1018 changed files with 28445 additions and 48508 deletions
--- a/.claude/scheduled_tasks.lock
+++ b/.claude/scheduled_tasks.lock
@ -1 +0,0 @@
-{"sessionId":"9cea077c-56da-4223-a765-be38c688106b","pid":1384,"procStart":"1332","acquiredAt":1780168110981}
--- a/.gitattributes
+++ b/.gitattributes
@ -1,10 +0,0 @@
-# Paths excluded from release tarballs. `git archive` (used by
-# scripts/release/make_release.sh) honours `export-ignore`, so these dev-only
-# trees never ship in libreportal-<ver>.tar.gz.
-scripts/unused    export-ignore
-scripts/release   export-ignore
-site              export-ignore
-docs              export-ignore
-.claude           export-ignore
-.gitignore        export-ignore
-.gitattributes    export-ignore
--- a/.gitignore
+++ b/.gitignore
@ -10,14 +10,3 @@
 # Node dependencies — installed via `npm ci` at image build, never vendored.
 node_modules/
 npm-debug.log*
-
-# Release build output (scripts/release/make_release.sh).
-/dist/
-
-# Eleventy site build output + generator-produced data (scripts/gen-data.mjs).
-# site/ is the legacy website location (active site now lives in
-# containers/weblibreportal); these are build artifacts, not source.
-site/dist/
-site/src/_data/apps.json
-site/src/_data/categories.json
-
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -1,19 +0,0 @@
-# LibrePortal — agent notes
-
-## Verify WebUI changes visually before marking them done
-After changing anything user-visible in the WebUI (`containers/libreportal/frontend/`),
-confirm it actually renders correctly — syntax checks and type-correctness don't
-catch layout or visual regressions.
-
-The maintainer's dev environment provides a headless screenshot helper, `lp-shot`,
-that captures a WebUI route (or a single element, via a trailing CSS selector) to a
-PNG for review:
-
-```
-lp-shot /admin/system                       # full route -> /tmp/webui-shot.png
-lp-shot /admin/system /tmp/x.png 12 ".sys-strip"   # just one element, crisp
-```
-
-Use it (and read the PNG) to self-check UI work instead of assuming it looks right or
-asking the user to look. Skip it for purely backend/non-visual edits. If `lp-shot`
-isn't present, fall back to asking the user for a screenshot.
--- a/docs/contributing/contributing.md
+++ b/docs/contributing/contributing.md
--- a/docs/guide/promise.md
+++ b/docs/guide/promise.md
@ -7,7 +7,7 @@ to you — in plain language, so you can hold us to it.

 You can **run, study, modify, share, and fully use 100% of LibrePortal —
 every feature — for free, forever.** The entire platform is licensed under
-the GNU AGPLv3 (see [LICENSE](../../LICENSE)). There are **no feature paywalls in
+the GNU AGPLv3 (see [LICENSE](LICENSE)). There are **no feature paywalls in
 the software, no crippled "community edition," and no telemetry** phoning
 home.

--- a/README.md
+++ b/README.md
@ -21,7 +21,7 @@ toggle — it's the whole point.

 The entire platform is **free software under the [GNU AGPLv3](LICENSE)**.
 Self-host it and you get **everything** — every feature, no paywalls, no
-telemetry. See [our Promise](docs/guide/promise.md) for exactly what that means.
+telemetry. See [our Promise](PROMISE.md) for exactly what that means.

 ## What you get

@ -34,22 +34,11 @@ telemetry. See [our Promise](docs/guide/promise.md) for exactly what that means.
 ## Quick start

 ```bash
-curl -fsSL https://get.libreportal.org/install.sh | sudo bash
+git clone https://gitea.scottwebstar.co.uk/Webstar/LibrePortal.git
+cd LibrePortal
+./init.sh
 ```

-This installs a versioned, checksum-verified release (Debian/Ubuntu, root). Put
-data on separate disks with `--system-dir=` / `--containers-dir=` / `--backups-dir=`.
-
-> The `get.libreportal.org` host is still being set up — until it's live, build a
-> release and install from it locally (see the docs below).
-
-## Documentation
-
- **[docs/guide/install-and-use.md](docs/guide/install-and-use.md)** — install, place data on separate disks/drives,
-  update, back up, uninstall.
- **[docs/contributing/development.md](docs/contributing/development.md)** — run a dev copy, cut stable/edge
-  releases, and test them before publishing.
-
 ## LibrePortal Connect (optional)

 Self-hosting is free and complete. If you'd rather not fiddle with the tricky
@ -59,11 +48,11 @@ different: we work like a **courier carrying a sealed box.** We move your data
 between your devices and store backup copies, but it stays locked and *you*
 hold the only key — we can't open it, and we never run your apps for you.
 **Everything we offer, you can also set up yourself for free.**
-[Our Promise](docs/guide/promise.md) spells out exactly where that line sits.
+[Our Promise](PROMISE.md) spells out exactly where that line sits.

 ## Contributing

-PRs welcome — see [CONTRIBUTING.md](docs/contributing/contributing.md). We use a lightweight
+PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). We use a lightweight
 DCO sign-off (`git commit -s`), no CLA.

 ## Acknowledgments
--- a/configs/backup/.category
+++ b/configs/backup/.category
@ -2,4 +2,4 @@ TITLE=Backup
 DESCRIPTION=Backup schedules, retention, and engine settings
 ICON=backup
 ORDER=3
-SUBCATEGORY_ORDER=backup_general,backup_retention,backup_engine
+SUBCATEGORY_ORDER=backup_general,backup_retention,backup_advanced
--- a/configs/backup/backup_advanced
+++ b/configs/backup/backup_advanced
@ -1,10 +1,8 @@
 # ================================================================================
-# Backup Engine - **ADVANCED** Engine-level knobs most users won't need to touch
-# @icon ⚙️
+# Backup Advanced - **ADVANCED** Engine-level knobs most users won't need to touch
 # ================================================================================
-CFG_BACKUP_ENGINE=restic                                       # Default Backup Engine - Fallback engine for new locations (each location can override) [restic:Restic|borg:BorgBackup|kopia:Kopia]
-CFG_BACKUP_DEFAULT_PATH=                                        # Default Backup Location - Base directory for locations set to Automatic path mode; each location lives in its own numbered subfolder (<path>/<id>). Empty = the LibrePortal backups root (own mount-able).
-CFG_BACKUP_STRATEGY=auto                                       # Backup Strategy - How containers are quiesced before snapshotting [auto:Automatic — live where safe, stop otherwise (recommended)|stop-snapshot-start:Stop → snapshot → start (always safe)|pause-snapshot-unpause:Pause → snapshot → unpause (less downtime)|live:Live — snapshot while running (force)]
+CFG_BACKUP_ENGINE=restic                                       # Default Backup Engine - Fallback engine for new locations (each location can override) [restic:restic|borg:BorgBackup|kopia:Kopia]
+CFG_BACKUP_STRATEGY=stop-snapshot-start                        # Backup Strategy - How containers are quiesced before snapshotting [stop-snapshot-start:Stop → snapshot → start (safe default)|pause-snapshot-unpause:Pause → snapshot → unpause (less downtime)|live:Live — snapshot while running (only with DB dump hooks)]
 CFG_BACKUP_VERIFY_AFTER=true                                   # Verify After Backup - Run integrity check after each backup
 CFG_BACKUP_VERIFY_DATA_PERCENT=5                               # Verify Data Sample % - Percentage of repo data to checksum-verify weekly
 CFG_BACKUP_PARALLEL_REPOS=true                                 # Parallel Repos - Push to all enabled locations in parallel
--- a/configs/backup/backup_general
+++ b/configs/backup/backup_general
@ -1,5 +1,5 @@
 # ================================================================================
 # Backup General - Scheduling
-# @icon 💾
 # ================================================================================
 CFG_BACKUP_CRONTAB_APP="0 5 * * *"                             # App Backup Schedule - Crontab schedule for application backups
+CFG_BACKUP_CRONTAB_APP_INTERVAL=3                              # App Backup Interval - Minutes between app backup checks
--- a/configs/backup/backup_retention
+++ b/configs/backup/backup_retention
@ -1,6 +1,5 @@
 # ================================================================================
 # Backup Retention - Default retention policy applied at every forget pass.
-# @icon 🗓️
 # Per-location overrides supported via the Locations edit modal.
 #
 # Most users should pick a "Backup style" preset on the Schedule page rather
--- a/configs/backup/locations/1/location.config
+++ b/configs/backup/locations/1/location.config
@ -2,23 +2,23 @@
 # Edit via the Locations page on /backup, or directly here.
 CFG_BACKUP_LOC_1_NAME="Local disk"                              # Location Name - Friendly label shown in the UI
 CFG_BACKUP_LOC_1_ENABLED=true                                   # Enabled - Snapshot to this location
-CFG_BACKUP_LOC_1_ENGINE=restic                                  # Engine - Backup engine used at this location [restic:Restic|borg:BorgBackup|kopia:Kopia] **ADVANCED**
+CFG_BACKUP_LOC_1_ENGINE=restic                                  # Engine - Backup engine used at this location [restic:restic|borg:BorgBackup|kopia:Kopia]
 CFG_BACKUP_LOC_1_PASSWORD=RANDOMIZEDPASSWORD1                   # Repository Password - Used to encrypt/decrypt snapshots — back up offline!
 CFG_BACKUP_LOC_1_TYPE=local                                     # Type - Backend [local:Local / mounted path|sftp:SFTP|rest:REST|s3:S3|b2:Backblaze B2|gs:Google Cloud Storage|azure:Azure|rclone:rclone]
-CFG_BACKUP_LOC_1_PATH_MODE=auto                                 # Path Mode - Automatic uses the Default Backup Location from the Backup Engine config (one subfolder per location); Custom uses the path below [auto:Automatic|custom:Custom path]
+CFG_BACKUP_LOC_1_PATH_MODE=auto                                 # Path Mode - Where this location stores its data [auto:Automatic (/docker/backups/<id>)|custom:Custom path]
 CFG_BACKUP_LOC_1_PATH=                                          # Custom Path - Filesystem path on this server (used when Path Mode = Custom)
-CFG_BACKUP_LOC_1_URI=                                           # URI Override - Custom restic URI (leave blank to build from the fields below) **ADVANCED**
+CFG_BACKUP_LOC_1_URI=                                           # URI Override - Custom restic URI (leave blank to build from the fields below)
 CFG_BACKUP_LOC_1_SSH_USER=                                      # SSH User - For sftp type
 CFG_BACKUP_LOC_1_SSH_HOST=                                      # SSH Host - For sftp type
-CFG_BACKUP_LOC_1_SSH_PORT=22                                    # SSH Port - For sftp type **ADVANCED**
+CFG_BACKUP_LOC_1_SSH_PORT=22                                    # SSH Port - For sftp type
 CFG_BACKUP_LOC_1_SSH_PATH=                                      # SSH Remote Path - Path on the remote host where the repo lives
-CFG_BACKUP_LOC_1_SSH_AUTH=key                                   # SSH Authentication - [key:SSH key (managed by LibrePortal)|password:Password (via sshpass)]
+CFG_BACKUP_LOC_1_SSH_AUTH=key                                   # SSH Authentication - [key:SSH key (~/.ssh/id_rsa)|password:Password (via sshpass)]
 CFG_BACKUP_LOC_1_SSH_PASS=                                      # SSH Password - Used only when SSH Authentication is set to Password
 CFG_BACKUP_LOC_1_S3_ACCESS_KEY=                                 # S3 Access Key - For s3 type
 CFG_BACKUP_LOC_1_S3_SECRET_KEY=                                 # S3 Secret Key - For s3 type
 CFG_BACKUP_LOC_1_B2_ACCOUNT_ID=                                 # B2 Account ID - For b2 type
 CFG_BACKUP_LOC_1_B2_ACCOUNT_KEY=                                # B2 Account Key - For b2 type
-CFG_BACKUP_LOC_1_APPEND_ONLY=false                              # Append-only - Refuse forget/prune for this location (ransomware-safe) **ADVANCED**
+CFG_BACKUP_LOC_1_APPEND_ONLY=false                              # Append-only - Refuse forget/prune for this location (ransomware-safe)
 CFG_BACKUP_LOC_1_CUSTOM_RETENTION=false                         # Custom Retention - Override the global retention for this location
 CFG_BACKUP_LOC_1_KEEP_LAST=                                     # Keep Last - Snapshots to always retain (blank = global)
 CFG_BACKUP_LOC_1_KEEP_DAILY=                                    # Keep Daily - Days (blank = global)
--- a/configs/features/.category
+++ b/configs/features/.category
@ -0,0 +1,5 @@
+TITLE=Features
+DESCRIPTION=Toggle system components and features
+ICON=features
+ORDER=5
+SUBCATEGORY_ORDER=features_core,features_security,features_terminal
--- a/configs/features/features_core
+++ b/configs/features/features_core
@ -0,0 +1,18 @@
+# ================================================================================
+# Core Features - Essential LibrePortal functionality and core services
+# ================================================================================
+CFG_REQUIREMENT_CONFIG=true                               # Configuration Management - Enable configuration management system for LibrePortal settings
+CFG_REQUIREMENT_COMMAND=true                              # Command Line Tool - Install the libreportal command line tool for system management
+CFG_REQUIREMENT_WEBUI=true                                # Web Interface - Install and manage the LibrePortal web based management interface
+CFG_REQUIREMENT_WEBUI_SERVICE=true                        # Web Task Service - Install the task management systemd service for the web interface
+CFG_REQUIREMENT_DATABASE=true                             # Database Support - Install and configure database support for application data storage
+CFG_REQUIREMENT_PASSWORDS=true                            # Password Management - Enable password generation and management features
+CFG_REQUIREMENT_DOCKER_CE=true                            # Docker CE - Install Docker Community Edition instead of the default Docker version
+CFG_REQUIREMENT_DOCKER_COMPOSE=true                       # Docker Compose - Install Docker Compose for multi container application management
+CFG_REQUIREMENT_DOCKER_NETWORK=true                       # Docker Network - Create and manage Docker network for container communication
+CFG_REQUIREMENT_UFW=true                                  # Firewall Protection - Install and configure the Uncomplicated Firewall for system security
+CFG_REQUIREMENT_UFWD=true                                 # Docker Firewall - Install UFW Docker for container aware firewall management which is rooted Docker specific
+CFG_REQUIREMENT_SSLCERTS=true                             # SSL Certificates - Generate and manage SSL certificates for secure HTTPS connections
+CFG_REQUIREMENT_CRONTAB=true                              # Scheduled Tasks - Setup scheduled tasks and automated maintenance jobs
+CFG_REQUIREMENT_WHITELIST_PORT_UPDATER=true               # Auto Port Management - Automatically update port whitelist when applications are installed or removed
+CFG_REQUIREMENT_BCRYPT_SAVE=true                          # Password Encryption - Encrypt saved passwords using bcrypt for enhanced security
--- a/configs/features/features_security
+++ b/configs/features/features_security
@ -0,0 +1,7 @@
+# ================================================================================
+# Security and Authentication - SSH access and security configuration
+# ================================================================================
+CFG_REQUIREMENT_SSHKEY_DOWNLOADER=false                   # SSH Key Downloader - Enable SSH key download functionality for remote access
+CFG_REQUIREMENT_SSH_DISABLE_PASSWORDS=false               # SSH Password Disable - Disable password authentication for SSH requiring key based access only
+CFG_REQUIREMENT_GLUETUN_FOR_ALL=false                     # Gluetun For All Apps - Allow routing through Gluetun VPN for every app (default: only curated categories)
+
--- a/configs/features/features_terminal
+++ b/configs/features/features_terminal
@ -0,0 +1,12 @@
+# ================================================================================
+# Terminal Only - Advanced terminal based features and utilities **ADVANCED**
+# ================================================================================
+CFG_REQUIREMENT_SUGGEST_INSTALLS=false                    # Install Suggestions - Enable application suggestions and recommendations during installation
+CFG_REQUIREMENT_SUGGEST_METRICS=true                      # Metrics Suggestions - Offer Prometheus and Grafana during first install (requires Install Suggestions enabled)
+CFG_REQUIREMENT_CONTINUE_PROMPT=false                     # Continue Prompts - Show continue prompts during installation for user confirmation
+CFG_REQUIREMENT_CONFIGS_CHECK=true                        # Config Validation - Validate configuration files on startup for errors and consistency
+CFG_REQUIREMENT_CONFIGS_AUTO_UPDATE=true                  # Auto Config Updates - Add new config options from the template (non-interactive)
+CFG_REQUIREMENT_CONFIGS_AUTO_DELETE=true                  # Auto Config Deletes - Remove config options no longer present in the template
+CFG_REQUIREMENT_MISSING_IPS=false                         # IP Configuration Check - Check for and alert about missing IP configurations
+CFG_REQUIREMENT_DOCKER_NETWORK_PRUNE=true                 # Docker Network Cleanup - Enable automatic cleanup of unused Docker networks
+CFG_REQUIREMENT_DOCKER_SWITCHER=true                      # Docker Switcher - Install Docker version switching utility for managing multiple Docker versions
--- a/configs/general/.category
+++ b/configs/general/.category
@ -2,4 +2,4 @@ TITLE=General
 DESCRIPTION=Basic system settings and identification
 ICON=general
 ORDER=1
-SUBCATEGORY_ORDER=general_basic,general_mail,general_install,general_core,general_docker_install,general_terminal,general_catalogs,general_libreportal
+SUBCATEGORY_ORDER=general_basic,general_mail,general_install,general_docker_install,general_terminal,general_libreportal
--- a/configs/general/general_basic
+++ b/configs/general/general_basic
@ -1,7 +1,5 @@
 # ================================================================================
 # General - Basic system settings and identification
-# @icon 🏷️
 # ================================================================================
 CFG_INSTALL_NAME=Change-Me                               # Installation Name - The name for your LibrePortal instance
 CFG_TIMEZONE=Etc/UTC                                     # System Timezone - Timezone for scheduled tasks and logging timestamps
-CFG_INSTALL_LEVEL=beginner                               # Experience Level - Beginner hides technical detail and skips advanced setup steps. Advanced reveals everything by default. Set during the first-run wizard; can be flipped any time via the Advanced toggle in the WebUI. [beginner:Beginner — simple|advanced:Advanced — show everything]
--- a/configs/general/general_catalogs
+++ b/configs/general/general_catalogs
@ -1,19 +0,0 @@
-# ================================================================================
-# App Catalogs - Extra app-catalog sources the App Center browses
-# @icon 🗂️
-# ================================================================================
-# Each slot is a catalog base URL served with a signed /<channel>/index.json
-# (channel defaults to stable; append |<channel> for another). Sources are tried
-# in priority order 1..9. The official catalog (from the Release Host) is always
-# source #1 and is NOT listed here. Third-party catalogs are UNVERIFIED — you are
-# trusting that host. Edit these from the App Center's Catalog Sources block.
-CFG_CATALOG_OFFICIAL_ENABLED=true                        # Official Catalog - Include the official LibrePortal catalog (source #1) in the App Center. Disabling only hides its apps from browsing; system updates/hotfixes still use the official release host. [true:On|false:Off] **ADVANCED**
-CFG_CATALOG_1=                                           # Catalog 1 - Extra catalog base URL, e.g. https://catalog.example.org
-CFG_CATALOG_2=                                           # Catalog 2 - Extra catalog base URL
-CFG_CATALOG_3=                                           # Catalog 3 - Extra catalog base URL
-CFG_CATALOG_4=                                           # Catalog 4 - Extra catalog base URL
-CFG_CATALOG_5=                                           # Catalog 5 - Extra catalog base URL
-CFG_CATALOG_6=                                           # Catalog 6 - Extra catalog base URL
-CFG_CATALOG_7=                                           # Catalog 7 - Extra catalog base URL
-CFG_CATALOG_8=                                           # Catalog 8 - Extra catalog base URL
-CFG_CATALOG_9=                                           # Catalog 9 - Extra catalog base URL
--- a/configs/general/general_core
+++ b/configs/general/general_core
@ -1,12 +0,0 @@
-# ================================================================================
-# Core Components - Core LibrePortal components installed at setup time **ADVANCED**
-# @icon 🧩
-# ================================================================================
-CFG_REQUIREMENT_CONFIG=true                              # Configuration Management - Install the configuration management system. Disabling this on an existing install will brick the system. **ADVANCED** **DEV**
-CFG_REQUIREMENT_COMMAND=true                             # Command Line Tool - Install the libreportal command line tool. Disabling this on an existing install will brick the system. **ADVANCED** **DEV**
-CFG_REQUIREMENT_WEBUI=true                               # Web Interface - Install the LibrePortal WebUI. Disabling this on an existing install will brick the system. **ADVANCED** **DEV**
-CFG_REQUIREMENT_WEBUI_SERVICE=true                       # Web Task Service - Install the task-processor systemd service that backs the WebUI. Disabling this on an existing install will brick the system. **ADVANCED** **DEV**
-CFG_REQUIREMENT_DATABASE=true                            # Database Support - Install and configure database support for application data storage. Install-time choice only — flipping post-install will not retrofit. **ADVANCED** **DEV**
-CFG_REQUIREMENT_PASSWORDS=true                           # Password Management - Enable password generation and management features. Install-time choice only. **ADVANCED** **DEV**
-CFG_REQUIREMENT_DOCKER_CE=true                           # Docker CE - Install Docker Community Edition instead of the distro default. Install-time choice only — flipping post-install does not swap Docker. **ADVANCED** **DEV**
-CFG_REQUIREMENT_DOCKER_COMPOSE=true                      # Docker Compose - Install Docker Compose for multi-container application management. Install-time choice only. **ADVANCED** **DEV**
--- a/configs/general/general_docker_install
+++ b/configs/general/general_docker_install
@ -1,8 +1,7 @@
 # ================================================================================
 # Docker - Container runtime installation and configuration **ADVANCED**
-# @icon 🐳
 # ================================================================================
-CFG_DOCKER_INSTALL_TYPE=rootless                          # Docker Installation Type - rootless (default, recommended): containers run unprivileged so a breakout isn't host root; rooted: legacy, containers run as root [rootless|rooted]
+CFG_DOCKER_INSTALL_TYPE=rooted                           # Docker Installation Type - Security based setup rooted or rootless Docker installation [rooted|rootless]
 CFG_DOCKER_INSTALL_USER=dockerinstall                    # Docker Install User - Username for Docker installation operations
 CFG_DOCKER_INSTALL_PASS=RANDOMIZEDPASSWORD2              # Docker Install Password - Password for Docker install user

--- a/configs/general/general_install
+++ b/configs/general/general_install
@ -1,13 +1,9 @@
 # ================================================================================
 # Installation Setup - Local or Git Repository configuration and version control
-# @icon 📦
 # ================================================================================
-CFG_INSTALL_MODE=release                   # Installation Mode - How LibrePortal is fetched + updated. Hidden by default — only shown when Developer Mode is on (click the LibrePortal logo 10 times) or when the install is already on git/local (auto-enables Developer Mode). **DEV** [release:Release - Stable|git:Git clone|local:Local folder]
-CFG_RELEASE_BASE_URL=https://get.libreportal.org        # Release Host - Base URL serving the release channels (override for self-hosting) **ADVANCED**
-CFG_RELEASE_CHANNEL=stable                              # Release Channel - Pick the release channel for the tarball installer. Stable is the recommended default; Edge ships from main and may contain in-flight changes. **DEV** [stable:Release - Stable|edge:Release - Bleeding Edge]
-CFG_DEV_MODE=false                                       # Developer Mode - Reveal advanced developer / dev-install options across the WebUI. Auto-enables when the install is already on git/local. Easter egg: click the LibrePortal logo 10 times to toggle. **ADVANCED** [true:On|false:Off]
+CFG_INSTALL_MODE=local                     # Installation Mode - Method used for installation of LibrePortal
 CFG_GIT_URL=changeme                                     # Git Repository URL - Git repository URL for LibrePortal configuration
 CFG_GIT_USER=changeme                                    # Git Username - Git username for repository authentication
 CFG_GIT_KEY=changeme                                     # Git Access Key - SSH key or API key for Git repository access
-CFG_GIT_UPDATES=true                                     # Auto Check Updates - Check for updates automatically
-CFG_GIT_AUTO_UPDATES=true                                # Auto Apply Updates - Automatically apply updates when available
+CFG_GIT_UPDATES=true                                     # Auto Check Updates - Check for Git repository updates automatically
+CFG_GIT_AUTO_UPDATES=true                                # Auto Apply Updates - Automatically apply Git updates when available
--- a/configs/general/general_libreportal
+++ b/configs/general/general_libreportal
@ -1,5 +1,4 @@
 # ================================================================================
 # LibrePortal - Specific LibrePortal configurations **ADVANCED**
-# @icon 🪐
 # ================================================================================
 CFG_LIBREPORTAL_USER_PASS=changeme                        # LibrePortal User Password - Password for the LibrePortal system user account
--- a/configs/general/general_mail
+++ b/configs/general/general_mail
@ -1,6 +1,5 @@
 # ================================================================================
 # Mail - Mail Server Settings
-# @icon ✉️
 # ================================================================================
 CFG_MAIL_ENABLED=false                                # Mail Enabled - Enable mail server configuration for applications
 CFG_MAIL_HOST=mail.domain.com                     # Mail Server Host - Your mail server hostname
--- a/configs/general/general_terminal
+++ b/configs/general/general_terminal
@ -1,6 +1,5 @@
 # ================================================================================
 # Terminal - System utilities and advanced settings **ADVANCED**
-# @icon 🖥️
 # ================================================================================
 CFG_UPDATER_CHECK=60                                     # Update Check Interval - Hours between system update checks
 CFG_SWAPFILE_SIZE=2G                                     # Swap File Size - Size of swap file for memory management
@ -8,12 +7,3 @@ CFG_GENERATED_PASS_LENGTH=14                             # Password Length - Len
 CFG_GENERATED_USER_LENGTH=8                              # Username Length - Length for auto generated usernames
 CFG_UFW_LOGGING=off                                      # Firewall Logging - UFW firewall logging level [off|low|medium|high|full]
 CFG_TEXT_EDITOR=nano                                     # Text Editor - Default text editor for system operations [nano|vim]
-CFG_REQUIREMENT_CRONTAB=true                             # Scheduled Tasks - Install scheduled tasks and automated maintenance jobs
-CFG_REQUIREMENT_CONFIGS_CHECK=true                       # Config Validation - Validate configuration files on startup for errors and consistency
-CFG_REQUIREMENT_CONFIGS_AUTO_UPDATE=true                 # Auto Config Updates - Add new config options from the template (non-interactive)
-CFG_REQUIREMENT_CONFIGS_AUTO_DELETE=true                 # Auto Config Deletes - Remove config options no longer present in the template
-CFG_REQUIREMENT_MISSING_IPS=false                        # IP Configuration Check - Check for and alert about missing IP configurations
-CFG_REQUIREMENT_CONTINUE_PROMPT=false                    # Continue Prompts - Show continue prompts during installation for user confirmation
-CFG_REQUIREMENT_CONTINUE_ON_ERROR=true                   # Continue On Error - Log failures to error_report.log and continue instead of aborting (on by default to surface issues; turn off for strict abort once clean)
-CFG_REQUIREMENT_SUGGEST_INSTALLS=false                   # Install Suggestions - Enable application suggestions and recommendations during installation
-CFG_REQUIREMENT_SUGGEST_METRICS=true                     # Metrics Suggestions - Offer Prometheus and Grafana during first install (requires Install Suggestions enabled)
--- a/configs/network/.category
+++ b/configs/network/.category
@ -2,4 +2,4 @@ TITLE=Network
 DESCRIPTION=Network configuration and domain management
 ICON=network
 ORDER=4
-SUBCATEGORY_ORDER=network_domains,network_whitelist,network_firewall,network_dns,network_docker,network_rootless,network_ports,network_headscale
+SUBCATEGORY_ORDER=network_domains,network_whitelist,network_dns,network_docker,network_ports,network_headscale
--- a/configs/network/network_dns
+++ b/configs/network/network_dns
@ -1,6 +1,5 @@
 # ================================================================================
 # DNS - Dynamic Name Server Addresses
-# @icon 🌐
 # ================================================================================

 CFG_DNS_SERVER_1=9.9.9.9                                 # Primary DNS - Primary DNS server for network resolution
--- a/configs/network/network_docker
+++ b/configs/network/network_docker
@ -1,11 +1,7 @@
 # ================================================================================
 # Docker Network - Network settings for the Docker Network **ADVANCED**
-# @icon 🕸️
 # ================================================================================

 CFG_NETWORK_NAME=vpn                                     # Network Name - Docker network name for container communication
 CFG_NETWORK_SUBNET=10.100.0.0/16                         # Network Subnet - Subnet range for Docker network
-CFG_NETWORK_MTU=auto                                     # Network MTU - Maximum transmission unit for network packets. 'auto' probes the real path MTU and clamps to a safe value (fixes large image pulls stalling with EOF on Qubes/NAT/VPN links where the path MTU is below 1500); or set an explicit number like 1500 or 1280. **ADVANCED**
-CFG_REQUIREMENT_DOCKER_NETWORK=true                      # Docker Network - Create and manage the Docker network for container communication
-CFG_REQUIREMENT_DOCKER_NETWORK_PRUNE=true                # Network Cleanup - Automatically prune unused Docker networks
-CFG_REQUIREMENT_DOCKER_SWITCHER=true                     # Docker Switcher - Install the Docker version switching utility
+CFG_NETWORK_MTU=1500                                     # Network MTU - Maximum transmission unit for network packets
--- a/configs/network/network_domains
+++ b/configs/network/network_domains
@ -1,6 +1,5 @@
 # ================================================================================
 # Domains - Domain configuration for Traefik web services
-# @icon 🌍
 # ================================================================================
 CFG_DOMAIN_1=                                            # Domain 1 - Domain slot 1 for a Traefik
 CFG_DOMAIN_2=                                            # Domain 2 - Domain slot 2 for a Traefik
@ -11,4 +10,3 @@ CFG_DOMAIN_6=                                            # Domain 6 - Domain slo
 CFG_DOMAIN_7=                                            # Domain 7 - Domain slot 7 for a Traefik
 CFG_DOMAIN_8=                                            # Domain 8 - Domain slot 8 for a Traefik
 CFG_DOMAIN_9=                                            # Domain 9 - Domain slot 9 for a Traefik
-CFG_REQUIREMENT_SSLCERTS=true                            # SSL Certificates - Generate and manage SSL certificates for secure HTTPS connections **ADVANCED**
--- a/configs/network/network_firewall
+++ b/configs/network/network_firewall
@ -1,7 +0,0 @@
-# ================================================================================
-# Firewall - Host firewall and port-whitelist automation **ADVANCED**
-# @icon 🧱
-# ================================================================================
-CFG_REQUIREMENT_UFW=true                                 # Firewall Protection - Install and configure the Uncomplicated Firewall (UFW) for system security
-CFG_REQUIREMENT_UFWD=true                                # Docker Firewall - Install UFW-Docker for container-aware firewall management (rooted Docker only)
-CFG_REQUIREMENT_WHITELIST_PORT_UPDATER=true              # Auto Port Whitelisting - Update the port whitelist automatically when applications are installed or removed
--- a/configs/network/network_headscale
+++ b/configs/network/network_headscale
@ -1,6 +1,5 @@
 # ================================================================================
 # Headscale - VPN service configuration **ADVANCED**
-# @icon 🛰️
 # ================================================================================
 CFG_HEADSCALE_HOST=                                      # Headscale Host - Headscale server hostname for VPN services
 CFG_HEADSCALE_KEY=                                       # Headscale Key - Authentication key for Headscale server
--- a/configs/network/network_ports
+++ b/configs/network/network_ports
@ -1,6 +1,5 @@
 # ================================================================================
 # Ports - Settings for the Network Ports **ADVANCED**
-# @icon 🔌
 # ================================================================================

 CFG_PORT_RANGE=3000-9999                                 # Port allocation range - Range for port allocation Start to End
--- a/configs/network/network_rootless
+++ b/configs/network/network_rootless
@ -1,6 +0,0 @@
-# ================================================================================
-# Rootless Networking - Network stack and behaviour for rootless Docker **ADVANCED**
-# @icon 🔀
-# ================================================================================
-
-CFG_ROOTLESS_NET=pasta                                   # Rootless Network Driver - Network stack for rootless Docker. pasta (default): actively maintained, preserves the real client source IP on inbound connections, lower idle CPU; slirp4netns: legacy fallback, maintenance-only upstream. The matching rootlesskit port driver is selected automatically. On Debian, the installer also applies the local AppArmor override pasta needs (see scripts/docker/install/rootless/rootless_apparmor.sh) so this is a single-toggle switch. **ADVANCED** [pasta:Pasta (default, actively maintained)|slirp4netns:slirp4netns (legacy fallback)]
--- a/configs/network/network_whitelist
+++ b/configs/network/network_whitelist
@ -1,5 +1,4 @@
 # ================================================================================
 # Whitelist - Allow specific IPs for Specified Treafik Apps
-# @icon ✅
 # ================================================================================
 CFG_IPS_WHITELIST=HOSTIPHERE                             # IP Whitelist - Comma separated list of allowed IP addresses
--- a/configs/security/.category
+++ b/configs/security/.category
@ -2,4 +2,4 @@ TITLE=Security
 DESCRIPTION=Intrusion prevention, bouncers, and host firewall configuration
 ICON=security
 ORDER=5
-SUBCATEGORY_ORDER=security_logins,security_ssh
+SUBCATEGORY_ORDER=security_logins
--- a/configs/security/security_logins
+++ b/configs/security/security_logins
@ -1,6 +1,5 @@
 # ================================================================================
 # Logins - User accounts and authentication credentials
-# @icon 🔑
 # ================================================================================
 CFG_TRAEFIK_USER=RANDOMIZEDUSERNAME1                       # Traefik Username - Username for Traefik Admin Panel login and protected apps
 CFG_TRAEFIK_PASS=RANDOMIZEDPASSWORD2                       # Traefik Password - Password for Traefik Admin Panel login and protected apps
--- a/configs/security/security_ssh
+++ b/configs/security/security_ssh
@ -1,8 +0,0 @@
-# ================================================================================
-# SSH & Access Hardening - Secure remote access and auth-storage toggles **ADVANCED**
-# @icon 🔐
-# ================================================================================
-CFG_REQUIREMENT_SSHKEY_DOWNLOADER=false                  # SSH Key Downloader - Enable SSH key download functionality for remote access
-CFG_REQUIREMENT_SSH_DISABLE_PASSWORDS=false              # Disable SSH Passwords - Disable password authentication for SSH (requires key-based access only)
-CFG_REQUIREMENT_BCRYPT_SAVE=true                         # Password Encryption - Encrypt saved passwords using bcrypt for enhanced security
-CFG_REQUIREMENT_GLUETUN_FOR_ALL=false                    # Gluetun For All Apps - Allow routing through Gluetun VPN for every app (default: only curated categories)
--- a/configs/webui/.category
+++ b/configs/webui/.category
@ -2,4 +2,4 @@ TITLE=WebUI
 DESCRIPTION=Web interface settings and preferences
 ICON=webui
 ORDER=2
-SUBCATEGORY_ORDER=webui_logins,webui_logs,webui_updater
+SUBCATEGORY_ORDER=webui_logins,webui_logs
--- a/configs/webui/webui_logins
+++ b/configs/webui/webui_logins
@ -1,6 +1,5 @@
 # ================================================================================
 # WebUI Logins - Web interface authentication settings
-# @icon 🪟
 # ================================================================================
 CFG_WEBUI_USERNAME=RANDOMIZEDUSERNAME1                                    # WebUI Username - Username for web interface login
 CFG_WEBUI_PASSWORD=RANDOMIZEDPASSWORD1                                 # WebUI Password - Password for web interface login
--- a/configs/webui/webui_logs
+++ b/configs/webui/webui_logs
@ -1,6 +1,5 @@
 # ================================================================================
 # WebUI Logs - Log-streaming behaviour for the Services tab **ADVANCED**
-# @icon 📜
 # ================================================================================
 CFG_WEBUI_LOG_STREAM_IDLE_TIMEOUT_MINUTES=10               # Idle Timeout - Disconnect a log stream after this much silence. The viewer overlays a Resume button so the user can re-open the stream. 0 disables.
 CFG_WEBUI_LOG_STREAM_MAX_DURATION_MINUTES=60               # Max Duration - Hard cap on a single stream. Resume button appears at the cap. 0 disables (not recommended).
--- a/configs/webui/webui_updater
+++ b/configs/webui/webui_updater
@ -1,6 +0,0 @@
-# ================================================================================
-# WebUI Updater - Automatic app update, CVE & improvement scanning **ADVANCED**
-# @icon 🔄
-# ================================================================================
-CFG_UPDATER_SCAN_INTERVAL=30                               # App Scan Interval - Minutes between automatic app update/CVE/improvement scans. 0 disables.
-CFG_HOTFIX_AUTO=security-breakage                          # Hotfix Auto-Apply - Which signed hotfix severities apply automatically on the update check [security-breakage|all|off]
--- a/containers/adguard/adguard.config
+++ b/containers/adguard/adguard.config
@ -14,7 +14,6 @@
 #
 CFG_ADGUARD_APP_NAME=adguard
 CFG_ADGUARD_BACKUP=true
-CFG_ADGUARD_BACKUP_STRATEGY=auto
 CFG_ADGUARD_COMPOSE_FILE=default
 CFG_ADGUARD_HEALTHCHECK=true
 CFG_ADGUARD_AUTHELIA=false
--- a/containers/adguard/adguard.sh
+++ b/containers/adguard/adguard.sh
@ -0,0 +1,276 @@
+#!/bin/bash
+
+# Category : Networking
+# Description : AdGuard - DNS based Ad Blocking (c/u/s/r/i):
+
+installAdguard()
+{
+    local config_variables="$1"
+
+    if [[ "$adguard" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent adguard;
+        local app_name=$CFG_ADGUARD_APP_NAME
+    	initializeAppVariables $app_name;
+    fi
+
+    if [[ "$adguard" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$adguard" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$adguard" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$adguard" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$adguard" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Completing AdGuardHome initial setup automatically"
+        echo ""
+
+        # The legacy `$usedport1` variable is no longer populated by the
+        # current install pipeline; the resolved host port is stored in the
+        # PORTS_TAG_1 docker-compose tag (format `external:internal`). Pull
+        # it from there so the curl + URL printout actually point somewhere.
+        local adguard_compose_file="$containers_dir$app_name/docker-compose.yml"
+        local adguard_port_pair
+        adguard_port_pair=$(tagsManagerGetTagContent "$adguard_compose_file" "PORTS_TAG_1")
+        local adguard_admin_port="${adguard_port_pair%%:*}"
+
+        if [[ -n "$public_ip_v4" && -n "$adguard_admin_port" ]]; then
+            echo "    External : http://$public_ip_v4:$adguard_admin_port/"
+        fi
+        if [[ -n "$host_setup" ]]; then
+            echo "    Hostname : http://$host_setup/"
+        fi
+        echo ""
+
+        # AdGuardHome ships a setup wizard that normally needs five clicks in a
+        # browser before the daemon writes its config file. Same wizard is
+        # exposed as an HTTP API (POST /control/install/configure), so we
+        # drive it from here and skip the manual interaction. We pre-poll the
+        # admin endpoint until the container is up, then send the form, then
+        # let the existing post-install sed edits run against the freshly
+        # written AdGuardHome.yaml.
+        local adguard_setup_url="http://127.0.0.1:${adguard_admin_port}"
+        local adguard_attempts=0
+        local adguard_max_attempts=60
+        while ((adguard_attempts < adguard_max_attempts)); do
+            if curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/status" 2>/dev/null \
+               || curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/install/get_addresses" 2>/dev/null; then
+                break
+            fi
+            sleep 2
+            ((adguard_attempts++))
+        done
+
+        if ((adguard_attempts >= adguard_max_attempts)); then
+            isError "AdGuardHome admin endpoint did not respond on $adguard_setup_url within $((adguard_max_attempts * 2))s — open the URL and complete setup manually, then re-run the installer to apply the post-setup tweaks."
+        else
+            local adguard_user="${CFG_ADGUARD_USER:-admin}"
+            local adguard_pass="${CFG_ADGUARD_PASSWORD:-}"
+            if [[ -z "$adguard_pass" ]]; then
+                adguard_pass=$(generateRandomPassword)
+                updateConfigOption "CFG_ADGUARD_PASSWORD" "$adguard_pass" >/dev/null 2>&1 || true
+                isNotice "Generated a random AdGuardHome admin password and saved it to CFG_ADGUARD_PASSWORD."
+            fi
+
+            # Internal container ports are fixed (3000 admin, 53 DNS); host
+            # mapping is what `usedport1` etc. handle.
+            local adguard_payload
+            adguard_payload=$(cat <<JSON
+{
+  "web": { "ip": "0.0.0.0", "port": 3000, "autofix": false },
+  "dns": { "ip": "0.0.0.0", "port": 53, "autofix": false },
+  "username": "${adguard_user}",
+  "password": "${adguard_pass}"
+}
+JSON
+)
+            if curl -fsS -X POST \
+                 -H 'Content-Type: application/json' \
+                 --data "$adguard_payload" \
+                 --max-time 15 \
+                 "${adguard_setup_url}/control/install/configure" >/dev/null 2>&1; then
+                isSuccessful "AdGuardHome admin setup completed automatically (user: $adguard_user)."
+            else
+                # 422/403 here typically means setup was already done on a
+                # previous install; the post-setup tweaks below are still
+                # safe to run against the existing yaml.
+                isNotice "AdGuardHome /control/install/configure rejected the request — assuming it's already configured. If this is a fresh install, complete setup manually at $adguard_setup_url."
+            fi
+            # Small breather so AdGuardHome finishes flushing AdGuardHome.yaml
+            # to disk before the sed edits below touch it.
+            #sleep 3
+        fi
+
+        #result=$(sudo sed -i "s/address: 0.0.0.0:80/address: 0.0.0.0:${usedport2}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 80 to $usedport2 for Admin Panel"
+
+        #result=$(sudo sed -i "s/port: 53/port: ${usedport3}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 53 to $usedport3 for DNS Port"
+
+        #result=$(sudo sed -i "s/port_https: 443/port_https: ${usedport4}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 443 to $usedport4 for DNS Port"
+
+        #result=$(sudo sed -i "s/port_dns_over_tls: 853/port_dns_over_tls: ${usedport5}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 853 to $usedport5 for port_dns_over_tls"
+
+        #result=$(sudo sed -i "s/port_dns_over_quic: 853/port_dns_over_quic: ${usedport5}/g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        #checkSuccess "Changing port 853 to $usedport5 for port_dns_over_quic"
+
+        # NOTE: We deliberately do *not* force `tls.enabled: true` here.
+        # That section configures encrypted DNS (DoT/DoH/DoQ) and AdGuardHome
+        # crash-loops on startup with `[fatal] creating dns server: parsing
+        # tls key pair: tls: failed to find any PEM data in certificate input`
+        # if `enabled: true` is set without a real certificate pair pointed
+        # at by `certificate_path` / `private_key_path`. The admin user can
+        # opt into encrypted DNS from Settings → Encryption once they've
+        # provided a cert.
+
+        if [[ $public == "true" ]]; then
+            result=$(sudo sed -i "s|allow_unencrypted_doh: false|allow_unencrypted_doh: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+            checkSuccess "Setting allow_unencrypted_doh to false for Traefik"
+        fi
+
+        result=$(sudo sed -i "s|anonymize_client_ip: false: false|anonymize_client_ip: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
+        checkSuccess "Setting anonymize_client_ip to true for privacy reasons"
+
+        # Force the admin web bind back to 0.0.0.0:3000 inside the container.
+        # The docker-compose mapping is `<host_port>:3000`, so the container
+        # MUST listen on 3000 internally for the host port to reach it. After
+        # the install API call AdGuardHome sometimes ends up bound to 0.0.0.0:80
+        # (its build-time default) instead of the port we sent — which is
+        # exactly what causes "unable to connect" on the host port.
+        local adguard_yaml="$containers_dir$app_name/conf/AdGuardHome.yaml"
+        if [[ -f "$adguard_yaml" ]]; then
+            # New schema (v0.107+): single `address: 0.0.0.0:NN` line under `http:`.
+            sudo sed -i 's|^\(\s*address:\s*\)0\.0\.0\.0:[0-9]\+|\10.0.0.0:3000|' "$adguard_yaml"
+            # Old schema fallback: separate `bind_host:` / `bind_port:` keys.
+            sudo sed -i 's|^\(\s*bind_host:\s*\).*|\10.0.0.0|' "$adguard_yaml"
+            sudo sed -i 's|^\(\s*bind_port:\s*\)[0-9]\+|\13000|' "$adguard_yaml"
+            checkSuccess "Pinned AdGuardHome admin bind to 0.0.0.0:3000 (matches the compose port mapping)."
+        fi
+
+        dockerComposeRestart "$app_name";
+
+        # Health-check after the restart so the user finds out *here* if
+        # AdGuardHome didn't come back up cleanly, rather than later when
+        # they try to open the URL and just see "unable to connect".
+        #
+        # Drop `-f` and accept any HTTP status code: now that the admin
+        # account is configured, `/control/status` returns 401 to an
+        # unauthenticated request — which is fine, it means the server is
+        # up and answering. We only care whether the connection succeeded
+        # at all, not what the response body says. `-w '%{http_code}'`
+        # gives us a 3-digit code on success and an empty string on a
+        # connection failure / timeout.
+        local adguard_health_attempts=0
+        while ((adguard_health_attempts < 20)); do
+            local adguard_health_code
+            adguard_health_code=$(curl -sS -o /dev/null --max-time 2 \
+                -w '%{http_code}' "${adguard_setup_url}/control/status" 2>/dev/null)
+            if [[ "$adguard_health_code" =~ ^[1-5][0-9][0-9]$ ]]; then
+                isSuccessful "AdGuardHome admin UI is reachable on $adguard_setup_url (HTTP $adguard_health_code)"
+                break
+            fi
+            sleep 1
+            ((adguard_health_attempts++))
+        done
+        if ((adguard_health_attempts >= 20)); then
+            isError "AdGuardHome admin UI did not respond after restart on $adguard_setup_url. Check the container logs (\`docker logs adguard-service\`) and the conf/AdGuardHome.yaml bind address."
+        fi
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating the WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		monitoringRefreshAll;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        # Same final-summary call shape as wireguard / vaultwarden. Pass the
+        # admin user/password we just configured so the user sees the
+        # credentials exactly once, at the end of the install.
+        menuShowFinalMessages "$app_name" "${CFG_ADGUARD_USER:-admin}" "$CFG_ADGUARD_PASSWORD";
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    adguard=n
+}
--- a/containers/adguard/scripts/adguard_auth.sh
+++ b/containers/adguard/scripts/adguard_auth.sh
@ -1,30 +0,0 @@
-#!/bin/bash
-
-authAdapter_adguard_setPassword() {
-    local user="$1" password="$2"
-    user="${user:-${CFG_ADGUARD_ADMIN_USER:-admin}}"
-    [[ -z "$password" ]] && password=$(generateRandomPassword)
-
-    local yaml="${containers_dir}adguard/conf/AdGuardHome.yaml"
-    [[ ! -f "$yaml" ]] && { isError "AdGuardHome.yaml not found at $yaml."; return 1; }
-    if ! command -v htpasswd >/dev/null 2>&1; then
-        isError "htpasswd is required to bcrypt the new password."
-        return 1
-    fi
-
-    local bcrypt
-    bcrypt=$(htpasswd -bnBC 10 "" "$password" | tr -d ':\n')
-    [[ -z "$bcrypt" ]] && { isError "bcrypt failed."; return 1; }
-
-    # The yaml is owned by the in-container uid, so the rewrite runs in the
-    # root-owned appcfg helper (fixed path, validated user + bcrypt).
-    if ! runAppCfg adguard-auth "$user" "$bcrypt"; then
-        isError "Could not update AdGuardHome.yaml (no users password line, or invalid input)."
-        return 1
-    fi
-
-    authPersistCfg adguard ADMIN_USER "$user"
-    authPersistCfg adguard ADMIN_PASSWORD "$password"
-    dockerComposeRestart adguard
-    isSuccessful "AdGuard admin set. User: $user — Password: $password"
-}
--- a/containers/adguard/scripts/adguard_install_hooks.sh
+++ b/containers/adguard/scripts/adguard_install_hooks.sh
@ -1,142 +0,0 @@
-#!/bin/bash
-
-# AdGuard Home install hooks — drive the first-boot setup wizard via its
-# HTTP API so the admin doesn't have to click through five pages, then
-# pin the admin bind back to 0.0.0.0:3000 (matches the compose mapping)
-# and health-check the result.
-
-adguard_install_post_start()
-{
-    local app_name="$1"
-
-    ((menu_number++))
-    echo ""
-    echo "---- $menu_number. Completing AdGuardHome initial setup automatically"
-    echo ""
-
-    # The legacy `$usedport1` variable isn't populated by the current
-    # install pipeline; the resolved host port is stored in the PORTS_TAG_1
-    # docker-compose tag (format `external:internal`). Pull it from there
-    # so the curl + URL printout actually point somewhere real.
-    local adguard_compose_file="$containers_dir$app_name/docker-compose.yml"
-    local adguard_port_pair
-    adguard_port_pair=$(tagsManagerGetTagContent "$adguard_compose_file" "PORTS_TAG_1")
-    local adguard_admin_port="${adguard_port_pair%%:*}"
-
-    if [[ -n "$public_ip_v4" && -n "$adguard_admin_port" ]]; then
-        echo "    External : http://$public_ip_v4:$adguard_admin_port/"
-    fi
-    if [[ -n "$host_setup" ]]; then
-        echo "    Hostname : http://$host_setup/"
-    fi
-    echo ""
-
-    # AdGuardHome ships a setup wizard that normally needs five clicks in
-    # a browser before the daemon writes its config file. Same wizard is
-    # exposed as an HTTP API (POST /control/install/configure), so drive
-    # it from here and skip the manual interaction. Pre-poll the admin
-    # endpoint until the container is up, then send the form, then let
-    # the post-install sed edits run against the freshly written
-    # AdGuardHome.yaml.
-    local adguard_setup_url="http://127.0.0.1:${adguard_admin_port}"
-    local adguard_attempts=0
-    local adguard_max_attempts=60
-    while ((adguard_attempts < adguard_max_attempts)); do
-        if curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/status" 2>/dev/null \
-           || curl -fsS -o /dev/null --max-time 2 "${adguard_setup_url}/control/install/get_addresses" 2>/dev/null; then
-            break
-        fi
-        sleep 2
-        ((adguard_attempts++))
-    done
-
-    if ((adguard_attempts >= adguard_max_attempts)); then
-        isError "AdGuardHome admin endpoint did not respond on $adguard_setup_url within $((adguard_max_attempts * 2))s — open the URL and complete setup manually, then re-run the installer to apply the post-setup tweaks."
-    else
-        local adguard_user="${CFG_ADGUARD_USER:-admin}"
-        local adguard_pass="${CFG_ADGUARD_PASSWORD:-}"
-        if [[ -z "$adguard_pass" ]]; then
-            adguard_pass=$(generateRandomPassword)
-            updateConfigOption "CFG_ADGUARD_PASSWORD" "$adguard_pass" >/dev/null 2>&1 || true
-            isNotice "Generated a random AdGuardHome admin password and saved it to CFG_ADGUARD_PASSWORD."
-        fi
-
-        # Internal container ports are fixed (3000 admin, 53 DNS); host
-        # mapping is what `usedport1` etc. handle.
-        local adguard_payload
-        adguard_payload=$(cat <<JSON
-{
-  "web": { "ip": "0.0.0.0", "port": 3000, "autofix": false },
-  "dns": { "ip": "0.0.0.0", "port": 53, "autofix": false },
-  "username": "${adguard_user}",
-  "password": "${adguard_pass}"
-}
-JSON
-)
-        if curl -fsS -X POST \
-             -H 'Content-Type: application/json' \
-             --data "$adguard_payload" \
-             --max-time 15 \
-             "${adguard_setup_url}/control/install/configure" >/dev/null 2>&1; then
-            isSuccessful "AdGuardHome admin setup completed automatically (user: $adguard_user)."
-        else
-            # 422/403 here typically means setup was already done on a
-            # previous install; the post-setup tweaks below are still
-            # safe to run against the existing yaml.
-            isNotice "AdGuardHome /control/install/configure rejected the request — assuming it's already configured. If this is a fresh install, complete setup manually at $adguard_setup_url."
-        fi
-    fi
-
-    local result
-    if [[ "$public" == "true" ]]; then
-        result=$(runFileOp sed -i "s|allow_unencrypted_doh: false|allow_unencrypted_doh: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-        checkSuccess "Setting allow_unencrypted_doh to false for Traefik"
-    fi
-
-    result=$(runFileOp sed -i "s|anonymize_client_ip: false: false|anonymize_client_ip: true|g" "$containers_dir$app_name/conf/AdGuardHome.yaml")
-    checkSuccess "Setting anonymize_client_ip to true for privacy reasons"
-
-    # Force the admin web bind back to 0.0.0.0:3000 inside the container.
-    # The docker-compose mapping is `<host_port>:3000`, so the container
-    # MUST listen on 3000 internally for the host port to reach it. After
-    # the install API call AdGuardHome sometimes ends up bound to
-    # 0.0.0.0:80 (its build-time default) — exactly what causes "unable
-    # to connect" on the host port.
-    local adguard_yaml="$containers_dir$app_name/conf/AdGuardHome.yaml"
-    if [[ -f "$adguard_yaml" ]]; then
-        runFileOp sed -i 's|^\(\s*address:\s*\)0\.0\.0\.0:[0-9]\+|\10.0.0.0:3000|' "$adguard_yaml"
-        runFileOp sed -i 's|^\(\s*bind_host:\s*\).*|\10.0.0.0|' "$adguard_yaml"
-        runFileOp sed -i 's|^\(\s*bind_port:\s*\)[0-9]\+|\13000|' "$adguard_yaml"
-        checkSuccess "Pinned AdGuardHome admin bind to 0.0.0.0:3000 (matches the compose port mapping)."
-    fi
-
-    dockerComposeRestart "$app_name"
-
-    # Drop `-f` and accept any HTTP status code: now that the admin
-    # account is configured, /control/status returns 401 to an
-    # unauthenticated request — which is fine, it means the server is up
-    # and answering. We only care whether the connection succeeded at
-    # all, not what the response body says.
-    local adguard_health_attempts=0
-    local adguard_health_code
-    while ((adguard_health_attempts < 20)); do
-        adguard_health_code=$(curl -sS -o /dev/null --max-time 2 \
-            -w '%{http_code}' "${adguard_setup_url}/control/status" 2>/dev/null)
-        if [[ "$adguard_health_code" =~ ^[1-5][0-9][0-9]$ ]]; then
-            isSuccessful "AdGuardHome admin UI is reachable on $adguard_setup_url (HTTP $adguard_health_code)"
-            break
-        fi
-        sleep 1
-        ((adguard_health_attempts++))
-    done
-    if ((adguard_health_attempts >= 20)); then
-        isError "AdGuardHome admin UI did not respond after restart on $adguard_setup_url. Check the container logs (\`docker logs adguard-service\`) and the conf/AdGuardHome.yaml bind address."
-    fi
-}
-
-adguard_install_message_data()
-{
-    # Echo the admin user + password as space-separated tokens so they
-    # become $username $password positional args to menuShowFinalMessages.
-    echo "${CFG_ADGUARD_USER:-admin} $CFG_ADGUARD_PASSWORD"
-}
--- a/containers/adguard/scripts/adguard_update_specifics.sh
+++ b/containers/adguard/scripts/adguard_update_specifics.sh
@ -1,12 +0,0 @@
-#!/bin/bash
-
-# Post-install/update specifics for AdGuard Home — dispatched by appUpdateSpecifics
-# (containers/<app>/scripts/<app>_update_specifics.sh defining appUpdateSpecifics_<app>).
-appUpdateSpecifics_adguard() {
-    local app_name="$1"
-    if [[ $CFG_REQUIREMENT_DNS_UPDATER == "true" ]]; then
-        updateDNS "$app_name" install
-    fi
-    # Split-horizon local DNS: app subdomains resolve to the box on the LAN.
-    declare -F setupLocalDnsRewrites >/dev/null 2>&1 && setupLocalDnsRewrites
-}
--- a/containers/adguard/tools/adguard.tools.json
+++ b/containers/adguard/tools/adguard.tools.json
@ -1,20 +0,0 @@
-{
-  "tools": [
-    {
-      "id":          "reset_password",
-      "label":       "Reset Admin Password",
-      "description": "Set a new admin password. Leave blank to generate one.",
-      "icon":        "🔑",
-      "fields": [
-        { "name": "password", "label": "New password", "type": "password", "placeholder": "Leave blank to generate" }
-      ]
-    },
-    {
-      "id":          "apply_dns_updater",
-      "label":       "Apply DNS Updater",
-      "description": "Point this server's DNS at AdGuard now.",
-      "icon":        "🌐",
-      "fields":      []
-    }
-  ]
-}
--- a/containers/authelia/authelia.config
+++ b/containers/authelia/authelia.config
@ -17,7 +17,6 @@
 CFG_AUTHELIA_APP_NAME=authelia
 CFG_AUTHELIA_REQUIRES="domain,traefik"
 CFG_AUTHELIA_BACKUP=true
-CFG_AUTHELIA_BACKUP_STRATEGY=auto
 CFG_AUTHELIA_COMPOSE_FILE=default
 CFG_AUTHELIA_HEALTHCHECK=true
 CFG_AUTHELIA_AUTHELIA=false
--- a/containers/authelia/authelia.sh
+++ b/containers/authelia/authelia.sh
@ -0,0 +1,208 @@
+#!/bin/bash
+
+# Category : Security
+# Description : Authelia - Authentication & SSO (c/u/s/r/i):
+
+installAuthelia()
+{
+    local config_variables="$1"
+
+    if [[ "$authelia" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent authelia;
+        local app_name=$CFG_AUTHELIA_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$authelia" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$authelia" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$authelia" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+    if [[ "$authelia" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$authelia" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+        # Pre-flight: bail out before touching any compose/config if the
+        # global prerequisites aren't met. CFG_AUTHELIA_REQUIRES lists
+        # what's needed (currently "domain,traefik"); the helper prints a
+        # clear list of what's missing so the user knows what to fix.
+        if ! appInstallCheckRequirements "$app_name" "$CFG_AUTHELIA_REQUIRES"; then
+            authelia=n
+            return 1
+        fi
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        local result=$(copyResource "$app_name" "configuration.yml" "config" | sudo tee -a "$logs_dir/$docker_log_file" 2>&1)
+        checkSuccess "Copying configuration.yml to $containers_dir$app_name/config"
+
+        local result=$(copyResource "$app_name" "users_database.yml" "config" | sudo tee -a "$logs_dir/$docker_log_file" 2>&1)
+        checkSuccess "Copying users_database.yml to $containers_dir$app_name/config"
+
+        local authelia_config_file="$containers_dir$app_name/config/configuration.yml"
+        sudo sed -i "s|AUTHELIA_THEME_PLACEHOLDER|$CFG_AUTHELIA_THEME|g" "$authelia_config_file"
+        sudo sed -i "s|AUTHELIA_DOMAIN_PLACEHOLDER|$domain_full|g" "$authelia_config_file"
+        sudo sed -i "s|AUTHELIA_HOST_PLACEHOLDER|$host_setup|g" "$authelia_config_file"
+        checkSuccess "Substituting Authelia configuration values (theme=$CFG_AUTHELIA_THEME domain=$domain_full host=$host_setup)"
+
+        local authelia_secrets_dir="$containers_dir$app_name/secrets"
+        sudo mkdir -p "$authelia_secrets_dir"
+        for secret_name in JWT_SECRET SESSION_SECRET STORAGE_ENCRYPTION_KEY; do
+            local secret_file="$authelia_secrets_dir/$secret_name"
+            if [[ ! -s "$secret_file" ]]; then
+                openssl rand -hex 64 | sudo tee "$secret_file" >/dev/null
+                sudo chmod 600 "$secret_file"
+            fi
+        done
+        sudo chown -R "$docker_install_user":"$docker_install_user" "$authelia_secrets_dir"
+        checkSuccess "Generated Authelia secrets at $authelia_secrets_dir"
+
+        # Enable Authelia's telemetry/metrics endpoint only when
+        # CFG_AUTHELIA_MONITORING=true (toggles the libreportal-monitoring
+        # marker block in configuration.yml).
+        monitoringToggleAppConfig "$app_name" "config/configuration.yml";
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Configuring Authelia admin account"
+        echo ""
+
+        local authelia_admin_user="${CFG_AUTHELIA_ADMIN_USERNAME:-admin}"
+        local authelia_admin_pass="${CFG_AUTHELIA_ADMIN_PASSWORD:-authelia}"
+        local authelia_users_file="$containers_dir$app_name/config/users_database.yml"
+        local authelia_attempts=0
+        while ((authelia_attempts < 30)); do
+            if sudo docker exec authelia-service authelia --version >/dev/null 2>&1; then
+                break
+            fi
+            sleep 2
+            ((authelia_attempts++))
+        done
+
+        if ((authelia_attempts >= 30)); then
+            isNotice "Authelia container did not become responsive in time — admin left at default (admin / authelia)."
+        else
+            local authelia_hash
+            authelia_hash=$(sudo docker exec authelia-service authelia crypto hash generate argon2 --password "$authelia_admin_pass" 2>/dev/null \
+                | grep -oE '\$argon2[^[:space:]]+')
+            if [[ -z "$authelia_hash" ]]; then
+                isNotice "Could not generate Authelia password hash — admin left at default (admin / authelia)."
+            else
+                sudo tee "$authelia_users_file" >/dev/null <<EOF
+---
+users:
+  ${authelia_admin_user}:
+    disabled: false
+    displayname: "Admin"
+    password: "${authelia_hash}"
+    email: ${authelia_admin_user}@${domain_full:-example.com}
+    groups:
+      - admins
+EOF
+                sudo chown "$docker_install_user":"$docker_install_user" "$authelia_users_file"
+                isSuccessful "Configured Authelia admin (user: $authelia_admin_user)."
+                dockerComposeRestart "$app_name";
+            fi
+        fi
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		# Self-correcting: adds Authelia's scrape target + dashboard to
+		# Prometheus/Grafana when CFG_AUTHELIA_MONITORING=true, removes them
+		# when it's off. No-ops with a notice if either app isn't installed.
+		monitoringRefreshAll;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your new service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+        echo ""
+        isNotice "Authelia admin login:"
+        echo ""
+        echo "      Username : ${authelia_admin_user}"
+        echo "      Password : ${authelia_admin_pass}"
+        echo ""
+
+		menu_number=0
+        #sleep 3s
+        cd
+	fi
+	authelia=n
+}
--- a/containers/authelia/docker-compose.yml
+++ b/containers/authelia/docker-compose.yml
@ -23,7 +23,6 @@ services:
    labels:
      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
-      libreportal.backup.db: "sqlite:::config/db.sqlite3"
      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
      # TRAEFIK_PORT_1_BEGIN
      traefik.http.routers.authelia-service.entrypoints: web,websecure
--- a/containers/authelia/scripts/authelia_install_hooks.sh
+++ b/containers/authelia/scripts/authelia_install_hooks.sh
@ -1,111 +0,0 @@
-#!/bin/bash
-
-# Authelia install hooks — requirements check, config + secrets bootstrap,
-# admin account provisioning, and an end-of-install credentials notice.
-
-authelia_install_pre()
-{
-    local app_name="$1"
-    if ! appInstallCheckRequirements "$app_name" "$CFG_AUTHELIA_REQUIRES"; then
-        authelia=n
-        return 1
-    fi
-}
-
-authelia_install_post_compose()
-{
-    local app_name="$1"
-
-    local result
-    result=$(copyResource "$app_name" "configuration.yml" "config" | runInstallWrite -a "$logs_dir/$docker_log_file" 2>&1)
-    checkSuccess "Copying configuration.yml to $containers_dir$app_name/config"
-
-    result=$(copyResource "$app_name" "users_database.yml" "config" | runInstallWrite -a "$logs_dir/$docker_log_file" 2>&1)
-    checkSuccess "Copying users_database.yml to $containers_dir$app_name/config"
-
-    local authelia_config_file="$containers_dir$app_name/config/configuration.yml"
-    runFileOp sed -i "s|AUTHELIA_THEME_PLACEHOLDER|$CFG_AUTHELIA_THEME|g" "$authelia_config_file"
-    runFileOp sed -i "s|AUTHELIA_DOMAIN_PLACEHOLDER|$domain_full|g" "$authelia_config_file"
-    runFileOp sed -i "s|AUTHELIA_HOST_PLACEHOLDER|$host_setup|g" "$authelia_config_file"
-    checkSuccess "Substituting Authelia configuration values (theme=$CFG_AUTHELIA_THEME domain=$domain_full host=$host_setup)"
-
-    local authelia_secrets_dir="$containers_dir$app_name/secrets"
-    runFileOp mkdir -p "$authelia_secrets_dir"
-    local secret_name secret_file
-    for secret_name in JWT_SECRET SESSION_SECRET STORAGE_ENCRYPTION_KEY; do
-        secret_file="$authelia_secrets_dir/$secret_name"
-        if [[ ! -s "$secret_file" ]]; then
-            openssl rand -hex 64 | runFileWrite "$secret_file"
-            runFileOp chmod 600 "$secret_file"
-        fi
-    done
-    runFileOp chown -R "$docker_install_user":"$docker_install_user" "$authelia_secrets_dir"
-    checkSuccess "Generated Authelia secrets at $authelia_secrets_dir"
-
-    # Authelia's metrics block lives in configuration.yml (not the compose),
-    # so toggle it here. The driver already toggled docker-compose.yml.
-    monitoringToggleAppConfig "$app_name" "config/configuration.yml"
-}
-
-authelia_install_post_start()
-{
-    local app_name="$1"
-
-    ((menu_number++))
-    echo ""
-    echo "---- $menu_number. Configuring Authelia admin account"
-    echo ""
-
-    local authelia_admin_user="${CFG_AUTHELIA_ADMIN_USERNAME:-admin}"
-    local authelia_admin_pass="${CFG_AUTHELIA_ADMIN_PASSWORD:-authelia}"
-    local authelia_users_file="$containers_dir$app_name/config/users_database.yml"
-    local authelia_attempts=0
-    while ((authelia_attempts < 30)); do
-        if runFileOp docker exec authelia-service authelia --version >/dev/null 2>&1; then
-            break
-        fi
-        sleep 2
-        ((authelia_attempts++))
-    done
-
-    if ((authelia_attempts >= 30)); then
-        isNotice "Authelia container did not become responsive in time — admin left at default (admin / authelia)."
-        return 0
-    fi
-
-    local authelia_hash
-    authelia_hash=$(runFileOp docker exec authelia-service authelia crypto hash generate argon2 --password "$authelia_admin_pass" 2>/dev/null \
-        | grep -oE '\$argon2[^[:space:]]+')
-    if [[ -z "$authelia_hash" ]]; then
-        isNotice "Could not generate Authelia password hash — admin left at default (admin / authelia)."
-        return 0
-    fi
-
-    runFileWrite "$authelia_users_file" <<EOF
---
-users:
-  ${authelia_admin_user}:
-    disabled: false
-    displayname: "Admin"
-    password: "${authelia_hash}"
-    email: ${authelia_admin_user}@${domain_full:-example.com}
-    groups:
-      - admins
-EOF
-    runFileOp chown "$docker_install_user":"$docker_install_user" "$authelia_users_file"
-    isSuccessful "Configured Authelia admin (user: $authelia_admin_user)."
-    dockerComposeRestart "$app_name"
-}
-
-authelia_install_post()
-{
-    local app_name="$1"
-    local authelia_admin_user="${CFG_AUTHELIA_ADMIN_USERNAME:-admin}"
-    local authelia_admin_pass="${CFG_AUTHELIA_ADMIN_PASSWORD:-authelia}"
-    echo ""
-    isNotice "Authelia admin login:"
-    echo ""
-    echo "      Username : ${authelia_admin_user}"
-    echo "      Password : ${authelia_admin_pass}"
-    echo ""
-}
--- a/containers/bookstack/bookstack.config
+++ b/containers/bookstack/bookstack.config
@ -12,13 +12,7 @@
 # ADMIN_PASSWORD = password used for the Bookstack admin account
 #
 CFG_BOOKSTACK_APP_NAME=bookstack
-# MULTI_INSTANCE = if true, this app can run as multiple isolated instances
-# (own data/DB/subdomain/backups) via `libreportal instance create`. Only set on
-# apps whose compose identity (container_name, Traefik routers, backup labels)
-# is instance-safe — see scripts/instance/instance_create.sh.
-CFG_BOOKSTACK_MULTI_INSTANCE=true
 CFG_BOOKSTACK_BACKUP=true
-CFG_BOOKSTACK_BACKUP_STRATEGY=auto
 CFG_BOOKSTACK_COMPOSE_FILE=default
 CFG_BOOKSTACK_HEALTHCHECK=true
 CFG_BOOKSTACK_AUTHELIA=false
--- a/containers/bookstack/bookstack.sh
+++ b/containers/bookstack/bookstack.sh
@ -0,0 +1,180 @@
+#!/bin/bash
+
+# Category : Knowledge Management
+# Description : Bookstack - Wiki/Knowledge Base (c/u/s/r/i):
+
+installBookstack()
+{
+    local config_variables="$1"
+
+    if [[ "$bookstack" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent bookstack;
+        local app_name=$CFG_BOOKSTACK_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$bookstack" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$bookstack" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$bookstack" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$bookstack" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$bookstack" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+        bookstack_target_email="${CFG_BOOKSTACK_ADMIN_EMAIL:-admin@admin.com}"
+        bookstack_target_pass="${CFG_BOOKSTACK_ADMIN_PASSWORD:-password}"
+
+        bookstack_compose_file="$containers_dir$app_name/docker-compose.yml"
+        bookstack_port_pair=$(tagsManagerGetTagContent "$bookstack_compose_file" "PORTS_TAG_1")
+        bookstack_host_port="${bookstack_port_pair%%:*}"
+        bookstack_probe_url="http://127.0.0.1:${bookstack_host_port}/login"
+
+        isNotice "Waiting for Bookstack to come online at ${bookstack_probe_url} ..."
+        isNotice "This may take up to 20 seconds, please wait..."
+
+        bookstack_attempts=0
+        bookstack_ready=0
+        while ((bookstack_attempts < 60)); do
+            bookstack_http_code=$(curl -sS -o /dev/null --max-time 3 -w '%{http_code}' "$bookstack_probe_url" 2>/dev/null)
+            if [[ "$bookstack_http_code" =~ ^(200|302)$ ]]; then
+                bookstack_ready=1
+                break
+            fi
+            sleep 2
+            ((bookstack_attempts++))
+        done
+
+        if ((bookstack_ready == 0)); then
+            isNotice "Bookstack did not respond on ${bookstack_probe_url} within $((60 * 2))s — admin account left at upstream defaults."
+            echo ""
+            isNotice "Bookstack admin login (default):"
+            echo ""
+            echo "      Email    : admin@admin.com"
+            echo "      Password : password"
+            echo ""
+        else
+            isSuccessful "Bookstack is online (HTTP ${bookstack_http_code})."
+
+            bookstack_create_output=$(sudo docker exec \
+                -e EZ_BS_NEW_EMAIL="$bookstack_target_email" \
+                -e EZ_BS_NEW_PASS="$bookstack_target_pass" \
+                bookstack sh -c 'cd /app/www && s6-setuidgid abc php artisan bookstack:create-admin --no-ansi --email="$EZ_BS_NEW_EMAIL" --name=Admin --password="$EZ_BS_NEW_PASS" 2>&1')
+            bookstack_create_rc=$?
+            if [[ $bookstack_create_rc -eq 0 ]]; then
+                isSuccessful "Bookstack admin account created (email: $bookstack_target_email)."
+
+                if [[ "$bookstack_target_email" != "admin@admin.com" ]]; then
+                    sudo docker exec -i bookstack php /app/www/artisan tinker --no-ansi >/dev/null 2>&1 <<'PHP'
+$c = class_exists('\BookStack\Users\Models\User') ? '\BookStack\Users\Models\User' : '\BookStack\Auth\User';
+optional($c::where('email', 'admin@admin.com')->first())->delete();
+PHP
+                    isSuccessful "Removed seeded admin@admin.com account."
+                fi
+
+                echo ""
+                isNotice "Bookstack admin login:"
+                echo ""
+                echo "      Email    : ${bookstack_target_email}"
+                echo "      Password : ${bookstack_target_pass}"
+                echo ""
+            else
+                isNotice "Bookstack admin auto-create failed (exit $bookstack_create_rc). Output:"
+                echo "$bookstack_create_output" | sed 's/^/        /'
+                echo ""
+                isNotice "Falling back to upstream defaults — update from inside Bookstack."
+                echo ""
+                isNotice "Bookstack admin login (default):"
+                echo ""
+                echo "      Email    : admin@admin.com"
+                echo "      Password : password"
+                echo ""
+            fi
+        fi
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    bookstack=n
+}
--- a/containers/bookstack/docker-compose.yml
+++ b/containers/bookstack/docker-compose.yml
@ -32,8 +32,6 @@ services:
    labels:
      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
-      libreportal.backup.db: "mariadb:bookstack_db:db:"
-      libreportal.backup.files: "bookstack:/config:data"
      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
      # TRAEFIK_PORT_1_BEGIN
      traefik.http.routers.bookstack-service.entrypoints: web,websecure
--- a/containers/bookstack/scripts/bookstack_install_hooks.sh
+++ b/containers/bookstack/scripts/bookstack_install_hooks.sh
@ -1,84 +0,0 @@
-#!/bin/bash
-
-# Bookstack install hooks — drive the post-start admin account bootstrap.
-# Generic installApp driver handles compose / start / db / monitoring; this
-# adds the readiness probe + first-admin provisioning the original
-# installBookstack() did inline.
-
-bookstack_install_post_start()
-{
-    local app_name="$1"
-
-    local bookstack_target_email="${CFG_BOOKSTACK_ADMIN_EMAIL:-admin@admin.com}"
-    local bookstack_target_pass="${CFG_BOOKSTACK_ADMIN_PASSWORD:-password}"
-
-    local bookstack_compose_file="$containers_dir$app_name/docker-compose.yml"
-    local bookstack_port_pair
-    bookstack_port_pair=$(tagsManagerGetTagContent "$bookstack_compose_file" "PORTS_TAG_1")
-    local bookstack_host_port="${bookstack_port_pair%%:*}"
-    local bookstack_probe_url="http://127.0.0.1:${bookstack_host_port}/login"
-
-    isNotice "Waiting for Bookstack to come online at ${bookstack_probe_url} ..."
-    isNotice "This may take up to 20 seconds, please wait..."
-
-    local bookstack_attempts=0
-    local bookstack_ready=0
-    local bookstack_http_code
-    while ((bookstack_attempts < 60)); do
-        bookstack_http_code=$(curl -sS -o /dev/null --max-time 3 -w '%{http_code}' "$bookstack_probe_url" 2>/dev/null)
-        if [[ "$bookstack_http_code" =~ ^(200|302)$ ]]; then
-            bookstack_ready=1
-            break
-        fi
-        sleep 2
-        ((bookstack_attempts++))
-    done
-
-    if ((bookstack_ready == 0)); then
-        isNotice "Bookstack did not respond on ${bookstack_probe_url} within $((60 * 2))s — admin account left at upstream defaults."
-        echo ""
-        isNotice "Bookstack admin login (default):"
-        echo ""
-        echo "      Email    : admin@admin.com"
-        echo "      Password : password"
-        echo ""
-        return 0
-    fi
-    isSuccessful "Bookstack is online (HTTP ${bookstack_http_code})."
-
-    local bookstack_create_output
-    bookstack_create_output=$(runFileOp docker exec \
-        -e EZ_BS_NEW_EMAIL="$bookstack_target_email" \
-        -e EZ_BS_NEW_PASS="$bookstack_target_pass" \
-        bookstack sh -c 'cd /app/www && s6-setuidgid abc php artisan bookstack:create-admin --no-ansi --email="$EZ_BS_NEW_EMAIL" --name=Admin --password="$EZ_BS_NEW_PASS" 2>&1')
-    local bookstack_create_rc=$?
-    if [[ $bookstack_create_rc -eq 0 ]]; then
-        isSuccessful "Bookstack admin account created (email: $bookstack_target_email)."
-
-        if [[ "$bookstack_target_email" != "admin@admin.com" ]]; then
-            runFileOp docker exec -i bookstack php /app/www/artisan tinker --no-ansi >/dev/null 2>&1 <<'PHP'
-$c = class_exists('\BookStack\Users\Models\User') ? '\BookStack\Users\Models\User' : '\BookStack\Auth\User';
-optional($c::where('email', 'admin@admin.com')->first())->delete();
-PHP
-            isSuccessful "Removed seeded admin@admin.com account."
-        fi
-
-        echo ""
-        isNotice "Bookstack admin login:"
-        echo ""
-        echo "      Email    : ${bookstack_target_email}"
-        echo "      Password : ${bookstack_target_pass}"
-        echo ""
-    else
-        isNotice "Bookstack admin auto-create failed (exit $bookstack_create_rc). Output:"
-        echo "$bookstack_create_output" | sed 's/^/        /'
-        echo ""
-        isNotice "Falling back to upstream defaults — update from inside Bookstack."
-        echo ""
-        isNotice "Bookstack admin login (default):"
-        echo ""
-        echo "      Email    : admin@admin.com"
-        echo "      Password : password"
-        echo ""
-    fi
-}
--- a/containers/bookstack/tools/bookstack.tools.json
+++ b/containers/bookstack/tools/bookstack.tools.json
@ -1,106 +0,0 @@
-{
-  "tools": [
-    {
-      "id": "reset_password",
-      "category": "users",
-      "label": "Reset User Password",
-      "description": "Set a new password for an existing user. Leave blank to generate one.",
-      "icon": "🔑",
-      "fields": [
-        {
-          "name": "email",
-          "label": "User email",
-          "type": "text",
-          "placeholder": "user@example.com",
-          "required": true
-        },
-        {
-          "name": "password",
-          "label": "New password",
-          "type": "password",
-          "placeholder": "Leave blank to generate"
-        }
-      ]
-    },
-    {
-      "id": "create_account",
-      "category": "users",
-      "label": "Create User Account",
-      "description": "Add a new user. Tick \"Make admin\" for full rights.",
-      "icon": "👤",
-      "fields": [
-        {
-          "name": "email",
-          "label": "Email",
-          "type": "text",
-          "placeholder": "user@example.com",
-          "required": true
-        },
-        {
-          "name": "name",
-          "label": "Display name",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "password",
-          "label": "Password",
-          "type": "password",
-          "placeholder": "Leave blank to generate"
-        },
-        {
-          "name": "admin",
-          "label": "Make admin",
-          "type": "checkbox",
-          "default": false
-        }
-      ]
-    },
-    {
-      "id": "list_users",
-      "category": "users",
-      "label": "List Users",
-      "description": "List every user and their role.",
-      "icon": "📋",
-      "fields": []
-    },
-    {
-      "id": "delete_user",
-      "category": "users",
-      "label": "Delete User Account",
-      "description": "Permanently remove a user.",
-      "icon": "🗑",
-      "destructive": true,
-      "confirm": "This cannot be undone.",
-      "fields": [
-        {
-          "name": "email",
-          "label": "User email",
-          "type": "text",
-          "required": true
-        }
-      ]
-    },
-    {
-      "id": "set_admin",
-      "category": "users",
-      "label": "Set Admin Status",
-      "description": "Promote or demote a user.",
-      "icon": "👑",
-      "fields": [
-        {
-          "name": "email",
-          "label": "User email",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "admin",
-          "label": "Make admin",
-          "type": "checkbox",
-          "default": false
-        }
-      ]
-    }
-  ]
-}
--- a/containers/crowdsec/crowdsec.config
+++ b/containers/crowdsec/crowdsec.config
@ -19,7 +19,6 @@ CFG_CROWDSEC_HOST_SERVICE=crowdsec
 CFG_CROWDSEC_HOST_SERVICES=crowdsec.service,crowdsec-firewall-bouncer.service
 CFG_CROWDSEC_HOST_LOG_FILES="crowdsec.service|/var/log/crowdsec.log,crowdsec-firewall-bouncer.service|/var/log/crowdsec-firewall-bouncer.log"
 CFG_CROWDSEC_BACKUP=true
-CFG_CROWDSEC_BACKUP_STRATEGY=auto
 CFG_CROWDSEC_MONITORING=false
 CFG_CROWDSEC_PROMETHEUS_LISTEN=0.0.0.0:6060
 #
--- a/containers/crowdsec/crowdsec.sh
+++ b/containers/crowdsec/crowdsec.sh
@ -4,8 +4,8 @@
 # Description : CrowdSec - Intrusion Prevention (c/u/s/r/i):
 #
 # Host-installed agent (apt + systemd) — no Docker container. Host install
-# logic lives in scripts/crowdsec_install_host.sh (installCrowdsecHost) beside
-# this file; install registration uses the shared hostAppInstall helper
+# logic lives in scripts/install/install_crowdsec.sh (installCrowdsecHost);
+# install registration uses the shared hostAppInstall helper
 # (scripts/install/host_app.sh). uninstall/stop/restartCrowdsec (below) are the
 # host-side hooks dockerUninstallApp / dockerStopApp / dockerRestartApp invoke.

@ -58,18 +58,18 @@ uninstallCrowdsec()
    echo ""
    echo "---- $menu_number. Stopping CrowdSec host services."
    echo ""
-    local result; result=$(runSystem systemctl disable --now crowdsec-firewall-bouncer 2>&1)
+    local result=$(sudo systemctl disable --now crowdsec-firewall-bouncer 2>&1)
    checkSuccess "Disabling firewall bouncer"
-    local result; result=$(runSystem systemctl disable --now crowdsec 2>&1)
+    local result=$(sudo systemctl disable --now crowdsec 2>&1)
    checkSuccess "Disabling agent"

    ((menu_number++))
    echo ""
    echo "---- $menu_number. Removing CrowdSec packages."
    echo ""
-    local result; result=$(runSystem DEBIAN_FRONTEND=noninteractive apt-get purge -y -q crowdsec crowdsec-firewall-bouncer-nftables </dev/null 2>&1)
+    local result=$(sudo DEBIAN_FRONTEND=noninteractive apt-get purge -y -q crowdsec crowdsec-firewall-bouncer-nftables </dev/null 2>&1)
    checkSuccess "Purged packages"
-    local result; result=$(runSystem DEBIAN_FRONTEND=noninteractive apt-get autoremove -y -q </dev/null 2>&1)
+    local result=$(sudo DEBIAN_FRONTEND=noninteractive apt-get autoremove -y -q </dev/null 2>&1)
    checkSuccess "Removed orphaned dependencies"

    crowdsecToggleLibrePortalLogMounts off
@ -81,9 +81,9 @@ uninstallCrowdsec()
 stopCrowdsec()
 {
    isNotice "Stopping CrowdSec host services..."
-    local result; result=$(runSystem systemctl stop crowdsec-firewall-bouncer 2>&1)
+    local result=$(sudo systemctl stop crowdsec-firewall-bouncer 2>&1)
    checkSuccess "Stopped firewall bouncer"
-    local result; result=$(runSystem systemctl stop crowdsec 2>&1)
+    local result=$(sudo systemctl stop crowdsec 2>&1)
    checkSuccess "Stopped agent"
 }

@ -93,8 +93,8 @@ stopCrowdsec()
 restartCrowdsec()
 {
    isNotice "Restarting CrowdSec host services..."
-    local result; result=$(runSystem systemctl restart crowdsec 2>&1)
+    local result=$(sudo systemctl restart crowdsec 2>&1)
    checkSuccess "Restarted agent"
-    local result; result=$(runSystem systemctl restart crowdsec-firewall-bouncer 2>&1)
+    local result=$(sudo systemctl restart crowdsec-firewall-bouncer 2>&1)
    checkSuccess "Restarted firewall bouncer"
 }
--- a/containers/crowdsec/scripts/crowdsec_fix_priority.sh
+++ b/containers/crowdsec/scripts/crowdsec_fix_priority.sh
@ -1,19 +0,0 @@
-#!/bin/bash
-
-appCrowdSecFixPriority() {
-    local cfg="/etc/crowdsec/bouncers/crowdsec-firewall-bouncer.yaml"
-    if [[ ! -f "$cfg" ]]; then
-        isNotice "Bouncer config not found at $cfg — is CrowdSec installed?"
-        return 1
-    fi
-
-    # The bouncer yaml is root-owned under /etc/crowdsec; the backup + nftables
-    # ipv4/ipv6 priority rewrite (to -100) runs in the root-owned crowdsec helper.
-    runCrowdsec bouncer-priority
-    checkSuccess "Patched nftables priority to -100 in $cfg"
-
-    runSystem systemctl restart crowdsec-firewall-bouncer
-    checkSuccess "Restarted crowdsec-firewall-bouncer"
-
-    isSuccessful "Priority updated. Run 'crowdsec_verify_firewall' to confirm CrowdSec now runs before UFW."
-}
--- a/containers/dashy/dashy.config
+++ b/containers/dashy/dashy.config
@ -11,7 +11,6 @@
 #
 CFG_DASHY_APP_NAME=dashy
 CFG_DASHY_BACKUP=true
-CFG_DASHY_BACKUP_STRATEGY=auto
 CFG_DASHY_COMPOSE_FILE=default
 CFG_DASHY_HEALTHCHECK=true
 CFG_DASHY_AUTHELIA=false
--- a/containers/dashy/dashy.sh
+++ b/containers/dashy/dashy.sh
@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Category : Miscellaneous
+# Description : Dashy - Dashboard Tool (c/t/u/s/r/i):
+
+installDashy()
+{
+    local config_variables="$1"
+
+    if [[ "$dashy" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent dashy;
+        local app_name=$CFG_DASHY_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$dashy" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$dashy" == *[tT]* ]]; then
+        dashyToolsMenu;
+    fi
+
+    if [[ "$dashy" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$dashy" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$dashy" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$dashy" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your new service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    dashy=n
+}
--- a/containers/dashy/scripts/dashy_update_specifics.sh
+++ b/containers/dashy/scripts/dashy_update_specifics.sh
@ -1,10 +0,0 @@
-#!/bin/bash
-
-# Post-install/update specifics for Dashy — dispatched by appUpdateSpecifics.
-appUpdateSpecifics_dashy() {
-    # Refresh apps-services.json (the source of truth appDashyUpdateConf reads)
-    # before generating dashy's conf.yml. On a first dashy install the file may
-    # not yet reflect dashy itself; on a re-install the previous selection survives.
-    webuiLibrePortalUpdate
-    appDashyUpdateConf
-}
--- a/containers/dashy/tools/dashy.tools.json
+++ b/containers/dashy/tools/dashy.tools.json
@ -1,21 +0,0 @@
-{
-  "tools": [
-    {
-      "id": "manage_shortcuts",
-      "label": "Manage Shortcuts",
-      "description": "Pick which apps appear on the Dashy dashboard.",
-      "icon": "🧩",
-      "fields": [
-        {
-          "name": "selected",
-          "label": "Apps to show on the dashboard",
-          "type": "app_urls_multi",
-          "prefillFromCfgKey": "CFG_DASHY_SHORTCUTS",
-          "excludeApps": [
-            "dashy"
-          ]
-        }
-      ]
-    }
-  ]
-}
--- a/containers/focalboard/docker-compose.yml
+++ b/containers/focalboard/docker-compose.yml
@ -11,7 +11,7 @@ services:
      - "PORTS_DATA_1" #LIBREPORTAL|PORTS_TAG_1|PORTS_DATA_1
    # GLUETUN_OFF_END
    volumes:
-      - ./data:/opt/focalboard/data
+      - ./data:/data
    environment:
      - VIRTUAL_HOST:DOMAINSUBNAME_DATA #LIBREPORTAL|DOMAINSUBNAME_TAG|DOMAINSUBNAME_DATA
      - VIRTUAL_PORT:8000
@ -22,8 +22,6 @@ services:
    labels:
      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
-      libreportal.backup.db: "sqlite:::data/focalboard.db"
-      libreportal.backup.files: "focalboard-service:/opt/focalboard/data:data"
      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
      # TRAEFIK_PORT_1_BEGIN
      traefik.http.routers.focalboard-service.entrypoints: web,websecure
--- a/containers/focalboard/focalboard.config
+++ b/containers/focalboard/focalboard.config
@ -11,7 +11,6 @@
 #
 CFG_FOCALBOARD_APP_NAME=focalboard
 CFG_FOCALBOARD_BACKUP=true
-CFG_FOCALBOARD_BACKUP_STRATEGY=auto
 CFG_FOCALBOARD_COMPOSE_FILE=default
 CFG_FOCALBOARD_HEALTHCHECK=true
 CFG_FOCALBOARD_AUTHELIA=false
--- a/containers/focalboard/focalboard.sh
+++ b/containers/focalboard/focalboard.sh
@ -0,0 +1,110 @@
+#!/bin/bash
+
+# Category : Productivity
+# Description : Focalboard - Project Management (c/u/s/r/i):
+
+installFocalboard()
+{
+    local config_variables="$1"
+
+    if [[ "$focalboard" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent focalboard;
+        local app_name=$CFG_FOCALBOARD_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$focalboard" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$focalboard" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$focalboard" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+    if [[ "$focalboard" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$focalboard" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+	fi
+	focalboard=n
+}
--- a/containers/focalboard/scripts/focalboard_update_specifics.sh
+++ b/containers/focalboard/scripts/focalboard_update_specifics.sh
@ -1,12 +0,0 @@
-#!/bin/bash
-
-# Post-install/update specifics for Focalboard — dispatched by appUpdateSpecifics.
-appUpdateSpecifics_focalboard() {
-    local app_name="$1"
-    # Focalboard runs as nobody (65534) and writes its sqlite db + uploads under
-    # its mounted data dir; fixPermissionsBeforeStart hands the dir to the install
-    # user, so give it to 65534 here or the server can't open the database.
-    # Setting shouldrestart (not local) requests the restart in appUpdateSpecifics.
-    runOwnership app-data-nobody "$app_name"
-    shouldrestart="true"
-}
--- a/containers/focalboard/tools/focalboard.tools.json
+++ b/containers/focalboard/tools/focalboard.tools.json
@ -1,83 +0,0 @@
-{
-  "tools": [
-    {
-      "id": "reset_password",
-      "category": "users",
-      "label": "Reset User Password",
-      "description": "Set a new password for an existing user. Leave blank to generate one.",
-      "icon": "🔑",
-      "fields": [
-        {
-          "name": "username",
-          "label": "Username",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "password",
-          "label": "New password",
-          "type": "password",
-          "placeholder": "Leave blank to generate"
-        }
-      ]
-    },
-    {
-      "id": "create_account",
-      "category": "users",
-      "label": "Create User Account",
-      "description": "Add a new user. Tick \"Make admin\" for full rights.",
-      "icon": "👤",
-      "fields": [
-        {
-          "name": "username",
-          "label": "Username",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "email",
-          "label": "Email",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "password",
-          "label": "Password",
-          "type": "password",
-          "placeholder": "Leave blank to generate"
-        },
-        {
-          "name": "admin",
-          "label": "Make admin",
-          "type": "checkbox",
-          "default": false
-        }
-      ]
-    },
-    {
-      "id": "list_users",
-      "category": "users",
-      "label": "List Users",
-      "description": "List every user.",
-      "icon": "📋",
-      "fields": []
-    },
-    {
-      "id": "delete_user",
-      "category": "users",
-      "label": "Delete User Account",
-      "description": "Permanently remove a user.",
-      "icon": "🗑",
-      "destructive": true,
-      "confirm": "This cannot be undone.",
-      "fields": [
-        {
-          "name": "username",
-          "label": "Username",
-          "type": "text",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/containers/gitea/docker-compose.yml
+++ b/containers/gitea/docker-compose.yml
@ -64,8 +64,6 @@ services:
    labels:
      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
-      libreportal.backup.db: "sqlite:::data/gitea/gitea/gitea.db"
-      libreportal.backup.files: "gitea-service:/data:data/gitea"
      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
      # TRAEFIK_PORT_1_BEGIN
      traefik.http.routers.gitea-service.entrypoints: web,websecure
--- a/containers/gitea/gitea.config
+++ b/containers/gitea/gitea.config
@ -13,7 +13,6 @@
 #
 CFG_GITEA_APP_NAME=gitea
 CFG_GITEA_BACKUP=true
-CFG_GITEA_BACKUP_STRATEGY=auto
 CFG_GITEA_COMPOSE_FILE=default
 CFG_GITEA_HEALTHCHECK=true
 CFG_GITEA_AUTHELIA=false
--- a/containers/gitea/gitea.sh
+++ b/containers/gitea/gitea.sh
@ -0,0 +1,139 @@
+#!/bin/bash
+
+# Category : Development & Version Control
+# Description : Gitea - Git Repository Management (c/u/s/r/i):
+
+installGitea()
+{
+    local config_variables="$1"
+
+    if [[ "$gitea" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent gitea;
+        local app_name=$CFG_GITEA_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$gitea" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$gitea" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$gitea" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+    if [[ "$gitea" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$gitea" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        # Enable Gitea's /metrics endpoint only when CFG_GITEA_MONITORING=true
+        # (toggles the libreportal-monitoring marker block in the compose).
+        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
+
+        # /metrics rides Gitea's public web port, so it's locked behind a
+        # bearer token. CFG_GITEA_METRICS_TOKEN lives in the .config (filled
+        # once by the RANDOMIZEDPASSWORD scanner, preserved across reinstalls)
+        # and reaches the compose via the GITEA_METRICS_TOKEN_TAG tag — mirror
+        # that same value into the Prometheus scrape fragment so the two agree.
+        if monitoringAppEnabled "$app_name"; then
+            if [[ -n "$CFG_GITEA_METRICS_TOKEN" ]]; then
+                sudo sed -i "s|GITEA_METRICS_TOKEN_PLACEHOLDER|${CFG_GITEA_METRICS_TOKEN}|g" \
+                    "$containers_dir$app_name/resources/monitoring/prometheus-scrape.yml"
+                checkSuccess "Synced Gitea /metrics token to the Prometheus scrape config"
+            else
+                isNotice "CFG_GITEA_METRICS_TOKEN is empty — Gitea /metrics scrape may 401."
+            fi
+        fi
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		# Self-correcting: adds Gitea's scrape target + dashboard to
+		# Prometheus/Grafana when CFG_GITEA_MONITORING=true, removes them when
+		# it's off. No-ops with a notice if either app isn't installed.
+		monitoringRefreshAll;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+	fi
+	gitea=n
+}
--- a/containers/gitea/scripts/gitea_install_hooks.sh
+++ b/containers/gitea/scripts/gitea_install_hooks.sh
@ -1,25 +0,0 @@
-#!/bin/bash
-
-# Gitea install hooks — mirror CFG_GITEA_METRICS_TOKEN into the Prometheus
-# scrape fragment so the bearer token in the compose env matches what the
-# Prometheus side sends.
-
-gitea_install_post_compose()
-{
-    local app_name="$1"
-
-    # The driver already ran monitoringToggleAppConfig "$app_name" docker-compose.yml,
-    # so the metrics block reflects CFG_GITEA_MONITORING. /metrics rides
-    # Gitea's public web port and is token-protected; sync the token into
-    # the scrape config so the two sides agree.
-    if monitoringAppEnabled "$app_name"; then
-        if [[ -n "$CFG_GITEA_METRICS_TOKEN" ]]; then
-            local result
-            result=$(runFileOp sed -i "s|GITEA_METRICS_TOKEN_PLACEHOLDER|${CFG_GITEA_METRICS_TOKEN}|g" \
-                "$containers_dir$app_name/resources/monitoring/prometheus-scrape.yml")
-            checkSuccess "Synced Gitea /metrics token to the Prometheus scrape config"
-        else
-            isNotice "CFG_GITEA_METRICS_TOKEN is empty — Gitea /metrics scrape may 401."
-        fi
-    fi
-}
--- a/containers/gitea/tools/gitea.tools.json
+++ b/containers/gitea/tools/gitea.tools.json
@ -1,105 +0,0 @@
-{
-  "tools": [
-    {
-      "id": "reset_password",
-      "category": "users",
-      "label": "Reset User Password",
-      "description": "Set a new password for an existing user. Leave blank to generate one.",
-      "icon": "🔑",
-      "fields": [
-        {
-          "name": "username",
-          "label": "Username",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "password",
-          "label": "New password",
-          "type": "password",
-          "placeholder": "Leave blank to generate"
-        }
-      ]
-    },
-    {
-      "id": "create_account",
-      "category": "users",
-      "label": "Create User Account",
-      "description": "Add a new user. Tick \"Make admin\" for full rights.",
-      "icon": "👤",
-      "fields": [
-        {
-          "name": "username",
-          "label": "Username",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "email",
-          "label": "Email",
-          "type": "text",
-          "placeholder": "user@example.com",
-          "required": true
-        },
-        {
-          "name": "password",
-          "label": "Password",
-          "type": "password",
-          "placeholder": "Leave blank to generate"
-        },
-        {
-          "name": "admin",
-          "label": "Make admin",
-          "type": "checkbox",
-          "default": false
-        }
-      ]
-    },
-    {
-      "id": "list_users",
-      "category": "users",
-      "label": "List Users",
-      "description": "List every user.",
-      "icon": "📋",
-      "fields": []
-    },
-    {
-      "id": "delete_user",
-      "category": "users",
-      "label": "Delete User Account",
-      "description": "Permanently remove a user.",
-      "icon": "🗑",
-      "destructive": true,
-      "confirm": "This cannot be undone.",
-      "fields": [
-        {
-          "name": "username",
-          "label": "Username",
-          "type": "text",
-          "required": true
-        }
-      ]
-    },
-    {
-      "id": "set_admin",
-      "category": "users",
-      "label": "Set Admin Status",
-      "description": "Promote or demote a user.",
-      "icon": "👑",
-      "fields": [
-        {
-          "name": "username",
-          "label": "Username",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "admin",
-          "label": "Make admin",
-          "type": "checkbox",
-          "default": false
-        }
-      ]
-    }
-  ]
-}
--- a/containers/gluetun/gluetun.config
+++ b/containers/gluetun/gluetun.config
@ -12,7 +12,6 @@
 #
 CFG_GLUETUN_APP_NAME=gluetun
 CFG_GLUETUN_BACKUP=true
-CFG_GLUETUN_BACKUP_STRATEGY=auto
 CFG_GLUETUN_COMPOSE_FILE=default
 CFG_GLUETUN_HEALTHCHECK=true
 CFG_GLUETUN_AUTHELIA=false
@ -49,13 +48,6 @@ CFG_GLUETUN_CONTROL_SERVER_API_KEY=RANDOMIZEDPASSWORD1
 #
 CFG_GLUETUN_HEALTH_TARGETS="mullvad.net:443,eff.org:443"
 CFG_GLUETUN_HEALTH_ICMP_IPS="9.9.9.9"
-# PROVIDERS_REFRESH_HOURS = how often (hours) to re-fetch gluetun's upstream
-#   server list, which powers the provider/country pickers. It's a few MB and
-#   rarely changes, so we don't pull it on every WebUI update. Lower it for a
-#   fresher list, raise it on a slow/metered link, or set 0 to never auto-fetch
-#   (refresh on demand from the Tools tab instead). Default 24.
-#
-CFG_GLUETUN_PROVIDERS_REFRESH_HOURS=24
 #
 # =============================================================================
 # METADATA
--- a/containers/gluetun/gluetun.sh
+++ b/containers/gluetun/gluetun.sh
@ -0,0 +1,136 @@
+#!/bin/bash
+
+# Category : Networking
+# Description : Gluetun - VPN client for routing other containers (c/u/s/r/i):
+
+installGluetun()
+{
+    local config_variables="$1"
+
+    if [[ "$gluetun" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent gluetun;
+        local app_name=$CFG_GLUETUN_APP_NAME
+        initializeAppVariables $app_name;
+    fi
+
+    if [[ "$gluetun" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$gluetun" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$gluetun" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$gluetun" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$gluetun" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        monitoringToggleAppConfig "$app_name" "docker-compose.yml";
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+        fixPermissionsBeforeStart $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+        dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+        setupHeadscale $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+        databaseInstallApp $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating the WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Refreshing Gluetun provider snapshot."
+        echo ""
+
+        webuiGenerateGluetunProviders;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Re-attaching gluetun-routed apps (post-recreate)."
+        echo ""
+
+        # Gluetun was just (re)created — every existing routed app holds a
+        # stale container ID in its network_mode. Reattach them now so the
+        # user doesn't have to chase silent netns drift later.
+        appGluetunRoutedRecreate
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Routing existing apps through Gluetun (optional)."
+        echo ""
+
+        gluetunRouteExistingAppsPrompt;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		monitoringRefreshAll;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+
+        menuShowFinalMessages "$app_name";
+
+        menu_number=0
+        cd
+    fi
+    gluetun=n
+}
--- a/containers/gluetun/scripts/gluetun_compose_tags.sh
+++ b/containers/gluetun/scripts/gluetun_compose_tags.sh
@ -1,16 +0,0 @@
-#!/bin/bash
-
-# App-specific compose tags for Gluetun (VPN gateway) + its forwarded-port wiring.
-appSetupComposeTags_gluetun() {
-    local full_file_path="$1"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_VPN_SERVICE_PROVIDER_TAG" "$CFG_GLUETUN_VPN_SERVICE_PROVIDER"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_VPN_TYPE_TAG" "$CFG_GLUETUN_VPN_TYPE"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_VPN_COUNTRIES_TAG" "$CFG_GLUETUN_VPN_COUNTRIES"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_OPENVPN_USER_TAG" "$CFG_GLUETUN_OPENVPN_USER"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_OPENVPN_PASSWORD_TAG" "$CFG_GLUETUN_OPENVPN_PASSWORD"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_WIREGUARD_PRIVATE_KEY_TAG" "$CFG_GLUETUN_WIREGUARD_PRIVATE_KEY"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_WIREGUARD_ADDRESSES_TAG" "$CFG_GLUETUN_WIREGUARD_ADDRESSES"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_HEALTH_TARGETS_TAG"  "${CFG_GLUETUN_HEALTH_TARGETS:-mullvad.net:443,eff.org:443}"
-    tagsManagerUpdateUniversalTag "$full_file_path" "GLUETUN_HEALTH_ICMP_IPS_TAG" "${CFG_GLUETUN_HEALTH_ICMP_IPS:-9.9.9.9}"
-    appNetworkRegisterPorts_gluetun
-}
--- a/containers/gluetun/scripts/gluetun_install_hooks.sh
+++ b/containers/gluetun/scripts/gluetun_install_hooks.sh
@ -1,35 +0,0 @@
-#!/bin/bash
-
-# Gluetun install hooks — post-start provider snapshot refresh + reattach
-# any apps routed through gluetun (their network_mode holds a stale
-# container ID after gluetun was just recreated) + offer to onboard
-# existing apps.
-
-gluetun_install_post_start()
-{
-    local app_name="$1"
-
-    ((menu_number++))
-    echo ""
-    echo "---- $menu_number. Refreshing Gluetun provider snapshot."
-    echo ""
-
-    GLUETUN_PROVIDERS_FORCE=1 appWebuiRefresh_gluetun
-
-    ((menu_number++))
-    echo ""
-    echo "---- $menu_number. Re-attaching gluetun-routed apps (post-recreate)."
-    echo ""
-
-    # Gluetun was just (re)created — every existing routed app holds a
-    # stale container ID in its network_mode. Reattach them now so the
-    # user doesn't have to chase silent netns drift later.
-    appGluetunRoutedRecreate
-
-    ((menu_number++))
-    echo ""
-    echo "---- $menu_number. Routing existing apps through Gluetun (optional)."
-    echo ""
-
-    gluetunRouteExistingAppsPrompt
-}
--- a/containers/gluetun/tools/gluetun.tools.json
+++ b/containers/gluetun/tools/gluetun.tools.json
@ -1,11 +0,0 @@
-{
-  "tools": [
-    {
-      "id": "refresh_providers",
-      "label": "Refresh VPN Providers",
-      "description": "Refresh the VPN provider and country lists.",
-      "icon": "🔄",
-      "fields": []
-    }
-  ]
-}
--- a/containers/grafana/grafana.config
+++ b/containers/grafana/grafana.config
@ -14,7 +14,6 @@
 CFG_GRAFANA_APP_NAME=grafana
 CFG_GRAFANA_REQUIRES="prometheus"
 CFG_GRAFANA_BACKUP=true
-CFG_GRAFANA_BACKUP_STRATEGY=auto
 CFG_GRAFANA_COMPOSE_FILE=default
 CFG_GRAFANA_HEALTHCHECK=true
 CFG_GRAFANA_AUTHELIA=false
--- a/containers/grafana/grafana.sh
+++ b/containers/grafana/grafana.sh
@ -0,0 +1,133 @@
+#!/bin/bash
+
+# Category : Development & Version Control
+# Description : Grafana - Metrics Visualizer (c/u/s/r/i):
+
+installGrafana()
+{
+    local config_variables="$1"
+
+    if [[ "$grafana" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent grafana;
+        local app_name=$CFG_GRAFANA_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$grafana" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$grafana" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$grafana" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+	if [[ "$grafana" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+	fi
+
+    if [[ "$grafana" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+        if ! appInstallCheckRequirements "$app_name" "$CFG_GRAFANA_REQUIRES"; then
+            grafana=n
+            return 1
+        fi
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        # Grafana
+        if [ -d "${containers_dir}grafana/grafana_storage" ]; then
+            local result=$(sudo chmod -R 777 "${containers_dir}grafana/grafana_storage")
+            checkSuccess "Set permissions to grafana_storage folder."
+        fi
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Updating WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Provisioning monitoring dashboards from installed apps."
+		echo ""
+
+		# Re-gather the Prometheus datasource + every monitoring-enabled app's
+		# dashboards into provisioning/ — so a fresh (or re-)install of Grafana
+		# picks up the apps that already had CFG_<APP>_MONITORING=true.
+		# monitoringRefreshAll also covers Grafana's own scrape target when
+		# CFG_GRAFANA_MONITORING=true.
+		monitoringRefreshAll;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    grafana=n
+}
--- a/containers/grafana/scripts/grafana_install_hooks.sh
+++ b/containers/grafana/scripts/grafana_install_hooks.sh
@ -1,23 +0,0 @@
-#!/bin/bash
-
-# Grafana install hooks — pre-flight prereq check + post-start 0777 on the
-# storage folder so Grafana can write its sqlite db regardless of host UID.
-
-grafana_install_pre()
-{
-    local app_name="$1"
-    if ! appInstallCheckRequirements "$app_name" "$CFG_GRAFANA_REQUIRES"; then
-        grafana=n
-        return 1
-    fi
-}
-
-grafana_install_post_start()
-{
-    local app_name="$1"
-    if [ -d "${containers_dir}grafana/grafana_storage" ]; then
-        local result
-        result=$(runFileOp chmod -R 777 "${containers_dir}grafana/grafana_storage")
-        checkSuccess "Set permissions to grafana_storage folder."
-    fi
-}
--- a/containers/headscale/docker-compose.yml
+++ b/containers/headscale/docker-compose.yml
@ -20,8 +20,6 @@ services:
    labels:
      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
-      libreportal.backup.db: "sqlite:::data/db.sqlite"
-      libreportal.backup.files: "headscale-service:/var/lib/headscale:data"
    healthcheck:
      disable: HEALTHCHECK_DATA #LIBREPORTAL|HEALTHCHECK_TAG|HEALTHCHECK_DATA
    # GLUETUN_OFF_BEGIN
--- a/containers/headscale/headscale.config
+++ b/containers/headscale/headscale.config
@ -11,7 +11,6 @@
 #
 CFG_HEADSCALE_APP_NAME=headscale
 CFG_HEADSCALE_BACKUP=true
-CFG_HEADSCALE_BACKUP_STRATEGY=auto
 CFG_HEADSCALE_COMPOSE_FILE=default
 CFG_HEADSCALE_HEALTHCHECK=true
 CFG_HEADSCALE_BASIC_AUTH_PASS=RANDOMIZEDPASSWORD1
--- a/containers/headscale/headscale.sh
+++ b/containers/headscale/headscale.sh
@ -0,0 +1,127 @@
+#!/bin/bash
+
+# Category : Networking
+# Description : Self-hosted WireGuard orchestrator (c/u/s/r/i):
+
+installHeadscale()
+{
+    local config_variables="$1"
+
+    if [[ "$headscale" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent headscale;
+        local app_name=$CFG_HEADSCALE_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$headscale" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$headscale" == *[uU]* ]]; then
+        dockerUninstallApp $app_name;
+    fi
+
+    if [[ "$headscale" == *[sS]* ]]; then
+        dockerComposeDown $app_name;
+    fi
+
+    if [[ "$headscale" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$headscale" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+        local result=$(createFolders "loud" $docker_install_user $containers_dir$app_name/config)
+        checkSuccess "Create config folder"
+
+		local result=$(copyResource "$app_name" "config.yaml" "config" | sudo tee -a "$logs_dir/$docker_log_file" 2>&1)
+		checkSuccess "Copying config.yaml to config folder."
+
+        configSetupFileWithData $app_name "config.yaml" "config";
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up database records"
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Refreshing monitoring integration."
+		echo ""
+
+		monitoringRefreshAll;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+        echo "    NOTE - The password to login in defined in the yml install file that was installed"
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    headscale=n
+}
--- a/containers/headscale/scripts/headscale_install_hooks.sh
+++ b/containers/headscale/scripts/headscale_install_hooks.sh
@ -1,19 +0,0 @@
-#!/bin/bash
-
-# Headscale install hooks — drop the config.yaml template into the
-# container's config folder before start so the daemon has its config on
-# first boot.
-
-headscale_install_post_compose()
-{
-    local app_name="$1"
-
-    local result
-    result=$(createFolders "loud" $docker_install_user $containers_dir$app_name/config)
-    checkSuccess "Create config folder"
-
-    result=$(copyResource "$app_name" "config.yaml" "config" | runInstallWrite -a "$logs_dir/$docker_log_file" 2>&1)
-    checkSuccess "Copying config.yaml to config folder."
-
-    configSetupFileWithData $app_name "config.yaml" "config"
-}
--- a/containers/headscale/scripts/tailscale_install.sh
+++ b/containers/headscale/scripts/tailscale_install.sh
@ -1,19 +0,0 @@
-#!/bin/bash
-
-tailscaleInstallToContainer()
-{
-    local app_name="$1"
-    local type="$2"
-
-    local result; result=$(createFolders "loud" $docker_install_user $containers_dir$app_name/tailscale)
-    checkSuccess "Creating Tailscale folder"
-
-    copyFile "loud" "${install_containers_dir}headscale/resources/tailscale.sh" "$containers_dir$app_name/tailscale/tailscale.sh" $docker_install_user | runInstallWrite -a "$logs_dir/$docker_log_file" 2>&1
-
-    if [[ "$type" != "install" ]]; then
-        dockerComposeRestart $app_name;
-    fi
-
-    dockerCommandRun "docker exec -it $app_name /usr/local/bin/tailscale.sh"
-    checkSuccess "Executing Tailscale installer script in the $app_name container"
-}
--- a/containers/invidious/docker-compose.yml
+++ b/containers/invidious/docker-compose.yml
@ -42,7 +42,6 @@ services:
    labels:
      libreportal.category: "CATEGORY_DATA" #LIBREPORTAL|CATEGORY_TAG|CATEGORY_DATA
      libreportal.title: "TITLE_DATA" #LIBREPORTAL|TITLE_TAG|TITLE_DATA
-      libreportal.backup.db: "postgres:invidious-db:postgresdata:"
      traefik.enable: TRAEFIK_ENABLE_DATA #LIBREPORTAL|TRAEFIK_ENABLE_TAG|TRAEFIK_ENABLE_DATA
      # TRAEFIK_PORT_1_BEGIN
      traefik.http.routers.invidious-service.entrypoints: web,websecure
--- a/containers/invidious/invidious.config
+++ b/containers/invidious/invidious.config
@ -11,7 +11,6 @@
 #
 CFG_INVIDIOUS_APP_NAME=invidious
 CFG_INVIDIOUS_BACKUP=false
-CFG_INVIDIOUS_BACKUP_STRATEGY=auto
 CFG_INVIDIOUS_COMPOSE_FILE=default
 CFG_INVIDIOUS_HEALTHCHECK=false
 CFG_INVIDIOUS_AUTHELIA=false
--- a/containers/invidious/invidious.sh
+++ b/containers/invidious/invidious.sh
@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Category : Media & Streaming
+# Description : Invidious - Privacy-focused YouTube Frontend (c/u/s/r/i/t):
+
+installInvidious()
+{
+    local config_variables="$1"
+
+    if [[ "$invidious" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent invidious;
+        local app_name=$CFG_INVIDIOUS_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$invidious" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+    if [[ "$invidious" == *[tT]* ]]; then
+        invidiousToolsMenu;
+    fi
+
+	if [[ "$invidious" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$invidious" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+	if [[ "$invidious" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+	fi
+
+    if [[ "$invidious" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. Updating WebUI config file."
+		echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+		echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    invidious=n
+}
--- a/containers/invidious/tools/invidious.tools.json
+++ b/containers/invidious/tools/invidious.tools.json
@ -1,77 +0,0 @@
-{
-  "tools": [
-    {
-      "id": "reset_password",
-      "category": "users",
-      "label": "Reset User Password",
-      "description": "Set a new password for an existing user. Leave blank to generate one.",
-      "icon": "🔑",
-      "fields": [
-        {
-          "name": "email",
-          "label": "Email",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "password",
-          "label": "New password",
-          "type": "password",
-          "placeholder": "Leave blank to generate"
-        }
-      ]
-    },
-    {
-      "id": "create_account",
-      "category": "users",
-      "label": "Create User Account",
-      "description": "Add a new user. Sign-in uses the email address.",
-      "icon": "👤",
-      "fields": [
-        {
-          "name": "email",
-          "label": "Email",
-          "type": "text",
-          "required": true
-        },
-        {
-          "name": "password",
-          "label": "Password",
-          "type": "password",
-          "placeholder": "Leave blank to generate"
-        },
-        {
-          "name": "admin",
-          "label": "Make admin",
-          "type": "checkbox",
-          "default": false
-        }
-      ]
-    },
-    {
-      "id": "list_users",
-      "category": "users",
-      "label": "List Users",
-      "description": "List every user.",
-      "icon": "📋",
-      "fields": []
-    },
-    {
-      "id": "delete_user",
-      "category": "users",
-      "label": "Delete User Account",
-      "description": "Permanently remove a user.",
-      "icon": "🗑",
-      "destructive": true,
-      "confirm": "This cannot be undone.",
-      "fields": [
-        {
-          "name": "email",
-          "label": "Email",
-          "type": "text",
-          "required": true
-        }
-      ]
-    }
-  ]
-}
--- a/containers/ipinfo/ipinfo.config
+++ b/containers/ipinfo/ipinfo.config
@ -11,7 +11,6 @@
 #
 CFG_IPINFO_APP_NAME=ipinfo
 CFG_IPINFO_BACKUP=false
-CFG_IPINFO_BACKUP_STRATEGY=auto
 CFG_IPINFO_COMPOSE_FILE=default
 CFG_IPINFO_HEALTHCHECK=true
 CFG_IPINFO_AUTHELIA=false
--- a/containers/ipinfo/ipinfo.sh
+++ b/containers/ipinfo/ipinfo.sh
@ -0,0 +1,110 @@
+#!/bin/bash
+
+# Category : Networking
+# Description : IPinfo - IP Geolocation and Information (c/u/s/r/i):
+
+installIpinfo()
+{
+    local config_variables="$1"
+
+    if [[ "$ipinfo" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent ipinfo;
+        local app_name=$CFG_IPINFO_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$ipinfo" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$ipinfo" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$ipinfo" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+	if [[ "$ipinfo" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+	fi
+
+    if [[ "$ipinfo" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Updating WebUI config file."
+        echo ""
+
+        webuiContainerSetup $app_name install;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your $app_name service using any of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+    fi
+    ipinfo=n
+}
--- a/containers/jellyfin/jellyfin.config
+++ b/containers/jellyfin/jellyfin.config
@ -11,7 +11,6 @@
 #
 CFG_JELLYFIN_APP_NAME=jellyfin
 CFG_JELLYFIN_BACKUP=true
-CFG_JELLYFIN_BACKUP_STRATEGY=auto
 CFG_JELLYFIN_COMPOSE_FILE=default
 CFG_JELLYFIN_HEALTHCHECK=true
 CFG_JELLYFIN_AUTHELIA=false
--- a/containers/jellyfin/jellyfin.sh
+++ b/containers/jellyfin/jellyfin.sh
@ -0,0 +1,103 @@
+#!/bin/bash
+
+# Category : Media & Streaming
+# Description : Jellyfin - Media Server (c/u/s/r/i):
+
+installJellyfin()
+{
+    local config_variables="$1"
+
+    if [[ "$jellyfin" == *[cCtTuUsSrRiI]* ]]; then
+        dockerConfigSetupToContainer silent jellyfin;
+        local app_name=$CFG_JELLYFIN_APP_NAME
+		initializeAppVariables $app_name;
+    fi
+
+    if [[ "$jellyfin" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$jellyfin" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$jellyfin" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+    if [[ "$jellyfin" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$jellyfin" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Pulling a default Jellyfin docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start Jellyfin"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your new service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+	fi
+	jellyfin=n
+}
--- a/containers/jitsimeet/jitsimeet.config
+++ b/containers/jitsimeet/jitsimeet.config
@ -11,7 +11,6 @@
 #
 CFG_JITSIMEET_APP_NAME=jitsimeet
 CFG_JITSIMEET_BACKUP=true
-CFG_JITSIMEET_BACKUP_STRATEGY=auto
 CFG_JITSIMEET_COMPOSE_FILE=default
 CFG_JITSIMEET_HEALTHCHECK=true
 CFG_JITSIMEET_AUTHELIA=false
--- a/containers/jitsimeet/jitsimeet.sh
+++ b/containers/jitsimeet/jitsimeet.sh
@ -0,0 +1,202 @@
+#!/bin/bash
+
+# Category : Communication & Collaboration Tools
+# Description : Jitsi Meet - Video Conferencing *UNFINISHED* (c/u/s/r/i):
+
+installJitsimeet()
+{
+    local config_variables="$1"
+
+    if [[ "$jitsimeet" == *[cCtTuUsSrRiI]* ]]; then
+		dockerConfigSetupToContainer silent jitsimeet;
+		local app_name=$CFG_JITSIMEET_APP_NAME
+		git_url=$CFG_JITSIMEET_GIT
+		initializeAppVariables $app_name;
+	fi
+
+    if [[ "$jitsimeet" == *[cC]* ]]; then
+        editAppConfig $app_name;
+    fi
+
+	if [[ "$jitsimeet" == *[uU]* ]]; then
+		dockerUninstallApp $app_name;
+	fi
+
+	if [[ "$jitsimeet" == *[sS]* ]]; then
+		dockerComposeDown $app_name;
+	fi
+
+    if [[ "$jitsimeet" == *[rR]* ]]; then
+        dockerComposeRestart $app_name;
+    fi
+
+    if [[ "$jitsimeet" == *[iI]* ]]; then
+        isHeader "Install $app_name"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up install folder and config file for $app_name."
+        echo ""
+
+        dockerConfigSetupToContainer "loud" "$app_name" "install" "$config_variables";
+        isSuccessful "Install folders and Config files have been setup for $app_name."
+
+        ((menu_number++))
+        echo ""
+
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Downloading latest GitHub release"
+        echo ""
+
+		latest_tag=$(git ls-remote --refs --sort="version:refname" --tags $git_url | cut -d/ -f3- | tail -n1)
+		echo "The latest tag is: $latest_tag"
+
+		local result=$(createFolders "loud" $docker_install_user $containers_dir$app_name)
+		checkSuccess "Creating $app_name container installation folder"
+		local result=$(cd $containers_dir$app_name && sudo rm -rf $containers_dir$app_name/$latest_tag.zip)
+		checkSuccess "Deleting zip file to prevent conflicts"
+		local result=$(createTouch $containers_dir$app_name/$latest_tag.txt $docker_install_user && echo 'Installed "$latest_tag" on "$backupDate"!' > $latest_tag.txt)
+		checkSuccess "Create logging txt file"
+
+
+		# Download files and unzip
+		local result=$(sudo wget -O $containers_dir$app_name/$latest_tag.zip $git_url/archive/refs/tags/$latest_tag.zip)
+		checkSuccess "Downloading tagged zip file from GitHub"
+		local result=$(sudo unzip -o $containers_dir$app_name/$latest_tag.zip -d $containers_dir$app_name)
+		checkSuccess "Unzip downloaded file"
+		local result=$(sudo mv $containers_dir$app_name/docker-jitsi-meet-$latest_tag/* $containers_dir$app_name)
+		checkSuccess "Moving all files from zip file to install directory"
+		local result=$(sudo rm -rf $containers_dir$app_name/$latest_tag.zip && sudo rm -rf $containers_dir$app_name/$latest_tag/)
+		checkSuccess "Removing downloaded zip file as no longer needed"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up the $app_name docker-compose.yml file."
+        echo ""
+
+        dockerComposeSetupFile $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating file permissions before starting."
+        echo ""
+
+		fixPermissionsBeforeStart $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Setting up .env file for setup"
+        echo ""
+
+		dockerSetupEnvFile;
+
+		# Updating custom .env values
+		local result=$(sudo sed -i "s|CONFIG=~/.jitsi-meet-cfg|CONFIG=$containers_dir$app_name/.jitsi-meet-cfg|g" $containers_dir$app_name/.env)
+		checkSuccess "Updating .env file with new install path"
+
+		local result=$(sudo sed -i "s|#PUBLIC_URL=https://meet.example.com|PUBLIC_URL=https://$host_setup|g" $containers_dir$app_name/.env)
+		checkSuccess "Updating .env file with Public URL to $host_setup"
+
+		local result=$(sudo sed -i "s|HTTP_PORT=8000|HTTP_PORT=$usedport1|g" $containers_dir$app_name/.env)
+		checkSuccess "Updating .env file with HTTP_PORT to $usedport1"
+
+		local result=$(sudo sed -i "s|HTTPS_PORT=8443|HTTPS_PORT=$usedport2|g" $containers_dir$app_name/.env)
+		checkSuccess "Updating .env file with HTTP_PORT to $usedport2"
+
+		#local result=$(echo "ENABLE_HTTP_REDIRECT=1" | sudo tee -a "$containers_dir$app_name/.env")
+		#checkSuccess "Updating .env file with option : ENABLE_HTTP_REDIRECT"
+
+		# Values are missing from the .env by default for some reason
+		# https://github.com/jitsi/docker-jitsi-meet/commit/12051700562d9826f9e024ad649c4dd9b88f94de#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5
+		local result=$(echo "XMPP_DOMAIN=meet.jitsi" | sudo tee -a "$containers_dir$app_name/.env")
+		checkSuccess "Updating .env file with missing option : XMPP_DOMAIN"
+
+		local result=$(echo "XMPP_SERVER=xmpp.meet.jitsi" | sudo tee -a "$containers_dir$app_name/.env")
+		checkSuccess "Updating .env file with missing option : XMPP_SERVER"
+
+		local result=$(echo "JVB_PORT=$usedport4" | sudo tee -a "$containers_dir$app_name/.env")
+		checkSuccess "Updating .env file with missing option : JVB_PORT"
+
+		local result=$(echo "JVB_TCP_MAPPED_PORT=$usedport5" | sudo tee -a "$containers_dir$app_name/.env")
+		checkSuccess "Updating .env file with missing option : JVB_TCP_MAPPED_PORT"
+
+		local result=$(echo "JVB_TCP_PORT=$usedport5" | sudo tee -a "$containers_dir$app_name/.env")
+		checkSuccess "Updating .env file with missing option : JVB_TCP_PORT"
+
+		local result=$(cd "$containers_dir$app_name" && sudo ./gen-passwords.sh)
+		checkSuccess "Running Jitsi Meet gen-passwords.sh script"
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running the docker-compose.yml to install and start $app_name"
+        echo ""
+
+		dockerComposeUpdateAndStartApp $app_name install;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Adjusting $app_name docker system files for port changes."
+        echo ""
+
+        #dockerCommandRun "docker exec -it $app_name /bin/bash && cd /"
+
+		#local result=$(sudo sed -i "s|80|$usedport1|g" $containers_dir$app_nameweb/default)
+		#checkSuccess "Updating Docker NGINX default site port 80 to $usedport1"
+
+		#local result=$(sudo sed -i "s|443|$usedport2|g" $containers_dir$app_nameweb/default)
+		#checkSuccess "Updating Docker NGINX default site port 443 to $usedport2"
+
+		local result=$(sudo sed -i "s|80|$usedport1|g" $containers_dir$app_name/web/rootfs/defaults/default)
+		checkSuccess "Updating NGINX default site port 80 to $usedport1"
+
+		local result=$(sudo sed -i "s|443|$usedport2|g" $containers_dir$app_name/web/rootfs/defaults/default)
+		checkSuccess "Updating NGINX default site port 443 to $usedport2"
+
+        #dockerCommandRun "docker cp '$containers_dir$app_name' '$app_name:/etc/nginx/sites-available/default'"
+		dockerComposeRestart $app_name;
+
+        ((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Application specific updates (if required)"
+        echo ""
+
+        appUpdateSpecifics $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Running Headscale setup (if required)"
+        echo ""
+
+		setupHeadscale $app_name;
+
+		((menu_number++))
+		echo ""
+        echo "---- $menu_number. Adding $app_name to the Apps Database table."
+        echo ""
+
+		databaseInstallApp $app_name;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. Updating WebUI config file."
+        echo ""
+
+		webuiContainerSetup $app_name install;
+
+		((menu_number++))
+        echo ""
+        echo "---- $menu_number. You can find $app_name files at $containers_dir$app_name"
+        echo ""
+        echo "    You can now navigate to your new service using one of the options below : "
+        echo ""
+
+        menuShowFinalMessages $app_name;
+
+		menu_number=0
+        #sleep 3s
+        cd
+	fi
+	jitsimeet=n
+}
--- a/containers/jitsimeet/scripts/jitsimeet_install_hooks.sh
+++ b/containers/jitsimeet/scripts/jitsimeet_install_hooks.sh
@ -1,101 +0,0 @@
-#!/bin/bash
-
-# Jitsi Meet install hooks — Jitsi ships its docker layout as a tagged
-# release zip on GitHub, so we download + unpack it before compose setup.
-# Then mass-edit the .env, generate passwords, and rewire the nginx ports.
-
-jitsimeet_install_post_setup()
-{
-    local app_name="$1"
-    local git_url="$CFG_JITSIMEET_GIT"
-
-    ((menu_number++))
-    echo ""
-    echo "---- $menu_number. Downloading latest GitHub release"
-    echo ""
-
-    local latest_tag
-    latest_tag=$(git ls-remote --refs --sort="version:refname" --tags "$git_url" | cut -d/ -f3- | tail -n1)
-    echo "The latest tag is: $latest_tag"
-
-    local result
-    result=$(createFolders "loud" $docker_install_user $containers_dir$app_name)
-    checkSuccess "Creating $app_name container installation folder"
-    result=$(cd $containers_dir$app_name && runFileOp rm -rf $containers_dir$app_name/$latest_tag.zip)
-    checkSuccess "Deleting zip file to prevent conflicts"
-    result=$(createTouch $containers_dir$app_name/$latest_tag.txt $docker_install_user && echo "Installed \"$latest_tag\" on \"$backupDate\"!" > $latest_tag.txt)
-    checkSuccess "Create logging txt file"
-
-    result=$(runFileOp wget -O $containers_dir$app_name/$latest_tag.zip $git_url/archive/refs/tags/$latest_tag.zip)
-    checkSuccess "Downloading tagged zip file from GitHub"
-    result=$(runFileOp unzip -o $containers_dir$app_name/$latest_tag.zip -d $containers_dir$app_name)
-    checkSuccess "Unzip downloaded file"
-    result=$(runFileOp mv $containers_dir$app_name/docker-jitsi-meet-$latest_tag/* $containers_dir$app_name)
-    checkSuccess "Moving all files from zip file to install directory"
-    result=$(runFileOp rm -rf $containers_dir$app_name/$latest_tag.zip && runFileOp rm -rf $containers_dir$app_name/$latest_tag/)
-    checkSuccess "Removing downloaded zip file as no longer needed"
-}
-
-jitsimeet_install_post_compose()
-{
-    local app_name="$1"
-
-    ((menu_number++))
-    echo ""
-    echo "---- $menu_number. Setting up .env file for setup"
-    echo ""
-
-    dockerSetupEnvFile
-
-    local result
-    result=$(runFileOp sed -i "s|CONFIG=~/.jitsi-meet-cfg|CONFIG=$containers_dir$app_name/.jitsi-meet-cfg|g" $containers_dir$app_name/.env)
-    checkSuccess "Updating .env file with new install path"
-
-    result=$(runFileOp sed -i "s|#PUBLIC_URL=https://meet.example.com|PUBLIC_URL=https://$host_setup|g" $containers_dir$app_name/.env)
-    checkSuccess "Updating .env file with Public URL to $host_setup"
-
-    result=$(runFileOp sed -i "s|HTTP_PORT=8000|HTTP_PORT=$usedport1|g" $containers_dir$app_name/.env)
-    checkSuccess "Updating .env file with HTTP_PORT to $usedport1"
-
-    result=$(runFileOp sed -i "s|HTTPS_PORT=8443|HTTPS_PORT=$usedport2|g" $containers_dir$app_name/.env)
-    checkSuccess "Updating .env file with HTTP_PORT to $usedport2"
-
-    # Defaults missing from the shipped .env (see jitsi/docker-jitsi-meet
-    # commit 12051700562d…). Append them here so the install boots.
-    result=$(echo "XMPP_DOMAIN=meet.jitsi" | runFileWrite -a "$containers_dir$app_name/.env")
-    checkSuccess "Updating .env file with missing option : XMPP_DOMAIN"
-
-    result=$(echo "XMPP_SERVER=xmpp.meet.jitsi" | runFileWrite -a "$containers_dir$app_name/.env")
-    checkSuccess "Updating .env file with missing option : XMPP_SERVER"
-
-    result=$(echo "JVB_PORT=$usedport4" | runFileWrite -a "$containers_dir$app_name/.env")
-    checkSuccess "Updating .env file with missing option : JVB_PORT"
-
-    result=$(echo "JVB_TCP_MAPPED_PORT=$usedport5" | runFileWrite -a "$containers_dir$app_name/.env")
-    checkSuccess "Updating .env file with missing option : JVB_TCP_MAPPED_PORT"
-
-    result=$(echo "JVB_TCP_PORT=$usedport5" | runFileWrite -a "$containers_dir$app_name/.env")
-    checkSuccess "Updating .env file with missing option : JVB_TCP_PORT"
-
-    result=$(cd "$containers_dir$app_name" && runFileOp ./gen-passwords.sh)
-    checkSuccess "Running Jitsi Meet gen-passwords.sh script"
-}
-
-jitsimeet_install_post_start()
-{
-    local app_name="$1"
-
-    ((menu_number++))
-    echo ""
-    echo "---- $menu_number. Adjusting $app_name docker system files for port changes."
-    echo ""
-
-    local result
-    result=$(runFileOp sed -i "s|80|$usedport1|g" $containers_dir$app_name/web/rootfs/defaults/default)
-    checkSuccess "Updating NGINX default site port 80 to $usedport1"
-
-    result=$(runFileOp sed -i "s|443|$usedport2|g" $containers_dir$app_name/web/rootfs/defaults/default)
-    checkSuccess "Updating NGINX default site port 443 to $usedport2"
-
-    dockerComposeRestart $app_name
-}
--- a/containers/libreportal/backend/package-lock.json
+++ b/containers/libreportal/backend/package-lock.json
@ -9,7 +9,6 @@
      "version": "1.0.0",
      "dependencies": {
        "bcryptjs": "^2.4.3",
-        "compression": "^1.8.1",
        "cookie-parser": "^1.4.6",
        "express": "^4.17.1",
        "jsonwebtoken": "^9.0.2",
@ -131,42 +130,6 @@
        "url": "https://github.com/sponsors/ljharb"
      }
    },
-    "node_modules/compressible": {
-      "version": "2.0.18",
-      "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
-      "integrity": "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==",
-      "dependencies": {
-        "mime-db": ">= 1.43.0 < 2"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/compression": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
-      "integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
-      "dependencies": {
-        "bytes": "3.1.2",
-        "compressible": "~2.0.18",
-        "debug": "2.6.9",
-        "negotiator": "~0.6.4",
-        "on-headers": "~1.1.0",
-        "safe-buffer": "5.2.1",
-        "vary": "~1.1.2"
-      },
-      "engines": {
-        "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/compression/node_modules/negotiator": {
-      "version": "0.6.4",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz",
-      "integrity": "sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
    "node_modules/content-disposition": {
      "version": "0.5.4",
      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
@ -684,14 +647,6 @@
        "node": ">= 0.8"
      }
    },
-    "node_modules/on-headers": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
-      "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
    "node_modules/parseurl": {
      "version": "1.3.3",
      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
--- a/containers/libreportal/backend/package.json
+++ b/containers/libreportal/backend/package.json
@ -4,7 +4,6 @@
  "main": "server.js",
  "dependencies": {
    "bcryptjs": "^2.4.3",
-    "compression": "^1.8.1",
    "cookie-parser": "^1.4.6",
    "express": "^4.17.1",
    "jsonwebtoken": "^9.0.2",
--- a/containers/libreportal/backend/routes/docker-info-routes.js
+++ b/containers/libreportal/backend/routes/docker-info-routes.js
@ -1,400 +0,0 @@
-// Read-only Docker inspection routes for the Admin → System deep-dive pages.
-//
-//   GET /api/system/containers
-//     List every container with a per-app summary (compose-project grouping
-//     mirrors what metrics_apps.json does, but with extra per-container
-//     fields the deep-dive pages need: state, status, image, ports, mounts,
-//     restart count). Cached for STAT_TTL_MS.
-//
-//   GET /api/system/containers/:id
-//     Full container detail straight from `docker inspect`. Includes
-//     resource limits, mounts, networks, env, health-check state, restart
-//     policy. Cached briefly so the page can poll without thrashing the
-//     daemon.
-//
-//   GET /api/system/containers/:id/stats
-//     One-shot live stats sample (one frame of /containers/<id>/stats).
-//     Returns the same shape Docker emits, plus a derived `cpu_percent`
-//     and `mem_percent` so the frontend doesn't have to recompute.
-//
-//   GET /api/system/containers/:id/logs?tail=N
-//     Last N lines of combined stdout/stderr, multiplex-decoded.
-//
-//   GET /api/system/storage
-//     `docker system df` — total + reclaimable for the engine overhead worth
-//     acting on (images, build cache). Cached for STORAGE_TTL_MS because this is
-//     one of the more expensive calls on a busy daemon. Named volumes and
-//     container writable layers are omitted: LibrePortal apps keep data in bind
-//     mounts, so both read ~empty here — per-app on-disk usage is generated
-//     separately (see webuiSystemAppStorage / /data/system/app_storage.json).
-//
-// Mounted at /api/system in routes.js (so paths are /api/system/containers
-// etc.). Uses the shared docker util (utils/docker.js) which talks to the
-// bind-mounted unix socket — no `docker` CLI inside the container, no
-// extra deps.
-
-const express = require('express');
-const { dockerRequest, dockerStream, decodeMultiplexedLog, DOCKER_SOCKET } = require('../utils/docker.js');
-
-const router = express.Router();
-
-const STAT_TTL_MS = 1500;
-const STORAGE_TTL_MS = 5000;
-const LIST_TTL_MS = 1500;
-
-// Trivial per-key TTL cache so concurrent tabs don't pile up daemon calls.
-function makeTtlCache(ttl) {
-    const m = new Map();
-    return {
-        async get(key, loader) {
-            const now = Date.now();
-            const hit = m.get(key);
-            if (hit && (now - hit.at) < ttl) return hit.value;
-            const value = await loader();
-            m.set(key, { value, at: now });
-            return value;
-        },
-        invalidate(key) { m.delete(key); },
-    };
-}
-
-const listCache = makeTtlCache(LIST_TTL_MS);
-const statCache = makeTtlCache(STAT_TTL_MS);
-const inspectCache = makeTtlCache(STAT_TTL_MS);
-const storageCache = makeTtlCache(STORAGE_TTL_MS);
-
-// Container id slug used on the wire. Real Docker ids are 64-char hex; the
-// short form is the first 12 chars. We accept either, plus container
-// *names* (which can include /., _, -). Anything else is rejected.
-const SAFE_CONTAINER_REF = /^[a-zA-Z0-9_.\-]{1,128}$/;
-function safeRef(s) { return typeof s === 'string' && SAFE_CONTAINER_REF.test(s); }
-
-function reduceContainer(c) {
-    // Compose project label tells us which "app" (in LibrePortal terms) a
-    // container belongs to. Containers without that label fall back to
-    // their own name as a single-container app.
-    const labels = c.Labels || {};
-    const project = labels['com.docker.compose.project'] || (c.Names && c.Names[0] ? c.Names[0].replace(/^\//, '') : null);
-    const service = labels['com.docker.compose.service'] || null;
-    const name = (c.Names && c.Names[0]) ? c.Names[0].replace(/^\//, '') : c.Id?.slice(0, 12) || '';
-    const networks = c.NetworkSettings && c.NetworkSettings.Networks
-        ? Object.entries(c.NetworkSettings.Networks).map(([n, v]) => ({ name: n, ip: v?.IPAddress || null }))
-        : [];
-    const ports = Array.isArray(c.Ports)
-        ? c.Ports.map(p => ({ ip: p.IP || null, host: p.PublicPort || null, container: p.PrivatePort, proto: p.Type }))
-        : [];
-    return {
-        id: c.Id,
-        short: (c.Id || '').slice(0, 12),
-        name,
-        image: c.Image,
-        image_id: c.ImageID,
-        project,
-        service,
-        state: c.State,
-        status: c.Status,
-        created: c.Created,                 // epoch seconds
-        labels,
-        ports,
-        networks,
-        mounts: Array.isArray(c.Mounts) ? c.Mounts.map(m => ({
-            type: m.Type,
-            source: m.Source,
-            target: m.Destination,
-            mode: m.Mode,
-            rw: m.RW,
-        })) : [],
-    };
-}
-
-// CPU% from a Docker stats frame. The daemon emits cumulative CPU usage in
-// nanoseconds plus the system-wide CPU time; the percentage is the delta
-// over the previous frame normalised by online CPUs. The first call has no
-// prev frame, so Docker conveniently sends both `cpu_stats` (current) and
-// `precpu_stats` (previous) in every frame.
-function cpuPercent(s) {
-    const cpu = s.cpu_stats, pre = s.precpu_stats;
-    if (!cpu || !pre) return 0;
-    const cpuDelta = (cpu.cpu_usage?.total_usage || 0) - (pre.cpu_usage?.total_usage || 0);
-    const sysDelta = (cpu.system_cpu_usage || 0) - (pre.system_cpu_usage || 0);
-    const onlineCpus = cpu.online_cpus
-        || (cpu.cpu_usage?.percpu_usage?.length)
-        || 1;
-    if (sysDelta <= 0 || cpuDelta < 0) return 0;
-    return +((cpuDelta / sysDelta) * onlineCpus * 100).toFixed(2);
-}
-
-function memUsage(s) {
-    const m = s.memory_stats || {};
-    const usage = m.usage || 0;
-    // Docker counts page-cache in `usage`; the "real" working set excludes
-    // cached memory. Matches what `docker stats` shows.
-    const cache = (m.stats && (m.stats.cache || m.stats.total_inactive_file)) || 0;
-    const used = Math.max(0, usage - cache);
-    const limit = m.limit || 0;
-    return {
-        used, cache, limit,
-        percent: limit ? +((used / limit) * 100).toFixed(2) : 0,
-    };
-}
-
-function netUsage(s) {
-    const nets = s.networks || {};
-    let rx = 0, tx = 0;
-    for (const v of Object.values(nets)) {
-        rx += v.rx_bytes || 0;
-        tx += v.tx_bytes || 0;
-    }
-    return { rx_total: rx, tx_total: tx };
-}
-
-function blkioUsage(s) {
-    const b = (s.blkio_stats && s.blkio_stats.io_service_bytes_recursive) || [];
-    let read = 0, write = 0;
-    for (const e of b) {
-        if (e.op === 'Read' || e.op === 'read') read += e.value || 0;
-        else if (e.op === 'Write' || e.op === 'write') write += e.value || 0;
-    }
-    return { read, write };
-}
-
-function pidsUsage(s) {
-    const p = s.pids_stats || {};
-    return { current: p.current || 0, limit: p.limit || 0 };
-}
-
-// ---------------------------------------------------------------------------
-
-router.get('/containers', async (req, res) => {
-    if (!DOCKER_SOCKET) return res.status(503).json({ error: 'docker_socket_unavailable' });
-    try {
-        const list = await listCache.get('all', () =>
-            dockerRequest('GET', '/containers/json', { all: 'true' })
-        );
-        const containers = (Array.isArray(list) ? list : []).map(reduceContainer);
-        // Group by project for convenience — frontend uses both shapes.
-        const byApp = new Map();
-        for (const c of containers) {
-            const key = c.project || c.name;
-            if (!byApp.has(key)) byApp.set(key, []);
-            byApp.get(key).push(c);
-        }
-        const apps = [...byApp.entries()].map(([app, members]) => {
-            const running = members.filter(c => c.state === 'running').length;
-            return { app, containers: members.length, running, members };
-        }).sort((a, b) => b.running - a.running || a.app.localeCompare(b.app));
-        res.set('Cache-Control', 'no-store');
-        res.json({ containers, apps, updated: new Date().toISOString() });
-    } catch (err) {
-        res.status(500).json({ error: err.message });
-    }
-});
-
-router.get('/containers/:id', async (req, res) => {
-    if (!DOCKER_SOCKET) return res.status(503).json({ error: 'docker_socket_unavailable' });
-    const { id } = req.params;
-    if (!safeRef(id)) return res.status(400).json({ error: 'invalid_id' });
-    try {
-        const detail = await inspectCache.get(`inspect:${id}`, () =>
-            dockerRequest('GET', `/containers/${encodeURIComponent(id)}/json`)
-        );
-        if (!detail) return res.status(404).json({ error: 'not_found' });
-        // Project the verbose inspect payload down to what the deep-dive
-        // page actually wants. Keeps the wire small and the frontend
-        // contract stable.
-        const host = detail.HostConfig || {};
-        const state = detail.State || {};
-        const cfg = detail.Config || {};
-        const netSettings = detail.NetworkSettings || {};
-        const out = {
-            id: detail.Id,
-            short: (detail.Id || '').slice(0, 12),
-            name: (detail.Name || '').replace(/^\//, ''),
-            image: cfg.Image || detail.Image,
-            image_id: detail.Image,
-            created: detail.Created,
-            project: (cfg.Labels && cfg.Labels['com.docker.compose.project']) || null,
-            service: (cfg.Labels && cfg.Labels['com.docker.compose.service']) || null,
-            labels: cfg.Labels || {},
-            state: {
-                status: state.Status,
-                running: !!state.Running,
-                paused: !!state.Paused,
-                restarting: !!state.Restarting,
-                oom_killed: !!state.OOMKilled,
-                dead: !!state.Dead,
-                pid: state.Pid || 0,
-                exit_code: state.ExitCode ?? null,
-                error: state.Error || '',
-                started_at: state.StartedAt || null,
-                finished_at: state.FinishedAt || null,
-                restart_count: detail.RestartCount || 0,
-                health: state.Health ? {
-                    status: state.Health.Status,
-                    failing_streak: state.Health.FailingStreak,
-                    log: (state.Health.Log || []).slice(-5).map(l => ({
-                        start: l.Start, end: l.End, exit_code: l.ExitCode, output: (l.Output || '').slice(0, 800)
-                    })),
-                } : null,
-            },
-            limits: {
-                memory:    host.Memory || 0,            // bytes; 0 = unlimited
-                memory_swap: host.MemorySwap || 0,
-                memory_reservation: host.MemoryReservation || 0,
-                cpu_shares: host.CpuShares || 0,
-                cpu_quota: host.CpuQuota || 0,          // microseconds in CpuPeriod
-                cpu_period: host.CpuPeriod || 0,
-                nano_cpus: host.NanoCpus || 0,          // 1e9 = 1 cpu
-                pids: host.PidsLimit || 0,
-                restart_policy: (host.RestartPolicy && host.RestartPolicy.Name) || 'no',
-                restart_max: (host.RestartPolicy && host.RestartPolicy.MaximumRetryCount) || 0,
-            },
-            mounts: (detail.Mounts || []).map(m => ({
-                type: m.Type,
-                source: m.Source,
-                target: m.Destination,
-                mode: m.Mode,
-                rw: m.RW,
-            })),
-            networks: netSettings.Networks
-                ? Object.entries(netSettings.Networks).map(([name, v]) => ({
-                    name,
-                    ip: v?.IPAddress || null,
-                    mac: v?.MacAddress || null,
-                    gateway: v?.Gateway || null,
-                }))
-                : [],
-            ports: netSettings.Ports
-                ? Object.entries(netSettings.Ports).flatMap(([k, bindings]) => {
-                    const [containerPort, proto] = k.split('/');
-                    if (!Array.isArray(bindings) || !bindings.length) {
-                        return [{ container: parseInt(containerPort, 10), proto, host: null, ip: null }];
-                    }
-                    return bindings.map(b => ({
-                        container: parseInt(containerPort, 10),
-                        proto,
-                        host: b.HostPort ? parseInt(b.HostPort, 10) : null,
-                        ip: b.HostIp || null,
-                    }));
-                })
-                : [],
-        };
-        res.set('Cache-Control', 'no-store');
-        res.json(out);
-    } catch (err) {
-        if (/404/.test(err.message)) return res.status(404).json({ error: 'not_found' });
-        res.status(500).json({ error: err.message });
-    }
-});
-
-router.get('/containers/:id/stats', async (req, res) => {
-    if (!DOCKER_SOCKET) return res.status(503).json({ error: 'docker_socket_unavailable' });
-    const { id } = req.params;
-    if (!safeRef(id)) return res.status(400).json({ error: 'invalid_id' });
-    try {
-        const sample = await statCache.get(`stats:${id}`, () =>
-            dockerRequest('GET', `/containers/${encodeURIComponent(id)}/stats`, { stream: 'false' })
-        );
-        if (!sample) return res.status(404).json({ error: 'not_found' });
-        res.set('Cache-Control', 'no-store');
-        res.json({
-            t: Date.now(),
-            cpu_percent: cpuPercent(sample),
-            memory: memUsage(sample),
-            network: netUsage(sample),
-            blkio: blkioUsage(sample),
-            pids: pidsUsage(sample),
-        });
-    } catch (err) {
-        if (/404/.test(err.message)) return res.status(404).json({ error: 'not_found' });
-        res.status(500).json({ error: err.message });
-    }
-});
-
-router.get('/containers/:id/logs', async (req, res) => {
-    if (!DOCKER_SOCKET) return res.status(503).json({ error: 'docker_socket_unavailable' });
-    const { id } = req.params;
-    if (!safeRef(id)) return res.status(400).json({ error: 'invalid_id' });
-    const tail = Math.max(1, Math.min(2000, parseInt(req.query.tail, 10) || 200));
-    try {
-        const { stream } = await dockerStream(`/containers/${encodeURIComponent(id)}/logs`, {
-            stdout: 'true', stderr: 'true', tail: String(tail), timestamps: 'true',
-        });
-        const chunks = [];
-        for await (const c of stream) chunks.push(c);
-        const text = decodeMultiplexedLog(Buffer.concat(chunks));
-        res.set('Cache-Control', 'no-store');
-        res.type('text/plain').send(text);
-    } catch (err) {
-        if (/404/.test(err.message)) return res.status(404).json({ error: 'not_found' });
-        res.status(500).json({ error: err.message });
-    }
-});
-
-router.get('/storage', async (req, res) => {
-    if (!DOCKER_SOCKET) return res.status(503).json({ error: 'docker_socket_unavailable' });
-    try {
-        const df = await storageCache.get('df', () => dockerRequest('GET', '/system/df'));
-        if (!df) return res.status(500).json({ error: 'no_data' });
-        // Roll the verbose response up into headline numbers per category. We
-        // surface only the engine overhead worth acting on — images and build
-        // cache — and skip container writable layers: for LibrePortal that's a
-        // near-zero scratch number (app data lives in bind mounts, shown per-app
-        // elsewhere) that just confuses the picture.
-        // "Reclaimable" reflects exactly what the Reclaim button frees: dangling
-        // images + the whole build cache. Tagged-but-unused images are
-        // deliberately NOT counted — the safe prune leaves them alone — so the
-        // headline matches the button's effect instead of overstating it.
-        const isDangling = (im) => {
-            const tags = im.RepoTags || [];
-            return tags.length === 0 || tags.every(t => t.includes('<none>'));
-        };
-        const sumImages = (df.Images || []).reduce(
-            (a, im) => {
-                a.count++;
-                a.size += im.Size || 0;
-                a.shared += im.SharedSize || 0;
-                if (isDangling(im)) a.reclaimable += im.Size || 0;
-                return a;
-            },
-            { count: 0, size: 0, shared: 0, reclaimable: 0 }
-        );
-        const sumBuild = (df.BuildCache || []).reduce(
-            (a, b) => {
-                a.count++;
-                a.size += b.Size || 0;
-                if (!b.InUse) a.reclaimable += b.Size || 0;
-                return a;
-            },
-            { count: 0, size: 0, reclaimable: 0 }
-        );
-        // Every image, largest first — the Storage page lists them all so the
-        // user can remove specific ones (deletion runs through the task/CLI,
-        // not from here). Dangling <none> images are included on purpose.
-        const images = (df.Images || [])
-            .slice()
-            .sort((a, b) => (b.Size || 0) - (a.Size || 0))
-            .map(im => ({
-                id: im.Id,
-                repo_tags: im.RepoTags || [],
-                size: im.Size || 0,
-                shared_size: im.SharedSize || 0,
-                containers: im.Containers || 0,
-                created: im.Created,
-            }));
-        const total = sumImages.size + sumBuild.size;
-        const reclaimable = sumImages.reclaimable + sumBuild.reclaimable;
-        res.set('Cache-Control', 'no-store');
-        res.json({
-            total, reclaimable,
-            images: sumImages,
-            build_cache: sumBuild,
-            image_list: images,
-            updated: new Date().toISOString(),
-        });
-    } catch (err) {
-        res.status(500).json({ error: err.message });
-    }
-});
-
-module.exports = router;
--- a/Show More
+++ b/Show More
				`@ -1 +0,0 @@`
				`{"sessionId":"9cea077c-56da-4223-a765-be38c688106b","pid":1384,"procStart":"1332","acquiredAt":1780168110981}`