feat: add joyride

.github/actions/extract-build-artifact/action.yaml

@@ -20,7 +20,7 @@ runs:
   using: "composite"
   steps:
     - name: Prebuilt debian dependencies
-      uses: homarr-labs/homarr/.github/actions/prebuilt-debian@dev
+      uses: ./.github/actions/prebuilt-debian@dev
       id: prebuilt-debian
       with:
         architecture: ${{ inputs.architecture }}

CHANGELOG.md

@@ -1,44 +1,3 @@
-## [1.47.0](https://github.com/homarr-labs/homarr/compare/v1.46.0...v1.47.0) (2025-12-19)
-
-### Features
-
-* [#4452](https://github.com/homarr-labs/homarr/issues/4452) improve calendar design ([#4461](https://github.com/homarr-labs/homarr/issues/4461)) ([08e9f7d](https://github.com/homarr-labs/homarr/commit/08e9f7d8d85475788534b46e6cceb40a7231c09d))
-
-### Bug Fixes
-
-* **boards:** selection menu not shown to users without change access ([#4689](https://github.com/homarr-labs/homarr/issues/4689)) ([a0a11e3](https://github.com/homarr-labs/homarr/commit/a0a11e35707513fee45551e09c26ff633f636c32))
-* **deps:** update dependency dns-caching to ^0.2.9 ([#4648](https://github.com/homarr-labs/homarr/issues/4648)) ([6deab2e](https://github.com/homarr-labs/homarr/commit/6deab2ecec2dc4f5192b53213cb755a9853eb7c0))
-* **deps:** update dependency drizzle-orm to ^0.45.1 ([#4663](https://github.com/homarr-labs/homarr/issues/4663)) ([f635009](https://github.com/homarr-labs/homarr/commit/f63500961f11589a972a41dde9e4117b1f25141c))
-* **deps:** update dependency fast-xml-parser to ^5.3.3 ([#4683](https://github.com/homarr-labs/homarr/issues/4683)) ([611b65e](https://github.com/homarr-labs/homarr/commit/611b65e8bd420aaad580bf35071b651093623c95))
-* **deps:** update dependency isomorphic-dompurify to ^2.34.0 ([#4650](https://github.com/homarr-labs/homarr/issues/4650)) ([5d5c18b](https://github.com/homarr-labs/homarr/commit/5d5c18b3649d5fa1b2b933d443ccd5abcbb84e3a))
-* **deps:** update dependency jotai to ^2.16.0 ([#4655](https://github.com/homarr-labs/homarr/issues/4655)) ([4aef85b](https://github.com/homarr-labs/homarr/commit/4aef85ba60f4978da5a0b13c08e1799949fe4497))
-* **deps:** update dependency ldapts to v8.0.16 ([#4640](https://github.com/homarr-labs/homarr/issues/4640)) ([ada5597](https://github.com/homarr-labs/homarr/commit/ada5597cf3ab0bafb04e9176b431d257b36d1dc8))
-* **deps:** update dependency ldapts to v8.0.17 ([#4642](https://github.com/homarr-labs/homarr/issues/4642)) ([c09da85](https://github.com/homarr-labs/homarr/commit/c09da85f3a8450a70991ff0656228a9aa1364f89))
-* **deps:** update dependency ldapts to v8.0.18 ([#4653](https://github.com/homarr-labs/homarr/issues/4653)) ([4bd142e](https://github.com/homarr-labs/homarr/commit/4bd142e09c666cc84c67c93e2202e571565b766c))
-* **deps:** update dependency ldapts to v8.0.19 ([#4669](https://github.com/homarr-labs/homarr/issues/4669)) ([8ed771d](https://github.com/homarr-labs/homarr/commit/8ed771d30073809b08a6ace2c29b3de2675e37d1))
-* **deps:** update dependency ldapts to v8.0.20 ([#4684](https://github.com/homarr-labs/homarr/issues/4684)) ([703c8cc](https://github.com/homarr-labs/homarr/commit/703c8ccc060bb1775a72f405da1e169926b1ce5d))
-* **deps:** update dependency ldapts to v8.0.21 ([#4695](https://github.com/homarr-labs/homarr/issues/4695)) ([7f6eaa0](https://github.com/homarr-labs/homarr/commit/7f6eaa0b1f397a37b6acd15e0ccfea75ee2e0161))
-* **deps:** update dependency ldapts to v8.0.22 ([#4700](https://github.com/homarr-labs/homarr/issues/4700)) ([391d725](https://github.com/homarr-labs/homarr/commit/391d725191563ba5048593c14baf077a924cea44))
-* **deps:** update dependency ldapts to v8.0.23 ([#4701](https://github.com/homarr-labs/homarr/issues/4701)) ([db337b2](https://github.com/homarr-labs/homarr/commit/db337b2525762c96acd815bd4fdacfaabff5f0cf))
-* **deps:** update dependency next-intl to v4.6.0 ([#4691](https://github.com/homarr-labs/homarr/issues/4691)) ([1ff6fac](https://github.com/homarr-labs/homarr/commit/1ff6fac71bb9187d0eb703a7b6543daf8861efe8))
-* **deps:** update dependency sass to ^1.94.3 ([#4646](https://github.com/homarr-labs/homarr/issues/4646)) ([7e91d12](https://github.com/homarr-labs/homarr/commit/7e91d12439826eee76f118448c583294c3c46b42))
-* **deps:** update dependency sass to ^1.95.0 ([#4647](https://github.com/homarr-labs/homarr/issues/4647)) ([eb760da](https://github.com/homarr-labs/homarr/commit/eb760da8b30583575fb638995fc2f2acbd5b2961))
-* **deps:** update dependency sass to ^1.95.1 ([#4661](https://github.com/homarr-labs/homarr/issues/4661)) ([e327c66](https://github.com/homarr-labs/homarr/commit/e327c660b239840c4929f536eff3096342cc3433))
-* **deps:** update dependency sass to ^1.96.0 ([#4668](https://github.com/homarr-labs/homarr/issues/4668)) ([bdfc150](https://github.com/homarr-labs/homarr/commit/bdfc1501152450a1546962331037a6fc1c782e4e))
-* **deps:** update dependency swagger-ui-react to ^5.31.0 ([#4672](https://github.com/homarr-labs/homarr/issues/4672)) ([4d593f5](https://github.com/homarr-labs/homarr/commit/4d593f5b9d1f47ae2368f42131e8ef8d32f73fc9))
-* **deps:** update dependency typescript-eslint to ^8.49.0 ([#4645](https://github.com/homarr-labs/homarr/issues/4645)) ([220cb66](https://github.com/homarr-labs/homarr/commit/220cb669a13fead953ff42040b39e06d1dcc1fe2))
-* **deps:** update mantine monorepo to ^8.3.10 ([#4651](https://github.com/homarr-labs/homarr/issues/4651)) ([d0652f7](https://github.com/homarr-labs/homarr/commit/d0652f7cf5ac0e63a61adcfe43e53c4ed130e8fc))
-* **deps:** update react monorepo to v19.2.2 ([#4676](https://github.com/homarr-labs/homarr/issues/4676)) ([82e79f2](https://github.com/homarr-labs/homarr/commit/82e79f26274a289e1ce4f9331b6ba16f00f5a86c))
-* **deps:** update react monorepo to v19.2.3 ([#4680](https://github.com/homarr-labs/homarr/issues/4680)) ([4c71856](https://github.com/homarr-labs/homarr/commit/4c7185646d9d061d1aebf9194f9ef2f810fc3384))
-* **deps:** update testcontainers-node monorepo to ^11.10.0 ([#4659](https://github.com/homarr-labs/homarr/issues/4659)) ([c880ce9](https://github.com/homarr-labs/homarr/commit/c880ce9bd99a7056f20d450275fcbc37f9372f63))
-* **deps:** update trpc monorepo to ^11.8.0 ([#4697](https://github.com/homarr-labs/homarr/issues/4697)) ([1f44845](https://github.com/homarr-labs/homarr/commit/1f44845df489bb33bcfe943c6a05c0f157037ed6))
-* **downloads:** improve progress to only show 100 percent if fully completed ([#4621](https://github.com/homarr-labs/homarr/issues/4621)) ([1062745](https://github.com/homarr-labs/homarr/commit/10627453d5b5a17991bbe9b8d4bc23981b366c39))
-* **iframe-widget:** permission selection not applying to any origin ([#4616](https://github.com/homarr-labs/homarr/issues/4616)) ([479f083](https://github.com/homarr-labs/homarr/commit/479f083ab8ec405d1b8296b32a20262f6192a1f9))
-* **invites:** creation with custom expiration not working ([#4677](https://github.com/homarr-labs/homarr/issues/4677)) ([423da9e](https://github.com/homarr-labs/homarr/commit/423da9eeb88510a123bdd2447dc97b54c5f1dec4))
-* reference to prebuilt-debian action does not work ([47d7458](https://github.com/homarr-labs/homarr/commit/47d7458143d8801947cae1985745fa827b247dd1))
-* **stock-price:** use previous-close for change calculation ([#4674](https://github.com/homarr-labs/homarr/issues/4674)) ([17fc7a0](https://github.com/homarr-labs/homarr/commit/17fc7a043b4adbed9f14408e23c95ec5fba0c8b8))
-* **tdarr:** array parse error ([#4678](https://github.com/homarr-labs/homarr/issues/4678)) ([d86af07](https://github.com/homarr-labs/homarr/commit/d86af072bf136d76b02f3efa2c15520a4f63974e))
-
 ## [1.46.0](https://github.com/homarr-labs/homarr/compare/v1.45.3...v1.46.0) (2025-12-12)
 
 ### Features

CODEOWNERS

@@ -1,9 +1 @@
-# ── CODEOWNERS ───────────────────────────────────────
 * @homarr-labs/maintainers
-
-# Exempt Renovate‑managed files (no owners)
-package.json          @homarr-labs/none
-package-lock.json     @homarr-labs/none
-pnpm-lock.yaml        @homarr-labs/none
-Dockerfile            @homarr-labs/none
-docker-compose.yml    @homarr-labs/none

apps/nextjs/package.json

@@ -23,6 +23,7 @@
     "@homarr/api": "workspace:^0.1.0",
     "@homarr/auth": "workspace:^0.1.0",
     "@homarr/boards": "workspace:^0.1.0",
+    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
     "@homarr/cron-job-status": "workspace:^0.1.0",
@@ -71,7 +72,6 @@
     "clsx": "^2.1.1",
     "dayjs": "^1.11.19",
     "dotenv": "^17.2.3",
-    "drizzle-orm": "^0.45.1",
     "flag-icons": "^7.5.0",
     "glob": "^13.0.0",
     "isomorphic-dompurify": "^2.34.0",
@@ -83,12 +83,13 @@
     "react": "19.2.3",
     "react-dom": "19.2.3",
     "react-error-boundary": "^6.0.0",
+    "react-joyride": "^2.9.3",
     "react-simple-code-editor": "^0.14.1",
     "sass": "^1.96.0",
     "superjson": "2.2.6",
     "swagger-ui-react": "^5.31.0",
     "use-deep-compare-effect": "^1.8.1",
-    "zod": "^4.2.0"
+    "zod": "^4.1.13"
   },
   "devDependencies": {
     "@homarr/eslint-config": "workspace:^0.2.0",

apps/nextjs/src/app/[locale]/auth/invite/[id]/page.tsx

@@ -1,10 +1,9 @@
 import { notFound } from "next/navigation";
 import { Card, Center, Stack, Text, Title } from "@mantine/core";
-import { and, eq } from "drizzle-orm";
 
 import { auth } from "@homarr/auth/next";
 import { isProviderEnabled } from "@homarr/auth/server";
-import { db } from "@homarr/db";
+import { and, db, eq } from "@homarr/db";
 import { invites } from "@homarr/db/schema";
 import { getScopedI18n } from "@homarr/translation/server";
 

apps/nextjs/src/app/[locale]/boards/(content)/_header-actions.tsx

@@ -44,7 +44,7 @@ export const BoardContentHeaderActions = () => {
   const { hasChangeAccess } = useBoardPermissions(board);
 
   if (!hasChangeAccess) {
-    return <SelectBoardsMenu />;
+    return null; // Hide actions for user without access
   }
 
   return (

apps/nextjs/src/app/[locale]/manage/help/tours/page.tsx

@@ -0,0 +1,38 @@
+import { auth } from "@homarr/auth/next";
+import { getScopedI18n } from "@homarr/translation/server";
+import { createMetaTitle } from "~/metadata";
+import { ManageContainer } from "~/components/manage/manage-container";
+import { DynamicBreadcrumb } from "~/components/navigation/dynamic-breadcrumb";
+import { Title, SimpleGrid, Card } from "@mantine/core";
+
+export async function generateMetadata() {
+  const session = await auth();
+  if (!session?.user || !session.user.permissions.includes("admin")) {
+    return {};
+  }
+
+  const t = await getScopedI18n("management");
+
+  return {
+    title: createMetaTitle(t("metaTitle")),
+  };
+}
+
+export default async function ToursPage() {
+  const t = await getScopedI18n("tours");
+  return (
+    <ManageContainer>
+      <DynamicBreadcrumb/>
+      <Title>{t("page.title")}</Title>
+
+      <SimpleGrid cols={{ base: 1, sm: 2, lg: 5 }}>
+        <Card></Card>
+        <Card></Card>
+        <Card></Card>
+        <Card></Card>
+        <Card></Card>
+        <Card></Card>
+      </SimpleGrid>
+    </ManageContainer>
+  )
+}

apps/nextjs/src/app/[locale]/manage/layout.tsx

@@ -23,6 +23,7 @@ import {
   IconUserFilled,
   IconUsers,
   IconUsersGroup,
+  IconMotorbikeFilled
 } from "@tabler/icons-react";
 
 import { auth } from "@homarr/auth/next";
@@ -158,6 +159,11 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
       label: t("items.help.label"),
       icon: IconHelpSquareRoundedFilled,
       items: [
+        {
+          label: t("items.help.items.tours"),
+          icon: IconMotorbikeFilled,
+          href: "/manage/help/tours"
+        },
         {
           label: t("items.help.items.documentation"),
           icon: IconBook2,

apps/nextjs/src/app/[locale]/manage/tools/certificates/hostnames/page.tsx

@@ -16,7 +16,7 @@ import {
 import { IconCertificateOff } from "@tabler/icons-react";
 
 import { auth } from "@homarr/auth/next";
-import { getTrustedCertificateHostnamesAsync } from "@homarr/core/infrastructure/certificates";
+import { getTrustedCertificateHostnamesAsync } from "@homarr/certificates/server";
 import { getI18n } from "@homarr/translation/server";
 import { Link } from "@homarr/ui";
 

apps/nextjs/src/app/[locale]/manage/tools/certificates/page.tsx

@@ -5,8 +5,8 @@ import { IconAlertTriangle, IconCertificate, IconCertificateOff } from "@tabler/
 import dayjs from "dayjs";
 
 import { auth } from "@homarr/auth/next";
+import { loadCustomRootCertificatesAsync } from "@homarr/certificates/server";
 import { getMantineColor } from "@homarr/common";
-import { loadCustomRootCertificatesAsync } from "@homarr/core/infrastructure/certificates";
 import type { SupportedLanguage } from "@homarr/translation";
 import { getI18n } from "@homarr/translation/server";
 import { Link } from "@homarr/ui";

apps/nextjs/src/app/[locale]/manage/users/create/page.tsx

@@ -1,9 +1,8 @@
 import { notFound } from "next/navigation";
-import { inArray } from "drizzle-orm";
 
 import { auth } from "@homarr/auth/next";
 import { isProviderEnabled } from "@homarr/auth/server";
-import { db } from "@homarr/db";
+import { db, inArray } from "@homarr/db";
 import { groups } from "@homarr/db/schema";
 import { everyoneGroup } from "@homarr/definitions";
 import { getScopedI18n } from "@homarr/translation/server";

apps/nextjs/src/app/api/[...trpc]/route.ts

@@ -1,6 +1,5 @@
 import type { NextRequest } from "next/server";
 import { userAgent } from "next/server";
-import { eq } from "drizzle-orm";
 import { createOpenApiFetchHandler } from "trpc-to-openapi";
 
 import { appRouter, createTRPCContext } from "@homarr/api";
@@ -9,7 +8,7 @@ import { hashPasswordAsync } from "@homarr/auth";
 import { createSessionAsync } from "@homarr/auth/server";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
-import { db } from "@homarr/db";
+import { db, eq } from "@homarr/db";
 import { apiKeys } from "@homarr/db/schema";
 
 const logger = createLogger({ module: "trpcOpenApiRoute" });

apps/nextjs/src/app/api/user-medias/[id]/route.ts

@@ -1,10 +1,9 @@
 import { notFound } from "next/navigation";
 import { NextResponse } from "next/server";
 import type { NextRequest } from "next/server";
-import { eq } from "drizzle-orm";
 import DOMPurify from "isomorphic-dompurify";
 
-import { db } from "@homarr/db";
+import { db, eq } from "@homarr/db";
 import { medias } from "@homarr/db/schema";
 
 export async function GET(_req: NextRequest, props: { params: Promise<{ id: string }> }) {

apps/tasks/package.json

@@ -39,7 +39,6 @@
     "@homarr/widgets": "workspace:^0.1.0",
     "dayjs": "^1.11.19",
     "dotenv": "^17.2.3",
-    "drizzle-orm": "^0.45.1",
     "fastify": "^5.6.2",
     "superjson": "2.2.6",
     "undici": "7.16.0"

apps/tasks/src/job-manager.ts

@@ -1,11 +1,10 @@
-import type { InferInsertModel } from "drizzle-orm";
-import { eq } from "drizzle-orm";
 import { schedule, validate as validateCron } from "node-cron";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import type { IJobManager } from "@homarr/cron-job-api";
 import type { jobGroup as cronJobGroup, JobGroupKeys } from "@homarr/cron-jobs";
-import type { Database } from "@homarr/db";
+import type { Database, InferInsertModel } from "@homarr/db";
+import { eq } from "@homarr/db";
 import { cronJobConfigurations } from "@homarr/db/schema";
 
 const logger = createLogger({ module: "jobManager" });

apps/tasks/src/on-start/session-cleanup.ts

@@ -1,8 +1,6 @@
-import { eq, inArray } from "drizzle-orm";
-
 import { env } from "@homarr/auth/env";
 import { createLogger } from "@homarr/core/infrastructure/logs";
-import { db } from "@homarr/db";
+import { db, eq, inArray } from "@homarr/db";
 import { sessions, users } from "@homarr/db/schema";
 import { supportedAuthProviders } from "@homarr/definitions";
 

apps/tasks/src/overrides.ts

@@ -1,5 +1,6 @@
 import { setGlobalDispatcher } from "undici";
 
-import { UndiciHttpAgent } from "@homarr/core/infrastructure/http";
+import { LoggingAgent } from "@homarr/common/server";
 
-setGlobalDispatcher(new UndiciHttpAgent());
+const agent = new LoggingAgent();
+setGlobalDispatcher(agent);

deployments/prebuilt-debian/package.json

@@ -4,10 +4,10 @@
   "dependencies": {
     "better-sqlite3": "^12.5.0"
   },
-  "packageManager": "pnpm@10.26.0",
+  "packageManager": "pnpm@10.25.0",
   "engines": {
     "node": ">=24.12.0",
-    "pnpm": ">=10.26.0"
+    "pnpm": ">=10.25.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [

package.json

@@ -1,6 +1,6 @@
 {
   "name": "homarr",
-  "version": "1.47.0",
+  "version": "1.46.0",
   "private": true,
   "scripts": {
     "build": "cross-env CI=true turbo build",
@@ -59,10 +59,10 @@
     "vite-tsconfig-paths": "^5.1.4",
     "vitest": "^4.0.15"
   },
-  "packageManager": "pnpm@10.26.0",
+  "packageManager": "pnpm@10.25.0",
   "engines": {
     "node": ">=24.12.0",
-    "pnpm": ">=10.26.0"
+    "pnpm": ">=10.25.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
@@ -84,18 +84,18 @@
       "brace-expansion@>=1.0.0 <=1.1.11": ">=4.0.1",
       "esbuild@<=0.24.2": ">=0.27.1",
       "form-data@>=4.0.0 <4.0.4": ">=4.0.5",
-      "hono@<4.6.5": ">=4.11.1",
+      "hono@<4.6.5": ">=4.11.0",
       "linkifyjs@<4.3.2": ">=4.3.2",
       "nanoid@>=4.0.0 <5.0.9": ">=5.1.6",
       "prismjs@<1.30.0": ">=1.30.0",
       "proxmox-api>undici": "7.16.0",
       "react-is": "^19.2.3",
-      "rollup@>=4.0.0 <4.22.4": ">=4.53.4",
+      "rollup@>=4.0.0 <4.22.4": ">=4.53.3",
       "sha.js@<=2.4.11": ">=2.4.12",
       "tar-fs@>=3.0.0 <3.0.9": ">=3.1.1",
       "tar-fs@>=2.0.0 <2.1.3": ">=3.1.1",
       "tmp@<=0.2.3": ">=0.2.5",
-      "vite@>=5.0.0 <=5.4.18": ">=7.3.0"
+      "vite@>=5.0.0 <=5.4.18": ">=7.2.7"
     },
     "patchedDependencies": {
       "@types/node-unifi": "patches/@types__node-unifi.patch",

packages/analytics/package.json

@@ -26,7 +26,6 @@
     "@homarr/db": "workspace:^0.1.0",
     "@homarr/server-settings": "workspace:^0.1.0",
     "@umami/node": "^0.4.0",
-    "drizzle-orm": "^0.45.1",
     "superjson": "2.2.6"
   },
   "devDependencies": {

packages/analytics/src/send-server-analytics.ts

@@ -1,9 +1,8 @@
 import type { UmamiEventData } from "@umami/node";
 import { Umami } from "@umami/node";
-import { count } from "drizzle-orm";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
-import { db } from "@homarr/db";
+import { count, db } from "@homarr/db";
 import { getServerSettingByKeyAsync } from "@homarr/db/queries";
 import { integrations, items, users } from "@homarr/db/schema";
 import type { defaultServerSettings } from "@homarr/server-settings";

packages/api/package.json

@@ -22,6 +22,7 @@
   "prettier": "@homarr/prettier-config",
   "dependencies": {
     "@homarr/auth": "workspace:^0.1.0",
+    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
     "@homarr/cron-job-api": "workspace:^0.1.0",
@@ -46,14 +47,13 @@
     "@trpc/react-query": "^11.8.0",
     "@trpc/server": "^11.8.0",
     "@trpc/tanstack-react-query": "^11.8.0",
-    "drizzle-orm": "^0.45.1",
     "lodash.clonedeep": "^4.5.0",
     "next": "16.0.10",
     "react": "19.2.3",
     "react-dom": "19.2.3",
     "superjson": "2.2.6",
     "trpc-to-openapi": "^3.1.0",
-    "zod": "^4.2.0"
+    "zod": "^4.1.13"
   },
   "devDependencies": {
     "@homarr/eslint-config": "workspace:^0.2.0",

packages/api/src/middlewares/integration.ts

@@ -1,5 +1,4 @@
 import { TRPCError } from "@trpc/server";
-import { and, eq, inArray } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import type { Session } from "@homarr/auth";
@@ -8,6 +7,7 @@ import { constructIntegrationPermissions } from "@homarr/auth/shared";
 import { decryptSecret } from "@homarr/common/server";
 import type { AtLeastOneOf } from "@homarr/common/types";
 import type { Database } from "@homarr/db";
+import { and, eq, inArray } from "@homarr/db";
 import { integrations } from "@homarr/db/schema";
 import type { IntegrationKind } from "@homarr/definitions";
 

packages/api/src/middlewares/item.ts

@@ -1,7 +1,7 @@
 import { TRPCError } from "@trpc/server";
-import { and, eq } from "drizzle-orm";
 import { z } from "zod/v4";
 
+import { and, eq } from "@homarr/db";
 import { items } from "@homarr/db/schema";
 import type { WidgetKind } from "@homarr/definitions";
 

packages/api/src/router/apiKeys.ts

@@ -1,10 +1,9 @@
-import { eq } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createSaltAsync, hashPasswordAsync } from "@homarr/auth";
 import { createId } from "@homarr/common";
 import { generateSecureRandomToken } from "@homarr/common/server";
-import { db } from "@homarr/db";
+import { db, eq } from "@homarr/db";
 import { apiKeys } from "@homarr/db/schema";
 
 import { createTRPCRouter, permissionRequiredProcedure } from "../trpc";

packages/api/src/router/app.ts

@@ -1,8 +1,8 @@
 import { TRPCError } from "@trpc/server";
-import { asc, eq, inArray, like } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
+import { asc, eq, inArray, like } from "@homarr/db";
 import { apps } from "@homarr/db/schema";
 import { selectAppSchema } from "@homarr/db/validationSchemas";
 import { getIconForName } from "@homarr/icons";

packages/api/src/router/app/app-access-control.ts

@@ -1,8 +1,7 @@
-import { eq, or } from "drizzle-orm";
 import SuperJSON from "superjson";
 
 import type { Session } from "@homarr/auth";
-import { db } from "@homarr/db";
+import { db, eq, or } from "@homarr/db";
 import { items } from "@homarr/db/schema";
 
 import type { WidgetComponentProps } from "../../../../widgets/src";

packages/api/src/router/board.ts

@@ -1,14 +1,12 @@
 import { TRPCError } from "@trpc/server";
-import type { InferInsertModel, InferSelectModel, SQL } from "drizzle-orm";
-import { and, asc, eq, inArray, isNull, like, not, or, sql } from "drizzle-orm";
 import superjson from "superjson";
 import { z } from "zod/v4";
 
 import { constructBoardPermissions } from "@homarr/auth/shared";
 import { createId } from "@homarr/common";
 import type { DeviceType } from "@homarr/common/server";
-import type { Database } from "@homarr/db";
-import { handleTransactionsAsync } from "@homarr/db";
+import type { Database, InferInsertModel, InferSelectModel, SQL } from "@homarr/db";
+import { and, asc, eq, handleTransactionsAsync, inArray, isNull, like, not, or, sql } from "@homarr/db";
 import { createDbInsertCollectionWithoutTransaction } from "@homarr/db/collection";
 import { getServerSettingByKeyAsync } from "@homarr/db/queries";
 import {

packages/api/src/router/board/board-access.ts

@@ -1,10 +1,9 @@
 import { TRPCError } from "@trpc/server";
-import type { SQL } from "drizzle-orm";
-import { eq, inArray } from "drizzle-orm";
 
 import type { Session } from "@homarr/auth";
 import { constructBoardPermissions } from "@homarr/auth/shared";
-import type { Database } from "@homarr/db";
+import type { Database, SQL } from "@homarr/db";
+import { eq, inArray } from "@homarr/db";
 import { boardGroupPermissions, boardUserPermissions, groupMembers } from "@homarr/db/schema";
 import type { BoardPermission } from "@homarr/definitions";
 

packages/api/src/router/certificates/certificate-router.ts

@@ -1,14 +1,11 @@
 import { X509Certificate } from "node:crypto";
 import { TRPCError } from "@trpc/server";
-import { and, eq } from "drizzle-orm";
 import { zfd } from "zod-form-data";
 import { z } from "zod/v4";
 
-import {
-  addCustomRootCertificateAsync,
-  removeCustomRootCertificateAsync,
-} from "@homarr/core/infrastructure/certificates";
+import { addCustomRootCertificateAsync, removeCustomRootCertificateAsync } from "@homarr/certificates/server";
 import { createLogger } from "@homarr/core/infrastructure/logs";
+import { and, eq } from "@homarr/db";
 import { trustedCertificateHostnames } from "@homarr/db/schema";
 import { certificateValidFileNameSchema, checkCertificateFile } from "@homarr/validation/certificates";
 

packages/api/src/router/group.ts

@@ -1,10 +1,9 @@
 import { TRPCError } from "@trpc/server";
-import { and, eq, like, not } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import type { Database } from "@homarr/db";
-import { handleTransactionsAsync } from "@homarr/db";
+import { and, eq, handleTransactionsAsync, like, not } from "@homarr/db";
 import { getMaxGroupPositionAsync } from "@homarr/db/queries";
 import { groupMembers, groupPermissions, groups } from "@homarr/db/schema";
 import { everyoneGroup } from "@homarr/definitions";

packages/api/src/router/home.ts

@@ -1,7 +1,5 @@
-import { eq, inArray, or } from "drizzle-orm";
-
 import { isProviderEnabled } from "@homarr/auth/server";
-import { db } from "@homarr/db";
+import { db, eq, inArray, or } from "@homarr/db";
 import {
   apps,
   boards,

packages/api/src/router/icons.ts

@@ -1,5 +1,4 @@
-import { and, like } from "drizzle-orm";
-
+import { and, like } from "@homarr/db";
 import { icons } from "@homarr/db/schema";
 import { iconsFindSchema } from "@homarr/validation/icons";
 

packages/api/src/router/integration/integration-access.ts

@@ -1,10 +1,9 @@
 import { TRPCError } from "@trpc/server";
-import type { SQL } from "drizzle-orm";
-import { eq, inArray } from "drizzle-orm";
 
 import type { Session } from "@homarr/auth";
 import { constructIntegrationPermissions } from "@homarr/auth/shared";
-import type { Database } from "@homarr/db";
+import type { Database, SQL } from "@homarr/db";
+import { eq, inArray } from "@homarr/db";
 import { groupMembers, integrationGroupPermissions, integrationUserPermissions } from "@homarr/db/schema";
 import type { IntegrationPermission } from "@homarr/definitions";
 

packages/api/src/router/integration/integration-router.ts

@@ -1,12 +1,11 @@
 import { TRPCError } from "@trpc/server";
-import { and, asc, eq, inArray, like, or } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createId, objectEntries } from "@homarr/common";
 import { decryptSecret, encryptSecret } from "@homarr/common/server";
 import { createLogger } from "@homarr/core/infrastructure/logs";
-import { handleTransactionsAsync } from "@homarr/db";
 import type { Database } from "@homarr/db";
+import { and, asc, eq, handleTransactionsAsync, inArray, like, or } from "@homarr/db";
 import {
   apps,
   groupMembers,

packages/api/src/router/invite.ts

@@ -1,9 +1,9 @@
 import { randomBytes } from "crypto";
 import { TRPCError } from "@trpc/server";
-import { asc, eq } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
+import { asc, eq } from "@homarr/db";
 import { invites } from "@homarr/db/schema";
 import { selectInviteSchema } from "@homarr/db/validationSchemas";
 

packages/api/src/router/location.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { fetchWithTimeoutAsync } from "@homarr/core/infrastructure/http/timeout";
+import { fetchWithTimeout } from "@homarr/common";
 
 import { createTRPCRouter, publicProcedure } from "../trpc";
 
@@ -36,7 +36,7 @@ export const locationRouter = createTRPCRouter({
     .input(locationSearchCityInput)
     .output(locationSearchCityOutput)
     .query(async ({ input }) => {
-      const res = await fetchWithTimeoutAsync(`https://geocoding-api.open-meteo.com/v1/search?name=${input.query}`);
+      const res = await fetchWithTimeout(`https://geocoding-api.open-meteo.com/v1/search?name=${input.query}`);
       return (await res.json()) as z.infer<typeof locationSearchCityOutput>;
     }),
 });

packages/api/src/router/medias/media-router.ts

@@ -1,9 +1,9 @@
 import { TRPCError } from "@trpc/server";
-import type { InferInsertModel } from "drizzle-orm";
-import { and, desc, eq, like } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
+import type { InferInsertModel } from "@homarr/db";
+import { and, desc, eq, like } from "@homarr/db";
 import { iconRepositories, icons, medias } from "@homarr/db/schema";
 import { createLocalImageUrl, LOCAL_ICON_REPOSITORY_SLUG, mapMediaToIcon } from "@homarr/icons/local";
 import { byIdSchema, paginatedSchema } from "@homarr/validation/common";

packages/api/src/router/onboard/onboard-queries.ts

@@ -1,9 +1,8 @@
-import { eq } from "drizzle-orm";
-
 import { isProviderEnabled } from "@homarr/auth/server";
 import { objectEntries } from "@homarr/common";
 import type { MaybePromise } from "@homarr/common/types";
 import type { Database } from "@homarr/db";
+import { eq } from "@homarr/db";
 import { groups, onboarding } from "@homarr/db/schema";
 import type { OnboardingStep } from "@homarr/definitions";
 import { credentialsAdminGroup } from "@homarr/definitions";

packages/api/src/router/search-engine/search-engine-router.ts

@@ -1,9 +1,9 @@
 import { TRPCError } from "@trpc/server";
-import { asc, eq, like } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import { createLogger } from "@homarr/core/infrastructure/logs";
+import { asc, eq, like } from "@homarr/db";
 import { getServerSettingByKeyAsync, updateServerSettingByKeyAsync } from "@homarr/db/queries";
 import { searchEngines, users } from "@homarr/db/schema";
 import { createIntegrationAsync } from "@homarr/integrations";

packages/api/src/router/section/section-router.ts

@@ -1,7 +1,7 @@
 import { TRPCError } from "@trpc/server";
-import { and, eq } from "drizzle-orm";
 import { z } from "zod/v4";
 
+import { and, eq } from "@homarr/db";
 import { sectionCollapseStates, sections } from "@homarr/db/schema";
 
 import { createTRPCRouter, protectedProcedure } from "../../trpc";

packages/api/src/router/test/board.spec.ts

@@ -1,11 +1,10 @@
-import type { InferInsertModel } from "drizzle-orm";
-import { and, eq, not } from "drizzle-orm";
 import SuperJSON from "superjson";
 import { describe, expect, it, test, vi } from "vitest";
 
 import type { Session } from "@homarr/auth";
 import { createId } from "@homarr/common";
-import type { Database } from "@homarr/db";
+import type { Database, InferInsertModel } from "@homarr/db";
+import { and, eq, not } from "@homarr/db";
 import {
   boardGroupPermissions,
   boards,

packages/api/src/router/test/board/board-access.spec.ts

@@ -1,8 +1,8 @@
-import { eq } from "drizzle-orm";
 import { describe, expect, test, vi } from "vitest";
 
 import * as authShared from "@homarr/auth/shared";
 import { createId } from "@homarr/common";
+import { eq } from "@homarr/db";
 import { boards, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";
 

packages/api/src/router/test/group.spec.ts

@@ -1,9 +1,9 @@
-import { eq } from "drizzle-orm";
 import { describe, expect, test, vi } from "vitest";
 
 import type { Session } from "@homarr/auth";
 import * as env from "@homarr/auth/env";
 import { createId } from "@homarr/common";
+import { eq } from "@homarr/db";
 import { groupMembers, groupPermissions, groups, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";
 import type { GroupPermissionKey } from "@homarr/definitions";

packages/api/src/router/test/integration/integration-access.spec.ts

@@ -1,8 +1,8 @@
-import { eq } from "drizzle-orm";
 import { describe, expect, test, vi } from "vitest";
 
 import * as authShared from "@homarr/auth/shared";
 import { createId } from "@homarr/common";
+import { eq } from "@homarr/db";
 import { integrations, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";
 

packages/api/src/router/test/user.spec.ts

@@ -1,9 +1,9 @@
-import { eq } from "drizzle-orm";
 import { describe, expect, it, test, vi } from "vitest";
 
 import type { Session } from "@homarr/auth";
 import { createId } from "@homarr/common";
 import type { Database } from "@homarr/db";
+import { eq } from "@homarr/db";
 import { invites, onboarding, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";
 import type { GroupPermissionKey, OnboardingStep } from "@homarr/definitions";

packages/api/src/router/user.ts

@@ -1,11 +1,11 @@
 import { TRPCError } from "@trpc/server";
-import { and, eq, like } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createSaltAsync, hashPasswordAsync } from "@homarr/auth";
 import { createId } from "@homarr/common";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import type { Database } from "@homarr/db";
+import { and, eq, like } from "@homarr/db";
 import { getMaxGroupPositionAsync } from "@homarr/db/queries";
 import { boards, groupMembers, groupPermissions, groups, invites, users } from "@homarr/db/schema";
 import { selectUserSchema } from "@homarr/db/validationSchemas";

packages/api/src/router/user/change-search-preferences.ts

@@ -1,9 +1,9 @@
 import { TRPCError } from "@trpc/server";
-import { eq } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import type { Session } from "@homarr/auth";
 import type { Modify } from "@homarr/common/types";
+import { eq } from "@homarr/db";
 import type { Database } from "@homarr/db";
 import { users } from "@homarr/db/schema";
 import { userChangeSearchPreferencesSchema } from "@homarr/validation/user";

packages/api/src/router/widgets/notebook.ts

@@ -1,8 +1,8 @@
 import { TRPCError } from "@trpc/server";
-import { eq } from "drizzle-orm";
 import SuperJSON from "superjson";
 import { z } from "zod/v4";
 
+import { eq } from "@homarr/db";
 import { boards, items } from "@homarr/db/schema";
 
 import { createTRPCRouter, protectedProcedure } from "../../trpc";

packages/auth/adapter.ts

@@ -1,8 +1,8 @@
 import type { Adapter } from "@auth/core/adapters";
 import { DrizzleAdapter } from "@auth/drizzle-adapter";
-import { and, eq } from "drizzle-orm";
 
 import type { Database } from "@homarr/db";
+import { and, eq } from "@homarr/db";
 import { accounts, sessions, users } from "@homarr/db/schema";
 import type { SupportedAuthProvider } from "@homarr/definitions";
 

packages/auth/callbacks.ts

@@ -1,9 +1,9 @@
 import dayjs from "dayjs";
-import { eq, inArray } from "drizzle-orm";
 import type { NextAuthConfig } from "next-auth";
 
 import type { Session } from "@homarr/auth";
 import type { Database } from "@homarr/db";
+import { eq, inArray } from "@homarr/db";
 import { groupMembers, groupPermissions, users } from "@homarr/db/schema";
 import { getPermissionsWithChildren } from "@homarr/definitions";
 

packages/auth/events.ts

@@ -1,9 +1,9 @@
 import { cookies } from "next/headers";
 import dayjs from "dayjs";
-import { and, eq, inArray } from "drizzle-orm";
 import type { NextAuthConfig } from "next-auth";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
+import { and, eq, inArray } from "@homarr/db";
 import type { Database } from "@homarr/db";
 import { groupMembers, groups, users } from "@homarr/db/schema";
 import { colorSchemeCookieKey, everyoneGroup } from "@homarr/definitions";

packages/auth/package.json

@@ -25,6 +25,7 @@
   "dependencies": {
     "@auth/core": "^0.41.1",
     "@auth/drizzle-adapter": "^1.11.1",
+    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
     "@homarr/db": "workspace:^0.1.0",
@@ -32,13 +33,12 @@
     "@homarr/validation": "workspace:^0.1.0",
     "bcrypt": "^6.0.0",
     "cookies": "^0.9.1",
-    "drizzle-orm": "^0.45.1",
-    "ldapts": "8.0.24",
+    "ldapts": "8.0.23",
     "next": "16.0.10",
     "next-auth": "5.0.0-beta.30",
     "react": "19.2.3",
     "react-dom": "19.2.3",
-    "zod": "^4.2.0"
+    "zod": "^4.1.13"
   },
   "devDependencies": {
     "@homarr/eslint-config": "workspace:^0.2.0",

packages/auth/permissions/integration-query-permissions.ts

@@ -1,7 +1,7 @@
-import { and, eq, inArray, or } from "drizzle-orm";
 import type { Session } from "next-auth";
 
 import type { Database } from "@homarr/db";
+import { and, eq, inArray, or } from "@homarr/db";
 import { boards, boardUserPermissions, groupMembers } from "@homarr/db/schema";
 import type { IntegrationPermission } from "@homarr/definitions";
 

packages/auth/permissions/integrations-with-permissions.ts

@@ -1,7 +1,6 @@
-import { eq, inArray } from "drizzle-orm";
 import type { Session } from "next-auth";
 
-import { db } from "@homarr/db";
+import { db, eq, inArray } from "@homarr/db";
 import { groupMembers, integrationGroupPermissions, integrationUserPermissions } from "@homarr/db/schema";
 
 import { constructIntegrationPermissions } from "./integration-permissions";

packages/auth/permissions/test/integration-query-permissions.spec.ts

@@ -1,8 +1,8 @@
-import type { InferInsertModel } from "drizzle-orm";
 import type { Session } from "next-auth";
 import { describe, expect, test, vi } from "vitest";
 
 import { createId } from "@homarr/common";
+import type { InferInsertModel } from "@homarr/db";
 import { boardGroupPermissions, boards, boardUserPermissions, groupMembers, groups, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";
 

packages/auth/providers/credentials/authorization/basic-authorization.ts

@@ -1,9 +1,9 @@
 import bcrypt from "bcrypt";
-import { and, eq } from "drizzle-orm";
 import type { z } from "zod/v4";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import type { Database } from "@homarr/db";
+import { and, eq } from "@homarr/db";
 import { users } from "@homarr/db/schema";
 import type { userSignInSchema } from "@homarr/validation/user";
 

packages/auth/providers/credentials/authorization/ldap-authorization.ts

@@ -1,11 +1,10 @@
 import { CredentialsSignin } from "@auth/core/errors";
-import { and, eq } from "drizzle-orm";
-import type { InferInsertModel } from "drizzle-orm";
 import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import { createLogger } from "@homarr/core/infrastructure/logs";
-import type { Database } from "@homarr/db";
+import type { Database, InferInsertModel } from "@homarr/db";
+import { and, eq } from "@homarr/db";
 import { users } from "@homarr/db/schema";
 import type { ldapSignInSchema } from "@homarr/validation/user";
 

packages/auth/providers/oidc/oidc-provider.ts

@@ -3,7 +3,7 @@ import type { OIDCConfig } from "@auth/core/providers";
 import type { Profile } from "@auth/core/types";
 import { customFetch } from "next-auth";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 
 import { env } from "../../env";
 import { createRedirectUri } from "../../redirect";

packages/auth/providers/test/ldap-authorization.spec.ts

@@ -1,9 +1,9 @@
 import { CredentialsSignin } from "@auth/core/errors";
-import { and, eq } from "drizzle-orm";
 import { describe, expect, test, vi } from "vitest";
 
 import { createId } from "@homarr/common";
 import type { Database } from "@homarr/db";
+import { and, eq } from "@homarr/db";
 import { groups, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";
 

packages/auth/test/events.spec.ts

@@ -1,9 +1,9 @@
 import type { ResponseCookie } from "next/dist/compiled/@edge-runtime/cookies";
 import type { ReadonlyRequestCookies } from "next/dist/server/web/spec-extension/adapters/request-cookies";
 import { cookies } from "next/headers";
-import { eq } from "drizzle-orm";
 import { describe, expect, test, vi } from "vitest";
 
+import { eq } from "@homarr/db";
 import type { Database } from "@homarr/db";
 import { groupMembers, groups, users } from "@homarr/db/schema";
 import { createDb } from "@homarr/db/test";

packages/certificates/eslint.config.js

@@ -0,0 +1,9 @@
+import baseConfig from "@homarr/eslint-config/base";
+
+/** @type {import('typescript-eslint').Config} */
+export default [
+  {
+    ignores: [],
+  },
+  ...baseConfig,
+];

packages/certificates/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@homarr/certificates",
+  "version": "0.1.0",
+  "private": true,
+  "license": "Apache-2.0",
+  "type": "module",
+  "exports": {
+    "./server": "./src/server.ts"
+  },
+  "typesVersions": {
+    "*": {
+      "*": [
+        "src/*"
+      ]
+    }
+  },
+  "scripts": {
+    "clean": "rm -rf .turbo node_modules",
+    "format": "prettier --check . --ignore-path ../../.gitignore",
+    "lint": "eslint",
+    "typecheck": "tsc --noEmit"
+  },
+  "prettier": "@homarr/prettier-config",
+  "dependencies": {
+    "@homarr/common": "workspace:^0.1.0",
+    "@homarr/db": "workspace:^0.1.0",
+    "undici": "7.16.0"
+  },
+  "devDependencies": {
+    "@homarr/eslint-config": "workspace:^0.2.0",
+    "@homarr/prettier-config": "workspace:^0.1.0",
+    "@homarr/tsconfig": "workspace:^0.1.0",
+    "eslint": "^9.39.2",
+    "typescript": "^5.9.3"
+  }
+}

packages/certificates/src/server.ts

@@ -0,0 +1,141 @@
+import { X509Certificate } from "node:crypto";
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import type { AgentOptions } from "node:https";
+import { Agent as HttpsAgent } from "node:https";
+import path from "node:path";
+import { checkServerIdentity, rootCertificates } from "node:tls";
+import axios from "axios";
+import type { RequestInfo, RequestInit, Response } from "undici";
+import { fetch } from "undici";
+
+import { env } from "@homarr/common/env";
+import { LoggingAgent } from "@homarr/common/server";
+import type { InferSelectModel } from "@homarr/db";
+import { db } from "@homarr/db";
+import type { trustedCertificateHostnames } from "@homarr/db/schema";
+
+const getCertificateFolder = () => {
+  if (env.NODE_ENV !== "production") return process.env.LOCAL_CERTIFICATE_PATH;
+  return process.env.LOCAL_CERTIFICATE_PATH ?? path.join("/appdata", "trusted-certificates");
+};
+
+export const loadCustomRootCertificatesAsync = async () => {
+  const folder = getCertificateFolder();
+
+  if (!folder) {
+    return [];
+  }
+
+  if (!fsSync.existsSync(folder)) {
+    await fs.mkdir(folder, { recursive: true });
+  }
+
+  const dirContent = await fs.readdir(folder);
+  return await Promise.all(
+    dirContent
+      .filter((file) => file.endsWith(".crt") || file.endsWith(".pem"))
+      .map(async (file) => ({
+        content: await fs.readFile(path.join(folder, file), "utf8"),
+        fileName: file,
+      })),
+  );
+};
+
+export const removeCustomRootCertificateAsync = async (fileName: string) => {
+  const folder = getCertificateFolder();
+  if (!folder) {
+    return null;
+  }
+
+  const existingFiles = await fs.readdir(folder, { withFileTypes: true });
+  if (!existingFiles.some((file) => file.isFile() && file.name === fileName)) {
+    throw new Error(`File ${fileName} does not exist`);
+  }
+
+  const fullPath = path.join(folder, fileName);
+  const content = await fs.readFile(fullPath, "utf8");
+
+  await fs.rm(fullPath);
+  try {
+    return new X509Certificate(content);
+  } catch {
+    return null;
+  }
+};
+
+export const addCustomRootCertificateAsync = async (fileName: string, content: string) => {
+  const folder = getCertificateFolder();
+  if (!folder) {
+    throw new Error(
+      "When you want to use custom certificates locally you need to set LOCAL_CERTIFICATE_PATH to an absolute path",
+    );
+  }
+
+  if (fileName.includes("/")) {
+    throw new Error("Invalid file name");
+  }
+
+  await fs.writeFile(path.join(folder, fileName), content);
+};
+
+export const getTrustedCertificateHostnamesAsync = async () => {
+  return await db.query.trustedCertificateHostnames.findMany();
+};
+
+export const getAllTrustedCertificatesAsync = async () => {
+  const customCertificates = await loadCustomRootCertificatesAsync();
+  return rootCertificates.concat(customCertificates.map((cert) => cert.content));
+};
+
+export const createCustomCheckServerIdentity = (
+  trustedHostnames: InferSelectModel<typeof trustedCertificateHostnames>[],
+): typeof checkServerIdentity => {
+  return (hostname, peerCertificate) => {
+    const matchingTrustedHostnames = trustedHostnames.filter(
+      (cert) => cert.thumbprint === peerCertificate.fingerprint256,
+    );
+
+    // We trust the certificate if we have a matching hostname
+    if (matchingTrustedHostnames.some((cert) => cert.hostname === hostname)) return undefined;
+
+    return checkServerIdentity(hostname, peerCertificate);
+  };
+};
+
+export const createCertificateAgentAsync = async (override?: {
+  ca: string | string[];
+  checkServerIdentity: typeof checkServerIdentity;
+}) => {
+  return new LoggingAgent({
+    connect: override ?? {
+      ca: await getAllTrustedCertificatesAsync(),
+      checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
+    },
+  });
+};
+
+export const createHttpsAgentAsync = async (override?: Pick<AgentOptions, "ca" | "checkServerIdentity">) => {
+  return new HttpsAgent(
+    override ?? {
+      ca: await getAllTrustedCertificatesAsync(),
+      checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
+    },
+  );
+};
+
+export const createAxiosCertificateInstanceAsync = async (
+  override?: Pick<AgentOptions, "ca" | "checkServerIdentity">,
+) => {
+  return axios.create({
+    httpsAgent: await createHttpsAgentAsync(override),
+  });
+};
+
+export const fetchWithTrustedCertificatesAsync = async (url: RequestInfo, options?: RequestInit): Promise<Response> => {
+  const agent = await createCertificateAgentAsync(undefined);
+  return fetch(url, {
+    ...options,
+    dispatcher: agent,
+  });
+};

packages/certificates/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "@homarr/tsconfig/base.json",
+  "compilerOptions": {
+    "tsBuildInfoFile": "node_modules/.cache/tsbuildinfo.json"
+  },
+  "include": ["*.ts", "src"],
+  "exclude": ["node_modules"]
+}

packages/cli/package.json

@@ -28,8 +28,7 @@
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/db": "workspace:^0.1.0",
     "@homarr/validation": "workspace:^0.1.0",
-    "dotenv": "^17.2.3",
-    "drizzle-orm": "^0.45.1"
+    "dotenv": "^17.2.3"
   },
   "devDependencies": {
     "@homarr/eslint-config": "workspace:^0.2.0",

packages/cli/src/commands/fix-usernames.ts

@@ -1,7 +1,6 @@
 import { command } from "@drizzle-team/brocli";
-import { eq } from "drizzle-orm";
 
-import { db } from "@homarr/db";
+import { db, eq } from "@homarr/db";
 import { users } from "@homarr/db/schema";
 
 export const fixUsernames = command({

packages/cli/src/commands/recreate-admin.ts

@@ -1,10 +1,9 @@
 import { command, string } from "@drizzle-team/brocli";
-import { and, count, eq } from "drizzle-orm";
 
 import { createSaltAsync, hashPasswordAsync } from "@homarr/auth";
 import { createId } from "@homarr/common";
 import { generateSecureRandomToken } from "@homarr/common/server";
-import { db } from "@homarr/db";
+import { and, count, db, eq } from "@homarr/db";
 import { getMaxGroupPositionAsync } from "@homarr/db/queries";
 import { groupMembers, groupPermissions, groups, users } from "@homarr/db/schema";
 import { usernameSchema } from "@homarr/validation/user";

packages/cli/src/commands/reset-password.ts

@@ -1,9 +1,8 @@
 import { command, string } from "@drizzle-team/brocli";
-import { and, eq } from "drizzle-orm";
 
 import { hashPasswordAsync } from "@homarr/auth";
 import { generateSecureRandomToken } from "@homarr/common/server";
-import { db } from "@homarr/db";
+import { and, db, eq } from "@homarr/db";
 import { sessions, users } from "@homarr/db/schema";
 
 export const resetPassword = command({

packages/common/env.ts

@@ -24,10 +24,12 @@ export const env = createEnv({
         message: `SECRET_ENCRYPTION_KEY must only contain hex characters${errorSuffix}`,
       }),
     NO_EXTERNAL_CONNECTION: createBooleanSchema(false),
+    ENABLE_DNS_CACHING: createBooleanSchema(false),
   },
   runtimeEnv: {
     SECRET_ENCRYPTION_KEY: process.env.SECRET_ENCRYPTION_KEY,
     NODE_ENV: process.env.NODE_ENV,
     NO_EXTERNAL_CONNECTION: process.env.NO_EXTERNAL_CONNECTION,
+    ENABLE_DNS_CACHING: process.env.ENABLE_DNS_CACHING,
   },
 });

packages/common/package.json

@@ -8,6 +8,7 @@
     ".": "./index.ts",
     "./types": "./src/types.ts",
     "./server": "./src/server.ts",
+    "./init-dns": "./src/dns.ts",
     "./client": "./src/client.ts",
     "./env": "./env.ts"
   },
@@ -29,12 +30,13 @@
     "@homarr/core": "workspace:^0.1.0",
     "@paralleldrive/cuid2": "^3.1.0",
     "dayjs": "^1.11.19",
+    "dns-caching": "^0.2.9",
     "next": "16.0.10",
     "octokit": "^5.0.5",
     "react": "19.2.3",
     "react-dom": "19.2.3",
     "undici": "7.16.0",
-    "zod": "^4.2.0",
+    "zod": "^4.1.13",
     "zod-validation-error": "^5.0.0"
   },
   "devDependencies": {

packages/common/src/dns.ts

@@ -2,7 +2,7 @@ import { DnsCacheManager } from "dns-caching";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
-import { dnsEnv } from "./env";
+import { env } from "../env";
 
 // Add global type augmentation for homarr
 declare global {
@@ -23,6 +23,6 @@ global.homarr.dnsCacheManager ??= new DnsCacheManager({
   logger,
 });
 
-if (dnsEnv.ENABLE_DNS_CACHING) {
+if (env.ENABLE_DNS_CACHING) {
   global.homarr.dnsCacheManager.initialize();
 }

packages/common/src/errors/http/handlers/http-error-handler.ts

@@ -1,11 +1,11 @@
-import type { ILogger } from "@homarr/core/infrastructure/logs";
+import type { Logger } from "@homarr/core/infrastructure/logs";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { AnyRequestError } from "../request-error";
 import type { ResponseError } from "../response-error";
 
 export abstract class HttpErrorHandler {
-  protected logger: ILogger;
+  protected logger: Logger;
 
   constructor(type: string) {
     this.logger = createLogger({ module: "httpErrorHandler", type });

packages/common/src/errors/parse/handlers/parse-error-handler.ts

@@ -1,10 +1,10 @@
-import type { ILogger } from "@homarr/core/infrastructure/logs";
+import type { Logger } from "@homarr/core/infrastructure/logs";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { ParseError } from "../parse-error";
 
 export abstract class ParseErrorHandler {
-  protected logger: ILogger;
+  protected logger: Logger;
   constructor(type: string) {
     this.logger = createLogger({ module: "parseErrorHandler", type });
   }

packages/common/src/fetch-agent.ts

@@ -0,0 +1,41 @@
+import type { Dispatcher } from "undici";
+import { Agent } from "undici";
+
+import { createLogger } from "@homarr/core/infrastructure/logs";
+
+// The below import statement initializes dns-caching
+import "./dns";
+
+const logger = createLogger({ module: "fetchAgent" });
+
+export class LoggingAgent extends Agent {
+  constructor(...props: ConstructorParameters<typeof Agent>) {
+    super(...props);
+  }
+
+  dispatch(options: Dispatcher.DispatchOptions, handler: Dispatcher.DispatchHandler): boolean {
+    const path = options.path
+      .split("/")
+      .map((segment) => (segment.length >= 32 && !segment.startsWith("?") ? "REDACTED" : segment))
+      .join("/");
+    const url = new URL(`${options.origin as string}${path}`);
+
+    // The below code should prevent sensitive data from being logged as
+    // some integrations use query parameters for auth
+    url.searchParams.forEach((value, key) => {
+      if (value === "") return; // Skip empty values
+      if (/^-?\d{1,12}$/.test(value)) return; // Skip small numbers
+      if (value === "true" || value === "false") return; // Skip boolean values
+      if (/^[a-zA-Z]{1,12}$/.test(value)) return; // Skip short strings
+      if (/^\d{4}-\d{2}-\d{2}$/.test(value)) return; // Skip dates
+      if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) return; // Skip date times
+
+      url.searchParams.set(key, "REDACTED");
+    });
+
+    logger.debug(
+      `Dispatching request ${url.toString().replaceAll("=&", "&")} (${Object.keys(options.headers ?? {}).length} headers)`,
+    );
+    return super.dispatch(options, handler);
+  }
+}

packages/common/src/fetch-with-timeout.ts

@@ -0,0 +1,16 @@
+/**
+ * Same as fetch, but with a timeout of 10 seconds.
+ * https://stackoverflow.com/questions/46946380/fetch-api-request-timeout
+ * @param param0 fetch arguments
+ * @returns fetch response
+ */
+export const fetchWithTimeout = (...[url, requestInit]: Parameters<typeof fetch>) => {
+  const controller = new AbortController();
+
+  // 10 seconds timeout:
+  const timeoutId = setTimeout(() => controller.abort(), 10000);
+
+  return fetch(url, { signal: controller.signal, ...requestInit }).finally(() => {
+    clearTimeout(timeoutId);
+  });
+};

packages/common/src/index.ts

@@ -9,6 +9,7 @@ export * from "./id";
 export * from "./url";
 export * from "./number";
 export * from "./error";
+export * from "./fetch-with-timeout";
 export * from "./theme";
 export * from "./function";
 export * from "./id";

packages/common/src/server.ts

@@ -1,4 +1,5 @@
 export * from "./security";
 export * from "./encryption";
 export * from "./user-agent";
+export * from "./fetch-agent";
 export * from "./errors";

packages/common/src/test/fetch-agent.spec.ts

@@ -1,9 +1,9 @@
 import type { Dispatcher } from "undici";
 import { describe, expect, test, vi } from "vitest";
 
-import { UndiciHttpAgent } from "@homarr/core/infrastructure/http";
+import * as logs from "@homarr/core/infrastructure/logs";
 
-import { TestLogger } from "../logs";
+import { LoggingAgent } from "../fetch-agent";
 
 vi.mock("undici", () => {
   return {
@@ -16,28 +16,37 @@ vi.mock("undici", () => {
   };
 });
 
+vi.mock("@homarr/core/infrastructure/logs", async () => {
+  const actual: typeof logs = await vi.importActual("@homarr/core/infrastructure/logs");
+  return {
+    ...actual,
+    createLogger: vi.fn().mockReturnValue({
+      debug: vi.fn(),
+    }),
+  };
+});
+
 const REDACTED = "REDACTED";
 
-describe("UndiciHttpAgent should log all requests", () => {
+const loggerMock = logs.createLogger({ module: "test" });
+
+describe("LoggingAgent should log all requests", () => {
   test("should log all requests", () => {
     // Arrange
-    const logger = new TestLogger();
-    const agent = new UndiciHttpAgent({ logger });
+    const debugSpy = vi.spyOn(loggerMock, "debug");
+    const agent = new LoggingAgent();
 
     // Act
     agent.dispatch({ origin: "https://homarr.dev", path: "/", method: "GET" }, {});
 
     // Assert
-    expect(logger.messages).toContainEqual({
-      level: "debug",
-      message: "Dispatching request https://homarr.dev/ (0 headers)",
-    });
+    expect(debugSpy).toHaveBeenCalledWith("Dispatching request https://homarr.dev/ (0 headers)");
   });
 
   test("should show amount of headers", () => {
     // Arrange
-    const logger = new TestLogger();
-    const agent = new UndiciHttpAgent({ logger });
+    const debugSpy = vi.spyOn(loggerMock, "debug");
+    const agent = new LoggingAgent();
 
     // Act
     agent.dispatch(
@@ -54,7 +63,7 @@ describe("UndiciHttpAgent should log all requests", () => {
     );
 
     // Assert
-    expect(logger.messages.at(-1)?.message).toContain("(2 headers)");
+    expect(debugSpy).toHaveBeenCalledWith(expect.stringContaining("(2 headers)"));
   });
 
   test.each([
@@ -72,14 +81,14 @@ describe("UndiciHttpAgent should log all requests", () => {
     [`/${"a".repeat(32)}/?param=123`, `/${REDACTED}/?param=123`],
   ])("should redact sensitive data in url https://homarr.dev%s", (path, expected) => {
     // Arrange
-    const logger = new TestLogger();
-    const agent = new UndiciHttpAgent({ logger });
+    const debugSpy = vi.spyOn(loggerMock, "debug");
+    const agent = new LoggingAgent();
 
     // Act
     agent.dispatch({ origin: "https://homarr.dev", path, method: "GET" }, {});
 
     // Assert
-    expect(logger.messages.at(-1)?.message).toContain(` https://homarr.dev${expected} `);
+    expect(debugSpy).toHaveBeenCalledWith(expect.stringContaining(` https://homarr.dev${expected} `));
   });
   test.each([
     ["empty", "/?empty"],
@@ -91,13 +100,13 @@ describe("UndiciHttpAgent should log all requests", () => {
     ["date times", "/?datetime=2022-01-01T00:00:00.000Z"],
   ])("should not redact values that are %s", (_reason, path) => {
     // Arrange
-    const logger = new TestLogger();
-    const agent = new UndiciHttpAgent({ logger });
+    const debugSpy = vi.spyOn(loggerMock, "debug");
+    const agent = new LoggingAgent();
 
     // Act
     agent.dispatch({ origin: "https://homarr.dev", path, method: "GET" }, {});
 
     // Assert
-    expect(logger.messages.at(-1)?.message).toContain(` https://homarr.dev${path} `);
+    expect(debugSpy).toHaveBeenCalledWith(expect.stringContaining(` https://homarr.dev${path} `));
   });
 });

packages/core/package.json

@@ -13,14 +13,7 @@
     "./infrastructure/logs/error": "./src/infrastructure/logs/error.ts",
     "./infrastructure/db": "./src/infrastructure/db/index.ts",
     "./infrastructure/db/env": "./src/infrastructure/db/env.ts",
-    "./infrastructure/db/constants": "./src/infrastructure/db/constants.ts",
-    "./infrastructure/certificates": "./src/infrastructure/certificates/index.ts",
-    "./infrastructure/certificates/hostnames/db/sqlite": "./src/infrastructure/certificates/hostnames/db/sqlite.ts",
-    "./infrastructure/certificates/hostnames/db/mysql": "./src/infrastructure/certificates/hostnames/db/mysql.ts",
-    "./infrastructure/certificates/hostnames/db/postgresql": "./src/infrastructure/certificates/hostnames/db/postgresql.ts",
-    "./infrastructure/dns/init": "./src/infrastructure/dns/init.ts",
-    "./infrastructure/http": "./src/infrastructure/http/index.ts",
-    "./infrastructure/http/timeout": "./src/infrastructure/http/timeout.ts"
+    "./infrastructure/db/constants": "./src/infrastructure/db/constants.ts"
   },
   "typesVersions": {
     "*": {
@@ -37,16 +30,15 @@
   },
   "prettier": "@homarr/prettier-config",
   "dependencies": {
-    "@t3-oss/env-nextjs": "^0.13.10",
+    "@t3-oss/env-nextjs": "^0.13.8",
     "better-sqlite3": "^12.5.0",
-    "dns-caching": "^0.2.9",
     "drizzle-orm": "^0.45.1",
     "ioredis": "5.8.2",
     "mysql2": "3.15.3",
     "pg": "^8.16.3",
     "superjson": "2.2.6",
     "winston": "3.19.0",
-    "zod": "^4.2.0"
+    "zod": "^4.1.13"
   },
   "devDependencies": {
     "@homarr/eslint-config": "workspace:^0.2.0",

packages/core/src/infrastructure/certificates/files/index.ts

@@ -1,74 +0,0 @@
-import { X509Certificate } from "node:crypto";
-import fsSync from "node:fs";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { rootCertificates } from "node:tls";
-
-const getCertificateFolder = () => {
-  if (process.env.NODE_ENV !== "production") return process.env.LOCAL_CERTIFICATE_PATH;
-  return process.env.LOCAL_CERTIFICATE_PATH ?? path.join("/appdata", "trusted-certificates");
-};
-
-export const loadCustomRootCertificatesAsync = async () => {
-  const folder = getCertificateFolder();
-
-  if (!folder) {
-    return [];
-  }
-
-  if (!fsSync.existsSync(folder)) {
-    await fs.mkdir(folder, { recursive: true });
-  }
-
-  const dirContent = await fs.readdir(folder);
-  return await Promise.all(
-    dirContent
-      .filter((file) => file.endsWith(".crt") || file.endsWith(".pem"))
-      .map(async (file) => ({
-        content: await fs.readFile(path.join(folder, file), "utf8"),
-        fileName: file,
-      })),
-  );
-};
-
-export const getAllTrustedCertificatesAsync = async () => {
-  const customCertificates = await loadCustomRootCertificatesAsync();
-  return rootCertificates.concat(customCertificates.map((cert) => cert.content));
-};
-
-export const removeCustomRootCertificateAsync = async (fileName: string) => {
-  const folder = getCertificateFolder();
-  if (!folder) {
-    return null;
-  }
-
-  const existingFiles = await fs.readdir(folder, { withFileTypes: true });
-  if (!existingFiles.some((file) => file.isFile() && file.name === fileName)) {
-    throw new Error(`File ${fileName} does not exist`);
-  }
-
-  const fullPath = path.join(folder, fileName);
-  const content = await fs.readFile(fullPath, "utf8");
-
-  await fs.rm(fullPath);
-  try {
-    return new X509Certificate(content);
-  } catch {
-    return null;
-  }
-};
-
-export const addCustomRootCertificateAsync = async (fileName: string, content: string) => {
-  const folder = getCertificateFolder();
-  if (!folder) {
-    throw new Error(
-      "When you want to use custom certificates locally you need to set LOCAL_CERTIFICATE_PATH to an absolute path",
-    );
-  }
-
-  if (fileName.includes("/")) {
-    throw new Error("Invalid file name");
-  }
-
-  await fs.writeFile(path.join(folder, fileName), content);
-};

packages/core/src/infrastructure/certificates/hostnames/db/mysql.ts

@@ -1,15 +0,0 @@
-import { mysqlTable, primaryKey, text, varchar } from "drizzle-orm/mysql-core";
-
-export const trustedCertificateHostnames = mysqlTable(
-  "trusted_certificate_hostname",
-  {
-    hostname: varchar({ length: 256 }).notNull(),
-    thumbprint: varchar({ length: 128 }).notNull(),
-    certificate: text().notNull(),
-  },
-  (table) => ({
-    compoundKey: primaryKey({
-      columns: [table.hostname, table.thumbprint],
-    }),
-  }),
-);

packages/core/src/infrastructure/certificates/hostnames/db/postgresql.ts

@@ -1,15 +0,0 @@
-import { pgTable, primaryKey, text, varchar } from "drizzle-orm/pg-core";
-
-export const trustedCertificateHostnames = pgTable(
-  "trusted_certificate_hostname",
-  {
-    hostname: varchar({ length: 256 }).notNull(),
-    thumbprint: varchar({ length: 128 }).notNull(),
-    certificate: text().notNull(),
-  },
-  (table) => ({
-    compoundKey: primaryKey({
-      columns: [table.hostname, table.thumbprint],
-    }),
-  }),
-);

packages/core/src/infrastructure/certificates/hostnames/db/schema.ts

@@ -1,10 +0,0 @@
-import { createSchema } from "../../../db";
-import * as mysql from "./mysql";
-import * as postgresql from "./postgresql";
-import * as sqlite from "./sqlite";
-
-export const schema = createSchema({
-  "better-sqlite3": () => sqlite,
-  mysql2: () => mysql,
-  "node-postgres": () => postgresql,
-});

packages/core/src/infrastructure/certificates/hostnames/db/sqlite.ts

@@ -1,15 +0,0 @@
-import { primaryKey, sqliteTable, text } from "drizzle-orm/sqlite-core";
-
-export const trustedCertificateHostnames = sqliteTable(
-  "trusted_certificate_hostname",
-  {
-    hostname: text().notNull(),
-    thumbprint: text().notNull(),
-    certificate: text().notNull(),
-  },
-  (table) => ({
-    compoundKey: primaryKey({
-      columns: [table.hostname, table.thumbprint],
-    }),
-  }),
-);

packages/core/src/infrastructure/certificates/hostnames/index.ts

@@ -1,12 +0,0 @@
-import type { InferSelectModel } from "drizzle-orm";
-
-import { createDb } from "../../db";
-import { schema } from "./db/schema";
-
-const db = createDb(schema);
-
-export const getTrustedCertificateHostnamesAsync = async () => {
-  return await db.query.trustedCertificateHostnames.findMany();
-};
-
-export type TrustedCertificateHostname = InferSelectModel<typeof schema.trustedCertificateHostnames>;

packages/core/src/infrastructure/certificates/index.ts

@@ -1,7 +0,0 @@
-export { getTrustedCertificateHostnamesAsync } from "./hostnames";
-export {
-  addCustomRootCertificateAsync,
-  removeCustomRootCertificateAsync,
-  getAllTrustedCertificatesAsync,
-  loadCustomRootCertificatesAsync,
-} from "./files";

packages/core/src/infrastructure/dns/env.ts

@@ -1,8 +0,0 @@
-import { createBooleanSchema, createEnv } from "../env";
-
-export const dnsEnv = createEnv({
-  server: {
-    ENABLE_DNS_CACHING: createBooleanSchema(true),
-  },
-  experimental__runtimeEnv: process.env,
-});

packages/core/src/infrastructure/http/http-agent.ts

@@ -1,72 +0,0 @@
-import type { Dispatcher } from "undici";
-import { Agent } from "undici";
-
-import type { ILogger } from "@homarr/core/infrastructure/logs";
-import { createLogger } from "@homarr/core/infrastructure/logs";
-
-// The below import statement initializes dns-caching
-import "@homarr/core/infrastructure/dns/init";
-
-interface HttpAgentOptions extends Agent.Options {
-  logger?: ILogger;
-}
-
-export class UndiciHttpAgent extends Agent {
-  private logger: ILogger;
-
-  constructor(props?: HttpAgentOptions) {
-    super(props);
-
-    this.logger = props?.logger ?? createLogger({ module: "httpAgent" });
-  }
-
-  dispatch(options: Dispatcher.DispatchOptions, handler: Dispatcher.DispatchHandler): boolean {
-    this.logRequestDispatch(options);
-    return super.dispatch(options, handler);
-  }
-
-  private logRequestDispatch(options: Dispatcher.DispatchOptions) {
-    const path = this.redactPathParams(options.path);
-    let url = new URL(`${options.origin as string}${path}`);
-    url = this.redactSearchParams(url);
-
-    this.logger.debug(
-      `Dispatching request ${url.toString().replaceAll("=&", "&")} (${Object.keys(options.headers ?? {}).length} headers)`,
-    );
-  }
-
-  /**
-   * Redact path parameters that are longer than 32 characters
-   * This is to prevent sensitive data from being logged
-   * @param path path of the request
-   * @returns redacted path
-   */
-  private redactPathParams(path: string): string {
-    return path
-      .split("/")
-      .map((segment) => (segment.length >= 32 && !segment.startsWith("?") ? "REDACTED" : segment))
-      .join("/");
-  }
-
-  /**
-   * Redact sensitive search parameters from the URL.
-   * It allows certain patterns to remain unredacted.
-   * Like small numbers, booleans, short strings, dates, and date-times.
-   * Some integrations use query parameters for auth.
-   * @param url URL object of the request
-   * @returns redacted URL object
-   */
-  private redactSearchParams(url: URL): URL {
-    url.searchParams.forEach((value, key) => {
-      if (value === "") return; // Skip empty values
-      if (/^-?\d{1,12}$/.test(value)) return; // Skip small numbers
-      if (value === "true" || value === "false") return; // Skip boolean values
-      if (/^[a-zA-Z]{1,12}$/.test(value)) return; // Skip short strings
-      if (/^\d{4}-\d{2}-\d{2}$/.test(value)) return; // Skip dates
-      if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) return; // Skip date times
-
-      url.searchParams.set(key, "REDACTED");
-    });
-    return url;
-  }
-}

packages/core/src/infrastructure/http/index.ts

@@ -1,8 +0,0 @@
-export { UndiciHttpAgent } from "./http-agent";
-export {
-  createAxiosCertificateInstanceAsync,
-  createCertificateAgentAsync,
-  createCustomCheckServerIdentity,
-  createHttpsAgentAsync,
-  fetchWithTrustedCertificatesAsync,
-} from "./request";

packages/core/src/infrastructure/http/request.ts

@@ -1,82 +0,0 @@
-import type { AgentOptions } from "node:https";
-import { Agent as HttpsAgent } from "node:https";
-import { checkServerIdentity } from "node:tls";
-import axios from "axios";
-import type { RequestInfo, RequestInit, Response } from "undici";
-import { fetch } from "undici";
-
-import {
-  getAllTrustedCertificatesAsync,
-  getTrustedCertificateHostnamesAsync,
-} from "@homarr/core/infrastructure/certificates";
-import { UndiciHttpAgent } from "@homarr/core/infrastructure/http";
-
-import type { TrustedCertificateHostname } from "../certificates/hostnames";
-import { withTimeoutAsync } from "./timeout";
-
-export const createCustomCheckServerIdentity = (
-  trustedHostnames: TrustedCertificateHostname[],
-): typeof checkServerIdentity => {
-  return (hostname, peerCertificate) => {
-    const matchingTrustedHostnames = trustedHostnames.filter(
-      (cert) => cert.thumbprint === peerCertificate.fingerprint256,
-    );
-
-    // We trust the certificate if we have a matching hostname
-    if (matchingTrustedHostnames.some((cert) => cert.hostname === hostname)) return undefined;
-
-    return checkServerIdentity(hostname, peerCertificate);
-  };
-};
-
-export const createCertificateAgentAsync = async (override?: {
-  ca: string | string[];
-  checkServerIdentity: typeof checkServerIdentity;
-}) => {
-  return new UndiciHttpAgent({
-    connect: override ?? {
-      ca: await getAllTrustedCertificatesAsync(),
-      checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
-    },
-  });
-};
-
-export const createHttpsAgentAsync = async (override?: Pick<AgentOptions, "ca" | "checkServerIdentity">) => {
-  return new HttpsAgent(
-    override ?? {
-      ca: await getAllTrustedCertificatesAsync(),
-      checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
-    },
-  );
-};
-
-export const createAxiosCertificateInstanceAsync = async (
-  override?: Pick<AgentOptions, "ca" | "checkServerIdentity">,
-) => {
-  return axios.create({
-    httpsAgent: await createHttpsAgentAsync(override),
-  });
-};
-
-export const fetchWithTrustedCertificatesAsync = async (
-  url: RequestInfo,
-  options?: RequestInit & { timeout?: number },
-): Promise<Response> => {
-  const agent = await createCertificateAgentAsync(undefined);
-  if (options?.timeout) {
-    return await withTimeoutAsync(
-      async (signal) =>
-        fetch(url, {
-          ...options,
-          signal,
-          dispatcher: agent,
-        }),
-      options.timeout,
-    );
-  }
-
-  return fetch(url, {
-    ...options,
-    dispatcher: agent,
-  });
-};

packages/core/src/infrastructure/http/timeout.ts

@@ -1,19 +0,0 @@
-import type { Response as UndiciResponse } from "undici";
-
-// https://stackoverflow.com/questions/46946380/fetch-api-request-timeout
-export const withTimeoutAsync = async <TResponse extends Response | UndiciResponse>(
-  callback: (signal: AbortSignal) => Promise<TResponse>,
-  timeout = 10000,
-) => {
-  const controller = new AbortController();
-
-  const timeoutId = setTimeout(() => controller.abort(), timeout);
-
-  return await callback(controller.signal).finally(() => {
-    clearTimeout(timeoutId);
-  });
-};
-
-export const fetchWithTimeoutAsync = async (...[url, requestInit]: Parameters<typeof fetch>) => {
-  return await withTimeoutAsync((signal) => fetch(url, { ...requestInit, signal }));
-};

packages/core/src/infrastructure/logs/index.ts

@@ -15,12 +15,4 @@ interface DefaultMetadata {
 }
 
 export const createLogger = (metadata: DefaultMetadata & Record<string, unknown>) => logger.child(metadata);
-
-type LogMethod = ((message: string, metadata?: Record<string, unknown>) => void) | ((error: unknown) => void);
-
-export interface ILogger {
-  debug: LogMethod;
-  info: LogMethod;
-  warn: LogMethod;
-  error: LogMethod;
-}
+export type Logger = winston.Logger;

packages/core/src/test/infrastructure/logs/index.ts

@@ -1,49 +0,0 @@
-import type { ILogger } from "@homarr/core/infrastructure/logs";
-import type { LogLevel } from "@homarr/core/infrastructure/logs/constants";
-
-interface LogMessage {
-  level: LogLevel;
-  message: string;
-  meta?: Record<string, unknown>;
-}
-
-interface LogError {
-  level: LogLevel;
-  error: unknown;
-}
-
-type LogEntry = LogMessage | LogError;
-
-export class TestLogger implements ILogger {
-  public entries: LogEntry[] = [];
-  public get messages(): LogMessage[] {
-    return this.entries.filter((entry) => "message" in entry);
-  }
-  public get errors(): LogError[] {
-    return this.entries.filter((entry) => "error" in entry);
-  }
-
-  private log(level: LogLevel, param1: unknown, param2?: Record<string, unknown>): void {
-    if (typeof param1 === "string") {
-      this.entries.push({ level, message: param1, meta: param2 });
-    } else {
-      this.entries.push({ level, error: param1 });
-    }
-  }
-
-  debug(param1: unknown, param2?: Record<string, unknown>): void {
-    this.log("debug", param1, param2);
-  }
-
-  info(param1: unknown, param2?: Record<string, unknown>): void {
-    this.log("info", param1, param2);
-  }
-
-  warn(param1: unknown, param2?: Record<string, unknown>): void {
-    this.log("warn", param1, param2);
-  }
-
-  error(param1: unknown, param2?: Record<string, unknown>): void {
-    this.log("error", param1, param2);
-  }
-}

packages/cron-job-api/package.json

@@ -34,7 +34,7 @@
     "@trpc/tanstack-react-query": "^11.8.0",
     "node-cron": "^4.2.1",
     "react": "19.2.3",
-    "zod": "^4.2.0"
+    "zod": "^4.1.13"
   },
   "devDependencies": {
     "@homarr/eslint-config": "workspace:^0.2.0",

packages/cron-jobs/package.json

@@ -38,7 +38,6 @@
     "@homarr/server-settings": "workspace:^0.1.0",
     "@homarr/translation": "workspace:^0.1.0",
     "@homarr/validation": "workspace:^0.1.0",
-    "drizzle-orm": "^0.45.1",
     "semver-parser": "^4.1.8"
   },
   "devDependencies": {

packages/cron-jobs/src/jobs/docker.ts

@@ -1,10 +1,9 @@
-import { eq } from "drizzle-orm";
 import SuperJSON from "superjson";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
 import { EVERY_MINUTE } from "@homarr/cron-jobs-core/expressions";
-import { db } from "@homarr/db";
+import { db, eq } from "@homarr/db";
 import { items } from "@homarr/db/schema";
 import { dockerContainersRequestHandler } from "@homarr/request-handler/docker";
 

packages/cron-jobs/src/jobs/icons-updater.ts

@@ -1,11 +1,9 @@
-import type { InferInsertModel } from "drizzle-orm";
-import { inArray, sql } from "drizzle-orm";
-
 import { createId, splitToNChunks, Stopwatch } from "@homarr/common";
 import { env } from "@homarr/common/env";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { EVERY_WEEK } from "@homarr/cron-jobs-core/expressions";
-import { db, handleTransactionsAsync } from "@homarr/db";
+import type { InferInsertModel } from "@homarr/db";
+import { db, handleTransactionsAsync, inArray, sql } from "@homarr/db";
 import { iconRepositories, icons } from "@homarr/db/schema";
 import { fetchIconsAsync } from "@homarr/icons";
 

packages/cron-jobs/src/jobs/minecraft-server-status.ts

@@ -1,8 +1,7 @@
-import { eq } from "drizzle-orm";
 import SuperJSON from "superjson";
 
 import { EVERY_5_MINUTES } from "@homarr/cron-jobs-core/expressions";
-import { db } from "@homarr/db";
+import { db, eq } from "@homarr/db";
 import { items } from "@homarr/db/schema";
 import { minecraftServerStatusRequestHandler } from "@homarr/request-handler/minecraft-server-status";
 

packages/cron-jobs/src/jobs/rss-feeds.ts

@@ -1,10 +1,9 @@
-import { eq } from "drizzle-orm";
 import SuperJSON from "superjson";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
 import { EVERY_10_MINUTES } from "@homarr/cron-jobs-core/expressions";
-import { db } from "@homarr/db";
+import { db, eq } from "@homarr/db";
 import { items } from "@homarr/db/schema";
 // This import is done that way to avoid circular dependencies.
 import { rssFeedsRequestHandler } from "@homarr/request-handler/rss-feeds";