fix(onboarding): avoid mutating emptyResult in docker discovery catch path

Fix app-only continue flow, handle stale label sync, per-layout yOffset,
blank label normalization, updatedAt on source upsert, docs link, and
forceDisableStatus for ping-enabled apps.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -33,6 +33,7 @@ body:
       options:
         # The below comment is used to insert a new version with on-release.yml
         #NEXT_VERSION#
+        - 1.68.0
         - 1.67.0
         - 1.66.1
         - 1.66.0

.github/workflows/code-quality.yml

@@ -163,3 +163,65 @@ jobs:
         run: cp .env.example .env
       - name: Build
         run: pnpm turbo build --affected
+
+  memory-regression:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      - name: Build Docker image
+        uses: docker/build-push-action@v7
+        with:
+          platforms: linux/amd64
+          context: .
+          push: false
+          load: true
+          tags: homarr-memory-test
+          network: host
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+        env:
+          SKIP_ENV_VALIDATION: true
+      - name: Start container and measure memory
+        run: |
+          docker run -d --name homarr-mem-test -p 17575:7575 homarr-memory-test
+          # Wait for container to be healthy (up to 60s)
+          healthy=false
+          for i in $(seq 1 30); do
+            if curl -sf http://localhost:17575/api/health 2>/dev/null; then
+              echo "Container healthy after $((i * 2))s"
+              healthy=true
+              break
+            fi
+            sleep 2
+          done
+          if [ "$healthy" != "true" ]; then
+            echo "ERROR: Container never became healthy"
+            docker logs homarr-mem-test --tail 50
+            exit 1
+          fi
+          # Warm up: hit the dashboard page a few times
+          for i in $(seq 1 5); do
+            curl -sf http://localhost:17575/ > /dev/null 2>&1 || true
+            sleep 2
+          done
+          # Measure RSS after warmup
+          MEM_KB=$(docker stats --no-stream --format '{{.MemUsage}}' homarr-mem-test | sed 's| /.*||')
+          echo "Raw memory: $MEM_KB"
+          # Convert to numeric MB (handles GiB and MiB suffixes)
+          MEM_NUM=$(echo "$MEM_KB" | awk '{
+            if ($0 ~ /GiB/) { gsub(/GiB/,""); print $1 * 1024 }
+            else if ($0 ~ /MiB/) { gsub(/MiB/,""); print $1 }
+            else if ($0 ~ /KiB/) { gsub(/KiB/,""); print $1 / 1024 }
+            else { print $1 / 1048576 }
+          }')
+          echo "Memory usage: ${MEM_NUM} MB"
+          MAX_MB=700
+          if awk "BEGIN {exit !($MEM_NUM > $MAX_MB)}"; then
+            echo "ERROR: Memory usage ${MEM_NUM} MB exceeds ${MAX_MB} MB threshold"
+            docker logs homarr-mem-test --tail 50
+            exit 1
+          fi
+          echo "Memory check passed: ${MEM_NUM} MB <= ${MAX_MB} MB"

.github/workflows/deployment-docker-image.yml

@@ -66,7 +66,7 @@ jobs:
       - uses: actions/setup-node@v6
         if: env.SKIP_RELEASE == 'false'
         with:
-          node-version: 24.16.0
+          node-version: 24.18.0
           package-manager-cache: false
       - run: npm i -g pnpm
         if: env.SKIP_RELEASE == 'false'

.mise.toml

@@ -1,2 +1,2 @@
 [tools]
-node = "24.16.0"
+node = "24.18.0"

.nvmrc

@@ -1 +1 @@
-24.16.0
+24.18.0

.vscode/extensions.json

@@ -1,7 +1,7 @@
 {
   "recommendations": [
     "dbaeumer.vscode-eslint",
-    "esbenp.prettier-vscode",
+    "oxc.oxc-vscode",
     "yoavbls.pretty-ts-errors",
     "million.million-lint",
     "lokalise.i18n-ally"

CHANGELOG.md

@@ -1,3 +1,36 @@
+## [1.68.1](https://github.com/homarr-labs/homarr/compare/v1.68.0...v1.68.1) (2026-06-30)
+
+### Bug Fixes
+
+* make source maps opt-in to restore v1.67.0 memory baseline ([57ef0af](https://github.com/homarr-labs/homarr/commit/57ef0af4a252ea39727caeba7e13587dabc6254e)), closes [#6123](https://github.com/homarr-labs/homarr/issues/6123)
+* revert production source maps to restore v1.67.0 memory baseline ([60a69e3](https://github.com/homarr-labs/homarr/commit/60a69e31efc7168b8f4309daf75954d7730d883b)), closes [#6123](https://github.com/homarr-labs/homarr/issues/6123)
+
+## [1.68.0](https://github.com/homarr-labs/homarr/compare/v1.67.0...v1.68.0) (2026-06-26)
+
+### Features
+
+* add VPN status widget ([#5812](https://github.com/homarr-labs/homarr/issues/5812)) ([a2bb53a](https://github.com/homarr-labs/homarr/commit/a2bb53a8b8fd17da3d2e23851b75d4e179f66225))
+* re-add Docker quick-access button in user menu ([#6054](https://github.com/homarr-labs/homarr/issues/6054)) ([abd1635](https://github.com/homarr-labs/homarr/commit/abd16354bc9ef3dddbb497fd16b03476535046ac)), closes [#2165](https://github.com/homarr-labs/homarr/issues/2165)
+* ship source maps for readable production stack traces ([#6031](https://github.com/homarr-labs/homarr/issues/6031)) ([89380f8](https://github.com/homarr-labs/homarr/commit/89380f81ddd132f5b1041a8f2c3b6c6b138923dd))
+
+### Bug Fixes
+
+* **beszel:** harden cache layer and prevent blank widgets ([#6052](https://github.com/homarr-labs/homarr/issues/6052)) ([49c2663](https://github.com/homarr-labs/homarr/commit/49c266374df12fea2404710232ced42e2de11dbf)), closes [#6030](https://github.com/homarr-labs/homarr/issues/6030)
+* **beszel:** improve stats date display, add click-to-stats modal, fix grid ordering ([#6026](https://github.com/homarr-labs/homarr/issues/6026)) ([55fb227](https://github.com/homarr-labs/homarr/commit/55fb227305fe51963e486ffb25c4ce6811a2f0e4))
+* **beszel:** leverage TanStack Query for stale-while-revalidate caching ([#6055](https://github.com/homarr-labs/homarr/issues/6055)) ([bbc4589](https://github.com/homarr-labs/homarr/commit/bbc4589c9e1608721fb58a6f9b03cca8d65c1c4a))
+* **beszel:** use 480m interval for 1w/30d stats views ([4383da3](https://github.com/homarr-labs/homarr/commit/4383da38ef634327c288626c58480cc1e5a2f805))
+* **beszel:** widget transparency, error handling, and cache invalidation ([#5993](https://github.com/homarr-labs/homarr/issues/5993)) ([39e4245](https://github.com/homarr-labs/homarr/commit/39e424563a3187dcf0dba5f654e2225be76aef51))
+* **icon-picker:** keep URL visible in edit mode, add SVG-first ordering ([#6051](https://github.com/homarr-labs/homarr/issues/6051)) ([e01571b](https://github.com/homarr-labs/homarr/commit/e01571b221812cd19a6d67ebe3cf44432104ec27))
+* **integrations:** prevent certificate trust button from submitting the form ([#6020](https://github.com/homarr-labs/homarr/issues/6020)) ([0f66bfd](https://github.com/homarr-labs/homarr/commit/0f66bfd6c128253ba644d80d7c908de5314cf997))
+* **manage/about:** bypass self-fetch + add manage error boundary (LLM exploration) ([#6009](https://github.com/homarr-labs/homarr/issues/6009)) ([19f9769](https://github.com/homarr-labs/homarr/commit/19f9769d9e669d56d793e9f6a0d265316113d743)), closes [#6008](https://github.com/homarr-labs/homarr/issues/6008) [#6008](https://github.com/homarr-labs/homarr/issues/6008) [#6008](https://github.com/homarr-labs/homarr/issues/6008)
+* **plex:** use series title for media releases instead of season label ([#6083](https://github.com/homarr-labs/homarr/issues/6083)) ([2443b89](https://github.com/homarr-labs/homarr/commit/2443b89b46f88fddbf41f0382a9f3bc5469c6fa8))
+* show app first in add item modal ([#6087](https://github.com/homarr-labs/homarr/issues/6087)) ([915c8a3](https://github.com/homarr-labs/homarr/commit/915c8a3501551fdccf786d0c34dc01107d873ce0))
+* **truenas:** report actual memory usage and pool free space ([#6017](https://github.com/homarr-labs/homarr/issues/6017)) ([f69e545](https://github.com/homarr-labs/homarr/commit/f69e545d6429aece0e55975c3b2426f20e91e545))
+* **unraid:** report disk free space instead of total size ([#6018](https://github.com/homarr-labs/homarr/issues/6018)) ([1fb97ee](https://github.com/homarr-labs/homarr/commit/1fb97ee9c6fbe656a7dd3a9d1e436125982533f4))
+* **widgets:** clean up health monitoring disk and size display ([#6019](https://github.com/homarr-labs/homarr/issues/6019)) ([e29c79a](https://github.com/homarr-labs/homarr/commit/e29c79a9028d9311dcb3d8323e0950a444589c7a))
+* **widgets:** hide health monitoring default tab option for non-proxmox integrations ([#6021](https://github.com/homarr-labs/homarr/issues/6021)) ([52df56b](https://github.com/homarr-labs/homarr/commit/52df56b19da8e0bcb6c2e5df47b7936ec63f3149))
+* **widgets:** hide system disk usage value when it overflows and show it in a tooltip ([#6022](https://github.com/homarr-labs/homarr/issues/6022)) ([a19c9d8](https://github.com/homarr-labs/homarr/commit/a19c9d88caacc86b42854c732818f0b5e5cc8dd5))
+
 ## [1.67.0](https://github.com/homarr-labs/homarr/compare/v1.66.1...v1.67.0) (2026-06-19)
 
 ### Features

CODEOWNERS

@@ -1,7 +1,193 @@
 # ── CODEOWNERS ───────────────────────────────────────
 * @homarr-labs/maintainers
 
-# Exempt Renovate‑managed files (no owners)
+# Specific features / integrations
+# These owners come from the PR that introduced each integration implementation.
+# Specific rules override the global fallback because CODEOWNERS uses the last
+# matching pattern; do not include @homarr-labs/maintainers here unless they
+# should also be requested for that integration.
+
+# AdGuard Home - introduced in https://github.com/homarr-labs/homarr/pull/929 by @hillaliy
+apps/docs/docs/integrations/adguard-home @hillaliy
+packages/integrations/src/adguard-home @hillaliy
+
+# Anchor - introduced in https://github.com/homarr-labs/homarr/pull/5040 by @ohmzi
+apps/docs/docs/integrations/anchor @ohmzi
+packages/integrations/src/anchor @ohmzi
+
+# ArchiveTeam Warrior - introduced in https://github.com/homarr-labs/homarr/pull/5784 by @darbyjack
+apps/docs/docs/integrations/archive-team-warrior @darbyjack
+packages/integrations/src/archive-team-warrior @darbyjack
+
+# Audiobookshelf - introduced in https://github.com/homarr-labs/homarr/pull/5910 by @ajnart
+apps/docs/docs/integrations/audiobookshelf @ajnart
+packages/integrations/src/audiobookshelf @ajnart
+
+# Beszel - introduced in https://github.com/homarr-labs/homarr/pull/5900 by @ajnart
+apps/docs/docs/integrations/beszel @ajnart
+packages/integrations/src/beszel @ajnart
+
+# Codeberg - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/codeberg @Aandree5
+packages/integrations/src/codeberg @Aandree5
+
+# Coolify - introduced in https://github.com/homarr-labs/homarr/pull/4789 by @Rhiz3K
+apps/docs/docs/integrations/coolify @Rhiz3K
+packages/integrations/src/coolify @Rhiz3K
+
+# Dash. - introduced in https://github.com/homarr-labs/homarr/pull/1541 by @manuel-rw
+apps/docs/docs/integrations/dash-dot @manuel-rw
+packages/integrations/src/dashdot @manuel-rw
+
+# Docker Hub - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/docker-hub @Aandree5
+packages/integrations/src/docker-hub @Aandree5
+
+# Emby - introduced in https://github.com/homarr-labs/homarr/pull/2466 by @Meierschlumpf
+apps/docs/docs/integrations/emby @Meierschlumpf
+packages/integrations/src/emby @Meierschlumpf
+
+# GitHub - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/github @Aandree5
+packages/integrations/src/github @Aandree5
+
+# GitHub Container Registry - introduced in https://github.com/homarr-labs/homarr/pull/3727 by @Aandree5
+apps/docs/docs/integrations/github-containerregistry @Aandree5
+packages/integrations/src/github-container-registry @Aandree5
+
+# GitLab - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/gitlab @Aandree5
+packages/integrations/src/gitlab @Aandree5
+
+# Glances - introduced in https://github.com/homarr-labs/homarr/pull/5102 by @manuel-rw
+apps/docs/docs/integrations/glances @manuel-rw
+packages/integrations/src/glances @manuel-rw
+
+# Gluetun - introduced in https://github.com/homarr-labs/homarr/pull/5812 by @Lok3sh-kumar
+apps/docs/docs/integrations/gluetun @Lok3sh-kumar
+packages/integrations/src/gluetun @Lok3sh-kumar
+
+# Gotify - introduced in https://github.com/homarr-labs/homarr/pull/5847 by @Nerdy-Technician
+apps/docs/docs/integrations/gotify @Nerdy-Technician
+packages/integrations/src/gotify @Nerdy-Technician
+
+# Home Assistant - introduced in https://github.com/homarr-labs/homarr/pull/578 by @manuel-rw
+apps/docs/docs/integrations/home-assistant @manuel-rw
+packages/integrations/src/homeassistant @manuel-rw
+
+# ICal - introduced in https://github.com/homarr-labs/homarr/pull/3980 by @NicolasNewman
+apps/docs/docs/integrations/ical @NicolasNewman
+packages/integrations/src/ical @NicolasNewman
+
+# Immich - introduced in https://github.com/homarr-labs/homarr/pull/5165 by @manuel-rw
+apps/docs/docs/integrations/immich @manuel-rw
+packages/integrations/src/immich @manuel-rw
+
+# Jellyfin - introduced in https://github.com/homarr-labs/homarr/pull/672 by @manuel-rw
+apps/docs/docs/integrations/jellyfin @manuel-rw
+packages/integrations/src/jellyfin @manuel-rw
+
+# Jellyseerr - introduced in https://github.com/homarr-labs/homarr/pull/774 by @manuel-rw
+apps/docs/docs/integrations/jellyseerr @manuel-rw
+packages/integrations/src/jellyseerr @manuel-rw
+
+# LinuxServer.io - introduced in https://github.com/homarr-labs/homarr/pull/3607 by @Aandree5
+apps/docs/docs/integrations/linux-server-io @Aandree5
+packages/integrations/src/linuxserverio @Aandree5
+
+# Navidrome - introduced in https://github.com/homarr-labs/homarr/pull/5910 by @ajnart
+apps/docs/docs/integrations/navidrome @ajnart
+packages/integrations/src/navidrome @ajnart
+
+# Nextcloud - introduced in https://github.com/homarr-labs/homarr/pull/2501 by @manuel-rw
+apps/docs/docs/integrations/nextcloud @manuel-rw
+packages/integrations/src/nextcloud @manuel-rw
+
+# npm - introduced in https://github.com/homarr-labs/homarr/pull/3253 by @Aandree5
+apps/docs/docs/integrations/npm @Aandree5
+packages/integrations/src/npm @Aandree5
+
+# ntfy - introduced in https://github.com/homarr-labs/homarr/pull/2900 by @itzTheMeow
+apps/docs/docs/integrations/ntfy @ajnart @manuel-rw
+packages/integrations/src/ntfy @ajnart @manuel-rw
+
+# OpenMediaVault - introduced in https://github.com/homarr-labs/homarr/pull/1142 by @hillaliy
+apps/docs/docs/integrations/open-media-vault @hillaliy
+packages/integrations/src/openmediavault @hillaliy
+
+# OPNsense - introduced in https://github.com/homarr-labs/homarr/pull/3424 by @Oupsman
+apps/docs/docs/integrations/opnsense @Oupsman
+packages/integrations/src/opnsense @Oupsman
+
+# Overseerr - introduced in https://github.com/homarr-labs/homarr/pull/774 by @manuel-rw
+apps/docs/docs/integrations/overseerr @manuel-rw
+packages/integrations/src/overseerr @manuel-rw
+
+# Paperless-ngx - introduced in https://github.com/homarr-labs/homarr/pull/5910 by @ajnart
+apps/docs/docs/integrations/paperless-ngx @ajnart
+packages/integrations/src/paperless-ngx @ajnart
+
+# PeaNUT - introduced in https://github.com/homarr-labs/homarr/pull/5862 by @afonsojramos
+apps/docs/docs/integrations/peanut @afonsojramos
+packages/integrations/src/peanut @afonsojramos
+
+# Pi-hole - introduced in https://github.com/homarr-labs/homarr/pull/521 by @Meierschlumpf
+apps/docs/docs/integrations/pi-hole @Meierschlumpf
+packages/integrations/src/pi-hole @Meierschlumpf
+
+# Plex - introduced in https://github.com/homarr-labs/homarr/pull/1342 by @hillaliy
+apps/docs/docs/integrations/plex @hillaliy
+packages/integrations/src/plex @hillaliy
+
+# Prowlarr - introduced in https://github.com/homarr-labs/homarr/pull/965 by @hillaliy
+apps/docs/docs/integrations/prowlarr @hillaliy
+packages/integrations/src/prowlarr @hillaliy
+
+# Proxmox - introduced in https://github.com/homarr-labs/homarr/pull/1969 by @Meierschlumpf
+apps/docs/docs/integrations/proxmox @Meierschlumpf
+packages/integrations/src/proxmox @Meierschlumpf
+
+# Quay - introduced in https://github.com/homarr-labs/homarr/pull/3607 by @Aandree5
+apps/docs/docs/integrations/quay @Aandree5
+packages/integrations/src/quay @Aandree5
+
+# search.ch - introduced in https://github.com/homarr-labs/homarr/pull/5180 by @Meierschlumpf
+apps/docs/docs/integrations/search-ch @Meierschlumpf
+packages/integrations/src/search-ch @Meierschlumpf
+
+# Speedtest Tracker - introduced in https://github.com/homarr-labs/homarr/pull/5363 by @kylegrieder
+apps/docs/docs/integrations/speedtest-tracker @kylegrieder
+packages/integrations/src/speedtest-tracker @kylegrieder
+
+# Technitium DNS - introduced in https://github.com/homarr-labs/homarr/pull/5832 by @lopsch
+apps/docs/docs/integrations/technitium-dns @lopsch
+packages/integrations/src/technitium @lopsch
+
+# Tracearr - introduced in https://github.com/homarr-labs/homarr/pull/5060 by @StrandedTurtle
+apps/docs/docs/integrations/tracearr @StrandedTurtle
+packages/integrations/src/tracearr @StrandedTurtle
+
+# TrueNAS - introduced in https://github.com/homarr-labs/homarr/pull/3745 by @manuel-rw
+apps/docs/docs/integrations/truenas @manuel-rw @afonsojramos
+packages/integrations/src/truenas @manuel-rw @afonsojramos
+
+# Umami - introduced in https://github.com/homarr-labs/homarr/pull/5362 by @febrile42
+apps/docs/docs/integrations/umami @febrile42
+packages/integrations/src/umami @febrile42
+
+# UniFi Controller - introduced in https://github.com/homarr-labs/homarr/pull/2236 by @pitschi
+apps/docs/docs/integrations/unifi-controller @pitschi
+packages/integrations/src/unifi-controller @pitschi
+
+# Unraid - introduced in https://github.com/homarr-labs/homarr/pull/4439 by @manuel-rw
+apps/docs/docs/integrations/unraid @manuel-rw
+packages/integrations/src/unraid @manuel-rw
+
+# Uptime Kuma - introduced in https://github.com/homarr-labs/homarr/pull/5910 by @ajnart
+apps/docs/docs/integrations/uptime-kuma @ajnart
+packages/integrations/src/uptime-kuma @ajnart
+
+# Exempt Renovate-managed files (no owners)
 package.json
 **/package.json
 package-lock.json

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.16.0-alpine AS base
+FROM node:24.18.0-alpine AS base
 
 FROM base AS builder
 RUN apk add --no-cache libc6-compat
@@ -42,6 +42,7 @@ RUN mkdir -p /var/cache/nginx && \
 
 COPY --from=builder /app/apps/nextjs/next.config.ts .
 COPY --from=builder /app/apps/nextjs/package.json .
+COPY --from=builder /app/pnpm-workspace.yaml ./pnpm-workspace.yaml
 
 COPY --from=builder /app/node_modules/better-sqlite3/build/Release/better_sqlite3.node /app/build/better_sqlite3.node
 

apps/docs/docs/getting-started/installation/helm.md

@@ -2,9 +2,9 @@
 
 <img src="https://raw.githubusercontent.com/homarr-labs/charts/refs/heads/main/charts/homarr/icon.svg" align="right" width="92" alt="homarr logo">
 
-![Version: 8.19.0](https://img.shields.io/badge/Version-8.19.0-informational?style=flat)
+![Version: 8.20.0](https://img.shields.io/badge/Version-8.20.0-informational?style=flat)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat)
-![AppVersion: v1.60.0](https://img.shields.io/badge/AppVersion-v1.60.0-informational?style=flat)
+![AppVersion: v1.68.0](https://img.shields.io/badge/AppVersion-v1.68.0-informational?style=flat)
 
 A Helm chart to deploy homarr for Kubernetes
 
@@ -383,6 +383,7 @@ All available values are listed on the [artifacthub](https://artifacthub.io/pack
 | containerPorts | object | `{"http":{"port":7575,"protocol":"TCP"}}` | containerPorts defines the ports to open on the container. It is a map where each entry specifies:    - `port`     (int)    (required): The port number to expose inside the container.    - `protocol` (string) (required): The network protocol (TCP or UDP) used for the port.    - `disabled` (bool)              : Optional flag to disable this port (defaults to false). Can be overridden via Helm values.  By default, this configuration exposes TCP port 7575 with the name `http`. |
 | database.migrationEnabled | bool | `true` | Database migration configuration. DB_MIGRATIONS_DISABLED Set to `true` to disable database migrations. Migrations are enabled by default (`false`). |
 | database.type | string | `"sqlite"` | Database type: sqlite, mysql or postgresql |
+| env.AUTH_COOKIE_PREFIX | string | `"homarr"` | Prefix used for all authentication cookies. Change if you run another Auth.js/NextAuth app on the same hostname to avoid cookie name collisions. Only letters, numbers, hyphens and underscores. |
 | env.AUTH_LDAP_BASE | string | `nil` | Base dn of your LDAP server |
 | env.AUTH_LDAP_BIND_DN | string | `nil` | User used for finding users and groups |
 | env.AUTH_LDAP_GROUP_CLASS | string | `"groupOfUniqueNames"` | Class used for querying groups |
@@ -395,7 +396,6 @@ All available values are listed on the [artifacthub](https://artifacthub.io/pack
 | env.AUTH_LDAP_USERNAME_FILTER_EXTRA_ARG | string | `nil` | Extra arguments for user search filter (& based) |
 | env.AUTH_LDAP_USER_MAIL_ATTRIBUTE | string | `"mail"` | Attribute used for mail field |
 | env.AUTH_LOGOUT_REDIRECT_URL | string | `nil` | URL to redirect to after clicking logging out. |
-| env.AUTH_COOKIE_PREFIX | string | `"homarr"` | Prefix used for all authentication cookies. Change if you run another Auth.js/NextAuth app on the same hostname to avoid cookie name collisions. Only letters, numbers, hyphens and underscores. |
 | env.AUTH_OIDC_AUTO_LOGIN | string | `"false"` | Automatically redirect to OIDC login |
 | env.AUTH_OIDC_CLIENT_NAME | string | `"OIDC"` | Display name of provider (in login screen) |
 | env.AUTH_OIDC_GROUPS_ATTRIBUTE | string | `"groups"` | Attribute used for groups (roles) claim |

apps/docs/docs/integrations/archiveteam-warrior/index.mdx

@@ -0,0 +1,35 @@
+---
+title: "ArchiveTeam Warrior"
+description: "ArchiveTeam Warrior is an easy-to-run virtual machine that helps preserve websites by using some of your bandwidth and disk space to download and upload content to ArchiveTeam’s archive."
+hide_title: true
+---
+
+import { IntegrationHeader } from "@site/src/components/integrations/header";
+import { AddingIntegration } from "@site/src/components/integrations/adding";
+import { IntegrationSecrets } from "@site/src/components/integrations/secrets";
+import { archiveTeamWarriorIntegration } from ".";
+
+<IntegrationHeader integration={archiveTeamWarriorIntegration} categories={["archiving"]} />
+
+The ArchiveTeam Warrior integration lets Homarr connect to your ArchiveTeam Warrior instance so you can manage and monitor your archiving tasks directly from your dashboard.
+
+### Adding the integration
+
+<AddingIntegration />
+
+### Secrets
+
+ArchiveTeam Warrior does not require authentication by default. If your instance is protected with basic authentication, you can provide a username and password.
+
+<IntegrationSecrets
+  secrets={[
+    {
+      credentials: [],
+      steps: [],
+    },
+    {
+      credentials: ["username", "password"],
+      steps: [],
+    },
+  ]}
+/>

apps/docs/docs/integrations/archiveteam-warrior/index.ts

@@ -0,0 +1,9 @@
+import { IntegrationDefinition } from "@site/src/types";
+
+export const archiveTeamWarriorIntegration: IntegrationDefinition = {
+  name: "ArchiveTeam Warrior",
+  description:
+    "ArchiveTeam Warrior is an easy-to-run virtual machine that helps preserve websites by using some of your bandwidth and disk space to download and upload content to ArchiveTeam’s archive.",
+  iconUrl: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/archiveteam-warrior.png",
+  path: "../../integrations/archiveteam-warrior",
+};

apps/docs/docs/integrations/docker-labels/index.mdx

@@ -0,0 +1,54 @@
+---
+title: 'Docker labels'
+description: 'Configure Homarr apps automatically using Docker container labels during onboarding.'
+hide_title: true
+---
+
+# Docker label discovery
+
+Homarr can read `homarr.*` labels on your containers to pre-populate apps during onboarding. Homepage-style `homepage.*` labels are supported as a fallback when no `homarr.name` label is set.
+
+## Required labels
+
+| Label | Description |
+| --- | --- |
+| `homarr.name` | Display name for the app |
+| `homarr.group` | Category section name on the board |
+| `homarr.href` | URL opened when clicking the app |
+
+## Optional labels
+
+| Label | Description |
+| --- | --- |
+| `homarr.icon` | Icon URL |
+| `homarr.description` | App description |
+| `homarr.ping` | Ping URL for status checks |
+| `homarr.id` | Stable external ID (defaults to container ID) |
+| `homarr.board` | Target board name |
+| `homarr.integration` | Integration kind (e.g. `sonarr`) for onboarding integration setup |
+| `homarr.widget` | Widget kind hint (parsed, not auto-placed yet) |
+| `homarr.hide` | Hide container from discovery |
+
+## Homepage fallback
+
+When `homarr.name` is absent, Homarr reads `homepage.name`, `homepage.group`, `homepage.href`, `homepage.icon`, and `homepage.description` if homepage label reading is enabled (default: on).
+
+## Example
+
+```yaml
+services:
+  sonarr:
+    image: lscr.io/linuxserver/sonarr:latest
+    labels:
+      homarr.name: "Sonarr"
+      homarr.group: "Media"
+      homarr.href: "http://sonarr:8989"
+      homarr.icon: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/sonarr.svg"
+      homarr.integration: "sonarr"
+```
+
+## Onboarding behavior
+
+During the integrations step, Homarr scans labeled containers first. Labeled services appear with their configured name, group, and URL. Unlabeled running containers still use image-based discovery as a fallback.
+
+When you finish onboarding, selected label-based apps are synced into category sections on your board. Integration widgets are placed separately in the default section.

apps/docs/docs/integrations/docker-labels/index.ts

@@ -0,0 +1,8 @@
+import { IntegrationDefinition } from "@site/src/types";
+
+export const dockerLabelsIntegration: IntegrationDefinition = {
+  name: "Docker labels",
+  description: "Configure Homarr apps automatically using Docker container labels.",
+  iconUrl: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/docker.svg",
+  path: "../../integrations/docker-labels",
+};

apps/docs/docs/integrations/docker/index.mdx

@@ -93,9 +93,11 @@ They are then available in the app list and can be used as normally added apps.
 
 ### Configuration
 
-Currently Homarr supports one label for configuration of the containers:
+Homarr supports Docker labels for automatic app discovery during onboarding. See [Docker labels](../docker-labels/index.mdx) for the full reference.
 
-- **homarr.hide:** If set to any value, the container will be hidden from the Docker Containers widget and tools page.
+Currently Homarr supports one label for hiding containers:
+
+- **homarr.hide:** If set to any value, the container will be hidden from the Docker Containers widget, tools page, and label discovery.
 
 ### Security
 Mounting docker sockets can be risky, as they permit full control over your docker service.

apps/docs/docs/integrations/gluetun/index.mdx

@@ -0,0 +1,52 @@
+---
+title: 'Gluetun'
+description: 'Connect Gluetun to Homarr as a VPN integration.'
+hide_title: true
+---
+
+import { IntegrationHeader } from '@site/src/components/integrations/header';
+import { IntegrationCapabilites } from '@site/src/components/integrations/widgets';
+import { AddingIntegration } from '@site/src/components/integrations/adding';
+import { IntegrationSecrets } from '@site/src/components/integrations/secrets';
+import { gluetunIntegration } from '.';
+import { vpnWidget } from '@site/docs/widgets/vpn';
+
+<IntegrationHeader
+  integration={gluetunIntegration}
+  categories={['VPN', 'Network']}
+/>
+
+[Gluetun](https://github.com/qdm12/gluetun) exposes a control server that Homarr can query to report the VPN tunnel
+status, DNS status, public IP address, and active provider details in the VPN widget.
+
+### Widgets & Capabilities
+
+<IntegrationCapabilites
+  items={[{
+    widget: vpnWidget,
+  }]}
+/>
+
+### Setting up the Gluetun control server
+
+Refer to the [Gluetun control server documentation](https://github.com/qdm12/gluetun-wiki/blob/main/setup/advanced/control-server.md#authentication) to enable and configure authentication.
+
+### Adding the integration
+
+<AddingIntegration />
+
+### Secrets
+
+Gluetun's control server can be left unprotected or secured with either an API key or HTTP Basic authentication.
+Choose the option that matches how your Gluetun instance integration is set up.
+
+<IntegrationSecrets secrets={[{
+  credentials: [],
+  steps: [],
+},{
+  credentials: ['username', 'password'],
+  steps: [],
+},{
+  credentials: ['apiKey'],
+  steps: [],
+},,]} />

apps/docs/docs/integrations/gluetun/index.ts

@@ -0,0 +1,8 @@
+import { IntegrationDefinition } from "@site/src/types";
+
+export const gluetunIntegration: IntegrationDefinition = {
+  name: "Gluetun",
+  description: "VPN control server integration for Homarr's VPN widget.",
+  iconUrl: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/gluetun.svg",
+  path: "../../integrations/gluetun",
+};

apps/docs/docs/widgets/calendar/index.mdx

@@ -63,7 +63,9 @@ import withoutIntegrations from './img/without-integrations.png';
 
 ### Interactions
 
-- View calendar events by clicking on the marked dates.
+- Hover over a marked date to preview its events in a popover.
+- Click on a marked date to pin the popover open (it will stay visible even after moving the mouse away).
+- Click the date again or click outside to close the pinned popover.
 
 ### Adding the widget
 

apps/docs/docs/widgets/vpn/index.mdx

@@ -0,0 +1,40 @@
+---
+title: 'VPN'
+description: 'Monitor the status of your VPN integrations.'
+hide_title: true
+---
+
+import { WidgetHeader } from '@site/src/components/widgets/header';
+import { AddingWidget } from '@site/src/components/widgets/adding';
+import { WidgetIntegrations } from '@site/src/components/widgets/integrations';
+import { vpnWidget } from '.';
+import { gluetunIntegration } from '@site/docs/integrations/gluetun';
+
+<WidgetHeader
+  widget={vpnWidget}
+  categories={['Network', 'Security']}
+/>
+
+The VPN widget provides a compact overview of each configured VPN integration. It shows whether the tunnel and DNS
+services are up, the currently exposed public IP address, and the VPN provider and protocol being used.
+
+When multiple VPN integrations are attached, the widget renders one card per integration so you can compare their
+current status at a glance.
+
+### Screenshots
+
+import singleIntegrationImage from './img/single.png';
+
+<div>
+  <img src={singleIntegrationImage} alt="VPN widget showing a single integration" width={128 * 3} />
+</div>
+
+### Supported Integrations
+
+<WidgetIntegrations items={[{
+  integration: gluetunIntegration,
+}]} />
+
+### Adding the widget
+
+<AddingWidget />

apps/docs/docs/widgets/vpn/index.ts

@@ -0,0 +1,9 @@
+import { WidgetDefinition } from "@site/src/types";
+import { IconShieldLock } from "@tabler/icons-react";
+
+export const vpnWidget: WidgetDefinition = {
+  icon: IconShieldLock,
+  name: "VPN",
+  description: "Monitor the connection status, public IP, and provider details of your VPN integrations.",
+  path: "../../widgets/vpn",
+};

apps/nextjs/src/app/[locale]/init/_steps/integrations/init-integrations.tsx

@@ -50,7 +50,7 @@ interface IntegrationDraft {
   initialUrl: string;
   initialName?: string;
   dockerPort?: number | null;
-  source: "manual" | "docker";
+  source: "manual" | "docker" | "label";
 }
 
 export const InitIntegrations = () => {
@@ -65,6 +65,7 @@ export const InitIntegrations = () => {
 
   const { mutateAsync: setupIntegrations } = clientApi.onboard.setupIntegrations.useMutation();
   const { mutateAsync: createApps } = clientApi.onboard.createAppsFromDiscovery.useMutation();
+  const { mutateAsync: syncLabelApps } = clientApi.onboard.syncDockerLabelApps.useMutation();
 
   const { data: dockerData, isPending: isDockerLoading } = clientApi.onboard.discoverDockerServices.useQuery(
     undefined,
@@ -98,7 +99,7 @@ export const InitIntegrations = () => {
           initialUrl: item.suggestedUrl,
           initialName: item.containerName,
           dockerPort: item.publishedPort,
-          source: "docker",
+          source: item.source,
         });
       }
       newKinds.add(item.kind);
@@ -132,7 +133,8 @@ export const InitIntegrations = () => {
     const newDrafts = new Map(drafts);
     for (const kind of selectedKinds) {
       const existing = newDrafts.get(kind);
-      if (baseHost) {
+      const useUrlTemplate = baseHost && existing?.source !== "label";
+      if (useUrlTemplate) {
         newDrafts.set(kind, {
           kind,
           initialUrl: buildIntegrationUrl(kind, baseHost, urlMode, existing?.dockerPort ?? undefined),
@@ -152,10 +154,32 @@ export const InitIntegrations = () => {
   const finishSetupAsync = async () => {
     setPhase("done");
     try {
-      const appsToCreate = dockerApps.filter((app) => selectedAppIds.has(app.containerId));
-      if (appsToCreate.length > 0) {
+      const selectedApps = dockerApps.filter((app) => selectedAppIds.has(app.containerId));
+      const labelApps = selectedApps.filter((app) => app.source === "label");
+      const imageApps = selectedApps.filter((app) => app.source !== "label");
+
+      if (labelApps.length > 0) {
+        const labelAppsWithHost = labelApps.filter((app): app is typeof app & { host: string } => Boolean(app.host));
+        const missingHostCount = labelApps.length - labelAppsWithHost.length;
+        if (missingHostCount > 0) {
+          throw new Error("Some selected Docker label apps are missing host metadata");
+        }
+        if (labelAppsWithHost.length > 0) {
+          const syncResult = await syncLabelApps(
+            labelAppsWithHost.map((app) => ({
+              containerId: app.containerId,
+              host: app.host,
+            })),
+          );
+          if (syncResult.notFound > 0) {
+            throw new Error("Some selected Docker label apps were not found");
+          }
+        }
+      }
+
+      if (imageApps.length > 0) {
         await createApps(
-          appsToCreate.map((app) => {
+          imageApps.map((app) => {
             const href = baseHost
               ? buildAppUrl(app.containerName, baseHost, urlMode, app.publishedPort ?? undefined)
               : app.suggestedUrl;
@@ -167,6 +191,7 @@ export const InitIntegrations = () => {
           }),
         );
       }
+
       await setupIntegrations();
       router.refresh();
     } catch {
@@ -336,9 +361,16 @@ export const InitIntegrations = () => {
                       >
                         <Stack justify="space-between" h="100%" gap={4} align="center">
                           <Group justify="space-between" w="100%" wrap="nowrap">
-                            <Text size="xs" fw={500} lineClamp={1} style={{ flex: 1, minWidth: 0 }}>
-                              {app.containerName}
-                            </Text>
+                            <Stack gap={0} style={{ flex: 1, minWidth: 0 }}>
+                              <Text size="xs" fw={500} lineClamp={1}>
+                                {app.containerName}
+                              </Text>
+                              {app.group && (
+                                <Text size="xs" c="dimmed" lineClamp={1}>
+                                  {app.group}
+                                </Text>
+                              )}
+                            </Stack>
                             {isSelected && <IconCheck size={14} color="var(--mantine-color-blue-6)" />}
                           </Group>
                           <Avatar size="sm" radius="sm" src={app.iconUrl} styles={{ image: { objectFit: "contain" } }}>
@@ -359,8 +391,14 @@ export const InitIntegrations = () => {
             {t("action.skip")}
           </Button>
           <Button
-            onClick={handleContinueToConfig}
-            disabled={selectedKinds.length === 0 || undefined}
+            onClick={() => {
+              if (selectedKinds.length === 0) {
+                void finishSetupAsync();
+                return;
+              }
+              handleContinueToConfig();
+            }}
+            disabled={(selectedKinds.length === 0 && selectedAppCount === 0) || undefined}
             rightSection={<IconArrowRight size={16} stroke={1.5} />}
             suppressHydrationWarning
           >
@@ -404,7 +442,8 @@ const ConfigurePhase = ({
   const currentKind = selectedKinds[currentIndex]!;
   const draft = drafts.get(currentKind);
   const progress = ((currentIndex + 1) / selectedKinds.length) * 100;
-  const computedUrl = baseHost
+  const useUrlTemplate = baseHost && draft?.source !== "label";
+  const computedUrl = useUrlTemplate
     ? buildIntegrationUrl(currentKind, baseHost, urlMode, draft?.dockerPort ?? undefined)
     : draft?.initialUrl;
 

apps/nextjs/src/app/[locale]/manage/about/page.tsx

@@ -1,4 +1,3 @@
-import { headers } from "next/headers";
 import Image from "next/image";
 import {
   Accordion,
@@ -41,11 +40,10 @@ import { getScopedI18n } from "@homarr/translation/server";
 import { homarrLogoPath } from "~/components/layout/logo/homarr-logo";
 import { DynamicBreadcrumb } from "~/components/navigation/dynamic-breadcrumb";
 import { createMetaTitle } from "~/metadata";
-import type { PackageJsonDependencies } from "~/versions/package-reader";
-import { getPackageVersion } from "~/versions/package-reader";
-import type githubContributorsJson from "../../../../../../../static-data/contributors.json";
-import type openCollectiveContributorsJson from "../../../../../../../static-data/opencollective-contributors.json";
-import type crowdinContributorsJson from "../../../../../../../static-data/translators.json";
+import { getDependenciesAsync, getPackageVersion } from "~/versions/package-reader";
+import githubContributors from "@static-data/contributors.json";
+import openCollectiveContributors from "@static-data/opencollective-contributors.json";
+import crowdinContributors from "@static-data/translators.json";
 import classes from "./about.module.css";
 
 export async function generateMetadata() {
@@ -56,32 +54,10 @@ export async function generateMetadata() {
   };
 }
 
-const getHostAsync = async () => {
-  if (process.env.HOSTNAME) {
-    return `${process.env.HOSTNAME}:3000`;
-  }
-
-  return (await headers()).get("host");
-};
-
 export default async function AboutPage() {
-  const baseServerUrl = `http://${await getHostAsync()}`;
   const t = await getScopedI18n("management.page.about");
   const version = getPackageVersion();
-  const dependencies = (await fetch(`${baseServerUrl}/api/about/dependencies`).then((res) =>
-    res.json(),
-  )) as PackageJsonDependencies;
-  const githubContributors = (await fetch(`${baseServerUrl}/api/about/contributors/github`).then((res) =>
-    res.json(),
-  )) as typeof githubContributorsJson;
-
-  const crowdinContributors = (await fetch(`${baseServerUrl}/api/about/contributors/crowdin`).then((res) =>
-    res.json(),
-  )) as typeof crowdinContributorsJson;
-
-  const openCollectiveContributors = (await fetch(`${baseServerUrl}/api/about/contributors/opencollective`).then(
-    (res) => res.json(),
-  )) as typeof openCollectiveContributorsJson;
+  const dependencies = await getDependenciesAsync();
 
   return (
     <div>
@@ -185,7 +161,7 @@ export default async function AboutPage() {
             <SimpleGrid cols={{ xs: 1, sm: 2, md: 3, lg: 4, xl: 5 }} spacing="md">
               {Object.entries(dependencies)
                 .filter(([, value]) => !value.includes("workspace:"))
-                .sort(([key1], [key2]) => key1.localeCompare(key2))
+                .toSorted(([key1], [key2]) => key1.localeCompare(key2))
                 .map(([name, version]) => (
                   <UnstyledButton
                     key={name}

apps/nextjs/src/app/[locale]/manage/error.tsx

@@ -0,0 +1,42 @@
+"use client";
+
+import { useEffect } from "react";
+import { Button, Center, Stack, Text, Title } from "@mantine/core";
+import { IconAlertTriangle } from "@tabler/icons-react";
+
+import { useI18n, useScopedI18n } from "@homarr/translation/client";
+
+export default function ManageErrorPage({
+  error,
+  unstable_retry,
+}: {
+  error: Error & { digest?: string };
+  unstable_retry: () => void;
+}) {
+  const tError = useScopedI18n("management.error");
+  const t = useI18n();
+
+  useEffect(() => {
+    console.error(error);
+  }, [error]);
+
+  return (
+    <Center h="100%">
+      <Stack align="center" gap="xs">
+        <IconAlertTriangle size={48} stroke={1.5} />
+        <Title order={3}>{tError("title")}</Title>
+        <Text size="sm" c="dimmed" maw={480} ta="center">
+          {tError("text")}
+        </Text>
+        {error.digest && (
+          <Text size="xs" c="dimmed">
+            {tError("digest", { digest: error.digest })}
+          </Text>
+        )}
+        <Button variant="light" onClick={unstable_retry}>
+          {t("common.action.tryAgain")}
+        </Button>
+      </Stack>
+    </Center>
+  );
+}

apps/nextjs/src/app/[locale]/manage/tools/api/page.tsx

@@ -10,6 +10,7 @@ import { extractBaseUrlFromHeaders } from "@homarr/common";
 import { getScopedI18n } from "@homarr/translation/server";
 
 import { createMetaTitle } from "~/metadata";
+import { DynamicBreadcrumb } from "~/components/navigation/dynamic-breadcrumb";
 import { extractMcpTools } from "~/app/api/mcp/_extract-tools";
 import { ApiKeysManagement } from "./components/api-keys";
 import { ApiPageTabs } from "./components/api-page-tabs";
@@ -79,17 +80,20 @@ export default async function ApiPage() {
   const toolGroups = getMcpToolGroups();
 
   return (
-    <Stack>
-      <ApiPageTabs
-        documentationLabel={t("documentation.label")}
-        apiKeyLabel={t("apiKey.label")}
-        mcpLabel={t("mcp.label")}
-        documentationPanel={<ScalarApiReference document={document} />}
-        authenticationPanel={<ApiKeysManagement apiKeys={apiKeys} />}
-        baseUrl={baseUrl}
-        hasApiKeys={apiKeys.length > 0}
-        toolGroups={toolGroups}
-      />
-    </Stack>
+    <>
+      <DynamicBreadcrumb />
+      <Stack>
+        <ApiPageTabs
+          documentationLabel={t("documentation.label")}
+          apiKeyLabel={t("apiKey.label")}
+          mcpLabel={t("mcp.label")}
+          documentationPanel={<ScalarApiReference document={document} />}
+          authenticationPanel={<ApiKeysManagement apiKeys={apiKeys} />}
+          baseUrl={baseUrl}
+          hasApiKeys={apiKeys.length > 0}
+          toolGroups={toolGroups}
+        />
+      </Stack>
+    </>
   );
 }

apps/nextjs/src/app/[locale]/manage/tools/backup/page.tsx

@@ -6,6 +6,7 @@ import { dbEnv } from "@homarr/core/infrastructure/db/env";
 import { getScopedI18n } from "@homarr/translation/server";
 
 import { createMetaTitle } from "~/metadata";
+import { DynamicBreadcrumb } from "~/components/navigation/dynamic-breadcrumb";
 import { BackupExportCard } from "./_components/backup-export-card";
 import { BackupImportCard } from "./_components/backup-import-card";
 
@@ -31,10 +32,13 @@ export default async function BackupPage() {
   const t = await getScopedI18n("management.page.tool.backup");
 
   return (
-    <Stack>
-      <Title>{t("title")}</Title>
-      <BackupExportCard />
-      <BackupImportCard />
-    </Stack>
+    <>
+      <DynamicBreadcrumb />
+      <Stack>
+        <Title>{t("title")}</Title>
+        <BackupExportCard />
+        <BackupImportCard />
+      </Stack>
+    </>
   );
 }

apps/nextjs/src/app/[locale]/manage/tools/docker/docker-table.tsx

@@ -149,16 +149,20 @@ const createColumns = (t: TranslationFunction): MRT_ColumnDef<DockerContainer>[]
   },
 ];
 
-export function DockerTable({ containers, timestamp }: RouterOutputs["docker"]["getContainers"]) {
+interface DockerTableProps {
+  initialData?: RouterOutputs["docker"]["getContainers"];
+}
+
+export function DockerTable({ initialData }: DockerTableProps) {
   const t = useI18n();
   const tDocker = useScopedI18n("docker");
-  const { data } = clientApi.docker.getContainers.useQuery(undefined, {
-    initialData: { containers, timestamp },
+  const { data, isFetching } = clientApi.docker.getContainers.useQuery(undefined, {
+    initialData,
     refetchOnMount: false,
     refetchOnWindowFocus: false,
     refetchOnReconnect: false,
   });
-  const relativeTime = useTimeAgo(data.timestamp);
+  const relativeTime = useTimeAgo(data?.timestamp ?? new Date());
   const utils = clientApi.useUtils();
   const { mutate, isPending } = clientApi.docker.invalidate.useMutation({
     async onSuccess() {
@@ -176,8 +180,11 @@ export function DockerTable({ containers, timestamp }: RouterOutputs["docker"]["
     },
   });
 
+  const containers = data?.containers ?? [];
+
   const table = useTranslatedMantineReactTable({
-    data: data.containers,
+    data: containers,
+    state: { isLoading: isFetching },
     enableDensityToggle: false,
     enableColumnActions: false,
     enableColumnFilters: false,
@@ -190,7 +197,7 @@ export function DockerTable({ containers, timestamp }: RouterOutputs["docker"]["
     enableBottomToolbar: false,
     positionGlobalFilter: "right",
     mantineSearchTextInputProps: {
-      placeholder: tDocker("table.search", { count: String(data.containers.length) }),
+      placeholder: tDocker("table.search", { count: String(containers.length) }),
       style: { minWidth: 300 },
       autoFocus: true,
     },

apps/nextjs/src/app/[locale]/manage/tools/docker/page.tsx

@@ -23,7 +23,7 @@ export default async function DockerPage() {
       <DynamicBreadcrumb />
       <Stack>
         <Title order={1}>{tDocker("title")}</Title>
-        <DockerTable containers={containers} timestamp={timestamp} />
+        <DockerTable initialData={{ containers, timestamp }} />
       </Stack>
     </>
   );

apps/nextjs/src/app/[locale]/manage/users/groups/[id]/layout.tsx

@@ -7,6 +7,7 @@ import { getI18n, getScopedI18n } from "@homarr/translation/server";
 import { Link } from "@homarr/ui";
 
 import { ManageContainer } from "~/components/manage/manage-container";
+import { DynamicBreadcrumb } from "~/components/navigation/dynamic-breadcrumb";
 import { NavigationLink } from "./_navigation";
 
 interface LayoutProps {
@@ -24,6 +25,7 @@ export default async function Layout(props: PropsWithChildren<LayoutProps>) {
 
   return (
     <ManageContainer size="xl">
+      <DynamicBreadcrumb dynamicMappings={new Map([[params.id, group.name]])} />
       <Grid>
         <GridCol span={12}>
           <Group justify="space-between" align="center">

apps/nextjs/src/app/api/about/contributors/crowdin/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 
-import crowdinContributors from "../../../../../../../../static-data/translators.json";
+import crowdinContributors from "@static-data/translators.json";
 
 export const GET = () => {
   return NextResponse.json(crowdinContributors);

apps/nextjs/src/app/api/about/contributors/github/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 
-import githubContributors from "../../../../../../../../static-data/contributors.json";
+import githubContributors from "@static-data/contributors.json";
 
 export const GET = () => {
   return NextResponse.json(githubContributors);

apps/nextjs/src/app/api/about/contributors/opencollective/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 
-import openCollectiveContributors from "../../../../../../../../static-data/opencollective-contributors.json";
+import openCollectiveContributors from "@static-data/opencollective-contributors.json";
 
 export const GET = () => {
   return NextResponse.json(openCollectiveContributors);

apps/nextjs/src/app/api/backup/test/backup.spec.ts

@@ -211,7 +211,17 @@ describe("SQLite backup", () => {
       const decryptedAfter = decryptWithKey(updatedRow.value as `${string}.${string}`, newKey);
       expect(decryptedAfter).toBe(plaintext);
 
-      expect(() => decryptWithKey(updatedRow.value as `${string}.${string}`, oldKey)).toThrow();
+      // The old key must no longer recover the plaintext. With AES-256-CBC this
+      // usually fails PKCS7 padding validation (throws), but ~1/256 of the time the
+      // wrong key yields valid padding and returns garbage instead of throwing, so
+      // assert on the actual property (plaintext is unrecoverable) rather than throwing.
+      let decryptedWithOldKey: string | null = null;
+      try {
+        decryptedWithOldKey = decryptWithKey(updatedRow.value as `${string}.${string}`, oldKey);
+      } catch {
+        // Expected for most wrong keys: padding validation fails.
+      }
+      expect(decryptedWithOldKey).not.toBe(plaintext);
 
       sqlite.close();
     });

apps/nextjs/src/components/backup/use-backup-analysis.ts

@@ -142,7 +142,8 @@ export const useBackupAnalysis = () => {
                   phase: "error",
                 });
                 throw new Error(
-                  `Migration ${migration.tag} failed: ${migrationErr instanceof Error ? migrationErr.message : "Unknown error"}`, { cause: migrationErr },
+                  `Migration ${migration.tag} failed: ${migrationErr instanceof Error ? migrationErr.message : "Unknown error"}`,
+                  { cause: migrationErr },
                 );
               }
 

apps/nextjs/src/components/board/items/item-content.tsx

@@ -1,3 +1,5 @@
+import type { MutableRefObject } from "react";
+import { useRef } from "react";
 import { Badge, Card } from "@mantine/core";
 import { useElementSize } from "@mantine/hooks";
 import { QueryErrorResetBoundary } from "@tanstack/react-query";
@@ -16,6 +18,7 @@ import classes from "../sections/item.module.css";
 import { useItemActions } from "./item-actions";
 import itemContentClasses from "./item-content.module.css";
 import { BoardItemMenu } from "./item-menu";
+import { WidgetContextMenu } from "./widget-context-menu";
 
 interface BoardItemContentProps {
   item: SectionItem;
@@ -30,30 +33,33 @@ const getOverflowFromKind = (kind: SectionItem["kind"]) => {
 export const BoardItemContent = ({ item }: BoardItemContentProps) => {
   const { ref, width, height } = useElementSize<HTMLDivElement>();
   const board = useRequiredBoard();
+  const widgetStateRef = useRef<Record<string, unknown> | null>(null);
 
   return (
     <>
-      <Card
-        ref={ref}
-        className={combineClasses(
-          classes.itemCard,
-          `${item.kind}-wrapper`,
-          "grid-stack-item-content",
-          item.advancedOptions.customCssClasses.join(" "),
-        )}
-        radius={board.itemRadius}
-        styles={{
-          root: {
-            "--opacity": board.opacity / 100,
-            containerType: "size",
-            overflow: getOverflowFromKind(item.kind),
-            "--border-color": item.advancedOptions.borderColor !== "" ? item.advancedOptions.borderColor : undefined,
-          },
-        }}
-        p={0}
-      >
-        <InnerContent item={item} width={width} height={height} />
-      </Card>
+      <WidgetContextMenu item={item} widgetStateRef={widgetStateRef}>
+        <Card
+          ref={ref}
+          className={combineClasses(
+            classes.itemCard,
+            `${item.kind}-wrapper`,
+            "grid-stack-item-content",
+            item.advancedOptions.customCssClasses.join(" "),
+          )}
+          radius={board.itemRadius}
+          styles={{
+            root: {
+              "--opacity": board.opacity / 100,
+              containerType: "size",
+              overflow: getOverflowFromKind(item.kind),
+              "--border-color": item.advancedOptions.borderColor !== "" ? item.advancedOptions.borderColor : undefined,
+            },
+          }}
+          p={0}
+        >
+          <InnerContent item={item} width={width} height={height} widgetStateRef={widgetStateRef} />
+        </Card>
+      </WidgetContextMenu>
       {item.advancedOptions.title?.trim() && (
         <Badge
           pos="absolute"
@@ -83,6 +89,7 @@ interface InnerContentProps {
   item: SectionItem;
   width: number;
   height: number;
+  widgetStateRef: MutableRefObject<Record<string, unknown> | null>;
 }
 
 const InnerContent = ({ item, ...dimensions }: InnerContentProps) => {

apps/nextjs/src/components/board/items/item-select-modal.tsx

@@ -41,7 +41,12 @@ export const ItemSelectModal = createModal<void>(({ actions }) => {
           name: t(`widget.${kind}.name`),
           description: t(`widget.${kind}.description`),
         }))
-        .sort((itemA, itemB) => itemA.name.localeCompare(itemB.name)),
+        .sort((itemA, itemB) => {
+          if (itemA.kind === "app") return -1;
+          if (itemB.kind === "app") return 1;
+
+          return itemA.name.localeCompare(itemB.name);
+        }),
     [t],
   );
 

apps/nextjs/src/components/board/items/widget-context-menu.tsx

@@ -0,0 +1,250 @@
+"use client";
+
+import type { MutableRefObject, ReactNode } from "react";
+import { useCallback, useMemo } from "react";
+import { Group, Menu, Switch } from "@mantine/core";
+import { IconCopy, IconLayoutKanban, IconSettings, IconTrash } from "@tabler/icons-react";
+
+import { clientApi } from "@homarr/api/client";
+import { useSession } from "@homarr/auth/client";
+import { useRequiredBoard } from "@homarr/boards/context";
+import { useEditMode } from "@homarr/boards/edit-mode";
+import { useConfirmModal, useModalAction } from "@homarr/modals";
+import { useSettings } from "@homarr/settings";
+import { translateIfNecessary } from "@homarr/translation";
+import { useI18n, useScopedI18n } from "@homarr/translation/client";
+import type { WidgetContextMenuAction } from "@homarr/widgets";
+import { reduceWidgetOptionsWithDefaultValues, widgetImports } from "@homarr/widgets";
+import { WidgetEditModal } from "@homarr/widgets/modals";
+
+import type { SectionItem } from "~/app/[locale]/boards/_types";
+import { useSectionContext } from "../sections/section-context";
+import { useItemActions } from "./item-actions";
+import { ItemMoveModal } from "./item-move-modal";
+
+interface WidgetContextMenuProps {
+  item: SectionItem;
+  widgetStateRef: MutableRefObject<Record<string, unknown> | null>;
+  children: ReactNode;
+}
+
+export const WidgetContextMenu = ({ item, widgetStateRef, children }: WidgetContextMenuProps) => {
+  const { data: session } = useSession();
+  const [isEditMode] = useEditMode();
+  const board = useRequiredBoard();
+  const tItem = useScopedI18n("item");
+  const tMenu = useScopedI18n("item.menu.label");
+  const t = useI18n();
+  const settings = useSettings();
+  const { openModal } = useModalAction(WidgetEditModal);
+  const { openModal: openMoveModal } = useModalAction(ItemMoveModal);
+  const { openConfirmModal } = useConfirmModal();
+  const { updateItemOptions, updateItemAdvancedOptions, updateItemIntegrations, duplicateItem, removeItem } =
+    useItemActions();
+  const { data: integrationData, isPending } = clientApi.integration.all.useQuery();
+  const { mutate: saveBoard } = clientApi.board.saveBoard.useMutation();
+  const currentDefinition = useMemo(() => widgetImports[item.kind].definition, [item.kind]);
+  const { gridstack } = useSectionContext().refs;
+
+  const options = useMemo(
+    () => reduceWidgetOptionsWithDefaultValues(item.kind, settings, item.options) as Record<string, unknown>,
+    [item.kind, settings, item.options],
+  );
+
+  type OptionDef = { type: string; skipContextMenu?: boolean };
+  const toggleOptions = useMemo(() => {
+    const rawOptions = currentDefinition.createOptions(settings) as unknown as Record<string, OptionDef>;
+    return Object.entries(rawOptions).filter(([, def]) => def.type === "switch" && !def.skipContextMenu);
+  }, [currentDefinition, settings]);
+
+  const widgetContextActions = useMemo(() => {
+    const def = currentDefinition as Record<string, unknown>;
+    if (typeof def.contextActions !== "function") return [];
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const actions = (def.contextActions as any)({
+      options,
+      setOptions: (partial: Record<string, unknown>) => {
+        updateItemOptions({ itemId: item.id, newOptions: { ...options, ...partial } });
+      },
+      integrationIds: item.integrationIds,
+      context: { isEditMode, boardId: board.id, itemId: item.id },
+      widgetStateRef,
+    });
+    return (Array.isArray(actions) ? actions : []) as WidgetContextMenuAction[];
+  }, [currentDefinition, options, item, updateItemOptions, isEditMode, board.id, widgetStateRef]);
+
+  const persistBoard = useCallback(
+    (updatedItems: typeof board.items) => {
+      saveBoard({ ...board, items: updatedItems });
+    },
+    [board, saveBoard],
+  );
+
+  const openEditModal = useCallback(() => {
+    openModal(
+      {
+        kind: item.kind,
+        value: {
+          advancedOptions: item.advancedOptions,
+          options: item.options,
+          integrationIds: item.integrationIds,
+        },
+        onSuccessfulEdit: (editResult) => {
+          updateItemOptions({ itemId: item.id, newOptions: editResult.options });
+          updateItemAdvancedOptions({ itemId: item.id, newAdvancedOptions: editResult.advancedOptions });
+          updateItemIntegrations({ itemId: item.id, newIntegrations: editResult.integrationIds });
+          if (!isEditMode) {
+            persistBoard(
+              board.items.map((boardItem) =>
+                boardItem.id !== item.id
+                  ? boardItem
+                  : {
+                      ...boardItem,
+                      options: editResult.options,
+                      advancedOptions: editResult.advancedOptions,
+                      integrationIds: editResult.integrationIds,
+                    },
+              ),
+            );
+          }
+        },
+        integrationData: (integrationData ?? []).filter(
+          (integration) =>
+            "supportedIntegrations" in currentDefinition &&
+            (currentDefinition.supportedIntegrations as string[]).some((kind) => kind === integration.kind),
+        ),
+        integrationSupport: "supportedIntegrations" in currentDefinition,
+        settings,
+        appId: item.kind === "app" ? (item.options.appId as string | undefined) : undefined,
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      { title: (fn: any) => `${fn("item.edit.title")} - ${fn(`widget.${item.kind}.name`)}` },
+    );
+  }, [
+    openModal,
+    item,
+    updateItemOptions,
+    updateItemAdvancedOptions,
+    updateItemIntegrations,
+    integrationData,
+    currentDefinition,
+    settings,
+    isEditMode,
+    persistBoard,
+    board,
+  ]);
+
+  const handleToggle = useCallback(
+    (key: string) => (checked: boolean) => {
+      const newOptions = { ...options, [key]: checked };
+      updateItemOptions({ itemId: item.id, newOptions });
+      persistBoard(
+        board.items.map((boardItem) => (boardItem.id !== item.id ? boardItem : { ...boardItem, options: newOptions })),
+      );
+    },
+    [options, item.id, updateItemOptions, persistBoard, board],
+  );
+
+  if (!session) return <>{children}</>;
+
+  const visibleWidgetActions = widgetContextActions.filter((a) => !a.hidden);
+
+  return (
+    <Menu shadow="md" width={300} closeOnItemClick={false} position="right-start" offset={4}>
+      <Menu.ContextMenu>{children}</Menu.ContextMenu>
+      <Menu.Dropdown>
+        {toggleOptions.length > 0 && (
+          <>
+            <Menu.Label>{tMenu("options")}</Menu.Label>
+            {toggleOptions.map(([key]) => (
+              <Menu.Item key={key} onClick={() => handleToggle(key)(!options[key])}>
+                {/* eslint-disable-next-line @typescript-eslint/no-explicit-any */}
+                <Group wrap="nowrap">
+                  {String(translateIfNecessary(t, ((fn: any) => fn(`widget.${item.kind}.option.${key}.label`)) as any))}
+                  <Switch size="xs" checked={Boolean(options[key])} readOnly tabIndex={-1} ml="auto" />
+                </Group>
+              </Menu.Item>
+            ))}
+          </>
+        )}
+
+        {visibleWidgetActions.length > 0 && (
+          <>
+            {toggleOptions.length > 0 && <Menu.Divider />}
+            <Menu.Label>{tMenu("actions")}</Menu.Label>
+            {visibleWidgetActions.map((action) => {
+              const Icon = action.icon;
+              return (
+                <Menu.Item
+                  key={action.key}
+                  closeMenuOnClick
+                  leftSection={Icon ? <Icon size={16} /> : undefined}
+                  onClick={action.onClick}
+                  disabled={action.disabled}
+                  color={action.color}
+                >
+                  {String(translateIfNecessary(t, action.label))}
+                </Menu.Item>
+              );
+            })}
+          </>
+        )}
+
+        {isEditMode && (
+          <>
+            {(toggleOptions.length > 0 || visibleWidgetActions.length > 0) && <Menu.Divider />}
+            <Menu.Item
+              closeMenuOnClick
+              leftSection={<IconLayoutKanban size={16} />}
+              onClick={() => {
+                if (!gridstack.current) return;
+                openMoveModal({ item, columnCount: gridstack.current.getColumn(), gridStack: gridstack.current });
+              }}
+            >
+              {tItem("action.moveResize")}
+            </Menu.Item>
+            <Menu.Item
+              closeMenuOnClick
+              leftSection={<IconCopy size={16} />}
+              onClick={() => duplicateItem({ itemId: item.id })}
+            >
+              {tItem("action.duplicate")}
+            </Menu.Item>
+          </>
+        )}
+
+        <>
+          {!isEditMode && (toggleOptions.length > 0 || visibleWidgetActions.length > 0) && <Menu.Divider />}
+          <Menu.Item
+            closeMenuOnClick
+            leftSection={<IconSettings size={16} />}
+            onClick={openEditModal}
+            disabled={isPending}
+          >
+            {tMenu("settings")}
+          </Menu.Item>
+        </>
+
+        {isEditMode && (
+          <>
+            <Menu.Divider />
+            <Menu.Item
+              closeMenuOnClick
+              color="red"
+              leftSection={<IconTrash size={16} />}
+              onClick={() => {
+                openConfirmModal({
+                  title: tItem("remove.title"),
+                  children: tItem("remove.message"),
+                  onConfirm: () => removeItem({ itemId: item.id }),
+                });
+              }}
+            >
+              {tItem("action.remove")}
+            </Menu.Item>
+          </>
+        )}
+      </Menu.Dropdown>
+    </Menu>
+  );
+};

apps/nextjs/src/components/board/sections/item.module.css

@@ -10,3 +10,8 @@
   background-color: var(--background-color) !important;
   border-color: var(--border-color) !important;
 }
+
+.itemCard:global(.iframe-wrapper) {
+  background-color: transparent !important;
+  border-color: transparent !important;
+}

apps/nextjs/src/components/integration/integration-grid-shared.ts

@@ -57,6 +57,7 @@ export const categoryTranslationKeys: Record<string, string> = {
   mediaMonitoring: "integration.category.mediaMonitoring",
   speedtest: "integration.category.speedtest",
   analytics: "integration.category.analytics",
+  vpn: "integration.category.vpn",
   documents: "integration.category.documents",
   mediaLibrary: "integration.category.mediaLibrary",
   uptimeMonitoring: "integration.category.uptimeMonitoring",

apps/nextjs/src/components/layout/header/docker-quick-access-modal.tsx

@@ -0,0 +1,10 @@
+"use client";
+
+import { createModal } from "@homarr/modals";
+
+import { DockerTable } from "~/app/[locale]/manage/tools/docker/docker-table";
+
+export const DockerQuickAccessModal = createModal<void>(() => <DockerTable />).withOptions({
+  defaultTitle: (t) => t("docker.title"),
+  size: 1400,
+});

apps/nextjs/src/components/layout/header/user.tsx

@@ -3,6 +3,7 @@ import { UnstyledButton } from "@mantine/core";
 
 import { api } from "@homarr/api/server";
 import { auth } from "@homarr/auth/next";
+import { env } from "@homarr/docker/env";
 
 import { CurrentUserAvatar } from "~/components/user-avatar";
 import { UserAvatarMenu } from "~/components/user-avatar-menu";
@@ -11,9 +12,10 @@ import { UpdateIndicator } from "./update";
 export const UserButton = async () => {
   const session = await auth();
   const isAdmin = session?.user.permissions.includes("admin");
+  const isDockerEnabled = isAdmin && env.ENABLE_DOCKER;
   const availableUpdatesPromise = isAdmin ? api.updateChecker.getAvailableUpdates() : undefined;
   return (
-    <UserAvatarMenu availableUpdatesPromise={availableUpdatesPromise}>
+    <UserAvatarMenu availableUpdatesPromise={availableUpdatesPromise} isDockerEnabled={isDockerEnabled}>
       <UnstyledButton>
         <Suspense fallback={<CurrentUserAvatar size="md" />}>
           <UpdateIndicator availableUpdatesPromise={availableUpdatesPromise} disabled={!isAdmin}>

apps/nextjs/src/components/navigation/dynamic-breadcrumb.tsx

@@ -14,6 +14,8 @@ interface DynamicBreadcrumbProps {
   nonInteractable?: string[];
 }
 
+const categorySegments = new Set(["tools"]);
+
 /**
  * Breadcrumb is client side rendered. Elements are automatically
  * calculated and translated using dynamic keys.
@@ -60,8 +62,11 @@ export const DynamicBreadcrumb = ({
         const translationKey = `${pathnameParts.slice(0, index + 1).join(".")}`;
         const mappedValue = dynamicMappings?.get(pathnamePart);
 
+        const isNonInteractable =
+          nonInteractable?.includes(pathnamePart) === true || categorySegments.has(pathnamePart);
+
         if (mappedValue) {
-          if (nonInteractable?.includes(pathnamePart)) {
+          if (isNonInteractable) {
             return <Text key={href}>{mappedValue}</Text>;
           }
           return (
@@ -71,7 +76,7 @@ export const DynamicBreadcrumb = ({
           );
         }
 
-        if (nonInteractable?.includes(pathnamePart)) {
+        if (isNonInteractable) {
           return <Text key={href}>{t(`${translationKey}.label` as TranslationKeys)}</Text>;
         }
 

apps/nextjs/src/components/user-avatar-menu.tsx

@@ -5,7 +5,15 @@ import { useCallback, useEffect } from "react";
 import { useRouter } from "next/navigation";
 import { Center, Menu, Stack, Text, useMantineColorScheme } from "@mantine/core";
 import { useHotkeys, useTimeout } from "@mantine/hooks";
-import { IconCheck, IconHome, IconLogin, IconLogout, IconSettings, IconTool } from "@tabler/icons-react";
+import {
+  IconBrandDocker,
+  IconCheck,
+  IconHome,
+  IconLogin,
+  IconLogout,
+  IconSettings,
+  IconTool,
+} from "@tabler/icons-react";
 
 import type { RouterOutputs } from "@homarr/api";
 import { signOut, useSession } from "@homarr/auth/client";
@@ -17,14 +25,16 @@ import { Link } from "@homarr/ui";
 import { useAuthContext } from "~/app/[locale]/_client-providers/session";
 import { CurrentColorSchemeCombobox } from "./color-scheme/current-color-scheme-combobox";
 import { CurrentLanguageCombobox } from "./language/current-language-combobox";
+import { DockerQuickAccessModal } from "./layout/header/docker-quick-access-modal";
 import { AvailableUpdatesMenuItem } from "./layout/header/update";
 
 interface UserAvatarMenuProps {
   children: ReactNode;
   availableUpdatesPromise?: Promise<RouterOutputs["updateChecker"]["getAvailableUpdates"]>;
+  isDockerEnabled?: boolean;
 }
 
-export const UserAvatarMenu = ({ children, availableUpdatesPromise }: UserAvatarMenuProps) => {
+export const UserAvatarMenu = ({ children, availableUpdatesPromise, isDockerEnabled }: UserAvatarMenuProps) => {
   const t = useScopedI18n("common.userAvatar.menu");
   const { toggleColorScheme } = useMantineColorScheme();
   useHotkeys([[hotkeys.toggleColorScheme, toggleColorScheme]]);
@@ -34,6 +44,7 @@ export const UserAvatarMenu = ({ children, availableUpdatesPromise }: UserAvatar
 
   const { logoutUrl } = useAuthContext();
   const { openModal } = useModalAction(LogoutModal);
+  const { openModal: openDockerModal } = useModalAction(DockerQuickAccessModal);
 
   const handleSignout = useCallback(async () => {
     await signOut({
@@ -80,6 +91,11 @@ export const UserAvatarMenu = ({ children, availableUpdatesPromise }: UserAvatar
             <Menu.Item component={Link} href="/manage" leftSection={<IconTool size="1rem" />}>
               {t("management")}
             </Menu.Item>
+            {isDockerEnabled && (
+              <Menu.Item leftSection={<IconBrandDocker size="1rem" />} onClick={() => openDockerModal()}>
+                {t("docker")}
+              </Menu.Item>
+            )}
           </>
         )}
         <Menu.Divider />

apps/nextjs/src/versions/package-reader.ts

@@ -35,14 +35,22 @@ export const getDependenciesAsync = async (): Promise<PackageJsonDependencies> =
 type DependencyCatalog = Map<string, string>;
 const parseDependencyCatalogsAsync = async (): Promise<DependencyCatalog> => {
   const currentDir = path.dirname(fileURLToPath(import.meta.url));
-  const workspaceConfigContent = await fsPromises.readFile(
-    path.join(currentDir, "..", "..", "..", "..", "pnpm-workspace.yaml"),
-    "utf-8",
-  );
-  const workspaceConfig: unknown = parseYaml(workspaceConfigContent);
-  const parseResult = workspaceConfigCatalogSchema.parse(workspaceConfig);
+  const workspaceConfigPath = path.join(currentDir, "..", "..", "..", "..", "pnpm-workspace.yaml");
 
-  return new Map(Object.entries(parseResult.catalog ?? {}));
+  try {
+    const workspaceConfigContent = await fsPromises.readFile(workspaceConfigPath, "utf-8");
+    const workspaceConfig: unknown = parseYaml(workspaceConfigContent);
+    const parseResult = workspaceConfigCatalogSchema.parse(workspaceConfig);
+    return new Map(Object.entries(parseResult.catalog ?? {}));
+  } catch (error) {
+    // The workspace config is absent in Docker (only the runner stage is shipped),
+    // so a missing file is expected. Surface any other failure (e.g. malformed YAML).
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      return new Map();
+    }
+
+    throw error;
+  }
 };
 
 const workspaceConfigCatalogSchema = z.object({

apps/nextjs/tsconfig.json

@@ -3,6 +3,7 @@
   "compilerOptions": {
     "paths": {
       "~/*": ["./src/*"],
+      "@static-data/*": ["../../static-data/*"],
       "@homarr/node-unifi": ["../../node_modules/@types/node-unifi"]
     },
     "plugins": [

deployments/prebuilt-debian/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.16.0-trixie AS base
+FROM node:24.18.0-trixie AS base
 WORKDIR /app
 COPY package.json .
 COPY pnpm-lock.yaml .

deployments/prebuilt-debian/package.json

@@ -5,8 +5,8 @@
     "better-sqlite3": "^12.10.0"
   },
   "engines": {
-    "node": ">=24.16.0",
-    "pnpm": ">=11.6.0"
+    "node": ">=24.18.0",
+    "pnpm": ">=11.9.0"
   },
-  "packageManager": "pnpm@11.6.0"
+  "packageManager": "pnpm@11.9.0"
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "homarr",
-  "version": "1.67.0",
+  "version": "1.68.1",
   "private": true,
   "scripts": {
     "build": "cross-env CI=true turbo build",
@@ -61,10 +61,10 @@
     "vitest": "catalog:"
   },
   "engines": {
-    "node": ">=24.16.0",
-    "pnpm": ">=11.6.0"
+    "node": ">=24.18.0",
+    "pnpm": ">=11.9.0"
   },
-  "packageManager": "pnpm@11.7.0",
+  "packageManager": "pnpm@11.9.0",
   "dependencies": {
     "jsonpath-plus": "catalog:"
   }

packages/api/src/router/icons.ts

@@ -15,20 +15,36 @@ export const iconsRouter = createTRPCRouter({
     })
     .input(iconsFindSchema)
     .query(async ({ ctx, input }) => {
+      const term = input.searchText?.toLowerCase().trim() ?? "";
+      const keywords = (input.searchText ?? "").split(" ").filter((keyword) => keyword.length > 0);
+
+      let whereCondition = undefined;
+      if (term.length > 0) {
+        whereCondition = and(...keywords.map((keyword) => like(icons.name, `%${keyword}%`)));
+      }
+
       return {
         icons: await ctx.db.query.iconRepositories.findMany({
           with: {
             icons: {
-              columns: {
-                id: true,
-                name: true,
-                url: true,
+              columns: { id: true, name: true, url: true },
+              where: whereCondition,
+              orderBy: (table, { asc, sql }) => {
+                // ponytail: SVG first, then alphabetical; with a search term,
+                // prepend a relevance tier (exact > prefix > substring).
+                const svgFirst = sql`CASE WHEN ${table.name} LIKE '%.svg' THEN 0 ELSE 1 END`;
+                const nameAsc = asc(table.name);
+                if (term.length === 0) {
+                  return [svgFirst, nameAsc];
+                }
+                const tier = sql`CASE
+                  WHEN LOWER(${table.name}) = ${term} THEN 0
+                  WHEN LOWER(${table.name}) LIKE ${term + "%"} THEN 1
+                  WHEN LOWER(${table.name}) LIKE ${`%${term}%`} THEN 2
+                  ELSE 3
+                END`;
+                return [tier, svgFirst, nameAsc];
               },
-              where:
-                (input.searchText?.length ?? 0) > 0
-                  ? // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-                    and(...input.searchText!.split(" ").map((keyword) => like(icons.name, `%${keyword}%`)))
-                  : undefined,
               limit: input.limitPerGroup,
             },
           },

packages/api/src/router/onboard/onboard-router.ts

@@ -3,10 +3,13 @@ import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import { encryptSecret } from "@homarr/common/server";
-import { eq, like, or } from "@homarr/db";
+import { createLogger } from "@homarr/core/infrastructure/logs";
+import { asc, eq, inArray, like, or } from "@homarr/db";
 import { placeAllWidgetsAsync } from "@homarr/db/queries";
+import { getServerSettingsAsync } from "@homarr/db/queries";
 import {
   apps,
+  boards,
   groups,
   icons,
   integrationItems,
@@ -33,6 +36,8 @@ import { MissingSecretError, testConnectionAsync } from "../integration/integrat
 import { mapTestConnectionError } from "../integration/map-test-connection-error";
 import { getOnboardingOrFallbackAsync, nextOnboardingStepAsync } from "./onboard-queries";
 
+const logger = createLogger({ module: "onboardDockerDiscovery" });
+
 interface PortInfo {
   IP?: string;
   PublicPort?: number;
@@ -43,6 +48,30 @@ interface SuggestedUrlResult {
   publishedPort: number | null;
 }
 
+type DockerDiscoverySource = "label" | "docker";
+
+interface DiscoveredIntegration {
+  containerId: string;
+  containerName: string;
+  kind: IntegrationKind;
+  suggestedUrl: string;
+  publishedPort: number | null;
+  iconUrl: string | null;
+  source: DockerDiscoverySource;
+  group?: string;
+}
+
+interface DiscoveredApp {
+  containerId: string;
+  containerName: string;
+  suggestedUrl: string;
+  publishedPort: number | null;
+  iconUrl: string | null;
+  source: DockerDiscoverySource;
+  group?: string;
+  host?: string;
+}
+
 const buildSuggestedUrl = (ports: PortInfo[] | undefined, host: string): SuggestedUrlResult => {
   const port = ports?.[0];
   if (port?.PublicPort) {
@@ -145,51 +174,91 @@ export const onboardRouter = createTRPCRouter({
     }),
   discoverDockerServices: onboardingProcedure.requiresStep("integrations").query(async ({ ctx }) => {
     const emptyResult = {
-      integrations: [] as {
-        containerId: string;
-        containerName: string;
-        kind: IntegrationKind;
-        suggestedUrl: string;
-        publishedPort: number | null;
-        iconUrl: string | null;
-      }[],
-      apps: [] as {
-        containerId: string;
-        containerName: string;
-        suggestedUrl: string;
-        publishedPort: number | null;
-        iconUrl: string | null;
-      }[],
+      integrations: [] as DiscoveredIntegration[],
+      apps: [] as DiscoveredApp[],
     };
 
     try {
-      const { DockerSingleton, dockerLabels } = await import("@homarr/docker");
+      const { DockerSingleton, dockerLabels, listDiscoveredContainersAsync } = await import("@homarr/docker");
+      const serverSettings = await getServerSettingsAsync(ctx.db);
+
+      const labeledServices = await listDiscoveredContainersAsync({
+        readHomepageLabels: serverSettings.docker.readHomepageLabels,
+      });
+      const labeledContainerIds = new Set(labeledServices.map((service) => service.containerId));
+      const seenKinds = new Set<IntegrationKind>();
+      const discoveredIntegrations: DiscoveredIntegration[] = [];
+      const discoveredApps: DiscoveredApp[] = [];
+
+      for (const service of labeledServices) {
+        if (service.integrationKind && !seenKinds.has(service.integrationKind)) {
+          seenKinds.add(service.integrationKind);
+          discoveredIntegrations.push({
+            containerId: service.containerId,
+            containerName: service.name,
+            kind: service.integrationKind,
+            suggestedUrl: service.href,
+            publishedPort: null,
+            iconUrl: service.icon ?? null,
+            source: "label",
+            group: service.group,
+          });
+          continue;
+        }
+
+        discoveredApps.push({
+          containerId: service.containerId,
+          containerName: service.name,
+          suggestedUrl: service.href,
+          publishedPort: null,
+          iconUrl: service.icon ?? null,
+          source: "label",
+          group: service.group,
+          host: service.host,
+        });
+      }
 
       const dockerInstances = DockerSingleton.getInstances();
       if (dockerInstances.length === 0) {
-        return { status: "empty" as const, ...emptyResult };
+        const hasResults = discoveredIntegrations.length > 0 || discoveredApps.length > 0;
+        return {
+          status: hasResults ? ("success" as const) : ("empty" as const),
+          integrations: discoveredIntegrations,
+          apps: discoveredApps,
+        };
       }
 
       const results = await Promise.allSettled(
         dockerInstances.map(async ({ instance, host }) => {
           const containerList = await instance.listContainers({ all: false });
-          return containerList.filter((c) => !(dockerLabels.hide in c.Labels)).map((c) => ({ ...c, host }));
+          return containerList
+            .filter((container) => !(dockerLabels.hide in container.Labels))
+            .filter((container) => !labeledContainerIds.has(container.Id))
+            .map((container) => ({ ...container, host }));
         }),
       );
 
-      const containers = results.flatMap((r) => (r.status === "fulfilled" ? r.value : []));
+      const containers = results.flatMap((result, index) => {
+        if (result.status === "fulfilled") {
+          return result.value;
+        }
 
-      if (containers.length === 0) {
+        logger.warn("Failed to list containers for onboarding discovery", {
+          host: dockerInstances[index]?.host,
+          cause: result.reason,
+        });
+        return [];
+      });
+
+      if (containers.length === 0 && discoveredIntegrations.length === 0 && discoveredApps.length === 0) {
         return { status: "empty" as const, ...emptyResult };
       }
 
-      const likeQueries = containers.map((c) => like(icons.name, `%${extractContainerImageName(c.Image)}%`));
+      const likeQueries = containers.map((container) =>
+        like(icons.name, `%${extractContainerImageName(container.Image)}%`),
+      );
       const dbIcons = likeQueries.length > 0 ? await ctx.db.query.icons.findMany({ where: or(...likeQueries) }) : [];
 
-      const seenKinds = new Set<IntegrationKind>();
-      const discoveredIntegrations = emptyResult.integrations;
-      const discoveredApps = emptyResult.apps;
-
       const cdnIconUrl = (slug: string) =>
         `https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/${slug}.svg`;
 
@@ -223,6 +292,7 @@ export const onboardRouter = createTRPCRouter({
             suggestedUrl,
             publishedPort,
             iconUrl,
+            source: "docker",
           });
         } else if (!kind && dbIcon) {
           discoveredApps.push({
@@ -231,19 +301,61 @@ export const onboardRouter = createTRPCRouter({
             suggestedUrl,
             publishedPort,
             iconUrl,
+            source: "docker",
+            host: container.host,
           });
         }
       }
 
+      const hasResults = discoveredIntegrations.length > 0 || discoveredApps.length > 0;
       return {
-        status: "success" as const,
+        status: hasResults ? ("success" as const) : ("empty" as const),
         integrations: discoveredIntegrations,
         apps: discoveredApps,
       };
-    } catch {
+    } catch (error) {
+      logger.warn("Docker discovery failed during onboarding", { cause: error });
       return { status: "unavailable" as const, ...emptyResult };
     }
   }),
+  syncDockerLabelApps: onboardingProcedure
+    .requiresStep("integrations")
+    .input(
+      z.array(
+        z.object({
+          containerId: z.string(),
+          host: z.string(),
+        }),
+      ),
+    )
+    .mutation(async ({ ctx, input }) => {
+      if (input.length === 0) {
+        return { created: 0, updated: 0, skipped: 0, notFound: 0 };
+      }
+
+      const { listDiscoveredContainersAsync, syncDiscoveredServicesAsync } = await import("@homarr/docker");
+      const serverSettings = await getServerSettingsAsync(ctx.db);
+      const labeledServices = await listDiscoveredContainersAsync({
+        readHomepageLabels: serverSettings.docker.readHomepageLabels,
+      });
+      const selectedKeys = new Set(input.map((entry) => `${entry.host}/${entry.containerId}`));
+      const selectedServices = labeledServices.filter((service) =>
+        selectedKeys.has(`${service.host}/${service.containerId}`),
+      );
+
+      const syncResult = await syncDiscoveredServicesAsync(selectedServices, {
+        targetBoardName: serverSettings.docker.targetBoardName,
+        enableStatusByDefault: serverSettings.board.enableStatusByDefault,
+        forceDisableStatus: serverSettings.board.forceDisableStatus,
+        defaultItemWidth: serverSettings.docker.defaultItemWidth,
+        defaultItemHeight: serverSettings.docker.defaultItemHeight,
+      });
+
+      return {
+        ...syncResult,
+        notFound: input.length - selectedServices.length,
+      };
+    }),
   createAppsFromDiscovery: onboardingProcedure
     .requiresStep("integrations")
     .input(
@@ -257,9 +369,17 @@ export const onboardRouter = createTRPCRouter({
     )
     .mutation(async ({ ctx, input }) => {
       if (input.length === 0) return;
+
+      const existingApps = await ctx.db.query.apps.findMany({ columns: { href: true } });
+      const existingHrefs = new Set(
+        existingApps.map((app) => app.href).filter((href): href is string => Boolean(href)),
+      );
+      const appsToCreate = input.filter((app) => !app.href || !existingHrefs.has(app.href));
+      if (appsToCreate.length === 0) return;
+
       const defaultIcon = "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/homarr.svg";
       await ctx.db.insert(apps).values(
-        input.map((app) => ({
+        appsToCreate.map((app) => ({
           id: createId(),
           name: app.name,
           iconUrl: app.iconUrl ?? defaultIcon,
@@ -270,16 +390,26 @@ export const onboardRouter = createTRPCRouter({
     }),
   setupIntegrations: onboardingProcedure.requiresStep("integrations").mutation(async ({ ctx }) => {
     const db = ctx.db;
+    const serverSettings = await getServerSettingsAsync(db);
 
     const allIntegrations = await db.query.integrations.findMany();
     const allApps = await db.query.apps.findMany();
+    const labelSyncedAppIds = new Set(
+      (await db.query.dockerAppSources.findMany({ columns: { appId: true } })).map((source) => source.appId),
+    );
+    const appsForWidgetPlacement = allApps.filter((app) => !labelSyncedAppIds.has(app.id));
 
-    const board = await db.query.boards.findFirst({
+    const boardList = await db.query.boards.findMany({
+      orderBy: asc(boards.name),
       with: {
         sections: true,
         layouts: true,
       },
     });
+    const targetBoardName = serverSettings.docker.targetBoardName;
+    const board = targetBoardName
+      ? (boardList.find((entry) => entry.name === targetBoardName) ?? boardList.at(0))
+      : boardList.at(0);
 
     if (!board) {
       await nextOnboardingStepAsync(db, undefined);
@@ -297,15 +427,16 @@ export const onboardRouter = createTRPCRouter({
     const layout = board.layouts[0];
 
     if (section && layout) {
-      const existingItems = await db.query.items.findMany({
-        where: eq(items.boardId, board.id),
+      const emptySectionLayouts = await db.query.itemLayouts.findMany({
+        where: eq(itemLayouts.sectionId, section.id),
+        columns: { itemId: true },
       });
-      for (const item of existingItems) {
-        await db.delete(integrationItems).where(eq(integrationItems.itemId, item.id));
-        await db.delete(itemLayouts).where(eq(itemLayouts.itemId, item.id));
-      }
-      if (existingItems.length > 0) {
-        await db.delete(items).where(eq(items.boardId, board.id));
+      const emptySectionItemIds = emptySectionLayouts.map((entry) => entry.itemId);
+
+      if (emptySectionItemIds.length > 0) {
+        await db.delete(integrationItems).where(inArray(integrationItems.itemId, emptySectionItemIds));
+        await db.delete(itemLayouts).where(inArray(itemLayouts.itemId, emptySectionItemIds));
+        await db.delete(items).where(inArray(items.id, emptySectionItemIds));
       }
 
       await placeAllWidgetsAsync(
@@ -317,7 +448,7 @@ export const onboardRouter = createTRPCRouter({
           columnCount: layout.columnCount,
         },
         allIntegrations,
-        allApps,
+        appsForWidgetPlacement,
       );
     }
 

packages/api/src/router/widgets/beszel.ts

@@ -2,6 +2,7 @@ import { TRPCError } from "@trpc/server";
 import { observable } from "@trpc/server/observable";
 import { z } from "zod/v4";
 
+import { createLogger } from "@homarr/core/infrastructure/logs";
 import { createIntegrationAsync } from "@homarr/integrations";
 import type { BeszelContainerStatsRecord, BeszelSystemStatsRecord } from "@homarr/integrations/types";
 import {
@@ -14,6 +15,8 @@ import type { BeszelAlertsData, BeszelSystemRow } from "@homarr/request-handler/
 import { createManyIntegrationMiddleware } from "../../middlewares/integration";
 import { createTRPCRouter, publicProcedure } from "../../trpc";
 
+const logger = createLogger({ module: "beszelRouter" });
+
 export const beszelRouter = createTRPCRouter({
   getSystems: publicProcedure
     .meta({
@@ -25,7 +28,9 @@ export const beszelRouter = createTRPCRouter({
     })
     .concat(createManyIntegrationMiddleware("query", "beszel", "mock"))
     .query(async ({ ctx }) => {
-      const results = await Promise.all(
+      const integrationIds = ctx.integrations.map((i) => i.id);
+      logger.debug("getSystems called", { userId: ctx.session?.user?.id, integrationIds });
+      const settled = await Promise.allSettled(
         ctx.integrations.map(async (integration) => {
           const innerHandler = beszelSystemsRequestHandler.handler(integration, {});
           const { data, timestamp } = await innerHandler.getCachedOrUpdatedDataAsync({
@@ -40,6 +45,29 @@ export const beszelRouter = createTRPCRouter({
           };
         }),
       );
+      const results = settled.map((result, index) => {
+        if (result.status === "fulfilled") return result.value;
+        const integration = ctx.integrations[index];
+        logger.warn("getSystems integration failed", {
+          userId: ctx.session?.user?.id,
+          integrationId: integration?.id,
+          error: result.reason,
+        });
+        return {
+          integrationId: integration?.id ?? "unknown",
+          integrationName: integration?.name ?? "unknown",
+          integrationUrl: integration?.url ?? "",
+          systems: [],
+          updatedAt: new Date(0),
+          error: result.reason instanceof Error ? result.reason.message : String(result.reason),
+        };
+      });
+      logger.debug("getSystems completed", {
+        userId: ctx.session?.user?.id,
+        integrationIds,
+        resultCount: results.length,
+        errorCount: results.filter((r) => "error" in r).length,
+      });
       return results;
     }),
 
@@ -83,7 +111,14 @@ export const beszelRouter = createTRPCRouter({
       }),
     )
     .query(async ({ ctx, input }) => {
-      const results = await Promise.all(
+      const integrationIds = ctx.integrations.map((i) => i.id);
+      logger.debug("getAlerts called", {
+        userId: ctx.session?.user?.id,
+        integrationIds,
+        includeHistory: input.includeHistory,
+        maxHistoryItems: input.maxHistoryItems,
+      });
+      const settled = await Promise.allSettled(
         ctx.integrations.map(async (integration) => {
           const alertsHandler = beszelAlertsRequestHandler.handler(integration, {
             includeHistory: input.includeHistory,
@@ -100,6 +135,7 @@ export const beszelRouter = createTRPCRouter({
           }
           return {
             integrationId: integration.id,
+            integrationName: integration.name,
             alerts: alertsResult.data.alerts,
             history: alertsResult.data.history,
             systemNameMap,
@@ -107,6 +143,30 @@ export const beszelRouter = createTRPCRouter({
           };
         }),
       );
+      const results = settled.map((result, index) => {
+        if (result.status === "fulfilled") return result.value;
+        const integration = ctx.integrations[index];
+        logger.warn("getAlerts integration failed", {
+          userId: ctx.session?.user?.id,
+          integrationId: integration?.id,
+          error: result.reason,
+        });
+        return {
+          integrationId: integration?.id ?? "unknown",
+          integrationName: integration?.name ?? "unknown",
+          alerts: [],
+          history: [],
+          systemNameMap: {},
+          updatedAt: new Date(0),
+          error: result.reason instanceof Error ? result.reason.message : String(result.reason),
+        };
+      });
+      logger.debug("getAlerts completed", {
+        userId: ctx.session?.user?.id,
+        integrationIds,
+        resultCount: results.length,
+        errorCount: results.filter((r) => "error" in r).length,
+      });
       return results;
     }),
 
@@ -164,13 +224,41 @@ export const beszelRouter = createTRPCRouter({
       if (!integration) {
         throw new TRPCError({ code: "BAD_REQUEST", message: "At least one Beszel integrationId is required" });
       }
-      const innerHandler = beszelStatsRequestHandler.handler(integration, {
+      logger.debug("getSystemStats called", {
+        userId: ctx.session?.user?.id,
+        integrationId: integration.id,
         systemId: input.systemId,
         timePeriod: input.timePeriod,
         includeDocker: input.includeDocker,
       });
-      const { data, timestamp } = await innerHandler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
-      return { integrationId: integration.id, ...data, updatedAt: timestamp };
+      try {
+        const innerHandler = beszelStatsRequestHandler.handler(integration, {
+          systemId: input.systemId,
+          timePeriod: input.timePeriod,
+          includeDocker: input.includeDocker,
+        });
+        const { data, timestamp } = await innerHandler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
+        logger.debug("getSystemStats completed", {
+          userId: ctx.session?.user?.id,
+          integrationId: integration.id,
+          systemId: input.systemId,
+        });
+        return { integrationId: integration.id, ...data, updatedAt: timestamp };
+      } catch (error) {
+        logger.warn("getSystemStats failed", {
+          userId: ctx.session?.user?.id,
+          integrationId: integration.id,
+          systemId: input.systemId,
+          error,
+        });
+        return {
+          integrationId: integration.id,
+          systemStats: [],
+          containerStats: [],
+          updatedAt: new Date(0),
+          error: error instanceof Error ? error.message : String(error),
+        };
+      }
     }),
 
   subscribeSystemStats: publicProcedure
@@ -190,6 +278,11 @@ export const beszelRouter = createTRPCRouter({
           emit.error(new Error("No Beszel integration configured"));
           return () => {};
         }
+        logger.debug("subscribeSystemStats opened", {
+          userId: ctx.session?.user?.id,
+          integrationId: integration.id,
+          systemId: input.systemId,
+        });
 
         const abortController = new AbortController();
 
@@ -199,6 +292,12 @@ export const beszelRouter = createTRPCRouter({
             await instance.subscribeRealtimeMetrics(input.systemId, (data) => emit.next(data), abortController.signal);
           } catch (error) {
             if (!abortController.signal.aborted) {
+              logger.warn("subscribeSystemStats error", {
+                userId: ctx.session?.user?.id,
+                integrationId: integration.id,
+                systemId: input.systemId,
+                error,
+              });
               if (error instanceof Error) {
                 emit.error(error);
               } else {
@@ -210,6 +309,11 @@ export const beszelRouter = createTRPCRouter({
 
         return () => {
           abortController.abort();
+          logger.debug("subscribeSystemStats closed", {
+            userId: ctx.session?.user?.id,
+            integrationId: integration.id,
+            systemId: input.systemId,
+          });
         };
       });
     }),

packages/api/src/router/widgets/index.ts

@@ -36,6 +36,7 @@ export const widgetRouter = createTRPCRouter({
   uptimeKuma: lazy(() => import("./uptime-kuma").then((mod) => mod.uptimeKumaRouter)),
   audioStats: lazy(() => import("./audio-stats").then((mod) => mod.audioStatsRouter)),
   umami: lazy(() => import("./umami").then((mod) => mod.umamiRouter)),
+  vpn: lazy(() => import("./vpn").then((mod) => mod.vpnRouter)),
   ups: lazy(() => import("./ups").then((mod) => mod.upsRouter)),
   customApi: lazy(() => import("./custom-api").then((mod) => mod.customApiRouter)),
 });

packages/api/src/router/widgets/vpn.ts

@@ -0,0 +1,59 @@
+import { observable } from "@trpc/server/observable";
+
+import type { Modify } from "@homarr/common/types";
+import type { Integration } from "@homarr/db/schema";
+import type { IntegrationKindByCategory } from "@homarr/definitions";
+import { getIntegrationKindsByCategory } from "@homarr/definitions";
+import type { VpnSummary } from "@homarr/integrations/types";
+import { vpnSummaryHandler } from "@homarr/request-handler/vpn";
+
+import { createManyIntegrationMiddleware } from "../../middlewares/integration";
+import { createTRPCRouter, publicProcedure } from "../../trpc";
+
+const createVpnIntegrationMiddleware = () =>
+  createManyIntegrationMiddleware("query", ...getIntegrationKindsByCategory("vpn"));
+
+export const vpnRouter = createTRPCRouter({
+  getSummaries: publicProcedure.unstable_concat(createVpnIntegrationMiddleware()).query(async ({ ctx }) => {
+    return await Promise.all(
+      ctx.integrations.map(async (integration) => {
+        const innerHandler = vpnSummaryHandler.handler(integration, {});
+        const { data, timestamp } = await innerHandler.getCachedOrUpdatedDataAsync({ forceUpdate: false });
+
+        return {
+          integration: {
+            id: integration.id,
+            name: integration.name,
+            kind: integration.kind,
+            updatedAt: timestamp,
+          },
+          summary: data,
+        };
+      }),
+    );
+  }),
+  subscribeSummaries: publicProcedure.unstable_concat(createVpnIntegrationMiddleware()).subscription(({ ctx }) => {
+    return observable<{
+      integration: Modify<Integration, { kind: IntegrationKindByCategory<"vpn"> }>;
+      summary: VpnSummary | null;
+    }>((emit) => {
+      const unsubscribes: (() => void)[] = [];
+      for (const integrationWithSecrets of ctx.integrations) {
+        const { decryptedSecrets: _, ...integration } = integrationWithSecrets;
+        const innerHandler = vpnSummaryHandler.handler(integrationWithSecrets, {});
+        const unsubscribe = innerHandler.subscribe((summary) => {
+          emit.next({
+            integration,
+            summary,
+          });
+        });
+        unsubscribes.push(unsubscribe);
+      }
+      return () => {
+        unsubscribes.forEach((unsubscribe) => {
+          unsubscribe();
+        });
+      };
+    });
+  }),
+});

packages/cron-jobs/src/index.ts

@@ -21,6 +21,7 @@ import { refreshNotificationsJob } from "./jobs/integrations/notifications";
 import { timetableJob } from "./jobs/integrations/timetable";
 import { tracearrJob } from "./jobs/integrations/tracearr";
 import { umamiActiveVisitorsJob } from "./jobs/integrations/umami";
+import { vpnJob } from "./jobs/integrations/vpn";
 import { minecraftServerStatusJob } from "./jobs/minecraft-server-status";
 import { pingJob } from "./jobs/ping";
 import { rssFeedsJob } from "./jobs/rss-feeds";
@@ -57,6 +58,7 @@ const getJobGroup = () => {
     timetable: timetableJob,
     tracearr: tracearrJob,
     umamiActiveVisitors: umamiActiveVisitorsJob,
+    vpn: vpnJob,
   });
 };
 

packages/cron-jobs/src/jobs/integrations/vpn.ts

@@ -0,0 +1,14 @@
+import { EVERY_30_SECONDS } from "@homarr/cron-jobs-core/expressions";
+import { vpnSummaryHandler } from "@homarr/request-handler/vpn";
+import { createRequestIntegrationJobHandler } from "@homarr/request-handler/lib/cached-request-integration-job-handler";
+
+import { createCronJob } from "../../lib";
+
+export const vpnJob = createCronJob("vpn", EVERY_30_SECONDS).withCallback(
+  createRequestIntegrationJobHandler(vpnSummaryHandler.handler, {
+    widgetKinds: ["vpn"],
+    getInput: {
+      vpn: () => ({}),
+    },
+  }),
+);

packages/db/migrations/mysql/0042_add_docker_app_source.sql

@@ -0,0 +1,17 @@
+CREATE TABLE `docker_app_source` (
+	`host` varchar(512) NOT NULL,
+	`container_id` varchar(128) NOT NULL,
+	`external_id` varchar(512) NOT NULL,
+	`app_id` varchar(64) NOT NULL,
+	`board_id` varchar(64) NOT NULL,
+	`item_id` varchar(64),
+	`integration_id` varchar(64),
+	`updated_at` timestamp NOT NULL DEFAULT (now()),
+	CONSTRAINT `docker_app_source_host_container_id_pk` PRIMARY KEY(`host`,`container_id`)
+);
+--> statement-breakpoint
+ALTER TABLE `docker_app_source` ADD CONSTRAINT `docker_app_source_app_id_app_id_fk` FOREIGN KEY (`app_id`) REFERENCES `app`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `docker_app_source` ADD CONSTRAINT `docker_app_source_board_id_board_id_fk` FOREIGN KEY (`board_id`) REFERENCES `board`(`id`) ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `docker_app_source` ADD CONSTRAINT `docker_app_source_item_id_item_id_fk` FOREIGN KEY (`item_id`) REFERENCES `item`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE `docker_app_source` ADD CONSTRAINT `docker_app_source_integration_id_integration_id_fk` FOREIGN KEY (`integration_id`) REFERENCES `integration`(`id`) ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX `docker_app_source__external_id_idx` ON `docker_app_source` (`host`,`external_id`);

packages/db/migrations/mysql/meta/_journal.json

@@ -295,6 +295,13 @@
       "when": 1780764500000,
       "tag": "0041_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 42,
+      "version": "5",
+      "when": 1780764600000,
+      "tag": "0042_add_docker_app_source",
+      "breakpoints": true
     }
   ]
 }

packages/db/migrations/postgresql/0008_add_docker_app_source.sql

@@ -0,0 +1,17 @@
+CREATE TABLE "docker_app_source" (
+	"host" varchar(512) NOT NULL,
+	"container_id" varchar(128) NOT NULL,
+	"external_id" varchar(512) NOT NULL,
+	"app_id" varchar(64) NOT NULL,
+	"board_id" varchar(64) NOT NULL,
+	"item_id" varchar(64),
+	"integration_id" varchar(64),
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "docker_app_source_host_container_id_pk" PRIMARY KEY("host","container_id")
+);
+--> statement-breakpoint
+ALTER TABLE "docker_app_source" ADD CONSTRAINT "docker_app_source_app_id_app_id_fk" FOREIGN KEY ("app_id") REFERENCES "public"."app"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "docker_app_source" ADD CONSTRAINT "docker_app_source_board_id_board_id_fk" FOREIGN KEY ("board_id") REFERENCES "public"."board"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "docker_app_source" ADD CONSTRAINT "docker_app_source_item_id_item_id_fk" FOREIGN KEY ("item_id") REFERENCES "public"."item"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "docker_app_source" ADD CONSTRAINT "docker_app_source_integration_id_integration_id_fk" FOREIGN KEY ("integration_id") REFERENCES "public"."integration"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "docker_app_source__external_id_idx" ON "docker_app_source" USING btree ("host","external_id");

packages/db/migrations/postgresql/meta/_journal.json

@@ -57,6 +57,13 @@
       "when": 1780764500000,
       "tag": "0007_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1780764600000,
+      "tag": "0008_add_docker_app_source",
+      "breakpoints": true
     }
   ]
 }

packages/db/migrations/sqlite/0040_add_docker_app_source.sql

@@ -0,0 +1,17 @@
+CREATE TABLE `docker_app_source` (
+	`host` text NOT NULL,
+	`container_id` text NOT NULL,
+	`external_id` text NOT NULL,
+	`app_id` text NOT NULL,
+	`board_id` text NOT NULL,
+	`item_id` text,
+	`integration_id` text,
+	`updated_at` integer NOT NULL,
+	PRIMARY KEY(`host`, `container_id`),
+	FOREIGN KEY (`app_id`) REFERENCES `app`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`board_id`) REFERENCES `board`(`id`) ON UPDATE no action ON DELETE cascade,
+	FOREIGN KEY (`item_id`) REFERENCES `item`(`id`) ON UPDATE no action ON DELETE set null,
+	FOREIGN KEY (`integration_id`) REFERENCES `integration`(`id`) ON UPDATE no action ON DELETE set null
+);
+--> statement-breakpoint
+CREATE INDEX `docker_app_source__external_id_idx` ON `docker_app_source` (`host`,`external_id`);

packages/db/migrations/sqlite/meta/_journal.json

@@ -281,6 +281,13 @@
       "when": 1780764500000,
       "tag": "0039_merge_custom_widget_url",
       "breakpoints": true
+    },
+    {
+      "idx": 40,
+      "version": "6",
+      "when": 1780764600000,
+      "tag": "0040_add_docker_app_source",
+      "breakpoints": true
     }
   ]
 }

packages/db/schema/index.ts

@@ -51,6 +51,7 @@ export const {
   cronJobConfigurations,
   customWidgetDefinitions,
   customWidgetSecrets,
+  dockerAppSources,
 } = schema;
 
 export type User = InferSelectModel<typeof schema.users>;

packages/db/schema/mysql.ts

@@ -547,6 +547,33 @@ export const cronJobConfigurations = mysqlTable("cron_job_configuration", {
   isEnabled: boolean().default(true).notNull(),
 });
 
+export const dockerAppSources = mysqlTable(
+  "docker_app_source",
+  {
+    host: varchar({ length: 512 }).notNull(),
+    containerId: varchar({ length: 128 }).notNull(),
+    externalId: varchar({ length: 512 }).notNull(),
+    appId: varchar({ length: 64 })
+      .notNull()
+      .references(() => apps.id, { onDelete: "cascade" }),
+    boardId: varchar({ length: 64 })
+      .notNull()
+      .references(() => boards.id, { onDelete: "cascade" }),
+    itemId: varchar({ length: 64 }).references(() => items.id, { onDelete: "set null" }),
+    integrationId: varchar({ length: 64 }).references(() => integrations.id, { onDelete: "set null" }),
+    updatedAt: timestamp()
+      .notNull()
+      .$onUpdateFn(() => new Date())
+      .$defaultFn(() => new Date()),
+  },
+  (table) => ({
+    compoundKey: primaryKey({
+      columns: [table.host, table.containerId],
+    }),
+    externalIdIdx: index("docker_app_source__external_id_idx").on(table.host, table.externalId),
+  }),
+);
+
 export const accountRelations = relations(accounts, ({ one }) => ({
   user: one(users, {
     fields: [accounts.userId],
@@ -826,3 +853,22 @@ export const customWidgetSecretRelations = relations(customWidgetSecrets, ({ one
     references: [customWidgetDefinitions.id],
   }),
 }));
+
+export const dockerAppSourceRelations = relations(dockerAppSources, ({ one }) => ({
+  app: one(apps, {
+    fields: [dockerAppSources.appId],
+    references: [apps.id],
+  }),
+  board: one(boards, {
+    fields: [dockerAppSources.boardId],
+    references: [boards.id],
+  }),
+  item: one(items, {
+    fields: [dockerAppSources.itemId],
+    references: [items.id],
+  }),
+  integration: one(integrations, {
+    fields: [dockerAppSources.integrationId],
+    references: [integrations.id],
+  }),
+}));

packages/db/schema/postgresql.ts

@@ -546,6 +546,33 @@ export const cronJobConfigurations = pgTable("cron_job_configuration", {
   isEnabled: boolean().default(true).notNull(),
 });
 
+export const dockerAppSources = pgTable(
+  "docker_app_source",
+  {
+    host: varchar({ length: 512 }).notNull(),
+    containerId: varchar({ length: 128 }).notNull(),
+    externalId: varchar({ length: 512 }).notNull(),
+    appId: varchar({ length: 64 })
+      .notNull()
+      .references(() => apps.id, { onDelete: "cascade" }),
+    boardId: varchar({ length: 64 })
+      .notNull()
+      .references(() => boards.id, { onDelete: "cascade" }),
+    itemId: varchar({ length: 64 }).references(() => items.id, { onDelete: "set null" }),
+    integrationId: varchar({ length: 64 }).references(() => integrations.id, { onDelete: "set null" }),
+    updatedAt: timestamp()
+      .notNull()
+      .$onUpdateFn(() => new Date())
+      .$defaultFn(() => new Date()),
+  },
+  (table) => ({
+    compoundKey: primaryKey({
+      columns: [table.host, table.containerId],
+    }),
+    externalIdIdx: index("docker_app_source__external_id_idx").on(table.host, table.externalId),
+  }),
+);
+
 export const accountRelations = relations(accounts, ({ one }) => ({
   user: one(users, {
     fields: [accounts.userId],
@@ -825,3 +852,22 @@ export const customWidgetSecretRelations = relations(customWidgetSecrets, ({ one
     references: [customWidgetDefinitions.id],
   }),
 }));
+
+export const dockerAppSourceRelations = relations(dockerAppSources, ({ one }) => ({
+  app: one(apps, {
+    fields: [dockerAppSources.appId],
+    references: [apps.id],
+  }),
+  board: one(boards, {
+    fields: [dockerAppSources.boardId],
+    references: [boards.id],
+  }),
+  item: one(items, {
+    fields: [dockerAppSources.itemId],
+    references: [items.id],
+  }),
+  integration: one(integrations, {
+    fields: [dockerAppSources.integrationId],
+    references: [integrations.id],
+  }),
+}));

packages/db/schema/sqlite.ts

@@ -536,6 +536,33 @@ export const cronJobConfigurations = sqliteTable("cron_job_configuration", {
   isEnabled: int({ mode: "boolean" }).default(true).notNull(),
 });
 
+export const dockerAppSources = sqliteTable(
+  "docker_app_source",
+  {
+    host: text().notNull(),
+    containerId: text().notNull(),
+    externalId: text().notNull(),
+    appId: text()
+      .notNull()
+      .references(() => apps.id, { onDelete: "cascade" }),
+    boardId: text()
+      .notNull()
+      .references(() => boards.id, { onDelete: "cascade" }),
+    itemId: text().references(() => items.id, { onDelete: "set null" }),
+    integrationId: text().references(() => integrations.id, { onDelete: "set null" }),
+    updatedAt: int({ mode: "timestamp" })
+      .$onUpdateFn(() => new Date())
+      .notNull()
+      .$defaultFn(() => new Date()),
+  },
+  (table) => ({
+    compoundKey: primaryKey({
+      columns: [table.host, table.containerId],
+    }),
+    externalIdIdx: index("docker_app_source__external_id_idx").on(table.host, table.externalId),
+  }),
+);
+
 export const accountRelations = relations(accounts, ({ one }) => ({
   user: one(users, {
     fields: [accounts.userId],
@@ -815,3 +842,22 @@ export const customWidgetSecretRelations = relations(customWidgetSecrets, ({ one
     references: [customWidgetDefinitions.id],
   }),
 }));
+
+export const dockerAppSourceRelations = relations(dockerAppSources, ({ one }) => ({
+  app: one(apps, {
+    fields: [dockerAppSources.appId],
+    references: [apps.id],
+  }),
+  board: one(boards, {
+    fields: [dockerAppSources.boardId],
+    references: [boards.id],
+  }),
+  item: one(items, {
+    fields: [dockerAppSources.itemId],
+    references: [items.id],
+  }),
+  integration: one(integrations, {
+    fields: [dockerAppSources.integrationId],
+    references: [integrations.id],
+  }),
+}));

packages/definitions/src/docs/homarr-docs-sitemap.ts

@@ -165,6 +165,7 @@ export type HomarrDocumentationPath =
   | "/docs/getting-started/installation/unraid"
   | "/docs/integrations/adguard-home"
   | "/docs/integrations/anchor"
+  | "/docs/integrations/archiveteam-warrior"
   | "/docs/integrations/aria2"
   | "/docs/integrations/audiobookshelf"
   | "/docs/integrations/beszel"
@@ -179,6 +180,7 @@ export type HomarrDocumentationPath =
   | "/docs/integrations/github"
   | "/docs/integrations/gitlab"
   | "/docs/integrations/glances"
+  | "/docs/integrations/gluetun"
   | "/docs/integrations/gotify"
   | "/docs/integrations/home-assistant"
   | "/docs/integrations/ical"
@@ -280,6 +282,7 @@ export type HomarrDocumentationPath =
   | "/docs/widgets/ups"
   | "/docs/widgets/uptime-kuma"
   | "/docs/widgets/video"
+  | "/docs/widgets/vpn"
   | "/docs/widgets/weather"
   | ""
   | "/sitemap.xml"
@@ -337,6 +340,7 @@ export type HomarrDocumentationPath =
   | "/docs/integrations/audiobookshelf"
   | "/docs/integrations/navidrome"
   | "/docs/integrations/umami"
+  | "/docs/integrations/gluetun"
   | "/docs/integrations/peanut"
   | "/docs/integrations/beszel"
   | "/docs/widgets/clock"
@@ -380,6 +384,7 @@ export type HomarrDocumentationPath =
   | "/docs/widgets/uptime-kuma"
   | "/docs/widgets/audio-stats"
   | "/docs/widgets/umami"
+  | "/docs/widgets/vpn"
   | "/docs/widgets/ups"
   | "/docs/widgets/beszel-system-table"
   | "/docs/widgets/beszel-system-grid"

packages/definitions/src/docs/integration-doc-slugs.ts

@@ -55,6 +55,7 @@ export const integrationDocSlugs: Record<IntegrationKind, string | null> = {
   audiobookshelf: "audiobookshelf",
   navidrome: "navidrome",
   umami: "umami",
+  gluetun: "gluetun",
   peaNut: "peanut",
   beszel: "beszel",
   archiveTeamWarrior: null,

packages/definitions/src/docs/widget-doc-slugs.ts

@@ -43,6 +43,7 @@ export const widgetDocSlugs: Record<WidgetKind, string | null> = {
   uptimeKuma: "uptime-kuma",
   audioStats: "audio-stats",
   umami: "umami",
+  vpn: "vpn",
   ups: "ups",
   archiveTeamWarrior: null,
   beszelSystemTable: "beszel-system-table",

packages/definitions/src/integration.ts

@@ -489,13 +489,20 @@ export const integrationDefs = {
     documentationUrl: createDocumentationLink("/docs/integrations/beszel"),
     defaultPort: 8090,
   },
+  gluetun: {
+    name: "Gluetun",
+    secretKinds: [["username", "password"], ["apiKey"], []],
+    iconUrl: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/gluetun.svg",
+    category: ["vpn"],
+    documentationUrl: createDocumentationLink("/docs/integrations/gluetun"),
+  },
   archiveTeamWarrior: {
     name: "ArchiveTeam Warrior",
     secretKinds: [[], ["username", "password"]],
     iconUrl: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/archiveteam-warrior.png",
     category: ["archiving"],
     defaultUrl: "http://localhost:8001",
-    documentationUrl: null,
+    documentationUrl: createDocumentationLink("/docs/integrations/archiveteam-warrior"),
   },
   // This integration only returns mock data, it is used during development (but can also be used in production by directly going to the create page)
   mock: {
@@ -604,6 +611,7 @@ export const integrationCategories = [
   "mediaMonitoring",
   "speedtest",
   "analytics",
+  "vpn",
   "archiving",
   "ups",
   "documents",

packages/definitions/src/widget-integration-map.ts

@@ -38,6 +38,7 @@ export const widgetIntegrationSupport: Partial<Record<WidgetKind, readonly Integ
   speedtestTracker: ["speedtestTracker"],
   uptimeKuma: ["uptimeKuma"],
   audioStats: ["navidrome", "audiobookshelf"],
+  vpn: getIntegrationKindsByCategory("vpn"),
   anchorNote: ["anchor"],
 };
 

packages/definitions/src/widget.ts

@@ -41,6 +41,7 @@ export const widgetKinds = [
   "uptimeKuma",
   "audioStats",
   "umami",
+  "vpn",
   "archiveTeamWarrior",
   "ups",
   "beszelSystemTable",

packages/docker/package.json

@@ -25,11 +25,15 @@
   "dependencies": {
     "@homarr/common": "workspace:^0.1.0",
     "@homarr/core": "workspace:^0.1.0",
-    "dockerode": "catalog:"
+    "@homarr/db": "workspace:^0.1.0",
+    "@homarr/definitions": "workspace:^0.1.0",
+    "dockerode": "catalog:",
+    "superjson": "catalog:"
   },
   "devDependencies": {
     "@homarr/tsconfig": "workspace:^0.1.0",
     "@types/dockerode": "catalog:",
-    "typescript": "catalog:"
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }

packages/docker/src/discovery/__tests__/parse-container-labels.spec.ts

@@ -0,0 +1,472 @@
+import type { ContainerInfo } from "dockerode";
+import { describe, expect, test } from "vitest";
+
+import { dockerLabels, homepageLabels } from "../../labels";
+import { parseContainerLabels } from "../parse-container-labels";
+
+const createContainer = (
+  labels: Record<string, string>,
+  id = "container-abc123",
+): Pick<ContainerInfo, "Id" | "Labels"> => ({
+  Id: id,
+  Labels: labels,
+});
+
+describe("parseContainerLabels", () => {
+  describe("homarr native labels", () => {
+    test("parses all homarr labels into DiscoveredService", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Jellyfin",
+          [dockerLabels.href]: "https://jellyfin.local",
+          [dockerLabels.icon]: "https://cdn.example/icon.png",
+          [dockerLabels.description]: "Media server",
+          [dockerLabels.ping]: "https://jellyfin.local/health",
+          [dockerLabels.id]: "jellyfin-1",
+          [dockerLabels.board]: "homelab",
+          [dockerLabels.integration]: "jellyfin",
+          [dockerLabels.widget]: "mediaServer",
+        }),
+        "socket",
+      );
+
+      expect(result).toEqual({
+        containerId: "container-abc123",
+        host: "socket",
+        group: "Media",
+        name: "Jellyfin",
+        href: "https://jellyfin.local",
+        icon: "https://cdn.example/icon.png",
+        description: "Media server",
+        pingUrl: "https://jellyfin.local/health",
+        externalId: "jellyfin-1",
+        boardName: "homelab",
+        integrationKind: "jellyfin",
+        widgetKind: "mediaServer",
+      });
+    });
+
+    test("parses minimal required homarr labels (name, group, href)", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Networking",
+          [dockerLabels.name]: "Pi-hole",
+          [dockerLabels.href]: "http://pihole:80/admin",
+        }),
+        "socket",
+      );
+
+      expect(result).toEqual({
+        containerId: "container-abc123",
+        host: "socket",
+        group: "Networking",
+        name: "Pi-hole",
+        href: "http://pihole:80/admin",
+        externalId: "container-abc123",
+      });
+    });
+
+    test("uses container ID as externalId when homarr.id is absent", () => {
+      const result = parseContainerLabels(
+        createContainer(
+          {
+            [dockerLabels.group]: "Media",
+            [dockerLabels.name]: "Plex",
+            [dockerLabels.href]: "http://plex:32400",
+          },
+          "sha256:deadbeef1234",
+        ),
+        "socket",
+      );
+
+      expect(result?.externalId).toBe("sha256:deadbeef1234");
+    });
+
+    test("uses homarr.id as externalId when present", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Plex",
+          [dockerLabels.href]: "http://plex:32400",
+          [dockerLabels.id]: "plex-server-main",
+        }),
+        "socket",
+      );
+
+      expect(result?.externalId).toBe("plex-server-main");
+    });
+  });
+
+  describe("homepage fallback labels", () => {
+    test("uses homepage labels when homarr.name is absent", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [homepageLabels.group]: "Downloads",
+          [homepageLabels.name]: "Sonarr",
+          [homepageLabels.href]: "https://sonarr.local",
+          [homepageLabels.icon]: "https://cdn.example/sonarr.png",
+          [homepageLabels.description]: "TV shows",
+        }),
+        "192.168.1.10:2375",
+      );
+
+      expect(result).toEqual({
+        containerId: "container-abc123",
+        host: "192.168.1.10:2375",
+        group: "Downloads",
+        name: "Sonarr",
+        href: "https://sonarr.local",
+        icon: "https://cdn.example/sonarr.png",
+        description: "TV shows",
+        externalId: "container-abc123",
+      });
+    });
+
+    test("does not use homepage fallback when readHomepageLabels is false", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [homepageLabels.group]: "Downloads",
+          [homepageLabels.name]: "Sonarr",
+          [homepageLabels.href]: "https://sonarr.local",
+        }),
+        "socket",
+        { readHomepageLabels: false },
+      );
+
+      expect(result).toBeNull();
+    });
+
+    test("homepage labels have no ping, board, integration, or widget support", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [homepageLabels.group]: "Media",
+          [homepageLabels.name]: "Emby",
+          [homepageLabels.href]: "http://emby:8096",
+        }),
+        "socket",
+      );
+
+      expect(result?.pingUrl).toBeUndefined();
+      expect(result?.boardName).toBeUndefined();
+      expect(result?.integrationKind).toBeUndefined();
+      expect(result?.widgetKind).toBeUndefined();
+    });
+  });
+
+  describe("label priority and mixing", () => {
+    test("prefers homarr labels over homepage when both are present", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Homarr Group",
+          [dockerLabels.name]: "Homarr Name",
+          [dockerLabels.href]: "https://homarr.local",
+          [homepageLabels.group]: "Homepage Group",
+          [homepageLabels.name]: "Homepage Name",
+          [homepageLabels.href]: "https://homepage.local",
+        }),
+        "socket",
+      );
+
+      expect(result?.group).toBe("Homarr Group");
+      expect(result?.name).toBe("Homarr Name");
+      expect(result?.href).toBe("https://homarr.local");
+    });
+
+    test("disables homepage fallback entirely when homarr.name is present", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.name]: "MyApp",
+          [dockerLabels.href]: "http://myapp:3000",
+          [homepageLabels.group]: "FromHomepage",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+
+    test("uses homarr icon with homepage name/group/href when homarr.name absent but homarr.icon present", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [homepageLabels.group]: "Media",
+          [homepageLabels.name]: "Jellyfin",
+          [homepageLabels.href]: "http://jellyfin:8096",
+          [dockerLabels.icon]: "https://custom-icon.example/jf.png",
+        }),
+        "socket",
+      );
+
+      expect(result?.name).toBe("Jellyfin");
+      expect(result?.icon).toBe("https://custom-icon.example/jf.png");
+    });
+  });
+
+  describe("homarr.hide", () => {
+    test("skips container when homarr.hide is present with value 'true'", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.hide]: "true",
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Hidden",
+          [dockerLabels.href]: "https://hidden.local",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+
+    test("skips container when homarr.hide is present with empty value", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.hide]: "",
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Hidden",
+          [dockerLabels.href]: "https://hidden.local",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+
+    test("skips container when homarr.hide is any string (key presence is enough)", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.hide]: "anything",
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Hidden",
+          [dockerLabels.href]: "https://hidden.local",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("missing required labels", () => {
+    test("returns null when group is missing", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.name]: "NoGroup",
+          [dockerLabels.href]: "https://nogroup.local",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+
+    test("returns null when name is missing", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.href]: "https://noname.local",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+
+    test("returns null when href is missing", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "NoHref",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+
+    test("returns null when homepage labels are incomplete (missing group)", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [homepageLabels.name]: "Incomplete",
+          [homepageLabels.href]: "http://incomplete.local",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("whitespace handling", () => {
+    test("trims whitespace from all label values", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "  Media  ",
+          [dockerLabels.name]: "  Jellyfin  ",
+          [dockerLabels.href]: "  https://jellyfin.local  ",
+          [dockerLabels.icon]: "  https://icon.png  ",
+          [dockerLabels.description]: "  A media server  ",
+        }),
+        "socket",
+      );
+
+      expect(result?.group).toBe("Media");
+      expect(result?.name).toBe("Jellyfin");
+      expect(result?.href).toBe("https://jellyfin.local");
+      expect(result?.icon).toBe("https://icon.png");
+      expect(result?.description).toBe("A media server");
+    });
+
+    test("treats whitespace-only values as empty (missing)", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "   ",
+          [dockerLabels.href]: "https://example.local",
+        }),
+        "socket",
+      );
+
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("integration and widget kind validation", () => {
+    test("parses valid integration kind", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Radarr",
+          [dockerLabels.href]: "http://radarr:7878",
+          [dockerLabels.integration]: "radarr",
+        }),
+        "socket",
+      );
+
+      expect(result?.integrationKind).toBe("radarr");
+    });
+
+    test("ignores invalid integration kind", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Custom App",
+          [dockerLabels.href]: "http://custom:3000",
+          [dockerLabels.integration]: "nonExistentIntegration",
+        }),
+        "socket",
+      );
+
+      expect(result?.integrationKind).toBeUndefined();
+    });
+
+    test("parses valid widget kind", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Jellyfin",
+          [dockerLabels.href]: "http://jellyfin:8096",
+          [dockerLabels.widget]: "mediaServer",
+        }),
+        "socket",
+      );
+
+      expect(result?.widgetKind).toBe("mediaServer");
+    });
+
+    test("ignores invalid widget kind", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "Custom",
+          [dockerLabels.href]: "http://custom:3000",
+          [dockerLabels.widget]: "totallyFakeWidget",
+        }),
+        "socket",
+      );
+
+      expect(result?.widgetKind).toBeUndefined();
+    });
+
+    test("handles empty integration kind gracefully", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Media",
+          [dockerLabels.name]: "App",
+          [dockerLabels.href]: "http://app:3000",
+          [dockerLabels.integration]: "",
+        }),
+        "socket",
+      );
+
+      expect(result?.integrationKind).toBeUndefined();
+    });
+  });
+
+  describe("real-world scenarios", () => {
+    test("homepage-only service (common migration use case)", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [homepageLabels.group]: "Monitoring",
+          [homepageLabels.name]: "Grafana",
+          [homepageLabels.href]: "http://grafana:3000",
+          [homepageLabels.icon]: "grafana",
+          [homepageLabels.description]: "Metrics and dashboards",
+        }),
+        "tcp://192.168.1.50:2375",
+      );
+
+      expect(result).toEqual({
+        containerId: "container-abc123",
+        host: "tcp://192.168.1.50:2375",
+        group: "Monitoring",
+        name: "Grafana",
+        href: "http://grafana:3000",
+        icon: "grafana",
+        description: "Metrics and dashboards",
+        externalId: "container-abc123",
+      });
+    });
+
+    test("service targeting a specific board", () => {
+      const result = parseContainerLabels(
+        createContainer({
+          [dockerLabels.group]: "Infrastructure",
+          [dockerLabels.name]: "Traefik",
+          [dockerLabels.href]: "http://traefik:8080",
+          [dockerLabels.board]: "networking-board",
+          [dockerLabels.icon]: "https://cdn.example/traefik.svg",
+        }),
+        "socket",
+      );
+
+      expect(result?.boardName).toBe("networking-board");
+    });
+
+    test("service with all optional fields empty uses defaults", () => {
+      const result = parseContainerLabels(
+        createContainer(
+          {
+            [dockerLabels.group]: "Tools",
+            [dockerLabels.name]: "Portainer",
+            [dockerLabels.href]: "http://portainer:9000",
+          },
+          "abc123def456",
+        ),
+        "socket",
+      );
+
+      expect(result?.icon).toBeUndefined();
+      expect(result?.description).toBeUndefined();
+      expect(result?.pingUrl).toBeUndefined();
+      expect(result?.boardName).toBeUndefined();
+      expect(result?.integrationKind).toBeUndefined();
+      expect(result?.widgetKind).toBeUndefined();
+      expect(result?.externalId).toBe("abc123def456");
+    });
+
+    test("container with no labels returns null", () => {
+      const result = parseContainerLabels(createContainer({}), "socket");
+      expect(result).toBeNull();
+    });
+  });
+});

packages/docker/src/discovery/index.ts

@@ -0,0 +1,8 @@
+export type { DiscoveredService } from "./types";
+export { parseContainerLabels, type ParseContainerLabelsOptions } from "./parse-container-labels";
+export { listDiscoveredContainersAsync } from "./list-discovered-containers";
+export {
+  syncDiscoveredServicesAsync,
+  type SyncDiscoveredServicesOptions,
+  type SyncDiscoveredServicesResult,
+} from "./sync-discovered-services";

packages/docker/src/discovery/list-discovered-containers.ts

@@ -0,0 +1,45 @@
+import { createLogger } from "@homarr/core/infrastructure/logs";
+import { ErrorWithMetadata } from "@homarr/core/infrastructure/logs/error";
+
+import { dockerLabels, homepageLabels } from "../labels";
+import { DockerSingleton } from "../singleton";
+import type { ParseContainerLabelsOptions } from "./parse-container-labels";
+import { parseContainerLabels } from "./parse-container-labels";
+import type { DiscoveredService } from "./types";
+
+const logger = createLogger({ module: "dockerDiscovery" });
+
+const hasDiscoveryLabels = (labels: Record<string, string>) =>
+  Object.values(dockerLabels).some((label) => label !== dockerLabels.hide && label in labels) ||
+  Object.values(homepageLabels).some((label) => label in labels);
+
+export const listDiscoveredContainersAsync = async (
+  options: ParseContainerLabelsOptions = {},
+): Promise<DiscoveredService[]> => {
+  const dockerInstances = DockerSingleton.getInstances();
+  const results = await Promise.allSettled(
+    dockerInstances.map(async ({ instance, host }) => {
+      const containers = await instance.listContainers({ all: true });
+      return containers
+        .filter((container) => hasDiscoveryLabels(container.Labels ?? {}))
+        .map((container) => parseContainerLabels(container, host, options))
+        .filter((service): service is DiscoveredService => service !== null);
+    }),
+  );
+
+  return results.flatMap((result, index) => {
+    if (result.status === "fulfilled") {
+      return result.value;
+    }
+
+    logger.warn(
+      new ErrorWithMetadata(
+        "Failed to list containers for discovery",
+        { host: dockerInstances[index]?.host },
+        { cause: result.reason },
+      ),
+    );
+
+    return [];
+  });
+};

packages/docker/src/discovery/parse-container-labels.ts

@@ -0,0 +1,116 @@
+import type { ContainerInfo } from "dockerode";
+
+import { integrationKinds, widgetKinds } from "@homarr/definitions";
+import type { IntegrationKind, WidgetKind } from "@homarr/definitions";
+
+import { dockerLabels, homepageLabels } from "../labels";
+import type { DiscoveredService } from "./types";
+
+export interface ParseContainerLabelsOptions {
+  readHomepageLabels?: boolean;
+}
+
+const homarrLabelKeys = {
+  group: dockerLabels.group,
+  name: dockerLabels.name,
+  href: dockerLabels.href,
+  icon: dockerLabels.icon,
+  description: dockerLabels.description,
+  ping: dockerLabels.ping,
+  id: dockerLabels.id,
+  board: dockerLabels.board,
+  integration: dockerLabels.integration,
+  widget: dockerLabels.widget,
+} as const;
+
+const homepageLabelKeys = {
+  group: homepageLabels.group,
+  name: homepageLabels.name,
+  href: homepageLabels.href,
+  icon: homepageLabels.icon,
+  description: homepageLabels.description,
+} as const;
+
+const integrationKindSet = new Set<string>(integrationKinds);
+const widgetKindSet = new Set<string>(widgetKinds);
+
+const readLabel = (labels: Record<string, string>, key: string) => {
+  const value = labels[key]?.trim();
+  if (!value) {
+    return undefined;
+  }
+  return value;
+};
+
+const resolveLabelValue = (
+  labels: Record<string, string>,
+  homarrKey: string,
+  homepageKey: string,
+  useHomepageFallback: boolean,
+) => readLabel(labels, homarrKey) ?? (useHomepageFallback ? readLabel(labels, homepageKey) : undefined);
+
+export const parseContainerLabels = (
+  container: Pick<ContainerInfo, "Id" | "Labels">,
+  host: string,
+  options: ParseContainerLabelsOptions = {},
+): DiscoveredService | null => {
+  const labels = container.Labels ?? {};
+
+  if (dockerLabels.hide in labels) {
+    return null;
+  }
+
+  const readHomepageLabels = options.readHomepageLabels ?? true;
+  const hasHomarrName = Boolean(readLabel(labels, dockerLabels.name));
+  const useHomepageFallback = readHomepageLabels && !hasHomarrName;
+
+  const name = resolveLabelValue(labels, homarrLabelKeys.name, homepageLabelKeys.name, useHomepageFallback);
+  const href = resolveLabelValue(labels, homarrLabelKeys.href, homepageLabelKeys.href, useHomepageFallback);
+  const group = resolveLabelValue(labels, homarrLabelKeys.group, homepageLabelKeys.group, useHomepageFallback);
+
+  if (!name || !href || !group) {
+    return null;
+  }
+
+  const icon =
+    readLabel(labels, homarrLabelKeys.icon) ??
+    (useHomepageFallback ? readLabel(labels, homepageLabelKeys.icon) : undefined);
+  const description =
+    readLabel(labels, homarrLabelKeys.description) ??
+    (useHomepageFallback ? readLabel(labels, homepageLabelKeys.description) : undefined);
+  const pingUrl = readLabel(labels, homarrLabelKeys.ping);
+  const boardName = readLabel(labels, homarrLabelKeys.board);
+  const externalId = readLabel(labels, homarrLabelKeys.id) ?? container.Id;
+
+  const integrationKind = parseIntegrationKind(readLabel(labels, homarrLabelKeys.integration));
+  const widgetKind = parseWidgetKind(readLabel(labels, homarrLabelKeys.widget));
+
+  return {
+    containerId: container.Id,
+    host,
+    group,
+    name,
+    href,
+    icon,
+    description,
+    pingUrl,
+    externalId,
+    boardName,
+    integrationKind,
+    widgetKind,
+  };
+};
+
+const parseIntegrationKind = (value: string | undefined): IntegrationKind | undefined => {
+  if (!value || !integrationKindSet.has(value)) {
+    return undefined;
+  }
+  return value as IntegrationKind;
+};
+
+const parseWidgetKind = (value: string | undefined): WidgetKind | undefined => {
+  if (!value || !widgetKindSet.has(value)) {
+    return undefined;
+  }
+  return value as WidgetKind;
+};

packages/docker/src/discovery/sync-discovered-services.ts

@@ -0,0 +1,471 @@
+import SuperJSON from "superjson";
+
+import { createId } from "@homarr/common";
+import { createLogger } from "@homarr/core/infrastructure/logs";
+import { emptySuperJSON } from "@homarr/definitions";
+import type { InferInsertModel, InferSelectModel } from "@homarr/db";
+import { and, asc, db, eq, handleTransactionsAsync } from "@homarr/db";
+import { createDbInsertCollectionForTransaction } from "@homarr/db/collection";
+import { apps, boards, dockerAppSources, itemLayouts, items, layouts, sections } from "@homarr/db/schema";
+
+import type { DiscoveredService } from "./types";
+
+const logger = createLogger({ module: "dockerDiscoverySync" });
+
+export interface SyncDiscoveredServicesOptions {
+  targetBoardName?: string | null;
+  enableStatusByDefault?: boolean;
+  forceDisableStatus?: boolean;
+  defaultItemWidth?: number;
+  defaultItemHeight?: number;
+}
+
+export interface SyncDiscoveredServicesResult {
+  created: number;
+  updated: number;
+  skipped: number;
+}
+
+interface SyncMetadata {
+  appId: string;
+  itemId?: string;
+}
+
+interface AppItemOptions {
+  appId: string;
+  openInNewTab: boolean;
+  showTitle: boolean;
+  descriptionDisplayMode: "hidden";
+  layout: "column";
+  pingEnabled: boolean;
+}
+
+type AppRow = InferSelectModel<typeof apps>;
+
+type BoardWithRelations = NonNullable<Awaited<ReturnType<typeof loadBoardsWithRelationsAsync>>>[number];
+
+type BoardItem = BoardWithRelations["items"][number];
+
+const createSyncKey = (service: DiscoveredService) => `${service.host}/${service.containerId}`;
+
+const appsMatchByHref = (app: Pick<AppRow, "href">, href: string) => app.href === href;
+
+export const syncDiscoveredServicesAsync = async (
+  discoveredServices: DiscoveredService[],
+  options: SyncDiscoveredServicesOptions = {},
+): Promise<SyncDiscoveredServicesResult> => {
+  const itemWidth = options.defaultItemWidth ?? 1;
+  const itemHeight = options.defaultItemHeight ?? 1;
+  const result: SyncDiscoveredServicesResult = { created: 0, updated: 0, skipped: 0 };
+  const syncMetadata = new Map<string, SyncMetadata>();
+  const existingApps = await db.query.apps.findMany();
+  const existingSources = await db.query.dockerAppSources.findMany();
+  const boardList = await loadBoardsWithRelationsAsync();
+
+  const appsToInsert: InferInsertModel<typeof apps>[] = [];
+  const appsToUpdate: { id: string; values: Partial<InferInsertModel<typeof apps>> }[] = [];
+  const sectionsToInsert: InferInsertModel<typeof sections>[] = [];
+  const itemsToInsert: InferInsertModel<typeof items>[] = [];
+  const itemLayoutsToInsert: InferInsertModel<typeof itemLayouts>[] = [];
+
+  const pendingSectionsByBoard = new Map<string, InferInsertModel<typeof sections>[]>();
+  const sectionYOffsetByBoard = new Map<string, number>();
+  const itemYOffsetBySection = new Map<string, number>();
+  const pendingItemLayouts: InferInsertModel<typeof itemLayouts>[] = [];
+
+  for (const service of discoveredServices) {
+    const syncKey = createSyncKey(service);
+
+    if (syncMetadata.has(syncKey)) {
+      result.skipped += 1;
+      continue;
+    }
+
+    const board = resolveTargetBoard(boardList, service, options.targetBoardName);
+    if (!board) {
+      logger.warn("No target board found for discovered service", { syncKey, boardName: service.boardName });
+      result.skipped += 1;
+      continue;
+    }
+
+    const firstLayout = getFirstLayout(board.layouts);
+    if (!firstLayout) {
+      logger.warn("Board has no layouts for discovered service", { boardId: board.id, syncKey });
+      result.skipped += 1;
+      continue;
+    }
+
+    const existingSource = existingSources.find(
+      (source) => source.host === service.host && source.externalId === service.externalId,
+    );
+    const existingApp = existingSource
+      ? existingApps.find((app) => app.id === existingSource.appId)
+      : existingApps.find((app) => appsMatchByHref(app, service.href));
+    let appId: string;
+    let wasCreated = false;
+    let wasUpdated = false;
+
+    if (existingApp) {
+      appId = existingApp.id;
+      const updateValues = buildAppUpdateValues(service, existingApp);
+      if (updateValues) {
+        appsToUpdate.push({ id: appId, values: updateValues });
+        wasUpdated = true;
+        Object.assign(existingApp, updateValues);
+      }
+    } else {
+      appId = createId();
+      const newApp = buildAppInsert(service, appId);
+      appsToInsert.push(newApp);
+      existingApps.push(newApp as AppRow);
+      wasCreated = true;
+    }
+
+    const categorySection = findOrCreateCategorySection(
+      board,
+      service.group,
+      sectionsToInsert,
+      pendingSectionsByBoard,
+      sectionYOffsetByBoard,
+    );
+
+    const existingItem = findAppItemForApp(board.items, itemsToInsert, pendingItemLayouts, appId, categorySection.id);
+
+    if (!existingItem) {
+      const newItemId = createId();
+
+      const newItemLayouts = board.layouts.map((layout) => ({
+        itemId: newItemId,
+        sectionId: categorySection.id,
+        layoutId: layout.id,
+        xOffset: 0,
+        yOffset: getNextItemYOffset(
+          board,
+          categorySection.id,
+          layout.id,
+          itemYOffsetBySection,
+          pendingItemLayouts,
+          itemHeight,
+        ),
+        width: itemWidth,
+        height: itemHeight,
+      }));
+
+      itemsToInsert.push({
+        id: newItemId,
+        boardId: board.id,
+        kind: "app",
+        options: SuperJSON.stringify(buildAppItemOptions(appId, service, options)),
+        advancedOptions: SuperJSON.stringify({
+          title: null,
+          customCssClasses: [],
+          borderColor: "",
+        }),
+      });
+
+      itemLayoutsToInsert.push(...newItemLayouts);
+      pendingItemLayouts.push(...newItemLayouts);
+      syncMetadata.set(syncKey, { appId, itemId: newItemId });
+      wasCreated = true;
+    } else {
+      syncMetadata.set(syncKey, { appId, itemId: existingItem.id });
+    }
+
+    if (wasCreated) {
+      result.created += 1;
+    } else if (wasUpdated) {
+      result.updated += 1;
+    } else {
+      result.skipped += 1;
+    }
+  }
+
+  const sourcesToUpsert: InferInsertModel<typeof dockerAppSources>[] = [];
+  for (const [syncKey, meta] of syncMetadata.entries()) {
+    const service = discoveredServices.find((svc) => createSyncKey(svc) === syncKey);
+    if (!service) continue;
+
+    const board = resolveTargetBoard(boardList, service, options.targetBoardName);
+    if (!board) continue;
+
+    sourcesToUpsert.push({
+      host: service.host,
+      containerId: service.containerId,
+      externalId: service.externalId,
+      appId: meta.appId,
+      boardId: board.id,
+      itemId: meta.itemId ?? null,
+    });
+  }
+
+  if (
+    appsToInsert.length === 0 &&
+    appsToUpdate.length === 0 &&
+    sectionsToInsert.length === 0 &&
+    itemsToInsert.length === 0 &&
+    sourcesToUpsert.length === 0
+  ) {
+    return result;
+  }
+
+  const insertCollection = createDbInsertCollectionForTransaction(["apps", "sections", "items", "itemLayouts"]);
+  insertCollection.apps.push(...appsToInsert);
+  insertCollection.sections.push(...sectionsToInsert);
+  insertCollection.items.push(...itemsToInsert);
+  insertCollection.itemLayouts.push(...itemLayoutsToInsert);
+
+  await handleTransactionsAsync(db, {
+    async handleAsync(innerDb) {
+      for (const { id, values } of appsToUpdate) {
+        await innerDb
+          .update(apps as never)
+          .set(values)
+          .where(eq(apps.id, id));
+      }
+      await insertCollection.insertAllAsync(innerDb);
+      const table = dockerAppSources as never;
+      for (const source of sourcesToUpsert) {
+        const existing = await innerDb.query.dockerAppSources.findFirst({
+          where: and(eq(dockerAppSources.host, source.host), eq(dockerAppSources.containerId, source.containerId)),
+        });
+        if (existing) {
+          await innerDb
+            .update(table)
+            .set({
+              appId: source.appId,
+              boardId: source.boardId,
+              itemId: source.itemId,
+              externalId: source.externalId,
+              updatedAt: new Date(),
+            })
+            .where(and(eq(dockerAppSources.host, source.host), eq(dockerAppSources.containerId, source.containerId)));
+        } else {
+          await innerDb.insert(table).values(source as never);
+        }
+      }
+    },
+    handleSync(innerDb) {
+      for (const { id, values } of appsToUpdate) {
+        innerDb
+          .update(apps as never)
+          .set(values)
+          .where(eq(apps.id, id))
+          .run();
+      }
+      insertCollection.insertAll(innerDb);
+      for (const source of sourcesToUpsert) {
+        try {
+          innerDb.insert(dockerAppSources).values(source).run();
+        } catch {
+          innerDb
+            .update(dockerAppSources)
+            .set({
+              appId: source.appId,
+              boardId: source.boardId,
+              itemId: source.itemId,
+              externalId: source.externalId,
+              updatedAt: new Date(),
+            })
+            .where(and(eq(dockerAppSources.host, source.host), eq(dockerAppSources.containerId, source.containerId)))
+            .run();
+        }
+      }
+    },
+  });
+
+  return result;
+};
+
+const loadBoardsWithRelationsAsync = async () =>
+  db.query.boards.findMany({
+    orderBy: asc(boards.name),
+    with: {
+      layouts: true,
+      sections: true,
+      items: {
+        with: {
+          layouts: true,
+        },
+      },
+    },
+  });
+
+const resolveTargetBoard = (
+  boardList: BoardWithRelations[],
+  service: DiscoveredService,
+  defaultBoardName: string | null | undefined,
+) => {
+  const boardName = service.boardName ?? defaultBoardName ?? undefined;
+  if (boardName) {
+    return boardList.find((board) => board.name === boardName) ?? boardList.at(0);
+  }
+  return boardList.at(0);
+};
+
+const getFirstLayout = (boardLayouts: InferSelectModel<typeof layouts>[]) =>
+  [...boardLayouts].sort((layoutA, layoutB) => layoutA.breakpoint - layoutB.breakpoint).at(0);
+
+const buildAppInsert = (service: DiscoveredService, appId: string): InferInsertModel<typeof apps> => ({
+  id: appId,
+  name: service.name,
+  description: service.description ?? null,
+  iconUrl: service.icon ?? "",
+  href: service.href,
+  pingUrl: service.pingUrl ?? null,
+});
+
+const buildAppUpdateValues = (
+  service: DiscoveredService,
+  existingApp: AppRow,
+): Partial<InferInsertModel<typeof apps>> | null => {
+  const values: Partial<InferInsertModel<typeof apps>> = {};
+
+  if (existingApp.name !== service.name) {
+    values.name = service.name;
+  }
+  if (existingApp.href !== service.href) {
+    values.href = service.href;
+  }
+  if (service.icon !== undefined && existingApp.iconUrl !== service.icon) {
+    values.iconUrl = service.icon;
+  }
+  if (service.description !== undefined && existingApp.description !== service.description) {
+    values.description = service.description;
+  }
+  if (service.pingUrl !== undefined && existingApp.pingUrl !== service.pingUrl) {
+    values.pingUrl = service.pingUrl;
+  }
+
+  return Object.keys(values).length > 0 ? values : null;
+};
+
+const buildAppItemOptions = (
+  appId: string,
+  service: DiscoveredService,
+  options: SyncDiscoveredServicesOptions,
+): AppItemOptions => ({
+  appId,
+  openInNewTab: true,
+  showTitle: true,
+  descriptionDisplayMode: "hidden",
+  layout: "column",
+  pingEnabled:
+    !(options.forceDisableStatus ?? false) && (Boolean(service.pingUrl) || (options.enableStatusByDefault ?? true)),
+});
+
+const findOrCreateCategorySection = (
+  board: BoardWithRelations,
+  groupName: string,
+  sectionsToInsert: InferInsertModel<typeof sections>[],
+  pendingSectionsByBoard: Map<string, InferInsertModel<typeof sections>[]>,
+  sectionYOffsetByBoard: Map<string, number>,
+): InferInsertModel<typeof sections> & { id: string } => {
+  const pendingForBoard = pendingSectionsByBoard.get(board.id) ?? [];
+  const pendingMatch = pendingForBoard.find((section) => section.kind === "category" && section.name === groupName);
+  if (pendingMatch) {
+    return pendingMatch as InferInsertModel<typeof sections> & { id: string };
+  }
+
+  const existingSection = board.sections.find((section) => section.kind === "category" && section.name === groupName);
+  if (existingSection) {
+    return existingSection;
+  }
+
+  const categorySections = board.sections.filter((section) => section.kind === "category");
+  const pendingCategorySections = pendingForBoard.filter((section) => section.kind === "category");
+  const maxYOffset = Math.max(
+    0,
+    ...categorySections.map((section) => section.yOffset ?? 0),
+    ...pendingCategorySections.map((section) => section.yOffset ?? 0),
+    sectionYOffsetByBoard.get(board.id) ?? 0,
+  );
+  const yOffset = maxYOffset + 1;
+  sectionYOffsetByBoard.set(board.id, yOffset);
+
+  const newSection: InferInsertModel<typeof sections> = {
+    id: createId(),
+    boardId: board.id,
+    kind: "category",
+    xOffset: 0,
+    yOffset,
+    name: groupName,
+    options: emptySuperJSON,
+  };
+
+  sectionsToInsert.push(newSection);
+  board.sections.push(newSection as BoardWithRelations["sections"][number]);
+  pendingSectionsByBoard.set(board.id, [...pendingForBoard, newSection]);
+
+  return newSection as InferInsertModel<typeof sections> & { id: string };
+};
+
+const findAppItemForApp = (
+  boardItems: BoardItem[],
+  pendingItems: InferInsertModel<typeof items>[],
+  pendingLayouts: InferInsertModel<typeof itemLayouts>[],
+  appId: string,
+  sectionId: string,
+) => {
+  const dbMatch = boardItems.find((item) => itemMatchesAppInSection(item, appId, sectionId));
+  if (dbMatch) {
+    return dbMatch;
+  }
+
+  const pendingMatch = pendingItems.find((item) => {
+    if (item.kind !== "app") {
+      return false;
+    }
+    const itemOptions = SuperJSON.parse<AppItemOptions>(item.options ?? emptySuperJSON);
+    if (itemOptions.appId !== appId) {
+      return false;
+    }
+    return pendingLayouts.some((layout) => layout.itemId === item.id && layout.sectionId === sectionId);
+  });
+
+  return pendingMatch ? { id: pendingMatch.id } : undefined;
+};
+
+const itemMatchesAppInSection = (item: BoardItem, appId: string, sectionId: string) => {
+  if (item.kind !== "app") {
+    return false;
+  }
+
+  const itemOptions = SuperJSON.parse<AppItemOptions>(item.options);
+  if (itemOptions.appId !== appId) {
+    return false;
+  }
+
+  return item.layouts.some((layout) => layout.sectionId === sectionId);
+};
+
+const getNextItemYOffset = (
+  board: BoardWithRelations,
+  sectionId: string,
+  layoutId: string,
+  itemYOffsetBySection: Map<string, number>,
+  pendingLayouts: InferInsertModel<typeof itemLayouts>[],
+  itemHeight: number,
+) => {
+  const sectionKey = `${board.id}/${sectionId}/${layoutId}`;
+  const trackedYOffset = itemYOffsetBySection.get(sectionKey);
+  if (trackedYOffset !== undefined) {
+    const nextYOffset = trackedYOffset + itemHeight;
+    itemYOffsetBySection.set(sectionKey, nextYOffset);
+    return trackedYOffset;
+  }
+
+  const dbLayouts = board.items.flatMap((item) =>
+    item.layouts.filter((layout) => layout.sectionId === sectionId && layout.layoutId === layoutId),
+  );
+  const pendingSectionLayouts = pendingLayouts.filter(
+    (layout) => layout.sectionId === sectionId && layout.layoutId === layoutId,
+  );
+
+  const maxYOffset = [...dbLayouts, ...pendingSectionLayouts].reduce(
+    (max, layout) => Math.max(max, layout.yOffset + layout.height),
+    0,
+  );
+
+  itemYOffsetBySection.set(sectionKey, maxYOffset + itemHeight);
+  return maxYOffset;
+};

packages/docker/src/discovery/types.ts

@@ -0,0 +1,16 @@
+import type { IntegrationKind, WidgetKind } from "@homarr/definitions";
+
+export interface DiscoveredService {
+  containerId: string;
+  host: string;
+  group: string;
+  name: string;
+  href: string;
+  icon?: string;
+  description?: string;
+  pingUrl?: string;
+  externalId: string;
+  boardName?: string;
+  integrationKind?: IntegrationKind;
+  widgetKind?: WidgetKind;
+}

packages/docker/src/index.ts

@@ -9,3 +9,4 @@ export const containerStates = ["created", "running", "paused", "restarting", "e
 
 export type ContainerState = (typeof containerStates)[number];
 export * from "./labels";
+export * from "./discovery";

packages/docker/src/labels.ts

@@ -1,4 +1,21 @@
 export const dockerLabels = {
-  // Label to hide a container from Homarrs docker integration
   hide: "homarr.hide",
+  group: "homarr.group",
+  name: "homarr.name",
+  href: "homarr.href",
+  icon: "homarr.icon",
+  description: "homarr.description",
+  ping: "homarr.ping",
+  id: "homarr.id",
+  board: "homarr.board",
+  integration: "homarr.integration",
+  widget: "homarr.widget",
+} as const;
+
+export const homepageLabels = {
+  group: "homepage.group",
+  name: "homepage.name",
+  href: "homepage.href",
+  icon: "homepage.icon",
+  description: "homepage.description",
 } as const;

packages/forms-collection/src/icon-picker/icon-picker.tsx

@@ -1,8 +1,11 @@
+"use client";
+
 import type { FocusEventHandler } from "react";
-import { startTransition } from "react";
+import { startTransition, useEffect, useState } from "react";
 import {
   ActionIcon,
   Box,
+  Button,
   Card,
   Combobox,
   Flex,
@@ -18,7 +21,7 @@ import {
   useCombobox,
 } from "@mantine/core";
 import { useDebouncedValue, useUncontrolled } from "@mantine/hooks";
-import { IconUpload } from "@tabler/icons-react";
+import { IconMoodEmpty, IconSearchOff, IconUpload } from "@tabler/icons-react";
 
 import { clientApi } from "@homarr/api/client";
 import { useSession } from "@homarr/auth/client";
@@ -34,7 +37,6 @@ interface IconPickerProps {
   error?: string | null;
   onFocus?: FocusEventHandler;
   onBlur?: FocusEventHandler;
-
   label?: string;
   placeholder?: string;
   withAsterisk?: boolean;
@@ -50,29 +52,30 @@ export const IconPicker = ({
   label,
   placeholder,
 }: IconPickerProps) => {
-  const [value, setValue] = useUncontrolled({
-    value: propsValue,
-    onChange,
-  });
-  const [search, setSearch] = useUncontrolled({
-    value,
-    onChange: (value) => {
-      setValue(value);
-    },
-  });
-  const [previewUrl, setPreviewUrl] = useUncontrolled({
-    value: propsValue ?? null,
-  });
+  const [value, setValue] = useUncontrolled({ value: propsValue, onChange });
+  const [query, setQuery] = useState("");
+
+  // ponytail: reset the typed query when the committed value changes
+  // externally (form reset, parent re-render) so the input reverts to the URL.
+  useEffect(() => {
+    setQuery("");
+  }, [value]);
+
   const { data: session } = useSession();
-
   const tCommon = useScopedI18n("common");
+  const [debouncedQuery] = useDebouncedValue(query, 100);
 
-  const [debouncedSearch] = useDebouncedValue(search, 100);
+  // ponytail: only search when the typed query differs from the committed
+  // value. On mount the input shows the existing URL (edit mode), which
+  // would never match the bare filenames in the icon table.
+  const searchText = (debouncedQuery !== (value ?? "") && debouncedQuery) || "";
 
-  // We use not useSuspenseQuery as it would cause an above Suspense boundary to trigger and so searching for something is bad UX.
-  const { data } = clientApi.icon.findIcons.useQuery({
-    searchText: debouncedSearch,
-  });
+  // ponytail: not useSuspenseQuery — an above Suspense boundary would
+  // trigger on every keystroke and the dropdown flash is bad UX.
+  const { data, isLoading, isError, refetch } = clientApi.icon.findIcons.useQuery(
+    { searchText },
+    { placeholderData: (prev) => prev },
+  );
 
   const combobox = useCombobox({
     onDropdownClose: () => combobox.resetSelectedOption(),
@@ -90,25 +93,15 @@ export const IconPicker = ({
       >
         <UnstyledButton
           onClick={() => {
-            const value = item.url;
             startTransition(() => {
-              setPreviewUrl(value);
-              setSearch(value);
-              setValue(value);
+              setValue(item.url);
+              setQuery("");
               combobox.closeDropdown();
             });
           }}
         >
           <Indicator label="SVG" disabled={!item.url.endsWith(".svg")} size={16}>
-            <Card
-              p="sm"
-              pos="relative"
-              style={{
-                overflow: "visible",
-                cursor: "pointer",
-              }}
-              className={classes.iconCard}
-            >
+            <Card p="sm" pos="relative" style={{ overflow: "visible", cursor: "pointer" }} className={classes.iconCard}>
               <Box w={25} h={25}>
                 <Image src={item.url} w={25} h={25} />
               </Box>
@@ -130,6 +123,48 @@ export const IconPicker = ({
     );
   });
 
+  // ponytail: show the typed query if non-empty, else fall back to the URL.
+  const inputValue = query || value || "";
+  // ponytail: show the existing icon as a left-section preview.
+  const leftSection = shouldShowPreview(value) && <img src={value} alt="" style={{ width: 20, height: 20 }} />;
+  // ponytail: prop override -> real count -> loading text.
+  const placeholderText =
+    placeholder ||
+    (data && tCommon("iconPicker.header", { countIcons: String(data.countIcons) })) ||
+    tCommon("iconPicker.headerLoading");
+
+  const renderDropdown = () => {
+    if (isError) {
+      return (
+        <Stack align="center" gap="xs" p="md">
+          <IconSearchOff size={32} stroke={1.5} />
+          <Text size="sm">{tCommon("iconPicker.error")}</Text>
+          <Button size="xs" variant="default" onClick={() => refetch()}>
+            {tCommon("action.tryAgain")}
+          </Button>
+        </Stack>
+      );
+    }
+    if (isLoading) {
+      return Array(15)
+        .fill(0)
+        .map((_, index) => (
+          <Combobox.Option value={`skeleton-${index}`} key={index} disabled>
+            <Skeleton height={25} visible />
+          </Combobox.Option>
+        ));
+    }
+    if (totalOptions > 0) {
+      return <Stack gap={4}>{groups}</Stack>;
+    }
+    return (
+      <Stack align="center" gap="xs" p="md">
+        <IconMoodEmpty size={32} stroke={1.5} />
+        <Text size="sm">{tCommon("iconPicker.noResults", { search: debouncedQuery })}</Text>
+      </Stack>
+    );
+  };
+
   return (
     <Combobox store={combobox} withinPortal>
       <Combobox.Target>
@@ -137,16 +172,11 @@ export const IconPicker = ({
           <InputBase
             flex={1}
             rightSection={<Combobox.Chevron />}
-            leftSection={
-              shouldShowPreview(previewUrl) ? <img src={previewUrl} alt="" style={{ width: 20, height: 20 }} /> : null
-            }
-            value={search}
+            leftSection={leftSection}
+            value={inputValue}
             onChange={(event) => {
               combobox.openDropdown();
-              combobox.updateSelectedOptionIndex();
-              setSearch(event.currentTarget.value);
-              setValue(event.currentTarget.value);
-              setPreviewUrl(null);
+              setQuery(event.currentTarget.value);
             }}
             onClick={() => combobox.openDropdown()}
             onFocus={(event) => {
@@ -156,25 +186,21 @@ export const IconPicker = ({
             onBlur={(event) => {
               onBlur?.(event);
               combobox.closeDropdown();
-              setPreviewUrl(value);
-              setSearch(value || "");
+              setQuery("");
             }}
             rightSectionPointerEvents="none"
             withAsterisk={withAsterisk}
             error={error}
             label={label ?? tCommon("iconPicker.label")}
-            placeholder={placeholder ?? tCommon("iconPicker.header", { countIcons: String(data?.countIcons ?? 0) })}
+            placeholder={placeholderText}
           />
           {session?.user.permissions.includes("media-upload") && (
             <UploadMedia
               onSuccess={(medias) => {
                 const first = medias.at(0);
                 if (!first) return;
-
                 startTransition(() => {
                   setValue(first.url);
-                  setPreviewUrl(first.url);
-                  setSearch(first.url);
                 });
               }}
             >
@@ -190,17 +216,7 @@ export const IconPicker = ({
 
       <Combobox.Dropdown>
         <Combobox.Options mah={350} style={{ overflowY: "auto" }}>
-          {totalOptions > 0 ? (
-            <Stack gap={4}>{groups}</Stack>
-          ) : (
-            Array(15)
-              .fill(0)
-              .map((_, index: number) => (
-                <Combobox.Option value={`skeleton-${index}`} key={index} disabled>
-                  <Skeleton height={25} visible />
-                </Combobox.Option>
-              ))
-          )}
+          {renderDropdown()}
         </Combobox.Options>
       </Combobox.Dropdown>
     </Combobox>
@@ -209,8 +225,8 @@ export const IconPicker = ({
 
 // This regex is used to prevent loading a preview like en or /en which would trigger a language change
 // See https://github.com/homarr-labs/homarr/issues/3070
-const localizationPathRegex = new RegExp(`^/?(${supportedLanguages.join("|")})(/.*)?$`, "i" /* ignore casing */);
-const shouldShowPreview = (value: string | null): value is string => {
+const localizationPathRegex = new RegExp(`^/?(${supportedLanguages.join("|")})(/.*)?$`, "i");
+const shouldShowPreview = (value: string | null | undefined): value is string => {
   if (!value) return false;
   return !localizationPathRegex.test(value);
 };

packages/integrations/src/base/creator.ts

@@ -21,6 +21,7 @@ import { GitHubContainerRegistryIntegration } from "../github-container-registry
 import { GithubIntegration } from "../github/github-integration";
 import { GitlabIntegration } from "../gitlab/gitlab-integration";
 import { GlancesIntegration } from "../glances/glances-integration";
+import { GluetunIntegration } from "../gluetun/gluetun-integration";
 import { HomeAssistantIntegration } from "../homeassistant/homeassistant-integration";
 import { ICalIntegration } from "../ical/ical-integration";
 import { ImmichIntegration } from "../immich/immich-integration";
@@ -137,6 +138,7 @@ export const integrationCreators = {
   audiobookshelf: AudiobookshelfIntegration,
   navidrome: NavidromeIntegration,
   umami: UmamiIntegration,
+  gluetun: GluetunIntegration,
   archiveTeamWarrior: ArchiveTeamWarriorIntegration,
   uptimeKuma: UptimeKumaIntegration,
   peaNut: PeaNutIntegration,

packages/integrations/src/beszel/beszel-integration.ts

@@ -46,10 +46,13 @@ export class BeszelIntegration extends Integration {
   private async authenticateAsync(): Promise<BeszelSession> {
     const existingSession = await this.sessionStore.getAsync();
     if (existingSession) {
+      logger.debug("Using stored Beszel session", { integrationId: this.integration.id });
       return existingSession;
     }
 
-    const response = await fetchWithTrustedCertificatesAsync(this.url("/api/collections/users/auth-with-password"), {
+    const authUrl = this.url("/api/collections/users/auth-with-password");
+    logger.debug("Authenticating with Beszel", { integrationId: this.integration.id, url: authUrl.pathname });
+    const response = await fetchWithTrustedCertificatesAsync(authUrl, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
@@ -57,23 +60,28 @@ export class BeszelIntegration extends Integration {
         password: this.getSecretValue("password"),
       }),
     });
+    logger.debug("Beszel auth response received", { integrationId: this.integration.id, status: response.status });
 
     if (!response.ok) {
+      logger.warn("Beszel auth failed", { integrationId: this.integration.id, status: response.status });
       throw new ResponseError(response);
     }
 
     const data = (await response.json()) as BeszelAuthResponse;
     const session: BeszelSession = { token: data.token, userId: data.record.id };
     await this.sessionStore.setAsync(session);
+    logger.debug("Saved Beszel session", { integrationId: this.integration.id, userId: session.userId });
     return session;
   }
 
   private async fetchWithAuthAsync(url: URL, options: { method?: string; body?: string } = {}) {
+    const method = options.method ?? "GET";
+    const start = performance.now();
     let session = await this.authenticateAsync();
 
     const doFetch = (token: string) =>
       fetchWithTrustedCertificatesAsync(url, {
-        method: options.method ?? "GET",
+        method,
         headers: {
           Authorization: token,
           ...(options.body ? { "Content-Type": "application/json" } : {}),
@@ -82,14 +90,42 @@ export class BeszelIntegration extends Integration {
       });
 
     let response = await doFetch(session.token);
+    logger.debug("Beszel response", {
+      integrationId: this.integration.id,
+      method,
+      path: url.pathname,
+      status: response.status,
+      durationMs: Math.round(performance.now() - start),
+      attempt: 1,
+    });
 
     if (response.status === 401) {
+      logger.warn("Beszel 401, clearing session and retrying", {
+        integrationId: this.integration.id,
+        method,
+        path: url.pathname,
+      });
       await this.sessionStore.clearAsync();
       session = await this.authenticateAsync();
       response = await doFetch(session.token);
+      logger.debug("Beszel response (after re-auth)", {
+        integrationId: this.integration.id,
+        method,
+        path: url.pathname,
+        status: response.status,
+        durationMs: Math.round(performance.now() - start),
+        attempt: 2,
+      });
     }
 
     if (!response.ok) {
+      logger.warn("Beszel request failed", {
+        integrationId: this.integration.id,
+        method,
+        path: url.pathname,
+        status: response.status,
+        durationMs: Math.round(performance.now() - start),
+      });
       throw new ResponseError(response);
     }
 
@@ -257,6 +293,7 @@ export class BeszelIntegration extends Integration {
   ): Promise<void> {
     const session = await this.authenticateAsync();
     const sseUrl = this.url("/api/realtime");
+    logger.debug("Opening Beszel SSE connection", { integrationId: this.integration.id, systemId });
 
     const sseResponse = await fetchWithTrustedCertificatesAsync(sseUrl, {
       headers: { Authorization: session.token },
@@ -264,8 +301,14 @@ export class BeszelIntegration extends Integration {
     });
 
     if (!sseResponse.ok || !sseResponse.body) {
+      logger.warn("Beszel SSE connection failed", {
+        integrationId: this.integration.id,
+        systemId,
+        status: sseResponse.status,
+      });
       throw new ResponseError(sseResponse);
     }
+    logger.debug("Beszel SSE connection opened", { integrationId: this.integration.id, systemId });
 
     const reader = sseResponse.body.getReader();
     const decoder = new TextDecoder();
@@ -322,6 +365,10 @@ export class BeszelIntegration extends Integration {
         }
       }
       if (!signal.aborted) {
+        logger.warn("Beszel SSE stream ended unexpectedly", {
+          integrationId: this.integration.id,
+          systemId,
+        });
         throw new Error("Beszel SSE stream ended unexpectedly");
       }
     } finally {

packages/integrations/src/glances/glances-integration.ts

@@ -35,7 +35,7 @@ export class GlancesIntegration extends Integration implements ISystemHealthMoni
 
     if (session == null) throw new Error("Session was unexpectitly null");
 
-    const stats = await this.getAllStatsAsync();
+    const [stats, cpuTemp] = await Promise.all([this.getAllStatsAsync(), this.getCpuTempAsync()]);
 
     return {
       cpuUtilization: stats.cpu.total,
@@ -58,7 +58,7 @@ export class GlancesIntegration extends Integration implements ISystemHealthMoni
       cpuModelName: stats.quicklook?.cpu_name ?? "Unknown",
       loadAverage: null,
       smart: [],
-      cpuTemp: undefined,
+      cpuTemp,
       gpu: stats.gpu.map((gpu) => ({
         gpuId: gpu.gpu_id,
         name: gpu.name,
@@ -80,6 +80,23 @@ export class GlancesIntegration extends Integration implements ISystemHealthMoni
     return await response.text();
   }
 
+  private async getCpuTempAsync(): Promise<number | undefined> {
+    // CPU temperature is optional data, so a transport error or payload drift on
+    // /api/4/sensors must not fail the whole getSystemInfoAsync() call.
+    try {
+      const response = await fetchWithTrustedCertificatesAsync(this.url("/api/4/sensors"));
+
+      if (!response.ok) {
+        return undefined;
+      }
+
+      const sensors = await sensorsSchema.parseAsync(await response.json());
+      return parseGlancesCpuTempFromSensors(sensors);
+    } catch {
+      return undefined;
+    }
+  }
+
   private async getAllStatsAsync() {
     const response = await fetchWithTrustedCertificatesAsync(this.url("/api/4/all"));
 
@@ -173,3 +190,33 @@ const allSchema = z.object({
     )
     .default([]),
 });
+
+const sensorsSchema = z.array(
+  z.object({
+    label: z.string(),
+    value: z.number(),
+    type: z.string().optional(),
+  }),
+);
+
+const cpuTempLabelPriority = ["CPU", "Package id 0"] as const;
+
+export const parseGlancesCpuTempFromSensors = (sensors: z.infer<typeof sensorsSchema>): number | undefined => {
+  const temperatureSensors = sensors.filter(
+    (sensor) => sensor.type === "temperature_core" || sensor.type === "temperature",
+  );
+
+  for (const label of cpuTempLabelPriority) {
+    const match = temperatureSensors.find((sensor) => sensor.label === label);
+    if (match) {
+      return match.value;
+    }
+  }
+
+  const firstCore = temperatureSensors[0];
+  if (firstCore) {
+    return firstCore.value;
+  }
+
+  return undefined;
+};

packages/integrations/src/gluetun/gluetun-integration.ts

@@ -0,0 +1,115 @@
+import { ResponseError } from "@homarr/common/server";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
+
+import type { IntegrationTestingInput } from "../base/integration";
+import { Integration } from "../base/integration";
+import { TestConnectionError } from "../base/test-connection/test-connection-error";
+import type { TestingResult } from "../base/test-connection/test-connection-service";
+import type { VpnSummaryIntegration } from "../interfaces/vpn-summary/vpn-summary-integration";
+import type { VpnSummary } from "../interfaces/vpn-summary/vpn-summary-types";
+import {
+  gluetunDnsStatusSchema,
+  gluetunPublicIpSchema,
+  gluetunVpnSettingsSchema,
+  gluetunVpnStatusSchema,
+} from "./gluetun-types";
+import type { GluetunDnsStatus, GluetunPublicIp, GluetunVpnSettings, GluetunVpnStatus } from "./gluetun-types";
+
+export class GluetunIntegration extends Integration implements VpnSummaryIntegration {
+  protected async testingAsync(input: IntegrationTestingInput): Promise<TestingResult> {
+    const authHeaders = this.getAuthHeaders();
+    const url = this.url("/v1/vpn/status");
+    const response = await input.fetchAsync(url, {
+      headers: authHeaders,
+    });
+
+    if (!response.ok) {
+      return TestConnectionError.StatusResult(response);
+    }
+
+    return { success: true };
+  }
+
+  public async getSummaryAsync(): Promise<VpnSummary> {
+    const authHeaders = this.getAuthHeaders();
+    const [vpnStatus, dnsStatus, publicIp, vpnSettings] = await Promise.all([
+      this.getVpnStatusAsync(authHeaders),
+      this.getDnsStatusAsync(authHeaders),
+      this.getPublicIpAsync(authHeaders),
+      this.getVpnSettingAsync(authHeaders),
+    ]);
+
+    return {
+      vpnStatus: vpnStatus.status,
+      dnsStatus: dnsStatus.status,
+      publicIp: publicIp.public_ip,
+      country: publicIp.country,
+      city: publicIp.city,
+      vpnProvider: {
+        protocol: vpnSettings.type,
+        provider: vpnSettings.provider.name,
+      },
+    };
+  }
+
+  private async getVpnStatusAsync(authHeaders: Record<string, string>): Promise<GluetunVpnStatus> {
+    const url = this.url("/v1/vpn/status");
+
+    const response = await fetchWithTrustedCertificatesAsync(url, {
+      headers: authHeaders,
+    });
+
+    if (!response.ok) throw new ResponseError(response);
+    return gluetunVpnStatusSchema.parse(await response.json());
+  }
+
+  private async getDnsStatusAsync(authHeaders: Record<string, string>): Promise<GluetunDnsStatus> {
+    const url = this.url("/v1/dns/status");
+
+    const response = await fetchWithTrustedCertificatesAsync(url, {
+      headers: authHeaders,
+    });
+
+    if (!response.ok) throw new ResponseError(response);
+    return gluetunDnsStatusSchema.parse(await response.json());
+  }
+
+  private async getPublicIpAsync(authHeaders: Record<string, string>): Promise<GluetunPublicIp> {
+    const url = this.url("/v1/publicip/ip");
+
+    const response = await fetchWithTrustedCertificatesAsync(url, {
+      headers: authHeaders,
+    });
+
+    if (!response.ok) throw new ResponseError(response);
+    return gluetunPublicIpSchema.parse(await response.json());
+  }
+
+  private async getVpnSettingAsync(authHeaders: Record<string, string>): Promise<GluetunVpnSettings> {
+    const url = this.url("/v1/vpn/settings");
+
+    const response = await fetchWithTrustedCertificatesAsync(url, {
+      headers: authHeaders,
+    });
+
+    if (!response.ok) throw new ResponseError(response);
+    return gluetunVpnSettingsSchema.parse(await response.json());
+  }
+
+  private getAuthHeaders(): Record<string, string> {
+    if (this.hasSecretValue("apiKey")) {
+      return { "X-API-Key": this.getSecretValue("apiKey") };
+    }
+
+    if (this.hasSecretValue("username") && this.hasSecretValue("password")) {
+      const username = this.getSecretValue("username");
+      const password = this.getSecretValue("password");
+
+      const encodedCredentials = btoa(`${username}:${password}`);
+
+      return { Authorization: `Basic ${encodedCredentials}` };
+    }
+
+    return {};
+  }
+}

packages/integrations/src/gluetun/gluetun-types.ts

@@ -0,0 +1,116 @@
+import { z } from "zod/v4";
+
+export const gluetunVpnStatusSchema = z.object({
+  status: z.string(),
+});
+
+export type GluetunVpnStatus = z.infer<typeof gluetunVpnStatusSchema>;
+
+export const gluetunDnsStatusSchema = gluetunVpnStatusSchema;
+
+export type GluetunDnsStatus = z.infer<typeof gluetunDnsStatusSchema>;
+
+export const gluetunPublicIpSchema = z.object({
+  public_ip: z.string(),
+  region: z.string(),
+  country: z.string(),
+  city: z.string(),
+  location: z.string(),
+  organization: z.string(),
+  postal_code: z.string(),
+  timezone: z.string(),
+});
+
+export type GluetunPublicIp = z.infer<typeof gluetunPublicIpSchema>;
+
+const gluetunServerSelectionOpenvpnSchema = z.object({
+  config_file_path: z.string(),
+  protocol: z.string(),
+  endpoint_ip: z.string(),
+  custom_port: z.number(),
+  pia_encryption_preset: z.string(),
+});
+
+const gluetunServerSelectionWireguardSchema = z.object({
+  endpoint_ip: z.string(),
+  endpoint_port: z.number(),
+  public_key: z.string(),
+});
+
+const gluetunServerSelectionSchema = z.object({
+  vpn: z.string(),
+  countries: z.array(z.string()).nullable(),
+  categories: z.array(z.string()).nullable(),
+  regions: z.array(z.string()).nullable(),
+  cities: z.array(z.string()).nullable(),
+  isps: z.array(z.string()).nullable(),
+  names: z.array(z.string()).nullable(),
+  numbers: z.array(z.number()).nullable(),
+  hostnames: z.array(z.string()),
+  owned_only: z.boolean(),
+  free_only: z.boolean(),
+  premium_only: z.boolean(),
+  stream_only: z.boolean(),
+  multi_hop_only: z.boolean(),
+  port_forward_only: z.boolean(),
+  secure_core_only: z.boolean(),
+  tor_only: z.boolean(),
+  openvpn: gluetunServerSelectionOpenvpnSchema,
+  wireguard: gluetunServerSelectionWireguardSchema,
+});
+
+const gluetunPortForwardingSchema = z.object({
+  enabled: z.boolean(),
+  provider: z.string(),
+  status_file_path: z.string(),
+  up_command: z.string(),
+  down_command: z.string(),
+  listening_port: z.number(),
+  username: z.string(),
+  password: z.string(),
+});
+
+const gluetunProviderSchema = z.object({
+  name: z.string(),
+  server_selection: gluetunServerSelectionSchema,
+  port_forwarding: gluetunPortForwardingSchema,
+});
+
+const gluetunOpenvpnSettingsSchema = z.object({
+  version: z.string(),
+  user: z.string(),
+  password: z.string(),
+  config_file_path: z.string(),
+  ciphers: z.array(z.string()).nullable(),
+  auth: z.string(),
+  cert: z.string(),
+  key: z.string(),
+  encrypted_key: z.string(),
+  key_passphrase: z.string(),
+  pia_encryption_preset: z.string(),
+  mssfix: z.number(),
+  interface: z.string(),
+  process_user: z.string(),
+  verbosity: z.number(),
+  flags: z.array(z.string()).nullable(),
+});
+
+const gluetunWireguardSettingsSchema = z.object({
+  private_key: z.string(),
+  pre_shared_key: z.string(),
+  addresses: z.array(z.string()),
+  allowed_ips: z.array(z.string()),
+  interface: z.string(),
+  persistent_keep_alive_interval: z.number(),
+  mtu: z.number(),
+  implementation: z.string(),
+});
+
+export const gluetunVpnSettingsSchema = z.object({
+  type: z.string(),
+  provider: gluetunProviderSchema,
+  openvpn: gluetunOpenvpnSettingsSchema,
+  wireguard: gluetunWireguardSettingsSchema,
+});
+
+export type GluetunVpnSettings = z.infer<typeof gluetunVpnSettingsSchema>;

packages/integrations/src/gluetun/test/gluetun-integration.spec.ts

@@ -0,0 +1,371 @@
+import { Response } from "undici";
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+import { createDb } from "@homarr/db/test";
+
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
+
+import type { IntegrationTestingInput } from "../../base/integration";
+import { GluetunIntegration } from "../gluetun-integration";
+import {
+  gluetunDnsStatusSchema,
+  gluetunPublicIpSchema,
+  gluetunVpnSettingsSchema,
+  gluetunVpnStatusSchema,
+} from "../gluetun-types";
+
+vi.mock("@homarr/db", async (importActual) => {
+  // eslint-disable-next-line @typescript-eslint/consistent-type-imports
+  const actual = await importActual<typeof import("@homarr/db")>();
+  return {
+    ...actual,
+    db: createDb(),
+  };
+});
+
+vi.mock("@homarr/core/infrastructure/http", () => ({
+  fetchWithTrustedCertificatesAsync: vi.fn(),
+}));
+
+const TEST_URL = "https://gluetun.example.com";
+const TEST_API_KEY = "test-api-key";
+const TEST_USERNAME = "user";
+const TEST_PASSWORD = "p@ss";
+
+const mockFetch = vi.mocked(fetchWithTrustedCertificatesAsync);
+
+type FetchResponse = Awaited<ReturnType<typeof fetchWithTrustedCertificatesAsync>>;
+
+const VPN_STATUS_PAYLOAD = { status: "running" };
+const DNS_STATUS_PAYLOAD = { status: "running" };
+const PUBLIC_IP_PAYLOAD = {
+  public_ip: "203.0.113.42",
+  region: "Europe",
+  country: "Germany",
+  city: "Berlin",
+  location: "52.5200,13.4050",
+  organization: "Example Org",
+  postal_code: "10115",
+  timezone: "Europe/Berlin",
+};
+const VPN_SETTINGS_PAYLOAD = {
+  type: "wireguard",
+  provider: {
+    name: "mullvad",
+    server_selection: {
+      vpn: "wireguard",
+      countries: ["Germany"],
+      categories: null,
+      regions: null,
+      cities: ["Berlin"],
+      isps: null,
+      names: null,
+      numbers: null,
+      hostnames: ["de-ber-wg-001"],
+      owned_only: false,
+      free_only: false,
+      premium_only: false,
+      stream_only: false,
+      multi_hop_only: false,
+      port_forward_only: false,
+      secure_core_only: false,
+      tor_only: false,
+      openvpn: {
+        config_file_path: "",
+        protocol: "udp",
+        endpoint_ip: "",
+        custom_port: 0,
+        pia_encryption_preset: "",
+      },
+      wireguard: {
+        endpoint_ip: "203.0.113.1",
+        endpoint_port: 51820,
+        public_key: "pubkey",
+      },
+    },
+    port_forwarding: {
+      enabled: false,
+      provider: "mullvad",
+      status_file_path: "",
+      up_command: "",
+      down_command: "",
+      listening_port: 0,
+      username: "",
+      password: "",
+    },
+  },
+  openvpn: {
+    version: "",
+    user: "",
+    password: "",
+    config_file_path: "",
+    ciphers: null,
+    auth: "",
+    cert: "",
+    key: "",
+    encrypted_key: "",
+    key_passphrase: "",
+    pia_encryption_preset: "",
+    mssfix: 0,
+    interface: "tun0",
+    process_user: "",
+    verbosity: 0,
+    flags: null,
+  },
+  wireguard: {
+    private_key: "",
+    pre_shared_key: "",
+    addresses: ["10.0.0.2/32"],
+    allowed_ips: ["0.0.0.0/0"],
+    interface: "wg0",
+    persistent_keep_alive_interval: 25,
+    mtu: 1420,
+    implementation: "auto",
+  },
+};
+
+const jsonResponse = (body: unknown, init: ResponseInit = { status: 200 }): FetchResponse =>
+  new Response(JSON.stringify(body), {
+    ...init,
+    headers: { "content-type": "application/json" },
+  }) as unknown as FetchResponse;
+
+const setupHappyPath = () => {
+  mockFetch.mockImplementation((url) => {
+    const urlString = typeof url === "string" ? url : url.toString();
+    const { pathname } = new URL(urlString);
+
+    switch (pathname) {
+      case "/v1/vpn/status":
+        return Promise.resolve(jsonResponse(VPN_STATUS_PAYLOAD));
+      case "/v1/dns/status":
+        return Promise.resolve(jsonResponse(DNS_STATUS_PAYLOAD));
+      case "/v1/publicip/ip":
+        return Promise.resolve(jsonResponse(PUBLIC_IP_PAYLOAD));
+      case "/v1/vpn/settings":
+        return Promise.resolve(jsonResponse(VPN_SETTINGS_PAYLOAD));
+      default:
+        return Promise.resolve(jsonResponse({ error: "not found" }, { status: 404 }));
+    }
+  });
+};
+
+const createIntegrationWithApiKey = () =>
+  new GluetunIntegration({
+    id: "gluetun-1",
+    name: "Gluetun",
+    url: TEST_URL,
+    externalUrl: null,
+    decryptedSecrets: [{ kind: "apiKey", value: TEST_API_KEY }],
+  });
+
+const createIntegrationWithBasicAuth = () =>
+  new GluetunIntegration({
+    id: "gluetun-2",
+    name: "Gluetun",
+    url: TEST_URL,
+    externalUrl: null,
+    decryptedSecrets: [
+      { kind: "username", value: TEST_USERNAME },
+      { kind: "password", value: TEST_PASSWORD },
+    ],
+  });
+
+describe("GluetunIntegration.getSummaryAsync", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  test("maps the four upstream responses into a flat VPN summary", async () => {
+    setupHappyPath();
+
+    const result = await createIntegrationWithApiKey().getSummaryAsync();
+
+    expect(result).toEqual({
+      vpnStatus: "running",
+      dnsStatus: "running",
+      publicIp: "203.0.113.42",
+      country: "Germany",
+      city: "Berlin",
+      vpnProvider: {
+        protocol: "wireguard",
+        provider: "mullvad",
+      },
+    });
+  });
+
+  test("hits each of the four control endpoints exactly once", async () => {
+    setupHappyPath();
+
+    await createIntegrationWithApiKey().getSummaryAsync();
+
+    const calledPaths = mockFetch.mock.calls.map(([url]) => {
+      const urlString = typeof url === "string" ? url : url.toString();
+      return new URL(urlString).pathname;
+    });
+
+    expect(calledPaths).toHaveLength(4);
+    expect(new Set(calledPaths)).toEqual(
+      new Set(["/v1/vpn/status", "/v1/dns/status", "/v1/publicip/ip", "/v1/vpn/settings"]),
+    );
+  });
+
+  test("sends X-API-Key header when an apiKey secret is configured", async () => {
+    setupHappyPath();
+
+    await createIntegrationWithApiKey().getSummaryAsync();
+
+    for (const [, init] of mockFetch.mock.calls) {
+      const headers = (init?.headers ?? {}) as Record<string, string>;
+      expect(headers["X-API-Key"]).toBe(TEST_API_KEY);
+      expect(headers.Authorization).toBeUndefined();
+    }
+  });
+
+  test("sends Basic auth header when username/password are configured", async () => {
+    setupHappyPath();
+
+    await createIntegrationWithBasicAuth().getSummaryAsync();
+
+    const expected = `Basic ${btoa(`${TEST_USERNAME}:${TEST_PASSWORD}`)}`;
+    for (const [, init] of mockFetch.mock.calls) {
+      const headers = (init?.headers ?? {}) as Record<string, string>;
+      expect(headers.Authorization).toBe(expected);
+      expect(headers["X-API-Key"]).toBeUndefined();
+    }
+  });
+
+  test("throws when any upstream endpoint returns a non-OK status", async () => {
+    mockFetch.mockImplementation((url) => {
+      const urlString = typeof url === "string" ? url : url.toString();
+      const { pathname } = new URL(urlString);
+
+      if (pathname === "/v1/publicip/ip") {
+        return Promise.resolve(jsonResponse({ error: "unauthorized" }, { status: 401 }));
+      }
+      return Promise.resolve(jsonResponse(VPN_STATUS_PAYLOAD));
+    });
+
+    await expect(createIntegrationWithApiKey().getSummaryAsync()).rejects.toThrow();
+  });
+
+  test("throws when an upstream payload fails schema validation", async () => {
+    mockFetch.mockImplementation((url) => {
+      const urlString = typeof url === "string" ? url : url.toString();
+      const { pathname } = new URL(urlString);
+
+      if (pathname === "/v1/publicip/ip") {
+        return Promise.resolve(jsonResponse({ public_ip: 123 }));
+      }
+      return Promise.resolve(jsonResponse(VPN_STATUS_PAYLOAD));
+    });
+
+    await expect(createIntegrationWithApiKey().getSummaryAsync()).rejects.toThrow();
+  });
+});
+
+describe("GluetunIntegration testing endpoint", () => {
+  type TestingFn = (input: IntegrationTestingInput) => Promise<{ success: boolean }>;
+
+  const invokeTesting = (integration: GluetunIntegration, input: IntegrationTestingInput) => {
+    const testing = (integration as unknown as { testingAsync: TestingFn }).testingAsync.bind(integration);
+    return testing(input);
+  };
+
+  const makeInput = (response: Response): IntegrationTestingInput =>
+    ({
+      fetchAsync: vi.fn().mockResolvedValue(response),
+    }) as unknown as IntegrationTestingInput;
+
+  test("returns success when /v1/vpn/status responds 200", async () => {
+    const input = makeInput(new Response(JSON.stringify(VPN_STATUS_PAYLOAD), { status: 200 }));
+
+    const result = await invokeTesting(createIntegrationWithApiKey(), input);
+
+    expect(result.success).toBe(true);
+  });
+
+  test("returns a status-code failure when /v1/vpn/status responds non-OK", async () => {
+    const input = makeInput(new Response("unauthorized", { status: 401 }));
+
+    const result = await invokeTesting(createIntegrationWithApiKey(), input);
+
+    expect(result.success).toBe(false);
+  });
+
+  test("passes the api-key header through to fetchAsync", async () => {
+    const response = new Response(JSON.stringify(VPN_STATUS_PAYLOAD), { status: 200 });
+    const input = makeInput(response);
+
+    await invokeTesting(createIntegrationWithApiKey(), input);
+
+    const fetchAsyncMock = vi.mocked(input.fetchAsync);
+    const init = fetchAsyncMock.mock.calls[0]?.[1];
+    const headers = (init?.headers ?? {}) as Record<string, string>;
+    expect(headers["X-API-Key"]).toBe(TEST_API_KEY);
+  });
+
+  test("passes the Basic auth header through to fetchAsync when username/password are configured", async () => {
+    const response = new Response(JSON.stringify(VPN_STATUS_PAYLOAD), { status: 200 });
+    const input = makeInput(response);
+
+    await invokeTesting(createIntegrationWithBasicAuth(), input);
+
+    const fetchAsyncMock = vi.mocked(input.fetchAsync);
+    const init = fetchAsyncMock.mock.calls[0]?.[1];
+    const headers = (init?.headers ?? {}) as Record<string, string>;
+    const expected = `Basic ${btoa(`${TEST_USERNAME}:${TEST_PASSWORD}`)}`;
+    expect(headers.Authorization).toBe(expected);
+    expect(headers["X-API-Key"]).toBeUndefined();
+  });
+});
+
+describe("gluetun schemas", () => {
+  test("vpn status schema accepts a string status", () => {
+    expect(gluetunVpnStatusSchema.parse({ status: "running" })).toEqual({ status: "running" });
+  });
+
+  test("vpn status schema rejects a missing status", () => {
+    expect(() => gluetunVpnStatusSchema.parse({})).toThrow();
+  });
+
+  test("dns status schema mirrors vpn status schema", () => {
+    expect(gluetunDnsStatusSchema.parse({ status: "stopped" })).toEqual({ status: "stopped" });
+    expect(() => gluetunDnsStatusSchema.parse({ status: 42 })).toThrow();
+  });
+
+  test("public ip schema parses the full payload", () => {
+    expect(gluetunPublicIpSchema.parse(PUBLIC_IP_PAYLOAD)).toEqual(PUBLIC_IP_PAYLOAD);
+  });
+
+  test("public ip schema rejects a missing required field", () => {
+    const { city: _city, ...partial } = PUBLIC_IP_PAYLOAD;
+    expect(() => gluetunPublicIpSchema.parse(partial)).toThrow();
+  });
+
+  test("vpn settings schema parses a wireguard payload", () => {
+    const parsed = gluetunVpnSettingsSchema.parse(VPN_SETTINGS_PAYLOAD);
+    expect(parsed.type).toBe("wireguard");
+    expect(parsed.provider.name).toBe("mullvad");
+  });
+
+  test("vpn settings schema accepts nullable server-selection arrays", () => {
+    const payloadWithNulls = {
+      ...VPN_SETTINGS_PAYLOAD,
+      provider: {
+        ...VPN_SETTINGS_PAYLOAD.provider,
+        server_selection: {
+          ...VPN_SETTINGS_PAYLOAD.provider.server_selection,
+          countries: null,
+          cities: null,
+        },
+      },
+    };
+
+    expect(() => gluetunVpnSettingsSchema.parse(payloadWithNulls)).not.toThrow();
+  });
+
+  test("vpn settings schema rejects a non-string type", () => {
+    expect(() => gluetunVpnSettingsSchema.parse({ ...VPN_SETTINGS_PAYLOAD, type: 1 })).toThrow();
+  });
+});

packages/integrations/src/gotify/gotify-integration.ts

@@ -15,9 +15,9 @@ export class GotifyIntegration extends Integration implements INotificationsInte
   }
 
   private getHeaders() {
-    const credentials = Buffer.from(
-      `${super.getSecretValue("username")}:${super.getSecretValue("password")}`,
-    ).toString("base64");
+    const credentials = Buffer.from(`${super.getSecretValue("username")}:${super.getSecretValue("password")}`).toString(
+      "base64",
+    );
     return { Authorization: `Basic ${credentials}` };
   }
 
@@ -31,11 +31,13 @@ export class GotifyIntegration extends Integration implements INotificationsInte
     if (!result.success) throw new Error(`Failed to parse Gotify response: ${result.error.message}`);
     const parsed = result.data;
 
-    return parsed.messages.map((message): Notification => ({
-      id: String(message.id),
-      time: new Date(message.date),
-      title: message.title,
-      body: message.message,
-    }));
+    return parsed.messages.map(
+      (message): Notification => ({
+        id: String(message.id),
+        time: new Date(message.date),
+        title: message.title,
+        body: message.message,
+      }),
+    );
   }
 }

packages/integrations/src/interfaces/vpn-summary/vpn-summary-integration.ts

@@ -0,0 +1,5 @@
+import type { VpnSummary } from "./vpn-summary-types";
+
+export interface VpnSummaryIntegration {
+  getSummaryAsync(): Promise<VpnSummary>;
+}

packages/integrations/src/interfaces/vpn-summary/vpn-summary-types.ts

@@ -0,0 +1,13 @@
+export interface VpnProviderDetails {
+  protocol: string;
+  provider: string;
+}
+
+export interface VpnSummary {
+  vpnStatus: string;
+  dnsStatus: string;
+  publicIp: string;
+  country: string;
+  city: string;
+  vpnProvider: VpnProviderDetails;
+}

packages/integrations/src/media-organizer/lidarr/lidarr-integration.ts

@@ -69,36 +69,24 @@ export class LidarrIntegration extends Integration implements ICalendarIntegrati
   private getLinksForLidarrCalendarEvent = (event: z.infer<typeof lidarrCalendarEventSchema>) => {
     const links: CalendarLink[] = [];
 
+    // titleSlug is only present when Lidarr returns it; guard so a missing value
+    // neither breaks the link nor drops the event.
+    if (event.artist.titleSlug) {
+      links.push({
+        href: this.externalUrl(`/artist/${event.artist.titleSlug}`).toString(),
+        name: "Lidarr",
+        logo: "/images/apps/lidarr.svg",
+        color: undefined,
+        isDark: true,
+      });
+    }
+
     for (const link of event.artist.links) {
-      switch (link.name) {
-        case "vgmdb":
-          links.push({
-            href: link.url,
-            name: "VgmDB",
-            color: "#f5c518",
-            isDark: false,
-            logo: "/images/apps/vgmdb.svg",
-          });
-          break;
-        case "imdb":
-          links.push({
-            href: link.url,
-            name: "IMDb",
-            color: "#f5c518",
-            isDark: false,
-            logo: "/images/apps/imdb.png",
-          });
-          break;
-        case "last":
-          links.push({
-            href: link.url,
-            name: "LastFM",
-            color: "#cf222a",
-            isDark: false,
-            logo: "/images/apps/lastfm.svg",
-          });
-          break;
+      const externalLink = lidarrExternalCalendarLinks[link.name];
+      if (!externalLink) {
+        continue;
       }
+      links.push({ ...externalLink, href: link.url });
     }
 
     return links;
@@ -109,7 +97,7 @@ export class LidarrIntegration extends Integration implements ICalendarIntegrati
   ): z.infer<typeof lidarrCalendarEventSchema>["images"][number] | undefined => {
     const flatImages = [...event.images];
 
-    const sortedImages = flatImages.sort(
+    const sortedImages = flatImages.toSorted(
       (imageA, imageB) =>
         mediaOrganizerPriorities.indexOf(imageA.coverType) - mediaOrganizerPriorities.indexOf(imageB.coverType),
     );
@@ -149,6 +137,16 @@ const lidarrCalendarEventSchema = z.object({
   title: z.string(),
   overview: z.string().optional(),
   images: lidarrCalendarEventImageSchema,
-  artist: z.object({ links: z.array(z.object({ url: z.string().url(), name: z.string() })), artistName: z.string() }),
+  artist: z.object({
+    links: z.array(z.object({ url: z.string().url(), name: z.string() })),
+    artistName: z.string(),
+    titleSlug: z.string().optional(),
+  }),
   releaseDate: z.string().transform((value) => new Date(value)),
 });
+
+const lidarrExternalCalendarLinks: Record<string, Omit<CalendarLink, "href">> = {
+  vgmdb: { name: "VgmDB", color: "#f5c518", isDark: false, logo: "/images/apps/vgmdb.svg" },
+  imdb: { name: "IMDb", color: "#f5c518", isDark: false, logo: "/images/apps/imdb.png" },
+  last: { name: "LastFM", color: "#cf222a", isDark: false, logo: "/images/apps/lastfm.svg" },
+};

packages/integrations/src/plex/plex-integration.ts

@@ -127,11 +127,18 @@ export class PlexIntegration extends Integration implements IMediaServerIntegrat
 
     const media =
       data.MediaContainer.Metadata?.filter((item) => item.Image).map((item) => {
+        const title =
+          item.type === "episode"
+            ? (item.grandparentTitle ?? item.title)
+            : item.type === "season"
+              ? (item.parentTitle ?? item.title)
+              : item.title;
+
         return {
           id: item.Media?.at(0)?.id.toString() ?? item.key,
           type: mapType(item.type),
-          title: item.title,
-          subtitle: item.tagline,
+          title,
+          subtitle: title === item.title ? item.tagline : item.title,
           description: item.summary,
           releaseDate: item.originallyAvailableAt
             ? new Date(item.originallyAvailableAt)
@@ -222,6 +229,8 @@ const recentlyAddedSchema = z.object({
           studio: z.string().optional(),
           type: z.string(), // For example "movie", "album"
           title: z.string(),
+          parentTitle: z.string().optional(),
+          grandparentTitle: z.string().optional(),
           summary: z.string().optional(),
           duration: z.number().optional(),
           addedAt: z.number(),

packages/integrations/src/plex/test/plex-integration.spec.ts

@@ -0,0 +1,140 @@
+// @vitest-environment node
+import { Response } from "undici";
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
+
+import type { IntegrationSecret } from "../../base/types";
+import { PlexIntegration } from "../plex-integration";
+
+const imageProxyMocks = vi.hoisted(() => ({
+  createImageAsync: vi.fn((url: string) => Promise.resolve(`proxied:${url}`)),
+}));
+
+vi.mock("@homarr/core/infrastructure/http", () => ({
+  fetchWithTrustedCertificatesAsync: vi.fn(),
+}));
+
+vi.mock("@homarr/image-proxy", () => ({
+  ImageProxy: class {
+    createImageAsync = imageProxyMocks.createImageAsync;
+  },
+}));
+
+const TEST_URL = "https://plex.example.com";
+const mockFetch = vi.mocked(fetchWithTrustedCertificatesAsync);
+
+const secrets: IntegrationSecret[] = [{ kind: "apiKey", value: "plex-token" }];
+
+const createIntegration = () =>
+  new PlexIntegration({
+    id: "test-plex",
+    name: "Test Plex",
+    url: TEST_URL,
+    externalUrl: null,
+    decryptedSecrets: secrets,
+  });
+
+const createMetadataItem = (key: string, overrides: Record<string, unknown>) => ({
+  key: `/library/metadata/${key}`,
+  type: "movie",
+  title: "Movie",
+  addedAt: 1_735_689_600,
+  Image: [
+    {
+      type: "coverPoster",
+      url: `/library/metadata/${key}/thumb`,
+    },
+  ],
+  ...overrides,
+});
+
+beforeEach(() => {
+  mockFetch.mockReset();
+  imageProxyMocks.createImageAsync.mockClear();
+});
+
+describe("PlexIntegration.getMediaReleasesAsync", () => {
+  test("uses the series title for TV seasons and episodes", async () => {
+    mockFetch.mockImplementation((url) => {
+      const urlString = String(url);
+
+      if (urlString.endsWith("/identity")) {
+        return Promise.resolve(
+          new Response(JSON.stringify({ MediaContainer: { machineIdentifier: "server-id" } }), { status: 200 }),
+        ) as unknown as ReturnType<typeof fetchWithTrustedCertificatesAsync>;
+      }
+
+      if (urlString.endsWith("/library/recentlyAdded")) {
+        return Promise.resolve(
+          new Response(
+            JSON.stringify({
+              MediaContainer: {
+                Metadata: [
+                  createMetadataItem("season", {
+                    type: "season",
+                    title: "Season 1",
+                    parentTitle: "Breaking Bad",
+                  }),
+                  createMetadataItem("episode", {
+                    type: "episode",
+                    title: "Review",
+                    parentTitle: "Season 1",
+                    grandparentTitle: "The Bear",
+                  }),
+                  createMetadataItem("movie", {
+                    type: "movie",
+                    title: "Inception",
+                    tagline: "Dreams feel real",
+                  }),
+                  createMetadataItem("show", {
+                    type: "show",
+                    title: "The Last of Us",
+                    tagline: "A series tagline",
+                  }),
+                  createMetadataItem("missing-parent", {
+                    type: "season",
+                    title: "Season 3",
+                  }),
+                ],
+              },
+            }),
+            { status: 200 },
+          ),
+        ) as unknown as ReturnType<typeof fetchWithTrustedCertificatesAsync>;
+      }
+
+      throw new Error(`Unexpected Plex request: ${urlString}`);
+    });
+
+    const releases = await createIntegration().getMediaReleasesAsync();
+
+    expect(releases).toMatchObject([
+      {
+        title: "Breaking Bad",
+        subtitle: "Season 1",
+        type: "tv",
+      },
+      {
+        title: "The Bear",
+        subtitle: "Review",
+        type: "tv",
+      },
+      {
+        title: "Inception",
+        subtitle: "Dreams feel real",
+        type: "movie",
+      },
+      {
+        title: "The Last of Us",
+        subtitle: "A series tagline",
+        type: "tv",
+      },
+      {
+        title: "Season 3",
+        subtitle: undefined,
+        type: "tv",
+      },
+    ]);
+  });
+});

packages/integrations/src/types.ts

@@ -4,6 +4,7 @@ export * from "./interfaces/network-controller-summary/network-controller-summar
 export * from "./interfaces/firewall-summary/firewall-summary-types";
 export * from "./interfaces/health-monitoring/health-monitoring-types";
 export * from "./interfaces/ups-summary/ups-summary-types";
+export * from "./interfaces/vpn-summary/vpn-summary-types";
 export * from "./interfaces/indexer-manager/indexer-manager-types";
 export * from "./interfaces/media-requests/media-request-types";
 export * from "./base/searchable-integration";
@@ -22,4 +23,5 @@ export * from "./audiobookshelf/audiobookshelf-types";
 export * from "./navidrome/navidrome-types";
 export * from "./paperless-ngx/paperless-ngx-types";
 export * from "./umami/umami-types";
+export * from "./gluetun/gluetun-types";
 export * from "./beszel/beszel-types";

packages/integrations/test/glances-unit.spec.ts

@@ -1,11 +1,11 @@
 // @vitest-environment node
 
-import { describe, expect, test, vi } from "vitest";
+import { beforeEach, describe, expect, test, vi } from "vitest";
 
 import { createDb } from "@homarr/db/test";
 import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
 
-import { GlancesIntegration } from "../src/glances/glances-integration";
+import { GlancesIntegration, parseGlancesCpuTempFromSensors } from "../src/glances/glances-integration";
 
 // ─── module mocks ────────────────────────────────────────────────────────────
 
@@ -64,6 +64,19 @@ function makeResponse(body: unknown) {
   } as never;
 }
 
+function mockGlancesFetch(statsBody: unknown, sensorsBody: unknown) {
+  mockFetch.mockImplementation(((url: string | URL) => {
+    const urlString = url.toString();
+    if (urlString.endsWith("/api/4/all")) {
+      return Promise.resolve(makeResponse(statsBody));
+    }
+    if (urlString.endsWith("/api/4/sensors")) {
+      return Promise.resolve(makeResponse(sensorsBody));
+    }
+    return Promise.reject(new Error(`Unexpected fetch URL: ${urlString}`));
+  }) as typeof fetchWithTrustedCertificatesAsync);
+}
+
 const integrationInput = {
   id: "test-glances",
   name: "Glances",
@@ -75,8 +88,12 @@ const integrationInput = {
 // ─── tests ───────────────────────────────────────────────────────────────────
 
 describe("GlancesIntegration schema", () => {
+  beforeEach(() => {
+    mockFetch.mockReset();
+  });
+
   test("parses stats when quicklook is present", async () => {
-    mockFetch.mockResolvedValueOnce(makeResponse({ ...baseStats, quicklook: { cpu_name: "Apple M1" } }));
+    mockGlancesFetch({ ...baseStats, quicklook: { cpu_name: "Apple M1" } }, []);
 
     const integration = new GlancesIntegration(integrationInput);
     const result = await integration.getSystemInfoAsync();
@@ -86,7 +103,7 @@ describe("GlancesIntegration schema", () => {
   });
 
   test("returns Unknown cpuModelName when quicklook is absent (macOS scenario)", async () => {
-    mockFetch.mockResolvedValueOnce(makeResponse(baseStats));
+    mockGlancesFetch(baseStats, []);
 
     const integration = new GlancesIntegration(integrationInput);
     const result = await integration.getSystemInfoAsync();
@@ -95,9 +112,41 @@ describe("GlancesIntegration schema", () => {
   });
 
   test("does not throw a Zod parse error when quicklook is missing", async () => {
-    mockFetch.mockResolvedValueOnce(makeResponse(baseStats));
+    mockGlancesFetch(baseStats, []);
 
     const integration = new GlancesIntegration(integrationInput);
     await expect(integration.getSystemInfoAsync()).resolves.not.toThrow();
   });
+
+  test("reads CPU temperature from sensors", async () => {
+    mockGlancesFetch(baseStats, [
+      { label: "CPU", unit: "C", value: 58, type: "temperature_core" },
+      { label: "Core 0", unit: "C", value: 54, type: "temperature_core" },
+    ]);
+
+    const integration = new GlancesIntegration(integrationInput);
+    const result = await integration.getSystemInfoAsync();
+
+    expect(result.cpuTemp).toBe(58);
+  });
+});
+
+describe("parseGlancesCpuTempFromSensors", () => {
+  test("prefers CPU label over core sensors", () => {
+    const result = parseGlancesCpuTempFromSensors([
+      { label: "Core 0", value: 54, type: "temperature_core" },
+      { label: "CPU", value: 58, type: "temperature_core" },
+    ]);
+
+    expect(result).toBe(58);
+  });
+
+  test("falls back to Package id 0", () => {
+    const result = parseGlancesCpuTempFromSensors([
+      { label: "Core 0", value: 54, type: "temperature_core" },
+      { label: "Package id 0", value: 62, type: "temperature_core" },
+    ]);
+
+    expect(result).toBe(62);
+  });
 });

packages/integrations/test/lidarr-unit.spec.ts

@@ -0,0 +1,76 @@
+// @vitest-environment node
+
+import { describe, expect, test, vi } from "vitest";
+
+import { createDb } from "@homarr/db/test";
+import { fetchWithTrustedCertificatesAsync } from "@homarr/core/infrastructure/http";
+
+import { LidarrIntegration } from "../src/media-organizer/lidarr/lidarr-integration";
+
+vi.mock("@homarr/db", async (importActual) => {
+  const actual = await importActual<typeof import("@homarr/db")>();
+  return { ...actual, db: createDb() };
+});
+
+vi.mock("@homarr/core/infrastructure/certificates", async (importActual) => {
+  const actual = await importActual<typeof import("@homarr/core/infrastructure/certificates")>();
+  return {
+    ...actual,
+    getTrustedCertificateHostnamesAsync: vi.fn().mockResolvedValue([]),
+  };
+});
+
+vi.mock("@homarr/core/infrastructure/http", () => ({
+  fetchWithTrustedCertificatesAsync: vi.fn(),
+}));
+
+const mockFetch = vi.mocked(fetchWithTrustedCertificatesAsync);
+
+const integrationInput = {
+  id: "test-lidarr",
+  name: "Lidarr",
+  url: "http://localhost:8686",
+  decryptedSecrets: [{ kind: "apiKey" as const, value: "test-key" }],
+  externalUrl: null,
+};
+
+describe("LidarrIntegration calendar", () => {
+  test("includes Lidarr artist link in calendar events", async () => {
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () =>
+        Promise.resolve([
+          {
+            title: "Test Album",
+            overview: "Overview",
+            images: [],
+            artist: {
+              artistName: "Test Artist",
+              titleSlug: "test-artist",
+              links: [{ name: "last", url: "https://last.fm/music/Test+Artist" }],
+            },
+            releaseDate: "2026-01-01T00:00:00Z",
+          },
+        ]),
+    } as never);
+
+    const integration = new LidarrIntegration(integrationInput);
+    const events = await integration.getCalendarEventsAsync(new Date("2026-01-01"), new Date("2026-01-31"));
+
+    expect(events[0]?.links[0]).toMatchObject({
+      name: "Lidarr",
+      href: "http://localhost:8686/artist/test-artist",
+      logo: "/images/apps/lidarr.svg",
+    });
+    // The existing external artist link must survive the Lidarr-link prepend.
+    expect(events[0]?.links).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          name: "LastFM",
+          href: "https://last.fm/music/Test+Artist",
+          logo: "/images/apps/lastfm.svg",
+        }),
+      ]),
+    );
+  });
+});

packages/integrations/test/technitium.spec.ts

@@ -2,15 +2,7 @@
 
 import type { StartedTestContainer } from "testcontainers";
 import { GenericContainer, Wait } from "testcontainers";
-import {
-  beforeAll,
-  beforeEach,
-  afterAll,
-  describe,
-  expect,
-  test,
-  vi,
-} from "vitest";
+import { beforeAll, beforeEach, afterAll, describe, expect, test, vi } from "vitest";
 
 import { createDb } from "@homarr/db/test";
 
@@ -31,15 +23,10 @@ vi.mock("@homarr/db", async (importActual) => {
 
 vi.mock("@homarr/core/infrastructure/certificates", async (importActual) => {
   // eslint-disable-next-line @typescript-eslint/consistent-type-imports
-  const actual =
-    await importActual<
-      typeof import("@homarr/core/infrastructure/certificates")
-    >();
+  const actual = await importActual<typeof import("@homarr/core/infrastructure/certificates")>();
   return {
     ...actual,
-    getTrustedCertificateHostnamesAsync: vi
-      .fn()
-      .mockImplementation(() => Promise.resolve([])),
+    getTrustedCertificateHostnamesAsync: vi.fn().mockImplementation(() => Promise.resolve([])),
   };
 });
 
@@ -90,9 +77,7 @@ const INTEGRATION_ID = "test-technitium";
 
 const makeInput = (
   baseUrl: string,
-  auth:
-    | { kind: "credentials"; password?: string }
-    | { kind: "apiKey"; value: string },
+  auth: { kind: "credentials"; password?: string } | { kind: "apiKey"; value: string },
 ): IntegrationInput => ({
   id: INTEGRATION_ID,
   name: "Technitium DNS",
@@ -109,10 +94,7 @@ const makeInput = (
 
 // Fetch an API token appropriate for the server version.
 // v15 has a dedicated createToken endpoint; legacy reuses the session token from login.
-async function fetchApiToken(
-  baseUrl: string,
-  apiVersion: TechnitiumVersion,
-): Promise<string> {
+async function fetchApiToken(baseUrl: string, apiVersion: TechnitiumVersion): Promise<string> {
   if (apiVersion === "v15") {
     // v15 exposes a dedicated endpoint for non-expiring API tokens.
     const res = await fetch(
@@ -122,9 +104,7 @@ async function fetchApiToken(
   }
   // Legacy: /api/user/login exists on all tested versions (v11–v14) and returns a session
   // token that can be used as a long-lived API key via the ?token= query parameter.
-  const res = await fetch(
-    `${baseUrl}/api/user/login?user=${DEFAULT_USERNAME}&pass=${DEFAULT_PASSWORD}`,
-  );
+  const res = await fetch(`${baseUrl}/api/user/login?user=${DEFAULT_USERNAME}&pass=${DEFAULT_PASSWORD}`);
   return ((await res.json()) as { token: string }).token;
 }
 
@@ -144,16 +124,12 @@ const pool: Record<string, ContainerEntry> = {};
 beforeAll(async () => {
   await Promise.all(
     VERSIONS.map(async ({ tag, apiVersion }) => {
-      const container = await new GenericContainer(
-        `technitium/dns-server:${tag}`,
-      )
+      const container = await new GenericContainer(`technitium/dns-server:${tag}`)
         .withExposedPorts(5380)
         // Explicitly set the admin password so all versions use the same credentials.
         // Without this, older versions may generate a random password on first run.
         .withEnvironment({ DNS_SERVER_ADMIN_PASSWORD: DEFAULT_PASSWORD })
-        .withWaitStrategy(
-          Wait.forLogMessage("Technitium DNS Server was started successfully."),
-        )
+        .withWaitStrategy(Wait.forLogMessage("Technitium DNS Server was started successfully."))
         .start();
       const baseUrl = `http://${container.getHost()}:${container.getMappedPort(5380)}`;
       const apiToken = await fetchApiToken(baseUrl, apiVersion);
@@ -163,238 +139,209 @@ beforeAll(async () => {
 }, 120_000);
 
 afterAll(async () => {
-  await Promise.all(
-    Object.values(pool).map(({ container }) => container.stop()),
-  );
+  await Promise.all(Object.values(pool).map(({ container }) => container.stop()));
 });
 
 // ─── version-parameterised suites ────────────────────────────────────────────
 
-describe.each(VERSIONS)(
-  "Technitium DNS $tag ($apiVersion)",
-  ({ tag, apiVersion }) => {
-    let baseUrl: string;
-    let apiToken: string;
+describe.each(VERSIONS)("Technitium DNS $tag ($apiVersion)", ({ tag, apiVersion }) => {
+  let baseUrl: string;
+  let apiToken: string;
 
-    beforeAll(() => {
-      const entry = pool[tag];
-      if (!entry)
-        throw new Error(`Container pool entry for ${tag} was not initialized`);
-      ({ baseUrl, apiToken } = entry);
-    });
+  beforeAll(() => {
+    const entry = pool[tag];
+    if (!entry) throw new Error(`Container pool entry for ${tag} was not initialized`);
+    ({ baseUrl, apiToken } = entry);
+  });
 
-    beforeEach(() => {
-      sessionState[INTEGRATION_ID] = null;
-    });
+  beforeEach(() => {
+    sessionState[INTEGRATION_ID] = null;
+  });
 
-    // ── factory ────────────────────────────────────────────────────────────────
+  // ── factory ────────────────────────────────────────────────────────────────
 
-    describe("createTechnitiumDnsIntegrationAsync (factory)", () => {
-      test("factory creates a working integration (auto-detects version)", async () => {
-        const integration = await createTechnitiumDnsIntegrationAsync(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+  describe("createTechnitiumDnsIntegrationAsync (factory)", () => {
+    test("factory creates a working integration (auto-detects version)", async () => {
+      const integration = await createTechnitiumDnsIntegrationAsync(makeInput(baseUrl, { kind: "credentials" }));
 
-        const result = await integration.getSummaryAsync();
+      const result = await integration.getSummaryAsync();
 
-        expect(result.status).toBe("enabled");
-        expect(result.dnsQueriesToday).toBeGreaterThanOrEqual(0);
-      }, 20_000);
-    });
+      expect(result.status).toBe("enabled");
+      expect(result.dnsQueriesToday).toBeGreaterThanOrEqual(0);
+    }, 20_000);
+  });
 
-    // ── getSummaryAsync ────────────────────────────────────────────────────────
+  // ── getSummaryAsync ────────────────────────────────────────────────────────
 
-    describe("getSummaryAsync", () => {
-      test("returns valid summary with credentials", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+  describe("getSummaryAsync", () => {
+    test("returns valid summary with credentials", async () => {
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }));
 
-        const result = await integration.getSummaryAsync();
+      const result = await integration.getSummaryAsync();
 
-        expect(result.dnsQueriesToday).toBeGreaterThanOrEqual(0);
-        expect(result.adsBlockedToday).toBeGreaterThanOrEqual(0);
-        expect(result.adsBlockedTodayPercentage).toBeGreaterThanOrEqual(0);
-        expect(result.domainsBeingBlocked).toBeGreaterThanOrEqual(0);
-        expect(result.status).toBe("enabled");
-      }, 20_000);
+      expect(result.dnsQueriesToday).toBeGreaterThanOrEqual(0);
+      expect(result.adsBlockedToday).toBeGreaterThanOrEqual(0);
+      expect(result.adsBlockedTodayPercentage).toBeGreaterThanOrEqual(0);
+      expect(result.domainsBeingBlocked).toBeGreaterThanOrEqual(0);
+      expect(result.status).toBe("enabled");
+    }, 20_000);
 
-      test("returns valid summary with API key", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "apiKey", value: apiToken }),
-          apiVersion,
-        );
+    test("returns valid summary with API key", async () => {
+      const integration = new TechnitiumDnsIntegration(
+        makeInput(baseUrl, { kind: "apiKey", value: apiToken }),
+        apiVersion,
+      );
 
-        const result = await integration.getSummaryAsync();
+      const result = await integration.getSummaryAsync();
 
-        expect(result.status).toBe("enabled");
-        expect(result.dnsQueriesToday).toBeGreaterThanOrEqual(0);
-      }, 20_000);
+      expect(result.status).toBe("enabled");
+      expect(result.dnsQueriesToday).toBeGreaterThanOrEqual(0);
+    }, 20_000);
 
-      test("domainsBeingBlocked is a non-negative number (blockedZones + blockListZones)", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+    test("domainsBeingBlocked is a non-negative number (blockedZones + blockListZones)", async () => {
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }));
 
-        const result = await integration.getSummaryAsync();
+      const result = await integration.getSummaryAsync();
 
-        expect(typeof result.domainsBeingBlocked).toBe("number");
-        expect(result.domainsBeingBlocked).toBeGreaterThanOrEqual(0);
-      }, 20_000);
-    });
+      expect(typeof result.domainsBeingBlocked).toBe("number");
+      expect(result.domainsBeingBlocked).toBeGreaterThanOrEqual(0);
+    }, 20_000);
+  });
 
-    // ── session caching ────────────────────────────────────────────────────────
+  // ── session caching ────────────────────────────────────────────────────────
 
-    describe("session caching", () => {
-      test("login is performed once and token is cached for subsequent calls", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+  describe("session caching", () => {
+    test("login is performed once and token is cached for subsequent calls", async () => {
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }));
 
-        await integration.getSummaryAsync();
-        const tokenAfterFirst = sessionState[INTEGRATION_ID]?.token;
-        expect(tokenAfterFirst).toBeDefined();
+      await integration.getSummaryAsync();
+      const tokenAfterFirst = sessionState[INTEGRATION_ID]?.token;
+      expect(tokenAfterFirst).toBeDefined();
 
-        await integration.getSummaryAsync();
-        const tokenAfterSecond = sessionState[INTEGRATION_ID]?.token;
+      await integration.getSummaryAsync();
+      const tokenAfterSecond = sessionState[INTEGRATION_ID]?.token;
 
-        expect(tokenAfterSecond).toBe(tokenAfterFirst);
-      }, 20_000);
+      expect(tokenAfterSecond).toBe(tokenAfterFirst);
+    }, 20_000);
 
-      test("recovers from an expired/invalid stored token by re-logging in", async () => {
-        // Plant a bad token with the correct version so it hits the right API path before failing
-        sessionState[INTEGRATION_ID] = {
-          token: "deliberately-invalid-token",
-          version: apiVersion,
-        };
+    test("recovers from an expired/invalid stored token by re-logging in", async () => {
+      // Plant a bad token with the correct version so it hits the right API path before failing
+      sessionState[INTEGRATION_ID] = {
+        token: "deliberately-invalid-token",
+        version: apiVersion,
+      };
 
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-          apiVersion,
-        );
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }), apiVersion);
 
-        const result = await integration.getSummaryAsync();
+      const result = await integration.getSummaryAsync();
 
-        expect(result.status).toBe("enabled");
-        expect(sessionState[INTEGRATION_ID]).not.toBeNull();
-        expect(sessionState[INTEGRATION_ID]?.token).not.toBe(
-          "deliberately-invalid-token",
-        );
-      }, 20_000);
-    });
+      expect(result.status).toBe("enabled");
+      expect(sessionState[INTEGRATION_ID]).not.toBeNull();
+      expect(sessionState[INTEGRATION_ID]?.token).not.toBe("deliberately-invalid-token");
+    }, 20_000);
+  });
 
-    // ── blocking state changes ─────────────────────────────────────────────────
+  // ── blocking state changes ─────────────────────────────────────────────────
 
-    describe("blocking state changes", () => {
-      test("disableAsync permanently disables blocking", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+  describe("blocking state changes", () => {
+    test("disableAsync permanently disables blocking", async () => {
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }));
 
-        await integration.disableAsync();
-        const result = await integration.getSummaryAsync();
+      await integration.disableAsync();
+      const result = await integration.getSummaryAsync();
 
-        expect(result.status).toBe("disabled");
+      expect(result.status).toBe("disabled");
 
-        await integration.enableAsync(); // restore
-      }, 20_000);
+      await integration.enableAsync(); // restore
+    }, 20_000);
 
-      test("enableAsync re-enables blocking after permanent disable", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+    test("enableAsync re-enables blocking after permanent disable", async () => {
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }));
 
-        await integration.disableAsync();
-        await integration.enableAsync();
-        const result = await integration.getSummaryAsync();
+      await integration.disableAsync();
+      await integration.enableAsync();
+      const result = await integration.getSummaryAsync();
 
-        expect(result.status).toBe("enabled");
-      }, 20_000);
+      expect(result.status).toBe("enabled");
+    }, 20_000);
 
-      test("disableAsync with duration temporarily disables blocking", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+    test("disableAsync with duration temporarily disables blocking", async () => {
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }));
 
-        await integration.disableAsync(120); // 120s → 2 min
-        const result = await integration.getSummaryAsync();
+      await integration.disableAsync(120); // 120s → 2 min
+      const result = await integration.getSummaryAsync();
 
-        expect(result.status).toBe("disabled");
+      expect(result.status).toBe("disabled");
 
-        await integration.enableAsync(); // restore
-      }, 20_000);
+      await integration.enableAsync(); // restore
+    }, 20_000);
 
-      test("disableAsync with small duration (1s) rounds up to 1 minute and disables", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+    test("disableAsync with small duration (1s) rounds up to 1 minute and disables", async () => {
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }));
 
-        await integration.disableAsync(1);
-        const result = await integration.getSummaryAsync();
+      await integration.disableAsync(1);
+      const result = await integration.getSummaryAsync();
 
-        expect(result.status).toBe("disabled");
+      expect(result.status).toBe("disabled");
 
-        await integration.enableAsync(); // restore
-      }, 20_000);
+      await integration.enableAsync(); // restore
+    }, 20_000);
 
-      test("enableAsync cancels an active timed disable immediately", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        );
+    test("enableAsync cancels an active timed disable immediately", async () => {
+      const integration = new TechnitiumDnsIntegration(makeInput(baseUrl, { kind: "credentials" }));
 
-        await integration.disableAsync(600); // 10 minutes
-        await integration.enableAsync();
-        const result = await integration.getSummaryAsync();
+      await integration.disableAsync(600); // 10 minutes
+      await integration.enableAsync();
+      const result = await integration.getSummaryAsync();
 
-        expect(result.status).toBe("enabled");
-      }, 20_000);
-    });
+      expect(result.status).toBe("enabled");
+    }, 20_000);
+  });
 
-    // ── testConnectionAsync ────────────────────────────────────────────────────
+  // ── testConnectionAsync ────────────────────────────────────────────────────
 
-    describe("testConnectionAsync", () => {
-      test("succeeds with valid credentials", async () => {
-        const result = await new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "credentials" }),
-        ).testConnectionAsync();
-        expect(result.success).toBe(true);
-      }, 20_000);
+  describe("testConnectionAsync", () => {
+    test("succeeds with valid credentials", async () => {
+      const result = await new TechnitiumDnsIntegration(
+        makeInput(baseUrl, { kind: "credentials" }),
+      ).testConnectionAsync();
+      expect(result.success).toBe(true);
+    }, 20_000);
 
-      test("succeeds with valid API key", async () => {
-        const result = await new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "apiKey", value: apiToken }),
-          apiVersion,
-        ).testConnectionAsync();
-        expect(result.success).toBe(true);
-      }, 20_000);
+    test("succeeds with valid API key", async () => {
+      const result = await new TechnitiumDnsIntegration(
+        makeInput(baseUrl, { kind: "apiKey", value: apiToken }),
+        apiVersion,
+      ).testConnectionAsync();
+      expect(result.success).toBe(true);
+    }, 20_000);
 
-      test("fails with wrong password — returns authorization error", async () => {
-        const integration = new TechnitiumDnsIntegration(
-          makeInput(baseUrl, {
-            kind: "credentials",
-            password: "wrong-password",
-          }),
-        );
+    test("fails with wrong password — returns authorization error", async () => {
+      const integration = new TechnitiumDnsIntegration(
+        makeInput(baseUrl, {
+          kind: "credentials",
+          password: "wrong-password",
+        }),
+      );
 
-        const result = await integration.testConnectionAsync();
+      const result = await integration.testConnectionAsync();
 
-        expect(result.success).toBe(false);
-        if (result.success) return;
-        expect(result.error).toBeInstanceOf(TestConnectionError);
-        expect(result.error.type).toBe("authorization");
-      }, 20_000);
+      expect(result.success).toBe(false);
+      if (result.success) return;
+      expect(result.error).toBeInstanceOf(TestConnectionError);
+      expect(result.error.type).toBe("authorization");
+    }, 20_000);
 
-      test("fails with invalid API key — returns authorization error", async () => {
-        const result = await new TechnitiumDnsIntegration(
-          makeInput(baseUrl, { kind: "apiKey", value: "invalid-api-key-xyz" }),
-          apiVersion,
-        ).testConnectionAsync();
+    test("fails with invalid API key — returns authorization error", async () => {
+      const result = await new TechnitiumDnsIntegration(
+        makeInput(baseUrl, { kind: "apiKey", value: "invalid-api-key-xyz" }),
+        apiVersion,
+      ).testConnectionAsync();
 
-        expect(result.success).toBe(false);
-        if (result.success) return;
-        expect(result.error).toBeInstanceOf(TestConnectionError);
-        expect(result.error.type).toBe("authorization");
-      }, 20_000);
-    });
-  },
-);
+      expect(result.success).toBe(false);
+      if (result.success) return;
+      expect(result.error).toBeInstanceOf(TestConnectionError);
+      expect(result.error.type).toBe("authorization");
+    }, 20_000);
+  });
+});

packages/redis/src/lib/channel.ts

@@ -415,8 +415,18 @@ export const createChannelWithLatestAndEvents = <TData>(channelName: string) =>
       });
     },
     publishAndUpdateLastStateAsync: async (data: TData) => {
-      await publisher.publish(channelName, superjson.stringify(data));
-      await getSetClient.set(channelName, superjson.stringify({ data, timestamp: new Date() }));
+      // Set first, then publish. If publish fails the storage is still consistent
+      // and subscribers will catch up on the next event.
+      const payload = superjson.stringify({ data, timestamp: new Date() });
+      await getSetClient.set(channelName, payload);
+      try {
+        await publisher.publish(channelName, superjson.stringify(data));
+      } catch (error) {
+        logger.warn("Failed to publish cache update (storage is correct, subscribers will catch up)", {
+          channel: channelName,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      }
     },
     setAsync: async (data: TData) => {
       await getSetClient.set(channelName, superjson.stringify({ data, timestamp: new Date() }));

packages/request-handler/src/beszel.ts

@@ -1,5 +1,6 @@
 import dayjs from "dayjs";
 
+import { createLogger } from "@homarr/core/infrastructure/logs";
 import { createIntegrationAsync } from "@homarr/integrations";
 import type {
   BeszelAlert,
@@ -13,6 +14,8 @@ import type {
 
 import { createCachedIntegrationRequestHandler } from "./lib/cached-integration-request-handler";
 
+const logger = createLogger({ module: "beszelRequestHandler" });
+
 export type { BeszelSystemRow } from "@homarr/integrations/types";
 
 /**
@@ -56,6 +59,7 @@ export const beszelSystemsRequestHandler = createCachedIntegrationRequestHandler
   Record<string, never>
 >({
   async requestAsync(integration) {
+    const start = performance.now();
     const instance = await createIntegrationAsync(integration);
     const systems = await instance.getSystemsAsync();
     const enriched = await Promise.all(
@@ -64,9 +68,16 @@ export const beszelSystemsRequestHandler = createCachedIntegrationRequestHandler
         return mapToSystemRow(system, details);
       }),
     );
+    logger.debug("beszelSystems fetch completed", {
+      integrationId: integration.id,
+      durationMs: Math.round(performance.now() - start),
+      count: enriched.length,
+    });
     return enriched;
   },
-  cacheDuration: dayjs.duration(5, "seconds"),
+  cacheDuration: dayjs.duration(1, "second"),
+  fallbackToStaleOnError: true,
+  retry: { attempts: 2, delayMs: 500 },
   queryKey: "beszelSystems",
 });
 
@@ -81,22 +92,31 @@ export const beszelAlertsRequestHandler = createCachedIntegrationRequestHandler<
   { includeHistory: boolean; maxHistoryItems: number }
 >({
   async requestAsync(integration, input) {
+    const start = performance.now();
     const instance = await createIntegrationAsync(integration);
     const alerts = await instance.getAlertsAsync();
     const history = input.includeHistory ? await instance.getAlertHistoryAsync(undefined, input.maxHistoryItems) : [];
+    logger.debug("beszelAlerts fetch completed", {
+      integrationId: integration.id,
+      durationMs: Math.round(performance.now() - start),
+      alertsCount: alerts.length,
+      historyCount: history.length,
+    });
     return { alerts, history };
   },
-  cacheDuration: dayjs.duration(15, "seconds"),
+  cacheDuration: dayjs.duration(1, "second"),
+  fallbackToStaleOnError: true,
+  retry: { attempts: 2, delayMs: 500 },
   queryKey: "beszelAlerts",
 });
 
-const timePeriodConfig: Record<string, { type: string; perPage: number; cacheSeconds: number }> = {
-  "1m": { type: "1m", perPage: 60, cacheSeconds: 5 },
-  "1h": { type: "1m", perPage: 60, cacheSeconds: 60 },
-  "12h": { type: "10m", perPage: 72, cacheSeconds: 300 },
-  "24h": { type: "20m", perPage: 72, cacheSeconds: 600 },
-  "1w": { type: "1440m", perPage: 9, cacheSeconds: 1800 },
-  "30d": { type: "1440m", perPage: 32, cacheSeconds: 3600 },
+const timePeriodConfig: Record<string, { type: string; perPage: number }> = {
+  "1m": { type: "1m", perPage: 60 },
+  "1h": { type: "1m", perPage: 60 },
+  "12h": { type: "10m", perPage: 72 },
+  "24h": { type: "20m", perPage: 72 },
+  "1w": { type: "480m", perPage: 21 },
+  "30d": { type: "480m", perPage: 90 },
 };
 
 export interface BeszelStatsData {
@@ -110,19 +130,25 @@ export const beszelStatsRequestHandler = createCachedIntegrationRequestHandler<
   { systemId: string; timePeriod: string; includeDocker: boolean }
 >({
   async requestAsync(integration, input) {
-    const config = timePeriodConfig[input.timePeriod] ?? { type: "1m", perPage: 60, cacheSeconds: 60 };
+    const start = performance.now();
+    const config = timePeriodConfig[input.timePeriod] ?? { type: "1m", perPage: 60 };
     const instance = await createIntegrationAsync(integration);
     const systemStats = await instance.getSystemStatsAsync(input.systemId, config.type, config.perPage);
     const containerStats = input.includeDocker
       ? await instance.getContainerStatsAsync(input.systemId, config.type, config.perPage).catch(() => [])
       : [];
+    logger.debug("beszelStats fetch completed", {
+      integrationId: integration.id,
+      systemId: input.systemId,
+      timePeriod: input.timePeriod,
+      durationMs: Math.round(performance.now() - start),
+      systemStatsCount: systemStats.length,
+      containerStatsCount: containerStats.length,
+    });
     return { systemStats, containerStats };
   },
-  cacheDuration: dayjs.duration(60, "seconds"),
+  cacheDuration: dayjs.duration(1, "second"),
+  fallbackToStaleOnError: true,
+  retry: { attempts: 2, delayMs: 500 },
   queryKey: "beszelStats",
-  cacheDurationForInput(input) {
-    const config = timePeriodConfig[input.timePeriod];
-    if (!config) return undefined;
-    return dayjs.duration(config.cacheSeconds, "seconds");
-  },
 });

packages/request-handler/src/lib/cached-integration-request-handler.ts

@@ -18,6 +18,9 @@ interface Options<TData, TKind extends IntegrationKind, TInput extends Record<st
   requestAsync: (integration: IntegrationOfKind<TKind>, input: TInput) => Promise<TData>;
   cacheDuration: Duration;
   cacheDurationForInput?: (input: TInput) => Duration | undefined;
+  fallbackToStaleOnError?: boolean;
+  retry?: { attempts?: number; delayMs?: number };
+  isValid?: (data: TData) => boolean;
 }
 
 export const createCachedIntegrationRequestHandler = <
@@ -35,6 +38,9 @@ export const createCachedIntegrationRequestHandler = <
           return await options.requestAsync(input.integration, input.options);
         },
         cacheDuration: options.cacheDurationForInput?.(itemOptions) ?? options.cacheDuration,
+        fallbackToStaleOnError: options.fallbackToStaleOnError,
+        retry: options.retry,
+        isValid: options.isValid,
         createRedisChannel(input, handlerOptions) {
           return createIntegrationOptionsChannel<TData>(input.integration.id, handlerOptions.queryKey, input.options);
         },