Merge branch 'dev' into add-more-openapi

CODEOWNERS

@@ -1 +1,9 @@
+# ── CODEOWNERS ───────────────────────────────────────
 * @homarr-labs/maintainers
+
+# Exempt Renovate‑managed files (no owners)
+package.json          @homarr-labs/none
+package-lock.json     @homarr-labs/none
+pnpm-lock.yaml        @homarr-labs/none
+Dockerfile            @homarr-labs/none
+docker-compose.yml    @homarr-labs/none

apps/nextjs/package.json

@@ -23,7 +23,6 @@
     "@homarr/api": "workspace:^0.1.0",
     "@homarr/auth": "workspace:^0.1.0",
     "@homarr/boards": "workspace:^0.1.0",
-    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
     "@homarr/cron-job-status": "workspace:^0.1.0",
@@ -56,6 +55,7 @@
     "@mantine/modals": "^8.3.10",
     "@mantine/tiptap": "^8.3.10",
     "@million/lint": "1.0.14",
+    "@scalar/api-reference-react": "^0.8.11",
     "@tabler/icons-react": "^3.35.0",
     "@tanstack/react-query": "^5.90.12",
     "@tanstack/react-query-devtools": "^5.91.1",
@@ -83,11 +83,9 @@
     "react": "19.2.3",
     "react-dom": "19.2.3",
     "react-error-boundary": "^6.0.0",
-    "react-joyride": "^2.9.3",
     "react-simple-code-editor": "^0.14.1",
     "sass": "^1.96.0",
     "superjson": "2.2.6",
-    "swagger-ui-react": "^5.31.0",
     "use-deep-compare-effect": "^1.8.1",
     "zod": "^4.1.13"
   },
@@ -100,7 +98,6 @@
     "@types/prismjs": "^1.26.5",
     "@types/react": "19.2.7",
     "@types/react-dom": "19.2.3",
-    "@types/swagger-ui-react": "^5.18.0",
     "concurrently": "^9.2.1",
     "eslint": "^9.39.2",
     "node-loader": "^2.1.0",

apps/nextjs/src/app/[locale]/boards/(content)/_header-actions.tsx

@@ -44,7 +44,7 @@ export const BoardContentHeaderActions = () => {
   const { hasChangeAccess } = useBoardPermissions(board);
 
   if (!hasChangeAccess) {
-    return null; // Hide actions for user without access
+    return <SelectBoardsMenu />;
   }
 
   return (

apps/nextjs/src/app/[locale]/manage/help/tours/page.tsx

@@ -1,38 +0,0 @@
-import { auth } from "@homarr/auth/next";
-import { getScopedI18n } from "@homarr/translation/server";
-import { createMetaTitle } from "~/metadata";
-import { ManageContainer } from "~/components/manage/manage-container";
-import { DynamicBreadcrumb } from "~/components/navigation/dynamic-breadcrumb";
-import { Title, SimpleGrid, Card } from "@mantine/core";
-
-export async function generateMetadata() {
-  const session = await auth();
-  if (!session?.user || !session.user.permissions.includes("admin")) {
-    return {};
-  }
-
-  const t = await getScopedI18n("management");
-
-  return {
-    title: createMetaTitle(t("metaTitle")),
-  };
-}
-
-export default async function ToursPage() {
-  const t = await getScopedI18n("tours");
-  return (
-    <ManageContainer>
-      <DynamicBreadcrumb/>
-      <Title>{t("page.title")}</Title>
-
-      <SimpleGrid cols={{ base: 1, sm: 2, lg: 5 }}>
-        <Card></Card>
-        <Card></Card>
-        <Card></Card>
-        <Card></Card>
-        <Card></Card>
-        <Card></Card>
-      </SimpleGrid>
-    </ManageContainer>
-  )
-}

apps/nextjs/src/app/[locale]/manage/layout.tsx

@@ -23,7 +23,6 @@ import {
   IconUserFilled,
   IconUsers,
   IconUsersGroup,
-  IconMotorbikeFilled
 } from "@tabler/icons-react";
 
 import { auth } from "@homarr/auth/next";
@@ -159,11 +158,6 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
       label: t("items.help.label"),
       icon: IconHelpSquareRoundedFilled,
       items: [
-        {
-          label: t("items.help.items.tours"),
-          icon: IconMotorbikeFilled,
-          href: "/manage/help/tours"
-        },
         {
           label: t("items.help.items.documentation"),
           icon: IconBook2,

apps/nextjs/src/app/[locale]/manage/tools/api/components/swagger-ui.tsx

@@ -1,23 +0,0 @@
-"use client";
-
-import type { OpenAPIObject } from "openapi3-ts/oas31";
-import SwaggerUI from "swagger-ui-react";
-
-// workaround for CSS that cannot be processed by next.js, https://github.com/swagger-api/swagger-ui/issues/10045
-import "../swagger-ui-dark.css";
-import "../swagger-ui-overrides.css";
-import "../swagger-ui.css";
-
-interface SwaggerUIClientProps {
-  document: OpenAPIObject;
-}
-
-export const SwaggerUIClient = ({ document }: SwaggerUIClientProps) => {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const requestInterceptor = (req: Record<string, any>) => {
-    req.credentials = "omit";
-    return req;
-  };
-
-  return <SwaggerUI requestInterceptor={requestInterceptor} spec={document} />;
-};

apps/nextjs/src/app/[locale]/manage/tools/api/page.tsx

@@ -1,6 +1,7 @@
 import { headers } from "next/headers";
 import { notFound } from "next/navigation";
 import { Stack, Tabs, TabsList, TabsPanel, TabsTab } from "@mantine/core";
+import { ApiReferenceReact } from "@scalar/api-reference-react";
 
 import { openApiDocument } from "@homarr/api";
 import { api } from "@homarr/api/server";
@@ -8,11 +9,14 @@ import { auth } from "@homarr/auth/next";
 import { extractBaseUrlFromHeaders } from "@homarr/common";
 import { getScopedI18n } from "@homarr/translation/server";
 
-import { SwaggerUIClient } from "~/app/[locale]/manage/tools/api/components/swagger-ui";
 import { createMetaTitle } from "~/metadata";
 import { ApiKeysManagement } from "./components/api-keys";
 
-export async function generateMetadata() {
+import "@scalar/api-reference-react/style.css";
+
+import { Metadata } from "next";
+
+export async function generateMetadata(): Promise<Metadata> {
   const session = await auth();
   if (!session?.user || !session.user.permissions.includes("admin")) {
     return {};
@@ -45,7 +49,21 @@ export default async function ApiPage() {
           <ApiKeysManagement apiKeys={apiKeys} />
         </TabsPanel>
         <TabsPanel value={"documentation"}>
-          <SwaggerUIClient document={document} />
+          <ApiReferenceReact
+            configuration={{
+              content: document,
+              layout: "classic",
+              showSidebar: false,
+              hideDarkModeToggle: true,
+              showDeveloperTools: "never",
+              hiddenClients: true,
+              darkMode: session.user.colorScheme === "dark",
+              authentication: {
+                preferredSecurityScheme: "apikey",
+              },
+              hideSearch: true,
+            }}
+          />
         </TabsPanel>
       </Tabs>
     </Stack>

apps/nextjs/src/app/[locale]/manage/tools/api/swagger-ui-overrides.css

@@ -1,4 +0,0 @@
-.swagger-ui .info {
-  margin: 0 !important;
-  margin-bottom: 20px !important;
-}

apps/nextjs/src/app/[locale]/manage/tools/certificates/hostnames/page.tsx

@@ -16,7 +16,7 @@ import {
 import { IconCertificateOff } from "@tabler/icons-react";
 
 import { auth } from "@homarr/auth/next";
-import { getTrustedCertificateHostnamesAsync } from "@homarr/certificates/server";
+import { getTrustedCertificateHostnamesAsync } from "@homarr/core/infrastructure/certificates";
 import { getI18n } from "@homarr/translation/server";
 import { Link } from "@homarr/ui";
 

apps/nextjs/src/app/[locale]/manage/tools/certificates/page.tsx

@@ -5,8 +5,8 @@ import { IconAlertTriangle, IconCertificate, IconCertificateOff } from "@tabler/
 import dayjs from "dayjs";
 
 import { auth } from "@homarr/auth/next";
-import { loadCustomRootCertificatesAsync } from "@homarr/certificates/server";
 import { getMantineColor } from "@homarr/common";
+import { loadCustomRootCertificatesAsync } from "@homarr/core/infrastructure/certificates";
 import type { SupportedLanguage } from "@homarr/translation";
 import { getI18n } from "@homarr/translation/server";
 import { Link } from "@homarr/ui";

apps/tasks/src/overrides.ts

@@ -1,6 +1,5 @@
 import { setGlobalDispatcher } from "undici";
 
-import { LoggingAgent } from "@homarr/common/server";
+import { UndiciHttpAgent } from "@homarr/core/infrastructure/http";
 
-const agent = new LoggingAgent();
-setGlobalDispatcher(agent);
+setGlobalDispatcher(new UndiciHttpAgent());

packages/api/package.json

@@ -22,7 +22,6 @@
   "prettier": "@homarr/prettier-config",
   "dependencies": {
     "@homarr/auth": "workspace:^0.1.0",
-    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
     "@homarr/cron-job-api": "workspace:^0.1.0",

packages/api/src/root.ts

@@ -11,6 +11,7 @@ import { importRouter } from "./router/import/import-router";
 import { infoRouter } from "./router/info";
 import { integrationRouter } from "./router/integration/integration-router";
 import { inviteRouter } from "./router/invite";
+import { itemsRouter } from "./router/item/item-router";
 import { kubernetesRouter } from "./router/kubernetes/router/kubernetes-router";
 import { locationRouter } from "./router/location";
 import { logRouter } from "./router/log";
@@ -49,6 +50,7 @@ export const appRouter = createTRPCRouter({
   updateChecker: updateCheckerRouter,
   certificates: certificateRouter,
   info: infoRouter,
+  item: itemsRouter,
 });
 
 // export type definition of API

packages/api/src/router/board/board-access.ts

@@ -17,6 +17,7 @@ export const throwIfActionForbiddenAsync = async (
   ctx: { db: Database; session: Session | null },
   boardWhere: SQL<unknown>,
   permission: BoardPermission,
+  error?: TRPCError,
 ) => {
   const { db, session } = ctx;
   const groupsOfCurrentUser = await db.query.groupMembers.findMany({
@@ -40,7 +41,7 @@ export const throwIfActionForbiddenAsync = async (
   });
 
   if (!board) {
-    notAllowed();
+    notAllowed(error);
   }
 
   const { hasViewAccess, hasChangeAccess, hasFullAccess } = constructBoardPermissions(board, session);
@@ -57,14 +58,18 @@ export const throwIfActionForbiddenAsync = async (
     return; // As view access is required and user has view access, allow
   }
 
-  notAllowed();
+  notAllowed(error);
 };
 
 /**
  * This method returns NOT_FOUND to prevent snooping on board existence
  * A function is used to use the method without return statement
  */
-function notAllowed(): never {
+function notAllowed(error?: TRPCError): never {
+  if (error) {
+    throw error;
+  }
+
   throw new TRPCError({
     code: "NOT_FOUND",
     message: "Board not found",

packages/api/src/router/certificates/certificate-router.ts

@@ -3,7 +3,10 @@ import { TRPCError } from "@trpc/server";
 import { zfd } from "zod-form-data";
 import { z } from "zod/v4";
 
-import { addCustomRootCertificateAsync, removeCustomRootCertificateAsync } from "@homarr/certificates/server";
+import {
+  addCustomRootCertificateAsync,
+  removeCustomRootCertificateAsync,
+} from "@homarr/core/infrastructure/certificates";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { and, eq } from "@homarr/db";
 import { trustedCertificateHostnames } from "@homarr/db/schema";

packages/api/src/router/group.ts

@@ -6,7 +6,8 @@ import type { Database } from "@homarr/db";
 import { and, eq, handleTransactionsAsync, like, not } from "@homarr/db";
 import { getMaxGroupPositionAsync } from "@homarr/db/queries";
 import { groupMembers, groupPermissions, groups } from "@homarr/db/schema";
-import { everyoneGroup } from "@homarr/definitions";
+import { selectGroupSchema, selectUserSchema } from "@homarr/db/validationSchemas";
+import { everyoneGroup, groupPermissionKeys } from "@homarr/definitions";
 import { byIdSchema, paginatedSchema } from "@homarr/validation/common";
 import {
   groupCreateSchema,
@@ -22,33 +23,65 @@ import { throwIfCredentialsDisabled } from "./invite/checks";
 import { nextOnboardingStepAsync } from "./onboard/onboard-queries";
 
 export const groupRouter = createTRPCRouter({
-  getAll: permissionRequiredProcedure.requiresPermission("admin").query(async ({ ctx }) => {
-    const dbGroups = await ctx.db.query.groups.findMany({
-      with: {
-        members: {
-          with: {
-            user: {
-              columns: {
-                id: true,
-                name: true,
-                email: true,
-                image: true,
+  getAll: permissionRequiredProcedure
+    .requiresPermission("admin")
+    .input(z.void())
+    .output(
+      z.array(
+        selectGroupSchema.and(
+          z.object({ members: z.array(selectUserSchema.pick({ id: true, name: true, email: true, image: true })) }),
+        ),
+      ),
+    )
+    .meta({
+      openapi: { method: "GET", path: "/api/groups", tags: ["groups"], protect: true, summary: "Retrieve all groups" },
+    })
+    .query(async ({ ctx }) => {
+      const dbGroups = await ctx.db.query.groups.findMany({
+        with: {
+          members: {
+            with: {
+              user: {
+                columns: {
+                  id: true,
+                  name: true,
+                  email: true,
+                  image: true,
+                },
               },
             },
           },
         },
-      },
-    });
+      });
 
-    return dbGroups.map((group) => ({
-      ...group,
-      members: group.members.map((member) => member.user),
-    }));
-  }),
+      return dbGroups.map((group) => ({
+        ...group,
+        members: group.members.map((member) => member.user),
+      }));
+    }),
 
   getPaginated: permissionRequiredProcedure
     .requiresPermission("admin")
     .input(paginatedSchema)
+    .output(
+      z.object({
+        items: z.array(
+          selectGroupSchema.and(
+            z.object({ members: z.array(selectUserSchema.pick({ id: true, name: true, email: true, image: true })) }),
+          ),
+        ),
+        totalCount: z.number(),
+      }),
+    )
+    .meta({
+      openapi: {
+        method: "GET",
+        path: "/api/groups/paginated",
+        tags: ["groups"],
+        protect: true,
+        summary: "Retrieve groups with pagination",
+      },
+    })
     .query(async ({ input, ctx }) => {
       const whereQuery = input.search ? like(groups.name, `%${input.search.trim()}%`) : undefined;
       const groupCount = await ctx.db.$count(groups, whereQuery);
@@ -84,6 +117,24 @@ export const groupRouter = createTRPCRouter({
   getById: permissionRequiredProcedure
     .requiresPermission("admin")
     .input(byIdSchema)
+    .output(
+      selectGroupSchema.and(
+        z.object({
+          owner: selectUserSchema.pick({ id: true, name: true, image: true, email: true }).nullable(),
+          members: z.array(selectUserSchema.pick({ id: true, name: true, email: true, image: true, provider: true })),
+          permissions: z.array(z.enum(groupPermissionKeys)),
+        }),
+      ),
+    )
+    .meta({
+      openapi: {
+        method: "GET",
+        path: "/api/groups/{id}",
+        tags: ["groups"],
+        protect: true,
+        summary: "Retrieve group details",
+      },
+    })
     .query(async ({ input, ctx }) => {
       const group = await ctx.db.query.groups.findFirst({
         where: eq(groups.id, input.id),
@@ -201,6 +252,10 @@ export const groupRouter = createTRPCRouter({
   createGroup: permissionRequiredProcedure
     .requiresPermission("admin")
     .input(groupCreateSchema)
+    .output(z.string())
+    .meta({
+      openapi: { method: "POST", path: "/api/groups", tags: ["groups"], protect: true, summary: "Create group" },
+    })
     .mutation(async ({ input, ctx }) => {
       await checkSimilarNameAndThrowAsync(ctx.db, input.name);
 
@@ -219,6 +274,10 @@ export const groupRouter = createTRPCRouter({
   updateGroup: permissionRequiredProcedure
     .requiresPermission("admin")
     .input(groupUpdateSchema)
+    .output(z.void())
+    .meta({
+      openapi: { method: "PUT", path: "/api/groups/{id}", tags: ["groups"], protect: true, summary: "Update group" },
+    })
     .mutation(async ({ input, ctx }) => {
       await throwIfGroupNotFoundAsync(ctx.db, input.id);
       await throwIfGroupNameIsReservedAsync(ctx.db, input.id);
@@ -303,6 +362,10 @@ export const groupRouter = createTRPCRouter({
   deleteGroup: permissionRequiredProcedure
     .requiresPermission("admin")
     .input(byIdSchema)
+    .output(z.void())
+    .meta({
+      openapi: { method: "DELETE", path: "/api/groups/{id}", tags: ["groups"], protect: true, summary: "Delete group" },
+    })
     .mutation(async ({ input, ctx }) => {
       await throwIfGroupNotFoundAsync(ctx.db, input.id);
       await throwIfGroupNameIsReservedAsync(ctx.db, input.id);
@@ -312,6 +375,16 @@ export const groupRouter = createTRPCRouter({
   addMember: permissionRequiredProcedure
     .requiresPermission("admin")
     .input(groupUserSchema)
+    .output(z.void())
+    .meta({
+      openapi: {
+        method: "POST",
+        path: "/api/groups/{groupId}/members/{userId}",
+        tags: ["groups"],
+        protect: true,
+        summary: "Add member to group",
+      },
+    })
     .mutation(async ({ input, ctx }) => {
       await throwIfGroupNotFoundAsync(ctx.db, input.groupId);
       await throwIfGroupNameIsReservedAsync(ctx.db, input.groupId);
@@ -328,6 +401,8 @@ export const groupRouter = createTRPCRouter({
         });
       }
 
+      // TODO: Create another pr to only allow adding users with provider=credentials
+
       await ctx.db.insert(groupMembers).values({
         groupId: input.groupId,
         userId: input.userId,
@@ -336,6 +411,16 @@ export const groupRouter = createTRPCRouter({
   removeMember: permissionRequiredProcedure
     .requiresPermission("admin")
     .input(groupUserSchema)
+    .output(z.void())
+    .meta({
+      openapi: {
+        method: "DELETE",
+        path: "/api/groups/{groupId}/members/{userId}",
+        tags: ["groups"],
+        protect: true,
+        summary: "Remove member from group",
+      },
+    })
     .mutation(async ({ input, ctx }) => {
       await throwIfGroupNotFoundAsync(ctx.db, input.groupId);
       await throwIfGroupNameIsReservedAsync(ctx.db, input.groupId);

packages/api/src/router/item/item-router.ts

@@ -0,0 +1,366 @@
+import { TRPCError } from "@trpc/server";
+import SuperJSON from "superjson";
+import z from "zod";
+
+import { createId, objectEntries } from "@homarr/common";
+import type { InferInsertModel } from "@homarr/db";
+import { and, eq, handleTransactionsAsync } from "@homarr/db";
+import { createDbInsertCollectionWithoutTransaction } from "@homarr/db/collection";
+import { boards, itemLayouts, items } from "@homarr/db/schema";
+import { selectItemLayoutSchema, selectitemSchema } from "@homarr/db/validationSchemas";
+import type { WidgetKind } from "@homarr/definitions";
+import { widgetKinds } from "@homarr/definitions";
+import { byIdSchema } from "@homarr/validation/common";
+import { zodEnumFromArray } from "@homarr/validation/enums";
+import { itemAdvancedOptionsSchema } from "@homarr/validation/shared";
+
+import { reduceWidgetOptionsWithDefaultValues, widgetImports } from "../../../../widgets/src";
+import type { WidgetOptionDefinition } from "../../../../widgets/src/options";
+import { convertIntersectionToZodObject } from "../../schema-merger";
+import { createTRPCRouter, protectedProcedure } from "../../trpc";
+import { throwIfActionForbiddenAsync } from "../board/board-access";
+
+const createItemOptionsSchema = (kind: WidgetKind): z.ZodObject =>
+  z.object(
+    objectEntries(
+      widgetImports[kind].definition.createOptions({
+        enableStatusByDefault: true,
+        firstDayOfWeek: 1,
+        forceDisableStatus: false,
+      }),
+    ).reduce(
+      (previous, [key, value]: [string, WidgetOptionDefinition]) => {
+        previous[key] = value.validate;
+        return previous;
+      },
+      {} as Record<string, z.ZodType>,
+    ),
+  );
+
+const outputItemSchema = z.union([
+  ...widgetKinds.map((kind) =>
+    z
+      .object({
+        kind: z.literal(kind),
+        options: createItemOptionsSchema(kind),
+        advancedOptions: itemAdvancedOptionsSchema,
+        layouts: z.array(selectItemLayoutSchema.omit({ itemId: true })),
+      })
+      .and(
+        selectitemSchema.pick({
+          id: true,
+          boardId: true,
+        }),
+      ),
+  ),
+]);
+
+const manageItemSchema = z.object({
+  boardId: z.string(),
+  kind: zodEnumFromArray(widgetKinds),
+  options: z.record(z.string(), z.unknown().optional()),
+  advancedOptions: itemAdvancedOptionsSchema,
+  layouts: z.array(selectItemLayoutSchema.omit({ itemId: true })),
+});
+
+export const itemsRouter = createTRPCRouter({
+  getAll: protectedProcedure
+    .input(
+      z.object({
+        boardId: z.string(),
+      }),
+    )
+    .output(z.array(outputItemSchema))
+    .meta({
+      openapi: {
+        method: "GET",
+        path: "/api/boards/{boardId}/items",
+        tags: ["items"],
+        protect: true,
+        summary: "Retrieve all items for board",
+      },
+    })
+    .query(async ({ ctx, input }) => {
+      const board = await ctx.db.query.boards.findFirst({
+        where: (fields, { eq }) => eq(fields.id, input.boardId),
+        with: {
+          items: {
+            with: {
+              layouts: true,
+            },
+          },
+        },
+      });
+
+      const error = new TRPCError({
+        code: "NOT_FOUND",
+        message: "Board not found",
+      });
+
+      if (!board) throw error;
+      await throwIfActionForbiddenAsync(ctx, eq(boards.id, input.boardId), "view", error);
+
+      return board.items.map((item) => ({
+        ...item,
+        options: reduceWidgetOptionsWithDefaultValues(
+          item.kind,
+          {
+            enableStatusByDefault: true,
+            firstDayOfWeek: 1,
+            forceDisableStatus: false,
+          },
+          SuperJSON.parse(item.options),
+        ),
+        advancedOptions: itemAdvancedOptionsSchema.parse(SuperJSON.parse(item.advancedOptions)),
+        layouts: item.layouts.map(({ itemId: _, ...layout }) => layout),
+      }));
+    }),
+  createItem: protectedProcedure
+    .input(manageItemSchema)
+    .output(outputItemSchema)
+    .meta({
+      openapi: {
+        method: "POST",
+        path: "/api/items",
+        tags: ["items"],
+        protect: true,
+        summary: "Create item on board",
+        description: "Options available can be viewed in response options object. Input options are optional",
+      },
+    })
+    .mutation(async ({ ctx, input }) => {
+      const board = await ctx.db.query.boards.findFirst({
+        where: (fields, { eq }) => eq(fields.id, input.boardId),
+      });
+
+      const error = new TRPCError({
+        code: "NOT_FOUND",
+        message: "Board not found",
+      });
+
+      if (!board) throw error;
+      await throwIfActionForbiddenAsync(ctx, eq(boards.id, board.id), "modify", error);
+
+      const itemOptionsSchema = createItemOptionsSchema(input.kind);
+      const fullOptions = reduceWidgetOptionsWithDefaultValues(
+        input.kind,
+        { enableStatusByDefault: true, firstDayOfWeek: 1, forceDisableStatus: false },
+        input.options,
+      );
+      const result = await itemOptionsSchema.safeParseAsync(fullOptions);
+      if (!result.success) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "Failed to parse item options",
+          cause: result.error,
+        });
+      }
+
+      const item = {
+        id: createId(),
+        boardId: input.boardId,
+        kind: input.kind,
+        advancedOptions: input.advancedOptions,
+        options: result.data,
+      };
+
+      const itemInsert: InferInsertModel<typeof items> = {
+        ...item,
+        advancedOptions: SuperJSON.stringify(item.advancedOptions),
+        options: SuperJSON.stringify(item.options),
+      };
+      const layoutInserts: InferInsertModel<typeof itemLayouts>[] = input.layouts.map((layout) => ({
+        ...layout,
+        itemId: item.id,
+      }));
+
+      const insertCollection = createDbInsertCollectionWithoutTransaction(["items", "itemLayouts"]);
+      insertCollection.items.push(itemInsert);
+      insertCollection.itemLayouts.push(...layoutInserts);
+      await insertCollection.insertAllAsync(ctx.db);
+
+      return {
+        ...item,
+        layouts: layoutInserts,
+      };
+    }),
+  getItem: protectedProcedure
+    .input(byIdSchema)
+    .output(outputItemSchema)
+    .meta({
+      openapi: {
+        method: "GET",
+        path: "/api/items/{id}",
+        tags: ["items"],
+        protect: true,
+        summary: "Retrieve item from a board",
+      },
+    })
+    .query(async ({ ctx, input }) => {
+      const item = await ctx.db.query.items.findFirst({
+        where: (fields, { eq }) => eq(fields.id, input.id),
+        with: {
+          layouts: true,
+        },
+      });
+
+      const error = new TRPCError({
+        code: "NOT_FOUND",
+        message: "Item not found",
+      });
+
+      if (!item) throw error;
+      await throwIfActionForbiddenAsync(ctx, eq(boards.id, item.boardId), "view", error);
+
+      return {
+        ...item,
+        options: reduceWidgetOptionsWithDefaultValues(
+          item.kind,
+          {
+            enableStatusByDefault: true,
+            firstDayOfWeek: 1,
+            forceDisableStatus: false,
+          },
+          SuperJSON.parse(item.options),
+        ),
+        advancedOptions: itemAdvancedOptionsSchema.parse(SuperJSON.parse(item.advancedOptions)),
+        layouts: item.layouts.map(({ itemId: _, ...layout }) => layout),
+      };
+    }),
+  updateItem: protectedProcedure
+    .input(convertIntersectionToZodObject(manageItemSchema.omit({ boardId: true, kind: true }).and(byIdSchema)))
+    .output(outputItemSchema)
+    .meta({
+      openapi: {
+        method: "PUT",
+        path: "/api/items/{id}",
+        tags: ["items"],
+        protect: true,
+        summary: "Update an item on the board",
+      },
+    })
+    .mutation(async ({ ctx, input }) => {
+      const item = await ctx.db.query.items.findFirst({
+        where: (fields, { eq }) => eq(fields.id, input.id),
+        with: {
+          layouts: true,
+        },
+      });
+
+      const error = new TRPCError({
+        code: "NOT_FOUND",
+        message: "Item not found",
+      });
+      if (!item) throw error;
+
+      await throwIfActionForbiddenAsync(ctx, eq(boards.id, item.boardId), "modify", error);
+
+      const previousOptions = SuperJSON.parse<Record<string, unknown>>(item.options);
+      const combinedOptions = {
+        ...previousOptions,
+        ...input.options,
+      };
+      const itemOptionsSchema = createItemOptionsSchema(item.kind);
+      const fullOptions = reduceWidgetOptionsWithDefaultValues(
+        item.kind,
+        { enableStatusByDefault: true, firstDayOfWeek: 1, forceDisableStatus: false },
+        combinedOptions,
+      );
+      const optionsResult = await itemOptionsSchema.safeParseAsync(fullOptions);
+      if (!optionsResult.success) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "Failed to parse item options",
+          cause: optionsResult.error,
+        });
+      }
+
+      await handleTransactionsAsync(ctx.db, {
+        async handleAsync(db, schema) {
+          await db.transaction(async (transaction) => {
+            await transaction
+              .update(schema.items)
+              .set({
+                advancedOptions: SuperJSON.stringify(input.advancedOptions),
+                options: SuperJSON.stringify(optionsResult),
+              })
+              .where(eq(schema.items.id, input.id));
+
+            for (const itemLayout of input.layouts) {
+              await transaction
+                .update(schema.itemLayouts)
+                .set({
+                  height: itemLayout.height,
+                  width: itemLayout.width,
+                  sectionId: itemLayout.sectionId,
+                  xOffset: itemLayout.xOffset,
+                  yOffset: itemLayout.yOffset,
+                })
+                .where(
+                  and(eq(schema.itemLayouts.itemId, input.id), eq(schema.itemLayouts.layoutId, itemLayout.layoutId)),
+                );
+            }
+          });
+        },
+        handleSync(db) {
+          db.transaction((transaction) => {
+            transaction
+              .update(items)
+              .set({
+                advancedOptions: SuperJSON.stringify(input.advancedOptions),
+                options: SuperJSON.stringify(optionsResult),
+              })
+              .where(eq(items.id, input.id));
+
+            for (const itemLayout of input.layouts) {
+              transaction
+                .update(itemLayouts)
+                .set({
+                  height: itemLayout.height,
+                  width: itemLayout.width,
+                  sectionId: itemLayout.sectionId,
+                  xOffset: itemLayout.xOffset,
+                  yOffset: itemLayout.yOffset,
+                })
+                .where(and(eq(itemLayouts.itemId, input.id), eq(itemLayouts.layoutId, itemLayout.layoutId)));
+            }
+          });
+        },
+      });
+
+      return {
+        id: input.id,
+        kind: item.kind,
+        boardId: item.boardId,
+        advancedOptions: input.advancedOptions,
+        options: optionsResult,
+        layouts: input.layouts,
+      };
+    }),
+  deleteItem: protectedProcedure
+    .input(byIdSchema)
+    .output(z.void())
+    .meta({
+      openapi: {
+        method: "DELETE",
+        path: "/api/items/{id}",
+        tags: ["items"],
+        protect: true,
+        summary: "Delete an item from board",
+      },
+    })
+    .mutation(async ({ ctx, input }) => {
+      const item = await ctx.db.query.items.findFirst({
+        where: (fields, { eq }) => eq(fields.id, input.id),
+      });
+      const error = new TRPCError({
+        code: "NOT_FOUND",
+        message: "Item not found",
+      });
+      if (!item) throw error;
+
+      await throwIfActionForbiddenAsync(ctx, eq(boards.id, item.boardId), "modify", error);
+
+      await ctx.db.delete(items).where(eq(items.id, input.id));
+    }),
+});

packages/api/src/router/location.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { fetchWithTimeout } from "@homarr/common";
+import { fetchWithTimeoutAsync } from "@homarr/core/infrastructure/http/timeout";
 
 import { createTRPCRouter, publicProcedure } from "../trpc";
 
@@ -36,7 +36,7 @@ export const locationRouter = createTRPCRouter({
     .input(locationSearchCityInput)
     .output(locationSearchCityOutput)
     .query(async ({ input }) => {
-      const res = await fetchWithTimeout(`https://geocoding-api.open-meteo.com/v1/search?name=${input.query}`);
+      const res = await fetchWithTimeoutAsync(`https://geocoding-api.open-meteo.com/v1/search?name=${input.query}`);
       return (await res.json()) as z.infer<typeof locationSearchCityOutput>;
     }),
 });

packages/auth/package.json

@@ -25,7 +25,6 @@
   "dependencies": {
     "@auth/core": "^0.41.1",
     "@auth/drizzle-adapter": "^1.11.1",
-    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
     "@homarr/db": "workspace:^0.1.0",

packages/auth/providers/oidc/oidc-provider.ts

@@ -3,7 +3,7 @@ import type { OIDCConfig } from "@auth/core/providers";
 import type { Profile } from "@auth/core/types";
 import { customFetch } from "next-auth";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import { env } from "../../env";
 import { createRedirectUri } from "../../redirect";

packages/certificates/eslint.config.js

@@ -1,9 +0,0 @@
-import baseConfig from "@homarr/eslint-config/base";
-
-/** @type {import('typescript-eslint').Config} */
-export default [
-  {
-    ignores: [],
-  },
-  ...baseConfig,
-];

packages/certificates/package.json

@@ -1,36 +0,0 @@
-{
-  "name": "@homarr/certificates",
-  "version": "0.1.0",
-  "private": true,
-  "license": "Apache-2.0",
-  "type": "module",
-  "exports": {
-    "./server": "./src/server.ts"
-  },
-  "typesVersions": {
-    "*": {
-      "*": [
-        "src/*"
-      ]
-    }
-  },
-  "scripts": {
-    "clean": "rm -rf .turbo node_modules",
-    "format": "prettier --check . --ignore-path ../../.gitignore",
-    "lint": "eslint",
-    "typecheck": "tsc --noEmit"
-  },
-  "prettier": "@homarr/prettier-config",
-  "dependencies": {
-    "@homarr/common": "workspace:^0.1.0",
-    "@homarr/db": "workspace:^0.1.0",
-    "undici": "7.16.0"
-  },
-  "devDependencies": {
-    "@homarr/eslint-config": "workspace:^0.2.0",
-    "@homarr/prettier-config": "workspace:^0.1.0",
-    "@homarr/tsconfig": "workspace:^0.1.0",
-    "eslint": "^9.39.2",
-    "typescript": "^5.9.3"
-  }
-}

packages/certificates/src/server.ts

@@ -1,141 +0,0 @@
-import { X509Certificate } from "node:crypto";
-import fsSync from "node:fs";
-import fs from "node:fs/promises";
-import type { AgentOptions } from "node:https";
-import { Agent as HttpsAgent } from "node:https";
-import path from "node:path";
-import { checkServerIdentity, rootCertificates } from "node:tls";
-import axios from "axios";
-import type { RequestInfo, RequestInit, Response } from "undici";
-import { fetch } from "undici";
-
-import { env } from "@homarr/common/env";
-import { LoggingAgent } from "@homarr/common/server";
-import type { InferSelectModel } from "@homarr/db";
-import { db } from "@homarr/db";
-import type { trustedCertificateHostnames } from "@homarr/db/schema";
-
-const getCertificateFolder = () => {
-  if (env.NODE_ENV !== "production") return process.env.LOCAL_CERTIFICATE_PATH;
-  return process.env.LOCAL_CERTIFICATE_PATH ?? path.join("/appdata", "trusted-certificates");
-};
-
-export const loadCustomRootCertificatesAsync = async () => {
-  const folder = getCertificateFolder();
-
-  if (!folder) {
-    return [];
-  }
-
-  if (!fsSync.existsSync(folder)) {
-    await fs.mkdir(folder, { recursive: true });
-  }
-
-  const dirContent = await fs.readdir(folder);
-  return await Promise.all(
-    dirContent
-      .filter((file) => file.endsWith(".crt") || file.endsWith(".pem"))
-      .map(async (file) => ({
-        content: await fs.readFile(path.join(folder, file), "utf8"),
-        fileName: file,
-      })),
-  );
-};
-
-export const removeCustomRootCertificateAsync = async (fileName: string) => {
-  const folder = getCertificateFolder();
-  if (!folder) {
-    return null;
-  }
-
-  const existingFiles = await fs.readdir(folder, { withFileTypes: true });
-  if (!existingFiles.some((file) => file.isFile() && file.name === fileName)) {
-    throw new Error(`File ${fileName} does not exist`);
-  }
-
-  const fullPath = path.join(folder, fileName);
-  const content = await fs.readFile(fullPath, "utf8");
-
-  await fs.rm(fullPath);
-  try {
-    return new X509Certificate(content);
-  } catch {
-    return null;
-  }
-};
-
-export const addCustomRootCertificateAsync = async (fileName: string, content: string) => {
-  const folder = getCertificateFolder();
-  if (!folder) {
-    throw new Error(
-      "When you want to use custom certificates locally you need to set LOCAL_CERTIFICATE_PATH to an absolute path",
-    );
-  }
-
-  if (fileName.includes("/")) {
-    throw new Error("Invalid file name");
-  }
-
-  await fs.writeFile(path.join(folder, fileName), content);
-};
-
-export const getTrustedCertificateHostnamesAsync = async () => {
-  return await db.query.trustedCertificateHostnames.findMany();
-};
-
-export const getAllTrustedCertificatesAsync = async () => {
-  const customCertificates = await loadCustomRootCertificatesAsync();
-  return rootCertificates.concat(customCertificates.map((cert) => cert.content));
-};
-
-export const createCustomCheckServerIdentity = (
-  trustedHostnames: InferSelectModel<typeof trustedCertificateHostnames>[],
-): typeof checkServerIdentity => {
-  return (hostname, peerCertificate) => {
-    const matchingTrustedHostnames = trustedHostnames.filter(
-      (cert) => cert.thumbprint === peerCertificate.fingerprint256,
-    );
-
-    // We trust the certificate if we have a matching hostname
-    if (matchingTrustedHostnames.some((cert) => cert.hostname === hostname)) return undefined;
-
-    return checkServerIdentity(hostname, peerCertificate);
-  };
-};
-
-export const createCertificateAgentAsync = async (override?: {
-  ca: string | string[];
-  checkServerIdentity: typeof checkServerIdentity;
-}) => {
-  return new LoggingAgent({
-    connect: override ?? {
-      ca: await getAllTrustedCertificatesAsync(),
-      checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
-    },
-  });
-};
-
-export const createHttpsAgentAsync = async (override?: Pick<AgentOptions, "ca" | "checkServerIdentity">) => {
-  return new HttpsAgent(
-    override ?? {
-      ca: await getAllTrustedCertificatesAsync(),
-      checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
-    },
-  );
-};
-
-export const createAxiosCertificateInstanceAsync = async (
-  override?: Pick<AgentOptions, "ca" | "checkServerIdentity">,
-) => {
-  return axios.create({
-    httpsAgent: await createHttpsAgentAsync(override),
-  });
-};
-
-export const fetchWithTrustedCertificatesAsync = async (url: RequestInfo, options?: RequestInit): Promise<Response> => {
-  const agent = await createCertificateAgentAsync(undefined);
-  return fetch(url, {
-    ...options,
-    dispatcher: agent,
-  });
-};

packages/certificates/tsconfig.json

@@ -1,8 +0,0 @@
-{
-  "extends": "@homarr/tsconfig/base.json",
-  "compilerOptions": {
-    "tsBuildInfoFile": "node_modules/.cache/tsbuildinfo.json"
-  },
-  "include": ["*.ts", "src"],
-  "exclude": ["node_modules"]
-}

packages/common/env.ts

@@ -24,12 +24,10 @@ export const env = createEnv({
         message: `SECRET_ENCRYPTION_KEY must only contain hex characters${errorSuffix}`,
       }),
     NO_EXTERNAL_CONNECTION: createBooleanSchema(false),
-    ENABLE_DNS_CACHING: createBooleanSchema(false),
   },
   runtimeEnv: {
     SECRET_ENCRYPTION_KEY: process.env.SECRET_ENCRYPTION_KEY,
     NODE_ENV: process.env.NODE_ENV,
     NO_EXTERNAL_CONNECTION: process.env.NO_EXTERNAL_CONNECTION,
-    ENABLE_DNS_CACHING: process.env.ENABLE_DNS_CACHING,
   },
 });

packages/common/package.json

@@ -8,7 +8,6 @@
     ".": "./index.ts",
     "./types": "./src/types.ts",
     "./server": "./src/server.ts",
-    "./init-dns": "./src/dns.ts",
     "./client": "./src/client.ts",
     "./env": "./env.ts"
   },
@@ -30,7 +29,6 @@
     "@homarr/core": "workspace:^0.1.0",
     "@paralleldrive/cuid2": "^3.1.0",
     "dayjs": "^1.11.19",
-    "dns-caching": "^0.2.9",
     "next": "16.0.10",
     "octokit": "^5.0.5",
     "react": "19.2.3",

packages/common/src/errors/http/handlers/http-error-handler.ts

@@ -1,11 +1,11 @@
-import type { Logger } from "@homarr/core/infrastructure/logs";
+import type { ILogger } from "@homarr/core/infrastructure/logs";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { AnyRequestError } from "../request-error";
 import type { ResponseError } from "../response-error";
 
 export abstract class HttpErrorHandler {
-  protected logger: Logger;
+  protected logger: ILogger;
 
   constructor(type: string) {
     this.logger = createLogger({ module: "httpErrorHandler", type });

packages/common/src/errors/parse/handlers/parse-error-handler.ts

@@ -1,10 +1,10 @@
-import type { Logger } from "@homarr/core/infrastructure/logs";
+import type { ILogger } from "@homarr/core/infrastructure/logs";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { ParseError } from "../parse-error";
 
 export abstract class ParseErrorHandler {
-  protected logger: Logger;
+  protected logger: ILogger;
   constructor(type: string) {
     this.logger = createLogger({ module: "parseErrorHandler", type });
   }

packages/common/src/fetch-agent.ts

@@ -1,41 +0,0 @@
-import type { Dispatcher } from "undici";
-import { Agent } from "undici";
-
-import { createLogger } from "@homarr/core/infrastructure/logs";
-
-// The below import statement initializes dns-caching
-import "./dns";
-
-const logger = createLogger({ module: "fetchAgent" });
-
-export class LoggingAgent extends Agent {
-  constructor(...props: ConstructorParameters<typeof Agent>) {
-    super(...props);
-  }
-
-  dispatch(options: Dispatcher.DispatchOptions, handler: Dispatcher.DispatchHandler): boolean {
-    const path = options.path
-      .split("/")
-      .map((segment) => (segment.length >= 32 && !segment.startsWith("?") ? "REDACTED" : segment))
-      .join("/");
-    const url = new URL(`${options.origin as string}${path}`);
-
-    // The below code should prevent sensitive data from being logged as
-    // some integrations use query parameters for auth
-    url.searchParams.forEach((value, key) => {
-      if (value === "") return; // Skip empty values
-      if (/^-?\d{1,12}$/.test(value)) return; // Skip small numbers
-      if (value === "true" || value === "false") return; // Skip boolean values
-      if (/^[a-zA-Z]{1,12}$/.test(value)) return; // Skip short strings
-      if (/^\d{4}-\d{2}-\d{2}$/.test(value)) return; // Skip dates
-      if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) return; // Skip date times
-
-      url.searchParams.set(key, "REDACTED");
-    });
-
-    logger.debug(
-      `Dispatching request ${url.toString().replaceAll("=&", "&")} (${Object.keys(options.headers ?? {}).length} headers)`,
-    );
-    return super.dispatch(options, handler);
-  }
-}

packages/common/src/fetch-with-timeout.ts

@@ -1,16 +0,0 @@
-/**
- * Same as fetch, but with a timeout of 10 seconds.
- * https://stackoverflow.com/questions/46946380/fetch-api-request-timeout
- * @param param0 fetch arguments
- * @returns fetch response
- */
-export const fetchWithTimeout = (...[url, requestInit]: Parameters<typeof fetch>) => {
-  const controller = new AbortController();
-
-  // 10 seconds timeout:
-  const timeoutId = setTimeout(() => controller.abort(), 10000);
-
-  return fetch(url, { signal: controller.signal, ...requestInit }).finally(() => {
-    clearTimeout(timeoutId);
-  });
-};

packages/common/src/index.ts

@@ -9,7 +9,6 @@ export * from "./id";
 export * from "./url";
 export * from "./number";
 export * from "./error";
-export * from "./fetch-with-timeout";
 export * from "./theme";
 export * from "./function";
 export * from "./id";

packages/common/src/server.ts

@@ -1,5 +1,4 @@
 export * from "./security";
 export * from "./encryption";
 export * from "./user-agent";
-export * from "./fetch-agent";
 export * from "./errors";

packages/core/package.json

@@ -13,7 +13,14 @@
     "./infrastructure/logs/error": "./src/infrastructure/logs/error.ts",
     "./infrastructure/db": "./src/infrastructure/db/index.ts",
     "./infrastructure/db/env": "./src/infrastructure/db/env.ts",
-    "./infrastructure/db/constants": "./src/infrastructure/db/constants.ts"
+    "./infrastructure/db/constants": "./src/infrastructure/db/constants.ts",
+    "./infrastructure/certificates": "./src/infrastructure/certificates/index.ts",
+    "./infrastructure/certificates/hostnames/db/sqlite": "./src/infrastructure/certificates/hostnames/db/sqlite.ts",
+    "./infrastructure/certificates/hostnames/db/mysql": "./src/infrastructure/certificates/hostnames/db/mysql.ts",
+    "./infrastructure/certificates/hostnames/db/postgresql": "./src/infrastructure/certificates/hostnames/db/postgresql.ts",
+    "./infrastructure/dns/init": "./src/infrastructure/dns/init.ts",
+    "./infrastructure/http": "./src/infrastructure/http/index.ts",
+    "./infrastructure/http/timeout": "./src/infrastructure/http/timeout.ts"
   },
   "typesVersions": {
     "*": {
@@ -32,6 +39,7 @@
   "dependencies": {
     "@t3-oss/env-nextjs": "^0.13.8",
     "better-sqlite3": "^12.5.0",
+    "dns-caching": "^0.2.9",
     "drizzle-orm": "^0.45.1",
     "ioredis": "5.8.2",
     "mysql2": "3.15.3",

packages/core/src/infrastructure/certificates/files/index.ts

@@ -0,0 +1,74 @@
+import { X509Certificate } from "node:crypto";
+import fsSync from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { rootCertificates } from "node:tls";
+
+const getCertificateFolder = () => {
+  if (process.env.NODE_ENV !== "production") return process.env.LOCAL_CERTIFICATE_PATH;
+  return process.env.LOCAL_CERTIFICATE_PATH ?? path.join("/appdata", "trusted-certificates");
+};
+
+export const loadCustomRootCertificatesAsync = async () => {
+  const folder = getCertificateFolder();
+
+  if (!folder) {
+    return [];
+  }
+
+  if (!fsSync.existsSync(folder)) {
+    await fs.mkdir(folder, { recursive: true });
+  }
+
+  const dirContent = await fs.readdir(folder);
+  return await Promise.all(
+    dirContent
+      .filter((file) => file.endsWith(".crt") || file.endsWith(".pem"))
+      .map(async (file) => ({
+        content: await fs.readFile(path.join(folder, file), "utf8"),
+        fileName: file,
+      })),
+  );
+};
+
+export const getAllTrustedCertificatesAsync = async () => {
+  const customCertificates = await loadCustomRootCertificatesAsync();
+  return rootCertificates.concat(customCertificates.map((cert) => cert.content));
+};
+
+export const removeCustomRootCertificateAsync = async (fileName: string) => {
+  const folder = getCertificateFolder();
+  if (!folder) {
+    return null;
+  }
+
+  const existingFiles = await fs.readdir(folder, { withFileTypes: true });
+  if (!existingFiles.some((file) => file.isFile() && file.name === fileName)) {
+    throw new Error(`File ${fileName} does not exist`);
+  }
+
+  const fullPath = path.join(folder, fileName);
+  const content = await fs.readFile(fullPath, "utf8");
+
+  await fs.rm(fullPath);
+  try {
+    return new X509Certificate(content);
+  } catch {
+    return null;
+  }
+};
+
+export const addCustomRootCertificateAsync = async (fileName: string, content: string) => {
+  const folder = getCertificateFolder();
+  if (!folder) {
+    throw new Error(
+      "When you want to use custom certificates locally you need to set LOCAL_CERTIFICATE_PATH to an absolute path",
+    );
+  }
+
+  if (fileName.includes("/")) {
+    throw new Error("Invalid file name");
+  }
+
+  await fs.writeFile(path.join(folder, fileName), content);
+};

packages/core/src/infrastructure/certificates/hostnames/db/mysql.ts

@@ -0,0 +1,15 @@
+import { mysqlTable, primaryKey, text, varchar } from "drizzle-orm/mysql-core";
+
+export const trustedCertificateHostnames = mysqlTable(
+  "trusted_certificate_hostname",
+  {
+    hostname: varchar({ length: 256 }).notNull(),
+    thumbprint: varchar({ length: 128 }).notNull(),
+    certificate: text().notNull(),
+  },
+  (table) => ({
+    compoundKey: primaryKey({
+      columns: [table.hostname, table.thumbprint],
+    }),
+  }),
+);

packages/core/src/infrastructure/certificates/hostnames/db/postgresql.ts

@@ -0,0 +1,15 @@
+import { pgTable, primaryKey, text, varchar } from "drizzle-orm/pg-core";
+
+export const trustedCertificateHostnames = pgTable(
+  "trusted_certificate_hostname",
+  {
+    hostname: varchar({ length: 256 }).notNull(),
+    thumbprint: varchar({ length: 128 }).notNull(),
+    certificate: text().notNull(),
+  },
+  (table) => ({
+    compoundKey: primaryKey({
+      columns: [table.hostname, table.thumbprint],
+    }),
+  }),
+);

packages/core/src/infrastructure/certificates/hostnames/db/schema.ts

@@ -0,0 +1,10 @@
+import { createSchema } from "../../../db";
+import * as mysql from "./mysql";
+import * as postgresql from "./postgresql";
+import * as sqlite from "./sqlite";
+
+export const schema = createSchema({
+  "better-sqlite3": () => sqlite,
+  mysql2: () => mysql,
+  "node-postgres": () => postgresql,
+});

packages/core/src/infrastructure/certificates/hostnames/db/sqlite.ts

@@ -0,0 +1,15 @@
+import { primaryKey, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+export const trustedCertificateHostnames = sqliteTable(
+  "trusted_certificate_hostname",
+  {
+    hostname: text().notNull(),
+    thumbprint: text().notNull(),
+    certificate: text().notNull(),
+  },
+  (table) => ({
+    compoundKey: primaryKey({
+      columns: [table.hostname, table.thumbprint],
+    }),
+  }),
+);

packages/core/src/infrastructure/certificates/hostnames/index.ts

@@ -0,0 +1,12 @@
+import type { InferSelectModel } from "drizzle-orm";
+
+import { createDb } from "../../db";
+import { schema } from "./db/schema";
+
+const db = createDb(schema);
+
+export const getTrustedCertificateHostnamesAsync = async () => {
+  return await db.query.trustedCertificateHostnames.findMany();
+};
+
+export type TrustedCertificateHostname = InferSelectModel<typeof schema.trustedCertificateHostnames>;

packages/core/src/infrastructure/certificates/index.ts

@@ -0,0 +1,7 @@
+export { getTrustedCertificateHostnamesAsync } from "./hostnames";
+export {
+  addCustomRootCertificateAsync,
+  removeCustomRootCertificateAsync,
+  getAllTrustedCertificatesAsync,
+  loadCustomRootCertificatesAsync,
+} from "./files";

packages/core/src/infrastructure/dns/env.ts

@@ -0,0 +1,8 @@
+import { createBooleanSchema, createEnv } from "../env";
+
+export const dnsEnv = createEnv({
+  server: {
+    ENABLE_DNS_CACHING: createBooleanSchema(false),
+  },
+  experimental__runtimeEnv: process.env,
+});

packages/core/src/infrastructure/dns/init.ts

@@ -2,7 +2,7 @@ import { DnsCacheManager } from "dns-caching";
 
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
-import { env } from "../env";
+import { dnsEnv } from "./env";
 
 // Add global type augmentation for homarr
 declare global {
@@ -23,6 +23,6 @@ global.homarr.dnsCacheManager ??= new DnsCacheManager({
   logger,
 });
 
-if (env.ENABLE_DNS_CACHING) {
+if (dnsEnv.ENABLE_DNS_CACHING) {
   global.homarr.dnsCacheManager.initialize();
 }

packages/core/src/infrastructure/http/http-agent.ts

@@ -0,0 +1,72 @@
+import type { Dispatcher } from "undici";
+import { Agent } from "undici";
+
+import type { ILogger } from "@homarr/core/infrastructure/logs";
+import { createLogger } from "@homarr/core/infrastructure/logs";
+
+// The below import statement initializes dns-caching
+import "@homarr/core/infrastructure/dns/init";
+
+interface HttpAgentOptions extends Agent.Options {
+  logger?: ILogger;
+}
+
+export class UndiciHttpAgent extends Agent {
+  private logger: ILogger;
+
+  constructor(props?: HttpAgentOptions) {
+    super(props);
+
+    this.logger = props?.logger ?? createLogger({ module: "httpAgent" });
+  }
+
+  dispatch(options: Dispatcher.DispatchOptions, handler: Dispatcher.DispatchHandler): boolean {
+    this.logRequestDispatch(options);
+    return super.dispatch(options, handler);
+  }
+
+  private logRequestDispatch(options: Dispatcher.DispatchOptions) {
+    const path = this.redactPathParams(options.path);
+    let url = new URL(`${options.origin as string}${path}`);
+    url = this.redactSearchParams(url);
+
+    this.logger.debug(
+      `Dispatching request ${url.toString().replaceAll("=&", "&")} (${Object.keys(options.headers ?? {}).length} headers)`,
+    );
+  }
+
+  /**
+   * Redact path parameters that are longer than 32 characters
+   * This is to prevent sensitive data from being logged
+   * @param path path of the request
+   * @returns redacted path
+   */
+  private redactPathParams(path: string): string {
+    return path
+      .split("/")
+      .map((segment) => (segment.length >= 32 && !segment.startsWith("?") ? "REDACTED" : segment))
+      .join("/");
+  }
+
+  /**
+   * Redact sensitive search parameters from the URL.
+   * It allows certain patterns to remain unredacted.
+   * Like small numbers, booleans, short strings, dates, and date-times.
+   * Some integrations use query parameters for auth.
+   * @param url URL object of the request
+   * @returns redacted URL object
+   */
+  private redactSearchParams(url: URL): URL {
+    url.searchParams.forEach((value, key) => {
+      if (value === "") return; // Skip empty values
+      if (/^-?\d{1,12}$/.test(value)) return; // Skip small numbers
+      if (value === "true" || value === "false") return; // Skip boolean values
+      if (/^[a-zA-Z]{1,12}$/.test(value)) return; // Skip short strings
+      if (/^\d{4}-\d{2}-\d{2}$/.test(value)) return; // Skip dates
+      if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)) return; // Skip date times
+
+      url.searchParams.set(key, "REDACTED");
+    });
+    return url;
+  }
+}

packages/core/src/infrastructure/http/index.ts

@@ -0,0 +1,8 @@
+export { UndiciHttpAgent } from "./http-agent";
+export {
+  createAxiosCertificateInstanceAsync,
+  createCertificateAgentAsync,
+  createCustomCheckServerIdentity,
+  createHttpsAgentAsync,
+  fetchWithTrustedCertificatesAsync,
+} from "./request";

packages/core/src/infrastructure/http/request.ts

@@ -0,0 +1,82 @@
+import type { AgentOptions } from "node:https";
+import { Agent as HttpsAgent } from "node:https";
+import { checkServerIdentity } from "node:tls";
+import axios from "axios";
+import type { RequestInfo, RequestInit, Response } from "undici";
+import { fetch } from "undici";
+
+import {
+  getAllTrustedCertificatesAsync,
+  getTrustedCertificateHostnamesAsync,
+} from "@homarr/core/infrastructure/certificates";
+import { UndiciHttpAgent } from "@homarr/core/infrastructure/http";
+
+import type { TrustedCertificateHostname } from "../certificates/hostnames";
+import { withTimeoutAsync } from "./timeout";
+
+export const createCustomCheckServerIdentity = (
+  trustedHostnames: TrustedCertificateHostname[],
+): typeof checkServerIdentity => {
+  return (hostname, peerCertificate) => {
+    const matchingTrustedHostnames = trustedHostnames.filter(
+      (cert) => cert.thumbprint === peerCertificate.fingerprint256,
+    );
+
+    // We trust the certificate if we have a matching hostname
+    if (matchingTrustedHostnames.some((cert) => cert.hostname === hostname)) return undefined;
+
+    return checkServerIdentity(hostname, peerCertificate);
+  };
+};
+
+export const createCertificateAgentAsync = async (override?: {
+  ca: string | string[];
+  checkServerIdentity: typeof checkServerIdentity;
+}) => {
+  return new UndiciHttpAgent({
+    connect: override ?? {
+      ca: await getAllTrustedCertificatesAsync(),
+      checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
+    },
+  });
+};
+
+export const createHttpsAgentAsync = async (override?: Pick<AgentOptions, "ca" | "checkServerIdentity">) => {
+  return new HttpsAgent(
+    override ?? {
+      ca: await getAllTrustedCertificatesAsync(),
+      checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
+    },
+  );
+};
+
+export const createAxiosCertificateInstanceAsync = async (
+  override?: Pick<AgentOptions, "ca" | "checkServerIdentity">,
+) => {
+  return axios.create({
+    httpsAgent: await createHttpsAgentAsync(override),
+  });
+};
+
+export const fetchWithTrustedCertificatesAsync = async (
+  url: RequestInfo,
+  options?: RequestInit & { timeout?: number },
+): Promise<Response> => {
+  const agent = await createCertificateAgentAsync(undefined);
+  if (options?.timeout) {
+    return await withTimeoutAsync(
+      async (signal) =>
+        fetch(url, {
+          ...options,
+          signal,
+          dispatcher: agent,
+        }),
+      options.timeout,
+    );
+  }
+
+  return fetch(url, {
+    ...options,
+    dispatcher: agent,
+  });
+};

packages/core/src/infrastructure/http/timeout.ts

@@ -0,0 +1,19 @@
+import type { Response as UndiciResponse } from "undici";
+
+// https://stackoverflow.com/questions/46946380/fetch-api-request-timeout
+export const withTimeoutAsync = async <TResponse extends Response | UndiciResponse>(
+  callback: (signal: AbortSignal) => Promise<TResponse>,
+  timeout = 10000,
+) => {
+  const controller = new AbortController();
+
+  const timeoutId = setTimeout(() => controller.abort(), timeout);
+
+  return await callback(controller.signal).finally(() => {
+    clearTimeout(timeoutId);
+  });
+};
+
+export const fetchWithTimeoutAsync = async (...[url, requestInit]: Parameters<typeof fetch>) => {
+  return await withTimeoutAsync((signal) => fetch(url, { ...requestInit, signal }));
+};

packages/core/src/infrastructure/logs/index.ts

@@ -15,4 +15,12 @@ interface DefaultMetadata {
 }
 
 export const createLogger = (metadata: DefaultMetadata & Record<string, unknown>) => logger.child(metadata);
-export type Logger = winston.Logger;
+
+type LogMethod = ((message: string, metadata?: Record<string, unknown>) => void) | ((error: unknown) => void);
+
+export interface ILogger {
+  debug: LogMethod;
+  info: LogMethod;
+  warn: LogMethod;
+  error: LogMethod;
+}

packages/core/src/test/infrastructure/http/http-agent.spec.ts

@@ -1,9 +1,9 @@
 import type { Dispatcher } from "undici";
 import { describe, expect, test, vi } from "vitest";
 
-import * as logs from "@homarr/core/infrastructure/logs";
+import { UndiciHttpAgent } from "@homarr/core/infrastructure/http";
 
-import { LoggingAgent } from "../fetch-agent";
+import { TestLogger } from "../logs";
 
 vi.mock("undici", () => {
   return {
@@ -16,37 +16,28 @@ vi.mock("undici", () => {
   };
 });
 
-vi.mock("@homarr/core/infrastructure/logs", async () => {
-  const actual: typeof logs = await vi.importActual("@homarr/core/infrastructure/logs");
-  return {
-    ...actual,
-    createLogger: vi.fn().mockReturnValue({
-      debug: vi.fn(),
-    }),
-  };
-});
-
 const REDACTED = "REDACTED";
 
-const loggerMock = logs.createLogger({ module: "test" });
-
-describe("LoggingAgent should log all requests", () => {
+describe("UndiciHttpAgent should log all requests", () => {
   test("should log all requests", () => {
     // Arrange
-    const debugSpy = vi.spyOn(loggerMock, "debug");
-    const agent = new LoggingAgent();
+    const logger = new TestLogger();
+    const agent = new UndiciHttpAgent({ logger });
 
     // Act
     agent.dispatch({ origin: "https://homarr.dev", path: "/", method: "GET" }, {});
 
     // Assert
-    expect(debugSpy).toHaveBeenCalledWith("Dispatching request https://homarr.dev/ (0 headers)");
+    expect(logger.messages).toContainEqual({
+      level: "debug",
+      message: "Dispatching request https://homarr.dev/ (0 headers)",
+    });
   });
 
   test("should show amount of headers", () => {
     // Arrange
-    const debugSpy = vi.spyOn(loggerMock, "debug");
-    const agent = new LoggingAgent();
+    const logger = new TestLogger();
+    const agent = new UndiciHttpAgent({ logger });
 
     // Act
     agent.dispatch(
@@ -63,7 +54,7 @@ describe("LoggingAgent should log all requests", () => {
     );
 
     // Assert
-    expect(debugSpy).toHaveBeenCalledWith(expect.stringContaining("(2 headers)"));
+    expect(logger.messages.at(-1)?.message).toContain("(2 headers)");
   });
 
   test.each([
@@ -81,14 +72,14 @@ describe("LoggingAgent should log all requests", () => {
     [`/${"a".repeat(32)}/?param=123`, `/${REDACTED}/?param=123`],
   ])("should redact sensitive data in url https://homarr.dev%s", (path, expected) => {
     // Arrange
-    const debugSpy = vi.spyOn(loggerMock, "debug");
-    const agent = new LoggingAgent();
+    const logger = new TestLogger();
+    const agent = new UndiciHttpAgent({ logger });
 
     // Act
     agent.dispatch({ origin: "https://homarr.dev", path, method: "GET" }, {});
 
     // Assert
-    expect(debugSpy).toHaveBeenCalledWith(expect.stringContaining(` https://homarr.dev${expected} `));
+    expect(logger.messages.at(-1)?.message).toContain(` https://homarr.dev${expected} `);
   });
   test.each([
     ["empty", "/?empty"],
@@ -100,13 +91,13 @@ describe("LoggingAgent should log all requests", () => {
     ["date times", "/?datetime=2022-01-01T00:00:00.000Z"],
   ])("should not redact values that are %s", (_reason, path) => {
     // Arrange
-    const debugSpy = vi.spyOn(loggerMock, "debug");
-    const agent = new LoggingAgent();
+    const logger = new TestLogger();
+    const agent = new UndiciHttpAgent({ logger });
 
     // Act
     agent.dispatch({ origin: "https://homarr.dev", path, method: "GET" }, {});
 
     // Assert
-    expect(debugSpy).toHaveBeenCalledWith(expect.stringContaining(` https://homarr.dev${path} `));
+    expect(logger.messages.at(-1)?.message).toContain(` https://homarr.dev${path} `);
   });
 });

packages/core/src/test/infrastructure/logs/index.ts

@@ -0,0 +1,49 @@
+import type { ILogger } from "@homarr/core/infrastructure/logs";
+import type { LogLevel } from "@homarr/core/infrastructure/logs/constants";
+
+interface LogMessage {
+  level: LogLevel;
+  message: string;
+  meta?: Record<string, unknown>;
+}
+
+interface LogError {
+  level: LogLevel;
+  error: unknown;
+}
+
+type LogEntry = LogMessage | LogError;
+
+export class TestLogger implements ILogger {
+  public entries: LogEntry[] = [];
+  public get messages(): LogMessage[] {
+    return this.entries.filter((entry) => "message" in entry);
+  }
+  public get errors(): LogError[] {
+    return this.entries.filter((entry) => "error" in entry);
+  }
+
+  private log(level: LogLevel, param1: unknown, param2?: Record<string, unknown>): void {
+    if (typeof param1 === "string") {
+      this.entries.push({ level, message: param1, meta: param2 });
+    } else {
+      this.entries.push({ level, error: param1 });
+    }
+  }
+
+  debug(param1: unknown, param2?: Record<string, unknown>): void {
+    this.log("debug", param1, param2);
+  }
+
+  info(param1: unknown, param2?: Record<string, unknown>): void {
+    this.log("info", param1, param2);
+  }
+
+  warn(param1: unknown, param2?: Record<string, unknown>): void {
+    this.log("warn", param1, param2);
+  }
+
+  error(param1: unknown, param2?: Record<string, unknown>): void {
+    this.log("error", param1, param2);
+  }
+}

packages/db/schema/mysql.ts

@@ -46,6 +46,8 @@ const customBlob = customType<{ data: Buffer }>({
   },
 });
 
+export * from "@homarr/core/infrastructure/certificates/hostnames/db/mysql";
+
 export const apiKeys = mysqlTable("apiKey", {
   id: varchar({ length: 64 }).notNull().primaryKey(),
   apiKey: text().notNull(),
@@ -495,20 +497,6 @@ export const onboarding = mysqlTable("onboarding", {
   previousStep: varchar({ length: 64 }).$type<OnboardingStep>(),
 });
 
-export const trustedCertificateHostnames = mysqlTable(
-  "trusted_certificate_hostname",
-  {
-    hostname: varchar({ length: 256 }).notNull(),
-    thumbprint: varchar({ length: 128 }).notNull(),
-    certificate: text().notNull(),
-  },
-  (table) => ({
-    compoundKey: primaryKey({
-      columns: [table.hostname, table.thumbprint],
-    }),
-  }),
-);
-
 export const cronJobConfigurations = mysqlTable("cron_job_configuration", {
   name: varchar({ length: 256 }).notNull().primaryKey(),
   cronExpression: varchar({ length: 32 }).notNull(),

packages/db/schema/postgresql.ts

@@ -45,6 +45,8 @@ const customBlob = customType<{ data: Buffer }>({
   },
 });
 
+export * from "@homarr/core/infrastructure/certificates/hostnames/db/postgresql";
+
 export const apiKeys = pgTable("apiKey", {
   id: varchar({ length: 64 }).notNull().primaryKey(),
   apiKey: text().notNull(),
@@ -494,20 +496,6 @@ export const onboarding = pgTable("onboarding", {
   previousStep: varchar({ length: 64 }).$type<OnboardingStep>(),
 });
 
-export const trustedCertificateHostnames = pgTable(
-  "trusted_certificate_hostname",
-  {
-    hostname: varchar({ length: 256 }).notNull(),
-    thumbprint: varchar({ length: 128 }).notNull(),
-    certificate: text().notNull(),
-  },
-  (table) => ({
-    compoundKey: primaryKey({
-      columns: [table.hostname, table.thumbprint],
-    }),
-  }),
-);
-
 export const cronJobConfigurations = pgTable("cron_job_configuration", {
   name: varchar({ length: 256 }).notNull().primaryKey(),
   cronExpression: varchar({ length: 32 }).notNull(),

packages/db/schema/sqlite.ts

@@ -28,6 +28,8 @@ import type {
   WidgetKind,
 } from "@homarr/definitions";
 
+export * from "@homarr/core/infrastructure/certificates/hostnames/db/sqlite";
+
 export const apiKeys = sqliteTable("apiKey", {
   id: text().notNull().primaryKey(),
   apiKey: text().notNull(),
@@ -480,20 +482,6 @@ export const onboarding = sqliteTable("onboarding", {
   previousStep: text().$type<OnboardingStep>(),
 });
 
-export const trustedCertificateHostnames = sqliteTable(
-  "trusted_certificate_hostname",
-  {
-    hostname: text().notNull(),
-    thumbprint: text().notNull(),
-    certificate: text().notNull(),
-  },
-  (table) => ({
-    compoundKey: primaryKey({
-      columns: [table.hostname, table.thumbprint],
-    }),
-  }),
-);
-
 export const cronJobConfigurations = sqliteTable("cron_job_configuration", {
   name: text().notNull().primaryKey(),
   cronExpression: text().notNull(),

packages/db/validationSchemas.ts

@@ -1,9 +1,12 @@
-import { createSelectSchema } from "drizzle-zod";
+import { createInsertSchema, createSelectSchema } from "drizzle-zod";
 
-import { apps, boards, groups, invites, searchEngines, serverSettings, users } from "./schema";
+import { apps, boards, groups, invites, itemLayouts, items, searchEngines, serverSettings, users } from "./schema";
 
 export const selectAppSchema = createSelectSchema(apps);
 export const selectBoardSchema = createSelectSchema(boards);
+export const selectitemSchema = createSelectSchema(items);
+export const insertItemSchema = createInsertSchema(items);
+export const selectItemLayoutSchema = createSelectSchema(itemLayouts);
 export const selectGroupSchema = createSelectSchema(groups);
 export const selectInviteSchema = createSelectSchema(invites);
 export const selectSearchEnginesSchema = createSelectSchema(searchEngines);

packages/icons/src/repositories/github.icon-repository.ts

@@ -1,6 +1,6 @@
 import { parse } from "path";
 
-import { fetchWithTimeout } from "@homarr/common";
+import { fetchWithTimeoutAsync } from "@homarr/core/infrastructure/http/timeout";
 
 import type { IconRepositoryLicense } from "../types/icon-repository-license";
 import type { RepositoryIconGroup } from "../types/repository-icon-group";
@@ -23,7 +23,7 @@ export class GitHubIconRepository extends IconRepository {
       throw new Error("Repository URLs are required for this repository");
     }
 
-    const response = await fetchWithTimeout(this.repositoryIndexingUrl);
+    const response = await fetchWithTimeoutAsync(this.repositoryIndexingUrl);
     const listOfFiles = (await response.json()) as GitHubApiResponse;
 
     return {

packages/icons/src/repositories/jsdelivr.icon-repository.ts

@@ -1,6 +1,6 @@
 import { parse } from "path";
 
-import { fetchWithTimeout } from "@homarr/common";
+import { fetchWithTimeoutAsync } from "@homarr/core/infrastructure/http/timeout";
 
 import type { IconRepositoryLicense } from "../types/icon-repository-license";
 import type { RepositoryIconGroup } from "../types/repository-icon-group";
@@ -19,7 +19,7 @@ export class JsdelivrIconRepository extends IconRepository {
   }
 
   protected async getAllIconsInternalAsync(): Promise<RepositoryIconGroup> {
-    const response = await fetchWithTimeout(this.repositoryIndexingUrl);
+    const response = await fetchWithTimeoutAsync(this.repositoryIndexingUrl);
     const listOfFiles = (await response.json()) as JsdelivrApiResponse;
 
     return {

packages/image-proxy/package.json

@@ -22,7 +22,6 @@
   },
   "prettier": "@homarr/prettier-config",
   "dependencies": {
-    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
     "@homarr/redis": "workspace:^0.1.0",

packages/image-proxy/src/index.ts

@@ -1,8 +1,8 @@
 import bcrypt from "bcrypt";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { createId } from "@homarr/common";
 import { decryptSecret, encryptSecret } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
 import { createGetSetChannel } from "@homarr/redis";

packages/integrations/package.json

@@ -29,7 +29,6 @@
     "@ctrl/qbittorrent": "^9.11.0",
     "@ctrl/transmission": "^7.4.0",
     "@gitbeaker/rest": "^43.8.0",
-    "@homarr/certificates": "workspace:^0.1.0",
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
     "@homarr/db": "workspace:^0.1.0",

packages/integrations/src/adguard-home/adguard-home-integration.ts

@@ -1,5 +1,5 @@
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ParseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import type { IntegrationTestingInput } from "../base/integration";
 import { Integration } from "../base/integration";

packages/integrations/src/base/integration.ts

@@ -3,8 +3,8 @@ import type { AxiosInstance } from "axios";
 import type { Dispatcher } from "undici";
 import { fetch as undiciFetch } from "undici";
 
-import { createAxiosCertificateInstanceAsync, createCertificateAgentAsync } from "@homarr/certificates/server";
 import { removeTrailingSlash } from "@homarr/common";
+import { createAxiosCertificateInstanceAsync, createCertificateAgentAsync } from "@homarr/core/infrastructure/http";
 import type { IntegrationSecretKind } from "@homarr/definitions";
 
 import { HandleIntegrationErrors } from "./errors/decorator";

packages/integrations/src/base/test-connection/test-connection-service.ts

@@ -1,12 +1,12 @@
 import type { X509Certificate } from "node:crypto";
 import tls from "node:tls";
 
+import { getPortFromUrl } from "@homarr/common";
 import {
-  createCustomCheckServerIdentity,
   getAllTrustedCertificatesAsync,
   getTrustedCertificateHostnamesAsync,
-} from "@homarr/certificates/server";
-import { getPortFromUrl } from "@homarr/common";
+} from "@homarr/core/infrastructure/certificates";
+import { createCustomCheckServerIdentity } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationRequestErrorOfType } from "../errors/http/integration-request-error";

packages/integrations/src/codeberg/codeberg-integration.ts

@@ -1,6 +1,6 @@
 import type { RequestInit, Response } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationTestingInput } from "../base/integration";

packages/integrations/src/dashdot/dashdot-integration.ts

@@ -5,7 +5,7 @@ import "@homarr/redis";
 import dayjs from "dayjs";
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import { createChannelEventHistoryOld } from "../../../redis/src/lib/channel";
 import type { IntegrationTestingInput } from "../base/integration";

packages/integrations/src/docker-hub/docker-hub-integration.ts

@@ -1,7 +1,7 @@
 import type { fetch, RequestInit, Response } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationInput, IntegrationTestingInput } from "../base/integration";

packages/integrations/src/download-client/aria2/aria2-integration.ts

@@ -1,8 +1,8 @@
 import path from "path";
 import type { fetch as undiciFetch } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import { Integration } from "../../base/integration";
 import type { IntegrationTestingInput } from "../../base/integration";

packages/integrations/src/download-client/deluge/deluge-integration.ts

@@ -2,7 +2,7 @@ import { Deluge } from "@ctrl/deluge";
 import dayjs from "dayjs";
 import type { Dispatcher } from "undici";
 
-import { createCertificateAgentAsync } from "@homarr/certificates/server";
+import { createCertificateAgentAsync } from "@homarr/core/infrastructure/http";
 
 import { HandleIntegrationErrors } from "../../base/errors/decorator";
 import { integrationOFetchHttpErrorHandler } from "../../base/errors/http";

packages/integrations/src/download-client/nzbget/nzbget-integration.ts

@@ -1,8 +1,8 @@
 import dayjs from "dayjs";
 import type { fetch as undiciFetch } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import { Integration } from "../../base/integration";
 import type { IntegrationTestingInput } from "../../base/integration";

packages/integrations/src/download-client/qbittorrent/qbittorrent-integration.ts

@@ -2,7 +2,7 @@ import { QBittorrent } from "@ctrl/qbittorrent";
 import dayjs from "dayjs";
 import type { Dispatcher } from "undici";
 
-import { createCertificateAgentAsync } from "@homarr/certificates/server";
+import { createCertificateAgentAsync } from "@homarr/core/infrastructure/http";
 
 import { HandleIntegrationErrors } from "../../base/errors/decorator";
 import { integrationOFetchHttpErrorHandler } from "../../base/errors/http";

packages/integrations/src/download-client/sabnzbd/sabnzbd-integration.ts

@@ -2,8 +2,8 @@ import dayjs from "dayjs";
 import duration from "dayjs/plugin/duration";
 import type { fetch as undiciFetch } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import { Integration } from "../../base/integration";
 import type { IntegrationTestingInput } from "../../base/integration";

packages/integrations/src/download-client/transmission/transmission-integration.ts

@@ -2,7 +2,7 @@ import { Transmission } from "@ctrl/transmission";
 import dayjs from "dayjs";
 import type { Dispatcher } from "undici";
 
-import { createCertificateAgentAsync } from "@homarr/certificates/server";
+import { createCertificateAgentAsync } from "@homarr/core/infrastructure/http";
 
 import { HandleIntegrationErrors } from "../../base/errors/decorator";
 import { integrationOFetchHttpErrorHandler } from "../../base/errors/http";

packages/integrations/src/emby/emby-integration.ts

@@ -1,8 +1,8 @@
 import { BaseItemKind } from "@jellyfin/sdk/lib/generated-client/models";
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import type { IntegrationTestingInput } from "../base/integration";
 import { Integration } from "../base/integration";

packages/integrations/src/github-container-registry/github-container-registry-integration.ts

@@ -2,7 +2,7 @@ import { createAppAuth } from "@octokit/auth-app";
 import { Octokit, RequestError } from "octokit";
 import type { fetch } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import { HandleIntegrationErrors } from "../base/errors/decorator";

packages/integrations/src/github/github-integration.ts

@@ -2,7 +2,7 @@ import { createAppAuth } from "@octokit/auth-app";
 import { Octokit, RequestError as OctokitRequestError } from "octokit";
 import type { fetch } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import { HandleIntegrationErrors } from "../base/errors/decorator";

packages/integrations/src/gitlab/gitlab-integration.ts

@@ -3,7 +3,7 @@ import { createRequesterFn, defaultOptionsHandler } from "@gitbeaker/requester-u
 import type { FormattedResponse, RequestOptions, ResourceOptions } from "@gitbeaker/requester-utils";
 import { Gitlab } from "@gitbeaker/rest";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationTestingInput } from "../base/integration";

packages/integrations/src/homeassistant/homeassistant-integration.ts

@@ -1,7 +1,7 @@
 import z from "zod";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
 

packages/integrations/src/ical/ical-integration.ts

@@ -1,6 +1,6 @@
 import ICAL from "ical.js";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import type { IntegrationTestingInput } from "../base/integration";
 import { Integration } from "../base/integration";

packages/integrations/src/jellyfin/jellyfin-integration.ts

@@ -6,7 +6,7 @@ import { getUserApi } from "@jellyfin/sdk/lib/utils/api/user-api";
 import { getUserLibraryApi } from "@jellyfin/sdk/lib/utils/api/user-library-api";
 import type { AxiosInstance } from "axios";
 
-import { createAxiosCertificateInstanceAsync } from "@homarr/certificates/server";
+import { createAxiosCertificateInstanceAsync } from "@homarr/core/infrastructure/http";
 
 import { HandleIntegrationErrors } from "../base/errors/decorator";
 import { integrationAxiosHttpErrorHandler } from "../base/errors/http";

packages/integrations/src/linuxserverio/linuxserverio-integration.ts

@@ -1,4 +1,4 @@
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationTestingInput } from "../base/integration";

packages/integrations/src/media-organizer/lidarr/lidarr-integration.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import { Integration } from "../../base/integration";

packages/integrations/src/media-organizer/radarr/radarr-integration.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationTestingInput } from "../../base/integration";

packages/integrations/src/media-organizer/readarr/readarr-integration.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import { Integration } from "../../base/integration";

packages/integrations/src/media-organizer/sonarr/sonarr-integration.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import { Integration } from "../../base/integration";

packages/integrations/src/media-transcoding/tdarr-integration.ts

@@ -1,4 +1,4 @@
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import type { IntegrationTestingInput } from "../base/integration";
 import { Integration } from "../base/integration";

packages/integrations/src/nextcloud/nextcloud.integration.ts

@@ -6,7 +6,7 @@ import type { RequestInit as NodeFetchRequestInit } from "node-fetch";
 import * as ical from "node-ical";
 import { DAVClient } from "tsdav";
 
-import { createHttpsAgentAsync } from "@homarr/certificates/server";
+import { createHttpsAgentAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import { HandleIntegrationErrors } from "../base/errors/decorator";

packages/integrations/src/npm/npm-integration.ts

@@ -1,4 +1,4 @@
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import type { IntegrationTestingInput } from "../base/integration";
 import { Integration } from "../base/integration";

packages/integrations/src/ntfy/ntfy-integration.ts

@@ -1,5 +1,5 @@
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import { Integration } from "../base/integration";
 import type { IntegrationTestingInput } from "../base/integration";

packages/integrations/src/openmediavault/openmediavault-integration.ts

@@ -1,7 +1,7 @@
 import type { Headers, HeadersInit, fetch as undiciFetch, Response as UndiciResponse } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationInput, IntegrationTestingInput } from "../base/integration";

packages/integrations/src/opnsense/opnsense-integration.ts

@@ -1,5 +1,5 @@
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ParseError, ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import { createChannelEventHistoryOld } from "../../../redis/src/lib/channel";
 import type { IntegrationTestingInput } from "../base/integration";

packages/integrations/src/overseerr/overseerr-integration.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
 

packages/integrations/src/pi-hole/pi-hole-integration-factory.ts

@@ -1,5 +1,5 @@
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { removeTrailingSlash } from "@homarr/common";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import type { IntegrationInput } from "../base/integration";
 import { PiHoleIntegrationV5 } from "./v5/pi-hole-integration-v5";

packages/integrations/src/pi-hole/v5/pi-hole-integration-v5.ts

@@ -1,5 +1,5 @@
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import type { IntegrationTestingInput } from "../../base/integration";
 import { Integration } from "../../base/integration";

packages/integrations/src/pi-hole/v6/pi-hole-integration-v6.ts

@@ -1,8 +1,8 @@
 import type { fetch as undiciFetch, Response as UndiciResponse } from "undici";
 import type { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationInput, IntegrationTestingInput } from "../../base/integration";

packages/integrations/src/plex/plex-integration.ts

@@ -1,8 +1,8 @@
 import { parseStringPromise } from "xml2js";
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
 import { ParseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ImageProxy } from "@homarr/image-proxy";
 

packages/integrations/src/prowlarr/prowlarr-integration.ts

@@ -1,6 +1,6 @@
 import { z } from "zod/v4";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
 import type { IntegrationTestingInput } from "../base/integration";
 import { Integration } from "../base/integration";

packages/integrations/src/proxmox/proxmox-integration.ts

@@ -1,7 +1,7 @@
 import type { Proxmox } from "proxmox-api";
 import proxmoxApi from "proxmox-api";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import { HandleIntegrationErrors } from "../base/errors/decorator";

packages/integrations/src/quay/quay-integration.ts

@@ -1,6 +1,6 @@
 import type { RequestInit, Response } from "undici";
 
-import { fetchWithTrustedCertificatesAsync } from "@homarr/certificates/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationTestingInput } from "../base/integration";

packages/integrations/src/unifi-controller/unifi-controller-integration.ts

@@ -2,12 +2,12 @@ import type tls from "node:tls";
 import axios from "axios";
 import { HttpCookieAgent, HttpsCookieAgent } from "http-cookie-agent/http";
 
+import { getPortFromUrl } from "@homarr/common";
 import {
-  createCustomCheckServerIdentity,
   getAllTrustedCertificatesAsync,
   getTrustedCertificateHostnamesAsync,
-} from "@homarr/certificates/server";
-import { getPortFromUrl } from "@homarr/common";
+} from "@homarr/core/infrastructure/certificates";
+import { createCustomCheckServerIdentity } from "@homarr/core/infrastructure/http";
 import type { SiteStats } from "@homarr/node-unifi";
 import Unifi from "@homarr/node-unifi";
 

packages/integrations/test/aria2.spec.ts

@@ -14,6 +14,16 @@ vi.mock("@homarr/db", async (importActual) => {
     db: createDb(),
   };
 });
+vi.mock("@homarr/core/infrastructure/certificates", async (importActual) => {
+  // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+  const actual = await importActual<typeof import("@homarr/core/infrastructure/certificates")>();
+  return {
+    ...actual,
+    getTrustedCertificateHostnamesAsync: vi.fn().mockImplementation(() => {
+      return Promise.resolve([]);
+    }),
+  };
+});
 
 const API_KEY = "ARIA2_API_KEY";
 const IMAGE_NAME = "hurlenko/aria2-ariang:latest";