Merge branch 'dev' into feat/sqlite-import-export

Co-authored-by: homarr-renovate[bot] <158783068+homarr-renovate[bot]@users.noreply.github.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -33,6 +33,7 @@ body:
       options:
         # The below comment is used to insert a new version with on-release.yml
         #NEXT_VERSION#
+        - 1.64.0
         - 1.62.0
         - 1.61.0
         - 1.60.1-beta.1

apps/nextjs/next.config.ts

@@ -5,9 +5,21 @@ import "@homarr/common/env";
 import "@homarr/core/infrastructure/logs/env";
 import "@homarr/docker/env";
 
+import { readFileSync } from "fs";
+
 import type { NextConfig } from "next";
 import createNextIntlPlugin from "next-intl/plugin";
 
+const homarrVersion = (() => {
+  for (const candidate of ["../../package.json", "./package.json"]) {
+    try {
+      const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
+      if (pkg.name === "homarr") return pkg.version as string;
+    } catch {}
+  }
+  return "unknown";
+})();
+
 // Package path does not work... so we need to use relative path
 const withNextIntl = createNextIntlPlugin({
   experimental: {
@@ -17,6 +29,9 @@ const withNextIntl = createNextIntlPlugin({
 });
 
 const nextConfig: NextConfig = {
+  env: {
+    HOMARR_VERSION: homarrVersion,
+  },
   output: "standalone",
   reactStrictMode: true,
   // react compiler breaks mantine-react-table, so disabled for now
@@ -27,7 +42,7 @@ const nextConfig: NextConfig = {
    * dockerode is required in the external server packages because of https://github.com/homarr-labs/homarr/issues/612
    * isomorphic-dompurify and jsdom are required, see https://github.com/kkomelin/isomorphic-dompurify/issues/356
    */
-  serverExternalPackages: ["dockerode", "isomorphic-dompurify", "jsdom"],
+  serverExternalPackages: ["dockerode", "isomorphic-dompurify", "jsdom", "better-sqlite3"],
   experimental: {
     optimizePackageImports: ["@mantine/core", "@mantine/hooks", "@tabler/icons-react"],
     turbopackFileSystemCacheForDev: true,

apps/nextjs/package.json

@@ -72,9 +72,13 @@
     "clsx": "catalog:",
     "dayjs": "catalog:",
     "dotenv": "catalog:",
+    "drizzle-orm": "catalog:",
     "flag-icons": "catalog:",
     "glob": "catalog:",
+    "adm-zip": "catalog:",
+    "better-sqlite3": "catalog:",
     "isomorphic-dompurify": "catalog:",
+    "jszip": "catalog:",
     "jotai": "catalog:",
     "mantine-react-table": "catalog:",
     "next": "catalog:",
@@ -85,6 +89,7 @@
     "react-error-boundary": "catalog:",
     "react-simple-code-editor": "catalog:",
     "sass": "catalog:",
+    "sql.js": "catalog:",
     "superjson": "catalog:",
     "swagger-ui-react": "catalog:",
     "use-deep-compare-effect": "catalog:",
@@ -93,6 +98,8 @@
   },
   "devDependencies": {
     "@homarr/tsconfig": "workspace:^0.1.0",
+    "@types/adm-zip": "catalog:",
+    "@types/better-sqlite3": "catalog:",
     "@types/chroma-js": "catalog:",
     "@types/node": "catalog:",
     "@types/prismjs": "catalog:",

apps/nextjs/src/app/[locale]/init/_steps/start/init-start.tsx

@@ -2,13 +2,16 @@ import { Stack, Text } from "@mantine/core";
 import { IconFileImport, IconPlayerPlay } from "@tabler/icons-react";
 
 import { getMantineColor } from "@homarr/common";
+import { dbEnv } from "@homarr/core/infrastructure/db/env";
 import { getScopedI18n } from "@homarr/translation/server";
 
 import { InitStepCard } from "../../_components/init-step-card";
+import { InitSqliteRestore } from "./sqlite-restore";
 import { InitStartButton } from "./next-button";
 
 export const InitStart = async () => {
   const tStart = await getScopedI18n("init.step.start");
+  const isSqlite = dbEnv.DRIVER === "better-sqlite3";
 
   return (
     <InitStepCard>
@@ -27,6 +30,7 @@ export const InitStart = async () => {
         >
           {tStart("action.importOldmarr")}
         </InitStartButton>
+        {isSqlite && <InitSqliteRestore />}
       </Stack>
     </InitStepCard>
   );

apps/nextjs/src/app/[locale]/init/_steps/start/sqlite-restore.tsx

@@ -0,0 +1,43 @@
+"use client";
+
+import { useState } from "react";
+import { Button, Collapse, Stack, Text } from "@mantine/core";
+import { IconDatabaseImport } from "@tabler/icons-react";
+
+import { getMantineColor } from "@homarr/common";
+import { useScopedI18n } from "@homarr/translation/client";
+
+import { DatabaseRestoreFlow } from "~/components/backup";
+
+export const InitSqliteRestore = () => {
+  const t = useScopedI18n("init.step.start.action");
+  const [expanded, setExpanded] = useState(false);
+
+  if (expanded) {
+    return (
+      <Stack gap="sm">
+        <Button
+          variant="subtle"
+          size="xs"
+          onClick={() => setExpanded(false)}
+        >
+          {t("backToOptions")}
+        </Button>
+        <Text size="sm" c="dimmed">
+          {t("restoreSqliteDescription")}
+        </Text>
+        <DatabaseRestoreFlow variant="standalone" />
+      </Stack>
+    );
+  }
+
+  return (
+    <Button
+      onClick={() => setExpanded(true)}
+      variant="default"
+      leftSection={<IconDatabaseImport color={getMantineColor("orange", 6)} size={16} stroke={1.5} />}
+    >
+      {t("restoreSqlite")}
+    </Button>
+  );
+};

apps/nextjs/src/app/[locale]/manage/layout.tsx

@@ -10,6 +10,7 @@ import {
   IconBrandTablerFilled,
   IconCertificate,
   IconClipboardListFilled,
+  IconDatabaseExport,
   IconDirectionsFilled,
   IconGitFork,
   IconHelpSquareRoundedFilled,
@@ -28,6 +29,7 @@ import {
 import { auth } from "@homarr/auth/next";
 import { isProviderEnabled } from "@homarr/auth/server";
 import { createDocumentationLink } from "@homarr/definitions";
+import { dbEnv } from "@homarr/core/infrastructure/db/env";
 import { env } from "@homarr/docker/env";
 import { getScopedI18n } from "@homarr/translation/server";
 
@@ -154,6 +156,12 @@ export default async function ManageLayout({ children }: PropsWithChildren) {
           href: "/manage/tools/tasks",
           hidden: !session?.user.permissions.includes("admin"),
         },
+        {
+          label: t("items.tools.items.backup"),
+          icon: IconDatabaseExport,
+          href: "/manage/tools/backup",
+          hidden: !session?.user.permissions.includes("admin") || dbEnv.DRIVER !== "better-sqlite3",
+        },
       ],
     },
     {

apps/nextjs/src/app/[locale]/manage/tools/backup/_components/backup-export-card.tsx

@@ -0,0 +1,87 @@
+"use client";
+
+import { useState } from "react";
+import { Alert, Button, Card, Group, Stack, Text, Title } from "@mantine/core";
+import { IconAlertTriangle, IconDatabaseExport, IconDownload } from "@tabler/icons-react";
+
+import { useScopedI18n } from "@homarr/translation/client";
+
+import { DangerousActionConfirmation } from "~/components/backup/dangerous-action-confirmation";
+
+export const BackupExportCard = () => {
+  const t = useScopedI18n("management.page.tool.backup.export");
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [showConfirm, setShowConfirm] = useState(false);
+
+  const handleExport = async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const response = await fetch("/api/backup/export");
+      if (!response.ok) {
+        const errorMessage = await response.json().then(
+          (data) => data.error,
+          () => `Server returned ${response.status}`,
+        );
+        throw new Error(errorMessage ?? t("error"));
+      }
+
+      const blob = await response.blob();
+      const url = URL.createObjectURL(blob);
+      const filename = response.headers.get("Content-Disposition")?.match(/filename="(.+)"/)?.[1] ?? "homarr-backup.zip";
+
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = filename;
+      a.click();
+      URL.revokeObjectURL(url);
+      setShowConfirm(false);
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("error"));
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <Card withBorder>
+      <Stack gap="sm">
+        <Group gap="sm">
+          <IconDatabaseExport size={24} />
+          <Title order={4}>{t("title")}</Title>
+        </Group>
+        <Text size="sm" c="dimmed">
+          {t("description")}
+        </Text>
+        {error && (
+          <Alert color="red" icon={<IconAlertTriangle size={16} />}>
+            {error}
+          </Alert>
+        )}
+
+        {showConfirm ? (
+          <DangerousActionConfirmation
+            title={t("confirm.title")}
+            warningTitle={t("confirm.warningTitle")}
+            warningBody={t("confirm.warningBody")}
+            typePrompt={t("confirm.typePrompt", { phrase: "I understand" })}
+            submitLabel={t("confirm.submit")}
+            submitIcon={<IconDownload size={16} />}
+            cancelLabel={t("confirm.cancel")}
+            onConfirm={handleExport}
+            onCancel={() => setShowConfirm(false)}
+            disabled={loading}
+            color="orange"
+          />
+        ) : (
+          <Group>
+            <Button leftSection={<IconDownload size={16} />} loading={loading} onClick={() => setShowConfirm(true)}>
+              {t("button")}
+            </Button>
+          </Group>
+        )}
+      </Stack>
+    </Card>
+  );
+};

apps/nextjs/src/app/[locale]/manage/tools/backup/_components/backup-import-card.tsx

@@ -0,0 +1,27 @@
+"use client";
+
+import { Card, Group, Stack, Text, Title } from "@mantine/core";
+import { IconDatabaseImport } from "@tabler/icons-react";
+
+import { useScopedI18n } from "@homarr/translation/client";
+
+import { DatabaseRestoreFlow } from "~/components/backup";
+
+export const BackupImportCard = () => {
+  const t = useScopedI18n("management.page.tool.backup.import");
+
+  return (
+    <Card withBorder>
+      <Stack gap="md">
+        <Group gap="sm">
+          <IconDatabaseImport size={24} />
+          <Title order={4}>{t("title")}</Title>
+        </Group>
+        <Text size="sm" c="dimmed">
+          {t("description")}
+        </Text>
+        <DatabaseRestoreFlow />
+      </Stack>
+    </Card>
+  );
+};

apps/nextjs/src/app/[locale]/manage/tools/backup/page.tsx

@@ -0,0 +1,40 @@
+import { notFound } from "next/navigation";
+import { Stack, Title } from "@mantine/core";
+
+import { auth } from "@homarr/auth/next";
+import { dbEnv } from "@homarr/core/infrastructure/db/env";
+import { getScopedI18n } from "@homarr/translation/server";
+
+import { createMetaTitle } from "~/metadata";
+import { BackupExportCard } from "./_components/backup-export-card";
+import { BackupImportCard } from "./_components/backup-import-card";
+
+export async function generateMetadata() {
+  const session = await auth();
+  if (!session?.user.permissions.includes("admin") || dbEnv.DRIVER !== "better-sqlite3") {
+    return {};
+  }
+
+  const t = await getScopedI18n("management.page.tool.backup");
+
+  return {
+    title: createMetaTitle(t("metaTitle")),
+  };
+}
+
+export default async function BackupPage() {
+  const session = await auth();
+  if (!session?.user.permissions.includes("admin") || dbEnv.DRIVER !== "better-sqlite3") {
+    notFound();
+  }
+
+  const t = await getScopedI18n("management.page.tool.backup");
+
+  return (
+    <Stack>
+      <Title>{t("title")}</Title>
+      <BackupExportCard />
+      <BackupImportCard />
+    </Stack>
+  );
+}

apps/nextjs/src/app/api/backup/export/route.ts

@@ -0,0 +1,75 @@
+import fs from "fs";
+import path from "path";
+
+import { NextResponse } from "next/server";
+import AdmZip from "adm-zip";
+import Database from "better-sqlite3";
+
+import { auth } from "@homarr/auth/next";
+import { env } from "@homarr/common/env";
+import { dbEnv } from "@homarr/core/infrastructure/db/env";
+
+export async function GET() {
+  const session = await auth();
+  if (!session?.user.permissions.includes("admin")) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+  }
+
+  if (dbEnv.DRIVER !== "better-sqlite3") {
+    return NextResponse.json({ error: "SQLite backup is only available for SQLite databases" }, { status: 400 });
+  }
+
+  const dbPath = dbEnv.URL as string | undefined;
+  if (!dbPath || !fs.existsSync(dbPath)) {
+    return NextResponse.json({ error: "Database file not found" }, { status: 500 });
+  }
+
+  const tempPath = path.join(path.dirname(dbPath), "db.backup.sqlite");
+  let sourceDb: InstanceType<typeof Database> | null = null;
+
+  try {
+    sourceDb = new Database(dbPath, { readonly: true });
+    sourceDb.pragma("wal_checkpoint(TRUNCATE)");
+    sourceDb.exec(`VACUUM INTO '${tempPath}'`);
+    sourceDb.close();
+    sourceDb = null;
+
+    const dbBuffer = fs.readFileSync(tempPath);
+
+    const metadata = {
+      homarrVersion: process.env.HOMARR_VERSION ?? "unknown",
+      exportedAt: new Date().toISOString(),
+      dbDialect: "sqlite",
+      encryptionKey: env.SECRET_ENCRYPTION_KEY,
+    };
+
+    const zip = new AdmZip();
+    zip.addFile("db.sqlite", dbBuffer);
+    zip.addFile("metadata.json", Buffer.from(JSON.stringify(metadata, null, 2)));
+
+    const zipBuffer = zip.toBuffer();
+
+    const date = new Date().toISOString().split("T")[0];
+    const filename = `homarr-backup-${date}.zip`;
+
+    return new NextResponse(zipBuffer, {
+      status: 200,
+      headers: {
+        "Content-Type": "application/zip",
+        "Content-Disposition": `attachment; filename="${filename}"`,
+        "Content-Length": zipBuffer.length.toString(),
+      },
+    });
+  } catch (error) {
+    console.error("[backup/export] Export failed:", error);
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return NextResponse.json({ error: `Export failed: ${message}` }, { status: 500 });
+  } finally {
+    sourceDb?.close();
+    try {
+      if (fs.existsSync(tempPath)) fs.unlinkSync(tempPath);
+    } catch (cleanupErr) {
+      console.error("[backup/export] Failed to clean up temp file:", cleanupErr);
+    }
+  }
+}

apps/nextjs/src/app/api/backup/import/route.ts

@@ -0,0 +1,194 @@
+import crypto from "crypto";
+import fs from "fs";
+import path from "path";
+
+import { NextResponse } from "next/server";
+import AdmZip from "adm-zip";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+
+import { auth } from "@homarr/auth/next";
+import { env } from "@homarr/common/env";
+import { DB_CASING } from "@homarr/core/infrastructure/db/constants";
+import { dbEnv } from "@homarr/core/infrastructure/db/env";
+import { db } from "@homarr/db";
+
+import { findMigrationsFolder } from "../shared";
+
+const REQUIRED_ZIP_ENTRIES = ["db.sqlite", "metadata.json"] as const;
+const ALGORITHM = "aes-256-cbc";
+const HEX_KEY_REGEX = /^[0-9a-fA-F]{64}$/;
+
+const reEncryptSecrets = (tempDb: InstanceType<typeof Database>, importedKeyHex: string) => {
+  const currentKeyHex = env.SECRET_ENCRYPTION_KEY;
+  if (importedKeyHex === currentKeyHex) return;
+
+  if (!HEX_KEY_REGEX.test(importedKeyHex)) {
+    throw new Error("Imported encryption key is not a valid 64-character hex string");
+  }
+
+  const oldKey = Buffer.from(importedKeyHex, "hex");
+  const newKey = Buffer.from(currentKeyHex, "hex");
+
+  const rows = tempDb.prepare('SELECT "integration_id", "kind", "value" FROM "integrationSecret"').all() as {
+    integration_id: string;
+    kind: string;
+    value: string;
+  }[];
+
+  if (rows.length === 0) return;
+
+  const updateStmt = tempDb.prepare('UPDATE "integrationSecret" SET "value" = ? WHERE "integration_id" = ? AND "kind" = ?');
+  const transaction = tempDb.transaction(() => {
+    for (const row of rows) {
+      const parts = row.value.split(".");
+      if (parts.length !== 2) {
+        throw new Error(
+          `Malformed secret value for integration ${row.integration_id} (${row.kind}): expected "data.iv" format`,
+        );
+      }
+      const [data, dataIv] = parts as [string, string];
+
+      try {
+        const iv = Buffer.from(dataIv, "hex");
+        const encrypted = Buffer.from(data, "hex");
+        const decipher = crypto.createDecipheriv(ALGORITHM, oldKey, iv);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]).toString();
+
+        const newIv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv(ALGORITHM, newKey, newIv);
+        const newEncrypted = Buffer.concat([cipher.update(decrypted), cipher.final()]);
+        const newValue = `${newEncrypted.toString("hex")}.${newIv.toString("hex")}`;
+
+        updateStmt.run(newValue, row.integration_id, row.kind);
+      } catch {
+        throw new Error(`Failed to re-encrypt secret for integration ${row.integration_id} (${row.kind})`);
+      }
+    }
+  });
+  transaction();
+};
+
+const isOnboardingActiveAsync = async (): Promise<boolean> => {
+  const onboardingRow = await db.query.onboarding.findFirst();
+  if (!onboardingRow) return false;
+  return onboardingRow.step === "start";
+};
+
+export async function POST(req: Request) {
+  const session = await auth();
+  const isAdmin = session?.user.permissions.includes("admin") ?? false;
+  const isOnboarding = !isAdmin && (await isOnboardingActiveAsync());
+
+  if (!isAdmin && !isOnboarding) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
+  }
+
+  if (dbEnv.DRIVER !== "better-sqlite3") {
+    return NextResponse.json({ error: "SQLite restore is only available for SQLite databases" }, { status: 400 });
+  }
+
+  const dbPath = dbEnv.URL as string | undefined;
+  if (!dbPath) {
+    return NextResponse.json({ error: "Database path not configured" }, { status: 500 });
+  }
+
+  let formData: FormData;
+  try {
+    formData = await req.formData();
+  } catch {
+    return NextResponse.json({ error: "Invalid form data" }, { status: 400 });
+  }
+
+  const file = formData.get("file");
+  if (!(file instanceof File)) {
+    return NextResponse.json({ error: "No file provided" }, { status: 400 });
+  }
+
+  const arrayBuffer = await file.arrayBuffer();
+  let zip: AdmZip;
+  try {
+    zip = new AdmZip(Buffer.from(arrayBuffer));
+  } catch {
+    return NextResponse.json({ error: "Invalid ZIP file" }, { status: 400 });
+  }
+
+  const entries = zip.getEntries().map((e) => e.entryName);
+  const missingEntries = REQUIRED_ZIP_ENTRIES.filter((name) => !entries.includes(name));
+  if (missingEntries.length > 0) {
+    return NextResponse.json({ error: `Invalid backup: missing ${missingEntries.join(", ")}` }, { status: 400 });
+  }
+
+  const migrationsFolder = findMigrationsFolder();
+  if (!migrationsFolder) {
+    return NextResponse.json({ error: "Migration files not found" }, { status: 500 });
+  }
+
+  const tempPath = path.join(path.dirname(dbPath), "db.import.sqlite");
+  let tempDb: InstanceType<typeof Database> | null = null;
+
+  try {
+    const dbEntry = zip.getEntry("db.sqlite")!;
+    fs.writeFileSync(tempPath, dbEntry.getData());
+
+    tempDb = new Database(tempPath);
+    const drizzleDb = drizzle(tempDb, { casing: DB_CASING });
+    migrate(drizzleDb, { migrationsFolder });
+
+    const metadataEntry = zip.getEntry("metadata.json")!;
+    const metadata = JSON.parse(metadataEntry.getData().toString());
+
+    const rawKey = metadata.encryptionKey ?? zip.getEntry("encryption-key.txt")?.getData().toString().trim();
+    const importedKey = typeof rawKey === "string" && rawKey.length > 0 ? rawKey : undefined;
+
+    const secretCount = (
+      tempDb.prepare('SELECT COUNT(*) as count FROM "integrationSecret"').get() as { count: number }
+    ).count;
+
+    if (secretCount > 0 && !importedKey) {
+      throw new Error(
+        "Backup contains integration secrets but no encryption key. " +
+        "Cannot restore without the original SECRET_ENCRYPTION_KEY.",
+      );
+    }
+
+    if (importedKey) {
+      reEncryptSecrets(tempDb, importedKey);
+    }
+
+    tempDb.close();
+    tempDb = null;
+
+    fs.renameSync(tempPath, dbPath);
+
+    for (const suffix of ["-wal", "-shm"] as const) {
+      try {
+        const sidecar = `${dbPath}${suffix}`;
+        if (fs.existsSync(sidecar)) fs.unlinkSync(sidecar);
+      } catch (cleanupErr) {
+        console.error(`Failed to remove ${suffix} file:`, cleanupErr);
+      }
+    }
+
+    setTimeout(() => {
+      console.log("Database restored, restarting server...");
+      process.exit(0);
+    }, 500);
+
+    return NextResponse.json({ success: true, message: "Database restored. Server is restarting..." });
+  } catch (error) {
+    console.error("[backup/import] Restore failed:", error);
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return NextResponse.json({ error: `Restore failed: ${message}` }, { status: 500 });
+  } finally {
+    tempDb?.close();
+    if (fs.existsSync(tempPath)) {
+      try {
+        fs.unlinkSync(tempPath);
+      } catch {
+        // temp file may have been renamed already
+      }
+    }
+  }
+}

apps/nextjs/src/app/api/backup/migrations/route.ts

@@ -0,0 +1,63 @@
+import fs from "fs";
+import path from "path";
+
+import { NextResponse } from "next/server";
+
+import { findMigrationsFolder } from "../shared";
+
+interface JournalEntry {
+  idx: number;
+  version: string;
+  when: number;
+  tag: string;
+  breakpoints: boolean;
+}
+
+interface MigrationFile {
+  idx: number;
+  tag: string;
+  sql: string;
+  when: number;
+}
+
+export async function GET() {
+  try {
+    const migrationsFolder = findMigrationsFolder();
+    if (!migrationsFolder) {
+      return NextResponse.json({ error: "Migration files not found" }, { status: 500 });
+    }
+
+    const journalPath = path.join(migrationsFolder, "meta", "_journal.json");
+    if (!fs.existsSync(journalPath)) {
+      return NextResponse.json({ error: "Migration journal not found" }, { status: 500 });
+    }
+
+    const journal = JSON.parse(fs.readFileSync(journalPath, "utf-8")) as { entries: JournalEntry[] };
+
+    const migrations: MigrationFile[] = [];
+    for (const entry of journal.entries) {
+      const sqlPath = path.join(migrationsFolder, `${entry.tag}.sql`);
+      if (!fs.existsSync(sqlPath)) continue;
+
+      migrations.push({
+        idx: entry.idx,
+        tag: entry.tag,
+        sql: fs.readFileSync(sqlPath, "utf-8"),
+        when: entry.when,
+      });
+    }
+
+    return NextResponse.json(
+      { total: migrations.length, migrations },
+      {
+        headers: {
+          "Cache-Control": "public, max-age=3600",
+        },
+      },
+    );
+  } catch (error) {
+    console.error("[backup/migrations] Failed to read migrations:", error);
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return NextResponse.json({ error: `Failed to read migrations: ${message}` }, { status: 500 });
+  }
+}

apps/nextjs/src/app/api/backup/shared.ts

@@ -0,0 +1,12 @@
+import fs from "fs";
+import path from "path";
+
+const migrationsFolderCandidates = [
+  path.join(process.cwd(), "db/migrations/sqlite"),
+  path.join(process.cwd(), "packages/db/migrations/sqlite"),
+  path.resolve(process.cwd(), "../../db/migrations/sqlite"),
+  "/app/db/migrations/sqlite",
+];
+
+export const findMigrationsFolder = () =>
+  migrationsFolderCandidates.find((candidate) => fs.existsSync(candidate));

apps/nextjs/src/app/api/backup/sql-wasm/route.ts

@@ -0,0 +1,30 @@
+import fs from "fs";
+import path from "path";
+
+import { NextResponse } from "next/server";
+
+const wasmCandidates = [
+  path.join(process.cwd(), "public/sql-wasm.wasm"),
+  path.join(process.cwd(), "apps/nextjs/public/sql-wasm.wasm"),
+  path.resolve(process.cwd(), "../../node_modules/sql.js/dist/sql-wasm.wasm"),
+  path.join(process.cwd(), "node_modules/sql.js/dist/sql-wasm.wasm"),
+];
+
+let cachedWasm: Buffer | null = null;
+
+export async function GET() {
+  if (!cachedWasm) {
+    const found = wasmCandidates.find((p) => fs.existsSync(p));
+    if (!found) {
+      return NextResponse.json({ error: "WASM binary not found" }, { status: 500 });
+    }
+    cachedWasm = fs.readFileSync(found);
+  }
+
+  return new NextResponse(cachedWasm, {
+    headers: {
+      "Content-Type": "application/wasm",
+      "Cache-Control": "public, max-age=31536000, immutable",
+    },
+  });
+}

apps/nextjs/src/app/api/backup/test/backup.spec.ts

@@ -0,0 +1,308 @@
+import crypto from "crypto";
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+import AdmZip from "adm-zip";
+import Database from "better-sqlite3";
+import { drizzle } from "drizzle-orm/better-sqlite3";
+import { migrate } from "drizzle-orm/better-sqlite3/migrator";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { DB_CASING } from "@homarr/core/infrastructure/db/constants";
+
+const ALGORITHM = "aes-256-cbc";
+const MIGRATIONS_FOLDER = "./packages/db/migrations/sqlite";
+
+const generateHexKey = () => crypto.randomBytes(32).toString("hex");
+
+const encryptWithKey = (text: string, keyHex: string): `${string}.${string}` => {
+  const key = Buffer.from(keyHex, "hex");
+  const iv = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  let encrypted = cipher.update(text);
+  encrypted = Buffer.concat([encrypted, cipher.final()]);
+  return `${encrypted.toString("hex")}.${iv.toString("hex")}`;
+};
+
+const decryptWithKey = (value: `${string}.${string}`, keyHex: string): string => {
+  const key = Buffer.from(keyHex, "hex");
+  const [data, dataIv] = value.split(".") as [string, string];
+  const iv = Buffer.from(dataIv, "hex");
+  const encrypted = Buffer.from(data, "hex");
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  let decrypted = decipher.update(encrypted);
+  decrypted = Buffer.concat([decrypted, decipher.final()]);
+  return decrypted.toString();
+};
+
+const createTestDb = (dbPath: string) => {
+  const sqlite = new Database(dbPath);
+  const db = drizzle(sqlite, { casing: DB_CASING });
+  migrate(db, { migrationsFolder: MIGRATIONS_FOLDER });
+  return { db, sqlite };
+};
+
+describe("SQLite backup", () => {
+  let tmpDir: string;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "homarr-backup-test-"));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  describe("export ZIP structure", () => {
+    it("should create a ZIP containing all required entries", () => {
+      const dbPath = path.join(tmpDir, "db.sqlite");
+      const { sqlite } = createTestDb(dbPath);
+
+      const backupPath = path.join(tmpDir, "db.backup.sqlite");
+      sqlite.pragma("wal_checkpoint(TRUNCATE)");
+      sqlite.exec(`VACUUM INTO '${backupPath}'`);
+      sqlite.close();
+
+      const dbBuffer = fs.readFileSync(backupPath);
+      const metadata = {
+        homarrVersion: "test",
+        exportedAt: new Date().toISOString(),
+        dbDialect: "sqlite",
+        encryptionKey: generateHexKey(),
+      };
+
+      const zip = new AdmZip();
+      zip.addFile("db.sqlite", dbBuffer);
+      zip.addFile("metadata.json", Buffer.from(JSON.stringify(metadata)));
+
+      const zipPath = path.join(tmpDir, "backup.zip");
+      zip.writeZip(zipPath);
+
+      const readBack = new AdmZip(zipPath);
+      const entryNames = readBack.getEntries().map((e) => e.entryName).sort();
+      expect(entryNames).toEqual(["db.sqlite", "metadata.json"]);
+
+      const dbEntry = readBack.getEntry("db.sqlite");
+      expect(dbEntry).toBeDefined();
+      expect(dbEntry!.header.size).toBeGreaterThan(0);
+    });
+
+    it("should produce a valid SQLite database in the ZIP", () => {
+      const dbPath = path.join(tmpDir, "db.sqlite");
+      const { sqlite } = createTestDb(dbPath);
+
+      const backupPath = path.join(tmpDir, "db.backup.sqlite");
+      sqlite.exec(`VACUUM INTO '${backupPath}'`);
+      sqlite.close();
+
+      const backupDb = new Database(backupPath, { readonly: true });
+      const tables = backupDb
+        .prepare("SELECT name FROM sqlite_master WHERE type='table' ORDER BY name")
+        .all() as { name: string }[];
+
+      expect(tables.map((t) => t.name)).toContain("board");
+      expect(tables.map((t) => t.name)).toContain("user");
+      expect(tables.map((t) => t.name)).toContain("integrationSecret");
+
+      backupDb.close();
+    });
+  });
+
+  describe("import ZIP validation", () => {
+    it("should detect missing required entries", () => {
+      const zip = new AdmZip();
+      zip.addFile("db.sqlite", Buffer.from("dummy"));
+
+      const entries = zip.getEntries().map((e) => e.entryName);
+      const required = ["db.sqlite", "metadata.json"];
+      const missing = required.filter((name) => !entries.includes(name));
+
+      expect(missing).toEqual(["metadata.json"]);
+    });
+
+    it("should accept valid backup ZIP with all entries", () => {
+      const zip = new AdmZip();
+      zip.addFile("db.sqlite", Buffer.from("dummy"));
+      zip.addFile("metadata.json", Buffer.from(JSON.stringify({ dbDialect: "sqlite", encryptionKey: generateHexKey() })));
+
+      const entries = zip.getEntries().map((e) => e.entryName);
+      const required = ["db.sqlite", "metadata.json"];
+      const missing = required.filter((name) => !entries.includes(name));
+
+      expect(missing).toHaveLength(0);
+    });
+
+    it("should accept legacy backup ZIP with encryption-key.txt", () => {
+      const zip = new AdmZip();
+      zip.addFile("db.sqlite", Buffer.from("dummy"));
+      zip.addFile("encryption-key.txt", Buffer.from(generateHexKey()));
+      zip.addFile("metadata.json", Buffer.from(JSON.stringify({ dbDialect: "sqlite" })));
+
+      const entries = zip.getEntries().map((e) => e.entryName);
+      const required = ["db.sqlite", "metadata.json"];
+      const missing = required.filter((name) => !entries.includes(name));
+
+      expect(missing).toHaveLength(0);
+    });
+  });
+
+  describe("secret re-encryption", () => {
+    it("should re-encrypt secrets from old key to new key", () => {
+      const dbPath = path.join(tmpDir, "db.sqlite");
+      const { sqlite } = createTestDb(dbPath);
+
+      const oldKey = generateHexKey();
+      const newKey = generateHexKey();
+      const plaintext = "my-secret-password";
+
+      const encryptedValue = encryptWithKey(plaintext, oldKey);
+
+      sqlite.exec(`
+        INSERT INTO "integration" ("id", "name", "url", "kind")
+        VALUES ('int-1', 'Test', 'http://test', 'adGuardHome')
+      `);
+      sqlite.exec(`
+        INSERT INTO "integrationSecret" ("integration_id", "kind", "value", "updated_at")
+        VALUES ('int-1', 'apiKey', '${encryptedValue}', ${Math.floor(Date.now() / 1000)})
+      `);
+
+      const decryptedBefore = decryptWithKey(encryptedValue, oldKey);
+      expect(decryptedBefore).toBe(plaintext);
+
+      const oldKeyBuf = Buffer.from(oldKey, "hex");
+      const newKeyBuf = Buffer.from(newKey, "hex");
+
+      const rows = sqlite
+        .prepare('SELECT "integration_id", "kind", "value" FROM "integrationSecret"')
+        .all() as { integration_id: string; kind: string; value: string }[];
+
+      const updateStmt = sqlite.prepare(
+        'UPDATE "integrationSecret" SET "value" = ? WHERE "integration_id" = ? AND "kind" = ?',
+      );
+
+      for (const row of rows) {
+        const [data, dataIv] = row.value.split(".") as [string, string];
+        const iv = Buffer.from(dataIv, "hex");
+        const encrypted = Buffer.from(data, "hex");
+        const decipher = crypto.createDecipheriv(ALGORITHM, oldKeyBuf, iv);
+        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]).toString();
+
+        const newIv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv(ALGORITHM, newKeyBuf, newIv);
+        const newEncrypted = Buffer.concat([cipher.update(decrypted), cipher.final()]);
+        const newValue = `${newEncrypted.toString("hex")}.${newIv.toString("hex")}`;
+
+        updateStmt.run(newValue, row.integration_id, row.kind);
+      }
+
+      const updatedRow = sqlite
+        .prepare('SELECT "value" FROM "integrationSecret" WHERE "integration_id" = ?')
+        .get("int-1") as { value: string };
+
+      const decryptedAfter = decryptWithKey(updatedRow.value as `${string}.${string}`, newKey);
+      expect(decryptedAfter).toBe(plaintext);
+
+      expect(() => decryptWithKey(updatedRow.value as `${string}.${string}`, oldKey)).toThrow();
+
+      sqlite.close();
+    });
+
+    it("should skip re-encryption when keys match", () => {
+      const dbPath = path.join(tmpDir, "db.sqlite");
+      const { sqlite } = createTestDb(dbPath);
+
+      const sameKey = generateHexKey();
+      const plaintext = "my-secret";
+      const encryptedValue = encryptWithKey(plaintext, sameKey);
+
+      sqlite.exec(`
+        INSERT INTO "integration" ("id", "name", "url", "kind")
+        VALUES ('int-1', 'Test', 'http://test', 'adGuardHome')
+      `);
+      sqlite.exec(`
+        INSERT INTO "integrationSecret" ("integration_id", "kind", "value", "updated_at")
+        VALUES ('int-1', 'apiKey', '${encryptedValue}', ${Math.floor(Date.now() / 1000)})
+      `);
+
+      const rowBefore = sqlite
+        .prepare('SELECT "value" FROM "integrationSecret" WHERE "integration_id" = ?')
+        .get("int-1") as { value: string };
+
+      expect(rowBefore.value).toBe(encryptedValue);
+
+      const decrypted = decryptWithKey(rowBefore.value as `${string}.${string}`, sameKey);
+      expect(decrypted).toBe(plaintext);
+
+      sqlite.close();
+    });
+  });
+
+  describe("VACUUM INTO consistency", () => {
+    it("should produce a consistent copy via VACUUM INTO", () => {
+      const dbPath = path.join(tmpDir, "db.sqlite");
+      const { sqlite } = createTestDb(dbPath);
+
+      sqlite.exec(`
+        INSERT INTO "app" ("id", "name", "icon_url")
+        VALUES ('app-1', 'TestApp', 'https://example.com/icon.png')
+      `);
+
+      const backupPath = path.join(tmpDir, "db.vacuum.sqlite");
+      sqlite.pragma("wal_checkpoint(TRUNCATE)");
+      sqlite.exec(`VACUUM INTO '${backupPath}'`);
+
+      const backupDb = new Database(backupPath, { readonly: true });
+      const app = backupDb.prepare('SELECT "name" FROM "app" WHERE "id" = ?').get("app-1") as { name: string } | undefined;
+
+      expect(app).toBeDefined();
+      expect(app!.name).toBe("TestApp");
+
+      backupDb.close();
+      sqlite.close();
+    });
+  });
+
+  describe("migration on imported DB", () => {
+    it("should successfully migrate an imported database", () => {
+      const sourcePath = path.join(tmpDir, "source.sqlite");
+      const { sqlite: sourceDb } = createTestDb(sourcePath);
+
+      sourceDb.exec(`
+        INSERT INTO "board" ("id", "name", "is_public", "primary_color", "secondary_color", "opacity", "item_radius", "background_image_attachment", "background_image_repeat", "background_image_size", "disable_status")
+        VALUES ('board-1', 'TestBoard', 0, '#fa5252', '#fd7e14', 100, 'lg', 'fixed', 'no-repeat', 'cover', 0)
+      `);
+      sourceDb.close();
+
+      const importPath = path.join(tmpDir, "import.sqlite");
+      fs.copyFileSync(sourcePath, importPath);
+
+      const importDb = new Database(importPath);
+      const drizzleDb = drizzle(importDb, { casing: DB_CASING });
+      migrate(drizzleDb, { migrationsFolder: MIGRATIONS_FOLDER });
+
+      const board = importDb.prepare('SELECT "name" FROM "board" WHERE "id" = ?').get("board-1") as { name: string } | undefined;
+      expect(board).toBeDefined();
+      expect(board!.name).toBe("TestBoard");
+
+      importDb.close();
+    });
+  });
+
+  describe("encryption key validation", () => {
+    it("should reject invalid hex keys", () => {
+      const invalidKeys = ["short", "not-hex-at-all-this-is-invalid-key-that-is-sixty-four-char!", ""];
+      const hexKeyRegex = /^[0-9a-fA-F]{64}$/;
+
+      for (const key of invalidKeys) {
+        expect(hexKeyRegex.test(key)).toBe(false);
+      }
+    });
+
+    it("should accept valid 64-char hex keys", () => {
+      const validKey = generateHexKey();
+      const hexKeyRegex = /^[0-9a-fA-F]{64}$/;
+      expect(hexKeyRegex.test(validKey)).toBe(true);
+    });
+  });
+});

apps/nextjs/src/components/backup/backup-preview-panel.tsx

@@ -0,0 +1,114 @@
+"use client";
+
+import { Badge, Group, Paper, Stack, Table, Text, ThemeIcon, Title } from "@mantine/core";
+import { IconCheck, IconDatabase, IconGitBranch } from "@tabler/icons-react";
+
+import { useScopedI18n } from "@homarr/translation/client";
+
+import type { BackupAnalysis } from "./types";
+import { PREVIEW_TABLE_KEYS } from "./types";
+
+interface BackupPreviewPanelProps {
+  analysis: BackupAnalysis;
+}
+
+export const BackupPreviewPanel = ({ analysis }: BackupPreviewPanelProps) => {
+  const t = useScopedI18n("management.page.tool.backup.restore.preview");
+  const exportDate = new Date(analysis.metadata.exportedAt).toLocaleString();
+  const pendingCount = analysis.migrations.pending.length;
+  const hasPendingMigrations = pendingCount > 0;
+
+  return (
+    <Stack gap="md">
+      <Paper p="md" radius="md" withBorder>
+        <Stack gap="sm">
+          <Group gap="sm">
+            <ThemeIcon variant="light" color="blue" size="lg" radius="xl">
+              <IconDatabase size={18} />
+            </ThemeIcon>
+            <div>
+              <Title order={5}>{t("title")}</Title>
+              <Text size="xs" c="dimmed">
+                {t("exported", { date: exportDate })}
+              </Text>
+            </div>
+            <Badge variant="light" color="gray" ml="auto">
+              Homarr {analysis.metadata.homarrVersion}
+            </Badge>
+          </Group>
+
+          <Table striped withTableBorder>
+            <Table.Thead>
+              <Table.Tr>
+                <Table.Th>{t("entity")}</Table.Th>
+                <Table.Th ta="right">{t("count")}</Table.Th>
+              </Table.Tr>
+            </Table.Thead>
+            <Table.Tbody>
+              {PREVIEW_TABLE_KEYS.map((key) => (
+                <Table.Tr key={key}>
+                  <Table.Td>{t(`entities.${key}` as never)}</Table.Td>
+                  <Table.Td ta="right">
+                    <Group gap={4} justify="flex-end">
+                      {(analysis.counts[key] ?? 0) > 0 && (
+                        <IconCheck size={14} color="var(--mantine-color-green-6)" />
+                      )}
+                      <Text size="sm" ff="monospace">{analysis.counts[key] ?? 0}</Text>
+                    </Group>
+                  </Table.Td>
+                </Table.Tr>
+              ))}
+            </Table.Tbody>
+          </Table>
+
+          {analysis.boardNames.length > 0 && (
+            <Group gap="xs" wrap="wrap">
+              <Text size="sm" fw={500}>{t("boards")}:</Text>
+              {analysis.boardNames.map((name) => (
+                <Badge key={name} variant="light" size="sm">{name}</Badge>
+              ))}
+            </Group>
+          )}
+        </Stack>
+      </Paper>
+
+      {hasPendingMigrations && (
+        <Paper p="md" radius="md" withBorder bd="1px solid var(--mantine-color-orange-8)">
+          <Group gap="sm">
+            <ThemeIcon variant="light" color="orange" size="lg" radius="xl">
+              <IconGitBranch size={18} />
+            </ThemeIcon>
+            <div>
+              <Text size="sm" fw={600}>
+                {pendingCount === 1
+                  ? t("migrationsApplied", { count: String(pendingCount) })
+                  : t("migrationsAppliedPlural", { count: String(pendingCount) })}
+              </Text>
+              <Text size="xs" c="dimmed">
+                {pendingCount === 1
+                  ? t("migrationsOlderVersion", { count: String(pendingCount) })
+                  : t("migrationsOlderVersionPlural", { count: String(pendingCount) })}
+              </Text>
+            </div>
+            <Badge variant="light" color="orange" ml="auto">
+              {t("migrationsPending", { count: String(pendingCount) })}
+            </Badge>
+          </Group>
+        </Paper>
+      )}
+
+      {!hasPendingMigrations && (
+        <Paper p="md" radius="md" withBorder>
+          <Group gap="sm">
+            <ThemeIcon variant="light" color="green" size="lg" radius="xl">
+              <IconGitBranch size={18} />
+            </ThemeIcon>
+            <Text size="sm" fw={500} c="dimmed">
+              {t("migrationsUpToDate", { count: String(analysis.migrations.total) })}
+            </Text>
+          </Group>
+        </Paper>
+      )}
+    </Stack>
+  );
+};

apps/nextjs/src/components/backup/dangerous-action-confirmation.tsx

@@ -0,0 +1,91 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { useState } from "react";
+import { Alert, Box, Button, Group, Paper, Stack, Text, TextInput } from "@mantine/core";
+import { IconAlertTriangle, IconShieldExclamation } from "@tabler/icons-react";
+
+const CONFIRMATION_PHRASE = "I understand";
+
+interface DangerousActionConfirmationProps {
+  title: string;
+  warningTitle: string;
+  warningBody: string;
+  typePrompt: string;
+  submitLabel: string;
+  submitIcon: ReactNode;
+  cancelLabel: string;
+  onConfirm: () => void;
+  onCancel: () => void;
+  disabled?: boolean;
+  color?: string;
+}
+
+export const DangerousActionConfirmation = ({
+  title,
+  warningTitle,
+  warningBody,
+  typePrompt,
+  submitLabel,
+  submitIcon,
+  cancelLabel,
+  onConfirm,
+  onCancel,
+  disabled,
+  color = "red",
+}: DangerousActionConfirmationProps) => {
+  const [value, setValue] = useState("");
+  const isMatch = value.trim().toLowerCase() === CONFIRMATION_PHRASE.toLowerCase();
+
+  return (
+    <Paper p="lg" radius="md" withBorder bd={`1px solid var(--mantine-color-${color}-9)`}>
+      <Stack gap="md">
+        <Group gap="sm">
+          <IconShieldExclamation size={24} color={`var(--mantine-color-${color}-6)`} />
+          <Text size="lg" fw={700} c={color}>
+            {title}
+          </Text>
+        </Group>
+
+        <Alert color={color} variant="light" icon={<IconAlertTriangle size={20} />}>
+          <Stack gap={4}>
+            <Text size="sm" fw={600}>{warningTitle}</Text>
+            <Text size="sm">{warningBody}</Text>
+          </Stack>
+        </Alert>
+
+        <Box>
+          <Text size="sm" fw={500} mb={4}>
+            {typePrompt}
+          </Text>
+          <TextInput
+            value={value}
+            onChange={(e) => setValue(e.currentTarget.value)}
+            placeholder={CONFIRMATION_PHRASE}
+            disabled={disabled}
+            styles={{
+              input: {
+                fontFamily: "var(--mantine-font-family-monospace)",
+                borderColor: isMatch ? "var(--mantine-color-green-6)" : undefined,
+              },
+            }}
+          />
+        </Box>
+
+        <Group justify="flex-end">
+          <Button variant="subtle" color="gray" onClick={onCancel} disabled={disabled}>
+            {cancelLabel}
+          </Button>
+          <Button
+            color={color}
+            leftSection={submitIcon}
+            onClick={onConfirm}
+            disabled={!isMatch || disabled}
+          >
+            {submitLabel}
+          </Button>
+        </Group>
+      </Stack>
+    </Paper>
+  );
+};

apps/nextjs/src/components/backup/database-restore-flow.tsx

@@ -0,0 +1,227 @@
+"use client";
+
+import { useCallback, useRef, useState } from "react";
+import { Alert, Button, Group, Loader, rem, Stack, Text } from "@mantine/core";
+import type { FileWithPath } from "@mantine/dropzone";
+import { Dropzone, MIME_TYPES } from "@mantine/dropzone";
+import { IconAlertTriangle, IconArrowRight, IconFileZip, IconUpload, IconX } from "@tabler/icons-react";
+
+import "@mantine/dropzone/styles.css";
+
+import { useScopedI18n } from "@homarr/translation/client";
+
+import type { RestoreStep } from "./types";
+import { BackupPreviewPanel } from "./backup-preview-panel";
+import { MigrationProgressPanel } from "./migration-progress-panel";
+import { RestoreConfirmation } from "./restore-confirmation";
+import { RestoreProgressPanel } from "./restore-progress-panel";
+import { useBackupAnalysis } from "./use-backup-analysis";
+
+interface DatabaseRestoreFlowProps {
+  variant?: "card" | "standalone";
+  onRestoreComplete?: () => void;
+}
+
+export const DatabaseRestoreFlow = ({ variant = "card", onRestoreComplete }: DatabaseRestoreFlowProps) => {
+  const t = useScopedI18n("management.page.tool.backup.restore");
+  const [file, setFile] = useState<FileWithPath | null>(null);
+  const [step, setStep] = useState<RestoreStep>("upload");
+  const [importError, setImportError] = useState<string | null>(null);
+  const apiDoneRef = useRef(false);
+  const animDoneRef = useRef(false);
+  const apiErrorRef = useRef<string | null>(null);
+  const { analysis, loading, error: analysisError, migrationProgress, analyzeFile, reset } = useBackupAnalysis();
+
+  const handleFileDrop = useCallback(
+    (files: FileWithPath[]) => {
+      const droppedFile = files[0];
+      if (!droppedFile) return;
+      setFile(droppedFile);
+      setStep("preview");
+      setImportError(null);
+      void analyzeFile(droppedFile);
+    },
+    [analyzeFile],
+  );
+
+  const handleClear = useCallback(() => {
+    setFile(null);
+    setStep("upload");
+    setImportError(null);
+    apiDoneRef.current = false;
+    animDoneRef.current = false;
+    apiErrorRef.current = null;
+    reset();
+  }, [reset]);
+
+  const tryFinalize = useCallback(() => {
+    if (!apiDoneRef.current) return;
+
+    if (apiErrorRef.current) {
+      setImportError(apiErrorRef.current);
+      setStep("error");
+      return;
+    }
+
+    if (!animDoneRef.current) return;
+    onRestoreComplete?.();
+    window.location.reload();
+  }, [onRestoreComplete]);
+
+  const handleConfirm = useCallback(async () => {
+    if (!file) return;
+    setStep("restoring");
+    setImportError(null);
+    apiDoneRef.current = false;
+    animDoneRef.current = false;
+    apiErrorRef.current = null;
+
+    try {
+      const formData = new FormData();
+      formData.append("file", file);
+      const response = await fetch("/api/backup/import", { method: "POST", body: formData });
+
+      if (!response.ok) {
+        try {
+          const data = await response.json();
+          apiErrorRef.current = data.error ?? t("failed.title");
+        } catch {
+          apiErrorRef.current = `Server returned ${response.status}`;
+        }
+      }
+    } catch {
+      apiErrorRef.current = t("failed.title");
+    } finally {
+      apiDoneRef.current = true;
+      tryFinalize();
+    }
+  }, [file, t, tryFinalize]);
+
+  const handleAnimationComplete = useCallback(() => {
+    animDoneRef.current = true;
+    tryFinalize();
+  }, [tryFinalize]);
+
+  if (step === "upload") {
+    return (
+      <Dropzone
+        onDrop={handleFileDrop}
+        acceptColor="blue.6"
+        rejectColor="red.6"
+        accept={[MIME_TYPES.zip, "application/x-zip-compressed"]}
+        multiple={false}
+        maxSize={1024 * 1024 * 256}
+        radius="md"
+      >
+        <Group justify="center" gap="xl" mih={variant === "standalone" ? 200 : 160} style={{ pointerEvents: "none" }}>
+          <Dropzone.Accept>
+            <IconUpload style={{ width: rem(52), height: rem(52), color: "var(--mantine-color-blue-6)" }} stroke={1.5} />
+          </Dropzone.Accept>
+          <Dropzone.Reject>
+            <IconX style={{ width: rem(52), height: rem(52), color: "var(--mantine-color-red-6)" }} stroke={1.5} />
+          </Dropzone.Reject>
+          <Dropzone.Idle>
+            <IconFileZip style={{ width: rem(52), height: rem(52), color: "var(--mantine-color-dimmed)" }} stroke={1.5} />
+          </Dropzone.Idle>
+          <div>
+            <Text size="xl" inline>
+              {t("dropzone.title")}
+            </Text>
+            <Text size="sm" c="dimmed" inline mt={7}>
+              {t("dropzone.description")}
+            </Text>
+          </div>
+        </Group>
+      </Dropzone>
+    );
+  }
+
+  if (step === "preview") {
+    return (
+      <Stack gap="md">
+        <Group justify="space-between">
+          <Group gap="sm">
+            <IconFileZip size={20} />
+            <div>
+              <Text size="sm" fw={500}>{file?.name}</Text>
+              <Text size="xs" c="dimmed">{file ? `${(file.size / 1024 / 1024).toFixed(2)} MB` : ""}</Text>
+            </div>
+          </Group>
+          <Button variant="subtle" size="xs" onClick={handleClear}>
+            {t("changeFile")}
+          </Button>
+        </Group>
+
+        {loading && migrationProgress && (
+          <MigrationProgressPanel progress={migrationProgress} />
+        )}
+
+        {loading && !migrationProgress && (
+          <Group justify="center" py="xl">
+            <Loader size="sm" />
+            <Text size="sm" c="dimmed">{t("analyzing")}</Text>
+          </Group>
+        )}
+
+        {analysisError && (
+          <Alert color="red" icon={<IconAlertTriangle size={16} />} title={t("analysisError")}>
+            {analysisError}
+          </Alert>
+        )}
+
+        {analysis && (
+          <>
+            <BackupPreviewPanel analysis={analysis} />
+            <Group justify="flex-end">
+              <Button
+                rightSection={<IconArrowRight size={16} />}
+                onClick={() => setStep("confirm")}
+              >
+                {t("continueToRestore")}
+              </Button>
+            </Group>
+          </>
+        )}
+      </Stack>
+    );
+  }
+
+  if (step === "confirm") {
+    return (
+      <Stack gap="md">
+        {analysis && <BackupPreviewPanel analysis={analysis} />}
+        <RestoreConfirmation
+          onConfirm={handleConfirm}
+          onCancel={() => setStep("preview")}
+        />
+      </Stack>
+    );
+  }
+
+  if (step === "restoring") {
+    return (
+      <RestoreProgressPanel
+        active
+        migrations={analysis?.migrations.pending ?? []}
+        onComplete={handleAnimationComplete}
+      />
+    );
+  }
+
+  if (step === "error") {
+    return (
+      <Stack gap="md">
+        <Alert color="red" icon={<IconAlertTriangle size={16} />} title={t("failed.title")} radius="md">
+          <Text size="sm">{importError}</Text>
+        </Alert>
+        <Group>
+          <Button variant="subtle" onClick={handleClear}>
+            {t("tryAgain")}
+          </Button>
+        </Group>
+      </Stack>
+    );
+  }
+
+  return null;
+};

apps/nextjs/src/components/backup/index.ts

@@ -0,0 +1,3 @@
+export { DatabaseRestoreFlow } from "./database-restore-flow";
+export { DangerousActionConfirmation } from "./dangerous-action-confirmation";
+export type { BackupAnalysis, RestoreStep } from "./types";

apps/nextjs/src/components/backup/migration-progress-panel.tsx

@@ -0,0 +1,60 @@
+"use client";
+
+import { Box, Group, Loader, Paper, Stack, Text, ThemeIcon, Timeline } from "@mantine/core";
+import { IconCheck, IconDatabase, IconLoader } from "@tabler/icons-react";
+
+import { useScopedI18n } from "@homarr/translation/client";
+
+import type { MigrationProgress } from "./use-backup-analysis";
+
+interface MigrationProgressPanelProps {
+  progress: MigrationProgress;
+}
+
+export const MigrationProgressPanel = ({ progress }: MigrationProgressPanelProps) => {
+  const t = useScopedI18n("management.page.tool.backup.restore.migration");
+
+  return (
+    <Paper p="md" radius="md" bg="var(--mantine-color-dark-7)">
+      <Stack gap="sm">
+        <Group gap="xs">
+          <ThemeIcon size="sm" variant="light" color="blue" radius="xl">
+            <IconDatabase size={12} />
+          </ThemeIcon>
+          <Text size="sm" fw={600}>
+            {t("title", { current: String(progress.current), total: String(progress.total) })}
+          </Text>
+        </Group>
+
+        <Box pl={4}>
+          <Timeline active={progress.current - 1} bulletSize={20} lineWidth={2} color="blue">
+            {Array.from({ length: progress.total }, (_, i) => {
+              const isDone = i < progress.current - 1 || (i === progress.current - 1 && progress.phase === "done");
+              const isActive = i === progress.current - 1 && progress.phase === "applying";
+
+              return (
+                <Timeline.Item
+                  key={i}
+                  bullet={
+                    isDone ? (
+                      <IconCheck size={12} />
+                    ) : isActive ? (
+                      <Loader size={10} color="white" />
+                    ) : (
+                      <IconLoader size={12} />
+                    )
+                  }
+                  title={
+                    <Text size="xs" ff="monospace" c={isDone ? "dimmed" : isActive ? "white" : "dimmed"}>
+                      {i === progress.current - 1 ? progress.tag : t("migrationLabel", { index: String(i + 1) })}
+                    </Text>
+                  }
+                />
+              );
+            })}
+          </Timeline>
+        </Box>
+      </Stack>
+    </Paper>
+  );
+};

apps/nextjs/src/components/backup/restore-confirmation.tsx

@@ -0,0 +1,32 @@
+"use client";
+
+import { IconDatabaseImport } from "@tabler/icons-react";
+
+import { useScopedI18n } from "@homarr/translation/client";
+
+import { DangerousActionConfirmation } from "./dangerous-action-confirmation";
+
+interface RestoreConfirmationProps {
+  onConfirm: () => void;
+  onCancel: () => void;
+  disabled?: boolean;
+}
+
+export const RestoreConfirmation = ({ onConfirm, onCancel, disabled }: RestoreConfirmationProps) => {
+  const t = useScopedI18n("management.page.tool.backup.restore.confirm");
+
+  return (
+    <DangerousActionConfirmation
+      title={t("title")}
+      warningTitle={t("warningTitle")}
+      warningBody={t("warningBody")}
+      typePrompt={t("typePrompt", { phrase: "I understand" })}
+      submitLabel={t("submit")}
+      submitIcon={<IconDatabaseImport size={16} />}
+      cancelLabel={t("cancel")}
+      onConfirm={onConfirm}
+      onCancel={onCancel}
+      disabled={disabled}
+    />
+  );
+};

apps/nextjs/src/components/backup/restore-progress-panel.tsx

@@ -0,0 +1,159 @@
+"use client";
+
+import { useEffect, useMemo, useState } from "react";
+import { Box, Group, Loader, Paper, Stack, Text, ThemeIcon, Timeline } from "@mantine/core";
+import {
+  IconCheck,
+  IconDatabaseImport,
+  IconFileZip,
+  IconKey,
+  IconLoader,
+  IconRefresh,
+  IconTransform,
+} from "@tabler/icons-react";
+import type { Icon } from "@tabler/icons-react";
+
+import { useScopedI18n } from "@homarr/translation/client";
+
+import type { MigrationFile } from "./types";
+
+const BASE_PHASE_DURATIONS: Record<string, number> = {
+  extracting: 1200,
+  encrypting: 1500,
+  swapping: 800,
+  restarting: 10000,
+};
+
+const MIGRATION_STEP_DURATION = 100;
+
+interface TimelineStep {
+  key: string;
+  label: string;
+  icon: Icon;
+  duration: number;
+}
+
+interface RestoreProgressPanelProps {
+  active: boolean;
+  migrations: MigrationFile[];
+  onComplete?: () => void;
+}
+
+export const RestoreProgressPanel = ({ active, migrations, onComplete }: RestoreProgressPanelProps) => {
+  const t = useScopedI18n("management.page.tool.backup.restore.progress");
+  const [currentStepIdx, setCurrentStepIdx] = useState(-1);
+
+  const steps = useMemo((): TimelineStep[] => {
+    const result: TimelineStep[] = [
+      { key: "extracting", label: t("extracting"), icon: IconFileZip, duration: BASE_PHASE_DURATIONS.extracting! },
+    ];
+
+    if (migrations.length > 0) {
+      for (const migration of migrations) {
+        result.push({
+          key: `migration-${migration.idx}`,
+          label: migration.tag,
+          icon: IconDatabaseImport,
+          duration: MIGRATION_STEP_DURATION,
+        });
+      }
+    } else {
+      result.push({
+        key: "migrating",
+        label: t("migrating"),
+        icon: IconDatabaseImport,
+        duration: 300,
+      });
+    }
+
+    result.push(
+      { key: "encrypting", label: t("encrypting"), icon: IconKey, duration: BASE_PHASE_DURATIONS.encrypting! },
+      { key: "swapping", label: t("swapping"), icon: IconTransform, duration: BASE_PHASE_DURATIONS.swapping! },
+      { key: "restarting", label: t("restarting"), icon: IconRefresh, duration: BASE_PHASE_DURATIONS.restarting! },
+    );
+
+    return result;
+  }, [migrations, t]);
+
+  useEffect(() => {
+    if (!active) return;
+
+    let cancelled = false;
+    const run = async () => {
+      for (let i = 0; i < steps.length; i++) {
+        if (cancelled) return;
+        setCurrentStepIdx(i);
+        await new Promise((r) => setTimeout(r, steps[i]!.duration));
+      }
+      if (!cancelled) {
+        onComplete?.();
+      }
+    };
+
+    void run();
+    return () => { cancelled = true; };
+  }, [active, onComplete, steps]);
+
+  if (!active && currentStepIdx === -1) return null;
+
+  return (
+    <Paper p="lg" radius="md" bg="var(--mantine-color-dark-7)">
+      <Stack gap="md">
+        <Group gap="xs">
+          <Loader size="sm" color="blue" />
+          <Text size="sm" fw={600}>
+            {t("title")}
+          </Text>
+        </Group>
+
+        <Box pl={4}>
+          <Timeline
+            active={currentStepIdx}
+            bulletSize={24}
+            lineWidth={2}
+            color="blue"
+          >
+            {steps.map((step, i) => {
+              const isDone = i < currentStepIdx;
+              const isActive = i === currentStepIdx;
+              const isMigration = step.key.startsWith("migration-");
+
+              return (
+                <Timeline.Item
+                  key={step.key}
+                  bullet={
+                    isDone ? (
+                      <ThemeIcon size={24} radius="xl" color="green" variant="filled">
+                        <IconCheck size={14} />
+                      </ThemeIcon>
+                    ) : isActive ? (
+                      <ThemeIcon size={24} radius="xl" color="blue" variant="filled">
+                        <Loader size={12} color="white" />
+                      </ThemeIcon>
+                    ) : (
+                      <ThemeIcon size={24} radius="xl" color="gray" variant="light">
+                        <IconLoader size={14} />
+                      </ThemeIcon>
+                    )
+                  }
+                >
+                  <Group gap="xs" mt={-4}>
+                    <step.icon size={16} color={isDone ? "var(--mantine-color-green-6)" : isActive ? "var(--mantine-color-blue-5)" : "var(--mantine-color-dimmed)"} />
+                    <Text
+                      size={isMigration ? "xs" : "sm"}
+                      fw={isActive ? 600 : 400}
+                      ff={isMigration ? "monospace" : undefined}
+                      c={isDone ? "green" : isActive ? "white" : "dimmed"}
+                    >
+                      {step.label}
+                    </Text>
+                  </Group>
+                </Timeline.Item>
+              );
+            })}
+          </Timeline>
+        </Box>
+      </Stack>
+    </Paper>
+  );
+};

apps/nextjs/src/components/backup/types.ts

@@ -0,0 +1,30 @@
+export interface BackupMetadata {
+  homarrVersion: string;
+  exportedAt: string;
+  dbDialect: string;
+  encryptionKey?: string;
+}
+
+export interface MigrationFile {
+  idx: number;
+  tag: string;
+  sql: string;
+  when: number;
+}
+
+export interface MigrationStatus {
+  applied: number;
+  pending: MigrationFile[];
+  total: number;
+}
+
+export interface BackupAnalysis {
+  metadata: BackupMetadata;
+  counts: Record<string, number>;
+  boardNames: string[];
+  migrations: MigrationStatus;
+}
+
+export type RestoreStep = "upload" | "preview" | "confirm" | "restoring" | "error";
+
+export const PREVIEW_TABLE_KEYS = ["board", "user", "app", "integration", "item", "media", "search_engine"] as const;

apps/nextjs/src/components/backup/use-backup-analysis.ts

@@ -0,0 +1,187 @@
+"use client";
+
+import { useCallback, useRef, useState } from "react";
+
+import { useScopedI18n } from "@homarr/translation/client";
+
+import type { BackupAnalysis, MigrationFile, MigrationStatus } from "./types";
+import { PREVIEW_TABLE_KEYS } from "./types";
+
+const DRIZZLE_MIGRATIONS_TABLE = "__drizzle_migrations";
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+const getAppliedMigrationCount = (db: any): number => {
+  try {
+    const result = db.exec(`SELECT COUNT(*) FROM "${DRIZZLE_MIGRATIONS_TABLE}"`);
+    return (result[0]?.values[0]?.[0] as number) ?? 0;
+  } catch {
+    return 0;
+  }
+};
+
+const fetchMigrations = async (): Promise<MigrationFile[]> => {
+  const res = await fetch("/api/backup/migrations");
+  if (!res.ok) throw new Error("Failed to fetch migration files from server");
+  const data = await res.json();
+  return data.migrations ?? [];
+};
+
+const countEntities = (db: any): Record<string, number> => {
+  const counts: Record<string, number> = {};
+  for (const key of PREVIEW_TABLE_KEYS) {
+    try {
+      const result = db.exec(`SELECT COUNT(*) FROM "${key}"`);
+      counts[key] = (result[0]?.values[0]?.[0] as number) ?? 0;
+    } catch {
+      counts[key] = 0;
+    }
+  }
+  return counts;
+};
+
+const getBoardNames = (db: any): string[] => {
+  try {
+    const result = db.exec('SELECT "name" FROM "board" ORDER BY "name"');
+    return result[0]?.values.map((row: unknown[]) => row[0] as string) ?? [];
+  } catch {
+    return [];
+  }
+};
+
+export interface MigrationProgress {
+  current: number;
+  total: number;
+  tag: string;
+  phase: "pending" | "applying" | "done" | "error";
+}
+
+export const useBackupAnalysis = () => {
+  const t = useScopedI18n("management.page.tool.backup.restore");
+  const [analysis, setAnalysis] = useState<BackupAnalysis | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [migrationProgress, setMigrationProgress] = useState<MigrationProgress | null>(null);
+  const dbRef = useRef<any>(null);
+
+  const analyzeFile = useCallback(async (file: File) => {
+    setLoading(true);
+    setError(null);
+    setAnalysis(null);
+    setMigrationProgress(null);
+
+    try {
+      const [JSZip, initSqlJs, allMigrations, wasmBinary] = await Promise.all([
+        import("jszip").then((m) => m.default),
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        import("sql.js").then((m: any) => m.default),
+        fetchMigrations(),
+        fetch("/api/backup/sql-wasm").then((r) => {
+          if (!r.ok) throw new Error("Failed to load SQL WASM binary");
+          return r.arrayBuffer();
+        }),
+      ]);
+
+      const arrayBuffer = await file.arrayBuffer();
+      const zip = await JSZip.loadAsync(arrayBuffer);
+
+      const metadataFile = zip.file("metadata.json");
+      if (!metadataFile) throw new Error(t("invalidMissingMetadata"));
+      const dbFile = zip.file("db.sqlite");
+      if (!dbFile) throw new Error(t("invalidMissingDb"));
+
+      const metadata = JSON.parse(await metadataFile.async("string"));
+      const dbBuffer = await dbFile.async("uint8array");
+
+      const SQL = await initSqlJs({ wasmBinary });
+
+      const db = new SQL.Database(dbBuffer);
+      dbRef.current = db;
+
+      try {
+        const appliedCount = getAppliedMigrationCount(db);
+        const pendingMigrations = allMigrations.filter((m) => m.idx >= appliedCount);
+
+        const migrations: MigrationStatus = {
+          applied: appliedCount,
+          pending: pendingMigrations,
+          total: allMigrations.length,
+        };
+
+        if (pendingMigrations.length > 0) {
+          for (let i = 0; i < pendingMigrations.length; i++) {
+            const migration = pendingMigrations[i]!;
+            setMigrationProgress({
+              current: i + 1,
+              total: pendingMigrations.length,
+              tag: migration.tag,
+              phase: "applying",
+            });
+
+            await delay(100);
+
+            try {
+              const statements = migration.sql
+                .split("--> statement-breakpoint")
+                .map((s) => s.trim())
+                .filter(Boolean);
+
+              for (const stmt of statements) {
+                db.run(stmt);
+              }
+
+              db.run(
+                `INSERT INTO "${DRIZZLE_MIGRATIONS_TABLE}" ("hash", "created_at") VALUES (?, ?)`,
+                [migration.tag, Date.now()],
+              );
+            } catch (migrationErr) {
+              setMigrationProgress({
+                current: i + 1,
+                total: pendingMigrations.length,
+                tag: migration.tag,
+                phase: "error",
+              });
+              throw new Error(
+                `Migration ${migration.tag} failed: ${migrationErr instanceof Error ? migrationErr.message : "Unknown error"}`,
+              );
+            }
+
+            setMigrationProgress({
+              current: i + 1,
+              total: pendingMigrations.length,
+              tag: migration.tag,
+              phase: "done",
+            });
+
+            await delay(50);
+          }
+        }
+
+        const counts = countEntities(db);
+        const boardNames = getBoardNames(db);
+
+        setMigrationProgress(null);
+        setAnalysis({ metadata, counts, boardNames, migrations });
+      } finally {
+        db.close();
+        dbRef.current = null;
+      }
+    } catch (err) {
+      setError(err instanceof Error ? err.message : t("analyzeError"));
+    } finally {
+      setLoading(false);
+    }
+  }, [t]);
+
+  const reset = useCallback(() => {
+    if (dbRef.current) {
+      try { dbRef.current.close(); } catch { /* already closed */ }
+      dbRef.current = null;
+    }
+    setAnalysis(null);
+    setError(null);
+    setMigrationProgress(null);
+  }, []);
+
+  return { analysis, loading, error, migrationProgress, analyzeFile, reset };
+};

apps/nextjs/src/react-app-env.d.ts

@@ -2,3 +2,4 @@ declare module "*.png";
 declare module "*.svg";
 declare module "*.jpeg";
 declare module "*.jpg";
+declare module "sql.js";

nginx.conf

@@ -23,7 +23,7 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
-            client_max_body_size 32M;
+            client_max_body_size 256M;
         }
     }
 }

package.json

@@ -78,7 +78,7 @@
     "overrides": {
       "@babel/helpers@<7.26.10": ">=7.29.7",
       "@babel/runtime@<7.26.10": ">=7.29.7",
-      "axios@>=1.0.0 <1.8.2": ">=1.16.1",
+      "axios@>=1.0.0 <1.8.2": ">=1.17.0",
       "brace-expansion@>=2.0.0 <=2.0.1": ">=5.0.6",
       "brace-expansion@>=1.0.0 <=1.1.11": ">=5.0.6",
       "esbuild@<=0.24.2": ">=0.28.0",
@@ -88,13 +88,13 @@
       "nanoid@>=4.0.0 <5.0.9": ">=5.1.11",
       "prismjs@<1.30.0": ">=1.30.0",
       "proxmox-api>undici": "7.24.6",
-      "react-is": "^19.2.6",
+      "react-is": "^19.2.7",
-      "rollup@>=4.0.0 <4.22.4": ">=4.60.4",
+      "rollup@>=4.0.0 <4.22.4": ">=4.61.1",
       "sha.js@<=2.4.11": ">=2.4.12",
       "tar-fs@>=3.0.0 <3.0.9": ">=3.1.2",
       "tar-fs@>=2.0.0 <2.1.3": ">=3.1.2",
       "tmp@<=0.2.3": ">=0.2.7",
-      "vite@>=5.0.0 <=5.4.18": ">=8.0.14"
+      "vite@>=5.0.0 <=5.4.18": ">=8.0.16"
     },
     "patchedDependencies": {
       "@types/node-unifi": "patches/@types__node-unifi.patch",

packages/api/src/router/board.ts

@@ -1604,22 +1604,24 @@ const getFullBoardWithWhereAsync = async (db: Database, where: SQL<unknown>, use
         collapsed: collapseStates.at(0)?.collapsed ?? false,
       }),
     ),
-    items: items.map(({ integrations: itemIntegrations, ...item }) =>
+    items: items
-      parseItem({
+      .map(({ integrations: itemIntegrations, ...item }) =>
-        ...item,
+        parseItem({
-        layouts: item.layouts.map((layout) => ({
+          ...item,
-          xOffset: layout.xOffset,
+          layouts: item.layouts.map((layout) => ({
-          yOffset: layout.yOffset,
+            xOffset: layout.xOffset,
-          width: layout.width,
+            yOffset: layout.yOffset,
-          height: layout.height,
+            width: layout.width,
-          layoutId: layout.layoutId,
+            height: layout.height,
-          sectionId: layout.sectionId,
+            layoutId: layout.layoutId,
-        })),
+            sectionId: layout.sectionId,
-        integrationIds: itemIntegrations.map((item) => item.integration.id),
+          })),
-        advancedOptions: superjson.parse<BoardItemAdvancedOptions>(item.advancedOptions),
+          integrationIds: itemIntegrations.map((item) => item.integration.id),
-        options: superjson.parse<Record<string, unknown>>(item.options),
+          advancedOptions: superjson.parse<BoardItemAdvancedOptions>(item.advancedOptions),
-      }),
+          options: superjson.parse<Record<string, unknown>>(item.options),
-    ),
+        }),
+      )
+      .filter((item) => item !== null),
   };
 };
 
@@ -1635,7 +1637,7 @@ const parseItem = (item: unknown) => {
   const result = outputItemSchema.safeParse(item);
 
   if (!result.success) {
-    throw new Error(result.error.message);
+    return null;
   }
   return result.data;
 };

packages/definitions/src/integration.ts

@@ -364,7 +364,7 @@ export const integrationDefs = {
   },
   truenas: {
     name: "TrueNAS",
-    secretKinds: [["username", "password"]],
+    secretKinds: [["username", "password"], ["apiKey"]],
     iconUrl: "https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons@master/svg/truenas.svg",
     category: ["healthMonitoring"],
     documentationUrl: createDocumentationLink("/docs/integrations/truenas"),

packages/integrations/package.json

@@ -47,12 +47,14 @@
     "timezones-ical-library": "catalog:",
     "tsdav": "catalog:",
     "undici": "catalog:",
+    "ws": "catalog:",
     "xml2js": "catalog:",
     "zod": "catalog:"
   },
   "devDependencies": {
     "@homarr/tsconfig": "workspace:^0.1.0",
     "@types/node-unifi": "catalog:",
+    "@types/ws": "catalog:",
     "@types/xml2js": "catalog:",
     "typescript": "catalog:"
   }

packages/integrations/src/base/integration.ts

@@ -85,6 +85,16 @@ export abstract class Integration {
     return this.createUrl(this.integration.externalUrl ?? this.integration.url, path, queryParams);
   }
 
+  protected webSocketUrl(
+    path: `/${string}`,
+    queryParams?: Record<string, string | Date | number | boolean | null | undefined>,
+  ) {
+    const url = this.url(path, queryParams);
+    // http -> ws, https -> wss
+    url.protocol = url.protocol.replace("http", "ws");
+    return url;
+  }
+
   public async testConnectionAsync(): Promise<TestingResult> {
     try {
       const url = new URL(this.integration.url);

packages/integrations/src/truenas/test/truenas-api.spec.ts

@@ -0,0 +1,79 @@
+import { describe, expect, test } from "vitest";
+
+import { trueNasApis } from "../truenas-api";
+
+describe("trueNasApis descriptors", () => {
+  test("expose the expected endpoints and handshake requirements", () => {
+    expect(trueNasApis.jsonRpc).toMatchObject({
+      kind: "jsonRpc",
+      path: "/api/current",
+      requiresSessionHandshake: false,
+    });
+    expect(trueNasApis.legacy).toMatchObject({
+      kind: "legacy",
+      path: "/websocket",
+      requiresSessionHandshake: true,
+    });
+  });
+});
+
+describe("jsonRpc api", () => {
+  const { buildRequest, matchResponse } = trueNasApis.jsonRpc;
+
+  test("builds a JSON-RPC 2.0 envelope", () => {
+    expect(buildRequest("id-1", "system.info", [])).toStrictEqual({
+      jsonrpc: "2.0",
+      id: "id-1",
+      method: "system.info",
+      params: [],
+    });
+  });
+
+  test("matches a result for the requested id", () => {
+    const result = matchResponse({ jsonrpc: "2.0", id: "id-1", result: true }, "id-1");
+    expect(result).toStrictEqual({ result: true });
+  });
+
+  test("returns the error when the response carries one", () => {
+    const error = { code: -32001, message: "Not authenticated" };
+    expect(matchResponse({ jsonrpc: "2.0", id: "id-1", error }, "id-1")).toStrictEqual({ error });
+  });
+
+  test("ignores responses for a different id", () => {
+    expect(matchResponse({ jsonrpc: "2.0", id: "other", result: true }, "id-1")).toBeUndefined();
+  });
+
+  test("ignores non JSON-RPC messages", () => {
+    expect(matchResponse({ msg: "result", id: "id-1", result: true }, "id-1")).toBeUndefined();
+  });
+});
+
+describe("legacy api", () => {
+  const { buildRequest, matchResponse } = trueNasApis.legacy;
+
+  test("builds a DDP method envelope", () => {
+    expect(buildRequest("id-1", "auth.login", ["user", "pass"])).toStrictEqual({
+      id: "id-1",
+      msg: "method",
+      method: "auth.login",
+      params: ["user", "pass"],
+    });
+  });
+
+  test("matches a result message for the requested id", () => {
+    expect(matchResponse({ msg: "result", id: "id-1", result: false }, "id-1")).toStrictEqual({ result: false });
+  });
+
+  test("returns the error when the result message carries one", () => {
+    const error = { error: 13, reason: "boom" };
+    expect(matchResponse({ msg: "result", id: "id-1", error }, "id-1")).toStrictEqual({ error });
+  });
+
+  test("ignores responses for a different id", () => {
+    expect(matchResponse({ msg: "result", id: "other", result: true }, "id-1")).toBeUndefined();
+  });
+
+  test("ignores non-result messages such as the session handshake", () => {
+    expect(matchResponse({ msg: "connected", session: "abc" }, "id-1")).toBeUndefined();
+  });
+});

packages/integrations/src/truenas/test/truenas-integration.spec.ts

@@ -0,0 +1,264 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+import { IntegrationRequestError } from "../../base/errors/http/integration-request-error";
+import type { IntegrationSecret } from "../../base/types";
+
+const ws = vi.hoisted(() => {
+  const sentPayloads: Record<string, unknown>[] = [];
+  const constructedUrls: string[] = [];
+  // A failure with a `code` emits a coded TLS-style error; without one it mimics a missing endpoint (HTTP 404).
+  const failures: { path: string; code?: string }[] = [];
+  let responder: (method: string, params: unknown[]) => unknown = () => undefined;
+
+  type Listener = (...args: unknown[]) => void;
+
+  class FakeWebSocket {
+    static readonly OPEN = 1;
+    public readyState = FakeWebSocket.OPEN;
+    private readonly listeners: Record<string, Listener[]> = {};
+
+    constructor(url: URL | string) {
+      constructedUrls.push(url.toString());
+      setTimeout(() => {
+        const failure = failures.find((candidate) => url.toString().includes(candidate.path));
+        if (failure) {
+          const error: Error & { code?: string } = new Error(failure.code ?? "Unexpected server response: 404");
+          if (failure.code) error.code = failure.code;
+          this.dispatch("error", error);
+        } else {
+          this.dispatch("open");
+        }
+      }, 0);
+    }
+
+    on(event: string, listener: Listener) {
+      (this.listeners[event] ??= []).push(listener);
+      return this;
+    }
+
+    once(event: string, listener: Listener) {
+      const wrapper: Listener = (...args) => {
+        this.off(event, wrapper);
+        listener(...args);
+      };
+      return this.on(event, wrapper);
+    }
+
+    off(event: string, listener: Listener) {
+      this.listeners[event] = (this.listeners[event] ?? []).filter((candidate) => candidate !== listener);
+      return this;
+    }
+
+    send(raw: string) {
+      const payload = JSON.parse(raw) as Record<string, unknown>;
+      sentPayloads.push(payload);
+
+      if (payload.msg === "connect") {
+        this.respond(JSON.stringify({ msg: "connected", session: "test-session" }));
+        return;
+      }
+
+      const result = responder(payload.method as string, (payload.params as unknown[] | undefined) ?? []);
+      const envelope =
+        payload.jsonrpc === "2.0"
+          ? { jsonrpc: "2.0", id: payload.id, result }
+          : { msg: "result", id: payload.id, result };
+      this.respond(JSON.stringify(envelope));
+    }
+
+    close() {
+      this.readyState = 3;
+    }
+
+    private respond(message: string) {
+      setTimeout(() => this.dispatch("message", message), 0);
+    }
+
+    private dispatch(event: string, ...args: unknown[]) {
+      // `off` replaces the array rather than mutating it, so iterating it directly is safe.
+      for (const listener of this.listeners[event] ?? []) listener(...args);
+    }
+  }
+
+  return {
+    FakeWebSocket,
+    sentPayloads,
+    constructedUrls,
+    failures,
+    setResponder: (fn: (method: string, params: unknown[]) => unknown) => {
+      responder = fn;
+    },
+  };
+});
+
+vi.mock("ws", () => ({ WebSocket: ws.FakeWebSocket }));
+vi.mock("@homarr/core/infrastructure/certificates", () => ({
+  getAllTrustedCertificatesAsync: vi.fn().mockResolvedValue([]),
+  getTrustedCertificateHostnamesAsync: vi.fn().mockResolvedValue([]),
+}));
+vi.mock("@homarr/core/infrastructure/http", () => ({
+  createCustomCheckServerIdentity: () => () => undefined,
+}));
+
+import { TrueNasIntegration } from "../truenas-integration";
+
+const happyResponder = (method: string) => {
+  switch (method) {
+    case "auth.login":
+    case "auth.login_with_api_key":
+      return true;
+    case "system.info":
+      return {
+        version: "TrueNAS-SCALE-24.10",
+        hostname: "nas",
+        physmem: 16_000_000_000,
+        model: "Intel Xeon",
+        uptime_seconds: 3600,
+      };
+    case "reporting.get_data":
+      return [
+        {
+          name: "cpu",
+          identifier: "cpu",
+          aggregations: emptyAggregations(),
+          start: 0,
+          end: 1,
+          legend: [],
+          data: [[1000, 12]],
+        },
+        {
+          name: "memory",
+          identifier: "memory",
+          aggregations: emptyAggregations(),
+          start: 0,
+          end: 1,
+          legend: [],
+          data: [[1000, 8_000_000_000]],
+        },
+        {
+          name: "cputemp",
+          identifier: "cputemp",
+          aggregations: emptyAggregations(),
+          start: 0,
+          end: 1,
+          legend: [],
+          data: [[1000, 45]],
+        },
+      ];
+    case "pool.query":
+      return [{ name: "tank", status: "ONLINE", healthy: true, free: 500, size: 1000, allocated: 500 }];
+    case "interface.query":
+      return [{ id: "eth0", name: "eth0" }];
+    case "reporting.netdata_get_data":
+      return [{ name: "interface", identifier: "eth0", data: [[1000, 100, 200]] }];
+    default:
+      return null;
+  }
+};
+
+const emptyAggregations = () => ({ min: {}, mean: {}, max: {} });
+
+let integrationCounter = 0;
+const createIntegration = (decryptedSecrets: IntegrationSecret[]) =>
+  new TrueNasIntegration({
+    id: `truenas-${(integrationCounter += 1)}`,
+    name: "TrueNAS Test",
+    url: "https://truenas.local",
+    externalUrl: null,
+    decryptedSecrets,
+  });
+
+const credentials: IntegrationSecret[] = [
+  { kind: "username", value: "root" },
+  { kind: "password", value: "secret" },
+];
+
+describe("TrueNasIntegration", () => {
+  beforeEach(() => {
+    ws.sentPayloads.length = 0;
+    ws.constructedUrls.length = 0;
+    ws.failures.length = 0;
+    ws.setResponder(happyResponder);
+  });
+
+  test("fetches and maps system info over the JSON-RPC API", async () => {
+    const integration = createIntegration(credentials);
+
+    const result = await integration.getSystemInfoAsync();
+
+    expect(ws.constructedUrls).toContain("wss://truenas.local/api/current");
+    // JSON-RPC does not use the legacy "connect" session handshake.
+    expect(ws.sentPayloads.some((payload) => payload.msg === "connect")).toBe(false);
+
+    expect(result).toMatchObject({
+      version: "TrueNAS-SCALE-24.10",
+      cpuModelName: "Intel Xeon",
+      cpuTemp: 45,
+      memAvailableInBytes: 16_000_000_000,
+      memUsedInBytes: 8_000_000_000,
+      uptime: 3600,
+      rebootRequired: false,
+      availablePkgUpdates: 0,
+      loadAverage: null,
+      gpu: [],
+      network: { up: 20_000, down: 10_000 },
+      fileSystem: [{ deviceName: "tank", available: "1000", used: "500", percentage: 50 }],
+      smart: [{ deviceName: "tank", healthy: true, overallStatus: "ONLINE", temperature: null }],
+    });
+  });
+
+  test("authenticates with an API key when one is configured", async () => {
+    const integration = createIntegration([{ kind: "apiKey", value: "api-key-123" }]);
+
+    await integration.getSystemInfoAsync();
+
+    const authPayload = ws.sentPayloads.find((payload) => String(payload.method).startsWith("auth."));
+    expect(authPayload).toMatchObject({ method: "auth.login_with_api_key", params: ["api-key-123"] });
+  });
+
+  test("authenticates with username and password when no API key is configured", async () => {
+    const integration = createIntegration(credentials);
+
+    await integration.getSystemInfoAsync();
+
+    const authPayload = ws.sentPayloads.find((payload) => String(payload.method).startsWith("auth."));
+    expect(authPayload).toMatchObject({ method: "auth.login", params: ["root", "secret"] });
+  });
+
+  test("falls back to the legacy websocket API when the JSON-RPC endpoint is unavailable", async () => {
+    ws.failures.push({ path: "/api/current" });
+    const integration = createIntegration(credentials);
+
+    const result = await integration.getSystemInfoAsync();
+
+    expect(ws.constructedUrls).toContain("wss://truenas.local/api/current");
+    expect(ws.constructedUrls).toContain("wss://truenas.local/websocket");
+    // The legacy API requires the "connect" session handshake before authenticating.
+    expect(ws.sentPayloads[0]).toMatchObject({ msg: "connect" });
+    expect(ws.sentPayloads.find((payload) => String(payload.method).startsWith("auth."))).toMatchObject({
+      msg: "method",
+      method: "auth.login",
+    });
+    expect(result.version).toBe("TrueNAS-SCALE-24.10");
+  });
+
+  test("rejects when authentication is not successful", async () => {
+    ws.setResponder((method) => (method.startsWith("auth.") ? false : happyResponder(method)));
+    const integration = createIntegration(credentials);
+
+    await expect(integration.getSystemInfoAsync()).rejects.toThrow();
+  });
+
+  test("surfaces a self-signed certificate as a certificate request error without falling back", async () => {
+    ws.failures.push({ path: "/api/current", code: "DEPTH_ZERO_SELF_SIGNED_CERT" });
+    ws.failures.push({ path: "/websocket", code: "DEPTH_ZERO_SELF_SIGNED_CERT" });
+    const integration = createIntegration(credentials);
+
+    const error = await integration.getSystemInfoAsync().catch((caught: unknown) => caught);
+
+    expect(error).toBeInstanceOf(IntegrationRequestError);
+    expect((error as IntegrationRequestError).cause).toMatchObject({ type: "certificate", reason: "untrusted" });
+    // A certificate failure is endpoint-independent, so the legacy API must not be tried.
+    expect(ws.constructedUrls).not.toContain("wss://truenas.local/websocket");
+  });
+});

packages/integrations/src/truenas/truenas-api.ts

@@ -0,0 +1,50 @@
+export type TrueNasApiKind = "jsonRpc" | "legacy";
+
+export type TrueNasResponse = { result: unknown } | { error: unknown };
+
+export interface TrueNasApi {
+  kind: TrueNasApiKind;
+  /** Websocket path appended to the integration URL. */
+  path: `/${string}`;
+  /** The legacy DDP API requires a "connect" handshake before authentication, the JSON-RPC API does not. */
+  requiresSessionHandshake: boolean;
+  /** Builds the request envelope for a method call. */
+  buildRequest: (id: string, method: string, params: unknown[]) => Record<string, unknown>;
+  /**
+   * Returns the response payload when `message` is the reply to `id`,
+   * otherwise `undefined` so the caller keeps waiting for a later message.
+   */
+  matchResponse: (message: Record<string, unknown>, id: string) => TrueNasResponse | undefined;
+}
+
+/**
+ * JSON-RPC 2.0 API introduced in TrueNAS SCALE 24.10 (Electric Eel) and the
+ * legacy DDP-style websocket API used before it. Both expose the same
+ * middleware methods, so only the transport envelope differs.
+ * @see https://www.truenas.com/docs/api/scale_rest_api.html
+ * @see https://www.truenas.com/docs/api/scale_websocket_api.html#websocket_protocol
+ */
+export const trueNasApis = {
+  jsonRpc: {
+    kind: "jsonRpc",
+    path: "/api/current",
+    requiresSessionHandshake: false,
+    buildRequest: (id: string, method: string, params: unknown[]) => ({ jsonrpc: "2.0", id, method, params }),
+    matchResponse: (message: Record<string, unknown>, id: string) => {
+      if (message.id !== id || message.jsonrpc !== "2.0") return undefined;
+      if (message.error != null) return { error: message.error };
+      return { result: message.result };
+    },
+  },
+  legacy: {
+    kind: "legacy",
+    path: "/websocket",
+    requiresSessionHandshake: true,
+    buildRequest: (id: string, method: string, params: unknown[]) => ({ id, msg: "method", method, params }),
+    matchResponse: (message: Record<string, unknown>, id: string) => {
+      if (message.id !== id || message.msg !== "result") return undefined;
+      if (message.error != null) return { error: message.error };
+      return { result: message.result };
+    },
+  },
+} satisfies Record<TrueNasApiKind, TrueNasApi>;

packages/integrations/src/truenas/truenas-client.ts

@@ -0,0 +1,315 @@
+import type { RawData } from "ws";
+import { WebSocket } from "ws";
+import z from "zod";
+
+import { createId } from "@homarr/common";
+import { matchErrorCode, RequestError, ResponseError } from "@homarr/common/server";
+import {
+  getAllTrustedCertificatesAsync,
+  getTrustedCertificateHostnamesAsync,
+} from "@homarr/core/infrastructure/certificates";
+import { createCustomCheckServerIdentity } from "@homarr/core/infrastructure/http";
+import { createLogger } from "@homarr/core/infrastructure/logs";
+
+import type { IntegrationTestingInput } from "../base/integration";
+import type { TrueNasApi } from "./truenas-api";
+import { trueNasApis } from "./truenas-api";
+
+const logger = createLogger({ module: "trueNasClient" });
+
+const REQUEST_TIMEOUT_MS = 5000;
+
+type CertificateOptions = IntegrationTestingInput["options"];
+
+export type TrueNasCredentials = { apiKey: string } | { username: string; password: string };
+
+/**
+ * Handles talking to a TrueNAS server: opening a websocket with Homarr's
+ * trusted certificates, negotiating the API variant, authenticating, and
+ * sending method requests. Connections are reused across the per-request
+ * integration instances and reconnected transparently when the server drops
+ * an idle socket.
+ */
+export class TrueNasClient {
+  // Keyed by integration id. The value is the in-flight connection promise so concurrent
+  // callers reuse a single socket instead of racing to open duplicates.
+  private static readonly connectionMap = new Map<string, Promise<TrueNasSocket>>();
+  private static readonly apiMap = new Map<string, TrueNasApi>();
+
+  constructor(
+    private readonly id: string,
+    private readonly webSocketUrl: (path: `/${string}`) => URL,
+    private readonly credentials: TrueNasCredentials,
+  ) {}
+
+  /** Sends an authenticated request, reusing the cached connection while it is open. */
+  public async requestAsync(method: string, params: unknown[] = []): Promise<unknown> {
+    const socket = await this.getSocketAsync();
+    return socket.requestAsync(method, params);
+  }
+
+  /**
+   * Opens a connection with the provided certificate options, authenticates,
+   * and closes it. Used by the connection test, which may run with updated
+   * credentials, so any cached connection is dropped and the API re-detected.
+   */
+  public async testAsync(certificate: CertificateOptions): Promise<void> {
+    this.evictConnection();
+    TrueNasClient.apiMap.delete(this.id);
+
+    const socket = await this.openSocketAsync(certificate);
+    try {
+      await this.authenticateAsync(socket);
+    } finally {
+      socket.close();
+    }
+  }
+
+  private getSocketAsync(): Promise<TrueNasSocket> {
+    let connection = TrueNasClient.connectionMap.get(this.id);
+    if (!connection) {
+      connection = this.connectAndAuthenticateAsync();
+      TrueNasClient.connectionMap.set(this.id, connection);
+
+      const evict = () => {
+        if (TrueNasClient.connectionMap.get(this.id) === connection) {
+          TrueNasClient.connectionMap.delete(this.id);
+        }
+      };
+      // Reconnect on the next request once this attempt fails or the server drops the socket.
+      connection.then((socket) => socket.onClose(evict), evict);
+    }
+
+    return connection;
+  }
+
+  private async connectAndAuthenticateAsync(): Promise<TrueNasSocket> {
+    const socket = await this.openSocketAsync(await resolveCertificateOptionsAsync());
+    try {
+      await this.authenticateAsync(socket);
+    } catch (error) {
+      // Never keep an unauthenticated socket, it would be reused without re-authenticating.
+      socket.close();
+      throw error;
+    }
+    return socket;
+  }
+
+  private evictConnection() {
+    const connection = TrueNasClient.connectionMap.get(this.id);
+    if (!connection) return;
+
+    TrueNasClient.connectionMap.delete(this.id);
+    connection.then((socket) => socket.close()).catch(() => undefined);
+  }
+
+  /**
+   * Connects using the JSON-RPC API (TrueNAS 24.10+) when available and falls
+   * back to the legacy websocket API otherwise. A missing JSON-RPC endpoint
+   * surfaces as a plain protocol error; certificate, connection, DNS and
+   * timeout errors are endpoint-independent and are never retried.
+   */
+  private async openSocketAsync(certificate: CertificateOptions): Promise<TrueNasSocket> {
+    const cachedApi = TrueNasClient.apiMap.get(this.id);
+    if (cachedApi) {
+      return openTrueNasSocketAsync(this.webSocketUrl(cachedApi.path), cachedApi, certificate);
+    }
+
+    try {
+      const socket = await openTrueNasSocketAsync(
+        this.webSocketUrl(trueNasApis.jsonRpc.path),
+        trueNasApis.jsonRpc,
+        certificate,
+      );
+      TrueNasClient.apiMap.set(this.id, trueNasApis.jsonRpc);
+      return socket;
+    } catch (error) {
+      if (error instanceof RequestError) throw error;
+
+      logger.debug("JSON-RPC API unavailable, falling back to the legacy websocket API", {
+        error: error instanceof Error ? error.message : undefined,
+      });
+      const socket = await openTrueNasSocketAsync(
+        this.webSocketUrl(trueNasApis.legacy.path),
+        trueNasApis.legacy,
+        certificate,
+      );
+      TrueNasClient.apiMap.set(this.id, trueNasApis.legacy);
+      return socket;
+    }
+  }
+
+  /**
+   * Authenticates with an API key when one is configured, otherwise with the
+   * username and password. Both methods work on either API.
+   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#websocket_protocol
+   */
+  private async authenticateAsync(socket: TrueNasSocket): Promise<void> {
+    const response =
+      "apiKey" in this.credentials
+        ? await socket.requestAsync("auth.login_with_api_key", [this.credentials.apiKey])
+        : await socket.requestAsync("auth.login", [this.credentials.username, this.credentials.password]);
+
+    const success = await z.boolean().parseAsync(response);
+    if (!success) throw new ResponseError({ status: 401 });
+  }
+}
+
+/**
+ * Wraps a single websocket connection and speaks whichever TrueNAS API
+ * ({@link trueNasApis}) was negotiated when it was opened.
+ */
+class TrueNasSocket {
+  constructor(
+    private readonly webSocket: WebSocket,
+    private readonly api: TrueNasApi,
+  ) {}
+
+  public close() {
+    this.webSocket.close();
+  }
+
+  public onClose(listener: () => void) {
+    this.webSocket.once("close", listener);
+  }
+
+  /**
+   * The legacy DDP API requires a "connect" handshake to obtain a session
+   * before any method can be called.
+   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#websocket_protocol
+   */
+  public registerSessionAsync(): Promise<void> {
+    return new Promise((resolve, reject) => {
+      const handler = (raw: RawData) => {
+        const message = parseMessage(raw);
+        if (message?.msg === "connected") {
+          this.webSocket.off("message", handler);
+          resolve();
+        } else if (message?.msg === "failed") {
+          this.webSocket.off("message", handler);
+          reject(new Error("Unable to establish TrueNAS session"));
+        }
+      };
+
+      this.webSocket.on("message", handler);
+      this.webSocket.send(JSON.stringify({ msg: "connect", version: "1", support: ["1"] }));
+    });
+  }
+
+  /**
+   * Sends a method request and resolves with its result. Rejects after
+   * {@link REQUEST_TIMEOUT_MS} when no matching response was received.
+   */
+  public requestAsync(method: string, params: unknown[] = []): Promise<unknown> {
+    return new Promise((resolve, reject) => {
+      const id = createId();
+
+      const cleanup = () => {
+        clearTimeout(timeoutId);
+        this.webSocket.off("message", handler);
+        this.webSocket.off("close", onClose);
+        this.webSocket.off("error", onError);
+      };
+
+      const handler = (raw: RawData) => {
+        const message = parseMessage(raw);
+        if (!message) return;
+
+        const response = this.api.matchResponse(message, id);
+        if (!response) return;
+
+        cleanup();
+        if ("error" in response) {
+          reject(new Error(`TrueNAS method "${method}" failed: ${JSON.stringify(response.error)}`));
+          return;
+        }
+        logger.debug("Received method response", { id, method, api: this.api.kind });
+        resolve(response.result);
+      };
+
+      // A dropped connection would otherwise leave the request hanging until the timeout below.
+      const onClose = () => {
+        cleanup();
+        reject(
+          new RequestError(
+            { type: "connection", reason: "reset", code: "ECONNRESET" },
+            { cause: new Error("Connection closed before a response was received") },
+          ),
+        );
+      };
+      const onError = (error: Error) => {
+        cleanup();
+        reject(error);
+      };
+
+      const timeoutId = setTimeout(() => {
+        cleanup();
+        reject(
+          new RequestError(
+            {
+              type: "timeout",
+              reason: "aborted",
+              code: "ECONNABORTED",
+            },
+            { cause: new Error("Canceled request after 5 seconds") },
+          ),
+        );
+      }, REQUEST_TIMEOUT_MS);
+
+      this.webSocket.on("message", handler);
+      this.webSocket.once("close", onClose);
+      this.webSocket.once("error", onError);
+      logger.debug("Sending method request", { id, method, api: this.api.kind });
+      this.webSocket.send(JSON.stringify(this.api.buildRequest(id, method, params)));
+    });
+  }
+}
+
+/**
+ * Opens a websocket using Homarr's trusted certificates and performs the
+ * session handshake when the API requires it. TLS, connection, DNS and timeout
+ * failures are translated into {@link RequestError}s so the connection test can
+ * offer to trust a self-signed certificate, exactly like the HTTP integrations.
+ */
+const openTrueNasSocketAsync = async (
+  url: URL,
+  api: TrueNasApi,
+  certificate: CertificateOptions,
+): Promise<TrueNasSocket> => {
+  logger.debug("Connecting to TrueNAS websocket", { url: url.toString(), api: api.kind });
+
+  const webSocket = await new Promise<WebSocket>((resolve, reject) => {
+    const socket = new WebSocket(url, {
+      ca: certificate.ca,
+      // The @types/ws contract types this as returning a boolean, but ws forwards it to
+      // tls.connect which uses Node's `Error | undefined` contract that our helper follows.
+      checkServerIdentity: certificate.checkServerIdentity as never,
+    });
+
+    socket.once("open", () => resolve(socket));
+    socket.once("error", (error: Error & { code?: string }) => {
+      const matched = error.code ? matchErrorCode(error.code) : undefined;
+      reject(matched ? new RequestError(matched, { cause: error }) : error);
+    });
+  });
+
+  const socket = new TrueNasSocket(webSocket, api);
+  if (api.requiresSessionHandshake) await socket.registerSessionAsync();
+  return socket;
+};
+
+const resolveCertificateOptionsAsync = async (): Promise<CertificateOptions> => ({
+  ca: await getAllTrustedCertificatesAsync(),
+  checkServerIdentity: createCustomCheckServerIdentity(await getTrustedCertificateHostnamesAsync()),
+});
+
+const parseMessage = (raw: RawData): Record<string, unknown> | undefined => {
+  try {
+    const parsed: unknown = JSON.parse(raw.toString());
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : undefined;
+  } catch {
+    return undefined;
+  }
+};

packages/integrations/src/truenas/truenas-integration.ts

@@ -1,8 +1,6 @@
 import dayjs from "dayjs";
 import z from "zod";
 
-import { createId } from "@homarr/common";
-import { RequestError, ResponseError } from "@homarr/common/server";
 import { createLogger } from "@homarr/core/infrastructure/logs";
 
 import type { IntegrationTestingInput } from "../base/integration";
@@ -10,252 +8,21 @@ import { Integration } from "../base/integration";
 import type { TestingResult } from "../base/test-connection/test-connection-service";
 import type { ISystemHealthMonitoringIntegration } from "../interfaces/health-monitoring/health-monitoring-integration";
 import type { SystemHealthMonitoring } from "../interfaces/health-monitoring/health-monitoring-types";
+import type { TrueNasCredentials } from "./truenas-client";
+import { TrueNasClient } from "./truenas-client";
 
 const logger = createLogger({ module: "trueNasIntegration" });
 
 const NETWORK_MULTIPLIER = 100;
 
 export class TrueNasIntegration extends Integration implements ISystemHealthMonitoringIntegration {
-  private static webSocketMap = new Map<string, WebSocket>();
+  private client?: TrueNasClient;
-
-  private wsUrl() {
-    const url = super.url("/websocket");
-    url.protocol = url.protocol.replace("http", "ws");
-    return url;
-  }
-
-  private get webSocket() {
-    return TrueNasIntegration.webSocketMap.get(this.integration.id) ?? null;
-  }
-
-  protected async testingAsync(_input: IntegrationTestingInput): Promise<TestingResult> {
-    const webSocket = await this.connectWebSocketAsync();
-    await this.registerSessionAsync(webSocket);
-    await this.authenticateWebSocketAsync(webSocket);
-
-    // Remove current socket connection so we can authenticate with updated credentials
-    TrueNasIntegration.webSocketMap.delete(this.integration.id);
 
+  protected async testingAsync(input: IntegrationTestingInput): Promise<TestingResult> {
+    await this.getClient().testAsync(input.options);
     return { success: true };
   }
 
-  /**
-   * TrueNAS API uses WebSocket. This function connects to the socket
-   * and resolves the promise if the connection was successful.
-   * @see https://www.truenas.com/docs/api/scale_websocket_api.html
-   */
-  private async connectWebSocketAsync(): Promise<WebSocket> {
-    logger.debug("Connecting to websocket server", {
-      url: this.wsUrl(),
-    });
-    const webSocket = new WebSocket(this.wsUrl());
-
-    return new Promise((resolve, reject) => {
-      webSocket.onopen = () => {
-        logger.debug("Connected to websocket server", {
-          url: this.wsUrl(),
-        });
-        resolve(webSocket);
-      };
-
-      webSocket.onerror = () => {
-        reject(new Error("Failed to connect"));
-      };
-    });
-  }
-
-  /**
-   * Before authentication, a session must be obtained from the server using the "connect" event.
-   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#websocket_protocol
-   */
-  private async registerSessionAsync(webSocket: WebSocket): Promise<void> {
-    return new Promise((resolve, reject) => {
-      const subscribe = (event: MessageEvent<string>) => {
-        const data = JSON.parse(event.data) as { msg: string };
-        if (data.msg === "connected") {
-          webSocket.removeEventListener("message", subscribe);
-          resolve();
-        } else if (data.msg === "failed") {
-          webSocket.removeEventListener("message", subscribe);
-          reject(new Error("Unable to establish connection"));
-        }
-      };
-
-      webSocket.addEventListener("message", subscribe);
-      webSocket.send(
-        JSON.stringify({
-          msg: "connect",
-          version: "1", // this must be number, not string
-          support: ["1"], // this must be number, not string
-        }),
-      );
-    });
-  }
-
-  /**
-   * After a session was obtained, the session can be authenticated.
-   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#websocket_protocol
-   */
-  private async authenticateWebSocketAsync(webSocket?: WebSocket): Promise<void> {
-    logger.debug("Authenticating with username and password", {
-      url: this.wsUrl(),
-    });
-    const response = await this.requestAsync(
-      "auth.login",
-      [this.getSecretValue("username"), this.getSecretValue("password")],
-      webSocket,
-    );
-    const result = await z.boolean().parseAsync(response);
-    if (!result) throw new ResponseError({ status: 401 });
-    logger.debug("Authenticated successfully with username and password", {
-      url: this.wsUrl(),
-    });
-  }
-
-  private async getPoolsAsync() {
-    logger.debug("Retrieving pools", {
-      url: this.wsUrl(),
-    });
-
-    const response = await this.requestAsync("pool.query", [
-      [],
-      {
-        extra: {
-          is_upgraded: true,
-        },
-      },
-    ]);
-    const result = await poolSchema.parseAsync(response);
-    // Offline / exported pools have null values for allocated, size and free, so we filter them out
-    // See https://github.com/homarr-labs/homarr/issues/5194
-    const activePools = result
-      .map((pool) => {
-        if (pool.allocated !== null && pool.size !== null && pool.free !== null) {
-          return {
-            ...pool,
-            allocated: pool.allocated,
-            size: pool.size,
-            free: pool.free,
-          };
-        }
-
-        return null;
-      })
-      .filter((pool) => pool !== null);
-    logger.debug("Retrieved pools", {
-      url: this.wsUrl(),
-      totalCount: result.length,
-      activeCount: activePools.length,
-    });
-    return activePools;
-  }
-
-  /**
-   * Retrieves data using the reporting method
-   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#reporting
-   */
-  private async getReportingAsync(): Promise<ReportingItem[]> {
-    logger.debug("Retrieving reporting data", {
-      url: this.wsUrl(),
-    });
-
-    const response = await this.requestAsync("reporting.get_data", [
-      [
-        {
-          name: "cpu",
-        },
-        {
-          name: "memory",
-        },
-        {
-          name: "cputemp",
-        },
-      ],
-      {
-        aggregate: true,
-        start: dayjs().add(-5, "minutes").unix(),
-        end: dayjs().unix(),
-      },
-    ]);
-    const result = await z.array(reportingItemSchema).parseAsync(response);
-
-    logger.debug("Retrieved reporting data", {
-      url: this.wsUrl(),
-      count: result.length,
-    });
-    return result;
-  }
-
-  /**
-   * Retrieves a list of all available network interfaces
-   * @see https://www.truenas.com/docs/core/13.0/api/core_websocket_api.html#interface
-   */
-  private async getNetworkInterfacesAsync(): Promise<z.infer<typeof networkInterfaceSchema>> {
-    logger.debug("Retrieving available network-interfaces", {
-      url: this.wsUrl(),
-    });
-
-    const response = await this.requestAsync("interface.query", [
-      [], // no filters
-      {},
-    ]);
-    const result = await networkInterfaceSchema.parseAsync(response);
-
-    logger.debug("Retrieved available network-interfaces", {
-      url: this.wsUrl(),
-      count: result.length,
-    });
-    return result;
-  }
-
-  /**
-   * Retrieves reporting network data of the last 5 minutes
-   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#reporting
-   */
-  private async getReportingNetdataAsync(): Promise<z.infer<typeof reportingNetDataSchema>> {
-    const networkInterfaces = await this.getNetworkInterfacesAsync();
-
-    logger.debug("Retrieving reporting network data", {
-      url: this.wsUrl(),
-    });
-
-    const response = await this.requestAsync("reporting.netdata_get_data", [
-      networkInterfaces.map((networkInterface) => ({
-        name: "interface",
-        identifier: networkInterface.id,
-      })),
-      {
-        start: dayjs().add(-5, "minutes").unix(),
-        end: dayjs().unix(),
-      },
-    ]);
-    const result = await reportingNetDataSchema.parseAsync(response);
-
-    logger.debug("Retrieved reporting-network-data", {
-      url: this.wsUrl(),
-      count: result.length,
-    });
-    return result;
-  }
-
-  /**
-   * Retrieves information about the system
-   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#system
-   */
-  private async getSystemInformationAsync(): Promise<z.infer<typeof systemInfoSchema>> {
-    logger.debug("Retrieving system-information", {
-      url: this.wsUrl(),
-    });
-
-    const response = await this.requestAsync("system.info");
-    const result = await systemInfoSchema.parseAsync(response);
-
-    logger.debug("Retrieved system-information", {
-      url: this.wsUrl(),
-    });
-    return result;
-  }
-
   public async getSystemInfoAsync(): Promise<SystemHealthMonitoring> {
     const systemInformation = await this.getSystemInformationAsync();
     const reporting = await this.getReportingAsync();
@@ -272,7 +39,7 @@ export class TrueNasIntegration extends Integration implements ISystemHealthMoni
 
     return {
       cpuUtilization: cpuData.reduce((acc, item) => acc + (item > 100 ? 0 : item), 0) / cpuData.length,
-      cpuTemp: Math.max(...cpuTempData.filter((_item, i) => i > 0)),
+      cpuTemp: Math.max(...cpuTempData.filter((_item, index) => index > 0)),
       memAvailableInBytes: systemInformation.physmem,
       memUsedInBytes: memoryData[1] ?? 0, // Index 0 is UNIX timestamp, Index 1 is free space in bytes
       fileSystem: datasets.map((dataset) => ({
@@ -301,87 +68,164 @@ export class TrueNasIntegration extends Integration implements ISystemHealthMoni
     };
   }
 
-  /**
+  private getClient(): TrueNasClient {
-   * Send a request through websocket and return response
+    return (this.client ??= this.createClient());
-   * Times out after 5 seconds when no response was received.
-   * @param method json-rpc method to call
-   * @param params array of parameters
-   * @param webSocketOverride override of webSocket, helpful for not storing the connection
-   * @returns result of json-rpc call
-   */
-  private async requestAsync(method: string, params: unknown[] = [], webSocketOverride?: WebSocket) {
-    let webSocket = webSocketOverride ?? this.webSocket;
-    if (webSocket?.readyState !== WebSocket.OPEN) {
-      logger.debug("Connecting to websocket", {
-        url: this.wsUrl(),
-      });
-      // We can only land here with static webSocket
-      webSocket = await this.connectWebSocketAsync();
-      await this.registerSessionAsync(webSocket);
-
-      TrueNasIntegration.webSocketMap.set(this.integration.id, webSocket);
-      await this.authenticateWebSocketAsync();
-    }
-
-    return await new Promise((resolve, reject) => {
-      const id = createId();
-      const handler = (event: MessageEvent<string>) => {
-        const data = JSON.parse(event.data) as Record<string, unknown>;
-        if (data.msg !== "result") return;
-        if (data.id !== id) return;
-
-        clearTimeout(timeoutId);
-        webSocket.removeEventListener("message", handler);
-        logger.debug("Received method response", {
-          id,
-          method,
-          url: this.wsUrl(),
-        });
-        resolve(data.result);
-      };
-      const timeoutId = setTimeout(() => {
-        webSocket.removeEventListener("message", handler);
-        reject(
-          new RequestError(
-            {
-              type: "timeout",
-              reason: "aborted",
-              code: "ECONNABORTED",
-            },
-            { cause: new Error("Canceled request after 5 seconds") },
-          ),
-        );
-      }, 5000);
-
-      webSocket.addEventListener("message", handler);
-
-      logger.debug("Sending method request", {
-        id,
-        method,
-        url: this.wsUrl(),
-      });
-
-      webSocket.send(
-        JSON.stringify({
-          id,
-          msg: "method",
-          method,
-          params,
-        }),
-      );
-    });
   }
 
-  private extractNetworkTrafficData = (data: z.infer<typeof reportingNetDataSchema>, index = 1 | 2) => {
+  private createClient(): TrueNasClient {
+    const credentials: TrueNasCredentials = this.hasSecretValue("apiKey")
+      ? { apiKey: this.getSecretValue("apiKey") }
+      : { username: this.getSecretValue("username"), password: this.getSecretValue("password") };
+
+    return new TrueNasClient(this.integration.id, (path) => this.webSocketUrl(path), credentials);
+  }
+
+  private async requestAsync(method: string, params: unknown[] = []): Promise<unknown> {
+    return this.getClient().requestAsync(method, params);
+  }
+
+  private async getPoolsAsync() {
+    logger.debug("Retrieving pools", { url: this.integration.url });
+
+    const response = await this.requestAsync("pool.query", [
+      [],
+      {
+        extra: {
+          is_upgraded: true,
+        },
+      },
+    ]);
+    const result = await poolSchema.parseAsync(response);
+    // Offline / exported pools have null values for allocated, size and free, so we filter them out
+    // See https://github.com/homarr-labs/homarr/issues/5194
+    const activePools = result
+      .map((pool) => {
+        if (pool.allocated !== null && pool.size !== null && pool.free !== null) {
+          return {
+            ...pool,
+            allocated: pool.allocated,
+            size: pool.size,
+            free: pool.free,
+          };
+        }
+
+        return null;
+      })
+      .filter((pool) => pool !== null);
+    logger.debug("Retrieved pools", {
+      url: this.integration.url,
+      totalCount: result.length,
+      activeCount: activePools.length,
+    });
+    return activePools;
+  }
+
+  /**
+   * Retrieves data using the reporting method
+   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#reporting
+   */
+  private async getReportingAsync(): Promise<ReportingItem[]> {
+    logger.debug("Retrieving reporting data", { url: this.integration.url });
+
+    const response = await this.requestAsync("reporting.get_data", [
+      [
+        {
+          name: "cpu",
+        },
+        {
+          name: "memory",
+        },
+        {
+          name: "cputemp",
+        },
+      ],
+      {
+        aggregate: true,
+        start: dayjs().add(-5, "minutes").unix(),
+        end: dayjs().unix(),
+      },
+    ]);
+    const result = await z.array(reportingItemSchema).parseAsync(response);
+
+    logger.debug("Retrieved reporting data", {
+      url: this.integration.url,
+      count: result.length,
+    });
+    return result;
+  }
+
+  /**
+   * Retrieves a list of all available network interfaces
+   * @see https://www.truenas.com/docs/core/13.0/api/core_websocket_api.html#interface
+   */
+  private async getNetworkInterfacesAsync(): Promise<z.infer<typeof networkInterfaceSchema>> {
+    logger.debug("Retrieving available network-interfaces", { url: this.integration.url });
+
+    const response = await this.requestAsync("interface.query", [
+      [], // no filters
+      {},
+    ]);
+    const result = await networkInterfaceSchema.parseAsync(response);
+
+    logger.debug("Retrieved available network-interfaces", {
+      url: this.integration.url,
+      count: result.length,
+    });
+    return result;
+  }
+
+  /**
+   * Retrieves reporting network data of the last 5 minutes
+   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#reporting
+   */
+  private async getReportingNetdataAsync(): Promise<z.infer<typeof reportingNetDataSchema>> {
+    const networkInterfaces = await this.getNetworkInterfacesAsync();
+
+    logger.debug("Retrieving reporting network data", { url: this.integration.url });
+
+    const response = await this.requestAsync("reporting.netdata_get_data", [
+      networkInterfaces.map((networkInterface) => ({
+        name: "interface",
+        identifier: networkInterface.id,
+      })),
+      {
+        start: dayjs().add(-5, "minutes").unix(),
+        end: dayjs().unix(),
+      },
+    ]);
+    const result = await reportingNetDataSchema.parseAsync(response);
+
+    logger.debug("Retrieved reporting-network-data", {
+      url: this.integration.url,
+      count: result.length,
+    });
+    return result;
+  }
+
+  /**
+   * Retrieves information about the system
+   * @see https://www.truenas.com/docs/api/scale_websocket_api.html#system
+   */
+  private async getSystemInformationAsync(): Promise<z.infer<typeof systemInfoSchema>> {
+    logger.debug("Retrieving system-information", { url: this.integration.url });
+
+    const response = await this.requestAsync("system.info");
+    const result = await systemInfoSchema.parseAsync(response);
+
+    logger.debug("Retrieved system-information", { url: this.integration.url });
+    return result;
+  }
+
+  private extractNetworkTrafficData = (data: z.infer<typeof reportingNetDataSchema>, index: 1 | 2) => {
     return data.reduce((acc, current) => acc + (current.data.at(-1)?.at(index) ?? 0), 0);
   };
 
-  private extractLatestReportingData(data: ReportingItem[], key: ReportingItem["identifier"]) {
+  private extractLatestReportingData(data: ReportingItem[], identifier: ReportingItem["identifier"]) {
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const item = data.find((reportingItem) => reportingItem.identifier === identifier);
-    const dataObject = data.find((item) => item.identifier === key)!;
+    // Reporting rows are [timestamp, ...values] in ascending time order, so the last row is the most recent reading.
-    // TODO: check why the below sorting is done, because right now it compares number[] with number[]?
+    const latest = item?.data.at(-1);
-    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    if (!latest) throw new Error(`TrueNAS returned no "${identifier}" reporting data`);
-    return dataObject.data.sort((item1, item2) => (item1 > item2 ? -1 : 1))[0]!;
+    return latest;
   }
 }
 

packages/translation/src/lang/en.json

@@ -7,7 +7,10 @@
         "description": "To get started, please select how you want to set up your Homarr instance.",
         "action": {
           "scratch": "Start from scratch",
-          "importOldmarr": "Import from Homarr before 1.0"
+          "importOldmarr": "Import from Homarr before 1.0",
+          "restoreSqlite": "Restore from SQLite backup",
+          "restoreSqliteDescription": "Upload a full SQLite database backup from a previous Homarr instance. This will restore all boards, users, apps, integrations, and settings.",
+          "backToOptions": "← Back to setup options"
         }
       },
       "import": {
@@ -3498,7 +3501,8 @@
             "logs": "Logs",
             "api": "API",
             "certificates": "Certificates",
-            "tasks": "Tasks"
+            "tasks": "Tasks",
+            "backup": "Backup"
           }
         },
         "settings": "Settings",
@@ -4038,6 +4042,125 @@
               }
             }
           }
+        },
+        "backup": {
+          "title": "Full Database Backup",
+          "metaTitle": "Backup & Restore",
+          "export": {
+            "title": "Export Database",
+            "description": "Download a full backup of your SQLite database including all settings, users, boards, and encrypted integration secrets. The backup is bundled as a ZIP file with the encryption key and metadata.",
+            "button": "Download Backup",
+            "error": "Export failed",
+            "confirm": {
+              "title": "Sensitive data export",
+              "warningTitle": "This export contains your entire database.",
+              "warningBody": "The backup includes all users, integration secrets (encrypted), API keys, board configurations, and app data. Store the exported file securely and do not share it.",
+              "typePrompt": "Type \"{phrase}\" to continue",
+              "submit": "Export Database",
+              "cancel": "Cancel"
+            }
+          },
+          "import": {
+            "title": "Restore Database",
+            "description": "Upload a previously exported backup ZIP to restore your database. This will replace your entire database. If the backup was created with a different encryption key, secrets will be automatically re-encrypted.",
+            "warning": "Restoring a backup will completely replace your current database and restart the application. This action cannot be undone.",
+            "dropzone": {
+              "title": "Drop your backup ZIP here or click to browse",
+              "description": "Only .zip files from a Homarr SQLite backup are accepted"
+            },
+            "changeFile": "Change file",
+            "button": "Restore Database",
+            "success": {
+              "title": "Restore Complete",
+              "message": "Database has been restored successfully. The application is restarting..."
+            },
+            "error": "Import failed"
+          },
+          "preview": {
+            "title": "Backup Contents",
+            "exported": "Exported {date}",
+            "loading": "Analyzing backup file...",
+            "errorTitle": "Preview Error",
+            "entity": "Entity",
+            "count": "Count",
+            "boards": "Boards",
+            "entities": {
+              "board": "Boards",
+              "user": "Users",
+              "app": "Apps",
+              "integration": "Integrations",
+              "item": "Widgets",
+              "media": "Media",
+              "search_engine": "Search Engines"
+            },
+            "analyzeError": "Failed to analyze backup file",
+            "invalidMissingMetadata": "Invalid backup: missing metadata.json",
+            "invalidMissingDb": "Invalid backup: missing db.sqlite"
+          },
+          "restore": {
+            "dropzone": {
+              "title": "Drop your backup ZIP here",
+              "description": "Accepts .zip files from a Homarr SQLite backup (max 256 MB)"
+            },
+            "analyzing": "Analyzing backup...",
+            "changeFile": "Change file",
+            "continueToRestore": "Continue to restore",
+            "tryAgain": "Try again",
+            "analysisError": "Analysis Error",
+            "preview": {
+              "title": "Backup Contents",
+              "exported": "Exported {date}",
+              "entity": "Entity",
+              "count": "Count",
+              "boards": "Boards",
+              "entities": {
+                "board": "Boards",
+                "user": "Users",
+                "app": "Apps",
+                "integration": "Integrations",
+                "item": "Widgets",
+                "media": "Media",
+                "search_engine": "Search Engines"
+              },
+              "migrationsApplied": "{count} migration applied",
+              "migrationsAppliedPlural": "{count} migrations applied",
+              "migrationsOlderVersion": "This backup was from an older Homarr version. {count} schema migration was applied to bring it up to date.",
+              "migrationsOlderVersionPlural": "This backup was from an older Homarr version. {count} schema migrations were applied to bring it up to date.",
+              "migrationsUpToDate": "Database schema is up to date ({count} migrations applied)",
+              "upToDate": "Up to date",
+              "migrationsPending": "{count} pending"
+            },
+            "migration": {
+              "title": "Applying migrations ({current}/{total})",
+              "migrationLabel": "Migration {index}"
+            },
+            "confirm": {
+              "title": "Destructive action",
+              "warningTitle": "This will permanently replace your entire database.",
+              "warningBody": "All current boards, users, apps, integrations, settings, and sessions will be lost. This action cannot be undone. The application will restart after the restore.",
+              "typePrompt": "Type \"{phrase}\" to continue",
+              "cancel": "Cancel",
+              "submit": "Restore Database"
+            },
+            "progress": {
+              "title": "Restoring database...",
+              "extracting": "Extracting backup archive",
+              "migrating": "Applying database migrations",
+              "encrypting": "Re-encrypting integration secrets",
+              "swapping": "Replacing database file",
+              "restarting": "Restarting server"
+            },
+            "complete": {
+              "title": "Restore Complete",
+              "message": "Database has been restored successfully. The server is restarting — please refresh the page in a few seconds."
+            },
+            "failed": {
+              "title": "Restore Failed"
+            },
+            "invalidMissingMetadata": "Invalid backup: missing metadata.json",
+            "invalidMissingDb": "Invalid backup: missing db.sqlite",
+            "analyzeError": "Failed to analyze backup"
+          }
         }
       },
       "about": {

pnpm-workspace.yaml

@@ -14,25 +14,25 @@ catalog:
   "@dnd-kit/utilities": ^3.2.2
   "@drizzle-team/brocli": ^0.12.0
   "@extractus/feed-extractor": 7.2.1
-  '@gfazioli/mantine-onboarding-tour': ^4.0.1
+  '@gfazioli/mantine-onboarding-tour': ^4.0.4
   "@gitbeaker/rest": ^43.8.0
   "@homarr/gridstack": ^1.12.0
   "@homarr/node-unifi": ^2.6.0
   "@immich/sdk": ^2.7.5
   "@jellyfin/sdk": ^0.13.0
   "@kubernetes/client-node": ^1.4.0
-  "@mantine/charts": ^9.2.2
+  "@mantine/charts": ^9.3.0
-  "@mantine/colors-generator": ^9.2.2
+  "@mantine/colors-generator": ^9.3.0
-  "@mantine/core": ^9.2.2
+  "@mantine/core": ^9.3.0
-  "@mantine/dates": ^9.2.2
+  "@mantine/dates": ^9.3.0
-  "@mantine/dropzone": ^9.2.2
+  "@mantine/dropzone": ^9.3.0
-  "@mantine/form": ^9.2.2
+  "@mantine/form": ^9.3.0
-  "@mantine/hooks": ^9.2.2
+  "@mantine/hooks": ^9.3.0
-  "@mantine/modals": ^9.2.2
+  "@mantine/modals": ^9.3.0
-  "@mantine/notifications": ^9.2.2
+  "@mantine/notifications": ^9.3.0
-  "@mantine/spotlight": ^9.2.2
+  "@mantine/spotlight": ^9.3.0
-  "@mantine/tiptap": ^9.2.2
+  "@mantine/tiptap": ^9.3.0
-  "@next/eslint-plugin-next": 16.2.6
+  "@next/eslint-plugin-next": 16.2.7
   "@octokit/auth-app": ^8.2.0
   "@paralleldrive/cuid2": ^3.3.0
   "@playwright/test": ^1.60.0
@@ -44,28 +44,28 @@ catalog:
   "@semantic-release/release-notes-generator": ^14.1.1
   "@t3-oss/env-nextjs": ^0.13.11
   "@tabler/icons-react": ^3.44.0
-  "@tanstack/react-query": ^5.100.14
+  "@tanstack/react-query": ^5.101.0
-  "@tanstack/react-query-devtools": ^5.100.14
+  "@tanstack/react-query-devtools": ^5.101.0
-  "@tanstack/react-query-next-experimental": ^5.100.14
+  "@tanstack/react-query-next-experimental": ^5.101.0
   "@testcontainers/mysql": ^12.0.1
   "@testcontainers/postgresql": ^12.0.1
   "@testcontainers/redis": ^12.0.1
-  "@tiptap/extension-color": 3.24.0
+  "@tiptap/extension-color": 3.25.0
-  "@tiptap/extension-highlight": 3.24.0
+  "@tiptap/extension-highlight": 3.25.0
-  "@tiptap/extension-image": 3.24.0
+  "@tiptap/extension-image": 3.25.0
-  "@tiptap/extension-link": ^3.24.0
+  "@tiptap/extension-link": ^3.25.0
-  "@tiptap/extension-placeholder": ^3.24.0
+  "@tiptap/extension-placeholder": ^3.25.0
-  "@tiptap/extension-table": 3.24.0
+  "@tiptap/extension-table": 3.25.0
-  "@tiptap/extension-table-cell": 3.24.0
+  "@tiptap/extension-table-cell": 3.25.0
-  "@tiptap/extension-table-header": 3.24.0
+  "@tiptap/extension-table-header": 3.25.0
-  "@tiptap/extension-table-row": 3.24.0
+  "@tiptap/extension-table-row": 3.25.0
-  "@tiptap/extension-task-item": 3.24.0
+  "@tiptap/extension-task-item": 3.25.0
-  "@tiptap/extension-task-list": 3.24.0
+  "@tiptap/extension-task-list": 3.25.0
-  "@tiptap/extension-text-align": 3.24.0
+  "@tiptap/extension-text-align": 3.25.0
-  "@tiptap/extension-text-style": 3.24.0
+  "@tiptap/extension-text-style": 3.25.0
-  "@tiptap/extension-underline": 3.24.0
+  "@tiptap/extension-underline": 3.25.0
-  "@tiptap/react": ^3.24.0
+  "@tiptap/react": ^3.25.0
-  "@tiptap/starter-kit": ^3.24.0
+  "@tiptap/starter-kit": ^3.25.0
   "@trpc/client": ^11.17.0
   "@trpc/next": ^11.17.0
   "@trpc/react-query": ^11.17.0
@@ -84,7 +84,7 @@ catalog:
   "@types/node-unifi": ^2.5.1
   "@types/pg": ^8.20.0
   "@types/prismjs": ^1.26.6
-  "@types/react": 19.2.15
+  "@types/react": 19.2.16
   "@types/react-dom": 19.2.3
   "@types/swagger-ui-react": ^5.18.0
   "@types/video.js": ^7.3.58
@@ -92,12 +92,14 @@ catalog:
   "@types/xml2js": ^0.4.14
   "@umami/node": ^0.4.0
   "@vitejs/plugin-react": ^5.2.0
-  "@vitest/coverage-v8": ^4.1.7
+  "@vitest/coverage-v8": ^4.1.8
-  "@vitest/ui": ^4.1.7
+  "@vitest/ui": ^4.1.8
   "@xterm/addon-canvas": ^0.7.0
   "@xterm/addon-fit": 0.11.0
   "@xterm/xterm": ^6.0.0
   adm-zip: 0.5.17
+  jszip: ^3.10.1
+  sql.js: ^1.12.0
   babel-plugin-react-compiler: ^1.0.0
   bcrypt: ^6.0.0
   better-sqlite3: ^12.10.0
@@ -126,7 +128,7 @@ catalog:
   glob: ^13.0.6
   ical.js: ^2.2.1
   ioredis: 5.11.0
-  isomorphic-dompurify: ^3.15.0
+  isomorphic-dompurify: ^3.16.0
   jotai: ^2.20.0
   jsdom: ^29.1.1
   json5: ^2.2.3
@@ -135,19 +137,19 @@ catalog:
   mantine-react-table: npm:mantine-react-table-open@9.0.3
   maria2: ^0.4.1
   mysql2: 3.22.4
-  next: 16.2.6
+  next: 16.2.7
   next-auth: 5.0.0-beta.31
   next-intl: 4.13.0
   node-loader: ^2.1.0
   octokit: ^5.0.5
-  oxfmt: ^0.52.0
+  oxfmt: ^0.53.0
   oxlint: ^1.67.0
   pg: ^8.21.0
   postcss-preset-mantine: ^1.18.0
   prismjs: ^1.30.0
   proxmox-api: 1.1.1
-  react: 19.2.6
+  react: 19.2.7
-  react-dom: 19.2.6
+  react-dom: 19.2.7
   react-error-boundary: ^6.1.2
   react-markdown: ^10.1.0
   react-quill-new: ^3.8.3
@@ -155,7 +157,7 @@ catalog:
   recharts: ^3.8.1
   sass: ^1.100.0
   semantic-release: ^25.0.3
-  semver-parser: ^4.2.0
+  semver-parser: ^4.2.1
   superjson: 2.2.6
   svgson: ^5.3.1
   swagger-ui-react: ^5.32.6
@@ -170,7 +172,7 @@ catalog:
   use-deep-compare-effect: ^1.8.1
   video.js: ^8.23.7
   vite-tsconfig-paths: ^6.1.1
-  vitest: ^4.1.7
+  vitest: ^4.1.8
   winston: 3.19.0
   ws: ^8.21.0
   xml2js: ^0.6.2

scripts/run.sh

@@ -10,8 +10,11 @@ if [ "$DB_MIGRATIONS_DISABLED" = "true" ]; then
   echo "DB migrations are disabled, skipping"
 else
     echo "Running DB migrations"
-    # We disable redis logs during migration as the redis client is not yet started
     DISABLE_REDIS_LOGS=true node ./db/migrations/$DB_DIALECT/migrate.cjs ./db/migrations/$DB_DIALECT
+    if [ $? -ne 0 ]; then
+        echo "ERROR: DB migrations failed, aborting startup"
+        exit 1
+    fi
 fi
 
 # Auth secret is generated every time the container starts as it is required, but not used because we don't need JWTs or Mail hashing
@@ -36,26 +39,38 @@ else
     REDIS_PID=$!
 fi
 
-node apps/nextjs/server.js &
+SHUTTING_DOWN=false
-NEXTJS_PID=$!
 
-# Function to handle SIGTERM and shut down services
 terminate() {
-    echo "Received SIGTERM. Shutting down..."
+    SHUTTING_DOWN=true
-    kill -TERM $NGINX_PID $NEXTJS_PID 2>/dev/null
+    echo "Shutting down..."
-    wait
+    kill -TERM $NEXTJS_PID 2>/dev/null
-    # kill redis-server last because of logging of other services and only if $REDIS_PID is set
+    wait $NEXTJS_PID 2>/dev/null
+    kill -TERM $NGINX_PID 2>/dev/null
+    wait $NGINX_PID 2>/dev/null
     if [ -n "$REDIS_PID" ]; then
         kill -TERM $REDIS_PID 2>/dev/null
-        wait
+        wait $REDIS_PID 2>/dev/null
     fi
     echo "Shutdown complete."
     exit 0
 }
 
-# When SIGTERM (docker stop <container>) / SIGINT (ctrl+c) is received, run the terminate function
 trap terminate TERM INT
 
-# Wait for all processes
+node apps/nextjs/server.js &
-wait $NEXTJS_PID
+NEXTJS_PID=$!
-terminate
+
+while true; do
+    wait $NEXTJS_PID
+    EXIT_CODE=$?
+
+    if [ "$SHUTTING_DOWN" = true ]; then
+        break
+    fi
+
+    echo "Next.js exited with code $EXIT_CODE, restarting in 1s..."
+    sleep 1
+    node apps/nextjs/server.js &
+    NEXTJS_PID=$!
+done