fix(timetable): isolate URL SSRF validation into a tested module

Extract timetable base-URL validation (private/loopback/metadata/NAT64 block lists + DNS-rebinding address pinning) out of the widget router into a dedicated timetable-options-validation module, and separate the IPv4 and IPv6 block lists so each family is matched against its own rules. Board and options routers load the validator lazily at the call site. Carved out of #6691 so this security-relevant change can land independently of the larger widget/integration refactor. All 27 existing SSRF unit tests pass.
fix: polish login backdrop and wordmark (#6687 )
2026-08-24 15:16:49 +02:00 · 2026-08-24 12:26:19 +02:00
48 changed files with 356 additions and 1123 deletions
@@ -36,8 +36,6 @@ pnpm cli harness setup feature-board

 The command builds `homarr:feature-board`, starts a container with a persistent data volume, enables demo mode, and keeps demo mutations writable (`DEMO_READ_ONLY=false`). Docker assigns a free host port by default; use the URL printed by the command or query it later:

-The demo board includes every widget kind. Integration-backed widgets use the bundled mock integration; media widgets use public stock assets.
-
 ```sh
 pnpm cli harness port feature-board
 ```
@@ -75,7 +75,6 @@ import {
  throwIfCustomWidgetBoardDuplicationForbidden,
  throwIfCustomWidgetPlacementChangeForbidden,
 } from "./board/custom-widget-placement-access";
-import { validateTimetableOptionsChangeAsync } from "./widgets/timetable";

 interface BoardItemPlacementRectangle {
  xOffset: number;
@@ -1497,6 +1496,7 @@ export const boardRouter = createTRPCRouter({
    for (const item of input.items) {
      if (item.kind !== "timetable") continue;
      const previousItem = dbBoard.items.find((dbItem) => dbItem.id === item.id);
+      const { validateTimetableOptionsChangeAsync } = await import("./timetable-options-validation");
      await validateTimetableOptionsChangeAsync(
        item.options,
        previousItem?.kind === "timetable" ? previousItem.options : undefined,
@@ -2073,6 +2073,7 @@ export const boardRouter = createTRPCRouter({
      });

      if (input.kind === "timetable") {
+        const { validateTimetableOptionsChangeAsync } = await import("./timetable-options-validation");
        await validateTimetableOptionsChangeAsync(input.options);
      }

@@ -0,0 +1,162 @@
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+import { TRPCError } from "@trpc/server";
+import { parse } from "superjson";
+import z from "zod";
+
+import type { TimetableResolvedAddress } from "@homarr/request-handler/timetable";
+import { DEFAULT_TIMETABLE_BASE_URL, normalizeTimetableBaseUrl } from "@homarr/request-handler/timetable-url";
+
+const timetableOptionsSchema = z.object({ baseUrl: z.string().optional() }).passthrough();
+
+const blockedTimetableIpv4Addresses = new BlockList();
+const blockedTimetableIpv4Subnets = [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4],
+] as const;
+
+const blockedTimetableIpv6Addresses = new BlockList();
+const blockedTimetableIpv6Subnets = [
+  ["::", 96],
+  ["::ffff:0:0", 96],
+  ["::ffff:0:0:0", 96],
+  ["64:ff9b::", 96],
+  ["64:ff9b:1::", 48],
+  ["100::", 64],
+  ["2001::", 32],
+  ["2001:2::", 48],
+  ["2001:10::", 28],
+  ["2001:db8::", 32],
+  ["2002::", 16],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8],
+] as const;
+
+for (const [network, prefix] of blockedTimetableIpv4Subnets) {
+  blockedTimetableIpv4Addresses.addSubnet(network, prefix, "ipv4");
+}
+
+for (const [network, prefix] of blockedTimetableIpv6Subnets) {
+  blockedTimetableIpv6Addresses.addSubnet(network, prefix, "ipv6");
+}
+
+export const normalizeTimetableBaseUrlOrThrowBadRequest = (baseUrl: string) => {
+  try {
+    return normalizeTimetableBaseUrl(baseUrl);
+  } catch (cause) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: cause instanceof Error ? cause.message : "Invalid timetable base URL",
+      cause,
+    });
+  }
+};
+
+export const getSavedTimetableBaseUrl = (serializedOptions: string) => {
+  try {
+    const options = timetableOptionsSchema.parse(parse<unknown>(serializedOptions));
+    return normalizeTimetableBaseUrl(options.baseUrl ?? DEFAULT_TIMETABLE_BASE_URL);
+  } catch (cause) {
+    throw new TRPCError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: "Timetable widget configuration is invalid",
+      cause,
+    });
+  }
+};
+
+const normalizeHostname = (hostname: string) => {
+  let withoutBrackets = hostname;
+  if (hostname.startsWith("[") && hostname.endsWith("]")) withoutBrackets = hostname.slice(1, -1);
+  return withoutBrackets.toLowerCase().replace(/\.$/, "");
+};
+
+const isBlockedTimetableAddress = (address: string, family: number) => {
+  if (family === 6) return blockedTimetableIpv6Addresses.check(address, "ipv6");
+  return blockedTimetableIpv4Addresses.check(address, "ipv4");
+};
+
+export const resolvePublicTimetableAddressesAsync = async (baseUrl: string): Promise<TimetableResolvedAddress[]> => {
+  const hostname = normalizeHostname(new URL(baseUrl).hostname);
+  const hostnameFamily = isIP(hostname);
+  const isInternalHostname =
+    hostnameFamily === 0 &&
+    (!hostname.includes(".") ||
+      hostname === "localhost" ||
+      hostname.endsWith(".localhost") ||
+      hostname.endsWith(".local") ||
+      hostname.endsWith(".internal") ||
+      hostname.endsWith(".lan") ||
+      hostname.endsWith(".home.arpa"));
+
+  if (isInternalHostname) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "Timetable base URL must use a public host" });
+  }
+
+  let addresses: TimetableResolvedAddress[];
+  try {
+    let resolvedAddresses = [{ address: hostname, family: hostnameFamily }];
+    if (hostnameFamily === 0) resolvedAddresses = await lookup(hostname, { all: true, verbatim: true });
+    addresses = resolvedAddresses.filter(
+      (entry): entry is TimetableResolvedAddress => entry.family === 4 || entry.family === 6,
+    );
+  } catch (cause) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Timetable base URL host could not be resolved",
+      cause,
+    });
+  }
+
+  if (addresses.length === 0 || addresses.some(({ address, family }) => isBlockedTimetableAddress(address, family))) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Timetable base URL must not target a private or internal address",
+    });
+  }
+
+  return addresses.toSorted((left, right) => left.family - right.family || left.address.localeCompare(right.address));
+};
+
+const normalizeTimetableOptionsBaseUrlOrThrowBadRequest = (options: Record<string, unknown>) => {
+  const parsedOptions = timetableOptionsSchema.safeParse(options);
+  if (!parsedOptions.success) {
+    throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid timetable widget options" });
+  }
+  return normalizeTimetableBaseUrlOrThrowBadRequest(parsedOptions.data.baseUrl ?? DEFAULT_TIMETABLE_BASE_URL);
+};
+
+export const validateTimetableOptionsChangeAsync = async (
+  nextOptions: Record<string, unknown>,
+  previousOptions?: Record<string, unknown>,
+) => {
+  const nextBaseUrl = normalizeTimetableOptionsBaseUrlOrThrowBadRequest(nextOptions);
+  if (nextBaseUrl === DEFAULT_TIMETABLE_BASE_URL) return;
+
+  let previousBaseUrl: string | undefined;
+  if (previousOptions) {
+    try {
+      previousBaseUrl = normalizeTimetableOptionsBaseUrlOrThrowBadRequest(previousOptions);
+    } catch {
+      // Invalid legacy options must not prevent replacing them with a valid configuration.
+    }
+  }
+  if (nextBaseUrl === previousBaseUrl) return;
+
+  await resolvePublicTimetableAddressesAsync(nextBaseUrl);
+};
@@ -3,12 +3,7 @@ import { z } from "zod/v4";

 import { ResponseError } from "@homarr/common/server";
 import { createLogger } from "@homarr/core/infrastructure/logs";
-import {
-  anchorNotesListInputSchema,
-  anchorNoteUpdateInputSchema,
-  createIntegrationAsync,
-  mockWidgetData,
-} from "@homarr/integrations";
+import { anchorNotesListInputSchema, anchorNoteUpdateInputSchema, createIntegrationAsync } from "@homarr/integrations";
 import { anchorNoteRequestHandler, anchorNotesListRequestHandler } from "@homarr/request-handler/anchor-notes";

 import { createOneIntegrationMiddleware } from "../../middlewares/integration";
@@ -20,12 +15,6 @@ const noteIdInput = z.object({

 const logger = createLogger({ module: "anchorNotesRouter" });

-const assertMockNoteExists = (noteId: string) => {
-  if (noteId === mockWidgetData.anchorNote.id) return;
-
-  throw new TRPCError({ code: "NOT_FOUND", message: "Note not found" });
-};
-
 const isJsonDeltaString = (value: string) => {
  try {
    const parsed: unknown = JSON.parse(value);
@@ -51,64 +40,34 @@ const normalizeAnchorContent = (content: string | undefined) => {

 export const anchorNotesRouter = createTRPCRouter({
  listNotes: publicProcedure
-    .concat(createOneIntegrationMiddleware("query", "anchor", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "anchor"))
    .input(anchorNotesListInputSchema)
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") {
-        const search = input.search?.toLowerCase();
-        const notes = mockWidgetData.anchorNotes.filter((note) => !search || note.title.toLowerCase().includes(search));
-        return notes.slice(0, input.limit ?? 50);
-      }
-
-      const handler = anchorNotesListRequestHandler.handler(
-        { ...ctx.integration, kind: "anchor" },
-        {
-          ...input,
-          limit: input.limit ?? 50,
-        },
-      );
+      const handler = anchorNotesListRequestHandler.handler(ctx.integration, { ...input, limit: input.limit ?? 50 });

      const { data } = await handler.getDataAsync();

      return data;
    }),
  getNote: publicProcedure
-    .concat(createOneIntegrationMiddleware("query", "anchor", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "anchor"))
    .input(noteIdInput)
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") {
-        assertMockNoteExists(input.noteId);
-        return mockWidgetData.anchorNote;
-      }
-
-      const handler = anchorNoteRequestHandler.handler(
-        { ...ctx.integration, kind: "anchor" },
-        { noteId: input.noteId },
-      );
+      const handler = anchorNoteRequestHandler.handler(ctx.integration, { noteId: input.noteId });

      const { data } = await handler.getDataAsync();

      return data;
    }),
  updateNote: protectedProcedure
-    .concat(createOneIntegrationMiddleware("interact", "anchor", "mock"))
+    .concat(createOneIntegrationMiddleware("interact", "anchor"))
    .input(anchorNoteUpdateInputSchema)
    .mutation(async ({ ctx, input }) => {
+      const integrationInstance = await createIntegrationAsync(ctx.integration);
      const normalizedContent = normalizeAnchorContent(input.content);
      const isContentNormalized =
        input.content !== undefined && normalizedContent !== undefined && input.content !== normalizedContent;

-      if (ctx.integration.kind === "mock") {
-        assertMockNoteExists(input.noteId);
-        return {
-          ...mockWidgetData.anchorNote,
-          ...(input.title !== undefined ? { title: input.title } : {}),
-          ...(normalizedContent !== undefined ? { content: normalizedContent } : {}),
-        };
-      }
-
-      const integrationInstance = await createIntegrationAsync({ ...ctx.integration, kind: "anchor" });
-
      try {
        const updatedNote = await integrationInstance.updateNoteAsync({
          noteId: input.noteId,
@@ -1,18 +1,13 @@
 import { archiveTeamWarriorRequestHandler } from "@homarr/request-handler/archive-team-warrior";
-import { mockWidgetData } from "@homarr/integrations";

 import { createOneIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, publicProcedure } from "../../trpc";

 export const archiveTeamWarriorRouter = createTRPCRouter({
  getStatus: publicProcedure
-    .concat(createOneIntegrationMiddleware("query", "archiveTeamWarrior", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "archiveTeamWarrior"))
    .query(async ({ ctx }) => {
-      if (ctx.integration.kind === "mock") {
-        return { status: mockWidgetData.archiveTeamWarrior, updatedAt: new Date(mockWidgetData.timestamp) };
-      }
-
-      const handler = archiveTeamWarriorRequestHandler.handler({ ...ctx.integration, kind: "archiveTeamWarrior" }, {});
+      const handler = archiveTeamWarriorRequestHandler.handler(ctx.integration, {});
      const { data, timestamp } = await handler.getDataAsync();

      return {
@@ -1,16 +1,14 @@
 import { audiobookshelfRequestHandler } from "@homarr/request-handler/audiobookshelf";
 import { navidromeRequestHandler } from "@homarr/request-handler/navidrome";
-import { mockWidgetData } from "@homarr/integrations";

 import { createOneIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, publicProcedure } from "../../trpc";

 export const audioStatsRouter = createTRPCRouter({
  getStats: publicProcedure
-    .concat(createOneIntegrationMiddleware("query", "navidrome", "audiobookshelf", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "navidrome", "audiobookshelf"))
    .query(async ({ ctx }) => {
      const { kind } = ctx.integration;
-      if (kind === "mock") return { kind: "navidrome" as const, data: mockWidgetData.audioStats };

      const fetchByKind = {
        navidrome: async () => {
@@ -1,5 +1,4 @@
 import { bazarrBadgesRequestHandler } from "@homarr/request-handler/bazarr";
-import { mockWidgetData } from "@homarr/integrations";

 import { createOneIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, publicProcedure } from "../../trpc";
@@ -13,11 +12,9 @@ export const bazarrRouter = createTRPCRouter({
          "Get missing subtitle counts, provider issues, and health warnings for a Bazarr integration. REQUIRED: integrationId from integration_all",
      },
    })
-    .concat(createOneIntegrationMiddleware("query", "bazarr", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "bazarr"))
    .query(async ({ ctx }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.bazarr;
-
-      const innerHandler = bazarrBadgesRequestHandler.handler({ ...ctx.integration, kind: "bazarr" }, {});
+      const innerHandler = bazarrBadgesRequestHandler.handler(ctx.integration, {});
      const data = await innerHandler.getDataAsync();
      return data.data;
    }),
@@ -1,5 +1,4 @@
 import type { CoolifyInstanceInfo } from "@homarr/integrations/types";
-import { mockWidgetData } from "@homarr/integrations";
 import { coolifyRequestHandler } from "@homarr/request-handler/coolify";

 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
@@ -17,22 +16,12 @@ interface CoolifyInstanceResult {

 export const coolifyRouter = createTRPCRouter({
  getInstancesInfo: publicProcedure
-    .concat(createManyIntegrationMiddleware("query", "coolify", "mock"))
+    .concat(createManyIntegrationMiddleware("query", "coolify"))
    .query(async ({ ctx }) => {
      return await settleIntegrationQueries(
        ctx.integrations,
        async (integration): Promise<CoolifyInstanceResult> => {
-          if (integration.kind === "mock") {
-            return {
-              integrationId: integration.id,
-              integrationName: integration.name,
-              integrationUrl: integration.url,
-              instanceInfo: mockWidgetData.coolify,
-              updatedAt: new Date(mockWidgetData.timestamp),
-            };
-          }
-
-          const innerHandler = coolifyRequestHandler.handler({ ...integration, kind: "coolify" }, {});
+          const innerHandler = coolifyRequestHandler.handler(integration, {});
          const { data, timestamp } = await innerHandler.getDataAsync();

          return {
@@ -1,6 +1,4 @@
 import { getIntegrationKindsByCategory } from "@homarr/definitions";
-import type { IntegrationKind } from "@homarr/definitions";
-import { mockWidgetData } from "@homarr/integrations";
 import {
  firewallCpuRequestHandler,
  firewallInterfacesRequestHandler,
@@ -12,53 +10,29 @@ import { createManyIntegrationMiddleware } from "../../middlewares/integration";
 import { settleIntegrationQueries, toPublicIntegrationError } from "../../settle-integrations";
 import { createTRPCRouter, publicProcedure } from "../../trpc";

-const firewallMiddleware = createManyIntegrationMiddleware(
-  "query",
-  ...getIntegrationKindsByCategory("firewall"),
-  "mock",
-);
+const firewallMiddleware = createManyIntegrationMiddleware("query", ...getIntegrationKindsByCategory("firewall"));

-interface FirewallResult<TSummary> {
-  integration: { id: string; name: string; kind: IntegrationKind; updatedAt: Date };
-  summary: TSummary;
-  error?: string;
-}
-
-const queryFirewall = <TSummary>(
-  handler: {
-    handler: (
-      integration: any,
-      input: Record<string, never>,
-    ) => { getDataAsync: () => Promise<{ data: TSummary; timestamp: Date }> };
+const queryFirewall = <
+  THandler extends {
+    handler: (integration: any, input: any) => { getDataAsync: () => Promise<{ data: any; timestamp: Date }> };
  },
-  createFallback: () => TSummary,
-  getMockData: () => TSummary,
+>(
+  handler: THandler,
+  createFallback: () => Awaited<ReturnType<ReturnType<THandler["handler"]>["getDataAsync"]>>["data"],
 ) =>
  publicProcedure.concat(firewallMiddleware).query(async ({ ctx }) =>
    settleIntegrationQueries(
      ctx.integrations,
-      async (integration): Promise<FirewallResult<TSummary>> => {
-        if (integration.kind === "mock") {
-          return {
-            integration: {
-              id: integration.id,
-              name: integration.name,
-              kind: integration.kind,
-              updatedAt: new Date(mockWidgetData.timestamp),
-            },
-            summary: getMockData(),
-            error: undefined,
-          };
-        }
-        const { data, timestamp } = await handler.handler({ ...integration, kind: "opnsense" }, {}).getDataAsync();
+      async (integration) => {
+        const { data, timestamp } = await handler.handler(integration, {}).getDataAsync();
        return {
          integration: { id: integration.id, name: integration.name, kind: integration.kind, updatedAt: timestamp },
-          summary: data,
-          error: undefined,
+          summary: data as Awaited<ReturnType<ReturnType<THandler["handler"]>["getDataAsync"]>>["data"],
+          error: undefined as string | undefined,
        };
      },
      {
-        fallback: (integration, error): FirewallResult<TSummary> => ({
+        fallback: (integration, error) => ({
          integration: { id: integration.id, name: integration.name, kind: integration.kind, updatedAt: new Date(0) },
          summary: createFallback(),
          error: toPublicIntegrationError(error),
@@ -69,24 +43,8 @@ const queryFirewall = <TSummary>(
  );

 export const firewallRouter = createTRPCRouter({
-  getFirewallCpuStatus: queryFirewall(
-    firewallCpuRequestHandler,
-    () => ({ total: 0 }),
-    () => mockWidgetData.firewallCpu,
-  ),
-  getFirewallInterfacesStatus: queryFirewall(
-    firewallInterfacesRequestHandler,
-    () => [],
-    () => mockWidgetData.firewallInterfaces,
-  ),
-  getFirewallVersionStatus: queryFirewall(
-    firewallVersionRequestHandler,
-    () => ({ version: "Unknown" }),
-    () => mockWidgetData.firewallVersion,
-  ),
-  getFirewallMemoryStatus: queryFirewall(
-    firewallMemoryRequestHandler,
-    () => ({ used: 0, total: 0, percent: 0 }),
-    () => mockWidgetData.firewallMemory,
-  ),
+  getFirewallCpuStatus: queryFirewall(firewallCpuRequestHandler, () => ({ total: 0 })),
+  getFirewallInterfacesStatus: queryFirewall(firewallInterfacesRequestHandler, () => []),
+  getFirewallVersionStatus: queryFirewall(firewallVersionRequestHandler, () => ({ version: "Unknown" })),
+  getFirewallMemoryStatus: queryFirewall(firewallMemoryRequestHandler, () => ({ used: 0, total: 0, percent: 0 })),
 });
@@ -1,7 +1,6 @@
 import { z } from "zod/v4";

 import { getIntegrationKindsByCategory } from "@homarr/definitions";
-import { mockWidgetData } from "@homarr/integrations";
 import {
  immichAlbumRequestHandler,
  immichAlbumsRequestHandler,
@@ -13,12 +12,11 @@ import { createOneIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, publicProcedure } from "../../trpc";

 const createImmichIntegrationMiddleware = (action: IntegrationAction) =>
-  createOneIntegrationMiddleware(action, ...getIntegrationKindsByCategory("photoService"), "mock");
+  createOneIntegrationMiddleware(action, ...getIntegrationKindsByCategory("photoService"));

 export const immichRouter = createTRPCRouter({
  getServerStats: publicProcedure.concat(createImmichIntegrationMiddleware("query")).query(async ({ ctx }) => {
-    if (ctx.integration.kind === "mock") return mockWidgetData.immichStats;
-    const innerHandler = immichStatsRequestHandler.handler({ ...ctx.integration, kind: "immich" }, {});
+    const innerHandler = immichStatsRequestHandler.handler(ctx.integration, {});
    const data = await innerHandler.getDataAsync();
    return data.data;
  }),
@@ -31,13 +29,7 @@ export const immichRouter = createTRPCRouter({
      }),
    )
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.immichAlbum;
-      const innerHandler = immichAlbumRequestHandler.handler(
-        { ...ctx.integration, kind: "immich" },
-        {
-          albumId: input.albumId,
-        },
-      );
+      const innerHandler = immichAlbumRequestHandler.handler(ctx.integration, { albumId: input.albumId });
      const data = await innerHandler.getDataAsync();
      return data.data;
    }),
@@ -50,13 +42,7 @@ export const immichRouter = createTRPCRouter({
    )
    .concat(createImmichIntegrationMiddleware("query"))
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.immichAlbums.slice(0, input.limit);
-      const innerHandler = immichAlbumsRequestHandler.handler(
-        { ...ctx.integration, kind: "immich" },
-        {
-          limit: input.limit,
-        },
-      );
+      const innerHandler = immichAlbumsRequestHandler.handler(ctx.integration, { limit: input.limit });
      const data = await innerHandler.getDataAsync();
      return data.data;
    }),
@@ -9,7 +9,6 @@ import { boards, items } from "@homarr/db/schema";
 import type { WidgetOptionsSettings } from "../../../../widgets/src";
 import { createTRPCRouter, protectedProcedure, publicProcedure } from "../../trpc";
 import { throwIfActionForbiddenAsync } from "../board/board-access";
-import { validateTimetableOptionsChangeAsync } from "./timetable";
 import { throwIfCustomWidgetPlacementChangeForbidden } from "../board/custom-widget-placement-access";

 export const optionsRouter = createTRPCRouter({
@@ -50,6 +49,7 @@ export const optionsRouter = createTRPCRouter({
      const previousOptions = SuperJSON.parse<Record<string, unknown>>(item.options);
      const updatedOptions = { ...previousOptions, ...input.newOptions };
      if (item.kind === "timetable") {
+        const { validateTimetableOptionsChangeAsync } = await import("../timetable-options-validation");
        await validateTimetableOptionsChangeAsync(updatedOptions, previousOptions);
      }
      throwIfCustomWidgetPlacementChangeForbidden({
@@ -1,16 +1,12 @@
 import { paperlessNgxStatsRequestHandler } from "@homarr/request-handler/paperless-ngx";
-import { mockWidgetData } from "@homarr/integrations";

 import { createOneIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, publicProcedure } from "../../trpc";

 export const paperlessNgxRouter = createTRPCRouter({
-  getStats: publicProcedure
-    .concat(createOneIntegrationMiddleware("query", "paperlessNgx", "mock"))
-    .query(async ({ ctx }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.paperlessNgx;
-      const innerHandler = paperlessNgxStatsRequestHandler.handler({ ...ctx.integration, kind: "paperlessNgx" }, {});
-      const data = await innerHandler.getDataAsync();
-      return data.data;
-    }),
+  getStats: publicProcedure.concat(createOneIntegrationMiddleware("query", "paperlessNgx")).query(async ({ ctx }) => {
+    const innerHandler = paperlessNgxStatsRequestHandler.handler(ctx.integration, {});
+    const data = await innerHandler.getDataAsync();
+    return data.data;
+  }),
 });
@@ -1,5 +1,4 @@
 import { patchmonStatsRequestHandler } from "@homarr/request-handler/patchmon";
-import { mockWidgetData } from "@homarr/integrations";

 import { createOneIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, protectedProcedure } from "../../trpc";
@@ -13,10 +12,9 @@ export const patchmonRouter = createTRPCRouter({
          "Get PatchMon host patch statistics including total hosts, hosts needing updates, security update counts, up-to-date hosts, outdated packages, repositories, and OS distribution. REQUIRED: integrationId (single PatchMon integration ID from integration_all). Requires authenticated session (API key or browser login) and integration query access.",
      },
    })
-    .concat(createOneIntegrationMiddleware("query", "patchmon", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "patchmon"))
    .query(async ({ ctx }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.patchmon;
-      const innerHandler = patchmonStatsRequestHandler.handler({ ...ctx.integration, kind: "patchmon" }, {});
+      const innerHandler = patchmonStatsRequestHandler.handler(ctx.integration, {});
      const { data } = await innerHandler.getDataAsync();
      return data;
    }),
@@ -1,5 +1,4 @@
 import { speedtestTrackerRequestHandler } from "@homarr/request-handler/speedtest-tracker";
-import { mockWidgetData } from "@homarr/integrations";

 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
 import { settleIntegrationQueries, toPublicIntegrationError } from "../../settle-integrations";
@@ -7,22 +6,12 @@ import { createTRPCRouter, publicProcedure } from "../../trpc";

 export const speedtestTrackerRouter = createTRPCRouter({
  getDashboard: publicProcedure
-    .concat(createManyIntegrationMiddleware("query", "speedtestTracker", "mock"))
+    .concat(createManyIntegrationMiddleware("query", "speedtestTracker"))
    .query(async ({ ctx }) => {
      return await settleIntegrationQueries(
        ctx.integrations,
        async (integration) => {
-          if (integration.kind === "mock") {
-            return {
-              integrationId: integration.id,
-              integrationName: integration.name,
-              integrationUrl: integration.url,
-              dashboard: mockWidgetData.speedtestTracker,
-              updatedAt: new Date(mockWidgetData.timestamp),
-              error: undefined,
-            };
-          }
-          const innerHandler = speedtestTrackerRequestHandler.handler({ ...integration, kind: "speedtestTracker" }, {});
+          const innerHandler = speedtestTrackerRequestHandler.handler(integration, {});
          const { data, timestamp } = await innerHandler.getDataAsync();

          return {
@@ -1,7 +1,4 @@
-import { lookup } from "node:dns/promises";
-import { BlockList, isIP } from "node:net";
 import { TRPCError } from "@trpc/server";
-import { parse } from "superjson";
 import z from "zod";

 import type { Session } from "@homarr/auth";
@@ -13,10 +10,15 @@ import {
  timetableGetTimetableRequestHandler,
  timetableSearchStationsRequestHandler,
 } from "@homarr/request-handler/timetable";
-import { DEFAULT_TIMETABLE_BASE_URL, normalizeTimetableBaseUrl } from "@homarr/request-handler/timetable-url";
+import { DEFAULT_TIMETABLE_BASE_URL } from "@homarr/request-handler/timetable-url";

 import { createTRPCRouter, publicProcedure } from "../../trpc";
 import { throwIfActionForbiddenAsync } from "../board/board-access";
+import {
+  getSavedTimetableBaseUrl,
+  normalizeTimetableBaseUrlOrThrowBadRequest,
+  resolvePublicTimetableAddressesAsync,
+} from "../timetable-options-validation";

 const baseUrlSchema = z.string().url().max(2_048);
 const timetableSourceSchema = z.object({
@@ -24,172 +26,6 @@ const timetableSourceSchema = z.object({
  itemId: z.string().max(100).optional(),
  boardId: z.string().max(100).optional(),
 });
-const timetableOptionsSchema = z.object({ baseUrl: z.string().optional() }).passthrough();
-
-const blockedTimetableIpv4Addresses = new BlockList();
-const blockedTimetableIpv6Addresses = new BlockList();
-const blockedTimetableSubnets = [
-  ["0.0.0.0", 8, "ipv4"],
-  ["10.0.0.0", 8, "ipv4"],
-  ["100.64.0.0", 10, "ipv4"],
-  ["127.0.0.0", 8, "ipv4"],
-  ["169.254.0.0", 16, "ipv4"],
-  ["172.16.0.0", 12, "ipv4"],
-  ["192.0.0.0", 24, "ipv4"],
-  ["192.0.2.0", 24, "ipv4"],
-  ["192.88.99.0", 24, "ipv4"],
-  ["192.168.0.0", 16, "ipv4"],
-  ["198.18.0.0", 15, "ipv4"],
-  ["198.51.100.0", 24, "ipv4"],
-  ["203.0.113.0", 24, "ipv4"],
-  ["224.0.0.0", 4, "ipv4"],
-  ["240.0.0.0", 4, "ipv4"],
-  ["::", 96, "ipv6"],
-  ["::ffff:0:0", 96, "ipv6"],
-  ["::ffff:0:0:0", 96, "ipv6"],
-  ["64:ff9b::", 96, "ipv6"],
-  ["64:ff9b:1::", 48, "ipv6"],
-  ["100::", 64, "ipv6"],
-  ["2001::", 32, "ipv6"],
-  ["2001:2::", 48, "ipv6"],
-  ["2001:10::", 28, "ipv6"],
-  ["2001:db8::", 32, "ipv6"],
-  ["2002::", 16, "ipv6"],
-  ["fc00::", 7, "ipv6"],
-  ["fe80::", 10, "ipv6"],
-  ["fec0::", 10, "ipv6"],
-  ["ff00::", 8, "ipv6"],
-] as const;
-
-for (const [network, prefix, family] of blockedTimetableSubnets) {
-  const blockList = family === "ipv4" ? blockedTimetableIpv4Addresses : blockedTimetableIpv6Addresses;
-  blockList.addSubnet(network, prefix, family);
-}
-
-const normalizeBaseUrlOrThrowBadRequest = (baseUrl: string) => {
-  try {
-    return normalizeTimetableBaseUrl(baseUrl);
-  } catch (cause) {
-    throw new TRPCError({
-      code: "BAD_REQUEST",
-      message: cause instanceof Error ? cause.message : "Invalid timetable base URL",
-      cause,
-    });
-  }
-};
-
-const throwInvalidSavedTimetableConfiguration = (cause: unknown): never => {
-  throw new TRPCError({
-    code: "INTERNAL_SERVER_ERROR",
-    message: "Timetable widget configuration is invalid",
-    cause,
-  });
-};
-
-const parseSavedTimetableOptions = (serializedOptions: string) => {
-  try {
-    return timetableOptionsSchema.parse(parse<unknown>(serializedOptions));
-  } catch (cause) {
-    return throwInvalidSavedTimetableConfiguration(cause);
-  }
-};
-
-const normalizeSavedTimetableBaseUrl = (baseUrl: string) => {
-  try {
-    return normalizeTimetableBaseUrl(baseUrl);
-  } catch (cause) {
-    return throwInvalidSavedTimetableConfiguration(cause);
-  }
-};
-
-const normalizeHostname = (hostname: string) => {
-  const withoutBrackets = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
-  return withoutBrackets.toLowerCase().replace(/\.$/, "");
-};
-
-const isBlockedTimetableAddress = (address: string, family: number) => {
-  return family === 6
-    ? blockedTimetableIpv6Addresses.check(address, "ipv6")
-    : blockedTimetableIpv4Addresses.check(address, "ipv4");
-};
-
-const resolvePublicTimetableAddressesAsync = async (baseUrl: string): Promise<TimetableResolvedAddress[]> => {
-  const hostname = normalizeHostname(new URL(baseUrl).hostname);
-  const hostnameFamily = isIP(hostname);
-  const isInternalHostname =
-    hostnameFamily === 0 &&
-    (!hostname.includes(".") ||
-      hostname === "localhost" ||
-      hostname.endsWith(".localhost") ||
-      hostname.endsWith(".local") ||
-      hostname.endsWith(".internal") ||
-      hostname.endsWith(".lan") ||
-      hostname.endsWith(".home.arpa"));
-
-  if (isInternalHostname) {
-    throw new TRPCError({ code: "BAD_REQUEST", message: "Timetable base URL must use a public host" });
-  }
-
-  let addresses: TimetableResolvedAddress[];
-  try {
-    const resolvedAddresses =
-      hostnameFamily === 0
-        ? await lookup(hostname, { all: true, verbatim: true })
-        : [{ address: hostname, family: hostnameFamily }];
-    addresses = resolvedAddresses.filter(
-      (entry): entry is TimetableResolvedAddress => entry.family === 4 || entry.family === 6,
-    );
-  } catch (cause) {
-    throw new TRPCError({
-      code: "BAD_REQUEST",
-      message: "Timetable base URL host could not be resolved",
-      cause,
-    });
-  }
-
-  if (addresses.length === 0 || addresses.some(({ address, family }) => isBlockedTimetableAddress(address, family))) {
-    throw new TRPCError({
-      code: "BAD_REQUEST",
-      message: "Timetable base URL must not target a private or internal address",
-    });
-  }
-
-  return addresses.toSorted((left, right) => left.family - right.family || left.address.localeCompare(right.address));
-};
-
-const normalizeTimetableOptionsBaseUrlOrThrowBadRequest = (options: Record<string, unknown>) => {
-  const parsedOptions = timetableOptionsSchema.safeParse(options);
-  if (!parsedOptions.success) {
-    throw new TRPCError({ code: "BAD_REQUEST", message: "Invalid timetable widget options" });
-  }
-  return normalizeBaseUrlOrThrowBadRequest(parsedOptions.data.baseUrl ?? DEFAULT_TIMETABLE_BASE_URL);
-};
-
-export const validateTimetableOptionsChangeAsync = async (
-  nextOptions: Record<string, unknown>,
-  previousOptions?: Record<string, unknown>,
-) => {
-  const nextBaseUrl = normalizeTimetableOptionsBaseUrlOrThrowBadRequest(nextOptions);
-  if (nextBaseUrl === DEFAULT_TIMETABLE_BASE_URL) return;
-
-  let previousBaseUrl: string | undefined;
-  if (previousOptions) {
-    try {
-      previousBaseUrl = normalizeTimetableOptionsBaseUrlOrThrowBadRequest(previousOptions);
-    } catch {
-      // Invalid legacy options must not prevent replacing them with a valid configuration.
-    }
-  }
-  if (nextBaseUrl === previousBaseUrl) return;
-
-  await resolvePublicTimetableAddressesAsync(nextBaseUrl);
-};
-
-const getSavedTimetableBaseUrl = (serializedOptions: string) => {
-  const options = parseSavedTimetableOptions(serializedOptions);
-  return normalizeSavedTimetableBaseUrl(options.baseUrl ?? DEFAULT_TIMETABLE_BASE_URL);
-};
-
 interface ResolvedTimetableSource {
  baseUrl: string;
  pinnedAddresses?: TimetableResolvedAddress[];
@@ -200,7 +36,7 @@ const resolveTimetableBaseUrlAsync = async (
  input: z.infer<typeof timetableSourceSchema>,
  allowBoardConfiguration = false,
 ): Promise<ResolvedTimetableSource> => {
-  const requestedBaseUrl = normalizeBaseUrlOrThrowBadRequest(input.baseUrl);
+  const requestedBaseUrl = normalizeTimetableBaseUrlOrThrowBadRequest(input.baseUrl);
  if (allowBoardConfiguration) {
    if (input.boardId) {
      await throwIfActionForbiddenAsync(ctx, eq(boards.id, input.boardId), "modify");
@@ -1,50 +1,37 @@
 import { tracearrRequestHandler } from "@homarr/request-handler/tracearr";
-import { mockWidgetData } from "@homarr/integrations";

 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
 import { settleIntegrationQueries, toPublicIntegrationError } from "../../settle-integrations";
 import { createTRPCRouter, publicProcedure } from "../../trpc";

 export const tracearrRouter = createTRPCRouter({
-  getDashboard: publicProcedure
-    .concat(createManyIntegrationMiddleware("query", "tracearr", "mock"))
-    .query(async ({ ctx }) => {
-      return await settleIntegrationQueries(
-        ctx.integrations,
-        async (integration) => {
-          if (integration.kind === "mock") {
-            return {
-              integrationId: integration.id,
-              integrationName: integration.name,
-              integrationUrl: integration.url,
-              dashboard: mockWidgetData.tracearr,
-              updatedAt: new Date(mockWidgetData.timestamp),
-              error: undefined,
-            };
-          }
-          const innerHandler = tracearrRequestHandler.handler({ ...integration, kind: "tracearr" }, {});
-          const { data, timestamp } = await innerHandler.getDataAsync();
+  getDashboard: publicProcedure.concat(createManyIntegrationMiddleware("query", "tracearr")).query(async ({ ctx }) => {
+    return await settleIntegrationQueries(
+      ctx.integrations,
+      async (integration) => {
+        const innerHandler = tracearrRequestHandler.handler(integration, {});
+        const { data, timestamp } = await innerHandler.getDataAsync();

-          return {
-            integrationId: integration.id,
-            integrationName: integration.name,
-            integrationUrl: integration.url,
-            dashboard: data as typeof data | null,
-            updatedAt: timestamp,
-            error: undefined as string | undefined,
-          };
-        },
-        {
-          fallback: (integration, error) => ({
-            integrationId: integration.id,
-            integrationName: integration.name,
-            integrationUrl: integration.url,
-            dashboard: null,
-            updatedAt: new Date(0),
-            error: toPublicIntegrationError(error),
-          }),
-          throwOnAllFailures: true,
-        },
-      );
-    }),
+        return {
+          integrationId: integration.id,
+          integrationName: integration.name,
+          integrationUrl: integration.url,
+          dashboard: data as typeof data | null,
+          updatedAt: timestamp,
+          error: undefined as string | undefined,
+        };
+      },
+      {
+        fallback: (integration, error) => ({
+          integrationId: integration.id,
+          integrationName: integration.name,
+          integrationUrl: integration.url,
+          dashboard: null,
+          updatedAt: new Date(0),
+          error: toPublicIntegrationError(error),
+        }),
+        throwOnAllFailures: true,
+      },
+    );
+  }),
 });
@@ -1,5 +1,4 @@
 import { traefikRequestHandler } from "@homarr/request-handler/traefik";
-import { mockWidgetData } from "@homarr/integrations";

 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
 import { settleIntegrationQueries, toPublicIntegrationError } from "../../settle-integrations";
@@ -14,22 +13,12 @@ export const traefikRouter = createTRPCRouter({
          "Retrieve Traefik dashboard data, including routers, services, middlewares, and entry points, for the given integration IDs.",
      },
    })
-    .concat(createManyIntegrationMiddleware("query", "traefik", "mock"))
+    .concat(createManyIntegrationMiddleware("query", "traefik"))
    .query(async ({ ctx }) => {
      return await settleIntegrationQueries(
        ctx.integrations,
        async (integration) => {
-          if (integration.kind === "mock") {
-            return {
-              integrationId: integration.id,
-              integrationName: integration.name,
-              integrationUrl: integration.url,
-              dashboard: mockWidgetData.traefik,
-              updatedAt: new Date(mockWidgetData.timestamp),
-              error: undefined,
-            };
-          }
-          const innerHandler = traefikRequestHandler.handler({ ...integration, kind: "traefik" }, {});
+          const innerHandler = traefikRequestHandler.handler(integration, {});
          const { data, timestamp } = await innerHandler.getDataAsync();

          return {
@@ -2,7 +2,7 @@ import { z } from "zod/v4";

 import { createLogger } from "@homarr/core/infrastructure/logs";
 import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
-import { createIntegrationAsync, mockWidgetData } from "@homarr/integrations";
+import { createIntegrationAsync } from "@homarr/integrations";
 import {
  umamiActiveVisitorsRequestHandler,
  umamiEventNamesRequestHandler,
@@ -19,18 +19,15 @@ import { createTRPCRouter, publicProcedure } from "../../trpc";
 const logger = createLogger({ module: "umami-router" });

 export const umamiRouter = createTRPCRouter({
-  getWebsites: publicProcedure
-    .concat(createOneIntegrationMiddleware("query", "umami", "mock"))
-    .query(async ({ ctx }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.umamiWebsites;
-      try {
-        const instance = await createIntegrationAsync({ ...ctx.integration, kind: "umami" });
-        return await instance.getWebsitesAsync();
-      } catch (error) {
-        logger.warn(new Error("Failed to load websites", { cause: error }));
-        return [];
-      }
-    }),
+  getWebsites: publicProcedure.concat(createOneIntegrationMiddleware("query", "umami")).query(async ({ ctx }) => {
+    try {
+      const instance = await createIntegrationAsync(ctx.integration);
+      return await instance.getWebsitesAsync();
+    } catch (error) {
+      logger.warn(new Error("Failed to load websites", { cause: error }));
+      return [];
+    }
+  }),

  getVisitorStats: publicProcedure
    .input(
@@ -40,26 +37,14 @@ export const umamiRouter = createTRPCRouter({
        eventName: z.string().optional(),
      }),
    )
-    .concat(createManyIntegrationMiddleware("query", "umami", "mock"))
+    .concat(createManyIntegrationMiddleware("query", "umami"))
    .query(async ({ ctx, input }) => {
      return await settleIntegrationQueries(ctx.integrations, async (integration) => {
-        if (integration.kind === "mock") {
-          return {
-            integrationId: integration.id,
-            integrationName: integration.name,
-            integrationUrl: integration.url,
-            visitorStats: { ...mockWidgetData.umamiVisitorStats, timeFrame: input.timeFrame },
-            updatedAt: new Date(mockWidgetData.timestamp),
-          };
-        }
-        const innerHandler = umamiRequestHandler.handler(
-          { ...integration, kind: "umami" },
-          {
-            websiteId: input.websiteId,
-            timeFrame: input.timeFrame,
-            eventName: input.eventName,
-          },
-        );
+        const innerHandler = umamiRequestHandler.handler(integration, {
+          websiteId: input.websiteId,
+          timeFrame: input.timeFrame,
+          eventName: input.eventName,
+        });
        const { data, timestamp } = await innerHandler.getDataAsync();

        return {
@@ -74,16 +59,10 @@ export const umamiRouter = createTRPCRouter({

  getEventNames: publicProcedure
    .input(z.object({ websiteId: z.string() }))
-    .concat(createOneIntegrationMiddleware("query", "umami", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "umami"))
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.umamiEventNames;
      try {
-        const innerHandler = umamiEventNamesRequestHandler.handler(
-          { ...ctx.integration, kind: "umami" },
-          {
-            websiteId: input.websiteId,
-          },
-        );
+        const innerHandler = umamiEventNamesRequestHandler.handler(ctx.integration, { websiteId: input.websiteId });
        const { data } = await innerHandler.getDataAsync();
        return data;
      } catch (error) {
@@ -102,18 +81,14 @@ export const umamiRouter = createTRPCRouter({
        limit: z.number().int().min(1).max(500),
      }),
    )
-    .concat(createOneIntegrationMiddleware("query", "umami", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "umami"))
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.umamiTopPages.slice(0, input.limit);
      try {
-        const innerHandler = umamiTopPagesRequestHandler.handler(
-          { ...ctx.integration, kind: "umami" },
-          {
-            websiteId: input.websiteId,
-            timeFrame: input.timeFrame,
-            limit: input.limit,
-          },
-        );
+        const innerHandler = umamiTopPagesRequestHandler.handler(ctx.integration, {
+          websiteId: input.websiteId,
+          timeFrame: input.timeFrame,
+          limit: input.limit,
+        });
        const { data } = await innerHandler.getDataAsync();
        return data;
      } catch (error) {
@@ -136,18 +111,14 @@ export const umamiRouter = createTRPCRouter({
        limit: z.number().int().min(1).max(500),
      }),
    )
-    .concat(createOneIntegrationMiddleware("query", "umami", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "umami"))
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") return mockWidgetData.umamiTopReferrers.slice(0, input.limit);
      try {
-        const innerHandler = umamiTopReferrersRequestHandler.handler(
-          { ...ctx.integration, kind: "umami" },
-          {
-            websiteId: input.websiteId,
-            timeFrame: input.timeFrame,
-            limit: input.limit,
-          },
-        );
+        const innerHandler = umamiTopReferrersRequestHandler.handler(ctx.integration, {
+          websiteId: input.websiteId,
+          timeFrame: input.timeFrame,
+          limit: input.limit,
+        });
        const { data } = await innerHandler.getDataAsync();
        return data;
      } catch (error) {
@@ -170,21 +141,15 @@ export const umamiRouter = createTRPCRouter({
        eventNames: z.array(z.string()),
      }),
    )
-    .concat(createOneIntegrationMiddleware("query", "umami", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "umami"))
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") {
-        return mockWidgetData.umamiEventSeries.filter((series) => input.eventNames.includes(series.eventName));
-      }
      try {
        const sortedNames = [...input.eventNames].toSorted();
-        const innerHandler = umamiMultiEventRequestHandler.handler(
-          { ...ctx.integration, kind: "umami" },
-          {
-            websiteId: input.websiteId,
-            timeFrame: input.timeFrame,
-            eventNames: sortedNames,
-          },
-        );
+        const innerHandler = umamiMultiEventRequestHandler.handler(ctx.integration, {
+          websiteId: input.websiteId,
+          timeFrame: input.timeFrame,
+          eventNames: sortedNames,
+        });
        const { data } = await innerHandler.getDataAsync();
        return data;
      } catch (error) {
@@ -201,16 +166,12 @@ export const umamiRouter = createTRPCRouter({

  getActiveVisitors: publicProcedure
    .input(z.object({ websiteId: z.string() }))
-    .concat(createOneIntegrationMiddleware("query", "umami", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "umami"))
    .query(async ({ ctx, input }) => {
-      if (ctx.integration.kind === "mock") return 7;
      try {
-        const innerHandler = umamiActiveVisitorsRequestHandler.handler(
-          { ...ctx.integration, kind: "umami" },
-          {
-            websiteId: input.websiteId,
-          },
-        );
+        const innerHandler = umamiActiveVisitorsRequestHandler.handler(ctx.integration, {
+          websiteId: input.websiteId,
+        });
        const { data } = await innerHandler.getDataAsync();
        return data;
      } catch (error) {
@@ -1,5 +1,4 @@
 import { uptimeKumaRequestHandler } from "@homarr/request-handler/uptime-kuma";
-import { mockWidgetData } from "@homarr/integrations";

 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
 import { settleIntegrationQueries, toPublicIntegrationError } from "../../settle-integrations";
@@ -7,22 +6,12 @@ import { createTRPCRouter, publicProcedure } from "../../trpc";

 export const uptimeKumaRouter = createTRPCRouter({
  getDashboard: publicProcedure
-    .concat(createManyIntegrationMiddleware("query", "uptimeKuma", "mock"))
+    .concat(createManyIntegrationMiddleware("query", "uptimeKuma"))
    .query(async ({ ctx }) => {
      return await settleIntegrationQueries(
        ctx.integrations,
        async (integration) => {
-          if (integration.kind === "mock") {
-            return {
-              integrationId: integration.id,
-              integrationName: integration.name,
-              integrationUrl: integration.url,
-              dashboard: mockWidgetData.uptimeKuma,
-              updatedAt: new Date(mockWidgetData.timestamp),
-              error: undefined,
-            };
-          }
-          const innerHandler = uptimeKumaRequestHandler.handler({ ...integration, kind: "uptimeKuma" }, {});
+          const innerHandler = uptimeKumaRequestHandler.handler(integration, {});
          const { data, timestamp } = await innerHandler.getDataAsync();

          return {
@@ -1,41 +1,18 @@
 import { getIntegrationKindsByCategory } from "@homarr/definitions";
-import type { IntegrationKind } from "@homarr/definitions";
-import { mockWidgetData } from "@homarr/integrations";
-import type { VpnSummary } from "@homarr/integrations/types";
 import { vpnSummaryHandler } from "@homarr/request-handler/vpn";

 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
 import { settleIntegrationQueries, toPublicIntegrationError } from "../../settle-integrations";
 import { createTRPCRouter, publicProcedure } from "../../trpc";

-interface VpnResult {
-  integration: { id: string; name: string; kind: IntegrationKind; updatedAt: Date };
-  summary: VpnSummary | null;
-  error?: string;
-}
-
 export const vpnRouter = createTRPCRouter({
  getSummaries: publicProcedure
-    .unstable_concat(createManyIntegrationMiddleware("query", ...getIntegrationKindsByCategory("vpn"), "mock"))
+    .unstable_concat(createManyIntegrationMiddleware("query", ...getIntegrationKindsByCategory("vpn")))
    .query(async ({ ctx }) => {
      return await settleIntegrationQueries(
        ctx.integrations,
-        async (integration): Promise<VpnResult> => {
-          if (integration.kind === "mock") {
-            return {
-              integration: {
-                id: integration.id,
-                name: integration.name,
-                kind: integration.kind,
-                updatedAt: new Date(mockWidgetData.timestamp),
-              },
-              summary: mockWidgetData.vpn,
-              error: undefined,
-            };
-          }
-          const { data, timestamp } = await vpnSummaryHandler
-            .handler({ ...integration, kind: "gluetun" }, {})
-            .getDataAsync();
+        async (integration) => {
+          const { data, timestamp } = await vpnSummaryHandler.handler(integration, {}).getDataAsync();
          return {
            integration: {
              id: integration.id,
@@ -48,7 +25,7 @@ export const vpnRouter = createTRPCRouter({
          };
        },
        {
-          fallback: (integration, error): VpnResult => ({
+          fallback: (integration, error) => ({
            integration: {
              id: integration.id,
              name: integration.name,
@@ -1,5 +1,4 @@
 import { wudStatsRequestHandler } from "@homarr/request-handler/wud";
-import { mockWidgetData } from "@homarr/integrations";

 import { createOneIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, publicProcedure } from "../../trpc";
@@ -10,15 +9,12 @@ export const wudRouter = createTRPCRouter({
      mcp: {
        enabled: true,
        description:
-          "Returns monitored-container counts and available updates from a What's Up Docker integration, or mock statistics from a mock integration. REQUIRED: integrationId from integration_all. The caller needs query permission for that integration.",
+          "Returns monitored-container counts and available updates from a What's Up Docker integration. REQUIRED: integrationId from integration_all. The caller needs query permission for that integration.",
      },
    })
-    .concat(createOneIntegrationMiddleware("query", "wud", "mock"))
+    .concat(createOneIntegrationMiddleware("query", "wud"))
    .query(async ({ ctx }) => {
-      if (ctx.integration.kind === "mock") {
-        return { stats: mockWidgetData.wud, updatedAt: new Date(mockWidgetData.timestamp) };
-      }
-      const handler = wudStatsRequestHandler.handler({ ...ctx.integration, kind: "wud" }, {});
+      const handler = wudStatsRequestHandler.handler(ctx.integration, {});
      const { data, timestamp } = await handler.getDataAsync();

      return {
@@ -730,168 +730,6 @@ const buildDemoWidgets = (appIds: string[], customWidgetDefinitionId: string): D
  { kind: "notifications", xOffset: 3, yOffset: 9, width: 2, height: 2, needsIntegration: true },
  { kind: "beszelAlerts", xOffset: 5, yOffset: 9, width: 4, height: 2, needsIntegration: true },

-  // Extended integrations
-  { kind: "mediaTranscoding", xOffset: 0, yOffset: 14, width: 4, height: 3, needsIntegration: true },
-  { kind: "beszelSystemTable", xOffset: 4, yOffset: 14, width: 4, height: 3, needsIntegration: true },
-  { kind: "networkControllerSummary", xOffset: 8, yOffset: 14, width: 4, height: 3, needsIntegration: true },
-  {
-    kind: "networkControllerStatus",
-    xOffset: 0,
-    yOffset: 17,
-    width: 3,
-    height: 2,
-    needsIntegration: true,
-    options: { content: "wifi" },
-  },
-  { kind: "ups", xOffset: 3, yOffset: 17, width: 3, height: 2, needsIntegration: true },
-  {
-    kind: "smartHome-entityState",
-    xOffset: 6,
-    yOffset: 17,
-    width: 3,
-    height: 2,
-    needsIntegration: true,
-    options: { entityId: "sensor.homarr_demo", displayName: "Demo environment", entityUnit: "online" },
-  },
-  {
-    kind: "smartHome-executeAutomation",
-    xOffset: 9,
-    yOffset: 17,
-    width: 3,
-    height: 2,
-    needsIntegration: true,
-    options: { automationId: "automation.homarr_demo", displayName: "Run demo routine" },
-  },
-
-  // Everyday tools
-  { kind: "dnsHoleControls", xOffset: 0, yOffset: 19, width: 2, height: 2, needsIntegration: true },
-  {
-    kind: "bookmarks",
-    xOffset: 2,
-    yOffset: 19,
-    width: 4,
-    height: 2,
-    needsIntegration: false,
-    options: { title: "Launchpad", layout: "grid", items: appIds.slice(0, 6), openNewTab: true },
-  },
-  {
-    kind: "countdown",
-    xOffset: 6,
-    yOffset: 19,
-    width: 2,
-    height: 2,
-    needsIntegration: false,
-    options: {
-      events: [
-        {
-          id: "demo-new-year",
-          label: "New year 2030",
-          targetUtc: "2030-01-01T00:00:00.000Z",
-          startUtc: "2026-01-01T00:00:00.000Z",
-          timeZone: "Europe/Paris",
-          recurrence: "none",
-        },
-      ],
-      showProgress: true,
-      showSeconds: false,
-    },
-  },
-  { kind: "stockPrice", xOffset: 8, yOffset: 19, width: 2, height: 2, needsIntegration: false },
-  { kind: "releases", xOffset: 10, yOffset: 19, width: 2, height: 2, needsIntegration: false },
-  {
-    kind: "iframe",
-    xOffset: 0,
-    yOffset: 21,
-    width: 4,
-    height: 3,
-    needsIntegration: false,
-    options: {
-      embedUrl: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/homarr.svg",
-      allowScrolling: false,
-    },
-  },
-  {
-    kind: "video",
-    xOffset: 4,
-    yOffset: 21,
-    width: 4,
-    height: 3,
-    needsIntegration: false,
-    options: {
-      feedUrl: "https://interactive-examples.mdn.mozilla.net/media/cc0-videos/flower.mp4",
-      hasAutoPlay: false,
-      isMuted: true,
-      hasControls: true,
-    },
-  },
-  { kind: "minecraftServerStatus", xOffset: 8, yOffset: 21, width: 2, height: 3, needsIntegration: false },
-  {
-    kind: "timetable",
-    xOffset: 10,
-    yOffset: 21,
-    width: 2,
-    height: 3,
-    needsIntegration: false,
-    options: { baseUrl: "https://search.ch", station: { value: "8507000", label: "Bern" } },
-  },
-
-  // Complete mock integration gallery
-  {
-    kind: "immich-albumCarousel",
-    xOffset: 0,
-    yOffset: 24,
-    width: 3,
-    height: 3,
-    needsIntegration: true,
-    options: { albumId: "demo-paris", rotationIntervalSeconds: 8, showPhotoInfo: true, randomizePhotos: false },
-  },
-  { kind: "coolify", xOffset: 3, yOffset: 24, width: 3, height: 3, needsIntegration: true },
-  { kind: "systemResources", xOffset: 6, yOffset: 24, width: 3, height: 3, needsIntegration: true },
-  { kind: "systemDisks", xOffset: 9, yOffset: 24, width: 3, height: 3, needsIntegration: true },
-
-  { kind: "immich-serverStats", xOffset: 0, yOffset: 27, width: 2, height: 3, needsIntegration: true },
-  { kind: "paperlessNgx", xOffset: 2, yOffset: 27, width: 2, height: 3, needsIntegration: true },
-  { kind: "patchmon", xOffset: 4, yOffset: 27, width: 2, height: 3, needsIntegration: true },
-  {
-    kind: "speedtestTracker",
-    xOffset: 6,
-    yOffset: 27,
-    width: 4,
-    height: 3,
-    needsIntegration: true,
-    options: { showLatestResult: true, showStats: true, showRecentResults: false, showPingGraph: false },
-  },
-  { kind: "audioStats", xOffset: 10, yOffset: 27, width: 2, height: 3, needsIntegration: true },
-
-  { kind: "uptimeKuma", xOffset: 0, yOffset: 30, width: 3, height: 2, needsIntegration: true },
-  { kind: "firewall", xOffset: 3, yOffset: 30, width: 3, height: 2, needsIntegration: true },
-  { kind: "vpn", xOffset: 6, yOffset: 30, width: 3, height: 2, needsIntegration: true },
-  { kind: "bazarr", xOffset: 9, yOffset: 30, width: 3, height: 2, needsIntegration: true },
-
-  { kind: "archiveTeamWarrior", xOffset: 0, yOffset: 32, width: 3, height: 2, needsIntegration: true },
-  { kind: "wud", xOffset: 3, yOffset: 32, width: 3, height: 2, needsIntegration: true },
-  {
-    kind: "anchorNote",
-    xOffset: 6,
-    yOffset: 32,
-    width: 2,
-    height: 2,
-    needsIntegration: true,
-    options: { noteId: "homarr-demo-note", showTitle: true, showUpdatedAt: true },
-  },
-  { kind: "tracearr", xOffset: 8, yOffset: 32, width: 4, height: 2, needsIntegration: true },
-
-  { kind: "traefik", xOffset: 0, yOffset: 34, width: 6, height: 2, needsIntegration: true },
-  {
-    kind: "umami",
-    xOffset: 6,
-    yOffset: 34,
-    width: 6,
-    height: 2,
-    needsIntegration: true,
-    options: { websiteId: "homarr-demo", timeFrame: "24h", viewMode: "chart", chartType: "bar" },
-  },
-
  // Right app rail
  ...appIds.map(
    (appId, index): DemoWidget => ({
@@ -7,7 +7,6 @@ import SuperJSON from "superjson";
 import { expect, test } from "vitest";

 import { DB_CASING } from "@homarr/core/infrastructure/db/constants";
-import { widgetIntegrationSupport, widgetKinds } from "@homarr/definitions";

 import type { Database } from "..";
 import { seedDataAsync } from "../migrations/seed";
@@ -46,7 +45,7 @@ test("SQLite migrations seed the five disabled bundled custom widgets", async ()
  connection.close();
 });

-test("SQLite migrations seed the complete demo widget gallery", async () => {
+test("SQLite migrations seed the redesigned demo dashboard", async () => {
  const previousDemoMode = process.env.DEMO_MODE;
  process.env.DEMO_MODE = "true";
  const connection = new BetterSqlite3(":memory:");
@@ -66,7 +65,7 @@ test("SQLite migrations seed the complete demo widget gallery", async () => {
      with: {
        layouts: true,
        sections: { with: { collapseStates: true, layouts: true } },
-        items: { with: { integrations: true, layouts: true } },
+        items: { with: { layouts: true } },
      },
    });
    if (!board) throw new Error("Demo board was not seeded");
@@ -127,18 +126,6 @@ test("SQLite migrations seed the complete demo widget gallery", async () => {
    expectItemLayout("notifications", 3, 9, 2, 2);
    expectItemLayout("beszelAlerts", 5, 9, 4, 2);

-    expect(new Set(board.items.map((item) => item.kind))).toEqual(new Set(widgetKinds));
-    const mockIntegration = await database.query.integrations.findFirst({
-      where: (table, { eq }) => eq(table.kind, "mock"),
-    });
-    if (!mockIntegration) throw new Error("Demo mock integration was not seeded");
-    for (const item of board.items) {
-      if (widgetIntegrationSupport[item.kind] === undefined) continue;
-      expect(item.integrations).toEqual([
-        expect.objectContaining({ integrationId: mockIntegration.id, itemId: item.id }),
-      ]);
-    }
-
    for (const kind of ["weather", "airQuality"]) {
      const item = itemByKind(kind);
      if (!item?.options) throw new Error(`Demo ${kind} options were not seeded`);
@@ -26,12 +26,6 @@ describe("native feature capability descriptor", () => {
    }
  });

-  test("supports the mock integration for every integration-backed widget", () => {
-    for (const capability of Object.values(nativeFeatureCapabilities)) {
-      expect(capability.integrations).toContain("mock");
-    }
-  });
-
  test("derives optional connections and server selection limits", () => {
    expect(widgetKindsWithOptionalIntegrations).toEqual(new Set(["calendar"]));
    expect(widgetIntegrationLimits).toEqual({
@@ -41,32 +41,32 @@ export const nativeFeatureCapabilities = {
      (kind) => kind !== "patchmon" && kind !== "wud",
    ),
  },
-  firewall: { integrations: [...getIntegrationKindsByCategory("firewall"), "mock"] },
+  firewall: { integrations: getIntegrationKindsByCategory("firewall") },
  notifications: { integrations: getIntegrationKindsByCategory("notifications") },
  mediaReleases: { integrations: ["mock", "emby", "jellyfin", "plex"] },
-  systemResources: { integrations: ["dashDot", "openmediavault", "truenas", "unraid", "glances", "synology", "mock"] },
-  systemDisks: { integrations: ["dashDot", "openmediavault", "truenas", "unraid", "synology", "mock"] },
+  systemResources: { integrations: ["dashDot", "openmediavault", "truenas", "unraid", "glances", "synology"] },
+  systemDisks: { integrations: ["dashDot", "openmediavault", "truenas", "unraid", "synology"] },
  beszelAlerts: { integrations: ["beszel", "mock"] },
  beszelSystemGrid: { integrations: ["beszel", "mock"] },
  beszelSystemStats: { integrations: ["beszel", "mock"] },
  beszelSystemTable: { integrations: ["beszel", "mock"] },
-  coolify: { integrations: ["coolify", "mock"] },
-  "immich-serverStats": { integrations: ["immich", "mock"], serverMaxIntegrations: 1 },
-  "immich-albumCarousel": { integrations: ["immich", "mock"], serverMaxIntegrations: 1 },
-  paperlessNgx: { integrations: ["paperlessNgx", "mock"], serverMaxIntegrations: 1 },
-  patchmon: { integrations: ["patchmon", "mock"], serverMaxIntegrations: 1 },
-  bazarr: { integrations: ["bazarr", "mock"], serverMaxIntegrations: 1 },
-  tracearr: { integrations: ["tracearr", "mock"] },
-  speedtestTracker: { integrations: ["speedtestTracker", "mock"] },
-  uptimeKuma: { integrations: ["uptimeKuma", "mock"] },
-  audioStats: { integrations: ["navidrome", "audiobookshelf", "mock"], serverMaxIntegrations: 1 },
-  umami: { integrations: ["umami", "mock"], serverMaxIntegrations: 1 },
-  vpn: { integrations: [...getIntegrationKindsByCategory("vpn"), "mock"] },
+  coolify: { integrations: ["coolify"] },
+  "immich-serverStats": { integrations: ["immich"], serverMaxIntegrations: 1 },
+  "immich-albumCarousel": { integrations: ["immich"], serverMaxIntegrations: 1 },
+  paperlessNgx: { integrations: ["paperlessNgx"], serverMaxIntegrations: 1 },
+  patchmon: { integrations: ["patchmon"], serverMaxIntegrations: 1 },
+  bazarr: { integrations: ["bazarr"], serverMaxIntegrations: 1 },
+  tracearr: { integrations: ["tracearr"] },
+  speedtestTracker: { integrations: ["speedtestTracker"] },
+  uptimeKuma: { integrations: ["uptimeKuma"] },
+  audioStats: { integrations: ["navidrome", "audiobookshelf"], serverMaxIntegrations: 1 },
+  umami: { integrations: ["umami"], serverMaxIntegrations: 1 },
+  vpn: { integrations: getIntegrationKindsByCategory("vpn") },
  ups: { integrations: getIntegrationKindsByCategory("ups") },
-  archiveTeamWarrior: { integrations: ["archiveTeamWarrior", "mock"], serverMaxIntegrations: 1 },
-  anchorNote: { integrations: ["anchor", "mock"], serverMaxIntegrations: 1 },
-  traefik: { integrations: ["traefik", "mock"] },
-  wud: { integrations: ["wud", "mock"], serverMaxIntegrations: 1 },
+  archiveTeamWarrior: { integrations: ["archiveTeamWarrior"], serverMaxIntegrations: 1 },
+  anchorNote: { integrations: ["anchor"], serverMaxIntegrations: 1 },
+  traefik: { integrations: ["traefik"] },
+  wud: { integrations: ["wud"], serverMaxIntegrations: 1 },
 } as const satisfies Partial<Record<WidgetKind, NativeFeatureCapabilityDescriptor>>;

 const nativeFeatureCapabilityEntries = Object.entries(nativeFeatureCapabilities) as [
@@ -45,7 +45,6 @@ export { UmamiIntegration } from "./umami/umami-integration";
 export { PeaNutIntegration } from "./peanut/peanut-integration";
 export { BazarrIntegration } from "./bazarr/bazarr-integration";
 export { TraefikIntegration } from "./traefik/traefik-integration";
-export { mockWidgetData } from "./mock/widget-data";

 // Types
 export type { IntegrationInput } from "./base/integration";
@@ -1,355 +0,0 @@
-import type { AnchorNote, AnchorNoteSummary } from "../anchor/anchor-types";
-import type { ArchiveTeamWarriorStatus } from "../archive-team-warrior/archive-team-warrior-types";
-import type { BazarrBadges } from "../bazarr/bazarr-types";
-import type { CoolifyInstanceInfo } from "../coolify/coolify-types";
-import type { ImmichAlbum, ImmichServerStats } from "../immich/immich-integration";
-import type { NavidromeDashboardData } from "../navidrome/navidrome-types";
-import type { PaperlessNgxStats } from "../paperless-ngx/paperless-ngx-types";
-import type { PatchMonStats } from "../patchmon/patchmon-types";
-import type { SpeedtestTrackerDashboardData } from "../speedtest-tracker/speedtest-tracker-types";
-import type { TracearrDashboardData } from "../tracearr/tracearr-types";
-import type { TraefikDashboardData } from "../traefik/traefik-types";
-import type { UmamiEventSeries, UmamiMetricItem, UmamiVisitorStats, UmamiWebsite } from "../umami/umami-types";
-import type { UptimeKumaDashboardData } from "../uptime-kuma/uptime-kuma-types";
-import type { WudStats } from "../wud/wud-types";
-import type {
-  FirewallCpuSummary,
-  FirewallInterfacesSummary,
-  FirewallMemorySummary,
-  FirewallVersionSummary,
-} from "../interfaces/firewall-summary/firewall-summary-types";
-import type { VpnSummary } from "../interfaces/vpn-summary/vpn-summary-types";
-
-const demoTimestamp = "2026-08-24T12:00:00.000Z";
-
-const anchorNote: AnchorNote = {
-  id: "homarr-demo-note",
-  title: "Homarr demo runbook",
-  content: JSON.stringify({
-    ops: [
-      { insert: "Welcome to the complete Homarr widget gallery.\n", attributes: { bold: true } },
-      { insert: "Every integration-backed card below is powered by safe mock data.\n" },
-    ],
-  }),
-  createdAt: demoTimestamp,
-  updatedAt: demoTimestamp,
-  isPinned: true,
-  isArchived: false,
-  tagIds: ["demo"],
-  permission: "editor",
-  background: null,
-  userId: "demo",
-};
-
-export const mockWidgetData = {
-  timestamp: demoTimestamp,
-  anchorNote,
-  anchorNotes: [
-    {
-      id: anchorNote.id,
-      title: anchorNote.title,
-      updatedAt: anchorNote.updatedAt,
-      isPinned: anchorNote.isPinned,
-      tagIds: anchorNote.tagIds,
-      permission: anchorNote.permission,
-    },
-  ] satisfies AnchorNoteSummary[],
-  archiveTeamWarrior: {
-    status: "running",
-    runnerStatus: "running",
-    project: { id: "urlteam2", title: "URLTeam 2" },
-    selectedProject: "urlteam2",
-    broadcastMessage: "Archiving the open web, one URL at a time.",
-    bandwidth: {
-      received: 8_942_000_000,
-      sent: 1_284_000_000,
-      receiving: 4_800_000,
-      sending: 720_000,
-      session_id: "homarr-demo-session",
-    },
-    items: [
-      { id: "demo-1", name: "urls-20260824-01", status: "running", project: "urlteam2", startTime: 1_777_000_000 },
-      { id: "demo-2", name: "urls-20260824-00", status: "completed", project: "urlteam2" },
-    ],
-    counts: { running: 1, completed: 284, failed: 2, canceled: 0 },
-    updatedAt: demoTimestamp,
-  } satisfies ArchiveTeamWarriorStatus,
-  audioStats: { artistCount: 842, albumCount: 1_976, songCount: 24_681 } satisfies NavidromeDashboardData,
-  bazarr: {
-    episodes: 12,
-    movies: 4,
-    providers: 6,
-    status: 0,
-    sonarr_signalr: "connected",
-    radarr_signalr: "connected",
-    announcements: 1,
-  } satisfies BazarrBadges,
-  coolify: {
-    version: "4.0.0-beta.420",
-    servers: [
-      {
-        id: 1,
-        uuid: "homarr-demo-edge",
-        name: "Paris edge",
-        ip: "10.0.0.20",
-        is_reachable: true,
-        is_usable: true,
-        settings: { server_id: 1, is_build_server: true, is_reachable: true, is_usable: true },
-      },
-    ],
-    applications: [
-      {
-        id: 1,
-        uuid: "homarr-demo-app",
-        name: "Homarr",
-        status: "running:healthy",
-        fqdn: "https://homarr.dev",
-        projectName: "Home cloud",
-        environmentName: "Production",
-      },
-      {
-        id: 2,
-        uuid: "media-demo-app",
-        name: "Media stack",
-        status: "running:healthy",
-        fqdn: null,
-        projectName: "Home cloud",
-        environmentName: "Production",
-      },
-    ],
-    services: [
-      {
-        id: 3,
-        uuid: "postgres-demo-service",
-        name: "Postgres",
-        status: "running:healthy",
-        fqdn: null,
-        applications: [],
-        projectName: "Home cloud",
-        environmentName: "Production",
-      },
-    ],
-  } satisfies CoolifyInstanceInfo,
-  firewallCpu: { total: 23 } satisfies FirewallCpuSummary,
-  firewallInterfaces: [
-    {
-      data: [
-        { name: "WAN", receive: 18_400_000, transmit: 4_200_000 },
-        { name: "LAN", receive: 46_700_000, transmit: 21_300_000 },
-      ],
-      timestamp: new Date(demoTimestamp),
-    },
-  ] satisfies FirewallInterfacesSummary[],
-  firewallMemory: { used: 3_220_000_000, total: 8_590_000_000, percent: 37.5 } satisfies FirewallMemorySummary,
-  firewallVersion: { version: "24.7.11" } satisfies FirewallVersionSummary,
-  immichStats: {
-    userCount: 4,
-    photoCount: 48_392,
-    videoCount: 2_418,
-    totalLibraryUsageInBytes: 684_510_412_800,
-  } satisfies ImmichServerStats,
-  immichAlbums: [
-    { id: "demo-paris", albumName: "Paris weekend", assetCount: 128 },
-    { id: "demo-mountains", albumName: "Alpine trails", assetCount: 84 },
-  ],
-  immichAlbum: {
-    id: "demo-paris",
-    albumName: "Paris weekend",
-    assets: [
-      {
-        id: "demo-photo-1",
-        thumbhash: null,
-        fileModifiedAt: demoTimestamp,
-        fileCreatedAt: demoTimestamp,
-        updatedAt: demoTimestamp,
-        type: "IMAGE",
-        publicLink: "https://images.unsplash.com/photo-1502602898657-3e91760cbb34?auto=format&fit=crop&w=1200&q=80",
-      },
-      {
-        id: "demo-photo-2",
-        thumbhash: null,
-        fileModifiedAt: demoTimestamp,
-        fileCreatedAt: demoTimestamp,
-        updatedAt: demoTimestamp,
-        type: "IMAGE",
-        publicLink: "https://images.unsplash.com/photo-1464822759023-fed622ff2c3b?auto=format&fit=crop&w=1200&q=80",
-      },
-    ],
-  } satisfies ImmichAlbum,
-  paperlessNgx: {
-    documentsTotal: 2_847,
-    documentsInbox: 14,
-    correspondentsCount: 96,
-    tagsCount: 38,
-    documentTypesCount: 12,
-  } satisfies PaperlessNgxStats,
-  patchmon: {
-    totalHosts: 18,
-    hostsNeedingUpdates: 5,
-    securityUpdates: 7,
-    upToDateHosts: 13,
-    hostsWithSecurityUpdates: 3,
-    recentUpdates24h: 11,
-    totalOutdatedPackages: 26,
-    totalRepos: 42,
-    lastUpdated: demoTimestamp,
-    osDistribution: [
-      { name: "Ubuntu 24.04", count: 9, osType: "linux", osVersion: "24.04" },
-      { name: "Debian 13", count: 6, osType: "linux", osVersion: "13" },
-      { name: "Fedora 42", count: 3, osType: "linux", osVersion: "42" },
-    ],
-  } satisfies PatchMonStats,
-  speedtestTracker: {
-    latestResult: {
-      id: 42,
-      ping: 8.4,
-      download_bits: 936_000_000,
-      upload_bits: 487_000_000,
-      healthy: true,
-      created_at: new Date(demoTimestamp),
-    },
-    stats: {
-      ping: { avg: 9.1, min: 6.8, max: 14.2 },
-      download: { avg: 901, avg_bits: 901_000_000, min: 822, max: 948 },
-      upload: { avg: 472, avg_bits: 472_000_000, min: 431, max: 495 },
-      total_results: 128,
-    },
-    recentResults: [
-      {
-        id: 42,
-        ping: 8.4,
-        download_bits: 936_000_000,
-        upload_bits: 487_000_000,
-        healthy: true,
-        created_at: new Date(demoTimestamp),
-      },
-    ],
-  } satisfies SpeedtestTrackerDashboardData,
-  tracearr: {
-    stats: { activeStreams: 2, totalUsers: 14, totalSessions: 1_248, recentViolations: 1, timestamp: demoTimestamp },
-    streams: {
-      data: [],
-      summary: {
-        total: 2,
-        transcodes: 1,
-        directStreams: 0,
-        directPlays: 1,
-        totalBitrate: "24.8 Mbps",
-        byServer: [
-          {
-            serverId: "demo",
-            serverName: "Homarr Media",
-            total: 2,
-            transcodes: 1,
-            directStreams: 0,
-            directPlays: 1,
-            totalBitrate: "24.8 Mbps",
-          },
-        ],
-      },
-    },
-    violations: { data: [], meta: { total: 1, page: 1, pageSize: 10 } },
-    recentActivity: { data: [], meta: { total: 1_248, page: 1, pageSize: 10 } },
-  } satisfies TracearrDashboardData,
-  traefik: {
-    version: "3.5.0",
-    entryPoints: ["web", "websecure", "metrics"],
-    failedEndpoints: [],
-    resources: [
-      { protocol: "http", type: "router", name: "homarr@docker", provider: "docker", status: "enabled" },
-      { protocol: "http", type: "service", name: "homarr@docker", provider: "docker", status: "enabled" },
-      { protocol: "http", type: "middleware", name: "secure-headers@file", provider: "file", status: "enabled" },
-    ],
-    http: {
-      routers: { total: 12, enabled: 12, warnings: 0, errors: 0 },
-      services: { total: 10, enabled: 10, warnings: 0, errors: 0 },
-      middlewares: { total: 8, enabled: 8, warnings: 0, errors: 0 },
-    },
-    tcp: {
-      routers: { total: 2, enabled: 2, warnings: 0, errors: 0 },
-      services: { total: 2, enabled: 2, warnings: 0, errors: 0 },
-      middlewares: { total: 0, enabled: 0, warnings: 0, errors: 0 },
-    },
-    udp: {
-      routers: { total: 1, enabled: 1, warnings: 0, errors: 0 },
-      services: { total: 1, enabled: 1, warnings: 0, errors: 0 },
-    },
-  } satisfies TraefikDashboardData,
-  umamiWebsites: [{ id: "homarr-demo", name: "Homarr demo", domain: "demo.homarr.dev" }] satisfies UmamiWebsite[],
-  umamiVisitorStats: {
-    domain: "demo.homarr.dev",
-    websiteId: "homarr-demo",
-    websiteName: "Homarr demo",
-    totalVisitors: 8_429,
-    totalPageviews: 21_384,
-    totalVisits: 11_207,
-    bounceRate: 32.4,
-    avgDuration: 284,
-    timeFrame: "24h",
-    dataPoints: [
-      { timestamp: "2026-08-24T08:00:00.000Z", visitors: 280, events: 0 },
-      { timestamp: "2026-08-24T10:00:00.000Z", visitors: 410, events: 0 },
-      { timestamp: "2026-08-24T12:00:00.000Z", visitors: 536, events: 0 },
-    ],
-    eventCount: 0,
-  } satisfies UmamiVisitorStats,
-  umamiEventNames: ["dashboard_opened", "widget_added", "board_shared"],
-  umamiTopPages: [
-    { x: "/", y: 8_240 },
-    { x: "/boards/home", y: 5_812 },
-    { x: "/manage/integrations", y: 1_942 },
-  ] satisfies UmamiMetricItem[],
-  umamiTopReferrers: [
-    { x: "github.com", y: 3_842 },
-    { x: "google.com", y: 2_106 },
-    { x: "docs.homarr.dev", y: 1_284 },
-  ] satisfies UmamiMetricItem[],
-  umamiEventSeries: [
-    {
-      eventName: "dashboard_opened",
-      dataPoints: [
-        { x: "2026-08-24T08:00:00.000Z", y: 92 },
-        { x: "2026-08-24T10:00:00.000Z", y: 134 },
-        { x: "2026-08-24T12:00:00.000Z", y: 188 },
-      ],
-    },
-  ] satisfies UmamiEventSeries[],
-  uptimeKuma: {
-    totalMonitors: 6,
-    upCount: 5,
-    downCount: 1,
-    pausedCount: 0,
-    averageUptimePercent: 99.72,
-    monitors: [
-      { id: 1, name: "Homarr", status: "up", uptimePercent24h: 100 },
-      { id: 2, name: "Media server", status: "up", uptimePercent24h: 99.98 },
-      { id: 3, name: "Home cloud", status: "up", uptimePercent24h: 99.91 },
-      { id: 4, name: "Backups", status: "up", uptimePercent24h: 99.62 },
-      { id: 5, name: "VPN", status: "up", uptimePercent24h: 99.8 },
-      { id: 6, name: "Lab service", status: "down", uptimePercent24h: 98.99 },
-    ],
-  } satisfies UptimeKumaDashboardData,
-  vpn: {
-    vpnStatus: "running",
-    dnsStatus: "running",
-    publicIp: "198.51.100.42",
-    country: "France",
-    city: "Paris",
-    vpnProvider: { protocol: "wireguard", provider: "Mullvad" },
-  } satisfies VpnSummary,
-  wud: {
-    totalContainers: 24,
-    updatesAvailable: 3,
-    updates: [
-      {
-        id: "homarr",
-        name: "Homarr",
-        currentVersion: "v1.35.0",
-        newVersion: "v1.36.0",
-        link: "https://github.com/homarr-labs/homarr",
-      },
-      { id: "postgres", name: "Postgres", currentVersion: "17.5", newVersion: "17.6", link: null },
-      { id: "redis", name: "Redis", currentVersion: "8.0.2", newVersion: "8.0.3", link: null },
-    ],
-  } satisfies WudStats,
-} as const;
@@ -31,11 +31,14 @@
 }

 .marqueeRail {
+  --marquee-horizontal-mask: linear-gradient(black, black);
  position: absolute;
  top: -14rem;
  bottom: -14rem;
  width: clamp(22rem, 26vw, 32rem);
-  mask-image: linear-gradient(to bottom, transparent, black 10%, black 90%, transparent);
+  mask-image:
+    linear-gradient(to bottom, transparent, black 10%, black 90%, transparent), var(--marquee-horizontal-mask);
+  mask-composite: intersect;
 }

 .marqueeRail > * {
@@ -46,12 +49,14 @@
 .marqueeRailLeft {
  left: -7rem;
  --integration-marquee-accent: var(--studio-glow-color);
+  --marquee-horizontal-mask: linear-gradient(to right, black 55%, transparent);
 }

 .marqueeRailRight {
  right: -7rem;
  top: -22rem;
  --integration-marquee-accent: var(--studio-secondary-glow-color);
+  --marquee-horizontal-mask: linear-gradient(to left, black 55%, transparent);
 }

 .shell {
@@ -1,8 +1,7 @@
 "use client";

-import type { CSSProperties, MouseEvent as ReactMouseEvent } from "react";
+import type { CSSProperties } from "react";
 import { useState } from "react";
-import { useComputedColorScheme } from "@mantine/core";
 import confetti from "canvas-confetti";

 import HomarrWordmarkLight from "./homarr-wordmark-light";
@@ -15,21 +14,23 @@ interface OnboardingWordmarkProps {
  large?: boolean;
 }

+const defaultWordmarkUrl = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/homarr-wordmark-light.svg";
+
 export const OnboardingWordmark = ({ primaryColor, secondaryColor, large = false }: OnboardingWordmarkProps) => {
  const [celebrating, setCelebrating] = useState(false);
-  const colorScheme = useComputedColorScheme("light");
  const sounds = useOnboardingSounds();
+  const className = `${classes.wordmark} ${classes.onboardingWordmark} ${large ? classes.welcomeWordmark : ""} ${celebrating ? classes.celebratingWordmark : ""}`;
  const colors = {
    "--homarr-wordmark-primary": primaryColor ?? "#F92424",
    "--homarr-wordmark-secondary": secondaryColor ?? "#FA5252",
-    "--homarr-wordmark-foreground": colorScheme === "light" ? "#1A1B1E" : "#FEFDFD",
+    "--homarr-wordmark-foreground": "#FEFDFD",
  } as CSSProperties;

-  const celebrate = (event: ReactMouseEvent<SVGSVGElement>) => {
+  const celebrate = (logoElement: Element) => {
    sounds.hover();
-    const logo = event.currentTarget.getBoundingClientRect();
+    const logo = logoElement.getBoundingClientRect();
    const originY = (logo.top + logo.height / 2) / window.innerHeight;
-    const colors = primaryColor && secondaryColor ? [primaryColor, secondaryColor] : undefined;
+    const confettiColors = primaryColor && secondaryColor ? [primaryColor, secondaryColor] : undefined;

    if (!window.matchMedia("(prefers-reduced-motion: reduce)").matches) setCelebrating(true);
    for (const { angle, originX } of [
@@ -45,19 +46,23 @@ export const OnboardingWordmark = ({ primaryColor, secondaryColor, large = false
        ticks: 90,
        scalar: 0.8,
        origin: { x: originX / window.innerWidth, y: originY },
-        colors,
+        colors: confettiColors,
        disableForReducedMotion: true,
      });
    }
  };

+  if (primaryColor === undefined && secondaryColor === undefined) {
+    return <img src={defaultWordmarkUrl} alt="Homarr" width={1477} height={1054} className={className} />;
+  }
+
  return (
    <HomarrWordmarkLight
      role="img"
      aria-label="Homarr"
      style={colors}
-      className={`${classes.wordmark} ${classes.onboardingWordmark} ${large ? classes.welcomeWordmark : ""} ${celebrating ? classes.celebratingWordmark : ""}`}
-      onMouseEnter={celebrate}
+      className={className}
+      onMouseEnter={(event) => celebrate(event.currentTarget)}
      onAnimationEnd={() => setCelebrating(false)}
    />
  );
@@ -8,7 +8,7 @@ export const { definition, componentLoader } = createWidgetDefinition("anchorNot
  supportsAdvancedFocus: true,
  queryKey: [["widget", "anchorNotes"]],
  maxIntegrations: 1,
-  supportedIntegrations: ["anchor", "mock"],
+  supportedIntegrations: ["anchor"],
  createOptions() {
    return optionsBuilder.from((factory) => ({
      noteId: factory.anchorNote(),
@@ -14,5 +14,5 @@ export const { definition, componentLoader } = createWidgetDefinition("archiveTe
      }),
    }));
  },
-  supportedIntegrations: ["archiveTeamWarrior", "mock"],
+  supportedIntegrations: ["archiveTeamWarrior"],
 }).withDynamicImport(() => import("./component"));
@@ -4,8 +4,7 @@ import { createWidgetDefinition, matchesWidgetRuntimeQuery } from "../definition
 import { optionsBuilder } from "../options";

 const hideUnlessNavidrome = {
-  shouldHide: (_: unknown, integrationKinds: string[]) =>
-    !integrationKinds.includes("navidrome") && !integrationKinds.includes("mock"),
+  shouldHide: (_: unknown, integrationKinds: string[]) => !integrationKinds.includes("navidrome"),
 };

 const hideUnlessAudiobookshelf = {
@@ -17,7 +16,7 @@ export const { definition, componentLoader } = createWidgetDefinition("audioStat
  supportsAdvancedFocus: true,
  queryKeys: [[["widget", "audioStats", "getStats"]], [["widget", "mediaServer", "getCurrentStreams"]]],
  queryMatcher: matchesWidgetRuntimeQuery,
-  supportedIntegrations: ["navidrome", "audiobookshelf", "mock"],
+  supportedIntegrations: ["navidrome", "audiobookshelf"],
  integrationsRequired: true,
  maxIntegrations: 1,
  createOptions() {
@@ -6,7 +6,7 @@ import { optionsBuilder } from "../options";
 export const { definition, componentLoader } = createWidgetDefinition("bazarr", {
  supportsAdvancedFocus: true,
  icon: IconBadgeCc,
-  supportedIntegrations: ["bazarr", "mock"],
+  supportedIntegrations: ["bazarr"],
  integrationsRequired: true,
  maxIntegrations: 1,
  createOptions() {
@@ -19,7 +19,7 @@ export const { definition, componentLoader } = createWidgetDefinition("coolify",
      }),
    }));
  },
-  supportedIntegrations: ["coolify", "mock"],
+  supportedIntegrations: ["coolify"],
  errors: {
    INTERNAL_SERVER_ERROR: {
      icon: IconServerOff,
@@ -12,7 +12,7 @@ export const { definition, componentLoader } = createWidgetDefinition("firewall"
  createOptions() {
    return optionsBuilder.from(() => ({}));
  },
-  supportedIntegrations: [...getIntegrationKindsByCategory("firewall"), "mock"],
+  supportedIntegrations: getIntegrationKindsByCategory("firewall"),
  errors: {
    INTERNAL_SERVER_ERROR: {
      icon: IconWallOff,
@@ -62,7 +62,7 @@ export const { definition, componentLoader } = createWidgetDefinition("immich-al
          : undefined,
    }),
  refetchInterval: null,
-  supportedIntegrations: ["immich", "mock"],
+  supportedIntegrations: ["immich"],
  integrationsRequired: true,
  maxIntegrations: 1,
  contextActions: ({ widgetRuntimeRef }) => {
@@ -9,7 +9,7 @@ export const { definition, componentLoader } = createWidgetDefinition("immich-se
  queryKeys: [[["widget", "immich", "getServerStats"]], [["widget", "immich", "getAlbums"]]],
  queryMatcher: matchesWidgetRuntimeQuery,
  refetchInterval: null,
-  supportedIntegrations: ["immich", "mock"],
+  supportedIntegrations: ["immich"],
  integrationsRequired: true,
  maxIntegrations: 1,
  createOptions() {
@@ -7,7 +7,7 @@ export const { definition, componentLoader } = createWidgetDefinition("paperless
  supportsAdvancedFocus: false,
  icon: IconFileText,
  refetchInterval: null,
-  supportedIntegrations: ["paperlessNgx", "mock"],
+  supportedIntegrations: ["paperlessNgx"],
  integrationsRequired: true,
  maxIntegrations: 1,
  createOptions() {
@@ -9,7 +9,7 @@ import { patchmonOptionsSuperRefine } from "./threshold-validation";
 export const { definition, componentLoader } = createWidgetDefinition("patchmon", {
  supportsAdvancedFocus: true,
  icon: IconShieldCheck,
-  supportedIntegrations: ["patchmon", "mock"],
+  supportedIntegrations: ["patchmon"],
  integrationsRequired: true,
  maxIntegrations: 1,
  createOptions() {
@@ -30,7 +30,7 @@ export const { definition, componentLoader } = createWidgetDefinition("speedtest
      },
    );
  },
-  supportedIntegrations: ["speedtestTracker", "mock"],
+  supportedIntegrations: ["speedtestTracker"],
  errors: {
    INTERNAL_SERVER_ERROR: {
      icon: IconServerOff,
@@ -9,7 +9,7 @@ export const { definition, componentLoader } = createWidgetDefinition("systemDis
  icon: IconServer2,
  queryKey: [["widget", "healthMonitoring"]],
  refetchInterval: 10,
-  supportedIntegrations: ["dashDot", "openmediavault", "truenas", "unraid", "synology", "mock"],
+  supportedIntegrations: ["dashDot", "openmediavault", "truenas", "unraid", "synology"],
  createOptions() {
    return optionsBuilder.from(
      (factory) => ({
@@ -24,7 +24,7 @@ export const { definition, componentLoader } = createWidgetDefinition("systemRes
  supportsAdvancedFocus: true,
  queryKey: [["widget", "healthMonitoring"]],
  refetchInterval: 10,
-  supportedIntegrations: ["dashDot", "openmediavault", "truenas", "unraid", "glances", "synology", "mock"],
+  supportedIntegrations: ["dashDot", "openmediavault", "truenas", "unraid", "glances", "synology"],
  createOptions() {
    return optionsBuilder.from((factory) => ({
      hasShadow: factory.switch({ defaultValue: true }),
@@ -24,7 +24,7 @@ export const { definition, componentLoader } = createWidgetDefinition("tracearr"
      }),
    }));
  },
-  supportedIntegrations: ["tracearr", "mock"],
+  supportedIntegrations: ["tracearr"],
  errors: {
    INTERNAL_SERVER_ERROR: {
      icon: IconServerOff,
@@ -19,7 +19,7 @@ export const { definition, componentLoader } = createWidgetDefinition("traefik",
      }),
    }));
  },
-  supportedIntegrations: ["traefik", "mock"],
+  supportedIntegrations: ["traefik"],
  errors: {
    INTERNAL_SERVER_ERROR: {
      icon: IconRouteOff,
@@ -18,7 +18,7 @@ export const { definition, componentLoader } = createWidgetDefinition("umami", {
  ],
  queryMatcher: matchesWidgetRuntimeQuery,
  refetchInterval: null,
-  supportedIntegrations: ["umami", "mock"],
+  supportedIntegrations: ["umami"],
  integrationsRequired: true,
  maxIntegrations: 1,
  createOptions() {
@@ -34,7 +34,7 @@ export const { definition, componentLoader } = createWidgetDefinition("uptimeKum
      }),
    }));
  },
-  supportedIntegrations: ["uptimeKuma", "mock"],
+  supportedIntegrations: ["uptimeKuma"],
  errors: {
    INTERNAL_SERVER_ERROR: {
      icon: IconServerOff,
@@ -12,5 +12,5 @@ export const { componentLoader, definition } = createWidgetDefinition("vpn", {
  createOptions() {
    return optionsBuilder.from(() => ({}));
  },
-  supportedIntegrations: [...getIntegrationKindsByCategory("vpn"), "mock"],
+  supportedIntegrations: getIntegrationKindsByCategory("vpn"),
 }).withDynamicImport(() => import("./component"));
@@ -7,7 +7,7 @@ export const { definition, componentLoader } = createWidgetDefinition("wud", {
  icon: IconBrandDocker,
  supportsAdvancedFocus: true,
  refetchInterval: null,
-  supportedIntegrations: ["wud", "mock"],
+  supportedIntegrations: ["wud"],
  integrationsRequired: true,
  maxIntegrations: 1,
  createOptions() {