx

@@ -1,54 +1,21 @@
 "use client";
 
 import { useCallback, useMemo } from "react";
-import { Button, Box, Center, Loader, Menu, ScrollArea, Select, SimpleGrid, Stack, Text } from "@mantine/core";
-import { IconPlugConnectedX, IconServer, IconQuestionMark, IconServerOff } from "@tabler/icons-react";
+import { Box, Button, Center, Loader, Menu, ScrollArea, Select, Stack, Text } from "@mantine/core";
+import { IconQuestionMark, IconServer, IconServerOff } from "@tabler/icons-react";
 
 import { clientApi } from "@homarr/api/client";
 import { useSession } from "@homarr/auth/client";
 import { constructBoardPermissions } from "@homarr/auth/shared";
 import { useOptionalBoard } from "@homarr/boards/context";
-import type { BeszelContainerStatsRecord, BeszelSystemStatsRecord } from "@homarr/integrations/types";
 import { useScopedI18n } from "@homarr/translation/client";
 
 import classes from "./component.module.css";
 
 import type { WidgetComponentProps } from "../definition";
-import { containerColors } from "../beszel/_shared/colors";
 import type { BeszelTimePeriod } from "../beszel/_shared/chart";
-import {
-  BeszelChartPanel,
-  CPU_Y_AXIS_DOMAIN,
-  useContainerNames,
-  useDockerChartData,
-  useEfsChartData,
-  useSystemChartData,
-} from "../beszel/_shared/chart";
-import {
-  chartAxisFormatters,
-  formatByteRate,
-  formatGB,
-  formatPercent,
-  formatStorageBytes,
-} from "../beszel/_shared/format";
 import { BeszelIntegrationErrorIndicator } from "../beszel/_shared/error-indicator";
-import { makeTooltipProps } from "../beszel/_shared/tooltip";
-import { useLiveStats } from "../beszel/_shared/use-live-stats";
-
-const tooltipPercent = makeTooltipProps(formatPercent);
-const tooltipGB = makeTooltipProps(formatGB, true);
-const tooltipRate = makeTooltipProps(formatByteRate, true);
-const tooltipPercentTotal = makeTooltipProps(formatPercent, true);
-const tooltipBytesTotal = makeTooltipProps(formatStorageBytes, true);
-
-const CHART_HEIGHT = 180;
-const MB = 1024 * 1024;
-const gridColumns = [1, 2] as const;
-
-function statsWhenShown<T>(show: boolean | undefined, data: T | undefined): T | undefined {
-  if (!show || !data) return undefined;
-  return data;
-}
+import { BeszelStatsView } from "../beszel/_shared/stats-view";
 
 export default function BeszelSystemStatsWidget({
   options,
@@ -71,14 +38,12 @@ export default function BeszelSystemStatsWidget({
   } = clientApi.widget.beszel.getSystems.useQuery({ integrationIds });
 
   const systems = useMemo(
-    () => systemsResult.flatMap((r) => r.systems.map((s) => ({ value: s.id, label: s.name }))),
+    () => systemsResult.flatMap((result) => result.systems.map((system) => ({ value: system.id, label: system.name }))),
     [systemsResult],
   );
-
   const selectedSystem = options.systemId || systems[0]?.value || "";
-  const selectedLabel = systems.find((s) => s.value === selectedSystem)?.label;
-  const systemExists = systems.some((s) => s.value === selectedSystem);
-  const systemReady = !systemsPending && (selectedSystem === "" || systemExists);
+  const selectedLabel = systems.find((system) => system.value === selectedSystem)?.label;
+  const systemExists = systems.some((system) => system.value === selectedSystem);
 
   const handleSelectSystem = useCallback(
     (value: string) => {
@@ -90,139 +55,13 @@ export default function BeszelSystemStatsWidget({
     [setOptions, hasChangeAccess, boardId, itemId, saveItemOptions],
   );
 
-  const showDocker = options.showDockerCpu || options.showDockerMemory || options.showDockerNetwork;
-  const isLive = options.timePeriod === "1m";
-
-  const { data: statsResult, error: statsError } = clientApi.widget.beszel.getSystemStats.useQuery(
-    {
-      integrationIds,
-      systemId: selectedSystem,
-      timePeriod: options.timePeriod as "1m" | "1h" | "12h" | "24h" | "1w" | "30d",
-      includeDocker: showDocker,
-    },
-    {
-      refetchInterval: isLive ? false : 5_000,
-      enabled: !isLive && systemReady && selectedSystem !== "",
-    },
-  );
-
-  const { data: liveData, error: liveError } = useLiveStats(integrationIds, selectedSystem, isLive && systemReady);
-
-  let activeStats:
-    | { systemStats: BeszelSystemStatsRecord[]; containerStats: BeszelContainerStatsRecord[]; error?: string }
-    | null
-    | undefined = statsResult;
-  if (isLive) {
-    activeStats = liveData;
-  }
-
-  const mappers = useMemo(
-    () => ({
-      cpu: (s: { cpu: number }) => ({ [t("chart.cpu.series")]: s.cpu }),
-      memory: (s: { mu: number; mb: number }) => ({
-        [t("chart.memory.series")]: s.mu,
-        [t("chart.memory.cache")]: s.mb ?? 0,
-      }),
-      disk: (s: { du: number }) => ({ [t("chart.disk.series")]: s.du }),
-      diskIO: (s: { dr?: number; dw?: number }) => ({
-        [t("chart.diskIO.read")]: (s.dr ?? 0) * MB,
-        [t("chart.diskIO.write")]: (s.dw ?? 0) * MB,
-      }),
-      network: (s: { ns: number; nr: number; b?: [number, number] }) => ({
-        [t("chart.network.sent")]: s.b?.[0] ?? s.ns,
-        [t("chart.network.recv")]: s.b?.[1] ?? s.nr,
-      }),
-    }),
-    [t],
-  );
-
-  const series = useMemo(
-    () => ({
-      cpu: [{ name: t("chart.cpu.series"), color: "teal.6" }],
-      memory: [
-        { name: t("chart.memory.series"), color: "teal.5" },
-        { name: t("chart.memory.cache"), color: "teal.8" },
-      ],
-      disk: [{ name: t("chart.disk.series"), color: "grape.6" }],
-      diskIO: [
-        { name: t("chart.diskIO.write"), color: "orange.6" },
-        { name: t("chart.diskIO.read"), color: "blue.6" },
-      ],
-      network: [
-        { name: t("chart.network.sent"), color: "blue.6" },
-        { name: t("chart.network.recv"), color: "teal.6" },
-      ],
-    }),
-    [t],
-  );
-
-  const systemStats = activeStats?.systemStats;
-  const containerStatsRaw = activeStats?.containerStats;
-
-  const timePeriod = options.timePeriod as BeszelTimePeriod;
-  const cpuData = useSystemChartData(statsWhenShown(options.showCpu, systemStats), mappers.cpu, timePeriod);
-  const memoryData = useSystemChartData(statsWhenShown(options.showMemory, systemStats), mappers.memory, timePeriod);
-  const diskData = useSystemChartData(statsWhenShown(options.showDisk, systemStats), mappers.disk, timePeriod);
-  const diskIOData = useSystemChartData(statsWhenShown(options.showDiskIO, systemStats), mappers.diskIO, timePeriod);
-  const networkData = useSystemChartData(statsWhenShown(options.showNetwork, systemStats), mappers.network, timePeriod);
-
-  const containerNames = useContainerNames(statsWhenShown(showDocker, containerStatsRaw));
-  const dockerCpuData = useDockerChartData(
-    statsWhenShown(options.showDockerCpu, containerStatsRaw),
-    containerNames,
-    "cpu",
-    timePeriod,
-  );
-  const dockerMemData = useDockerChartData(
-    statsWhenShown(options.showDockerMemory, containerStatsRaw),
-    containerNames,
-    "memory",
-    timePeriod,
-  );
-  const dockerNetData = useDockerChartData(
-    statsWhenShown(options.showDockerNetwork, containerStatsRaw),
-    containerNames,
-    "network",
-    timePeriod,
-  );
-
-  const efsPaths = useMemo(() => {
-    if (!systemStats) return [];
-    const paths = new Set<string>();
-    for (const record of systemStats) {
-      if (record.stats.efs) {
-        for (const path of Object.keys(record.stats.efs)) {
-          paths.add(path);
-        }
-      }
-    }
-    return [...paths];
-  }, [systemStats]);
-
-  const storageData = useEfsChartData(statsWhenShown(options.showStorage, systemStats), efsPaths, timePeriod);
-
-  const containerSeries = useMemo(
-    () => containerNames.map((name, i) => ({ name, color: containerColors[i % containerColors.length] as string })),
-    [containerNames],
-  );
-
-  const storageSeries = useMemo(
-    () => efsPaths.map((path, i) => ({ name: path, color: containerColors[i % containerColors.length] as string })),
-    [efsPaths],
-  );
-
-  const cols = gridColumns[Number(width > 600)];
-
   if (systemsError) throw systemsError;
-  if (!isLive && statsError) throw statsError;
-
-  if (systemsPending) {
+  if (systemsPending)
     return (
       <Center h="100%">
         <Loader size="sm" />
       </Center>
     );
-  }
 
   if (systems.length === 0) {
     return (
@@ -240,7 +79,7 @@ export default function BeszelSystemStatsWidget({
     );
   }
 
-  if (!systemsPending && !systemExists && systems.length > 0) {
+  if (!systemExists) {
     return (
       <Center h="100%">
         <Stack align="center" gap="sm" p="md">
@@ -260,22 +99,6 @@ export default function BeszelSystemStatsWidget({
     );
   }
 
-  if (isLive && liveError && !liveData) {
-    return (
-      <Center h="100%">
-        <Stack align="center" gap="sm" p="md">
-          <IconPlugConnectedX size={40} />
-          <Text size="sm" c="dimmed" ta="center">
-            {t("error.liveConnectionFailed")}
-          </Text>
-          <Button size="xs" variant="light" onClick={() => setOptions({ newOptions: { timePeriod: "1h" } })}>
-            {t("error.switchToHistorical")}
-          </Button>
-        </Stack>
-      </Center>
-    );
-  }
-
   return (
     <Box h="100%" pos="relative">
       <Box pos="absolute" top={4} right={8} style={{ zIndex: 1 }}>
@@ -284,7 +107,7 @@ export default function BeszelSystemStatsWidget({
       <ScrollArea
         h="100%"
         className={classes.beszelStatsContainer}
-        style={{ pointerEvents: (isEditMode && "none") || undefined }}
+        style={{ pointerEvents: isEditMode ? "none" : undefined }}
       >
         <Stack gap="md" p="sm">
           {!isEditMode && systems.length > 1 && (
@@ -300,176 +123,37 @@ export default function BeszelSystemStatsWidget({
                 </Button>
               </Menu.Target>
               <Menu.Dropdown>
-                {systems.map((s) => (
+                {systems.map((system) => (
                   <Menu.Item
-                    key={s.value}
+                    key={system.value}
                     fz="xs"
-                    fw={s.value === selectedSystem ? 600 : 400}
-                    c={s.value !== selectedSystem ? "dimmed" : undefined}
-                    onClick={() => handleSelectSystem(s.value)}
+                    fw={system.value === selectedSystem ? 600 : 400}
+                    c={system.value !== selectedSystem ? "dimmed" : undefined}
+                    onClick={() => handleSelectSystem(system.value)}
                   >
-                    {s.label}
+                    {system.label}
                   </Menu.Item>
                 ))}
               </Menu.Dropdown>
             </Menu>
           )}
-
-          {!isLive && !activeStats && systemReady && selectedSystem !== "" && (
-            <Center h={CHART_HEIGHT}>
-              <Loader size="sm" />
-            </Center>
-          )}
-
-          {!isLive && activeStats && "error" in activeStats && activeStats.error && (
-            <Center h={CHART_HEIGHT}>
-              <Stack align="center" gap="xs">
-                <IconServerOff size={24} opacity={0.5} />
-                <Text size="sm" c="dimmed">
-                  {activeStats.error}
-                </Text>
-              </Stack>
-            </Center>
-          )}
-
-          {activeStats && (!("error" in activeStats) || !activeStats.error) && (
-            <SimpleGrid cols={cols} spacing="md">
-              {options.showCpu && cpuData.length > 0 && (
-                <BeszelChartPanel
-                  title={t("chart.cpu.title")}
-                  subtitle={t("chart.cpu.subtitle")}
-                  chartProps={{
-                    h: CHART_HEIGHT,
-                    data: cpuData,
-                    series: series.cpu,
-                    yAxisFormatter: chartAxisFormatters.percent,
-                    yAxisDomain: CPU_Y_AXIS_DOMAIN,
-                    tooltipProps: tooltipPercent,
-                  }}
-                />
-              )}
-
-              {options.showMemory && memoryData.length > 0 && (
-                <BeszelChartPanel
-                  title={t("chart.memory.title")}
-                  subtitle={t("chart.memory.subtitle")}
-                  chartProps={{
-                    h: CHART_HEIGHT,
-                    data: memoryData,
-                    type: "stacked",
-                    series: series.memory,
-                    yAxisFormatter: chartAxisFormatters.gb,
-                    tooltipProps: tooltipGB,
-                  }}
-                />
-              )}
-
-              {options.showDisk && diskData.length > 0 && (
-                <BeszelChartPanel
-                  title={t("chart.disk.title")}
-                  subtitle={t("chart.disk.subtitle")}
-                  chartProps={{
-                    h: CHART_HEIGHT,
-                    data: diskData,
-                    series: series.disk,
-                    yAxisFormatter: chartAxisFormatters.gb,
-                    tooltipProps: tooltipGB,
-                  }}
-                />
-              )}
-
-              {options.showDiskIO && diskIOData.length > 0 && (
-                <BeszelChartPanel
-                  title={t("chart.diskIO.title")}
-                  subtitle={t("chart.diskIO.subtitle")}
-                  chartProps={{
-                    h: CHART_HEIGHT,
-                    data: diskIOData,
-                    series: series.diskIO,
-                    yAxisFormatter: chartAxisFormatters.rate,
-                    tooltipProps: tooltipRate,
-                  }}
-                />
-              )}
-
-              {options.showNetwork && networkData.length > 0 && (
-                <BeszelChartPanel
-                  title={t("chart.network.title")}
-                  subtitle={t("chart.network.subtitle")}
-                  chartProps={{
-                    h: CHART_HEIGHT,
-                    data: networkData,
-                    series: series.network,
-                    yAxisFormatter: chartAxisFormatters.rate,
-                    tooltipProps: tooltipRate,
-                  }}
-                />
-              )}
-
-              {options.showStorage && storageData.length > 0 && storageSeries.length > 0 && (
-                <BeszelChartPanel
-                  title={t("chart.storage.title")}
-                  subtitle={t("chart.storage.subtitle")}
-                  chartProps={{
-                    h: CHART_HEIGHT,
-                    data: storageData,
-                    type: "stacked",
-                    series: storageSeries,
-                    yAxisFormatter: chartAxisFormatters.bytes,
-                    tooltipProps: tooltipBytesTotal,
-                  }}
-                />
-              )}
-
-              {showDocker && containerSeries.length > 0 && (
-                <>
-                  {options.showDockerCpu && dockerCpuData.length > 0 && (
-                    <BeszelChartPanel
-                      title={t("chart.dockerCpu.title")}
-                      subtitle={t("chart.dockerCpu.subtitle")}
-                      chartProps={{
-                        h: CHART_HEIGHT,
-                        data: dockerCpuData,
-                        type: "stacked",
-                        series: containerSeries,
-                        yAxisFormatter: chartAxisFormatters.percent,
-                        tooltipProps: tooltipPercentTotal,
-                      }}
-                    />
-                  )}
-
-                  {options.showDockerMemory && dockerMemData.length > 0 && (
-                    <BeszelChartPanel
-                      title={t("chart.dockerMemory.title")}
-                      subtitle={t("chart.dockerMemory.subtitle")}
-                      chartProps={{
-                        h: CHART_HEIGHT,
-                        data: dockerMemData,
-                        type: "stacked",
-                        series: containerSeries,
-                        yAxisFormatter: chartAxisFormatters.bytes,
-                        tooltipProps: tooltipBytesTotal,
-                      }}
-                    />
-                  )}
-
-                  {options.showDockerNetwork && dockerNetData.length > 0 && (
-                    <BeszelChartPanel
-                      title={t("chart.dockerNetwork.title")}
-                      subtitle={t("chart.dockerNetwork.subtitle")}
-                      chartProps={{
-                        h: CHART_HEIGHT,
-                        data: dockerNetData,
-                        series: containerSeries,
-                        yAxisFormatter: chartAxisFormatters.rate,
-                        tooltipProps: tooltipRate,
-                      }}
-                    />
-                  )}
-                </>
-              )}
-            </SimpleGrid>
-          )}
+          <BeszelStatsView
+            integrationIds={integrationIds}
+            systemId={selectedSystem}
+            timePeriod={options.timePeriod as BeszelTimePeriod}
+            columns={width > 600 ? 2 : 1}
+            visibility={{
+              cpu: options.showCpu,
+              memory: options.showMemory,
+              disk: options.showDisk,
+              diskIO: options.showDiskIO,
+              network: options.showNetwork,
+              dockerCpu: options.showDockerCpu,
+              dockerMemory: options.showDockerMemory,
+              dockerNetwork: options.showDockerNetwork,
+            }}
+            onSwitchToHistorical={() => setOptions({ newOptions: { timePeriod: "1h" } })}
+          />
         </Stack>
       </ScrollArea>
     </Box>

packages/widgets/src/beszel-system-stats/index.ts

@@ -16,6 +16,7 @@ const timePeriodOptions = [
 
 export const { definition, componentLoader } = createWidgetDefinition("beszelSystemStats", {
   icon: IconChartAreaLine,
+  queryKey: [["widget", "beszel"]],
   supportedIntegrations: ["beszel", "mock"],
   integrationsRequired: true,
   createOptions() {
@@ -45,7 +46,6 @@ export const { definition, componentLoader } = createWidgetDefinition("beszelSys
       showDockerCpu: factory.switch({ defaultValue: true }),
       showDockerMemory: factory.switch({ defaultValue: true }),
       showDockerNetwork: factory.switch({ defaultValue: true }),
-      showStorage: factory.switch({ defaultValue: true }),
     }));
   },
   errors: {

packages/widgets/src/beszel-system-table/component.tsx

@@ -26,10 +26,18 @@ import { useScopedI18n } from "@homarr/translation/client";
 import type { WidgetComponentProps } from "../definition";
 import type { BeszelSystemRow } from "../beszel/_shared/types";
 import { loadAvgColor, statusColorMap, thresholdColor } from "../beszel/_shared/colors";
-import { formatByteRate, formatLoadAvg, formatPercent, formatTemp, formatUptime } from "../beszel/_shared/format";
+import {
+  formatByteRate,
+  formatLoadAvg,
+  formatPercent,
+  formatTemp,
+  formatUptime,
+  getProgressTrackSize,
+} from "../beszel/_shared/format";
 import { useBeszelFilteredSystems } from "../beszel/_shared/hooks";
 import { BeszelIntegrationErrorIndicator } from "../beszel/_shared/error-indicator";
 import { BeszelSystemStatsModal } from "../beszel/_shared/system-stats-modal";
+import { DiskUsage } from "../beszel/_shared/disk-usage";
 
 const directionMultiplier: Record<string, number> = { asc: 1, desc: -1 };
 
@@ -97,11 +105,16 @@ export default function BeszelSystemTableWidget({
   }, [filteredSystems, sortStatus]);
 
   const PercentCell = ({ value }: { value: number }) => (
-    <Group gap={4} wrap="nowrap" style={{ flex: 1 }}>
-      <Text size={size.fontSize} fw={500} miw={size.valueMiw} ta="right" style={{ whiteSpace: "nowrap" }}>
+    <Group gap={8} wrap="nowrap" style={{ flex: 1 }}>
+      <Text size={size.fontSize} fw={500} w={size.valueMiw} ta="left" style={{ whiteSpace: "nowrap", flexShrink: 0 }}>
         {formatPercent(value)}
       </Text>
-      <Progress value={value} color={thresholdColor(value)} size={size.progressSize} style={{ flex: 1 }} />
+      <Progress
+        value={value}
+        color={thresholdColor(value)}
+        size={getProgressTrackSize(size.progressSize)}
+        style={{ flex: 1 }}
+      />
     </Group>
   );
 
@@ -156,7 +169,15 @@ export default function BeszelSystemTableWidget({
           </Group>
         ),
         sortable: true,
-        render: (record) => <PercentCell value={record.disk} />,
+        render: (record) => (
+          <DiskUsage
+            system={record}
+            fontSize={size.fontSize}
+            progressSize={size.progressSize}
+            valueMiw={size.valueMiw}
+            valueGap={8}
+          />
+        ),
       },
       options.showGpu && {
         accessor: "gpu",

packages/widgets/src/beszel-system-table/index.ts

@@ -25,6 +25,7 @@ const sortDirectionOptions = [
 
 export const { definition, componentLoader } = createWidgetDefinition("beszelSystemTable", {
   icon: IconTable,
+  queryKey: [["widget", "beszel"]],
   supportedIntegrations: ["beszel", "mock"],
   integrationsRequired: true,
   createOptions() {

packages/widgets/src/beszel/_shared/chart.spec.ts

@@ -0,0 +1,87 @@
+import { describe, expect, test } from "vitest";
+
+import type { BeszelSystemStatsRecord } from "@homarr/integrations/types";
+
+import { buildDiskChartData, padLiveTimeGrid } from "./chart";
+
+const record = (
+  created: string,
+  du: number,
+  efs: BeszelSystemStatsRecord["stats"]["efs"],
+): BeszelSystemStatsRecord => ({
+  id: created,
+  system: "system-1",
+  type: "1m",
+  created,
+  updated: created,
+  stats: {
+    cpu: 0,
+    m: 0,
+    mu: 0,
+    mp: 0,
+    mb: 0,
+    s: 0,
+    su: 0,
+    d: 938.8,
+    du,
+    dp: 51.15,
+    efs,
+  },
+});
+
+describe("buildDiskChartData", () => {
+  test("keeps root and extra filesystem usage in GiB without stacking or byte conversion", () => {
+    const data = buildDiskChartData(
+      [
+        record("2026-07-11T13:46:00.000Z", 455.81, {
+          sda: { d: 1906.8, du: 1656.45, r: 0, w: 0 },
+          sdb: { d: 5587.04, du: 3936.86, r: 0, w: 0 },
+          sdc: { d: 3724.18, du: 1589.84, r: 0, w: 0 },
+        }),
+      ],
+      ["sda", "sdb", "sdc"],
+      "Root",
+      "1h",
+    );
+
+    expect(data).toHaveLength(1);
+    expect(data[0]).toMatchObject({ Root: 455.81, sda: 1656.45, sdb: 3936.86, sdc: 1589.84 });
+  });
+
+  test("uses zero for a filesystem missing from an individual sample and orders historical records oldest first", () => {
+    const data = buildDiskChartData(
+      [
+        record("2026-07-11T13:47:00.000Z", 2, { sda: { d: 10, du: 4, r: 0, w: 0 } }),
+        record("2026-07-11T13:46:00.000Z", 1, undefined),
+      ],
+      ["sda"],
+      "Root",
+      "1h",
+    );
+
+    expect(data.map((point) => ({ Root: point.Root, sda: point.sda }))).toEqual([
+      { Root: 1, sda: 0 },
+      { Root: 2, sda: 4 },
+    ]);
+  });
+});
+
+describe("padLiveTimeGrid", () => {
+  test("keeps a fixed 60-second window with the newest sample at the right edge", () => {
+    const data = padLiveTimeGrid([{ time: "13:51:30", rawTime: "2026-07-11T13:51:30.217Z", CPU: 18.07 }]);
+
+    expect(data).toHaveLength(60);
+    expect(data[0]).not.toHaveProperty("CPU");
+    expect(data[58]).not.toHaveProperty("CPU");
+    expect(data[59]).toMatchObject({ CPU: 18.07 });
+  });
+
+  test("leaves null gaps for missing seconds instead of stretching existing points", () => {
+    const data = padLiveTimeGrid([
+      { time: "13:51:28", rawTime: "2026-07-11T13:51:28.000Z", CPU: 10 },
+      { time: "13:51:30", rawTime: "2026-07-11T13:51:30.000Z", CPU: 20 },
+    ]);
+
+    expect(data.slice(-3).map((point) => point.CPU)).toEqual([10, undefined, 20]);
+  });
+});

packages/widgets/src/beszel/_shared/chart.tsx

@@ -30,6 +30,7 @@ function prepareRecords<T>(records: T[], timePeriod: BeszelTimePeriod) {
 }
 
 function padTimeGrid(data: Record<string, unknown>[], timePeriod: BeszelTimePeriod) {
+  if (timePeriod === "1m") return padLiveTimeGrid(data);
   const days = periodDays[timePeriod];
   if (!days) return data;
 
@@ -50,6 +51,38 @@ function padTimeGrid(data: Record<string, unknown>[], timePeriod: BeszelTimePeri
   return result.toSorted((a, b) => new Date(a.rawTime as string).getTime() - new Date(b.rawTime as string).getTime());
 }
 
+export function padLiveTimeGrid(data: Record<string, unknown>[], pointCount = 60) {
+  if (data.length === 0) return data;
+
+  const end = dayjs(
+    data.reduce((latest, point) => {
+      const timestamp = new Date(point.rawTime as string).getTime();
+      return Number.isFinite(timestamp) ? Math.max(latest, timestamp) : latest;
+    }, 0),
+  ).startOf("second");
+  const pointsBySecond = new Map(
+    data.map(
+      (point) =>
+        [
+          dayjs(point.rawTime as string)
+            .startOf("second")
+            .valueOf(),
+          point,
+        ] as const,
+    ),
+  );
+
+  return Array.from({ length: pointCount }, (_, index) => {
+    const timestamp = end.subtract(pointCount - index - 1, "second");
+    return (
+      pointsBySecond.get(timestamp.valueOf()) ?? {
+        time: timestamp.format(timeFormats["1m"]),
+        rawTime: timestamp.toISOString(),
+      }
+    );
+  });
+}
+
 const yAxisBase = { tickMargin: 0, tick: { fontSize: 10 } } as const;
 const chartStyle = { minWidth: 0, minHeight: 1 } as const;
 const panelStyle = { minWidth: 0, overflow: "hidden" } as const;
@@ -174,24 +207,39 @@ const defaultContainerExtractors: Record<string, ContainerExtractor> = {
   network: (c) => (c?.b ? c.b[0] + c.b[1] : (c?.ns ?? 0) + (c?.nr ?? 0)),
 };
 
-export const useEfsChartData = (
+export const useDiskChartData = (
   systemStats: BeszelSystemStatsRecord[] | undefined,
   efsPaths: string[],
+  rootSeriesName: string,
   timePeriod: BeszelTimePeriod = "1h",
 ) =>
-  useMemo(() => {
-    if (!systemStats?.length) return [];
-    const { fmt, ordered } = prepareRecords(systemStats, timePeriod);
-    const mapped = ordered.map((record) => {
-      const point: Record<string, unknown> = { time: fmt(record.created), rawTime: record.created };
-      const efs = record.stats.efs ?? {};
-      for (const path of efsPaths) {
-        point[path] = efs[path]?.du ?? 0;
-      }
-      return point;
-    });
-    return padTimeGrid(mapped, timePeriod);
-  }, [systemStats, efsPaths, timePeriod]);
+  useMemo(
+    () => buildDiskChartData(systemStats, efsPaths, rootSeriesName, timePeriod),
+    [systemStats, efsPaths, rootSeriesName, timePeriod],
+  );
+
+export const buildDiskChartData = (
+  systemStats: BeszelSystemStatsRecord[] | undefined,
+  efsPaths: string[],
+  rootSeriesName: string,
+  timePeriod: BeszelTimePeriod = "1h",
+) => {
+  if (!systemStats?.length) return [];
+  const { fmt, ordered } = prepareRecords(systemStats, timePeriod);
+  const mapped = ordered.map((record) => {
+    const point: Record<string, unknown> = {
+      time: fmt(record.created),
+      rawTime: record.created,
+      [rootSeriesName]: record.stats.du,
+    };
+    const efs = record.stats.efs ?? {};
+    for (const path of efsPaths) {
+      point[path] = efs[path]?.du ?? 0;
+    }
+    return point;
+  });
+  return padTimeGrid(mapped, timePeriod);
+};
 
 export const useDockerChartData = (
   containerStats: BeszelContainerStatsRecord[] | undefined,

packages/widgets/src/beszel/_shared/disk-usage.tsx

@@ -0,0 +1,105 @@
+import { Box, Group, HoverCard, Progress, Stack, Text, UnstyledButton } from "@mantine/core";
+
+import type { BeszelSystemRow } from "./types";
+import { thresholdColor } from "./colors";
+import { formatPercent, getProgressTrackSize } from "./format";
+
+interface DiskUsageProps {
+  system: BeszelSystemRow;
+  fontSize: string;
+  progressSize: "xs" | "sm";
+  valueMiw: number;
+  valueGap?: number;
+}
+
+const mountLabel = (path: string) =>
+  path === "/" ? "ROOT" : (path.split("/").filter(Boolean).at(-1) ?? path).toUpperCase();
+const severityColor = (value: number) => `var(--mantine-color-${thresholdColor(value)}-6)`;
+
+export const DiskUsage = ({ system, fontSize, progressSize, valueMiw, valueGap = 6 }: DiskUsageProps) => {
+  const filesystems = Object.entries(system.extraFilesystems).filter(([path]) => path !== "/");
+  const trackSize = getProgressTrackSize(progressSize);
+  const dotSize = progressSize === "xs" ? 2 : 3;
+  const dotGap = 2;
+
+  return (
+    <Group gap={valueGap} wrap="nowrap" style={{ flex: 1, minWidth: 0, marginLeft: "auto" }}>
+      <Text size={fontSize} fw={500} w={valueMiw} ta="left" style={{ whiteSpace: "nowrap", flexShrink: 0 }}>
+        {formatPercent(system.disk)}
+      </Text>
+      <HoverCard
+        position="right"
+        withArrow
+        shadow="md"
+        openDelay={200}
+        closeDelay={100}
+        disabled={filesystems.length === 0}
+      >
+        <HoverCard.Target>
+          {filesystems.length > 0 ? (
+            <UnstyledButton
+              aria-label={`Show usage for ${filesystems.length + 1} filesystems`}
+              style={{
+                display: "flex",
+                alignItems: "center",
+                flex: 1,
+                minWidth: 24,
+                cursor: "pointer",
+              }}
+            >
+              <Box pos="relative" style={{ flex: 1, minWidth: 24 }}>
+                <Progress value={system.disk} color={thresholdColor(system.disk)} size={trackSize} />
+                <Group
+                  gap={dotGap}
+                  wrap="nowrap"
+                  aria-hidden
+                  pos="absolute"
+                  top="50%"
+                  right={Math.max(2, dotGap)}
+                  style={{ transform: "translateY(-50%)" }}
+                >
+                  {filesystems.map(([path, value]) => (
+                    <Box
+                      key={path}
+                      w={dotSize}
+                      h={dotSize}
+                      style={{
+                        borderRadius: "50%",
+                        backgroundColor: severityColor(value),
+                        boxShadow: "0 0 0 0.5px var(--mantine-color-body)",
+                        flex: "0 0 auto",
+                      }}
+                    />
+                  ))}
+                </Group>
+              </Box>
+            </UnstyledButton>
+          ) : (
+            <Box style={{ display: "flex", alignItems: "center", flex: 1, minWidth: 24 }}>
+              <Box pos="relative" style={{ flex: 1, minWidth: 24 }}>
+                <Progress value={system.disk} color={thresholdColor(system.disk)} size={trackSize} />
+              </Box>
+            </Box>
+          )}
+        </HoverCard.Target>
+        <HoverCard.Dropdown p={8}>
+          <Stack gap={6} miw={145}>
+            {[["/", system.disk] as const, ...filesystems].map(([path, value]) => (
+              <Stack key={path} gap={1}>
+                <Text size="10px" c="dimmed" fw={500} lh={1.2}>
+                  {mountLabel(path)}
+                </Text>
+                <Group gap={8} wrap="nowrap">
+                  <Text size="sm" fw={600} miw={48} lh={1.25}>
+                    {formatPercent(value)}
+                  </Text>
+                  <Progress value={value} color={thresholdColor(value)} size="xs" style={{ flex: 1 }} />
+                </Group>
+              </Stack>
+            ))}
+          </Stack>
+        </HoverCard.Dropdown>
+      </HoverCard>
+    </Group>
+  );
+};

packages/widgets/src/beszel/_shared/format.spec.ts

@@ -0,0 +1,21 @@
+import { describe, expect, test } from "vitest";
+
+import { chartAxisFormatters, formatGB, getProgressTrackSize } from "./format";
+
+describe("Beszel storage formatting", () => {
+  test("keeps smaller values in GB", () => {
+    expect(formatGB(455.81)).toBe("455.81 GB");
+    expect(chartAxisFormatters.gb(455.81)).toBe("456G");
+  });
+
+  test("promotes large GiB values to TB", () => {
+    expect(formatGB(3323)).toBe("3.25 TB");
+    expect(formatGB(3936.86)).toBe("3.84 TB");
+    expect(chartAxisFormatters.gb(3323)).toBe("3.2T");
+  });
+
+  test("maps progress sizes consistently", () => {
+    expect(getProgressTrackSize("xs")).toBe(6);
+    expect(getProgressTrackSize("sm")).toBe(9);
+  });
+});

packages/widgets/src/beszel/_shared/format.ts

@@ -29,14 +29,22 @@ export const formatStorageBytes = (bytes: number): string => formatScaled(bytes,
 
 export const formatGB = (value: number): string => {
   if (!value || !Number.isFinite(value)) return "0 GB";
+  if (Math.abs(value) >= 1024) return `${(value / 1024).toFixed(2)} TB`;
   return `${value.toFixed(2)} GB`;
 };
 
 export const formatPercent = (value: number): string => `${value.toFixed(1)}%`;
 
+export const getProgressTrackSize = (size: "xs" | "sm"): number => (size === "xs" ? 6 : 9);
+
 export const chartAxisFormatters = {
   percent: formatPercent,
-  gb: (value: number) => (!value ? "0" : `${Number(value).toFixed(0)}G`),
+  gb: (value: number) => {
+    const numericValue = Number(value);
+    if (!numericValue) return "0";
+    if (Math.abs(numericValue) >= 1024) return `${(numericValue / 1024).toFixed(1)}T`;
+    return `${numericValue.toFixed(0)}G`;
+  },
   mb: (value: number) => (!value ? "0" : `${Number(value).toFixed(0)}M`),
   bytes: (value: number) => formatScaledCompact(Number(value), byteUnits, "0"),
   rate: (value: number) => formatScaledCompact(Number(value), rateUnits, "0"),

packages/widgets/src/beszel/_shared/stats-view.tsx

@@ -0,0 +1,339 @@
+"use client";
+
+import { useMemo } from "react";
+import { Button, Center, Group, SimpleGrid, Skeleton, Stack, Text } from "@mantine/core";
+import { IconPlugConnectedX, IconServerOff } from "@tabler/icons-react";
+
+import { clientApi } from "@homarr/api/client";
+import type { BeszelContainerStatsRecord, BeszelSystemStatsRecord } from "@homarr/integrations/types";
+import { useScopedI18n } from "@homarr/translation/client";
+
+import { containerColors } from "./colors";
+import type { BeszelTimePeriod } from "./chart";
+import {
+  BeszelChartPanel,
+  CPU_Y_AXIS_DOMAIN,
+  useContainerNames,
+  useDiskChartData,
+  useDockerChartData,
+  useSystemChartData,
+} from "./chart";
+import { chartAxisFormatters, formatByteRate, formatGB, formatPercent, formatStorageBytes } from "./format";
+import { makeTooltipProps } from "./tooltip";
+import { useLiveStats } from "./use-live-stats";
+
+const CHART_HEIGHT = 180;
+const MB = 1024 * 1024;
+const tooltipPercent = makeTooltipProps(formatPercent);
+const tooltipGB = makeTooltipProps(formatGB, true);
+const tooltipRate = makeTooltipProps(formatByteRate, true);
+const tooltipPercentTotal = makeTooltipProps(formatPercent, true);
+const tooltipBytesTotal = makeTooltipProps(formatStorageBytes, true);
+
+const ChartSkeleton = () => (
+  <Stack gap={4} style={{ minWidth: 0 }}>
+    <Group gap="xs">
+      <Skeleton h={14} w={72} radius="sm" />
+      <Skeleton h={10} w={110} radius="sm" />
+    </Group>
+    <Skeleton h={CHART_HEIGHT} radius="sm" />
+  </Stack>
+);
+
+export interface BeszelStatsVisibility {
+  cpu: boolean;
+  memory: boolean;
+  disk: boolean;
+  diskIO: boolean;
+  network: boolean;
+  dockerCpu: boolean;
+  dockerMemory: boolean;
+  dockerNetwork: boolean;
+}
+
+interface BeszelStatsViewProps {
+  integrationIds: string[];
+  systemId: string;
+  timePeriod: BeszelTimePeriod;
+  visibility: BeszelStatsVisibility;
+  columns: 1 | 2;
+  onSwitchToHistorical?: () => void;
+}
+
+const whenVisible = <T,>(visible: boolean, data: T | undefined) => (visible ? data : undefined);
+
+export function BeszelStatsView({
+  integrationIds,
+  systemId,
+  timePeriod,
+  visibility,
+  columns,
+  onSwitchToHistorical,
+}: BeszelStatsViewProps) {
+  const t = useScopedI18n("widget.beszelSystemStats");
+  const showDocker = visibility.dockerCpu || visibility.dockerMemory || visibility.dockerNetwork;
+  const isLive = timePeriod === "1m";
+
+  const { data: historicalData, error: historicalError } = clientApi.widget.beszel.getSystemStats.useQuery(
+    { integrationIds, systemId, timePeriod, includeDocker: showDocker },
+    { refetchInterval: isLive ? false : 5_000, enabled: !isLive && systemId !== "" },
+  );
+  const { data: liveData, error: liveError } = useLiveStats(integrationIds, systemId, isLive && systemId !== "");
+
+  const activeStats:
+    | { systemStats: BeszelSystemStatsRecord[]; containerStats: BeszelContainerStatsRecord[]; error?: string }
+    | null
+    | undefined = isLive ? liveData : historicalData;
+
+  const mappers = useMemo(
+    () => ({
+      cpu: (s: { cpu: number }) => ({ [t("chart.cpu.series")]: s.cpu }),
+      memory: (s: { mu: number; mb: number }) => ({
+        [t("chart.memory.series")]: s.mu,
+        [t("chart.memory.cache")]: s.mb ?? 0,
+      }),
+      diskIO: (s: { dr?: number; dw?: number }) => ({
+        [t("chart.diskIO.read")]: (s.dr ?? 0) * MB,
+        [t("chart.diskIO.write")]: (s.dw ?? 0) * MB,
+      }),
+      network: (s: { ns?: number; nr?: number; b?: [number, number] }) => ({
+        [t("chart.network.sent")]: s.b?.[0] ?? s.ns ?? 0,
+        [t("chart.network.recv")]: s.b?.[1] ?? s.nr ?? 0,
+      }),
+    }),
+    [t],
+  );
+
+  const series = useMemo(
+    () => ({
+      cpu: [{ name: t("chart.cpu.series"), color: "teal.6" }],
+      memory: [
+        { name: t("chart.memory.series"), color: "teal.5" },
+        { name: t("chart.memory.cache"), color: "teal.8" },
+      ],
+      diskIO: [
+        { name: t("chart.diskIO.write"), color: "orange.6" },
+        { name: t("chart.diskIO.read"), color: "blue.6" },
+      ],
+      network: [
+        { name: t("chart.network.sent"), color: "blue.6" },
+        { name: t("chart.network.recv"), color: "teal.6" },
+      ],
+    }),
+    [t],
+  );
+
+  const systemStats = activeStats?.systemStats;
+  const containerStats = activeStats?.containerStats;
+  const cpuData = useSystemChartData(whenVisible(visibility.cpu, systemStats), mappers.cpu, timePeriod);
+  const memoryData = useSystemChartData(whenVisible(visibility.memory, systemStats), mappers.memory, timePeriod);
+  const diskIOData = useSystemChartData(whenVisible(visibility.diskIO, systemStats), mappers.diskIO, timePeriod);
+  const networkData = useSystemChartData(whenVisible(visibility.network, systemStats), mappers.network, timePeriod);
+
+  const efsPaths = useMemo(() => {
+    const paths = new Set<string>();
+    for (const record of systemStats ?? []) {
+      for (const path of Object.keys(record.stats.efs ?? {})) paths.add(path);
+    }
+    return [...paths];
+  }, [systemStats]);
+  const rootSeriesName = t("chart.disk.series");
+  const diskData = useDiskChartData(whenVisible(visibility.disk, systemStats), efsPaths, rootSeriesName, timePeriod);
+  const diskSeries = useMemo(
+    () => [
+      { name: rootSeriesName, color: "grape.6" },
+      ...efsPaths.map((path, index) => ({
+        name: path,
+        color: containerColors[(index + 1) % containerColors.length] as string,
+      })),
+    ],
+    [efsPaths, rootSeriesName],
+  );
+
+  const containerNames = useContainerNames(whenVisible(showDocker, containerStats));
+  const containerSeries = useMemo(
+    () =>
+      containerNames.map((name, index) => ({ name, color: containerColors[index % containerColors.length] as string })),
+    [containerNames],
+  );
+  const dockerCpuData = useDockerChartData(
+    whenVisible(visibility.dockerCpu, containerStats),
+    containerNames,
+    "cpu",
+    timePeriod,
+  );
+  const dockerMemoryData = useDockerChartData(
+    whenVisible(visibility.dockerMemory, containerStats),
+    containerNames,
+    "memory",
+    timePeriod,
+  );
+  const dockerNetworkData = useDockerChartData(
+    whenVisible(visibility.dockerNetwork, containerStats),
+    containerNames,
+    "network",
+    timePeriod,
+  );
+
+  if (historicalError) throw historicalError;
+
+  if (isLive && liveError) {
+    return (
+      <Center h={CHART_HEIGHT}>
+        <Stack align="center" gap="sm" p="md">
+          <IconPlugConnectedX size={40} />
+          <Text size="sm" c="dimmed" ta="center">
+            {t("error.liveConnectionFailed")}
+          </Text>
+          {onSwitchToHistorical && (
+            <Button size="xs" variant="light" onClick={onSwitchToHistorical}>
+              {t("error.switchToHistorical")}
+            </Button>
+          )}
+        </Stack>
+      </Center>
+    );
+  }
+
+  if (!activeStats) {
+    const visibleChartCount = Object.values(visibility).filter(Boolean).length;
+    return (
+      <SimpleGrid cols={columns} spacing="md" aria-label="Loading system statistics">
+        {Array.from({ length: visibleChartCount }, (_, index) => (
+          <ChartSkeleton key={index} />
+        ))}
+      </SimpleGrid>
+    );
+  }
+
+  if ("error" in activeStats && activeStats.error) {
+    return (
+      <Center h={CHART_HEIGHT}>
+        <Stack align="center" gap="xs">
+          <IconServerOff size={24} opacity={0.5} />
+          <Text size="sm" c="dimmed">
+            {activeStats.error}
+          </Text>
+        </Stack>
+      </Center>
+    );
+  }
+
+  return (
+    <SimpleGrid cols={columns} spacing="md">
+      {visibility.cpu && cpuData.length > 0 && (
+        <BeszelChartPanel
+          title={t("chart.cpu.title")}
+          subtitle={t("chart.cpu.subtitle")}
+          chartProps={{
+            h: CHART_HEIGHT,
+            data: cpuData,
+            series: series.cpu,
+            yAxisFormatter: chartAxisFormatters.percent,
+            yAxisDomain: CPU_Y_AXIS_DOMAIN,
+            tooltipProps: tooltipPercent,
+          }}
+        />
+      )}
+      {visibility.memory && memoryData.length > 0 && (
+        <BeszelChartPanel
+          title={t("chart.memory.title")}
+          subtitle={t("chart.memory.subtitle")}
+          chartProps={{
+            h: CHART_HEIGHT,
+            data: memoryData,
+            type: "stacked",
+            series: series.memory,
+            yAxisFormatter: chartAxisFormatters.gb,
+            tooltipProps: tooltipGB,
+          }}
+        />
+      )}
+      {visibility.disk && diskData.length > 0 && (
+        <BeszelChartPanel
+          title={t("chart.disk.title")}
+          subtitle={t("chart.disk.subtitle")}
+          chartProps={{
+            h: CHART_HEIGHT,
+            data: diskData,
+            type: "stacked",
+            series: diskSeries,
+            yAxisFormatter: chartAxisFormatters.gb,
+            tooltipProps: tooltipGB,
+          }}
+        />
+      )}
+      {visibility.diskIO && diskIOData.length > 0 && (
+        <BeszelChartPanel
+          title={t("chart.diskIO.title")}
+          subtitle={t("chart.diskIO.subtitle")}
+          chartProps={{
+            h: CHART_HEIGHT,
+            data: diskIOData,
+            series: series.diskIO,
+            yAxisFormatter: chartAxisFormatters.rate,
+            tooltipProps: tooltipRate,
+          }}
+        />
+      )}
+      {visibility.network && networkData.length > 0 && (
+        <BeszelChartPanel
+          title={t("chart.network.title")}
+          subtitle={t("chart.network.subtitle")}
+          chartProps={{
+            h: CHART_HEIGHT,
+            data: networkData,
+            series: series.network,
+            yAxisFormatter: chartAxisFormatters.rate,
+            tooltipProps: tooltipRate,
+          }}
+        />
+      )}
+      {showDocker && containerSeries.length > 0 && (
+        <>
+          {visibility.dockerCpu && dockerCpuData.length > 0 && (
+            <BeszelChartPanel
+              title={t("chart.dockerCpu.title")}
+              subtitle={t("chart.dockerCpu.subtitle")}
+              chartProps={{
+                h: CHART_HEIGHT,
+                data: dockerCpuData,
+                type: "stacked",
+                series: containerSeries,
+                yAxisFormatter: chartAxisFormatters.percent,
+                tooltipProps: tooltipPercentTotal,
+              }}
+            />
+          )}
+          {visibility.dockerMemory && dockerMemoryData.length > 0 && (
+            <BeszelChartPanel
+              title={t("chart.dockerMemory.title")}
+              subtitle={t("chart.dockerMemory.subtitle")}
+              chartProps={{
+                h: CHART_HEIGHT,
+                data: dockerMemoryData,
+                type: "stacked",
+                series: containerSeries,
+                yAxisFormatter: chartAxisFormatters.bytes,
+                tooltipProps: tooltipBytesTotal,
+              }}
+            />
+          )}
+          {visibility.dockerNetwork && dockerNetworkData.length > 0 && (
+            <BeszelChartPanel
+              title={t("chart.dockerNetwork.title")}
+              subtitle={t("chart.dockerNetwork.subtitle")}
+              chartProps={{
+                h: CHART_HEIGHT,
+                data: dockerNetworkData,
+                series: containerSeries,
+                yAxisFormatter: chartAxisFormatters.rate,
+                tooltipProps: tooltipRate,
+              }}
+            />
+          )}
+        </>
+      )}
+    </SimpleGrid>
+  );
+}

packages/widgets/src/beszel/_shared/system-stats-modal.tsx

@@ -1,25 +1,15 @@
 "use client";
 
-import { useMemo, useState } from "react";
-import { SegmentedControl, SimpleGrid, Stack } from "@mantine/core";
+import { useState } from "react";
+import { SegmentedControl, Stack } from "@mantine/core";
 
-import { clientApi } from "@homarr/api/client";
 import { createModal } from "@homarr/modals";
-import { useScopedI18n } from "@homarr/translation/client";
 
 import type { BeszelTimePeriod } from "./chart";
-import { BeszelChartPanel, CPU_Y_AXIS_DOMAIN, useSystemChartData } from "./chart";
-import { chartAxisFormatters, formatByteRate, formatGB, formatPercent } from "./format";
-import { makeTooltipProps } from "./tooltip";
-
-const tooltipPercent = makeTooltipProps(formatPercent);
-const tooltipGB = makeTooltipProps(formatGB, true);
-const tooltipRate = makeTooltipProps(formatByteRate, true);
-
-const CHART_HEIGHT = 180;
-const MB = 1024 * 1024;
+import { BeszelStatsView } from "./stats-view";
 
 const timePeriodOptions: { value: BeszelTimePeriod; label: string }[] = [
+  { value: "1m", label: "Live" },
   { value: "1h", label: "1H" },
   { value: "12h", label: "12H" },
   { value: "24h", label: "24H" },
@@ -27,141 +17,41 @@ const timePeriodOptions: { value: BeszelTimePeriod; label: string }[] = [
   { value: "30d", label: "30D" },
 ];
 
+const allCharts = {
+  cpu: true,
+  memory: true,
+  disk: true,
+  diskIO: true,
+  network: true,
+  dockerCpu: true,
+  dockerMemory: true,
+  dockerNetwork: true,
+} as const;
+
 interface BeszelSystemStatsModalProps {
   integrationId: string;
   systemId: string;
 }
 
 export const BeszelSystemStatsModal = createModal<BeszelSystemStatsModalProps>(({ innerProps }) => {
-  const t = useScopedI18n("widget.beszelSystemStats");
   const [timePeriod, setTimePeriod] = useState<BeszelTimePeriod>("1h");
 
-  const { data } = clientApi.widget.beszel.getSystemStats.useQuery({
-    integrationIds: [innerProps.integrationId],
-    systemId: innerProps.systemId,
-    timePeriod,
-    includeDocker: false,
-  });
-
-  const mappers = useMemo(
-    () => ({
-      cpu: (s: { cpu: number }) => ({ [t("chart.cpu.series")]: s.cpu }),
-      memory: (s: { mu: number; mb: number }) => ({
-        [t("chart.memory.series")]: s.mu,
-        [t("chart.memory.cache")]: s.mb ?? 0,
-      }),
-      disk: (s: { du: number }) => ({ [t("chart.disk.series")]: s.du }),
-      diskIO: (s: { dr?: number; dw?: number }) => ({
-        [t("chart.diskIO.read")]: (s.dr ?? 0) * MB,
-        [t("chart.diskIO.write")]: (s.dw ?? 0) * MB,
-      }),
-      network: (s: { ns: number; nr: number; b?: [number, number] }) => ({
-        [t("chart.network.sent")]: s.b?.[0] ?? s.ns,
-        [t("chart.network.recv")]: s.b?.[1] ?? s.nr,
-      }),
-    }),
-    [t],
-  );
-
-  const series = useMemo(
-    () => ({
-      cpu: [{ name: t("chart.cpu.series"), color: "teal.6" }],
-      memory: [
-        { name: t("chart.memory.series"), color: "teal.5" },
-        { name: t("chart.memory.cache"), color: "teal.8" },
-      ],
-      disk: [{ name: t("chart.disk.series"), color: "grape.6" }],
-      diskIO: [
-        { name: t("chart.diskIO.write"), color: "orange.6" },
-        { name: t("chart.diskIO.read"), color: "blue.6" },
-      ],
-      network: [
-        { name: t("chart.network.sent"), color: "blue.6" },
-        { name: t("chart.network.recv"), color: "teal.6" },
-      ],
-    }),
-    [t],
-  );
-
-  const systemStats = data?.systemStats;
-  const cpuData = useSystemChartData(systemStats, mappers.cpu, timePeriod);
-  const memoryData = useSystemChartData(systemStats, mappers.memory, timePeriod);
-  const diskData = useSystemChartData(systemStats, mappers.disk, timePeriod);
-  const diskIOData = useSystemChartData(systemStats, mappers.diskIO, timePeriod);
-  const networkData = useSystemChartData(systemStats, mappers.network, timePeriod);
-
   return (
     <Stack gap="md">
       <SegmentedControl
         size="xs"
         value={timePeriod}
-        onChange={(v) => setTimePeriod(v as BeszelTimePeriod)}
+        onChange={(value) => setTimePeriod(value as BeszelTimePeriod)}
         data={timePeriodOptions}
       />
-      <SimpleGrid cols={2} spacing="md">
-        {cpuData.length > 0 && (
-          <BeszelChartPanel
-            title={t("chart.cpu.title")}
-            chartProps={{
-              h: CHART_HEIGHT,
-              data: cpuData,
-              series: series.cpu,
-              yAxisFormatter: chartAxisFormatters.percent,
-              yAxisDomain: CPU_Y_AXIS_DOMAIN,
-              tooltipProps: tooltipPercent,
-            }}
-          />
-        )}
-        {memoryData.length > 0 && (
-          <BeszelChartPanel
-            title={t("chart.memory.title")}
-            chartProps={{
-              h: CHART_HEIGHT,
-              data: memoryData,
-              type: "stacked",
-              series: series.memory,
-              yAxisFormatter: chartAxisFormatters.gb,
-              tooltipProps: tooltipGB,
-            }}
-          />
-        )}
-        {diskData.length > 0 && (
-          <BeszelChartPanel
-            title={t("chart.disk.title")}
-            chartProps={{
-              h: CHART_HEIGHT,
-              data: diskData,
-              series: series.disk,
-              yAxisFormatter: chartAxisFormatters.gb,
-              tooltipProps: tooltipGB,
-            }}
-          />
-        )}
-        {diskIOData.length > 0 && (
-          <BeszelChartPanel
-            title={t("chart.diskIO.title")}
-            chartProps={{
-              h: CHART_HEIGHT,
-              data: diskIOData,
-              series: series.diskIO,
-              yAxisFormatter: chartAxisFormatters.rate,
-              tooltipProps: tooltipRate,
-            }}
-          />
-        )}
-        {networkData.length > 0 && (
-          <BeszelChartPanel
-            title={t("chart.network.title")}
-            chartProps={{
-              h: CHART_HEIGHT,
-              data: networkData,
-              series: series.network,
-              yAxisFormatter: chartAxisFormatters.rate,
-              tooltipProps: tooltipRate,
-            }}
-          />
-        )}
-      </SimpleGrid>
+      <BeszelStatsView
+        integrationIds={[innerProps.integrationId]}
+        systemId={innerProps.systemId}
+        timePeriod={timePeriod}
+        visibility={allCharts}
+        columns={2}
+        onSwitchToHistorical={() => setTimePeriod("1h")}
+      />
     </Stack>
   );
 }).withOptions({

packages/widgets/src/beszel/_shared/use-live-stats.ts

@@ -1,12 +1,14 @@
 "use client";
 
 import { useCallback, useEffect, useRef, useState } from "react";
+import { skipToken } from "@tanstack/react-query";
 
 import { clientApi } from "@homarr/api/client";
 import type { BeszelContainerStatsRecord, BeszelSystemStatsRecord } from "@homarr/integrations/types";
 
-// 120 records at ~1 per second = 2 minutes of rolling data for charts
-const MAX_BUFFER = 120;
+// Beszel emits roughly one record per second. Keep a sliding one-minute window
+// without synthesizing points for missed updates.
+const MAX_BUFFER = 60;
 
 export const useLiveStats = (integrationIds: string[], systemId: string, enabled: boolean) => {
   const [systemStats, setSystemStats] = useState<BeszelSystemStatsRecord[]>([]);
@@ -29,9 +31,8 @@ export const useLiveStats = (integrationIds: string[], systemId: string, enabled
   }, []);
 
   clientApi.widget.beszel.subscribeSystemStats.useSubscription(
-    { integrationIds, systemId },
+    enabled && systemId !== "" ? { integrationIds, systemId } : skipToken,
     {
-      enabled: enabled && systemId !== "",
       onData(event) {
         setError(null);
         if (event.type === "system_stats") {
@@ -48,7 +49,7 @@ export const useLiveStats = (integrationIds: string[], systemId: string, enabled
 
   // Reset buffers when system changes or integration changes
   const prevKeyRef = useRef<string>("");
-  const currentKey = `${integrationIds.join(",")}:${systemId}`;
+  const currentKey = `${integrationIds.join(",")}:${systemId}:${enabled}`;
   useEffect(() => {
     if (prevKeyRef.current !== currentKey) {
       prevKeyRef.current = currentKey;

packages/widgets/src/definition.ts

@@ -1,6 +1,6 @@
 import type React from "react";
 import type { LoaderComponent } from "next/dynamic";
-import type { QueryClient } from "@tanstack/react-query";
+import type { QueryClient, QueryKey } from "@tanstack/react-query";
 import type { DefaultErrorData } from "@trpc/server/unstable-core-do-not-import";
 
 import type { IntegrationKind, WidgetKind } from "@homarr/definitions";
@@ -69,6 +69,7 @@ export const createWidgetDefinition = <TKind extends WidgetKind, TDefinition ext
 
 export interface WidgetDefinition {
   icon: TablerIcon;
+  queryKey?: QueryKey;
   supportedIntegrations?: IntegrationKind[];
   integrationsRequired?: boolean;
   maxIntegrations?: number;

packages/widgets/src/docker/component.tsx

@@ -3,13 +3,13 @@
 import { useMemo } from "react";
 import { ActionIcon, Avatar, Badge, Center, Group, Stack, Text, Tooltip } from "@mantine/core";
 import type { IconProps } from "@tabler/icons-react";
-import { IconBrandDocker, IconPlayerPlay, IconPlayerStop, IconRotateClockwise } from "@tabler/icons-react";
+import { IconBrandDocker, IconPlayerPlay, IconPlayerStop, IconRefresh, IconRotateClockwise } from "@tabler/icons-react";
 import type { MRT_ColumnDef, MRT_VisibilityState } from "mantine-react-table";
 import { MantineReactTable } from "mantine-react-table";
 
 import type { RouterOutputs } from "@homarr/api";
 import { clientApi } from "@homarr/api/client";
-import { humanFileSize, useTimeAgo } from "@homarr/common";
+import { formatBytes, useTimeAgo } from "@homarr/common";
 import type { ContainerState } from "@homarr/docker";
 import { containerStateColorMap, cpuUsageColor, memoryUsageColor, safeValue } from "@homarr/docker/shared";
 import { showErrorNotification, showSuccessNotification } from "@homarr/notifications";
@@ -110,7 +110,7 @@ const createColumns = (
 
       return (
         <Text size="xs" c={memoryUsageColor(bytesUsage, row.original.state)}>
-          {humanFileSize(bytesUsage)}
+          {formatBytes(bytesUsage)}
         </Text>
       );
     },
@@ -184,7 +184,11 @@ export default function DockerWidget({ options, width, isEditMode }: WidgetCompo
   const t = useScopedI18n("docker");
   const isTiny = width <= 256;
 
-  const { data } = clientApi.docker.getContainers.useQuery(undefined, {
+  const {
+    data,
+    refetch,
+    isFetching,
+  } = clientApi.docker.getContainers.useQuery(undefined, {
     refetchInterval: 30_000,
   });
   const containers = data?.containers ?? [];
@@ -297,12 +301,23 @@ export default function DockerWidget({ options, width, isEditMode }: WidgetCompo
             </Text>
 
             <Text size="sm" style={{ whiteSpace: "nowrap" }}>
-              {t("table.totalMemory", { memory: humanFileSize(totals.memory) })}
+              {t("table.totalMemory", { memory: formatBytes(totals.memory) })}
             </Text>
 
-            <Text size="sm" style={{ whiteSpace: "nowrap" }}>
-              {t("table.updated", { when: relativeTime })}
-            </Text>
+            <Tooltip
+              label={t("table.refresh.lastUpdated", { when: relativeTime })}
+            >
+              <ActionIcon
+                size="sm"
+                variant="transparent"
+                c="var(--mantine-color-text)"
+                loading={isFetching}
+                onClick={() => void refetch()}
+                aria-label={t("table.refresh.lastUpdated", { when: relativeTime })}
+              >
+                <IconRefresh style={actionIconIconStyle} />
+              </ActionIcon>
+            </Tooltip>
           </Group>
         </Group>
       )}

packages/widgets/src/docker/index.ts

@@ -25,6 +25,7 @@ const columnTranslationKeyMap = {
 
 export const { definition, componentLoader } = createWidgetDefinition("dockerContainers", {
   icon: IconBrandDocker,
+  queryKey: [["docker", "getContainers"]],
   createOptions() {
     return optionsBuilder.from((factory) => ({
       columns: factory.multiSelect({

packages/widgets/src/downloads/component.tsx

@@ -43,7 +43,7 @@ import { MantineReactTable, useMantineReactTable } from "mantine-react-table";
 
 import { clientApi } from "@homarr/api/client";
 import { useIntegrationsWithInteractAccess } from "@homarr/auth/client";
-import { humanFileSize, useIntegrationConnected } from "@homarr/common";
+import { formatByteRate, formatBytes, useIntegrationConnected } from "@homarr/common";
 import { getIconUrl, getIntegrationKindsByCategory } from "@homarr/definitions";
 import type { ExtendedClientStatus, ExtendedDownloadClientItem } from "@homarr/integrations";
 import { useScopedI18n } from "@homarr/translation/client";
@@ -386,7 +386,7 @@ export default function DownloadClientsWidget({
         sortUndefined: "last",
         Cell: ({ cell }) => {
           const downSpeed = cell.getValue<ExtendedDownloadClientItem["downSpeed"]>();
-          return downSpeed ? <Text size="xs">{humanFileSize(downSpeed, "/s")}</Text> : null;
+          return downSpeed ? <Text size="xs">{formatByteRate(downSpeed)}</Text> : null;
         },
       },
       {
@@ -466,7 +466,7 @@ export default function DownloadClientsWidget({
         ...columnsDefBase({ key: "received", showHeader: true }),
         Cell: ({ cell }) => {
           const received = cell.getValue<ExtendedDownloadClientItem["received"]>();
-          return <Text size="xs">{humanFileSize(received)}</Text>;
+          return <Text size="xs">{formatBytes(received)}</Text>;
         },
       },
       {
@@ -474,14 +474,14 @@ export default function DownloadClientsWidget({
         sortUndefined: "last",
         Cell: ({ cell }) => {
           const sent = cell.getValue<ExtendedDownloadClientItem["sent"]>();
-          return sent && <Text size="xs">{humanFileSize(sent)}</Text>;
+          return sent && <Text size="xs">{formatBytes(sent)}</Text>;
         },
       },
       {
         ...columnsDefBase({ key: "size", showHeader: true }),
         Cell: ({ cell }) => {
           const size = cell.getValue<ExtendedDownloadClientItem["size"]>();
-          return <Text size="xs">{humanFileSize(size)}</Text>;
+          return <Text size="xs">{formatBytes(size)}</Text>;
         },
       },
       {
@@ -521,7 +521,7 @@ export default function DownloadClientsWidget({
         sortUndefined: "last",
         Cell: ({ cell }) => {
           const upSpeed = cell.getValue<ExtendedDownloadClientItem["upSpeed"]>();
-          return upSpeed && <Text size="xs">{humanFileSize(upSpeed, "/s")}</Text>;
+          return upSpeed && <Text size="xs">{formatByteRate(upSpeed)}</Text>;
         },
       },
     ],
@@ -669,21 +669,21 @@ const ItemInfoModal = ({ items, currentIndex, opened, onClose }: ItemInfoModalPr
           {item.type !== "miscellaneous" && (
             <NormalizedLine
               itemKey="upSpeed"
-              values={item.upSpeed === undefined ? undefined : humanFileSize(item.upSpeed, "/s")}
+              values={item.upSpeed === undefined ? undefined : formatByteRate(item.upSpeed)}
             />
           )}
 
           <NormalizedLine
             itemKey="downSpeed"
-            values={item.downSpeed === undefined ? undefined : humanFileSize(item.downSpeed, "/s")}
+            values={item.downSpeed === undefined ? undefined : formatByteRate(item.downSpeed)}
           />
 
           {item.type !== "miscellaneous" && (
-            <NormalizedLine itemKey="sent" values={item.sent === undefined ? undefined : humanFileSize(item.sent)} />
+            <NormalizedLine itemKey="sent" values={item.sent === undefined ? undefined : formatBytes(item.sent)} />
           )}
 
-          <NormalizedLine itemKey="received" values={humanFileSize(item.received)} />
-          <NormalizedLine itemKey="size" values={humanFileSize(item.size)} />
+          <NormalizedLine itemKey="received" values={formatBytes(item.received)} />
+          <NormalizedLine itemKey="size" values={formatBytes(item.size)} />
           <NormalizedLine
             itemKey="progress"
             values={new Intl.NumberFormat("en", {
@@ -744,10 +744,7 @@ const ClientsControl = ({ clients, filters, setFilters, availableStatuses }: Cli
     { paused: [] as string[], active: [] as string[] },
   );
   const someInteract = clients.some(({ interact }) => interact);
-  const totalSpeed = humanFileSize(
-    clients.reduce((count, { status }) => count + (status?.rates.down ?? 0), 0),
-    "/s",
-  );
+  const totalSpeed = formatByteRate(clients.reduce((count, { status }) => count + (status?.rates.down ?? 0), 0));
 
   const utils = clientApi.useUtils();
   const invalidateDownloads = { onSettled: () => void utils.widget.downloads.getJobsAndStatuses.invalidate() };
@@ -849,21 +846,21 @@ const ClientsControl = ({ clients, filters, setFilters, availableStatuses }: Cli
                           {client.status.rates.up !== undefined ? (
                             <Group display="flex" justify="center" c="green" w="100%" gap={5}>
                               <Text flex={1} ta="right">
-                                {`↑ ${humanFileSize(client.status.rates.up, "/s")}`}
+                                {`↑ ${formatByteRate(client.status.rates.up)}`}
                               </Text>
                               <Text>{"-"}</Text>
                               <Text flex={1} ta="left">
-                                {humanFileSize(client.status.totalUp ?? 0)}
+                                {formatBytes(client.status.totalUp ?? 0)}
                               </Text>
                             </Group>
                           ) : undefined}
                           <Group display="flex" justify="center" c="blue" w="100%" gap={5}>
                             <Text flex={1} ta="right">
-                              {`↓ ${humanFileSize(client.status.rates.down, "/s")}`}
+                              {`↓ ${formatByteRate(client.status.rates.down)}`}
                             </Text>
                             <Text>{"-"}</Text>
                             <Text flex={1} ta="left">
-                              {humanFileSize(Math.floor(client.status.totalDown ?? 0))}
+                              {formatBytes(Math.floor(client.status.totalDown ?? 0))}
                             </Text>
                           </Group>
                         </Stack>

packages/widgets/src/health-monitoring/cluster/resource-popover.tsx

@@ -16,7 +16,7 @@ import {
 import dayjs from "dayjs";
 import duration from "dayjs/plugin/duration";
 
-import { capitalize, humanFileSize } from "@homarr/common";
+import { capitalize, formatBytes, formatBytesPair } from "@homarr/common";
 import type { ComputeResource, Resource, StorageResource } from "@homarr/integrations/types";
 import { useScopedI18n } from "@homarr/translation/client";
 
@@ -93,16 +93,18 @@ const RightSection = ({ label, value }: RightSectionProps) => {
 
 const ComputeResourceDetails = ({ item }: { item: ComputeResource }) => {
   const t = useScopedI18n("widget.healthMonitoring.cluster.popover.detail");
+  const memory = formatBytesPair(item.memory.used, item.memory.total);
+  const storage = formatBytesPair(item.storage.used, item.storage.total);
   return (
     <List>
       <List.Item icon={<IconCpu size={16} />}>
         {t("cpu")} - {item.cpu.cores}
       </List.Item>
       <List.Item icon={<IconBrain size={16} />}>
-        {t("memory")} - {humanFileSize(item.memory.used)} / {humanFileSize(item.memory.total)}
+        {t("memory")} - {memory.used} / {memory.available}
       </List.Item>
       <List.Item icon={<IconDatabase size={16} />}>
-        {t("storage")} - {humanFileSize(item.storage.used)} / {humanFileSize(item.storage.total)}
+        {t("storage")} - {storage.used} / {storage.available}
       </List.Item>
       <List.Item icon={<IconClockHour3 size={16} />}>
         {t("uptime")} - {dayjs(dayjs().add(-item.uptime, "seconds")).fromNow(true)}
@@ -121,6 +123,7 @@ const ComputeResourceDetails = ({ item }: { item: ComputeResource }) => {
 const StorageResourceDetails = ({ item }: { item: StorageResource }) => {
   const t = useScopedI18n("widget.healthMonitoring.cluster.popover.detail");
   const storagePercent = item.total ? (item.used / item.total) * 100 : 0;
+  const storage = formatBytesPair(item.used, item.total);
   return (
     <Stack gap={0}>
       <Center>
@@ -133,7 +136,7 @@ const StorageResourceDetails = ({ item }: { item: StorageResource }) => {
         />
         <Group align="center" gap={0}>
           <Text>
-            {t("storage")} - {humanFileSize(item.used)} / {humanFileSize(item.total)}
+            {t("storage")} - {storage.used} / {storage.available}
           </Text>
         </Group>
       </Center>
@@ -152,11 +155,11 @@ const DiskStats = ({ item }: { item: ComputeResource }) => {
     <List.Item icon={<IconDatabase size={16} />}>
       <Group gap="sm">
         <Group gap={0}>
-          <Text>{humanFileSize(item.storage.write)}</Text>
+          <Text>{formatBytes(item.storage.write)}</Text>
           <IconArrowNarrowDown size={14} />
         </Group>
         <Group gap={0}>
-          <Text>{humanFileSize(item.storage.read)}</Text>
+          <Text>{formatBytes(item.storage.read)}</Text>
           <IconArrowNarrowUp size={14} />
         </Group>
       </Group>
@@ -172,11 +175,11 @@ const NetStats = ({ item }: { item: ComputeResource }) => {
     <List.Item icon={<IconNetwork size={16} />}>
       <Group gap="sm">
         <Group gap={0}>
-          <Text>{humanFileSize(item.network.in)}</Text>
+          <Text>{formatBytes(item.network.in)}</Text>
           <IconArrowNarrowDown size={14} />
         </Group>
         <Group gap={0}>
-          <Text>{humanFileSize(item.network.out)}</Text>
+          <Text>{formatBytes(item.network.out)}</Text>
           <IconArrowNarrowUp size={14} />
         </Group>
       </Group>

packages/widgets/src/health-monitoring/system-health.tsx

@@ -32,7 +32,7 @@ import duration from "dayjs/plugin/duration";
 
 import { clientApi } from "@homarr/api/client";
 import { useRequiredBoard } from "@homarr/boards/context";
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import type { TranslationFunction } from "@homarr/translation";
 import { useI18n } from "@homarr/translation/client";
 
@@ -277,7 +277,7 @@ export const progressColor = (percentage: number) => {
 // them (e.g. Unraid, dashdot). Format the former and pass the latter through untouched.
 const formatFileSize = (value: string) => {
   const bytes = Number(value);
-  return Number.isFinite(bytes) ? humanFileSize(Math.round(bytes)) : value;
+  return Number.isFinite(bytes) ? formatBytes(Math.round(bytes)) : value;
 };
 
 interface FileSystem {

packages/widgets/src/immich/server-stats/component.tsx

@@ -5,7 +5,7 @@ import { Group, Stack, Text } from "@mantine/core";
 import { IconDatabase, IconPhoto, IconUsers, IconVideo } from "@tabler/icons-react";
 
 import { clientApi } from "@homarr/api/client";
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import { useI18n } from "@homarr/translation/client";
 
 import { WidgetEmptyState } from "../../common/empty-state";
@@ -46,7 +46,7 @@ export default function ImmichServerStatsWidget({
         <StatItem
           icon={<IconDatabase size={20} />}
           label={t("widget.immich-serverStats.storage")}
-          value={humanFileSize(stats.totalLibraryUsageInBytes)}
+          value={formatBytes(stats.totalLibraryUsageInBytes)}
         />
       )}
     </Stack>

packages/widgets/src/media-transcoding/panels/queue.panel.tsx

@@ -14,7 +14,7 @@ import {
 } from "@mantine/core";
 import { IconHeartbeat, IconTransform } from "@tabler/icons-react";
 
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import type { TdarrQueue } from "@homarr/integrations";
 import { useI18n } from "@homarr/translation/client";
 
@@ -72,7 +72,7 @@ export function QueuePanel(props: QueuePanelProps) {
                 </Group>
               </TableTd>
               <TableTd py={2}>
-                <Text size="xs">{humanFileSize(item.fileSize)}</Text>
+                <Text size="xs">{formatBytes(item.fileSize)}</Text>
               </TableTd>
             </TableTr>
           ))}

packages/widgets/src/media-transcoding/panels/statistics.panel.tsx

@@ -3,7 +3,7 @@ import { Card, Center, Group, RingProgress, ScrollArea, Stack, Text, Title, Tool
 import { IconDatabaseHeart, IconFileDescription, IconHeartbeat, IconTransform } from "@tabler/icons-react";
 
 import { useRequiredBoard } from "@homarr/boards/context";
-import { humanFileSize } from "@homarr/common";
+import { formatBytes } from "@homarr/common";
 import type { TdarrPieSegment, TdarrStatistics } from "@homarr/integrations";
 import { useI18n } from "@homarr/translation/client";
 import type { TablerIcon } from "@homarr/ui";
@@ -41,7 +41,7 @@ export function StatisticsPanel(props: StatisticsPanelProps) {
         <StatisticItem
           icon={IconDatabaseHeart}
           label={t("savedSpace")}
-          value={humanFileSize(Math.floor(allLibs.totalSavedSpace))}
+          value={formatBytes(Math.floor(allLibs.totalSavedSpace))}
         />
       </Group>
       <Group justify="center" wrap="wrap" grow>